News for hackers. Stuff that matters.

A comment on Abusing Linux's firewall: the hack that allowed us to build Spectrum. Parent comment

Re:Abusing Linux's firewall: the hack that allowed us to bui... by freedomben on Thursday April 12, 2018 @04:05PM (#16824458)
Right, TPROXY is an iptables module (which implies that without someone to port it (assuming porting is even possible due to architectural differences), it isn't going to work on NFTables).

To clarify my original question, what will cloudflare do if/when iptables finally goes away? Has thought been put into it? Will they implement their own type of TPROXY? Will they continue to support iptables themselves? There's quite a few paths, and I'm interested in which one they deem most optimal because I respect their opinions a lot.

[ Parent | on HN ]
Re:Abusing Linux's firewall: the hack that allowed us to bui... by iakie on Thursday April 12, 2018 @06:26PM (#16825503)
actually, TPROXY is very very lightly coupled with iptables. In fact, you can directly use TPROXY without iptables.

here's a 50 line kernel module that uses TPROXY to do the samething without touching iptables.

https://pastebin.com/uxUf6MFS

looking at the nftables code, I think the only reason nftables doesn't support TPROXY is that no one wrote some of the config parsing / seralization stuff.

[ Parent | on HN ]
Re:Abusing Linux's firewall: the hack that allowed us to bui... by jrochkind1 on Thursday April 12, 2018 @07:18PM (#16825818)
Sounds like cloudflare might want to start trying to submit some nftables TPROXY support now, so it's there in the vanilla kernel when they end up needing it. :)
[ Parent | on HN ]
Re:Abusing Linux's firewall: the hack that allowed us to bui... by RandomBK on Thursday April 12, 2018 @09:39PM (#16826505)
It'd expect someone to eventually submit such a patch, though I don't know how urgent this issue is. Iptables isn't going anywhere anytime soon, so Cloudflare can continue to use this method on the edge nodes.
[ Parent | on HN ]