Abusing Linux's firewall: the hack that allowed us to build Spectrum

Re:Abusing Linux's firewall: the hack that allowed us to bui... by dboreham on Thursday April 12, 2018 @04:25PM (#16824629)

Not sure the headline is accurate: surely these kernel mechanisms were invented specifically _to_ allow this functionality? Therefore there is no abuse. More like “we found a mostly-forgotten netfilter feature designed to do the thing we’re trying to do, so we used it”.

[ Parent | on HN ]

Re:Abusing Linux's firewall: the hack that allowed us to bui... by jchw on Friday April 13, 2018 @12:08AM (#16827070)

Not exactly. TPROXY is designed for transparent proxying, but by way of the mechanism it works, can also be used to approximate binding to all TCP ports. The latter use case is a bit different.

[ Parent | on HN ]

Re:Abusing Linux's firewall: the hack that allowed us to bui... by aidenn0 on Friday April 13, 2018 @01:50AM (#16827415)

but they are binding all TCP ports to implement a transparent proxy, no?

[ Parent | on HN ]

Re:Abusing Linux's firewall: the hack that allowed us to bui... by nikanj on Friday April 13, 2018 @05:25AM (#16828293)

Transparent _reverse_ proxy, which very likely was not the originally intended use case.

[ Parent | on HN ]