News for hackers. Stuff that matters.

A comment on Abusing Linux's firewall: the hack that allowed us to build Spectrum. Parent comment

Re:Abusing Linux's firewall: the hack that allowed us to bui... by iakie on Thursday April 12, 2018 @06:26PM (#16825503)
actually, TPROXY is very very lightly coupled with iptables. In fact, you can directly use TPROXY without iptables.

here's a 50 line kernel module that uses TPROXY to do the samething without touching iptables.

https://pastebin.com/uxUf6MFS

looking at the nftables code, I think the only reason nftables doesn't support TPROXY is that no one wrote some of the config parsing / seralization stuff.

[ Parent | on HN ]
Re:Abusing Linux's firewall: the hack that allowed us to bui... by jrochkind1 on Thursday April 12, 2018 @07:18PM (#16825818)
Sounds like cloudflare might want to start trying to submit some nftables TPROXY support now, so it's there in the vanilla kernel when they end up needing it. :)
[ Parent | on HN ]
Re:Abusing Linux's firewall: the hack that allowed us to bui... by RandomBK on Thursday April 12, 2018 @09:39PM (#16826505)
It'd expect someone to eventually submit such a patch, though I don't know how urgent this issue is. Iptables isn't going anywhere anytime soon, so Cloudflare can continue to use this method on the edge nodes.
[ Parent | on HN ]