Re: ip level NKE - how to trace the process that generates traffic?
Re: ip level NKE - how to trace the process that generates traffic?
- Subject: Re: ip level NKE - how to trace the process that generates traffic?
- From: James J <email@hidden>
- Date: Tue, 06 Mar 2012 00:07:03 +0200
Thank you very much,
I'll try this.
2012/3/5 Vincent Lubet <email@hidden>:
> James,
>
> Writing transparent proxy on a host can be challenging and I am not sure what's the best approach.
>
> You could use a "programatic" socket filter to attach your socket filter only on the sockets opened by your proxy app using the SO_NKE socket option. That way you would not have to rely on proc_selfpid().
>
> Vincent
>
> On Mar 5, 2012, at 1:37 PM, James J wrote:
>
>> Hello Vincent,
>> Thank you for the response.
>>
>> I am wondering, if this is the right approach to develop a transparent
>> proxy server?
>> What concerns me with this traffic redirecting method, is that there
>> are a lot of notes that proc_selfpid() does not always return the
>> right PID (of my transparent local proxy) for a Socket NKE.
>> Maybe you are familiar with any caveats that this method may conceal?
>>
>> What i need - is to redirect all the ip traffic that was not generated
>> by my application (transparent proxy) to this application (transparent
>> proxy).
>>
>> Thank you..
>>
>> 2012/3/4 Vincent Lubet <email@hidden>:
>>>
>>> On Mar 3, 2012, at 8:49 AM, James J wrote:
>>>
>>>> Hello
>>>> I am developing a kind of a traffic redirector for transparent proxy
>>>> filter, which should redirect all the IP traffic to a proxy (usermode)
>>>> application, except the traffic, that is generated by this proxy
>>>> application, which should be passed through freely.
>>>>
>>>> I know I can find out whether the mbufs come from my application or
>>>> not in a Socket filter NKE (when the NKE is being attached to the
>>>> application socket, by calling proc_selfpid()). However, in IP level
>>>> NKE this is impossible.
>>>> Would there be a way to trace "the origins" of the mbuf that I receive
>>>> in my ipf_output_func() function?
>>>
>>> You could use a socket filter NKE that would add a specific mbuf tag for traffic being sent by your proxy application. Your IP filter would then simply check the presence of this mbuf ta.
>>>
>>> Vincent
>>>
>
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macnetworkprog mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden