Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #181833

Re: TCP proxy for host on subnet

Show all headers | View raw

On 06/06/2017 14:22, Henning Follmann wrote:
> On Tue, Jun 06, 2017 at 10:59:30AM +0100, Ron Leach wrote:
>>
>> I was also unsure whether socat would hold open a connection to
>> name.server.tld even if no transactions were taking place, or whether socat
>> would only open the connection each time traffic arrived on 3129 and it
>> forked another child process.  The documentation seems to imply that the
>> 'open' takes place before traffic and before forking, which suggests to me
>> that the connection is opened and remains open.  I'd prefer an arrangement
>> where a connection was made each time a transaction sequence was initiated
>> by traffic on the local, incoming, 3129 port (in my example), and then
>> closed when traffic stopped.
>>
>
> [...] With the fact that socat is pretty much the
> universal patch cable, you are expecting too much here.
> It seems you are looking for a protocol aware proxy.
>

Not wanting the proxy be protocol-aware, but considering what 'states' 
the proxy, and the destination-server, might remain in for extended 
periods of time.  Just keeping in mind resource consumption and 
potential for congestion, so that performance issues don't turn out to 
compromise what - really - looks to be a promising solution.

In the meantime, between posts, I have done some testing and, because 
I could not find much comment about this aspect, I'd like to share 
here what I found.

I altered the command to log to a file in /var/log, and to log more 
details (options -d -d -d), including the 'connection' open and close, 
and the traffic sequences.

For tests, I used telnet on a source machine on this subnet, and socat 
on a proxy server to reach an smtp server we have at another site; I 
only passed the

EHLO,
HELP, and
QUIT

commands, because I did not want to falsely trigger the intrusion 
detection systems on the server.  But those few commands served to 
reveal what socat was doing.

The socat command I used was

$ socat -d -d -d -lf /var/log/socat \ 
TCP4-LISTEN:3129,su=nobody,fork,range=192.168.0.0/24,reuseaddr \ 
TCP4:server.ourdomain.tld:4444

Here's what I found.

1.  socat stopped right away; the log showed that socat could not 
create its child processes. I wondered whether this might be because 
socat needed to run as root.  su, and then # socat started ok.

2.  socat did not 'detach' from the keyboard session, so the screen 
remained with a blank line and no shell prompt.  [This means that if I 
invoke a solution this way, I will have to have a session running all 
the time that I want socat to run.]

3.  Running telnet from a different test machine:
$ telnet 192.168.0.123 3129
resulted in:
220 server.ourdomain.tld ESMTP Exim Tue .........
and the simple transaction sequence followed, ending with
quit
221 server.ourdomain.tld closing connection
$
So the proxying worked fine.  But what did socat do, itself?

4.  On the proxy machine, /var/log/socat showed

a.  socat set itself up, listening on (in our test) 3129;
- no child processes at this point, and
- *no* outbound connection to server.ourdomain.tld - yet

b.  A few seconds or so later, socat 'accepted connection' from the 
telnet test machine, and
- forked a child process, while
- remaining listening for any other connection from the acceptable 
range of IP addresses

c.  Meanwhile, the child process
- 'opened' a connection to server.ourdomain.tld:4444, and
- bridged that channel to the input channel from telnet machine, and
- transferred 88 bytes (the Exim 220 welcome message)
- There followed the short transaction exchange, then finally socat
- sensed 'EOF' on both sides and shut down transmission for both sides
- and the child process exited

5.  socat master process
- was (and is) still running
- and went on to pass additional test sequences from a variety of machines

6.  I can close socat using ^C

Henning, for a universal patch cable, it's pretty good, and seems to 
work sensibly in terms of resources, too, releasing connections and 
processes as they reach a quiescent state.

A useful suggestion; much appreciated.

regards, Ron

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

TCP proxy for host on subnet Ron Leach <ronleach@tesco.net> - 2017-06-05 13:40 +0200
  Re: TCP proxy for host on subnet Darac Marjal <mailinglist@darac.org.uk> - 2017-06-05 15:30 +0200
  Re: TCP proxy for host on subnet Henning <henning@itcfollmann.com> - 2017-06-05 15:40 +0200
    Re: TCP proxy for host on subnet Ron Leach <ronleach@tesco.net> - 2017-06-06 12:00 +0200
      Re: TCP proxy for host on subnet <tomas@tuxteam.de> - 2017-06-06 12:50 +0200
        Re: TCP proxy for host on subnet Henning Follmann <hfollmann@itcfollmann.com> - 2017-06-06 15:30 +0200
          Re: TCP proxy for host on subnet tomas@tuxteam.de - 2017-06-06 16:30 +0200
      Re: TCP proxy for host on subnet Henning Follmann <hfollmann@itcfollmann.com> - 2017-06-06 15:40 +0200
        Re: TCP proxy for host on subnet Ron Leach <ronleach@tesco.net> - 2017-06-06 18:40 +0200
          Re: TCP proxy for host on subnet Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-06 19:10 +0200
            Re: TCP proxy for host on subnet Ron Leach <ronleach@tesco.net> - 2017-06-10 13:00 +0200
              Re: TCP proxy for host on subnet <tomas@tuxteam.de> - 2017-06-10 15:30 +0200
                Re: TCP proxy for host on subnet Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-13 14:40 +0200
                Re: TCP proxy for host on subnet <tomas@tuxteam.de> - 2017-06-13 21:20 +0200

csiph-web