lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Mon, 8 Jan 2007 00:58:42 +0100
From:	Harald Welte <>
To:	Lennert Buytenhek <>
Cc:	KOVACS Krisztian <>,,
Subject: Re: [PATCH/RFC 00/10] Transparent proxying patches version 4

On Sun, Jan 07, 2007 at 05:11:06PM +0100, Lennert Buytenhek wrote:
> On Sun, Jan 07, 2007 at 03:11:34PM +0100, Harald Welte wrote:
> > > So instead of using NAT to dynamically redirect traffic to local
> > > addresses, we now rely on "native" non-locally-bound sockets and do
> > > early socket lookups for inbound IPv4 packets. 
> > 
> > It's good to see a solid implementation of this 'old idea'.  
> > 
> > Just as a quick historical note to netdev:  This is the way how the
> > netfilter project  advised the balabit guys to implement fully
> > transparent proxy support, after having seen the complexity of the old
> > nat-based TPROXY patches.
> Didn't rusty tell the balabit guys to use the NAT approach?

that was originally, way back.  It turned out to be a bad idea, after
all... way too complex.  At least that's how I look at it.  Too sad :(

Rusty and me then had the idea about the routing based approach at some
point, if I remember correctly.  We talked about it with Krisztian and
Balazs at least on one occasion.

All that isn't really important.  All I wanted to say was:

"I (and AFAIR the netfilter core team) believe this is the way to
implement good support for transparent proxying.  It's already the
second completely independent implementation, let's merge it after all."

- Harald Welte <>       
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

Powered by blists - more mailing lists