Iptables transparent proxy support

[jpsollie]

Not sure if it can be done, but maybe via ar7 cfg:
I tried to route all udp + TCP requests to public dns servers to the local dns resolver in order to improve query cache. Unfortunately, I did not succeed including iptabes' nat or mangle x_tproxy target in order to remap the connections, always symbols missing when including the module :(
Is this possible via the AVM connection tracking?

EDIT to clarify:
I'd like to write in mangle table to change the destination IP to 192.168.178.1 (Fritz' IP, no nat needed) or to 127.0.0.1 (using NAT) when the destination port is 53 and source IP is 192.168.178.0/24.

[fda77]

Avms kernel hacks to make its "packet accelerator" work prevent conntrack to work.
If you have a slow (typical german) internet connection you could try to disabled it
See old FAQ
Or flash Openwrt

[jpsollie]

Openwrt isn't (yet) supported on the 7590.
The target is to avoid the slow dns lookups, http(s) connections work at their advertised speed, so unless there really is no other way, I'd like to keep my hands off.
Do I need connection tracking in the first place if I simply want to modify a packet's destination IP without actually caring about the connection at all? because the problem is: I can't even load xtables with tproxy compiled in due to missing symbols on the AVM kernel

[jpsollie]

so I'm clearly missing something:

insmod /lib/modules/4.9.325/kernel/net/ipv4/netfilter/nf_defrag_ipv4.ko; dmesg | tail
insmod: ERROR: could not insert module /lib/modules/4.9.325/kernel/net/ipv4/netfilter/nf_defrag_ipv4.ko: Invalid parameters
[ 1429.968669] nf_defrag_ipv4: disagrees about version of symbol nf_unregister_hooks
[ 1429.968682] nf_defrag_ipv4: Unknown symbol nf_unregister_hooks (err -22)
[ 1429.968711] nf_defrag_ipv4: disagrees about version of symbol ip_defrag
[ 1429.968723] nf_defrag_ipv4: Unknown symbol ip_defrag (err -22)
[ 1436.559950] nf_defrag_ipv4: disagrees about version of symbol nf_register_hooks
[ 1436.559998] nf_defrag_ipv4: Unknown symbol nf_register_hooks (err -22)
[ 1436.560018] nf_defrag_ipv4: disagrees about version of symbol nf_unregister_hooks
[ 1436.560030] nf_defrag_ipv4: Unknown symbol nf_unregister_hooks (err -22)
[ 1436.560059] nf_defrag_ipv4: disagrees about version of symbol ip_defrag
[ 1436.560071] nf_defrag_ipv4: Unknown symbol ip_defrag (err -22)

root@router:/var/mod/root# cat /proc/kallsyms | grep hooks
95ba1834 T nf_unregister_net_hooks
95ba18a0 T nf_register_net_hooks
95ba1b20 T _nf_unregister_hooks
95ba1b7c T _nf_register_hooks
95ba1c68 T nf_unregister_hooks
95ba1cd4 T nf_register_hooks
960e5a80 T capability_add_hooks

anyone who knows a way to actually make this work?

EDIT2:

ls /lib/modules/4.9.325/kernel/net/ipv4/netfilter/
ip_tables.ko       iptable_mangle.ko  nf_defrag_ipv4.ko
iptable_filter.ko  iptable_raw.ko     nf_log_ipv4.ko
root@router:/var/mod/root# modprobe --show-modversions nf_defrag_ipv4
modprobe: FATAL: Module nf_defrag_ipv4 not found.

kmod instead of busybox shows a lot more ... why isn't nf_defrag_ipv4 registered?

Again EDIT:

cat /proc/version
Linux version 4.9.325 ([email protected]) (gcc version 8.4.0 (Buildroot 2020.02.1-g53bf1c36) ) #1 SMP 2023-05-04

cat .config | grep KERNEL_GCC_VERSION
FREETZ_KERNEL_GCC_VERSION="8.3.0"

This does not look healthy ...

[jpsollie]

pretty sure I'm out of ideas right now:
I changed the compiler to 8.4 using this diff:

--- a/config/ui/toolchain.in
+++ b/config/ui/toolchain.in
@@ -156,7 +156,7 @@ choice
                depends on FREETZ_AVM_GCC_5
 
        config FREETZ_KERNEL_GCC_8
-               bool "gcc-8.3"
+               bool "gcc-8.4"
                depends on FREETZ_AVM_GCC_8
 
        config FREETZ_KERNEL_GCC_9
@@ -284,7 +284,7 @@ config FREETZ_KERNEL_GCC_VERSION
        default "4.7.4" if FREETZ_KERNEL_GCC_4_7
        default "4.8.5" if FREETZ_KERNEL_GCC_4_8
        default "5.5.0" if FREETZ_KERNEL_GCC_5
-       default "8.3.0" if FREETZ_KERNEL_GCC_8
+       default "8.4.0" if FREETZ_KERNEL_GCC_8
        default "9.3.0" if FREETZ_KERNEL_GCC_9

but it still didn't work :(
objdump revealed why:

$ objdump -s --section .comment source/kernel/ref-grx5-7590_07.56/lib/modules/4.9.325/kernel/fs/fat/vfat.ko 

source/kernel/ref-grx5-7590_07.56/lib/modules/4.9.325/kernel/fs/fat/vfat.ko:     file format elf32-bigmips

Contents of section .comment:
 0000 00474343 3a202847 4e552920 382e342e  .GCC: (GNU) 8.4.
 0010 30000047 43433a20 28474e55 2920382e  0..GCC: (GNU) 8.
 0020 342e3000                             4.0.            
$ objdump -s --section .comment build/original/filesystem/lib/modules/4.9.325/kernel/fs/fat/vfat.ko 

build/original/filesystem/lib/modules/4.9.325/kernel/fs/fat/vfat.ko:     file format elf32-bigmips

Contents of section .comment:
 0000 00474343 3a202842 75696c64 726f6f74  .GCC: (Buildroot
 0010 20323032 302e3032 2e312d67 35336266   2020.02.1-g53bf
 0020 31633336 2920382e 342e3000 00474343  1c36) 8.4.0..GCC
 0030 3a202842 75696c64 726f6f74 20323032  : (Buildroot 202
 0040 302e3032 2e312d67 35336266 31633336  0.02.1-g53bf1c36
 0050 2920382e 342e3000                    ) 8.4.0. 

so I guess that's game over for self-made modules :(

[fda77]

modprobe: FATAL: Module nf_defrag_ipv4 not found.

die FILE does not exist. you could use "insmod" with a path to .ko. "modinfo" with a .ko shows basic module infos
im not sure if the "buildroot" etc strings matter, avm uses it a long time.
i dont know if this tool still works: https://freetz-ng.github.io/freetz-ng/make/#vermagic

[jpsollie]

the output of vermagic is the same:

root@router:/var/mod/root# vermagic -d cpunet.ko 
Section name:                           .modinfo
[000] license=GPL v2
[015] description=Cross CPU Network Device
[052] author=Alexander Theißen <[email protected]>
[100] alias=of:N*T*Cavm,cpunetC*
[127] alias=of:N*T*Cavm,cpunet
[152] depends=
[161] vermagic=4.9.325 SMP mod_unload modversions MIPS32_R2 32BIT 
root@router:/var/mod/root# cp /lib/modules/4.9.325/kernel/net/ipv4/netfilter/nf_defrag_ipv4.ko ./
root@router:/var/mod/root# vermagic -d nf_defrag_ipv4.ko 
Section name:                           .modinfo
[000] license=GPL
[012] depends=
[021] intree=Y
[030] vermagic=4.9.325 SMP mod_unload modversions MIPS32_R2 32BIT 

insmod complains about missing symbols which are actually present in /proc/kallsyms

[fda77]

maybe the avm sources are crap .. again. they "forget" all the time to publish the exact sources they used

[jpsollie]

I hope there's something I can do. Do you have a suggestion?

[fda77]

Ask AVM why their sources are crap and they should fix the missing symbols?