Subject: [dtn-users] Several improvements of dtntunnel

From: "[email-masked]" <[email-masked]>
Date: Tue, 5 Mar 2013 13:47:18 +0300

Hello dtn users,

I would like to share a patch that turns dtntunnel into a transparent proxy
which
intercepts TCP and UDP traffic and transports it from one IP network to
another
through a DTN in a way that application client and server "think" that they
are
connected to a usual IP network. Hosts running dtntunnel on different DTN
nodes
act as network routers from the IP networks point of view.

Here is a description of how this works.

--------------------------------------------------------------------------------------------------------
A host running dtntunnel in transparent mode ("-p" option) can act as an IP
network router for TCP and UDP protocols, that are redirected to dtntunnel
with
the help of IPTables and TProxy.

Transparent mode is implemented with the use of Tproxy mechanism, which is
supported in Linux only. For the description of Tproxy see tproxy.txt in
the
Documentation/networking subdirectory of Linux kernel source tree.

Here is how this looks at the network level. Hosts A and B are reachable
via DTN
while local networks of A and B may even be not connected via IP protocol:
[IP Host A] <-> [DTN node with dtntunnel] <-> (DTN Network) <->
            <-> [DTN node with dtntunnel] <-> [IP Host B]

Here is how this looks at the application level. Application client and
server
communicate transparently as if there was an IP network between them. Both
client and server see IP addresses and ports of each other, not of
dtntunnel as
it is without transparent mode enabled:
[Application client] <-> [dtntunnel -T] <-> (DTN Network) <->
                     <-> [dtntunnel -L] <-> [Application server]

In order to let transparent mode work, insert the following IPTables and
routing
rules on the host where you run dtntunnel in tunnel mode ("-T" option):
iptables -t mangle -N DTNTUNNEL
iptables -t mangle -A DTNTUNNEL -j MARK --set-mark 1
iptables -t mangle -A DTNTUNNEL -j ACCEPT
iptables -t mangle -A PREROUTING -p $PROTO -m socket -j DTNTUNNEL
iptables -t mangle -A PREROUTING -p $PROTO --dport $APPLICATION_PORT -j
TPROXY \
         --on-port $DTNTUNNEL_PORT --tproxy-mark 1/1
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100

If you run application client on the same host as dtntunnel in tunnel mode,
you
have to insert an additional IPTables rule:
iptables -t mangle -A OUTPUT -o $EXTERNAL_IF -p $PROTO --dport
$APPLICATION_PORT \
         -j MARK --set-xmark 1
NOTE: This will work only for application client running on the same host
as
dtntunnel in tunnel mode, not for a server running on the same host as
dtntunnel
in listen mode ("-L" option).

In the above commands $PROTO is either tcp or udp;
$APPLICATION_PORT is a port number used by an application protocol, ex. 22
for SSH,
53 for DNS, 80 for HTTP, port range can be given in the form 22:23;
$DTNTUNNEL_PORT is the dtntunnel lport as given in tunnel specification;
$EXTERNAL_IF is a name of a network interface towards the remote network
that is
to be reached via DTN.

NOTE: Don't forget to add network routes on the hosts that will use
dtntunnel host
as a router. In the most simple case setting the default gateway address to
the
address of the host running dtntunnel is enough.

In transparent mode dtntunnel can use multiple destination EIDs in order to
be able
to transport data to multiple IP networks reachable through different DTN
nodes.
To enable this feature specify <destination eid table file name> instead of
<destination_eid> in dtntunnel command line.

Eid table file format: <IP network address> <DTN node EID>.
Eid table file example:
192.168.4.0/24 dtn://dtn1.dtn/dtntunnel/app
192.168.5.0/24 dtn://dtn2.dtn/dtntunnel/app
--------------------------------------------------------------------------------------------------------

My patch dtntunnel_transparent.ss.patch should be applied on top of a patch
dtntunnel.udp_bidirectional.dz.patch, written by David Zoller and published
here with his
kind permission. Both patches apply cleanly to the today's Sourceforge
version of dtn2.
To apply the patches, go to apps/dtntunnel subdirectory of dtn2 source tree
and issue the
commands:
patch -p1 < dtntunnel.udp_bidirectional.dz.patch
patch -p1 < dtntunnel_transparent.ss.patch

David's patch brings the following improvements:
1) fix two memory leaks in TCPTunnel;
2) fix an issue with TCPTunnel when the connection closed by the server
side of an
application is not closed on the client side;
3) a complete rewrite of UDPTunnel code that enables bidirectional data
transmission,
packet reordering option and possibly something else which I could have
missed.

I hope these two patches will be accepted to the dtn2 mainstream.

I would like to thank David for his support, it would be hardly possible
for me to make
transparent dtntunnel without his help and advices.
I would also like to thank Elwyn Davies for his help with building NORM CL
libraries and
making NORM work with recent DTN2 code.

Best regards,
Sergey Sireskin

---

From: David Zoller <[email-masked]>
Date: Tue, 5 Mar 2013 22:02:30 -0600

Hi Sergey,
Nice working with you and thanks for advancing my knowledge of sockets and
network manipulation. The transparent proxy is a pretty cool patch! I've
attached a PDF with some experimenting I did that includes the
configurations I used. This evening I was able to use the one tunnel to
connect to two systems on three different ports. I'll have to figure out
how to get more systems involved to give the destination EID table file a
workout :)
Best regards,
DZ

On Tue, Mar 5, 2013 at 4:47 AM, [email-masked] <[email-masked]>wrote:

> Hello dtn users,
>
> I would like to share a patch that turns dtntunnel into a transparent
> proxy which
> through a DTN in a way that application client and server "think" that
> they are
> If you run application client on the same host as dtntunnel in tunnel
> mode, you
> as a router. In the most simple case setting the default gateway address
> to the
> In transparent mode dtntunnel can use multiple destination EIDs in order
> to be able
> dtntunnel.udp_bidirectional.dz.patch, written by David Zoller and
> published here with his
> To apply the patches, go to apps/dtntunnel subdirectory of dtn2 source
> tree and issue the
> commands:
> _______________________________________________
> dtn-users mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/dtn-users
>
>

---

From: "[email-masked]" <[email-masked]>
Date: Wed, 6 Mar 2013 11:42:40 +0300

Hi David,

Thanks for sharing your presentation! I think it would be nice if you add
one or two less detailed and less complex slides to your presentation as an
overview of transparent dtntunnel concept. Just to make it easier to
understand what it's all about for those who are not familiar with things
like iptables, NAT, policy routing, tproxy, etc.

Best regards,
Sergey

2013/3/6 David Zoller <[email-masked]>

>> network router for TCP and UDP protocols, that are redirected to
>> dtntunnel with
>> $APPLICATION_PORT is a port number used by an application protocol, ex.
>> 22 for SSH,
>> I would also like to thank Elwyn Davies for his help with building NORM
>> CL libraries and

-- 
Best regards,
Sergey Sireskin