Skip to content

Commit 3d7b5ce

Browse files
MikeWang000000MikeWang000000
committed
fix: Update firewall rules
1 parent b58e208 commit 3d7b5ce

6 files changed

Lines changed: 44 additions & 131 deletions

File tree

‎src/ipv4ipt.c‎

Lines changed: 3 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ static int ipt4_iface_setup(void)
8989
int fh_ipt4_setup(void)
9090
{
9191
char xmark_str[64], nfqnum_str[32];
92-
size_t i, ipt_cmds_cnt, ipt_opt_cmds_cnt;
92+
size_t i, ipt_cmds_cnt;
9393
int res;
9494
char *ipt_cmds[][32] = {
9595
{"iptables", "-w", "-t", "mangle", "-N", "FAKEHTTP_S", NULL},
@@ -161,13 +161,6 @@ int fh_ipt4_setup(void)
161161
/*
162162
exclude marked packets
163163
*/
164-
{"iptables", "-w", "-t", "mangle", "-A", "FAKEHTTP_R", "-m", "mark",
165-
"--mark", xmark_str, "-j", "CONNMARK", "--set-xmark", xmark_str,
166-
NULL},
167-
168-
{"iptables", "-w", "-t", "mangle", "-A", "FAKEHTTP_R", "-m",
169-
"connmark", "--mark", xmark_str, "-j", "MARK", "--set-xmark",
170-
xmark_str, NULL},
171164

172165
{"iptables", "-w", "-t", "mangle", "-A", "FAKEHTTP_R", "-m", "mark",
173166
"--mark", xmark_str, "-j", "RETURN", NULL},
@@ -179,22 +172,10 @@ int fh_ipt4_setup(void)
179172
"--tcp-flags", "SYN,FIN,RST", "SYN", "-j", "NFQUEUE",
180173
"--queue-bypass", "--queue-num", nfqnum_str, NULL}};
181174

182-
char *ipt_opt_cmds[][32] = {
183-
/*
184-
exclude packets from connections with more than 32 packets
185-
*/
186-
{"iptables", "-w", "-t", "mangle", "-I", "FAKEHTTP_R", "-m",
187-
"connbytes", "!", "--connbytes", "0:32", "--connbytes-dir", "both",
188-
"--connbytes-mode", "packets", "-j", "RETURN", NULL},
189-
190-
/*
191-
exclude big packets
192-
*/
193-
{"iptables", "-w", "-t", "mangle", "-I", "FAKEHTTP_R", "-m", "length",
194-
"!", "--length", "0:120", "-j", "RETURN", NULL}};
175+
E("ERROR: iptables rules is under development, please use nft.");
176+
return -1;
195177

196178
ipt_cmds_cnt = sizeof(ipt_cmds) / sizeof(*ipt_cmds);
197-
ipt_opt_cmds_cnt = sizeof(ipt_opt_cmds) / sizeof(*ipt_opt_cmds);
198179

199180
res = snprintf(xmark_str, sizeof(xmark_str), "%" PRIu32 "/%" PRIu32,
200181
g_ctx.fwmark, g_ctx.fwmask);
@@ -219,10 +200,6 @@ int fh_ipt4_setup(void)
219200
}
220201
}
221202

222-
for (i = 0; i < ipt_opt_cmds_cnt; i++) {
223-
fh_execute_command(ipt_opt_cmds[i], 1, NULL);
224-
}
225-
226203
res = ipt4_iface_setup();
227204
if (res < 0) {
228205
E(T(ipt4_iface_setup));

‎src/ipv4nft.c‎

Lines changed: 15 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,24 @@ static int nft4_iface_setup(void)
4141
E("ERROR: snprintf(): %s", "failure");
4242
return -1;
4343
}
44+
res = fh_execute_command(nft_iface_cmd, 0, NULL);
45+
if (res < 0) {
46+
E(T(fh_execute_command));
47+
return -1;
48+
}
4449

50+
res = snprintf(nftstr, sizeof(nftstr),
51+
"add rule ip fakehttp fh_postrouting jump fh_rules");
52+
if (res < 0 || (size_t) res >= sizeof(nftstr)) {
53+
E("ERROR: snprintf(): %s", "failure");
54+
return -1;
55+
}
4556
res = fh_execute_command(nft_iface_cmd, 0, NULL);
4657
if (res < 0) {
4758
E(T(fh_execute_command));
4859
return -1;
4960
}
61+
5062
return 0;
5163
}
5264

@@ -85,7 +97,6 @@ static int nft4_iface_setup(void)
8597

8698
int fh_nft4_setup(void)
8799
{
88-
size_t i, nft_opt_cmds_cnt;
89100
int res;
90101
char *nft_cmd[] = {"nft", "-f", "-", NULL};
91102
char nft_conf_buff[2048];
@@ -95,7 +106,7 @@ int fh_nft4_setup(void)
95106
" type filter hook prerouting priority mangle - 5;\n"
96107
" policy accept;\n"
97108
/*
98-
exclude local IPs
109+
exclude local IPs (from source)
99110
*/
100111
" ip saddr 0.0.0.0/8 return;\n"
101112
" ip saddr 10.0.0.0/8 return;\n"
@@ -108,10 +119,10 @@ int fh_nft4_setup(void)
108119
" }\n"
109120
"\n"
110121
" chain fh_postrouting {\n"
111-
" type filter hook postrouting priority mangle - 5;\n"
122+
" type filter hook postrouting priority srcnat + 5;\n"
112123
" policy accept;\n"
113124
/*
114-
exclude local IPs
125+
exclude local IPs (to destination)
115126
*/
116127
" ip daddr 0.0.0.0/8 return;\n"
117128
" ip daddr 10.0.0.0/8 return;\n"
@@ -128,12 +139,6 @@ int fh_nft4_setup(void)
128139
/*
129140
exclude marked packets
130141
*/
131-
" meta mark and %" PRIu32 " == %" PRIu32
132-
" ct mark set ct mark and %" PRIu32 " xor %" PRIu32 ";\n"
133-
134-
" ct mark and %" PRIu32 " == %" PRIu32
135-
" meta mark set mark and %" PRIu32 " xor %" PRIu32 ";\n"
136-
137142
" meta mark and %" PRIu32 " == %" PRIu32 " return;\n"
138143

139144
/*
@@ -145,24 +150,7 @@ int fh_nft4_setup(void)
145150
" }\n"
146151
"}\n";
147152

148-
char *nft_opt_cmds[][32] = {
149-
/*
150-
exclude packets from connections with more than 32 packets
151-
*/
152-
{"nft", "insert rule ip fakehttp fh_rules ct packets > 32 return",
153-
NULL},
154-
155-
/*
156-
exclude big packets
157-
*/
158-
{"nft", "insert rule ip fakehttp fh_rules meta length > 120 return",
159-
NULL}};
160-
161-
nft_opt_cmds_cnt = sizeof(nft_opt_cmds) / sizeof(*nft_opt_cmds);
162-
163153
res = snprintf(nft_conf_buff, sizeof(nft_conf_buff), nft_conf_fmt,
164-
g_ctx.fwmask, g_ctx.fwmark, ~g_ctx.fwmask, g_ctx.fwmark,
165-
g_ctx.fwmask, g_ctx.fwmark, ~g_ctx.fwmask, g_ctx.fwmark,
166154
g_ctx.fwmask, g_ctx.fwmark, g_ctx.nfqnum);
167155
if (res < 0 || (size_t) res >= sizeof(nft_conf_buff)) {
168156
E("ERROR: snprintf(): %s", "failure");
@@ -177,10 +165,6 @@ int fh_nft4_setup(void)
177165
return -1;
178166
}
179167

180-
for (i = 0; i < nft_opt_cmds_cnt; i++) {
181-
fh_execute_command(nft_opt_cmds[i], 1, NULL);
182-
}
183-
184168
res = nft4_iface_setup();
185169
if (res < 0) {
186170
E(T(nft4_iface_setup));

‎src/ipv6ipt.c‎

Lines changed: 3 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ static int ipt6_iface_setup(void)
8989
int fh_ipt6_setup(void)
9090
{
9191
char xmark_str[64], nfqnum_str[32];
92-
size_t i, ipt_cmds_cnt, ipt_opt_cmds_cnt;
92+
size_t i, ipt_cmds_cnt;
9393
int res;
9494
char *ipt_cmds[][32] = {
9595
{"ip6tables", "-w", "-t", "mangle", "-N", "FAKEHTTP_S", NULL},
@@ -128,7 +128,6 @@ int fh_ipt6_setup(void)
128128
{"ip6tables", "-w", "-t", "mangle", "-A", "FAKEHTTP_S", "-s",
129129
"fe80::/10", "-j", "RETURN", NULL},
130130

131-
132131
/*
133132
exclude special IPv6 addresses (to destination)
134133
*/
@@ -156,14 +155,6 @@ int fh_ipt6_setup(void)
156155
/*
157156
exclude marked packets
158157
*/
159-
{"ip6tables", "-w", "-t", "mangle", "-A", "FAKEHTTP_R", "-m", "mark",
160-
"--mark", xmark_str, "-j", "CONNMARK", "--set-xmark", xmark_str,
161-
NULL},
162-
163-
{"ip6tables", "-w", "-t", "mangle", "-A", "FAKEHTTP_R", "-m",
164-
"connmark", "--mark", xmark_str, "-j", "MARK", "--set-xmark",
165-
xmark_str, NULL},
166-
167158
{"ip6tables", "-w", "-t", "mangle", "-A", "FAKEHTTP_R", "-m", "mark",
168159
"--mark", xmark_str, "-j", "RETURN", NULL},
169160

@@ -174,22 +165,10 @@ int fh_ipt6_setup(void)
174165
"--tcp-flags", "SYN,FIN,RST", "SYN", "-j", "NFQUEUE",
175166
"--queue-bypass", "--queue-num", nfqnum_str, NULL}};
176167

177-
char *ipt_opt_cmds[][32] = {
178-
/*
179-
exclude packets from connections with more than 32 packets
180-
*/
181-
{"ip6tables", "-w", "-t", "mangle", "-I", "FAKEHTTP_R", "-m",
182-
"connbytes", "!", "--connbytes", "0:32", "--connbytes-dir", "both",
183-
"--connbytes-mode", "packets", "-j", "RETURN", NULL},
184-
185-
/*
186-
exclude big packets
187-
*/
188-
{"ip6tables", "-w", "-t", "mangle", "-I", "FAKEHTTP_R", "-m", "length",
189-
"!", "--length", "0:120", "-j", "RETURN", NULL}};
168+
E("ERROR: iptables rules is under development, please use nft.");
169+
return -1;
190170

191171
ipt_cmds_cnt = sizeof(ipt_cmds) / sizeof(*ipt_cmds);
192-
ipt_opt_cmds_cnt = sizeof(ipt_opt_cmds) / sizeof(*ipt_opt_cmds);
193172

194173
res = snprintf(xmark_str, sizeof(xmark_str), "%" PRIu32 "/%" PRIu32,
195174
g_ctx.fwmark, g_ctx.fwmask);
@@ -214,10 +193,6 @@ int fh_ipt6_setup(void)
214193
}
215194
}
216195

217-
for (i = 0; i < ipt_opt_cmds_cnt; i++) {
218-
fh_execute_command(ipt_opt_cmds[i], 1, NULL);
219-
}
220-
221196
res = ipt6_iface_setup();
222197
if (res < 0) {
223198
E(T(ipt6_iface_setup));

‎src/ipv6nft.c‎

Lines changed: 15 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,24 @@ static int nft6_iface_setup(void)
4141
E("ERROR: snprintf(): %s", "failure");
4242
return -1;
4343
}
44+
res = fh_execute_command(nft_iface_cmd, 0, NULL);
45+
if (res < 0) {
46+
E(T(fh_execute_command));
47+
return -1;
48+
}
4449

50+
res = snprintf(nftstr, sizeof(nftstr),
51+
"add rule ip6 fakehttp fh_postrouting jump fh_rules");
52+
if (res < 0 || (size_t) res >= sizeof(nftstr)) {
53+
E("ERROR: snprintf(): %s", "failure");
54+
return -1;
55+
}
4556
res = fh_execute_command(nft_iface_cmd, 0, NULL);
4657
if (res < 0) {
4758
E(T(fh_execute_command));
4859
return -1;
4960
}
61+
5062
return 0;
5163
}
5264

@@ -85,7 +97,6 @@ static int nft6_iface_setup(void)
8597

8698
int fh_nft6_setup(void)
8799
{
88-
size_t i, nft_opt_cmds_cnt;
89100
int res;
90101
char *nft_cmd[] = {"nft", "-f", "-", NULL};
91102
char nft_conf_buff[2048];
@@ -95,7 +106,7 @@ int fh_nft6_setup(void)
95106
" type filter hook prerouting priority mangle - 5;\n"
96107
" policy accept;\n"
97108
/*
98-
exclude special IPv6 addresses
109+
exclude special IPv6 addresses (from source)
99110
*/
100111
" ip6 saddr ::/127 return;\n"
101112
" ip6 saddr ::ffff:0:0/96 return;\n"
@@ -107,10 +118,10 @@ int fh_nft6_setup(void)
107118
" }\n"
108119
"\n"
109120
" chain fh_postrouting {\n"
110-
" type filter hook postrouting priority mangle - 5;\n"
121+
" type filter hook postrouting priority srcnat + 5;\n"
111122
" policy accept;\n"
112123
/*
113-
exclude special IPv6 addresses
124+
exclude special IPv6 addresses (to destination)
114125
*/
115126
" ip6 daddr ::/127 return;\n"
116127
" ip6 daddr ::ffff:0:0/96 return;\n"
@@ -126,12 +137,6 @@ int fh_nft6_setup(void)
126137
/*
127138
exclude marked packets
128139
*/
129-
" meta mark and %" PRIu32 " == %" PRIu32
130-
" ct mark set ct mark and %" PRIu32 " xor %" PRIu32 ";\n"
131-
132-
" ct mark and %" PRIu32 " == %" PRIu32
133-
" meta mark set mark and %" PRIu32 " xor %" PRIu32 ";\n"
134-
135140
" meta mark and %" PRIu32 " == %" PRIu32 " return;\n"
136141

137142
/*
@@ -143,24 +148,7 @@ int fh_nft6_setup(void)
143148
" }\n"
144149
"}\n";
145150

146-
char *nft_opt_cmds[][32] = {
147-
/*
148-
exclude packets from connections with more than 32 packets
149-
*/
150-
{"nft", "insert rule ip6 fakehttp fh_rules ct packets > 32 return",
151-
NULL},
152-
153-
/*
154-
exclude big packets
155-
*/
156-
{"nft", "insert rule ip6 fakehttp fh_rules meta length > 120 return",
157-
NULL}};
158-
159-
nft_opt_cmds_cnt = sizeof(nft_opt_cmds) / sizeof(*nft_opt_cmds);
160-
161151
res = snprintf(nft_conf_buff, sizeof(nft_conf_buff), nft_conf_fmt,
162-
g_ctx.fwmask, g_ctx.fwmark, ~g_ctx.fwmask, g_ctx.fwmark,
163-
g_ctx.fwmask, g_ctx.fwmark, ~g_ctx.fwmask, g_ctx.fwmark,
164152
g_ctx.fwmask, g_ctx.fwmark, g_ctx.nfqnum);
165153
if (res < 0 || (size_t) res >= sizeof(nft_conf_buff)) {
166154
E("ERROR: snprintf(): %s", "failure");
@@ -175,10 +163,6 @@ int fh_nft6_setup(void)
175163
return -1;
176164
}
177165

178-
for (i = 0; i < nft_opt_cmds_cnt; i++) {
179-
fh_execute_command(nft_opt_cmds[i], 1, NULL);
180-
}
181-
182166
res = nft6_iface_setup();
183167
if (res < 0) {
184168
E(T(nft6_iface_setup));

‎src/nfqueue.c‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -77,12 +77,12 @@ static int callback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
7777
memset(&sll, 0, sizeof(sll));
7878
sll.sll_family = AF_PACKET;
7979
sll.sll_protocol = ph->hw_protocol;
80-
if (iifindex) {
81-
sll.sll_pkttype = PACKET_HOST;
82-
sll.sll_ifindex = iifindex;
83-
} else if (oifindex) {
80+
if (oifindex) {
8481
sll.sll_pkttype = PACKET_OUTGOING;
8582
sll.sll_ifindex = oifindex;
83+
} else if (iifindex) {
84+
sll.sll_pkttype = PACKET_HOST;
85+
sll.sll_ifindex = iifindex;
8686
} else {
8787
EE("ERROR: Failed to get interface index");
8888
goto ret_accept;
@@ -102,20 +102,13 @@ static int callback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
102102
if (res < 0) {
103103
EE(T(fh_rawsend_handle));
104104
goto ret_accept;
105-
} else if (res) {
106-
goto ret_accept;
107105
}
108106

109107
if (modified) {
110-
return nfq_set_verdict2(qh, pkt_id, NF_REPEAT, g_ctx.fwmark, pkt_len,
111-
pkt_data);
108+
return nfq_set_verdict(qh, pkt_id, NF_ACCEPT, pkt_len, pkt_data);
112109
}
113-
return nfq_set_verdict2(qh, pkt_id, NF_REPEAT, g_ctx.fwmark, 0, NULL);
114110

115111
ret_accept:
116-
if (modified) {
117-
return nfq_set_verdict(qh, pkt_id, NF_ACCEPT, pkt_len, pkt_data);
118-
}
119112
return nfq_set_verdict(qh, pkt_id, NF_ACCEPT, 0, NULL);
120113
}
121114

‎src/rawsend.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -401,7 +401,7 @@ int fh_rawsend_handle(struct sockaddr_ll *sll, uint8_t *pkt_data, int pkt_len,
401401
return -1;
402402
}
403403

404-
return 1;
404+
return 0;
405405
} else if (sll->sll_pkttype == PACKET_OUTGOING && tcph->syn) {
406406
if (!g_ctx.outbound) {
407407
E_INFO("%s:%u <===SYN(?)=== %s:%u", dst_ip, ntohs(tcph->dest),
@@ -418,10 +418,10 @@ int fh_rawsend_handle(struct sockaddr_ll *sll, uint8_t *pkt_data, int pkt_len,
418418
ntohs(tcph->source));
419419
}
420420

421-
return 1;
421+
return 0;
422422
} else {
423423
E_INFO("%s:%u ===(?)=== %s:%u", src_ip, ntohs(tcph->source), dst_ip,
424424
ntohs(tcph->dest));
425-
return 1;
425+
return 0;
426426
}
427427
}

0 commit comments

Comments
 (0)