enter punchd
This commit is contained in:
parent
9056b28627
commit
f5e07b79f4
140
punch.nim
140
punch.nim
|
|
@ -1,140 +0,0 @@
|
||||||
import
|
|
||||||
asyncdispatch,
|
|
||||||
asyncutils,
|
|
||||||
network_interface,
|
|
||||||
packet_info,
|
|
||||||
strformat
|
|
||||||
|
|
||||||
from nativesockets import SOCK_RAW, bindAddr, htons
|
|
||||||
from posix import ioctl, setsockopt, SockAddr, SockLen, SocketHandle
|
|
||||||
|
|
||||||
export NetworkInterfaceError
|
|
||||||
|
|
||||||
type
|
|
||||||
Sockaddr_ll {.importc: "struct sockaddr_ll", pure, final,
|
|
||||||
header: "<linux/if_packet.h>".} = object
|
|
||||||
sll_family: cushort # Always AF_PACKET
|
|
||||||
sll_protocol: cushort # Physical-layer protocol
|
|
||||||
sll_ifindex: cint # Interface number
|
|
||||||
sll_hatype: cushort # ARP hardware type
|
|
||||||
sll_pkttype: cuchar # Packet type
|
|
||||||
sll_halen: cuchar # Length of address
|
|
||||||
sll_addr: array[8, cuchar] # Physical-layer address
|
|
||||||
|
|
||||||
Packet_mreq {.importc: "struct packet_mreq", pure, final,
|
|
||||||
header: "<linux/if_packet.h>".} = object
|
|
||||||
mr_ifindex: cint
|
|
||||||
mr_type: cushort
|
|
||||||
mr_alen: cushort
|
|
||||||
mr_address: array[8, cuchar]
|
|
||||||
|
|
||||||
PunchHoleError* = object of ValueError
|
|
||||||
|
|
||||||
var
|
|
||||||
AF_PACKET {.importc: "AF_PACKET", header: "<sys/socket.h>".}: cushort
|
|
||||||
SOL_PACKET {.importc: "SOL_PACKET", header: "<sys/socket.h>".}: cushort
|
|
||||||
ETH_P_ALL {.importc: "ETH_P_ALL", header: "<linux/if_ether.h>".}: cushort
|
|
||||||
PACKET_ADD_MEMBERSHIP {.importc: "PACKET_ADD_MEMBERSHIP", header: "<linux/if_packet.h>".}: cushort
|
|
||||||
PACKET_MR_PROMISC {.importc: "PACKET_MR_PROMISC", header: "<linux/if_packet.h>".}: cushort
|
|
||||||
|
|
||||||
proc setupRawSocket(iface: NetworkInterface): AsyncFD =
|
|
||||||
# Create a raw packet socket. For accessing outgoing packets we need to use
|
|
||||||
# ETH_P_ALL which is needed in network byte order, see packet(7) man page.
|
|
||||||
result = createAsyncNativeSocket(AF_PACKET.cint,
|
|
||||||
SOCK_RAW.cint,
|
|
||||||
htons(ETH_P_ALL).cint)
|
|
||||||
|
|
||||||
# Limit capturing of packets to the desired network interface, see
|
|
||||||
# netdevice(7) man page
|
|
||||||
echo "interface: ", iface.name, ", index: ", iface.index
|
|
||||||
var sa = Sockaddr_ll(sll_family: AF_PACKET,
|
|
||||||
sll_protocol: htons(ETH_P_ALL),
|
|
||||||
sll_ifindex: iface.index)
|
|
||||||
if bindAddr(result.SocketHandle,
|
|
||||||
cast[ptr SockAddr](addr sa),
|
|
||||||
sizeof(Sockaddr_ll).SockLen) != 0:
|
|
||||||
raise newException(PunchHoleError, "cannot bind to interface")
|
|
||||||
|
|
||||||
# Enable promiscuous mode, see netdevice(7) man page
|
|
||||||
var req = Packet_mreq(mr_ifindex: iface.index, mr_type: PACKET_MR_PROMISC)
|
|
||||||
if setsockopt(result.SocketHandle,
|
|
||||||
SOL_PACKET.cint,
|
|
||||||
PACKET_ADD_MEMBERSHIP.cint,
|
|
||||||
addr req,
|
|
||||||
sizeof(req).SockLen) != 0:
|
|
||||||
raise newException(PunchHoleError, "cannot enable promiscuous mode")
|
|
||||||
|
|
||||||
proc captureSequenceNumber(rawFd: AsyncFD,
|
|
||||||
clientAddress: string,
|
|
||||||
clientPort: Port,
|
|
||||||
serverAddress: string,
|
|
||||||
serverPort: Port): Future[uint32] {.async.} =
|
|
||||||
while true:
|
|
||||||
let packet = await rawFd.recv(4000)
|
|
||||||
if packet == "":
|
|
||||||
break
|
|
||||||
echo "packet len: ", packet.len
|
|
||||||
let packetInfo = fromString(packet)
|
|
||||||
if packetInfo.protocol == tcp and
|
|
||||||
packetInfo.tcpIpSrc == clientAddress and
|
|
||||||
packetInfo.tcpPortSrc.int == clientPort.int and
|
|
||||||
packetInfo.tcpIpDst == serverAddress and
|
|
||||||
packetInfo.tcpPortDst.int == serverPort.int:
|
|
||||||
return packetInfo.tcpSeqNumber
|
|
||||||
|
|
||||||
proc addFirewallRule(clientAddress: string,
|
|
||||||
clientPort: Port,
|
|
||||||
serverAddress: string,
|
|
||||||
serverPort: Port) {.async.} =
|
|
||||||
let firewall_cmd = fmt"""iptables -A INPUT \
|
|
||||||
-d {clientAddress} \
|
|
||||||
-p icmp \
|
|
||||||
--icmp-type time-exceeded \
|
|
||||||
-m conntrack \
|
|
||||||
--ctstate RELATED \
|
|
||||||
--ctproto tcp \
|
|
||||||
--ctorigsrc {clientAddress} \
|
|
||||||
--ctorigsrcport {clientPort.int} \
|
|
||||||
--ctorigdst {serverAddress} \
|
|
||||||
--ctorigdstport {serverPort.int} \
|
|
||||||
-j DROP"""
|
|
||||||
let exitcode = await asyncExecCmd(firewall_cmd)
|
|
||||||
if exitcode != 0:
|
|
||||||
raise newException(PunchHoleError, "cannot add firewall rule")
|
|
||||||
|
|
||||||
proc deleteFirewallRule(clientAddress: string,
|
|
||||||
clientPort: Port,
|
|
||||||
serverAddress: string,
|
|
||||||
serverPort: Port) {.async.} =
|
|
||||||
let firewall_cmd = fmt"""iptables -D INPUT \
|
|
||||||
-d {clientAddress} \
|
|
||||||
-p icmp \
|
|
||||||
--icmp-type time-exceeded \
|
|
||||||
-m conntrack \
|
|
||||||
--ctstate RELATED \
|
|
||||||
--ctproto tcp \
|
|
||||||
--ctorigsrc {clientAddress} \
|
|
||||||
--ctorigsrcport {clientPort.int} \
|
|
||||||
--ctorigdst {serverAddress} \
|
|
||||||
--ctorigdstport {serverPort.int} \
|
|
||||||
-j DROP"""
|
|
||||||
let exitcode = await asyncExecCmd(firewall_cmd)
|
|
||||||
if exitcode != 0:
|
|
||||||
raise newException(PunchHoleError, "cannot delete firewall rule")
|
|
||||||
|
|
||||||
proc punchHoleAsClient*(clientAddress: string,
|
|
||||||
clientPort: Port,
|
|
||||||
serverAddress: string,
|
|
||||||
serverPort: Port) {.async.} =
|
|
||||||
let iface = fromIpAddress(clientAddress)
|
|
||||||
let rawFd = setupRawSocket(iface)
|
|
||||||
let seqNumber = await captureSequenceNumber(rawFd,
|
|
||||||
clientAddress,
|
|
||||||
clientPort,
|
|
||||||
serverAddress,
|
|
||||||
serverPort)
|
|
||||||
echo "captured sequence number: ", seqNumber
|
|
||||||
await addFirewallRule(clientAddress, clientPort, serverAddress, serverPort)
|
|
||||||
await deleteFirewallRule(clientAddress, clientPort, serverAddress, serverPort)
|
|
||||||
closeSocket(rawFd)
|
|
||||||
|
|
||||||
|
|
@ -0,0 +1,84 @@
|
||||||
|
import asyncdispatch, asyncnet, os, strformat, strutils
|
||||||
|
from nativesockets import Domain, SockType, Protocol
|
||||||
|
from net import IpAddress, Port, `$`
|
||||||
|
import asyncutils
|
||||||
|
import message
|
||||||
|
import tcp_syni
|
||||||
|
|
||||||
|
from strutils import format, join
|
||||||
|
from nativesockets import setSockOptInt
|
||||||
|
|
||||||
|
type
|
||||||
|
# Requests
|
||||||
|
TcpSyniConnect = object
|
||||||
|
srcIp: IpAddress
|
||||||
|
srcPorts: array[3, Port]
|
||||||
|
dstIp: IpAddress
|
||||||
|
dstPorts: array[3, Port]
|
||||||
|
|
||||||
|
TcpSyniAccept = object
|
||||||
|
dstIp: IpAddress
|
||||||
|
dstPorts: array[3, Port]
|
||||||
|
srcIp: IpAddress
|
||||||
|
srcPorts: array[3, Port]
|
||||||
|
seqNums: array[10, uint32]
|
||||||
|
|
||||||
|
proc handleRequest(line: string, unixSock: AsyncSocket) {.async.} =
|
||||||
|
var id: string
|
||||||
|
var sock: AsyncSocket
|
||||||
|
var puncher: TcpSyniPuncher
|
||||||
|
try:
|
||||||
|
let args = line.parseArgs(3)
|
||||||
|
id = args[1]
|
||||||
|
|
||||||
|
case args[0]:
|
||||||
|
of "tcp-syni-connect":
|
||||||
|
let req = parseMessage[TcpSyniConnect](args[2])
|
||||||
|
proc handleSeqNumbers(seqNumbers: seq[uint32]) {.async.} =
|
||||||
|
let content = @["tcp-syni-accept", $req.srcIp, req.srcPorts.join(","),
|
||||||
|
$req.dstIp, req.dstPorts.join(","),
|
||||||
|
seqNumbers.join(",")].join("|")
|
||||||
|
await unixSock.send(&"progress|{id}|{content}\n")
|
||||||
|
puncher = await initPuncher(req.srcPorts[0], req.dstIp, req.dstPorts)
|
||||||
|
sock = await puncher.connect(handleSeqNumbers)
|
||||||
|
|
||||||
|
of "tcp-syni-accept":
|
||||||
|
let req = parseMessage[TcpSyniAccept](args[2])
|
||||||
|
puncher = await initPuncher(req.srcPorts[0], req.dstIp, req.dstPorts,
|
||||||
|
@(req.seqNums))
|
||||||
|
sock = await puncher.accept()
|
||||||
|
|
||||||
|
else:
|
||||||
|
raise newException(ValueError, "invalid request")
|
||||||
|
|
||||||
|
let unixFd = unixSock.getFd.AsyncFD
|
||||||
|
await unixFd.asyncSendMsg(&"ok|{id}\n", @[fromFd(sock.getFd.AsyncFD)])
|
||||||
|
await puncher.cleanup
|
||||||
|
|
||||||
|
except PunchHoleError as e:
|
||||||
|
await unixSock.send(&"error|{id}|{e.msg}\n")
|
||||||
|
await puncher.cleanup
|
||||||
|
except ValueError:
|
||||||
|
unixSock.close
|
||||||
|
|
||||||
|
proc handleRequests(userSock: AsyncSocket) {.async.} =
|
||||||
|
while true:
|
||||||
|
let line = await userSock.recvLine(maxLength = 400)
|
||||||
|
if line.len == 0:
|
||||||
|
break
|
||||||
|
asyncCheck handleRequest(line, userSock)
|
||||||
|
|
||||||
|
proc handleUsers(sock: AsyncSocket) {.async.} =
|
||||||
|
while true:
|
||||||
|
let user = await sock.accept()
|
||||||
|
asyncCheck handleRequests(user)
|
||||||
|
|
||||||
|
proc main() =
|
||||||
|
removeFile("/tmp/punchd.socket")
|
||||||
|
let unixSocket = newAsyncSocket(AF_UNIX, SOCK_STREAM, IPPROTO_IP)
|
||||||
|
unixSocket.bindUnix("/tmp/punchd.socket")
|
||||||
|
asyncCheck handleUsers(unixSocket)
|
||||||
|
runForever()
|
||||||
|
|
||||||
|
when isMainModule:
|
||||||
|
main()
|
||||||
|
|
@ -0,0 +1,60 @@
|
||||||
|
import asyncdispatch
|
||||||
|
from nativesockets import SOCK_RAW, bindAddr, htons
|
||||||
|
from posix import setsockopt, SockAddr, SockLen, SocketHandle
|
||||||
|
import network_interface
|
||||||
|
|
||||||
|
type
|
||||||
|
RawSocketError* = object of CatchableError
|
||||||
|
|
||||||
|
Sockaddr_ll {.importc: "struct sockaddr_ll", pure, final,
|
||||||
|
header: "<linux/if_packet.h>".} = object
|
||||||
|
sll_family: cushort # Always AF_PACKET
|
||||||
|
sll_protocol: cushort # Physical-layer protocol
|
||||||
|
sll_ifindex: cint # Interface number
|
||||||
|
sll_hatype: cushort # ARP hardware type
|
||||||
|
sll_pkttype: cuchar # Packet type
|
||||||
|
sll_halen: cuchar # Length of address
|
||||||
|
sll_addr: array[8, cuchar] # Physical-layer address
|
||||||
|
|
||||||
|
Packet_mreq {.importc: "struct packet_mreq", pure, final,
|
||||||
|
header: "<linux/if_packet.h>".} = object
|
||||||
|
mr_ifindex: cint
|
||||||
|
mr_type: cushort
|
||||||
|
mr_alen: cushort
|
||||||
|
mr_address: array[8, cuchar]
|
||||||
|
|
||||||
|
var
|
||||||
|
AF_PACKET {.importc: "AF_PACKET", header: "<sys/socket.h>".}: cushort
|
||||||
|
SOL_PACKET {.importc: "SOL_PACKET", header: "<sys/socket.h>".}: cushort
|
||||||
|
ETH_P_ALL {.importc: "ETH_P_ALL", header: "<linux/if_ether.h>".}: cushort
|
||||||
|
PACKET_ADD_MEMBERSHIP {.importc: "PACKET_ADD_MEMBERSHIP", header: "<linux/if_packet.h>".}: cushort
|
||||||
|
PACKET_MR_PROMISC {.importc: "PACKET_MR_PROMISC", header: "<linux/if_packet.h>".}: cushort
|
||||||
|
|
||||||
|
proc setupRawSocket*(iface: NetworkInterface): AsyncFD =
|
||||||
|
# Create a raw packet socket. For accessing outgoing packets we need to use
|
||||||
|
# ETH_P_ALL which is needed in network byte order, see packet(7) man page.
|
||||||
|
result = createAsyncNativeSocket(AF_PACKET.cint,
|
||||||
|
SOCK_RAW.cint,
|
||||||
|
htons(ETH_P_ALL).cint)
|
||||||
|
|
||||||
|
# Limit capturing of packets to the desired network interface, see
|
||||||
|
# netdevice(7) man page
|
||||||
|
echo "interface: ", iface.name, ", index: ", iface.index
|
||||||
|
var sa = Sockaddr_ll(sll_family: AF_PACKET,
|
||||||
|
sll_protocol: htons(ETH_P_ALL),
|
||||||
|
sll_ifindex: iface.index)
|
||||||
|
if bindAddr(result.SocketHandle,
|
||||||
|
cast[ptr SockAddr](addr sa),
|
||||||
|
sizeof(Sockaddr_ll).SockLen) != 0:
|
||||||
|
raise newException(RawSocketError, "cannot bind to interface")
|
||||||
|
|
||||||
|
# Enable promiscuous mode, see netdevice(7) man page
|
||||||
|
var req = Packet_mreq(mr_ifindex: iface.index, mr_type: PACKET_MR_PROMISC)
|
||||||
|
if setsockopt(result.SocketHandle,
|
||||||
|
SOL_PACKET.cint,
|
||||||
|
PACKET_ADD_MEMBERSHIP.cint,
|
||||||
|
addr req,
|
||||||
|
sizeof(req).SockLen) != 0:
|
||||||
|
raise newException(RawSocketError, "cannot enable promiscuous mode")
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -0,0 +1,121 @@
|
||||||
|
import asyncdispatch, asyncnet, strformat
|
||||||
|
from net import IpAddress, Port, `$`, getPrimaryIPAddr
|
||||||
|
from nativesockets import setSockOptInt
|
||||||
|
import asyncutils
|
||||||
|
import network_interface
|
||||||
|
import packet_info
|
||||||
|
import raw_socket
|
||||||
|
|
||||||
|
var IPPROTO_IP {.importc: "IPPROTO_IP", header: "<netinet/in.h>".}: cint
|
||||||
|
var IP_TTL {.importc: "IP_TTL", header: "<netinet/in.h>".}: cint
|
||||||
|
|
||||||
|
type
|
||||||
|
TcpSyniPuncher* = object
|
||||||
|
srcIp: IpAddress
|
||||||
|
srcPort: Port
|
||||||
|
dstIp: IpAddress
|
||||||
|
dstPorts: array[10, Port]
|
||||||
|
seqNums: seq[uint32]
|
||||||
|
|
||||||
|
PunchProgressCb* = proc (seqNums: seq[uint32]) {.async.}
|
||||||
|
|
||||||
|
PunchHoleError* = object of ValueError
|
||||||
|
|
||||||
|
proc addFirewallRule(srcIp: IpAddress, srcPort: Port,
|
||||||
|
dstIp: IpAddress, dstPort: Port) {.async.} =
|
||||||
|
let firewall_cmd = fmt"""iptables -A INPUT \
|
||||||
|
-d {srcIp} \
|
||||||
|
-p icmp \
|
||||||
|
--icmp-type time-exceeded \
|
||||||
|
-m conntrack \
|
||||||
|
--ctstate RELATED \
|
||||||
|
--ctproto tcp \
|
||||||
|
--ctorigsrc {srcIp} \
|
||||||
|
--ctorigsrcport {srcPort.int} \
|
||||||
|
--ctorigdst {dstIp} \
|
||||||
|
--ctorigdstport {dstPort.int} \
|
||||||
|
-j DROP"""
|
||||||
|
let exitcode = await asyncExecCmd(firewall_cmd)
|
||||||
|
if exitcode != 0:
|
||||||
|
raise newException(PunchHoleError, "cannot add firewall rule")
|
||||||
|
|
||||||
|
proc delFirewallRule(srcIp: IpAddress, srcPort: Port,
|
||||||
|
dstIp: IpAddress, dstPort: Port) {.async.} =
|
||||||
|
let firewall_cmd = fmt"""iptables -D INPUT \
|
||||||
|
-d {srcIp} \
|
||||||
|
-p icmp \
|
||||||
|
--icmp-type time-exceeded \
|
||||||
|
-m conntrack \
|
||||||
|
--ctstate RELATED \
|
||||||
|
--ctproto tcp \
|
||||||
|
--ctorigsrc {srcIp} \
|
||||||
|
--ctorigsrcport {srcPort.int} \
|
||||||
|
--ctorigdst {dstIp} \
|
||||||
|
--ctorigdstport {dstPort.int} \
|
||||||
|
-j DROP"""
|
||||||
|
let exitcode = await asyncExecCmd(firewall_cmd)
|
||||||
|
if exitcode != 0:
|
||||||
|
raise newException(PunchHoleError, "cannot delete firewall rule")
|
||||||
|
|
||||||
|
proc captureSeqNumbers(puncher: TcpSyniPuncher, rawFd: AsyncFD,
|
||||||
|
cb: PunchProgressCb) {.async.} =
|
||||||
|
# FIXME: timeout?
|
||||||
|
var seqNums = newSeq[uint32]()
|
||||||
|
while seqNums.len < puncher.dstPorts.len:
|
||||||
|
let packet = await rawFd.recv(4000)
|
||||||
|
if packet == "":
|
||||||
|
break
|
||||||
|
echo "packet len: ", packet.len
|
||||||
|
let packetInfo = fromString(packet)
|
||||||
|
if packetInfo.protocol == tcp and
|
||||||
|
packetInfo.tcpIpSrc == $puncher.srcIp and
|
||||||
|
packetInfo.tcpPortSrc.int == puncher.srcPort.int and
|
||||||
|
packetInfo.tcpIpDst == $puncher.dstIp:
|
||||||
|
for i, port in puncher.dstPorts.pairs:
|
||||||
|
if packetInfo.tcpPortDst.int == port.int:
|
||||||
|
seqNums.add(packetInfo.tcpSeqNumber)
|
||||||
|
break
|
||||||
|
await cb(seqNums)
|
||||||
|
|
||||||
|
proc initPuncher*(srcPort: Port, dstIp: IpAddress, dstPorts: array[3, Port],
|
||||||
|
seqNums: seq[uint32] = @[]): Future[TcpSyniPuncher] {.async.} =
|
||||||
|
let localIp = getPrimaryIPAddr(dstIp)
|
||||||
|
# TODO: do real port prediction
|
||||||
|
var predictedDstPorts: array[10, Port]
|
||||||
|
let basePort = min(dstPorts[1].uint16, uint16.high - 9)
|
||||||
|
for i in 0.uint16 .. 9.uint16:
|
||||||
|
predictedDstPorts[i] = Port(basePort + i)
|
||||||
|
result = TcpSyniPuncher(srcIp: localIp, srcPort: srcPort, dstIp: dstIp,
|
||||||
|
dstPorts: predictedDstPorts, seqNums: seqNums)
|
||||||
|
for dstPort in result.dstPorts:
|
||||||
|
await addFirewallRule(result.srcIp, result.srcPort, result.dstIp, dstPort)
|
||||||
|
|
||||||
|
proc cleanup*(puncher: TcpSyniPuncher) {.async.} =
|
||||||
|
for dstPort in puncher.dstPorts:
|
||||||
|
await delFirewallRule(puncher.srcIp, puncher.srcPort, puncher.dstIp, dstPort)
|
||||||
|
|
||||||
|
proc doConnect(srcIp: IpAddress, srcPort: Port, dstIp: IpAddress,
|
||||||
|
dstPort: Port, future: Future[AsyncSocket]) {.async.} =
|
||||||
|
let sock = newAsyncSocket()
|
||||||
|
sock.setSockOpt(OptReuseAddr, true)
|
||||||
|
sock.getFd.setSockOptInt(IPPROTO_IP, IP_TTL, 2)
|
||||||
|
sock.bindAddr(srcPort, $srcIp)
|
||||||
|
try:
|
||||||
|
await sock.connect($dstIp, dstPort)
|
||||||
|
future.complete(sock)
|
||||||
|
except OSError as e:
|
||||||
|
echo &"connection {srcIP}:{srcPort.int} -> {dstIp}:{dstPort.int} failed: ", e.msg
|
||||||
|
discard
|
||||||
|
|
||||||
|
proc connect*(puncher: TcpSyniPuncher,
|
||||||
|
progressCb: PunchProgressCb): Future[AsyncSocket] =
|
||||||
|
result = newFuture[AsyncSocket]("tcp_syni.connect")
|
||||||
|
let iface = fromIpAddress($puncher.srcIp)
|
||||||
|
let rawFd = setupRawSocket(iface)
|
||||||
|
asyncCheck puncher.captureSeqNumbers(rawFd, progressCb)
|
||||||
|
for dstPort in puncher.dstPorts:
|
||||||
|
asyncCheck doConnect(puncher.srcIp, puncher.srcPort, puncher.dstIp,
|
||||||
|
dstPort, result)
|
||||||
|
|
||||||
|
proc accept*(puncher: TcpSyniPuncher): Future[AsyncSocket] =
|
||||||
|
result = newFuture[AsyncSocket]("tcp_syni.accept")
|
||||||
Loading…
Reference in New Issue