From 74906587084af9ff3fa845843f22e624ec039d25 Mon Sep 17 00:00:00 2001 From: Vadim Vetrov Date: Tue, 30 Jul 2024 23:10:00 +0300 Subject: [PATCH] Carry split and detection functions to separate file This needed to escape code duplication in further development of kernel module. Also this cleanups the code. --- Makefile | 2 +- mangle.c | 430 +++++++++++++++++++++++++++++++++++++++++++++++ mangle.h | 63 +++++++ youtubeUnblock.c | 428 ++++++---------------------------------------- 4 files changed, 546 insertions(+), 377 deletions(-) create mode 100644 mangle.c create mode 100644 mangle.h diff --git a/Makefile b/Makefile index d84f590..c621152 100644 --- a/Makefile +++ b/Makefile @@ -17,7 +17,7 @@ export CC LD CFLAGS LDFLAGS APP:=$(BUILD_DIR)/youtubeUnblock -SRCS := youtubeUnblock.c +SRCS := youtubeUnblock.c mangle.c OBJS := $(SRCS:%.c=$(BUILD_DIR)/%.o) LIBNFNETLINK := $(DEPSDIR)/lib/libnfnetlink.a diff --git a/mangle.c b/mangle.c new file mode 100644 index 0000000..60fc05e --- /dev/null +++ b/mangle.c @@ -0,0 +1,430 @@ +#include "mangle.h" +#include + +#ifdef KERNEL_SPACE +static __u16 nfq_checksum(__u32 sum, __u16 *buf, int size) +{ + while (size > 1) { + sum += *buf++; + size -= sizeof(__u16); + } + if (size) { +#if __BYTE_ORDER == __BIG_ENDIAN + sum += (uint16_t)*(uint8_t *)buf << 8; +#else + sum += (__u16)*(__u8 *)buf; +#endif + } + + sum = (sum >> 16) + (sum & 0xffff); + sum += (sum >> 16); + + return (__u16)(~sum); +} + +static __u16 nfq_checksum_tcpudp_ipv4(struct iphdr *iph, __u16 protonum) +{ + __u32 sum = 0; + __u32 iph_len = iph->ihl*4; + __u32 len = ntohs(iph->tot_len) - iph_len; + __u8 *payload = (__u8 *)iph + iph_len; + + sum += (iph->saddr >> 16) & 0xFFFF; + sum += (iph->saddr) & 0xFFFF; + sum += (iph->daddr >> 16) & 0xFFFF; + sum += (iph->daddr) & 0xFFFF; + sum += htons(protonum); + sum += htons(len); + + return nfq_checksum(sum, (__u16 *)payload, len); +} + +static void nfq_ip_set_checksum(struct iphdr *iph) +{ + __u32 iph_len = iph->ihl * 4; + + iph->check = 0; + iph->check = nfq_checksum(0, (__u16 *)iph, iph_len); +} + +static void +nfq_tcp_compute_checksum_ipv4(struct tcphdr *tcph, struct iphdr *iph) +{ + /* checksum field in header needs to be zero for calculation. */ + tcph->check = 0; + tcph->check = nfq_checksum_tcpudp_ipv4(iph, IPPROTO_TCP); +} +#else +#include +#include +#include + +typedef uint8_t __u8; +typedef uint32_t __u32; +typedef uint16_t __u16; +#endif + + +int ip4_payload_split(__u8 *pkt, __u32 buflen, + struct iphdr **iph, __u32 *iph_len, + __u8 **payload, __u32 *plen) { + if (pkt == NULL || buflen < sizeof(struct iphdr)) { + return -EINVAL; + } + + struct iphdr *hdr = (struct iphdr *)pkt; + if (hdr->version != IPVERSION) return -EINVAL; + + __u32 hdr_len = hdr->ihl * 4; + __u32 pktlen = ntohs(hdr->tot_len); + if (pktlen < buflen || hdr_len > pktlen) return -EINVAL; + + if (iph) + *iph = hdr; + if (iph_len) + *iph_len = hdr_len; + if (payload) + *payload = pkt + hdr_len; + if (plen) + *plen = pktlen - hdr_len; + + return 0; +} + +int tcp4_payload_split(__u8 *pkt, __u32 buflen, + struct iphdr **iph, __u32 *iph_len, + struct tcphdr **tcph, __u32 *tcph_len, + __u8 **payload, __u32 *plen) { + struct iphdr *hdr; + __u32 hdr_len; + struct tcphdr *thdr; + __u32 thdr_len; + + __u8 *tcph_pl; + __u32 tcph_plen; + + if (ip4_payload_split(pkt, buflen, &hdr, &hdr_len, + &tcph_pl, &tcph_plen)){ + return -EINVAL; + } + + if ( + hdr->protocol != IPPROTO_TCP || + !(ntohs(hdr->frag_off) & IP_DF) || + tcph_plen < sizeof(struct tcphdr)) { + return -EINVAL; + } + + + thdr = (struct tcphdr *)(tcph_pl); + thdr_len = (*tcph)->doff * 4; + + if (thdr_len > tcph_plen) { + return -EINVAL; + } + + if (iph) *iph = hdr; + if (iph_len) *iph_len = hdr_len; + if (tcph) *tcph = thdr; + if (tcph_len) *tcph_len = thdr_len; + if (payload) *payload = tcph_pl + thdr_len; + if (plen) *plen = tcph_plen - thdr_len; + + return 0; +} + +// split packet to two ipv4 fragments. +int ip4_frag(const __u8 *pkt, __u32 buflen, __u32 payload_offset, + __u8 *frag1, __u32 *f1len, + __u8 *frag2, __u32 *f2len) { + + struct iphdr *hdr; + const __u8 *payload; + __u32 plen; + __u32 hdr_len; + + if (ip4_payload_split( + (__u8 *)pkt, buflen, + &hdr, &hdr_len, (__u8 **)&payload, &plen)) { + return -EINVAL; + } + + if (plen <= payload_offset) { + return -EINVAL; + } + + if (payload_offset & ((1 << 3) - 1)) { +#ifdef KERNEL_SPACE +#else + errno = EINVAL; + perror("Payload offset MUST be a multiply of 8!"); +#endif + + return -EINVAL; + } + + __u32 f1_plen = payload_offset; + __u32 f1_dlen = f1_plen + hdr_len; + + __u32 f2_plen = plen - payload_offset; + __u32 f2_dlen = f2_plen + hdr_len; + + if (*f1len < f1_dlen || *f2len < f2_dlen) { + return -ENOMEM; + } + *f1len = f1_dlen; + *f2len = f2_dlen; + + memcpy(frag1, hdr, hdr_len); + memcpy(frag2, hdr, hdr_len); + + memcpy(frag1 + hdr_len, payload, f1_plen); + memcpy(frag2 + hdr_len, payload + payload_offset, f2_plen); + + struct iphdr *f1_hdr = (void *)frag1; + struct iphdr *f2_hdr = (void *)frag2; + + __u16 f1_frag_off = ntohs(f1_hdr->frag_off); + __u16 f2_frag_off = ntohs(f2_hdr->frag_off); + + f1_frag_off &= IP_OFFMASK; + f1_frag_off |= IP_MF; + + if ((f2_frag_off & ~IP_OFFMASK) == IP_MF) { + f2_frag_off &= IP_OFFMASK; + f2_frag_off |= IP_MF; + } else { + f2_frag_off &= IP_OFFMASK; + } + + f2_frag_off += (__u16)payload_offset / 8; + + f1_hdr->frag_off = htons(f1_frag_off); + f1_hdr->tot_len = htons(f1_dlen); + + f2_hdr->frag_off = htons(f2_frag_off); + f2_hdr->tot_len = htons(f2_dlen); + + +#if defined(DEBUG) && !defined(KERNEL_SPACE) + printf("Packet split in portion %u %u\n", f1_plen, f2_plen); +#endif + + nfq_ip_set_checksum(f1_hdr); + nfq_ip_set_checksum(f2_hdr); + + return 0; +} + +// split packet to two tcp-on-ipv4 segments. +int tcp4_frag(const __u8 *pkt, __u32 buflen, __u32 payload_offset, + __u8 *seg1, __u32 *s1len, + __u8 *seg2, __u32 *s2len) { + + struct iphdr *hdr; + __u32 hdr_len; + struct tcphdr *tcph; + __u32 tcph_len; + __u32 plen; + const __u8 *payload; + + if (tcp4_payload_split((__u8 *)pkt, buflen, + &hdr, &hdr_len, + &tcph, &tcph_len, + (__u8 **)&payload, &plen)) { + return -EINVAL; + } + + if (plen <= payload_offset) { + return -EINVAL; + } + + __u32 s1_plen = payload_offset; + __u32 s1_dlen = s1_plen + hdr_len + tcph_len; + + __u32 s2_plen = plen - payload_offset; + __u32 s2_dlen = s2_plen + hdr_len + tcph_len; + + if (*s1len < s1_dlen || *s2len < s2_dlen) return -ENOMEM; + + *s1len = s1_dlen; + *s2len = s2_dlen; + + memcpy(seg1, hdr, hdr_len); + memcpy(seg2, hdr, hdr_len); + + memcpy(seg1 + hdr_len, tcph, tcph_len); + memcpy(seg2 + hdr_len, tcph, tcph_len); + + memcpy(seg1 + hdr_len + tcph_len, payload, s1_plen); + memcpy(seg2 + hdr_len + tcph_len, payload + payload_offset, s2_plen); + + struct iphdr *s1_hdr = (void *)seg1; + struct iphdr *s2_hdr = (void *)seg2; + + struct tcphdr *s1_tcph = (void *)(seg1 + hdr_len); + struct tcphdr *s2_tcph = (void *)(seg2 + hdr_len); + + s1_hdr->tot_len = htons(s1_dlen); + s2_hdr->tot_len = htons(s2_dlen); + + s2_tcph->seq = htonl(ntohl(s2_tcph->seq) + payload_offset); + +#if defined(DEBUG) && !defined(KERNEL_SPACE) + printf("Packet split in portion %u %u\n", s1_plen, s2_plen); +#endif + + nfq_tcp_compute_checksum_ipv4(s1_tcph, s1_hdr); + nfq_tcp_compute_checksum_ipv4(s2_tcph, s2_hdr); + + return 0; +} + +#define TLS_CONTENT_TYPE_HANDSHAKE 0x16 +#define TLS_HANDSHAKE_TYPE_CLIENT_HELLO 0x01 +#define TLS_EXTENSION_SNI 0x0000 +#define TLS_EXTENSION_CLIENT_HELLO_ENCRYPTED 0xfe0d + +const char googlevideo_ending[] = "googlevideo.com"; +const int googlevideo_len = 15; + +#define GOOGLEVIDEO_MARK 0xfc74 + + +typedef __u8 uint8_t; +typedef __u32 uint32_t; +typedef __u16 uint16_t; + +/** + * Processes tls payload of the tcp request. + * + * data Payload data of TCP. + * dlen Length of `data`. + */ +struct verdict analyze_tls_data( + const uint8_t *data, + uint32_t dlen) +{ + struct verdict vrd = {0}; + + size_t i = 0; + const uint8_t *data_end = data + dlen; + + while (i + 4 < dlen) { + const uint8_t *msgData = data + i; + + uint8_t tls_content_type = *msgData; + uint8_t tls_vmajor = *(msgData + 1); + uint8_t tls_vminor = *(msgData + 2); + uint16_t message_length = ntohs(*(uint16_t *)(msgData + 3)); + const uint8_t *message_length_ptr = msgData + 3; + + + if (i + 5 + message_length > dlen) break; + + if (tls_content_type != TLS_CONTENT_TYPE_HANDSHAKE) + goto nextMessage; + + + const uint8_t *handshakeProto = msgData + 5; + + if (handshakeProto + 1 >= data_end) break; + + uint8_t handshakeType = *handshakeProto; + + if (handshakeType != TLS_HANDSHAKE_TYPE_CLIENT_HELLO) + goto nextMessage; + + const uint8_t *msgPtr = handshakeProto; + msgPtr += 1; + const uint8_t *handshakeProto_length_ptr = msgPtr + 1; + msgPtr += 3 + 2 + 32; + + if (msgPtr + 1 >= data_end) break; + uint8_t sessionIdLength = *msgPtr; + msgPtr++; + msgPtr += sessionIdLength; + + if (msgPtr + 2 >= data_end) break; + uint16_t ciphersLength = ntohs(*(uint16_t *)msgPtr); + msgPtr += 2; + msgPtr += ciphersLength; + + if (msgPtr + 1 >= data_end) break; + uint8_t compMethodsLen = *msgPtr; + msgPtr++; + msgPtr += compMethodsLen; + + if (msgPtr + 2 >= data_end) break; + uint16_t extensionsLen = ntohs(*(uint16_t *)msgPtr); + const uint8_t *extensionsLen_ptr = msgPtr; + msgPtr += 2; + + const uint8_t *extensionsPtr = msgPtr; + const uint8_t *extensions_end = extensionsPtr + extensionsLen; + if (extensions_end > data_end) break; + + while (extensionsPtr < extensions_end) { + const uint8_t *extensionPtr = extensionsPtr; + if (extensionPtr + 4 >= extensions_end) break; + + uint16_t extensionType = + ntohs(*(uint16_t *)extensionPtr); + extensionPtr += 2; + + uint16_t extensionLen = + ntohs(*(uint16_t *)extensionPtr); + const uint8_t *extensionLen_ptr = extensionPtr; + extensionPtr += 2; + + + if (extensionPtr + extensionLen > extensions_end) + break; + + if (extensionType != TLS_EXTENSION_SNI) + goto nextExtension; + + const uint8_t *sni_ext_ptr = extensionPtr; + + if (sni_ext_ptr + 2 >= extensions_end) break; + uint16_t sni_ext_dlen = ntohs(*(uint16_t *)sni_ext_ptr); + + const uint8_t *sni_ext_dlen_ptr = sni_ext_ptr; + sni_ext_ptr += 2; + + const uint8_t *sni_ext_end = sni_ext_ptr + sni_ext_dlen; + if (sni_ext_end >= extensions_end) break; + + if (sni_ext_ptr + 3 >= sni_ext_end) break; + uint8_t sni_type = *sni_ext_ptr++; + uint16_t sni_len = ntohs(*(uint16_t *)sni_ext_ptr); + sni_ext_ptr += 2; + + if (sni_ext_ptr + sni_len > sni_ext_end) break; + + char *sni_name = (char *)sni_ext_ptr; + // sni_len + + vrd.sni_offset = (uint8_t *)sni_name - data; + vrd.sni_len = sni_len; + + char *gv_startp = sni_name + sni_len - googlevideo_len; + if (sni_len >= googlevideo_len && + sni_len < 128 && + !strncmp(gv_startp, + googlevideo_ending, + googlevideo_len)) { + + vrd.gvideo_hello = 1; + } + +nextExtension: + extensionsPtr += 2 + 2 + extensionLen; + } +nextMessage: + i += 5 + message_length; + } + + return vrd; +} + diff --git a/mangle.h b/mangle.h new file mode 100644 index 0000000..f3c15e3 --- /dev/null +++ b/mangle.h @@ -0,0 +1,63 @@ +#ifndef YU_MANGLE_H +#define YU_MANGLE_H +#define RAWSOCKET_MARK 0xfc70 + +#ifdef KERNEL_SPACE +#include +typedef __u8 uint8_t; +typedef __u32 uint32_t; + +#include +#include +#include +#include +#include +#include +#include + +#include +#define ntohs(x) __constant_ntohs(x) +#define ntohl(x) __constant_ntohl(x) +#define htons(x) __constant_htons(x) +#define htonl(x) __constant_htonl(x) + +#define IP_RF 0x8000 /* reserved fragment flag */ +#define IP_DF 0x4000 /* dont fragment flag */ +#define IP_MF 0x2000 /* more fragments flag */ +#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */ +#else +#include +#include +#include +#include +#include +#include +#endif + +struct verdict { + int gvideo_hello; /* google video hello packet */ + int sni_offset; /* offset from start of tcp _payload_ */ + int sni_len; +}; + +struct verdict analyze_tls_data(const uint8_t *data, uint32_t dlen); + +int ip4_frag(const uint8_t *pkt, uint32_t pktlen, + uint32_t payload_offset, + uint8_t *frag1, uint32_t *f1len, + uint8_t *frag2, uint32_t *f2len); + +int tcp4_frag(const uint8_t *pkt, uint32_t pktlen, + uint32_t payload_offset, + uint8_t *seg1, uint32_t *s1len, + uint8_t *seg2, uint32_t *s2len); + +int ip4_payload_split(uint8_t *pkt, uint32_t buflen, + struct iphdr **iph, uint32_t *iph_len, + uint8_t **payload, uint32_t *plen); + +int tcp4_payload_split(uint8_t *pkt, uint32_t buflen, + struct iphdr **iph, uint32_t *iph_len, + struct tcphdr **tcph, uint32_t *tcph_len, + uint8_t **payload, uint32_t *plen); +#endif /* YU_MANGLE_H */ diff --git a/youtubeUnblock.c b/youtubeUnblock.c index 8cb88e3..3a4730a 100644 --- a/youtubeUnblock.c +++ b/youtubeUnblock.c @@ -1,10 +1,15 @@ #define _GNU_SOURCE +#ifndef __linux__ +#error "The package is linux only!" +#endif + +#ifdef KERNEL_SPACE +#error "The build aims to the kernel, not userspace" +#endif + #include #include -#include #include -#include -#include #include #include @@ -21,6 +26,7 @@ #include #include +#include "mangle.h" #ifndef NOUSE_GSO #define USE_GSO @@ -41,9 +47,6 @@ #error "Too much threads" #endif -#ifndef __linux__ -#error "The package is linux only!" -#endif static struct { uint32_t queue_start_num; @@ -173,229 +176,63 @@ static int close_raw_socket(void) { return 0; } -// split packet to two ipv4 fragments. -static int ipv4_frag(struct pkt_buff *pktb, size_t payload_offset, - struct pkt_buff **frag1, struct pkt_buff **frag2) { - uint8_t buff1[MNL_SOCKET_BUFFER_SIZE]; - uint8_t buff2[MNL_SOCKET_BUFFER_SIZE]; - - struct iphdr *hdr = nfq_ip_get_hdr(pktb); - size_t hdr_len = hdr->ihl * 4; - - uint8_t *payload = pktb_data(pktb) + hdr_len; - size_t plen = pktb_len(pktb) - hdr_len; - - if (hdr == NULL || payload == NULL || plen <= payload_offset) { - errno = EINVAL; - return -1; - } - - if (payload_offset & ((1 << 3) - 1)) { - fprintf(stderr, "Payload offset MUST be a multiply of 8!\n"); - errno = EINVAL; - return -1; - } - - size_t f1_plen = payload_offset; - size_t f1_dlen = f1_plen + hdr_len; - - size_t f2_plen = plen - payload_offset; - size_t f2_dlen = f2_plen + hdr_len; - - memcpy(buff1, hdr, hdr_len); - memcpy(buff2, hdr, hdr_len); - - memcpy(buff1 + hdr_len, payload, f1_plen); - memcpy(buff2 + hdr_len, payload + payload_offset, f2_plen); - - struct iphdr *f1_hdr = (void *)buff1; - struct iphdr *f2_hdr = (void *)buff2; - - uint16_t f1_frag_off = ntohs(f1_hdr->frag_off); - uint16_t f2_frag_off = ntohs(f2_hdr->frag_off); - - f1_frag_off &= IP_OFFMASK; - f1_frag_off |= IP_MF; - - if ((f2_frag_off & ~IP_OFFMASK) == IP_MF) { - f2_frag_off &= IP_OFFMASK; - f2_frag_off |= IP_MF; - } else { - f2_frag_off &= IP_OFFMASK; - } - - f2_frag_off += (uint16_t)payload_offset / 8; - - f1_hdr->frag_off = htons(f1_frag_off); - f1_hdr->tot_len = htons(f1_dlen); - - f2_hdr->frag_off = htons(f2_frag_off); - f2_hdr->tot_len = htons(f2_dlen); - - -#ifdef DEBUG - printf("Packet split in portion %zu %zu\n", f1_dlen, f2_dlen); -#endif - - nfq_ip_set_checksum(f1_hdr); - nfq_ip_set_checksum(f2_hdr); - - *frag1 = pktb_alloc(AF_INET, buff1, f1_dlen, 0); - if (*frag1 == NULL) - return -1; - - *frag2 = pktb_alloc(AF_INET, buff2, f2_dlen, 0); - if (*frag2 == NULL) { - pktb_free(*frag1); - return -1; - } - - return 0; -} - -// split packet to two tcp-on-ipv4 segments. -static int tcp4_frag(struct pkt_buff *pktb, size_t payload_offset, - struct pkt_buff **seg1, struct pkt_buff **seg2) { - uint8_t buff1[MNL_SOCKET_BUFFER_SIZE]; - uint8_t buff2[MNL_SOCKET_BUFFER_SIZE]; - - struct iphdr *hdr = nfq_ip_get_hdr(pktb); - size_t hdr_len = hdr->ihl * 4; - if (hdr == NULL) {errno = EINVAL; return -1;} - if (hdr->protocol != IPPROTO_TCP || !(ntohs(hdr->frag_off) & IP_DF)) { - errno = EINVAL; - return -1; - } - - if (nfq_ip_set_transport_header(pktb, hdr)) - return -1; - - struct tcphdr *tcph = nfq_tcp_get_hdr(pktb); - size_t tcph_len = tcph->doff * 4; - if (tcph == NULL) { - errno = EINVAL; - return -1; - } - - uint8_t *payload = nfq_tcp_get_payload(tcph, pktb); - size_t plen = nfq_tcp_get_payload_len(tcph, pktb); - - if (hdr == NULL || payload == NULL || plen <= payload_offset) { - errno = EINVAL; - return -1; - } - - size_t s1_plen = payload_offset; - size_t s1_dlen = s1_plen + hdr_len + tcph_len; - - size_t s2_plen = plen - payload_offset; - size_t s2_dlen = s2_plen + hdr_len + tcph_len; - - memcpy(buff1, hdr, hdr_len); - memcpy(buff2, hdr, hdr_len); - - memcpy(buff1 + hdr_len, tcph, tcph_len); - memcpy(buff2 + hdr_len, tcph, tcph_len); - - memcpy(buff1 + hdr_len + tcph_len, payload, s1_plen); - memcpy(buff2 + hdr_len + tcph_len, payload + payload_offset, s2_plen); - - struct iphdr *s1_hdr = (void *)buff1; - struct iphdr *s2_hdr = (void *)buff2; - - struct tcphdr *s1_tcph = (void *)(buff1 + hdr_len); - struct tcphdr *s2_tcph = (void *)(buff2 + hdr_len); - - s1_hdr->tot_len = htons(s1_dlen); - s2_hdr->tot_len = htons(s2_dlen); - - // s2_hdr->id = htons(ntohs(s1_hdr->id) + 1); - s2_tcph->seq = htonl(ntohl(s2_tcph->seq) + payload_offset); - // printf("%zu %du %du\n", payload_offset, ntohs(s1_tcph->seq), ntohs(s2_tcph->seq)); - -#ifdef DEBUG - printf("Packet split in portion %zu %zu\n", s1_dlen, s2_dlen); -#endif - - nfq_tcp_compute_checksum_ipv4(s1_tcph, s1_hdr); - nfq_tcp_compute_checksum_ipv4(s2_tcph, s2_hdr); - - *seg1 = pktb_alloc(AF_INET, buff1, s1_dlen, 0); - if (*seg1 == NULL) - return -1; - - *seg2 = pktb_alloc(AF_INET, buff2, s2_dlen, 0); - if (*seg2 == NULL) { - pktb_free(*seg1); - return -1; - } - - - return 0; -} #define AVAILABLE_MTU 1384 -static int send_raw_socket(struct pkt_buff *pktb) { - if (pktb_len(pktb) > AVAILABLE_MTU) { +static int send_raw_socket(const uint8_t *pkt, uint32_t pktlen) { + if (pktlen > AVAILABLE_MTU) { #ifdef DEBUG printf("Split packet!\n"); #endif - struct pkt_buff *buff1; - struct pkt_buff *buff2; + uint8_t buff1[MNL_SOCKET_BUFFER_SIZE]; + uint32_t buff1_size = MNL_SOCKET_BUFFER_SIZE; + uint8_t buff2[MNL_SOCKET_BUFFER_SIZE]; + uint32_t buff2_size = MNL_SOCKET_BUFFER_SIZE; #ifdef USE_TCP_SEGMENTATION - if (tcp4_frag(pktb, AVAILABLE_MTU-128, &buff1, &buff2) < 0) + if ((errno = tcp4_frag(pkt, pktlen, AVAILABLE_MTU-128, + buff1, &buff1_size, buff2, &buff2_size)) < 0) return -1; #else - if (ipv4_frag(pktb, AVAILABLE_MTU-128, &buff1, &buff2) < 0) + if ((errno = ip4_frag(pkt, pktlen, AVAILABLE_MTU-128, + buff1, &buff1_size, buff2, &buff2_size)) < 0) return -1; #endif int sent = 0; - int status = send_raw_socket(buff1); + int status = send_raw_socket(buff1, buff1_size); if (status >= 0) sent += status; else { - pktb_free(buff1); - pktb_free(buff2); return status; } - pktb_free(buff1); - status = send_raw_socket(buff2); + status = send_raw_socket(buff2, buff2_size); if (status >= 0) sent += status; else { - pktb_free(buff2); return status; } - pktb_free(buff2); return sent; } - struct iphdr *iph = nfq_ip_get_hdr(pktb); - if (iph == NULL) - return -1; - if(nfq_ip_set_transport_header(pktb, iph)) + struct iphdr *iph; + + if ((errno = ip4_payload_split( + (uint8_t *)pkt, pktlen, &iph, NULL, NULL, NULL)) < 0) { + errno *= -1; return -1; + } + int sin_port = 0; - struct tcphdr *tcph = nfq_tcp_get_hdr(pktb); - struct udphdr *udph = nfq_udp_get_hdr(pktb); - - if (tcph != NULL) { + struct tcphdr *tcph; + if (tcp4_payload_split((uint8_t *)pkt, pktlen, NULL, NULL, &tcph, NULL, NULL, NULL) == 0) sin_port = tcph->dest; - errno = 0; - } else if (udph != NULL) { - sin_port = udph->dest; - } else { - return -1; - } struct sockaddr_in daddr = { .sin_family = AF_INET, @@ -408,7 +245,7 @@ static int send_raw_socket(struct pkt_buff *pktb) { pthread_mutex_lock(&config.rawsocket_lock); int sent = sendto(config.rawsocket, - pktb_data(pktb), pktb_len(pktb), 0, + pkt, pktlen, 0, (struct sockaddr *)&daddr, sizeof(daddr)); pthread_mutex_unlock(&config.rawsocket_lock); @@ -426,160 +263,13 @@ struct packet_data { }; -#define TLS_CONTENT_TYPE_HANDSHAKE 0x16 -#define TLS_HANDSHAKE_TYPE_CLIENT_HELLO 0x01 -#define TLS_EXTENSION_SNI 0x0000 -#define TLS_EXTENSION_CLIENT_HELLO_ENCRYPTED 0xfe0d - -const char googlevideo_ending[] = "googlevideo.com"; -const int googlevideo_len = 15; - -#define GOOGLEVIDEO_MARK 0xfc74 - -struct verdict { - int gvideo_hello; /* google video hello packet */ - int sni_offset; /* offset from start of tcp _payload_ */ - int sni_len; -}; - -/** - * Processes tls payload of the tcp request. - * - * data Payload data of TCP. - * dlen Length of `data`. - */ -static struct verdict analyze_tls_data( - const uint8_t *data, - uint32_t dlen) -{ - struct verdict vrd = {0}; - - size_t i = 0; - const uint8_t *data_end = data + dlen; - - while (i + 4 < dlen) { - const uint8_t *msgData = data + i; - - uint8_t tls_content_type = *msgData; - uint8_t tls_vmajor = *(msgData + 1); - uint8_t tls_vminor = *(msgData + 2); - uint16_t message_length = ntohs(*(uint16_t *)(msgData + 3)); - const uint8_t *message_length_ptr = msgData + 3; - - - if (i + 5 + message_length > dlen) break; - - if (tls_content_type != TLS_CONTENT_TYPE_HANDSHAKE) - goto nextMessage; - - - const uint8_t *handshakeProto = msgData + 5; - - if (handshakeProto + 1 >= data_end) break; - - uint8_t handshakeType = *handshakeProto; - - if (handshakeType != TLS_HANDSHAKE_TYPE_CLIENT_HELLO) - goto nextMessage; - - const uint8_t *msgPtr = handshakeProto; - msgPtr += 1; - const uint8_t *handshakeProto_length_ptr = msgPtr + 1; - msgPtr += 3 + 2 + 32; - - if (msgPtr + 1 >= data_end) break; - uint8_t sessionIdLength = *msgPtr; - msgPtr++; - msgPtr += sessionIdLength; - - if (msgPtr + 2 >= data_end) break; - uint16_t ciphersLength = ntohs(*(uint16_t *)msgPtr); - msgPtr += 2; - msgPtr += ciphersLength; - - if (msgPtr + 1 >= data_end) break; - uint8_t compMethodsLen = *msgPtr; - msgPtr++; - msgPtr += compMethodsLen; - - if (msgPtr + 2 >= data_end) break; - uint16_t extensionsLen = ntohs(*(uint16_t *)msgPtr); - const uint8_t *extensionsLen_ptr = msgPtr; - msgPtr += 2; - - const uint8_t *extensionsPtr = msgPtr; - const uint8_t *extensions_end = extensionsPtr + extensionsLen; - if (extensions_end > data_end) break; - - while (extensionsPtr < extensions_end) { - const uint8_t *extensionPtr = extensionsPtr; - if (extensionPtr + 4 >= extensions_end) break; - - uint16_t extensionType = - ntohs(*(uint16_t *)extensionPtr); - extensionPtr += 2; - - uint16_t extensionLen = - ntohs(*(uint16_t *)extensionPtr); - const uint8_t *extensionLen_ptr = extensionPtr; - extensionPtr += 2; - - - if (extensionPtr + extensionLen > extensions_end) - break; - - if (extensionType != TLS_EXTENSION_SNI) - goto nextExtension; - - const uint8_t *sni_ext_ptr = extensionPtr; - - if (sni_ext_ptr + 2 >= extensions_end) break; - uint16_t sni_ext_dlen = ntohs(*(uint16_t *)sni_ext_ptr); - - const uint8_t *sni_ext_dlen_ptr = sni_ext_ptr; - sni_ext_ptr += 2; - - const uint8_t *sni_ext_end = sni_ext_ptr + sni_ext_dlen; - if (sni_ext_end >= extensions_end) break; - - if (sni_ext_ptr + 3 >= sni_ext_end) break; - uint8_t sni_type = *sni_ext_ptr++; - uint16_t sni_len = ntohs(*(uint16_t *)sni_ext_ptr); - sni_ext_ptr += 2; - - if (sni_ext_ptr + sni_len > sni_ext_end) break; - - char *sni_name = (char *)sni_ext_ptr; - // sni_len - - vrd.sni_offset = (uint8_t *)sni_name - data; - vrd.sni_len = sni_len; - - char *gv_startp = sni_name + sni_len - googlevideo_len; - if (sni_len >= googlevideo_len && - sni_len < 128 && - !strncmp(gv_startp, - googlevideo_ending, - googlevideo_len)) { - - vrd.gvideo_hello = 1; - } - -nextExtension: - extensionsPtr += 2 + 2 + extensionLen; - } -nextMessage: - i += 5 + message_length; - } - - return vrd; -} - // Per-queue data. Passed to queue_cb. struct queue_data { struct mnl_socket **_nl; int queue_num; }; + + /** * Used to accept unsupported packets (GSOs) */ @@ -655,8 +345,10 @@ static int process_packet(const struct packet_data packet, struct queue_data qda #endif } - struct pkt_buff *frag1; - struct pkt_buff *frag2; + uint8_t frag1[MNL_SOCKET_BUFFER_SIZE]; + uint8_t frag2[MNL_SOCKET_BUFFER_SIZE]; + uint32_t f1len = MNL_SOCKET_BUFFER_SIZE; + uint32_t f2len = MNL_SOCKET_BUFFER_SIZE; nfq_nlmsg_verdict_put(verdnlh, packet.id, NF_DROP); @@ -664,26 +356,18 @@ static int process_packet(const struct packet_data packet, struct queue_data qda size_t ipd_offset = vrd.sni_offset; size_t mid_offset = ipd_offset + vrd.sni_len / 2; - struct pkt_buff *pktb = pktb_alloc( - family, - packet.payload, - packet.payload_len, - 0); - - if (tcp4_frag(pktb, mid_offset, &frag1, &frag2) < 0) { + if ((errno = tcp4_frag(raw_payload, raw_payload_len, + mid_offset, frag1, &f1len, frag2, &f2len)) < 0) { + errno *= -1; perror("tcp4_frag"); - pktb_free(pktb); goto fallback; } - if ((send_raw_socket(frag2) == -1) || (send_raw_socket(frag1) == -1)) { + if ((send_raw_socket(frag2, f2len) < 0) || + (send_raw_socket(frag1, f1len) < 0)) { perror("raw frags send"); } - pktb_free(frag1); - pktb_free(frag2); - pktb_free(pktb); - #else // TODO: Implement compute of tcp checksum // GSO may turn kernel to not compute the tcp checksum. @@ -694,19 +378,19 @@ static int process_packet(const struct packet_data packet, struct queue_data qda size_t ipd_offset = ((char *)data - (char *)tcph) + vrd.sni_offset; size_t mid_offset = ipd_offset + vrd.sni_len / 2; mid_offset += 8 - mid_offset % 8; - - if (ipv4_frag(pktb, mid_offset, &frag1, &frag2) < 0) { - perror("ipv4_frag"); + if ((errno = ip4_frag(raw_payload, raw_payload_len, + mid_offset, frag1, &f1len, frag2, &f2len)) < 0) { + errno *= -1; + perror("ip4_frag"); goto fallback; } - if ((send_raw_socket(frag1) == -1) || (send_raw_socket(frag2) == -1)) { + if ((send_raw_socket(frag2, f2len) < 0) || + (send_raw_socket(frag1, f1len) < 0)) { perror("raw frags send"); } - pktb_free(frag1); - pktb_free(frag2); #endif } @@ -780,6 +464,8 @@ static int queue_cb(const struct nlmsghdr *nlh, void *data) { return process_packet(packet, *qdata); } +#define BUF_SIZE (0xffff + (MNL_SOCKET_BUFFER_SIZE / 2)) + int init_queue(int queue_num) { struct mnl_socket *nl; @@ -791,14 +477,7 @@ int init_queue(int queue_num) { uint32_t portid = mnl_socket_get_portid(nl); struct nlmsghdr *nlh; - char *buf; - size_t buf_size = 0xffff + (MNL_SOCKET_BUFFER_SIZE / 2); - buf = malloc(buf_size); - if (!buf) { - perror("Allocate recieve buffer"); - goto die_sock; - } - + char buf[BUF_SIZE]; nlh = nfq_nlmsg_put(buf, NFQNL_MSG_CONFIG, queue_num); nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_BIND); @@ -837,7 +516,7 @@ int init_queue(int queue_num) { printf("Queue %d started!\n", qdata.queue_num); while (1) { - ret = mnl_socket_recvfrom(nl, buf, buf_size); + ret = mnl_socket_recvfrom(nl, buf, BUF_SIZE); if (ret == -1) { perror("mnl_socket_recvfrom"); continue; @@ -850,13 +529,10 @@ int init_queue(int queue_num) { } - free(buf); close_socket(&nl); return 0; die: - free(buf); -die_sock: close_socket(&nl); return -1; }