mirror of
https://github.com/Waujito/youtubeUnblock.git
synced 2024-12-22 06:15:31 +00:00
Merge branch 'quic' into dev
This commit is contained in:
Vadim Vetrov
commit
7f340fb033
21
README.md
21
README.md
@ -8,6 +8,7 @@
|
||||
- [Check it](#check-it)
|
||||
- [Flags](#flags)
|
||||
- [Troubleshooting](#troubleshooting)
|
||||
- [TV](#tv)
|
||||
- [Troubleshooting EPERMS (Operation not permitted)](#troubleshooting-eperms-operation-not-permitted)
|
||||
- [How it works:](#how-it-works)
|
||||
- [How it processes packets](#how-it-processes-packets)
|
||||
@ -137,12 +138,16 @@ Available flags:
|
||||
|
||||
- `--frag-sni-faked={0|1}` Specifies **youtubeUnblock** to send fake packets near *ClientHello* (fills payload with zeroes). Defaults to **0**.
|
||||
|
||||
- `--quic-drop` Drop all QUIC packets which goes to youtubeUnblock. Won't affect any other UDP packets. Suitable for some TVs.
|
||||
|
||||
- `--fk-winsize=<winsize>` Specifies window size for the fragmented TCP packet. Applicable if you want for response to be fragmented. May slowdown connection initialization.
|
||||
|
||||
- `--seg2delay=<delay>` This flag forces **youtubeUnblock** to wait a little bit before send the 2nd part of the split packet.
|
||||
|
||||
- `--silent` Disables verbose mode.
|
||||
|
||||
- `--trace` Maximum verbosity for debugging purposes.
|
||||
|
||||
- `--no-gso` Disables support for Google Chrome fat packets which uses GSO. This feature is well tested now, so this flag probably won't fix anything.
|
||||
|
||||
- `--threads=<threads number>` Specifies the amount of threads you want to be running for your program. This defaults to **1** and shouldn't be edited for normal use. If you have performance issues, consult [performance chaptr](https://github.com/Waujito/youtubeUnblock?tab=readme-ov-file#performance)
|
||||
@ -155,6 +160,22 @@ If you are on Chromium you may have to disable *kyber* (the feature that makes t
|
||||
|
||||
If your browser is using QUIC it may not work properly. Disable it in Chrome in `chrome://flags` and in Firefox `network.http.http{2,3}.enable(d)` in `about:config` option.
|
||||
|
||||
### TV
|
||||
|
||||
Televisions are the biggest headache. Some users report that disabling QUIC + `--sni-domains=all` may work. To disable QUIC you may use `--quic-drop` [flag](#flags) with proper firewall configuration (check description of the flag). Note, that this flag won't disable gQUIC and some TVs may relay on it. To disable gQUIC you will need to block the entire 443 port for udp in firewall configuration:
|
||||
|
||||
For **nftables** do
|
||||
```
|
||||
nft insert rule inet fw4 forward udp dport 443 counter drop
|
||||
```
|
||||
|
||||
For **iptables**
|
||||
```
|
||||
iptables -I OUTPUT -p udp --dport 443 -j DROP
|
||||
```
|
||||
|
||||
Note that these rules may **break the stability of internet** so use them carefully and **only if** --quic-drop doesn't work.
|
||||
|
||||
### Troubleshooting EPERMS (Operation not permitted)
|
||||
|
||||
*EPERM* may occur in a lot of places but generally here are two: *mnl_cb_run* and when sending the packet via *rawsocket* (raw_frags_send and send fake sni).
|
||||
|
||||
24
args.c
24
args.c
@ -32,10 +32,11 @@ struct config_t config = {
|
||||
#endif
|
||||
|
||||
#ifdef DEBUG
|
||||
.verbose = true,
|
||||
.verbose = 1,
|
||||
#else
|
||||
.verbose = false,
|
||||
.verbose = 0,
|
||||
#endif
|
||||
|
||||
.domains_str = defaul_snistr,
|
||||
.domains_strlen = sizeof(defaul_snistr),
|
||||
|
||||
@ -53,13 +54,15 @@ struct config_t config = {
|
||||
#define OPT_FRAG_SNI_REVERSE 12
|
||||
#define OPT_FRAG_SNI_FAKED 13
|
||||
#define OPT_FK_WINSIZE 14
|
||||
#define OPT_TRACE 15
|
||||
#define OPT_QUIC_DROP 16
|
||||
#define OPT_SEG2DELAY 5
|
||||
#define OPT_THREADS 6
|
||||
#define OPT_SILENT 7
|
||||
#define OPT_NO_GSO 8
|
||||
#define OPT_QUEUE_NUM 9
|
||||
|
||||
#define OPT_MAX OPT_FRAG_SNI_FAKED
|
||||
#define OPT_MAX OPT_QUIC_DROP
|
||||
|
||||
static struct option long_opt[] = {
|
||||
{"help", 0, 0, 'h'},
|
||||
@ -73,9 +76,11 @@ static struct option long_opt[] = {
|
||||
{"frag-sni-reverse", 1, 0, OPT_FRAG_SNI_REVERSE},
|
||||
{"frag-sni-faked", 1, 0, OPT_FRAG_SNI_FAKED},
|
||||
{"fk-winsize", 1, 0, OPT_FK_WINSIZE},
|
||||
{"quic-drop", 0, 0, OPT_QUIC_DROP},
|
||||
{"seg2delay", 1, 0, OPT_SEG2DELAY},
|
||||
{"threads", 1, 0, OPT_THREADS},
|
||||
{"silent", 0, 0, OPT_SILENT},
|
||||
{"trace", 0, 0, OPT_TRACE},
|
||||
{"no-gso", 0, 0, OPT_NO_GSO},
|
||||
{"queue-num", 1, 0, OPT_QUEUE_NUM},
|
||||
{0,0,0,0}
|
||||
@ -120,9 +125,11 @@ void print_usage(const char *argv0) {
|
||||
printf("\t--frag-sni-reverse={0|1}\n");
|
||||
printf("\t--frag-sni-faked={0|1}\n");
|
||||
printf("\t--fk-winsize=<winsize>\n");
|
||||
printf("\t--quic-drop\n");
|
||||
printf("\t--seg2delay=<delay>\n");
|
||||
printf("\t--threads=<threads number>\n");
|
||||
printf("\t--silent\n");
|
||||
printf("\t--trace\n");
|
||||
printf("\t--no-gso\n");
|
||||
printf("\n");
|
||||
}
|
||||
@ -140,12 +147,18 @@ int parse_args(int argc, char *argv[]) {
|
||||
case 'v':
|
||||
print_version();
|
||||
goto stop_exec;
|
||||
case OPT_TRACE:
|
||||
config.verbose = 2;
|
||||
break;
|
||||
case OPT_SILENT:
|
||||
config.verbose = 0;
|
||||
break;
|
||||
case OPT_NO_GSO:
|
||||
config.use_gso = 0;
|
||||
break;
|
||||
case OPT_QUIC_DROP:
|
||||
config.quic_drop = 1;
|
||||
break;
|
||||
case OPT_SNI_DOMAINS:
|
||||
if (!strcmp(optarg, "all")) {
|
||||
config.all_domains = 1;
|
||||
@ -329,7 +342,12 @@ void print_welcome() {
|
||||
printf("GSO is enabled\n");
|
||||
}
|
||||
|
||||
if (config.quic_drop) {
|
||||
printf("All QUIC packets will be dropped\n");
|
||||
}
|
||||
|
||||
if (config.all_domains) {
|
||||
printf("All Client Hello will be targetted by youtubeUnblock!\n");
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
4
config.h
4
config.h
@ -25,7 +25,11 @@ struct config_t {
|
||||
unsigned char faking_ttl;
|
||||
int fake_sni;
|
||||
unsigned int fake_sni_seq_len;
|
||||
#define VERBOSE_INFO 0
|
||||
#define VERBOSE_DEBUG 1
|
||||
#define VERBOSE_TRACE 2
|
||||
int verbose;
|
||||
int quic_drop;
|
||||
/* In milliseconds */
|
||||
unsigned int seg2_delay;
|
||||
const char *domains_str;
|
||||
|
||||
39
logging.h
Normal file
39
logging.h
Normal file
@ -0,0 +1,39 @@
|
||||
#ifndef LOGGING_H
|
||||
#define LOGGING_H
|
||||
#include "config.h"
|
||||
|
||||
#define LOG_LEVEL (config.verbose)
|
||||
|
||||
#ifdef KERNEL_SPACE
|
||||
#include <linux/printk.h>
|
||||
#define printf pr_info
|
||||
#define perror pr_err
|
||||
#define lgerror(msg, ret, ...) __extension__ ({ \
|
||||
printf(msg ": %d\n", ##__VA_ARGS__, ret); \
|
||||
})
|
||||
#else
|
||||
#include <stdio.h> // IWYU pragma: export
|
||||
#include <errno.h>
|
||||
#define lgerror(msg, ret, ...) __extension__ ({ \
|
||||
errno = -(ret); \
|
||||
printf(msg ": %s\n", ##__VA_ARGS__, strerror(errno)); \
|
||||
})
|
||||
#endif /* PROGRAM_SPACE */
|
||||
|
||||
|
||||
#define lgdebugmsg(msg, ...) \
|
||||
(LOG_LEVEL >= VERBOSE_DEBUG ? printf(msg "\n", ##__VA_ARGS__) : 0)
|
||||
|
||||
#define lgtracemsg(msg, ...) \
|
||||
(LOG_LEVEL >= VERBOSE_TRACE ? printf(msg "\n", ##__VA_ARGS__) : 0)
|
||||
|
||||
#define lgtrace_start(msg, ...) \
|
||||
(LOG_LEVEL >= VERBOSE_TRACE ? printf("[TRACE] " msg " ( ", ##__VA_ARGS__) : 0)
|
||||
|
||||
#define lgtrace_addp(msg, ...) \
|
||||
(LOG_LEVEL >= VERBOSE_TRACE ? printf(msg", ", ##__VA_ARGS__) : 0)
|
||||
|
||||
#define lgtrace_end() \
|
||||
(LOG_LEVEL >= VERBOSE_TRACE ? printf(") \n") : 0)
|
||||
|
||||
#endif /* LOGGING_H */
|
||||
417
mangle.c
417
mangle.c
@ -1,33 +1,51 @@
|
||||
#include <stdlib.h>
|
||||
#define _GNU_SOURCE
|
||||
#include "types.h" // IWYU pragma: keep
|
||||
#include "mangle.h"
|
||||
#include "config.h"
|
||||
#include "utils.h"
|
||||
#include "quic.h"
|
||||
#include "logging.h"
|
||||
|
||||
#ifdef KERNEL_SPACE
|
||||
#include <linux/printk.h>
|
||||
#include <linux/ip.h>
|
||||
|
||||
#define printf pr_info
|
||||
#define perror pr_err
|
||||
#define lgerror(msg, ret) (pr_err(msg ": %d\n", ret))
|
||||
#else
|
||||
#include <stdio.h>
|
||||
#include <libnetfilter_queue/libnetfilter_queue_ipv4.h>
|
||||
#include <libnetfilter_queue/libnetfilter_queue_tcp.h>
|
||||
|
||||
typedef uint8_t __u8;
|
||||
typedef uint32_t __u32;
|
||||
typedef uint16_t __u16;
|
||||
|
||||
#define lgerror(msg, ret) __extension__ ({errno = -ret; perror(msg);})
|
||||
#ifndef KERNEL_SCOPE
|
||||
#include <stdlib.h>
|
||||
#endif
|
||||
|
||||
|
||||
int process_packet(const uint8_t *raw_payload, uint32_t raw_payload_len) {
|
||||
if (raw_payload_len > MAX_PACKET_SIZE) {
|
||||
return PKT_ACCEPT;
|
||||
}
|
||||
|
||||
const struct iphdr *iph;
|
||||
uint32_t iph_len;
|
||||
const uint8_t *ip_payload;
|
||||
uint32_t ip_payload_len;
|
||||
|
||||
int ret;
|
||||
|
||||
ret = ip4_payload_split((uint8_t *)raw_payload, raw_payload_len,
|
||||
(struct iphdr **)&iph, &iph_len,
|
||||
(uint8_t **)&ip_payload, &ip_payload_len);
|
||||
|
||||
|
||||
if (ret < 0)
|
||||
goto accept;
|
||||
|
||||
switch (iph->protocol) {
|
||||
case IPPROTO_TCP:
|
||||
return process_tcp4_packet(raw_payload, raw_payload_len);
|
||||
case IPPROTO_UDP:
|
||||
return process_udp4_packet(raw_payload, raw_payload_len);
|
||||
default:
|
||||
goto accept;
|
||||
}
|
||||
|
||||
accept:
|
||||
return PKT_ACCEPT;
|
||||
drop:
|
||||
return PKT_DROP;
|
||||
}
|
||||
|
||||
int process_tcp4_packet(const uint8_t *raw_payload, uint32_t raw_payload_len) {
|
||||
const struct iphdr *iph;
|
||||
uint32_t iph_len;
|
||||
const struct tcphdr *tcph;
|
||||
@ -46,8 +64,7 @@ int process_packet(const uint8_t *raw_payload, uint32_t raw_payload_len) {
|
||||
struct tls_verdict vrd = analyze_tls_data(data, dlen);
|
||||
|
||||
if (vrd.target_sni) {
|
||||
if (config.verbose)
|
||||
printf("Target SNI detected: %.*s\n", vrd.sni_len, data + vrd.sni_offset);
|
||||
lgdebugmsg("Target SNI detected: %.*s", vrd.sni_len, data + vrd.sni_offset);
|
||||
|
||||
uint8_t payload[MAX_PACKET_SIZE];
|
||||
uint32_t payload_len = raw_payload_len;
|
||||
@ -73,7 +90,7 @@ int process_packet(const uint8_t *raw_payload, uint32_t raw_payload_len) {
|
||||
|
||||
|
||||
if (dlen > 1480 && config.verbose) {
|
||||
printf("WARNING! Client Hello packet is too big and may cause issues!\n");
|
||||
lgdebugmsg("WARNING! Client Hello packet is too big and may cause issues!");
|
||||
}
|
||||
|
||||
if (config.fake_sni) {
|
||||
@ -136,6 +153,79 @@ drop:
|
||||
return PKT_DROP;
|
||||
}
|
||||
|
||||
int process_udp4_packet(const uint8_t *pkt, uint32_t pktlen) {
|
||||
const struct iphdr *iph;
|
||||
uint32_t iph_len;
|
||||
const struct udphdr *udph;
|
||||
const uint8_t *data;
|
||||
uint32_t dlen;
|
||||
|
||||
int ret = udp4_payload_split((uint8_t *)pkt, pktlen,
|
||||
(struct iphdr **)&iph, &iph_len,
|
||||
(struct udphdr **)&udph,
|
||||
(uint8_t **)&data, &dlen);
|
||||
|
||||
lgtrace_start("Got udp packet");
|
||||
|
||||
if (ret < 0) {
|
||||
lgtrace_addp("undefined");
|
||||
goto accept;
|
||||
}
|
||||
|
||||
if (dlen > 10 && config.verbose >= VERBOSE_TRACE) {
|
||||
printf("UDP payload start: [ ");
|
||||
for (int i = 0; i < 10; i++) {
|
||||
printf("%02x ", data[i]);
|
||||
}
|
||||
printf("], ");
|
||||
}
|
||||
|
||||
lgtrace_addp("QUIC probe");
|
||||
const struct quic_lhdr *qch;
|
||||
uint32_t qch_len;
|
||||
struct quic_cids qci;
|
||||
uint8_t *quic_raw_payload;
|
||||
uint32_t quic_raw_plen;
|
||||
ret = quic_parse_data((uint8_t *)data, dlen,
|
||||
(struct quic_lhdr **)&qch, &qch_len, &qci,
|
||||
&quic_raw_payload, &quic_raw_plen);
|
||||
|
||||
if (ret < 0) {
|
||||
lgtrace_addp("undefined type");
|
||||
goto accept;
|
||||
}
|
||||
|
||||
lgtrace_addp("QUIC detected");
|
||||
uint8_t qtype = qch->type;
|
||||
|
||||
if (config.quic_drop) {
|
||||
goto drop;
|
||||
}
|
||||
|
||||
if (qch->version == QUIC_V1)
|
||||
qtype = quic_convtype_v1(qtype);
|
||||
else if (qch->version == QUIC_V2)
|
||||
qtype = quic_convtype_v2(qtype);
|
||||
|
||||
if (qtype != QUIC_INITIAL_TYPE) {
|
||||
lgtrace_addp("quic message type: %d", qtype);
|
||||
goto accept;
|
||||
}
|
||||
|
||||
lgtrace_addp("quic initial message");
|
||||
|
||||
accept:
|
||||
lgtrace_addp("accepted");
|
||||
lgtrace_end();
|
||||
|
||||
return PKT_ACCEPT;
|
||||
drop:
|
||||
lgtrace_addp("dropped");
|
||||
lgtrace_end();
|
||||
|
||||
return PKT_DROP;
|
||||
}
|
||||
|
||||
int send_ip4_frags(const uint8_t *packet, uint32_t pktlen, const uint32_t *poses, uint32_t poses_sz, uint32_t dvs) {
|
||||
if (poses_sz == 0) {
|
||||
if (config.seg2_delay && ((dvs > 0) ^ config.frag_sni_reverse)) {
|
||||
@ -160,7 +250,7 @@ int send_ip4_frags(const uint8_t *packet, uint32_t pktlen, const uint32_t *poses
|
||||
int ret;
|
||||
|
||||
if (dvs > poses[0]) {
|
||||
printf("send_frags: Recursive dvs(%d) is more than poses0(%d)\n", dvs, poses[0]);
|
||||
lgerror("send_frags: Recursive dvs(%d) is more than poses0(%d)", -EINVAL, dvs, poses[0]);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
@ -168,8 +258,7 @@ int send_ip4_frags(const uint8_t *packet, uint32_t pktlen, const uint32_t *poses
|
||||
frag1, &f1len, frag2, &f2len);
|
||||
|
||||
if (ret < 0) {
|
||||
lgerror("send_frags: frag", ret);
|
||||
printf("Error context: packet with size %d, position: %d, recursive dvs: %d\n", pktlen, poses[0], dvs);
|
||||
lgerror("send_frags: frag: with context packet with size %d, position: %d, recursive dvs: %d", ret, pktlen, poses[0], dvs);
|
||||
return ret;
|
||||
}
|
||||
|
||||
@ -224,7 +313,7 @@ int send_tcp4_frags(const uint8_t *packet, uint32_t pktlen, const uint32_t *pose
|
||||
int ret;
|
||||
|
||||
if (dvs > poses[0]) {
|
||||
printf("send_frags: Recursive dvs(%d) is more than poses0(%d)\n", dvs, poses[0]);
|
||||
lgerror("send_frags: Recursive dvs(%d) is more than poses0(%d)", -EINVAL, dvs, poses[0]);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
@ -232,8 +321,7 @@ int send_tcp4_frags(const uint8_t *packet, uint32_t pktlen, const uint32_t *pose
|
||||
frag1, &f1len, frag2, &f2len);
|
||||
|
||||
if (ret < 0) {
|
||||
lgerror("send_frags: frag", ret);
|
||||
printf("Error context: packet with size %d, position: %d, recursive dvs: %d\n", pktlen, poses[0], dvs);
|
||||
lgerror("send_frags: frag: with context packet with size %d, position: %d, recursive dvs: %d", ret, pktlen, poses[0], dvs);
|
||||
return ret;
|
||||
}
|
||||
|
||||
@ -340,278 +428,16 @@ int post_fake_sni(const struct iphdr *iph, unsigned int iph_len,
|
||||
return 0;
|
||||
}
|
||||
|
||||
void tcp4_set_checksum(struct tcphdr *tcph, struct iphdr *iph)
|
||||
{
|
||||
#ifdef KERNEL_SPACE
|
||||
uint32_t tcp_packet_len = ntohs(iph->tot_len) - (iph->ihl << 2);
|
||||
tcph->check = 0;
|
||||
tcph->check = csum_tcpudp_magic(
|
||||
iph->saddr, iph->daddr, tcp_packet_len,
|
||||
IPPROTO_TCP,
|
||||
csum_partial(tcph, tcp_packet_len, 0));
|
||||
#else
|
||||
nfq_tcp_compute_checksum_ipv4(tcph, iph);
|
||||
#endif
|
||||
}
|
||||
|
||||
void ip4_set_checksum(struct iphdr *iph)
|
||||
{
|
||||
#ifdef KERNEL_SPACE
|
||||
iph->check = 0;
|
||||
iph->check = ip_fast_csum(iph, iph->ihl);
|
||||
#else
|
||||
nfq_ip_set_checksum(iph);
|
||||
#endif
|
||||
}
|
||||
|
||||
|
||||
int ip4_payload_split(__u8 *pkt, __u32 buflen,
|
||||
struct iphdr **iph, __u32 *iph_len,
|
||||
__u8 **payload, __u32 *plen) {
|
||||
if (pkt == NULL || buflen < sizeof(struct iphdr)) {
|
||||
lgerror("ip4_payload_split: pkt|buflen", -EINVAL);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
struct iphdr *hdr = (struct iphdr *)pkt;
|
||||
if (hdr->version != IPVERSION) {
|
||||
lgerror("ip4_payload_split: ipversion", -EINVAL);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
__u32 hdr_len = hdr->ihl * 4;
|
||||
__u32 pktlen = ntohs(hdr->tot_len);
|
||||
if (buflen < pktlen || hdr_len > pktlen) {
|
||||
lgerror("ip4_payload_split: buflen cmp pktlen", -EINVAL);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (iph)
|
||||
*iph = hdr;
|
||||
if (iph_len)
|
||||
*iph_len = hdr_len;
|
||||
if (payload)
|
||||
*payload = pkt + hdr_len;
|
||||
if (plen)
|
||||
*plen = pktlen - hdr_len;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int tcp4_payload_split(__u8 *pkt, __u32 buflen,
|
||||
struct iphdr **iph, __u32 *iph_len,
|
||||
struct tcphdr **tcph, __u32 *tcph_len,
|
||||
__u8 **payload, __u32 *plen) {
|
||||
struct iphdr *hdr;
|
||||
__u32 hdr_len;
|
||||
struct tcphdr *thdr;
|
||||
__u32 thdr_len;
|
||||
|
||||
__u8 *tcph_pl;
|
||||
__u32 tcph_plen;
|
||||
|
||||
if (ip4_payload_split(pkt, buflen, &hdr, &hdr_len,
|
||||
&tcph_pl, &tcph_plen)){
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
||||
if (
|
||||
hdr->protocol != IPPROTO_TCP ||
|
||||
tcph_plen < sizeof(struct tcphdr)) {
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
||||
thdr = (struct tcphdr *)(tcph_pl);
|
||||
thdr_len = thdr->doff * 4;
|
||||
|
||||
if (thdr_len > tcph_plen) {
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (iph) *iph = hdr;
|
||||
if (iph_len) *iph_len = hdr_len;
|
||||
if (tcph) *tcph = thdr;
|
||||
if (tcph_len) *tcph_len = thdr_len;
|
||||
if (payload) *payload = tcph_pl + thdr_len;
|
||||
if (plen) *plen = tcph_plen - thdr_len;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
// split packet to two ipv4 fragments.
|
||||
int ip4_frag(const __u8 *pkt, __u32 buflen, __u32 payload_offset,
|
||||
__u8 *frag1, __u32 *f1len,
|
||||
__u8 *frag2, __u32 *f2len) {
|
||||
|
||||
struct iphdr *hdr;
|
||||
const __u8 *payload;
|
||||
__u32 plen;
|
||||
__u32 hdr_len;
|
||||
int ret;
|
||||
|
||||
if (!frag1 || !f1len || !frag2 || !f2len)
|
||||
return -EINVAL;
|
||||
|
||||
if ((ret = ip4_payload_split(
|
||||
(__u8 *)pkt, buflen,
|
||||
&hdr, &hdr_len, (__u8 **)&payload, &plen)) < 0) {
|
||||
lgerror("ipv4_frag: TCP Header extract error", ret);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (plen <= payload_offset) {
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (payload_offset & ((1 << 3) - 1)) {
|
||||
lgerror("ipv4_frag: Payload offset MUST be a multiply of 8!", -EINVAL);
|
||||
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
__u32 f1_plen = payload_offset;
|
||||
__u32 f1_dlen = f1_plen + hdr_len;
|
||||
|
||||
__u32 f2_plen = plen - payload_offset;
|
||||
__u32 f2_dlen = f2_plen + hdr_len;
|
||||
|
||||
if (*f1len < f1_dlen || *f2len < f2_dlen) {
|
||||
return -ENOMEM;
|
||||
}
|
||||
*f1len = f1_dlen;
|
||||
*f2len = f2_dlen;
|
||||
|
||||
memcpy(frag1, hdr, hdr_len);
|
||||
memcpy(frag2, hdr, hdr_len);
|
||||
|
||||
memcpy(frag1 + hdr_len, payload, f1_plen);
|
||||
memcpy(frag2 + hdr_len, payload + payload_offset, f2_plen);
|
||||
|
||||
struct iphdr *f1_hdr = (void *)frag1;
|
||||
struct iphdr *f2_hdr = (void *)frag2;
|
||||
|
||||
__u16 f1_frag_off = ntohs(f1_hdr->frag_off);
|
||||
__u16 f2_frag_off = ntohs(f2_hdr->frag_off);
|
||||
|
||||
f1_frag_off &= IP_OFFMASK;
|
||||
f1_frag_off |= IP_MF;
|
||||
|
||||
if ((f2_frag_off & ~IP_OFFMASK) == IP_MF) {
|
||||
f2_frag_off &= IP_OFFMASK;
|
||||
f2_frag_off |= IP_MF;
|
||||
} else {
|
||||
f2_frag_off &= IP_OFFMASK;
|
||||
}
|
||||
|
||||
f2_frag_off += (__u16)payload_offset / 8;
|
||||
|
||||
f1_hdr->frag_off = htons(f1_frag_off);
|
||||
f1_hdr->tot_len = htons(f1_dlen);
|
||||
|
||||
f2_hdr->frag_off = htons(f2_frag_off);
|
||||
f2_hdr->tot_len = htons(f2_dlen);
|
||||
|
||||
|
||||
if (config.verbose)
|
||||
printf("Packet split in portion %u %u\n", f1_plen, f2_plen);
|
||||
|
||||
ip4_set_checksum(f1_hdr);
|
||||
ip4_set_checksum(f2_hdr);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
// split packet to two tcp-on-ipv4 segments.
|
||||
int tcp4_frag(const __u8 *pkt, __u32 buflen, __u32 payload_offset,
|
||||
__u8 *seg1, __u32 *s1len,
|
||||
__u8 *seg2, __u32 *s2len) {
|
||||
|
||||
struct iphdr *hdr;
|
||||
__u32 hdr_len;
|
||||
struct tcphdr *tcph;
|
||||
__u32 tcph_len;
|
||||
__u32 plen;
|
||||
const __u8 *payload;
|
||||
int ret;
|
||||
|
||||
if (!seg1 || !s1len || !seg2 || !s2len)
|
||||
return -EINVAL;
|
||||
|
||||
if ((ret = tcp4_payload_split((__u8 *)pkt, buflen,
|
||||
&hdr, &hdr_len,
|
||||
&tcph, &tcph_len,
|
||||
(__u8 **)&payload, &plen)) < 0) {
|
||||
lgerror("tcp4_frag: tcp4_payload_split", ret);
|
||||
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
||||
if (
|
||||
ntohs(hdr->frag_off) & IP_MF ||
|
||||
ntohs(hdr->frag_off) & IP_OFFMASK) {
|
||||
printf("tcp4_frag: frag value: %d\n",
|
||||
ntohs(hdr->frag_off));
|
||||
lgerror("tcp4_frag: ip fragmentation is set", -EINVAL);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
||||
if (plen <= payload_offset) {
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
__u32 s1_plen = payload_offset;
|
||||
__u32 s1_dlen = s1_plen + hdr_len + tcph_len;
|
||||
|
||||
__u32 s2_plen = plen - payload_offset;
|
||||
__u32 s2_dlen = s2_plen + hdr_len + tcph_len;
|
||||
|
||||
if (*s1len < s1_dlen || *s2len < s2_dlen)
|
||||
return -ENOMEM;
|
||||
|
||||
*s1len = s1_dlen;
|
||||
*s2len = s2_dlen;
|
||||
|
||||
memcpy(seg1, hdr, hdr_len);
|
||||
memcpy(seg2, hdr, hdr_len);
|
||||
|
||||
memcpy(seg1 + hdr_len, tcph, tcph_len);
|
||||
memcpy(seg2 + hdr_len, tcph, tcph_len);
|
||||
|
||||
memcpy(seg1 + hdr_len + tcph_len, payload, s1_plen);
|
||||
memcpy(seg2 + hdr_len + tcph_len, payload + payload_offset, s2_plen);
|
||||
|
||||
struct iphdr *s1_hdr = (void *)seg1;
|
||||
struct iphdr *s2_hdr = (void *)seg2;
|
||||
|
||||
struct tcphdr *s1_tcph = (void *)(seg1 + hdr_len);
|
||||
struct tcphdr *s2_tcph = (void *)(seg2 + hdr_len);
|
||||
|
||||
s1_hdr->tot_len = htons(s1_dlen);
|
||||
s2_hdr->tot_len = htons(s2_dlen);
|
||||
|
||||
s2_tcph->seq = htonl(ntohl(s2_tcph->seq) + payload_offset);
|
||||
|
||||
if (config.verbose)
|
||||
printf("Packet split in portion %u %u\n", s1_plen, s2_plen);
|
||||
|
||||
tcp4_set_checksum(s1_tcph, s1_hdr);
|
||||
tcp4_set_checksum(s2_tcph, s2_hdr);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#define TLS_CONTENT_TYPE_HANDSHAKE 0x16
|
||||
#define TLS_HANDSHAKE_TYPE_CLIENT_HELLO 0x01
|
||||
#define TLS_EXTENSION_SNI 0x0000
|
||||
#define TLS_EXTENSION_CLIENT_HELLO_ENCRYPTED 0xfe0d
|
||||
|
||||
typedef __u8 uint8_t;
|
||||
typedef __u32 uint32_t;
|
||||
typedef __u16 uint16_t;
|
||||
typedef uint8_t uint8_t;
|
||||
typedef uint32_t uint32_t;
|
||||
typedef uint16_t uint16_t;
|
||||
|
||||
/**
|
||||
* Processes tls payload of the tcp request.
|
||||
@ -817,8 +643,13 @@ int fail4_packet(uint8_t *payload, uint32_t plen) {
|
||||
}
|
||||
|
||||
if (config.faking_strategy == FAKE_STRAT_ACK_SEQ) {
|
||||
#ifdef KERNEL_SCOPE
|
||||
tcph->seq = 124;
|
||||
tcph->ack_seq = 124;
|
||||
#else
|
||||
tcph->seq = random();
|
||||
tcph->ack_seq = random();
|
||||
#endif
|
||||
} else if (config.faking_strategy == FAKE_STRAT_TTL) {
|
||||
iph->ttl = config.faking_ttl;
|
||||
}
|
||||
|
||||
80
mangle.h
80
mangle.h
@ -1,35 +1,7 @@
|
||||
#ifndef YU_MANGLE_H
|
||||
#define YU_MANGLE_H
|
||||
|
||||
#ifdef KERNEL_SPACE
|
||||
#include <linux/types.h>
|
||||
typedef __u8 uint8_t;
|
||||
typedef __u32 uint32_t;
|
||||
|
||||
#include <linux/string.h>
|
||||
#include <linux/errno.h>
|
||||
#include <linux/stddef.h>
|
||||
#include <linux/net.h>
|
||||
#include <linux/in.h>
|
||||
#include <linux/ip.h>
|
||||
#include <linux/tcp.h>
|
||||
|
||||
#include <asm/byteorder.h>
|
||||
|
||||
/* from <netinet/ip.h> */
|
||||
#define IP_RF 0x8000 /* reserved fragment flag */
|
||||
#define IP_DF 0x4000 /* dont fragment flag */
|
||||
#define IP_MF 0x2000 /* more fragments flag */
|
||||
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
|
||||
#else
|
||||
#define USER_SPACE
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
#include <errno.h>
|
||||
#include <arpa/inet.h>
|
||||
#include <netinet/ip.h>
|
||||
#include <netinet/tcp.h>
|
||||
#endif
|
||||
#include "types.h"
|
||||
|
||||
/**
|
||||
* Result of analyze_tls_data function
|
||||
@ -46,42 +18,6 @@ struct tls_verdict {
|
||||
*/
|
||||
struct tls_verdict analyze_tls_data(const uint8_t *data, uint32_t dlen);
|
||||
|
||||
/**
|
||||
* Splits the packet to two IP fragments on position payload_offset.
|
||||
* payload_offset indicates the position relatively to start of IP payload
|
||||
* (start of transport header)
|
||||
*/
|
||||
int ip4_frag(const uint8_t *pkt, uint32_t pktlen,
|
||||
uint32_t payload_offset,
|
||||
uint8_t *frag1, uint32_t *f1len,
|
||||
uint8_t *frag2, uint32_t *f2len);
|
||||
|
||||
/**
|
||||
* Splits the packet to two TCP segments on position payload_offset
|
||||
* payload_offset indicates the position relatively to start of TCP payload.
|
||||
*/
|
||||
int tcp4_frag(const uint8_t *pkt, uint32_t pktlen,
|
||||
uint32_t payload_offset,
|
||||
uint8_t *seg1, uint32_t *s1len,
|
||||
uint8_t *seg2, uint32_t *s2len);
|
||||
|
||||
/**
|
||||
* Splits the raw packet payload to ip header and ip payload.
|
||||
*/
|
||||
int ip4_payload_split(uint8_t *pkt, uint32_t buflen,
|
||||
struct iphdr **iph, uint32_t *iph_len,
|
||||
uint8_t **payload, uint32_t *plen);
|
||||
|
||||
/**
|
||||
* Splits the raw packet payload to ip header, tcp header and tcp payload.
|
||||
*/
|
||||
int tcp4_payload_split(uint8_t *pkt, uint32_t buflen,
|
||||
struct iphdr **iph, uint32_t *iph_len,
|
||||
struct tcphdr **tcph, uint32_t *tcph_len,
|
||||
uint8_t **payload, uint32_t *plen);
|
||||
|
||||
void tcp4_set_checksum(struct tcphdr *tcph, struct iphdr *iph);
|
||||
void ip4_set_checksum(struct iphdr *iph);
|
||||
|
||||
/**
|
||||
* Generates fake client hello message
|
||||
@ -104,6 +40,20 @@ int fail4_packet(uint8_t *payload, uint32_t plen);
|
||||
*/
|
||||
int process_packet(const uint8_t *packet, uint32_t packet_len);
|
||||
|
||||
|
||||
/**
|
||||
* Processe the TCP packet.
|
||||
* Returns verdict.
|
||||
*/
|
||||
int process_tcp4_packet(const uint8_t *raw_payload, uint32_t raw_payload_len);
|
||||
|
||||
|
||||
/**
|
||||
* Processes the UDP packet.
|
||||
* Returns verdict.
|
||||
*/
|
||||
int process_udp4_packet(const uint8_t *pkt, uint32_t pktlen);
|
||||
|
||||
/**
|
||||
* Sends fake client hello.
|
||||
*/
|
||||
|
||||
140
quic.c
Normal file
140
quic.c
Normal file
@ -0,0 +1,140 @@
|
||||
#include "quic.h"
|
||||
#include "logging.h"
|
||||
|
||||
|
||||
/**
|
||||
* Packet number.
|
||||
*/
|
||||
struct quic_pnumber {
|
||||
uint8_t d1;
|
||||
uint8_t d2;
|
||||
uint8_t d3;
|
||||
uint8_t d4;
|
||||
};
|
||||
|
||||
uint64_t quic_parse_varlength(uint8_t *variable, uint64_t *mlen) {
|
||||
if (mlen && *mlen == 0) return 0;
|
||||
uint64_t vr = (*variable & 0x3F);
|
||||
uint8_t len = 1 << (*variable >> 6);
|
||||
|
||||
if (mlen) {
|
||||
if (*mlen < len) return 0;
|
||||
*mlen = len;
|
||||
}
|
||||
|
||||
++variable;
|
||||
for (uint8_t i = 1; i < len; i++) {
|
||||
vr = (vr << 8) + *variable;
|
||||
++variable;
|
||||
}
|
||||
|
||||
return vr;
|
||||
}
|
||||
|
||||
int quic_parse_data(uint8_t *raw_payload, uint32_t raw_payload_len,
|
||||
struct quic_lhdr **qch, uint32_t *qch_len,
|
||||
struct quic_cids *qci,
|
||||
uint8_t **payload, uint32_t *plen) {
|
||||
if ( raw_payload == NULL ||
|
||||
raw_payload_len < sizeof(struct quic_lhdr))
|
||||
goto invalid_packet;
|
||||
|
||||
struct quic_lhdr *nqch = (struct quic_lhdr *)raw_payload;
|
||||
uint32_t left_len = raw_payload_len - sizeof(struct quic_lhdr);
|
||||
uint8_t *cur_rawptr = raw_payload + sizeof(struct quic_lhdr);
|
||||
if (!nqch->fixed) {
|
||||
lgtrace_addp("quic fixed uset");
|
||||
return -EPROTO;
|
||||
}
|
||||
|
||||
uint8_t found = 0;
|
||||
for (uint8_t i = 0; i < sizeof(supported_versions); i++) {
|
||||
if (ntohl(nqch->version) == supported_versions[i]) {
|
||||
found = 1;
|
||||
}
|
||||
}
|
||||
|
||||
if (!found) {
|
||||
lgtrace_addp("quic version undefined %d", ntohl(nqch->version));
|
||||
return -EPROTO;
|
||||
}
|
||||
|
||||
lgtrace_addp("quic version valid %d", ntohl(nqch->version));
|
||||
|
||||
if (left_len < 2) goto invalid_packet;
|
||||
struct quic_cids nqci = {0};
|
||||
|
||||
nqci.dst_len = *cur_rawptr++;
|
||||
left_len--;
|
||||
if (left_len < nqci.dst_len) goto invalid_packet;
|
||||
nqci.dst_id = cur_rawptr;
|
||||
cur_rawptr += nqci.dst_len;
|
||||
left_len -= nqci.dst_len;
|
||||
|
||||
nqci.src_len = *cur_rawptr++;
|
||||
left_len--;
|
||||
if (left_len < nqci.src_len) goto invalid_packet;
|
||||
nqci.src_id = cur_rawptr;
|
||||
cur_rawptr += nqci.src_len;
|
||||
left_len -= nqci.src_len;
|
||||
|
||||
if (qch) *qch = nqch;
|
||||
if (qch_len) {
|
||||
*qch_len = sizeof(struct quic_lhdr) +
|
||||
nqci.src_len + nqci.dst_len;
|
||||
}
|
||||
if (qci) *qci = nqci;
|
||||
if (payload) *payload = cur_rawptr;
|
||||
if (plen) *plen = left_len;
|
||||
|
||||
return 0;
|
||||
|
||||
invalid_packet:
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
int quic_parse_initial_message(uint8_t *inpayload, uint32_t inplen,
|
||||
const struct quic_lhdr *qch,
|
||||
struct quici_hdr *qhdr,
|
||||
uint8_t **payload, uint32_t *plen) {
|
||||
if (inplen < 3) goto invalid_packet;
|
||||
struct quici_hdr nqhdr;
|
||||
|
||||
uint8_t *cur_ptr = inpayload;
|
||||
uint32_t left_len = inplen;
|
||||
uint64_t tlen = left_len;
|
||||
|
||||
nqhdr.token_len = quic_parse_varlength(cur_ptr, &tlen);
|
||||
nqhdr.token = cur_ptr + tlen;
|
||||
|
||||
if (left_len < nqhdr.token_len + tlen)
|
||||
goto invalid_packet;
|
||||
cur_ptr += tlen + nqhdr.token_len;
|
||||
left_len -= tlen + nqhdr.token_len;
|
||||
|
||||
tlen = left_len;
|
||||
nqhdr.length = quic_parse_varlength(cur_ptr, &tlen);
|
||||
|
||||
if (left_len != nqhdr.length + tlen &&
|
||||
left_len <= qch->number_length + 1)
|
||||
goto invalid_packet;
|
||||
|
||||
uint32_t packet_number = 0;
|
||||
|
||||
for (uint8_t i = 0; i <= qch->number_length; i++) {
|
||||
packet_number = (packet_number << 8) + *cur_ptr++;
|
||||
left_len--;
|
||||
}
|
||||
|
||||
nqhdr.packet_number = packet_number;
|
||||
|
||||
if (qhdr) *qhdr = nqhdr;
|
||||
if (payload) *payload = cur_ptr;
|
||||
if (plen) *plen = left_len;
|
||||
|
||||
return 0;
|
||||
|
||||
invalid_packet:
|
||||
lgerror("QUIC invalid Initial packet", -EINVAL);
|
||||
return -EINVAL;
|
||||
}
|
||||
128
quic.h
Normal file
128
quic.h
Normal file
@ -0,0 +1,128 @@
|
||||
#ifndef QUIC_H
|
||||
#define QUIC_H
|
||||
#include "types.h"
|
||||
|
||||
|
||||
/**
|
||||
* @macro
|
||||
*
|
||||
* :macro:`NGTCP2_INITIAL_SALT_V1` is a salt value which is used to
|
||||
* derive initial secret. It is used for QUIC v1.
|
||||
*/
|
||||
#define QUIC_INITIAL_SALT_V1 \
|
||||
"\x38\x76\x2c\xf7\xf5\x59\x34\xb3\x4d\x17\x9a\xe6\xa4\xc8\x0c\xad" \
|
||||
"\xcc\xbb\x7f\x0a"
|
||||
|
||||
/**
|
||||
* @macro
|
||||
*
|
||||
* :macro:`NGTCP2_INITIAL_SALT_V2` is a salt value which is used to
|
||||
* derive initial secret. It is used for QUIC v2.
|
||||
*/
|
||||
#define QUIC_INITIAL_SALT_V2 \
|
||||
"\x0d\xed\xe3\xde\xf7\x00\xa6\xdb\x81\x93\x81\xbe\x6e\x26\x9d\xcb" \
|
||||
"\xf9\xbd\x2e\xd9"
|
||||
|
||||
#define QUIC_INITIAL_TYPE 0
|
||||
#define QUIC_0_RTT_TYPE 1
|
||||
#define QUIC_HANDSHAKE_TYPE 2
|
||||
#define QUIC_RETRY_TYPE 3
|
||||
|
||||
#define QUIC_INITIAL_TYPE_V1 0b00
|
||||
#define QUIC_0_RTT_TYPE_V1 0b01
|
||||
#define QUIC_HANDSHAKE_TYPE_V1 0b10
|
||||
#define QUIC_RETRY_TYPE_V1 0b11
|
||||
#define quic_convtype_v1(type) (type)
|
||||
|
||||
#define QUIC_INITIAL_TYPE_V2 0b01
|
||||
#define QUIC_0_RTT_TYPE_V2 0b10
|
||||
#define QUIC_HANDSHAKE_TYPE_V2 0b11
|
||||
#define QUIC_RETRY_TYPE_V2 0b00
|
||||
#define quic_convtype_v2(type) (((type) + 1) & 0b11)
|
||||
|
||||
#define QUIC_V1 1 // RFC 9000
|
||||
#define QUIC_V2 0x6b3343cf // RFC 9369
|
||||
|
||||
static const uint32_t supported_versions[] = {
|
||||
QUIC_V1,
|
||||
QUIC_V2,
|
||||
};
|
||||
|
||||
/**
|
||||
* Quic Large Header
|
||||
*/
|
||||
struct quic_lhdr {
|
||||
#if __BYTE_ORDER == __LITTLE_ENDIAN
|
||||
uint8_t number_length:2;
|
||||
uint8_t reserved:2;
|
||||
uint8_t type:2;
|
||||
uint8_t fixed:1;
|
||||
uint8_t form:1;
|
||||
#elif __BYTE_ORDER == __BIG_ENDIAN
|
||||
uint8_t form:1;
|
||||
uint8_t fixed:1;
|
||||
uint8_t type:2;
|
||||
uint8_t reserved:2;
|
||||
uint8_t number_length:2;
|
||||
#else
|
||||
#error "Undefined endian"
|
||||
#endif
|
||||
uint32_t version;
|
||||
}__attribute__((packed));
|
||||
|
||||
/**
|
||||
* Quic Large Header Ids
|
||||
* (separated from the original header because of varying dst
|
||||
*/
|
||||
struct quic_cids {
|
||||
uint8_t dst_len;
|
||||
uint8_t *dst_id;
|
||||
uint8_t src_len;
|
||||
uint8_t *src_id;
|
||||
};
|
||||
|
||||
/**
|
||||
* Parses QUIС raw data (UDP payload) to quic large header and
|
||||
* quic payload.
|
||||
*
|
||||
* \qch_len is sizeof(qch) + qci->dst_len + qci->src_id
|
||||
* \payload is Type-Specific payload (#17.2).
|
||||
*/
|
||||
int quic_parse_data(uint8_t *raw_payload, uint32_t raw_payload_len,
|
||||
struct quic_lhdr **qch, uint32_t *qch_len,
|
||||
struct quic_cids *qci,
|
||||
uint8_t **payload, uint32_t *plen);
|
||||
|
||||
|
||||
/**
|
||||
* Parses QUIC variable-length integer. (#16)
|
||||
* \variable is a pointer to the sequence to be parsed
|
||||
* (varlen integer in big endian format)
|
||||
*
|
||||
* \mlen Used to signal about variable length and validate left length
|
||||
* in the buffer.
|
||||
*/
|
||||
uint64_t quic_parse_varlength(uint8_t *variable, uint64_t *mlen);
|
||||
|
||||
// quici stands for QUIC Initial
|
||||
|
||||
/**
|
||||
* This structure should be parsed
|
||||
*/
|
||||
struct quici_hdr {
|
||||
uint64_t token_len;
|
||||
uint8_t *token;
|
||||
uint64_t length;
|
||||
uint32_t packet_number;
|
||||
};
|
||||
|
||||
/**
|
||||
* Parses QUIC initial payload.
|
||||
* \inpayload is a raw QUIC payload (payload after quic large header)
|
||||
*/
|
||||
int quic_parse_initial_message(uint8_t *inpayload, uint32_t inplen,
|
||||
const struct quic_lhdr *qch,
|
||||
struct quici_hdr *qhdr,
|
||||
uint8_t **payload, uint32_t *plen);
|
||||
|
||||
#endif /* QUIC_H */
|
||||
47
types.h
Normal file
47
types.h
Normal file
@ -0,0 +1,47 @@
|
||||
#ifndef TYPES_H
|
||||
#define TYPES_H
|
||||
#include <bits/endian.h>
|
||||
|
||||
#ifdef KERNEL_SCOPE
|
||||
#include <linux/errno.h> // IWYU pragma: export
|
||||
#include <linux/string.h> // IWYU pragma: export
|
||||
|
||||
#include <linux/types.h>
|
||||
typedef __u8 uint8_t;
|
||||
typedef __u16 uint16_t;
|
||||
typedef __u32 uint32_t;
|
||||
typedef __u64 uint64_t;
|
||||
typedef __i8 int8_t;
|
||||
typedef __i16 int16_t;
|
||||
typedef __i32 int32_t;
|
||||
typedef __i64 int64_t;
|
||||
#else /* USERSPACE_SCOPE */
|
||||
|
||||
#include <errno.h> // IWYU pragma: export
|
||||
#include <stdint.h> // IWYU pragma: export
|
||||
#include <string.h> // IWYU pragma: export
|
||||
|
||||
#endif /* SCOPES */
|
||||
|
||||
// Network specific structures
|
||||
#ifdef KERNEL_SPACE
|
||||
#include <linux/stddef.h> // IWYU pragma: export
|
||||
#include <linux/net.h> // IWYU pragma: export
|
||||
#include <linux/in.h> // IWYU pragma: export
|
||||
#include <linux/ip.h> // IWYU pragma: export
|
||||
#include <linux/tcp.h> // IWYU pragma: export
|
||||
|
||||
/* from <netinet/ip.h> */
|
||||
#define IP_RF 0x8000 /* reserved fragment flag */
|
||||
#define IP_DF 0x4000 /* dont fragment flag */
|
||||
#define IP_MF 0x2000 /* more fragments flag */
|
||||
#define IP_OFFMASK 0x1fff /* mask for fragmenting bits */
|
||||
#else
|
||||
#define USER_SPACE
|
||||
#include <arpa/inet.h> // IWYU pragma: export
|
||||
#include <netinet/ip.h> // IWYU pragma: export
|
||||
#include <netinet/tcp.h> // IWYU pragma: export
|
||||
#include <netinet/udp.h> // IWYU pragma: export
|
||||
#endif
|
||||
|
||||
#endif /* TYPES_H */
|
||||
@ -22,7 +22,7 @@ export CC CCLD LD CFLAGS LDFLAGS LIBNFNETLINK_CFLAGS LIBNFNETLINK_LIBS LIBMNL_CF
|
||||
|
||||
APP:=$(BUILD_DIR)/youtubeUnblock
|
||||
|
||||
SRCS := youtubeUnblock.c mangle.c args.c
|
||||
SRCS := youtubeUnblock.c mangle.c args.c utils.c quic.c
|
||||
OBJS := $(SRCS:%.c=$(BUILD_DIR)/%.o)
|
||||
|
||||
LIBNFNETLINK := $(DEPSDIR)/lib/libnfnetlink.a
|
||||
|
||||
312
utils.c
Normal file
312
utils.c
Normal file
@ -0,0 +1,312 @@
|
||||
#include "utils.h"
|
||||
#include "logging.h"
|
||||
|
||||
#ifdef KERNEL_SPACE
|
||||
#include <linux/ip.h>
|
||||
#else
|
||||
#include <stdlib.h>
|
||||
#include <libnetfilter_queue/libnetfilter_queue_ipv4.h>
|
||||
#include <libnetfilter_queue/libnetfilter_queue_tcp.h>
|
||||
#endif
|
||||
|
||||
|
||||
void tcp4_set_checksum(struct tcphdr *tcph, struct iphdr *iph)
|
||||
{
|
||||
#ifdef KERNEL_SPACE
|
||||
uint32_t tcp_packet_len = ntohs(iph->tot_len) - (iph->ihl << 2);
|
||||
tcph->check = 0;
|
||||
tcph->check = csum_tcpudp_magic(
|
||||
iph->saddr, iph->daddr, tcp_packet_len,
|
||||
IPPROTO_TCP,
|
||||
csum_partial(tcph, tcp_packet_len, 0));
|
||||
#else
|
||||
nfq_tcp_compute_checksum_ipv4(tcph, iph);
|
||||
#endif
|
||||
}
|
||||
|
||||
void ip4_set_checksum(struct iphdr *iph)
|
||||
{
|
||||
#ifdef KERNEL_SPACE
|
||||
iph->check = 0;
|
||||
iph->check = ip_fast_csum(iph, iph->ihl);
|
||||
#else
|
||||
nfq_ip_set_checksum(iph);
|
||||
#endif
|
||||
}
|
||||
|
||||
|
||||
int ip4_payload_split(uint8_t *pkt, uint32_t buflen,
|
||||
struct iphdr **iph, uint32_t *iph_len,
|
||||
uint8_t **payload, uint32_t *plen) {
|
||||
if (pkt == NULL || buflen < sizeof(struct iphdr)) {
|
||||
lgerror("ip4_payload_split: pkt|buflen", -EINVAL);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
struct iphdr *hdr = (struct iphdr *)pkt;
|
||||
if (hdr->version != IPVERSION) {
|
||||
lgerror("ip4_payload_split: ipversion", -EINVAL);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
uint32_t hdr_len = hdr->ihl * 4;
|
||||
uint32_t pktlen = ntohs(hdr->tot_len);
|
||||
if (buflen < pktlen || hdr_len > pktlen) {
|
||||
lgerror("ip4_payload_split: buflen cmp pktlen", -EINVAL);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (iph)
|
||||
*iph = hdr;
|
||||
if (iph_len)
|
||||
*iph_len = hdr_len;
|
||||
if (payload)
|
||||
*payload = pkt + hdr_len;
|
||||
if (plen)
|
||||
*plen = pktlen - hdr_len;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int tcp4_payload_split(uint8_t *pkt, uint32_t buflen,
|
||||
struct iphdr **iph, uint32_t *iph_len,
|
||||
struct tcphdr **tcph, uint32_t *tcph_len,
|
||||
uint8_t **payload, uint32_t *plen) {
|
||||
struct iphdr *hdr;
|
||||
uint32_t hdr_len;
|
||||
struct tcphdr *thdr;
|
||||
uint32_t thdr_len;
|
||||
|
||||
uint8_t *tcph_pl;
|
||||
uint32_t tcph_plen;
|
||||
|
||||
if (ip4_payload_split(pkt, buflen, &hdr, &hdr_len,
|
||||
&tcph_pl, &tcph_plen)){
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
||||
if (
|
||||
hdr->protocol != IPPROTO_TCP ||
|
||||
tcph_plen < sizeof(struct tcphdr)) {
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
||||
thdr = (struct tcphdr *)(tcph_pl);
|
||||
thdr_len = thdr->doff * 4;
|
||||
|
||||
if (thdr_len > tcph_plen) {
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (iph) *iph = hdr;
|
||||
if (iph_len) *iph_len = hdr_len;
|
||||
if (tcph) *tcph = thdr;
|
||||
if (tcph_len) *tcph_len = thdr_len;
|
||||
if (payload) *payload = tcph_pl + thdr_len;
|
||||
if (plen) *plen = tcph_plen - thdr_len;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int udp4_payload_split(uint8_t *pkt, uint32_t buflen,
|
||||
struct iphdr **iph, uint32_t *iph_len,
|
||||
struct udphdr **udph,
|
||||
uint8_t **payload, uint32_t *plen) {
|
||||
struct iphdr *hdr;
|
||||
uint32_t hdr_len;
|
||||
struct udphdr *uhdr;
|
||||
uint32_t uhdr_len;
|
||||
|
||||
uint8_t *ip_ph;
|
||||
uint32_t ip_phlen;
|
||||
|
||||
if (ip4_payload_split(pkt, buflen, &hdr, &hdr_len,
|
||||
&ip_ph, &ip_phlen)){
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
||||
if (
|
||||
hdr->protocol != IPPROTO_UDP ||
|
||||
ip_phlen < sizeof(struct udphdr)) {
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
||||
uhdr = (struct udphdr *)(ip_ph);
|
||||
if (uhdr->len != 0 && ntohs(uhdr->len) != ip_phlen) {
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (iph) *iph = hdr;
|
||||
if (iph_len) *iph_len = hdr_len;
|
||||
if (udph) *udph = uhdr;
|
||||
if (payload) *payload = ip_ph + sizeof(struct udphdr);
|
||||
if (plen) *plen = ip_phlen - sizeof(struct udphdr);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
// split packet to two ipv4 fragments.
|
||||
int ip4_frag(const uint8_t *pkt, uint32_t buflen, uint32_t payload_offset,
|
||||
uint8_t *frag1, uint32_t *f1len,
|
||||
uint8_t *frag2, uint32_t *f2len) {
|
||||
|
||||
struct iphdr *hdr;
|
||||
const uint8_t *payload;
|
||||
uint32_t plen;
|
||||
uint32_t hdr_len;
|
||||
int ret;
|
||||
|
||||
if (!frag1 || !f1len || !frag2 || !f2len)
|
||||
return -EINVAL;
|
||||
|
||||
if ((ret = ip4_payload_split(
|
||||
(uint8_t *)pkt, buflen,
|
||||
&hdr, &hdr_len, (uint8_t **)&payload, &plen)) < 0) {
|
||||
lgerror("ipv4_frag: TCP Header extract error", ret);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (plen <= payload_offset) {
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (payload_offset & ((1 << 3) - 1)) {
|
||||
lgerror("ipv4_frag: Payload offset MUST be a multiply of 8!", -EINVAL);
|
||||
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
uint32_t f1_plen = payload_offset;
|
||||
uint32_t f1_dlen = f1_plen + hdr_len;
|
||||
|
||||
uint32_t f2_plen = plen - payload_offset;
|
||||
uint32_t f2_dlen = f2_plen + hdr_len;
|
||||
|
||||
if (*f1len < f1_dlen || *f2len < f2_dlen) {
|
||||
return -ENOMEM;
|
||||
}
|
||||
*f1len = f1_dlen;
|
||||
*f2len = f2_dlen;
|
||||
|
||||
memcpy(frag1, hdr, hdr_len);
|
||||
memcpy(frag2, hdr, hdr_len);
|
||||
|
||||
memcpy(frag1 + hdr_len, payload, f1_plen);
|
||||
memcpy(frag2 + hdr_len, payload + payload_offset, f2_plen);
|
||||
|
||||
struct iphdr *f1_hdr = (void *)frag1;
|
||||
struct iphdr *f2_hdr = (void *)frag2;
|
||||
|
||||
uint16_t f1_frag_off = ntohs(f1_hdr->frag_off);
|
||||
uint16_t f2_frag_off = ntohs(f2_hdr->frag_off);
|
||||
|
||||
f1_frag_off &= IP_OFFMASK;
|
||||
f1_frag_off |= IP_MF;
|
||||
|
||||
if ((f2_frag_off & ~IP_OFFMASK) == IP_MF) {
|
||||
f2_frag_off &= IP_OFFMASK;
|
||||
f2_frag_off |= IP_MF;
|
||||
} else {
|
||||
f2_frag_off &= IP_OFFMASK;
|
||||
}
|
||||
|
||||
f2_frag_off += (uint16_t)payload_offset / 8;
|
||||
|
||||
f1_hdr->frag_off = htons(f1_frag_off);
|
||||
f1_hdr->tot_len = htons(f1_dlen);
|
||||
|
||||
f2_hdr->frag_off = htons(f2_frag_off);
|
||||
f2_hdr->tot_len = htons(f2_dlen);
|
||||
|
||||
|
||||
lgdebugmsg("Packet split in portion %u %u", f1_plen, f2_plen);
|
||||
|
||||
ip4_set_checksum(f1_hdr);
|
||||
ip4_set_checksum(f2_hdr);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
// split packet to two tcp-on-ipv4 segments.
|
||||
int tcp4_frag(const uint8_t *pkt, uint32_t buflen, uint32_t payload_offset,
|
||||
uint8_t *seg1, uint32_t *s1len,
|
||||
uint8_t *seg2, uint32_t *s2len) {
|
||||
|
||||
struct iphdr *hdr;
|
||||
uint32_t hdr_len;
|
||||
struct tcphdr *tcph;
|
||||
uint32_t tcph_len;
|
||||
uint32_t plen;
|
||||
const uint8_t *payload;
|
||||
int ret;
|
||||
|
||||
if (!seg1 || !s1len || !seg2 || !s2len)
|
||||
return -EINVAL;
|
||||
|
||||
if ((ret = tcp4_payload_split((uint8_t *)pkt, buflen,
|
||||
&hdr, &hdr_len,
|
||||
&tcph, &tcph_len,
|
||||
(uint8_t **)&payload, &plen)) < 0) {
|
||||
lgerror("tcp4_frag: tcp4_payload_split", ret);
|
||||
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
||||
if (
|
||||
ntohs(hdr->frag_off) & IP_MF ||
|
||||
ntohs(hdr->frag_off) & IP_OFFMASK) {
|
||||
lgdebugmsg("tcp4_frag: frag value: %d",
|
||||
ntohs(hdr->frag_off));
|
||||
lgerror("tcp4_frag: ip fragmentation is set", -EINVAL);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
||||
if (plen <= payload_offset) {
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
uint32_t s1_plen = payload_offset;
|
||||
uint32_t s1_dlen = s1_plen + hdr_len + tcph_len;
|
||||
|
||||
uint32_t s2_plen = plen - payload_offset;
|
||||
uint32_t s2_dlen = s2_plen + hdr_len + tcph_len;
|
||||
|
||||
if (*s1len < s1_dlen || *s2len < s2_dlen)
|
||||
return -ENOMEM;
|
||||
|
||||
*s1len = s1_dlen;
|
||||
*s2len = s2_dlen;
|
||||
|
||||
memcpy(seg1, hdr, hdr_len);
|
||||
memcpy(seg2, hdr, hdr_len);
|
||||
|
||||
memcpy(seg1 + hdr_len, tcph, tcph_len);
|
||||
memcpy(seg2 + hdr_len, tcph, tcph_len);
|
||||
|
||||
memcpy(seg1 + hdr_len + tcph_len, payload, s1_plen);
|
||||
memcpy(seg2 + hdr_len + tcph_len, payload + payload_offset, s2_plen);
|
||||
|
||||
struct iphdr *s1_hdr = (void *)seg1;
|
||||
struct iphdr *s2_hdr = (void *)seg2;
|
||||
|
||||
struct tcphdr *s1_tcph = (void *)(seg1 + hdr_len);
|
||||
struct tcphdr *s2_tcph = (void *)(seg2 + hdr_len);
|
||||
|
||||
s1_hdr->tot_len = htons(s1_dlen);
|
||||
s2_hdr->tot_len = htons(s2_dlen);
|
||||
|
||||
s2_tcph->seq = htonl(ntohl(s2_tcph->seq) + payload_offset);
|
||||
|
||||
lgdebugmsg("Packet split in portion %u %u", s1_plen, s2_plen);
|
||||
|
||||
tcp4_set_checksum(s1_tcph, s1_hdr);
|
||||
tcp4_set_checksum(s2_tcph, s2_hdr);
|
||||
|
||||
return 0;
|
||||
}
|
||||
51
utils.h
Normal file
51
utils.h
Normal file
@ -0,0 +1,51 @@
|
||||
#ifndef UTILS_H
|
||||
#define UTILS_H
|
||||
|
||||
#include "types.h"
|
||||
|
||||
/**
|
||||
* Splits the packet to two IP fragments on position payload_offset.
|
||||
* payload_offset indicates the position relatively to start of IP payload
|
||||
* (start of transport header)
|
||||
*/
|
||||
int ip4_frag(const uint8_t *pkt, uint32_t pktlen,
|
||||
uint32_t payload_offset,
|
||||
uint8_t *frag1, uint32_t *f1len,
|
||||
uint8_t *frag2, uint32_t *f2len);
|
||||
|
||||
/**
|
||||
* Splits the packet to two TCP segments on position payload_offset
|
||||
* payload_offset indicates the position relatively to start of TCP payload.
|
||||
*/
|
||||
int tcp4_frag(const uint8_t *pkt, uint32_t pktlen,
|
||||
uint32_t payload_offset,
|
||||
uint8_t *seg1, uint32_t *s1len,
|
||||
uint8_t *seg2, uint32_t *s2len);
|
||||
|
||||
/**
|
||||
* Splits the raw packet payload to ip header and ip payload.
|
||||
*/
|
||||
int ip4_payload_split(uint8_t *pkt, uint32_t buflen,
|
||||
struct iphdr **iph, uint32_t *iph_len,
|
||||
uint8_t **payload, uint32_t *plen);
|
||||
|
||||
/**
|
||||
* Splits the raw packet payload to ip header, tcp header and tcp payload.
|
||||
*/
|
||||
int tcp4_payload_split(uint8_t *pkt, uint32_t buflen,
|
||||
struct iphdr **iph, uint32_t *iph_len,
|
||||
struct tcphdr **tcph, uint32_t *tcph_len,
|
||||
uint8_t **payload, uint32_t *plen);
|
||||
|
||||
/**
|
||||
* Splits the raw packet payload to ip header, udp header and udp payload.
|
||||
*/
|
||||
int udp4_payload_split(uint8_t *pkt, uint32_t buflen,
|
||||
struct iphdr **iph, uint32_t *iph_len,
|
||||
struct udphdr **udph,
|
||||
uint8_t **payload, uint32_t *plen);
|
||||
|
||||
void tcp4_set_checksum(struct tcphdr *tcph, struct iphdr *iph);
|
||||
void ip4_set_checksum(struct iphdr *iph);
|
||||
|
||||
#endif /* UTILS_H */
|
||||
@ -31,6 +31,7 @@
|
||||
#include "config.h"
|
||||
#include "mangle.h"
|
||||
#include "args.h"
|
||||
#include "utils.h"
|
||||
|
||||
pthread_mutex_t rawsocket_lock;
|
||||
int rawsocket = -2;
|
||||
|
||||
Loading…
Reference in New Issue
Block a user