diff --git a/backend/test.py b/backend/test.py index e233309..a0e9dc1 100644 --- a/backend/test.py +++ b/backend/test.py @@ -46,7 +46,8 @@ class NFTableManager(Singleton): class FiregexTables(NFTableManager): - prerouting_porthijack = "porthijack" + prerouting_porthijack = "prerouting_porthijack" + postrouting_porthijack = "postrouting_porthijack" def __init__(self): super().__init__([ @@ -54,14 +55,25 @@ class FiregexTables(NFTableManager): "family":"inet", "table":self.table_name, "name":self.prerouting_porthijack, - "type":"nat", - "hook":"output", - "prio":-100, + "type":"filter", + "hook":"prerouting", + "prio":-300, + "policy":"accept" + }}}, + {"add":{"chain":{ + "family":"inet", + "table":self.table_name, + "name":self.postrouting_porthijack, + "type":"filter", + "hook":"postrouting", + "prio":-300, "policy":"accept" }}} ],[ {"flush":{"chain":{"table":self.table_name,"family":"inet", "name":self.prerouting_porthijack}}}, - {"delete":{"chain":{"table":self.table_name,"family":"inet", "name":self.prerouting_porthijack}}} + {"delete":{"chain":{"table":self.table_name,"family":"inet", "name":self.prerouting_porthijack}}}, + {"flush":{"chain":{"table":self.table_name,"family":"inet", "name":self.postrouting_porthijack}}}, + {"delete":{"chain":{"table":self.table_name,"family":"inet", "name":self.postrouting_porthijack}}} ]) def add(self, ip_int, proto, public_port, proxy_port): @@ -75,59 +87,16 @@ class FiregexTables(NFTableManager): "expr": [ {'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'daddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}}, {'match': {'left': { "payload": {"protocol": str(proto), "field": "dport"}}, "op": "==", "right": int(public_port)}}, - {'redirect' : {'port' : int(proxy_port), 'flags' : []}} + {'mangle': {'key': {'payload': {'protocol': str(proto), 'field': 'dport'}}, 'value': int(proxy_port)}} ] }}}) -""" - def add_output(self, queue_range, proto, port, ip_int): - - - def add_input(self, queue_range, proto = None, port = None, ip_int = None): - init, end = queue_range - if init > end: init, end = end, init - ip_int = ip_parse(ip_int) - ip_addr = str(ip_int).split("/")[0] - ip_addr_cidr = int(str(ip_int).split("/")[1]) - self.cmd({"insert":{"rule":{ + self.cmd({ "insert":{ "rule": { "family": "inet", "table": self.table_name, - "chain": self.input_chain, + "chain": self.postrouting_porthijack, "expr": [ - {'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'daddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}}, - {'match': {"left": { "payload": {"protocol": str(proto), "field": "dport"}}, "op": "==", "right": int(port)}}, - {"queue": {"num": str(init) if init == end else {"range":[init, end] }, "flags": ["bypass"]}} + {'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'saddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}}, + {'match': {'left': { "payload": {"protocol": str(proto), "field": "sport"}}, "op": "==", "right": int(proxy_port)}}, + {'mangle': {'key': {'payload': {'protocol': str(proto), 'field': 'sport'}}, 'value': int(public_port)}} ] }}}) - - def get(self) -> List[FiregexFilter]: - res = [] - for filter in [ele["rule"] for ele in self.list() if "rule" in ele and ele["rule"]["table"] == self.table_name]: - queue_str = filter["expr"][2]["queue"]["num"] - queue = None - if isinstance(queue_str,dict): queue = int(queue_str["range"][0]), int(queue_str["range"][1]) - else: queue = int(queue_str), int(queue_str) - ip_int = None - if isinstance(filter["expr"][0]["match"]["right"],str): - ip_int = str(ip_parse(filter["expr"][0]["match"]["right"])) - else: - ip_int = f'{filter["expr"][0]["match"]["right"]["prefix"]["addr"]}/{filter["expr"][0]["match"]["right"]["prefix"]["len"]}' - res.append(FiregexFilter( - target=filter["chain"], - id=int(filter["handle"]), - queue=queue, - proto=filter["expr"][1]["match"]["left"]["payload"]["protocol"], - port=filter["expr"][1]["match"]["right"], - ip_int=ip_int - )) - return res -""" -try: - #print(FiregexTables().list()) - FiregexTables().init() - FiregexTables().add("127.0.0.1","tcp", 8080, 8081) - input() -except: - traceback.print_exc() - FiregexTables().reset() - -#https://www.mankier.com/5/libnftables-json \ No newline at end of file