End of test for port-hijacking

backend/test.py

@@ -46,7 +46,8 @@ class NFTableManager(Singleton):
 
 
 class FiregexTables(NFTableManager):
-    prerouting_porthijack = "porthijack"
+    prerouting_porthijack = "prerouting_porthijack"
+    postrouting_porthijack = "postrouting_porthijack"
     
     def __init__(self):
         super().__init__([
@@ -54,14 +55,25 @@ class FiregexTables(NFTableManager):
                 "family":"inet",
                 "table":self.table_name,
                 "name":self.prerouting_porthijack,
-                "type":"nat",
+                "type":"filter",
-                "hook":"output",
+                "hook":"prerouting",
-                "prio":-100,
+                "prio":-300,
+                "policy":"accept"
+            }}},
+            {"add":{"chain":{
+                "family":"inet",
+                "table":self.table_name,
+                "name":self.postrouting_porthijack,
+                "type":"filter",
+                "hook":"postrouting",
+                "prio":-300,
                 "policy":"accept"
             }}}
         ],[
             {"flush":{"chain":{"table":self.table_name,"family":"inet", "name":self.prerouting_porthijack}}},
-            {"delete":{"chain":{"table":self.table_name,"family":"inet", "name":self.prerouting_porthijack}}}
+            {"delete":{"chain":{"table":self.table_name,"family":"inet", "name":self.prerouting_porthijack}}},
+            {"flush":{"chain":{"table":self.table_name,"family":"inet", "name":self.postrouting_porthijack}}},
+            {"delete":{"chain":{"table":self.table_name,"family":"inet", "name":self.postrouting_porthijack}}}
         ])
 
     def add(self, ip_int, proto, public_port, proxy_port):
@@ -75,59 +87,16 @@ class FiregexTables(NFTableManager):
             "expr": [
                     {'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'daddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}},
                     {'match': {'left': { "payload": {"protocol": str(proto), "field": "dport"}}, "op": "==", "right": int(public_port)}},
-                    {'redirect' : {'port' : int(proxy_port), 'flags' : []}}
+                    {'mangle': {'key': {'payload': {'protocol': str(proto), 'field': 'dport'}}, 'value': int(proxy_port)}}
                 ]
         }}})
-"""
-    def add_output(self, queue_range, proto, port, ip_int):
-
-
-    def add_input(self, queue_range, proto = None, port = None, ip_int = None):
-        init, end = queue_range
-        if init > end: init, end = end, init
-        ip_int = ip_parse(ip_int)
-        ip_addr = str(ip_int).split("/")[0]
-        ip_addr_cidr = int(str(ip_int).split("/")[1])
         self.cmd({ "insert":{ "rule": {
             "family": "inet",
             "table": self.table_name,
-            "chain": self.input_chain,
+            "chain": self.postrouting_porthijack,
             "expr": [
-                    {'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'daddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}},
+                    {'match': {'left': {'payload': {'protocol': ip_family(ip_int), 'field': 'saddr'}}, 'op': '==', 'right': {"prefix": {"addr": ip_addr, "len": ip_addr_cidr}}}},
-                    {'match': {"left": { "payload": {"protocol": str(proto), "field": "dport"}}, "op": "==", "right": int(port)}},
+                    {'match': {'left': { "payload": {"protocol": str(proto), "field": "sport"}}, "op": "==", "right": int(proxy_port)}},
-                    {"queue": {"num": str(init) if init == end else {"range":[init, end] }, "flags": ["bypass"]}}
+                    {'mangle': {'key': {'payload': {'protocol': str(proto), 'field': 'sport'}}, 'value': int(public_port)}}
                 ]
         }}})
-
-    def get(self) -> List[FiregexFilter]:
-        res = []
-        for filter in [ele["rule"] for ele in self.list() if "rule" in ele and ele["rule"]["table"] == self.table_name]:
-            queue_str = filter["expr"][2]["queue"]["num"]
-            queue = None
-            if isinstance(queue_str,dict): queue = int(queue_str["range"][0]), int(queue_str["range"][1])
-            else: queue = int(queue_str), int(queue_str)
-            ip_int = None
-            if isinstance(filter["expr"][0]["match"]["right"],str):
-                ip_int = str(ip_parse(filter["expr"][0]["match"]["right"]))
-            else:
-                ip_int = f'{filter["expr"][0]["match"]["right"]["prefix"]["addr"]}/{filter["expr"][0]["match"]["right"]["prefix"]["len"]}'
-            res.append(FiregexFilter(
-                target=filter["chain"],
-                id=int(filter["handle"]),
-                queue=queue,
-                proto=filter["expr"][1]["match"]["left"]["payload"]["protocol"],
-                port=filter["expr"][1]["match"]["right"],
-                ip_int=ip_int
-            ))
-        return res
-"""
-try:
-    #print(FiregexTables().list())
-    FiregexTables().init()
-    FiregexTables().add("127.0.0.1","tcp", 8080, 8081)
-    input()
-except:
-    traceback.print_exc()
-    FiregexTables().reset()
-
-#https://www.mankier.com/5/libnftables-json