diff options
Diffstat (limited to 'src/platform')
| -rw-r--r-- | src/platform/linux/nftables.rs | 35 |
1 files changed, 33 insertions, 2 deletions
diff --git a/src/platform/linux/nftables.rs b/src/platform/linux/nftables.rs index 4809000..acc6163 100644 --- a/src/platform/linux/nftables.rs +++ b/src/platform/linux/nftables.rs @@ -17,11 +17,42 @@ fn nft(rule: &str) -> Result<()> { pub fn install_nft_rules() -> Result<()> { let queue_num = opt::queue_num(); + + // 0,8: TLSPlaintext.type = 0x16 (handshake) + // 8,8: TLSPlaintext.legacy_record_version[0] + // 40,8: Handshake.msg_type = 0x1 (client_hello) + // 72,8: ClientHello.legacy_version[0] + // + // From RFC 8446: + // legacy_record_version: MUST be set to 0x0303 for all records + // generated by a TLS 1.3 implementation other than an initial + // ClientHello (i.e., one not generated after a HelloRetryRequest), + // where it MAY also be 0x0301 for compatibility purposes. This + // field is deprecated and MUST be ignored for all purposes. + // Previous versions of TLS would use other values in this field + // under some circumstances. + // + // legacy_version: In previous versions of TLS, this field was used for + // version negotiation and represented the highest version number + // supported by the client. Experience has shown that many servers + // do not properly implement version negotiation, leading to "version + // intolerance" in which the server rejects an otherwise acceptable + // ClientHello with a version number higher than it supports. In + // TLS 1.3, the client indicates its version preferences in the + // "supported_versions" extension (Section 4.2.1) and the + // legacy_version field MUST be set to 0x0303, which is the version + // number for TLS 1.2. TLS 1.3 ClientHellos are identified as having + // a legacy_version of 0x0303 and a supported_versions extension + // present with 0x0304 as the highest version indicated therein. + // (See Appendix D for details about backward compatibility.) + // + // long things short, either can be 0x0303 or 0x0301 (for + // legacy_version, 0x0302 too) let rule = format!( - r#"add table inet {DPIBREAK_TABLE} + r#"add table inet {DPIBREAK_TABLE} add chain inet {DPIBREAK_TABLE} OUTPUT {{ type filter hook output priority 0; policy accept; }} add rule inet {DPIBREAK_TABLE} OUTPUT meta mark {INJECT_MARK} return -add rule inet {DPIBREAK_TABLE} OUTPUT tcp dport 443 @ih,0,8 0x16 @ih,40,8 0x01 queue num {queue_num} bypass"# +add rule inet {DPIBREAK_TABLE} OUTPUT tcp dport 443 @ih,0,8 0x16 @ih,8,8 0x03 @ih,40,8 0x01 @ih,72,8 0x03 queue num {queue_num} bypass"# ); nft(&rule)?; |