1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
|
// SPDX-FileCopyrightText: 2026 Dilluti0n <[email protected]>
// SPDX-License-Identifier: GPL-3.0-or-later
use std::sync::atomic;
use std::process::{Command, Stdio};
use std::io::Write;
use anyhow::{Result, Context, anyhow};
mod iptables;
use iptables::{IPTables, cleanup_xt_u32};
use crate::opt;
use super::INJECT_MARK;
const DPIBREAK_CHAIN: &str = "DPIBREAK";
const DPIBREAK_TABLE: &str = "dpibreak";
pub static IS_U32_SUPPORTED: atomic::AtomicBool = atomic::AtomicBool::new(false);
fn exec_process(args: &[&str], input: Option<&str>) -> Result<()> {
if args.is_empty() {
return Err(anyhow!("command args cannot be empty"));
}
let program = args[0];
let stdin_mode = if input.is_some() { Stdio::piped() } else { Stdio::null() };
let mut child = Command::new(program)
.args(&args[1..])
.stdin(stdin_mode)
.stdout(Stdio::null())
.stderr(Stdio::piped())
.spawn()
.with_context(|| format!("failed to spawn {}", program))?;
if let Some(data) = input {
if let Some(mut stdin) = child.stdin.take() {
stdin.write_all(data.as_bytes())
.with_context(|| format!("failed to write input to {}", program))?;
}
}
let output = child.wait_with_output()
.with_context(|| format!("failed to wait for {}", program))?;
match output.status.code() {
Some(0) => Ok(()),
Some(code) => Err(anyhow!("{} exited with status {}: {}", program, code,
String::from_utf8_lossy(&output.stderr))),
None => Err(anyhow!("{} terminated by signal", program))
}
}
/// Apply nft rules with `nft_command() -f -`.
fn nft(rule: &str) -> Result<()> {
crate::info!("nft: {rule}");
exec_process(&[opt::nft_command(), "-f", "-"], Some(rule))
}
pub struct InstalledRules {
is_nft_not_supported: bool,
ipt: Option<IPTables>,
ip6: Option<IPTables>
}
fn install_ipt6(is_ipv6: bool) -> Option<IPTables> {
let ipt = IPTables::new(is_ipv6).map_err(|e| crate::warn!("iptables: {e}")).ok()?;
if let Err(e) = ipt.install() {
crate::warn!("iptables: {e}");
_ = ipt.cleanup(); // partial rules
return None;
}
Some(ipt)
}
pub fn install() -> Result<InstalledRules> {
let mut is_nft_not_supported = false;
let mut ipt = None;
let mut ip6 = None;
if let Err(e) = install_nft_rules() {
is_nft_not_supported = true;
crate::warn!("nftables: {}", e.to_string());
crate::warn!("fallback to iptables");
ipt = install_ipt6(false);
ip6 = install_ipt6(true);
if ipt.is_none() && ip6.is_none() {
anyhow::bail!("failed to install rules");
}
}
Ok(InstalledRules{
is_nft_not_supported,
ipt,
ip6
})
}
impl Drop for InstalledRules {
fn drop(&mut self) {
if self.is_nft_not_supported {
if let Some(ipt) = &self.ipt {
ipt.cleanup().map_err(|e| crate::warn!("fail to cleanup iptables rules: {e}")).ok();
}
if let Some(ipt) = &self.ip6 {
ipt.cleanup().map_err(|e| crate::warn!("fail to cleanup ip6tables rules: {e}")).ok();
}
cleanup_xt_u32().map_err(|e| crate::warn!("fail to cleanup xt_u32: {e}")).ok();
} else {
nft_cleanup().map_err(|e| crate::warn!("fail to cleanup nftables rules: {e}")).ok();
}
}
}
pub fn ipt6_cleanup(is_ipv6: bool) -> Result<()> {
let ipt6 = IPTables::new(is_ipv6)?;
ipt6.cleanup()
}
pub fn nft_cleanup() -> Result<()> {
let rule = format!("delete table inet {DPIBREAK_TABLE}");
nft(&rule)?;
Ok(())
}
fn install_nft_rules() -> Result<()> {
let queue_num = opt::queue_num();
let rule = format!(
r#"add table inet {DPIBREAK_TABLE}
add chain inet {DPIBREAK_TABLE} OUTPUT {{ type filter hook output priority 0; policy accept; }}
add rule inet {DPIBREAK_TABLE} OUTPUT meta mark {INJECT_MARK} return
add rule inet {DPIBREAK_TABLE} OUTPUT tcp dport 443 @ih,0,8 0x16 @ih,40,8 0x01 queue num {queue_num} bypass"#
);
nft(&rule)?;
// clienthello filtered by nft
IS_U32_SUPPORTED.store(true, atomic::Ordering::Relaxed);
Ok(())
}
impl IPTables {
fn install(&self) -> Result<()> {
let q_num = crate::opt::queue_num().to_string();
// prevent inf loop
let mark = format!("{:#x}", INJECT_MARK);
let mut rule = vec![
"-p", "tcp", "--dport", "443",
"-j", "NFQUEUE", "--queue-num", &q_num, "--queue-bypass"
];
if iptables::is_u32_supported(self) {
const U32: &str = "0>>22&0x3C @ 12>>26&0x3C @ 0>>24&0xFF=0x16 && \
0>>22&0x3C @ 12>>26&0x3C @ 2>>24&0xFF=0x01";
rule.extend_from_slice(&["-m", "u32", "--u32", U32]);
}
self.new_chain("mangle", DPIBREAK_CHAIN)?;
self.insert(
"mangle",
DPIBREAK_CHAIN,
&["-m", "mark", "--mark", &mark, "-j", "RETURN"],
1
)?;
self.append("mangle", DPIBREAK_CHAIN, &rule)?;
crate::info!("{}: new chain {} on table mangle", self.cmd(), DPIBREAK_CHAIN);
self.insert("mangle", "POSTROUTING", &["-j", DPIBREAK_CHAIN], 1)?;
crate::info!("{}: add jump to {} chain on POSTROUTING", self.cmd(), DPIBREAK_CHAIN);
Ok(())
}
fn cleanup(&self) -> Result<()> {
if self.delete("mangle", "POSTROUTING", &["-j", DPIBREAK_CHAIN]).is_ok() {
crate::info!("{}: delete jump to {} from mangle/POSTROUTING", self.cmd(), DPIBREAK_CHAIN);
}
if self.flush_chain("mangle", DPIBREAK_CHAIN).is_ok() {
crate::info!("{}: flush chain {}", self.cmd(), DPIBREAK_CHAIN);
}
if self.delete_chain("mangle", DPIBREAK_CHAIN).is_ok() {
crate::info!("{}: delete chain {}", self.cmd(), DPIBREAK_CHAIN);
}
Ok(())
}
}
|
