-
Notifications
You must be signed in to change notification settings - Fork 51
/
nfq_linux.go
156 lines (125 loc) · 5.22 KB
/
nfq_linux.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
// +build linux
package enforcer
// Go libraries
import (
"fmt"
"strconv"
nfqueue "github.com/aporeto-inc/nfqueue-go"
"github.com/aporeto-inc/trireme/enforcer/utils/packet"
"go.uber.org/zap"
)
func errorCallback(err error, data interface{}) {
zap.L().Error("Error while processing packets on queue", zap.Error(err))
}
func networkCallback(packet *nfqueue.NFPacket, d interface{}) {
d.(*Datapath).processNetworkPacketsFromNFQ(packet)
}
func appCallBack(packet *nfqueue.NFPacket, d interface{}) {
d.(*Datapath).processApplicationPacketsFromNFQ(packet)
}
// startNetworkInterceptor will the process that processes packets from the network
// Still has one more copy than needed. Can be improved.
func (d *Datapath) startNetworkInterceptor() {
var err error
d.netStop = make([]chan bool, d.filterQueue.GetNumNetworkQueues())
for i := uint16(0); i < d.filterQueue.GetNumNetworkQueues(); i++ {
d.netStop[i] = make(chan bool)
}
nfq := make([]nfqueue.Verdict, d.filterQueue.GetNumNetworkQueues())
for i := uint16(0); i < d.filterQueue.GetNumNetworkQueues(); i++ {
// Initialize all the queues
nfq[i], err = nfqueue.CreateAndStartNfQueue(d.filterQueue.GetNetworkQueueStart()+i, d.filterQueue.GetNetworkQueueSize(), nfqueue.NfDefaultPacketSize, networkCallback, errorCallback, d)
if err != nil {
zap.L().Fatal("Unable to initialize netfilter queue", zap.Error(err))
}
go func(j uint16) {
for range d.netStop[j] {
return
}
}(i)
}
}
// startApplicationInterceptor will create a interceptor that processes
// packets originated from a local application
func (d *Datapath) startApplicationInterceptor() {
var err error
d.appStop = make([]chan bool, d.filterQueue.GetNumApplicationQueues())
for i := uint16(0); i < d.filterQueue.GetNumApplicationQueues(); i++ {
d.appStop[i] = make(chan bool)
}
nfq := make([]nfqueue.Verdict, d.filterQueue.GetNumApplicationQueues())
for i := uint16(0); i < d.filterQueue.GetNumApplicationQueues(); i++ {
nfq[i], err = nfqueue.CreateAndStartNfQueue(d.filterQueue.GetApplicationQueueStart()+i, d.filterQueue.GetApplicationQueueSize(), nfqueue.NfDefaultPacketSize, appCallBack, errorCallback, d)
if err != nil {
zap.L().Fatal("Unable to initialize netfilter queue", zap.Error(err))
}
go func(j uint16) {
for range d.appStop[j] {
return
}
}(i)
}
}
// processNetworkPacketsFromNFQ processes packets arriving from the network in an NF queue
func (d *Datapath) processNetworkPacketsFromNFQ(p *nfqueue.NFPacket) {
d.net.IncomingPackets++
// Parse the packet - drop if parsing fails
netPacket, err := packet.New(packet.PacketTypeNetwork, p.Buffer, strconv.Itoa(int(p.Mark)))
if err != nil {
d.net.CreateDropPackets++
netPacket.Print(packet.PacketFailureCreate)
} else if netPacket.IPProto == packet.IPProtocolTCP {
err = d.processNetworkTCPPackets(netPacket)
} else {
d.net.ProtocolDropPackets++
err = fmt.Errorf("Invalid IP Protocol %d", netPacket.IPProto)
}
if err != nil {
length := uint32(len(p.Buffer))
buffer := p.Buffer
p.QueueHandle.SetVerdict2(uint32(p.QueueHandle.QueueNum), 0, uint32(p.Mark), length, uint32(p.ID), buffer)
return
}
// // Accept the packet
buffer := make([]byte, len(netPacket.Buffer)+netPacket.TCPOptionLength()+netPacket.TCPDataLength())
copyIndex := copy(buffer, netPacket.Buffer)
copyIndex += copy(buffer[copyIndex:], netPacket.GetTCPOptions())
copyIndex += copy(buffer[copyIndex:], netPacket.GetTCPData())
// buffer = append(buffer, netPacket.GetTCPOptions()...)
// buffer = append(buffer, netPacket.GetTCPData()...)
// length = uint32(len(buffer))
p.QueueHandle.SetVerdict2(uint32(p.QueueHandle.QueueNum), 1, uint32(p.Mark), uint32(copyIndex), uint32(p.ID), buffer)
}
// processApplicationPackets processes packets arriving from an application and are destined to the network
func (d *Datapath) processApplicationPacketsFromNFQ(p *nfqueue.NFPacket) {
d.app.IncomingPackets++
// Being liberal on what we transmit - malformed TCP packets are let go
// We are strict on what we accept on the other side, but we don't block
// lots of things at the ingress to the network
appPacket, err := packet.New(packet.PacketTypeApplication, p.Buffer, strconv.Itoa(int(p.Mark)))
if err != nil {
d.app.CreateDropPackets++
appPacket.Print(packet.PacketFailureCreate)
} else if appPacket.IPProto == packet.IPProtocolTCP {
err = d.processApplicationTCPPackets(appPacket)
} else {
d.app.ProtocolDropPackets++
err = fmt.Errorf("Invalid IP Protocol %d", appPacket.IPProto)
}
if err != nil {
length := uint32(len(p.Buffer))
buffer := p.Buffer
p.QueueHandle.SetVerdict2(uint32(p.QueueHandle.QueueNum), 0, uint32(p.Mark), length, uint32(p.ID), buffer)
return
}
// Accept the packet
buffer := make([]byte, len(appPacket.Buffer)+appPacket.TCPOptionLength()+appPacket.TCPDataLength())
copyIndex := copy(buffer, appPacket.Buffer)
copyIndex += copy(buffer[copyIndex:], appPacket.GetTCPOptions())
copyIndex += copy(buffer[copyIndex:], appPacket.GetTCPData())
// buffer := appPacket.Buffer
// buffer = append(buffer, appPacket.GetTCPOptions()...)
// buffer = append(buffer, appPacket.GetTCPData()...)
// length = uint32(len(buffer))
p.QueueHandle.SetVerdict2(uint32(p.QueueHandle.QueueNum), 1, uint32(p.Mark), uint32(copyIndex), uint32(p.ID), buffer)
}