From 956bc5ab062b7fa213b4fa085d4fbac76a7131af Mon Sep 17 00:00:00 2001 From: wangyu Date: Fri, 4 Aug 2017 21:46:49 +0800 Subject: [PATCH] changed iptables -A to -I, auth_mode: simple --- common.cpp | 2 +- encrypt.cpp | 50 ++++++++++++++++++++++++++++++++++---------------- encrypt.h | 2 +- main.cpp | 50 +++++++++++++++++++++++++++++++++++++++++--------- network.cpp | 12 +++++++----- 5 files changed, 84 insertions(+), 32 deletions(-) diff --git a/common.cpp b/common.cpp index 3862dbf..28959ce 100644 --- a/common.cpp +++ b/common.cpp @@ -52,7 +52,7 @@ char * my_ntoa(u32_t ip) int add_iptables_rule(char * s) { strcpy(iptables_rule,s); - char buf[300]="iptables -A "; + char buf[300]="iptables -I "; strcat(buf,s); if(system(buf)==0) { diff --git a/encrypt.cpp b/encrypt.cpp index abcbc5b..6330baa 100755 --- a/encrypt.cpp +++ b/encrypt.cpp @@ -13,11 +13,11 @@ static int8_t zero_iv[]={0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0};//this prog use zero iv,you should make sure first block of data contains a random/nonce data -unordered_map auth_mode_tostring = {{auth_none, "none"}, {auth_md5, "md5"}, {auth_crc32, "crc32"},{auth_sum,"sum"}}; +unordered_map auth_mode_tostring = {{auth_none, "none"}, {auth_md5, "md5"}, {auth_crc32, "crc32"},{auth_simple,"simple"}}; unordered_map cipher_mode_tostring={{cipher_none,"none"},{cipher_aes128cbc,"aes128cbc"},{cipher_xor,"xor"}}; -auth_mode_t auth_mode=auth_sum; -cipher_mode_t cipher_mode=cipher_xor; +auth_mode_t auth_mode=auth_crc32; +cipher_mode_t cipher_mode=cipher_aes128cbc; /* @@ -45,7 +45,7 @@ unsigned int crc32h(unsigned char *message,int len) { return ~crc; } - +/* void sum(const unsigned char *data,int len,unsigned char* res) { memset(res,0,sizeof(int)); for(int i=0,j=0;i avaliable values:faketcp,udp,icmp\n"); printf(" -k,--key password to gen symetric key\n"); printf(" --auth-mode avaliable values:aes128cbc(default),xor,none\n"); - printf(" --cipher-mode avaliable values:md5(default),crc32,sum,none\n"); + printf(" --cipher-mode avaliable values:md5(default),crc32,simple,none\n"); printf(" -a,--auto-add auto add (and delete) iptables rule\n"); printf(" --disable-anti-replay disable anti-replay,not suggested"); @@ -2304,6 +2304,7 @@ void process_arg(int argc, char *argv[]) {"disable-anti-replay", no_argument, 0, 1}, {"auto-add", no_argument, 0, 'a'}, {"debug", no_argument, 0, 1}, + {"clear", no_argument, 0, 1}, {"sock-buf", required_argument, 0, 1}, {"seq-mode", required_argument, 0, 1}, {NULL, 0, 0, 0} @@ -2363,18 +2364,29 @@ void process_arg(int argc, char *argv[]) no_l = 0; if (strchr(optarg, ':') != 0) { sscanf(optarg, "%[^:]:%d", local_address, &local_port); + if(local_port==22) + { + mylog(log_fatal,"port 22 not allowed\n"); + myexit(-1); + } } else { - strcpy(local_address, "127.0.0.1"); - sscanf(optarg, "%d", &local_port); + mylog(log_fatal,"invalid parameter for -l ,%s,should be ip:port\n",optarg); + myexit(-1); + } break; case 'r': no_r = 0; if (strchr(optarg, ':') != 0) { sscanf(optarg, "%[^:]:%d", remote_address, &remote_port); + if(remote_port==22) + { + mylog(log_fatal,"port 22 not allowed\n"); + myexit(-1); + } } else { - strcpy(remote_address, "127.0.0.1"); - sscanf(optarg, "%d", &remote_port); + mylog(log_fatal,"invalid parameter for -r ,%s,should be ip:port\n",optarg); + myexit(-1); } break; case 's': @@ -2410,7 +2422,15 @@ void process_arg(int argc, char *argv[]) break; case 1: mylog(log_debug,"option_index: %d\n",option_index); - if(strcmp(long_options[option_index].name,"source-ip")==0) + if(strcmp(long_options[option_index].name,"clear")==0) + { + system("iptables-save |grep udp2raw_dWRwMnJhdw|sed -n 's/^-A/iptables -D/p'|sh"); + //system("iptables-save |grep udp2raw_dWRwMnJhdw|sed 's/^-A/iptables -D/'|sh"); + //system("iptables-save|grep -v udp2raw_dWRwMnJhdw|iptables-restore"); + mylog(log_info,"tried to clear all iptables rule created previously"); + myexit(-1); + } + else if(strcmp(long_options[option_index].name,"source-ip")==0) { mylog(log_debug,"parsing long option :source-ip\n"); sscanf(optarg, "%s", source_address); @@ -2620,16 +2640,28 @@ void iptables_warn() } if(auto_add_iptables_rule) { - strcat(rule," -m comment --comment udp2raw_added_"); + strcat(rule," -m comment --comment udp2raw_dWRwMnJhdw_"); + char const_id_str[100]; - sprintf(const_id_str,"%x",const_id); + sprintf(const_id_str,"%x_",const_id); + strcat(rule,const_id_str); + time_t timer; + char buffer[26]; + struct tm* tm_info; + + time(&timer); + tm_info = localtime(&timer); + + strftime(buffer, 26, "%Y-%m-%d-%H:%M:%S", tm_info); + + strcat(rule,buffer); add_iptables_rule(rule); } else { - mylog(log_warn,"make sure you have run once: iptables -A %s\n",rule); + mylog(log_warn,"make sure you have run once: iptables -I %s\n",rule); } } int main(int argc, char *argv[]) diff --git a/network.cpp b/network.cpp index 2178a71..8f9f945 100644 --- a/network.cpp +++ b/network.cpp @@ -1051,13 +1051,10 @@ int recv_raw_tcp(raw_info_t &raw_info,char * &payload,int &payloadlen) } else { - mylog(log_info,"tcph->doff= %u\n",tcph->doff); - } - if(tcph->rst==1) - { - mylog(log_error,"rst==1\n"); + //mylog(log_info,"tcph->doff= %u\n",tcph->doff); } + recv_info.ack=tcph->ack; recv_info.syn=tcph->syn; recv_info.rst=tcph->rst; @@ -1068,6 +1065,11 @@ int recv_raw_tcp(raw_info_t &raw_info,char * &payload,int &payloadlen) recv_info.ack_seq=ntohl(tcph->ack_seq); recv_info.psh=tcph->psh; + if(tcph->rst==1) + { + mylog(log_error,"[%s,%d]rst==1\n",my_ntoa(recv_info.src_ip),recv_info.src_port); + } + /* if(recv_info.has_ts) { send_info.ts_ack=recv_info.ts; //////////////////////////////////////////////modify