mirror of https://github.com/ValdikSS/GoodbyeDPI
Browse Source
This is a per-connection (per-destination) automatic TTL adjusting feature.
Basically a --set-ttl mode where you don't need to set specific TTL value.
It works as follows:
1. All incoming SYN/ACKs (the response to client's SYN) are intercepted
2. TTL value is extracted from SYN/ACK
3. New TTL is calculated with the simple formula:
128 > extracted_ttl > 64: // Server is running Windows
fakepacket_ttl = 128 - extracted_ttl - decrement
64 > extracted_ttl > 34: // Server is running Linux/FreeBSD/other
fakepacket_ttl = 64 - extracted_ttl - decrement
4. Fake packet is sent
To comply with the multi-path multi-hop server connections
where 1 hop dispersion is not rare, decrement should be at least of
value "2", which is the default.
The patch does not process "too strange" TTL values (bigger than 128,
less than 34).
windivert2
ValdikSS
3 years ago
4 changed files with 330 additions and 14 deletions
@ -0,0 +1,235 @@ |
|||
/**
|
|||
* TCP (TTL) Connection Tracker for GoodbyeDPI |
|||
* |
|||
* Monitors SYN/ACK only, to extract the TTL value of the remote server. |
|||
* |
|||
*/ |
|||
|
|||
#include <windows.h> |
|||
#include <time.h> |
|||
#include <stdio.h> |
|||
#include "goodbyedpi.h" |
|||
#include "ttltrack.h" |
|||
#include "utils/uthash.h" |
|||
|
|||
|
|||
/* key ('4' for IPv4 or '6' for IPv6 + srcip[16] + dstip[16] + srcport[2] + dstport[2]) */ |
|||
#define TCP_CONNRECORD_KEY_LEN 37 |
|||
|
|||
#define TCP_CLEANUP_INTERVAL_SEC 30 |
|||
|
|||
/* HACK!
|
|||
* uthash uses strlen() for HASH_FIND_STR. |
|||
* We have null bytes in our key, so we can't use strlen() |
|||
* And since it's always TCP_CONNRECORD_KEY_LEN bytes long, |
|||
* we don't need to use any string function to determine length. |
|||
*/ |
|||
#undef uthash_strlen |
|||
#define uthash_strlen(s) TCP_CONNRECORD_KEY_LEN |
|||
|
|||
typedef struct tcp_connrecord { |
|||
/* key ('4' for IPv4 or '6' for IPv6 + srcip[16] + dstip[16] + srcport[2] + dstport[2]) */ |
|||
char key[TCP_CONNRECORD_KEY_LEN]; |
|||
time_t time; /* time when this record was added */ |
|||
uint16_t ttl; |
|||
UT_hash_handle hh; /* makes this structure hashable */ |
|||
} tcp_connrecord_t; |
|||
|
|||
static time_t last_cleanup = 0; |
|||
static tcp_connrecord_t *conntrack = NULL; |
|||
|
|||
inline static void fill_key_data(char *key, const uint8_t is_ipv6, const uint32_t srcip[4], |
|||
const uint32_t dstip[4], const uint16_t srcport, const uint16_t dstport) |
|||
{ |
|||
int offset = 0; |
|||
|
|||
if (is_ipv6) { |
|||
*(uint8_t*)(key) = '6'; |
|||
offset += sizeof(uint8_t); |
|||
ipv6_copy_addr((uint32_t*)(key + offset), srcip); |
|||
offset += sizeof(uint32_t) * 4; |
|||
ipv6_copy_addr((uint32_t*)(key + offset), dstip); |
|||
offset += sizeof(uint32_t) * 4; |
|||
} |
|||
else { |
|||
*(uint8_t*)(key) = '4'; |
|||
offset += sizeof(uint8_t); |
|||
ipv4_copy_addr((uint32_t*)(key + offset), srcip); |
|||
offset += sizeof(uint32_t) * 4; |
|||
ipv4_copy_addr((uint32_t*)(key + offset), dstip); |
|||
offset += sizeof(uint32_t) * 4; |
|||
} |
|||
|
|||
*(uint16_t*)(key + offset) = srcport; |
|||
offset += sizeof(srcport); |
|||
*(uint16_t*)(key + offset) = dstport; |
|||
offset += sizeof(dstport); |
|||
} |
|||
|
|||
inline static void fill_data_from_key(uint8_t *is_ipv6, uint32_t srcip[4], uint32_t dstip[4], |
|||
uint16_t *srcport, uint16_t *dstport, const char *key) |
|||
{ |
|||
int offset = 0; |
|||
|
|||
if (key[0] == '6') { |
|||
*is_ipv6 = 1; |
|||
offset += sizeof(uint8_t); |
|||
ipv6_copy_addr(srcip, (uint32_t*)(key + offset)); |
|||
offset += sizeof(uint32_t) * 4; |
|||
ipv6_copy_addr(dstip, (uint32_t*)(key + offset)); |
|||
offset += sizeof(uint32_t) * 4; |
|||
} |
|||
else { |
|||
*is_ipv6 = 0; |
|||
offset += sizeof(uint8_t); |
|||
ipv4_copy_addr(srcip, (uint32_t*)(key + offset)); |
|||
offset += sizeof(uint32_t) * 4; |
|||
ipv4_copy_addr(dstip, (uint32_t*)(key + offset)); |
|||
offset += sizeof(uint32_t) * 4; |
|||
} |
|||
*srcport = *(uint16_t*)(key + offset); |
|||
offset += sizeof(*srcport); |
|||
*dstport = *(uint16_t*)(key + offset); |
|||
offset += sizeof(*dstport); |
|||
} |
|||
|
|||
inline static void construct_key(const uint32_t srcip[4], const uint32_t dstip[4], |
|||
const uint16_t srcport, const uint16_t dstport, |
|||
char *key, const uint8_t is_ipv6) |
|||
{ |
|||
debug("Construct key enter\n"); |
|||
if (key) { |
|||
debug("Constructing key\n"); |
|||
fill_key_data(key, is_ipv6, srcip, dstip, srcport, dstport); |
|||
} |
|||
debug("Construct key end\n"); |
|||
} |
|||
|
|||
inline static void deconstruct_key(const char *key, const tcp_connrecord_t *connrecord, |
|||
tcp_conntrack_info_t *conn_info) |
|||
{ |
|||
debug("Deconstruct key enter\n"); |
|||
if (key && conn_info) { |
|||
debug("Deconstructing key\n"); |
|||
fill_data_from_key(&conn_info->is_ipv6, |
|||
conn_info->srcip, conn_info->dstip, |
|||
&conn_info->srcport, &conn_info->dstport, |
|||
key); |
|||
|
|||
conn_info->ttl = connrecord->ttl; |
|||
} |
|||
debug("Deconstruct key end\n"); |
|||
} |
|||
|
|||
static int check_get_tcp_conntrack_key(const char *key, tcp_connrecord_t **connrecord) { |
|||
tcp_connrecord_t *tmp_connrecord = NULL; |
|||
if (!conntrack) return FALSE; |
|||
|
|||
HASH_FIND_STR(conntrack, key, tmp_connrecord); |
|||
if (tmp_connrecord) { |
|||
if (connrecord) |
|||
*connrecord = tmp_connrecord; |
|||
debug("check_get_tcp_conntrack_key found key\n"); |
|||
return TRUE; |
|||
} |
|||
debug("check_get_tcp_conntrack_key key not found\n"); |
|||
return FALSE; |
|||
} |
|||
|
|||
static int add_tcp_conntrack(const uint32_t srcip[4], const uint32_t dstip[4], |
|||
const uint16_t srcport, const uint16_t dstport, |
|||
const uint8_t is_ipv6, const uint8_t ttl |
|||
) |
|||
{ |
|||
if (!(srcip && srcport && dstip && dstport)) |
|||
return FALSE; |
|||
|
|||
tcp_connrecord_t *tmp_connrecord = malloc(sizeof(tcp_connrecord_t)); |
|||
construct_key(srcip, dstip, srcport, dstport, tmp_connrecord->key, is_ipv6); |
|||
|
|||
if (!check_get_tcp_conntrack_key(tmp_connrecord->key, NULL)) { |
|||
tmp_connrecord->time = time(NULL); |
|||
tmp_connrecord->ttl = ttl; |
|||
HASH_ADD_STR(conntrack, key, tmp_connrecord); |
|||
debug("Added TCP conntrack %u:%hu - %u:%hu\n", srcip[0], ntohs(srcport), dstip[0], ntohs(dstport)); |
|||
return TRUE; |
|||
} |
|||
debug("Not added TCP conntrack %u:%hu - %u:%hu\n", srcip[0], ntohs(srcport), dstip[0], ntohs(dstport)); |
|||
free(tmp_connrecord); |
|||
return FALSE; |
|||
} |
|||
|
|||
static void tcp_cleanup() { |
|||
tcp_connrecord_t *tmp_connrecord, *tmp_connrecord2 = NULL; |
|||
|
|||
if (last_cleanup == 0) { |
|||
last_cleanup = time(NULL); |
|||
return; |
|||
} |
|||
|
|||
if (difftime(time(NULL), last_cleanup) >= TCP_CLEANUP_INTERVAL_SEC) { |
|||
last_cleanup = time(NULL); |
|||
|
|||
HASH_ITER(hh, conntrack, tmp_connrecord, tmp_connrecord2) { |
|||
if (difftime(last_cleanup, tmp_connrecord->time) >= TCP_CLEANUP_INTERVAL_SEC) { |
|||
HASH_DEL(conntrack, tmp_connrecord); |
|||
free(tmp_connrecord); |
|||
} |
|||
} |
|||
} |
|||
} |
|||
|
|||
int tcp_handle_incoming(const uint32_t srcip[4], const uint32_t dstip[4], |
|||
const uint16_t srcport, const uint16_t dstport, |
|||
const uint8_t is_ipv6, const uint8_t ttl) |
|||
{ |
|||
tcp_cleanup(); |
|||
|
|||
debug("trying to add TCP srcport = %hu, dstport = %hu\n", ntohs(srcport), ntohs(dstport)); |
|||
return add_tcp_conntrack(srcip, dstip, srcport, dstport, is_ipv6, ttl); |
|||
|
|||
debug("____tcp_handle_incoming FALSE: srcport = %hu, dstport = %hu\n", ntohs(srcport), ntohs(dstport)); |
|||
return FALSE; |
|||
} |
|||
|
|||
int tcp_handle_outgoing(const uint32_t srcip[4], const uint32_t dstip[4], |
|||
const uint16_t srcport, const uint16_t dstport, |
|||
tcp_conntrack_info_t *conn_info, |
|||
const uint8_t is_ipv6) |
|||
{ |
|||
char key[TCP_CONNRECORD_KEY_LEN]; |
|||
tcp_connrecord_t *tmp_connrecord = NULL; |
|||
|
|||
if (!conn_info) |
|||
return FALSE; |
|||
|
|||
tcp_cleanup(); |
|||
construct_key(dstip, srcip, dstport, srcport, key, is_ipv6); |
|||
if (check_get_tcp_conntrack_key(key, &tmp_connrecord) && tmp_connrecord) { |
|||
/* Connection exists in conntrack, moving on */ |
|||
deconstruct_key(key, tmp_connrecord, conn_info); |
|||
HASH_DEL(conntrack, tmp_connrecord); |
|||
free(tmp_connrecord); |
|||
debug("____tcp_handle_outgoing TRUE: srcport = %hu\n", ntohs(srcport)); |
|||
return TRUE; |
|||
} |
|||
|
|||
debug("____tcp_handle_outgoing FALSE: srcport = %hu\n", ntohs(srcport)); |
|||
return FALSE; |
|||
} |
|||
|
|||
int tcp_get_auto_ttl(const uint8_t ttl, const uint8_t decrease_for) { |
|||
uint8_t ttl_of_fake_packet = 0; |
|||
|
|||
if (ttl > 64 && ttl < 128) { |
|||
ttl_of_fake_packet = 128 - ttl - decrease_for; |
|||
} |
|||
else if (ttl > 34 && ttl < 64) { |
|||
ttl_of_fake_packet = 64 - ttl - decrease_for; |
|||
} |
|||
else { |
|||
ttl_of_fake_packet = 0; |
|||
} |
|||
|
|||
return ttl_of_fake_packet; |
|||
} |
|||
@ -0,0 +1,25 @@ |
|||
#ifndef _TTLTRACK_H |
|||
#define _TTLTRACK_H |
|||
#include <stdint.h> |
|||
#include "dnsredir.h" |
|||
|
|||
typedef struct tcp_conntrack_info { |
|||
uint8_t is_ipv6; |
|||
uint8_t ttl; |
|||
uint32_t srcip[4]; |
|||
uint16_t srcport; |
|||
uint32_t dstip[4]; |
|||
uint16_t dstport; |
|||
} tcp_conntrack_info_t; |
|||
|
|||
int tcp_handle_incoming(const uint32_t srcip[4], const uint32_t dstip[4], |
|||
const uint16_t srcport, const uint16_t dstport, |
|||
const uint8_t is_ipv6, const uint8_t ttl); |
|||
|
|||
int tcp_handle_outgoing(const uint32_t srcip[4], const uint32_t dstip[4], |
|||
const uint16_t srcport, const uint16_t dstport, |
|||
tcp_conntrack_info_t *conn_info, |
|||
const uint8_t is_ipv6); |
|||
|
|||
int tcp_get_auto_ttl(const uint8_t ttl, const uint8_t decrease_for); |
|||
#endif |
|||
Loading…
Reference in new issue