|
| 1 | +// Package nfqueue implements a HTTP provider for solving the HTTP-01 challenge using nfqueue |
| 2 | +// by captureing http challange pacet in fly and answering it by ourself |
| 3 | +package nfqueue |
| 4 | + |
| 5 | +import ( |
| 6 | + "bufio" |
| 7 | + "bytes" |
| 8 | + "context" |
| 9 | + "fmt" |
| 10 | + "log" |
| 11 | + "net" |
| 12 | + "net/http" |
| 13 | + "os/exec" |
| 14 | + "runtime" |
| 15 | + "strings" |
| 16 | + "time" |
| 17 | + |
| 18 | + gnfqueue "github.com/florianl/go-nfqueue" |
| 19 | + "github.com/google/gopacket" |
| 20 | + "github.com/google/gopacket/layers" |
| 21 | +) |
| 22 | + |
| 23 | +// HTTPProvider implements HTTPProvider for `http-01` challenge. |
| 24 | +type HTTPProvider struct { |
| 25 | + port string |
| 26 | + context context.Context |
| 27 | + cancel context.CancelFunc |
| 28 | +} |
| 29 | + |
| 30 | +// NewHttpDpiProvider returns a HTTPProvider instance with a configured port. |
| 31 | +func NewHttpDpiProvider(port string) (*HTTPProvider, error) { |
| 32 | + |
| 33 | + c := &HTTPProvider{ |
| 34 | + port: port, |
| 35 | + } |
| 36 | + |
| 37 | + return c, nil |
| 38 | +} |
| 39 | + |
| 40 | +// this craft acme challange response in HTTP level |
| 41 | +func craftkeyauthresponse(keyAuth string) []byte { |
| 42 | + var reply []byte |
| 43 | + reply = fmt.Append(reply, "HTTP/1.1 200 OK\r\n") |
| 44 | + reply = fmt.Append(reply, "Content-Type: text/plain\r\n") |
| 45 | + reply = fmt.Append(reply, "server: go-acme-nfqueue\r\n") |
| 46 | + reply = fmt.Appendf(reply, "Content-Length: %d\r\n", len(keyAuth)) |
| 47 | + reply = fmt.Append(reply, "\r\n", keyAuth) |
| 48 | + |
| 49 | + return reply |
| 50 | +} |
| 51 | + |
| 52 | +// craft packet |
| 53 | +func craftReplyPacketBytes(keyAuth string, inputpacket gopacket.Packet) []byte { |
| 54 | + outbuffer := gopacket.NewSerializeBuffer() |
| 55 | + opt := gopacket.SerializeOptions{ |
| 56 | + FixLengths: true, |
| 57 | + ComputeChecksums: true, |
| 58 | + } |
| 59 | + inputTcp := inputpacket.Layer(layers.LayerTypeTCP).(*layers.TCP) |
| 60 | + inputIPv4 := inputpacket.Layer(layers.LayerTypeIPv4).(*layers.IPv4) |
| 61 | + |
| 62 | + httplayer := gopacket.Payload(craftkeyauthresponse(keyAuth)) |
| 63 | + tcplayer := &layers.TCP{ |
| 64 | + // we reply back so reverse src and dst ports |
| 65 | + SrcPort: inputTcp.DstPort, |
| 66 | + DstPort: inputTcp.SrcPort, |
| 67 | + Ack: inputTcp.Seq + uint32(len(inputTcp.Payload)), |
| 68 | + Seq: inputTcp.Ack, |
| 69 | + PSH: true, |
| 70 | + ACK: true, |
| 71 | + } |
| 72 | + // log.Infof("dstp: %s, srcp %s", tcplayer.DstPort.String(), tcp) |
| 73 | + //check network layer |
| 74 | + // this is reply so we reverse sorce and dst ip |
| 75 | + iplayer := &layers.IPv4{ |
| 76 | + SrcIP: inputIPv4.DstIP, |
| 77 | + DstIP: inputIPv4.SrcIP, |
| 78 | + } |
| 79 | + tcplayer.SetNetworkLayerForChecksum(iplayer) |
| 80 | + gopacket.SerializeLayers(outbuffer, opt, tcplayer, httplayer) |
| 81 | + |
| 82 | + return outbuffer.Bytes() |
| 83 | +} |
| 84 | + |
| 85 | +// sendPacket sends packet: TODO: call cleanup if errors out |
| 86 | +func sendPacket(packet []byte, DstIP *net.IP) error { |
| 87 | + var err error |
| 88 | + con, err := net.Dial("ip:6", DstIP.String()) |
| 89 | + if err != nil { |
| 90 | + return err |
| 91 | + } |
| 92 | + _, err = con.Write(packet) |
| 93 | + if err != nil { |
| 94 | + return err |
| 95 | + } |
| 96 | + return nil |
| 97 | +} |
| 98 | + |
| 99 | +// serve runs server by sniffing packets on firewall and inject response into it. |
| 100 | +// iptables :// |
| 101 | +func (w *HTTPProvider) serve(domain, token, keyAuth string) error { |
| 102 | + //run nfqueue start |
| 103 | + cmd := exec.Command("iptables", "-I", "INPUT", "-p", "tcp", "--dport", w.port, "-j", "NFQUEUE", "--queue-num", "8555") |
| 104 | + err := cmd.Run() |
| 105 | + // ensure even if clean funtion failed to called |
| 106 | + defer exec.Command("iptables", "-D", "INPUT", "-p", "tcp", "--dport", w.port, "-j", "NFQUEUE", "--queue-num", "8555").Run() |
| 107 | + if err != nil { |
| 108 | + return err |
| 109 | + } |
| 110 | + config := gnfqueue.Config{ |
| 111 | + NfQueue: 8555, |
| 112 | + MaxPacketLen: 0xFFFF, |
| 113 | + MaxQueueLen: 0xFF, |
| 114 | + Copymode: gnfqueue.NfQnlCopyPacket, |
| 115 | + WriteTimeout: 15 * time.Millisecond, |
| 116 | + } |
| 117 | + nf, err := gnfqueue.Open(&config) |
| 118 | + if err != nil { |
| 119 | + return err |
| 120 | + } |
| 121 | + defer nf.Close() |
| 122 | + |
| 123 | + //handle Packet |
| 124 | + handlepacket := func(a gnfqueue.Attribute) int { |
| 125 | + id := *a.PacketID |
| 126 | + opt := gopacket.DecodeOptions{ |
| 127 | + NoCopy: true, |
| 128 | + Lazy: false, |
| 129 | + } |
| 130 | + //assume ipv4 for now, will segfault |
| 131 | + payload := gopacket.NewPacket(*a.Payload, layers.LayerTypeIPv4, opt) |
| 132 | + ipL := payload.Layer(layers.LayerTypeIPv4) |
| 133 | + srcip := ipL.(*layers.IPv4).SrcIP |
| 134 | + if tcpLayer := payload.Layer(layers.LayerTypeTCP); tcpLayer != nil { |
| 135 | + // Get actual TCP data from this layer |
| 136 | + inputTcp, _ := tcpLayer.(*layers.TCP) |
| 137 | + // this should be HTTP payload |
| 138 | + httpPayload, err := http.ReadRequest(bufio.NewReader((bytes.NewReader(inputTcp.LayerPayload())))) |
| 139 | + if err != nil { |
| 140 | + nf.SetVerdict(id, gnfqueue.NfAccept) |
| 141 | + return 0 |
| 142 | + } |
| 143 | + // check token in http |
| 144 | + if strings.Contains(httpPayload.URL.Path, token) { |
| 145 | + //we got the token!, block the packet to backend server. |
| 146 | + nf.SetVerdict(id, gnfqueue.NfDrop) |
| 147 | + //forge our new reply |
| 148 | + replypacket := craftReplyPacketBytes(keyAuth, payload) |
| 149 | + // Send the modified packet back to VA, ignore err as it won't crash |
| 150 | + sendPacket(replypacket, &srcip) |
| 151 | + // packet sent, end of function |
| 152 | + return 0 |
| 153 | + } else { |
| 154 | + nf.SetVerdict(id, gnfqueue.NfAccept) |
| 155 | + return 0 |
| 156 | + } |
| 157 | + |
| 158 | + } else { |
| 159 | + nf.SetVerdict(id, gnfqueue.NfAccept) |
| 160 | + } |
| 161 | + |
| 162 | + return 0 |
| 163 | + } |
| 164 | + |
| 165 | + // Register your function to listen on nflqueue queue |
| 166 | + err = nf.Register(w.context, handlepacket) |
| 167 | + if err != nil { |
| 168 | + fmt.Println(err) |
| 169 | + return nil |
| 170 | + } |
| 171 | + |
| 172 | + // Block till the context expires |
| 173 | + <-w.context.Done() |
| 174 | + return nil |
| 175 | +} |
| 176 | + |
| 177 | +func (w *HTTPProvider) Present(domain, token, keyAuth string) error { |
| 178 | + // test if OS is linux, otherwise no point running this nfqueue is linux thing |
| 179 | + if runtime.GOOS != "linux" { |
| 180 | + log.Panicf("[%s] http-nfq provider isn't implimented non-linux", domain) |
| 181 | + } |
| 182 | + w.context, w.cancel = context.WithCancel(context.Background()) |
| 183 | + go w.serve(domain, token, keyAuth) |
| 184 | + return nil |
| 185 | +} |
| 186 | + |
| 187 | +// CleanUp removes the firewall rule created for the challenge. |
| 188 | +// solve should removed it already but just do be safe: |
| 189 | +// iptables -D INPUT -p tcp --dport Port -j NFQUEUE --queue-num 8555 |
| 190 | +func (w *HTTPProvider) CleanUp(domain, token, keyAuth string) error { |
| 191 | + cmd := exec.Command("iptables", "-D", "INPUT", "-p", "tcp", "--dport", w.port, "-j", "NFQUEUE", "--queue-num", "8555") |
| 192 | + cmd.Run() |
| 193 | + // tell nfqueue to shut down |
| 194 | + w.cancel() |
| 195 | + return nil |
| 196 | +} |
0 commit comments