Skip to content

netfilter and nftables stuff #143

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ivyl wants to merge 3 commits into
base: master
Choose a base branch
from
Open

netfilter and nftables stuff #143

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
78c14a0
Remove unused dnsq_soa_root
ivyl Aug 19, 2019
450848e
Rename Linux filtering method to netfilter
ivyl Aug 19, 2019
a7a5732
Add nftables example to README
ivyl Aug 19, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ tags: *.c *.h
$(CONF):
@case `uname` in \
Linux*) \
echo "#define USE_IPTABLES" >$(CONF) \
echo "#define USE_NETFILTER" >$(CONF) \
;; \
OpenBSD) \
echo "#define USE_PF" >$(CONF) \
Expand Down
36 changes: 36 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,42 @@ luser$ sg socksified -c "firefox"
root# iptables -t nat -A PREROUTING --in-interface eth_int -p tcp -j REDSOCKS
```

## nftables example

https://wiki.nftables.org/ - more modern replacemnt for iptables

```
# required to do redirects
modprobe nft_redir

nft -f - <<EOF
table ip nat {
chain REDSOCKS {
# hook to the output
type nat hook output priority 0; policy accept;

# skip if the user is not uid 1000
ip protocol tcp skuid != 1000 return

# skip for local ip ranges
ip daddr 0.0.0.0/8 return
ip daddr 10.0.0.0/8 return
ip daddr 100.64.0.0/10 return
ip daddr 127.0.0.0/8 return
ip daddr 169.254.0.0/16 return
ip daddr 172.16.0.0/12 return
ip daddr 192.168.0.0/16 return
ip daddr 198.18.0.0/15 return
ip daddr 224.0.0.0/4 return
ip daddr 240.0.0.0/4 return

# everything else tcp = redirect to redsocks
ip protocol tcp redirect to 12345
}
}
EOF
```

### Note about GID-based redirection

Keep in mind, that changed GID affects filesystem permissions, so if your
Expand Down
11 changes: 6 additions & 5 deletions base.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
#include <grp.h>
#include <stdlib.h>
#include "config.h"
#if defined USE_IPTABLES
#if defined USE_NETFILTER
# include <limits.h>
# include <linux/netfilter_ipv4.h>
#endif
Expand Down Expand Up @@ -214,8 +214,8 @@ static int getdestaddr_pf(
}
#endif

#ifdef USE_IPTABLES
static int getdestaddr_iptables(int fd, const struct sockaddr_in *client, const struct sockaddr_in *bindaddr, struct sockaddr_in *destaddr)
#ifdef USE_NETFILTER
static int getdestaddr_netfilter(int fd, const struct sockaddr_in *client, const struct sockaddr_in *bindaddr, struct sockaddr_in *destaddr)
{
socklen_t socklen = sizeof(*destaddr);
int error;
Expand Down Expand Up @@ -290,8 +290,9 @@ static redirector_subsys redirector_subsystems[] =
#ifdef USE_PF
{ .name = "pf", .init = redir_init_pf, .fini = redir_close_private, .getdestaddr = getdestaddr_pf },
#endif
#ifdef USE_IPTABLES
{ .name = "iptables", .getdestaddr = getdestaddr_iptables },
#ifdef USE_NETFILTER
{ .name = "netfilter", .getdestaddr = getdestaddr_netfilter },
{ .name = "iptables", .getdestaddr = getdestaddr_netfilter },
#endif
{ .name = "generic", .getdestaddr = getdestaddr_generic },
};
Expand Down
6 changes: 0 additions & 6 deletions dnsu2t.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,12 +46,6 @@ static void dnsu2t_pkt_from_relay(int fd, short what, void *_arg);
static void dnsu2t_relay_writable(int fd, short what, void *_arg);
static void dnsu2t_close_relay(dnsu2t_instance *self);

// this DNS query (IN SOA for `.`) acts as in-band DNS ping
static const uint8_t dnsq_soa_root[] = {
0x00, 0x00, 0x01, 0x20,
0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x06, 0x00, 0x01};

typedef struct inflight_req_t {
uint16_t id; // in network byte order
struct sockaddr_in clientaddr;
Expand Down
4 changes: 2 additions & 2 deletions redsocks.conf.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,12 @@ base {
// chroot = "/var/chroot";

/* possible `redirector' values are:
* iptables - for Linux
* netfilter - for Linux
* ipf - for FreeBSD
* pf - for OpenBSD
* generic - some generic redirector that MAY work
*/
redirector = iptables;
redirector = netfilter;

/* Override per-socket values for TCP_KEEPIDLE, TCP_KEEPCNT,
* and TCP_KEEPINTVL. see man 7 tcp for details.
Expand Down