gfwleak/tsg-packetadapter
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TSG-7678 并联环境下实现GTP路由封堵功能

Browse Source 
TSG-7702 支持外层IPv4且内层为IPv4的封装模式
	TSG-7703 支持外层IPv6且内层为IPv6的封装模式
	TSG-7704 支持外层IPv6且内层为IPv4的封装模式
	TSG-7705 支持外层IPv4且内层为IPv6的封装模式
This commit is contained in:
luwenpeng
2021-09-09 18:56:51 +08:00
commit e667e19f02
4 changed files with 964 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
README.md Normal file
View File

@@ -0,0 +1,70 @@
## 功能
并联环境下实现GTP路由封堵功能。
**实现**
将 “=> MAC => IPv4/IPv6 => UDP => GTP1 => IPv4/IPv6 => TCP/UDP“ 中的 "IPv4/IPv6 => UDP => GTP1" 协议层剥离。
**例子**
原数据包为：
``` shel
Frame 1: 90 bytes on wire (720 bits), 90 bytes captured (720 bits)
Ethernet II, Src: JuniperN_4d:d3:51 (08:81:f4:4d:d3:51), Dst: c8:67:d9:18:80:c3 (c8:67:d9:18:80:c3)
Internet Protocol Version 4, Src: 10.166.20.10, Dst: 10.2.3.35
User Datagram Protocol, Src Port: 2152, Dst Port: 2152
GPRS Tunneling Protocol
Internet Protocol Version 4, Src: 10.58.121.62, Dst: 217.76.78.112
Transmission Control Protocol, Src Port: 52144, Dst Port: 443, Seq: 1, Ack: 1, Len: 0
```
经过 NFQ 过滤后变为：
``` shel
Frame 1: 90 bytes on wire (720 bits), 90 bytes captured (720 bits)
Ethernet II, Src: JuniperN_4d:d3:51 (08:81:f4:4d:d3:51), Dst: c8:67:d9:18:80:c3 (c8:67:d9:18:80:c3)
Internet Protocol Version 4, Src: 10.58.121.62, Dst: 217.76.78.112
Transmission Control Protocol, Src Port: 52144, Dst Port: 443, Seq: 1, Ack: 1, Len: 0
```
## 构造测试环境
``` shell
# 清空 iptables
iptables -F -t nat
iptables -F -t filter
iptables -F -t mangle
iptables -F -t raw
ip6tables -F -t nat
ip6tables -F -t filter
ip6tables -F -t mangle
ip6tables -F -t raw
# 增加 iptables
/usr/sbin/iptables -A OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
/usr/sbin/ip6tables -A OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
# 删除 iptables
/usr/sbin/iptables -D OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
/usr/sbin/ip6tables -D OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
# 调试 iptables
/usr/sbin/iptables -A OUTPUT -o eno2 -j LOG
/usr/sbin/ip6tables -A OUTPUT -o eno2 -j LOG
# make
yum install -y libnetfilter_queue-devel
make
./nfq_filter_gtp
```
## 局限
/MAC/IPv6 的 first next header 必须为 UDP，否则跳过。
## TODO
// support service
// support filestat