e667e19f02
TSG-7702 支持外层IPv4且内层为IPv4的封装模式 TSG-7703 支持外层IPv6且内层为IPv6的封装模式 TSG-7704 支持外层IPv6且内层为IPv4的封装模式 TSG-7705 支持外层IPv4且内层为IPv6的封装模式
71 lines
1.9 KiB
Markdown
71 lines
1.9 KiB
Markdown
## 功能
|
||
|
||
并联环境下实现GTP路由封堵功能。
|
||
|
||
**实现**
|
||
|
||
将 “=> MAC => IPv4/IPv6 => UDP => GTP1 => IPv4/IPv6 => TCP/UDP“ 中的 "IPv4/IPv6 => UDP => GTP1" 协议层剥离。
|
||
|
||
**例子**
|
||
|
||
原数据包为：
|
||
|
||
``` shel
|
||
Frame 1: 90 bytes on wire (720 bits), 90 bytes captured (720 bits)
|
||
Ethernet II, Src: JuniperN_4d:d3:51 (08:81:f4:4d:d3:51), Dst: c8:67:d9:18:80:c3 (c8:67:d9:18:80:c3)
|
||
Internet Protocol Version 4, Src: 10.166.20.10, Dst: 10.2.3.35
|
||
User Datagram Protocol, Src Port: 2152, Dst Port: 2152
|
||
GPRS Tunneling Protocol
|
||
Internet Protocol Version 4, Src: 10.58.121.62, Dst: 217.76.78.112
|
||
Transmission Control Protocol, Src Port: 52144, Dst Port: 443, Seq: 1, Ack: 1, Len: 0
|
||
```
|
||
|
||
经过 NFQ 过滤后变为：
|
||
|
||
``` shel
|
||
Frame 1: 90 bytes on wire (720 bits), 90 bytes captured (720 bits)
|
||
Ethernet II, Src: JuniperN_4d:d3:51 (08:81:f4:4d:d3:51), Dst: c8:67:d9:18:80:c3 (c8:67:d9:18:80:c3)
|
||
Internet Protocol Version 4, Src: 10.58.121.62, Dst: 217.76.78.112
|
||
Transmission Control Protocol, Src Port: 52144, Dst Port: 443, Seq: 1, Ack: 1, Len: 0
|
||
```
|
||
|
||
## 构造测试环境
|
||
|
||
``` shell
|
||
# 清空 iptables
|
||
iptables -F -t nat
|
||
iptables -F -t filter
|
||
iptables -F -t mangle
|
||
iptables -F -t raw
|
||
ip6tables -F -t nat
|
||
ip6tables -F -t filter
|
||
ip6tables -F -t mangle
|
||
ip6tables -F -t raw
|
||
|
||
# 增加 iptables
|
||
/usr/sbin/iptables -A OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
|
||
/usr/sbin/ip6tables -A OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
|
||
|
||
# 删除 iptables
|
||
/usr/sbin/iptables -D OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
|
||
/usr/sbin/ip6tables -D OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
|
||
|
||
# 调试 iptables
|
||
/usr/sbin/iptables -A OUTPUT -o eno2 -j LOG
|
||
/usr/sbin/ip6tables -A OUTPUT -o eno2 -j LOG
|
||
|
||
# make
|
||
yum install -y libnetfilter_queue-devel
|
||
make
|
||
./nfq_filter_gtp
|
||
```
|
||
|
||
## 局限
|
||
|
||
/MAC/IPv6 的 first next header 必须为 UDP，否则跳过。
|
||
|
||
## TODO
|
||
|
||
// support service
|
||
// support filestat
|