iptables忽略pakage由scapy發送

對於Scool中的Projekt，我需要嗅探新的tcp握手包的網絡流量。我想自動爲此tcp連接創建一個新的iptables規則，並將其放入docker容器中。iptables忽略pakage由scapy發送

#!/usr/bin/env python2 

import subprocess 
from scapy.all import * 

def find_tcp_handshake(port, docker_ip): 
    global SYN 
    global ACK 
    # sniff for new syn pakage and send the pakage to function process_handshake() 
    sniff(lfilter=lambda x: x.haslayer(TCP) and str(x[TCP].dport) == port and x[TCP].flags & SYN and not x[TCP].flags & ACK, prn = lambda x:  process_handshake(paket = x, port = port, docker_ip = docker_ip)) 

def process_handshake(paket, port, docker_ip): 
    # get the four tcp parameter (destination an source - port and ip) 
    destination_port = port 
    source_ip = str(paket[IP].src) 
    source_port = str(paket[TCP].sport) 
    # add the iptables rule 
    add_ipt_rule(destination_ip = docker_ip, destination_port = destination_port, source_ip = source_ip, source_port = source_port) 
    # remove the ethernet layer (make sometimes problems) 
    paket = paket[IP] 
    # remove checksums (make sometimes problems) 
    del paket[TCP].chksum 
    del paket[IP].chksum 
    # this pakage will not arrive the docker container 
    send(paket) 

# funktion to send commands to bash 
def command (c): 
    return subprocess.Popen(c.split(" "), stdout=subprocess.PIPE).stdout.read().rstrip() 

# this rules are created from docker by default with the argument -p 80:80. I've added the source_ip and source_port part 
def add_ipt_rule(destination_ip, destination_port, source_ip, source_port): 
    command("iptables -I DOCKER -d " + destination_ip + "/32 -s " + source_ip + " ! -i docker0 -o docker0 -p tcp -m tcp --dport " + destination_port + " -j  ACCEPT") 
    command("iptables -t nat -I POSTROUTING -s " + destination_ip + "/32 -d " + destination_ip + "/32 -p tcp -m tcp --dport " + destination_port + " -j  MASQUERADE") 
    command("iptables -t nat -I DOCKER ! -i docker0 -p tcp -m tcp -s " + source_ip + " --sport " + source_port + " --dport " + destination_port + " -j  DNAT --to-destination " + destination_ip + ":" + destination_port) 

# my original script creates docker container itself and manage these in a sqlite database 
def main(): 
    docker_ip = "127.17.0.2" 
    port = "80" 
    find_tcp_handshake(port = port, docker_ip = docker_ip) 


# TCP-Flags for sniff rule (not all in use) 
FIN = 0x01 
SYN = 0x02 
RST = 0x04 
PSH = 0x08 
ACK = 0x10 
URG = 0x20 
ECE = 0x40 
CWR = 0x80 

if __name__ == "__main__": 
    main()

嗅探正在工作，iptables命令正在工作。

問題是當我用scapy重新發送pakage。它應該適合碼頭集裝箱。但這個pakage永遠不會達到iptables規則。當我從客戶端重新發送包裹時，規則正在工作。

scapy上是否有方法將包發送到iptables？

感謝您的幫助

來源

2017-08-15 C. Schmid

Scapy的低水平發送數據包，它們不是由netfilter的看到。如果要發送由netfilter顯示的數據包，可以將它們從另一臺計算機發送出去，也可以使用常規的socket API讓主機的IP堆棧爲您發送數據包。

來源

2017-08-22 18:40:53 Pierre

iptables忽略pakage由scapy發送

回答

相關問題