2
對於Scool中的Projekt,我需要嗅探新的tcp握手包的網絡流量。我想自動爲此tcp連接創建一個新的iptables規則,並將其放入docker容器中。iptables忽略pakage由scapy發送
#!/usr/bin/env python2
import subprocess
from scapy.all import *
def find_tcp_handshake(port, docker_ip):
global SYN
global ACK
# sniff for new syn pakage and send the pakage to function process_handshake()
sniff(lfilter=lambda x: x.haslayer(TCP) and str(x[TCP].dport) == port and x[TCP].flags & SYN and not x[TCP].flags & ACK, prn = lambda x: process_handshake(paket = x, port = port, docker_ip = docker_ip))
def process_handshake(paket, port, docker_ip):
# get the four tcp parameter (destination an source - port and ip)
destination_port = port
source_ip = str(paket[IP].src)
source_port = str(paket[TCP].sport)
# add the iptables rule
add_ipt_rule(destination_ip = docker_ip, destination_port = destination_port, source_ip = source_ip, source_port = source_port)
# remove the ethernet layer (make sometimes problems)
paket = paket[IP]
# remove checksums (make sometimes problems)
del paket[TCP].chksum
del paket[IP].chksum
# this pakage will not arrive the docker container
send(paket)
# funktion to send commands to bash
def command (c):
return subprocess.Popen(c.split(" "), stdout=subprocess.PIPE).stdout.read().rstrip()
# this rules are created from docker by default with the argument -p 80:80. I've added the source_ip and source_port part
def add_ipt_rule(destination_ip, destination_port, source_ip, source_port):
command("iptables -I DOCKER -d " + destination_ip + "/32 -s " + source_ip + " ! -i docker0 -o docker0 -p tcp -m tcp --dport " + destination_port + " -j ACCEPT")
command("iptables -t nat -I POSTROUTING -s " + destination_ip + "/32 -d " + destination_ip + "/32 -p tcp -m tcp --dport " + destination_port + " -j MASQUERADE")
command("iptables -t nat -I DOCKER ! -i docker0 -p tcp -m tcp -s " + source_ip + " --sport " + source_port + " --dport " + destination_port + " -j DNAT --to-destination " + destination_ip + ":" + destination_port)
# my original script creates docker container itself and manage these in a sqlite database
def main():
docker_ip = "127.17.0.2"
port = "80"
find_tcp_handshake(port = port, docker_ip = docker_ip)
# TCP-Flags for sniff rule (not all in use)
FIN = 0x01
SYN = 0x02
RST = 0x04
PSH = 0x08
ACK = 0x10
URG = 0x20
ECE = 0x40
CWR = 0x80
if __name__ == "__main__":
main()
嗅探正在工作,iptables命令正在工作。
問題是當我用scapy重新發送pakage。它應該適合碼頭集裝箱。但這個pakage永遠不會達到iptables規則。當我從客戶端重新發送包裹時,規則正在工作。
scapy上是否有方法將包發送到iptables?
感謝您的幫助