使用gopacket更改目标端口

Question

目前，我正在尝试从nfqueue中读取包并修改them.Unfortunately，但我在更改包的目标端口方面有点卡住了。请参阅下面的代码片段。其想法是将dest 8888改写为8000。我确实看到修改后的包从队列中退出，但是如果我想通过连接到端口8888连接到侦听端口8000的HTTP服务器，则连接超时。我猜包裹里有不正常的东西。

package main

import (
    "os"
    "os/signal"
    "syscall"

    "github.com/chifflier/nfqueue-go/nfqueue"
    "github.com/coreos/go-iptables/iptables"

    "github.com/google/gopacket"
    "github.com/google/gopacket/layers"
)

func sendNewPacket(payload *nfqueue.Payload, layers ...gopacket.SerializableLayer) {
    buffer := gopacket.NewSerializeBuffer()
    gopacket.SerializeLayers(buffer, gopacket.SerializeOptions{FixLengths: true, ComputeChecksums: true}, layers...)
    outgoingPacket := buffer.Bytes()
    payload.SetVerdictModified(nfqueue.NF_ACCEPT, outgoingPacket)
}

func realCallback(payload *nfqueue.Payload) int {
    packet := gopacket.NewPacket(payload.Data, layers.LayerTypeIPv4, gopacket.Default)
    ethLayer := packet.Layer(layers.LayerTypeEthernet)
    eth, _ := ethLayer.(*layers.Ethernet)
    if ipLayer := packet.Layer(layers.LayerTypeIPv4); ipLayer != nil {
        ip, _ := ipLayer.(*layers.IPv4)
        if tcpLayer := packet.Layer(layers.LayerTypeTCP); tcpLayer != nil {
            tcp, _ := tcpLayer.(*layers.TCP)
            if tcp.DstPort == 8888 {
                tcp.DstPort = 8000
                sendNewPacket(payload, eth, ip, tcp)
                return 0
            }
            if tcp.SrcPort == 8000 {
                tcp.SrcPort = 8888
                sendNewPacket(payload, eth, ip, tcp)
                return 0
            }
        }
    }
    payload.SetVerdict(nfqueue.NF_ACCEPT)
    return 0
}

func main() {
    ipt, err := iptables.New()
    if err != nil {
        panic(err)
    }
    ipt.Append("filter", "INPUT", "-p", "tcp", "-j", "NFQUEUE", "--queue-num", "0")
    ipt.Append("filter", "OUTPUT", "-p", "tcp", "-j", "NFQUEUE", "--queue-num", "0")
    q := new(nfqueue.Queue)
    q.SetCallback(realCallback)

    q.Init()
    defer q.Close()

    q.Unbind(syscall.AF_INET)
    q.Bind(syscall.AF_INET)
    q.CreateQueue(0)

    c := make(chan os.Signal, 1)
    signal.Notify(c, os.Interrupt)
    go func() {
        for sig := range c {
            _ = sig
            q.Close()
            err = ipt.ClearChain("filter", "INPUT")
            err = ipt.ClearChain("filter", "OUTPUT")
            if err != nil {
                panic(err)
            }
            os.Exit(0)
        }
    }()
    q.TryRun()
}

Answer 1

如果您对解决方案感兴趣，可以在这里找到代码：https://github.com/kung-foo/freki