123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177 |
- package firewall
- import (
- "bufio"
- "fmt"
- "io/ioutil"
- "log"
- "os"
- "regexp"
- "strings"
- "github.com/bettercap/bettercap/core"
- "github.com/bettercap/bettercap/network"
- "github.com/evilsocket/islazy/str"
- )
- var (
- sysCtlParser = regexp.MustCompile(`([^:]+):\s*(.+)`)
- pfFilePath = fmt.Sprintf("/tmp/bcap_pf_%d.conf", os.Getpid())
- )
- type PfFirewall struct {
- iface *network.Endpoint
- filename string
- forwarding bool
- enabled bool
- }
- func Make(iface *network.Endpoint) FirewallManager {
- firewall := &PfFirewall{
- iface: iface,
- filename: pfFilePath,
- forwarding: false,
- enabled: false,
- }
- firewall.forwarding = firewall.IsForwardingEnabled()
- return firewall
- }
- func (f PfFirewall) sysCtlRead(param string) (string, error) {
- if out, err := core.Exec("sysctl", []string{param}); err != nil {
- return "", err
- } else if m := sysCtlParser.FindStringSubmatch(out); len(m) == 3 && m[1] == param {
- return m[2], nil
- } else {
- return "", fmt.Errorf("Unexpected sysctl output: %s", out)
- }
- }
- func (f PfFirewall) sysCtlWrite(param string, value string) (string, error) {
- args := []string{"-w", fmt.Sprintf("%s=%s", param, value)}
- _, err := core.Exec("sysctl", args)
- if err != nil {
- return "", err
- }
- // make sure we actually wrote the value
- if out, err := f.sysCtlRead(param); err != nil {
- return "", err
- } else if out != value {
- return "", fmt.Errorf("Expected value for '%s' is %s, found %s", param, value, out)
- } else {
- return out, nil
- }
- }
- func (f PfFirewall) IsForwardingEnabled() bool {
- out, err := f.sysCtlRead("net.inet.ip.forwarding")
- if err != nil {
- log.Printf("ERROR: %s", err)
- return false
- }
- return strings.HasSuffix(out, ": 1")
- }
- func (f PfFirewall) enableParam(param string, enabled bool) error {
- var value string
- if enabled {
- value = "1"
- } else {
- value = "0"
- }
- if _, err := f.sysCtlWrite(param, value); err != nil {
- return err
- } else {
- return nil
- }
- }
- func (f PfFirewall) EnableForwarding(enabled bool) error {
- return f.enableParam("net.inet.ip.forwarding", enabled)
- }
- func (f PfFirewall) generateRule(r *Redirection) string {
- src_a := "any"
- dst_a := "any"
- if r.SrcAddress != "" {
- src_a = r.SrcAddress
- }
- if r.DstAddress != "" {
- dst_a = r.DstAddress
- }
- return fmt.Sprintf("rdr pass on %s proto %s from any to %s port %d -> %s port %d",
- r.Interface, r.Protocol, src_a, r.SrcPort, dst_a, r.DstPort)
- }
- func (f *PfFirewall) enable(enabled bool) {
- f.enabled = enabled
- if enabled {
- core.Exec("pfctl", []string{"-e"})
- } else {
- core.Exec("pfctl", []string{"-d"})
- }
- }
- func (f PfFirewall) EnableRedirection(r *Redirection, enabled bool) error {
- rule := f.generateRule(r)
- if enabled {
- fd, err := os.OpenFile(f.filename, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
- if err != nil {
- return err
- }
- defer fd.Close()
- if _, err = fd.WriteString(rule + "\n"); err != nil {
- return err
- }
- // enable pf
- f.enable(true)
- // load the rule
- if _, err := core.Exec("pfctl", []string{"-f", f.filename}); err != nil {
- return err
- }
- } else {
- fd, err := os.Open(f.filename)
- if err == nil {
- defer fd.Close()
- lines := ""
- scanner := bufio.NewScanner(fd)
- for scanner.Scan() {
- line := str.Trim(scanner.Text())
- if line != rule {
- lines += line + "\n"
- }
- }
- if str.Trim(lines) == "" {
- os.Remove(f.filename)
- f.enable(false)
- } else {
- ioutil.WriteFile(f.filename, []byte(lines), 0600)
- }
- }
- }
- return nil
- }
- func (f PfFirewall) Restore() {
- f.EnableForwarding(f.forwarding)
- if f.enabled {
- f.enable(false)
- }
- os.Remove(f.filename)
- }
|