iptables 忽略 scapy 发送的包答案

【问题标题】：iptables ignore package send by scapyiptables 忽略 scapy 发送的包
【发布时间】：2018-05-24 09:55:01
【问题描述】：

对于 Scool 的 Projekt，我需要嗅探网络流量以获取新的 tcp 握手包。我想为此 tcp 连接自动创建一个新的 iptables 规则到 docker 容器中。

#!/usr/bin/env python2

import subprocess
from scapy.all import *

def find_tcp_handshake(port, docker_ip):
    global SYN
    global ACK
    # sniff for new syn package and send the package to function process_handshake()
    sniff(lfilter=lambda x: x.haslayer(TCP) and str(x[TCP].dport) == port and x[TCP].flags & SYN and not x[TCP].flags & ACK, prn = lambda x:     process_handshake(paket = x, port = port, docker_ip = docker_ip))

def process_handshake(paket, port, docker_ip):
    # get the four tcp parameter (destination an source - port and ip)
    destination_port = port
    source_ip = str(paket[IP].src)
    source_port = str(paket[TCP].sport)
    # add the iptables rule
    add_ipt_rule(destination_ip = docker_ip, destination_port = destination_port, source_ip = source_ip, source_port = source_port)
    # remove the ethernet layer (make sometimes problems)
    paket = paket[IP]
    # remove checksums (make sometimes problems)
    del paket[TCP].chksum
    del paket[IP].chksum
    # this package will not arrive the docker container
    send(paket)

# funktion to send commands to bash
def command (c):
    return subprocess.Popen(c.split(" "), stdout=subprocess.PIPE).stdout.read().rstrip()

# this rules are created from docker by default with the argument -p 80:80. I've added the source_ip and source_port part
def add_ipt_rule(destination_ip, destination_port, source_ip, source_port):
    command("iptables -I DOCKER -d " + destination_ip + "/32 -s " + source_ip + " ! -i docker0 -o docker0 -p tcp -m tcp --dport " + destination_port + " -j     ACCEPT")
    command("iptables -t nat -I POSTROUTING -s " + destination_ip + "/32 -d " + destination_ip + "/32 -p tcp -m tcp --dport " + destination_port + " -j     MASQUERADE")
    command("iptables -t nat -I DOCKER ! -i docker0 -p tcp -m tcp -s " + source_ip + " --sport " + source_port + " --dport " + destination_port + " -j     DNAT --to-destination " + destination_ip + ":" + destination_port)

# my original script creates docker container itself and manage these in a sqlite database
def main():
    docker_ip = "127.17.0.2"
    port = "80"
    find_tcp_handshake(port = port, docker_ip = docker_ip)


# TCP-Flags for sniff rule (not all in use)
FIN = 0x01
SYN = 0x02
RST = 0x04
PSH = 0x08
ACK = 0x10
URG = 0x20
ECE = 0x40
CWR = 0x80

if __name__ == "__main__":
    main()

嗅探工作正常，iptables 命令工作正常。

问题是当我用 scapy 重新发送包时。它应该转发到 docker 容器。但是这个包永远不会到达 iptables 规则。当我从客户端重新发送包裹时，该规则正在起作用。

scapy 上是否有将包发送到 iptables 的方法？

【问题讨论】：

标签： python linux iptables scapy

【解决方案1】：

Scapy 在低级别发送数据包，netfilter 看不到它们。如果您想发送 netfilter 看到的数据包，您可以从另一台计算机发送它们，也可以使用常规的socket API 让主机的 IP 堆栈为您发送数据包。

【讨论】：