autohostlist debug

This commit is contained in:
bol-van
2023-11-09 12:08:09 +03:00
parent 2245377671
commit 3559e1f2b8
34 changed files with 194 additions and 64 deletions

View File

@@ -8,6 +8,7 @@
#include <sys/socket.h>
#include <arpa/inet.h>
#include <ifaddrs.h>
#include <time.h>
char *strncasestr(const char *s,const char *find, size_t slen)
{
@@ -211,3 +212,13 @@ int get_so_error(int fd)
errn=errno;
return errn;
}
int fprint_localtime(FILE *F)
{
struct tm t;
time_t now;
time(&now);
localtime_r(&now,&t);
return fprintf(F, "%02d.%02d.%04d %02d:%02d:%02d", t.tm_mday, t.tm_mon + 1, t.tm_year + 1900, t.tm_hour, t.tm_min, t.tm_sec);
}

View File

@@ -5,6 +5,7 @@
#include <netinet/in.h>
#include <sys/socket.h>
#include <netdb.h>
#include <stdio.h>
char *strncasestr(const char *s,const char *find, size_t slen);
@@ -41,3 +42,5 @@ static inline void phton16(uint8_t *p, uint16_t v) {
p[0] = (uint8_t)(v>>8);
p[1] = (uint8_t)v;
}
int fprint_localtime(FILE *F);

View File

@@ -56,7 +56,7 @@ struct params_s
strpool *hostlist, *hostlist_exclude;
struct str_list_head hostlist_files, hostlist_exclude_files;
char hostlist_auto_filename[PATH_MAX];
char hostlist_auto_filename[PATH_MAX], hostlist_auto_debuglog[PATH_MAX];
int hostlist_auto_fail_threshold, hostlist_auto_fail_time;
hostfail_pool *hostlist_auto_fail_counters;
@@ -72,3 +72,15 @@ extern struct params_s params;
#define _DBGPRINT(format, level, ...) { if (params.debug>=level) printf(format "\n", ##__VA_ARGS__); }
#define VPRINT(format, ...) _DBGPRINT(format,1,##__VA_ARGS__)
#define DBGPRINT(format, ...) _DBGPRINT(format,2,##__VA_ARGS__)
#define LOG_APPEND(filename, format, ...) \
{ \
FILE *F = fopen(filename,"at"); \
if (F) \
{ \
fprint_localtime(F); \
fprintf(F, " : " format "\n", ##__VA_ARGS__); \
fclose(F); \
} \
}
#define HOSTLIST_DEBUGLOG_APPEND(format, ...) if (*params.hostlist_auto_debuglog) LOG_APPEND(params.hostlist_auto_debuglog, format, ##__VA_ARGS__)

View File

@@ -299,6 +299,7 @@ static void auto_hostlist_failed(const char *hostname)
}
fail_counter->counter++;
VPRINT("auto hostlist : %s : fail counter %d/%d", hostname, fail_counter->counter, params.hostlist_auto_fail_threshold);
HOSTLIST_DEBUGLOG_APPEND("%s : fail counter %d/%d", hostname, fail_counter->counter, params.hostlist_auto_fail_threshold);
if (fail_counter->counter >= params.hostlist_auto_fail_threshold)
{
VPRINT("auto hostlist : fail threshold reached. adding %s to auto hostlist", hostname);
@@ -309,6 +310,7 @@ static void auto_hostlist_failed(const char *hostname)
if (!HostlistCheck(params.hostlist, params.hostlist_exclude, hostname, &bExcluded) && !bExcluded)
{
VPRINT("auto hostlist : adding %s", hostname);
HOSTLIST_DEBUGLOG_APPEND("%s : adding", hostname);
if (!StrPoolAddStr(&params.hostlist, hostname))
{
fprintf(stderr, "StrPoolAddStr out of memory\n");
@@ -321,7 +323,10 @@ static void auto_hostlist_failed(const char *hostname)
}
}
else
{
VPRINT("auto hostlist: NOT adding %s", hostname);
HOSTLIST_DEBUGLOG_APPEND("%s : NOT adding, duplicate detected", hostname);
}
}
}
@@ -340,7 +345,10 @@ void tamper_in(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,siz
VPRINT("incoming HTTP reply detected for hostname %s", ctrack->hostname);
bFail = HttpReplyLooksLikeDPIRedirect(segment, *size, ctrack->hostname);
if (bFail)
{
VPRINT("redirect to another domain detected. possibly DPI redirect.")
HOSTLIST_DEBUGLOG_APPEND("%s : redirect to another domain", ctrack->hostname);
}
else
VPRINT("local or in-domain redirect detected. it's not a DPI redirect.")
}
@@ -365,6 +373,7 @@ void rst_in(t_ctrack *ctrack)
if (!ctrack->bTamperInCutoff && ctrack->hostname)
{
VPRINT("incoming RST detected for hostname %s", ctrack->hostname);
HOSTLIST_DEBUGLOG_APPEND("%s : incoming RST", ctrack->hostname);
auto_hostlist_failed(ctrack->hostname);
}
}
@@ -378,6 +387,7 @@ void hup_out(t_ctrack *ctrack)
{
// local leg dropped connection after first request. probably due to timeout.
VPRINT("local leg closed connection after first request (timeout ?). hostname: %s", ctrack->hostname);
HOSTLIST_DEBUGLOG_APPEND("%s : client closed connection without server reply", ctrack->hostname);
auto_hostlist_failed(ctrack->hostname);
}
}

View File

@@ -166,6 +166,7 @@ static void exithelp(void)
" --hostlist-auto=<filename>\t\t; detect DPI blocks and build hostlist automatically\n"
" --hostlist-auto-fail-threshold=<int>\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n"
" --hostlist-auto-fail-time=<int>\t; all failed attemps must be within these seconds (default : %d)\n"
" --hostlist-auto-debug=<logfile>\t; debug auto hostlist positives\n"
"\nTAMPER:\n"
" --split-http-req=method|host\t\t; split at specified logical part of plain http request\n"
" --split-pos=<numeric_offset>\t\t; split at specified pos. split-http-req takes precedence for http.\n"
@@ -304,17 +305,18 @@ void parse_params(int argc, char *argv[])
{ "hostlist-auto",required_argument,0,0}, // optidx=35
{ "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=36
{ "hostlist-auto-fail-time",required_argument,0,0}, // optidx=37
{ "pidfile",required_argument,0,0 },// optidx=38
{ "debug",optional_argument,0,0 },// optidx=39
{ "local-rcvbuf",required_argument,0,0 },// optidx=40
{ "local-sndbuf",required_argument,0,0 },// optidx=41
{ "remote-rcvbuf",required_argument,0,0 },// optidx=42
{ "remote-sndbuf",required_argument,0,0 },// optidx=43
{ "socks",no_argument,0,0 },// optidx=44
{ "no-resolve",no_argument,0,0 },// optidx=45
{ "skip-nodelay",no_argument,0,0 },// optidx=46
{ "hostlist-auto-debug",required_argument,0,0}, // optidx=38
{ "pidfile",required_argument,0,0 },// optidx=39
{ "debug",optional_argument,0,0 },// optidx=40
{ "local-rcvbuf",required_argument,0,0 },// optidx=41
{ "local-sndbuf",required_argument,0,0 },// optidx=42
{ "remote-rcvbuf",required_argument,0,0 },// optidx=43
{ "remote-sndbuf",required_argument,0,0 },// optidx=44
{ "socks",no_argument,0,0 },// optidx=45
{ "no-resolve",no_argument,0,0 },// optidx=46
{ "skip-nodelay",no_argument,0,0 },// optidx=47
#if defined(BSD) && !defined(__OpenBSD__) && !defined(__APPLE__)
{ "enable-pf",no_argument,0,0 },// optidx=47
{ "enable-pf",no_argument,0,0 },// optidx=48
#endif
{ "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility
{ NULL,0,NULL,0 }
@@ -603,36 +605,51 @@ void parse_params(int argc, char *argv[])
exit_clean(1);
}
break;
case 38: /* pidfile */
case 38: /* hostlist-auto-debug */
{
FILE *F = fopen(optarg,"a+t");
if (!F)
{
fprintf(stderr, "cannot create %s\n", optarg);
exit_clean(1);
}
fclose(F);
if (params.droproot && chown(optarg, params.uid, -1))
fprintf(stderr, "could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", optarg);
strncpy(params.hostlist_auto_debuglog, optarg, sizeof(params.hostlist_auto_debuglog));
params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0';
}
break;
case 39: /* pidfile */
strncpy(params.pidfile,optarg,sizeof(params.pidfile));
params.pidfile[sizeof(params.pidfile)-1]='\0';
break;
case 39:
case 40:
params.debug = optarg ? atoi(optarg) : 1;
break;
case 40: /* local-rcvbuf */
case 41: /* local-rcvbuf */
params.local_rcvbuf = atoi(optarg)/2;
break;
case 41: /* local-sndbuf */
case 42: /* local-sndbuf */
params.local_sndbuf = atoi(optarg)/2;
break;
case 42: /* remote-rcvbuf */
case 43: /* remote-rcvbuf */
params.remote_rcvbuf = atoi(optarg)/2;
break;
case 43: /* remote-sndbuf */
case 44: /* remote-sndbuf */
params.remote_sndbuf = atoi(optarg)/2;
break;
case 44: /* socks */
case 45: /* socks */
params.proxy_type = CONN_TYPE_SOCKS;
break;
case 45: /* no-resolve */
case 46: /* no-resolve */
params.no_resolve = true;
break;
case 46: /* skip-nodelay */
case 47: /* skip-nodelay */
params.skip_nodelay = true;
break;
#if defined(BSD) && !defined(__OpenBSD__) && !defined(__APPLE__)
case 47: /* enable-pf */
case 48: /* enable-pf */
params.pf_enable = true;
break;
#endif