helper-program to use iptables

diff --git a/src/vpn/Makefile.am b/src/vpn/Makefile.am
index 8af6af749857a4b7261484feb94b4ed7cade74b3..77e49e098e63a5347a8689c0a024d312799b4553 100644 (file)
--- a/src/vpn/Makefile.am
+++ b/src/vpn/Makefile.am
@@ -10,16 +10,19 @@ endif
 
 if LINUX
 VPNBIN = gnunet-helper-vpn
+HIJACKBIN = gnunet-helper-hijack-dns
 install-exec-hook:
        chown root $(bindir)/gnunet-helper-vpn || true
        chmod u+s $(bindir)/gnunet-helper-vpn || true
+       chown root $(bindir)/gnunet-helper-hijack-dns || true
+       chmod u+s $(bindir)/gnunet-helper-hijack-dns || true
 else
 install-exec-hook:
 endif
 
 
 bin_PROGRAMS = \
- gnunet-daemon-vpn $(VPNBIN)
+ gnunet-daemon-vpn $(VPNBIN) $(HIJACKBIN)
 
 
 gnunet_helper_vpn_SOURCES = \
@@ -27,13 +30,8 @@ gnunet_helper_vpn_SOURCES = \
  gnunet-vpn-helper-p.h \
  gnunet-vpn-tun.h gnunet-vpn-tun.c
 
-# debug.c  debug.h \
-# packet.h packet.c \
-# pretty-print.c  pretty-print.h \
-# tcp.c  tcp.h \
-# test.c \
-# tun.c  tun.h \
-# udp.c udp.h
+gnunet_helper_hijack_dns_SOURCES = \
+ gnunet-helper-hijack-dns.c
 
 gnunet_daemon_vpn_SOURCES = \
  gnunet-daemon-vpn.c gnunet-vpn-pretty-print.c

diff --git a/src/vpn/gnunet-helper-hijack-dns.c b/src/vpn/gnunet-helper-hijack-dns.c
new file mode 100644 (file)
index 0000000..7add2cc
--- /dev/null
+++ b/src/vpn/gnunet-helper-hijack-dns.c
@@ -0,0 +1,91 @@
+/*
+   This file is part of GNUnet.
+   (C) 2010 Christian Grothoff
+
+   GNUnet is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published
+   by the Free Software Foundation; either version 3, or (at your
+   option) any later version.
+
+   GNUnet is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with GNUnet; see the file COPYING.  If not, write to the
+   Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+   Boston, MA 02111-1307, USA.
+   */
+
+/**
+ * @file vpn/gnunet-helper-hijack-dns.c
+ * @brief
+ * @author Philipp Tölke
+ */
+#define _GNU_SOURCE
+
+#include <arpa/inet.h>
+
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/stat.h>
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <gnunet_common.h>
+
+int fork_and_exec(char* file, char* cmd[]) {
+       pid_t pid = fork();
+       if (pid < 0) {
+               fprintf(stderr, "could not fork: %m\n");
+               return GNUNET_SYSERR;
+       }
+
+       int st = 0;
+
+       if (pid == 0) {
+               execv(file, cmd);
+       } else {
+               waitpid(pid, &st, 0);
+       }
+       return WIFEXITED(st) && (WEXITSTATUS(st) == 0);
+}
+
+int main(int argc, char** argv) {
+       int delete = 0;
+       int port = 0;
+       if (argc < 2) return GNUNET_SYSERR;
+
+       if (strncmp(argv[1], "-d", 2) == 0) {
+               if (argc < 3) return GNUNET_SYSERR;
+               delete = 1;
+               port = atoi(argv[2]);
+       } else {
+               port = atoi(argv[1]);
+       }
+
+       if (port == 0) return GNUNET_SYSERR;
+
+       struct stat s;
+       if (stat("/sbin/iptables", &s) < 0) {
+               fprintf(stderr, "stat on /sbin/iptables failed: %m\n");
+               return GNUNET_SYSERR;
+       }
+
+       char localport[7];
+       snprintf(localport, 7, "%d", port);
+
+       int r;
+       if (delete) {
+               r = fork_and_exec("/sbin/iptables", (char*[]){"iptables", "-t", "nat", "-D", "OUTPUT", "-p", "udp", "--sport", localport, "--dport", "53", "-j", "ACCEPT", NULL});
+               r = fork_and_exec("/sbin/iptables", (char*[]){"iptables", "-t", "nat", "-D", "OUTPUT", "-p", "udp", "--dport", "53", "-j", "DNAT", "--to-destination", "10.10.10.2:53", NULL});
+       } else {
+               r = fork_and_exec("/sbin/iptables", (char*[]){"iptables", "-t", "nat", "-I", "OUTPUT", "1", "-p", "udp", "--sport", localport, "--dport", "53", "-j", "ACCEPT", NULL});
+               r = fork_and_exec("/sbin/iptables", (char*[]){"iptables", "-t", "nat", "-I", "OUTPUT", "2", "-p", "udp", "--dport", "53", "-j", "DNAT", "--to-destination", "10.10.10.2:53", NULL});
+       }
+       if (r) return GNUNET_YES;
+       return GNUNET_SYSERR;
+}