From cd9ffba37c09c8bf72ccb7ad611d1794a711f560 Mon Sep 17 00:00:00 2001 From: eddc005 Date: Wed, 12 Jun 2024 23:52:41 +0100 Subject: [PATCH] feat: tor analyzer (phase 1) --- analyzer/tcp/tor.go | 61 ++++++++++++++++ cmd/root.go | 1 + ruleset/builtins/tor/interface.go | 9 +++ ruleset/builtins/tor/onionoo.go | 111 ++++++++++++++++++++++++++++++ ruleset/expr.go | 15 ++++ 5 files changed, 197 insertions(+) create mode 100644 analyzer/tcp/tor.go create mode 100644 ruleset/builtins/tor/interface.go create mode 100644 ruleset/builtins/tor/onionoo.go diff --git a/analyzer/tcp/tor.go b/analyzer/tcp/tor.go new file mode 100644 index 0000000..c579aa4 --- /dev/null +++ b/analyzer/tcp/tor.go @@ -0,0 +1,61 @@ +package tcp + +import ( + "github.com/apernet/OpenGFW/analyzer" + "github.com/apernet/OpenGFW/ruleset/builtins/tor" +) + +var _ analyzer.TCPAnalyzer = (*TorAnalyzer)(nil) + +type TorAnalyzer struct{ + directory tor.TorDirectory +} + +func (a *TorAnalyzer) Init() error { + var err error + a.directory, err = tor.GetOnionooDirectory() + return err +} + +func (a *TorAnalyzer) Name() string { + return "tor" +} + +// For now only TCP metadata is needed +func (a *TorAnalyzer) Limit() int { + return 1 +} + +func (a *TorAnalyzer) NewTCP(info analyzer.TCPInfo, logger analyzer.Logger) analyzer.TCPStream { + isRelay := a.directory.Query(info.DstIP, info.DstPort) + return newTorStream(logger, isRelay) +} + +type torStream struct { + logger analyzer.Logger + isRelay bool // Public relay identifier +} + +func newTorStream(logger analyzer.Logger, isRelay bool) *torStream { + return &torStream{logger: logger, isRelay: isRelay} +} + +func (s *torStream) Feed(rev, start, end bool, skip int, data []byte) (u *analyzer.PropUpdate, done bool) { + if skip != 0 { + return nil, true + } + if len(data) == 0 { + return nil, false + } + + return &analyzer.PropUpdate{ + Type: analyzer.PropUpdateReplace, + M: analyzer.PropMap{ + "relay": s.isRelay, + }, + }, true +} + +func (s *torStream) Close(limited bool) *analyzer.PropUpdate { + return nil +} diff --git a/cmd/root.go b/cmd/root.go index 1ccf025..2e11424 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -93,6 +93,7 @@ var analyzers = []analyzer.Analyzer{ &tcp.SocksAnalyzer{}, &tcp.SSHAnalyzer{}, &tcp.TLSAnalyzer{}, + &tcp.TorAnalyzer{}, &tcp.TrojanAnalyzer{}, &udp.DNSAnalyzer{}, &udp.OpenVPNAnalyzer{}, diff --git a/ruleset/builtins/tor/interface.go b/ruleset/builtins/tor/interface.go new file mode 100644 index 0000000..18c7e09 --- /dev/null +++ b/ruleset/builtins/tor/interface.go @@ -0,0 +1,9 @@ +package tor + +import "net" + +type TorDirectory interface { + Init() error + Add(ip net.IP, port uint16) + Query(ip net.IP, port uint16) bool +} diff --git a/ruleset/builtins/tor/onionoo.go b/ruleset/builtins/tor/onionoo.go new file mode 100644 index 0000000..545bffa --- /dev/null +++ b/ruleset/builtins/tor/onionoo.go @@ -0,0 +1,111 @@ +package tor + +import ( + "encoding/json" + "fmt" + "io" + "net" + "net/http" + "strconv" + "sync" +) + +const ( + onionooUrl = "https://onionoo.torproject.org/details" +) + +var _ TorDirectory = (*OnionooDirectory)(nil) + +// Singleton instance +var onionooInstance *OnionooDirectory +var once sync.Once + +func GetOnionooDirectory() (*OnionooDirectory, error) { + var err error + // Singleton initialization + once.Do(func() { + onionooInstance = &OnionooDirectory{ + directory: make(map[string]struct{}), + } + err = onionooInstance.Init() + }) + return onionooInstance, err +} + +type OnionooDirectory struct { + directory map[string]struct{} + sync.RWMutex +} + +// example detail entry +// {..., "or_addresses":["195.15.242.99:9001","[2001:1600:10:100::201]:9001"], ...} + +type OnionooDetail struct { + OrAddresses []string `json:"or_addresses"` +} + +type OnionooResponse struct { + Relays []OnionooDetail `json:"relays"` +} + +func (d *OnionooDirectory) Init() error { + response, err := d.downloadDirectory(onionooUrl) + if err != nil { + return err + } + for _, relay := range response.Relays { + for _, address := range relay.OrAddresses { + ipStr, portStr, err := net.SplitHostPort(address) + if err != nil { + continue + } + ip := net.ParseIP(ipStr) + port, err := strconv.ParseUint(portStr, 10, 16) + if ip != nil && err == nil { + d.Add(ip, uint16(port)) + } + } + } + // TODO: log number of entries loaded + return nil +} + +func (d *OnionooDirectory) Add(ip net.IP, port uint16) { + d.Lock() + defer d.Unlock() + addr := net.JoinHostPort(ip.String(), strconv.FormatUint(uint64(port), 10)) + d.directory[addr] = struct{}{} +} + +func (d *OnionooDirectory) Query(ip net.IP, port uint16) bool { + d.RLock() + defer d.RUnlock() + addr := net.JoinHostPort(ip.String(), strconv.FormatUint(uint64(port), 10)) + _, exists := d.directory[addr] + return exists +} + +func (d *OnionooDirectory) downloadDirectory(url string) (*OnionooResponse, error) { + resp, err := http.Get(url) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + return nil, fmt.Errorf("failed to fetch onionoo data: status code %d", resp.StatusCode) + } + + body, err := io.ReadAll(resp.Body) + if err != nil { + return nil, err + } + + var onionooResponse OnionooResponse + err = json.Unmarshal(body, &onionooResponse) + if err != nil { + return nil, fmt.Errorf("failed to parse onionoo json response: %s", err) + } + + return &onionooResponse, nil +} diff --git a/ruleset/expr.go b/ruleset/expr.go index 373d0d3..a7539ba 100644 --- a/ruleset/expr.go +++ b/ruleset/expr.go @@ -18,6 +18,7 @@ import ( "gopkg.in/yaml.v3" "github.com/apernet/OpenGFW/analyzer" + "github.com/apernet/OpenGFW/analyzer/tcp" "github.com/apernet/OpenGFW/modifier" "github.com/apernet/OpenGFW/ruleset/builtins" ) @@ -153,6 +154,9 @@ func CompileExprRules(rules []ExprRule, ans []analyzer.Analyzer, mods []modifier } else if a, ok := fullAnMap[name]; ok { // Analyzer, add to dependency map depAnMap[name] = a + if err:= analyzersInit(a); err != nil { + return nil, err + } } } cr := compiledExprRule{ @@ -242,6 +246,17 @@ func analyzersToMap(ans []analyzer.Analyzer) map[string]analyzer.Analyzer { return anMap } +// analyzersInit invokes custom analyzer init logics +func analyzersInit(a analyzer.Analyzer) error { + switch impl := a.(type) { + case *tcp.TorAnalyzer: + if err := impl.Init(); err != nil { + return err + } + } + return nil +} + // modifiersToMap converts a list of modifiers to a map of name -> modifier. // This is for easier lookup when compiling rules. func modifiersToMap(mods []modifier.Modifier) map[string]modifier.Modifier {