mirror of
https://github.com/alexbers/mtprotoproxy.git
synced 2026-03-14 07:13:09 +00:00
remove the hackish logic against replay attacks because it stopped to work with new android clients
see https://github.com/alexbers/mtprotoproxy/issues/183
This commit is contained in:
@@ -89,7 +89,6 @@ is_time_skewed = False
|
|||||||
fake_cert_len = random.randrange(1024, 4096)
|
fake_cert_len = random.randrange(1024, 4096)
|
||||||
mask_host_cached_ip = None
|
mask_host_cached_ip = None
|
||||||
last_clients_with_time_skew = {}
|
last_clients_with_time_skew = {}
|
||||||
last_clients_with_first_pkt_error = collections.Counter()
|
|
||||||
last_clients_with_same_handshake = collections.Counter()
|
last_clients_with_same_handshake = collections.Counter()
|
||||||
proxy_start_time = 0
|
proxy_start_time = 0
|
||||||
proxy_links = []
|
proxy_links = []
|
||||||
@@ -217,10 +216,6 @@ def init_config():
|
|||||||
# length of last client ip addresses for logging
|
# length of last client ip addresses for logging
|
||||||
conf_dict.setdefault("CLIENT_IPS_LEN", 131072)
|
conf_dict.setdefault("CLIENT_IPS_LEN", 131072)
|
||||||
|
|
||||||
# block bad first packets to even more protect against replay-based fingerprinting
|
|
||||||
block_on_first_pkt = conf_dict["MODES"]["classic"] or conf_dict["MODES"]["secure"]
|
|
||||||
conf_dict.setdefault("BLOCK_IF_FIRST_PKT_BAD", block_on_first_pkt)
|
|
||||||
|
|
||||||
# delay in seconds between stats printing
|
# delay in seconds between stats printing
|
||||||
conf_dict.setdefault("STATS_PRINT_PERIOD", 600)
|
conf_dict.setdefault("STATS_PRINT_PERIOD", 600)
|
||||||
|
|
||||||
@@ -1607,9 +1602,7 @@ async def handle_client(reader_clt, writer_clt):
|
|||||||
else:
|
else:
|
||||||
return
|
return
|
||||||
|
|
||||||
async def connect_reader_to_writer(rd, wr, user, rd_buf_size, block_if_first_pkt_bad=False):
|
async def connect_reader_to_writer(rd, wr, user, rd_buf_size):
|
||||||
global last_clients_with_first_pkt_error
|
|
||||||
is_first_pkt = True
|
|
||||||
try:
|
try:
|
||||||
while True:
|
while True:
|
||||||
data = await rd.read(rd_buf_size)
|
data = await rd.read(rd_buf_size)
|
||||||
@@ -1618,18 +1611,6 @@ async def handle_client(reader_clt, writer_clt):
|
|||||||
else:
|
else:
|
||||||
extra = {}
|
extra = {}
|
||||||
|
|
||||||
# protection against replay-based fingerprinting
|
|
||||||
if is_first_pkt:
|
|
||||||
is_first_pkt = False
|
|
||||||
|
|
||||||
ERR_PKT_DATA = b'l\xfe\xff\xff'
|
|
||||||
if block_if_first_pkt_bad and data == ERR_PKT_DATA:
|
|
||||||
last_clients_with_first_pkt_error[cl_ip] += 1
|
|
||||||
|
|
||||||
wr.write_eof()
|
|
||||||
await wr.drain()
|
|
||||||
return
|
|
||||||
|
|
||||||
if not data:
|
if not data:
|
||||||
wr.write_eof()
|
wr.write_eof()
|
||||||
await wr.drain()
|
await wr.drain()
|
||||||
@@ -1642,8 +1623,7 @@ async def handle_client(reader_clt, writer_clt):
|
|||||||
# print_err(e)
|
# print_err(e)
|
||||||
pass
|
pass
|
||||||
|
|
||||||
tg_to_clt = connect_reader_to_writer(reader_tg, writer_clt, user, get_to_clt_bufsize(),
|
tg_to_clt = connect_reader_to_writer(reader_tg, writer_clt, user, get_to_clt_bufsize())
|
||||||
block_if_first_pkt_bad=config.BLOCK_IF_FIRST_PKT_BAD)
|
|
||||||
clt_to_tg = connect_reader_to_writer(reader_clt, writer_tg, user, get_to_tg_bufsize())
|
clt_to_tg = connect_reader_to_writer(reader_clt, writer_tg, user, get_to_tg_bufsize())
|
||||||
task_tg_to_clt = asyncio.ensure_future(tg_to_clt)
|
task_tg_to_clt = asyncio.ensure_future(tg_to_clt)
|
||||||
task_clt_to_tg = asyncio.ensure_future(clt_to_tg)
|
task_clt_to_tg = asyncio.ensure_future(clt_to_tg)
|
||||||
@@ -1733,7 +1713,6 @@ async def handle_metrics(reader, writer):
|
|||||||
global proxy_start_time
|
global proxy_start_time
|
||||||
global proxy_links
|
global proxy_links
|
||||||
global last_clients_with_time_skew
|
global last_clients_with_time_skew
|
||||||
global last_clients_with_first_pkt_error
|
|
||||||
global last_clients_with_same_handshake
|
global last_clients_with_same_handshake
|
||||||
|
|
||||||
client_ip = writer.get_extra_info("peername")[0]
|
client_ip = writer.get_extra_info("peername")[0]
|
||||||
@@ -1793,7 +1772,6 @@ async def stats_printer():
|
|||||||
global user_stats
|
global user_stats
|
||||||
global last_client_ips
|
global last_client_ips
|
||||||
global last_clients_with_time_skew
|
global last_clients_with_time_skew
|
||||||
global last_clients_with_first_pkt_error
|
|
||||||
global last_clients_with_same_handshake
|
global last_clients_with_same_handshake
|
||||||
|
|
||||||
while True:
|
while True:
|
||||||
@@ -1819,12 +1797,6 @@ async def stats_printer():
|
|||||||
print("%s, clocks were %d minutes behind" % (ip, skew_minutes))
|
print("%s, clocks were %d minutes behind" % (ip, skew_minutes))
|
||||||
print(flush=True)
|
print(flush=True)
|
||||||
last_clients_with_time_skew.clear()
|
last_clients_with_time_skew.clear()
|
||||||
if last_clients_with_first_pkt_error:
|
|
||||||
print("Clients with error on the first packet (possible replay-attackers):")
|
|
||||||
for ip, times in last_clients_with_first_pkt_error.items():
|
|
||||||
print("%s, %d times" % (ip, times))
|
|
||||||
print(flush=True)
|
|
||||||
last_clients_with_first_pkt_error.clear()
|
|
||||||
if last_clients_with_same_handshake:
|
if last_clients_with_same_handshake:
|
||||||
print("Clients with duplicate handshake (likely replay-attackers):")
|
print("Clients with duplicate handshake (likely replay-attackers):")
|
||||||
for ip, times in last_clients_with_same_handshake.items():
|
for ip, times in last_clients_with_same_handshake.items():
|
||||||
|
|||||||
Reference in New Issue
Block a user