Домашний DPI, или как бороться с провайдером его же методами

local prefer_hosts = false
local prefer_socks_hosts = true

local intercept_domains = {".t.co", ".twimg.com", ".twitter.com", ".twttr.com"}

local cached_domains = ngx.shared.domains
local host = nil

local socket = ngx.req.socket(true)
socket.socktype = "CLIENT"
local god = require("resty.getorigdest")
local dest = god.getorigdest(socket)
local sni_name = ngx.var.ssl_preread_server_name
ngx.log(ngx.DEBUG, dest)
ngx.log(ngx.DEBUG, sni_name)
local openssl = require("resty.openssl")
openssl.load_modules()
local ngx_re = require("ngx.re")
local cjson = require("cjson")
local socks5 = require("resty.socks5")
local struct = require("struct")

local dests = ngx_re.split(dest, ":")
local dest_addr = dests[1]
local dest_port = tonumber(dests[2])

local connect_type_last = nil

local socket_create_with_type = function(typename)
    local target = ngx.socket.tcp()
    target.socktype = typename
    return target
end

local socket_connect_dest = function(target)
    local ok = nil
    local err = nil
    if (prefer_hosts == true and host ~= nil) then
        ok, err = target:connect(host, dest_port)
        connect_type_last = "host"
        if (err ~= nil) then
            local socktype = target.socktype
            target = socket_create_with_type(socktype)
            ok, err = target:connect(dest_addr, dest_port)
            connect_type_last = "ip"
        end
    else
        ok, err = target:connect(dest_addr, dest_port)
        connect_type_last = "ip"
        if (err ~= nil and host ~= nil) then
            local socktype = target.socktype
            target = socket_create_with_type(socktype)
            ok, err = target:connect(host, dest_port)
            connect_type_last = "host"
        end
    end
    if (ok == nil and err == nil) then
        err = "failure"
    end
    return target, err
end

local intercept = false
local connected = false
local isCached = false
local upstream = socket_create_with_type("UPSTREAM")

local bufsize = 1024 * 16
local peek, err, partpeek = socket:receiveany(bufsize)

if (peek == nil and partpeek ~= nil) then
    peek = partpeek
elseif (err ~= nil) then
    ngx.log(ngx.WARN, err)
end

local domainIntercept = false
if (sni_name ~= nil) then
    for _, v in pairs(intercept_domains) do
        local domain = "." .. sni_name
        local match = domain:sub(-string.len(v)) == v
        if (match == true) then
            domainIntercept = true
            ngx.log(ngx.DEBUG, sni_name .. " intercepted based on rule " .. v)
            --                      host = sni_name;
            break
        end
    end
end

if (domainIntercept == true) then
    intercept = true
elseif
    (dest_port == 80 or ngx.re.match(peek, "(^GET \\/)|(HTTP\\/1\\.0[\\r\\n]{1,2})|(HTTP\\/1\\.1[\\r\\n]{1,2})") ~= nil)
 then
    local http_host_find, err =
        ngx.re.match(peek, "[\\r\\n]{1,2}([hH][oO][sS][tT]:[ ]?){1}(?<host>[0-9A-Za-z\\-\\.]+)[\\r\\n]{1,2}")
    local http_host = nil
    if (http_host_find ~= nil and http_host_find["host"] ~= false) then
        http_host = http_host_find["host"]
    end

    if (http_host ~= nil and host == nil) then
        host = http_host
    end

    local cached = nil
    if (host ~= nil) then
        cached = cached_domains:get(host)
    end
    if (cached ~= nil) then
        ngx.log(ngx.INFO, "retrieved cached interception info: intercept=" .. tostring(cached))
        intercept = cached
        isCached = true
    else
        local err = nil
        upstream, err = socket_connect_dest(upstream)

        if (err ~= nil) then
            intercept = true
        else
            local ok, err = upstream:send(peek)
            if (err ~= nil) then
                ngx.log(ngx.WARN, err)
            end
            local data, err, partdata = upstream:receiveany(bufsize)
            if (data == nil and partdata ~= nil) then
                data = partdata
            elseif (err ~= nil) then
                ngx.log(ngx.WARN, err)
            end
            if (data ~= nil) then
                local match = "\r\nLocation: http://blackhole.beeline.ru/"
                local matched = data:find(match, 1, true)
                if (matched ~= nil) then
                    upstream:close()
                    upstream = socket_create_with_type("UPSTREAM")
                    intercept = true
                else
                    connected = true
                    local ok, err = socket:send(data)
                    if (err ~= nil) then
                        ngx.log(ngx.WARN, err)
                    end
                    peek = nil
                end
            end
        end
    end
elseif (dest_port == 443 or sni_name ~= nil) then
    local serv_host = nil

    if (sni_name ~= nil and host == nil) then
        host = sni_name
    end

    local cached = nil
    if (host ~= nil) then
        cached = cached_domains:get(host)
    end
    if (cached ~= nil) then
        ngx.log(ngx.INFO, "retrieved cached interception info: intercept=" .. tostring(cached))
        intercept = cached
        isCached = true
    else
        local err = nil
        upstream, err = socket_connect_dest(upstream)
        ngx.log(ngx.DEBUG, err)

        if (err ~= nil) then
            intercept = true
        else
            local ok, err = upstream:send(peek)
            if (err ~= nil) then
                ngx.log(ngx.WARN, err)
            end

            -- Parsing the ServerHello packet to retrieve the certificate
            local offset = 1
            local data = ""
            local size = 0
            local servercert = nil
            upstream:settimeouts(2000, 60000, 1000)
            while (servercert == nil) do
                if (size == 0 or offset >= size) then
                    local data2, err, partdata = upstream:receiveany(bufsize)
                    if (data2 ~= nil) then
                        data = data .. data2
                    elseif (data2 == nil and partdata ~= nil and partdata:len() > 0) then
                        data = data .. partdata
                    elseif (err ~= nil) then
                        ngx.log(ngx.WARN, err)
                        break
                    end
                    size = data:len()
                    ngx.log(ngx.DEBUG, "UPSTREAM received for ServerHello certificate retrieval! " .. size)
                end
                ngx.log(ngx.DEBUG, offset)
                if (offset < size) then
                    local contenttype, version, length, subtype = struct.unpack(">BHHB", data, offset)
                    if (contenttype ~= 22) then
                        -- We got something other than handshake before we retrieved the cert, probably the server is sending the cert encrypted, fallback to legacy cert retrieval
                        break
                    elseif (subtype ~= 11) then
                        offset = offset + 5 + length
                    else
                        local suboffset = offset + 5
                        local _, _, _, _, certslength, _, firstcertlength = struct.unpack(">BBHBHBH", data, suboffset)
                        -- We need only the first cert, we don't care about the others in the chain
                        local firstcert = data:sub(suboffset + 1 + 3 + 3 + 3, firstcertlength)
                        servercert = firstcert
                    end
                end
            end
            upstream:settimeouts(2000, 60000, 60000)

            local cert = nil
            if (servercert ~= nil) then
                cert = openssl.x509.new(servercert, "DER")
                ngx.log(ngx.DEBUG, "Cert retrieved from ServerHello peeking")
            else
                -- We employ a legacy method of gathering the certificate, involving connecting to the server and doing a SSL handshake by ourselves
                ngx.log(ngx.DEBUG, "LEGACY CERT RETRIEVE")
                local serv = socket_create_with_type("TLSCHECK")
                local err = nil
                serv, err = socket_connect_dest(serv)

                ngx.log(ngx.DEBUG, err)
                local session, err = serv:sslhandshake(false, sni_name, false, false)
                if (err ~= nil) then
                    ngx.log(ngx.DEBUG, err)
                    -- We fallback to proxying in case if we failed to connect due to timeout or reset (we are blackholed)
                    intercept = true
                else
                    ngx.log(ngx.DEBUG, err)
                    local sslsess, err = openssl.ssl.from_socket(serv)
                    ngx.log(ngx.DEBUG, err)
                    if (sslsess ~= nil) then
                        cert = sslsess:get_peer_certificate()
                        ngx.log(ngx.DEBUG, "Cert retrieved from secondary handshake")
                    end
                end
                serv:close()
            end

            -- Parsing the certificate
            if (cert ~= nil) then
                local sub = cert:get_subject_name()
                local alt = cert:get_subject_alt_name()

                for k, obj in pairs(sub) do
                    ngx.log(ngx.DEBUG, k .. " " .. cjson.encode(obj))

                    if (serv_host == nil and k == "CN" and obj.blob:find("*", 1, true) == nil) then
                        serv_host = obj.blob
                    end

                    if
                        (k == "CN" and obj.blob == "megafon.ru" and
                            (sni_name == nil or sni_name:find("megafon.ru", 1, true) == nil))
                     then
                        ngx.log(ngx.DEBUG, k .. " " .. obj.blob)
                        upstream:close()
                        upstream = socket_create_with_type("UPSTREAM")
                        intercept = true
                    end
                end
                for k, obj in pairs(alt) do
                    ngx.log(ngx.DEBUG, k .. " " .. cjson.encode(obj))

                    if (serv_host == nil and k == "DNS" and obj:find("*", 1, true) == nil) then
                        serv_host = obj
                    end
                end
            end

            if (serv_host ~= nil and host == nil) then
                host = serv_host
            end

            if (intercept ~= true) then
                connected = true
                local ok, err = socket:send(data)
                if (err ~= nil) then
                    ngx.log(ngx.WARN, err)
                end
                peek = nil
            end
        end
    end
end

if (connected == false and intercept == false) then
    local err = nil
    upstream, err = socket_connect_dest(upstream)

    if (err ~= nil) then
        intercept = true
        upstream = socket_create_with_type("UPSTREAM")
    end
end

if (isCached == false and domainIntercept == false) then
    ngx.log(ngx.DEBUG, "Saving cached data: host=" .. host .. ", intercept=" .. tostring(intercept))
    cached_domains:set(host, intercept)
end

if (intercept == true) then
    local ok, err = upstream:connect("192.168.120.1", 45213)
    ngx.log(ngx.DEBUG, err)
    ok, err = socks5.auth(upstream)
    ngx.log(ngx.DEBUG, err)

    local ok = nil
    local err = nil
    if (prefer_socks_hosts == true and host ~= nil) then
        ok, err = socks5.connect(upstream, host, dest_port)
        connect_type_last = "socks_host"
        if (err ~= nil) then
            upstream = socket_create_with_type("UPSTREAM")
            upstream:connect("192.168.120.1", 45213)
            ok, err = socks5.auth(upstream)
            ok, err = socks5.connect_ip(upstream, dest_ip, dest_port)
            connect_type_last = "socks_ip"
        end
    else
        ok, err = socks5.connect_ip(upstream, dest_addr, dest_port)
        connect_type_last = "socks_ip"
        if (err ~= nil and host ~= nil) then
            upstream = socket_create_with_type("UPSTREAM")
            upstream:connect("192.168.120.1", 45213)
            ok, err = socks5.auth(upstream)
            ok, err = socks5.connect(upstream, host, dest_port)
            connect_type_last = "socks_host"
        end
    end
    ngx.log(ngx.DEBUG, err)
end

upstream:setoption("keepalive", true)
upstream:setoption("tcp-nodelay", true)
upstream:setoption("sndbuf", bufsize)
upstream:setoption("rcvbuf", bufsize)

ngx.log(
    ngx.INFO,
    "RESULT: " ..
        tostring(host) ..
            "/" ..
                dest_addr ..
                    ":" .. dest_port .. " intercept:" .. tostring(intercept) .. " connecttype:" .. connect_type_last
)

local ok = false

if (peek ~= nil and peek:len() > 0) then
    ok, err = upstream:send(peek)
    if (err ~= nil) then
        ngx.log(ngx.WARN, err)
    end
else
    ok = true
end

local pipe = function(src, dst)
    while true do
        local data, err, partial = src:receiveany(bufsize)

        local errs = nil
        local ok = false
        if (data ~= nil) then
            ok, errs = dst:send(data)
        elseif (data == nil and partial ~= nil) then
            ok, errs = dst:send(partial)
        elseif (err == "closed") then
            ngx.log(ngx.WARN, src.socktype .. ":" .. err)
            return
        elseif (err ~= nil and err ~= "timeout") then
            ngx.log(ngx.WARN, src.socktype .. ":" .. err)
        end

        if (errs == "closed") then
            ngx.log(ngx.WARN, dst.socktype .. ":" .. errs)
            return
        elseif (errs ~= nil) then
            ngx.log(ngx.WARN, dst.socktypeerr .. ":" .. errs)
        end
    end
end

if (ok ~= false) then
    local co_updown = ngx.thread.spawn(pipe, upstream, socket)
    local co_downup = ngx.thread.spawn(pipe, socket, upstream)

    ngx.thread.wait(co_updown, co_downup)
end

upstream:close()
ngx.flush(true)
socket:shutdown("send")