rendered paste bodyIndex: configure.ac
===================================================================
--- configure.ac (revision 1776)
+++ configure.ac (working copy)
@@ -10,6 +10,8 @@
AM_INIT_AUTOMAKE([nepenthes], [0.2.2])
AC_REVISION([$Id$])
+AC_PROG_LIBTOOL
+
AC_PREFIX_DEFAULT(/opt/nepenthes)
AC_CONFIG_SRCDIR([nepenthes-core/include/Buffer.hpp])
AM_CONFIG_HEADER([config.h])
@@ -17,6 +19,7 @@
AM_CONDITIONAL(NDEBUG, test "$disable_debug" = yes)
AM_CONDITIONAL(PROFILE, test "$enable_profile" = yes)
+AM_CONDITIONAL(NFQUEUE, test x"$enable_nfqueue" = xyes)
AC_CANONICAL_HOST
AC_C_CONST
@@ -163,7 +166,7 @@
AC_CHECK_FUNCS([strndup alarm bzero gethostbyname gethostname gettimeofday inet_ntoa localtime_r memmove memset munmap select socket strcasecmp strdup strerror strncasecmp strstr strtoul setresgid setresuid])
-# libadns
+# libadns
AC_SUBST([LIB_ADNS])
# libpcre
@@ -252,9 +255,9 @@
if test x$ipq_inc != "xno"; then
CPPFLAGS="${CPPFLAGS} -I${ipq_inc}"
fi
-
+
AC_CHECK_HEADER(libipq.h,[enable_ipq=yes],[enable_ipq=no])
-
+
if test x$enable_ipq = "xyes" ; then
if test x$ipq_lib != "xno"; then
LDFLAGS="${LDFLAGS} -L${ipq_lib}"
@@ -305,11 +308,11 @@
AC_DEFINE([HAVE_PCAP], [1], [Define to 1 if you have packet capture library])
fi
fi
-
-fi
+fi
+
dnl **************************************************
dnl * ipfw support *
dnl **************************************************
@@ -320,19 +323,35 @@
if test x$enable_ipfw = "xyes"; then
AC_DEFINE([HAVE_IPFW], [1], [Define to 1 if you want ipfw divert on FreeBSD])
-fi
-
+fi
dnl **************************************************
+dnl * nfqueue support *
+dnl **************************************************
+AC_ARG_ENABLE(nfqueue,
+[ --enable-nfqueue enable Linux 2.6.14+ nfqueue support],
+ enable_nfqueue="$enableval", enable_nfqueue="no")
+
+have_nfqueue="no"
+
+if test x$enable_nfqueue = "xyes"; then
+ AC_CHECK_LIB([netfilter_queue], [nfq_open], have_nfqueue="yes", have_nfqueue="",[-lnfnetlink])
+ if test x$have_nfqueue = "xyes" ; then
+ AC_DEFINE([HAVE_NFQUEUE], [1], [Define to 1 if you have netfilter queue library for capture] )
+ fi
+fi
+
+
+dnl **************************************************
dnl * debug logging *
dnl **************************************************
-AC_ARG_ENABLE(debug-logging, [ --enable-debug-logging spam the console and logfile with all debug information [default=no]],
+AC_ARG_ENABLE(debug-logging, [ --enable-debug-logging spam the console and logfile with all debug information [default=no]],
enable_debug_logging="$enableval", enable_debug_logging="no")
if test x$enable_debug_logging = "xyes"; then
AC_DEFINE([HAVE_DEBUG_LOGGING], [1], [Define to 1 if you need debug logging])
-fi
+fi
# Checks for generic libraries.
@@ -368,11 +387,11 @@
orig_cppflags=$CPPFLAGS
orig_libs=$LIBS
-
+
CPPFLAGS="$CPPFLAGS `curl-config --cflags`"
LIBS="$LIBS `curl-config --libs`"
-
+
AC_CHECK_LIB([curl], [curl_version],
[AC_DEFINE(HAVE_LIBCURL, 1,
[Define if you want to use libcurl])
@@ -383,8 +402,8 @@
CPPFLAGS=$orig_cppflags
LIBS=$orig_libs
fi
-
+
dnl **************************************************
dnl * libpcre Support *
dnl **************************************************
@@ -401,7 +420,7 @@
if test xyes = "xyes"; then
orig_cppflags=$CPPFLAGS
-
+
if test "x$pcre_inc" != xno; then
CPPFLAGS="-I$pcre_inc $CPPFLAGS"
fi
@@ -410,14 +429,14 @@
if test "x$pcre_lib" != "xno"; then
LDFLAGS="-L$pcre_lib $LDFLAGS"
fi
-
+
AC_CHECK_LIB([pcre], [pcre_compile],
[AC_DEFINE(HAVE_LIBPCRE, 1,
[Define if you want to use libpcre])
LIB_PCRE="-lpcre"],
[AC_MSG_ERROR([libpcre is missing - install it please])
])
-fi
+fi
dnl **************************************************
dnl * libmagic Support *
@@ -435,7 +454,7 @@
if test xyes = "xyes"; then
orig_cppflags=$CPPFLAGS
-
+
if test "x$magic_inc" != xno; then
CPPFLAGS="-I$magic_inc $CPPFLAGS"
fi
@@ -445,7 +464,7 @@
LDFLAGS="-L$magic_lib $LDFLAGS"
fi
-
+
orig_libs=$LIBS
LIBS="-lz $LIBS"
@@ -469,7 +488,7 @@
AC_MSG_CHECKING(for libssh)
-AC_ARG_ENABLE(libssh, [ --enable-ssh Enable Support for ssh[default=auto]],
+AC_ARG_ENABLE(libssh, [ --enable-ssh Enable Support for ssh[default=auto]],
enable_ssh="$enableval", enable_ssh="yes")
AC_ARG_WITH(ssh-lib,
@@ -488,30 +507,30 @@
dnl **************************************************
orig_cppflags=$CPPFLAGS
-
+
if test "x$ssh_inc" != xno; then
CPPFLAGS="-I$ssh_inc $CPPFLAGS"
fi
-
+
AC_CHECK_HEADER(libssh.h, [found=yes], [found=no])
-
+
if test "x$found" != "xno"; then
dnl **************************************************
dnl * ssh lib *
dnl **************************************************
-
+
orig_ldflags=$LDFLAGS
if test "x$ssh_lib" != "xno"; then
LDFLAGS="-L$ssh_lib $LDFLAGS"
fi
AC_CHECK_LIB([ssh], [ssh_bind_new],[found=yes], [found=no])
-
+
if test "x$found" != "xyes"; then
LDFLAGS=$orig_ldflags
fi
- else
+ else
CPPFLAGS=$orig_cppflags
fi
@@ -522,10 +541,10 @@
AC_DEFINE(HAVE_LIBSSH,1,[Define wether we have libssh])
LIB_SSH="-lssh"
fi
-
-fi
+fi
+
dnl **************************************************
dnl * mysql Support *
dnl **************************************************
@@ -539,7 +558,7 @@
[mysql_inc=$withval],
[mysql_inc=no])
-AC_ARG_ENABLE(mysql, [ --enable-mysql Enable Support [default=auto]],
+AC_ARG_ENABLE(mysql, [ --enable-mysql Enable Support [default=auto]],
enable_mysql="$enableval", enable_mysql="no")
@@ -554,11 +573,11 @@
dnl **************************************************
orig_cppflags=$CPPFLAGS
-
+
if test "x$mysql_inc" != xno; then
CPPFLAGS="-I$mysql_inc $CPPFLAGS"
fi
-
+
AC_CHECK_HEADER(mysql.h, [found=yes], [found=no])
if test "x$found" != "xno"; then
@@ -567,17 +586,17 @@
dnl **************************************************
dnl * mysql lib *
dnl **************************************************
-
+
orig_ldflags=$LDFLAGS
if test "x$mysql_lib" != "xno"; then
LDFLAGS="-L$mysql_lib $LDFLAGS"
fi
AC_CHECK_LIB(mysqlclient, mysql_real_connect, [found=yes], [found=no])
-
+
if test "x$found" != "xyes"; then
LDFLAGS=$orig_ldflags
fi
- else
+ else
CPPFLAGS=$orig_cppflags
fi
@@ -589,8 +608,8 @@
LIB_MYSQL="-lmysqlclient"
fi
- AC_MSG_RESULT($enable_mysql)
-fi
+ AC_MSG_RESULT($enable_mysql)
+fi
@@ -608,7 +627,7 @@
[postgre_inc=$withval],
[postgre_inc=no])
-AC_ARG_ENABLE(postgre, [ --enable-postgre Enable Support [default=auto]],
+AC_ARG_ENABLE(postgre, [ --enable-postgre Enable Support [default=auto]],
enable_postgre="$enableval", enable_postgre="no")
@@ -623,11 +642,11 @@
dnl **************************************************
orig_cppflags=$CPPFLAGS
-
+
if test "x$postgre_inc" != xno; then
CPPFLAGS="-I$postgre_inc $CPPFLAGS"
fi
-
+
AC_CHECK_HEADER(libpq-fe.h, [found=yes], [found=no])
if test "x$found" != "xno"; then
@@ -636,17 +655,17 @@
dnl **************************************************
dnl * postgre lib *
dnl **************************************************
-
+
orig_ldflags=$LDFLAGS
if test "x$postgre_lib" != "xno"; then
LDFLAGS="-L$postgre_lib $LDFLAGS"
fi
AC_CHECK_LIB(pq, PQsetdbLogin, [found=yes], [found=no])
-
+
if test "x$found" != "xyes"; then
LDFLAGS=$orig_ldflags
fi
- else
+ else
CPPFLAGS=$orig_cppflags
fi
@@ -665,7 +684,7 @@
fi
-fi
+fi
@@ -682,7 +701,7 @@
[emu_inc=$withval],
[emu_inc=no])
-AC_ARG_ENABLE(emu, [ --enable-emu Enable Support [default=auto]],
+AC_ARG_ENABLE(emu, [ --enable-emu Enable Support [default=auto]],
enable_emu="$enableval", enable_emu="no")
@@ -695,11 +714,11 @@
dnl **************************************************
orig_cppflags=$CPPFLAGS
-
+
if test "x$emu_inc" != xno; then
CPPFLAGS="-I$emu_inc $CPPFLAGS"
fi
-
+
AC_CHECK_HEADER(emu/emu.h, [found=yes], [found=no])
if test "x$found" != "xno"; then
@@ -708,17 +727,17 @@
dnl **************************************************
dnl * emu lib *
dnl **************************************************
-
+
orig_ldflags=$LDFLAGS
if test "x$emu_lib" != "xno"; then
LDFLAGS="-L$emu_lib $LDFLAGS"
fi
AC_CHECK_LIB(emu, emu_new, [found=yes], [found=no])
-
+
if test "x$found" != "xyes"; then
LDFLAGS=$orig_ldflags
fi
- else
+ else
CPPFLAGS=$orig_cppflags
fi
@@ -729,7 +748,7 @@
AC_DEFINE(HAVE_EMU, 1 , [Define if we have emu client library])
LIB_EMU="-lemu"
fi
-fi
+fi
@@ -763,7 +782,7 @@
-AC_ARG_ENABLE(dnsresolve_adns, [ --enable-dnsresolve-adns Enable adns [default=yes]],
+AC_ARG_ENABLE(dnsresolve_adns, [ --enable-dnsresolve-adns Enable adns [default=yes]],
enable_dnsresolve_adns="$enableval", enable_dnsresolve_adns="yes")
dnl **************************************************
@@ -781,7 +800,7 @@
if test x$enable_dnsresolve_adns = xyes; then
orig_cppflags=$CPPFLAGS
-
+
if test "x$adns_inc" != xno; then
CPPFLAGS="-I$adns_inc $CPPFLAGS"
fi
@@ -855,11 +874,11 @@
AC_MSG_ERROR([libpreludes libprelude-config was not found in PATH])
enable_prelude=no
else
- AC_DEFINE(HAVE_LIBPRELUDE, 1,[Define if you want to use libprelude])
+ AC_DEFINE(HAVE_LIBPRELUDE, 1,[Define if you want to use libprelude])
PRELUDE_LDFLAGS=`$LIBPRELUDE_CONFIG --ldflags`
PRELUDE_LIBS=`$LIBPRELUDE_CONFIG --libs`
PRELUDE_CPPFLAGS=`$LIBPRELUDE_CONFIG --pthread-cflags`
-
+
LIB_PRELUDE="$PRELUDE_LIBS"
LDFLAG_PRELUDE="$PRELUDE_LDFLAGS"
CPPFLAGS="$CPPFLAGS $PRELUDE_CPPFLAGS"
@@ -874,8 +893,8 @@
dnl **************************************************
AC_MSG_CHECKING(whether to use libcap to improve security)
-AC_ARG_ENABLE(capabilities, [ --enable-capabilities Enable capabilities [default=auto]],
- [enable_capabilities="$enableval"],
+AC_ARG_ENABLE(capabilities, [ --enable-capabilities Enable capabilities [default=auto]],
+ [enable_capabilities="$enableval"],
[enable_capabilities="yes"])
if test x$enable_capabilities = xno ; then
@@ -885,7 +904,7 @@
[ --with-cap-include=PATH use libcap],
[cap_inc=$withval],
[cap_inc=no])
-
+
AC_ARG_WITH(cap-lib,
[ --with-cap-lib=PATH use libcap],
[cap_lib=$withval],
@@ -893,7 +912,7 @@
orig_cppflags=$CPPFLAGS
-
+
if test "x$cap_inc" != xno; then
CPPFLAGS="-I$cap_inc $CPPFLAGS"
fi
@@ -903,35 +922,35 @@
LDFLAGS="-L$cap_lib $LDFLAGS"
fi
- AC_CHECK_LIB(cap, cap_init,
+ AC_CHECK_LIB(cap, cap_init,
[
AC_DEFINE(HAVE_LIBCAP, 1,[Define if libcap is available to restrict process capabilities])
LIB_CAP="-lcap"
enable_capabilities="yes"
- ],
+ ],
[
AC_MSG_WARN([libcap check failed])
enable_capabilities="no (check failed)"
])
-
-fi
+fi
+
dnl **************************************************
dnl * liby existence *
dnl **************************************************
AC_CHECK_LIB(y, yyerror,
- [
+ [
LIB_LIBY="-ly"
enable_liby="yes"
- ],
+ ],
[
enable_liby="no"
])
-
+
AC_DEFUN([AC_DEFINE_DIR], [
prefix_NONE=
exec_prefix_NONE=
@@ -1019,13 +1038,13 @@
modules/log-hexdump/Makefile
])
# modules/shellcode-emulation/Makefile
-# modules/module-upnp/Makefile
+# modules/module-upnp/Makefile
# modules/log-prelude/Makefile
-# modules/module-drone/Makefile
+# modules/module-drone/Makefile
# modules/log-surfnet/Makefile])
# modules/vuln-netbios/Makefile
# modules/module-baitnswitch/Makefile
-# modules/dnsresolve-udns/Makefile
+# modules/dnsresolve-udns/Makefile
AC_OUTPUT
@@ -1039,19 +1058,20 @@
echo " - Support adns : $enable_dnsresolve_adns"
echo ""
echo "- Support Large Filesystem : $enable_lfs"
-echo ""
+echo ""
echo "- Support MySQL : $enable_mysql"
-echo ""
+echo ""
echo "- Support PostgreSQL : $enable_postgre"
-echo ""
+echo ""
echo "- Support ssh : $enable_ssh"
-echo ""
+echo ""
echo "- Support prelude : $enable_prelude"
-echo ""
+echo ""
echo "- Support capabilities : $enable_capabilities"
echo ""
echo "- Packet Monitoring/Sniffing"
echo " - linux ip_queue (ipq) : $enable_ipq"
+echo " - linux nfnetlink (nfqueue) : $have_nfqueue"
echo " - FBSD ipfw Divert sockets : $enable_ipfw"
echo " - Packet Capture Lib (pcap) : $enable_pcap"
Index: modules/module-honeytrap/TrapSocket.cpp
===================================================================
--- modules/module-honeytrap/TrapSocket.cpp (revision 1776)
+++ modules/module-honeytrap/TrapSocket.cpp (working copy)
@@ -5,24 +5,24 @@
*
*
* Copyright (C) 2005 Paul Baecher & Markus Koetter
- *
+ *
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
- *
- *
- * contact nepenthesdev@users.sourceforge.net
*
+ *
+ * contact nepenthesdev@users.sourceforge.net
+ *
*******************************************************************************/
/* $Id$ */
@@ -58,8 +58,8 @@
#include "module-honeytrap.hpp"
#include "PCAPSocket.hpp"
-#ifdef STDTAGS
- #undef STDTAGS
+#ifdef STDTAGS
+ #undef STDTAGS
#endif
#define STDTAGS l_mod
@@ -75,13 +75,17 @@
#ifdef HAVE_IPQ
m_IPQHandle = NULL;
-#endif
+#endif
+#ifdef HAVE_NFQUEUE
+ m_NFQUEUEHandle = NULL;
+#endif
+
#ifdef HAVE_IPFW
m_DivertSocket = -1;
#endif
-
+
}
TrapSocket::TrapSocket(string pcap_device)
@@ -90,7 +94,7 @@
#ifdef HAVE_PCAP
m_PcapDevice = pcap_device;
m_HTType = HT_PCAP;
-#else
+#else
m_HTType = HT_NONE;
#endif
@@ -104,7 +108,7 @@
m_HTType = HT_IPFW;
#ifdef HAVE_IPFW
m_DivertPort = divert_port;
-#else
+#else
m_HTType = HT_NONE;
#endif
m_DialogueFactory = "bridge Factory";
@@ -113,7 +117,12 @@
TrapSocket::TrapSocket(bool param)
{
TrapSocket();
+#ifdef HAVE_IPQ
m_HTType = HT_IPQ;
+#endif
+#ifdef HAVE_NFQUEUE
+ m_HTType = HT_NFQUEUE;
+#endif
m_DialogueFactory = "bridge Factory";
}
@@ -127,8 +136,8 @@
/**
* Module::Init()
- *
- *
+ *
+ *
* @return returns true if everything was fine, else false
* false indicates a fatal error
*/
@@ -145,6 +154,10 @@
retval = Init_IPQ();
break;
+ case HT_NFQUEUE:
+ retval = Init_NFQUEUE();
+ break;
+
case HT_IPFW:
retval = Init_IPFW();
break;
@@ -187,10 +200,47 @@
return true;
}
+bool TrapSocket::Init_NFQUEUE()
+{
+#ifdef HAVE_NFQUEUE
+ if ( (m_NFQUEUEHandle = nfq_open()) == NULL )
+ {
+ logCrit("Could not create nfqueue handle (nfq_open())\n");
+ return false;
+ }
+
+ if ( nfq_unbind_pf(m_NFQUEUEHandle, AF_INET) < 0 ) {
+ logCrit("Cannot unbind existing nfqueue handler (nfq_unbind_pf())\n");
+ return false;
+ }
+
+ if ( nfq_bind_pf(m_NFQUEUEHandle, AF_INET) < 0 ) {
+ logCrit("Cannot bind to nfqueue handler for AF_INTER (nfq_bind_pf())\n");
+ return false;
+ }
+
+ m_NFQUEUEQueueHandle = nfq_create_queue(m_NFQUEUEHandle, 0, &NFQueueCallback, NULL);
+ if ( m_NFQUEUEQueueHandle == NULL ) {
+ logCrit("Cannot create queue (nfq_create_queue())\n");
+ return false;
+ }
+
+ if ( nfq_set_mode(m_NFQUEUEQueueHandle, NFQNL_COPY_PACKET, 0xffff) < 0) {
+ logCrit("Cannot set packet copy mode (nfq_set_mode)\n");
+ return false;
+ }
+
+ NFQUEUE_fd = nfq_fd(m_NFQUEUEHandle);
+
+ logInfo("Initialised libipq\n");
+#endif // HAVE_NFQUEUE
+ return true;
+}
+
bool TrapSocket::Init_IPFW()
{
#ifdef HAVE_IPFW
- if ((m_DivertSocket = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) == -1)
+ if ((m_DivertSocket = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) == -1)
{
logCrit("Could not create divert socket for ipfw %s\n",strerror(errno));
return false;
@@ -200,7 +250,7 @@
m_DivertSin.sin_family = PF_INET;
m_DivertSin.sin_addr.s_addr = INADDR_ANY;
- if (bind(m_DivertSocket, (struct sockaddr *)&m_DivertSin, sizeof(m_DivertSin)) == -1)
+ if (bind(m_DivertSocket, (struct sockaddr *)&m_DivertSin, sizeof(m_DivertSin)) == -1)
{
logCrit("Could not bind divert socket %s\n",strerror(errno));
return false;
@@ -234,7 +284,7 @@
string bpf_filter_string = "tcp[tcpflags] & tcp-rst != 0 and tcp[4:4] = 0 ";
pcap_if_t *alldevsp = NULL;
-
+
if( pcap_findalldevs(&alldevsp,errbuf) == -1)
{
logCrit("pcap_findalldevs failed %s\n",errbuf);
@@ -274,14 +324,14 @@
if ( bpf_filter_string_addition == "" )
{
- bpf_filter_string_addition += string("src host ") +
- string(inet_ntoa(*(struct in_addr*) &(((struct sockaddr_in *)addr->addr)->sin_addr))) +
+ bpf_filter_string_addition += string("src host ") +
+ string(inet_ntoa(*(struct in_addr*) &(((struct sockaddr_in *)addr->addr)->sin_addr))) +
string(" ");
}
else
{
- bpf_filter_string_addition += string("or src host ") +
- string(inet_ntoa(*(struct in_addr*) &(((struct sockaddr_in *)addr->addr)->sin_addr))) +
+ bpf_filter_string_addition += string("or src host ") +
+ string(inet_ntoa(*(struct in_addr*) &(((struct sockaddr_in *)addr->addr)->sin_addr))) +
string(" ");
}
break;
@@ -292,7 +342,7 @@
}
logSpam("\n");
-
+
}
}
@@ -364,14 +414,14 @@
}
-
+
return true;
#else // HAVE_PCAP
logCrit("pcap not supported, hit the docs\n");
return false;
#endif // HAVE_PCAP
-
+
}
bool TrapSocket::Exit()
@@ -388,6 +438,10 @@
retval = Exit_IPQ();
break;
+ case HT_NFQUEUE:
+ retval = Exit_NFQUEUE();
+ break;
+
case HT_IPFW:
retval = Exit_IPFW();
break;
@@ -443,7 +497,19 @@
}
+bool TrapSocket::Exit_NFQUEUE()
+{
+#ifdef HAVE_NFQUEUE
+ if ( m_NFQUEUEHandle != NULL )
+ {
+ nfq_destroy_queue(m_NFQUEUEQueueHandle);
+ nfq_close(m_NFQUEUEHandle);
+ }
+#endif // HAVE_NFQueue
+ return true;
+}
+
bool TrapSocket::Exit_IPFW()
{
#ifdef HAVE_IPFW
@@ -484,6 +550,10 @@
retval = doRecv_IPQ();
break;
+ case HT_NFQUEUE:
+ retval = doRecv_NFQUEUE();
+ break;
+
case HT_IPFW:
retval = doRecv_IPFW();
break;
@@ -528,10 +598,10 @@
case DLT_PPP:
- /* PPP; if the first 2 bytes are 0xff and 0x03,
- * it's PPP in HDLC-like framing, with the PPP header following those two bytes,
+ /* PPP; if the first 2 bytes are 0xff and 0x03,
+ * it's PPP in HDLC-like framing, with the PPP header following those two bytes,
* otherwise it's PPP without framing, and the packet begins with the PPP header.
- */
+ */
offset = 4;
static char hldc_frame[] = { 0xff, 0x03 };
if (memcmp(pkt_data,hldc_frame,2) == 0)
@@ -594,7 +664,7 @@
logWarn("IPQ Received error message %d\n",ipq_get_msgerr(buf));
break;
- case IPQM_PACKET:
+ case IPQM_PACKET:
{
ipq_packet_msg_t *m = ipq_get_packet(buf);
@@ -612,7 +682,7 @@
if ( tcp->th_flags & TH_SYN && !(tcp->th_flags & TH_ACK) )
{
- createListener((libnet_ipv4_hdr *)ip,(libnet_tcp_hdr *)tcp,
+ createListener((libnet_ipv4_hdr *)ip,(libnet_tcp_hdr *)tcp,
(unsigned char *)m->payload,(uint16_t)m->data_len);
}
@@ -633,6 +703,58 @@
return 1;
}
+#ifdef HAVE_NFQUEUE
+int TrapSocket::NFQueueCallback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
+ struct nfq_data *nfa, void *data)
+{
+ uint32_t id = 0;
+ struct nfqnl_msg_packet_hdr *ph;
+ char *payload; /* nfq_get_payload(struct nfq_data *nfad, char **data) */
+ int len;
+// int retval;
+
+ ph = nfq_get_msg_packet_hdr(nfa);
+ if ( ph ) {
+ id = ntohl(ph->packet_id);
+ }
+ len = nfq_get_payload(nfa, &payload);
+ if (len >= 0) {
+ if ( ntohs(ph->hw_protocol) == ETHERTYPE_IP ) {
+ const struct libnet_ipv4_hdr* ip;
+ ip = (struct libnet_ipv4_hdr*)(payload);
+ int hlen = ip->ip_hl * 4;
+ const struct libnet_tcp_hdr* tcp;
+
+ tcp = (struct libnet_tcp_hdr*) ((u_char *)payload+hlen);
+
+ if ( tcp->th_flags & TH_SYN && !(tcp->th_flags & TH_ACK) )
+ {
+ g_ModuleHoneytrap->m_TrapSocket->createListener((libnet_ipv4_hdr *)ip,(libnet_tcp_hdr *)tcp,
+ (u_char *)payload,(uint16_t)len);
+ }
+ }
+ }
+
+ return nfq_set_verdict(qh, id, NF_ACCEPT, 0, NULL);
+}
+#endif
+
+int32_t TrapSocket::doRecv_NFQUEUE()
+{
+ logPF();
+#ifdef HAVE_NFQUEUE
+ char buf[NFQUEUE_PACKET_BUFSIZE] __attribute__ ((aligned));
+ int len;
+
+ len = recv(NFQUEUE_fd, buf, NFQUEUE_PACKET_BUFSIZE, 0);
+ if (len > 0) {
+ nfq_handle_packet(m_NFQUEUEHandle, buf, len);
+ }
+
+#endif // HAVE_NFQUEUE
+ return 1;
+}
+
int32_t TrapSocket::doRecv_IPFW()
{
logPF();
@@ -706,10 +828,10 @@
int32_t TrapSocket::getsockOpt(int32_t level, int32_t optname,void *optval,socklen_t *optlen)
{
-#if defined(linux) || defined(__linux)
+#if defined(linux) || defined(__linux)
return getsockopt(getSocket(), level, optname, optval, optlen);
#else
- return 0;
+ return 0;
#endif
}
@@ -732,20 +854,20 @@
ip->ip_hl * 4,
ntohs(ip->ip_len) );
- logSpam(" |- Source %s \n" ,
+ logSpam(" |- Source %s \n" ,
inet_ntoa(ip->ip_src) );
- logSpam(" |- Destionation %s \n" ,
+ logSpam(" |- Destionation %s \n" ,
inet_ntoa(ip->ip_dst) );
- logSpam(" |- Bits: %s %s, Offset : %d, checksum = %.4x, TTL = %d\n",
- ntohs(ip->ip_off) & IP_DF? "DF":"",
- ntohs(ip->ip_off) & IP_MF? "MF":"",
- ntohs(ip->ip_off) & IP_OFFMASK,
+ logSpam(" |- Bits: %s %s, Offset : %d, checksum = %.4x, TTL = %d\n",
+ ntohs(ip->ip_off) & IP_DF? "DF":"",
+ ntohs(ip->ip_off) & IP_MF? "MF":"",
+ ntohs(ip->ip_off) & IP_OFFMASK,
ntohs(ip->ip_sum),
- ip->ip_ttl);
+ ip->ip_ttl);
- logSpam(" |- proto = %d : \n",
+ logSpam(" |- proto = %d : \n",
ip->ip_p );
@@ -762,7 +884,7 @@
ntohs(tcp->th_ack));
logSpam(" |- bits %s %s %s %s %s %s %s %s\n",
- (tcp->th_flags) & TH_FIN?"FIN":"",
+ (tcp->th_flags) & TH_FIN?"FIN":"",
(tcp->th_flags) & TH_SYN?"SYN":"",
(tcp->th_flags) & TH_RST?"RST":"",
(tcp->th_flags) & TH_PUSH?"PUSH":"",
@@ -772,9 +894,9 @@
(tcp->th_flags) & TH_CWR?"CWR":""
);
- logSpam(" `- checksum = %.4x, windows = %.4x, urgent = %.4x\n",
+ logSpam(" `- checksum = %.4x, windows = %.4x, urgent = %.4x\n",
ntohs(tcp->th_sum),
- ntohs(tcp->th_win),
+ ntohs(tcp->th_win),
ntohs(tcp->th_urp) );
}
@@ -838,7 +960,7 @@
#ifdef HAVE_PCAP
isupport += "pcap,";
-#endif
+#endif
#ifdef HAVE_IPQ
isupport += "ipq,";
Index: modules/module-honeytrap/module-honeytrap.hpp
===================================================================
--- modules/module-honeytrap/module-honeytrap.hpp (revision 1776)
+++ modules/module-honeytrap/module-honeytrap.hpp (working copy)
@@ -53,6 +53,7 @@
{
class Buffer;
+ class TrapSocket;
typedef struct
{
@@ -122,7 +123,7 @@
string getPcapPath();
uint32_t getPcapMinPackets();
-
+ TrapSocket *m_TrapSocket;
protected:
map<connection_t ,Socket *,cmp_connection_t> m_Sockets;
Nepenthes *m_Nepenthes;
Index: modules/module-honeytrap/TrapSocket.hpp
===================================================================
--- modules/module-honeytrap/TrapSocket.hpp (revision 1776)
+++ modules/module-honeytrap/TrapSocket.hpp (working copy)
@@ -5,24 +5,24 @@
*
*
* Copyright (C) 2005 Paul Baecher & Markus Koetter
- *
+ *
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
- *
- *
- * contact nepenthesdev@users.sourceforge.net
*
+ *
+ * contact nepenthesdev@users.sourceforge.net
+ *
*******************************************************************************/
/* $Id$ */
@@ -45,7 +45,11 @@
#ifdef HAVE_IPQ
#include <linux/netfilter.h>
#include <libipq.h>
-#endif
+#endif
+#ifdef HAVE_NFQUEUE
+ #include <linux/netfilter.h>
+ #include <libnetfilter_queue/libnetfilter_queue.h>
+#endif
// #include <libnet.h>
#include <sys/types.h>
#include <netinet/in.h>
@@ -74,6 +78,7 @@
#define ETHER_HDRLEN 16
#define IPQ_PACKET_BUFSIZE 2048
+#define NFQUEUE_PACKET_BUFSIZE 4096
#define LIBNET_LIL_ENDIAN 1
#ifndef ETHERTYPE_IP
@@ -190,8 +195,8 @@
-/* These enums are used by IPX too. :-(
- *
+/* These enums are used by IPX too. :-(
+ *
* mappings to determine the state of a tcp connection in /proc/net/tcp
*
* taken from net-tools
@@ -215,11 +220,12 @@
class Buffer;
- typedef enum
+ typedef enum
{
HT_NONE,
HT_PCAP,
HT_IPQ,
+ HT_NFQUEUE,
HT_IPFW
} honeytrap_type;
@@ -238,11 +244,13 @@
bool Init();
bool Init_PCAP();
bool Init_IPQ();
+ bool Init_NFQUEUE();
bool Init_IPFW();
bool Exit();
bool Exit_PCAP();
bool Exit_IPQ();
+ bool Exit_NFQUEUE();
bool Exit_IPFW();
bool wantSend();
@@ -252,6 +260,7 @@
int32_t doRecv();
int32_t doRecv_PCAP();
int32_t doRecv_IPQ();
+ int32_t doRecv_NFQUEUE();
int32_t doRecv_IPFW();
int32_t getSocket();
@@ -262,18 +271,25 @@
static string getSupportedModes();
bool createListener(libnet_ipv4_hdr *ip, libnet_tcp_hdr *tcp, unsigned char *data, uint16_t size);
+ static int NFQueueCallback(nfq_q_handle*, nfgenmsg*, nfq_data*, void*);
protected:
-
+
#ifdef HAVE_PCAP
pcap_t *m_RawListener;
string m_PcapDevice;
int m_PcapDataLinkType;
#endif
-
+
#ifdef HAVE_IPQ
struct ipq_handle *m_IPQHandle;
#endif
+#ifdef HAVE_NFQUEUE
+ struct nfq_handle *m_NFQUEUEHandle;
+ struct nfq_q_handle *m_NFQUEUEQueueHandle;
+ int NFQUEUE_fd;
+#endif
+
#ifdef HAVE_IPFW
uint16_t m_DivertPort;
int m_DivertSocket;
Index: modules/module-honeytrap/Makefile.am
===================================================================
--- modules/module-honeytrap/Makefile.am (revision 1776)
+++ modules/module-honeytrap/Makefile.am (working copy)
@@ -6,11 +6,15 @@
AM_CPPFLAGS = -I$(top_srcdir)/nepenthes-core/include -I$(top_srcdir)/nepenthes-core/src -pipe -D _GNU_SOURCE -I/usr/include/libipq
AM_CXXFLAGS = -Wall -Werror
-AM_LDFLAGS = ${LIB_PCAP} ${LIB_IPQ}
+AM_LDFLAGS = ${LIB_PCAP} ${LIB_IPQ}
+if NFQUEUE
+AM_LDFLAGS += -lnetfilter_queue -lnfnetlink
+endif
+
pkglib_LTLIBRARIES = modulehoneytrap.la
-modulehoneytrap_la_SOURCES = module-honeytrap.cpp module-honeytrap.hpp
+modulehoneytrap_la_SOURCES = module-honeytrap.cpp module-honeytrap.hpp
modulehoneytrap_la_SOURCES += PCAPSocket.cpp PCAPSocket.hpp
modulehoneytrap_la_SOURCES += TrapSocket.cpp TrapSocket.hpp
modulehoneytrap_la_SOURCES += module-honeytrap.conf.dist
Index: modules/module-honeytrap/module-honeytrap.cpp
===================================================================
--- modules/module-honeytrap/module-honeytrap.cpp (revision 1776)
+++ modules/module-honeytrap/module-honeytrap.cpp (working copy)
@@ -5,24 +5,24 @@
*
*
* Copyright (C) 2005 Paul Baecher & Markus Koetter
- *
+ *
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
- *
- *
- * contact nepenthesdev@users.sourceforge.net
*
+ *
+ * contact nepenthesdev@users.sourceforge.net
+ *
*******************************************************************************/
/* $Id$ */
@@ -68,8 +68,8 @@
#include "TrapSocket.hpp"
-#ifdef STDTAGS
- #undef STDTAGS
+#ifdef STDTAGS
+ #undef STDTAGS
#endif
#define STDTAGS l_mod
@@ -81,7 +81,7 @@
*
* The idea is really good, and it as it was easy to make a nepenthes module of it, we stole it
*
- */
+ */
@@ -97,8 +97,8 @@
/**
* The Constructor
- * creates a new ModuleHoneyTrap Module,
- *
+ * creates a new ModuleHoneyTrap Module,
+ *
* @param nepenthes the pointer to our Nepenthes
*/
ModuleHoneyTrap::ModuleHoneyTrap(Nepenthes *nepenthes)
@@ -126,8 +126,8 @@
/**
* Module::Init()
- *
- *
+ *
+ *
* @return returns true if everything was fine, else false
* false indicates a fatal error
*/
@@ -141,8 +141,8 @@
}
-
+
string mode;
try
{
@@ -197,7 +197,7 @@
if (s->Init() != true)
return false;
}
-#endif
+#endif
#ifdef HAVE_IPQ
if (mode == "ipq")
@@ -206,8 +206,17 @@
if (s->Init() != true)
return false;
}
-#endif
+#endif
+#ifdef HAVE_NFQUEUE
+ if (mode == "nfqueue")
+ {
+ s = new TrapSocket(true);
+ if (s->Init() != true)
+ return false;
+ }
+#endif
+
#ifdef HAVE_IPFW
if (mode == "ipfw")
{
@@ -224,7 +233,7 @@
return false;
}
-#endif
+#endif
if (s == NULL)
{
@@ -233,12 +242,13 @@
}
-
+
m_Events.set(EV_SOCK_TCP_ACCEPT);
m_Events.set(EV_SOCK_TCP_CLOSE);
REG_EVENT_HANDLER(this);
+ m_TrapSocket = (TrapSocket *)s;
return true;
}