rendered paste body--- nepenthes+nfqueue.1.patch 2009-01-25 01:06:58.000000000 +0100
+++ foo.diff 2009-01-25 01:37:11.000000000 +0100
@@ -1,27 +1,6 @@
-Index: autohell.sh
-===================================================================
---- autohell.sh (revision 0)
-+++ autohell.sh (revision 0)
-@@ -0,0 +1,10 @@
-+#!/bin/sh
-+
-+touch config.h.in
-+touch ltmain.sh
-+chmod ugo+x ltmain.sh
-+
-+aclocal
-+automake --add-missing
-+autoconf
-+
-
-Property changes on: autohell.sh
-___________________________________________________________________
-Added: svn:executable
- + *
-
Index: configure.ac
===================================================================
---- configure.ac (revision 1777)
+--- configure.ac (revision 1776)
+++ configure.ac (working copy)
@@ -10,6 +10,8 @@
AM_INIT_AUTOMAKE([nepenthes], [0.2.2])
@@ -552,7 +531,7 @@
Index: modules/module-honeytrap/TrapSocket.cpp
===================================================================
---- modules/module-honeytrap/TrapSocket.cpp (revision 1777)
+--- modules/module-honeytrap/TrapSocket.cpp (revision 1776)
+++ modules/module-honeytrap/TrapSocket.cpp (working copy)
@@ -5,24 +5,24 @@
*
@@ -687,7 +666,7 @@
+ return false;
+ }
+
-+ if ( nfq_bind_pf(h, AF_INET) < 0 ) {
++ if ( nfq_bind_pf(m_NFQUEUEHandle, AF_INET) < 0 ) {
+ logCrit("Cannot bind to nfqueue handler for AF_INTER (nfq_bind_pf())\n");
+ return false;
+ }
@@ -855,19 +834,19 @@
(unsigned char *)m->payload,(uint16_t)m->data_len);
}
-@@ -633,6 +703,59 @@
+@@ -633,6 +703,58 @@
return 1;
}
+#ifdef HAVE_NFQUEUE
-+static int TrapSocket::NFQueueCallback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
++int TrapSocket::NFQueueCallback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
+ struct nfq_data *nfa, void *data)
+{
+ uint32_t id = 0;
+ struct nfqnl_msg_packet_hdr *ph;
+ char *payload; /* nfq_get_payload(struct nfq_data *nfad, char **data) */
+ int len;
-+ int retval;
++// int retval;
+
+ ph = nfq_get_msg_packet_hdr(nfa);
+ if ( ph ) {
@@ -875,7 +854,7 @@
+ }
+ len = nfq_get_payload(nfa, &payload);
+ if (len >= 0) {
-+ if ( ntohs(pk->hw_protocol) == ETHERTYPE_IP ) {
++ if ( ntohs(ph->hw_protocol) == ETHERTYPE_IP ) {
+ const struct libnet_ipv4_hdr* ip;
+ ip = (struct libnet_ipv4_hdr*)(payload);
+ int hlen = ip->ip_hl * 4;
@@ -883,27 +862,26 @@
+
+ tcp = (struct libnet_tcp_hdr*) ((u_char *)payload+hlen);
+
-+ if ( tcp->th_flags & TH_SYN && !(tcp->th_flags & TH_ACK) )
-+ {
-+ createListener((libnet_ipv4_hdr *)ip,(libnet_tcp_hdr *)tcp,
-+ (u_char *)payload,(uint16_t)len);
-+ }
++ if ( tcp->th_flags & TH_SYN && !(tcp->th_flags & TH_ACK) )
++ {
++ g_ModuleHoneytrap->m_TrapSocket->createListener((libnet_ipv4_hdr *)ip,(libnet_tcp_hdr *)tcp,
++ (u_char *)payload,(uint16_t)len);
+ }
++ }
+ }
+
+ return nfq_set_verdict(qh, id, NF_ACCEPT, 0, NULL);
+}
-+}
+#endif
+
+int32_t TrapSocket::doRecv_NFQUEUE()
+{
+ logPF();
+#ifdef HAVE_NFQUEUE
-+ unsigned char buf[NFQUEUE_PACKET_BUFSIZE] __attribute__ ((aligned));
++ char buf[NFQUEUE_PACKET_BUFSIZE] __attribute__ ((aligned));
+ int len;
+
-+ len = recv(NFQUEUE_fd, buf, NFQUEUE_PACKET_BUFSIZE, 0)
++ len = recv(NFQUEUE_fd, buf, NFQUEUE_PACKET_BUFSIZE, 0);
+ if (len > 0) {
+ nfq_handle_packet(m_NFQUEUEHandle, buf, len);
+ }
@@ -915,7 +893,7 @@
int32_t TrapSocket::doRecv_IPFW()
{
logPF();
-@@ -706,10 +829,10 @@
+@@ -706,10 +828,10 @@
int32_t TrapSocket::getsockOpt(int32_t level, int32_t optname,void *optval,socklen_t *optlen)
{
@@ -928,7 +906,7 @@
#endif
}
-@@ -732,20 +855,20 @@
+@@ -732,20 +854,20 @@
ip->ip_hl * 4,
ntohs(ip->ip_len) );
@@ -957,7 +935,7 @@
ip->ip_p );
-@@ -762,7 +885,7 @@
+@@ -762,7 +884,7 @@
ntohs(tcp->th_ack));
logSpam(" |- bits %s %s %s %s %s %s %s %s\n",
@@ -966,7 +944,7 @@
(tcp->th_flags) & TH_SYN?"SYN":"",
(tcp->th_flags) & TH_RST?"RST":"",
(tcp->th_flags) & TH_PUSH?"PUSH":"",
-@@ -772,9 +895,9 @@
+@@ -772,9 +894,9 @@
(tcp->th_flags) & TH_CWR?"CWR":""
);
@@ -978,7 +956,7 @@
ntohs(tcp->th_urp) );
}
-@@ -838,7 +961,7 @@
+@@ -838,7 +960,7 @@
#ifdef HAVE_PCAP
isupport += "pcap,";
@@ -987,9 +965,30 @@
#ifdef HAVE_IPQ
isupport += "ipq,";
+Index: modules/module-honeytrap/module-honeytrap.hpp
+===================================================================
+--- modules/module-honeytrap/module-honeytrap.hpp (revision 1776)
++++ modules/module-honeytrap/module-honeytrap.hpp (working copy)
+@@ -53,6 +53,7 @@
+ {
+
+ class Buffer;
++ class TrapSocket;
+
+ typedef struct
+ {
+@@ -122,7 +123,7 @@
+ string getPcapPath();
+ uint32_t getPcapMinPackets();
+
+-
++ TrapSocket *m_TrapSocket;
+ protected:
+ map<connection_t ,Socket *,cmp_connection_t> m_Sockets;
+ Nepenthes *m_Nepenthes;
Index: modules/module-honeytrap/TrapSocket.hpp
===================================================================
---- modules/module-honeytrap/TrapSocket.hpp (revision 1777)
+--- modules/module-honeytrap/TrapSocket.hpp (revision 1776)
+++ modules/module-honeytrap/TrapSocket.hpp (working copy)
@@ -5,24 +5,24 @@
*
@@ -1090,9 +1089,11 @@
int32_t doRecv_IPFW();
int32_t getSocket();
-@@ -263,17 +272,23 @@
+@@ -262,18 +271,25 @@
+
static string getSupportedModes();
bool createListener(libnet_ipv4_hdr *ip, libnet_tcp_hdr *tcp, unsigned char *data, uint16_t size);
++ static int NFQueueCallback(nfq_q_handle*, nfgenmsg*, nfq_data*, void*);
protected:
-
+
@@ -1118,7 +1119,7 @@
int m_DivertSocket;
Index: modules/module-honeytrap/Makefile.am
===================================================================
---- modules/module-honeytrap/Makefile.am (revision 1777)
+--- modules/module-honeytrap/Makefile.am (revision 1776)
+++ modules/module-honeytrap/Makefile.am (working copy)
@@ -6,11 +6,15 @@
@@ -1140,7 +1141,7 @@
modulehoneytrap_la_SOURCES += module-honeytrap.conf.dist
Index: modules/module-honeytrap/module-honeytrap.cpp
===================================================================
---- modules/module-honeytrap/module-honeytrap.cpp (revision 1777)
+--- modules/module-honeytrap/module-honeytrap.cpp (revision 1776)
+++ modules/module-honeytrap/module-honeytrap.cpp (working copy)
@@ -5,24 +5,24 @@
*
@@ -1262,7 +1263,7 @@
if (s == NULL)
{
-@@ -233,8 +242,8 @@
+@@ -233,12 +242,13 @@
}
@@ -1272,3 +1273,8 @@
m_Events.set(EV_SOCK_TCP_ACCEPT);
m_Events.set(EV_SOCK_TCP_CLOSE);
REG_EVENT_HANDLER(this);
+
++ m_TrapSocket = (TrapSocket *)s;
+
+ return true;
+ }