Index: configure.ac =================================================================== --- configure.ac (revision 1776) +++ configure.ac (working copy) @@ -10,6 +10,8 @@ AM_INIT_AUTOMAKE([nepenthes], [0.2.2]) AC_REVISION([$Id$]) +AC_PROG_LIBTOOL + AC_PREFIX_DEFAULT(/opt/nepenthes) AC_CONFIG_SRCDIR([nepenthes-core/include/Buffer.hpp]) AM_CONFIG_HEADER([config.h]) @@ -17,6 +19,7 @@ AM_CONDITIONAL(NDEBUG, test "$disable_debug" = yes) AM_CONDITIONAL(PROFILE, test "$enable_profile" = yes) +AM_CONDITIONAL(NFQUEUE, test x"$enable_nfqueue" = xyes) AC_CANONICAL_HOST AC_C_CONST @@ -163,7 +166,7 @@ AC_CHECK_FUNCS([strndup alarm bzero gethostbyname gethostname gettimeofday inet_ntoa localtime_r memmove memset munmap select socket strcasecmp strdup strerror strncasecmp strstr strtoul setresgid setresuid]) -# libadns +# libadns AC_SUBST([LIB_ADNS]) # libpcre @@ -252,9 +255,9 @@ if test x$ipq_inc != "xno"; then CPPFLAGS="${CPPFLAGS} -I${ipq_inc}" fi - + AC_CHECK_HEADER(libipq.h,[enable_ipq=yes],[enable_ipq=no]) - + if test x$enable_ipq = "xyes" ; then if test x$ipq_lib != "xno"; then LDFLAGS="${LDFLAGS} -L${ipq_lib}" @@ -305,11 +308,11 @@ AC_DEFINE([HAVE_PCAP], [1], [Define to 1 if you have packet capture library]) fi fi - -fi +fi + dnl ************************************************** dnl * ipfw support * dnl ************************************************** @@ -320,19 +323,35 @@ if test x$enable_ipfw = "xyes"; then AC_DEFINE([HAVE_IPFW], [1], [Define to 1 if you want ipfw divert on FreeBSD]) -fi - +fi dnl ************************************************** +dnl * nfqueue support * +dnl ************************************************** +AC_ARG_ENABLE(nfqueue, +[ --enable-nfqueue enable Linux 2.6.14+ nfqueue support], + enable_nfqueue="$enableval", enable_nfqueue="no") + +have_nfqueue="no" + +if test x$enable_nfqueue = "xyes"; then + AC_CHECK_LIB([netfilter_queue], [nfq_open], have_nfqueue="yes", have_nfqueue="",[-lnfnetlink]) + if test x$have_nfqueue = "xyes" ; then + AC_DEFINE([HAVE_NFQUEUE], [1], [Define to 1 if you have netfilter queue library for capture] ) + fi +fi + + +dnl ************************************************** dnl * debug logging * dnl ************************************************** -AC_ARG_ENABLE(debug-logging, [ --enable-debug-logging spam the console and logfile with all debug information [default=no]], +AC_ARG_ENABLE(debug-logging, [ --enable-debug-logging spam the console and logfile with all debug information [default=no]], enable_debug_logging="$enableval", enable_debug_logging="no") if test x$enable_debug_logging = "xyes"; then AC_DEFINE([HAVE_DEBUG_LOGGING], [1], [Define to 1 if you need debug logging]) -fi +fi # Checks for generic libraries. @@ -368,11 +387,11 @@ orig_cppflags=$CPPFLAGS orig_libs=$LIBS - + CPPFLAGS="$CPPFLAGS `curl-config --cflags`" LIBS="$LIBS `curl-config --libs`" - + AC_CHECK_LIB([curl], [curl_version], [AC_DEFINE(HAVE_LIBCURL, 1, [Define if you want to use libcurl]) @@ -383,8 +402,8 @@ CPPFLAGS=$orig_cppflags LIBS=$orig_libs fi - + dnl ************************************************** dnl * libpcre Support * dnl ************************************************** @@ -401,7 +420,7 @@ if test xyes = "xyes"; then orig_cppflags=$CPPFLAGS - + if test "x$pcre_inc" != xno; then CPPFLAGS="-I$pcre_inc $CPPFLAGS" fi @@ -410,14 +429,14 @@ if test "x$pcre_lib" != "xno"; then LDFLAGS="-L$pcre_lib $LDFLAGS" fi - + AC_CHECK_LIB([pcre], [pcre_compile], [AC_DEFINE(HAVE_LIBPCRE, 1, [Define if you want to use libpcre]) LIB_PCRE="-lpcre"], [AC_MSG_ERROR([libpcre is missing - install it please]) ]) -fi +fi dnl ************************************************** dnl * libmagic Support * @@ -435,7 +454,7 @@ if test xyes = "xyes"; then orig_cppflags=$CPPFLAGS - + if test "x$magic_inc" != xno; then CPPFLAGS="-I$magic_inc $CPPFLAGS" fi @@ -445,7 +464,7 @@ LDFLAGS="-L$magic_lib $LDFLAGS" fi - + orig_libs=$LIBS LIBS="-lz $LIBS" @@ -469,7 +488,7 @@ AC_MSG_CHECKING(for libssh) -AC_ARG_ENABLE(libssh, [ --enable-ssh Enable Support for ssh[default=auto]], +AC_ARG_ENABLE(libssh, [ --enable-ssh Enable Support for ssh[default=auto]], enable_ssh="$enableval", enable_ssh="yes") AC_ARG_WITH(ssh-lib, @@ -488,30 +507,30 @@ dnl ************************************************** orig_cppflags=$CPPFLAGS - + if test "x$ssh_inc" != xno; then CPPFLAGS="-I$ssh_inc $CPPFLAGS" fi - + AC_CHECK_HEADER(libssh.h, [found=yes], [found=no]) - + if test "x$found" != "xno"; then dnl ************************************************** dnl * ssh lib * dnl ************************************************** - + orig_ldflags=$LDFLAGS if test "x$ssh_lib" != "xno"; then LDFLAGS="-L$ssh_lib $LDFLAGS" fi AC_CHECK_LIB([ssh], [ssh_bind_new],[found=yes], [found=no]) - + if test "x$found" != "xyes"; then LDFLAGS=$orig_ldflags fi - else + else CPPFLAGS=$orig_cppflags fi @@ -522,10 +541,10 @@ AC_DEFINE(HAVE_LIBSSH,1,[Define wether we have libssh]) LIB_SSH="-lssh" fi - -fi +fi + dnl ************************************************** dnl * mysql Support * dnl ************************************************** @@ -539,7 +558,7 @@ [mysql_inc=$withval], [mysql_inc=no]) -AC_ARG_ENABLE(mysql, [ --enable-mysql Enable Support [default=auto]], +AC_ARG_ENABLE(mysql, [ --enable-mysql Enable Support [default=auto]], enable_mysql="$enableval", enable_mysql="no") @@ -554,11 +573,11 @@ dnl ************************************************** orig_cppflags=$CPPFLAGS - + if test "x$mysql_inc" != xno; then CPPFLAGS="-I$mysql_inc $CPPFLAGS" fi - + AC_CHECK_HEADER(mysql.h, [found=yes], [found=no]) if test "x$found" != "xno"; then @@ -567,17 +586,17 @@ dnl ************************************************** dnl * mysql lib * dnl ************************************************** - + orig_ldflags=$LDFLAGS if test "x$mysql_lib" != "xno"; then LDFLAGS="-L$mysql_lib $LDFLAGS" fi AC_CHECK_LIB(mysqlclient, mysql_real_connect, [found=yes], [found=no]) - + if test "x$found" != "xyes"; then LDFLAGS=$orig_ldflags fi - else + else CPPFLAGS=$orig_cppflags fi @@ -589,8 +608,8 @@ LIB_MYSQL="-lmysqlclient" fi - AC_MSG_RESULT($enable_mysql) -fi + AC_MSG_RESULT($enable_mysql) +fi @@ -608,7 +627,7 @@ [postgre_inc=$withval], [postgre_inc=no]) -AC_ARG_ENABLE(postgre, [ --enable-postgre Enable Support [default=auto]], +AC_ARG_ENABLE(postgre, [ --enable-postgre Enable Support [default=auto]], enable_postgre="$enableval", enable_postgre="no") @@ -623,11 +642,11 @@ dnl ************************************************** orig_cppflags=$CPPFLAGS - + if test "x$postgre_inc" != xno; then CPPFLAGS="-I$postgre_inc $CPPFLAGS" fi - + AC_CHECK_HEADER(libpq-fe.h, [found=yes], [found=no]) if test "x$found" != "xno"; then @@ -636,17 +655,17 @@ dnl ************************************************** dnl * postgre lib * dnl ************************************************** - + orig_ldflags=$LDFLAGS if test "x$postgre_lib" != "xno"; then LDFLAGS="-L$postgre_lib $LDFLAGS" fi AC_CHECK_LIB(pq, PQsetdbLogin, [found=yes], [found=no]) - + if test "x$found" != "xyes"; then LDFLAGS=$orig_ldflags fi - else + else CPPFLAGS=$orig_cppflags fi @@ -665,7 +684,7 @@ fi -fi +fi @@ -682,7 +701,7 @@ [emu_inc=$withval], [emu_inc=no]) -AC_ARG_ENABLE(emu, [ --enable-emu Enable Support [default=auto]], +AC_ARG_ENABLE(emu, [ --enable-emu Enable Support [default=auto]], enable_emu="$enableval", enable_emu="no") @@ -695,11 +714,11 @@ dnl ************************************************** orig_cppflags=$CPPFLAGS - + if test "x$emu_inc" != xno; then CPPFLAGS="-I$emu_inc $CPPFLAGS" fi - + AC_CHECK_HEADER(emu/emu.h, [found=yes], [found=no]) if test "x$found" != "xno"; then @@ -708,17 +727,17 @@ dnl ************************************************** dnl * emu lib * dnl ************************************************** - + orig_ldflags=$LDFLAGS if test "x$emu_lib" != "xno"; then LDFLAGS="-L$emu_lib $LDFLAGS" fi AC_CHECK_LIB(emu, emu_new, [found=yes], [found=no]) - + if test "x$found" != "xyes"; then LDFLAGS=$orig_ldflags fi - else + else CPPFLAGS=$orig_cppflags fi @@ -729,7 +748,7 @@ AC_DEFINE(HAVE_EMU, 1 , [Define if we have emu client library]) LIB_EMU="-lemu" fi -fi +fi @@ -763,7 +782,7 @@ -AC_ARG_ENABLE(dnsresolve_adns, [ --enable-dnsresolve-adns Enable adns [default=yes]], +AC_ARG_ENABLE(dnsresolve_adns, [ --enable-dnsresolve-adns Enable adns [default=yes]], enable_dnsresolve_adns="$enableval", enable_dnsresolve_adns="yes") dnl ************************************************** @@ -781,7 +800,7 @@ if test x$enable_dnsresolve_adns = xyes; then orig_cppflags=$CPPFLAGS - + if test "x$adns_inc" != xno; then CPPFLAGS="-I$adns_inc $CPPFLAGS" fi @@ -855,11 +874,11 @@ AC_MSG_ERROR([libpreludes libprelude-config was not found in PATH]) enable_prelude=no else - AC_DEFINE(HAVE_LIBPRELUDE, 1,[Define if you want to use libprelude]) + AC_DEFINE(HAVE_LIBPRELUDE, 1,[Define if you want to use libprelude]) PRELUDE_LDFLAGS=`$LIBPRELUDE_CONFIG --ldflags` PRELUDE_LIBS=`$LIBPRELUDE_CONFIG --libs` PRELUDE_CPPFLAGS=`$LIBPRELUDE_CONFIG --pthread-cflags` - + LIB_PRELUDE="$PRELUDE_LIBS" LDFLAG_PRELUDE="$PRELUDE_LDFLAGS" CPPFLAGS="$CPPFLAGS $PRELUDE_CPPFLAGS" @@ -874,8 +893,8 @@ dnl ************************************************** AC_MSG_CHECKING(whether to use libcap to improve security) -AC_ARG_ENABLE(capabilities, [ --enable-capabilities Enable capabilities [default=auto]], - [enable_capabilities="$enableval"], +AC_ARG_ENABLE(capabilities, [ --enable-capabilities Enable capabilities [default=auto]], + [enable_capabilities="$enableval"], [enable_capabilities="yes"]) if test x$enable_capabilities = xno ; then @@ -885,7 +904,7 @@ [ --with-cap-include=PATH use libcap], [cap_inc=$withval], [cap_inc=no]) - + AC_ARG_WITH(cap-lib, [ --with-cap-lib=PATH use libcap], [cap_lib=$withval], @@ -893,7 +912,7 @@ orig_cppflags=$CPPFLAGS - + if test "x$cap_inc" != xno; then CPPFLAGS="-I$cap_inc $CPPFLAGS" fi @@ -903,35 +922,35 @@ LDFLAGS="-L$cap_lib $LDFLAGS" fi - AC_CHECK_LIB(cap, cap_init, + AC_CHECK_LIB(cap, cap_init, [ AC_DEFINE(HAVE_LIBCAP, 1,[Define if libcap is available to restrict process capabilities]) LIB_CAP="-lcap" enable_capabilities="yes" - ], + ], [ AC_MSG_WARN([libcap check failed]) enable_capabilities="no (check failed)" ]) - -fi +fi + dnl ************************************************** dnl * liby existence * dnl ************************************************** AC_CHECK_LIB(y, yyerror, - [ + [ LIB_LIBY="-ly" enable_liby="yes" - ], + ], [ enable_liby="no" ]) - + AC_DEFUN([AC_DEFINE_DIR], [ prefix_NONE= exec_prefix_NONE= @@ -1019,13 +1038,13 @@ modules/log-hexdump/Makefile ]) # modules/shellcode-emulation/Makefile -# modules/module-upnp/Makefile +# modules/module-upnp/Makefile # modules/log-prelude/Makefile -# modules/module-drone/Makefile +# modules/module-drone/Makefile # modules/log-surfnet/Makefile]) # modules/vuln-netbios/Makefile # modules/module-baitnswitch/Makefile -# modules/dnsresolve-udns/Makefile +# modules/dnsresolve-udns/Makefile AC_OUTPUT @@ -1039,19 +1058,20 @@ echo " - Support adns : $enable_dnsresolve_adns" echo "" echo "- Support Large Filesystem : $enable_lfs" -echo "" +echo "" echo "- Support MySQL : $enable_mysql" -echo "" +echo "" echo "- Support PostgreSQL : $enable_postgre" -echo "" +echo "" echo "- Support ssh : $enable_ssh" -echo "" +echo "" echo "- Support prelude : $enable_prelude" -echo "" +echo "" echo "- Support capabilities : $enable_capabilities" echo "" echo "- Packet Monitoring/Sniffing" echo " - linux ip_queue (ipq) : $enable_ipq" +echo " - linux nfnetlink (nfqueue) : $have_nfqueue" echo " - FBSD ipfw Divert sockets : $enable_ipfw" echo " - Packet Capture Lib (pcap) : $enable_pcap" Index: modules/module-honeytrap/TrapSocket.cpp =================================================================== --- modules/module-honeytrap/TrapSocket.cpp (revision 1776) +++ modules/module-honeytrap/TrapSocket.cpp (working copy) @@ -5,24 +5,24 @@ * * * Copyright (C) 2005 Paul Baecher & Markus Koetter - * + * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. - * + * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. - * + * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - * - * - * contact nepenthesdev@users.sourceforge.net * + * + * contact nepenthesdev@users.sourceforge.net + * *******************************************************************************/ /* $Id$ */ @@ -58,8 +58,8 @@ #include "module-honeytrap.hpp" #include "PCAPSocket.hpp" -#ifdef STDTAGS - #undef STDTAGS +#ifdef STDTAGS + #undef STDTAGS #endif #define STDTAGS l_mod @@ -75,13 +75,17 @@ #ifdef HAVE_IPQ m_IPQHandle = NULL; -#endif +#endif +#ifdef HAVE_NFQUEUE + m_NFQUEUEHandle = NULL; +#endif + #ifdef HAVE_IPFW m_DivertSocket = -1; #endif - + } TrapSocket::TrapSocket(string pcap_device) @@ -90,7 +94,7 @@ #ifdef HAVE_PCAP m_PcapDevice = pcap_device; m_HTType = HT_PCAP; -#else +#else m_HTType = HT_NONE; #endif @@ -104,7 +108,7 @@ m_HTType = HT_IPFW; #ifdef HAVE_IPFW m_DivertPort = divert_port; -#else +#else m_HTType = HT_NONE; #endif m_DialogueFactory = "bridge Factory"; @@ -113,7 +117,12 @@ TrapSocket::TrapSocket(bool param) { TrapSocket(); +#ifdef HAVE_IPQ m_HTType = HT_IPQ; +#endif +#ifdef HAVE_NFQUEUE + m_HTType = HT_NFQUEUE; +#endif m_DialogueFactory = "bridge Factory"; } @@ -127,8 +136,8 @@ /** * Module::Init() - * - * + * + * * @return returns true if everything was fine, else false * false indicates a fatal error */ @@ -145,6 +154,10 @@ retval = Init_IPQ(); break; + case HT_NFQUEUE: + retval = Init_NFQUEUE(); + break; + case HT_IPFW: retval = Init_IPFW(); break; @@ -187,10 +200,47 @@ return true; } +bool TrapSocket::Init_NFQUEUE() +{ +#ifdef HAVE_NFQUEUE + if ( (m_NFQUEUEHandle = nfq_open()) == NULL ) + { + logCrit("Could not create nfqueue handle (nfq_open())\n"); + return false; + } + + if ( nfq_unbind_pf(m_NFQUEUEHandle, AF_INET) < 0 ) { + logCrit("Cannot unbind existing nfqueue handler (nfq_unbind_pf())\n"); + return false; + } + + if ( nfq_bind_pf(m_NFQUEUEHandle, AF_INET) < 0 ) { + logCrit("Cannot bind to nfqueue handler for AF_INTER (nfq_bind_pf())\n"); + return false; + } + + m_NFQUEUEQueueHandle = nfq_create_queue(m_NFQUEUEHandle, 0, &NFQueueCallback, NULL); + if ( m_NFQUEUEQueueHandle == NULL ) { + logCrit("Cannot create queue (nfq_create_queue())\n"); + return false; + } + + if ( nfq_set_mode(m_NFQUEUEQueueHandle, NFQNL_COPY_PACKET, 0xffff) < 0) { + logCrit("Cannot set packet copy mode (nfq_set_mode)\n"); + return false; + } + + NFQUEUE_fd = nfq_fd(m_NFQUEUEHandle); + + logInfo("Initialised libipq\n"); +#endif // HAVE_NFQUEUE + return true; +} + bool TrapSocket::Init_IPFW() { #ifdef HAVE_IPFW - if ((m_DivertSocket = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) == -1) + if ((m_DivertSocket = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) == -1) { logCrit("Could not create divert socket for ipfw %s\n",strerror(errno)); return false; @@ -200,7 +250,7 @@ m_DivertSin.sin_family = PF_INET; m_DivertSin.sin_addr.s_addr = INADDR_ANY; - if (bind(m_DivertSocket, (struct sockaddr *)&m_DivertSin, sizeof(m_DivertSin)) == -1) + if (bind(m_DivertSocket, (struct sockaddr *)&m_DivertSin, sizeof(m_DivertSin)) == -1) { logCrit("Could not bind divert socket %s\n",strerror(errno)); return false; @@ -234,7 +284,7 @@ string bpf_filter_string = "tcp[tcpflags] & tcp-rst != 0 and tcp[4:4] = 0 "; pcap_if_t *alldevsp = NULL; - + if( pcap_findalldevs(&alldevsp,errbuf) == -1) { logCrit("pcap_findalldevs failed %s\n",errbuf); @@ -274,14 +324,14 @@ if ( bpf_filter_string_addition == "" ) { - bpf_filter_string_addition += string("src host ") + - string(inet_ntoa(*(struct in_addr*) &(((struct sockaddr_in *)addr->addr)->sin_addr))) + + bpf_filter_string_addition += string("src host ") + + string(inet_ntoa(*(struct in_addr*) &(((struct sockaddr_in *)addr->addr)->sin_addr))) + string(" "); } else { - bpf_filter_string_addition += string("or src host ") + - string(inet_ntoa(*(struct in_addr*) &(((struct sockaddr_in *)addr->addr)->sin_addr))) + + bpf_filter_string_addition += string("or src host ") + + string(inet_ntoa(*(struct in_addr*) &(((struct sockaddr_in *)addr->addr)->sin_addr))) + string(" "); } break; @@ -292,7 +342,7 @@ } logSpam("\n"); - + } } @@ -364,14 +414,14 @@ } - + return true; #else // HAVE_PCAP logCrit("pcap not supported, hit the docs\n"); return false; #endif // HAVE_PCAP - + } bool TrapSocket::Exit() @@ -388,6 +438,10 @@ retval = Exit_IPQ(); break; + case HT_NFQUEUE: + retval = Exit_NFQUEUE(); + break; + case HT_IPFW: retval = Exit_IPFW(); break; @@ -443,7 +497,19 @@ } +bool TrapSocket::Exit_NFQUEUE() +{ +#ifdef HAVE_NFQUEUE + if ( m_NFQUEUEHandle != NULL ) + { + nfq_destroy_queue(m_NFQUEUEQueueHandle); + nfq_close(m_NFQUEUEHandle); + } +#endif // HAVE_NFQueue + return true; +} + bool TrapSocket::Exit_IPFW() { #ifdef HAVE_IPFW @@ -484,6 +550,10 @@ retval = doRecv_IPQ(); break; + case HT_NFQUEUE: + retval = doRecv_NFQUEUE(); + break; + case HT_IPFW: retval = doRecv_IPFW(); break; @@ -528,10 +598,10 @@ case DLT_PPP: - /* PPP; if the first 2 bytes are 0xff and 0x03, - * it's PPP in HDLC-like framing, with the PPP header following those two bytes, + /* PPP; if the first 2 bytes are 0xff and 0x03, + * it's PPP in HDLC-like framing, with the PPP header following those two bytes, * otherwise it's PPP without framing, and the packet begins with the PPP header. - */ + */ offset = 4; static char hldc_frame[] = { 0xff, 0x03 }; if (memcmp(pkt_data,hldc_frame,2) == 0) @@ -594,7 +664,7 @@ logWarn("IPQ Received error message %d\n",ipq_get_msgerr(buf)); break; - case IPQM_PACKET: + case IPQM_PACKET: { ipq_packet_msg_t *m = ipq_get_packet(buf); @@ -612,7 +682,7 @@ if ( tcp->th_flags & TH_SYN && !(tcp->th_flags & TH_ACK) ) { - createListener((libnet_ipv4_hdr *)ip,(libnet_tcp_hdr *)tcp, + createListener((libnet_ipv4_hdr *)ip,(libnet_tcp_hdr *)tcp, (unsigned char *)m->payload,(uint16_t)m->data_len); } @@ -633,6 +703,58 @@ return 1; } +#ifdef HAVE_NFQUEUE +int TrapSocket::NFQueueCallback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg, + struct nfq_data *nfa, void *data) +{ + uint32_t id = 0; + struct nfqnl_msg_packet_hdr *ph; + char *payload; /* nfq_get_payload(struct nfq_data *nfad, char **data) */ + int len; +// int retval; + + ph = nfq_get_msg_packet_hdr(nfa); + if ( ph ) { + id = ntohl(ph->packet_id); + } + len = nfq_get_payload(nfa, &payload); + if (len >= 0) { + if ( ntohs(ph->hw_protocol) == ETHERTYPE_IP ) { + const struct libnet_ipv4_hdr* ip; + ip = (struct libnet_ipv4_hdr*)(payload); + int hlen = ip->ip_hl * 4; + const struct libnet_tcp_hdr* tcp; + + tcp = (struct libnet_tcp_hdr*) ((u_char *)payload+hlen); + + if ( tcp->th_flags & TH_SYN && !(tcp->th_flags & TH_ACK) ) + { + g_ModuleHoneytrap->m_TrapSocket->createListener((libnet_ipv4_hdr *)ip,(libnet_tcp_hdr *)tcp, + (u_char *)payload,(uint16_t)len); + } + } + } + + return nfq_set_verdict(qh, id, NF_ACCEPT, 0, NULL); +} +#endif + +int32_t TrapSocket::doRecv_NFQUEUE() +{ + logPF(); +#ifdef HAVE_NFQUEUE + char buf[NFQUEUE_PACKET_BUFSIZE] __attribute__ ((aligned)); + int len; + + len = recv(NFQUEUE_fd, buf, NFQUEUE_PACKET_BUFSIZE, 0); + if (len > 0) { + nfq_handle_packet(m_NFQUEUEHandle, buf, len); + } + +#endif // HAVE_NFQUEUE + return 1; +} + int32_t TrapSocket::doRecv_IPFW() { logPF(); @@ -706,10 +828,10 @@ int32_t TrapSocket::getsockOpt(int32_t level, int32_t optname,void *optval,socklen_t *optlen) { -#if defined(linux) || defined(__linux) +#if defined(linux) || defined(__linux) return getsockopt(getSocket(), level, optname, optval, optlen); #else - return 0; + return 0; #endif } @@ -732,20 +854,20 @@ ip->ip_hl * 4, ntohs(ip->ip_len) ); - logSpam(" |- Source %s \n" , + logSpam(" |- Source %s \n" , inet_ntoa(ip->ip_src) ); - logSpam(" |- Destionation %s \n" , + logSpam(" |- Destionation %s \n" , inet_ntoa(ip->ip_dst) ); - logSpam(" |- Bits: %s %s, Offset : %d, checksum = %.4x, TTL = %d\n", - ntohs(ip->ip_off) & IP_DF? "DF":"", - ntohs(ip->ip_off) & IP_MF? "MF":"", - ntohs(ip->ip_off) & IP_OFFMASK, + logSpam(" |- Bits: %s %s, Offset : %d, checksum = %.4x, TTL = %d\n", + ntohs(ip->ip_off) & IP_DF? "DF":"", + ntohs(ip->ip_off) & IP_MF? "MF":"", + ntohs(ip->ip_off) & IP_OFFMASK, ntohs(ip->ip_sum), - ip->ip_ttl); + ip->ip_ttl); - logSpam(" |- proto = %d : \n", + logSpam(" |- proto = %d : \n", ip->ip_p ); @@ -762,7 +884,7 @@ ntohs(tcp->th_ack)); logSpam(" |- bits %s %s %s %s %s %s %s %s\n", - (tcp->th_flags) & TH_FIN?"FIN":"", + (tcp->th_flags) & TH_FIN?"FIN":"", (tcp->th_flags) & TH_SYN?"SYN":"", (tcp->th_flags) & TH_RST?"RST":"", (tcp->th_flags) & TH_PUSH?"PUSH":"", @@ -772,9 +894,9 @@ (tcp->th_flags) & TH_CWR?"CWR":"" ); - logSpam(" `- checksum = %.4x, windows = %.4x, urgent = %.4x\n", + logSpam(" `- checksum = %.4x, windows = %.4x, urgent = %.4x\n", ntohs(tcp->th_sum), - ntohs(tcp->th_win), + ntohs(tcp->th_win), ntohs(tcp->th_urp) ); } @@ -838,7 +960,7 @@ #ifdef HAVE_PCAP isupport += "pcap,"; -#endif +#endif #ifdef HAVE_IPQ isupport += "ipq,"; Index: modules/module-honeytrap/module-honeytrap.hpp =================================================================== --- modules/module-honeytrap/module-honeytrap.hpp (revision 1776) +++ modules/module-honeytrap/module-honeytrap.hpp (working copy) @@ -53,6 +53,7 @@ { class Buffer; + class TrapSocket; typedef struct { @@ -122,7 +123,7 @@ string getPcapPath(); uint32_t getPcapMinPackets(); - + TrapSocket *m_TrapSocket; protected: map m_Sockets; Nepenthes *m_Nepenthes; Index: modules/module-honeytrap/TrapSocket.hpp =================================================================== --- modules/module-honeytrap/TrapSocket.hpp (revision 1776) +++ modules/module-honeytrap/TrapSocket.hpp (working copy) @@ -5,24 +5,24 @@ * * * Copyright (C) 2005 Paul Baecher & Markus Koetter - * + * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. - * + * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. - * + * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - * - * - * contact nepenthesdev@users.sourceforge.net * + * + * contact nepenthesdev@users.sourceforge.net + * *******************************************************************************/ /* $Id$ */ @@ -45,7 +45,11 @@ #ifdef HAVE_IPQ #include #include -#endif +#endif +#ifdef HAVE_NFQUEUE + #include + #include +#endif // #include #include #include @@ -74,6 +78,7 @@ #define ETHER_HDRLEN 16 #define IPQ_PACKET_BUFSIZE 2048 +#define NFQUEUE_PACKET_BUFSIZE 4096 #define LIBNET_LIL_ENDIAN 1 #ifndef ETHERTYPE_IP @@ -190,8 +195,8 @@ -/* These enums are used by IPX too. :-( - * +/* These enums are used by IPX too. :-( + * * mappings to determine the state of a tcp connection in /proc/net/tcp * * taken from net-tools @@ -215,11 +220,12 @@ class Buffer; - typedef enum + typedef enum { HT_NONE, HT_PCAP, HT_IPQ, + HT_NFQUEUE, HT_IPFW } honeytrap_type; @@ -238,11 +244,13 @@ bool Init(); bool Init_PCAP(); bool Init_IPQ(); + bool Init_NFQUEUE(); bool Init_IPFW(); bool Exit(); bool Exit_PCAP(); bool Exit_IPQ(); + bool Exit_NFQUEUE(); bool Exit_IPFW(); bool wantSend(); @@ -252,6 +260,7 @@ int32_t doRecv(); int32_t doRecv_PCAP(); int32_t doRecv_IPQ(); + int32_t doRecv_NFQUEUE(); int32_t doRecv_IPFW(); int32_t getSocket(); @@ -262,18 +271,25 @@ static string getSupportedModes(); bool createListener(libnet_ipv4_hdr *ip, libnet_tcp_hdr *tcp, unsigned char *data, uint16_t size); + static int NFQueueCallback(nfq_q_handle*, nfgenmsg*, nfq_data*, void*); protected: - + #ifdef HAVE_PCAP pcap_t *m_RawListener; string m_PcapDevice; int m_PcapDataLinkType; #endif - + #ifdef HAVE_IPQ struct ipq_handle *m_IPQHandle; #endif +#ifdef HAVE_NFQUEUE + struct nfq_handle *m_NFQUEUEHandle; + struct nfq_q_handle *m_NFQUEUEQueueHandle; + int NFQUEUE_fd; +#endif + #ifdef HAVE_IPFW uint16_t m_DivertPort; int m_DivertSocket; Index: modules/module-honeytrap/Makefile.am =================================================================== --- modules/module-honeytrap/Makefile.am (revision 1776) +++ modules/module-honeytrap/Makefile.am (working copy) @@ -6,11 +6,15 @@ AM_CPPFLAGS = -I$(top_srcdir)/nepenthes-core/include -I$(top_srcdir)/nepenthes-core/src -pipe -D _GNU_SOURCE -I/usr/include/libipq AM_CXXFLAGS = -Wall -Werror -AM_LDFLAGS = ${LIB_PCAP} ${LIB_IPQ} +AM_LDFLAGS = ${LIB_PCAP} ${LIB_IPQ} +if NFQUEUE +AM_LDFLAGS += -lnetfilter_queue -lnfnetlink +endif + pkglib_LTLIBRARIES = modulehoneytrap.la -modulehoneytrap_la_SOURCES = module-honeytrap.cpp module-honeytrap.hpp +modulehoneytrap_la_SOURCES = module-honeytrap.cpp module-honeytrap.hpp modulehoneytrap_la_SOURCES += PCAPSocket.cpp PCAPSocket.hpp modulehoneytrap_la_SOURCES += TrapSocket.cpp TrapSocket.hpp modulehoneytrap_la_SOURCES += module-honeytrap.conf.dist Index: modules/module-honeytrap/module-honeytrap.cpp =================================================================== --- modules/module-honeytrap/module-honeytrap.cpp (revision 1776) +++ modules/module-honeytrap/module-honeytrap.cpp (working copy) @@ -5,24 +5,24 @@ * * * Copyright (C) 2005 Paul Baecher & Markus Koetter - * + * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. - * + * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. - * + * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - * - * - * contact nepenthesdev@users.sourceforge.net * + * + * contact nepenthesdev@users.sourceforge.net + * *******************************************************************************/ /* $Id$ */ @@ -68,8 +68,8 @@ #include "TrapSocket.hpp" -#ifdef STDTAGS - #undef STDTAGS +#ifdef STDTAGS + #undef STDTAGS #endif #define STDTAGS l_mod @@ -81,7 +81,7 @@ * * The idea is really good, and it as it was easy to make a nepenthes module of it, we stole it * - */ + */ @@ -97,8 +97,8 @@ /** * The Constructor - * creates a new ModuleHoneyTrap Module, - * + * creates a new ModuleHoneyTrap Module, + * * @param nepenthes the pointer to our Nepenthes */ ModuleHoneyTrap::ModuleHoneyTrap(Nepenthes *nepenthes) @@ -126,8 +126,8 @@ /** * Module::Init() - * - * + * + * * @return returns true if everything was fine, else false * false indicates a fatal error */ @@ -141,8 +141,8 @@ } - + string mode; try { @@ -197,7 +197,7 @@ if (s->Init() != true) return false; } -#endif +#endif #ifdef HAVE_IPQ if (mode == "ipq") @@ -206,8 +206,17 @@ if (s->Init() != true) return false; } -#endif +#endif +#ifdef HAVE_NFQUEUE + if (mode == "nfqueue") + { + s = new TrapSocket(true); + if (s->Init() != true) + return false; + } +#endif + #ifdef HAVE_IPFW if (mode == "ipfw") { @@ -224,7 +233,7 @@ return false; } -#endif +#endif if (s == NULL) { @@ -233,12 +242,13 @@ } - + m_Events.set(EV_SOCK_TCP_ACCEPT); m_Events.set(EV_SOCK_TCP_CLOSE); REG_EVENT_HANDLER(this); + m_TrapSocket = (TrapSocket *)s; return true; }