--- nepenthes+nfqueue.1.patch	2009-01-25 01:06:58.000000000 +0100
+++ foo.diff	2009-01-25 01:37:11.000000000 +0100
@@ -1,27 +1,6 @@
-Index: autohell.sh
-===================================================================
---- autohell.sh	(revision 0)
-+++ autohell.sh	(revision 0)
-@@ -0,0 +1,10 @@
-+#!/bin/sh
-+
-+touch config.h.in
-+touch ltmain.sh
-+chmod ugo+x ltmain.sh
-+
-+aclocal
-+automake --add-missing
-+autoconf
-+
-
-Property changes on: autohell.sh
-___________________________________________________________________
-Added: svn:executable
-   + *
-
 Index: configure.ac
 ===================================================================
---- configure.ac	(revision 1777)
+--- configure.ac	(revision 1776)
 +++ configure.ac	(working copy)
 @@ -10,6 +10,8 @@
  AM_INIT_AUTOMAKE([nepenthes], [0.2.2])
@@ -552,7 +531,7 @@
  
 Index: modules/module-honeytrap/TrapSocket.cpp
 ===================================================================
---- modules/module-honeytrap/TrapSocket.cpp	(revision 1777)
+--- modules/module-honeytrap/TrapSocket.cpp	(revision 1776)
 +++ modules/module-honeytrap/TrapSocket.cpp	(working copy)
 @@ -5,24 +5,24 @@
   *
@@ -687,7 +666,7 @@
 +		return false;
 +	}
 +
-+	if ( nfq_bind_pf(h, AF_INET) < 0 ) {
++	if ( nfq_bind_pf(m_NFQUEUEHandle, AF_INET) < 0 ) {
 +		logCrit("Cannot bind to nfqueue handler for AF_INTER (nfq_bind_pf())\n");
 +		return false;
 +	}
@@ -855,19 +834,19 @@
  								   (unsigned char *)m->payload,(uint16_t)m->data_len);
  
  				}
-@@ -633,6 +703,59 @@
+@@ -633,6 +703,58 @@
  	return 1;
  }
  
 +#ifdef HAVE_NFQUEUE
-+static int TrapSocket::NFQueueCallback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
++int TrapSocket::NFQueueCallback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
 +	      struct nfq_data *nfa, void *data)
 +{
 +	uint32_t id = 0;
 +	struct nfqnl_msg_packet_hdr *ph;
 +	char *payload; /* nfq_get_payload(struct nfq_data *nfad, char **data) */
 +	int len;
-+	int retval;
++//	int retval;
 +
 +	ph = nfq_get_msg_packet_hdr(nfa);
 +	if ( ph ) {
@@ -875,7 +854,7 @@
 +	}
 +	len = nfq_get_payload(nfa, &payload);
 +	if (len >= 0) {
-+		if ( ntohs(pk->hw_protocol) == ETHERTYPE_IP ) {
++		if ( ntohs(ph->hw_protocol) == ETHERTYPE_IP ) {
 +			const struct libnet_ipv4_hdr* ip;
 +			ip = (struct libnet_ipv4_hdr*)(payload);
 +			int hlen = ip->ip_hl * 4;
@@ -883,27 +862,26 @@
 +
 +			tcp = (struct libnet_tcp_hdr*) ((u_char *)payload+hlen);
 +
-+				if ( tcp->th_flags & TH_SYN && !(tcp->th_flags & TH_ACK) )
-+				{
-+					createListener((libnet_ipv4_hdr *)ip,(libnet_tcp_hdr *)tcp,
-+								   (u_char *)payload,(uint16_t)len);
-+				}
++			if ( tcp->th_flags & TH_SYN && !(tcp->th_flags & TH_ACK) )
++			{
++				g_ModuleHoneytrap->m_TrapSocket->createListener((libnet_ipv4_hdr *)ip,(libnet_tcp_hdr *)tcp,
++							   (u_char *)payload,(uint16_t)len);
 +			}
++		}
 +	}
 +
 +	return nfq_set_verdict(qh, id, NF_ACCEPT, 0, NULL);
 +}
-+}
 +#endif
 +
 +int32_t TrapSocket::doRecv_NFQUEUE()
 +{
 +	logPF();
 +#ifdef HAVE_NFQUEUE
-+	unsigned char buf[NFQUEUE_PACKET_BUFSIZE] __attribute__ ((aligned));
++	char buf[NFQUEUE_PACKET_BUFSIZE] __attribute__ ((aligned));
 +	int len;
 +
-+	len = recv(NFQUEUE_fd, buf, NFQUEUE_PACKET_BUFSIZE, 0)
++	len = recv(NFQUEUE_fd, buf, NFQUEUE_PACKET_BUFSIZE, 0);
 +	if (len > 0) {
 +		nfq_handle_packet(m_NFQUEUEHandle, buf, len);
 +	}
@@ -915,7 +893,7 @@
  int32_t TrapSocket::doRecv_IPFW()
  {
  	logPF();
-@@ -706,10 +829,10 @@
+@@ -706,10 +828,10 @@
  
  int32_t TrapSocket::getsockOpt(int32_t level, int32_t optname,void *optval,socklen_t *optlen)
  {
@@ -928,7 +906,7 @@
  #endif
  }
  
-@@ -732,20 +855,20 @@
+@@ -732,20 +854,20 @@
  			ip->ip_hl * 4,
  			ntohs(ip->ip_len) );
  
@@ -957,7 +935,7 @@
  			ip->ip_p  );
  
  
-@@ -762,7 +885,7 @@
+@@ -762,7 +884,7 @@
  			ntohs(tcp->th_ack));
  
  	logSpam("     |- bits %s %s %s %s %s %s %s %s\n",
@@ -966,7 +944,7 @@
  			(tcp->th_flags) & TH_SYN?"SYN":"",
  			(tcp->th_flags) & TH_RST?"RST":"",
  			(tcp->th_flags) & TH_PUSH?"PUSH":"",
-@@ -772,9 +895,9 @@
+@@ -772,9 +894,9 @@
  			(tcp->th_flags) & TH_CWR?"CWR":""
  		   );
  
@@ -978,7 +956,7 @@
  			ntohs(tcp->th_urp) );
  }
  
-@@ -838,7 +961,7 @@
+@@ -838,7 +960,7 @@
  
  #ifdef HAVE_PCAP
  	isupport += "pcap,";
@@ -987,9 +965,30 @@
  
  #ifdef HAVE_IPQ
  	isupport += "ipq,";
+Index: modules/module-honeytrap/module-honeytrap.hpp
+===================================================================
+--- modules/module-honeytrap/module-honeytrap.hpp	(revision 1776)
++++ modules/module-honeytrap/module-honeytrap.hpp	(working copy)
+@@ -53,6 +53,7 @@
+ {
+ 
+ 	class Buffer;
++	class TrapSocket;
+ 
+ 	typedef struct 
+ 	{
+@@ -122,7 +123,7 @@
+ 		string 		getPcapPath();
+ 		uint32_t	getPcapMinPackets();
+ 
+-
++		TrapSocket *m_TrapSocket;
+ 	protected:
+ 		map<connection_t ,Socket *,cmp_connection_t> m_Sockets;
+ 		Nepenthes *m_Nepenthes;
 Index: modules/module-honeytrap/TrapSocket.hpp
 ===================================================================
---- modules/module-honeytrap/TrapSocket.hpp	(revision 1777)
+--- modules/module-honeytrap/TrapSocket.hpp	(revision 1776)
 +++ modules/module-honeytrap/TrapSocket.hpp	(working copy)
 @@ -5,24 +5,24 @@
   *
@@ -1090,9 +1089,11 @@
  		int32_t doRecv_IPFW();
  
  		int32_t getSocket();
-@@ -263,17 +272,23 @@
+@@ -262,18 +271,25 @@
+ 
  		static string getSupportedModes();
  		bool createListener(libnet_ipv4_hdr *ip, libnet_tcp_hdr *tcp, unsigned char *data, uint16_t size);
++		static int NFQueueCallback(nfq_q_handle*, nfgenmsg*, nfq_data*, void*);
  	protected:
 -		
 +
@@ -1118,7 +1119,7 @@
  		int 				m_DivertSocket;
 Index: modules/module-honeytrap/Makefile.am
 ===================================================================
---- modules/module-honeytrap/Makefile.am	(revision 1777)
+--- modules/module-honeytrap/Makefile.am	(revision 1776)
 +++ modules/module-honeytrap/Makefile.am	(working copy)
 @@ -6,11 +6,15 @@
  
@@ -1140,7 +1141,7 @@
  modulehoneytrap_la_SOURCES += module-honeytrap.conf.dist
 Index: modules/module-honeytrap/module-honeytrap.cpp
 ===================================================================
---- modules/module-honeytrap/module-honeytrap.cpp	(revision 1777)
+--- modules/module-honeytrap/module-honeytrap.cpp	(revision 1776)
 +++ modules/module-honeytrap/module-honeytrap.cpp	(working copy)
 @@ -5,24 +5,24 @@
   *
@@ -1262,7 +1263,7 @@
  
  	if (s == NULL)
  	{
-@@ -233,8 +242,8 @@
+@@ -233,12 +242,13 @@
  	}
  
  
@@ -1272,3 +1273,8 @@
  	m_Events.set(EV_SOCK_TCP_ACCEPT);
  	m_Events.set(EV_SOCK_TCP_CLOSE);
  	REG_EVENT_HANDLER(this);
+ 
++	m_TrapSocket = (TrapSocket *)s;
+ 
+ 	return true;
+ }