Changeset 1283

Timestamp:

06/06/07 10:04:16 (1 year ago)

Author:

till

Message:

- unfreeze unsupported packtes in ipq/nfq connection monitors
- skeleton for a submitMwserv plugin

Files:

• honeytrap/trunk/configure.in (modified) (4 diffs)
• honeytrap/trunk/src/ipqmon.c (modified) (6 diffs)
• honeytrap/trunk/src/modules/Makefile.am (modified) (2 diffs)
• honeytrap/trunk/src/modules/htm_b64Decode.c (modified) (1 diff)
• honeytrap/trunk/src/modules/htm_submitMwserv.c (added)
• honeytrap/trunk/src/modules/htm_submitMwserv.h (added)
• honeytrap/trunk/src/modules/htm_vncDownload.c (modified) (1 diff)
• honeytrap/trunk/src/nfqmon.c (modified) (1 diff)

honeytrap/trunk/configure.in

@@ -411 +411 @@
-
-
+AC_ARG_WITH(submit-mwserv,
+        [  --with-submit-mwserv     Submit malware samples to a central server])
+AM_CONDITIONAL(BUILD_SUBMIT_MWSERV_PLUGIN, test x$with_submit_mwserv = xyes)
+if test "$with_submit_mwserv" = "yes"; then
+        with_submit_mwserv="X"
+
+        AC_CHECK_FUNC(gethostbyname, , AC_CHECK_LIB(nsl, gethostbyname))
+        AC_CHECK_FUNC(connect, , AC_CHECK_LIB(socket, connect))
+
+        AC_ARG_WITH(libcurl_includes,
+        [  --with-libcurl-includes=DIR  libcurl include directory],
+        [with_libcurl_includes="$withval"],[with_libcurl_includes=no])
+
+        AC_ARG_WITH(libcurl_libraries,
+        [  --with-libcurl-libraries=DIR  libcurl library directory],
+        [with_libcurl_libraries="$withval"],[with_libcurl_libraries=no])
+
+        if test "$with_libcurl_includes" != "no"; then
+                CPPFLAGS="${CPPFLAGS} -I${with_libcurl_includes}"
+        fi
+        AC_CHECK_HEADER(curl.h,,[AC_ERROR(curl.h not found.)])
+
+        AC_CHECK_LIB(curl, curl_version, LCURL="yes", LCURL="no")
+        if test "$LCURL" = "no"; then
+                echo
+                echo "   ERROR!  Libcurl library/headers not found. Install it or use the"
+                echo "   --with-libcurl-* options, if you have it installed in unusual place."
+                echo
+                exit
+        fi
+        if test "x$libcurl" = xno ; then
+                AC_MSG_CHECKING([checking for curl with SSL])
+                LIBS="$LIBS -lcurl -L/usr/local/ssl/lib -lssl -lcrypto"
+                AC_TRY_LINK([#include <curl/curl.h>], [curl_version();], libcurl=yes,
+                libcurl=no)
+                if test "x$libcurl" = xno ; then
+                        AC_MSG_RESULT(no)
+                        AC_MSG_ERROR([libcurl required. Go to http://curl.haxx.se/ to download and then install it first])
+                else
+                        AC_MSG_RESULT(yes)
+                fi
+        fi 
+else
+        with_submit_mwserv=" "
+fi
+
+
+
-AC_ARG_WITH(postgres,
-        [  --with-postgres          Store attack data in PostgreSQL database])
@@ -505 +553 @@
-AC_SUBST(INCLUDES)
-
-$with_ipq_mon != "yes" -a $with_nfq_mon != "yes" -a $with_ipfw_mon != "yes" -a $with_pcap_mon != "yes"
+! $with_ipq_mon -a ! $with_nfq_mon -a ! $with_ipfw_mon -a ! $with_pcap_mon
-  echo
-  echo "   ERROR! No connection monitor selected. Please reconfigure with --with-pcap-mon, --with-nfq-mon  or --with-ipq-mon."
@@ -511 +559 @@
-  exit 1
-fi
+
+echo $with_ipq_mon, $sith_nfq_mon, $with_ipfw_mon, $with_pcap_mon
-
-
@@ -524 +574 @@
-echo "--- honeytrap configuration ---"
-echo "General options"
-\x5b$enable_debug]
-\x5b$enable_profiling]
-\x5b$with_efence]
+($enable_debug)
+($enable_profile)
+($with_efence)
-echo
-echo "Connection monitor"
-\x5b$with_ipq_mon]
-\x5b$with_ipfw_mon]
-\x5b$with_nfq_mon]
-\x5b$with_pcap_mon]
+($with_ipq_mon)
+($with_ipfw_mon)
+($with_nfq_mon)
+($with_pcap_mon)
-echo
-echo "Optional plugins"
-
-
-
-
+
+
+
+
+

honeytrap/trunk/src/ipqmon.c

@@ -34 +34 @@
-#define BUFSIZE 1500
-
-static void die(struct ipq_handle *h) {
-        logmsg(LOG_ERR, 1, "IPQ Error: %s.\n", ipq_errstr());
-        ipq_destroy_handle(h);
-        clean_exit(EXIT_SUCCESS);
-}
-
-int start_ipq_mon(void) {
@@ -59 +54 @@
-        logmsg(LOG_DEBUG, 1, "Creating ipq connection monitor.\n");
-        if ((h = ipq_create_handle(0, PF_INET)) == NULL) {
-.\n"
-die(h
+: %s.\n", ipq_errstr()
+clean_exit(EXIT_FAILURE
-        }
-
-        if ((status = ipq_set_mode(h, IPQ_COPY_PACKET, BUFSIZE)) < 0) {
-
-
+
+
+
-        }
-
@@ -73 +69 @@
-                process = 1;
-                if ((status = ipq_read(h, buf, BUFSIZE, 0)) < 0) {
-
-
+
+
+
-                }
-                switch (ipq_message_type(buf)) {
@@ -95 +92 @@
-                                } else {
-                                        logmsg(LOG_ERR, 1, "Error - Protocol %u is not supported.\n", ip->ip_p);
+                                        if ((status = ipq_set_verdict(h, packet->packet_id, NF_ACCEPT, 0, NULL)) < 0) {
+                                                logmsg(LOG_ERR, 1, "Error - Could not set verdict on packet: %s.\n", ipq_errstr());
+                                                ipq_destroy_handle(h);
+                                                clean_exit(EXIT_FAILURE);
+                                        }
-                                        break;
-                                }
@@ -108 +110 @@
-                                                dport, PROTO(ip->ip_p));
-                                        if ((status = ipq_set_verdict(h, packet->packet_id, NF_ACCEPT, 0, NULL)) < 0) {
-
-
+
+
+
-                                        }
-                                        process = 0;
@@ -129 +132 @@
-                                                dport, PROTO(ip->ip_p));
-                                        if ((status = ipq_set_verdict(h, packet->packet_id, NF_ACCEPT, 0, NULL)) < 0) {
-
-
+
+
+
-                                        }
-                                        process = 0;

honeytrap/trunk/src/modules/Makefile.am

@@ -30 +30 @@
-if BUILD_CLAMAV_PLUGIN
-lib_LTLIBRARIES += htm_ClamAV.la
+endif
+
+if BUILD_SUBMIT_MWSERV_PLUGIN
+lib_LTLIBRARIES += htm_submitMwserv.la
-endif
-
@@ -67 +71 @@
-endif
-
+if BUILD_SUBMIT_MWSERV_PLUGIN
+htm_submitMwserv_la = htm_submitMwserv.c htm_submitMwserv.h
+htm_submitMwserv_la_LDFLAGS = -module -no-undefined -avoid-version
+endif
+
-install-exec-am:
-        $(mkinstalldirs) $(DESTDIR)/$(sysconfdir)/honeytrap/plugins

honeytrap/trunk/src/modules/htm_b64Decode.c

@@ -34 +34 @@
-#include "htm_b64Decode.h"
-
-htm_
+
-const char module_version[]="0.3.1";
-

honeytrap/trunk/src/modules/htm_vncDownload.c

@@ -28 +28 @@
-#include "htm_vncDownload.h"
-
-htm_
+
-const char module_version[]="0.3";
-

honeytrap/trunk/src/nfqmon.c

@@ -74 +74 @@
-                } else {
-                        logmsg(LOG_ERR, 1, "Error - Protocol %u is not supported.\n", ip->ip_p);
+                        if (nfq_set_verdict(qh, id, NF_ACCEPT, 0, NULL) == -1) {
+                                logmsg(LOG_ERR, 1, "Error - Could not set verdict on packet.\n");
+                                nfq_destroy_queue(qh);
+                                exit(EXIT_FAILURE);
+                        }
-                        return(-1);
-                }