Changeset 573

Timestamp:

06/24/06 16:32:16 (3 years ago)

Author:

common

Message:

nepenthes
- module-honeytrap

• removed libnet depency by copying the libnet tcp and ipv4 headers
  
• prepare support for freebsd ipwf divert socket mode
  
• create proper bpf filter for pcap mode
  
• set ip header offset based on datalink type (currently supported DLT_LINUX_SLL and DLT_EN10MB )
  
• move printing headers to a own method
  

Files:

• nepenthes/trunk/modules/module-honeytrap/module-honeytrap.conf.dist (modified) (1 diff)
• nepenthes/trunk/modules/module-honeytrap/module-honeytrap.cpp (modified) (17 diffs)
• nepenthes/trunk/modules/module-honeytrap/module-honeytrap.hpp (modified) (7 diffs)

nepenthes/trunk/modules/module-honeytrap/module-honeytrap.conf.dist

@@ -1 +1 @@
-module-honeytrap
-{
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-};

nepenthes/trunk/modules/module-honeytrap/module-honeytrap.cpp

@@ -28 +28 @@
-/* $Id$ */
-
-
+
+
+
+
+
-#include <netinet/in.h>
+
+
-
-#include "module-honeytrap.hpp"
@@ -38 +44 @@
-#include "LogManager.hpp"
-#include "DialogueFactoryManager.hpp"
-
+
-
-#include "Buffer.hpp"
@@ -102 +108 @@
-#endif 
-
-
+
+
+
+
+
-}
-
@@ -127 +137 @@
-
-#ifdef HAVE_IPQ
-
+
+
+
+
+
-#endif
-
@@ -149 +163 @@
-        }
-
+#ifdef HAVE_PCAP
-        if (mode == "pcap")
-        {
-                m_HTType = HT_PCAP;
-
-
+
+
+
+
-        if (mode == "ipq")
-        {
-                m_HTType = HT_IPQ;
-
+
+
+
+
+
+
+
+
+
+
+
+
-        {
-                logCrit("Invalid mode %s for module-honeytrap\n",mode.c_str());
@@ -175 +203 @@
-                retval = Init_IPQ();
-                break;
+
+        case HT_IPFW:
+                retval = Init_IPFW();
+                break;
+
+        default:
+                logCrit("Invalid mode for module-honeytrap\n");
+
-        }
-
@@ -210 +246 @@
-}
-
+bool ModuleHoneyTrap::Init_IPFW()
+{
+#ifdef HAVE_IPFW
+    if ((m_DivertSocket = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) == -1) 
+    {
+        logCrit("Could not create divert socket for ipfw %s\n",strerror(errno));
+        return false;
+    }
+    bzero(&m_DivertSin, sizeof(m_DivertSin));
+        m_DivertSin.sin_port = htons(4711);     // FIXME
+    m_DivertSin.sin_family = PF_INET;
+    m_DivertSin.sin_addr.s_addr = INADDR_ANY;
+
+    if (bind(m_DivertSocket, (struct sockaddr *)&m_DivertSin, sizeof(m_DivertSin)) == -1) 
+    {
+        logCrit("Could not bind divert socket %s\n",strerror(errno));
+        return false;
+    }
+        logInfo("Bound divert socket on port %i\n",4711);       //FIXME
+        return true;
+#else
+        logCrit("IPFW not supported, check your plattform\n");
+        return false;
+#endif // HAVE_IPFW
+
+}
+
+
-bool ModuleHoneyTrap::Init_PCAP()
-{
@@ -217 +281 @@
-
-        logInfo("Using pcap %s\n",pcap_lib_version());
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-        struct bpf_program filter;
-
+        logInfo("BPF Filter is %s\n",bpf_filter_string.c_str());
-        // int pcap_compile(pcap_t *p, struct bpf_program *fp, char *str, int optimize, bpf_u_int32 netmask)
-"tcp[tcpflags] & tcp-rst != 0"
+(char *)bpf_filter_string.c_str()
-        //      if ( pcap_compile(m_RawListener, &filter,  "host 192.168.53.20", 0, 0) == -1 )
-        {
@@ -262 +431 @@
-        }
-
+        int dll = pcap_datalink(m_RawListener);
+        switch( dll )
+        {
+        case DLT_LINUX_SLL:
+                logInfo("DataLinkLayer %s %s\n",pcap_datalink_val_to_name(dll),pcap_datalink_val_to_description(dll));
+                m_LinkLayerHeaderLength = 16;
+                break;
+
+
+        case DLT_EN10MB:
+                logInfo("DataLinkLayer %s %s\n",pcap_datalink_val_to_name(dll),pcap_datalink_val_to_description(dll));
+                m_LinkLayerHeaderLength = 14;
+                break;
+                
+        default:
+                logCrit("DataLink %i %s %s unknown, please file a bug\n",dll,pcap_datalink_val_to_name(dll),pcap_datalink_val_to_description(dll));
+                return false;
+        }
+                
+        return true;
+#else
+        logCrit("pcap not supported, hit the docs\n");
+        return false;
-#endif // HAVE_PCAP
-return true;
+
-}
-
@@ -278 +470 @@
-                retval = Exit_IPQ();
-                break;
+
+        case HT_IPFW:
+                retval = Exit_IPFW();
+                break;
+
+        default:
+                logCrit("Invalid mode for module-honeytrap\n");
-        }
-        return retval;
@@ -321 +520 @@
-}
-
+bool ModuleHoneyTrap::Exit_IPFW()
+{
+#ifdef HAVE_IPFW
+        if (m_DivertSocket != -1)
+        {
+                close(m_DivertSocket);
+        }
+#endif
+        return true;
+}
-
-
@@ -349 +558 @@
-                retval = doRecv_IPQ();
-                break;
+
+        case HT_IPFW:
+                retval = doRecv_IPFW();
+                break;
+
+
+        default:
+                logCrit("Invalid mode for module-honeytrap\n");
-        }
-        return retval;
@@ -367 +584 @@
-        if ( retval == 1 )
-        {
-
-
-
+
+
+
+
+
-
-                /* new connections are welcome */
-no
+
-                        return 0;
-                logInfo("Got RST packet from localhost:%i %i\n",ntohs(tcp->th_sport),tcp->th_sport);
@@ -433 +652 @@
-                                {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-
-                                        if ( isPortListening(ntohs(tcp->th_dport),*(uint32_t *)&(ip->ip_dst)) == false )
@@ -522 +690 @@
-}
-
+int32_t ModuleHoneyTrap::doRecv_IPFW()
+{
+        logPF();
+#ifdef HAVE_IPFW
+        int len;
+        char buf[2024];
+
+        if ( (len = recvfrom(m_DivertSocket, buf, sizeof(buf), 0,(struct sockaddr *)&m_DivertSin, &m_DivertSinLen)) == -1 )
+        {
+                logWarn("recvfrom() on divert socket failed %s\n",strerror(errno));
+                return 1;
+        }
+
+        // I'll add processing once i have access on a fbsd box with divert sockets enabled
+        logWarn("You are too early, the processing logic for data from divert sockets is a todo");
+        
+
+        if ( sendto(m_DivertSocket, buf, len, 0,(struct sockaddr *)&m_DivertSin, m_DivertSinLen) == -1 )
+        {
+                logWarn("Writing packet back to divert socket failed %s\n",strerror(errno));
+        }
+
+
+#endif
+        return 1;
+}
+
+
-int32_t ModuleHoneyTrap::getSocket()
-{
@@ -536 +732 @@
-                return m_IPQHandle->fd;
-#endif
-
+
+
+
+
+
+
+
+
+
+
-        }
-        return -1;
@@ -609 +814 @@
-}
-
+void ModuleHoneyTrap::printIPpacket(unsigned char *buf, uint32_t len)
+{
+        const struct libnet_ipv4_hdr* ip;
+
+        ip = (struct libnet_ipv4_hdr*)(buf);
+
+        int hlen = ip->ip_hl * 4;
+
+        const struct libnet_tcp_hdr* tcp;
+        tcp = (struct libnet_tcp_hdr*) ((u_char *)buf+hlen);
+
+
+        logSpam("-- IP v%d, ID = %d, Header Length = %d, Total Length = %d\n",
+                        ip->ip_v,
+                        ip->ip_id,
+                        ip->ip_hl * 4,
+                        ntohs(ip->ip_len) );
+
+        logSpam("  | %s --> " , 
+                        inet_ntoa(ip->ip_src) );
+
+        logSpam("%s \n" , 
+                        inet_ntoa(ip->ip_dst) );
+
+        logSpam("  |- Bits: %s %s, Offset : %d, checksum = %.4x, TTL = %d\n", 
+                        ntohs(ip->ip_off) & IP_DF? "DF":"", 
+                        ntohs(ip->ip_off) & IP_MF? "MF":"", 
+                        ntohs(ip->ip_off) & IP_OFFMASK, 
+                        ntohs(ip->ip_sum),
+                        ip->ip_ttl);   
+
+        logSpam("  |- proto = %d : \n", 
+                        ip->ip_p  );
+
+
+        logSpam("  `-- TCP, Header Length = %d Payload Length = %d\n",
+                        tcp->th_off *4,
+                        len); // <- this number is wrong
+
+        logSpam("     |- port Source = %d --> port Destination = %d\n",
+                        ntohs(tcp->th_sport),
+                        ntohs(tcp->th_dport));
+
+        logSpam("     |- Seq nb = %.4x ,Acknowledgement nb:%.4x\n",
+                        ntohs(tcp->th_seq),
+                        ntohs(tcp->th_ack));
+
+        logSpam("     |- bits %s %s %s %s %s %s %s %s\n",
+                        (tcp->th_flags) & TH_FIN?"FIN":"", 
+                        (tcp->th_flags) & TH_SYN?"SYN":"",
+                        (tcp->th_flags) & TH_RST?"RST":"",
+                        (tcp->th_flags) & TH_PUSH?"PUSH":"",
+                        (tcp->th_flags) & TH_ACK?"ACK":"",
+                        (tcp->th_flags) & TH_URG?"URG":"",
+                        (tcp->th_flags) & TH_ECE?"ECE":"",
+                        (tcp->th_flags) & TH_CWR?"CWR":""
+                   );
+
+        logSpam("     `- checksum = %.4x, windows = %.4x, urgent = %.4x\n", 
+                        ntohs(tcp->th_sum),
+                        ntohs(tcp->th_win), 
+                        ntohs(tcp->th_urp) );
+}
+
-extern "C" int32_t module_init(int32_t version, Module **module, Nepenthes *nepenthes)
-{

nepenthes/trunk/modules/module-honeytrap/module-honeytrap.hpp

@@ -31 +31 @@
-#define HAVE_IPQ
-
+#ifdef HAVE_PCAP
-#include <pcap.h>
-
+
-
-
-extern "C"
-{
+#ifdef HAVE_IPQ
-        #include <linux/netfilter.h>
-        #include <libipq.h>
-
+
+
+
+
+
-}
-
-
-
+
-
-
@@ -66 +71 @@
-#define ETHER_HDRLEN 16
-#define IPQ_PACKET_BUFSIZE 2048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        enum
-        {
@@ -138 +211 @@
-        typedef enum 
-        {
+                HT_NONE,
-                HT_PCAP,
-
+
+
-        } honeytrap_type;
-
@@ -151 +226 @@
-                bool Init_PCAP();
-                bool Init_IPQ();
+                bool Init_IPFW();
-
-                bool Exit();
-                bool Exit_PCAP();
-                bool Exit_IPQ();
+                bool Exit_IPFW();
-
-                bool wantSend();
@@ -163 +240 @@
-                int32_t doRecv_PCAP();
-                int32_t doRecv_IPQ();
+                int32_t doRecv_IPFW();
-
-                int32_t getSocket();
@@ -168 +246 @@
-
-                bool isPortListening(uint16_t localport, uint32_t localhost);
+
+                void printIPpacket(unsigned char *buf, uint32_t len);
-
-        protected:
-#ifdef HAVE_PCAP
-                pcap_t  *m_RawListener;
+                int     m_LinkLayerHeaderLength;
+                string  m_PcapDevice;
-#endif
- 
@@ -178 +260 @@
-#endif
-
+#ifdef HAVE_IPFW
+                uint16_t                        m_DivertPort;
+                int                             m_DivertSocket;
+                struct sockaddr_in      m_DivertSin;
+                socklen_t                       m_DivertSinLen;
+#endif
+
-                Nepenthes *m_Nepenthes;
-                honeytrap_type m_HTType;