/* returns packet id */
static u_int32_t print_pkt (struct nfq_data *tb)
{
int id = 0;
struct nfqnl_msg_packet_hdr *ph;
u_int32_t mark,ifi;
int ret;
char *data;
ph = nfq_get_msg_packet_hdr(tb);
if (ph){
id = ntohl(ph->packet_id);
printf("hw_protocol=0x%04x hook=%u id=%u ",
ntohs(ph->hw_protocol), ph->hook, id);
}
mark = nfq_get_nfmark(tb);
if (mark)
printf("mark=%u ", mark);
ifi = nfq_get_indev(tb);
if (ifi)
printf("indev=%u ", ifi);
ifi = nfq_get_outdev(tb);
if (ifi)
printf("outdev=%u ", ifi);
ret = nfq_get_payload(tb, &data);
if (ret >= 0)
printf("payload_len=%d ", ret);
fputc('\n', stdout);
return id;
}
static u_int32_t fwnfq_process_pkt (struct nfq_data *tb, FWAction *action)
{
struct nfqnl_msg_packet_hdr *ph;
gint id = 0;
u_int32_t mark, ifi, ifo, ifaceidx;
gint ret, iphdrlen;
gchar *data;
FWDirection dir;
struct ip *hdr;
ph = nfq_get_msg_packet_hdr(tb);
if ( ph ) {
id = ntohl(ph->packet_id);
printf("hw_protocol=0x%04x hook=%u id=%u ", ntohs(ph->hw_protocol), ph->hook, id);
}
mark = nfq_get_nfmark(tb);
if ( mark )
printf("mark=%u ", mark);
ifi = nfq_get_indev(tb);
if ( ifi ) {
printf("indev=%u ", ifi-1);
dir = DIR_INCOMING;
ifaceidx = ifi - 1;
}
ifo = nfq_get_outdev(tb);
if ( ifo ) {
printf("outdev=%u ", ifo-1);
dir = DIR_OUTGOING;
ifaceidx = ifo - 1;
}
ret = nfq_get_payload(tb, &data);
if ( ret >= 0 )
printf("payload_len=%d ", ret);
printf("\n\n");
/* Refresh every 50 packet */
// if ( (id % 50) == 0 ) {
// fwproc_netentries_process(PROTO_TCP);
// fwproc_netentries_process(PROTO_UDP);
// fwproc_scan_procdir();
// }
hdr = (struct ip *) data;
iphdrlen = hdr->ip_hl * 4; // IP header len = ip_hl * 4 (32 bits)
printf("*** PACKET PROTOCOL: %s ***\n", TxtProto[hdr->ip_p]);
*action = fwnfq_process_rules(ifaceidx, dir, data, id);
return id;
}
static u_int32_t print_pkt (struct nfq_data *tb)
{
int id = 0;
struct nfqnl_msg_packet_hdr *ph;
struct nfqnl_msg_packet_hw *hwph;
u_int32_t mark,ifi;
int ret;
char *data;
ph = nfq_get_msg_packet_hdr(tb);
if (ph) {
id = ntohl(ph->packet_id);
printf("hw_protocol=0x%04x hook=%u id=%u ",
ntohs(ph->hw_protocol), ph->hook, id);
}
hwph = nfq_get_packet_hw(tb);
if (hwph) {
int i, hlen = ntohs(hwph->hw_addrlen);
printf("hw_src_addr=");
for (i = 0; i < hlen-1; i++)
printf("%02x:", hwph->hw_addr[i]);
printf("%02x ", hwph->hw_addr[hlen-1]);
}
mark = nfq_get_nfmark(tb);
if (mark)
printf("mark=%u ", mark);
ifi = nfq_get_indev(tb);
if (ifi)
printf("indev=%u ", ifi);
ifi = nfq_get_outdev(tb);
if (ifi)
printf("outdev=%u ", ifi);
ifi = nfq_get_physindev(tb);
if (ifi)
printf("physindev=%u ", ifi);
ifi = nfq_get_physoutdev(tb);
if (ifi)
printf("physoutdev=%u ", ifi);
ret = nfq_get_payload(tb, &data);
if (ret >= 0) {
printf("payload_len=%d ", ret);
//processPacketData (data, ret);
}
fputc('\n', stdout);
return id;
}
int NFQSetupPkt (Packet *p, struct nfq_q_handle *qh, void *data)
{
struct nfq_data *tb = (struct nfq_data *)data;
int ret;
char *pktdata;
struct nfqnl_msg_packet_hdr *ph;
ph = nfq_get_msg_packet_hdr(tb);
if (ph != NULL) {
p->nfq_v.id = ntohl(ph->packet_id);
//p->nfq_v.hw_protocol = ntohs(p->nfq_v.ph->hw_protocol);
p->nfq_v.hw_protocol = ph->hw_protocol;
}
p->nfq_v.mark = nfq_get_nfmark(tb);
if (nfq_config.mode == NFQ_REPEAT_MODE) {
if ((nfq_config.mark & nfq_config.mask) ==
(p->nfq_v.mark & nfq_config.mask)) {
int iter = 0;
if (already_seen_warning < MAX_ALREADY_TREATED)
SCLogInfo("Packet seems already treated by suricata");
already_seen_warning++;
do {
ret = nfq_set_verdict(qh, p->nfq_v.id, NF_ACCEPT, 0, NULL);
} while ((ret < 0) && (iter++ < NFQ_VERDICT_RETRY_TIME));
if (ret < 0) {
SCLogWarning(SC_ERR_NFQ_SET_VERDICT,
"nfq_set_verdict of %p failed %" PRId32 "",
p, ret);
}
return -1 ;
}
}
p->nfq_v.ifi = nfq_get_indev(tb);
p->nfq_v.ifo = nfq_get_outdev(tb);
#ifdef NFQ_GET_PAYLOAD_SIGNED
ret = nfq_get_payload(tb, &pktdata);
#else
ret = nfq_get_payload(tb, (unsigned char **) &pktdata);
#endif /* NFQ_GET_PAYLOAD_SIGNED */
if (ret > 0) {
/* nfq_get_payload returns a pointer to a part of memory
* that is not preserved over the lifetime of our packet.
* So we need to copy it. */
if (ret > 65536) {
/* Will not be able to copy data ! Set length to 0
* to trigger an error in packet decoding.
* This is unlikely to happen */
SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "NFQ sent too big packet");
SET_PKT_LEN(p, 0);
} else {
PacketCopyData(p, (uint8_t *)pktdata, ret);
}
} else if (ret == -1) {
/* unable to get pointer to data, ensure packet length is zero.
* This will trigger an error in packet decoding */
SET_PKT_LEN(p, 0);
}
ret = nfq_get_timestamp(tb, &p->ts);
if (ret != 0) {
memset (&p->ts, 0, sizeof(struct timeval));
gettimeofday(&p->ts, NULL);
}
p->datalink = DLT_RAW;
return 0;
}
int payload_get_indev(struct payload *self)
{
return nfq_get_indev(self->nfad);
}
/* returns packet id */
static u_int32_t print_pkt (struct nfq_data *tb)
{
int id = 0;
struct nfqnl_msg_packet_hdr *ph;
u_int32_t mark,ifi;
int ret;
char *nf_packet;
ph = nfq_get_msg_packet_hdr(tb);
if (ph){
id = ntohl(ph->packet_id);
printf("hw_protocol=0x%04x hook=%u id=%u ",
ntohs(ph->hw_protocol), ph->hook, id);
}
mark = nfq_get_nfmark(tb);
if (mark)
printf("mark=%u ", mark);
ifi = nfq_get_indev(tb);
if (ifi)
printf("indev=%u ", ifi);
ifi = nfq_get_outdev(tb);
if (ifi)
printf("outdev=%u ", ifi);
ret = nfq_get_payload(tb, &nf_packet);
if ((ret >= 0)){
printf("payload_len=%d bytes", ret);
fputc('\n', stdout);
}
// parse the packet headers
struct iphdr *iph = ((struct iphdr *) nf_packet);
// Computing IP address translation from 32 bits words to 4*8bits decimal
/* NOTE ON THE LENGTHS
all lengths used in headers are specified in 32bits words
thus, to print the size in bytes, we need to multiply this value by 4
*/
// display IP HEADERS : ip.h line 45
// ntohs convert short unsigned int, ntohl do the same for long unsigned int
fprintf(stdout, "IP{v=%u; ihl=%u; tos=%u; tot_len=%u; id=%u; ttl=%u; protocol=%u; "
,iph->version, iph->ihl*4, iph->tos, ntohs(iph->tot_len), ntohs(iph->id), iph->ttl, iph->protocol);
char *saddr = inet_ntoa(*(struct in_addr *)&iph->saddr);
fprintf(stdout,"saddr=%s; ",saddr);
char *daddr = inet_ntoa(*(struct in_addr *)&iph->daddr);
fprintf(stdout,"daddr=%s}\n",daddr);
// if protocol is tcp
if (iph->protocol == 6){
// extract tcp header from packet
/* Calculate the size of the IP Header. iph->ihl contains the number of 32 bit
words that represent the header size. Therfore to get the number of bytes
multiple this number by 4 */
struct tcphdr *tcp = ((struct tcphdr *) (nf_packet + (iph->ihl << 2)));
/* Calculate the size of the TCP Header. tcp->doff contains the number of 32 bit
words that represent the header size. Therfore to get the number of bytes
multiple this number by 4 */
//int tcphdr_size = (tcp->doff << 2);
/* to print the TCP headers, we access the structure defined in tcp.h line 89
and convert values from hexadecimal to ascii */
fprintf(stdout, "TCP{sport=%u; dport=%u; seq=%u; ack_seq=%u; flags=u%ua%up%ur%us%uf%u; window=%u; urg=%u}\n",
ntohs(tcp->source), ntohs(tcp->dest), ntohl(tcp->seq), ntohl(tcp->ack_seq)
,tcp->urg, tcp->ack, tcp->psh, tcp->rst, tcp->syn, tcp->fin, ntohs(tcp->window), tcp->urg_ptr);
}
// if protocol is udp
if(iph->protocol == 17){
struct udphdr *udp = ((struct udphdr *) (nf_packet + (iph->ihl << 2)));
fprintf(stdout,"UDP{sport=%u; dport=%u; len=%u}\n",
ntohs(udp->source), ntohs(udp->dest), udp->len);
}
fprintf(stdout,"\n");
return id;
}
static int packet_input(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
struct nfq_data *nfa, void *data)
{
divert_cb cb = (divert_cb) data;
char *d;
int len;
int rc;
unsigned int id;
struct nfqnl_msg_packet_hdr *ph = nfq_get_msg_packet_hdr(nfa);
struct ip *ip;
int flags = 0;
struct timeval tv;
int rlen = 0;
void *rdata = NULL;
len = nfq_get_payload(nfa, &d);
if (len < 0)
err(1, "nfq_get_payload()");
if (nfq_get_indev(nfa))
flags |= DF_IN;
if (nfq_get_timestamp(nfa, &tv) == 0)
set_time(&tv);
else {
static int warn = 0;
if (!warn && !_conf.cf_disable_timers)
xprintf(XP_ALWAYS, "No timestamp provided in packet"
" - expect low performance due to"
" calls to gettimeofday\n");
warn = 1;
}
rc = cb(d, len, flags);
id = ntohl(ph->packet_id);
switch (rc) {
case DIVERT_MODIFY:
ip = (struct ip*) d;
rlen = ntohs(ip->ip_len);
rdata = d;
/* fallthrough */
case DIVERT_ACCEPT:
if (_mark) {
unsigned int mark = 0;
assert((mark & _mark) == 0);
nfq_set_verdict_mark(qh, id, NF_REPEAT,
htonl(_mark | mark),
rlen, rdata);
} else
nfq_set_verdict(qh, id, NF_ACCEPT, rlen, rdata);
break;
case DIVERT_DROP:
nfq_set_verdict(qh, id, NF_DROP, 0, NULL);
break;
default:
printf("Unknown verdict %d\n", rc);
abort();
}
return 0;
}
static int nfqueue_cb(
struct nfq_q_handle *qh,
struct nfgenmsg *nfmsg,
struct nfq_data *nfa,
void *data) {
char *pkt;
struct nfqnl_msg_packet_hdr *ph;
ph = nfq_get_msg_packet_hdr(nfa);
if ( ph ) {
int id = 0, size = 0;
id = ntohl(ph->packet_id);
size = nfq_get_payload(nfa, &pkt);
struct ip *iph = (struct ip *) pkt;
int id_protocol = identify_ip_protocol(pkt);
int dport = get_udp_dst_port(pkt);
int x = sizeof (struct ip) + sizeof (struct udphdr);
/* packets we are interested in are UDP multicast to 239.255.255.250:1900
* and start with a data string M-SEARCH
*/
if ( (dport == 1900) && (id_protocol == IPPROTO_UDP)
&& (ssdp.sin_addr.s_addr == iph->ip_dst.s_addr) ) {
/* get the index that the packet came in on */
u_int32_t idx = nfq_get_indev(nfa);
int i = 0;
for ( ;i < n_nfqix ; i++) {
if ( nfqix[i] == idx ) {
struct udphdr *udp = (struct udphdr *) (pkt + sizeof(struct ip));
char *dd = pkt + x;
struct sockaddr_in sendername;
sendername.sin_family = AF_INET;
sendername.sin_port = udp->source;
sendername.sin_addr.s_addr = iph->ip_src.s_addr;
/* printf("pkt found %s\n",dd);*/
ProcessSSDPData (sudp, dd, size - x,
&sendername, (unsigned short) 5555);
}
}
}
nfq_set_verdict(qh, id, NF_ACCEPT, 0, NULL);
} else {
syslog(LOG_ERR,"nfq_get_msg_packet_hdr failed");
return 1;
/* from nfqueue source: 0 = ok, >0 = soft error, <0 hard error */
}
return 0;
}
