/* returns packet id */ static u_int32_t print_pkt (struct nfq_data *tb) { int id = 0; struct nfqnl_msg_packet_hdr *ph; u_int32_t mark,ifi; int ret; char *data; ph = nfq_get_msg_packet_hdr(tb); if (ph){ id = ntohl(ph->packet_id); printf("hw_protocol=0x%04x hook=%u id=%u ", ntohs(ph->hw_protocol), ph->hook, id); } mark = nfq_get_nfmark(tb); if (mark) printf("mark=%u ", mark); ifi = nfq_get_indev(tb); if (ifi) printf("indev=%u ", ifi); ifi = nfq_get_outdev(tb); if (ifi) printf("outdev=%u ", ifi); ret = nfq_get_payload(tb, &data); if (ret >= 0) printf("payload_len=%d ", ret); fputc('\n', stdout); return id; }
static u_int32_t fwnfq_process_pkt (struct nfq_data *tb, FWAction *action) { struct nfqnl_msg_packet_hdr *ph; gint id = 0; u_int32_t mark, ifi, ifo, ifaceidx; gint ret, iphdrlen; gchar *data; FWDirection dir; struct ip *hdr; ph = nfq_get_msg_packet_hdr(tb); if ( ph ) { id = ntohl(ph->packet_id); printf("hw_protocol=0x%04x hook=%u id=%u ", ntohs(ph->hw_protocol), ph->hook, id); } mark = nfq_get_nfmark(tb); if ( mark ) printf("mark=%u ", mark); ifi = nfq_get_indev(tb); if ( ifi ) { printf("indev=%u ", ifi-1); dir = DIR_INCOMING; ifaceidx = ifi - 1; } ifo = nfq_get_outdev(tb); if ( ifo ) { printf("outdev=%u ", ifo-1); dir = DIR_OUTGOING; ifaceidx = ifo - 1; } ret = nfq_get_payload(tb, &data); if ( ret >= 0 ) printf("payload_len=%d ", ret); printf("\n\n"); /* Refresh every 50 packet */ // if ( (id % 50) == 0 ) { // fwproc_netentries_process(PROTO_TCP); // fwproc_netentries_process(PROTO_UDP); // fwproc_scan_procdir(); // } hdr = (struct ip *) data; iphdrlen = hdr->ip_hl * 4; // IP header len = ip_hl * 4 (32 bits) printf("*** PACKET PROTOCOL: %s ***\n", TxtProto[hdr->ip_p]); *action = fwnfq_process_rules(ifaceidx, dir, data, id); return id; }
static u_int32_t print_pkt (struct nfq_data *tb) { int id = 0; struct nfqnl_msg_packet_hdr *ph; struct nfqnl_msg_packet_hw *hwph; u_int32_t mark,ifi; int ret; char *data; ph = nfq_get_msg_packet_hdr(tb); if (ph) { id = ntohl(ph->packet_id); printf("hw_protocol=0x%04x hook=%u id=%u ", ntohs(ph->hw_protocol), ph->hook, id); } hwph = nfq_get_packet_hw(tb); if (hwph) { int i, hlen = ntohs(hwph->hw_addrlen); printf("hw_src_addr="); for (i = 0; i < hlen-1; i++) printf("%02x:", hwph->hw_addr[i]); printf("%02x ", hwph->hw_addr[hlen-1]); } mark = nfq_get_nfmark(tb); if (mark) printf("mark=%u ", mark); ifi = nfq_get_indev(tb); if (ifi) printf("indev=%u ", ifi); ifi = nfq_get_outdev(tb); if (ifi) printf("outdev=%u ", ifi); ifi = nfq_get_physindev(tb); if (ifi) printf("physindev=%u ", ifi); ifi = nfq_get_physoutdev(tb); if (ifi) printf("physoutdev=%u ", ifi); ret = nfq_get_payload(tb, &data); if (ret >= 0) { printf("payload_len=%d ", ret); //processPacketData (data, ret); } fputc('\n', stdout); return id; }
int NFQSetupPkt (Packet *p, struct nfq_q_handle *qh, void *data) { struct nfq_data *tb = (struct nfq_data *)data; int ret; char *pktdata; struct nfqnl_msg_packet_hdr *ph; ph = nfq_get_msg_packet_hdr(tb); if (ph != NULL) { p->nfq_v.id = ntohl(ph->packet_id); //p->nfq_v.hw_protocol = ntohs(p->nfq_v.ph->hw_protocol); p->nfq_v.hw_protocol = ph->hw_protocol; } p->nfq_v.mark = nfq_get_nfmark(tb); if (nfq_config.mode == NFQ_REPEAT_MODE) { if ((nfq_config.mark & nfq_config.mask) == (p->nfq_v.mark & nfq_config.mask)) { int iter = 0; if (already_seen_warning < MAX_ALREADY_TREATED) SCLogInfo("Packet seems already treated by suricata"); already_seen_warning++; do { ret = nfq_set_verdict(qh, p->nfq_v.id, NF_ACCEPT, 0, NULL); } while ((ret < 0) && (iter++ < NFQ_VERDICT_RETRY_TIME)); if (ret < 0) { SCLogWarning(SC_ERR_NFQ_SET_VERDICT, "nfq_set_verdict of %p failed %" PRId32 "", p, ret); } return -1 ; } } p->nfq_v.ifi = nfq_get_indev(tb); p->nfq_v.ifo = nfq_get_outdev(tb); #ifdef NFQ_GET_PAYLOAD_SIGNED ret = nfq_get_payload(tb, &pktdata); #else ret = nfq_get_payload(tb, (unsigned char **) &pktdata); #endif /* NFQ_GET_PAYLOAD_SIGNED */ if (ret > 0) { /* nfq_get_payload returns a pointer to a part of memory * that is not preserved over the lifetime of our packet. * So we need to copy it. */ if (ret > 65536) { /* Will not be able to copy data ! Set length to 0 * to trigger an error in packet decoding. * This is unlikely to happen */ SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "NFQ sent too big packet"); SET_PKT_LEN(p, 0); } else { PacketCopyData(p, (uint8_t *)pktdata, ret); } } else if (ret == -1) { /* unable to get pointer to data, ensure packet length is zero. * This will trigger an error in packet decoding */ SET_PKT_LEN(p, 0); } ret = nfq_get_timestamp(tb, &p->ts); if (ret != 0) { memset (&p->ts, 0, sizeof(struct timeval)); gettimeofday(&p->ts, NULL); } p->datalink = DLT_RAW; return 0; }
int payload_get_indev(struct payload *self) { return nfq_get_indev(self->nfad); }
/* returns packet id */ static u_int32_t print_pkt (struct nfq_data *tb) { int id = 0; struct nfqnl_msg_packet_hdr *ph; u_int32_t mark,ifi; int ret; char *nf_packet; ph = nfq_get_msg_packet_hdr(tb); if (ph){ id = ntohl(ph->packet_id); printf("hw_protocol=0x%04x hook=%u id=%u ", ntohs(ph->hw_protocol), ph->hook, id); } mark = nfq_get_nfmark(tb); if (mark) printf("mark=%u ", mark); ifi = nfq_get_indev(tb); if (ifi) printf("indev=%u ", ifi); ifi = nfq_get_outdev(tb); if (ifi) printf("outdev=%u ", ifi); ret = nfq_get_payload(tb, &nf_packet); if ((ret >= 0)){ printf("payload_len=%d bytes", ret); fputc('\n', stdout); } // parse the packet headers struct iphdr *iph = ((struct iphdr *) nf_packet); // Computing IP address translation from 32 bits words to 4*8bits decimal /* NOTE ON THE LENGTHS all lengths used in headers are specified in 32bits words thus, to print the size in bytes, we need to multiply this value by 4 */ // display IP HEADERS : ip.h line 45 // ntohs convert short unsigned int, ntohl do the same for long unsigned int fprintf(stdout, "IP{v=%u; ihl=%u; tos=%u; tot_len=%u; id=%u; ttl=%u; protocol=%u; " ,iph->version, iph->ihl*4, iph->tos, ntohs(iph->tot_len), ntohs(iph->id), iph->ttl, iph->protocol); char *saddr = inet_ntoa(*(struct in_addr *)&iph->saddr); fprintf(stdout,"saddr=%s; ",saddr); char *daddr = inet_ntoa(*(struct in_addr *)&iph->daddr); fprintf(stdout,"daddr=%s}\n",daddr); // if protocol is tcp if (iph->protocol == 6){ // extract tcp header from packet /* Calculate the size of the IP Header. iph->ihl contains the number of 32 bit words that represent the header size. Therfore to get the number of bytes multiple this number by 4 */ struct tcphdr *tcp = ((struct tcphdr *) (nf_packet + (iph->ihl << 2))); /* Calculate the size of the TCP Header. tcp->doff contains the number of 32 bit words that represent the header size. Therfore to get the number of bytes multiple this number by 4 */ //int tcphdr_size = (tcp->doff << 2); /* to print the TCP headers, we access the structure defined in tcp.h line 89 and convert values from hexadecimal to ascii */ fprintf(stdout, "TCP{sport=%u; dport=%u; seq=%u; ack_seq=%u; flags=u%ua%up%ur%us%uf%u; window=%u; urg=%u}\n", ntohs(tcp->source), ntohs(tcp->dest), ntohl(tcp->seq), ntohl(tcp->ack_seq) ,tcp->urg, tcp->ack, tcp->psh, tcp->rst, tcp->syn, tcp->fin, ntohs(tcp->window), tcp->urg_ptr); } // if protocol is udp if(iph->protocol == 17){ struct udphdr *udp = ((struct udphdr *) (nf_packet + (iph->ihl << 2))); fprintf(stdout,"UDP{sport=%u; dport=%u; len=%u}\n", ntohs(udp->source), ntohs(udp->dest), udp->len); } fprintf(stdout,"\n"); return id; }
static int packet_input(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg, struct nfq_data *nfa, void *data) { divert_cb cb = (divert_cb) data; char *d; int len; int rc; unsigned int id; struct nfqnl_msg_packet_hdr *ph = nfq_get_msg_packet_hdr(nfa); struct ip *ip; int flags = 0; struct timeval tv; int rlen = 0; void *rdata = NULL; len = nfq_get_payload(nfa, &d); if (len < 0) err(1, "nfq_get_payload()"); if (nfq_get_indev(nfa)) flags |= DF_IN; if (nfq_get_timestamp(nfa, &tv) == 0) set_time(&tv); else { static int warn = 0; if (!warn && !_conf.cf_disable_timers) xprintf(XP_ALWAYS, "No timestamp provided in packet" " - expect low performance due to" " calls to gettimeofday\n"); warn = 1; } rc = cb(d, len, flags); id = ntohl(ph->packet_id); switch (rc) { case DIVERT_MODIFY: ip = (struct ip*) d; rlen = ntohs(ip->ip_len); rdata = d; /* fallthrough */ case DIVERT_ACCEPT: if (_mark) { unsigned int mark = 0; assert((mark & _mark) == 0); nfq_set_verdict_mark(qh, id, NF_REPEAT, htonl(_mark | mark), rlen, rdata); } else nfq_set_verdict(qh, id, NF_ACCEPT, rlen, rdata); break; case DIVERT_DROP: nfq_set_verdict(qh, id, NF_DROP, 0, NULL); break; default: printf("Unknown verdict %d\n", rc); abort(); } return 0; }
static int nfqueue_cb( struct nfq_q_handle *qh, struct nfgenmsg *nfmsg, struct nfq_data *nfa, void *data) { char *pkt; struct nfqnl_msg_packet_hdr *ph; ph = nfq_get_msg_packet_hdr(nfa); if ( ph ) { int id = 0, size = 0; id = ntohl(ph->packet_id); size = nfq_get_payload(nfa, &pkt); struct ip *iph = (struct ip *) pkt; int id_protocol = identify_ip_protocol(pkt); int dport = get_udp_dst_port(pkt); int x = sizeof (struct ip) + sizeof (struct udphdr); /* packets we are interested in are UDP multicast to 239.255.255.250:1900 * and start with a data string M-SEARCH */ if ( (dport == 1900) && (id_protocol == IPPROTO_UDP) && (ssdp.sin_addr.s_addr == iph->ip_dst.s_addr) ) { /* get the index that the packet came in on */ u_int32_t idx = nfq_get_indev(nfa); int i = 0; for ( ;i < n_nfqix ; i++) { if ( nfqix[i] == idx ) { struct udphdr *udp = (struct udphdr *) (pkt + sizeof(struct ip)); char *dd = pkt + x; struct sockaddr_in sendername; sendername.sin_family = AF_INET; sendername.sin_port = udp->source; sendername.sin_addr.s_addr = iph->ip_src.s_addr; /* printf("pkt found %s\n",dd);*/ ProcessSSDPData (sudp, dd, size - x, &sendername, (unsigned short) 5555); } } } nfq_set_verdict(qh, id, NF_ACCEPT, 0, NULL); } else { syslog(LOG_ERR,"nfq_get_msg_packet_hdr failed"); return 1; /* from nfqueue source: 0 = ok, >0 = soft error, <0 hard error */ } return 0; }