Changeset 1183

Timestamp:

08/04/08 08:35:33 (1 year ago)

Author:

mbr

Message:

applied fwknop-1.9.6-no-NetPacket?.patch from Mirek

Files:

• fwknop/branches/fwknop-redhat-integration/fwknopd (modified) (9 diffs)

fwknop/branches/fwknop-redhat-integration/fwknopd

@@ -46 +46 @@
-use Net::IPv4Addr qw(ipv4_in_network);
-use Net::Pcap;
-use NetPacket::IP;
-use NetPacket::UDP;
-use NetPacket::TCP;
-use NetPacket::ICMP;
-use NetPacket::Ethernet;
-use IO::Socket;
-use IO::Handle;
@@ -393 +388 @@
-    my $src_ip     = '';
-    my $proto      = '';
-obj
+data
-
-    if ($debug) {
@@ -421 +416 @@
-    if ($config{'AUTH_MODE'} eq 'ULOG_PCAP') {
-        ### The ulogd pcap writer does not include link layer information
-NetPacket::IP->
+&ip_
-    } else {
-        if ($config{'FIREWALL_TYPE'} eq 'ipfw' and $cmdline_intf eq 'lo0') {
@@ -429 +424 @@
-            $pkt =~ s/^.{4}// if $pkt =~ /^[^\x45].{3}\x45/;
-
-NetPacket::IP->
+&ip_
-        } else {
-            if ($PCAP_COOKED_INTF) {
-                $ether_data = unpack("x[16]a*", $pkt);
-            } else {
-NetPacket::Ethernet::
-
-NetPacket::IP->
+&ethernet_
+
+&ip_
-        }
-    }
@@ -447 +442 @@
-
-    if ($proto == 1) {
-obj = NetPacket::ICMP->decode
+data = &icmp_decode_data
-    } elsif ($proto == 6) {
-obj = NetPacket::TCP->decode
+data = &tcp_decode_data
-    } elsif ($proto == 17) {
-obj = NetPacket::UDP->decode
+data = &udp_decode_data
-    } else {
-        return;
@@ -459 +454 @@
-    ### any valid SPA message will be longer than 10 bytes, but this
-    ### check is better than nothing
-unless defined $transport_obj->{'data'}
+if $transport_data eq ""
-
-    my $enc_msg_len = 0;
-obj->{'data'}
+data
-    if (10 < $enc_msg_len and $enc_msg_len < 1500) {
-        print STDERR localtime() . " [+] Data len: $enc_msg_len bytes\n"
@@ -474 +469 @@
-    if ($debug) {
-        ### make sure not to print non-printable stuff
-obj->{'data'}
+data
-        $data_tmp =~ s/[^\x20-\x7e]/NA/g;
-        print STDERR localtime() .
@@ -483 +478 @@
-            print STDERR localtime() .
-                "     Raw packet data (hex dump, minus packet headers):\n";
-obj->{'data'}
+data
-        }
-    }
@@ -489 +484 @@
-    ### see if this packet is worthy of being granted access through
-    ### the firewall
-obj->{'data'}
+data
-
-    &collect_warn_die_msgs();
-
-    return;
+}
+
+sub ethernet_strip() {
+    my $pkt = shift;
+
+    ### Silently return '' for short frames
+    return substr($pkt, 14);
+}
+
+sub ip_addr_bytes_to_string() {
+    my $bytes = shift;
+
+    my ($a, $b, $c, $d) = unpack('C[4]', $bytes);
+    return "$a.$b.$c.$d";
+}
+
+sub ip_decode() {
+    my $pkt = shift;
+
+    my $ip = {};
+    (my $ver_ihl, $ip->{'tos'}, $ip->{'len'}, $ip->{'id'}, my $flags_frag,
+     $ip->{'ttl'}, $ip->{'proto'}, $ip->{'cksum'}, my $src_ip, my $dest_ip)
+        = unpack("CCnnnCCna[4]a[4]", $pkt);
+    $ip->{'ver'} = $ver_ihl >> 4;
+    $ip->{'hlen'} = $ver_ihl & 0x0F;
+    $ip->{'flags'} = $flags_frag >> 13;
+    $ip->{'foffset'} = ($flags_frag & 0x1FFF) * 8;
+    $ip->{'src_ip'} = &ip_addr_bytes_to_string($src_ip);
+    $ip->{'dest_ip'} = &ip_addr_bytes_to_string($dest_ip);
+    my $data_start = $ip->{'hlen'} * 4;
+    if ($data_start < 20) {
+        $data_start = 20;
+    }
+    $ip->{'data'} = substr($pkt, $data_start);
+    return $ip;
+}
+
+sub icmp_decode_data() {
+    my $icmp = shift;
+
+    ### Silently return '' for short packets
+    return substr($icmp, 4);
+}
+
+sub tcp_decode_data() {
+    my $tcp = shift;
+
+    ### Silently return '' for short packets
+    if (length($tcp) < 20) {
+        return '';
+    }
+    my $data_start = 4 * (ord(substr($tcp, 12, 1)) >> 4);
+    if ($data_start < 20) {
+        $data_start = 20;
+    }
+    return substr($tcp, $data_start);
+}
+
+sub udp_decode_data() {
+    my $udp = shift;
+
+    ### Silently return '' for short packets
+    return substr($udp, 8);
-}
-