// main routine public override PacketMainReturn interiorMain(ref Packet in_packet) { // if the packet is ICMPv4 if (in_packet.GetHighestLayer() == Protocol.ICMP) { ICMPPacket packet = (ICMPPacket)in_packet; // check if the packet is allowed and deny all is false if (isAllowed(packet.Type.ToString(), packet.Code.ToString(), 4) && !data.DenyIPv4) { return null; } // else, log and drop it else { PacketMainReturn pmr; pmr = new PacketMainReturn(this); pmr.returnType = PacketMainReturnType.Drop; if (data.Log) { pmr.returnType |= PacketMainReturnType.Log; pmr.logMessage = "ICMP from " + packet.SourceIP.ToString() + " for " + packet.DestIP.ToString() + " was dropped."; } return pmr; } } // if the packet is ICMPv6 if (in_packet.GetHighestLayer() == Protocol.ICMPv6) { ICMPv6Packet packet = (ICMPv6Packet)in_packet; if ((isAllowed(packet.Type.ToString(), packet.Code.ToString(), 6) && !data.DenyIPv6) && isDeniedNDP(packet)) { return null; } else { PacketMainReturn pmr; pmr = new PacketMainReturn(this); pmr.returnType = PacketMainReturnType.Drop; if (data.Log) { pmr.returnType |= PacketMainReturnType.Log; pmr.logMessage = "ICMPv6 from " + packet.SourceIP.ToString() + " for " + packet.DestIP.ToString() + " was dropped."; } return pmr; } } return null; }
public override PacketMainReturn interiorMain(ref Packet in_packet) { // let the packet through PacketMainReturn pmr = new PacketMainReturn(MODULE_NAME); pmr.returnType = PacketMainReturnType.Allow; try { // get a usable form of the packet Protocol highestLayer = in_packet.GetHighestLayer(); string type = ""; bool outbound = false; uint length = 0; string ip = ""; switch (highestLayer) { case Protocol.TCP: TCPPacket tcpPacket = (TCPPacket)in_packet; type = TCP; outbound = tcpPacket.Outbound; length = tcpPacket.Length(); ip = outbound ? tcpPacket.DestIP.ToString() : tcpPacket.SourceIP.ToString(); break; case Protocol.UDP: UDPPacket udpPacket = (UDPPacket)in_packet; type = UDP; length = udpPacket.Length(); ip = outbound ? udpPacket.DestIP.ToString() : udpPacket.SourceIP.ToString(); break; case Protocol.ARP: ARPPacket arpPacket = (ARPPacket)in_packet; type = ARP; outbound = arpPacket.Outbound; length = arpPacket.Length(); ip = outbound ? arpPacket.ATargetIP.ToString() : arpPacket.ASenderIP.ToString(); break; case Protocol.DHCP: // no packet structure for this type break; case Protocol.DNS: DNSPacket dnsPacket = (DNSPacket)in_packet; type = DNS; outbound = dnsPacket.Outbound; length = dnsPacket.Length(); ip = outbound ? dnsPacket.DestIP.ToString() : dnsPacket.SourceIP.ToString(); break; case Protocol.EEth: EETHPacket eethPacket = (EETHPacket)in_packet; type = EETH; outbound = eethPacket.Outbound; length = eethPacket.Length(); ip = NO_IP; break; case Protocol.Ethernet: EthPacket ethPacket = (EthPacket)in_packet; type = ETHERNET; outbound = ethPacket.Outbound; length = ethPacket.Length(); ip = NO_IP; break; case Protocol.ICMP: ICMPPacket icmpPacket = (ICMPPacket)in_packet; type = ICMP; outbound = icmpPacket.Outbound; length = icmpPacket.Length(); ip = ip = outbound ? icmpPacket.DestIP.ToString() : icmpPacket.SourceIP.ToString(); break; case Protocol.ICMPv6: ICMPv6Packet icmpv6Packet = (ICMPv6Packet)in_packet; type = ICMPV6; outbound = icmpv6Packet.Outbound; length = icmpv6Packet.Length(); ip = outbound ? icmpv6Packet.DestIP.ToString() : icmpv6Packet.SourceIP.ToString(); break; case Protocol.IP: IPPacket ipPacket = (IPPacket)in_packet; type = IP; outbound = ipPacket.Outbound; length = ipPacket.Length(); ip = outbound ? ipPacket.DestIP.ToString() : ipPacket.SourceIP.ToString(); break; case Protocol.SNMP: // no packet structure available for this type break; default: break; } if (type != "") { bufferStatement("insert into connection_log values (" + (outbound ? DIRECTION_OUTBOUND : DIRECTION_INBOUND) + "," + DateTime.Now.Ticks + ",'" + ip + "'," + length + ",'" + type + "')"); // using Length here... // should TotalLength be used instead? } } catch (Exception e) { PassThru.LogCenter.Instance.Push(MODULE_NAME, e.Message); } return pmr; }
public override PacketMainReturn interiorMain(ref Packet in_packet) { if (in_packet.GetHighestLayer() == Protocol.ARP) { ARPPacket arpp = (ARPPacket)in_packet; if (arpp.isRequest && arpp.Outbound) { int ip = arpp.ATargetIP.GetHashCode(); if (!requestedIPs.Contains(ip)) requestedIPs.Add(ip); } else if (!arpp.Outbound) { int ip = arpp.ASenderIP.GetHashCode(); if (!arpp.isRequest) { if (requestedIPs.Contains(ip)) { lock (padlock) { if (data.arpCache.ContainsKey(arpp.ASenderIP)) { if (!Compare(data.arpCache[arpp.ASenderIP], arpp.ASenderMac)) { PacketMainReturn pmr = new PacketMainReturn(this); if (data.RectifyAttacks) pmr.returnType = PacketMainReturnType.Edited; else pmr.returnType = PacketMainReturnType.Drop; if (data.LogAttacks) pmr.returnType |= PacketMainReturnType.Log | PacketMainReturnType.Popup; switch (LanguageConfig.GetCurrentLanguage()) { case LanguageConfig.Language.NONE: case LanguageConfig.Language.ENGLISH: pmr.logMessage = "ARP Response from " + new PhysicalAddress(arpp.ASenderMac).ToString() + " for " + arpp.ASenderIP.ToString() + " does not match the ARP cache."; break; case LanguageConfig.Language.CHINESE: pmr.logMessage = new PhysicalAddress(arpp.ASenderMac).ToString() + "为" + arpp.ASenderIP.ToString() + "的ARP响应不匹配的ARP缓存。"; break; case LanguageConfig.Language.GERMAN: pmr.logMessage = "ARP Response von " + new PhysicalAddress(arpp.ASenderMac).ToString() + " für " + arpp.ASenderIP.ToString() + " nicht mit dem ARP-Cache."; break; case LanguageConfig.Language.RUSSIAN: pmr.logMessage = "ARP-ответ от " + new PhysicalAddress(arpp.ASenderMac).ToString() + " для " + arpp.ASenderIP.ToString() + " не соответствует кэш ARP."; break; case LanguageConfig.Language.SPANISH: pmr.logMessage = "Respuesta de ARP de " + new PhysicalAddress(arpp.ASenderMac).ToString() + " para " + arpp.ASenderIP.ToString() + " no coincide con la caché ARP."; break; case LanguageConfig.Language.PORTUGUESE: pmr.logMessage = "Resposta da ARP " + new PhysicalAddress(arpp.ASenderMac).ToString() + " para " + arpp.ASenderIP.ToString() + " não coincide com o cache ARP."; break; } if (data.RectifyAttacks) { arpp.ATargetIP = arpp.ASenderIP; arpp.ATargetMac = data.arpCache[arpp.ATargetIP]; arpp.ASenderMac = adapter.InterfaceInformation.GetPhysicalAddress().GetAddressBytes(); arpp.FromMac = arpp.ASenderMac; arpp.ToMac = arpp.ATargetMac; foreach (UnicastIPAddressInformation ipv4 in adapter.InterfaceInformation.GetIPProperties().UnicastAddresses) { if (ipv4.Address.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork) { arpp.ASenderIP = ipv4.Address; break; } } arpp.Outbound = true; in_packet = arpp; } return pmr; } else { requestedIPs.Remove(ip); } } else { data.arpCache[arpp.ASenderIP] = arpp.ASenderMac; if (UpdatedArpCache != null) UpdatedArpCache(); requestedIPs.Remove(ip); } } } else { lock (padlock) { if (data.arpCache.ContainsKey(arpp.ASenderIP)) { if (!Compare(data.arpCache[arpp.ASenderIP], arpp.ASenderMac)) { PacketMainReturn pmra = new PacketMainReturn(this); if (data.RectifyAttacks) pmra.returnType = PacketMainReturnType.Edited; else pmra.returnType = PacketMainReturnType.Drop | PacketMainReturnType.Popup; switch (LanguageConfig.GetCurrentLanguage()) { case LanguageConfig.Language.NONE: case LanguageConfig.Language.ENGLISH: pmra.logMessage = "ARP Response from " + new PhysicalAddress(arpp.ASenderMac).ToString() + " for " + arpp.ASenderIP.ToString() + " does not match the ARP cache."; break; case LanguageConfig.Language.CHINESE: pmra.logMessage = new PhysicalAddress(arpp.ASenderMac).ToString() + "为" + arpp.ASenderIP.ToString() + "的ARP响应不匹配的ARP缓存。"; break; case LanguageConfig.Language.GERMAN: pmra.logMessage = "ARP Response von " + new PhysicalAddress(arpp.ASenderMac).ToString() + " für " + arpp.ASenderIP.ToString() + " nicht mit dem ARP-Cache."; break; case LanguageConfig.Language.RUSSIAN: pmra.logMessage = "ARP-ответ от " + new PhysicalAddress(arpp.ASenderMac).ToString() + " для " + arpp.ASenderIP.ToString() + " не соответствует кэш ARP."; break; case LanguageConfig.Language.SPANISH: pmra.logMessage = "Respuesta de ARP de " + new PhysicalAddress(arpp.ASenderMac).ToString() + " para " + arpp.ASenderIP.ToString() + " no coincide con la caché ARP."; break; case LanguageConfig.Language.PORTUGUESE: pmra.logMessage = "Resposta da ARP " + new PhysicalAddress(arpp.ASenderMac).ToString() + " para " + arpp.ASenderIP.ToString() + " não coincide com o cache ARP."; break; } if (data.RectifyAttacks) { arpp.ATargetIP = arpp.ASenderIP; arpp.ATargetMac = data.arpCache[arpp.ATargetIP]; arpp.ASenderMac = adapter.InterfaceInformation.GetPhysicalAddress().GetAddressBytes(); arpp.FromMac = arpp.ASenderMac; arpp.ToMac = arpp.ATargetMac; foreach (UnicastIPAddressInformation ipv4 in adapter.InterfaceInformation.GetIPProperties().UnicastAddresses) { if (ipv4.Address.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork) { arpp.ASenderIP = ipv4.Address; break; } } arpp.Outbound = true; in_packet = arpp; } return pmra; } } } PacketMainReturn pmr = new PacketMainReturn(this); pmr.returnType = PacketMainReturnType.Drop; if (data.LogUnsolic) pmr.returnType |= PacketMainReturnType.Log; switch (LanguageConfig.GetCurrentLanguage()) { case LanguageConfig.Language.NONE: case LanguageConfig.Language.ENGLISH: pmr.logMessage = "Unsolicited ARP Response from " + new PhysicalAddress(arpp.ASenderMac).ToString() + " for " + arpp.ASenderIP.ToString(); break; case LanguageConfig.Language.CHINESE: pmr.logMessage = "未经请求的ARP应答为" + arpp.ASenderIP.ToString() + "从" + new PhysicalAddress(arpp.ASenderMac).ToString(); break; case LanguageConfig.Language.GERMAN: pmr.logMessage = "Initiativbewerbung ARP Response von " + new PhysicalAddress(arpp.ASenderMac).ToString() + " für " + arpp.ASenderIP.ToString(); break; case LanguageConfig.Language.RUSSIAN: pmr.logMessage = "Незапрошенные ответ ARP от " + new PhysicalAddress(arpp.ASenderMac).ToString() + " для " + arpp.ASenderIP.ToString(); break; case LanguageConfig.Language.SPANISH: pmr.logMessage = "Respuesta ARP no solicitados de " + new PhysicalAddress(arpp.ASenderMac).ToString() + " para " + arpp.ASenderIP.ToString(); break; case LanguageConfig.Language.PORTUGUESE: pmr.logMessage = "Resposta ARP não solicitadas a partir de " + new PhysicalAddress(arpp.ASenderMac).ToString() + " para " + arpp.ASenderIP.ToString(); break; } return pmr; } } else { lock (padlock) { if (data.arpCache.ContainsKey(arpp.ASenderIP)) { if (!Compare(data.arpCache[arpp.ASenderIP], arpp.ASenderMac)) { PacketMainReturn pmr = new PacketMainReturn(this); pmr.returnType = PacketMainReturnType.Drop; if (data.LogAttacks) pmr.returnType |= PacketMainReturnType.Log | PacketMainReturnType.Popup; switch (LanguageConfig.GetCurrentLanguage()) { case LanguageConfig.Language.NONE: case LanguageConfig.Language.ENGLISH: pmr.logMessage = "ARP Response from " + new PhysicalAddress(arpp.ASenderMac).ToString() + " for " + arpp.ASenderIP.ToString() + " does not match the ARP cache."; break; case LanguageConfig.Language.CHINESE: pmr.logMessage = new PhysicalAddress(arpp.ASenderMac).ToString() + "为" + arpp.ASenderIP.ToString() + "的ARP响应不匹配的ARP缓存。"; break; case LanguageConfig.Language.GERMAN: pmr.logMessage = "ARP Response von " + new PhysicalAddress(arpp.ASenderMac).ToString() + " für " + arpp.ASenderIP.ToString() + " nicht mit dem ARP-Cache."; break; case LanguageConfig.Language.RUSSIAN: pmr.logMessage = "ARP-ответ от " + new PhysicalAddress(arpp.ASenderMac).ToString() + " для " + arpp.ASenderIP.ToString() + " не соответствует кэш ARP."; break; case LanguageConfig.Language.SPANISH: pmr.logMessage = "Respuesta de ARP de " + new PhysicalAddress(arpp.ASenderMac).ToString() + " para " + arpp.ASenderIP.ToString() + " no coincide con la caché ARP."; break; case LanguageConfig.Language.PORTUGUESE: pmr.logMessage = "Resposta da ARP " + new PhysicalAddress(arpp.ASenderMac).ToString() + " para " + arpp.ASenderIP.ToString() + " não coincide com o cache ARP."; break; } return pmr; } } } } return null; } return null; } return null; }
// main routine public override PacketMainReturn interiorMain(ref Packet in_packet) { PacketMainReturn pmr; // check it the packet is, or contains, IP if (in_packet.ContainsLayer(Protocol.IP)) { // create a temp IPPacket obj and // check the IP address IPPacket temp = (IPPacket)in_packet; if (!(isIPAllowed(temp.SourceIP))) { pmr = new PacketMainReturn(this); pmr.returnType = PacketMainReturnType.Drop; return pmr; } } // simple sanity check to dump the ipcache if it gets too large. // this does not effect the blockcache of banned IPs if ((ipcache.Count) > 200) ipcache.Clear(); // TCP incoming packets if (in_packet.GetHighestLayer() == Protocol.TCP) { TCPPacket packet = ((TCPPacket)in_packet); packet.PacketTime = DateTime.UtcNow; // if it's inbound and the SYN flag is set if (!packet.Outbound && packet.SYN && !packet.ACK) { // first packet init if (TCPprevious_packet == null) TCPprevious_packet = packet; // if the IP hasn't been logged yet if (!(ipcache.ContainsKey(packet.SourceIP))) ipcache.Add(packet.SourceIP, 1); // if the ipcache contains the ip else if (ipcache.ContainsKey(packet.SourceIP)) { // increment the packet count if they're coming in fast if ((packet.PacketTime - TCPprevious_packet.PacketTime).TotalMilliseconds <= data.dos_threshold) ipcache[packet.SourceIP] = (ipcache[packet.SourceIP]) + 1; else ipcache[packet.SourceIP] = 1; // check if this packet = previous, if the packet count is > 50, // and if the time between sent packets is less than the threshhold if (packet.SourceIP.Equals(TCPprevious_packet.SourceIP) && ((ipcache[packet.SourceIP]) > 50) && (packet.PacketTime - TCPprevious_packet.PacketTime).TotalMilliseconds <= data.dos_threshold) { pmr = new PacketMainReturn(this); pmr.returnType = PacketMainReturnType.Drop | PacketMainReturnType.Log | PacketMainReturnType.Popup; pmr.logMessage = "DoS attempt detected from IP " + packet.SourceIP + " (likely spoofed). " + " Packets from this IP will be dropped. You can unblock this IP from the module interface."; data.BlockCache.Add(new BlockedIP(packet.SourceIP, DateTime.UtcNow, "DoS Attempt")); return pmr; } } TCPprevious_packet = packet; } } // fraggle attack mitigation if (in_packet.GetHighestLayer() == Protocol.UDP) { UDPPacket packet = ((UDPPacket)in_packet); packet.PacketTime = DateTime.UtcNow; // if it's inbound if (!(packet.Outbound)) { // add IP to cache or increment packet count if (!(ipcache.ContainsKey(packet.SourceIP))) ipcache.Add(packet.SourceIP, 1); else ipcache[packet.SourceIP] = (ipcache[packet.SourceIP]) + 1; // if the packet header is empty, headed towards port (7,13,19,17), and count > 50, // then it's probably a fraggle attack if (packet.isEmpty() && packet.DestPort.Equals(7) || packet.DestPort.Equals(13) || packet.DestPort.Equals(19) || packet.DestPort.Equals(17) && (ipcache[packet.SourceIP]) > 50) { pmr = new PacketMainReturn(this); pmr.returnType = PacketMainReturnType.Drop | PacketMainReturnType.Log | PacketMainReturnType.Popup; pmr.logMessage = "Potential fraggle attack from " + packet.SourceIP + " (likely spoofed). " + " Packets from this IP will be dropped. You can unblock this IP from the module interface."; data.BlockCache.Add(new BlockedIP(packet.SourceIP, DateTime.UtcNow, "Fraggle Attempt")); return pmr; } } } // smurf attack mitigation if (in_packet.GetHighestLayer() == Protocol.ICMP) { ICMPPacket packet = ((ICMPPacket)in_packet); packet.PacketTime = DateTime.UtcNow; if (!(packet.Outbound)) { // init the previous packet if (ICMPprevious_packet == null) ICMPprevious_packet = packet; // add IP to cache or increment packet count if (!(ipcache.ContainsKey(packet.SourceIP))) ipcache.Add(packet.SourceIP, 1); // if the packet is >= threshold after the previous and it's the same packet, clear up the cache else if ((packet.PacketTime.Millisecond - ICMPprevious_packet.PacketTime.Millisecond) >= data.dos_threshold && packet.Equals(ICMPprevious_packet)) ipcache[packet.SourceIP] = 1; // if the packet is coming in quickly, add it to the packet count else if ((packet.PacketTime.Millisecond - ICMPprevious_packet.PacketTime.Millisecond) <= data.dos_threshold) ipcache[packet.SourceIP] = (ipcache[packet.SourceIP]) + 1; // if the packet is an echo reply and the IP source // is the same as localhost and the time between packets is <= threshhold and // there are over 50 accumulated packets, it's probably a smurf attack if (packet.Type.ToString().Equals("0") && packet.Code.ToString().Equals("0") && packet.SourceIP.Equals(getLocalIP()) && (packet.PacketTime.Millisecond - ICMPprevious_packet.PacketTime.Millisecond) <= data.dos_threshold && ipcache[packet.SourceIP] > 50) { pmr = new PacketMainReturn(this); pmr.returnType = PacketMainReturnType.Drop | PacketMainReturnType.Log | PacketMainReturnType.Popup; pmr.logMessage = "Potential Smurf attack from " + packet.SourceIP + " (likely spoofed). " + " Packets from this IP will be dropped. You can unblock this IP from the module interface."; data.BlockCache.Add(new BlockedIP(packet.SourceIP, DateTime.UtcNow, "Smurf Attempt")); return pmr; } ICMPprevious_packet = packet; } } return null; }