sniffjoke-0.4.1+git20170825.1.434bfb1/AUTHORS0000644000000000000000000000172013147777044014321 0ustar00vecna pub 1024D/C6765430 2009-08-25 [expires: 2011-08-25] Key fingerprint = 341F 1A8C E2B4 F4F4 174D 7C21 B842 093D C676 5430 uid vecna uid vecna sub 3072g/E8157737 2009-08-25 [expires: 2011-08-25] ---------------------------------------------------------------------------- evilaliv3 sub 4096g/50A7F150 2009-05-10 [expires: 2014-05-09] ---------------------------------------------------------------------------- PROJECT MAIN PAGE (how to develop a plugin plugin, how does sniffjoke work, why it exists) http://www.delirandom.net/sniffjoke GITHUB: http://github.com/vecna/sniffjoke http://github.com/evilaliv3/sniffjoke sniffjoke-0.4.1+git20170825.1.434bfb1/CMakeLists.txt0000644000000000000000000000264013147777044016013 0ustar00CMAKE_MINIMUM_REQUIRED( VERSION 2.4 ) PROJECT( sniffjoke ) SET( PREFIX "/usr/local" ) SET( VERSION_MAJOR 0 ) SET( VERSION_MINOR 4 ) SET( SUFFIX "-1" ) SET(CMAKE_SHARED_LIBRARY_PREFIX "") # SET(CMAKE_CXX_FLAGS "-g3 -O3 -ansi -pedantic -Wall -Wno-variadic-macros ${CMAKE_CXX_FLAGS}") SET(CMAKE_CXX_FLAGS "-O3 -ansi -pedantic -Wall -Wno-variadic-macros ${CMAKE_CXX_FLAGS}") INCLUDE_DIRECTORIES( src src/service ) ADD_SUBDIRECTORY( src ) ADD_SUBDIRECTORY( conf ) if( MANDIR ) set( PATH_MAN ${MANDIR} ) else( MANDIR ) find_path( PATH_MAN NAMES "man" PATHS ${SEARCH_SYS} NO_DEFAULT_PATH ) if( PATH_MAN ) set( PATH_MAN "${PATH_MAN}/man/man1" ) else( PATH_MAN ) set( PATH_MAN "${CMAKE_INSTALL_PREFIX}/share/man/man1" ) endif( PATH_MAN ) endif( MANDIR ) INSTALL(FILES doc/sniffjoke.1 doc/sniffjokectl.1 doc/sniffjoke-autotest.1 DESTINATION ${PATH_MAN} PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) # uninstall target as officially explained on: # - http://www.youtube.com/watch?v=fw-nJRD78tA # - http://www.cmake.org/Wiki/CMake_FAQ#Can_I_do_.22make_uninstall.22_with_CMake.3F CONFIGURE_FILE( "${CMAKE_CURRENT_SOURCE_DIR}/cmake_uninstall.cmake.in" "${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake" IMMEDIATE @ONLY ) ADD_CUSTOM_TARGET( uninstall COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake ) # end of uninstall target sniffjoke-0.4.1+git20170825.1.434bfb1/COPYING0000644000000000000000000010451313147777044014310 0ustar00 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: Copyright (C) This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an "about box". You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read . sniffjoke-0.4.1+git20170825.1.434bfb1/ChangeLog0000644000000000000000000000501213147777044015021 0ustar0005 Jul 2011: published 0.4.2 - 'generic/' working again as default - no more hardcoded path - gentoo package, fixed warnings by 'QA' - support of --gw-mac-addr to avoid some distros issue with arp and parsing 22 May 2011: published 0.4.1 - gpg verified autotest files - documented autotest operations - bug fixed discovered in 0.4 rel 07 May 2011: Stabilized -rc1 - UserConf and NetIO command changed - sniffjoke-iptcpopt postponed to -rc2 - added manpage and docs update 28 Apr 2011: Implementation of sniffjoke-iptcpopt, beta6 - HDRoptions.cc singleton, good working 20 Apr 2011: Betatesting continue, (beta5!?) - HDRoptions_probe will check option on the route - IPTCPOptions use an efficent implementation for every location - how ironic: in the 30/12/2010 was "stabilized" :P 1 Apr 2011: Release 0.4 under betatesting - options testable in different environments - new hacks, scramble implemented - renew of TCPTrack.cc class - client/service are two separate software with an internal protocol 30 Dec 2010: Stabilized 0.4 release - sniffjoke-autotest generate the location file - plugin configuration 20 Nov 2010: In those months, when I and evilalv3 forget the ChangeLog... - the hacks are supported in external plugin(s) - the scrambling tech is became three - the TTL will be refreshed and cached - the entire Sniffjoke logic has been optimized - the entire Sniffjoke OOP has been reenginereed - the hack/scrambling tech are more configurable by options 1 Sep 2010: In those months, when I and evilaliv3 forgotten to update the changelog, a lot of bugs have been solved. - best class splitting in sniffjoke, more c++ compliant - usage of lists and queue - removed WebIO.cc and the swill library - supported unix socket communication and adminstration - locking, privileges downgrade and chroot - in short, when bugfix is complete this will be the 0.4, at the moment, this is the 0.4 alpha 2 release. 15 Apr 2009: patch swill_file("images/visualroute.gif", 0); by dezperado adding xplico proof 8 Apr 2009: patch by packz for supporting different path for swill library 1 Feb 2009: stabilization of 0.3 release, lack of: port configuration, statistics hack selection hack analysis 8 Jan 2009: fixed 0.3-beta to 0.3-beta-2 fixed includes, warnings, bugs 1 Jan 2009: stabilization of SniffJoke 0.3 beta release Features available: swill web interface, standard hacks (ttl, bad checksum, innocent) TCP port not available autodetect in Linux system sniffjoke-0.4.1+git20170825.1.434bfb1/NEWS0000755000000000000000000000000013147777044015513 2ChangeLogustar00sniffjoke-0.4.1+git20170825.1.434bfb1/README0000755000000000000000000000000013147777044015401 2README.mdustar00sniffjoke-0.4.1+git20170825.1.434bfb1/README.md0000644000000000000000000001100713147777044014527 0ustar00# This project is abandonware # SniffJoke: transparent TCP connection scrambler 0.4.1 SniffJoke is an application for Linux that handle transparently your TCP connection, delaying, modifyng and inject fake packets inside your transmission, make them almost impossible to be correctly readed by a passive wiretapping technology (IDS or sniffer) # Requirements cmake, gcc, iptables, tcpdump Suggested gnupg # How to compile/install mkdir build cd build cmake .. make sudo -s make install and you could check the exactly installed file by cat install_manifest.txt # Suggested setup, for configure your network capabilities sniffjoke-autotest -l name_of_your_location since you have ran the "autotest" in this network location (office, home, lab, etc...) you will invoke sniffjoke with: sniffjoke --location name_of_your_location sniffjokectl --stat sniffjokectl --start sniffjokectl --help [...] # Link and info **The domain name delirandom.org is expired, use the same link in archive.org ** SniffJoke man page: http://www.delirandom.net/sniffjoke/ SniffJoke location requirement: http://www.delirandom.net/sniffjoke/sniffjoke-locations SniffJoke concepts, goals: http://www.delirandom.net/sniffjoke/sniffjoke-how-does-work # CONFIG FILES installed in the 'generic' location ipblacklist.conf iptcp-options.conf ipwhitelist.conf plugins-enabled.conf port-aggressivity.conf sniffjoke-service.conf # CACHE and LOGs that should be generated in a location plugin.fake_close_fin.log plugin.fragmentation.log plugin.segmentation.log ttlfocusmap.bin # CONFIG FILES generated as location specific by sniffjoke-autotest iptcp-options.conf plugins-enabled.conf # Requirements Linux OS (>=2.6.19) with tun support; wifi/eth as default gateway (no other interface supported). ## Installed files The service binary /usr/local/bin/sniffjoke The client, required to manage remotely the configuration of Sj /usr/local/bin/sniffjokectl The "generic location" configuration, containing every default configuration files /usr/local/var/sniffjoke/generic/ SniffJoke plugins: /usr/local/lib/sniffjoke/*.so Scripts: /usr/local/bin/sniffjoke-autotest /usr/local/bin/sj-iptcpopt-probe /usr/local/bin/sj-commit-results Sniffjoke Man pages /usr/local/man/man1/sniffjoke.1 /usr/local/man/man1/sniffjokectl.1 /usr/local/man/man1/sniffjoke-autotest.1 # External service Sniffjoke in autotesting required to contact http://www.delirandom.net/sjA, this is not striclty required and if an user want to perform himself the test, will install the "pe.php" script, present in this package here conf/sjA/pe.php and using the semi-secret options -s and -a in sniffjoke-autotest (you will avoid every contact w/ delirandom) # Official sniffjoke page (expired domain, use archive.org) http://www.delirandom.net/sniffjoke (old) academic researchs: http://www.delirandom.net/sniffjoke/Insertion%20Evasion%20and%20denial%20of%20service%20on%20IDS.pdf Hacker's old bread: http://www.phrack.org/issues.html?issue=54&id=10#article MacOSx 0.3 ports as kernel module: http://en.roolz.org/trafscrambler.html Wireshark thread about Sj 0.3: http://www.mail-archive.com/wireshark-dev@wireshark.org/msg13465.html # Italian music support http://www.youtube.com/watch?v=y2pZ8C7ODSs Uochi Toki - Il ladro http://www.youtube.com/watch?v=T1-3q-vFsBY Uochi Toki - L'estetica # GPG public keys X-2:~ X$ gpg --keyserver pgp.mit.edu --recv-key C6765430 X-2:~ X$ gpg --fingerprint C6765430 pub 1024D/C6765430 2009-08-25 [expires: 2011-08-25] Key fingerprint = 341F 1A8C E2B4 F4F4 174D 7C21 B842 093D C676 5430 uid vecna uid vecna sub 3072g/E8157737 2009-08-25 [expires: 2011-08-25] X-2:~ X$ gpg --keyserver pgp.mit.edu --recv-key D9A950DE X-2:~ X$ gpg --fingerprint D9A950DE pub 1024D/D9A950DE 2009-05-10 [expires: 2014-05-09] Key fingerprint = C1ED 5C8F DB6A 1C74 A807 5695 91EC 9BB8 D9A9 50DE uid Giovanni Pellerano sub 4096g/50A7F150 2009-05-10 [expires: 2014-05-09] X-2:~ X$ gpg --keyserver pgp.mit.edu --recv-key 7D9E677D X-2:~ X$ gpg --fingerprint 7D9E677D pub 1024D/7D9E677D 2011-05-21 Key fingerprint = F37C 2042 5052 27E2 2FD7 D511 947F 574B 7D9E 677D uid SniffJoke project (http://www.delirandom.net/sniffjoke) sniffjoke-0.4.1+git20170825.1.434bfb1/cmake_uninstall.cmake.in0000644000000000000000000000164313147777044020035 0ustar00IF (NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") MESSAGE(FATAL_ERROR "Cannot find install manifest: \"@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt\"") ENDIF(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") FILE(READ "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt" files) STRING(REGEX REPLACE "\n" ";" files "${files}") FOREACH (file ${files}) IF (EXISTS "$ENV{DESTDIR}${file}") EXECUTE_PROCESS( COMMAND @CMAKE_COMMAND@ -E remove "$ENV{DESTDIR}${file}" OUTPUT_VARIABLE rm_out RESULT_VARIABLE rm_retval ) IF(NOT ${rm_retval} EQUAL 0) MESSAGE(FATAL_ERROR "Problem when removing \"$ENV{DESTDIR}${file}\"") ENDIF (NOT ${rm_retval} EQUAL 0) ELSE (EXISTS "$ENV{DESTDIR}${file}") MESSAGE(STATUS "File \"$ENV{DESTDIR}${file}\" does not exist.") ENDIF (EXISTS "$ENV{DESTDIR}${file}") ENDFOREACH(file) sniffjoke-0.4.1+git20170825.1.434bfb1/conf/0000755000000000000000000000000013147777044014176 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/doc/0000755000000000000000000000000013147777044014016 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/src/0000755000000000000000000000000013147777044014040 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/conf/CMakeLists.txt0000644000000000000000000000011513147777044016733 0ustar00INSTALL(DIRECTORY generic DESTINATION ${CMAKE_INSTALL_PREFIX}/var/sniffjoke) sniffjoke-0.4.1+git20170825.1.434bfb1/conf/PACKAGE_MANTAINER0000644000000000000000000000346213147777044016557 0ustar00This is a document written for the package mantainer The SniffJoke 0.4.x is intended only for Linux, and the package mantainer have some operations to check. As first: I will notice every package mantainer with a signed mail, when a new stable release of sniffjoke has been uploaded in the site. Git release must not be intended as stable, almost until we don't split the two branches in 'devel' and 'master' TROUBLE+POSSIBLE BUGS WHILE COMPILING: Warnings because the option implement virtual classes has not destructor (under CentOS causes a verbose shit) If you are running centos QA, tell to us eventually warnings TROUBLE+POSSIBLE BUGS WHILE INSTALLING: The usage of different paths, unability to call the three executables, not indexed man pages sniffjoke-autotest use 'locate' inside, for found some relevant directory, if you want to avoid, you should set the variable LOCSDIR= by hand, at the start of the script TROUBLE+POSSIBLE BUGS WHILE RUNNING AUTOTEST: Immediate exiting after the test of segmentation,INNOCENT (try the same command line with --foreground option, and check the exception raised) network error: unability to contact delirandom.net (check if you can, with curl, reach the links hardcoded in sniffjoke-autotest) TROUBLE+POSSIBLE BUGS WHILE SJ IS RUNNING: SniffJoke is broking all session (try to use --location 'generic', now run in limitated but stable supports) SniffJoke crashes (use --debug 6 --foreground and check when the service is quitting) TROUBLE+POSSIBLE BUGS WITH THE SJ CLIENT: Check if your architecture is little or big endian (this will be a serious hardcoded bug by us!) Check if the client connection is working with telnet (because you should have incidentally some firewall rules) sniffjoke-0.4.1+git20170825.1.434bfb1/conf/README-about-conf0000755000000000000000000000000013147777044023676 2../doc/config-location.txtustar00sniffjoke-0.4.1+git20170825.1.434bfb1/conf/generic/0000755000000000000000000000000013147777044015612 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/conf/sjA/0000755000000000000000000000000013147777044014713 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/conf/generic/THIS_IS_GENERIC0000644000000000000000000000000013147777044020021 0ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/conf/generic/ipblacklist.conf.example0000644000000000000000000000123113147777044022411 0ustar00# IP blacklist # will be enabled using the option --blacklist in the sniffjoke command line # or using the directive "blacklist" inside the sniffjoke-service.conf # configuration file. # # the IP address here are the ONLY IP addresses actively AVOIDED to be # hacked by sniffjoke whenever blacklist is enabled # www.phrack.org 120.138.19.103 123,100,444 # hackitoergosum.org 173.236.241.194 200,200,200 # olografix.org 195.32.69.44 4343,4242,4141 # note - not used at the moment: # tecnically this white/black list supports also three 32-bit option # www.evilaliv3.org 94.23.192.28 666,777,888 # and every time an IP address is add, the new options are refreshed sniffjoke-0.4.1+git20170825.1.434bfb1/conf/generic/iptcp-options.conf0000644000000000000000000000375313147777044021301 0ustar00# this is the options file description, THIS IS NOT A CONfIGURATION fILE # THAT MUST/SHOULD/WOULD BE USED IN A STABLE WAY. # # THIS BARELY SUPPORT, IN fACT, IP/TCP OPTIONS HACKING BECAUSE IS USED ONLY # DURING THE TEST1 Of "sniffjoke-autotest" # # # the value after the comma, it is a value taken from IPTCPopt.h, and have these meanings: # # CORRUPTUNASSIGNED = 0, NOT_CORRUPT = 1, ONESHOT = 2, TWOSHOT = 4, BOTH = 8, TRACK_ONLY = 16 # # [but, BOTH is never used], # # IP NOP, IP TIMESTAMP and TCP TIMESTAMP as "not corrupt", default: "oneshot" 0,1 1,2 2,1 3,2 4,2 5,2 6,2 7,2 8,2 9,2 10,2 11,2 12,2 13,2 # TCP TIMESTAMP follow: 14,1 15,2 16,2 17,2 18,2 # finished the dummy iptcp-options.conf # P.S. changing the ORDER of the number before, or the values, # will cause sniffjoke reject to start. # ## --- This is the list of the option associated # # configured option #0 IPOPT_NOOP as: [notcorrupt] ENABLED # configured option #1 IPOPT_EOL as: [oneshot] ENABLED # configured option #2 IPOPT_TIMESTAMP as: [notcorrupt] ENABLED # configured option #3 IPOPT_DUMMY (timestamp overflow) as: [notcorrupt] ENABLED # configured option #4 IPOPT_LSRR as: [notcorrupt] ENABLED # configured option #5 IPOPT_RR as: [notcorrupt] ENABLED # configured option #6 IPOPT_RA as: [notcorrupt] ENABLED # configured option #7 IPOPT_CIPSO as: [notcorrupt] ENABLED # configured option #8 IPOPT_SEC as: [notcorrupt] ENABLED # configured option #9 IPOPT_SID as: [notcorrupt] ENABLED # configured option #10 TCPOPT_NOP as: [notcorrupt] ENABLED # configured option #11 TCPOPT_EOL as: [notcorrupt] ENABLED # configured option #12 TCPOPT_MD5SIG as: [notcorrupt] ENABLED # configured option #13 TCPOPT_DUMMY (PAWS) as: [notcorrupt] ENABLED # configured option #14 TCPOPT_TIMESTAMP as: [notcorrupt] ENABLED # configured option #15 TCPOPT_MAXSEG as: [oneshot] ENABLED # configured option #16 TCPOPT_SACK as: [oneshot] ENABLED # configured option #17 TCPOPT_SACK_PERMITTED as: [oneshot] ENABLED # configured option #18 TCPOPT_WINDOW as: [oneshot] ENABLED # sniffjoke-0.4.1+git20170825.1.434bfb1/conf/generic/ipwhitelist.conf.example0000644000000000000000000000137513147777044022466 0ustar00# IP whitelist # will be enabled using the option --blacklist in the sniffjoke command line # or using the directive "blacklist" inside the sniffjoke-service.conf # configuration file. # # the IP address here are the ONLY IP addresses actively hacked by sniffjoke # whenever whitelist is enabled # www.punto-informatico.it 62.85.163.47 1,2,3 # www.canemucca.com 62.149.130.186 0,0,1 # www.saltonelcrudo.it 194.185.49.18 444,333,222 # encyclopediadramatica.com 208.100.46.116 1,1,1 # zrtp.org 80.92.66.14 2,2,2 # delirandom.net, useful in testing with: # # GENERATEDDATA=`seq 1 1500 | tr -d [:cntrl:] | sed -e's/6/111/g'` # curl -s --retry 0 --max-time 10 -d "sparedata=$GENERATEDDATA" -o /tmp/recv_DATA http://www.delirandom.net/sjA/pe.php 89.186.95.190 sniffjoke-0.4.1+git20170825.1.434bfb1/conf/generic/plugins-enabled.conf0000644000000000000000000000212013147777044021525 0ustar00# THIS IS THE DEFAULT sniffjoke enabler FILE # USE THIS ONLY IF sniffjoke-autotest IS NOT WORKING! # # -- the other enabler file are generated by sniffjoke-autotest # # this file related documentation: # http://www.delirandom.net/sniffjoke/plugins-development # http://www.delirandom.net/sniffjoke/sniffjoke-locations # # plugin_name,SCRAMBLESUPPORTED1,SCRAMBLESUPPORTED2 # parsing don't support SPACE BEFORE OR AFTER THE COMMA # # fake_close_fin,PRESCRIPTION,GUILTY # fake_close_rst,PRESCRIPTION,MALFORMED,GUILTY # fake_close with RESET is disabled because some middlething close the session. # I've disable because require to be verify by autotest: some NAT device will # otherwise kill your session. fake_data,PRESCRIPTION,GUILTY fake_seq,PRESCRIPTION,GUILTY # fake_syn,PRESCRIPTION,MALFORMED,GUILTY # fake_zero_window,INNOCENT fragmentation,INNOCENT segmentation,INNOCENT shift_ack,PRESCRIPTION,GUILTY # for the same reason of some NAT device, this option will not be included in this # generic location. # valid_rst_fake_seq,INNOCENT # # MALFORMED scramble has been disabled in the default sniffjoke-0.4.1+git20170825.1.434bfb1/conf/generic/port-aggressivity.conf0000644000000000000000000000424113147777044022164 0ustar00# this is the default port-aggressivity.conf, configuration file of sniffjoke # 0.4, written by vecna 27/Jan/2011, and contains come easy explanation about # the configurability of sniffjoke. # # the generated file have not all this information and you need to take a look # in this default file in order to customize your location files # # the keyword defining the FREQUENCY are: # # NONE .................. never used the hack (0% probability) # VERYRARE .............. 5% # RARE .................. 15% # COMMON ................ 40% # HEAVY ................. 75% # ALWAYS ................ 100% # PEEK10PKT ............. packer number 9, 10, 11 = 80%, other 2% # PEEK30PKT ............. packet number 29, 30, 31, = 90%, other 2% # EVERY5SECONDS ......... if the number of seconds are divisibile by 5= 90% # other moments, 2% # EVERY20SECONDS ........ if the number of seconds are divisibile by 20= 90% # other moment, 2% # PEEKATSTART ........... the first 20 packets = 65%, up to the 40th= 20%, after 2% # LONGPEEK .............. the first 60 pkts = 65%, up to the 120th= 20%, after 2% # # and should be mixed together using the "," # ^^^^^^^^^^^^^^^^^^^^^^^^ # this is always on the top of the port definition file, act as default 0:65535 RARE # follow the port rules 22 NONE # common unencrypted mail 25,110,143 LONGPEEK # Intensive in the web, if you note malfunfction, switch from "HEAVY" to "NORMAL" 80,8080,3128 PEEKATSTART # Windows service 135:139 PEEK10PKT # SQL.mysql 156,3306 LONGPEEK # https, I wander if this will help in iran tor dropping # https://blog.torproject.org/blog/update-internet-censorship-iran 443,8443 PEEKATSTART # ftp 21,20 PEEK10PKT # sip 5060 EVERY5SECONDS # telnet 23 ALWAYS # irc 6667,7000 ALWAYS # IM (yahoo, a-talk, ICQ+AOL, XMPP client, XMPP server), MSN 5050,5106,5190,5222,5269,6901 ALWAYS # RDP, VNC, X 3389,3899,5500,5800,6000 LONGPEEK # edonkey 4662 VERYRARE,EVERY20SECONDS # bittorrent 6881:6900 VERYRARE,EVERY20SECONDS 6902:6968 VERYRARE,EVERY20SECONDS 2710 VERYRARE,EVERY20SECONDS sniffjoke-0.4.1+git20170825.1.434bfb1/conf/generic/sniffjoke-service.conf0000644000000000000000000000167513147777044022106 0ustar00# default SniffJoke configuration file # # in fact is more or less the same of the default # but I prefer use a file to copy, because if I was # a sniffjoke user, I want a file to mod as start # and as a sniffjoke user, I use immediatly "active" # anyway I understand some user prefer start by hand #active # I usually, for debugging reason, use the command line --start # this is for who make test, enabling whitelist file: #whitelist # will use the file ipwhitelist.conf # uncommand the keyword #blacklist # will use the file ipblacklist.conf # keep foreground commented, use --foreground the few time # you need to debug with/in sniffjoke #foreground user nobody group nogroup management-address 127.0.0.1 debug 2 max-ttl-probe 30 # If you're editing your configuration file, you will # be interested in checking the official site: # http://www.delirandom.net/sniffjoke and checking # if some update, plugins or whatsoever has been # published sniffjoke-0.4.1+git20170825.1.434bfb1/conf/sjA/README.txt0000644000000000000000000000051313147777044016410 0ustar00sniffjoke-autotest support two "semi-secret" options, -s and -a -s http://yourserver.tld/pe.php Your HTTP connection where reach pe.php, in this directory included -a xx.yy.nn.kk Yout HTTP server IP ADDRESS doing this, you will be able to autotest your location without use the delirandom.net single point of failure. sniffjoke-0.4.1+git20170825.1.434bfb1/conf/sjA/pe.php0000644000000000000000000000050313147777044016026 0ustar00 sniffjoke-0.4.1+git20170825.1.434bfb1/doc/SJ-PROTOCOL.txt0000644000000000000000000000742313147777044016340 0ustar00 RFCSJ001 STATUS: INCOMPLETE IT022011 ANTANI SNIFFJOKE INTERNAL MANAGEMENT PROTOCOL (SIMP ?) Sniffjoke service is listening in UDP, waiting for a TEXTUAL COMMAND, followed optionally by a binary options for every command sent, an operation in sniffjoke is performed, and a binary answer is sent via UDP to the client. this is not an RFC-like document, is a documented series of C structures used for data exchange. SENT DATA: a variable string in an UDP packet, that will contain the following value to be accepted by the service: start start the mangling + return updated "stat" stop stop the mangling + return updated "stat" quit stop and close the sniffjoke service + return "stat" before close saveconf dump the current configuration stat get statistics about sniffjoke service process and configuration info get the list of the established session, injected packets count ttlmap get the list of the tracerouted host and the retrivered info showports get the list of the destination port/configuration debug [0:6] change the current debug value to the selected debug level (0 to 6) + return the updated "stat" RECEIVED DATA: the file containing the settings is: src/service/internalProtocol.h #define START_COMMAND_TYPE 1 #define STOP_COMMAND_TYPE 2 #define QUIT_COMMAND_TYPE 3 #define SAVECONF_COMMAND_TYPE 4 #define STAT_COMMAND_TYPE 5 #define LOGLEVEL_COMMAND_TYPE 6 #define SETPORT_COMMAND_TYPE 7 #define SHOWPORT_COMMAND_TYPE 8 #define INFO_COMMAND_TYPE 9 #define TTLMAP_COMMAND_TYPE 10 every command is stored in a command struct named "command_ret": struct command_ret { uint32_t cmd_len; uint32_t cmd_type; }; the cmd_type has one of the *_COMMAND_TYPE value, the cmd_len contains the entire lenght of the packet. the return type will be of few type: stat, ttl mapping, port configuration, session list. the STAT block: after the command_ret there are a lists of "single_block" structures: struct single_block { uint32_t len; uint32_t WHO; }; #define STAT_ACTIVE 1 #define STAT_DEBUGL 2 #define STAT_LOCAT 3 #define STAT_MACGW 4 #define STAT_GWADDR 5 #define STAT_IFACE 6 #define STAT_LOIP 7 #define STAT_TUNN 8 #define STAT_BINDA 9 #define STAT_BINDP 10 #define STAT_USER 11 #define STAT_GROUP 12 #define STAT_CHAINING 13 #define STAT_NO_TCP 14 #define STAT_NO_UDP 15 #define STAT_WHITELIST 16 #define STAT_BLACKLIST 17 #define STAT_ONLYP 18 after every single block structured there are the data described by "WHO", WHO take the value of the previously defined STAT_* the SHOWPORT return: struct port_info { uint16_t start; uint16_t end; uint16_t weight; } weight is the or-value containing the different strength values of injection applied to the range of port from "start" to "end". there are a list of there structured until all ports range are reported. the SESSION list: struct sex_record { uint8_t proto; uint32_t daddr; uint16_t sport; uint16_t dport; uint32_t packet_number; uint32_t injected_pktnumber; } every session is described in a list of "sex_record" until all are reported. struct ttl_record { time_t access; time_t nextprobe; uint32_t daddr; uint8_t sentprobe; uint8_t receivedprobe; uint8_t synackval; uint8_t ttlestimate; } rvery host tracked is described in a list of "ttl_record" until all are reported. sniffjoke-0.4.1+git20170825.1.434bfb1/doc/TODO.txt0000644000000000000000000000266613147777044015336 0ustar00TODO list for SniffJoke 0.5 SERVICE . testing IP options over different target OS . implement passive OS fingerprint with p0f in SessionTrack . verify gateway usage, implement ip source selection . accept whitelist/blacklist as configuration by client . implement server side support and port listening protection . NetIO.cc and UserConf.cc need to became an extension of a generic superclass to supports different OS easily. CLIENT . make a C#/Windows porting for sniffjokecli . develop a better protocol instead of SJ-PROTOCOL.txt based on C struct . make a firefox button in order to add in the whitelist the sites in use PLUGINS . layer 5 malformation, will support: - expansion of fake_data in order to inject layer 5 acceptable data and not simply random - expand fake data with a template model, in order to exploit fault in layer 5 sniffer flow reassembler BUGS - HEADER OPTIONS The main problems in IP/TCP options handling is: - you need to probe each of them for every destination, like ttlbruteforce does - you need a incominfilter like the plugins, for understood if a packet is generate by an options error and thus need to be stripped off - is needed a condition too, because in IP header options is not a problem use/abuse but in the TCP, the flags and the connection status *does matter*, and a condition() became required. - this will be solved developing the Scramble classes sniffjoke-0.4.1+git20170825.1.434bfb1/doc/config-location.txt0000644000000000000000000002046713147777044017643 0ustar00The directory 'generic/' contains the default configuration settings: SHOULD BE USED... ... ... BUT IS NOT SUGGESTED! it's copied in {INSTALL_PREFIX}/var/sniffjoke/ this directory will contain the "location" directories The concept of location stands for a network place where you use sniffjoke; sniffjoke can configure and optimize itself for every location separately and and the generic will work instead for the most of the time. * WHAT IS sniffjoke-autotest ? It's a script performing some sniffjoke tests and verifications to detect which kind of attack can be used in your network; this is the help: usage: {INSTALL_PREFIX}/bin/sniffjoke-autotest options This script runs plugins test along different destinations OS to determinate the selection of plugins and options that correctly works in the current location. Every workplace (office, home, freewifi) you use, neet to be setup as location. Having a location correctly configurated IS THE ONLY WAY to have SniffJoke working; technical details will be found in: http://www.delirandom.net/sniffjoke/sniffjoke-locations OPTIONS: -h show this message -l location name (required) -n number of replicas to be passed for the single hack (default 1) -g specify the group to privilege downgrade (default: nogroup) -u specify the user to privilege downgrade (default: nobody) it's required a LOCATION name, eg: office, home, nickhome, starbucks... sniffjoke-autotest will generate the best plugins-enabled.conf usable in this environment at the end of the tests (that include continuos restarting of sniffjoke with different options) will be created a new directory describing your location. after you will customize the options * WHY sniffjoke-autotest EXISTS ? The problem solved by the autotest suite arise because not every kind of evasion technology can work in every network. The script takes as argument the location name, creates the new directory /usr/local/var/sniffjoke/$NEWLOCATION and prepares all the related configuration files inside. When you need to use a specific locaton, you have to run sniffjoke with --location $LOCATIONNAME and the related directory will be used for the chroot; from that time on sniffjoke will use that directory as storage dir for logs and caches. * WHAT THE MEANING OF EVERY SINGLE CONFIG FILE ? *** plugins-enabled.conf It contains the list of the plugins to be used in your sniffjoke service. The plugins are the shared object contained in src/plugins and installed in /usr/local/lib/sniffjoke/*.so The configuration file contains these information: # comment plugin_name,SCRAMBLETECHSUPPORTED1,SCRAMBLETECHSUPPORTED2,... The plugin_name is exposed without path and intended to be found in the /usr/local/lib/sniffjoke directory. the scramble technology are separated by a comma and without whitespace, where the accepted scramble values are: PRESCRIPTION this the scramble technology that decreases the TTL in the packet causing to expire before reaching the remote host INNOCENT is a valid packet injected inside the stream MALFORMED is a packet with rfc-valid but incoherent for the usage in relation with the connection state of IP and TCP options or other malformation based on IP/TCP options header. GUILTY packet with bad checksum, discarded by the remote host but accepted by the sniffer (used as last resort is the less useful scramble but useful in the sniffjoke logic) *** sniffjoke-service.conf It does contain the same options that will be passed by command line: active will be present or not present, and is used if sniffjoke must start active in hijacking/injection or start and silently make mitm in the network without packet injection and session tracking default: not present user specify the username to use for the privileges downgrade after the chroot default: nobody suggested: it's suggested to a packet maintainer to create a sniffjoke user group the same as for user default: nogroup suggested: it's suggested to a packet maintainer to create a sniffjoke group management-address is the ip address where sniffjoke will bind the administrative socket, it's a required configuration parameter if you plan to use sniffjoke in a gateway and you want to manage the service by a different host default: 127.0.0.1 management-port the UDP port for the administrative traffic default: 8844 note: the two management info, need to be passed in the sniffjokectl (the client managing sniffjoke service) to the command line. debug the verbosity level used by sniffjoke: 0: suppress log, 1: common, 2: verbose, 3: debug, 4: session 5: packets 0: suppress log, no one line are provided 1: common, startup info and error reporting, generated the file sniffjoke.log inside the choosed location. 2: verbose, description and check of I/O operation, use sniffjoke.log only too 3: debug, intensive and complete I/O description, in sniffjoke.log always 4: session, creation of sniffjoke.log.session and session debug 5: packets, creation of sniffjoke.log.packet and debug of every packet default: 1 foreground it's an optional parameter used to make the sniffjoke service run in foreground default: no *** ipblacklist.conf the file contains a list of ip address, written without every other information, and whenever the blacklist is set in sniffjoke, the connection destinated to a matching IP address will work untouched by sniffjoke *** ipwhitelist.conf this is the same of blacklist, but you specify the only ip address that will be hacked. *** port-aggressivity.conf this is how the default and simplest section appears: # this is always on the top of the port definition file, act as default 1:65535 NORMAL # follow the port rules 22 RARE 23,25,110 COMMON 80,8080 PEEKATSTART,EVERY5SECONDS 6667,7000 ALWAYS you need to select the destination TCP ports, use as separator "," or ":" with the "," you should address the single port and with the ":" a range. Those value are called "Frequencies" and describe the frequency of the injection. related to the kind of session (IRC is really different, from sensibility of the data, amount of bytes and number of packets, from HTTP and peer2peer), those value should be mixed together, using the "," # # NONE .................. never used the hack (0% probability) # VERYRARE .............. 5% # RARE .................. 15% # COMMON ................ 40% # HEAVY ................. 75% # ALWAYS ................ 100% # PEEK10PKT ............. packer number 9, 10, 11 = 80%, other 2% # PEEK30PKT ............. packet number 29, 30, 31, = 90%, other 2% # EVERY5SECONDS ......... if the number of seconds are divisible by 5= 90% # other moments, 2% # EVERY20SECONDS ........ if the number of seconds are divisible by 20= 90% # other moment, 2% # PEEKATSTART ........... the first 20 packets = 65%, up to the 40th= 20%, after 2% # LONGPEEK .............. the first 60 pkts = 65%, up to the 120th= 20%, after 2% Is a matter of percentage. if you don't know what you do, it's suggested to use the default. if you instead find out a better default configuration please contact us commenting/sending it. At the time olny few TCP ports are configured. The Frequency and the Probability are the variables causing SniffJoke to be aggressive. How an user will manage those variables ? FACTS about injection: 1) A single injected packet will broke the reassembly applyed by a sniffer, for this reason is not required injection a large amount of packet (will result a bandwidth loss). 2) sniffer/IDS making patter detection (string comparison, heuristic analysis, etc...) will make this detection also without having the correctly rassembled stream (fake_data.so prevent from this) 3) Every sniffjoke injected packet will happen and will not, because the SniffJoke strength is based on the randomness. A non random patter will be detected and managed, a random one, will not. port-aggressivity has a strong influence about the injection happening, and the coder of the plugin too. The ALWAYS is used when the non-documentation option --only-plugin is called, an option used for testing a single hack+scramble combination, used in sniffjoke-autotest sniffjoke-0.4.1+git20170825.1.434bfb1/doc/generic-infos-README.txt0000644000000000000000000000736213147777044020252 0ustar00SniffJoke 0.4.1 developed by vecna and evilaliv3 homepage: http://www.delirandom.net/sniffjoke code repositories: http://github.com/vecna/sniffjoke http://github.com/evilaliv3/sniffjoke HEADLINE: This software is a single peer sniffer obfuscator. when you start SniffJoke from your network privileges, the outgoing internet connections became scattered with fake data - without interfere with your sessions - and confusing the sniffers in the network when their algorithms try to follow your stream. REMIND: 1) SniffJoke obfuscates the passive data collection: a man in the middle using a passive software like wireshark, dsniff, xplico, carnivore, ecc... ... so DOES NOT PROTECT about the data you, willing or not, send to evil third party, like a phisher, facebook or a proxy service. 2) SniffJoke does not guarantee a protection from an uber network expert that collects your data BY HANDS (if you know what's a tcp reconstruction flow, you will figure that is less expensive, for your enemy, to buy a whore payed for drug you), SniffJoke if effective defense from a massive data collection, a threat well solved by cryptography but the lack of security culture in "the others" require some single peer solution. SniffJoke is a free software, implemented in C++, and at the moment supports only under Linux environment. Will be easy make the OSX+BSD mods, will became in short. Some dumps from the site: http://www.deliandom.net/sniffjoke What's SniffJoke ? An internet client running SniffJoke injects in the transmission flow some packets able to seriously disturb passive analysis like sniffing, interception and low level information theft. No server supports needed! Why is this possible ? The internet protocols have been developed to allow two elements to communicate, not some third-parts to intercept their communication. This will happen, but the communication system has been not developed with this objective. SniffJoke uses the network protocol in a permitted way, exploiting the implicit difference of network stack present in an operating system respect the sniffers dissector. Why has it been developed ? Because too many people believe that the only way to obtain self-security is through control, I don't want to tell them they are wrong, but controlling internet is impossibile, if you want not to be controlled. It is obvious that you should not trust a security control that could be bypassed, isn't it? When you understand this, remember that the progressive acceptance of the control measure has been treated like a "necessary sacrifice". when you realize that this security method don't bring security, but only possibile abuses, you will be ready to stop accepting this useless sacrifice. What's SniffJoke don't protect from If you are using a nontrusted third part (facebook?) it doesn't matter how much your data is encrypted, scrambled or whatever: your data is in facebook store. Unprotected and presented. If you use a trojanized box, it's the same, it's like have an invisible and weightless watchers sit on your legs, transcribing everything you're doing. SniffJoke protects from: a sniffer in your network, a sniffer in the provider flow, a sniffer in the destination network. Security and social GOALs Various goals SniffJoke aim to achieves. Information security, will not be control based, almost, not in traffic and data passive analysis, because Internet technology is not engineered with this capability. Passive wiretapping is not only used by law enforcement (they have a lot of other technology in their dispositions); Wiretapping technology is widespread and usable by every entities, not for your safety, but for the value derived from your data. homepage updated 22/05/2011 sniffjoke-0.4.1+git20170825.1.434bfb1/doc/networking.txt0000644000000000000000000000606013147777044016750 0ustar00NETWORKING.txt SniffJoke 0.4.1 USAGE OF THE LOCAL FIREWALL RULE Here is explained how an outgoing packet lives with or without sniffjoke: Without SniffJoke: Application -> socket() -> kernel TCP stack -> IPTCP packet to your gateway -> hops (sniffer! :) -> destination. With SniffJoke: Application -> socket() -> kernel TCP stack -> IPTCP packet to your gateway that is a VPN endpoint handled by -> SniffJoke -> mangling & hacking -> gateway -> hops -> destination. What about the return ? Without SniffJoke: destination sent the answer IPTCP packet -> hops -> your gateway -> you box -> kernel TCP strack -> connect()/recv() -> application. With SniffJoke: destination sent the answer IPTCP packet -> hops -> your gateway -> the packet is read by sniffjoke AND by your box. (but your box have a firewall rule able to block the packets from your gateway mac address). SniffJoke sent the packet locally and becaming from a different interface is not blocked by the firewall. In this way, SniffJoke is able to modify th -> you box -> kernel TCP strack -> connect()/recv() -> application. NETWORKING DUMPS STATUS: from ifconfig, when sniffjoke is runnig, you should see: sniffjoke Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:172.16.1.3 P-t-P:1.198.10.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1420 Metric:1 RX packets:11 errors:0 dropped:0 overruns:0 frame:0 TX packets:3 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:500 RX bytes:841 (841.0 B) TX bytes:411 (411.0 B) from "route -n": Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.254.254.254 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 1.198.10.5 0.0.0.0 255.255.255.255 UH 0 0 0 sniffjoke 10.10.100.1 10.10.100.5 255.255.255.255 UGH 0 0 0 tun1 10.10.100.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun1 10.10.101.0 10.10.100.5 255.255.255.0 UG 0 0 0 tun1 172.16.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0 0.0.0.0 1.198.10.5 0.0.0.0 UG 0 0 0 sniffjoke tun1, tun0, eth0 are mine, but sniffjoke is added when the software is running, and became default gateway iptables -L, show the rule add from source mac address (all these status are restored when sniffjoke quits) Chain INPUT (policy ACCEPT) target prot opt source destination DROP all -- anywhere anywhere MAC 0X:1X:EX:9X:X9:0X via netstat -nap, you should see the administration port: udp 0 0 127.0.0.1:8844 0.0.0.0:* 16705/sniffjoke Triva, Italian language only: http://www.youtube.com/watch?v=vTbcos3MqrY Pino-holyshit!-Scotto & Caparezza !? sniffjoke-0.4.1+git20170825.1.434bfb1/doc/sniffjoke-autotest.10000644000000000000000000000475213147777044017734 0ustar00.TH sniffjoke-autotest 1 .PP .SH NAME Sniffjoke Autotest Suite 0.4.2 usage .PP .SH SYNOPSIS sniffjoke-autotest [OPTION]... .PP .SH DESCRIPTION This script runs plugins test along different destinations OS to determinate the selection of plugins that correctly works in the current location. .PP it's required a LOCATION name, eg: office, home, nickhome, starbucks... .PP sniffjoke-autotest will generate the best plugins_enabled.conf usable in this environment at the end of the tests (that include continuos restarting of sniffjoke with different options) will be created a new directory describing your location. after you will customize the options .PP sniffjoke-autotest verify every IP/TCP options implemented in sniffjoke, checking if your ISP filter them or not. Is generated iptcp-options.conf containing these information. .PP The options usefull when sniffjoke is started (by hand or by init script) .PP .SH SNIFFJOKE-AUTOTEST OPTIONS .PP .B -h show a command line options resume .PP .B -l accept a name for the currently profiling environment [required] .PP .B -n set the number of test replicas [default: 1] .PP .PP .SH "ERRORS, BUGS, ISSUE" Sometime sniffjoke-autotest simply exit with the message: .B Something in the network is not going well, and will not be a SniffJoke fault I suggest to copy paste the previously executed sniffjoke command line, adding the option "--foreground" and see by hand which kind of exception is triggered. .PP .SH "DEPENDENCIES" pub 1024D/7D9E677D 2011-05-21 Key fingerprint = F37C 2042 5052 27E2 2FD7 D511 947F 574B 7D9E 677D uid SniffJoke project (http://www.delirandom.net/sniffjoke) sniffjoke-autotest reports some URLs, message and info retrivered from delirandom.net, in order to authenticate these message, in a shell script, is downloaded the public key of the project, because the communications will be accepted only if verified by GnuPG signature. Inside sniffjoke-autotest is hardcoded the fingerprint. .PP .SH "AUTHOR" Claudio Agosti , Giovanni Pellerano .PP .SH "REPORTING BUGS" Report bugs to . .SH "COPYRIGHT" Copyright (GPL) 2008,2009,2010,2011 Claudio Agosti & Giovanni Pellerano. .br This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. .SH "SEE ALSO" http://www.delirandom.net/sniffjoke .TP .I sniffjoke(1) sniffjoke-autotest(1) sniffjoke-0.4.1+git20170825.1.434bfb1/doc/sniffjoke.10000644000000000000000000000731513147777044016064 0ustar00.TH sniffjoke 1 .PP .SH NAME Sniffjoke 0.4.2 usage .PP .SH SYNOPSIS sniffjoke [OPTION]... .PP .SH DESCRIPTION This software is a single peer sniffer obfuscator. when you start SniffJoke from your network privileges, the outgoing internet connections became scattered with fake data - without interfere with your sessions - and confusing the sniffers in the network when their algorithms try to follow your stream. .PP The options usefull when sniffjoke is started (by hand or by init script) .PP .SH SNIFFJOKE OPTIONS .PP .B --location specify the network environment (suggested) [default: generic]. use the script "sniffjoke-autotest" for the generation of the correct environment. eg: in your office, in your home, for every friend where you connect your computer, you need a different 'location'. the first time you need to use sniffjoke from a location, you run the autotest and automatically are checked the different combinations of available plugins+scrambles. .PP .B --dir specify the base directory where the location resides [default: /usr/local/var/sniffjoke/] [using both location and dir defaults, the configuration status will not be saved] .PP .B --user downgrade priviledge to the specified user [default: nobody] .PP .B --gw-mac-addr specify the default gateway mac address. by default is not required, because SniffJoke use some auto detection commands in order to acquire the local network informations. In some distribution, a fatal exception is triggered when tried, in those case this option became mandatory for the correct execution of SniffJoke. .PP .B --group downgrade priviledge to the specified group [default: nogroup] .PP .B --whitelist inject evasion packets only in the specified ip addresses. blacklist and whitelist are mutually exclusive. .PP .B --blacklist inject evasion packet in all session excluding the blacklisted ip address. blacklist and whitelist are mutually exclusive. .PP .B --start if present, evasion is activated immediatly [default: not present], for start/stop/reconfigure sniffjoke while running, use sniffjokectl .PP .B --debug set up verbosity level [default: 2] 1: suppress log, 2: common, 3: verbose, 4: debug, 5: session 6: packets .PP .B --foreground execute sniffjoke with foreground logging [default:background] .PP .B --admin [:port] specify administration IP address [default: 127.0.0.1:8844] .PP .B --force force restart (usable when another sniffjoke service is running) .PP .B --version show sniffjoke version .PP .B --help show a command line options resume .PP .PP When sniffjoke is running, it keeps on memory the configuration settings and dump them in a binary file, sniffjoke run under chroot directory and inside that there are files usefull for sniffjoke and for the user. .PP .PP When sniffjoke is running, you should send commands using sniffjokect. .PP .SS SEMI-SECRET OPTION This semi-secret option is used in testing within sniffjoke-autotest .PP .B --only-plugin plugin_name.so,SINGLESCRAMBLEUSED .PP .PP .SS [*] DEFAULTS: The default values are hardcoded in the software, passed at compile time from the building script, maybe a distribution-specific package will contain different paths. .PP .SH "AUTHOR" Claudio Agosti , Giovanni Pellerano .PP .SH "REPORTING BUGS" Report bugs to . .SH "COPYRIGHT" Copyright (GPL) 2008,2009,2010,2011 Claudio Agosti & Giovanni Pellerano. .br This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. .SH "SEE ALSO" http://www.delirandom.net/sniffjoke .TP .I sniffjokectl(1) sniffjoke-autotest(1) sniffjoke-0.4.1+git20170825.1.434bfb1/doc/sniffjokectl.10000644000000000000000000000361513147777044016566 0ustar00.TH sniffjokectl 1 .PP .SH NAME Sniffjoke CTL 0.4.2 usage .PP .SH SYNOPSIS sniffjokectl [OPTION]... [COMMAND] .PP .SH DESCRIPTION sniffjokectl is the sniffjoke manager, controller, client, whaterver. .PP When sniffjoke is running, you should send commands as command line arguments .PP .SH SNIFFJOKECTL OPTIONS .PP .B --address [:port] specify administration IP address [default: 127.0.0.1:8844] .PP .B --version show sniffjoke version .PP .B --timeout set milliseconds timeout when contacting SniffJoke service [default: 500] .PP .B --help show this help .PP .SH SNIFFJOKECTL COMMANDS .PP .B start start sniffjoke hijacking/injection .PP .B stop stop sniffjoke (sniffjoke will work in passive mode, like in pause) .PP .B quit stop sniffjoke, save config, abort the service .PP .B saveconf dump config file .PP .B stat get statistics about sniffjoke configuration and network .PP .B info get massive info about sniffjoke internet stats .PP .B showport show TCP ports strongness of injection .PP .B debug [1-6] change the log debug level .PP .PP Those commands are used and accepted only when sniffjoke is running and the "client instance" is listening and reachable in the UDP port. .PP When you start sniffjoke you could set your port rules and save the configuration with saveconf. .PP When you than restart sniffjoke, using the same --chroot-dir, the previous configurations are reloaded. .PP .SH "AUTHOR" Claudio Agosti , Giovanni Pellerano .PP .SH "REPORTING BUGS" Report bugs to . .SH "COPYRIGHT" Copyright (GPL) 2008,2009,2010,2011 Claudio Agosti & Giovanni Pellerano. .br This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. .SH "SEE ALSO" http://www.delirandom.net/sniffjoke .TP .I sniffjoke(1) sniffjoke-autotest(1) sniffjoke-0.4.1+git20170825.1.434bfb1/doc/tcp-hacks-and-scrambling.txt0000644000000000000000000000704213147777044021316 0ustar00HACKS & SCAMBLE TECH THIS FILE IS NOT UPDATED WITH THE RELEASE 0.4 and THEREFORE WILL NOT BE SAFE READ IT! the hacks define type of injected packet in order to cause a desync in the sniffed flow, every hacks is implemented in a separate plugin, present in sniffjoke under the plugins/ directory vecna@caturday:~/Desktop/sniffjoke-project/sniffjoke/src$ ls plugins/*/*.cc plugins/fake_close_fin/fake_close_fin.cc plugins/fake_zero_window/fake_zero_window.cc plugins/fake_close_rst/fake_close_rst.cc plugins/fragmentation/fragmentation.cc plugins/fake_fragment/fake_fragment.cc plugins/overlap_packet/overlap_packet.cc plugins/fake_segment/fake_segment.cc plugins/segmentation/segmentation.cc plugins/fake_seq/fake_seq.cc plugins/shift_ack/shift_ack.cc plugins/fake_syn/fake_syn.cc plugins/valid_rst_fake_seq/valid_rst_fake_seq.cc close: hacks that inject a fake signaling that mean the end of the session, the flag RST or FIN is used. In some network, the flag RST cause the session kill in some useful third parts (like a transparent proxy), and you will try to disable this hacks in your hackfile [info at the end of this file]. fake data: hacks that inject block of data that will overwrite the real trasmitted data inside the reassembled flow fake seq: h.t.i a packet with a fake sequence number, wishing the sniffer belive to it and goes out of sequence fake zero window: a packet with a tcp window value set to 0 shift ack: acking of a different sequence number valid reset fake seq: a *valid* packet (because the other are fake, [below information about the scrambling tech]) with a valid RST and a sequence number shifted of tcp.window value (or 64k) anyway the kernel ignore them. SCRAMBLING TECHNOLOGY when send a fake packet, the packet must appear acceptable for the sniffer and unacceptable (or unaccepted) by the server, the technics are three at the moment: 1) fake checksum: tcp checksum is corrupted, if the sniffer don't check it, it record the packet as good and the server drop it 2) ttl expire: the packets has a TTL value forged to expire before reach the server. the sniffer record it and the server not 3) corrupted IP options: the IP header support some extension in the options field. some kernel support them and some other not. A packet with an unsupported option will be dropped by the kernel, and the sniffer read it. this technique is growing in detail, OS analysis and related studies. SELECT AND HACKS SniffJoke search in your location the plugins-enabled.conf file: # SniffJoke plugins enabler file # # comment supported # fake_close_fin.so,TYPEOFSCRAMBLESUPPORTED #fake_close_rst.so,TYPEOFSCRAMBLESUPPORTED fake_data.so,TYPEOFSCRAMBLESUPPORTED fake_seq.so,TYPEOFSCRAMBLESUPPORTED #fake_syn.so #fake_zero_window.so #shift_ack.so valid_rst_fake_seq.so,TYPEOFSCRAMBLESUPPORTED # regards this is the plugins-enabled.conf file inside the "generic" location, acting as default for the user who don't have run sniffjoke-autotest. the type of scramble depends on your network, because some type of combination (like, real RST injection that will expire before reach the remote server, will be interpreted by your NAT gateway closing your session.) for this reason is done the autotest: it test every combination of hack + scramble and save a related configuration for the network environment you're are using (office, home) this is a freaking free software: documents well is a matter of respect and I understand, but truly, is painful, I prefer coding. sniffjoke-0.4.1+git20170825.1.434bfb1/doc/usage.txt0000644000000000000000000001021013147777044015655 0ustar00 __ _________ _ _ _____ __ == Sniffjoke 0.4 usage == ____ ____ __ ____ __ ____ ___ _______ this file is more or less the manpage sniffjoke --help this command returns three pieces of information: the option usefull when sniffjoke is started (by hand or by init script) Usage: sniffjoke [OPTION]... : --location specify the network environment (suggested) [default: generic] --dir specify the base directory where the location reside [default: /usr/local/var/sniffjoke/] [using both location and dir defaults, the configuration status will not be saved] --user downgrade priviledge to the specified user [default: nobody] --group downgrade priviledge to the specified group [default: nogroup] --no-tcp disable tcp mangling [default: tcp mangled] --no-udp disable udp mangling [default: udp mangled] --whitelist inject evasion packets only in the specified ip addresses --blacklist inject evasion packet in all session excluding the blacklisted ip address --start if present, evasion i'ts activated immediatly [default: not present] --chain enable chained hacking, powerful and entropic effects [default: disabled] --debug set verbosity level [default: 2] 0: suppress log, 1: common, 2: verbose, 3: debug, 4: session 5: packets --foreground running in foreground [default:background] --admin [:port] specify administration IP address [default: 127.0.0.1:8844] --force force restart (usable when another sniffjoke service is running) --version show sniffjoke version --help show this help when sniffjoke is running keep on memory the configuration settings and dump them in a binary file, sniffjoke run under chroot directory and inside them there are files usefull for sniffjoke and for the user. sniffjokectl --help and this is the sniffjoke manage, controller, client, whatever: Usage: sniffjokectl [OPTIONS]... [COMMANDS]... --address [:port] specify administration IP address [default: 127.0.0.1:8844] --version show sniffjoke version --timeout set milliseconds timeout when contacting SniffJoke service [default: 500] --help show this help when sniffjoke is running, you should send commands with a command line argument: start start sniffjoke hijacking/injection stop pause sniffjoke quit quit sniffjoke saveconf dump configuration file stat get statistics about sniffjoke configuration and network info get statistics about sniffjoke active sessions ttlmap show the mapped hop count for destination showport show the running port-aggressivity configuration set start:end value set the injection's strogness over particular tcp/udp port typical values are: eg.: set 80 COMMON,PEAKATSTART set 22,1194 NONE clear alias to "set 1:65535 NONE" debug [0-5] change the log debug level those command are used and accepted only when sniffjoke is running and the "client instance" is listening and reachable in the UDP port. when you set your port rules, save the configuration with saveconf and continue to use sniffjoke. when you restart sniffjoke, using the same --chroot-dir, the previous configurations are reloaded. SEMI-SECRET OPTION IN sniffjoke --only-plugin plugin_name.so,SINGLESCRAMBLEUSED is used during testing within sniffjoke-autotest [*] DEFAULTS: the default values are hardcoded in the software, passed at compile time from the building script, maybe a distribution-specific package will contain different paths. sniffjoke-0.4.1+git20170825.1.434bfb1/src/CMakeLists.txt0000644000000000000000000000015013147777044016574 0ustar00ADD_SUBDIRECTORY(service) ADD_SUBDIRECTORY(client) ADD_SUBDIRECTORY(plugins) ADD_SUBDIRECTORY(autotest) sniffjoke-0.4.1+git20170825.1.434bfb1/src/README-src0000644000000000000000000000253313147777044015510 0ustar00/service: contains the main sources for the sniffjoke software /client: contains sources for a command line interface written to manage sniffjoke service; in doc/ you will find the file SJ-PROTOCOL.txt, ad document that describe the protocol used for service-client communication. if you want to write a QT or other cool-GUI sniffjoke manager, we are glad to import it. /plugins: sniffjoke is an "anti sniffing SDK" or a "framework for userspace connection mangling" and the plugins are in fact the funny little code able to crumble to dust the thousand-dollar IDS apparatus your boss has buyed. at the moment not documentation are provided, but if you are capable to develop a plugin, I'll suggest to read in this order: fake_close_rst (simple injection of a packet) fake_close_fin (usage of cache and logging) fake_data (generation of two packets) segmentation (packet removed and substituted) use a lot of tcpdump and let us know, we have some ideas to develop and few time. /autotest: scripts used during autotest analysis, sniffjoke-autotest check the plugins + scramble combinations, and sj-iptcpopt-probe check the IP/TCP options header supports provided by your ISP/gateway sniffjoke-0.4.1+git20170825.1.434bfb1/src/autotest/0000755000000000000000000000000013147777044015710 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/src/client/0000755000000000000000000000000013147777044015316 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/0000755000000000000000000000000013147777044015521 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/0000755000000000000000000000000013147777044015500 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/src/autotest/CMakeLists.txt0000644000000000000000000000106313147777044020450 0ustar00# this cause autotest to know exactly, like the compiled binary # through config.h, which are the configured path INSTALL(FILES sniffjoke-autotest DESTINATION ${CMAKE_INSTALL_PREFIX}/bin PERMISSIONS OWNER_EXECUTE OWNER_READ GROUP_READ WORLD_READ) INSTALL(FILES sj-iptcpopt-probe DESTINATION ${CMAKE_INSTALL_PREFIX}/bin PERMISSIONS OWNER_EXECUTE OWNER_READ GROUP_READ WORLD_READ) INSTALL(FILES sj-commit-results DESTINATION ${CMAKE_INSTALL_PREFIX}/bin PERMISSIONS OWNER_EXECUTE OWNER_READ GROUP_READ WORLD_READ) sniffjoke-0.4.1+git20170825.1.434bfb1/src/autotest/sj-commit-results0000755000000000000000000000325213147777044021241 0ustar00#!/bin/bash shopt -s expand_aliases alias echo="echo -e" red="\e[1;31m" green="\e[1;32m" yellow="\e[1;33m" blue="\e[1;34m" violet="\e[1;35m" white="\e[1;39m" VERSION="041" usage() { cat << EOF usage: $0 options This script is part of SniffJoke autotest USUALLY - an user has not any needings in use this script OPTIONS: -l target location to send remotely -u URL which commit to (both required) EOF } while getopts “hl:u:” OPTION do case $OPTION in h) usage tput sgr0; exit 1 ;; l) LOCATION=`echo $OPTARG | sed 's#/*$##'` #removing eventual(s) trailing slash ;; u) RESULTS=$OPTARG ;; ?) usage tput sgr0; exit 1 ;; esac done if [ -z "$LOCATION" ]; then echo "${red} -l is required, is the location name" tput sgr0; exit 1 fi if [ -z "$RESULTS" ]; then echo "${red} -u is required, specify where the results will be posted: remind http://www.delirandom.net/sjA/pr.php" tput sgr0; exit 1 fi dFname="/tmp/$LOCATION/sjAlogs-$LOCATION.tar.bz2" cd /tmp/$LOCATION echo "${green} sending of the file $dFname to $RESULTS" output_put="/tmp/$LOCATION/HTTP_put.out" curl -o $output_put -T $dFname "$RESULTS?v=$VERSION" if [ -e "$output_put" ]; then MESSAGE=`grep "MESSAGE=" $output_put | cut -b 9-` URL=`grep "URL=" $output_put | cut -b 5-` echo "${blue} message received from the server:" echo "* --------- ----- --- -- -" echo "${green}$MESSAGE" echo "${green}$URL" else echo "${red}Error in uploading: operation fail" fi # clearing gay colors tput sgr0 sniffjoke-0.4.1+git20170825.1.434bfb1/src/autotest/sj-iptcpopt-probe0000755000000000000000000003050513147777044021222 0ustar00#!/bin/bash shopt -s expand_aliases alias echo="echo -e" red="\e[1;31m" green="\e[1;32m" yellow="\e[1;33m" blue="\e[1;34m" violet="\e[1;35m" white="\e[1;39m" OPTNAME[0]="IP_NOOP" OPTNAME[1]="IP_EOL" OPTNAME[2]="IP_TIMESTAMP" OPTNAME[3]="IP_TOverflow" OPTNAME[4]="IP_LSRR" OPTNAME[5]="IP_RR" OPTNAME[6]="IP_RA" OPTNAME[7]="IP_CIPSO" OPTNAME[8]="IP_SEC" OPTNAME[9]="IP_SID" OPTNAME[10]="TCP_NOOP" OPTNAME[11]="TCP_EOL" OPTNAME[12]="TCP_MD5" # the other opts are not implemented, but supported for be tracked #default values VERSION="041" LOCATION= GENERIC= OPTIONSAMOUNT=18 REALIMPLEMENTED=10 USERNAME="nobody" GROUPNAME="nogroup" DONE=0 SERVER_IP= PCAPS="../../" SNIFFJOKEBIN=`which sniffjoke` CURLBIN=`which curl` SNIFFJOKECLIBIN=`which sniffjokectl` usage() { cat << EOF usage: $0 options This script is part of SniffJoke autotest This script is invoked by sniffjoke-autotest and try the possibile combination of IP/TCP header options for the testing 'location' Is required a detailed test because different ISP will handle differently these options, considering a packet acceptable or not by internal policy, router configuration and updating frequency by hand this script should accept these argument: OPTIONS: -h show this message -w working directory (required) (eg: /tmp/home/, where sniffjoke-autotest is running) -u testing URL (required) -n username to downgrade privileges -g group to downgrade privileges -i server IPv4 format 000.000.000.000 (required) EOF } start_option_test() { pushd `dirname $TOTEST` >/dev/null 2>&1 CMDPART=`basename $TOTEST` OPCODE=`cat $CMDPART | cut -d '+' -f 2` OPTINDEX=`echo $OPCODE | tr -d [:alpha:]` OPTION_NAME=${OPTNAME[$OPTINDEX]} echo "${green}* OPTIONS UNDER TEST (${yellow}$TOTEST${green}) ${white}[${red}$(($DONE + 1))${white}/${red}$(($REALIMPLEMENTED * 2))${white}]" echo "${blue}working dir\t${yellow}\t[$PWD]" echo "${blue}Option\t\t${yellow}\t[$OPCODE], [$OPTION_NAME]" if [ ! -z "$UGPD" ]; then echo "${blue}User Group\t${yellow}\t[$UGPD]" fi echo "${blue}Tested Option\t${yellow}\t[$CMDPART]${white}" # $SERVER is like http://www.delirandom.net/sjA/pe.php mkdir $OPTION_NAME && cd $OPTION_NAME # now setup a temporary location, with the essential things required during tests: echo "# this a temporary generated IP whitelist configuration by sj-iptcp-probe, part of sniffjoke-autotest" > ipwhitelist.conf echo "# tested URL $SERVER, cmd line section $CMDPART, user/group $UGPD" >> ipwhitelist.conf echo $SERVER_IP >> ipwhitelist.conf cp $WORKDIR/generic/sniffjoke-service.conf . cp $WORKDIR/firstsimple/ttlfocusmap.bin . # port-aggressivity.conf is not required # iptcp-options.conf is excluded because are in testing mode # plugins-enabled too cd .. echo "${yellow}** Executing sniffjoke while testing $OPTION_NAME${white}" echo "$SNIFFJOKEBIN --debug 6 $UGPD --start --dir $PWD --location $OPTION_NAME --only-plugin `cat $CMDPART` --no-udp --whitelist" $SNIFFJOKEBIN --debug 6 $UGPD --start --dir $PWD --location $OPTION_NAME --only-plugin `cat $CMDPART` --no-udp --whitelist >/dev/null 2>&1 sleep 0.8 $SNIFFJOKECLIBIN stat > dumpService_stat.log if [ "$?" -eq 0 ]; then echo "${green}sniffjoke is correctly running${white}" else echo "${red}sniffjoke is not running - fatal error - remove $WORKDIR by hand${white}" tput sgr0; exit fi INTERFACE=`cat dumpService_stat.log | grep "hijacked interface:" | awk '{print $3}'` LOCALIP=`cat dumpService_stat.log | grep "hijacked local" | awk '{print $4}'` if [ -n "$INTERFACE" ]; then echo "${yellow}** Starting tcpdump on $INTERFACE${white} ($LOCALIP)" else echo "${red}Unable to detect hijacked interface by dumpService_stat.log - fatal - remove $TEMPDIR/$LOCATION by hand${white}" tput sgr0; exit fi echo "tcpdump -p -i $INTERFACE -U -w $PCAPS$OPTION_NAME"_"$OPCODE.pcap -s 0 tcp port 80 and host $SERVER_IP or icmp" tcpdump -p -i $INTERFACE -U -w $PCAPS$OPTION_NAME"_"$OPCODE.pcap -s 0 tcp port 80 and host $SERVER_IP or icmp >output.tcpdump 2>&1 & sleep 0.2 echo "${yellow}** Starting curl to post/echo at $SERVER ($SERVER_IP) under monitoring${white}" curl -s --retry 0 --max-time 10 -d "sparedata=$GENERATEDDATA" -o SPAREDATARECEIVED $SERVER >output.curl 2>&1 $SNIFFJOKECLIBIN info > dumpService_info.log $SNIFFJOKECLIBIN ttlmap > dumpService_ttlmap.log $SNIFFJOKECLIBIN quit > dumpService_quit.log if [ "$?" -eq 0 ]; then echo "${green}sniffjoke correctly closed${white}" else echo "${red}sniffjoke crashed during the test: very bad line to read :( remove $LOCATION by hand${white}" tput sgr0; exit fi sleep 0.5 killall -HUP tcpdump TCPNUMBER=`tcpdump -n -r $PCAPS$OPTION_NAME"_"$OPCODE.pcap tcp and greater 1000 and dst port 80 | wc -l` recv_TCPNUMBER=`tcpdump -n -r $PCAPS$OPTION_NAME"_"$OPCODE.pcap tcp and greater 1000 and src port 80 | wc -l` # happen too often, ping and udp port unreach icmpexpr="icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply and icmp[icmptype] != icmp-unreach" ICMPNUMBER=`tcpdump -n -r $PCAPS$OPTION_NAME"_"$OPCODE.pcap $icmpexpr | wc -l` if [ -e "SPAREDATARECEIVED" ]; then tr -d "\n" < SPAREDATARECEIVED > SPAREDATARECEIVED.clean CHECKSUM=`md5sum "SPAREDATARECEIVED.clean" | cut -b -32` else touch ZERO_BYTE_FILE CHECKSUM="{unexistent-output-file}" fi echo "$OPCODE\t$OPTION_NAME " >> $WORKDIR/options-collected-feedback echo "$OPCODE\torig:$VERIFYSUM recv:$CHECKSUM TCPo:$TCPNUMBER TCPi:$recv_TCPNUMBER ICMP:$ICMPNUMBER " >> $WORKDIR/options-collected-feedback if [ $VERIFYSUM != $CHECKSUM ]; then touch CHECKSUM_DIFFER else touch CHECKSUM_MATCH fi echo $TCPNUMBER > TCP echo $recv_TCPNUMBER > TCP.echoed echo $ICMPNUMBER > ICMP popd >/dev/null 2>&1 } while getopts “hw:n:g:u:i:” OPTION do case $OPTION in h) usage exit 1 ;; n) USERNAME=$OPTARG ;; g) GROUPNAME=$OPTARG ;; u) SERVER=$OPTARG ;; w) WORKDIR=`echo $OPTARG | sed 's#/*$##'` #removing eventual(s) trailing slash ;; i) SERVER_IP=$OPTARG ;; ?) usage exit 1 ;; esac done if [ -z "$SERVER" ] || [ -z "$WORKDIR" ] || [ -z "$SERVER_IP" ]; then echo "\n${red}" echo "no parameters supply: there is a reason if the user must invoke sniffjoke-autotest only! ${white}\n" usage tput sgr0; exit fi if [ -d "$WORKDIR/0" ]; then echo "\n${yellow}" echo "This location has been defiled by the option probe. now goes with capitan sheppard to probe uranus" echo "${red}" echo "there is a reason if the user must invoke sniffjoke-autotest only! dunno play with tha options!${white}\n" tput sgr0; exit fi UGPD="--user $USERNAME --group $GROUPNAME" cd $WORKDIR # check in the generic/iptcp-options.conf CONSTANTLY: these number will change every time # a new options is implemented # # the options between the 11 and the $OPTIONSAMOUNT (18) are not implemented at the moment # the option 3 is not implemented too, and the 1 is tracking only # check the static implementation linked in OptionPool::OptionPool() SUPPORTED_OPTIONS_N=`seq 0 $OPTIONSAMOUNT` for opt in $SUPPORTED_OPTIONS_N; do DIRNAME="optprobe/$opt" mkdir -p $DIRNAME # YES YES YES I know! is dirty this piece of code. gimme few time. if [ $opt == "3" ]; then touch "$DIRNAME/option_disable" continue; fi if [ $opt == "1" ]; then touch "$DIRNAME/option_disable" continue; fi if [ $opt == "11" ]; then touch "$DIRNAME/option_disable" continue; fi if [ $opt -ge "13" ]; then touch "$DIRNAME/option_disable" continue; fi mkdir "$DIRNAME/SINGLE" echo "HDRoptions_probe,INNOCENT+"$opt"S" >> "$DIRNAME/SINGLE/tested_cmdpart"; mkdir "$DIRNAME/DOUBLE" echo "HDRoptions_probe,INNOCENT+"$opt"D" >> "$DIRNAME/DOUBLE/tested_cmdpart"; done # generate the SPAREDATA file to send GENERATEDFILE="SPAREDATA_options" # the number '6' is not used in the test because sniffjoke, when runned # in debug mode (--debug 6) instead of filling the random segment of data # inject with random data, use the number '6'. Is useful when debugging # an hack. seq 1000 3000 | tr -d [:cntrl:] | sed -e's/6/111/g' | strings | tr -d "\n" > $GENERATEDFILE GENERATEDDATA=`cat $GENERATEDFILE` VERIFYSUM=`md5sum $GENERATEDFILE | cut -b -32` echo "${yellow}+ Starting SniffJoke IP/TCP options selective probe" echo "* Stopping possible running instances of sniffjoke service ($SNIFFJOKECLIBIN quit)" $SNIFFJOKECLIBIN quit >/dev/null 2>&1 OPTION_TO_TEST=`find . -name 'tested_cmdpart'` # create simple utility for whom must debug this painful hdr options bizzaro dance echo "#!/bin/sh\ntcpdump -vvv -s 0 -n -r \$1 | more\n" >> optprobe/view.sh chmod +x optprobe/view.sh for TOTEST in $OPTION_TO_TEST; do echo "${blue}Test #$DONE: Option #`echo $TOTEST | tr -c -d [:digit:]` ($SERVER_IP)" start_option_test DONE=$((DONE+1)) done OPTOUTPUT="iptcp-options.conf" echo "# this is an autogenerated file by sniffjoke-autotest (sj-iptcpopt-test)" > $OPTOUTPUT echo "# wheneven your network router, provider or some malfunction is detected" >> $OPTOUTPUT echo "# you are invited to regenerate this file" >> $OPTOUTPUT echo "# this file describe which combos of IP/TCP options will be used in your location" >> $OPTOUTPUT echo "# iptcp-options.conf \"$VERSION\" for location: `basename $WORKDIR` using $SERVER_IP\n" >> $OPTOUTPUT write_comment() { echo "# option $checkcnt: $1" >> $OPTOUTPUT } # the sequence used in this parsing is relevant, # and this is one of the most skinny algorithm in Sj for checkcnt in `seq 0 $OPTIONSAMOUNT`; do SINGLEDIR="optprobe/$checkcnt/SINGLE" DOUBLEDIR="optprobe/$checkcnt/DOUBLE" if [ -e "optprobe/$checkcnt/option_disable" ]; then write_comment "Option disabled - used for tracking only " echo "$checkcnt,16" >> $OPTOUTPUT continue; fi SINGLE_tcp=`cat $SINGLEDIR/TCP` SINGLE_icmp=`cat $SINGLEDIR/ICMP` DOUBLE_tcp=`cat $DOUBLEDIR/TCP` DOUBLE_icmp=`cat $DOUBLEDIR/ICMP` SINGLE_echoed=`cat $SINGLEDIR/TCP.echoed` DOUBLE_echoed=`cat $DOUBLEDIR/TCP.echoed` write_comment "(SINGLE: TCPo:$SINGLE_tcp ICMP:$SINGLE_icmp TCPi:$SINGLE_echoed DOUBLE: TCPo:$DOUBLE_tcp ICMP:$DOUBLE_icmp TCPi:$DOUBLE_echoed)" if [ -e "$SINGLEDIR/CHECKSUM_DIFFER" ]; then if [ $SINGLE_icmp -ge 5 ]; then write_comment "${OPTNAME[$checkcnt]} Single element of this options cause icmp error: must not be used" echo "$checkcnt,16" >> $OPTOUTPUT else write_comment "${OPTNAME[$checkcnt]} Single option corrupt a packet" echo "$checkcnt,2" >> $OPTOUTPUT fi continue; fi if [ -e "$DOUBLEDIR/CHECKSUM_DIFFER" ]; then if [ $DOUBLE_icmp -ge 5 ]; then if [ -e "$SINGLEDIR/CHECKSUM_MATCH" ]; then write_comment "${OPTNAME[$checkcnt]} duplication causes icmp error, but as single is OK" echo "$checkcnt,1" >> $OPTOUTPUT else write_comment "${OPTNAME[$checkcnt]} duplication causes icmp, as single is BAD, urgh!" echo "$checkcnt,2" >> $OPTOUTPUT fi else write_comment "${OPTNAME[$checkcnt]} Option duplication corrupt a packet" echo "$checkcnt,4" >> $OPTOUTPUT fi continue; fi if [ -e "$DOUBLEDIR/CHECKSUM_MATCH" ]; then write_comment "${OPTNAME[$checkcnt]} This option don't corrupt a packet" echo "$checkcnt,1" >> $OPTOUTPUT continue; fi done echo "\n# follow the index of the options analyzed:" >> $OPTOUTPUT for i in `seq 0 12`; do echo "# $i = ${OPTNAME[$i]}" >> $OPTOUTPUT; done now=`date` echo "\n# Generated in date: $now\n" >> $OPTOUTPUT echo "\n${blue}FINISHED! ${yellow}created $OPTOUTPUT\n" sniffjoke-0.4.1+git20170825.1.434bfb1/src/autotest/sniffjoke-autotest0000755000000000000000000006156613147777044021500 0ustar00#!/bin/bash locate_info() { cat << EOF $0 has not found, via locate, the path of the 'generic/' location you have three options to solve this issue: . install locate, launch updatedb and restart sniffjoke-autotest . you already has locate, but you need to updatedb . or, use the option: -d /directory/of/sniffjoke/locations/ checking that in 'locations/' will be present 'generic/' note: $0 use as marker the file THIS_IS_GENERIC EOF } shopt -s expand_aliases alias echo="echo -e" red="\e[1;31m" green="\e[1;32m" yellow="\e[1;33m" blue="\e[1;34m" violet="\e[1;35m" white="\e[1;39m" #default values VERSION="041" LOCATION= LOCSDIR= GENERICDIR= USERNAME= GROUPNAME= SERVERURL= GNUPGTRUST="NO" REPN=1 firstsimple= usage() { cat << EOF usage: $0 options This script runs plugins test along different destinations OS to determinate the selection of plugins and options that correctly works in the current location. Every workplace (office, home, freewifi) you use, neet to be setup as location. Having a location correctly configurated IS THE ONLY WAY to have SniffJoke working; technical details will be found in: http://www.delirandom.net/sniffjoke/sniffjoke-locations OPTIONS: -h show this message -l location name (required) -n number of replicas to be passed for the single hack (default 1) -g specify the group to privilege downgrade (default: nogroup) -u specify the user to privilege downgrade (default: nobody) EOF } dump_plugin_file() { cat >> $PLUGINLIST <<__EOF__ fake_close_fin,PRESCRIPTION fake_close_fin,MALFORMED fake_close_fin,GUILTY fake_close_rst,PRESCRIPTION fake_close_rst,MALFORMED fake_close_rst,GUILTY fake_data,PRESCRIPTION fake_data,MALFORMED fake_data,GUILTY fake_seq,PRESCRIPTION fake_seq,MALFORMED fake_seq,GUILTY fake_syn,PRESCRIPTION fake_syn,MALFORMED fake_syn,GUILTY fake_window,PRESCRIPTION fake_window,MALFORMED fake_window,GUILTY fragmentation,INNOCENT shift_ack,PRESCRIPTION shift_ack,MALFORMED shift_ack,GUILTY valid_rst_fake_seq,INNOCENT __EOF__ } trusted_server_contact() { # this is the trustable key # # pub 1024D/7D9E677D 2011-05-21 # Key fingerprint = F37C 2042 5052 27E2 2FD7 D511 947F 574B 7D9E 677D # uid SniffJoke project (http://www.delirandom.net/sniffjoke) # # and, to be sure became installed in every box: # # $ gpg -a --export 7D9E677D # -----BEGIN PGP PUBLIC KEY BLOCK----- # Version: GnuPG v1.4.10 (GNU/Linux) # # mQGiBE3YHaMRBACLou45ad2TnK6iQKHym7Q4AuySv+pxFVjd5QEJ/Gy3b5dM4bRn # y1NzuTxnCPpuR4c/Iv+rZbhSsoxqTAZ8YYJ4wdFEvDTLap9l1n8D66oYzYr9C1Tl # lxeCtz4hzJZK1M8agoBpnu0xRWCkZNziSdKPQGAlrSaTzLcrKaNYx727uwCg8XKF # fMe93oJtEmKSxl6S1V+mbOsD/j/2CfDuhtjJnHZWgmrlBrtghw9BubCi/o+TWNPs # a++FqUI+tw5G2CZiOS2HzR6/UIEcWr99HBGnyC6+B3TzyiU20T22DOCt8Dii65qt # j47rhKFAo6kUlJymY0X+fLzxxNBzS7BzrNIvLzCcdNmDsxjGtGtCedJCV09WNgRk # SgVpA/sHMF1rsYb4LGeg+unp7b6IyJgpeGagvTVqS366IReoftPatvbP18t4pdlD # wkGG2MnVtQFgz8o5LiS1AR6B74Lpr0FTIhMBUpi7A1JOetsliNImNPkrMJs1sYog # tWv59uDOYj7TfV2F9jMu1hWoedCLMsvwouXwaqFtk13PFg2hMbQ3U25pZmZKb2tl # IHByb2plY3QgKGh0dHA6Ly93d3cuZGVsaXJhbmRvbS5uZXQvc25pZmZqb2tlKYhg # BBMRAgAgBQJN2B2jAhsDBgsJCAcDAgQVAggDBBYCAwECHgECF4AACgkQlH9XS32e # Z31bjgCeIm4ft9zSztcsVFjdWnOyyKvNWckAnA6Ndf9Ps97Ve0u82ySNYFgHVqRR # iEoEEBECAAoFAk3YHmsDBQJ4AAoJELhCCT3GdlQwEl4AnA/OX42uxbC5GCn2tgBC # mJ7sBRawAKDfZ2G6q0S+JUWlQDFtbHwocCaIYA== # =FK0c # -----END PGP PUBLIC KEY BLOCK----- # # is a "sign only" key, that's why is so short GPGBIN=`which gpg` if [ ! -z "$GPGBIN" ]; then # REMIND: this is needed to avoid: KEYRINGOPT="--no-permission-warning --no-default-keyring --keyring $TEMPDIR/$LOCATION/sj.gpgkeyring" # gpg: WARNING: unsafe ownership on configuration file `/home/vecna/.gnupg/gpg.conf' # gpg: error reading key: public key not found echo "${green}GNuPG binary found: checking if key (1024D/7D9E677D 2011-05-21) is present on your keyring..." echo "${blue}" $GPGBIN --list-keys 7D9E677D >/dev/null 2>&1 if [ "$?" != "0" ]; then echo "${yellow} SniffJoke key not found: importing in a temporary keyring..." tput sgr0 $GPGBIN $KEYRINGOPT --keyserver pgp.mit.edu --recv-key 7D9E677D fi fingercheck=`$GPGBIN $KEYRINGOPT --fingerprint 7D9E677D | grep "fingerprint" | tr -d " " | cut -b 16- 2>&1` if [ -z "$fingercheck" ]; then echo "${red} Unable to retriver SniffJoke's key from ${blue}pgp.mit.edu${red}: Not required, but understimable neither" else if [ "$fingercheck" = "F37C2042505227E22FD7D511947F574B7D9E677D" ]; then echo "${green} Key verified: 7D9E677D, SniffJoke project (http://www.delirandom.net/sniffjoke)" GNUPGTRUST="YEP" else echo "${red} Something is wrong with your keys, keyserver or gpg: unable to verify the key" # default, GNUPGTRUST="NO" fi fi else echo "${red}gnupg not found! not required, but for paranoic guys, that's things matters" fi } routing_table_log() { route -n > $WORKDIR/route-$1.log } group_check() { GROUPNAME=`groups $USERNAME | cut -d " " -f 3` if [ -z "$GROUPNAME" ]; then echo "${red}Unable to found, in your system, the group of $USERNAME. ${white}please specify with the option -g and -u username/group" echo "(hey, you package mantainer! is better you create a dedicated sniffjoke user/group)" echo "A group is required because sniffjoke drop privileges. You will need to customize the ${green}sniffjoke-server.conf ${white}" echo "because by default is used nobody/nogroup" tput sgr0; exit fi } start_test() { REPLICAn=$1 if [[ $PLUGIN =~ ([a-z_]+),([A-Z0-9\+]+) ]]; then PNAME=${BASH_REMATCH[1]} SCRAMBLE=${BASH_REMATCH[2]} TESTID=$PNAME/$SCRAMBLE fi mkdir -p $TESTID echo "${green}.----" echo "${green}| ${blue}Plugin Name\t${yellow}\t[$PNAME]" echo "${green}| ${blue}Scramble\t${yellow}\t[$SCRAMBLE]" echo "${green}| ${blue}TestID\t${yellow}\t[$TESTID]" echo "${green}| ${blue}Test directory${yellow}\t[$TEMPDIR/$LOCATION/$TESTID]${white}" # $SERVER is like http://www.delirandom.net/sjA/pe.php for i in `seq 1 $REPLICAn`; do WORKDIR=$TESTID/replica-${i} mkdir -p $TESTID/replica-${i} cp $LOCSDIR/generic/sniffjoke-service.conf $TESTID/replica-${i}/ echo $SERVER_IP > $WORKDIR/ipwhitelist.conf if [ -e $firstsimple/ttlfocusmap.bin ]; then cp $firstsimple/ttlfocusmap.bin $TESTID/replica-${i}/ cp $TEMPDIR/$LOCATION/iptcp-options.conf $TESTID/replica-${i} echo "${green}| * COMBINATION OF TESTS (${yellow}$PLUGNDX/$PLUGIN_NUMBER${green}) REPLICA (${yellow}$i/$REPLICAn${green})" else echo "${green}| * ${blue}Goal:\t${green}\t[generate ttlfocusmap.bin, and test sniffjoke without any esoteric network trick]${white}" cp $LOCSDIR/generic/iptcp-options.conf $TESTID/replica-${i} fi echo "${yellow}** Executing sniffjoke with $PLUGIN combo${white}" echo "sniffjoke --debug 6 $UGPD --start --dir $TEMPDIR/$LOCATION/$TESTID --location replica-${i} --only-plugin $PLUGIN --no-udp --whitelist" $SNIFFJOKEBIN --debug 6 $UGPD --start --dir $TEMPDIR/$LOCATION/$TESTID --location replica-${i} --only-plugin $PLUGIN --no-udp --whitelist >/dev/null 2>&1 sleep 0.8 routing_table_log "after" $SNIFFJOKECLIBIN stat > $WORKDIR/dumpService_stat.log if [ "$?" -eq 0 ]; then echo "${green}sniffjoke is correctly running${white}" else echo "${red}sniffjoke is not running - fatal error - remove $TEMPDIR/$LOCATION by hand${white}" tput sgr0; exit fi INTERFACE=`cat $WORKDIR/dumpService_stat.log | grep "hijacked interface:" | awk '{print $3}'` if [ -n "$INTERFACE" ]; then echo "${yellow}** Starting tcpdump on $INTERFACE${white}, listening only $SERVER_IP and ICMP" else echo "${red}Unable to detect hijacked interface name by $WORKDIR/dumpService_stat.log - fatal - remove $TEMPDIR/$LOCATION by hand${white}" tput sgr0; exit fi echo "$TCPDUMPBIN -p -i $INTERFACE -U -w $PNAME-$SCRAMBLE-$i.pcap -s 0 tcp port 80 and host $SERVER_IP or icmp" $TCPDUMPBIN -p -i $INTERFACE -U -w $WORKDIR/$PNAME-$SCRAMBLE-$i.pcap -s 0 tcp port 80 and host $SERVER_IP or icmp >$WORKDIR/output.tcpdump 2>&1 & sleep 0.2 echo "${yellow}** Starting curl to post/echo at $SERVER_ADDR ($SERVER_IP) under monitoring${white}" curl -s --retry 0 --max-time 10 -d "sparedata=$GENERATEDDATA" -o $WORKDIR/SPAREDATARECEIVED $SERVER >/dev/null 2>&1 $SNIFFJOKECLIBIN info > $WORKDIR/dumpService_info.log $SNIFFJOKECLIBIN ttlmap > $WORKDIR/dumpService_ttlmap.log $SNIFFJOKECLIBIN quit > $WORKDIR/dumpService_quit.log if [ "$?" -eq 0 ]; then echo "${green}sniffjoke correctly closed${white}" else echo "${red}sniffjoke crashed during the test: very bad line to read :( remove $TEMPDIR/$LOCATION by hand${white}" tput sgr0; exit fi sleep 0.5 killall -HUP tcpdump done; echo 0 > $TESTID/passed_count for i in `seq 1 $REPLICAn`; do WORKDIR=$TESTID/replica-${i} if [ -e "$WORKDIR/SPAREDATARECEIVED" ]; then tr -d "\n" < $WORKDIR/SPAREDATARECEIVED > $WORKDIR/SPAREDATARECEIVED.clean CHECKSUM=`md5sum "$WORKDIR/SPAREDATARECEIVED.clean" | cut -b -32` else CHECKSUM="{unexistent-output-file}" # maybe the network has get an error isWorked=`grep "^0 packets captured" $WORKDIR/output.tcpdump` if [ -n "$isWorked" ]; then echo "${red}Something in the network is not going well, and will not be a SniffJoke fault" echo "${red}please, restart the test and remove the $TEMPDIR/$LOCATION" tput sgr0; exit; fi fi echo "orig:$VERIFYSUM recv:$CHECKSUM $TESTID $i" >> plugins-collected-feedback if [ $VERIFYSUM != $CHECKSUM ]; then # the failed_hacks and the working_hacks are generated and treated in the same style # the follow are useful infos for debug echo "$VERIFYSUM vs $CHECKSUM from $PNAME-$SCRAMBLE replica $i" >> $TESTID/failed_info else echo $i > $TESTID/passed_count fi done if [ `cat $TESTID/passed_count` -eq $REPLICAn ]; then echo $SCRAMBLE >> $PNAME/working_scrambles echo "${yellow}* FINISHED TEST $TESTID: ${green}TEST PASSED${white}\n" return 1 else echo $SCRAMBLE >> $PNAME/failed_scrambles echo "${yellow}* FINISHED TEST $TESTID: ${red}TEST FAILED${white}\n" return 0 fi } get_STATEDIR() { locate_exists=`which locate` if [ -z "$locate_exists" ]; then locate_info tput sgr0; exit; fi marker=`locate THIS_IS_GENERIC | grep "var/sniffjoke"` if [ ! -z "$marker" ]; then GENERICDIR=`dirname $marker` LOCSDIR=`echo $GENERICDIR | sed -e's/generic//g'` else locate_info tput sgr0; exit; fi } compress_location_output() { dFname="sjAlogs-$LOCATION.tar.bz2" tar -c -j -f $dFname --exclude='*DATA*' $TAR_EXCLUSION * } while getopts “hl:d:n:u:g:s:a:” OPTION do case $OPTION in h) usage tput sgr0; exit 1 ;; l) LOCATION=`echo $OPTARG | sed 's#/*$##'` #removing eventual(s) trailing slash ;; n) REPN=$OPTARG ;; u) USERNAME=$OPTARG ;; # -d is became a semi-secret not more required options, because to avoid every system # dependent requirement, now I'm using locate. this will cause some trouble in the developers, # or in the other with some sniffjoke broked installation. # the only solution, is keeping in your pants: http://www.youtube.com/watch?v=x-0FUCg7swU d) LOCSDIR=$OPTARG GENERICDIR="$LOCSDIR/generic" ;; g) GROUPNAME=$OPTARG ;; # -s option is semi-secret, because I use them while testing a server side method # more complex than the post_echo.php s) SERVERURL=$OPTARG ;; # -a MUST BE USED with -s a) SERVERADDR=$OPTARG ;; ?) usage tput sgr0; exit 1 ;; esac done # every system dependend path, will be obtain here, and checked below if [ -z "$LOCSDIR" ]; then get_STATEDIR fi TEMPDIR="/tmp" cd $TEMPDIR SNIFFJOKEBIN=`which sniffjoke` if [ -z "$SNIFFJOKEBIN" ]; then echo "\n${red}" echo "\"which sniffjoke\" has found nothing" echo "Are sniffjoke installed with the name \"sniffjoke\" ?" echo "${white}" tput sgr0; exit; fi TCPDUMPBIN=`which tcpdump` if [ -z "$TCPDUMPBIN" ]; then echo "\n${red}" echo "\"which tcpdump\" has found nothing" echo "tcpdump is required by this testing script, because the traffic need to be captured an analyzed" # if you're asking "where are the .pcap(s) analyzed ?" "in sj-iptcpopt-probe" echo "${white}" tput sgr0; exit; fi CURLBIN=`which curl` if [ -z "$CURLBIN" ]; then echo "\n${red}" echo "\"which curl\" has found nothing" echo "curl is required by this testing script, because are performed some HTML POSTs" echo "${white}" tput sgr0; exit; fi SNIFFJOKECLIBIN=`which sniffjokectl` if [ -z "$SNIFFJOKECLIBIN" ]; then echo "\n${red}" echo "\"which sniffjokectl\" has found nothing" echo "Are sniffjoke installed with the name \"sniffjokectl\" ?" echo "${white}" tput sgr0; exit; fi IPTCPPROBE=`which sj-iptcpopt-probe` if [ -z "$IPTCPPROBE" ]; then echo "\n${red}" echo "\"which sj-iptcpopt-probe\" has found nothing" echo "Are sniffjoke installed correctly ? sj-iptcpopt-probe and sniffjoke-autotest are installed together.." echo "${white}" tput sgr0; exit; fi USERID=`id -u` if [ $USERID != "0" ]; then echo "- Error, only root should run $0" tput sgr0; exit; fi if [ -z $LOCATION ]; then usage echo "\n${red}" echo "it's required a LOCATION name, eg: office, home, nickhome, starbucks..." echo "sniffjoke-autotest will generate the best plugins-enabled.conf usable in this environment" echo "at the end of the tests (that include continuos restarting of sniffjoke with different options)" echo "will be created a new directory describing your location. after you will customize the options" echo "${white}" tput sgr0; exit; fi if [ ! -d $LOCSDIR ]; then usage echo "\n${red}" echo "Bad issue: $LOCSDIR is expected to be a directory" echo "(should became from -d option or from internal usage of 'locate') " echo "${white}" tput sgr0; exit; fi if [ -z $USERNAME ]; then USERNAME="nobody" fi if [ -z $GROUPNAME ]; then group_check fi # user group privilege downgrade, this variable will be passed to ipopt testing UGPD="--user $USERNAME --group $GROUPNAME" if [ ! -d $GENERICDIR ]; then usage echo "\n${red}" echo "options \"-d\" invalid directory: we are looking for the path containing 'generic/'" echo "sniffjoke-autotest create at the given \"-d\", the new '$LOCATION/' copying some files from 'generic/'" echo "${white}" tput sgr0; exit; fi if [ -d $LOCSDIR/$LOCATION ]; then echo "\n${red}" echo "error: $LOCSDIR/$LOCATION directory already present, remove by hand: don't keep old location, nor two location with the same name :P" tput sgr0; exit; fi if [ -d $TEMPDIR/$LOCATION ]; then usage echo "\n${red}" echo "- error: $TEMPDIR/$LOCATION directory already present" echo "${white}" tput sgr0; exit; else mkdir $TEMPDIR/$LOCATION fi cd $TEMPDIR/$LOCATION echo "* Stopping possible running sniffjoke ($SNIFFJOKECLIBIN quit)" $SNIFFJOKECLIBIN quit >/dev/null 2>&1 ln -s $GENERICDIR . # dumping of useful information when sniffjoke doesn't run and you ask to the dev ifconfig >> LAN.info route -n >> LAN.info iptables -nL >> LAN.info uname -a >> LAN.info if [ -z "$SERVERURL" ]; then trusted_server_contact FILEURL="http://www.delirandom.net/sjA/autotest.php?v=$VERSION" echo "* retrivering multi-OS testing server list ($FILEURL)" SERVERFILE="sj-server.info" $CURLBIN -o $SERVERFILE $FILEURL >/dev/null 2>&1 if ! [ -e $SERVERFILE ]; then echo "\n${red}" echo "- unable to retriver $SERVERFILE with curl from [$FILEURL]" echo "${white}" tput sgr0; exit; fi if [ $GNUPGTRUST == "YEP" ]; then $GPGBIN $KEYRINGOPT --verify $SERVERFILE >/dev/null 2>&1 if [ "$?" != "0" ]; then echo "${red}Invalid GPG signature of received file! its a dangerous anomaly." echo "${red}Check by hand, and if something don't seem plain to you, give ^c and asks to your friends using SniffJoke" echo "${blue}Received file:" tput sgr0; cat $SERVERFILE echo "${red}If you want proceed, press return" read else echo ${green}Checked signature by gpg key: valid file received fi else echo "${yellow}Received $SERVERFILE, but without GnuPG could not be verified" fi # these are the variable retriverable from the server SERVER=`grep "TESTSRV=" $SERVERFILE | cut -b 9-` MESSAGE=`grep "MESSAGE=" $SERVERFILE | cut -b 9-` RESULTS=`grep "RESULTS=" $SERVERFILE | cut -b 9-` SERVER_IP=`grep "IPTEST=" $SERVERFILE | cut -b 8-` STOP=`grep "STOP=" $SERVERFILE | cut -b 6- | tr -c -d [:alpha:]` else # this is kind of easter egg, but, without cow super power echo "${blue} hello ${yellow}yellow ${blue}daddy! http://shinysushi.deviantart.com/art/Asari-Logic-194960943" SERVER=$SERVERURL SERVER_IP=$SERVERADDR fi if [ ! -z "$MESSAGE" ]; then echo "${blue}Message retrivered from the SniffJoke autotest service:" echo "* --------- ----- --- -- -" echo "${green}$MESSAGE ${blue}" echo "* --------- ----- --- -- -" echo "Message finished" if [ $STOP == "YES" ]; then echo "\n${green}do you want continue ? if not, give ^C and remove $TEMPDIR/$LOCATION, otherwise, press return" read fi fi echo "${yellow}+ Starting SniffJoke hacks test" # uh remember coder: the http port www.umpalumpa.net:803213 is NOT SUPPORTED SERVER_ADDR=`echo $SERVER | sed -e's/.*\/\///' | sed -e's/\/.*//'` if [ -z $SERVER_ADDR ] || [ -z $SERVER_IP ]; then echo "${red}Server Address and Server IP lacking: if you are not using -a or -s, there are some problem in delirandom" echo "Incidentally, delirandom is, at the moment, the single point of failure of this project" tput sgr0; exit; fi # oh yeah pippa middleton, this line is for you!!1: echo "${green} remote server IP '$SERVER_IP' and HTTP URL '$SERVER_ADDR'" PLUGINLIST="plugins-testsuite" dump_plugin_file PLUGIN_NUMBER=`wc -l < $PLUGINLIST` # generate the SPAREDATA file to send GENERATEDFILE="SPAREDATA_plugin" # the number '6' is not used in the test because sniffjoke, when runned # in debug mode (--debug 6) instead of filling the random segment of data # inject with random data, use the number '6'. Is useful when debugging # an hack. seq 1000 9000 | tr -d [:cntrl:] | sed -e's/6/111/g' | strings | tr -d "\n" > $GENERATEDFILE GENERATEDDATA=`cat $GENERATEDFILE` VERIFYSUM=`md5sum $GENERATEDFILE | cut -b -32` # OK GUYS, SINCE HERE WE'D SETUP THE ENVIRONMENT, NOW START THE THREE SECTION Of TESTS: # TEST 1) a simple plain connection, useful for the first traceroute and general checkup # TEST 2) testing of every IP/TCP header options and conseguencial generation of "iptcp-options.conf" # TEST 3) testing of every scramble+plugin combination, generation of "plugins-enabled.conf" # at the end, you have all the location specific files required for a safe usage of sniffjoke # TEST 1 PLUGIN="segmentation,INNOCENT" start_test 1 if [ ! $? ]; then echo "${red} the simplest test has failed, something dirty don't work in your network" tput sgr0; exit; fi firstsimple=$TEMPDIR/$LOCATION/firstsimple mv $TEMPDIR/$LOCATION/segmentation/INNOCENT/replica-1 $firstsimple # TEST 2 # (now in $firstsimple/ttlfocusmap.bin is cached the traceroute) $IPTCPPROBE -w "$TEMPDIR/$LOCATION" -u "$SERVER" -n $USERNAME -g $GROUPNAME -i $SERVER_IP # TEST 3 # (now in $TEMPDIR/$LOCATION/iptcp-options.conf there are the correct usage for this location) for PLUGNDX in `seq 1 $PLUGIN_NUMBER`; do PLUGIN=`head -$PLUGNDX $PLUGINLIST | tail -1` # those test need to be fixed or be used only where my test script will be hosted echo "${blue}Starting test vs Linux environment: ($SERVER_ADDR, $SERVER_IP)" start_test $REPN done # Parsing & formatting the results of TEST 3 PeL="plugins-enabled.conf" echo "# this is an autogenerated file by sniffjoke-autotest " > $PeL echo "# wheneven you change the network router, provider or some malfunction is detected" >> $PeL echo "# you are invited to regenerate this file" >> $PeL echo "# this plugins-enabled.conf \"$VERSION\" its for location: $LOCATION using $SERVER_IP" >> $PeL success_count=0 TAR_EXCLUSION="" for PLUGIN in `ls */working_scrambles 2>/dev/null | sed -e 's/\/working_scrambles//'` ; do SCRAMBLES=`cat $PLUGIN/working_scrambles | tr " " "," | tr [:cntrl:] ","` echo "$PLUGIN,$SCRAMBLES" | sed -es/,\$// >> $PeL success_count=$(($success_count+1)); for SCRAMBLE in `cat $PLUGIN/working_scrambles`; do TAR_EXCLUSION=$TAR_EXCLUSION" --exclude=$PLUGIN/$SCRAMBLE" done done echo "\n# follow the hacks+scramble that don't pass the sniffjoke-autotest in environment \"$LOCATION\"\n" >> $PeL failure_count=0 for PLUGIN in `ls */failed_scrambles 2>/dev/null | sed -e 's/\/failed_scrambles//'` ; do SCRAMBLES=`cat $PLUGIN/failed_scrambles | tr " " "," | tr [:cntrl:] ","` echo "# $PLUGIN,$SCRAMBLES" | sed -es/,\$// >> $PeL failure_count=$(($failure_count+1)); done now=`date` echo "\n# Generated in date: $now\n" >> $PeL echo "${yellow}FINISHED!\n" echo " ${red} $failure_count combinations of hack+scramble have not worked" echo " ${green} $success_count combinations of hack+scramble have worked correctly${white}" if [ $failure_count -ge 6 ]; then echo "\n" echo " ${red} Several combinations of hack+scramble have not worked: sometime has worked put an MTU lower, eg: ifconfig mtu 1300" echo "\n" fi chmod 444 plugins-enabled.conf DESTINATION=$LOCSDIR/$LOCATION mkdir $DESTINATION cp $GENERICDIR/port-aggressivity.conf $DESTINATION cp $GENERICDIR/sniffjoke-service.conf $DESTINATION cp $TEMPDIR/$LOCATION/iptcp-options.conf $DESTINATION cp plugins-enabled.conf $DESTINATION/plugins-enabled.conf echo "\n${yellow}* sniffjoke-autotest has dumped $TEMPDIR/$LOCATION/plugins-enabled.conf" echo "* that conf has been copyed in $DESTINATION with the other default configuration file." echo "* now, when you are using internet in this network environment, use sniffjoke with the option --location $LOCATION${white}" if [ ! -z "$SERVERURL" ]; then echo "${blue} compressig data and quitting: commit data not provided in hand usage" compress_location_output tput sgr0; exit; fi tput sgr0 echo "if you want to: 1) have an easyest support 2) have an automatized analysis of your network capability 3) contribute in sniffjoke" echo "automatically this script will send to the testing server some data collected in this test. what data are send:" echo " networking/system information (routing table, kernel configuration)" echo " log files of sniffjoke execution, warning: some IP address of your present connection may result (obviously, not the data)" echo " traffic monitor of the testing session and ICMP error traffic" echo " only the tests related the plugins that have failed" echo "${green}the data are intended to be used for debug and optimization only, and you could delete your submission when you wish." echo "submission will be do to \"$RESULTS\"" tput sgr0 echo "if you want to send, write: ${green}OK" read YESORNOT if [ "$YESORNOT" == "OK" ]; then compress_location_output echo "${green} sending of the file... to $RESULTS" output_put="$TEMPDIR/$LOCATION/HTTP_put.out" $CURLBIN -o $output_put -T $dFname "$RESULTS?v=$VERSION" if [ -e "$output_put" ]; then MESSAGE=`grep "MESSAGE=" $output_put | cut -b 9-` URL=`grep "URL=" $output_put | cut -b 5-` echo "${blue} message received from the server:" echo "* --------- ----- --- -- -" echo "${green}$MESSAGE" echo "${green}$URL" else echo "${red}Error in uploading: operation fail" fi else echo "freedom of choice imply that my script must accept '$YESORNOT' as different of 'OK'. no upload for this time :( amen" fi # clearing gay colors tput sgr0 sniffjoke-0.4.1+git20170825.1.434bfb1/src/client/CMakeLists.txt0000644000000000000000000000017513147777044020061 0ustar00ADD_EXECUTABLE(sniffjokectl main SniffJokeCli) INSTALL(TARGETS sniffjokectl RUNTIME DESTINATION ${CMAKE_INSTALL_PREFIX}/bin) sniffjoke-0.4.1+git20170825.1.434bfb1/src/client/SniffJokeCli.cc0000644000000000000000000004202613147777044020137 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "SniffJokeCli.h" #include "service/internalProtocol.h" #include "service/PortConf.h" #include #include #include #include #include #include #include #include #include #include #include SniffJokeCli::SniffJokeCli(const char* serveraddr, uint16_t serverport, uint32_t ms_timeout) : serveraddr(serveraddr), serverport(serverport), ms_timeout(ms_timeout) { } int32_t SniffJokeCli::send_command(const char *cmdstring) { int sock; struct sockaddr_in service_sin; /* address of service */ struct sockaddr_in from; /* address used for receiving data */ int rlen, flagblock; /* Create a UNIX datagram socket for client */ if ((sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) { fprintf(stderr, "FATAL: unable to open UDP socket for connect to SniffJoke service: %s", strerror(errno)); return SJ_ERROR; } memset(&service_sin, 0x00, sizeof (service_sin)); service_sin.sin_family = AF_INET; service_sin.sin_port = htons(serverport); if (!inet_aton(serveraddr, &service_sin.sin_addr)) { fprintf(stderr, "FATAL: unable to accept hostname (%s): only IP address allow", serveraddr); return SJ_ERROR; } if (sendto(sock, cmdstring, strlen(cmdstring), 0, (const struct sockaddr *) &service_sin, sizeof (service_sin)) == -1) { fprintf(stderr, "FATAL: unable to send message [%s] via %s:%d: %s", cmdstring, serveraddr, serverport, strerror(errno)); return SJ_ERROR; } /* because we loop over the socket file description, is required a non blocking mode */ flagblock = fcntl(sock, F_GETFL); if (fcntl(sock, F_SETFL, flagblock | O_NONBLOCK) == -1) { fprintf(stderr, "FATAL: unable to set non blocking mode in listening socket: %s", strerror(errno)); fprintf(stderr, "anyway: the command has been sent to sniffjoke service, without error in sending"); return SJ_ERROR; } /* poll is required for timeout pourpose checking, because only one file desciption is used */ struct pollfd fd; fd.events = POLLIN; fd.fd = sock; int nfds = poll(&fd, 1, ms_timeout); if (nfds == 1) { /* the same size declared in io_buf SniffJoke.cc service */ uint8_t received_data[HUGEBUF * 4] = {0}; uint8_t received_buf[LARGEBUF] = {0}; uint32_t progressive_recvl = 0; int fromlen = sizeof (struct sockaddr_in); do { memset(received_buf, 0x00, LARGEBUF); rlen = (recvfrom(sock, received_buf, LARGEBUF, MSG_WAITALL, (sockaddr*) & from, (socklen_t *) & fromlen)); if (rlen == -1) { if (errno != EAGAIN) { printf("unable to receive from local socket: %s\n", strerror(errno)); return SJ_ERROR; } break; } memcpy(&received_data[progressive_recvl], received_buf, rlen); progressive_recvl += rlen; } while (rlen > 0); if (!(parse_SjinternalProto(received_data, progressive_recvl))) { fprintf(stderr, "error in parsing received message\n"); return SJ_ERROR; } } else { printf("connection timeout: SniffJoke is not running, or --timeout too low\n"); return SJ_ERROR; } close(sock); return SJ_OK; } #define SPACESIZE 20 uint32_t SniffJokeCli::fillingSpaces(uint16_t p) { char testingline[MEDIUMBUF] = {0}; sprintf(testingline, "%d", p); return (SPACESIZE - strlen(testingline)); } uint32_t SniffJokeCli::fillingSpace(uint16_t s, uint16_t e) { char testingline[MEDIUMBUF] = {0}; sprintf(testingline, "%d:%d", s, e); return (SPACESIZE - strlen(testingline)); } void SniffJokeCli::resolveWeight(char *buf, size_t len, uint32_t weight) { const struct mapTheKeys *mtk; uint32_t writtedLen = 0; memset(buf, 0x00, len); /* this is taken from portConfParsing.cc */ const struct mapTheKeys mappedKeywords[] = { { AGG_RARE, AGG_N_RARE}, { AGG_VERYRARE, AGG_N_VERYRARE}, { AGG_COMMON, AGG_N_COMMON}, { AGG_ALWAYS, AGG_N_ALWAYS}, { AGG_PACKETS10PEEK, AGG_N_PACKETS10PEEK}, { AGG_PACKETS30PEEK, AGG_N_PACKETS30PEEK}, { AGG_TIMEBASED5S, AGG_N_TIMEBASED5S}, { AGG_TIMEBASED20S, AGG_N_TIMEBASED20S}, { AGG_STARTPEEK, AGG_N_STARTPEEK}, { AGG_LONGPEEK, AGG_N_LONGPEEK}, { AGG_NONE, AGG_N_NONE}, { AGG_HEAVY, AGG_N_HEAVY}, { 0, NULL} }; for (mtk = &mappedKeywords[0]; mtk->value; mtk++) { if (weight & mtk->value) { if (writtedLen) { buf[writtedLen] = ','; writtedLen++; } snprintf(&buf[writtedLen], (len - writtedLen - 1), "%s", mtk->keyword); writtedLen = strlen(buf); } } } /* TODO in the stable release: implement a sort of cryptography, resolving issue of authentication */ bool SniffJokeCli::parse_SjinternalProto(uint8_t *recvd, uint32_t rcvdlen) { struct command_ret blockInfo; /* first sanity check */ if ((uint32_t) rcvdlen < sizeof (blockInfo)) return false; memcpy(&blockInfo, (void *) recvd, sizeof (blockInfo)); /* global transfert sanity check */ if (blockInfo.cmd_len != (uint32_t) rcvdlen) { printf("invalid lenght (received %d, declared %d)\n", rcvdlen, blockInfo.cmd_len); return false; } switch (blockInfo.cmd_type) { case START_COMMAND_TYPE: printf("received (%d bytes) confirm of START command\n", rcvdlen); return printSJStat(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); case STOP_COMMAND_TYPE: printf("received (%d bytes) confirm of STOP command\n", rcvdlen); return printSJStat(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); case QUIT_COMMAND_TYPE: printf("received (%d bytes) confirm of QUIT command\n", rcvdlen); return printSJStat(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); case STAT_COMMAND_TYPE: printf("received (%d bytes) confirm of STAT command\n", rcvdlen); return printSJStat(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); case INFO_COMMAND_TYPE: printf("received (%d bytes) confirm of INFO command\n", rcvdlen); return printSJSessionInfo(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); case LOGLEVEL_COMMAND_TYPE: printf("received (%d bytes) confirm of LOGLEVEL command\n", rcvdlen); return printSJStat(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); case SAVECONF_COMMAND_TYPE: printf("received (%d bytes) confirm of SAVECONF command\n", rcvdlen); return printSJStat(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); case SETPORT_COMMAND_TYPE: printf("received (%d bytes) SET PORT is read only at the moment!\n", rcvdlen); return printSJPort(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); case SHOWPORT_COMMAND_TYPE: printf("received (%d bytes) confirm of SHOW PORT command\n", rcvdlen); return printSJPort(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); case TTLMAP_COMMAND_TYPE: printf("received (%d bytes) confirm of TTL MAP command\n", rcvdlen); return printSJTTL(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); case COMMAND_ERROR_MSG: printf("received (%d bytes) error in command sent\n", rcvdlen); return printSJError(&recvd[sizeof (blockInfo)], rcvdlen - sizeof (blockInfo)); default: printf("invalid command type %d ?\n", blockInfo.cmd_type); } return false; } /* this parse and print the data block exposed in SJ-PROTOCOL.txt: +--------+--------+---------+ | len 1 | who 1 | data 1 | +--------+--------+---------+ ... +--------+--------+---------+ | len N | who N | data N | +--------+--------+---------+ */ bool SniffJokeCli::printSJStat(const uint8_t *statblock, uint32_t blocklen) { uint32_t parsedlen = 0; struct single_block *singleData; while (parsedlen < blocklen) { singleData = (struct single_block *) &statblock[parsedlen]; void *pointed_data = (void *) &statblock[parsedlen + sizeof (struct single_block) ]; /* this are the possibile used storave variables */ bool boolvar = false; uint16_t intvar = 0; char charvar[MEDIUMBUF]; memset(charvar, 0x00, MEDIUMBUF); /* starting the parsing of the blocks */ switch (singleData->WHO) { case STAT_ACTIVE: boolvar = (bool)(*(uint8_t *) pointed_data); printf("SniffJoke\t\t%s\n", boolvar ? "running" : "not running"); break; case STAT_LOCAT: memcpy(&charvar, pointed_data, singleData->len); printf("location name:\t\t%s\n", charvar); break; case STAT_MACGW: memcpy(&charvar, pointed_data, singleData->len); printf("gateway hw address:\t%s\n", charvar); break; case STAT_GWADDR: memcpy(&charvar, pointed_data, singleData->len); printf("gateway IP address:\t%s\n", charvar); break; case STAT_NETIFACENAME: /* WARNING - REMIND: this name "hijacked interface" is grepped in sniffjoke-autotest */ memcpy(&charvar, pointed_data, singleData->len); printf("hijacked interface:\t%s\n", charvar); break; case STAT_NETIFACEIP: /* WARNING: the following name, "hijacked interface etc..." MUST NOT COLLIDE with the grep */ memcpy(&charvar, pointed_data, singleData->len); printf("hijacked local IPaddr:\t%s\n", charvar); break; case STAT_NETIFACEMTU: /* YEP, here too */ memcpy(&intvar, pointed_data, singleData->len); printf("hijacked MTU interface:\t%d\n", intvar); break; case STAT_TUNIFACENAME: memcpy(&charvar, pointed_data, singleData->len); printf("tunnel interface:\t%s\n", charvar); break; case STAT_TUNIFACEIP: memcpy(&charvar, pointed_data, singleData->len); printf("tunnel local IPaddr:\t%s\n", charvar); break; case STAT_TUNIFACEMTU: memcpy(&intvar, pointed_data, singleData->len); printf("tunnel MTU interface:\t%d\n", intvar); break; case STAT_DEBUGL: memcpy(&intvar, pointed_data, singleData->len); printf("debug level:\t\t%d\n", intvar); break; case STAT_BINDA: memcpy(&charvar, pointed_data, singleData->len); printf("admin address:\t\t%s\n", charvar); break; case STAT_BINDP: memcpy(&intvar, pointed_data, singleData->len); printf("admin UDP port:\t\t%d\n", intvar); break; case STAT_USER: memcpy(&charvar, pointed_data, singleData->len); printf("running user:\t\t%s\n", charvar); break; case STAT_GROUP: memcpy(&charvar, pointed_data, singleData->len); printf("running group:\t\t%s\n", charvar); break; case STAT_CHAINING: boolvar = (bool)(*(uint8_t *) pointed_data); printf("hack chaining:\t\t%s\n", boolvar ? "enabled" : "disabled"); break; case STAT_NO_TCP: boolvar = (bool)(*(uint8_t *) pointed_data); printf("tcp mangling:\t\t%s\n", boolvar ? "disabled" : "enabled"); break; case STAT_NO_UDP: boolvar = (bool)(*(uint8_t *) pointed_data); printf("udp mangling:\t\t%s\n", boolvar ? "disabled" : "enabled"); break; case STAT_WHITELIST: boolvar = (bool)(*(uint8_t *) pointed_data); printf("whitelist mode:\t\t%s\n", boolvar ? "enabled" : "disabled"); break; case STAT_BLACKLIST: boolvar = (bool)(*(uint8_t *) pointed_data); printf("blacklist mode:\t\t%s\n", boolvar ? "enabled" : "disabled"); break; case STAT_ONLYP: memcpy(&charvar, pointed_data, singleData->len); printf("single plugin:\t\t%s\n", charvar); break; default: break; } parsedlen += (singleData->len + sizeof (struct single_block)); } return true; } bool SniffJokeCli::printSJSessionInfo(const uint8_t *received, uint32_t rcvdlen) { struct sex_record *sr; uint32_t cnt = 1, i = 0; while (i < rcvdlen) { sr = (struct sex_record *) &received[i]; printf(" %02d) %s %u -> %s:%u #%d (injected %d)\n", cnt, sr->proto == IPPROTO_TCP ? "TCP" : "UDP", ntohs(sr->sport), inet_ntoa(*((struct in_addr *) &(sr->daddr))), ntohs(sr->dport), sr->packet_number, sr->injected_pktnumber ); cnt++; i += sizeof (struct sex_record); } if (!i) { printf("no sessions appear tracked at the moment\n"); } return true; } bool SniffJokeCli::printSJTTL(const uint8_t *received, uint32_t rcvdlen) { struct ttl_record *tr; uint32_t cnt = 1, i = 0; struct tm *tm; char access[SMALLBUF] = {0}; char nextprobe[SMALLBUF] = {0}; while (i < rcvdlen) { tr = (struct ttl_record *) &received[i]; tm = localtime(&tr->access); strftime(access, SMALLBUF, "%d %H:%M:%S", tm); tm = localtime(&tr->nextprobe); strftime(nextprobe, SMALLBUF, "%d %H:%M:%S", tm); printf(" %02d) %s [%s %s] sent #%d recv #%d incoming TTL (%d) ext hop dist %d\n", cnt, inet_ntoa(*((struct in_addr *) &(tr->daddr))), access, nextprobe, tr->sentprobe, tr->receivedprobe, tr->synackval, tr->ttlestimate ); cnt++; i += sizeof (struct ttl_record); } if (!i) { printf("no hosts appear hop-mapped at the moment\n"); } return true; } bool SniffJokeCli::printSJPort(const uint8_t *statblock, uint32_t blocklen) { char resolvedInfo[MEDIUMBUF]; /* the first goal is to detect the de-facto default in your conf */ uint16_t mostValue = AGG_NONE; uint16_t checkingValue = AGG_NONE; uint16_t occurrence = 0; do { uint16_t checking_occ = 0; for (uint32_t parsedlen = 0; parsedlen < blocklen; parsedlen += sizeof (struct port_info)) { struct port_info *pInfo = (struct port_info *) &statblock[parsedlen]; if (checkingValue == pInfo->weight) checking_occ++; } if (checking_occ > occurrence) { mostValue = checkingValue; occurrence = checking_occ; } checkingValue *= 2; } while (checkingValue <= AGG_LONGPEEK); for (uint32_t parsedlen = 0; parsedlen < blocklen; parsedlen += sizeof (struct port_info)) { struct port_info *pInfo = (struct port_info *) &statblock[parsedlen]; if (pInfo->weight == mostValue) continue; resolveWeight(resolvedInfo, sizeof (resolvedInfo), pInfo->weight); if (pInfo->start == pInfo->end) { printf("%d%*s%s\n", pInfo->start, fillingSpaces(pInfo->start), " ", resolvedInfo); } else { printf("%d:%d%*s%s\n", pInfo->start, pInfo->end, fillingSpace(pInfo->start, pInfo->end), " ", resolvedInfo); } } resolveWeight(resolvedInfo, sizeof (resolvedInfo), mostValue); printf("omitted rule from the list is %s and apply to all ports not present on the list\n", resolvedInfo); return true; } bool SniffJokeCli::printSJError(const uint8_t *statblock, uint32_t blocklen) { printf("error - not implemented the parsing of an error - ATM\n"); return true; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/client/SniffJokeCli.h0000644000000000000000000000413613147777044020001 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_SNIFFJOKECLI_H #define SJ_SNIFFJOKECLI_H #include "service/Utils.h" #include #include using namespace std; #define SJCTL_VERSION "0.4.0" #define SJCTL_DEFAULT_TIMEOUT 500 #define SJ_ERROR 1 #define SJ_OK 0 struct command { const char *cmd; int related_args; }; class SniffJokeCli { private: const char *serveraddr; uint16_t serverport; uint32_t ms_timeout; const char *cmd_buffer; uint32_t fillingSpaces(uint16_t); uint32_t fillingSpace(uint16_t, uint16_t); void resolveWeight(char *, size_t, uint32_t); bool parse_SjinternalProto(uint8_t *, uint32_t); bool printSJStat(const uint8_t *, uint32_t); bool printSJPort(const uint8_t *, uint32_t); bool printSJError(const uint8_t *, uint32_t); bool printSJSessionInfo(const uint8_t *, uint32_t); bool printSJTTL(const uint8_t *, uint32_t); public: SniffJokeCli(const char *, uint16_t, uint32_t); /* 0 on success, 1 on error */ int32_t send_command(const char *cmdstring); }; #endif /* SJ_SNIFFJOKECLI_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/client/main.cc0000644000000000000000000001336713147777044016563 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "SniffJokeCli.h" #include #include #include #include using namespace std; static void sjcli_version(const char *pname) { printf("%s: %s\n", pname, SJCTL_VERSION); } #define SNIFFJOKECLI_HELP_FORMAT \ "Usage: %s [OPTIONS]... [COMMANDS]...\n"\ " --address [:port]\tspecify administration IP address [default: %s:%d]\n"\ " --version\t\tshow sniffjoke version\n"\ " --timeout\t\tset milliseconds timeout when contacting SniffJoke service [default: %d]\n"\ " --help\t\t\tshow this help\n\n"\ "when sniffjoke is running, you should send commands with a command line argument:\n"\ " start\t\t\tstart sniffjoke hijacking/injection\n"\ " stop\t\t\tpause sniffjoke\n"\ " quit\t\t\tquit sniffjoke\n"\ " saveconf\t\tdump configuration file\n"\ " stat\t\t\tget statistics about sniffjoke configuration and network\n"\ " info\t\t\tget statistics about sniffjoke active sessions\n"\ " ttlmap\t\t\tshow the mapped hop count for destination\n"\ " showport\t\tshow the running port-aggressivity configuration\n"\ " set start:end value\tset the injection's strogness over selected port [not supported!]\n"\ "\t\tneed to be set in port-aggressivity.conf\n"\ " debug\t\t\t[%d-%d] change the log debug level\n\n"\ "\t\t\thttp://www.delirandom.net/sniffjoke\n" static void sjcli_help(const char *pname) { printf(SNIFFJOKECLI_HELP_FORMAT, pname, DEFAULT_ADMIN_ADDRESS, DEFAULT_ADMIN_PORT, SJCTL_DEFAULT_TIMEOUT, SUPPRESS_LEVEL, PACKET_LEVEL ); } /* return false on error in parsing or when command is not present */ static bool parse_command(char **av, uint32_t ac, struct command *sjcmdlist, char *retcmd) { for (uint32_t i = 0; i < ac; ++i) { struct command *ptr; for (ptr = &sjcmdlist[0]; ptr->cmd != NULL; ++ptr) { if (!strcmp(ptr->cmd, av[i])) { size_t usedlen = 0; snprintf(retcmd, 256, "%s", ptr->cmd); if (ptr->related_args + i > ac) return false; while (--(ptr->related_args)) { usedlen = strlen(retcmd); snprintf(&retcmd[usedlen], 256 - usedlen, " %s", av[++i]); } return true; } } } return false; } int main(int argc, char **argv) { struct sjcli_cmdline_opts { char admin_address[256]; uint16_t admin_port; uint32_t ms_timeout; char cmd_buffer[256]; } useropt; memset(&useropt, 0x00, sizeof (useropt)); /* setting the default defined in SniffJokeCli.h */ snprintf(useropt.admin_address, sizeof (useropt.admin_address), DEFAULT_ADMIN_ADDRESS); useropt.admin_port = DEFAULT_ADMIN_PORT; useropt.ms_timeout = SJCTL_DEFAULT_TIMEOUT; struct command sjcli_command[] = { { "start", 1}, { "stop", 1}, { "quit", 1}, { "saveconf", 1}, { "info", 1}, { "ttlmap", 1}, { "stat", 1}, { "showport", 1}, { "set", 3}, { "clear", 1}, { "debug", 2}, { NULL, 0} }; if (!parse_command(argv, argc, sjcli_command, useropt.cmd_buffer)) { sjcli_help(argv[0]); return -1; } struct option sjcli_option[] = { { "address", required_argument, NULL, 'a'}, { "timeout", required_argument, NULL, 't'}, { "version", no_argument, NULL, 'v'}, { "help", no_argument, NULL, 'h'}, { NULL, 0, NULL, 0} }; int charopt; while ((charopt = getopt_long(argc, argv, "c:a:t:vh", sjcli_option, NULL)) != -1) { switch (charopt) { case 'c': snprintf(useropt.cmd_buffer, sizeof (useropt.cmd_buffer), "%s", optarg); break; case 'a': snprintf(useropt.admin_address, sizeof (useropt.admin_address), "%s", optarg); char* port; if ((port = strchr(useropt.admin_address, ':')) != NULL) { *port = 0x00; int checked_port = atoi(++port); if (checked_port > 65535 || checked_port < 0) goto sniffjokecli_help; useropt.admin_port = (uint16_t) checked_port; } break; case 't': useropt.ms_timeout = atoi(optarg); break; case 'v': sjcli_version(argv[0]); return 0; sniffjokecli_help: case 'h': default: sjcli_help(argv[0]); return -1; argc -= optind; argv += optind; } } SniffJokeCli cli(useropt.admin_address, useropt.admin_port, useropt.ms_timeout); return cli.send_command(useropt.cmd_buffer); } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/CMakeLists.txt0000644000000000000000000000017413147777044020263 0ustar00ADD_SUBDIRECTORY(HDRoptions_probe) ADD_SUBDIRECTORY(payldBreakin) ADD_SUBDIRECTORY(badSync) ADD_SUBDIRECTORY(forcedClosing) sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/HDRoptions_probe/0000755000000000000000000000000013147777044020741 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/PluginsList.txt0000644000000000000000000000263013147777044020540 0ustar00 THE PLUGINS CATEGORY ARE: forcedClosing badSync payldBreakin The division in categories was made because the plugins attack, at this moment, will be divided in three big categories. forcedClosing The plugins inside this directory will try to inject packets who should bring an interruption. If the interruption don't work, is not required try randomly for the entire session length, Common facts about those plugins: 1) Its require an internal caching for inject a limited number inside a connection: these attacks work as "one-shot", if a sniffer follow it, a better mechanism of injection has been evaluated TODO fake_close_fin alredy implement that, is required make some MACROS inside Plugin.cc 2) Its will provide the random internal selection of foreseen the incoming ACK from the received, or to inject a packet that alone make the interruption badSync The injection here placed will damage the reassembled flow internal routines, it try to disrupt the seq-acking in both directions payldBreakin The payload Breaker plugins inject data in a smart way, fragment the packets in different layers, and try the overlapping segment attack (at the moment, under testing). These in the future will be expanded with layer 5 and more, injection HDRoptions_probe Used only by autotest software (called in sj-iptcpopt-probe shell script) sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/badSync/0000755000000000000000000000000013147777044017104 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/forcedClosing/0000755000000000000000000000000013147777044020302 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/payldBreakin/0000755000000000000000000000000013147777044020126 5ustar00sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/HDRoptions_probe/CMakeLists.txt0000644000000000000000000000032113147777044023475 0ustar00ADD_LIBRARY(HDRoptions_probe SHARED HDRoptions_probe.cc) INSTALL(TARGETS HDRoptions_probe DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/HDRoptions_probe/HDRoptions_probe.cc0000644000000000000000000001466313147777044024502 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "service/Plugin.h" #include "service/OptionPool.h" #include "service/HDRoptions.h" class HDRoptions_probe : public Plugin { #define PLUGIN_NAME "HDRoptions_probe" #define LOGNAME "HDRoptions-testing.log" #define MIN_TESTED_LEN 756 private: uint8_t sjOptIndex; pluginLogHandler *pLH; IPTCPopt *underTestOpt; corruption_t CorruptionSet; void applyTestedOption(Packet &target) { TTLFocus dummy(target); if(underTestOpt->optProto == IPPROTO_IP) { HDRoptions IPInjector(IPOPTS_INJECTOR, target, dummy); /* true corrupt: because only one option is set to corrupt, and the boolean marked acts as goal. * true strip previous */ IPInjector.injectSingleOpt(true, true, sjOptIndex ); } else /* IPPROTO_TCP */ { HDRoptions TCPInjector(TCPOPTS_INJECTOR, target, dummy); TCPInjector.injectSingleOpt(true, true, sjOptIndex ); } } public: HDRoptions_probe() : Plugin(PLUGIN_NAME, AGG_ALWAYS) { sjOptIndex = SUPPORTED_OPTIONS; /* the index really valid is SUPPORTED_OPTIONS -1 so this way on error we will trigger an exception */ } /* init is called with pluginName,SCRAMBLE+option, * the option in this case is */ virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { OptionPool *optPool = reinterpret_cast(sjE->instanced_itopts); pLH = new pluginLogHandler(PLUGIN_NAME, LOGNAME); if(pluginOption == NULL || strlen(pluginOption) == 1) { LOG_ALL("fatal: required $PLUGNAME,$SCRAMBLE+$OPTINDEX to be used: refer in the sniffjoke-iptcpoption script"); return false; } CorruptionSet = CORRUPTUNASSIGNED; if(pluginOption[strlen(pluginOption) -1] == 'S') CorruptionSet = ONESHOT; if(pluginOption[strlen(pluginOption) -1] == 'D') CorruptionSet = TWOSHOT; if(CorruptionSet == CORRUPTUNASSIGNED) { LOG_ALL("fatal: invalid usage of corruption selector - 'by hand' usage is neither suggested nor welcomed!"); return false; } char *getIndex = strdup(pluginOption); getIndex[strlen(getIndex) -1] = 0x00; sjOptIndex = atoi(getIndex); free(getIndex); if(sjOptIndex >= SUPPORTED_OPTIONS) { LOG_ALL("fatal: invalid 'option index' passed as arg: required >= 0 && < %d", SUPPORTED_OPTIONS); pLH->completeLog("fatal: invald 'option index' passed as arg: required >= 0 && < %d", SUPPORTED_OPTIONS); return false; } underTestOpt = optPool->get(sjOptIndex); if(underTestOpt->enabled == false) { LOG_ALL("fatal: option index %d accepted [%s] implementation disabled", sjOptIndex, underTestOpt->sjOptName); pLH->completeLog("fatal: 'option index' %d accepted [%s]: implementation disabled", sjOptIndex, underTestOpt->sjOptName); return false; } /* as first, the field "enable" is set to false */ optPool->disableAllOptions(); underTestOpt->enabled = true; /* we need to test NOT_CORRUPT, ONESHOT and TWOSHOT, this function * enable the single function, if disabled */ underTestOpt->optionConfigure(CorruptionSet); pLH->completeLog("Option index [%d] point to %s (opcode %d) and opt string [%s]", sjOptIndex, underTestOpt->sjOptName, underTestOpt->optValue, pluginOption); LOG_ALL("Loading HDRoptions_probe enabling only option [%s] index [%d] corruption %d", pluginOption, sjOptIndex, CorruptionSet); return true; } virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { if (origpkt.chainflag == FINALHACK) return false; return (origpkt.fragment == false && origpkt.proto == TCP && /* our the is apply only in the sniffjoke-autotest packet containing the numbers */ origpkt.tcppayloadlen > MIN_TESTED_LEN); /** * * remind: by hand testing: for x in `seq 1 2000`; do echo -n "$x" >> /tmp/sparedata; done cat /tmp/sparedata | sed -es/6/111/g > /tmp/send curl -s --retry 0 --max-time 10 -d "sparedata=`cat /tmp/send`" -o /tmp/recv http://www.delirandom.net/sjA/pe.php ** */ } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { Packet * pkt = new Packet(origpkt); pkt->randomizeID(); pkt->source = PLUGIN; pkt->position = ANTICIPATION; pkt->choosableScramble = SCRAMBLE_INNOCENT; pkt->wtf = INNOCENT; applyTestedOption(*pkt); removeOrigPkt = true; LOG_PACKET("new Packet injected with opt %s beliving to %s, source pktId i%u", underTestOpt->sjOptName, CorruptionSet == NOT_CORRUPT ? "NOT CORRUPT": "CORRUPT", origpkt.SjPacketId); upgradeChainFlag(pkt); pktVector.push_back(pkt); } }; /* common and ripetitive code block */ extern "C" Plugin* createPluginObj() { return new HDRoptions_probe(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/HDRoptions_probe/HDRoptions_probe_README.txt0000644000000000000000000000116113147777044025736 0ustar00This plugin is not intended to be used in the common sniffjoke daily activities, when is loaded it take a command line options that specify which kind of IP/TCP options will be used in your network. This probe is required, because in some network an options will be discarded and another will be accepted, and in other networks opposite results can happen too. Whenever an hacker/coder/whatever update the IPTCPoptImpl.cc is needed updating sj-iptcp-probe script, the definition in hardcodedDefine.h and make a lot of testing, because the IP/TCP options mangling is the most delicate scrhackmbling ever made :P good luck! sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/badSync/CMakeLists.txt0000644000000000000000000000106713147777044021650 0ustar00ADD_LIBRARY(shift_ack SHARED shift_ack.cc) ADD_LIBRARY(fake_seq SHARED fake_seq.cc) ADD_LIBRARY(fake_window SHARED fake_window.cc) INSTALL(TARGETS shift_ack DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) INSTALL(TARGETS fake_seq DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) INSTALL(TARGETS fake_window DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/badSync/fake_seq.cc0000644000000000000000000000645413147777044021202 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010,2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * when a sniffer collect the file using the sequence as stream offset, injecting a * completely random seq should cause extremely large and empty flow, truncation or * apparently large missinsg block of data. * * SOURCE: phrack, analysis of tcpflow, analysis of wireshark * VERIFIED IN: * KNOW BUGS: * WRITTEN IN VERSION: 0.4.0 */ #include "service/Plugin.h" class fake_seq : public Plugin { #define PLUGIN_NAME "Fake SEQ" public: fake_seq() : Plugin(PLUGIN_NAME, AGG_TIMEBASED5S) { }; virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { supportedScrambles = configuredScramble; return true; } virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { if (origpkt.chainflag == FINALHACK) return false; return (origpkt.fragment == false && origpkt.proto == TCP && !origpkt.tcp->syn && !origpkt.tcp->rst && !origpkt.tcp->fin && origpkt.tcppayload != NULL); } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { Packet * const pkt = new Packet(origpkt); pkt->randomizeID(); /* under test the anticipation seq only */ pkt->tcp->seq = htonl(ntohl(pkt->tcp->seq) + (random() % 5000) + 300); /* pkt->tcp->seq = htonl(ntohl(pkt->tcp->seq) - (random() % 5000)); */ pkt->tcp->window = htons((random() % 80) * 64); pkt->tcp->ack = pkt->tcp->ack_seq = 0; uint16_t newpayloadlen = random() % 100 + 200; pkt->tcppayloadResize(newpayloadlen); pkt->tcppayloadRandomFill(); pkt->source = PLUGIN; pkt->position = ANTICIPATION; pkt->wtf = pktRandomDamage(availableScrambles, supportedScrambles); pkt->choosableScramble = availableScrambles & supportedScrambles; upgradeChainFlag(pkt); pktVector.push_back(pkt); } }; extern "C" Plugin* createPluginObj() { return new fake_seq(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/badSync/fake_window.cc0000644000000000000000000000644013147777044021714 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * this hack alters the window value perceived by the sniffer for our source * * could be useful for futuer hacks. * * * SOURCE : deduction, whishful thinking * VERIFIED IN : * KNOW BUGS : * WRITTEN IN VERSION : 0.4.0 */ #include "service/Plugin.h" class fake_window : public Plugin { #define PLUGIN_NAME "Fake WINDOW" public: fake_window() : Plugin(PLUGIN_NAME, AGG_ALWAYS) { }; virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { supportedScrambles = configuredScramble; return true; } virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { if (origpkt.chainflag != HACKUNASSIGNED) return false; return (origpkt.fragment == false && origpkt.proto == TCP && !origpkt.tcp->syn && !origpkt.tcp->rst && !origpkt.tcp->fin); } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { Packet * const pkt = new Packet(origpkt); pkt->randomizeID(); /* all to re - do */ if (random_percent(50)) pkt->tcp->window = 0; /* ZERO WINDOW */ else memset_random(&(pkt->tcp->window), sizeof (pkt->tcp->window)); /* WINDOW UPDATE */ /* a zero/update window could ack segments */ if (random_percent(66)) { pkt->tcp->ack = 1; memset_random(&(pkt->tcp->ack_seq), sizeof (pkt->tcp->ack_seq)); } else { pkt->tcp->ack = 0; pkt->tcp->ack_seq = 0; } pkt->tcp->psh = 0; pkt->tcppayloadResize(0); pkt->source = PLUGIN; pkt->position = ANY_POSITION; pkt->wtf = pktRandomDamage(availableScrambles, supportedScrambles); pkt->choosableScramble = (availableScrambles & supportedScrambles); upgradeChainFlag(pkt); pktVector.push_back(pkt); } }; extern "C" Plugin* createPluginObj() { return new fake_window(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/badSync/shift_ack.cc0000644000000000000000000000620213147777044021346 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * Some sniffer don't keep attention to the sequence and the data, but to * the acknowledge sequence number. a shift sequence hack work sending a fake * ACK-packet with a seq_ack totally wrong. this was one of the hacks I've tried * to use without GUILTY/PRESCRIPTION invalidation, but as INNOCENT, because * if the ack is shifted more than the window value, the remote host must * invalidate them * * SOURCE: deduction, * VERIFIED IN: * KNOW BUGS: * WRITTEN IN VERSION: 0.4.0 */ #include "service/Plugin.h" class shift_ack : public Plugin { #define PLUGIN_NAME "unexpected ACK shift" public: shift_ack() : Plugin(PLUGIN_NAME, AGG_RARE) { } virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { supportedScrambles = configuredScramble; return true; } virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { if (origpkt.chainflag == FINALHACK) return false; return (origpkt.fragment == false && origpkt.proto == TCP && !origpkt.tcp->syn && !origpkt.tcp->rst && !origpkt.tcp->fin && origpkt.tcp->ack); } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { Packet * const pkt = new Packet(origpkt); pkt->randomizeID(); pkt->tcp->ack_seq = htonl(ntohl(pkt->tcp->ack_seq) - pkt->maxMTU() + random() % 2 * pkt->maxMTU()); pkt->source = PLUGIN; pkt->position = ANY_POSITION; pkt->wtf = pktRandomDamage(availableScrambles, supportedScrambles); pkt->choosableScramble = (availableScrambles & supportedScrambles); pkt->payloadRandomFill(); upgradeChainFlag(pkt); pktVector.push_back(pkt); } }; extern "C" Plugin* createPluginObj() { return new shift_ack(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/forcedClosing/CMakeLists.txt0000644000000000000000000000144613147777044023047 0ustar00ADD_LIBRARY(fake_close_rst SHARED fake_close_rst.cc) ADD_LIBRARY(fake_close_fin SHARED fake_close_fin.cc) ADD_LIBRARY(valid_rst_fake_seq SHARED valid_rst_fake_seq.cc) ADD_LIBRARY(fake_syn SHARED fake_syn.cc) INSTALL(TARGETS fake_close_rst DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) INSTALL(TARGETS fake_close_fin DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) INSTALL(TARGETS valid_rst_fake_seq DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) INSTALL(TARGETS fake_syn DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/forcedClosing/fake_close_fin.cc0000644000000000000000000001336713147777044023552 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * fake close is used because a sniffer could read a FIN like a session closing * tcp-flag, and stop the session monitoring/reassembly. * * SOURCE: phrack, deduction * VERIFIED IN: * KNOW BUGS: */ #include "service/Plugin.h" class fake_close_fin : public Plugin { #define PLUGIN_NAME "Fake FIN" #define PKT_LOG "plugin.fake_close_fin.log" #define MIN_INJECTED_PKTS 4 #define MAX_INJECTED_PKTS 10 private: pluginLogHandler pLH; /* every hack in "forcedClosing" will be useful "few times in a session", not for the * entire duration of the connections: for this reason is kept a cache record to count every * time a condition is returned "true" * * MIN_INJECTED_PKTS mean the minimum packets possibile, between MIN < x < MAX, the probability * to be true the condition use an inverted probability, until reach MAX, than will never be * injected again. * * this is implemented in the condition check and the useful generic method are implemented * in Plugin class, explanation useful will be found in ../PluginList.txt */ PluginCache FINcache; public: fake_close_fin() : Plugin(PLUGIN_NAME, AGG_PACKETS30PEEK), pLH(PLUGIN_NAME, PKT_LOG) { } virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { supportedScrambles = configuredScramble; return true; } virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { if (origpkt.chainflag == FINALHACK || origpkt.proto != TCP || origpkt.fragment == true) return false; pLH.completeLog("verifing condition for ip.id %d Sj#%u (dport %u) datalen %d total len %d", ntohs(origpkt.ip->id), origpkt.SjPacketId, ntohs(origpkt.tcp->dest), origpkt.tcppayloadlen, origpkt.pbuf.size()); /* preliminar condition, TCP and fragment already checked */ bool ret = (!origpkt.tcp->syn && !origpkt.tcp->rst && !origpkt.tcp->fin ); if (!ret) return false; /* cache checking, using the methods provide in the section 'forcedClosing' of Plugin.cc */ cacheRecord* matchRecord; if((matchRecord = verifyIfCache(&(tupleMatch), &FINcache, origpkt)) != NULL) { uint32_t *injectedYet = (uint32_t*)&(matchRecord->cached_data[0]); /* if is present, inverseProp, return true with decreasing probability up to MAX_INJ */ ret = inverseProportionality(*injectedYet, MIN_INJECTED_PKTS, MAX_INJECTED_PKTS); if(ret) { ++(*injectedYet); pLH.completeLog("packets in session #%d %s:%u Sj.hack %s (min %d max %d)", *injectedYet, inet_ntoa(*((struct in_addr *) &(origpkt.ip->daddr))), ntohs(origpkt.tcp->dest), ret ? "TRUE" : "FALSE", MIN_INJECTED_PKTS, MAX_INJECTED_PKTS); } } return ret; } void fixPushFin(Packet * const pkt, uint8_t availableScrambles) { pkt->randomizeID(); pkt->tcp->fin = 1; pkt->source = PLUGIN; pkt->position = ANTICIPATION; pkt->wtf = pktRandomDamage(availableScrambles, supportedScrambles); pkt->choosableScramble = (availableScrambles & supportedScrambles); pkt->chainflag = FINALHACK; pktVector.push_back(pkt); } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { /* the sniffer trust the FIN because has the last sequence number + 1 */ if (random_percent(80)) { Packet * const pkt = new Packet(origpkt); pkt->tcp->seq = htonl(ntohl(pkt->tcp->seq) - pkt->tcppayloadlen + 1); pkt->tcppayloadResize(0); pkt->tcp->psh = 0; fixPushFin(pkt, availableScrambles); pLH.completeLog("injection with seq/push modification, id %d (psh %d ack %d)", ntohs(pkt->ip->id), pkt->tcp->psh, pkt->tcp->ack ); } /* the sniffer trust the FIN because does see a coherent ack_seq in answer */ if (random_percent(80)) { Packet * const pkt = new Packet(origpkt); fixPushFin(pkt, availableScrambles); pLH.completeLog("injection with seq/push coherence keeping, id %d (psh %d ack %d)", ntohs(pkt->ip->id), pkt->tcp->psh, pkt->tcp->ack); } } }; extern "C" Plugin* createPluginObj() { return new fake_close_fin(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/forcedClosing/fake_close_rst.cc0000644000000000000000000001211513147777044023574 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * fake close is used because a sniffer could read a FIN like a session closing * tcp-flag, and stop the session monitoring/reassembly. * * SOURCE: phrack, deduction * VERIFIED IN: * KNOW BUGS: fastweb network (italian wire provider), should not support this hack * because the HAG close the session at the first valid RST exiting * from your box. */ #include "service/Plugin.h" class fake_close_rst : public Plugin { #define PLUGIN_NAME "Fake RST" #define PKT_LOG "plugin.fake_close_rst.log" #define MIN_INJECTED_PKTS 4 #define MAX_INJECTED_PKTS 10 private: pluginLogHandler pLH; /* every hack in "forcedClosing" will be useful "few times in a session", not for the * entire duration of the connections: for this reason is kept a cache record to count every * time a condition is returned "true" * * MIN_INJECTED_PKTS mean the minimum packets possibile, between MIN < x < MAX, the probability * to be true the condition use an inverted probability, until reach MAX, than will never be * injected again. * * this is implemented in the condition check and the useful generic method are implemented * in Plugin class, explanation useful will be found in ../PluginList.txt */ PluginCache RSTcache; public: fake_close_rst() : Plugin(PLUGIN_NAME, AGG_PACKETS30PEEK), pLH(PLUGIN_NAME, PKT_LOG) { }; virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { supportedScrambles = configuredScramble; return true; } virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { if (origpkt.chainflag == FINALHACK || origpkt.proto != TCP || origpkt.fragment == true) return false; pLH.completeLog("verifing condition for ip.id %d Sj#%u (dport %u) datalen %d total len %d", ntohs(origpkt.ip->id), origpkt.SjPacketId, ntohs(origpkt.tcp->dest), origpkt.tcppayloadlen, origpkt.pbuf.size()); /* preliminar condition, TCP and fragment already checked */ bool ret = (!origpkt.tcp->syn && !origpkt.tcp->rst && !origpkt.tcp->fin ); if (!ret) return false; /* cache checking, using the methods provide in the section 'forcedClosing' of Plugin.cc */ cacheRecord* matchRecord; if((matchRecord = verifyIfCache(&(tupleMatch), &RSTcache, origpkt)) != NULL) { uint32_t *injectedYet = (uint32_t*)&(matchRecord->cached_data[0]); /* if is present, inverseProp, return true with decreasing probability up to MAX_INJ */ ret = inverseProportionality(*injectedYet, MIN_INJECTED_PKTS, MAX_INJECTED_PKTS); if(ret) { ++(*injectedYet); pLH.completeLog("packets in session #%d %s:%u Sj.hack %s (min %d max %d)", *injectedYet, inet_ntoa(*((struct in_addr *) &(origpkt.ip->daddr))), ntohs(origpkt.tcp->dest), ret ? "TRUE" : "FALSE", MIN_INJECTED_PKTS, MAX_INJECTED_PKTS); } } return ret; } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { Packet * const pkt = new Packet(origpkt); pkt->randomizeID(); pkt->tcp->psh = 0; pkt->tcp->rst = 1; pkt->tcp->seq = htonl(ntohl(pkt->tcp->seq) - pkt->tcppayloadlen + 1); pkt->tcppayloadResize(0); pkt->source = PLUGIN; pkt->position = ANTICIPATION; pkt->wtf = pktRandomDamage(availableScrambles, supportedScrambles); pkt->choosableScramble = (availableScrambles & supportedScrambles); pkt->chainflag = FINALHACK; pktVector.push_back(pkt); } }; extern "C" Plugin* createPluginObj() { return new fake_close_rst(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/forcedClosing/fake_syn.cc0000644000000000000000000000713113147777044022412 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * a SYN packet, in a sniffer reassembly routine should mean the allocation/ * opening of a new flow. if this syn packet collide with a previously * allocated tuple, what happen ? * * SOURCE: deduction * VERIFIED IN: * KNOW BUGS: * WRITTEN IN VERSION: 0.4.0 */ #include "service/Plugin.h" class fake_syn : public Plugin { #define PLUGIN_NAME "Fake SYN" public: fake_syn() : Plugin(PLUGIN_NAME, AGG_RARE) { }; virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { supportedScrambles = configuredScramble; return true; } virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { if (origpkt.chainflag == FINALHACK) return false; return (origpkt.fragment == false && origpkt.proto == TCP && origpkt.tcp->syn && !origpkt.tcp->rst && !origpkt.tcp->fin); } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { for (uint8_t pkts = 0; pkts < 2; pkts++) { Packet * const pkt = new Packet(origpkt); pkt->randomizeID(); pkt->tcp->seq = htonl(ntohl(pkt->tcp->seq) + 65535 + (random() % 5000)); /* 20% is a SYN ACK */ if ((random() % 5) == 0) { pkt->tcp->ack = 1; pkt->tcp->ack_seq = random(); } else { pkt->tcp->ack = 0; pkt->tcp->ack_seq = 0; } /* 20% had source and dest port reversed */ if ((random() % 5) == 0) { uint16_t swap = pkt->tcp->source; pkt->tcp->source = pkt->tcp->dest; pkt->tcp->dest = swap; } pkt->source = PLUGIN; if (pkts == 0) /* first packet */ pkt->position = ANTICIPATION; else /* second packet */ pkt->position = POSTICIPATION; pkt->wtf = pktRandomDamage(availableScrambles, supportedScrambles); pkt->choosableScramble = (availableScrambles & supportedScrambles); upgradeChainFlag(pkt); pktVector.push_back(pkt); } } }; extern "C" Plugin* createPluginObj() { return new fake_syn(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/forcedClosing/valid_rst_fake_seq.cc0000644000000000000000000001315113147777044024437 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * A reset must be ignored if the ack value is more than last_ack_seq + window, * this is a path due to the denial of service named * "Slipping in the window: TCP Reset attacks", linked below * this is another ack working in INNOCENT mode, not with GUILTY/PRESCRIPTION * * SOURCE: deduction, analysis of the DoS [ http://kerneltrap.org/node/3072 ] * VERIFIED IN: * KNOW BUGS: * WRITTEN IN VERSION: 0.4.0 * */ #include "service/Plugin.h" class valid_rst_fake_seq : public Plugin { #define PLUGIN_NAME "valid offseq RST " #define PKT_LOG "plugin.valid_offseq_rst.log" #define MIN_INJECTED_PKTS 4 #define MAX_INJECTED_PKTS 10 private: pluginLogHandler pLH; /* every hack in "forcedClosing" will be useful "few times in a session", not for the * entire duration of the connections: for this reason is kept a cache record to count every * time a condition is returned "true" * * MIN_INJECTED_PKTS mean the minimum packets possibile, between MIN < x < MAX, the probability * to be true the condition use an inverted probability, until reach MAX, than will never be * injected again. * * this is implemented in the condition check and the useful generic method are implemented * in Plugin class, explanation useful will be found in ../PluginList.txt */ PluginCache OFFRSTcache; public: valid_rst_fake_seq() : Plugin(PLUGIN_NAME, AGG_PACKETS30PEEK), pLH(PLUGIN_NAME, PKT_LOG) { }; virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { if (!(ISSET_INNOCENT(configuredScramble) && !ISSET_INNOCENT(~configuredScramble))) { LOG_ALL("%s plugin supports only INNOCENT scramble type", PLUGIN_NAME); return false; } supportedScrambles = SCRAMBLE_INNOCENT; return true; } virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { if (origpkt.chainflag == FINALHACK || origpkt.proto != TCP || origpkt.fragment == true) return false; pLH.completeLog("verifing condition for ip.id %d Sj#%u (dport %u) datalen %d total len %d", ntohs(origpkt.ip->id), origpkt.SjPacketId, ntohs(origpkt.tcp->dest), origpkt.tcppayloadlen, origpkt.pbuf.size()); /* preliminar condition, TCP and fragment already checked */ bool ret = (!origpkt.tcp->syn && !origpkt.tcp->rst && !origpkt.tcp->fin ); if (!ret) return false; /* cache checking, using the methods provide in the section 'forcedClosing' of Plugin.cc */ cacheRecord* matchRecord; if((matchRecord = verifyIfCache(&(tupleMatch), &OFFRSTcache, origpkt)) != NULL) { uint32_t *injectedYet = (uint32_t*)&(matchRecord->cached_data[0]); /* if is present, inverseProp, return true with decreasing probability up to MAX_INJ */ ret = inverseProportionality(*injectedYet, MIN_INJECTED_PKTS, MAX_INJECTED_PKTS); if(ret) { ++(*injectedYet); pLH.completeLog("packets in session #%d %s:%u Sj.hack %s (min %d max %d)", *injectedYet, inet_ntoa(*((struct in_addr *) &(origpkt.ip->daddr))), ntohs(origpkt.tcp->dest), ret ? "TRUE" : "FALSE", MIN_INJECTED_PKTS, MAX_INJECTED_PKTS); } } return ret; } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { Packet * const pkt = new Packet(origpkt); pkt->randomizeID(); pkt->tcp->rst = 1; pkt->tcp->seq = htonl(ntohl(pkt->tcp->seq) + (65535 * 5) + (random() % 65535) ); pkt->tcp->window = htons((uint16_t) (-1)); /* tcp->ack and tcp->ack_seq is kept untouched */ pkt->tcp->psh = 0; pkt->tcppayloadResize(0); pkt->source = PLUGIN; pkt->position = ANY_POSITION; pkt->wtf = INNOCENT; /* useless, INNOCENT is never downgraded in last_pkt_fix, but safe */ pkt->choosableScramble = SCRAMBLE_INNOCENT; /* this packet will became dangerous if hacked again... is an INNOCENT RST based on the seq... */ pkt->chainflag = FINALHACK; pktVector.push_back(pkt); } }; extern "C" Plugin* createPluginObj() { return new valid_rst_fake_seq(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/payldBreakin/CMakeLists.txt0000644000000000000000000000142413147777044022667 0ustar00ADD_LIBRARY(fragmentation SHARED fragmentation.cc) ADD_LIBRARY(segmentation SHARED segmentation.cc) ADD_LIBRARY(overlap_packet SHARED overlap_packet.cc) ADD_LIBRARY(fake_data SHARED fake_data.cc) INSTALL(TARGETS fragmentation DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) INSTALL(TARGETS segmentation DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) INSTALL(TARGETS overlap_packet DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) INSTALL(TARGETS fake_data DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/${PROJECT_NAME} PERMISSIONS OWNER_READ GROUP_READ WORLD_READ) sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/payldBreakin/fake_data.cc0000644000000000000000000001233013147777044022333 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * this hack injects two packets (that will be invalidated with TTL expiring * or bad ip options or bad checksum) of the same length of the original packet, * one BEFORE and one AFTER the real packet. this cause that the sniffer, that * eventually confirms the readed data when the data was acknowledged, to * memorize the first packet or the last only (because they share the same * sequence number). the reassembled flow appears overridden by the data here * injected. shoulds be the leverage for an applicative injection (like a * fake mail instead of the real mail, etc...) * * the hack varies in relation to the packet trying to achive the maximum effect. * * 1) if the packet is an ip fragment applies fake_fragment(); * 2) if the packet is a tcp segment applies fake_segment(); * 3) if the packet is a udp datagram applies fake_datagram(); * * SOURCE: deduction, analysis of libnids * VERIFIED IN: * KNOW BUGS: * WRITTEN IN VERSION: 0.4.0 */ #include "service/Plugin.h" class fake_data : public Plugin { #define PLUGIN_NAME "Fake Data" private: Packet* fake_fragment(const Packet &origpkt) { Packet * const pkt = new Packet(origpkt); return pkt; } Packet* fake_segment(const Packet &origpkt) { Packet * const pkt = new Packet(origpkt); pkt->tcp->rst = 0; pkt->tcp->fin = 0; /* before, psh was random 50% to be set or not. now I keep the orig */ /* urg pointer is not used and is a little off topic handle here */ #if 0 if (random_percent(50)) { pkt->tcp->urg = 1; pkt->tcp->urg_ptr = pkt->tcp->seq << random() % 5; } else { pkt->tcp->urg = 0; } #endif return pkt; } Packet* fake_datagram(const Packet &origpkt) { Packet * const pkt = new Packet(origpkt); return pkt; } public: fake_data() : Plugin(PLUGIN_NAME, AGG_COMMON) { }; virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { supportedScrambles = configuredScramble; return true; } virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { if (origpkt.chainflag == FINALHACK) return false; if (origpkt.fragment) return true; /* a fake data apply only if a data exists */ if (origpkt.proto == TCP && origpkt.tcppayloadlen > 0) return true; if (origpkt.proto == UDP && origpkt.udppayloadlen > 0) return true; return false; } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { judge_t selectedScramble = pktRandomDamage(availableScrambles, supportedScrambles); Packet * (fake_data::*perProtoFunction)(const Packet &) = NULL; if (origpkt.fragment == false) { if (origpkt.proto == TCP && origpkt.tcppayload != NULL) perProtoFunction = &fake_data::fake_segment; else if (origpkt.proto == UDP && origpkt.udppayload != NULL) perProtoFunction = &fake_data::fake_datagram; } else { perProtoFunction = &fake_data::fake_fragment; } if (perProtoFunction == NULL) return; for (uint8_t pkts = 0; pkts < 2; pkts++) { Packet* pkt = (this->*perProtoFunction)(origpkt); pkt->randomizeID(); pkt->source = PLUGIN; if (pkts == 0) /* first packet */ pkt->position = ANTICIPATION; else /* second packet */ pkt->position = POSTICIPATION; pkt->wtf = selectedScramble; pkt->choosableScramble = (availableScrambles & supportedScrambles); pkt->tcppayloadRandomFill(); upgradeChainFlag(pkt); pktVector.push_back(pkt); } } }; extern "C" Plugin* createPluginObj() { return new fake_data(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/payldBreakin/fragmentation.cc0000644000000000000000000001635113147777044023301 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * http://en.wikipedia.org/wiki/IPv4#Fragmentation * * this hack simply does a massive fragmentation of a ip packet (or fragment itself). * this could help to bypass some simple sniffers and ids. * * SOURCE: fragmentation historically is a pain in the ass for whom code firewall & sniffer * VERIFIED IN: * KNOW BUGS: */ #include "service/Plugin.h" class fragmentation : public Plugin { #define PLUGIN_NAME "Fragmentation" #define PKT_LOG "plugin.fragmentation.log" /* RFC 791 states: * "Every internet module must be able to forward a datagram of 68 * octets without further fragmentation. This is because an internet * header may be up to 60 octets, and the minimum fragment is 8 octets." */ #define MIN_EXIST_PAYLOAD 8 /* * An IP Fragment Too Small exploit is when any fragment other than the final fragment * is less than 400 bytes, indicating that the fragment is likely intentionally crafted. * Small fragments may be used in denial of service attacks or in an attempt to bypass * security measures or detection. -- we don't want trigger this alarm! * https://secure.wikimedia.org/wikipedia/en/wiki/IP_fragmentation_attacks */ #define MIN_USABLE_MTU 576 #define MIN_HANDLING_LEN (MIN_USABLE_MTU + MIN_EXIST_PAYLOAD) /* space kept beside iphdr for ip options injection: the payload remaning = 68 * 8 */ #define MIN_OPTION_RESERVED 12 private: pluginLogHandler pLH; /* the cache is used for keep track of the packet loss impact over a fragmented session */ PluginCache FRAGcache; public: fragmentation() : Plugin(PLUGIN_NAME, AGG_ALWAYS), pLH(PLUGIN_NAME, PKT_LOG) { } virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { if (!(ISSET_INNOCENT(configuredScramble) && !ISSET_INNOCENT(~configuredScramble))) { LOG_ALL("%s plugin supports only INNOCENT scramble type", PLUGIN_NAME); return false; } pLH.completeLog("Initialization of fragmentation plugin (in the future, will be a scramble)"); supportedScrambles = SCRAMBLE_INNOCENT; return true; } virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { bool ret; if (origpkt.chainflag == FINALHACK || origpkt.proto != TCP || origpkt.fragment == true) return false; if (!(availableScrambles & supportedScrambles)) { origpkt.SELFLOG("no scramble avalable for %s", PLUGIN_NAME); return false; } /* we didn't check "origpkt.ip->frag_off & htons(IP_DF)" because want to _force_ frag */ ret = (origpkt.ippayloadlen >= MIN_HANDLING_LEN); pLH.completeLog("verified condition for ip.id %d Sj#%u ip payld %d tcp payld %d total len %d: %s", ntohs(origpkt.ip->id), origpkt.SjPacketId, origpkt.ippayloadlen, origpkt.tcppayloadlen, origpkt.pbuf.size(), ret ? "ACCEPT" : "REJECT"); return ret; } Packet * create_fragment(const Packet &origpkt, uint16_t since, uint16_t len) { Packet * ret = new Packet(origpkt, since, len, MIN_USABLE_MTU); ret->source = PLUGIN; /* the orig packet is removed, the position has no particular importance for the hack * anyway ANTICIPATION keep packets trasmission ordered. */ ret->position = ANTICIPATION; /* we keep the origpkt.wtf to permit this hack to segment both good and evil pkts */ ret->wtf = origpkt.wtf; /* will be re-hacked, of couse, also if not all plugins supports frag */ upgradeChainFlag(ret); return ret; } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { uint16_t start = 0; uint16_t tobesend = origpkt.ippayloadlen; Packet * fragPkt; /* fragDataLen is 544 byte of ip payload */ uint16_t fragDataLen = (MIN_USABLE_MTU - (sizeof(struct iphdr) + MIN_OPTION_RESERVED) ); /* ** ** ** * choose if generate TWO or THREE fragments: * * REMIND/TODO/WISHLIST: declaring our MTU to $ALOT, sniffjoke will choose internally if use * TCP segmentation or IP fragmentation, where is possibile. * ** ** **/ int32_t not_last_pkts; /* packets with (tcp + data) > 1088 are splitted in three, one "last pkts" is always present */ if (( origpkt.ippayloadlen - (fragDataLen * 2) ) > 0 ) not_last_pkts = 2; else not_last_pkts = 1; /* create the 1st (and 2nd ?) fragments */ do { fragPkt = create_fragment(origpkt, start, fragDataLen); fragPkt->choosableScramble = (availableScrambles & supportedScrambles); fragPkt->ip->frag_off = htons( (start >> 3) & IP_OFFMASK); pLH.completeLog("%d (Sj#%u) totl %d start %d fragl %u (tobesnd %d) frag_off %u origseq %u origippld %u", not_last_pkts, fragPkt->SjPacketId, fragPkt->pbuf.size(), start, fragDataLen, tobesend, ntohs(fragPkt->ip->frag_off), ntohl(origpkt.tcp->seq), origpkt.ippayloadlen ); fragPkt->ip->frag_off |= htons(IP_MF); pktVector.push_back(fragPkt); start += fragDataLen; tobesend -= fragDataLen; } while(--not_last_pkts); /* create the last fragment */ fragPkt = create_fragment(origpkt, start, tobesend); fragPkt->choosableScramble = (availableScrambles & supportedScrambles); fragPkt->ip->frag_off = htons( (start >> 3) & IP_OFFMASK); pktVector.push_back(fragPkt); pLH.completeLog("final fragment (Sj#%u) size %d start %d (frag_off %u) orig seq %u", fragPkt->SjPacketId, fragPkt->pbuf.size(), start, ntohs(fragPkt->ip->frag_off), ntohl(origpkt.tcp->seq) ); removeOrigPkt = true; } }; extern "C" Plugin* createPluginObj() { return new fragmentation(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/payldBreakin/overlap_packet.cc0000644000000000000000000001523213147777044023437 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . * this research is dedicated to: http://www.youtube.com/watch?v=63FbXbJEmIs */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * This hack overlap one fake data sent before a real one; * did the remote kernel keep the first or the earliest ? * seems that windows and unix have different behaviour! * * SOURCE: * VERIFIED IN: * KNOW BUGS: * WRITTEN IN VERSION: 0.4.0 */ #include "service/Plugin.h" class overlap_packet : public Plugin { #define PLUGIN_NAME "Overlap Packet" #define PKT_LOG "plugin.overlap_packet.log" #define MIN_PACKET_OVERTRY 200 #define SEQINFO 1 private: pluginLogHandler pLH; /* * how does it works ? * suppose to have a packet long 200 byte with sequcence X * * this plugin will send: * seq X len 60 * seq (X + 40) len 80 (and cache, X + 120 value) * seq X len 200 * seq (X + 120) len 80 (and cache ? boh!) * * when the incoming check found an ack_seq of X + 60, drop it. */ PluginCache OVRLAPcache; Packet * create_segment(const Packet &pkt, uint32_t seqOff, uint16_t newTcplen, bool cache, bool psh, bool ackkeep) { Packet * ret = new Packet(pkt); ret->randomizeID(); ret->tcp->seq = htonl( ntohl(ret->tcp->seq) + seqOff ); pLH.completeLog("creation of %d: seqOff %d (%u) new len %d + cache (%s) push (%s) ack (%s)", ret->SjPacketId, seqOff, ntohl(ret->tcp->seq), newTcplen, cache ? "YES" : "NO", psh ? "YES" : "NO", ackkeep ? "YES" : "NO"); if(newTcplen != ret->tcppayloadlen) { ret->tcppayloadResize(newTcplen); memset_random(ret->tcppayload, newTcplen); } if(!psh) { ret->tcp->psh = 0; } /* this is checked in every generated packet, to avoid ack duplications */ if(!ackkeep) { ret->tcp->ack = 0; ret->tcp->ack_seq = 0; } ret->source = PLUGIN; ret->wtf = INNOCENT; ret->choosableScramble = SCRAMBLE_INNOCENT; upgradeChainFlag(ret); if(cache) { uint32_t expectedAck = htonl(ntohl(ret->tcp->seq) + newTcplen); pLH.completeLog("+ expected Ack %u added to the cache (orig seq %u)", ntohl(expectedAck), ntohl(ret->tcp->seq) ); OVRLAPcache.add(*ret, (const unsigned char *)&expectedAck, sizeof(expectedAck)); } else { uint32_t dbg = (ntohl(ret->tcp->seq) + newTcplen); pLH.completeLog("? debug: orig seq %u ack_seq %u pushed len %d (w/out cache)", ntohl(ret->tcp->seq), (dbg), newTcplen ); } return ret; } public: overlap_packet() : Plugin(PLUGIN_NAME, AGG_RARE), pLH(PLUGIN_NAME, PKT_LOG) { } virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { if (!(ISSET_INNOCENT(configuredScramble) && !ISSET_INNOCENT(~configuredScramble))) { LOG_ALL("%s plugin supports only INNOCENT scramble type", pluginName); return false; } supportedScrambles = SCRAMBLE_INNOCENT; return true; } virtual void mangleIncoming(Packet &inpkt) { if( ntohs(inpkt.tcp->source) != 80 ) return; cacheRecord *acked = OVRLAPcache.check(&ackedseqMatch, inpkt); if (acked != NULL) { pLH.completeLog("! ack-seq match: (%u) packet removed", ntohl(inpkt.tcp->ack_seq)); removeOrigPkt = true; } else pLH.completeLog("# incoming ack_seq (%u) not removed", ntohl(inpkt.tcp->ack_seq)); } /* the only acceptable Scramble is INNOCENT, because the hack is based on * overlap the fragment of the same packet */ virtual bool condition(const Packet &origpkt, uint8_t availableScrambles) { if (origpkt.chainflag != HACKUNASSIGNED) return false; if (origpkt.chainflag == FINALHACK || origpkt.proto != TCP || origpkt.fragment == true) return false; /* pLH.completeLog("verifing condition for ip.id %d Sj#%u (dport %u) datalen %d total len %d seq %u", ntohs(origpkt.ip->id), origpkt.SjPacketId, ntohs(origpkt.tcp->dest), origpkt.tcppayloadlen, origpkt.pbuf.size(), ntohl(origpkt.tcp->seq) ); */ /* preliminar condition, TCP and fragment already checked */ bool ret = (!origpkt.tcp->syn && !origpkt.tcp->rst && origpkt.tcppayload != NULL && origpkt.tcppayloadlen > MIN_PACKET_OVERTRY); if (!ret) return false; return ret; } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { Packet * const pkt1 = create_segment(origpkt, 0, 60, false, false, true); pkt1->position = ANTICIPATION; pktVector.push_back(pkt1); Packet * const pkt2 = create_segment(origpkt, 40, 80, true, false, false); pkt2->position = ANTICIPATION; pktVector.push_back(pkt2); Packet * const pkt3 = create_segment(origpkt, 0, origpkt.tcppayloadlen, false, true, false); pkt3->position = ANTICIPATION; pktVector.push_back(pkt3); Packet * const pkt4 = create_segment(origpkt, 120, 80, false, false, false); pkt4->position = POSTICIPATION; pktVector.push_back(pkt4); removeOrigPkt = true; } }; extern "C" Plugin* createPluginObj() { return new overlap_packet(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/plugins/payldBreakin/segmentation.cc0000644000000000000000000002021013147777044023125 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * HACK COMMENT:, every hacks require intensive comments because should cause * malfunction, or KILL THE INTERNET :) * * this hack simply does a massive segmentation of a tcp packet; * this could help to bypass some simple sniffers and ids. * * * SOURCE: deduction, * VERIFIED IN: * KNOW BUGS: * WRITTEN IN VERSION: 0.4.0 */ #include "service/Plugin.h" class segmentation : public Plugin { #define PLUGIN_NAME "TCP Segmentation" #define PKT_LOG "plugin.segmentation.log" #define MIN_SPLIT_PAYLOAD 500 /* bytes */ #define MIN_SPLIT_PKTS 2 #define MAX_SPLIT_PKTS 5 #define MIN_TCP_PAYLOAD (MIN_SPLIT_PKTS * MIN_SPLIT_PAYLOAD) private: pluginLogHandler pLH; PluginCache cache; static bool filter(const cacheRecord &record, const Packet &pkt) { const Packet &refpkt = record.cached_packet; const uint32_t realnextseq = ntohl(refpkt.tcp->seq) + refpkt.tcppayloadlen; return (refpkt.ip->daddr == pkt.ip->saddr && refpkt.ip->saddr == pkt.ip->daddr && pkt.proto == TCP && refpkt.tcp->source == pkt.tcp->dest && refpkt.tcp->dest == pkt.tcp->source && pkt.tcp->ack == 1 && realnextseq > ntohl(pkt.tcp->ack_seq)); } public: segmentation() : Plugin(PLUGIN_NAME, AGG_RARE), pLH(PLUGIN_NAME, PKT_LOG) { }; virtual bool init(uint8_t configuredScramble, char *pluginOption, struct sjEnviron *sjE) { if (!(ISSET_INNOCENT(configuredScramble) && !ISSET_INNOCENT(~configuredScramble))) { LOG_ALL("%s plugin supports only INNOCENT scramble type", PLUGIN_NAME); return false; } /* the original is removed, and segments are inserted */ supportedScrambles = SCRAMBLE_INNOCENT; pLH.completeLog("Initialized plugin!"); return true; } virtual bool condition(const Packet & origpkt, uint8_t availableScrambles) { pLH.completeLog("verifing condition for id %d (sport %u) datalen %d total len %d", origpkt.ip->id, ntohs(origpkt.tcp->source), origpkt.tcppayloadlen, origpkt.pbuf.size()); if (origpkt.chainflag == FINALHACK) return false; if (origpkt.fragment == false && origpkt.proto == TCP && !origpkt.tcp->syn && !origpkt.tcp->rst && !origpkt.tcp->fin && origpkt.tcppayload != NULL && origpkt.tcppayloadlen >= MIN_TCP_PAYLOAD) return true; return false; } virtual void apply(const Packet &origpkt, uint8_t availableScrambles) { /* * due to the ratio: MIN_TCP_PAYLOAD = (MIN_SPLIT_PKTS * MIN_SPLIT_PAYLOAD) * the hack will produce pkts between a min of MIN_SPLIT_PKTS and a max of MAX_SPLIT_PKTS */ uint8_t pkts_n = MIN_SPLIT_PKTS + random() % (MAX_SPLIT_PKTS - (MIN_SPLIT_PKTS - 1)); uint32_t split_size = origpkt.tcppayloadlen / pkts_n; split_size = split_size > MIN_SPLIT_PAYLOAD ? split_size : MIN_SPLIT_PAYLOAD; pkts_n = (origpkt.tcppayloadlen / split_size) + ((origpkt.tcppayloadlen % split_size) ? 1 : 0); const uint32_t carry = (origpkt.tcppayloadlen % split_size) ? (origpkt.tcppayloadlen % split_size) : split_size; const uint32_t starting_seq = ntohl(origpkt.tcp->seq); const char *p; char saddr[MEDIUMBUF] = {0}, daddr[MEDIUMBUF] = {0}; p = inet_ntoa(*((struct in_addr *) &(origpkt.ip->saddr))); strncpy(saddr, p, sizeof (saddr)); p = inet_ntoa(*((struct in_addr *) &(origpkt.ip->daddr))); strncpy(daddr, p, sizeof (daddr)); pLH.completeLog("packet %s:%u -> %s:%u size %d start_seq %x (sport %u), splitted in %d chunk of %d bytes", saddr, ntohs(origpkt.tcp->source), daddr, ntohs(origpkt.tcp->dest), origpkt.tcppayloadlen, starting_seq, ntohs(origpkt.tcp->source), pkts_n, split_size); for (uint8_t pkts = 0; pkts < pkts_n; pkts++) { Packet * const pkt = new Packet(origpkt); pkt->randomizeID(); pkt->tcp->seq = htonl(starting_seq + (pkts * split_size)); uint32_t resizeAndCopy = 0; if (pkts < (pkts_n - 1)) /* first (pkt - 1) segments */ { pkt->tcp->fin = 0; pkt->tcp->rst = 0; /* if the PUSH is present, it's keept only in the lasy data pkt */ pkt->tcp->psh = 0; resizeAndCopy = split_size; } else /* last segment */ { resizeAndCopy = carry; } pkt->tcppayloadResize(resizeAndCopy); memcpy(pkt->tcppayload, &origpkt.tcppayload[pkts * split_size], resizeAndCopy); pkt->source = PLUGIN; /* * the orig packet is removed, so the value of the position * has no particular importance for the hack * * by the way setting this to ANTICIPATION it's fundamental * to keep packets trasmission ordered, and here is the reason why: * * ok tcp has sequence number to handle the packet reorder correctly but * we do a massive fragmentation to fight ids so with disordered * packets we would have a too much degraded session due to FAST_RETRASMIT * and others tcp features. */ pkt->position = ANTICIPATION; /* we keep the origpkt.wtf to permit this hack to segment both good and evil pkts */ pkt->wtf = origpkt.wtf; /* useless, INNOCENT is never downgraded in last_pkt_fix */ pkt->choosableScramble = (availableScrambles & supportedScrambles); /* I was tempted to set it FINALHACK, but Sj supports fragment, lets see */ upgradeChainFlag(pkt); pktVector.push_back(pkt); pLH.completeLog("%d/%d chunk seq|%x sjPacketId %d size %d", (pkts + 1), pkts_n, ntohl(pkt->tcp->seq), pkt->SjPacketId, resizeAndCopy); } cache.add(origpkt); removeOrigPkt = true; } void mangleIncoming(Packet &pkt) { cacheRecord *record = cache.check(&filter, pkt); if (record != NULL) { const char *p; char saddr[MEDIUMBUF] = {0}, daddr[MEDIUMBUF] = {0}; p = inet_ntoa(*((struct in_addr *) &(pkt.ip->saddr))); strncpy(saddr, p, sizeof (saddr)); p = inet_ntoa(*((struct in_addr *) &(pkt.ip->daddr))); strncpy(daddr, p, sizeof (daddr)); pLH.completeLog("requesting packet removal due to segmented ack: %s:%u -> %s:%u ack_seq|%x", saddr, ntohs(pkt.tcp->source), daddr, ntohs(pkt.tcp->dest), ntohl(pkt.tcp->ack_seq)); removeOrigPkt = true; } } }; extern "C" Plugin* createPluginObj() { return new segmentation(); } extern "C" void deletePluginObj(Plugin *who) { delete who; } extern "C" const char *versionValue() { return SW_VERSION; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/CMakeLists.txt0000644000000000000000000000135113147777044020240 0ustar00CONFIGURE_FILE(${CMAKE_CURRENT_SOURCE_DIR}/config.h.in ${CMAKE_CURRENT_SOURCE_DIR}/config.h) ADD_EXECUTABLE(sniffjoke HDRoptions IPList IPTCPopt IPTCPoptImpl OptionPool main NetIO Packet PacketFilter PacketQueue Plugin PluginPool PortConf Process SessionTrack SniffJoke TCPTrack TTLFocus UserConf Utils Debug) TARGET_LINK_LIBRARIES(sniffjoke "-ldl") INSTALL(TARGETS sniffjoke RUNTIME DESTINATION ${CMAKE_INSTALL_PREFIX}/sbin) sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/Debug.cc0000644000000000000000000001310113147777044017031 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011, 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "Debug.h" Debug::Debug(void) : debuglevel(ALL_LEVEL), logstream(stdout), session_logstream(stdout), packet_logstream(stdout) { } void Debug::setLogstream(const char *lsf) { logstream_file = lsf; logstream = NULL; } void Debug::setSessionLogstream(const char *lsf) { session_logstream_file = lsf; session_logstream = NULL; } void Debug::setPacketLogstream(const char *lsf) { packet_logstream_file = lsf; packet_logstream = NULL; } bool Debug::appendOpen(uint8_t thislevel, const char *fname, char *buf, FILE **previously) { if (*previously == stdout) return true; if (*previously != NULL) { log(thislevel, __func__, "requested close of logfile %s (vars used: %s and level %d)", fname, fname, thislevel); fclose(*previously); *previously = NULL; } if (debuglevel >= thislevel) { if ((fname == NULL) || ((*previously = fopen(fname, "a+")) == NULL)) return false; /* setbuffer(*previously, buf, DEBUGBUFFER); */ setlinebuf(*previously); log(thislevel, __func__, "opened logfile %s successful with debug level %d", fname, debuglevel); } return true; } bool Debug::resetLevel(void) { if (!appendOpen(ALL_LEVEL, logstream_file, logstream_buf, &logstream)) return false; if (!appendOpen(SESSION_LEVEL, session_logstream_file, session_logstream_buf, &session_logstream)) return false; if (!appendOpen(PACKET_LEVEL, packet_logstream_file, session_logstream_buf, &packet_logstream)) return false; return true; } void Debug::log(uint8_t errorlevel, const char *funcname, const char *msg, ...) { if (errorlevel <= debuglevel) { FILE *output_flow; if (logstream != NULL) output_flow = logstream; else output_flow = stderr; if (errorlevel == PACKET_LEVEL && packet_logstream != NULL) output_flow = packet_logstream; else if (errorlevel == SESSION_LEVEL && session_logstream != NULL) output_flow = session_logstream; /* the debug level used in development include function/pid/uid addictional infos */ if (errorlevel == DEBUG_LEVEL) fprintf(output_flow, "%s %s %d/%d ", sj_clock_str, funcname, getpid(), getuid()); else fprintf(output_flow, "%s ", sj_clock_str); va_list arguments; va_start(arguments, msg); vfprintf(output_flow, msg, arguments); va_end(arguments); fprintf(output_flow, "\n"); } } void Debug::downgradeOpenlog(uid_t uid, gid_t gid) { /* this should not be called when is not the root process to do */ if (getuid() && getgid()) return; if (logstream != NULL) if(fchown(fileno(logstream), uid, gid) == -1) RUNTIME_EXCEPTION("unable to change privileges to %d %d: %s", uid, gid, strerror(errno)); if (packet_logstream != NULL) if(fchown(fileno(packet_logstream), uid, gid) == -1) RUNTIME_EXCEPTION("unable to change privileges to %d %d: %s", uid, gid, strerror(errno)); if (session_logstream != NULL) if(fchown(fileno(session_logstream), uid, gid) == -1) RUNTIME_EXCEPTION("unable to change privileges to %d %d: %s", uid, gid, strerror(errno)); } /* Class pluginLogHandler used by plugins for selective logging */ pluginLogHandler::pluginLogHandler(const char *sN, const char *LfN) : selfName(sN) { if ((logstream = fopen(LfN, "a+")) == NULL) RUNTIME_EXCEPTION("unable to open %s: %s", LfN, strerror(errno)); /* at the moment is used this solution. soon, janus integration, will solve * every father/child/root/chroot/perm issue */ if(fchmod(fileno(logstream), 0666) == -1) RUNTIME_EXCEPTION("unable to make plugin %s (%s) rw+uga: %s", selfName, LfN, strerror(errno)); /* setbuffer(logstream, logstream_buf, DEBUGBUFFER); */ setlinebuf(logstream); completeLog("opened file %s successful for handler %s", LfN, selfName); } pluginLogHandler::~pluginLogHandler(void) { completeLog("requested logfile closing %s", selfName); fclose(logstream); } void pluginLogHandler::completeLog(const char *msg, ...) { fprintf(logstream, "%s ", sj_clock_str); va_list arguments; va_start(arguments, msg); vfprintf(logstream, msg, arguments); fprintf(logstream, "\n"); va_end(arguments); } void pluginLogHandler::simpleLog(const char *msg, ...) { va_list arguments; va_start(arguments, msg); vfprintf(logstream, msg, arguments); fprintf(logstream, "\n"); va_end(arguments); } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/Debug.h0000644000000000000000000000540313147777044016701 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_DEBUG_H #define SJ_DEBUG_H #include "Utils.h" #define DEBUGBUFFER 65536 /* 64k */ class Debug { private: friend class SniffJoke; friend class Process; uint8_t debuglevel; const char* logstream_file; const char* session_logstream_file; const char* packet_logstream_file; FILE *logstream; FILE *session_logstream; FILE *packet_logstream; char logstream_buf[DEBUGBUFFER]; char session_logstream_buf[DEBUGBUFFER]; char packet_logstream_buf[DEBUGBUFFER]; void setLogstream(const char *lsf); void setSessionLogstream(const char *lsf); void setPacketLogstream(const char *lsf); bool appendOpen(uint8_t thislevel, const char *fname, char* buf, FILE **previously); void downgradeOpenlog(uid_t, gid_t); bool resetLevel(void); public: Debug(void); void log(uint8_t, const char *, const char *, ...); uint8_t level(void) { return debuglevel; }; }; /* Facility to support debug and dumping by the plugins */ class pluginLogHandler { private: const char *selfName; FILE *logstream; char logstream_buf[DEBUGBUFFER]; public: pluginLogHandler(const char *, const char *); ~pluginLogHandler(void); void completeLog(const char *, ...); void simpleLog(const char *, ...); }; #define LOG_ALL(...) debug.log(ALL_LEVEL, __func__, __VA_ARGS__) #define LOG_VERBOSE(...) debug.log(VERBOSE_LEVEL, __func__, __VA_ARGS__) #define LOG_DEBUG(...) debug.log(DEBUG_LEVEL, __func__, __VA_ARGS__) #define LOG_SESSION(...) debug.log(SESSION_LEVEL, __func__, __VA_ARGS__) #define LOG_PACKET(...) debug.log(PACKET_LEVEL, __func__, __VA_ARGS__) /* global debug object defined into Debug.cc and exported by this module */ extern Debug debug; #endif /* SJ_DEBUG_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/HDRoptions.cc0000644000000000000000000004076713147777044020056 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * Handling randomized ip/tcp options.. WHAT dirty job! * * good ipoptions mean options that don't cause the discarging of packets, * they need to exist in order to avoid arbitrary discrimination. * * the future focus of those routine is to integrate the choosing of be * a bad or a good ipoptions analyzing the remote OS. * * - rules for adding: check the link : * http://www.iana.org/assignments/ip-parameters * test versus Linux/BSD/win/lose, submit to us, we are happy to add * every bit of randomization available. * * I've based a lot of consideration on: * http://lxr.oss.org.cn/source/net/ipv4/ip_options.c?v=2.6.36#L250 * * but checking: * http://www.faqs.org/rfcs/rfc1812.html * seems that some weird ipoptions will cause a packet to be discarded * on the route, without ever reach the server. we aim to create * ipoptions accepted by the router, and discarded from the remote host. */ #include "hardcodedDefines.h" /* defined at the bottom of hardcodedDefines.h */ #ifdef HEAVY_HDROPT_DEBUG #include #include #endif #include "HDRoptions.h" #include "IPTCPopt.h" #include "IPTCPoptImpl.h" #include "OptionPool.h" extern auto_ptr opt_pool; /* Now start the implementation of HDRoptions member */ HDRoptions::HDRoptions(injector_t t, Packet &pkt, TTLFocus &ttlfocus) : type(t), pkt(pkt), ttlfocus(ttlfocus), corruptRequest(false), corruptDone(false) { /* this 'swapPtr' is required to solve: * warning: dereferencing type-punned pointer will break strict-aliasing rules */ void *swapPtr; /* initialization of header and indexes on specific proto basis */ switch (type) { case IPOPTS_INJECTOR: protD.protoName = "IP"; protD.firstOptIndex = FIRST_IPOPT; protD.lastOptIndex = LAST_IPOPT; protD.NOP_code = IPOPT_NOOP; protD.EOL_code = IPOPT_END; protD.hdrMinLen = sizeof (struct iphdr); protD.optsMaxLen = MAXIPOPTIONS; /* protocol dependend pointer */ protD.hdrResize = &Packet::iphdrResize; swapPtr = reinterpret_cast(&(pkt.ip)); memcpy( &protD.hdrAddr, &swapPtr, sizeof(void *) ); protD.hdrLen = (uint8_t*) &pkt.iphdrlen; for (uint8_t i = protD.firstOptIndex; i <= protD.lastOptIndex; ++i) { switch (i) /* Specific IP options configurations goes here */ { case SJ_IPOPT_TIMESTOVERFLOW: (reinterpret_cast (opt_pool->get(i)))->setupTTLFocus(&ttlfocus); break; default: break; } } break; case TCPOPTS_INJECTOR: protD.protoName = "TCP"; protD.firstOptIndex = FIRST_TCPOPT; protD.lastOptIndex = LAST_TCPOPT; protD.NOP_code = TCPOPT_NOP; protD.EOL_code = TCPOPT_EOL; protD.hdrMinLen = sizeof (struct tcphdr); protD.optsMaxLen = MAXTCPOPTIONS; /* protocol dependend pointer */ protD.hdrResize = &Packet::tcphdrResize; swapPtr = reinterpret_cast(&(pkt.tcp)); memcpy( &protD.hdrAddr, &swapPtr, sizeof(void *) ); protD.hdrLen = (uint8_t*) &pkt.tcphdrlen; for (uint8_t i = protD.firstOptIndex; i <= protD.lastOptIndex; ++i) { switch (i) /* Specific TCP options configurations goes here */ { default: break; } } break; } /* initialization of "option Descriptor" */ memset( &oD, 0x00, sizeof(oD) ); oD.actual_opts_len = *protD.hdrLen - protD.hdrMinLen; pkt.SELFLOG("IP/TCP HDRoptions: free space %d actual protohdrlen %d mi/MA %d/%d actual len %d avail %d", pkt.freespace(), *protD.hdrLen, protD.hdrMinLen, protD.optsMaxLen, oD.actual_opts_len, oD.getAvailableOptLen() ); if(oD.actual_opts_len > protD.optsMaxLen) { RUNTIME_EXCEPTION("Actual options length %d > max supported options length %d", oD.actual_opts_len, protD.optsMaxLen); } /* remind: MTU is 80 byte less than the maximum available for don't check freespace */ oD.optshdr.resize(protD.optsMaxLen, protD.EOL_code); if(oD.actual_opts_len > 0) { for(uint32_t i = 0; i < *protD.hdrLen; i++) oD.optshdr.push_back( *(*((uint8_t **)protD.hdrAddr) + protD.hdrMinLen + i) ); acquirePresentOptions(pkt.SjPacketId); } LOG_PACKET("? checking space of opts header: %d < %d, resizing from %d to %d", oD.actual_opts_len, protD.optsMaxLen, oD.optshdr.size(), protD.optsMaxLen); } void HDRoptions::acquirePresentOptions(uint32_t PktID) { LOG_PACKET("*0 analyzing present %sopts for packet #%u, actual opts %d", protD.protoName, PktID, oD.actual_opts_len); uint8_t option_len = 1; for (uint8_t i = 0; i < oD.actual_opts_len; i += option_len) { uint8_t * const option = &oD.optshdr[i]; if (*option == protD.NOP_code) { option_len = 1; registerOptOccurrence(*option, i, option_len); continue; } if (*option == protD.EOL_code) { registerOptOccurrence(*option, i, 1); break; } option_len = (uint8_t) oD.optshdr[i + 1]; if (option_len == 0 || option_len > (oD.actual_opts_len - i)) { RUNTIME_EXCEPTION("INFO: an invalid %sopt: option|%02x option_len|%u residual|%u", protD.protoName, *option, option_len, (oD.actual_opts_len - i)); } registerOptOccurrence(*option, i, option_len); } } /* * this is a core method inside HDRoptions, it: * 1) check if a requested option(selected by a random or forced by a plugin) is enabled * 2) check if the goal is to corrupt or not, and choose the option by the counter data */ bool HDRoptions::evaluateInjectCoherence(uint8_t sjOptIndex) { const IPTCPopt &oDesc = *(opt_pool->get(sjOptIndex)); const uint8_t opt_occurrs = optTrack[sjOptIndex].size(); /* * 1st global check: can we use this option ? * an option could be implemented in IPTCPoptImpl.cc but could be put * simply for recognize the option, without injecting them. */ if (oDesc.enabled == false) return false; /* * 2nd global check: at which state of the injection are we? * we avoid corrupt options if we have just corrupted the packet * and we also alter the probability for the first injection * in favour of good injection. */ switch (oDesc.availableUsage) { case NOT_CORRUPT: if (corruptRequest == false && opt_occurrs == 0) return true; break; case ONESHOT: /* I like to corrupt only once */ if (corruptRequest == true && corruptDone == false) return true; break; case TWOSHOT: if (corruptRequest == true && corruptDone == false) { if (opt_occurrs <= 1) return true; } break; default: break; } /* if the requested option doesn't fit with the goal+status, and thus the * previous switch() has returned "true", the answer will be only a drop */ return false; } /* this is called on acquiring present options and after the injection, * it keeps track of every option, absolute offset and length (because will be * request a selective deletion) */ uint8_t HDRoptions::registerOptOccurrence(uint8_t optValue, uint8_t offset, uint8_t len) { for (uint8_t sjOptIndex = protD.firstOptIndex; sjOptIndex <= protD.lastOptIndex; ++sjOptIndex) { const IPTCPopt &oDesc = *(opt_pool->get(sjOptIndex)); if (optValue == oDesc.optValue) { struct option_occurrence occ; occ.off = offset; occ.len = len; optTrack[sjOptIndex].push_back(occ); LOG_PACKET("*+ registering %s at the index of %u options length %u (actual %d avail %u)", oDesc.sjOptName, offset, len, oD.actual_opts_len, oD.getAvailableOptLen() ); return optTrack[sjOptIndex].size(); } } /* * analysis: will we make a malformed and stripping an option we don't know ? * I belive is better to return false if the code is running here, but I prefer * support every IP options available in the optMap[]. * for this reason, in the beta and < 1.0 release the previous message * will be used for debug & progress pourposes. */ RUNTIME_EXCEPTION("INFO: a non trapped %sopt: option|%02x option_len|%u residual|%u", protD.protoName, optValue, len, (oD.actual_opts_len - offset)); } void HDRoptions::alignOpthdr(void) { uint8_t alignBytes = (oD.actual_opts_len % 4) ? 4 - (oD.actual_opts_len % 4) : 0; if (alignBytes) { oD.actual_opts_len += alignBytes; LOG_PACKET("*+ aligned to %u for %u bytes (avail %u)", oD.actual_opts_len, alignBytes, oD.getAvailableOptLen()); } } void HDRoptions::copyOpthdr(void) { memcpy(*((uint8_t **)protD.hdrAddr) + protD.hdrMinLen, &oD.optshdr[0], oD.actual_opts_len); } bool HDRoptions::isGoalAchieved(void) { return corruptRequest == corruptDone; } bool HDRoptions::prepareInjection(bool corrupt, bool strip_previous) { if (strip_previous) stripAllOptions(); corruptRequest = corrupt; return true; } void HDRoptions::completeHdrEdit(void) { LOG_PACKET("*- complete %shdr actual %u options len", protD.protoName, oD.actual_opts_len); alignOpthdr(); ((pkt).*(protD.hdrResize))(protD.hdrMinLen + oD.actual_opts_len); copyOpthdr(); } void HDRoptions::injector(uint8_t sjOptIndex) { IPTCPopt &oDesc = *(opt_pool->get(sjOptIndex)); while (evaluateInjectCoherence(sjOptIndex)) { const uint8_t writtedLen = oDesc.optApply(&oD); /* when this happen, is because no space is available, so * break; to avoid useless time consuming loop */ if (writtedLen == 0) break; const uint8_t opt_occurrs = registerOptOccurrence(oDesc.optValue, oD.actual_opts_len, writtedLen); oD.actual_opts_len += writtedLen; if (oDesc.availableUsage == ONESHOT && opt_occurrs == 1) corruptDone = true; else if (oDesc.availableUsage == TWOSHOT && opt_occurrs == 2) corruptDone = true; } } void HDRoptions::randomInjector(void) { vector seq; for (uint8_t i = protD.firstOptIndex; i <= protD.lastOptIndex; ++i) seq.push_back(i); random_shuffle(seq.begin(), seq.end()); for (vector::iterator it = seq.begin(); it != seq.end(); ++it) injector(*it); } bool HDRoptions::injectSingleOpt(bool corrupt, bool strip_previous, uint8_t sjOptIndex) { /* this check need to be done only on external public functions */ if (sjOptIndex < protD.firstOptIndex || sjOptIndex > protD.lastOptIndex) RUNTIME_EXCEPTION("invalid use of optcode index: %u", sjOptIndex); LOG_PACKET("*1 injecting single %sopt [%u]: actual_opt_len(%u) (avail %u) goal %s", protD.protoName, sjOptIndex, oD.actual_opts_len, oD.getAvailableOptLen(), corruptRequest ? "CORRUPT" : "NOT CORRUPT"); if (prepareInjection(corrupt, strip_previous)) injector(sjOptIndex); if (!isGoalAchieved()) { LOG_PACKET("*! injecting single %sopt [%u]: actual_opt_len(%u) (avail %u) goal NOT ACHIEVED = discarged options ", protD.protoName, sjOptIndex, oD.actual_opts_len, oD.getAvailableOptLen()); return false; } completeHdrEdit(); LOG_PACKET("*2 injecting single %sopt [%u]: actual_opt_len(%u) (avail %u) goal %s ", protD.protoName, sjOptIndex, oD.actual_opts_len, oD.getAvailableOptLen(), isGoalAchieved() ? "ACHIEVED" : "NOT ACHIEVED"); return true; } bool HDRoptions::injectRandomOpts(bool corrupt, bool strip_previous) { LOG_PACKET("*1 injecting random %sopts: actual_opt_len(%u) (avail %u) goal %s", protD.protoName, oD.actual_opts_len, oD.getAvailableOptLen(), corruptRequest ? "CORRUPT" : "NOT CORRUPT"); if (prepareInjection(corrupt, strip_previous)) randomInjector(); if (!isGoalAchieved()) { LOG_PACKET("*! injecting random %sopts: actual_opt_len(%u) (avail %u) goal NOT ACHIEVED = discarged options", protD.protoName, oD.actual_opts_len, oD.getAvailableOptLen()); return false; } completeHdrEdit(); LOG_PACKET("*2 injecting random %sopts: actual_opt_len(%u) (avail %u) goal %s ", protD.protoName, oD.actual_opts_len, oD.getAvailableOptLen(), isGoalAchieved() ? "ACHIEVED" : "NOT ACHIEVED"); return true; } bool HDRoptions::stripOption(uint8_t sjOptIndex) { bool found = false; /* this check need to be done only on external public functions */ if (sjOptIndex < protD.firstOptIndex || sjOptIndex > protD.lastOptIndex) RUNTIME_EXCEPTION("invalid use of optcode index: %u", sjOptIndex); IPTCPopt &oDesc = *(opt_pool->get(sjOptIndex)); for (vector::iterator it = optTrack[sjOptIndex].begin(); it != optTrack[sjOptIndex].end(); it++) { vector::iterator start = oD.optshdr.begin() + it->off; vector::iterator end = start + it->len; oD.optshdr.erase(start, end); oD.actual_opts_len -= it->len; uint16_t maxOptSpace = pkt.freespace() > protD.optsMaxLen ? protD.optsMaxLen : ((pkt.freespace() >> 4) << 4); oD.optshdr.resize(maxOptSpace, protD.EOL_code); LOG_PACKET("*- stripping single %sopt %s for %u bytes (avail %u)", protD.protoName, oDesc.sjOptName, it->len, oD.getAvailableOptLen()); optTrack[sjOptIndex].erase(it); completeHdrEdit(); found = true; } return found; } void HDRoptions::stripAllOptions() { LOG_PACKET("*- stripping all %s options (total of used %u)", protD.protoName, oD.actual_opts_len); for (uint32_t sjI = protD.firstOptIndex; sjI <= protD.lastOptIndex; sjI++) { while(optTrack[sjI].size()) { optTrack[sjI].pop_back(); } } uint16_t maxOptSpace = pkt.freespace() > protD.optsMaxLen ? protD.optsMaxLen : ((pkt.freespace() >> 4) << 4); oD.optshdr.resize(maxOptSpace, protD.EOL_code); oD.actual_opts_len = 0; } HDRoptions::~HDRoptions(void) { #ifdef HEAVY_HDROPT_DEBUG #define HDR_PREFIX "HDRoLog/" char fname[MEDIUMBUF]; mkdir(HDR_PREFIX, 0770); snprintf(fname, MEDIUMBUF, "%s%s-%s", HDR_PREFIX, inet_ntoa(*((struct in_addr *) &(pkt.ip->daddr))), protD.protoName); FILE *HDRoLog = fopen(fname, "a+"); if (HDRoLog == NULL) RUNTIME_EXCEPTION("unable to open %s:%s", fname, strerror(errno)); fprintf(HDRoLog, "RD %u%u SAPFR{%u%u%u%u%u}\tpktID %u\tip.id %u\t optL %d", corruptRequest, corruptDone, pkt.tcp->syn, pkt.tcp->ack, pkt.tcp->psh, pkt.tcp->fin, pkt.tcp->rst, pkt.SjPacketId, ntohs(pkt.ip->id), oD.actual_opts_len ); for (uint8_t i = protD.firstOptIndex; i <= protD.lastOptIndex; ++i) { if (optTrack[i].size() == false) { fprintf(HDRoLog, " ~%u", i); } else { IPTCPopt *yep = opt_pool->get(i); fprintf(HDRoLog, " %s", yep->sjOptName); for (vector::iterator it = optTrack[i].begin(); it != optTrack[i].end(); ++it) fprintf(HDRoLog, ":%u(%u)", it->off, it->len); } } fprintf(HDRoLog, "\n"); fclose(HDRoLog); #endif } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/HDRoptions.h0000644000000000000000000001055613147777044017711 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef HDROPTIONS_H #define HDROPTIONS_H #include #include #include "Utils.h" #include "Packet.h" #include "TTLFocus.h" #include "IPTCPopt.h" #define MAXIPOPTIONS 40 #define MAXTCPOPTIONS 40 #define MAXIPINJITERATIONS 5 /* max number of injected ip options / retries */ #define MAXTCPINJITERATIONS 5 /* max number of injected tcp options / retries */ /* * not all options are defined in the standard library, * so some values are defined here. * * references: * * http://www.networksorcery.com/enp/protocol/ip.htm * http://www.networksorcery.com/enp/protocol/tcp.htm */ #define IPOPT_NOOP_SIZE 1 #define IPOPT_CIPSO (6 |IPOPT_CONTROL|IPOPT_COPY) #define IPOPT_CIPSO_SIZE 10 #define IPOPT_SID_SIZE 4 #define TCPOPT_NOP_SIZE 1 #define TCPOPT_MD5SIG 19 #define TCPOPT_MD5SIG_SIZE 18 #define TCPOPT_MSS 2 #define TCPOPT_MSS_SIZE 4 #define DUMMY_OPCODE 255 /* * HDRoptions logic: * * The class optionLoaded, read from the file * 'option-support.conf' and setup * the optionImplement * * the HDRoptions is called for every Packet needing a manipoulation over the * header options, and import the correctly loaded impelementation from optionImplement * * optionImplement has some virtual methods and are implemented in * IPTCPoptApply.cc * * HDRoptions_probe.cc is plugin for option test and use those classess in a * lighty different way */ enum injector_t { IPOPTS_INJECTOR = 0, TCPOPTS_INJECTOR = 1 }; /* these struct are used inside HDRoptions for an easy handling */ struct option_occurrence { uint8_t off; uint8_t len; }; /* protocol specification contains the difference between TCP and IP header * manipoulation. is useful for make a simple code usable in both cases */ struct protocolSpec { const char *protoName; uint8_t firstOptIndex; uint8_t lastOptIndex; uint8_t NOP_code; uint8_t EOL_code; void **hdrAddr; uint8_t *hdrLen; uint8_t hdrMinLen; uint8_t optsMaxLen; void (Packet::*hdrResize)(uint8_t); }; class HDRoptions { private: injector_t type; Packet &pkt; TTLFocus &ttlfocus; bool corruptRequest; bool corruptDone; /* this struct is used to be passed to the IPTCPoptImpl extensions */ struct optHdrData oD; /* this struct is used to track protocol reference, to use the same methods * both for IP and TCP where possible */ struct protocolSpec protD; vector optTrack[SUPPORTED_OPTIONS]; /* validates present option and makes a working copy */ void acquirePresentOptions(uint32_t); /* the core selecting function */ bool evaluateInjectCoherence(uint8_t); /* registers the presence of an option and returns occurrences count */ uint8_t registerOptOccurrence(uint8_t, uint8_t, uint8_t); /* alignment of option header to be divisible by 4 */ void alignOpthdr(void); /* utilities functions */ void copyOpthdr(void); bool isGoalAchieved(void); bool prepareInjection(bool, bool); void completeHdrEdit(void); void injector(uint8_t); void randomInjector(void); public: HDRoptions(injector_t, Packet &, TTLFocus &); ~HDRoptions(); bool injectSingleOpt(bool, bool, uint8_t); bool injectRandomOpts(bool, bool); bool stripOption(uint8_t); void stripAllOptions(); }; #endif /* HDROPTIONS_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/IPList.cc0000644000000000000000000001120213147777044017147 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "IPList.h" #include #include #include IPList::IPList(uint32_t ip, uint8_t a, uint8_t b, uint8_t c) : ip(ip), a(a), b(b), c(c) { SELFLOG(""); } IPList::~IPList(void) { SELFLOG(""); } void IPList::selflog(const char *func, const char *format, ...) const { if (debug.level() == SUPPRESS_LEVEL) return; char loginfo[LARGEBUF]; va_list arguments; va_start(arguments, format); vsnprintf(loginfo, sizeof (loginfo), format, arguments); va_end(arguments); LOG_SESSION("%s: IP %s attribute a(%02x) b(%02x) c(%02x) %s", func, inet_ntoa(*((struct in_addr *) &(this->ip))), this->a, this->b, this->c, loginfo); } IPListMap::IPListMap(const char* ipConfFile) { LOG_ALL("loading ipList from %s", ipConfFile); dumpfname = ipConfFile; load(); } IPListMap::~IPListMap(void) { dump(); for (IPListMap::iterator it = begin(); it != end();) { delete &(*it->second); erase(it++); } } IPList& IPListMap::add(uint32_t ip, uint8_t a, uint8_t b, uint8_t c) { IPList *ipcnf; /* check if the key it's already present */ IPListMap::iterator it = find(ip); if (it != end()) /* on hit: update the IPConfig object. */ { ipcnf = &(*it->second); ipcnf->a = a; ipcnf->b = b; ipcnf->c = c; } else /* on miss: create a new IPConfig and insert it into the map */ ipcnf = &(*insert(pair(ip, new IPList(ip, a, b, c))).first->second); return *ipcnf; } bool IPListMap::isPresent(uint32_t ip) const { return (find(ip) != end()); } void IPListMap::load(void) { char record[MEDIUMBUF]; char tmp_ip[17]; uint32_t tmp_a, tmp_b, tmp_c; FILE *IPfileP = fopen(dumpfname, "r"); if (IPfileP == NULL) { LOG_ALL("unable to open %s: %s", dumpfname, strerror(errno)); return; } uint32_t records_num = 0; do { tmp_a = tmp_b = tmp_c = 0; memset(record, 0x00, MEDIUMBUF); if ( fgets(record, sizeof (record), IPfileP) == NULL ) break; if (record[0] == '#' || record[0] == '\n' || record[0] == ' ' || strlen(record) < 7) continue; /* C's chop() */ if (record[strlen(record) - 1] == '\n') record[strlen(record) - 1] = 0x00; sscanf(record, "%s %u,%u,%u", tmp_ip, &tmp_a, &tmp_b, &tmp_c); LOG_VERBOSE("importing record %d: %s %u,%u,%u", records_num, tmp_ip, tmp_a, tmp_b, tmp_c); /* the value in tmp_* are not used at the moment */ add(inet_addr(tmp_ip), (uint8_t) tmp_a, (uint8_t) tmp_b, (uint8_t) tmp_c); records_num++; } while (!feof(IPfileP)); fclose(IPfileP); LOG_ALL("from %s completed: %u records loaded", dumpfname, records_num); } /* Implemented but not used until the client sniffjokectl supports the updating of whitelist/blacklist */ void IPListMap::dump(void) { FILE *IPfileP = fopen(dumpfname, "w"); if (IPfileP == NULL) LOG_ALL("unable to open %s: %s", dumpfname, strerror(errno)); uint32_t records_num = 0; for (IPListMap::iterator it = begin(); it != end(); ++it) { IPList *tmp = &(*it->second); char record[MEDIUMBUF]; snprintf(record, sizeof (record), "%s %u,%u,%u\n", inet_ntoa(*((struct in_addr *) &(tmp->ip))), tmp->a, tmp->b, tmp->c); if (fwrite(&record, strlen(record), 1, IPfileP) != 1) { LOG_ALL("unable to dump ipconfig: %s", strerror(errno)); return; } ++records_num; } fclose(IPfileP); LOG_ALL("completed with %u records dumped", records_num); } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/IPList.h0000644000000000000000000000316313147777044017020 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_IPLIST_H #define SJ_IPLIST_H #include "Utils.h" class IPList { public: uint32_t ip; uint8_t a; uint8_t b; uint8_t c; IPList(uint32_t, uint8_t, uint8_t, uint8_t); ~IPList(void); /* utilities */ void selflog(const char *func, const char *format, ...) const; }; class IPListMap : public map { private: const char *dumpfname; public: IPListMap(const char*); ~IPListMap(void); IPList& add(uint32_t, uint8_t, uint8_t, uint8_t); bool isPresent(uint32_t) const; void load(void); void dump(void); }; #endif /* SJ_IPLIST_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/IPTCPopt.cc0000644000000000000000000000440213147777044017411 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "IPTCPopt.h" #include "Utils.h" IPTCPopt::IPTCPopt(bool enable, uint8_t sjI, const char * const sjN, uint8_t proto, uint8_t opcode) : enabled(enable), sjOptIndex(sjI), sjOptName(sjN), optProto(proto), optValue(opcode), availableUsage(CORRUPTUNASSIGNED) { } void IPTCPopt::optionConfigure(corruption_t c) { availableUsage = c; } /* this is the utility function used by the single option adder to calculate the best fit size for an option */ uint8_t IPTCPopt::getBestRandsize(struct optHdrData *oD, uint8_t fixedLen, uint8_t minRblks, uint8_t maxRblks, uint8_t blockSize) { const uint8_t minComputed = fixedLen + (minRblks * blockSize); const uint8_t maxComputed = fixedLen + (maxRblks * blockSize); const uint8_t checkedAvail = oD->getAvailableOptLen(); if (checkedAvail == minComputed || checkedAvail == maxComputed) return checkedAvail; if (checkedAvail < minComputed) return 0; if (checkedAvail > maxComputed) return (((random() % (maxRblks - minRblks + 1)) + minRblks) * blockSize) + fixedLen; /* else should try the best filling of memory and the NOP fill after */ const uint8_t blockNumber = (checkedAvail - fixedLen) / blockSize; return ((blockNumber * blockSize) + fixedLen); } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/IPTCPopt.h0000644000000000000000000000447113147777044017261 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_IPTCPOPT_H #define SJ_IPTCPOPT_H #include "Utils.h" /* NOT corrupt is an option that will never give an error, ONESHOT is an option that * make the packet dischargable, twoshot because some option trigger a fult if present * two time in the same header, and BOTH are option that will be either good or malformed * to be dumped by the remote host */ enum corruption_t { CORRUPTUNASSIGNED = 0, NOT_CORRUPT = 1, ONESHOT = 2, TWOSHOT = 4, BOTH = 8, TRACK_ONLY = 16 }; struct optHdrData { vector optshdr; uint8_t actual_opts_len; /* max value 40 on IP and TCP too */ uint8_t getAvailableOptLen() { /* using size had cause too much fault: now fuck tha vector */ return 40 - /* (uint8_t)optshdr.size() - */ actual_opts_len; }; }; class IPTCPopt { public: bool enabled; /* static enabler */ uint32_t sjOptIndex; /* sniffjoke options values */ const char* const sjOptName; uint8_t optProto; uint8_t optValue; /* rfc options values*/ corruption_t availableUsage; uint8_t getBestRandsize(struct optHdrData *, uint8_t, uint8_t, uint8_t, uint8_t); IPTCPopt(bool, uint8_t, const char *, uint8_t, uint8_t); void optionConfigure(corruption_t); virtual uint8_t optApply(struct optHdrData *) = 0; }; #endif /* SJ_IPTCPOPT_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/IPTCPoptImpl.cc0000644000000000000000000003671113147777044020243 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "IPTCPoptImpl.h" /* this file contains the extension of the class optionImplement, every options DETAIL, * injection function, is implemented here. * * in HDRoptions you will found the code SniffJoke-side for the corret choose * between the available options */ Io_NOOP::Io_NOOP(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_IPOPT_NOOP, "IPOPT_NOOP", IPPROTO_IP, IPOPT_NOOP) { } uint8_t Io_NOOP::optApply(struct optHdrData *oD) { if (oD->getAvailableOptLen() < IPOPT_NOOP_SIZE) return 0; const uint8_t index = oD->actual_opts_len; oD->optshdr[index] = IPOPT_NOOP; return IPOPT_NOOP_SIZE; } Io_EOL::Io_EOL(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_IPOPT_EOL, "IPOPT_EOL", IPPROTO_IP, IPOPT_EOL) { } uint8_t Io_EOL::optApply(struct optHdrData *oD) { return 0; } /* * IP TIMESTAMP hacking: * * The timestamp ip option are used in two ways, Io_TIMESTAMP * don't corrupt, the option is configured with empy timestamp space. * * the next instead, Io_TIMESTOVERFLOW, is under research and * the option is configured a precise setting of overflow variable * to permit an hack similar to prescription. * * reference: http://tools.ietf.org/rfc/rfc781.txt */ Io_TIMESTAMP::Io_TIMESTAMP(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_IPOPT_TIMESTAMP, "IPOPT_TIMESTAMP", IPPROTO_IP, IPOPT_TIMESTAMP) { } uint8_t Io_TIMESTAMP::optApply(struct optHdrData *oD) { /* * it has been tested that some networks (Fastweb) do silently filter packets * with this option set for security reasons. * so at the time we can't use this as a good for !corrupt packets. * * some interesting informations regarding this recomendations can also be found at: * http://tools.ietf.org/html/draft-gont-opsec-ip-options-filtering-00 * http://yurisk.info/2010/01/23/ip-options-are-evil * http://tinyurl.com/63gs5ce (Juniper configuration) * http://technet.microsoft.com/en-us/library/cc302652.aspx * microsoft isa as contromisure for CAN-2005-0048 seems to block by default: * - Record Route (7) * - Time Stamp (68) * - Loose Source Route (131) * - Strict Source Route (137) * * the same can be found on CISCO and Juniper (http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtipofil.html) * */ const uint8_t size_timestamp = getBestRandsize(oD, 4, 1, 6, 4); const uint8_t timestamps = (size_timestamp - 4) / 4; const uint8_t index = oD->actual_opts_len; /* getBestRandom return 0 if there is not enought space */ if (!size_timestamp) return 0; oD->optshdr[index] = IPOPT_TIMESTAMP; oD->optshdr[index + 1] = size_timestamp; oD->optshdr[index + 2] = 5; /* empty */ oD->optshdr[index + 3] = IPOPT_TS_TSONLY; /* by rfc preallocated options memory must be 0, because is filled by the other */ memset(&oD->optshdr[index + 4], 0, timestamps * 4); return size_timestamp; } Io_TIMESTOVERFLOW::Io_TIMESTOVERFLOW(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_IPOPT_TIMESTOVERFLOW, "IPOPT_DUMMY (timestamp overflow)", IPPROTO_IP, DUMMY_OPCODE) { } void Io_TIMESTOVERFLOW::setupTTLFocus(TTLFocus *refttlp) { ttlfocus = refttlp; } uint8_t Io_TIMESTOVERFLOW::optApply(struct optHdrData *oD) { return 0; #if 0 const uint8_t size_timestamp = getBestRandsize(oD, 4, 9, 9, 4); const uint8_t timestamps = (size_timestamp - 4) / 4; const uint8_t covered_destinations = timestamps + 15; /* the overflow counter is 4 bits */ if (ttlfocus->status != TTL_KNOWN || ttlfocus->ttl_estimate > covered_destinations) return 0; /* getBestRandom return 0 if there is not enought space */ if (!size_timestamp) return 0; const uint8_t index = oD->actual_opts_len; uint8_t overflow = 0; uint8_t last_filled = covered_destinations - ttlfocus->ttl_estimate; if (last_filled > timestamps) { overflow = (last_filled - timestamps); last_filled = timestamps; } oD->optshdr[index] = IPOPT_TIMESTAMP; oD->optshdr[index + 1] = size_timestamp; oD->optshdr[index + 2] = size_timestamp + 1; /* full */ oD->optshdr[index + 3] = (IPOPT_TS_TSONLY | (overflow << 4)); /* next will overflow */ memset(&oD->optshdr[index + 4], 0, timestamps * 4); memset_random(&oD->optshdr[index + 4], last_filled * 4); return size_timestamp; #endif } Io_LSRR::Io_LSRR(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_IPOPT_LSRR, "IPOPT_LSRR", IPPROTO_IP, IPOPT_LSRR) { } uint8_t Io_LSRR::optApply(struct optHdrData *oD) { /* http://tools.ietf.org/html/rfc1812 * * "A router MUST NOT originate a datagram containing multiple * source route options. What a router should do if asked to * forward a packet containing multiple source route options is * described in Section [5.2.4.1]." * * From [5.2.4.1]: * "It is an error for more than one source route option to appear in a * datagram. If it receives such a datagram, it SHOULD discard the * packet and reply with an ICMP Parameter Problem message whose pointer * points at the beginning of the second source route option. * * Extract from: net/ipv4/ip_options.c * * case IPOPT_SSRR: * case IPOPT_LSRR: * * [...] * * / * NB: cf RFC-1812 5.2.4.1 * / * if (opt->srr) { * pp_ptr = optptr; * goto error; * } * * so to corrupt we need to inject this option twice. * * DOUBTS: * - 1) the packet will be discarded at the first router that correctly implements the rfc. * if all does this this corruption is useles :( * - 2) the filled address are random, so the packet will quite surely dropped at first hop. * or sent onto a random path so probably will not reach the sniffer to. * (useful only dealing with a near sniffer) * * using SSRR is also possibile but using with withe packet will be surely trashed by the * first router. */ const uint8_t size_lsrr = getBestRandsize(oD, 3, 1, 4, 4); /* getBestRandom return 0 if there is not enought space */ if (!size_lsrr) return 0; const uint8_t index = oD->actual_opts_len; oD->optshdr[index] = IPOPT_LSRR; oD->optshdr[index + 1] = size_lsrr; oD->optshdr[index + 2] = 4; memset_random(&oD->optshdr[index + 3], (size_lsrr - 3)); return size_lsrr; } Io_RR::Io_RR(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_IPOPT_RR, "IPOPT_RR", IPPROTO_IP, IPOPT_RR) { } uint8_t Io_RR::optApply(struct optHdrData *oD) { /* * This option it's based on analysis of the linux kernel. (2.6.36) * * Extract from: net/ipv4/ip_options.c * * if (optptr[2] < 4) * pp_ptr = optptr + 2; * goto error; * * if (optptr[2] <= optlen) * if (optptr[2]+3 > optlen) * pp_ptr = optptr + 2; * goto error; * * [...] * * so here have two conditions we can disattend; * It's possible to create a unique hack that * due to random : public optionImplement exploits the first or the latter. */ const uint8_t size_rr = getBestRandsize(oD, 3, 1, 4, 4); /* getBestRandom return 0 if there is not enought space */ if (!size_rr) return 0; const uint8_t index = oD->actual_opts_len; oD->optshdr[index] = IPOPT_RR; oD->optshdr[index + 1] = size_rr; oD->optshdr[index + 2] = size_rr + 1; /* full */ memset_random(&(oD->optshdr)[index + 3], (size_rr - 3)); return size_rr; } Io_RA::Io_RA(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_IPOPT_RA, "IPOPT_RA", IPPROTO_IP, IPOPT_RA) { } uint8_t Io_RA::optApply(struct optHdrData *oD) { #define IPOPT_RA_SIZE 4 /* * by literature it's not clear if this option could * corrupt the packet. * studing it we have encontered some icmp errors * probably related to repeatitions of the option. * so we avoid it. */ if (oD->getAvailableOptLen() < IPOPT_RA_SIZE) return 0; const uint8_t index = oD->actual_opts_len; oD->optshdr[index] = IPOPT_RA; oD->optshdr[index + 1] = IPOPT_RA_SIZE; /* * the value of the option by rfc 2113 means: * 0: Router shall examine packet * 1-65535: Reserved * * the kernel linux does handle only the 0 value. * we set this random to see what will happen =) */ memset_random(&oD->optshdr[index + 2], 2); return IPOPT_RA_SIZE; } Io_CIPSO::Io_CIPSO(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_IPOPT_CIPSO, "IPOPT_CIPSO", IPPROTO_IP, IPOPT_CIPSO) { } uint8_t Io_CIPSO::optApply(struct optHdrData *oD) { /* * http://www.faqs.org/rfcs/rfc2828.html * * This option it's based on analysis of the linux kernel. (2.6.36) * * Extract from: net/ipv4/ip_options.c * * case IPOPT_CIPSO: * if ((!skb && !capable(CAP_NET_RAW)) || opt->cipso) * pp_ptr = optptr; * goto error; * opt->cipso = optptr - iph; * if (cipso_v4_validate(skb, &optptr)) * pp_ptr = optptr; * goto error; * break; * * so here have two conditions we can disattend; * - The CIPSO option can be not setted on the socket * - also if CIPSO option is setted the random data would * lead the packet to be discarded. */ /* this option always corrupts the packet */ if (oD->getAvailableOptLen() < IPOPT_CIPSO_SIZE) return 0; const uint8_t index = oD->actual_opts_len; oD->optshdr[index] = IPOPT_CIPSO; oD->optshdr[index + 1] = IPOPT_CIPSO_SIZE; memset_random(&oD->optshdr[index + 2], 8); return IPOPT_CIPSO_SIZE; } Io_SEC::Io_SEC(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_IPOPT_SEC, "IPOPT_SEC", IPPROTO_IP, IPOPT_SEC) { } uint8_t Io_SEC::optApply(struct optHdrData *oD) { /* * This option it's based on analysis of the linux kernel. (2.6.36) * * Extract from: net/ipv4/ip_options.c * * case IPOPT_SEC: * case IPOPT_SID: * default: * if (!skb && !capable(CAP_NET_RAW)) { * pp_ptr = optptr; * goto error; * } * * Sidenote: * It's interesting also the default switch case, * but not used in hacks at the moment */ #define IPOPT_SEC_SIZE 11 /* * this option always corrupts the packet due to random data values */ if (oD->getAvailableOptLen() < IPOPT_SEC_SIZE) return 0; const uint8_t index = oD->actual_opts_len; /* TODO - cohorent data for security OPT */ /* http://www.faqs.org/rfcs/rfc791.html "Security" */ oD->optshdr[index] = IPOPT_SEC; oD->optshdr[index + 1] = IPOPT_SEC_SIZE; memset_random(&oD->optshdr[index + 2], 9); return IPOPT_SEC_SIZE; } Io_SID::Io_SID(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_IPOPT_SID, "IPOPT_SID", IPPROTO_IP, IPOPT_SID) { } uint8_t Io_SID::optApply(struct optHdrData *oD) { /* this option corrupts the packet if repeated. */ if (oD->getAvailableOptLen() < IPOPT_SID_SIZE) return 0; const uint8_t index = oD->actual_opts_len; oD->optshdr[index] = IPOPT_SID; oD->optshdr[index + 1] = IPOPT_SID_SIZE; memset_random(&oD->optshdr[index + 2], 2); return IPOPT_SID_SIZE; } /* * TCP OPTIONS */ To_NOP::To_NOP(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_TCPOPT_NOP, "TCPOPT_NOP", IPPROTO_TCP, TCPOPT_NOP) { } uint8_t To_NOP::optApply(struct optHdrData *oD) { if (oD->getAvailableOptLen() < TCPOPT_NOP_SIZE) return 0; const uint8_t index = oD->actual_opts_len; oD->optshdr[index] = TCPOPT_NOP; return TCPOPT_NOP_SIZE; } To_EOL::To_EOL(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_TCPOPT_EOL, "TCPOPT_EOL", IPPROTO_TCP, TCPOPT_EOL) { } uint8_t To_EOL::optApply(struct optHdrData *oD) { return 0; } To_MD5SIG::To_MD5SIG(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_TCPOPT_MD5SIG, "TCPOPT_MD5SIG", IPPROTO_TCP, TCPOPT_MD5SIG) { } /* * http://tools.ietf.org/html/rfc2385 * http://frankstocktonart.blogspot.com/2011/04/eisner-nomination.html * * fyo: MD5 in BGP is not used, and this technology show more reialiability in the * https://secure.wikimedia.org/wikipedia/en/wiki/Generalized_TTL_security_mechanism * eyes of the tiger. * * MD5 need to be enabled remotely by a setsockopt. in a more easy way for enabling this * signature, TCPOPT_MD5SIG will became the first dianically checked TCP options in Sj * */ uint8_t To_MD5SIG::optApply(struct optHdrData *oD) { if (oD->getAvailableOptLen() < TCPOPT_MD5SIG_SIZE) return 0; const uint8_t index = oD->actual_opts_len; oD->optshdr[index] = TCPOPT_MD5SIG; oD->optshdr[index + 1] = TCPOPT_MD5SIG_SIZE; memset_random(&oD->optshdr[index + 2], TCPOPT_MD5SIG_SIZE - 2); return TCPOPT_MD5SIG_SIZE; } To_PAWSCORRUPT::To_PAWSCORRUPT(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_TCPOPT_PAWSCORRUPT, "TCPOPT_DUMMY (PAWS)", IPPROTO_TCP, DUMMY_OPCODE) { } uint8_t To_PAWSCORRUPT::optApply(struct optHdrData *oD) { return 0; #define TCPOPT_TIMESTAMP_SIZE 10 #if 0 if (oD->getAvailableOptLen() < TCPOPT_TIMESTAMP_SIZE) return 0; const uint8_t index = oD->actual_opts_len; oD->optshdr[index] = TCPOPT_TIMESTAMP; oD->optshdr[index + 1] = TCPOPT_TIMESTAMP_SIZE; *((uint32_t *) & oD->optshdr[index + 2]) = htonl(sj_clock - 600); /* sj_clock - 10 minutes */ memset_random(&oD->optshdr[index + 6], 4); return TCPOPT_TIMESTAMP_SIZE; #endif } To_TIMESTAMP::To_TIMESTAMP(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_TCPOPT_TIMESTAMP, "TCPOPT_TIMESTAMP", IPPROTO_TCP, TCPOPT_TIMESTAMP) { } uint8_t To_TIMESTAMP::optApply(struct optHdrData *oD) { return 0; } To_MSS::To_MSS(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_TCPOPT_MSS, "TCPOPT_MAXSEG", IPPROTO_TCP, TCPOPT_MAXSEG) { } uint8_t To_MSS::optApply(struct optHdrData *oD) { return 0; } To_SACK::To_SACK(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_TCPOPT_SACK, "TCPOPT_SACK", IPPROTO_TCP, TCPOPT_SACK) { } uint8_t To_SACK::optApply(struct optHdrData *oD) { return 0; } To_SACKPERM::To_SACKPERM(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_TCPOPT_SACKPERM, "TCPOPT_SACK_PERMITTED", IPPROTO_TCP, TCPOPT_SACK_PERMITTED) { } uint8_t To_SACKPERM::optApply(struct optHdrData *oD) { return 0; } To_WINDOW::To_WINDOW(bool enable) : IPTCPopt::IPTCPopt(enable, SJ_TCPOPT_WINDOW, "TCPOPT_WINDOW", IPPROTO_TCP, TCPOPT_WINDOW) { } uint8_t To_WINDOW::optApply(struct optHdrData *oD) { return 0; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/IPTCPoptImpl.h0000644000000000000000000000756413147777044020111 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_IPTCPOPTIMPL_H #define SJ_IPTCPOPTIMPL_H #include "Utils.h" #include #include #include "IPTCPopt.h" #include "TTLFocus.h" #define IPOPT_NOOP_SIZE 1 #define IPOPT_CIPSO (6 |IPOPT_CONTROL|IPOPT_COPY) #define IPOPT_CIPSO_SIZE 10 #define IPOPT_SID_SIZE 4 #define TCPOPT_NOP_SIZE 1 #define TCPOPT_MD5SIG 19 #define TCPOPT_MD5SIG_SIZE 18 #define TCPOPT_MSS 2 #define TCPOPT_MSS_SIZE 4 #define DUMMY_OPCODE 255 class Io_NOOP : public IPTCPopt { public: Io_NOOP(bool); protected: uint8_t optApply(struct optHdrData *); }; class Io_EOL : public IPTCPopt { public: Io_EOL(bool); protected: uint8_t optApply(struct optHdrData *); }; class Io_TIMESTAMP : public IPTCPopt { public: Io_TIMESTAMP(bool); protected: uint8_t optApply(struct optHdrData *); }; class Io_TIMESTOVERFLOW : public IPTCPopt { private: TTLFocus *ttlfocus; public: Io_TIMESTOVERFLOW(bool); void setupTTLFocus(TTLFocus *); protected: uint8_t optApply(struct optHdrData *); }; class Io_LSRR : public IPTCPopt { public: Io_LSRR(bool); protected: uint8_t optApply(struct optHdrData *); }; class Io_RR : public IPTCPopt { public: Io_RR(bool); protected: uint8_t optApply(struct optHdrData *); }; class Io_RA : public IPTCPopt { public: Io_RA(bool); protected: uint8_t optApply(struct optHdrData *); }; class Io_CIPSO : public IPTCPopt { public: Io_CIPSO(bool); protected: uint8_t optApply(struct optHdrData *); }; class Io_SEC : public IPTCPopt { public: Io_SEC(bool); protected: uint8_t optApply(struct optHdrData *); }; class Io_SID : public IPTCPopt { public: Io_SID(bool); protected: uint8_t optApply(struct optHdrData *); }; class To_NOP : public IPTCPopt { public: To_NOP(bool); protected: uint8_t optApply(struct optHdrData *); }; class To_EOL : public IPTCPopt { public: To_EOL(bool); protected: uint8_t optApply(struct optHdrData *); }; class To_MD5SIG : public IPTCPopt { public: To_MD5SIG(bool); protected: uint8_t optApply(struct optHdrData *); }; class To_PAWSCORRUPT : public IPTCPopt { public: To_PAWSCORRUPT(bool); protected: uint8_t optApply(struct optHdrData *); }; class To_TIMESTAMP : public IPTCPopt { public: To_TIMESTAMP(bool); protected: uint8_t optApply(struct optHdrData *); }; class To_MSS : public IPTCPopt { public: To_MSS(bool); protected: uint8_t optApply(struct optHdrData *); }; class To_SACK : public IPTCPopt { public: To_SACK(bool); protected: uint8_t optApply(struct optHdrData *); }; class To_SACKPERM : public IPTCPopt { public: To_SACKPERM(bool); protected: uint8_t optApply(struct optHdrData *); }; class To_WINDOW : public IPTCPopt { public: To_WINDOW(bool); protected: uint8_t optApply(struct optHdrData *); }; #endif /* SJ_IPTCPOPTIMPL_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/NetIO.cc0000644000000000000000000003051713147777044016773 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2008 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "NetIO.h" #include "UserConf.h" #include #include #include #include #include extern auto_ptr userconf; void NetIO::setupNET() { int tmpflags; int tmpfd; struct ifreq tmpifr; memset(&tmpifr, 0x00, sizeof (tmpifr)); if ((netfd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP))) != -1) LOG_DEBUG("datalink layer socket packet opened successfully"); else RUNTIME_EXCEPTION("unable to open datalink layer packet: %s", strerror(errno)); if (((tmpflags = fcntl(netfd, F_GETFD)) != -1) && (fcntl(netfd, F_SETFD, tmpflags | FD_CLOEXEC) != -1)) LOG_DEBUG("flag FD_CLOEXEC set successfully in netfd (F_SETFD)"); else RUNTIME_EXCEPTION("unable to set flag FD_CLOEXEC on netfd (F_SETFD): %s", strerror(errno)); strncpy(tmpifr.ifr_name, userconf->runcfg.net_iface_name, sizeof (tmpifr.ifr_name)); if (ioctl(netfd, SIOCGIFINDEX, &tmpifr) != -1) LOG_DEBUG("ioctl(SIOCGIFINDEX) executed successfully on interface %s", userconf->runcfg.net_iface_name); else RUNTIME_EXCEPTION("unable to execute ioctl(SIOCGIFINDEX) on interface %s: %s", userconf->runcfg.net_iface_name, strerror(errno)); memset(&send_ll, 0x00, sizeof (send_ll)); send_ll.sll_family = PF_PACKET; send_ll.sll_protocol = htons(ETH_P_IP); send_ll.sll_ifindex = tmpifr.ifr_ifindex; send_ll.sll_hatype = 0; send_ll.sll_pkttype = PACKET_HOST; send_ll.sll_halen = ETH_ALEN; memcpy(send_ll.sll_addr, userconf->runcfg.gw_mac_addr, ETH_ALEN); if (bind(netfd, (struct sockaddr *) &send_ll, sizeof (send_ll)) != -1) LOG_DEBUG("binding datalink layer interface successfully"); else RUNTIME_EXCEPTION("unable to bind datalink layer interface: %s", strerror(errno)); tmpfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_IP); if (ioctl(tmpfd, SIOCGIFMTU, &tmpifr) != -1) LOG_DEBUG("netfd mtu correctly get read %u (SIOCGIFMTU)", tmpifr.ifr_mtu); else RUNTIME_EXCEPTION("unable to get netfd mtu(SIOCGIFMTU): %s", strerror(errno)); userconf->runcfg.net_iface_mtu = tmpifr.ifr_mtu; close(tmpfd); } void NetIO::setupTUN() { const char *tundev = "/dev/net/tun"; int tmpflags; int tmpfd; struct ifreq tmpifr; memset(&tmpifr, 0x00, sizeof (tmpifr)); if ((tunfd = open(tundev, O_RDWR)) != -1) LOG_DEBUG("%s opened successfully", tundev); else RUNTIME_EXCEPTION("unable to open %s: %s, check the kernel module", tundev, strerror(errno)); if (((tmpflags = fcntl(tunfd, F_GETFD)) != -1) && (fcntl(tunfd, F_SETFD, tmpflags | FD_CLOEXEC) != -1)) LOG_DEBUG("flag FD_CLOEXEC set successfully on tunfd (F_SETFD)"); else RUNTIME_EXCEPTION("unable to set flag FD_CLOEXEC on tunfd (F_SETFD): %s", strerror(errno)); strncpy(tmpifr.ifr_name, TUN_IF_NAME, sizeof (tmpifr.ifr_name)); tmpifr.ifr_flags = IFF_TUN | IFF_NO_PI; if (ioctl(tunfd, TUNSETIFF, &tmpifr) != -1) LOG_DEBUG("flags set successfully on tunfd (TUNSETIFF)"); else RUNTIME_EXCEPTION("unable to set flags on tunfd (TUNSETIFF): %s", strerror(errno)); tmpfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_IP); if (ioctl(tmpfd, SIOCGIFFLAGS, &tmpifr) != -1) LOG_DEBUG("tunfd flags correctly read (SIOCGIFFLAGS)"); else RUNTIME_EXCEPTION("unable to get tunfd flags (SIOCGIFFLAGS): %s", strerror(errno)); tmpifr.ifr_flags |= IFF_UP | IFF_RUNNING | IFF_POINTOPOINT; if (ioctl(tmpfd, SIOCSIFFLAGS, &tmpifr) != -1) LOG_DEBUG("tunfd flags correctly set (SIOCSIFFLAGS)"); else RUNTIME_EXCEPTION("unable to get tunfd flags (SIOCSIFFLAGS): %s", strerror(errno)); userconf->runcfg.tun_iface_mtu = userconf->runcfg.net_iface_mtu - TUN_IF_MTU_DIFF; tmpifr.ifr_mtu = userconf->runcfg.tun_iface_mtu; if (ioctl(tmpfd, SIOCSIFMTU, &tmpifr) != -1) LOG_DEBUG("tunfd mtu correctly set to %u (SIOCSIFMTU)", userconf->runcfg.tun_iface_mtu); else RUNTIME_EXCEPTION("unable to set tunfd mtu to %u (SIOCSIFMTU): %s", userconf->runcfg.tun_iface_mtu, strerror(errno)); ((struct sockaddr_in *) &tmpifr.ifr_addr)->sin_family = AF_INET; ((struct sockaddr_in *) &tmpifr.ifr_addr)->sin_addr.s_addr = inet_addr(userconf->runcfg.net_iface_ip); if (ioctl(tmpfd, SIOCSIFADDR, &tmpifr) != -1) LOG_DEBUG("tunfd local addr correctly set to %s", userconf->runcfg.net_iface_ip); else RUNTIME_EXCEPTION("unable to set tunfd local addr to %s: %s", userconf->runcfg.net_iface_ip, strerror(errno)); ((struct sockaddr_in *) &tmpifr.ifr_addr)->sin_family = AF_INET; ((struct sockaddr_in *) &tmpifr.ifr_addr)->sin_addr.s_addr = inet_addr(DEFAULT_FAKE_IPADDR); memcpy(userconf->runcfg.tun_iface_ip, DEFAULT_FAKE_IPADDR, strlen(DEFAULT_FAKE_IPADDR)); if (ioctl(tmpfd, SIOCSIFDSTADDR, &tmpifr) != -1) LOG_DEBUG("tunfd point-to-point dest addr correctly set to %s", DEFAULT_FAKE_IPADDR); else RUNTIME_EXCEPTION("unable to set tunfd point-to-point dest addr to %s: %s", DEFAULT_FAKE_IPADDR, strerror(errno)); close(tmpfd); } NetIO::NetIO(void) { LOG_DEBUG(""); char cmd[MEDIUMBUF]; if (getuid() || geteuid()) RUNTIME_EXCEPTION("required root privileges"); /* pseudo sanity check of received data, sjconf had already make something */ if (strlen(userconf->runcfg.gw_ip_addr) < 7 || strlen(userconf->runcfg.gw_ip_addr) > 17) RUNTIME_EXCEPTION("invalid ip address [%s] is not an IPv4, check the config", userconf->runcfg.gw_ip_addr); if (strlen(userconf->runcfg.gw_mac_str) != 17) RUNTIME_EXCEPTION("invalid mac address [%s] is not a MAC, check the config", userconf->runcfg.gw_mac_str); setupNET(); setupTUN(); fds[0].fd = tunfd; fds[1].fd = netfd; snprintf(cmd, sizeof (cmd), "route del default"); LOG_VERBOSE("deleting default gateway in routing table"); execOSCmd(cmd); snprintf(cmd, sizeof (cmd), "route add default gw %s", DEFAULT_FAKE_IPADDR""); LOG_VERBOSE("setting default gateway our fake TUN endpoint ip address: %s", DEFAULT_FAKE_IPADDR); execOSCmd(cmd); snprintf(cmd, sizeof (cmd), "iptables -A INPUT -m mac --mac-source %s -j DROP", userconf->runcfg.gw_mac_str); LOG_ALL("dropping all traffic from the gateway [%s]", cmd); execOSCmd(cmd); } NetIO::~NetIO(void) { LOG_DEBUG(""); char cmd[MEDIUMBUF]; if (getuid() || geteuid()) LOG_VERBOSE("this process (%d) is not root: unable to restore default gw", getpid()); else { snprintf(cmd, sizeof (cmd), "route del default"); LOG_VERBOSE("root process (%d): deleting our default gw [route del default]", getpid()); execOSCmd(cmd); snprintf(cmd, sizeof (cmd), "ifconfig %s down", TUN_IF_NAME); LOG_VERBOSE("shutting down interface [%s]", TUN_IF_NAME, cmd); execOSCmd(cmd); snprintf(cmd, sizeof (cmd), "route add default gw %s", userconf->runcfg.gw_ip_addr); LOG_VERBOSE("restoring previous default gateway [%s]", cmd); execOSCmd(cmd); snprintf(cmd, sizeof (cmd), "iptables -D INPUT -m mac --mac-source %s -j DROP", userconf->runcfg.gw_mac_str); LOG_VERBOSE("deleting the filtering rule: [%s]", cmd); execOSCmd(cmd); } close(tunfd); close(netfd); } void NetIO::prepareConntrack(TCPTrack *ct) { conntrack = ct; } void NetIO::networkIO(void) { /* * This is a critical function for sniffjoke operativity. * * this function implements a variable poll step * if there is some data to send out the poll timout is set to * infinite because it's important to force data flush. * * if there is no data to send out the poll timeout is always * set to 1 ms; * * with a max cycle count of 10 and a poll timeout of 1ms * we will exit if: * - a burst of 20 pkts (10 network + 10 tunnel) has been received; * - a delay of 10ms has passed. * * read, read, read and than re-read all comments hundred times * before thinking to change this :P * */ uint32_t max_cycle = NETIOBURSTSIZE; vector pktbuf(userconf->runcfg.net_iface_mtu); ssize_t ret; Packet *pkt_tun = conntrack->readpacket(TUNNEL); Packet *pkt_net = conntrack->readpacket(NETWORK); while (pkt_tun != NULL || pkt_net != NULL || max_cycle) { if (max_cycle != 0) max_cycle--; if (pkt_tun != NULL || pkt_net != NULL) { /* * if there is some data to flush out the poll * timeout is set to infinite */ fds[0].events = (pkt_net != NULL) ? POLLIN | POLLOUT : POLLIN; fds[1].events = (pkt_tun != NULL) ? POLLIN | POLLOUT : POLLIN; nfds = poll(fds, 2, -1); } else { /* * if there are not data to flush out the poll * timeout is set to 1ms */ fds[0].events = POLLIN; fds[1].events = POLLIN; timespec timeout; timeout.tv_sec = 0; timeout.tv_nsec = 1000000; nfds = ppoll(fds, 2, &timeout, NULL); } if (!nfds) continue; /* in the three cases poll/ppoll is set, now we check the nfds return value */ if (nfds == -1) RUNTIME_EXCEPTION("strange and dangerous error in ppoll: %s", strerror(errno)); if (fds[0].revents & POLLIN) /* it's possibile to read from tunfd */ { ret = read(tunfd, &(pktbuf[0]), userconf->runcfg.tun_iface_mtu); if (ret == -1) RUNTIME_EXCEPTION("error reading from tunnel: %s", strerror(errno)); conntrack->writepacket(TUNNEL, &(pktbuf[0]), ret); } if (fds[0].revents & POLLOUT) /* it's possibile to write in tunfd */ { ret = write(tunfd, &(pkt_net->pbuf[0]), pkt_net->pbuf.size()); if (ret == -1) /* on single thread applications after a poll a write returns -1 only on error's case. */ RUNTIME_EXCEPTION("error writing in tunnel: %s", strerror(errno)); /* correctly written in tunfd */ delete pkt_net; pkt_net = conntrack->readpacket(NETWORK); } if (fds[1].revents & POLLIN) /* it's possible to read from netfd */ { ret = recv(netfd, &(pktbuf[0]), userconf->runcfg.net_iface_mtu, 0); if (ret == -1) RUNTIME_EXCEPTION("error reading from network: %s", strerror(errno)); conntrack->writepacket(NETWORK, &(pktbuf[0]), ret); } if (fds[1].revents & POLLOUT) /* it's possibile to write in netfd */ { ret = sendto(netfd, &(pkt_tun->pbuf[0]), pkt_tun->pbuf.size(), 0x00, (struct sockaddr *) &send_ll, sizeof (send_ll)); if (ret == -1) /* on single thread applications after a poll a write returns -1 only on error's case. */ RUNTIME_EXCEPTION("error writing in network: %s", strerror(errno)); /* correctly written in netfd */ delete pkt_tun; pkt_tun = conntrack->readpacket(TUNNEL); } } /* * If the flow control arrives here: * - output data has been flushed entirely * - there is some input data to handle (maximum 20 pkts i/o) or * a max delay of 10ms it's passed. */ conntrack->analyzePacketQueue(); } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/NetIO.h0000644000000000000000000000347713147777044016642 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2008 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_NETIO_H #define SJ_NETIO_H #include "Utils.h" #include "TCPTrack.h" #include #include class NetIO { private: TCPTrack *conntrack; /* tunfd/netfd: file descriptor for I/O purpose */ int tunfd; int netfd; /* * these data are required for handle * tunnel/ethernet man in the middle */ struct sockaddr_ll send_ll; /* poll variables, two file descriptors */ struct pollfd fds[2]; int nfds; int size; void setupTUN(); void setupNET(); public: /* * networkdown_condition express if the network is down and sniffjoke must be interrupted * --- but not killed! */ NetIO(void); ~NetIO(void); void prepareConntrack(TCPTrack *); void networkIO(void); }; #endif /* SJ_NETIO_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/OptionPool.cc0000644000000000000000000001470013147777044020113 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "hardcodedDefines.h" #include "OptionPool.h" #include "UserConf.h" extern auto_ptr userconf; const char *OptionPool::getCorruptionStr(corruption_t whatthafuck) { switch (whatthafuck) { case NOT_CORRUPT: return "notcorrupt"; case ONESHOT: return "oneshot"; case TWOSHOT: return "twoshot"; case BOTH: return "oneshot+twoshot"; case TRACK_ONLY: return "track only"; case CORRUPTUNASSIGNED: return "UNDEF-corruption"; default: RUNTIME_EXCEPTION("FATAL CODE [K1LL B1LL]: please send a notification to the developers"); } } corruption_t OptionPool::lineParser(FILE *flow, uint32_t optLooked) { corruption_t retval = CORRUPTUNASSIGNED; char line[MEDIUMBUF]; uint32_t linecnt = 0; uint32_t readedIndex, readedCorruption; do { if( fgets(line, MEDIUMBUF, flow) == NULL) break; ++linecnt; if (strlen(line) < 2 || line[0] == '#') continue; sscanf(line, "%u,%u", &readedIndex, &readedCorruption); if (readedIndex >= SUPPORTED_OPTIONS) RUNTIME_EXCEPTION("in option file invalid index at line %u", linecnt); if (readedIndex == optLooked) retval = (corruption_t) readedCorruption; else RUNTIME_EXCEPTION("found index %u instead of the expected %u (line %u)", readedIndex, optLooked, linecnt); if (feof(flow)) break; } while (retval == CORRUPTUNASSIGNED); if (retval == CORRUPTUNASSIGNED) RUNTIME_EXCEPTION("unable to found option index %u in the option config file", optLooked); return retval; } OptionPool::OptionPool() { /* WARNING: don't touch this piece of code if you are HIGH! */ pool.push_back(new Io_NOOP(true)); pool.push_back(new Io_EOL(false)); pool.push_back(new Io_TIMESTAMP(true)); pool.push_back(new Io_TIMESTOVERFLOW(false)); /* WARNING: don't touch this piece of code if you are SMOKED! */ pool.push_back(new Io_LSRR(true)); pool.push_back(new Io_RR(true)); pool.push_back(new Io_RA(true)); pool.push_back(new Io_CIPSO(true)); /* WARNING: don't touch this piece of code if you are DRUNKED! */ pool.push_back(new Io_SEC(true)); pool.push_back(new Io_SID(true)); pool.push_back(new To_NOP(true)); pool.push_back(new To_EOL(false)); /* WARNING: don't touch this piece of code if you are LAZY! */ pool.push_back(new To_MD5SIG(true)); pool.push_back(new To_PAWSCORRUPT(false)); pool.push_back(new To_TIMESTAMP(false)); pool.push_back(new To_MSS(false)); /* WARNING: don't touch this piece of code if you are BOXXY! */ pool.push_back(new To_SACK(false)); pool.push_back(new To_SACKPERM(false)); pool.push_back(new To_WINDOW(false)); /* WARNING, because the order MATTERS! this constructor column * IS DERIVED from the INCREMENTAL ORDER of the value in hardcodedDefines.h, and sj-iptcp-probe depends too! */ /* when is loaded the single plugin HDRoptions_probe, the option loader is instanced w/ NULL */ if (!(userconf->runcfg.onlyplugin[0] != 0x00 && !memcmp(userconf->runcfg.onlyplugin, IPTCPOPT_TEST_PLUGIN, strlen(IPTCPOPT_TEST_PLUGIN)))) { /* loading the configuration file, containings which option bring corruption for your ISP */ /* NOW - sets with the default used by vecna & evilaliv3 */ /* THESE DATA HAS TO BE LOADED FROM A Location-SPECIFIC CONFIGUATION FILE */ corruption_t writUsage; FILE *optInput = fopen(FILE_IPTCPOPT_CONF, "r"); if (optInput == NULL) RUNTIME_EXCEPTION("unable to open in reading options configuration %s: %s", FILE_IPTCPOPT_CONF, strerror(errno)); for (uint8_t sjI = 0; sjI < SUPPORTED_OPTIONS; ++sjI) { writUsage = lineParser(optInput, sjI); pool[sjI]->optionConfigure(writUsage); /* the enabling of an option has not sense anymore - TODO fix the constructor column before */ if(writUsage == TRACK_ONLY) pool[sjI]->enabled = false; else pool[sjI]->enabled = true; LOG_VERBOSE("configured option #%d %s as: [%s] %s", sjI, pool[sjI]->sjOptName, getCorruptionStr(writUsage), pool[sjI]->enabled ? "ENABLED" : "DISABLE" ); } fclose(optInput); LOG_DEBUG("options configuration loaded correctly from %s: %u defs", FILE_IPTCPOPT_CONF, SUPPORTED_OPTIONS); } else { /* testing modality - all options are loaded without a corruption definitions */ LOG_ALL("option configuration not supplied! Initializing in testing mode"); } } OptionPool::~OptionPool() { for (vector::iterator it = pool.begin(); it != pool.end(); it = pool.erase(it)) delete *it; } void OptionPool::disableAllOptions(void) { uint32_t enabledcnt = 0; for (vector::iterator it = pool.begin(); it != pool.end(); ++it) { if ((*it)->enabled == true) enabledcnt++; (*it)->enabled = false; } LOG_VERBOSE("%d options implementation was 'enabled', now all %d has been disabled", enabledcnt, pool.size()); } IPTCPopt *OptionPool::get(uint32_t sjOptIndex) { if (sjOptIndex >= SUPPORTED_OPTIONS) RUNTIME_EXCEPTION("Invalid index request: %u on %u available", sjOptIndex, SUPPORTED_OPTIONS); return pool[sjOptIndex]; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/OptionPool.h0000644000000000000000000000403013147777044017750 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_OPTIONPOOL_H #define SJ_OPTIONPOOL_H #include "IPTCPopt.h" #include "IPTCPoptImpl.h" class OptionPool { private: /* the settedProto and counter is used as static variable in the classes because is * used to track the counter in the getNextOpt methods */ uint8_t settedProto; uint8_t counter; vector pool; public: /* loadedOption is the main struct where the implementation are stored: HDRoptions * need to initialize every instance with them, and I've preferred a static reference */ OptionPool(); ~OptionPool(); /* methods for popoulate availOpts in HDRoptions */ IPTCPopt * get(uint32_t); /* construction is overloaded because in the UserConf routine the * configuration file is loaded and the static variable is setup. * * in hijacking time the constructor is called without any args */ corruption_t lineParser(FILE *, uint32_t); const char *getCorruptionStr(corruption_t); void disableAllOptions(void); }; #endif /* SJ_OPTIONPOOL_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/Packet.cc0000644000000000000000000005051413147777044017223 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "hardcodedDefines.h" /* defined at the bottom of hardcodedDefines.h */ #ifdef HEAVY_PACKET_DEBUG #include #include #endif #include "Packet.h" #include "HDRoptions.h" #include "UserConf.h" extern auto_ptr userconf; uint32_t Packet::SjPacketIdCounter; Packet::Packet(const unsigned char* buff, uint16_t size) : prev(NULL), next(NULL), queue(QUEUEUNASSIGNED), SjPacketId(++SjPacketIdCounter), source(SOURCEUNASSIGNED), proto(PROTOUNASSIGNED), position(POSITIONUNASSIGNED), wtf(JUDGEUNASSIGNED), choosableScramble(0), chainflag(HACKUNASSIGNED), fragment(false), fragFakeMTU(0), pbuf(size) { memcpy(&(pbuf[0]), buff, size); updatePacketMetadata(0, 0); } Packet::Packet(const Packet& pkt) : prev(NULL), next(NULL), queue(QUEUEUNASSIGNED), SjPacketId(++SjPacketIdCounter), source(SOURCEUNASSIGNED), proto(PROTOUNASSIGNED), position(POSITIONUNASSIGNED), wtf(JUDGEUNASSIGNED), choosableScramble(0), chainflag(pkt.chainflag), fragment(false), fragFakeMTU(0), pbuf(pkt.pbuf) { updatePacketMetadata(0, 0); this->SELFLOG("newly generated packet from: sjI#%d", pkt.SjPacketId); } Packet::Packet(const Packet& pkt, uint16_t ipdataoff, uint16_t fragdatalen, uint16_t fakeMTU) : prev(NULL), next(NULL), queue(QUEUEUNASSIGNED), SjPacketId(++SjPacketIdCounter), source(SOURCEUNASSIGNED), proto(PROTOUNASSIGNED), position(POSITIONUNASSIGNED), wtf(JUDGEUNASSIGNED), choosableScramble(0), chainflag(pkt.chainflag), fragment(true), fragFakeMTU(fakeMTU), pbuf(fragdatalen + sizeof(struct iphdr)) { /* copy of the IP header */ memcpy(&(pbuf[0]), &(pkt.pbuf[0]), sizeof(struct iphdr)); /* and of the selected IP payload */ memcpy(&(pbuf[sizeof(struct iphdr)]), &(pkt.pbuf[pkt.iphdrlen + ipdataoff]), fragdatalen); if ( (fragdatalen + sizeof(struct iphdr)) > fakeMTU ) { RUNTIME_EXCEPTION("creation of a fragment of (%d + %d ) with fake MTU of %d", fragdatalen, sizeof(struct iphdr), fakeMTU); } /* * now the packet has only the iphdr, without option and the ip payload, * 12 bytes options are assured between pbuf.size() and fakeMTU, if required a resize */ updatePacketMetadata(sizeof(struct iphdr), fragdatalen); this->SELFLOG("newly generated fragment (dataoff %d fraglen %d fakeMTU %d) source: sjI#%d", ipdataoff, fragdatalen, fakeMTU, pkt.SjPacketId); } uint32_t Packet::maxMTU(void) { /* when a fragment is created, also a fake MTU is passed as value */ if(fragment) return fragFakeMTU; else return userconf->runcfg.net_iface_mtu; } uint32_t Packet::freespace(void) { return maxMTU() - pbuf.size(); } /* the arguments are usually (0, 0): except in fragment creation: in this case, * the iphdr is stripped of the options and thus became iphdr, and tot_len is * resized by the construct in memcpy, therfore the new value is forced here */ void Packet::updatePacketMetadata(uint16_t forceHDRsize, uint16_t forceTOTsize) { const uint16_t pktlen = pbuf.size(); /* start initial metadata reset */ ip = NULL; iphdrlen = 0; ippayload = NULL; ippayloadlen = 0; /* unions initialization; * one for all because variables are all pointers or uint32_t */ tcp = NULL; /* udp, icmp */ tcphdrlen = 0; /* udphdrlen, icmphdrlen */ tcppayload = NULL; /* udppayload, icmppayload */ tcppayloadlen = 0; /* udppayloadlen, icmppayloadlen */ /* end initial metadata reset */ /* start IP update */ if (pktlen < sizeof (struct iphdr)) RUNTIME_EXCEPTION("pktlen < sizeof(struct iphdr)"); ip = (struct iphdr *) &(pbuf[0]); if (!forceHDRsize) { iphdrlen = ip->ihl * 4; } else { iphdrlen = forceHDRsize; ip->ihl = (forceHDRsize / 4); } ippayloadlen = pbuf.size() - iphdrlen; if (ippayloadlen) ippayload = (unsigned char *) ip + iphdrlen; if (pktlen < iphdrlen) RUNTIME_EXCEPTION("pktlen < iphdrlen"); if (forceTOTsize) ip->tot_len = htons(forceTOTsize + sizeof(struct iphdr)); /* end IP update */ if (fragment) { /* note: the frag_off and the flags at the moment is managed by the * calling functions, not by Packet. This will be not clean, but for * permit a selfcontained management, is required a passage of various * data (more fragment, the effective offset) and in fact these info * are decided by the calling member. */ proto = OTHER_IP; return; } switch (ip->protocol) { case IPPROTO_TCP: proto = TCP; /* start tcp update */ if (pktlen < iphdrlen + sizeof (struct tcphdr)) RUNTIME_EXCEPTION("pktlen < iphdrlen + sizeof(struct tcphdr)"); tcp = (struct tcphdr *) (ippayload); tcphdrlen = tcp->doff * 4; if (pktlen < iphdrlen + tcphdrlen) RUNTIME_EXCEPTION("pktlen < iphdrlen + tcphdrlen"); if (!(tcphdrlen >= sizeof(struct tcphdr) && tcphdrlen <= sizeof(struct tcphdr) + MAXTCPOPTIONS)) { RUNTIME_EXCEPTION("invalid tcphdrlen %d (min %d max %d)", tcphdrlen, sizeof(struct tcphdr), sizeof(struct tcphdr) + MAXTCPOPTIONS); } tcppayloadlen = pktlen - iphdrlen - tcphdrlen; if (tcppayloadlen) tcppayload = (unsigned char *) tcp + tcphdrlen; /* end tcp update */ break; case IPPROTO_UDP: proto = UDP; /* start udp update */ if (pktlen < iphdrlen + sizeof (struct udphdr)) RUNTIME_EXCEPTION("pktlen < iphdrlen + sizeof(struct udphdr)"); udp = (struct udphdr *) (ippayload); udphdrlen = sizeof (struct udphdr); if (pktlen < iphdrlen + udphdrlen) RUNTIME_EXCEPTION("pktlen < iphdrlen + udphdrlen"); if (pktlen < iphdrlen + ntohs(udp->len)) RUNTIME_EXCEPTION("pktlen != iphdrlen + ntohs(udp->len)"); udppayloadlen = pktlen - iphdrlen - udphdrlen; if (udppayloadlen) udppayload = (unsigned char *) tcp + udphdrlen; /* end udp update */ break; case IPPROTO_ICMP: proto = ICMP; /* start icmp update */ if (pktlen < iphdrlen + sizeof (struct icmphdr)) RUNTIME_EXCEPTION("pktlen < iphdrlen + sizeof(struct icmphdr)"); icmp = (struct icmphdr *) (ippayload); icmphdrlen = sizeof (struct icmphdr); if (pktlen < iphdrlen + icmphdrlen) RUNTIME_EXCEPTION("pktlen != iphdrlen + icmphdrlen"); icmppayloadlen = pktlen - iphdrlen - icmphdrlen; if (icmppayloadlen) icmppayload = (unsigned char *) icmp + icmphdrlen; /* end icmp update */ break; default: proto = OTHER_IP; } } uint32_t Packet::computeHalfSum(const unsigned char* data, uint16_t len) { const uint16_t *usdata = (uint16_t *) data; const uint16_t *end = (uint16_t *) data + (len / sizeof (uint16_t)); uint32_t sum = 0; while (usdata != end) sum += *usdata++; if (len % 2) sum += *(uint8_t *) usdata; return sum; } uint16_t Packet::computeSum(uint32_t sum) { sum = (sum >> 16) + (sum & 0xFFFF); sum += (sum >> 16); return ~sum; } void Packet::fixIPSum(void) { ip->check = 0; uint32_t sum = computeHalfSum((const unsigned char *) ip, iphdrlen); ip->check = computeSum(sum); } void Packet::fixIPTCPSum(void) { fixIPSum(); tcp->check = 0; uint32_t sum = computeHalfSum((const unsigned char *) &ip->saddr, 8); sum += htons(IPPROTO_TCP + ippayloadlen); sum += computeHalfSum((const unsigned char *) tcp, ippayloadlen); tcp->check = computeSum(sum); } void Packet::fixIPUDPSum(void) { fixIPSum(); udp->check = 0; uint32_t sum = computeHalfSum((const unsigned char *) &ip->saddr, 8); sum += htons(IPPROTO_UDP + ippayloadlen); sum += computeHalfSum((const unsigned char *) udp, ippayloadlen); udp->check = computeSum(sum); } void Packet::fixSum(void) { if (fragment == false) { switch (proto) { case TCP: fixIPTCPSum(); break; case UDP: fixIPUDPSum(); break; default: fixIPSum(); } } else { fixIPSum(); } } void Packet::corruptSum(void) { if (fragment == false) { switch (proto) { case TCP: tcp->check += 0xd34d; break; case UDP: udp->check += 0xd34d; break; default: ip->check += 0xd34d; } } else { ip->check += 0xd34d; } } bool Packet::selfIntegrityCheck(const char *pluginName) { if (wtf == JUDGEUNASSIGNED) { LOG_ALL("in %s not set \"wtf\" field (what the fuck Sj has to do with this packet?)", pluginName); goto errorinfo; } if (choosableScramble == 0) { LOG_ALL("in %s not set \"choosableScramble\" field (what the fuck Sj can to do with this packet?)", pluginName); goto errorinfo; } if (proto == PROTOUNASSIGNED) { LOG_ALL("in %s not set \"proto\" field, required %u", pluginName, pbuf.size()); goto errorinfo; } if (position == POSITIONUNASSIGNED) { LOG_ALL("in %s not set \"position\" field, required", pluginName); goto errorinfo; } if (chainflag == HACKUNASSIGNED) { LOG_ALL("in %s not set \"chainflag\" field, required", pluginName); goto errorinfo; } return true; errorinfo: LOG_VERBOSE("Invalid packet generation from a plugin: not a strong problem, but must be handled. remind"); return false; } void Packet::randomizeID(void) { ip->id = htons(ntohs(ip->id) - 10 + (random() % 20)); } void Packet::iphdrResize(uint8_t size) { if (size == iphdrlen) return; const uint16_t pktlen = pbuf.size(); /* * safety checks delegated to the function caller: * size : must be multiple of 4; * size : must be >= sizeof(struct iphdr)); * size : must be <= MAXIPHEADER; * pktlen - iphdrlen + size : must be <= maxMTU(). */ /* its important to update values into hdr before vector insert call because it can cause relocation */ ip->ihl = size / 4; vector::iterator it = pbuf.begin(); if (iphdrlen < size) { ip->tot_len = htons(pktlen + (size - iphdrlen)); pbuf.insert(it + iphdrlen, size - iphdrlen, IPOPT_NOOP); } else { /* iphdrlen > size */ ip->tot_len = htons(pktlen - (iphdrlen - size)); pbuf.erase(it + size, it + iphdrlen); } updatePacketMetadata(0, 0); } void Packet::tcphdrResize(uint8_t size) { if (fragment == true) RUNTIME_EXCEPTION("it's not possible to call this function on a ip fragment"); if (size == tcphdrlen) return; const uint16_t pktlen = pbuf.size(); /* * safety checks delegated to the function caller: * - size : must be multiple of 4; * - size : must be >= sizeof(struct tcphdr)); * - size : must be <= MAXTCPHEADER; * - pktlen - tcphdrlen + size : must be <= maxMTU(). */ /* its important to update values into hdr before vector insert call because it can cause relocation */ tcp->doff = size / 4; vector::iterator it = pbuf.begin() + iphdrlen; if (tcphdrlen < size) { ip->tot_len = htons(pktlen + (size - tcphdrlen)); pbuf.insert(it + tcphdrlen, size - tcphdrlen, TCPOPT_NOP); } else { /* tcphdrlen > size */ ip->tot_len = htons(pktlen - (tcphdrlen - size)); pbuf.erase(it + size, it + tcphdrlen); } updatePacketMetadata(0, 0); } void Packet::ippayloadResize(uint16_t size) { if (size == ippayloadlen) return; const uint16_t pktlen = pbuf.size(); /* begin safety checks */ if (pktlen - ippayloadlen + size > (int16_t) maxMTU()) RUNTIME_EXCEPTION("pktlen - ippayloadlen + (new) size > MTU"); /* end safety checks */ const uint16_t new_total_len = pktlen - ippayloadlen + size; /* its important to update values into hdr before vector insert call because it can cause relocation */ ip->tot_len = htons(new_total_len); pbuf.resize(new_total_len); updatePacketMetadata(0, 0); } void Packet::tcppayloadResize(uint16_t size) { if (size == tcppayloadlen) return; const uint16_t pktlen = pbuf.size(); /* begin safety checks */ if (pktlen - tcppayloadlen + size > (int16_t) maxMTU()) RUNTIME_EXCEPTION("pktlen - tcppayloadlen + (new) size > MTU"); /* end safety checks */ const uint16_t new_total_len = pktlen - tcppayloadlen + size; /* its important to update values into hdr before vector insert call because it can cause relocation */ ip->tot_len = htons(new_total_len); pbuf.resize(new_total_len); updatePacketMetadata(0, 0); } void Packet::udppayloadResize(uint16_t size) { if (size == udppayloadlen) return; const uint16_t pktlen = pbuf.size(); /* begin safety checks */ if (pktlen - udppayloadlen + size > (int16_t) maxMTU()) RUNTIME_EXCEPTION("pktlen - udppayload + (new) size > MTU"); /* end safety checks */ const uint16_t new_total_len = pktlen - udppayloadlen + size; /* its important to update values into hdr before vector insert call because it can cause relocation */ ip->tot_len = htons(new_total_len); /* in udp we have also to correct the len field */ udp->len = htons(udphdrlen + size); pbuf.resize(new_total_len); updatePacketMetadata(0, 0); } void Packet::ippayloadRandomFill(void) { memset_random(ippayload, pbuf.size() - iphdrlen); } void Packet::tcppayloadRandomFill(void) { memset_random(tcppayload, pbuf.size() - (iphdrlen + tcphdrlen)); } void Packet::udppayloadRandomFill(void) { memset_random(udppayload, pbuf.size() - (iphdrlen + udphdrlen)); } void Packet::payloadRandomFill(void) { if (fragment == false) { switch (proto) { case TCP: tcppayloadRandomFill(); break; case UDP: udppayloadRandomFill(); break; default: ippayloadRandomFill(); break; } } else { ippayloadRandomFill(); } } void Packet::selflog(const char *func, const char *format, ...) const { if (debug.level() == SUPPRESS_LEVEL) return; char loginfo[LARGEBUF] = {0}; va_list arguments; va_start(arguments, format); vsnprintf(loginfo, sizeof (loginfo), format, arguments); va_end(arguments); const char *p; char protoinfo[MEDIUMBUF] = {0}, saddr[MEDIUMBUF] = {0}, daddr[MEDIUMBUF] = {0}; p = inet_ntoa(*((struct in_addr *) &(ip->saddr))); strncpy(saddr, p, sizeof (saddr)); p = inet_ntoa(*((struct in_addr *) &(ip->daddr))); strncpy(daddr, p, sizeof (daddr)); const char *sourcestr = getSourceStr(source); const char *wtfstr = getWtfStr(wtf); const char *chainstr = getChainStr(chainflag); if (!fragment) { switch (proto) { case TCP: snprintf(protoinfo, sizeof (protoinfo), "TCP %u:%u SAFR{%u%u%u%u} L %u = %u+%u+%u", ntohs(tcp->source), ntohs(tcp->dest), tcp->syn, tcp->ack, tcp->fin, tcp->rst, (unsigned int) pbuf.size(), (htons(ip->tot_len) - ippayloadlen), (tcp->doff * 4), htons(ip->tot_len) - (ip->ihl * 4) - (tcp->doff * 4) ); break; case UDP: snprintf(protoinfo, sizeof (protoinfo), "UDP %u->%u len|%u(%u)", ntohs(udp->source), ntohs(udp->dest), (unsigned int) pbuf.size(), (unsigned int) (pbuf.size() - iphdrlen - udphdrlen) ); break; case ICMP: snprintf(protoinfo, sizeof (protoinfo), "ICMP type|%d code|%d len|%u(%u)", icmp->type, icmp->code, (unsigned int) pbuf.size(), (unsigned int) (pbuf.size() - iphdrlen - sizeof (struct icmphdr)) ); break; case OTHER_IP: snprintf(protoinfo, sizeof (protoinfo), "other proto: %d", ip->protocol); break; default: RUNTIME_EXCEPTION("FATAL CODE [CYN1C]: please send a notification to the developers (%u)", proto); break; } LOG_PACKET("%s: i%u s'%s w'%s c'%s %s->%s [%s] ttl:%u %s", func, SjPacketId, sourcestr, wtfstr, chainstr, saddr, daddr, protoinfo, ip->ttl, loginfo); } else { LOG_PACKET("%s: i%u s'%s w'%s c'%s %s->%s FRAG:%u '%s' ttl:%u %s", func, SjPacketId, sourcestr, wtfstr, chainstr, saddr, daddr, ntohs(ip->frag_off & IP_OFFMASK), ntohs(ip->frag_off & IP_MF) ? "MF" : "!MF", ip->ttl, loginfo); } } Packet::~Packet() { #ifdef HEAVY_PACKET_DEBUG #define PACKETLOG_PREFIX_TCP "TCPpktLog/" #define PACKETLOG_PREFIX_UDP "UDPpktLog/" const char *protoprefix = NULL; uint16_t sport = 0; uint16_t dport = 0; switch (proto) { case TCP: protoprefix = PACKETLOG_PREFIX_TCP; sport = ntohs(tcp->source); dport = ntohs(tcp->dest); break; case UDP: protoprefix = PACKETLOG_PREFIX_UDP; sport = ntohs(udp->source); dport = ntohs(udp->dest); break; case ICMP: case OTHER_IP: return; case PROTOUNASSIGNED: RUNTIME_EXCEPTION("FATAL CODE [L3B0WSK1]: please send a notification to the developers (%u)", proto); } mkdir(protoprefix, 0770); char fname[MEDIUMBUF]; snprintf(fname, MEDIUMBUF, "%s%s", protoprefix, inet_ntoa(*((struct in_addr *) &ip->daddr))); FILE *packetLog = fopen(fname, "a+"); if (packetLog == NULL) RUNTIME_EXCEPTION("unable to open %s:%s", fopen, strerror(errno)); fprintf(packetLog, "%d\t%d:%d%s%d\tchain %s, position %d, judge [%s], queue %d, from [%s]\n", SjPacketId, sport, dport, fragment ? "\tfrag " : "\t", (unsigned int) pbuf.size(), getChainStr(chainflag), position, getWtfStr(wtf), queue, getSourceStr(source)); fclose(packetLog); #endif } const char * Packet::getWtfStr(judge_t wtf) const { switch (wtf) { case PRESCRIPTION: return "ttlexpire"; case INNOCENT: return "innocent"; case GUILTY: return "badcksum"; case MALFORMED: return "malformed"; case JUDGEUNASSIGNED: return "U"; default: RUNTIME_EXCEPTION("FATAL CODE [3V0LUT10N4RYSL33PER]: please send a notification to the developers"); } } const char * Packet::getSourceStr(source_t source) const { switch (source) { case TUNNEL: return "tunnel"; case NETWORK: return "network"; case PLUGIN: return "hackinject"; case TRACEROUTE: return "tracert"; case SOURCEUNASSIGNED: return "U"; default: RUNTIME_EXCEPTION("FATAL CODE [S1KT4MBUR0]: please send a notification to the developers"); } } const char * Packet::getChainStr(chaining_t chainflag) const { switch (chainflag) { case FINALHACK: return "final"; case REHACKABLE: return "reHackable"; case HACKUNASSIGNED: return "U"; default: RUNTIME_EXCEPTION("FATAL CODE [P4ND3LD14V0L0]: please send a notification to the developers"); } } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/Packet.h0000644000000000000000000001371713147777044017071 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_PACKET_H #define SJ_PACKET_H #include "Utils.h" #include #include #include #include #include #include /* IT'S FUNDAMENTAL TO HAVE ALL ENUMS VALUES AS POWERS OF TWO TO PERMIT OR MASKS */ /* queue_t is a a reflection variable used by packet to know in what queue it's inserted */ enum queue_t { QUEUEUNASSIGNED = 0, YOUNG = 1, KEEP = 2, HACK = 4, SEND = 8 }; /* if the packet is injected by sniffjoke is marked with the evilbit */ enum evilbit_t { MORALITYUNASSIGNED = 0, GOOD = 1, EVIL = 2 }; /* the source_t is the nature of the packet, ANY_SOURCE is used at catch-all */ enum source_t { SOURCEUNASSIGNED = 0, TUNNEL = 1, NETWORK = 2, PLUGIN = 4, TRACEROUTE = 8 }; /* an enum for the proto. ANY_PROTO is the catch-all used when the queue(s) are queryed */ enum proto_t { PROTOUNASSIGNED = 0, TCP = 1, UDP = 2, ICMP = 4, OTHER_IP = 8 }; /* Every sniffjoke packet is based on be discarged from the remote host and accepted from * the sniffer, in order to obtain the sniffer tracking poisoning, those marker mean if the * packet need to be plain and correct (INNOCENT) to expire prematurely (PRESCRIPTION) to be * consider bad and discarged (GUILTY, corrupt the TCP checksum), MALFORMED (weird ip options) * or a random choose of those */ enum judge_t { JUDGEUNASSIGNED = 0, INNOCENT = 1, PRESCRIPTION = 2, GUILTY = 4, MALFORMED = 8 }; /* a sniffjoke packet should be send before the original packet or after the original packet */ enum position_t { POSITIONUNASSIGNED = 0, ANY_POSITION = 1, ANTICIPATION = 2, POSTICIPATION = 4 }; /* a packet will be rehacked or will not, these value are used in chaining mode */ enum chaining_t { HACKUNASSIGNED = 0, FINALHACK = 1, REHACKABLE = 2 }; class Packet { private: friend class PacketQueue; static uint32_t SjPacketIdCounter; Packet *prev; Packet *next; /* reflection variable used on queue change */ queue_t queue; public: uint32_t SjPacketId; /* variable to keep track of packet creation origins */ source_t source; /* proto variable, redundant but useful because defined to permit OR masks */ proto_t proto; /* status variable to force relative position of a packet with respect to an other. */ position_t position; /* define the actual selected scramble for the packet */ judge_t wtf; /* defines the acceptable scrambles accepted by the packet */ uint8_t choosableScramble; /* status variable for chained hack inherited on Packet(const Packet &). significative only if source == PLUGIN */ chaining_t chainflag; bool fragment; uint16_t fragFakeMTU; struct iphdr *ip; uint8_t iphdrlen; /* [20 - 60] bytes */ unsigned char *ippayload; uint16_t ippayloadlen; /* [0 - 65515] bytes */ union { struct tcphdr *tcp; struct udphdr *udp; struct icmphdr *icmp; }; union { uint8_t tcphdrlen; /* [20 - 60] bytes */ uint8_t udphdrlen; /* fixed: 8 bytes*/ uint8_t icmphdrlen; /* fixed: 8 bytes*/ }; union { unsigned char *tcppayload; unsigned char *udppayload; unsigned char *icmppayload; }; union { uint16_t tcppayloadlen; /* [0 - 65515] bytes */ uint16_t udppayloadlen; /* [0 - 65527] bytes */ uint16_t icmppayloadlen; /* [0 - 65527] bytes */ }; vector pbuf; /* pkt creation from readed buffer */ Packet(const unsigned char *, uint16_t); /* pkt creation from exisiting Packet object */ Packet(const Packet &); /* pkt fragment creation from an existing packet */ Packet(const Packet &, uint16_t, uint16_t, uint16_t); ~Packet(); uint32_t maxMTU(void); uint32_t freespace(void); void updatePacketMetadata(uint16_t, uint16_t); /* IP/TCP checksum functions */ uint32_t computeHalfSum(const unsigned char*, uint16_t); uint16_t computeSum(uint32_t); void fixIPSum(void); void fixIPTCPSum(void); void fixIPUDPSum(void); void fixSum(void); void corruptSum(void); /* autochecking */ bool selfIntegrityCheck(const char *); /* functions required in TCP/IP packets forging */ void randomizeID(void); void iphdrResize(uint8_t); void tcphdrResize(uint8_t); void ippayloadResize(uint16_t); void tcppayloadResize(uint16_t); void udppayloadResize(uint16_t); void ippayloadRandomFill(void); void tcppayloadRandomFill(void); void udppayloadRandomFill(void); void payloadRandomFill(void); /* MALFORMED hacks and distortion of INNOCENT packets */ bool injectIPOpts(bool, bool); bool injectTCPOpts(bool, bool); /* utilities */ void selflog(const char *, const char *, ...) const; const char *getWtfStr(judge_t) const; const char *getSourceStr(source_t) const; const char *getChainStr(chaining_t) const; }; #endif /* SJ_PACKET_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/PacketFilter.cc0000644000000000000000000000753213147777044020373 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "PacketFilter.h" FilterEntry::FilterEntry(uint16_t id, uint16_t totallen, uint32_t saddr, uint32_t daddr) : ip_id(id), ip_totallen(totallen), ip_saddr(saddr), ip_daddr(daddr) { } FilterEntry::FilterEntry(const Packet &pkt) : ip_id(pkt.ip->id), ip_totallen(pkt.ip->tot_len), ip_saddr(pkt.ip->saddr), ip_daddr(pkt.ip->daddr) { } bool FilterEntry::operator<(FilterEntry comp) const { if (ip_id < comp.ip_id) return true; else if (ip_id > comp.ip_id) return false; else { if (ip_totallen < comp.ip_totallen) return true; else if (ip_totallen > comp.ip_totallen) return false; else { if (ip_saddr < comp.ip_saddr) return true; else if (ip_saddr > comp.ip_saddr) return false; else { if (ip_daddr < comp.ip_daddr) return true; else return false; } } } } FilterMultiset::FilterMultiset(void) : timeout_len(PLUGINHASH_EXPIRYTIME), manage_timeout(sj_clock + timeout_len), first(&fm[0]), second(&fm[1]) { } FilterMultiset::~FilterMultiset(void) { first->clear(); second->clear(); } /* * tests the existance of the entry; * returns: * - true: if found, and automatically does remove the entry; * due to the multiset entry can be duplicated, this is * a feature much important that permit a fine count * during packet filtering. * * - false: if not found. */ bool FilterMultiset::check(const FilterEntry &hash) { manage(); if (first->erase(hash) || second->erase(hash)) return true; return false; } /* * inserts a new entry; due to the use of multiset entry can be * duplicate; this is particular important to permit multiple * packet to define multiple filters. * so repeated filters works as a fine counter during packet filtering. * */ void FilterMultiset::add(const FilterEntry &hash) { second->insert(hash); } void FilterMultiset::manage(void) { if (manage_timeout > sj_clock - timeout_len) return; multiset *tmp = first; first = second; second = tmp; second->clear(); manage_timeout = sj_clock + timeout_len; } bool PacketFilter::filterICMPErrors(const Packet &pkt) { if (pkt.icmppayloadlen > sizeof (struct iphdr)) { const struct iphdr *ip = (struct iphdr*) pkt.icmppayload; FilterEntry filter(ip->id, ip->tot_len, ip->saddr, ip->daddr); return filter_multiset.check(filter); } return false; } void PacketFilter::add(const Packet& pkt) { FilterEntry hash(pkt); filter_multiset.add(hash); } bool PacketFilter::match(const Packet& pkt) { if (pkt.proto == ICMP) return filterICMPErrors(pkt); return false; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/PacketFilter.h0000644000000000000000000000361013147777044020226 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "Utils.h" #include "Packet.h" class FilterEntry { public: const uint16_t ip_id; const uint16_t ip_totallen; const uint32_t ip_saddr; const uint32_t ip_daddr; FilterEntry(uint16_t, uint16_t, uint32_t, uint32_t); FilterEntry(const Packet &); bool operator<(FilterEntry) const; }; class FilterMultiset { private: const uint32_t timeout_len; uint32_t manage_timeout; multiset fm[2]; multiset *first; multiset *second; /* called automagically */ void manage(void); public: FilterMultiset(void); ~FilterMultiset(void); bool check(const FilterEntry &); void add(const FilterEntry &); }; class PacketFilter { private: FilterMultiset filter_multiset; bool filterICMPErrors(const Packet &pkt); public: void add(const Packet& pkt); bool match(const Packet& pkt); }; sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/PacketQueue.cc0000644000000000000000000001211513147777044020223 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "PacketQueue.h" PacketQueue::PacketQueue(void) : pkt_count(0), cur_queue(FIRST_QUEUE), cur_pkt(NULL), next_pkt(NULL) { LOG_DEBUG(""); memset(front, 0, sizeof (Packet*)*(QUEUE_NUM)); memset(back, 0, sizeof (Packet*)*(QUEUE_NUM)); } PacketQueue::~PacketQueue(void) { LOG_DEBUG(""); for (uint8_t i = FIRST_QUEUE; i <= LAST_QUEUE; ++i) { select((queue_t) i); while (get() && cur_pkt != NULL) delete cur_pkt; } } void PacketQueue::insert(Packet &pkt, queue_t queue) { if (pkt.queue != QUEUEUNASSIGNED) extract(pkt); /* pkt is not in any queue so: pkt.prev == NULL; pkt.next == NULL; */ ++pkt_count; pkt.queue = queue; if (front[queue] == NULL) { front[queue] = &pkt; back[queue] = &pkt; } else { pkt.prev = back[queue]; pkt.next = NULL; back[queue]->next = &pkt; back[queue] = &pkt; } } void PacketQueue::insertBefore(Packet &pkt, Packet &ref) { if (pkt.queue != QUEUEUNASSIGNED) extract(pkt); /* pkt is not in any queue so: pkt.prev == NULL; pkt.next == NULL; */ ++pkt_count; pkt.queue = ref.queue; if (front[ref.queue] == &ref) { pkt.prev = NULL; pkt.next = &ref; ref.prev = &pkt; front[ref.queue] = &pkt; return; } /* * ref is not front of the queue; * so it always has prev that we cand dereference without checking != NULL */ pkt.prev = ref.prev; pkt.next = &ref; ref.prev->next = &pkt; ref.prev = &pkt; } void PacketQueue::insertAfter(Packet &pkt, Packet &ref) { if (pkt.queue != QUEUEUNASSIGNED) extract(pkt); /* pkt is not in any queue so: pkt.prev == NULL; pkt.next == NULL; */ ++pkt_count; pkt.queue = ref.queue; if (back[ref.queue] == &ref) { pkt.prev = &ref; ref.next = &pkt; back[ref.queue] = &pkt; return; } /* * ref is not back of the queue; * so it always has next that we can dereference without checking != NULL */ pkt.prev = &ref; pkt.next = ref.next; ref.next->prev = &pkt; ref.next = &pkt; } void PacketQueue::extract(Packet &pkt) { --pkt_count; queue_t queue = pkt.queue; if (front[queue] == &pkt) { if (back[queue] == &pkt) { front[queue] = NULL; back[queue] = NULL; } else { /* * in this case we have always a next; * so we can dereference it without checking != NULL */ front[queue] = front[queue]->next; front[queue]->prev = NULL; } goto remove_reset_pkt; } else if (back[queue] == &pkt) { /* * in this case we have always a prev; * so we can dereference it without checking != NULL */ back[queue] = back[queue]->prev; back[queue]->next = NULL; goto remove_reset_pkt; } /* * pkt is not front or back of any queue; * so it always has prev and next that we cand dereference without checking != NULL */ pkt.prev->next = pkt.next; pkt.next->prev = pkt.prev; remove_reset_pkt: pkt.queue = QUEUEUNASSIGNED; pkt.prev = NULL; pkt.next = NULL; } void PacketQueue::drop(Packet &pkt) { if (pkt.queue != QUEUEUNASSIGNED) extract(pkt); delete &pkt; } void PacketQueue::select(queue_t queue) { cur_queue = queue; cur_pkt = NULL; next_pkt = front[queue]; } Packet* PacketQueue::get(void) { if (next_pkt != NULL) { cur_pkt = next_pkt; next_pkt = next_pkt->next; return cur_pkt; /* FOUND */ } return NULL; /* NOT FOUND */ } Packet* PacketQueue::getSource(source_t requestSrc) { while (next_pkt != NULL) { cur_pkt = next_pkt; next_pkt = next_pkt->next; if (cur_pkt->source == requestSrc) return cur_pkt; /* FOUND */ } return NULL; /* NOT FOUND */ } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/PacketQueue.h0000644000000000000000000000341713147777044020072 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_PACKET_QUEUE_H #define SJ_PACKET_QUEUE_H #include "Utils.h" #include "Packet.h" #define FIRST_QUEUE (YOUNG) #define LAST_QUEUE (SEND) #define QUEUE_NUM (LAST_QUEUE + 1) class PacketQueue { private: uint32_t pkt_count; Packet *front[QUEUE_NUM]; Packet *back[QUEUE_NUM]; queue_t cur_queue; Packet *cur_pkt; Packet *next_pkt; public: PacketQueue(void); ~PacketQueue(void); void insert(Packet &, queue_t); void insertBefore(Packet &, Packet &); void insertAfter(Packet &, Packet &); void extract(Packet &); void drop(Packet &); void select(queue_t); Packet* get(void); Packet* getSource(source_t); uint32_t size(void) { return pkt_count; }; }; #endif /* SJ_PACKET_QUEUE_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/Plugin.cc0000644000000000000000000001725413147777044017256 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010, 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "Plugin.h" PluginCache::PluginCache(time_t timeout) : timeout_len(timeout), manage_timeout(sj_clock + timeout), first(&fm[0]), second(&fm[1]) { LOG_DEBUG(""); } PluginCache::~PluginCache() { LOG_DEBUG(""); for (vector::iterator it = first->begin(); it != first->end(); it = first->erase(it)) delete *it; for (vector::iterator it = second->begin(); it != second->end(); it = second->erase(it)) delete *it; } cacheRecord* PluginCache::check(bool(*filter)(const cacheRecord &, const Packet &), const Packet &pkt) { manage(); for (vector::iterator it = first->begin(); it != first->end(); ++it) { if (filter(**it, pkt)) { cacheRecord *record = *it; /* update entry timeout moving it to the freshest vector */ first->erase(it); second->push_back(record); return record; } } for (vector::iterator it = second->begin(); it != second->end(); ++it) { if (filter(**it, pkt)) return *it; } return NULL; } cacheRecord* PluginCache::add(const Packet &pkt) { cacheRecord *newrecord = new cacheRecord(pkt); second->push_back(newrecord); return newrecord; } cacheRecord* PluginCache::add(const Packet &pkt, const unsigned char *data, size_t data_size) { cacheRecord *newrecord = new cacheRecord(pkt, data, data_size); second->push_back(newrecord); return newrecord; } void PluginCache::explicitDelete(struct cacheRecord *record) { for (vector::iterator it = first->begin(); it != first->end(); ++it) { if (*it == record) { delete *it; first->erase(it); return; } } for (vector::iterator it = second->begin(); it != second->end(); ++it) { if (*it == record) { delete *it; second->erase(it); return; } } } void PluginCache::manage(void) { if (manage_timeout > sj_clock - timeout_len) return; for (vector::iterator it = first->begin(); it != first->end(); it = first->erase(it)) delete *it; vector *tmp = first; first = second; second = tmp; manage_timeout = sj_clock + timeout_len; } Plugin::Plugin(const char* pluginName, uint16_t pluginFrequency) : pluginName(pluginName), pluginFrequency(pluginFrequency), removeOrigPkt(false) { } /* * availableScrambles is passed in the plugin application, is choose * related by the avalability in the sniffjoke status * * supportedScrambles is the declared usage in the startup */ judge_t Plugin::pktRandomDamage(uint8_t availableScrambles, uint8_t supportedScrambles) { uint8_t scrambles = (availableScrambles & supportedScrambles); char availStr[MEDIUMBUF], supportStr[MEDIUMBUF], andedStr[MEDIUMBUF]; snprintfScramblesList(availStr, MEDIUMBUF, availableScrambles); snprintfScramblesList(supportStr, MEDIUMBUF, supportedScrambles); snprintfScramblesList(andedStr, MEDIUMBUF, scrambles); if (ISSET_TTL(scrambles) && random_percent(70)) { LOG_PACKET("%s %s: avail [%s] init [%s] both [%s], choosed PRESCRIPTION", __func__, pluginName, availStr, supportStr, andedStr); return PRESCRIPTION; } if (ISSET_MALFORMED(scrambles) && random_percent(95)) { LOG_PACKET("%s %s: avail [%s] init [%s] both [%s], choosed MALFORMED", __func__, pluginName, availStr, supportStr, andedStr); return MALFORMED; } LOG_PACKET("%s %s: avail [%s] init [%s] both [%s], choosed GUILTY", __func__, pluginName, availStr, supportStr, andedStr); return GUILTY; } bool Plugin::condition(const Packet &, uint8_t availableScrambles) { return true; } void Plugin::apply(const Packet &, uint8_t availableScrambles) { return; } void Plugin::mangleIncoming(Packet &pkt) { } void Plugin::reset(void) { removeOrigPkt = false; pktVector.clear(); } void Plugin::upgradeChainFlag(Packet *pkt) { switch (pkt->chainflag) { case HACKUNASSIGNED: pkt->chainflag = REHACKABLE; break; case REHACKABLE: pkt->chainflag = FINALHACK; break; case FINALHACK: LOG_ALL("Warning: a non hackable-again packet has requested an increment status: check packet_id %u", pkt->SjPacketId); } } /* easy interface for cache handling inside an extended Plugin class, * you need to register as private plugins own "cache" onject and pass them, it * work more or less like the "get" and "find" differencies in the Pool */ cacheRecord *Plugin::verifyIfCache( bool(*pktFilter)(const cacheRecord &, const Packet &), PluginCache *localCache, const Packet &origpkt) { cacheRecord *ret = localCache->check(pktFilter, origpkt); /* if not present, need to be created a new entry */ if (ret == NULL) { uint32_t firstCachedPkt = 1; localCache->add(origpkt, (const unsigned char*) &firstCachedPkt, sizeof (firstCachedPkt)); } return ret; } /************ * * As explained in PluginList.txt, at the moment exists three kind of different macrotype of plugins, * every of these three kind, will require different method in supports * ************/ /* ___ forcedClosing section ___ * this is used as cache filter, aiming to match */ bool Plugin::tupleMatch(const cacheRecord &record, const Packet &pkt) { const Packet &refpkt = record.cached_packet; return (refpkt.ip->daddr == pkt.ip->daddr && refpkt.tcp->source == pkt.tcp->source && refpkt.tcp->dest == pkt.tcp->dest); } /* ___ forcedClosing section ___ * this is used for increase the probability af a matched packet, to be send early in the session */ bool Plugin::inverseProportionality(uint32_t pkts, uint32_t min_inj_pkts, uint32_t max_inj_pkts) { if (pkts < min_inj_pkts) return true; if (pkts > max_inj_pkts) return false; return (random_percent(100 - (pkts * max_inj_pkts))); } /* ___ forcedClosing section ___ */ /* ___ payldBreakin section ___ */ bool Plugin::ackedseqMatch(const cacheRecord &record, const Packet &pkt) { const Packet &refpkt = record.cached_packet; uint32_t expectedAck = *((uint32_t *)(&record.cached_data[0])); /* is used to check if a sequence sent is being ACKed */ return (refpkt.ip->daddr == pkt.ip->saddr && refpkt.tcp->dest == pkt.tcp->source && refpkt.tcp->dest == pkt.tcp->source && expectedAck == pkt.tcp->ack_seq); } /* ___ payldBreakin section ___ */ /* ___ badSync section ___ */ /* ___ badSync section ___ */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/Plugin.h0000644000000000000000000000766413147777044017124 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_PLUGIN_H #define SJ_PLUGIN_H #include "Utils.h" #include "Packet.h" /* * * Following this howto: http://www.faqs.org/docs/Linux-mini/C++-dlopen.html * we understood how to do a plugin and load it. * HackPacket classes are implemented as external modules and the programmer * shoulds implement condition and apply, constructor and distructor methods. * * At the end of every plugin code, it's is required to export two "C" symbols, * pointing to the constructor and the destructor method. * */ class cacheRecord { public: const Packet cached_packet; vectorcached_data; cacheRecord(const Packet& pkt) : cached_packet(pkt) { }; cacheRecord(const Packet& pkt, const unsigned char* data, size_t data_size) : cached_packet(pkt), cached_data(data, data + data_size) { }; }; class PluginCache { time_t timeout_len; time_t manage_timeout; vector fm[2]; vector *first; vector *second; /* called automagically */ void manage(void); public: PluginCache(time_t = PLUGINCACHE_EXPIRYTIME); ~PluginCache(); /* we export the iterator as return to permit explicit cache removal; this is not a requirement for plugins, due to the mangage routine included in cacheCheck */ cacheRecord* check(bool(*)(const cacheRecord &, const Packet &), const Packet &); cacheRecord* add(const Packet &); cacheRecord* add(const Packet &, const unsigned char*, size_t); void explicitDelete(struct cacheRecord *); }; class Plugin { public: const char * const pluginName; /* plugin name as const string */ uint8_t supportedScrambles; /* supported by the location, derived from plugin_enabler.conf.$location */ const uint16_t pluginFrequency; /* plugin frequency, using the value */ bool removeOrigPkt; /* boolean to be set true if the plugin needs to remove the original packet */ vector pktVector; /* std vector of Packet* used for created packets */ Plugin(const char *, uint16_t); judge_t pktRandomDamage(uint8_t, uint8_t); void upgradeChainFlag(Packet *); /* Plugin is an abstract class */ virtual bool init(uint8_t, char *, struct sjEnviron *) = 0; virtual bool condition(const Packet &, uint8_t); virtual void apply(const Packet &, uint8_t); virtual void mangleIncoming(Packet &); virtual void reset(void); /* follow the utilities usable by the plugins */ cacheRecord *verifyIfCache(bool(*)(const cacheRecord &, const Packet &), PluginCache *, const Packet &); bool inverseProportionality(uint32_t, uint32_t, uint32_t); /* filter used in caching, these are passed to cache.check and verifyIfCache */ static bool tupleMatch(const cacheRecord &, const Packet &); static bool ackedseqMatch(const cacheRecord &, const Packet &); }; #endif /* SJ_PLUGIN_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/PluginPool.cc0000644000000000000000000002773313147777044020113 0ustar00/*' * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011, 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "PluginPool.h" #include "UserConf.h" #include extern auto_ptr userconf; PluginTrack::PluginTrack(const char *plugabspath, uint8_t enabledScrambles, char *plugOpt) { LOG_VERBOSE("constructor %s to %s option [%s]", __func__, plugabspath, plugOpt); char enabledScramblesStr[LARGEBUF] = {0}; void *swapPtr; pluginHandler = dlopen(plugabspath, RTLD_NOW); if (pluginHandler == NULL) RUNTIME_EXCEPTION("unable to load plugin %s: %s", plugabspath, dlerror()); /* * Coder: we had used * http://www.opengroup.org/onlinepubs/009695399/functions/dlsym.html as reference * for use dlsym() insice C++, but if you serch in the web the following string: * * ISO C++ forbids casting between pointer-to-function and pointer-to-object * * you will understand because the old way: * fp_DeletePluginObj = (destructor_f *) dlsym(pluginHandler, "deletePluginObj"); * has been substituted at the moment with the less safe, but without warning, * usage of memcpy between the pointer returned by dlsym and the function pointer (fp_Blah) */ swapPtr = forcedSymbolCopy("createPluginObj", plugabspath); memcpy( (void *)&fp_CreatePluginObj, &swapPtr, sizeof(void *)); swapPtr = forcedSymbolCopy("deletePluginObj", plugabspath); memcpy( (void *)&fp_DeletePluginObj, &swapPtr, sizeof(void *)); swapPtr = forcedSymbolCopy("versionValue", plugabspath); memcpy( (void *)&fp_versionValue, &swapPtr, sizeof(void *)); if (strlen(fp_versionValue()) != strlen(SW_VERSION) || strcmp(fp_versionValue(), SW_VERSION)) { RUNTIME_EXCEPTION("loading %s incorred version (%s) with SniffJoke %s", plugabspath, fp_versionValue(), SW_VERSION); } selfObj = fp_CreatePluginObj(); if (selfObj->pluginName == NULL) { RUNTIME_EXCEPTION("Invalid implementation: %s lack of ->PluginName member", plugabspath); } declaredScramble = enabledScrambles; if(plugOpt != NULL) declaredOpt = strdup(plugOpt); else declaredOpt = NULL; snprintfScramblesList(enabledScramblesStr, sizeof (enabledScramblesStr), enabledScrambles); LOG_ALL("Loading of %s: %s, scramble sets %s(%d), acquired option [%s]", plugabspath, selfObj->pluginName, enabledScramblesStr, enabledScrambles, plugOpt != NULL ? plugOpt : "NONE" ); } void *PluginTrack::forcedSymbolCopy( const char *symName, const char *pap) { void *obtainPtr = dlsym(pluginHandler, symName); if (obtainPtr == NULL ) { RUNTIME_EXCEPTION("plugin %s lack of the symbol %s mangling symbols", pap, symName); } return obtainPtr; } void PluginPool::initializeAll(struct sjEnviron *autoptrList) { uint32_t counter = 1; for (vector::iterator it = pool.begin(); it != pool.end(); ++it) { const PluginTrack *plugin = *it; bool initval; initval = plugin->selfObj->init(plugin->declaredScramble, plugin->declaredOpt, autoptrList); if(initval == false) { RUNTIME_EXCEPTION("Unable to init %s whitin the current configuration context: scramble %d opt [%s]", plugin->selfObj->pluginName, plugin->declaredScramble, plugin->declaredOpt != NULL ? plugin->declaredOpt : "/" ); } LOG_DEBUG("%d) Initialized %s successfull with complete configuration context: scramble %d opt [%s]", counter, plugin->selfObj->pluginName, plugin->declaredScramble, plugin->declaredOpt != NULL ? plugin->declaredOpt : "/" ); counter++; } } /* * the constructor of PluginPool is called once; in the TCPTrack constructor the class member * plugin_pool is instanced. what we need here is to read the entire plugin list, open and fix the * list, keeping track in listOfPlugin variable * * plugin_pool() * * (class TCPTrack).plugin_pool is the name of the unique PluginPool element */ PluginPool::PluginPool(void) : globalEnabledScrambles(0) { /* globalEnabledScrambles is set from the sum of each plugin configuration */ if (userconf->runcfg.onlyplugin[0]) parseOnlyPlugin(); else parseEnablerFile(); if (!pool.size()) RUNTIME_EXCEPTION("fatal error: loaded correctly 0 plugins"); else LOG_ALL("loaded correctly %d plugins", pool.size()); char enabledScramblesStr[LARGEBUF]; snprintfScramblesList(enabledScramblesStr, sizeof (enabledScramblesStr), globalEnabledScrambles); LOG_ALL("Globally enabled scrambles: [%s]", enabledScramblesStr); LOG_ALL("SniffJoke will use this configuration to create confusion also on real packets"); } PluginPool::~PluginPool(void) { LOG_DEBUG(""); /* call the distructor loaded from the plugins */ for (vector::iterator it = pool.begin(); it != pool.end(); it = pool.erase(it)) { const PluginTrack *plugin = *it; LOG_DEBUG("calling %s destructor and closing plugin handler", plugin->selfObj->pluginName); plugin->fp_DeletePluginObj(plugin->selfObj); dlclose(plugin->pluginHandler); if(plugin->declaredOpt != NULL) free(plugin->declaredOpt); delete plugin; } } void PluginPool::importPlugin(const char *plugabspath, const char *enablerEntry, uint8_t enabledScramble, char *pOpt) { try { PluginTrack *plugin = new PluginTrack(plugabspath, enabledScramble, pOpt); pool.push_back(plugin); } catch (runtime_error &e) { RUNTIME_EXCEPTION("unable to load plugin %s", enablerEntry); } } bool PluginPool::parseScrambleOpt(char *list_str, uint8_t *retval, char **opt) { struct scrambleparm { const char *keyword; uint8_t scramble; }; #define SCRAMBLE_SUPPORTED 4 const struct scrambleparm availablescramble[SCRAMBLE_SUPPORTED] = { { SCRAMBLE_TTL_STR, SCRAMBLE_TTL}, { SCRAMBLE_MALFORMED_STR, SCRAMBLE_MALFORMED}, { SCRAMBLE_CHECKSUM_STR, SCRAMBLE_CHECKSUM}, { SCRAMBLE_INNOCENT_STR, SCRAMBLE_INNOCENT} }; bool foundScramble = false; char copyStr[MEDIUMBUF] = {0}, *optParse = NULL; *retval = 0; memcpy(copyStr, list_str, strlen(list_str)); /* check if the option is used, the char used for separation is '+' * optParse and copyStr are used for sanity check ONLY */ if ((optParse = strchr(copyStr, '+')) != NULL) { (*optParse) = 0x00; (optParse)++; if (*optParse == 0x00) { LOG_ALL("no valid option passed after the control char '+': %s", list_str); goto invalid_parsing; } /* no other symbol are accepted */ if (!isalnum(*optParse)) { LOG_ALL("invalid char after '+' only alphanumeric and digit accepted: %s", list_str); goto invalid_parsing; } /* const assigment */ (*opt) = strchr(list_str, '+'); ++(*opt); } /* the plugin_enable.conf.$LOCATION file has this format: * plugin.so,SCRAMBLE1[,SCRAMBLE2][,SCRAMBLE3] */ for (uint32_t i = 0; i < SCRAMBLE_SUPPORTED; i++) { if (strstr(copyStr, availablescramble[i].keyword)) { foundScramble = true; (*retval) |= availablescramble[i].scramble; } } invalid_parsing: return foundScramble; } void PluginPool::parseOnlyPlugin(void) { LOG_VERBOSE("onlyplugin [%s] forced to be applied ALWAYS", userconf->runcfg.onlyplugin); char *comma; char *pluginOpt = NULL; char onlyplugin_cpy[MEDIUMBUF] = {0}; char plugabspath[MEDIUMBUF] = {0}; uint8_t pluginEnabledScrambles = 0; snprintf(onlyplugin_cpy, sizeof (onlyplugin_cpy), "%s", userconf->runcfg.onlyplugin); if ((comma = strchr(onlyplugin_cpy, ',')) == NULL) RUNTIME_EXCEPTION("invalid use of --only-plugin: (%s)", userconf->runcfg.onlyplugin); *comma = 0x00; comma++; snprintf(plugabspath, sizeof (plugabspath), "%s%s.so", INSTALL_LIBDIR, onlyplugin_cpy); if (!parseScrambleOpt(comma, &pluginEnabledScrambles, &pluginOpt)) RUNTIME_EXCEPTION("invalid use of --only-plugin: (%s)", userconf->runcfg.onlyplugin); importPlugin(plugabspath, userconf->runcfg.onlyplugin, pluginEnabledScrambles, pluginOpt); /* we keep track of enabled scramble to apply confusion on real good packets */ globalEnabledScrambles |= pluginEnabledScrambles; } void PluginPool::parseEnablerFile(void) { char enablerabspath[LARGEBUF] = {0}; char plugabspath[MEDIUMBUF] = {0}; char enabledScramblesStr[LARGEBUF] = {0}; char enablerentry[LARGEBUF] = {0}; snprintf(enablerabspath, sizeof (enablerabspath), "%s/%s", userconf->runcfg.working_dir, FILE_PLUGINSENABLER); FILE *plugfile = fopen(enablerabspath, "r"); if (plugfile == NULL) RUNTIME_EXCEPTION("unable to open in reading %s: %s", enablerabspath, strerror(errno)); uint8_t line = 0; do { char *comma; char *pluginOpt = NULL; uint8_t enabledScrambles = 0; if( fgets(enablerentry, LARGEBUF, plugfile) == NULL) break; ++line; if (enablerentry[0] == '#' || enablerentry[0] == '\n' || enablerentry[0] == ' ') continue; /* C's chop() */ enablerentry[strlen(enablerentry) - 1] = 0x00; /* 11 is the minimum length of a ?.so plugin, comma and strlen("GUILTY") the shortest keyword */ if (strlen(enablerentry) < 11 || feof(plugfile)) { RUNTIME_EXCEPTION("reading %s: imported %d plugins, matched interruption at line %d", FILE_PLUGINSENABLER, pool.size(), line); } /* parsing of the file line, finding the first comma and make it a 0x00 */ if ((comma = strchr(enablerentry, ',')) == NULL) { RUNTIME_EXCEPTION("reading %s at line %d lack the comma separator for scramble selection", FILE_PLUGINSENABLER, line); } /* name,SCRAMBLE became name[NULL]SCRAMBLE, *comma point to "S" */ *comma = 0x00; comma++; snprintf(plugabspath, sizeof (plugabspath), "%s%s.so", INSTALL_LIBDIR, enablerentry); if (!parseScrambleOpt(comma, &enabledScrambles, &pluginOpt)) { RUNTIME_EXCEPTION("in line %d (%s), no valid scramble are present in %s", line, enablerentry, FILE_PLUGINSENABLER); } snprintfScramblesList(enabledScramblesStr, sizeof (enabledScramblesStr), enabledScrambles); LOG_VERBOSE("importing plugin [%s] enabled scrambles %s", enablerentry, enabledScramblesStr); importPlugin(plugabspath, enablerentry, enabledScrambles, pluginOpt); /* we keep track of enabled scramble to apply confusion on real good packets */ globalEnabledScrambles |= enabledScrambles; } while (!feof(plugfile)); fclose(plugfile); } uint8_t PluginPool::enabledScrambles() { return globalEnabledScrambles; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/PluginPool.h0000644000000000000000000000400513147777044017740 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_PLUGINPOOL_H #define SJ_PLUGINPOOL_H #include "Utils.h" #include "UserConf.h" #include "Plugin.h" typedef Plugin* constructor_f(); typedef void destructor_f(Plugin *); typedef const char* version_f(void); class PluginTrack { public: void *pluginHandler; constructor_f *fp_CreatePluginObj; destructor_f *fp_DeletePluginObj; version_f *fp_versionValue; Plugin *selfObj; uint8_t declaredScramble; char *declaredOpt; PluginTrack(const char *, uint8_t, char *); private: void *forcedSymbolCopy( const char *, const char *); }; class PluginPool { private: uint8_t globalEnabledScrambles; void importPlugin(const char *, const char *, uint8_t, char *); void parseOnlyPlugin(void); void parseEnablerFile(void); bool parseScrambleOpt(char *, uint8_t *, char **); public: PluginPool(); ~PluginPool(void); uint8_t enabledScrambles(); void initializeAll(struct sjEnviron *); vector pool; }; #endif /* SJ_PLUGINPOOL_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/PortConf.cc0000644000000000000000000001523613147777044017550 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "PortConf.h" /* find the first separator, port:portkeyword. will be a ' ' or a \t */ void portLine::fixPointer(void) { uint32_t portLen = 0, i = 0; bool spacing = false, before = true; char *startStrPort = NULL, *startKeyword = NULL; while (i < linelen) { /* this happen when "line[i]" match an invalid byte before the port number */ if (spacing == false && before && !isdigit(line[i])) goto error_before; /* this happen when the first digit is matched, at the first space */ if (spacing == false && before && isdigit(line[i])) before = false; /* this is used for set the pointer to the first byte */ if (spacing == false && startStrPort == NULL && isdigit(line[i])) startStrPort = &line[i]; /* continue to set endStrPort to the last byte in port1,porti2 or port1:portN */ if (spacing == false && (isdigit(line[i]) || line[i] == ':' || line[i] == ',')) portLen++; /* this is the spacing */ if (spacing == false && (line[i] == ' ' || line[i] == '\t')) spacing = true; /* pointer to the keyword, break the loop */ if (spacing == true && (line[i] != ' ' && line[i] != '\t') && isupper(line[i])) { startKeyword = &line[i]; break; } i++; } if (startStrPort == NULL || portLen == 0 || startKeyword == NULL) { error_message = "not all fields found in this line"; return; } /* copy in the right buffer the pointed data */ memset(portsblock, 0x00, MEDIUMBUF); memcpy(portsblock, startStrPort, portLen); memset(keywordblock, 0x00, MEDIUMBUF); memcpy(keywordblock, startKeyword, strlen(startKeyword)); return; error_before: error_message = "separator between ports and keywords not found"; } void portLine::setup(const char *readedline) { memset(line, 0x00, MEDIUMBUF); memcpy(line, readedline, strlen(readedline)); /* this is a modification that make more easy the extractValue for/strchr loop */ linelen = strlen(line); OrValue = 0; memset(portSelected, 0x00, sizeof (portSelected)); error_message = NULL; fixPointer(); } void portLine::extractPorts(void) { char *p = portsblock; uint32_t readedp; /* check if the user is not too much optimistic about conf flexibility */ char *comma = strchr(p, ','); char *dpoints = strchr(p, ':'); if ((comma != NULL) && (dpoints != NULL)) goto not_so_flexibility_error; if (comma != NULL) /* block of code when the comma list is detected */ { do { *comma = 0x00; readedp = atoi(p); if (readedp >= PORTSNUMBER || readedp < 0) goto invalid_range; portSelected[(uint16_t) atoi(p)] = true; p = ++comma; } while ((comma = strchr(p, ',')) != NULL); /* the last port, eg, one,two,three, here is trapped "three" because before is not */ readedp = atoi(p); if (readedp >= PORTSNUMBER || readedp < 0) goto invalid_range; portSelected[(uint16_t) atoi(p)] = true; } else if (dpoints != NULL) /* block of code handling the startport:endport range */ { uint32_t readedendp; *dpoints = 0x00; readedp = atoi(p); if (readedp >= PORTSNUMBER || readedp < 0) goto invalid_range; p = ++dpoints; readedendp = atoi(p); if (readedendp >= PORTSNUMBER || readedendp < 0) goto invalid_range; while (readedp <= readedendp) { portSelected[(uint16_t) readedp] = true; ++readedp; } } else /* the "single port" */ { readedp = atoi(p); if (readedp >= PORTSNUMBER || readedp < 0) goto invalid_range; portSelected[(uint16_t) readedp] = true; } return; invalid_range: error_message = "invalid range found, permitted goes since 1 to 65535"; return; not_so_flexibility_error: error_message = "a configuration line will support comma separation OR port range with ':', not both"; } void portLine::extractValue(void) { char *p = &keywordblock[0]; const struct mapTheKeys *mtk; bool foundK; const struct mapTheKeys mappedKeywords[] = { { AGG_NONE, AGG_N_NONE}, { AGG_VERYRARE, AGG_N_VERYRARE}, { AGG_RARE, AGG_N_RARE}, { AGG_COMMON, AGG_N_COMMON}, { AGG_HEAVY, AGG_N_HEAVY}, { AGG_ALWAYS, AGG_N_ALWAYS}, { AGG_PACKETS10PEEK, AGG_N_PACKETS10PEEK}, { AGG_PACKETS30PEEK, AGG_N_PACKETS30PEEK}, { AGG_TIMEBASED5S, AGG_N_TIMEBASED5S}, { AGG_TIMEBASED20S, AGG_N_TIMEBASED20S}, { AGG_STARTPEEK, AGG_N_STARTPEEK}, { AGG_LONGPEEK, AGG_N_LONGPEEK}, { AGG_HANDSHAKE, AGG_N_HANDSHAKE}, { 0, NULL} }; do { /* every keywork checked must be found, otherwise is an error */ foundK = false; if (*p == ',') { *p = 0x00; ++p; } for (mtk = &mappedKeywords[0]; mtk->value; ++mtk) { if (!memcmp(mtk->keyword, p, strlen(mtk->keyword))) { foundK = true; OrValue |= mtk->value; break; } } if (!foundK) goto keyword_not_found; } while ((p = strchr(p, ',')) != NULL); return; keyword_not_found: error_message = "invalid keyword found in this line"; } void portLine::mergeLine(uint16_t *portarray) { for (uint32_t i = 0; i < PORTSNUMBER; ++i) { if (portSelected[i]) portarray[i] = OrValue; } } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/PortConf.h0000644000000000000000000000322613147777044017406 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Entertainment offered Order of the Stick, which link is * http://www.giantitp.com/comics/oots0001.html, anyway we was talkin' * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_PARSINGLINE_H #define SJ_PARSINGLINE_H #include "Utils.h" struct mapTheKeys { uint16_t value; const char *keyword; }; class portLine { private: char line[MEDIUMBUF], keywordblock[MEDIUMBUF], portsblock[MEDIUMBUF]; uint32_t linelen; uint16_t OrValue; bool portSelected[PORTSNUMBER]; void fixPointer(void); public: const char *error_message; void setup(const char *); void extractPorts(void); void extractValue(void); void mergeLine(uint16_t *); }; #endif /* SJ_PARSINGLINE_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/Process.cc0000644000000000000000000001741613147777044017436 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "Process.h" #include "UserConf.h" #include extern auto_ptr userconf; /* startup of the process */ Process::Process(void) : userinfo_buf(NULL), groupinfo_buf(NULL) { LOG_DEBUG(""); if (getuid() || geteuid()) RUNTIME_EXCEPTION("required root privileges"); struct passwd *userinfo_result; struct group *groupinfo_result; size_t userinfo_buf_len = sysconf(_SC_GETPW_R_SIZE_MAX); size_t groupinfo_buf_len = sysconf(_SC_GETGR_R_SIZE_MAX); userinfo_buf = calloc(1, userinfo_buf_len); groupinfo_buf = calloc(1, groupinfo_buf_len); if (userinfo_buf == NULL || groupinfo_buf == NULL) RUNTIME_EXCEPTION("problem during memory allocation for userinfo or groupinfo"); getpwnam_r(userconf->runcfg.user, &userinfo, (char*) userinfo_buf, userinfo_buf_len, &userinfo_result); getgrnam_r(userconf->runcfg.group, &groupinfo, (char*) groupinfo_buf, groupinfo_buf_len, &groupinfo_result); if (userinfo_result == NULL || groupinfo_result == NULL) RUNTIME_EXCEPTION("invalid user or group specified: %s, %s", userconf->runcfg.user, userconf->runcfg.group); } Process::~Process(void) { LOG_DEBUG("[process id %d, uid %d]", getpid(), getuid()); free(userinfo_buf); free(groupinfo_buf); } int Process::detach(void) { pid_t pid_child; int pdes[2]; if ( pipe(pdes) == -1 ) RUNTIME_EXCEPTION("pid %d unable to open pipe: %s", getpid(), strerror(errno)); if ((pid_child = fork()) == -1) RUNTIME_EXCEPTION("unable to fork (calling pid %d, parent %d)", getpid(), getppid()); if (pid_child) { /* * Sniffjoke SERVICE FATHER: root privileges * process delegated to network cleanhup */ close(pdes[1]); if( read(pdes[0], &pid_child, sizeof (pid_t)) == -1) LOG_ALL("failure in father/child communication: %s", strerror(errno)); close(pdes[0]); return pid_child; } else { /* * Sniffjoke SERVICE CHILD: I/O, user privileges * networking process */ pid_child = getpid(); close(pdes[0]); if( write(pdes[1], &pid_child, sizeof (pid_t)) == -1) LOG_ALL("failure in child/father communication: %s", strerror(errno)); close(pdes[1]); LOG_DEBUG("forked child process, pid %d", getpid()); return 0; } } void Process::jail(void) { const char* chroot_dir = userconf->runcfg.working_dir; if (chown(chroot_dir, userinfo.pw_uid, groupinfo.gr_gid)) { RUNTIME_EXCEPTION("chown of %s to %s:%s failed: %s: unable to start SniffJoke", chroot_dir, userconf->runcfg.user, userconf->runcfg.group, strerror(errno)); } if (chdir(chroot_dir) || chroot(chroot_dir)) RUNTIME_EXCEPTION("chroot into %s: %s: unable to start sniffjoke", chroot_dir, strerror(errno)); LOG_VERBOSE("chroot'ed process %d in %s", getpid(), chroot_dir); } void Process::privilegesDowngrade(void) { debug.downgradeOpenlog(userinfo.pw_uid, groupinfo.gr_gid); if (setgid(groupinfo.gr_gid) || setuid(userinfo.pw_uid)) RUNTIME_EXCEPTION("error loosing root privileges"); if (!getuid() && !geteuid()) RUNTIME_EXCEPTION("SniffJoke user process can't be runned with root privileges"); LOG_VERBOSE("process %d downgrade privileges to uid %d gid %d", getpid(), userinfo.pw_uid, groupinfo.gr_gid); } void Process::sigtrapSetup(sig_t sigtrap_function) { sigemptyset(&sig_nset); sigemptyset(&sig_oset); sigaddset(&sig_nset, SIGINT); sigaddset(&sig_nset, SIGABRT); sigaddset(&sig_nset, SIGPIPE); sigaddset(&sig_nset, SIGTERM); sigaddset(&sig_nset, SIGQUIT); struct sigaction action; memset(&action, 0, sizeof (struct sigaction)); action.sa_handler = sigtrap_function; action.sa_mask = sig_nset; sigaction(SIGINT, &action, NULL); sigaction(SIGABRT, &action, NULL); sigaction(SIGPIPE, &action, NULL); sigaction(SIGTERM, &action, NULL); sigaction(SIGQUIT, &action, NULL); sigaction(SIGUSR1, &action, NULL); sigaction(SIGUSR2, &action, NULL); } void Process::sigtrapEnable(void) { sigprocmask(SIG_SETMASK, &sig_oset, NULL); } void Process::sigtrapDisable(void) { sigprocmask(SIG_BLOCK, &sig_nset, &sig_oset); } pid_t Process::readPidfile(void) { int ret = 0; FILE *pidFile = fopen(SJ_PIDFILE, "r"); if (pidFile == NULL) { LOG_DEBUG("pidfile %s not present: %s", SJ_PIDFILE, strerror(errno)); return ret; } #define PIDBLEN 7 char tmpstr[PIDBLEN]; if (fgets(tmpstr, PIDBLEN, pidFile) != NULL) ret = atoi(tmpstr); fclose(pidFile); return ret; } void Process::writePidfile(void) { FILE *pidFile = fopen(SJ_PIDFILE, "w"); if (pidFile == NULL) RUNTIME_EXCEPTION("unable to open pidfile %s for pid %d for writing", SJ_PIDFILE, getpid()); LOG_DEBUG("created pidfile %s from %d", SJ_PIDFILE, getpid()); fprintf(pidFile, "%d", getpid()); fclose(pidFile); } /* pidfile will be deleted if personal or derived from another process, the argument mean this */ void Process::unlinkPidfile(bool killOther) { FILE *pidFile = fopen(SJ_PIDFILE, "r"); char line[SMALLBUF]; pid_t written; if (pidFile == NULL) { LOG_DEBUG("error with file %s: %s", SJ_PIDFILE, strerror(errno)); return; } if( fgets(line, SMALLBUF, pidFile) == NULL) { LOG_ALL("weird, %s unable to read ? or empty ? [%s] anyway, will be removed", SJ_PIDFILE, strerror(errno)); written = 0; } else written = atoi(line); fclose(pidFile); if (!written) { LOG_DEBUG("unable to read of %s", SJ_PIDFILE); goto __unlinkPidfile; } if (written != getpid() && killOther) { LOG_DEBUG("ready to delete %s with %d pid (we are %d)", SJ_PIDFILE, written, getpid()); goto __unlinkPidfile; } if (written != getpid()) { LOG_DEBUG("ignored request (written %d we %d)", written, getpid()); return; } __unlinkPidfile: if (unlink(SJ_PIDFILE)) RUNTIME_EXCEPTION("weird, I'm able to open but not to unlink %s: %s", SJ_PIDFILE, strerror(errno)); LOG_DEBUG("pid %d unlinked pidfile %s", getpid(), SJ_PIDFILE); } void Process::background(void) { if (fork()) exit(0); int i; for (i = getdtablesize(); i >= 0; --i) close(i); /* stdin */ i = open("/dev/null", O_RDWR); /* stdout lazy eval stderr */ if(dup(i) == -1 || dup(i) == -1) RUNTIME_EXCEPTION("unable to go in background: %s", strerror(errno)); } void Process::isolation(void) { LOG_DEBUG("the pid %d, uid %d is isolating themeself", getpid(), getuid()); setsid(); umask(027); } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/Process.h0000644000000000000000000000334613147777044017275 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_PROCESS_H #define SJ_PROCESS_H #include "Utils.h" #include "UserConf.h" #include #include #include #include class Process { private: struct passwd userinfo; void* userinfo_buf; struct group groupinfo; void* groupinfo_buf; sigset_t sig_nset; sigset_t sig_oset; public: Process(void); ~Process(void); pid_t readPidfile(void); void writePidfile(void); void unlinkPidfile(bool); int detach(void); void jail(void); void privilegesDowngrade(void); void sigtrapSetup(sig_t); void sigtrapEnable(void); void sigtrapDisable(void); void background(void); void isolation(void); }; #endif /* SJ_PROCESS_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/SessionTrack.cc0000644000000000000000000001526413147777044020427 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "hardcodedDefines.h" /* defined at the bottom of hardcodedDefines.h */ #ifdef HEAVY_SESSION_DEBUG #include #include #endif #include "SessionTrack.h" SessionTrack::SessionTrack(const Packet &pkt) : access_timestamp(0), daddr(pkt.ip->daddr), packet_number(0), injected_pktnumber(0) { if (pkt.proto == TCP) { proto = IPPROTO_TCP; sport = pkt.tcp->source; dport = pkt.tcp->dest; } else /* pkt.proto == UDP */ { proto = IPPROTO_UDP; sport = pkt.udp->source; dport = pkt.udp->source; } SELFLOG("New session created from Packet ID #%d", pkt.SjPacketId); } SessionTrack::~SessionTrack(void) { SELFLOG(""); #ifdef HEAVY_SESSION_DEBUG #define SESSIONLOG_PREFIX "sessionLog/" mkdir(SESSIONLOG_PREFIX, 0770); char fname[MEDIUMBUF]; snprintf(fname, MEDIUMBUF, "%s%s", SESSIONLOG_PREFIX, inet_ntoa(*((struct in_addr *) &daddr))); FILE *sessionLog = fopen(fname, "a+"); if (sessionLog == NULL) RUNTIME_EXCEPTION("unable to open %s:%s", fname, strerror(errno)); char sj_clock_str[MEDIUMBUF]; strftime(sj_clock_str, sizeof (sj_clock_str), "%F %T", localtime(&access_timestamp)); fprintf(sessionLog, "%s\t%d:%d\t#%d, inj #%d\n", sj_clock_str, ntohs(sport), ntohs(dport), packet_number, injected_pktnumber); fclose(sessionLog); #endif } void SessionTrack::selflog(const char *func, const char *format, ...) const { if (debug.level() == SUPPRESS_LEVEL) return; char loginfo[LARGEBUF]; va_list arguments; va_start(arguments, format); vsnprintf(loginfo, sizeof (loginfo), format, arguments); va_end(arguments); LOG_SESSION("%s %s S|-:%u D|%s:%d #pkts|%d #injs|%d %s", func, proto == IPPROTO_TCP ? "TCP" : "UDP", ntohs(sport), inet_ntoa(*((struct in_addr *) &daddr)), ntohs(dport), packet_number, injected_pktnumber, loginfo ); } bool SessionTrackKey::operator<(SessionTrackKey comp) const { if (proto < comp.proto) return true; else if (proto > comp.proto) return false; else { if (daddr < comp.daddr) return true; else if (daddr > comp.daddr) return false; else { if (sport < comp.sport) return true; else if (sport > comp.sport) return false; else { if (dport < comp.dport) return true; else return false; } } } } SessionTrackMap::SessionTrackMap(void) : manage_timeout(sj_clock) { LOG_DEBUG(""); } SessionTrackMap::~SessionTrackMap(void) { LOG_DEBUG(""); for (SessionTrackMap::iterator it = begin(); it != end();) { delete &(*it->second); erase(it++); } } /* return a sessiontrack given a packet; return a new sessiontrack if no one exists */ SessionTrack& SessionTrackMap::get(const Packet &pkt) { SessionTrack *sessiontrack; /* create map key */ SessionTrackKey key; key.daddr = pkt.ip->daddr; if (pkt.proto == TCP) { key.proto = IPPROTO_TCP; key.sport = pkt.tcp->source; key.dport = pkt.tcp->dest; } else /* (pkt.proto == UDP) */ { key.proto = IPPROTO_UDP; key.sport = pkt.udp->source; key.dport = pkt.udp->dest; } /* check if the key it's already present */ SessionTrackMap::iterator it = find(key); if (it != end()) /* on hit: return the sessiontrack object. */ sessiontrack = it->second; else /* on miss: create a new sessiontrack and insert it into the map */ sessiontrack = insert(pair(key, new SessionTrack(pkt))).first->second; /* update access timestamp using global clock */ sessiontrack->access_timestamp = sj_clock; return *sessiontrack; } void SessionTrackMap::manage(void) { /* timeout check */ if (manage_timeout < sj_clock - SESSIONTRACKMAP_MANAGE_ROUTINE_TIMER) { manage_timeout = sj_clock; /* update the next manage timeout */ for (SessionTrackMap::iterator it = begin(); it != end();) { if ((*it).second->access_timestamp + SESSIONTRACK_EXPIRYTIME < sj_clock) { delete &(*it->second); erase(it++); } else { it++; } } } /* size check */ uint32_t map_size = size(); uint32_t index; if (map_size > SESSIONTRACKMAP_MEMORY_THRESHOLD) { /* * we are forced to make a map cleanup. * to solve this critical condition we decide to reset half * of the map, and to do the best selection we reorder * the map by the access timestamp. * the complexity cost of this operation is O(NLogN) * due to the sort algorithm. * this is the worst case; (others operations are linear) */ SessionTrack** tmp = new SessionTrack*[map_size]; index = 0; for (SessionTrackMap::iterator it = begin(); it != end(); ++it) tmp[index++] = it->second; clear(); sort(tmp, tmp + map_size, sessiontrackTimestampComparison); index = 0; do { const SessionTrackKey key = {tmp[index]->daddr, tmp[index]->sport, tmp[index]->dport}; insert(pair(key, tmp[index])); } while (++index != SESSIONTRACKMAP_MEMORY_THRESHOLD / 2); do delete tmp[index]; while (++index != map_size); delete[] tmp; } } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/SessionTrack.h0000644000000000000000000000431413147777044020263 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_SESSIONTRACK_H #define SJ_SESSIONTRACK_H #include "Utils.h" #include "Packet.h" class SessionTrack { friend class SessionTrackMap; private: time_t access_timestamp; /* access timestamp used to decretee expiry */ public: uint8_t proto; uint32_t daddr; uint16_t sport; uint16_t dport; uint32_t packet_number; uint32_t injected_pktnumber; SessionTrack(const Packet &); ~SessionTrack(void); /* utilities */ void selflog(const char *func, const char *format, ...) const; }; class SessionTrackKey { public: uint8_t proto; uint32_t daddr; uint16_t sport; uint16_t dport; bool operator<(SessionTrackKey) const; }; class SessionTrackMap : public map { private: time_t manage_timeout; struct sessiontrack_timestamp_comparison { bool operator() (const SessionTrack *i, const SessionTrack * j) { return ( i->access_timestamp < j->access_timestamp); } } sessiontrackTimestampComparison; public: SessionTrackMap(void); ~SessionTrackMap(void); SessionTrack& get(const Packet &); void manage(void); }; #endif /* SJ_SESSIONTRACK_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/SniffJoke.cc0000644000000000000000000006115613147777044017676 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version.in * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "SniffJoke.h" #include #include #include /* global variables */ time_t sj_clock; char sj_clock_str[MEDIUMBUF]; Debug debug; auto_ptr userconf; auto_ptr ttlfocus_map; auto_ptr sessiontrack_map; auto_ptr opt_pool; auto_ptr plugin_pool; /* the main must implement it */ void sigtrap(int); SniffJoke::SniffJoke(const struct sj_cmdline_opts &opts) : alive(true), opts(opts), service_pid(0) { updateClock(); userconf = auto_ptr (new UserConf(opts)); proc = auto_ptr (new Process); LOG_DEBUG(""); } SniffJoke::~SniffJoke(void) { if (getuid() || geteuid()) { LOG_DEBUG("service with user privileges [%d]", getpid()); cleanServerUser(); } else { LOG_DEBUG("service with root privileges [%d]", getpid()); cleanServerRoot(); } /* closing the log files */ cleanDebug(); } void SniffJoke::run(void) { pid_t old_service_pid = proc->readPidfile(); if (old_service_pid != 0) { if (!opts.force_restart) { LOG_ALL("SniffJoke is already running, use --force or check --help"); LOG_ALL("the pidfile %s contains the apparently running pid: %d", SJ_PIDFILE, old_service_pid); return; } else { LOG_VERBOSE("forcing exit of previous running service %d ...", old_service_pid); /* we have to do quite the same as in sniffjoke_server_cleanup, * but relative to the service_pid read with readPidfile; * here we can not use the waitpid because the process to kill it's not a child of us; * we can use a sleep(2) instead. */ kill(old_service_pid, SIGTERM); sleep(1); kill(old_service_pid, SIGKILL); proc->unlinkPidfile(true); LOG_ALL("a new instance of SniffJoke is starting"); } } if (!old_service_pid && opts.force_restart) LOG_VERBOSE("option --force ignore: not found a previously running SniffJoke"); if (!userconf->runcfg.active) LOG_ALL("SniffJoke started correctly, as INACTIVE: use \"sniffjokectl start\" to activate"); else LOG_ALL("SniffJoke started correctly and already ACTIVE, manage it with \"sniffjokectl\" if needed"); if (!opts.go_foreground) { proc->background(); } /* networkSetup read the config, the system and setup the local mitm */ userconf->networkSetup(); /* the code flow reach here, SniffJoke is ready to instance network environment */ mitm = auto_ptr (new NetIO); /* sigtrap handler mapped the same in both Sj processes */ proc->sigtrapSetup(sigtrap); /* proc->detach: fork() into two processes, from now on the real configuration is the one mantained by the child */ service_pid = proc->detach(); /* this is the root privileges thread, need to run for restore the network * environment in shutdown */ if (service_pid) { int deadtrace; proc->writePidfile(); if (waitpid(service_pid, &deadtrace, WUNTRACED) > 0) { if (WIFEXITED(deadtrace)) LOG_VERBOSE("child %d WIFEXITED", service_pid); if (WIFSIGNALED(deadtrace)) LOG_VERBOSE("child %d WIFSIGNALED", service_pid); if (WIFSTOPPED(deadtrace)) LOG_VERBOSE("child %d WIFSTOPPED", service_pid); } else LOG_VERBOSE("child waitpid failed with: %s", strerror(errno)); LOG_DEBUG("child %d died, going to shutdown", service_pid); } else { proc->isolation(); setupDebug(); /* loading the plugins used for tcp hacking, MUST be done before proc->jail() */ plugin_pool = auto_ptr (new PluginPool); opt_pool = auto_ptr (new OptionPool); proc->jail(); proc->privilegesDowngrade(); sessiontrack_map = auto_ptr (new SessionTrackMap); ttlfocus_map = auto_ptr (new TTLFocusMap); conntrack = auto_ptr (new TCPTrack); mitm->prepareConntrack(conntrack.get()); /* merge all auto_ptr instanced in a struct */ createSjEnvironment(); /* use this struct, and the data collected in PluginPool, to initialize all the plugins */ plugin_pool->initializeAll(&autoptrList); setupAdminSocket(); /* main block */ while (alive) { updateClock(); proc->sigtrapDisable(); mitm->networkIO(); handleAdminSocket(); proc->sigtrapEnable(); } } } void SniffJoke::updateClock(void) { sj_clock = time(NULL); strftime(sj_clock_str, sizeof (sj_clock_str), "%F %T", localtime(&sj_clock)); } void SniffJoke::setupDebug(void) { debug.debuglevel = userconf->runcfg.debug_level; if (!opts.go_foreground) { LOG_VERBOSE("the starting process is going to CLOSE the FOREGROUND LOGGING. from now the logfiles will be used instead."); debug.setLogstream(FILE_LOG); debug.setSessionLogstream(FILE_LOG_SESSION); debug.setPacketLogstream(FILE_LOG_PACKET); } else { LOG_ALL("foreground logging enabled, use ^c for quit SniffJoke"); } if (!debug.resetLevel()) RUNTIME_EXCEPTION("executing debug resetLevel"); } /* this function must not close the FILE *desc, because in the destructor of the * auto_ptr some debug call will be present. It simple need to flush the FILE, * and the descriptor are closed with the process, after. */ void SniffJoke::cleanDebug(void) { if (debug.logstream != NULL && debug.logstream != stdout) fflush(debug.logstream); if (debug.packet_logstream != NULL && debug.packet_logstream != stdout) fflush(debug.packet_logstream); if (debug.session_logstream != NULL && debug.session_logstream != stdout) fflush(debug.session_logstream); } void SniffJoke::cleanServerRoot(void) { if (service_pid) { LOG_VERBOSE("found server root pid %d (from %d)", service_pid, getpid()); kill(service_pid, SIGTERM); waitpid(service_pid, NULL, WUNTRACED); } proc->unlinkPidfile(false); } void SniffJoke::cleanServerUser(void) { LOG_DEBUG(""); } void SniffJoke::setupAdminSocket(void) { int tmp; struct sockaddr_in in_service; if ((tmp = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) { RUNTIME_EXCEPTION("unable to open UDP socket: %s", strerror(errno)); } memset(&in_service, 0x00, sizeof (in_service)); /* here we are running under chroot, resolution will not work without /etc/hosts and /etc/resolv.conf */ if (!inet_aton(userconf->runcfg.admin_address, &in_service.sin_addr)) { RUNTIME_EXCEPTION("unable to accept hostname (%s): only IP address allow", userconf->runcfg.admin_address); } in_service.sin_family = AF_INET; in_service.sin_port = htons(userconf->runcfg.admin_port); if (bind(tmp, (struct sockaddr *) &in_service, sizeof (in_service)) == -1) { close(tmp); RUNTIME_EXCEPTION("unable to bind UDP socket %s:%u: %s", userconf->runcfg.admin_address, ntohs(in_service.sin_port), strerror(errno)); } LOG_VERBOSE("bind %u UDP port in %s ip interface for administration", userconf->runcfg.admin_port, userconf->runcfg.admin_address); admin_socket_flags_blocking = fcntl(tmp, F_GETFL); admin_socket_flags_nonblocking = admin_socket_flags_blocking | O_NONBLOCK; if (fcntl(tmp, F_SETFL, admin_socket_flags_nonblocking) == -1) { close(tmp); RUNTIME_EXCEPTION("unable to set non blocking administration socket: %s", strerror(errno)); } admin_socket = tmp; } void SniffJoke::createSjEnvironment(void) { autoptrList.instanced_proc = reinterpret_cast (proc.get()); autoptrList.instanced_mitm = reinterpret_cast (mitm.get()); autoptrList.instanced_ct = reinterpret_cast (conntrack.get()); autoptrList.instanced_ucfg = reinterpret_cast (userconf.get()); autoptrList.instanced_ttl = reinterpret_cast (ttlfocus_map.get()); autoptrList.instanced_sex = reinterpret_cast (sessiontrack_map.get()); autoptrList.instanced_itopts = reinterpret_cast (opt_pool.get()); autoptrList.instanced_plugins = reinterpret_cast (plugin_pool.get()); } void SniffJoke::handleAdminSocket(void) { char r_buf[MEDIUMBUF] = {0}; uint8_t* output_buf = NULL; struct sockaddr_in fromaddr; int fromlen = sizeof (struct sockaddr_in); if ((recvfrom(admin_socket, r_buf, sizeof (r_buf), 0, (sockaddr*) & fromaddr, (socklen_t *) & fromlen)) == -1) { if (errno == EAGAIN || errno == EWOULDBLOCK) return; RUNTIME_EXCEPTION("unable to receive from local socket: %s", strerror(errno)); } LOG_VERBOSE("received command from the client: %s", r_buf); output_buf = handleCmd(r_buf); /* send the answer message to the client, maybe scattered in more packets (HUGEBUF are 4k bytes large) */ if (output_buf != NULL) { uint32_t sent = 0, avail = ((uint32_t *) output_buf)[0]; fcntl(admin_socket, F_SETFL, admin_socket_flags_blocking); do { uint32_t this_block = (avail - sent) > LARGEBUF ? LARGEBUF : (avail - sent); sendto(admin_socket, &output_buf[sent], this_block, 0, (struct sockaddr *) &fromaddr, sizeof (fromaddr)); sent += this_block; } while (sent < avail); fcntl(admin_socket, F_SETFL, admin_socket_flags_nonblocking); } else RUNTIME_EXCEPTION("BUG: command handling of [%s] doesn't return any answer", r_buf); /* delayed execution of requested commands (only debug level change ATM) */ if (debug.debuglevel != userconf->runcfg.debug_level) { LOG_ALL("changing log level since %u to %u\n", debug.debuglevel, userconf->runcfg.debug_level); debug.debuglevel = userconf->runcfg.debug_level; if (!debug.resetLevel()) RUNTIME_EXCEPTION("changing logfile settings"); } } uint8_t * SniffJoke::handleCmd(const char *cmd) { memset(io_buf, 0x00, sizeof (io_buf)); const uint16_t* psize = (uint16_t *) io_buf; LOG_DEBUG("command received begin processed: [%s]", cmd); /* the handleCmd* fill partialy the io_buf, as defined * protocol, the first 4 byte represent the length of the * data, uint32_t lenght included. * the data returned is conform * to the specifications in doc/SJ-PROTOCOL.txt */ if (!memcmp(cmd, "start", strlen("start"))) { handleCmdStart(); } else if (!memcmp(cmd, "stop", strlen("stop"))) { handleCmdStop(); } else if (!memcmp(cmd, "quit", strlen("quit"))) { handleCmdQuit(); } else if (!memcmp(cmd, "saveconf", strlen("saveconf"))) { handleCmdSaveconf(); } else if (!memcmp(cmd, "stat", strlen("stat"))) { handleCmdStat(); } else if (!memcmp(cmd, "info", strlen("info"))) { handleCmdInfo(); } else if (!memcmp(cmd, "ttlmap", strlen("ttlmap"))) { handleCmdTTL(); } else if (!memcmp(cmd, "showport", strlen("showport"))) { handleCmdShowport(); } else if (!memcmp(cmd, "set", strlen("set"))) { handleCmdSet(cmd); } else if (!memcmp(cmd, "clear", strlen("clear"))) { handleCmdSet("0:65535 NONE"); } else if (!memcmp(cmd, "debug", strlen("debug"))) { uint32_t debuglevel; sscanf(cmd, "debug %u", &debuglevel); if (debuglevel < SUPPRESS_LEVEL || debuglevel > TESTING_LEVEL) goto handle_error; handleCmdDebuglevel(debuglevel); } else { LOG_ALL("invalid command received"); } LOG_ALL("handled command (%s): answer %u bytes length", cmd, *psize); return io_buf; handle_error: LOG_ALL("invalid command received"); writeSJProtoError(); return io_buf; } void SniffJoke::handleCmdStart(void) { if (userconf->runcfg.active != true) LOG_VERBOSE("started SniffJoke as requested!"); else /* SniffJoke is already running */ LOG_VERBOSE("SniffJoke it's already in run status"); userconf->runcfg.active = true; /* this function fill io_buf with the status information */ writeSJStatus(START_COMMAND_TYPE); } void SniffJoke::handleCmdStop(void) { if (userconf->runcfg.active != false) LOG_VERBOSE("stopped SniffJoke as requested!"); else /* SniffJoke is already running */ LOG_VERBOSE("SniffJoke it's already in stop status"); userconf->runcfg.active = false; /* this function fill io_buf with the status information */ writeSJStatus(STOP_COMMAND_TYPE); } void SniffJoke::handleCmdQuit(void) { alive = false; LOG_VERBOSE("starting shutdown"); writeSJStatus(QUIT_COMMAND_TYPE); } /* this function like the debug level change, call some operations * that may fail. But in this case, is possibile know the status * of the operation immediatly. * * this function is never autocalled, but only specifically request by the client */ void SniffJoke::handleCmdSaveconf(void) { /* beside dump the FILE_CONF, sync_disk_configuration save the TCP port and list files */ if (!userconf->syncDiskConfiguration()) { /* TODO - handle the communication of the error in the client */ } /* as generic rule, when a command has not an output, write the status */ writeSJStatus(SAVECONF_COMMAND_TYPE); } void SniffJoke::handleCmdStat(void) { LOG_VERBOSE("stat requested"); writeSJStatus(STAT_COMMAND_TYPE); } void SniffJoke::handleCmdInfo(void) { LOG_VERBOSE("info command requested: sessions only supported in this version"); writeSJInfoDump(INFO_COMMAND_TYPE); } void SniffJoke::handleCmdTTL(void) { LOG_VERBOSE("ttlmap command requested: dumping ttl tracking data"); writeSJTTLmap(TTLMAP_COMMAND_TYPE); } void SniffJoke::handleCmdShowport(void) { LOG_VERBOSE("showport command requested: dumping port aggressivity and frequency"); writeSJPortStat(SHOWPORT_COMMAND_TYPE); } void SniffJoke::handleCmdSet(const char* cmd) { if (strlen(cmd) < strlen("set ")) { /* TODO - handle the communication of the error in the client */ } const char* portconf = cmd + strlen("set "); portLine pl; /* setup function clear the previously used private variables */ pl.setup(portconf); pl.extractPorts(); pl.extractValue(); if (pl.error_message) { /* TODO - handle the communication of the error in the client */ } else { pl.mergeLine(userconf->runcfg.portconf); } writeSJPortStat(SETPORT_COMMAND_TYPE); } void SniffJoke::handleCmdDebuglevel(uint8_t newdebuglevel) { if (newdebuglevel > TESTING_LEVEL) { LOG_ALL("requested debuglevel %u invalid (>= %u <= %u permitted)", newdebuglevel, SUPPRESS_LEVEL, TESTING_LEVEL); } else { userconf->runcfg.debug_level = newdebuglevel; } writeSJStatus(LOGLEVEL_COMMAND_TYPE); } /* * follow the method used for compose the io_buf with the internalProtocol.h struct, * those methods are intetnal in UserConf, and are, exception noted for handleCmdSaveconf * the only commands writing in io_buf and generating answer. */ void SniffJoke::writeSJPortStat(uint8_t type) { uint16_t prev_port = 0; uint16_t prev_kind = userconf->runcfg.portconf[0]; struct command_ret retInfo; uint32_t accumulen = sizeof (retInfo); /* clean the buffer and fix the starting pointer */ memset(io_buf, 0x00, sizeof (io_buf)); for (uint32_t i = 1; i < (PORTSNUMBER - 1); ++i) { if (userconf->runcfg.portconf[i] != prev_kind) { accumulen += appendSJPortBlock(&io_buf[accumulen], prev_port, i - 1, prev_kind); if (accumulen > sizeof (io_buf)) RUNTIME_EXCEPTION("someone has a very stupid sniffjoke configuration, or is trying to overflow me"); prev_kind = userconf->runcfg.portconf[i]; prev_port = i; } } accumulen += appendSJPortBlock(&io_buf[accumulen], prev_port, PORTSNUMBER - 1, prev_kind); retInfo.cmd_len = accumulen; retInfo.cmd_type = type; memcpy(io_buf, (void *) &retInfo, sizeof (retInfo)); } void SniffJoke::writeSJStatus(uint8_t commandReceived) { struct command_ret retInfo; uint32_t accumulen = sizeof (retInfo); /* clean the buffer and fix the starting pointer */ memset(io_buf, 0x00, sizeof (io_buf)); /* SJStatus is totally inspired by the IP/TCP options */ accumulen += appendSJStatus(&io_buf[accumulen], STAT_ACTIVE, sizeof (userconf->runcfg.active), userconf->runcfg.active); accumulen += appendSJStatus(&io_buf[accumulen], STAT_DEBUGL, sizeof (userconf->runcfg.debug_level), userconf->runcfg.debug_level); accumulen += appendSJStatus(&io_buf[accumulen], STAT_MACGW, strlen(userconf->runcfg.gw_mac_str), userconf->runcfg.gw_mac_str); accumulen += appendSJStatus(&io_buf[accumulen], STAT_GWADDR, strlen(userconf->runcfg.gw_ip_addr), userconf->runcfg.gw_ip_addr); accumulen += appendSJStatus(&io_buf[accumulen], STAT_NETIFACENAME, strlen(userconf->runcfg.net_iface_name), userconf->runcfg.net_iface_name); accumulen += appendSJStatus(&io_buf[accumulen], STAT_NETIFACEIP, strlen(userconf->runcfg.net_iface_ip), userconf->runcfg.net_iface_ip); accumulen += appendSJStatus(&io_buf[accumulen], STAT_NETIFACEMTU, sizeof (userconf->runcfg.net_iface_mtu), userconf->runcfg.net_iface_mtu); accumulen += appendSJStatus(&io_buf[accumulen], STAT_TUNIFACENAME, strlen(TUN_IF_NAME), TUN_IF_NAME); accumulen += appendSJStatus(&io_buf[accumulen], STAT_TUNIFACEIP, strlen(userconf->runcfg.tun_iface_ip), userconf->runcfg.tun_iface_ip); accumulen += appendSJStatus(&io_buf[accumulen], STAT_TUNIFACEMTU, sizeof (userconf->runcfg.tun_iface_mtu), userconf->runcfg.tun_iface_mtu); accumulen += appendSJStatus(&io_buf[accumulen], STAT_ONLYP, strlen(userconf->runcfg.onlyplugin), userconf->runcfg.onlyplugin); accumulen += appendSJStatus(&io_buf[accumulen], STAT_BINDA, strlen(userconf->runcfg.admin_address), userconf->runcfg.admin_address); accumulen += appendSJStatus(&io_buf[accumulen], STAT_BINDP, sizeof (userconf->runcfg.admin_port), userconf->runcfg.admin_port); accumulen += appendSJStatus(&io_buf[accumulen], STAT_USER, strlen(userconf->runcfg.user), userconf->runcfg.user); accumulen += appendSJStatus(&io_buf[accumulen], STAT_GROUP, strlen(userconf->runcfg.group), userconf->runcfg.group); accumulen += appendSJStatus(&io_buf[accumulen], STAT_LOCAT, strlen(userconf->runcfg.location), userconf->runcfg.location); accumulen += appendSJStatus(&io_buf[accumulen], STAT_CHAINING, sizeof (userconf->runcfg.chaining), userconf->runcfg.chaining); accumulen += appendSJStatus(&io_buf[accumulen], STAT_NO_TCP, sizeof (userconf->runcfg.no_tcp), userconf->runcfg.no_tcp); accumulen += appendSJStatus(&io_buf[accumulen], STAT_NO_UDP, sizeof (userconf->runcfg.no_udp), userconf->runcfg.no_udp); if (userconf->runcfg.whitelist) accumulen += appendSJStatus(&io_buf[accumulen], STAT_WHITELIST, sizeof (userconf->runcfg.whitelist), userconf->runcfg.whitelist); else if (userconf->runcfg.blacklist) accumulen += appendSJStatus(&io_buf[accumulen], STAT_BLACKLIST, sizeof (userconf->runcfg.blacklist), userconf->runcfg.blacklist); retInfo.cmd_len = accumulen; retInfo.cmd_type = commandReceived; memcpy(io_buf, &retInfo, sizeof (retInfo)); } void SniffJoke::writeSJTTLmap(uint8_t type) { struct command_ret retInfo; uint32_t accumulen = sizeof (retInfo); /* clean the buffer and fix the starting pointer */ memset(io_buf, 0x00, sizeof (io_buf)); for (TTLFocusMap::iterator it = ttlfocus_map->begin(); it != ttlfocus_map->end(); ++it) { if (accumulen > sizeof (io_buf) - sizeof (struct ttl_record)) { LOG_ALL("overflow trapped! io_buf %u bytes are not enought!", sizeof (io_buf)); break; } TTLFocus &TT = *((*it).second); accumulen += appendSJTTLInfo(&io_buf[accumulen], TT); } retInfo.cmd_len = accumulen; retInfo.cmd_type = type; memcpy(io_buf, &retInfo, sizeof (retInfo)); } void SniffJoke::writeSJInfoDump(uint8_t type) { struct command_ret retInfo; uint32_t accumulen = sizeof (retInfo); /* clean the buffer and fix the starting pointer */ memset(io_buf, 0x00, sizeof (io_buf)); for (SessionTrackMap::iterator it = sessiontrack_map->begin(); it != sessiontrack_map->end(); ++it) { if (accumulen > sizeof (io_buf) - sizeof (struct sex_record)) { LOG_ALL("overflow trapped! io_buf %u bytes are not enought!", sizeof (io_buf)); break; } SessionTrack &Tracked = *((*it).second); accumulen += appendSJSessionInfo(&io_buf[accumulen], Tracked); } retInfo.cmd_len = accumulen; retInfo.cmd_type = type; memcpy(io_buf, &retInfo, sizeof (retInfo)); } void SniffJoke::writeSJProtoError(void) { struct command_ret retInfo; memset(io_buf, 0x00, sizeof (io_buf)); retInfo.cmd_len = sizeof (retInfo); retInfo.cmd_type = COMMAND_ERROR_MSG; memcpy(io_buf, &retInfo, sizeof (retInfo)); } /* follow the most "internal" method for io_buf creation, called from the methods before */ uint32_t SniffJoke::appendSJStatus(uint8_t *p, int32_t WHO, uint32_t len, uint16_t value) { struct single_block singleData; singleData.len = len; singleData.WHO = WHO; memcpy(p, &singleData, sizeof (singleData)); p += sizeof (singleData); memcpy(p, &value, len); return len + sizeof (singleData); } uint32_t SniffJoke::appendSJStatus(uint8_t *p, int32_t WHO, uint32_t len, bool value) { struct single_block singleData; singleData.len = len; singleData.WHO = WHO; memcpy(p, &singleData, sizeof (singleData)); p += sizeof (singleData); *p = (uint8_t) value; return len + sizeof (singleData); } uint32_t SniffJoke::appendSJStatus(uint8_t *p, int32_t WHO, uint32_t len, const char* value) { if (len) { struct single_block singleData; singleData.len = len; singleData.WHO = WHO; memcpy(p, &singleData, sizeof (singleData)); p += sizeof (singleData); memcpy(p, value, len); len += sizeof (singleData); } return len; } uint32_t SniffJoke::appendSJPortBlock(uint8_t *p, uint16_t startP, uint16_t endP, uint16_t weight) { struct port_info pInfo; pInfo.start = startP; pInfo.end = endP; pInfo.weight = weight; memcpy(p, &pInfo, sizeof (pInfo)); return (sizeof (pInfo)); } uint32_t SniffJoke::appendSJTTLInfo(uint8_t *p, const TTLFocus &TT) { struct ttl_record ttlr; ttlr.access = TT.access_timestamp; ttlr.nextprobe = TT.next_probe_time; ttlr.daddr = TT.daddr; ttlr.sentprobe = TT.sent_probe; ttlr.receivedprobe = TT.received_probe; ttlr.synackval = TT.ttl_synack; ttlr.ttlestimate = TT.ttl_estimate; memcpy((void *) p, (void *) &ttlr, sizeof (ttlr)); return sizeof (ttlr); } uint32_t SniffJoke::appendSJSessionInfo(uint8_t *p, const SessionTrack &SexToDump) { struct sex_record sr; if (!SexToDump.packet_number) return 0; sr.proto = SexToDump.proto; sr.daddr = SexToDump.daddr; sr.dport = SexToDump.dport; sr.sport = SexToDump.sport; sr.packet_number = SexToDump.packet_number; sr.injected_pktnumber = SexToDump.injected_pktnumber; memcpy((void *) p, (void *) &sr, sizeof (sr)); return sizeof (sr); } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/SniffJoke.h0000644000000000000000000000652013147777044017532 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_SNIFFJOKE_H #define SJ_SNIFFJOKE_H #include "Utils.h" #include "UserConf.h" #include "Process.h" #include "NetIO.h" #include "TCPTrack.h" #include "TTLFocus.h" #include "SessionTrack.h" #include "OptionPool.h" #include "PluginPool.h" #include "config.h" class SniffJoke { public: bool alive; SniffJoke(const struct sj_cmdline_opts &); ~SniffJoke(void); void run(void); private: const sj_cmdline_opts &opts; auto_ptr proc; auto_ptr mitm; auto_ptr conntrack; /* after detach: * service_pid in the root process [the pid of the user process] * in the user process [0] */ pid_t service_pid; int admin_socket; int admin_socket_flags_blocking; int admin_socket_flags_nonblocking; /* used to copy structs for command I/O */ uint8_t io_buf[HUGEBUF * 4]; /* used to make public the singleton to the plugins */ struct sjEnviron autoptrList; void updateClock(void); void setupDebug(void); void cleanDebug(void); void cleanServerRoot(void); void cleanServerUser(void); void setupAdminSocket(void); void handleAdminSocket(void); void createSjEnvironment(void); /* internalProtocol handling */ uint8_t* handleCmd(const char *); /* single command management */ void handleCmdStart(void); void handleCmdStop(void); void handleCmdQuit(void); void handleCmdSaveconf(void); void handleCmdStat(void); void handleCmdInfo(void); void handleCmdTTL(void); void handleCmdShowport(void); void handleCmdSet(const char *); void handleCmdDebuglevel(uint8_t); /* main function for build the answer */ void writeSJStatus(uint8_t); void writeSJPortStat(uint8_t); void writeSJInfoDump(uint8_t); void writeSJTTLmap(uint8_t); void writeSJProtoError(void); /* called by writeSJ* functions = answer building */ uint32_t appendSJStatus(uint8_t *, int32_t, uint32_t, uint16_t); uint32_t appendSJStatus(uint8_t *, int32_t, uint32_t, bool); uint32_t appendSJStatus(uint8_t *, int32_t, uint32_t, const char *); uint32_t appendSJPortBlock(uint8_t *, uint16_t, uint16_t, uint16_t); uint32_t appendSJSessionInfo(uint8_t *, const SessionTrack &); uint32_t appendSJTTLInfo(uint8_t *, const TTLFocus &); }; #endif /* SJ_SNIFFJOKE_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/TCPTrack.cc0000644000000000000000000011113413147777044017423 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2008,2009,2010,2011 * vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "TCPTrack.h" #include "UserConf.h" #include "SessionTrack.h" #include "TTLFocus.h" #include "PluginPool.h" extern auto_ptr userconf; extern auto_ptr sessiontrack_map; extern auto_ptr ttlfocus_map; extern auto_ptr plugin_pool; TCPTrack::TCPTrack() { LOG_DEBUG(""); mangled_proto_mask = ICMP; if (!userconf->runcfg.no_tcp) mangled_proto_mask |= TCP; if (!userconf->runcfg.no_udp) mangled_proto_mask |= UDP; } TCPTrack::~TCPTrack(void) { LOG_DEBUG(""); } uint32_t TCPTrack::derivePercentage(uint32_t packet_number, uint16_t frequencyValue) { if (userconf->runcfg.onlyplugin[0]) frequencyValue = AGG_ALWAYS; uint32_t freqret = 0; if (frequencyValue & AGG_VERYRARE) { freqret += 5; } if (frequencyValue & AGG_RARE) { freqret += 15; } if (frequencyValue & AGG_COMMON) { freqret += 40; } if (frequencyValue & AGG_HEAVY) { freqret += 75; } if (frequencyValue & AGG_ALWAYS) { freqret += 100; } if (frequencyValue & AGG_PACKETS10PEEK) { if (!(++packet_number % 10) || !(--packet_number % 10) || !(--packet_number % 10)) freqret += 80; else freqret += 2; } if (frequencyValue & AGG_PACKETS30PEEK) { if (!(++packet_number % 30) || !(--packet_number % 30) || !(--packet_number % 30)) freqret += 90; else freqret += 2; } if (frequencyValue & AGG_TIMEBASED5S) { if (!((uint8_t) sj_clock % 5)) freqret += 90; else freqret += 2; } if (frequencyValue & AGG_TIMEBASED20S) { if (!((uint8_t) sj_clock % 20)) freqret += 90; else freqret += 2; } if (frequencyValue & AGG_STARTPEEK) { if (packet_number < 20) freqret += 65; else if (packet_number < 40) freqret += 20; else freqret += 2; } if (frequencyValue & AGG_LONGPEEK) { if (packet_number < 60) freqret += 55; else if (packet_number < 120) freqret += 20; else freqret += 2; } if (frequencyValue & AGG_HANDSHAKE) { if (packet_number < 4) freqret += 100; else freqret = 0; } if (frequencyValue & AGG_NONE) freqret = 0; return freqret; } /* * this function is used from the injectHack() routine to decretee * the possibility for an hack to happen. * returns true if it's possibile to forge the hack. * the calculation involves: * - the session packet count; a variable inside the equation (some hacks are * configured to act in peek time or packets number relationship) * - the frequency selector provided from the hack developer; used when the * port-aggressivity.conf file don't provide a specific configuration. * - the port configuration settings: derived from 'port-aggressivity.conf' */ bool TCPTrack::percentage(uint32_t packet_number, uint16_t hackFrequency, uint16_t userFrequency) { uint32_t aggressivity_percentage = 0; /* * as first is checked hackFrequency, because it could be AGG_ALWAYS * and this means that we are in testing mode with --only-olugin option */ if (hackFrequency & AGG_ALWAYS) return true; aggressivity_percentage = derivePercentage(packet_number, userFrequency); return ( ((uint32_t) random() % 100) < aggressivity_percentage); } uint16_t TCPTrack::getUserFrequency(const Packet &pkt) { /* MUST be called on TCP/UDP packet only */ if (pkt.proto == TCP) return userconf->runcfg.portconf[ntohs(pkt.tcp->dest)]; /* else, no other proto other than UDP will reach here. * * the UDP traffic is for the most a data-apply hacks, because no flag gaming * nor sequence hack exists. when a service is request to be ALWAYS hacked, we * accept this choose in UDP too. otherwise, is better use a costant noise * using AGG_COMMON */ if (userconf->runcfg.portconf[ntohs(pkt.udp->dest)] == AGG_ALWAYS) return AGG_ALWAYS; return AGG_COMMON; } uint8_t TCPTrack::discernAvailScramble(const Packet &pkt) { /* * TODO - when we will integrate passive os fingerprint and * we will do a a clever study about different OS answers about * IP option, for every OS we will have or not the related support */ uint8_t retval = SCRAMBLE_INNOCENT | SCRAMBLE_CHECKSUM | SCRAMBLE_MALFORMED; TTLFocus &ttlfocus = ttlfocus_map->get(pkt); if (ttlfocus.status == TTL_KNOWN) retval |= SCRAMBLE_TTL; return retval; } /* * this function is responsable of the ttl bruteforce stage used * to detect the hop distance between us and the remote peer. * * SniffJoke uses the first seen session packet as a starting point * for this stage. * * packets generated are a copy of the original (first seen) packet * with some little modifications to: * - ip->id ....... is used a univoke marker, useful for detect which packet * is returned as part of an ICMP time exceeded * - ip->ttl ...... is under incrmeental probe, like a traceroute * - tcp->source .. is required to modify it because will bring problem to * the real connection, if kept the same * - tcp->seq ..... same reason of ip->id, but used for check the SYN+ACK * having this univoke random seq as +1 in the ack_seq * */ void TCPTrack::injectTTLProbe(TTLFocus &ttlfocus) { Packet *injpkt; switch (ttlfocus.status) { case TTL_UNKNOWN: ttlfocus.status = TTL_BRUTEFORCE; /* do not break, continue inside TTL_BRUTEFORCE */ case TTL_BRUTEFORCE: if (ttlfocus.sent_probe == userconf->runcfg.max_ttl_probe) { if (!ttlfocus.probe_timeout) { ttlfocus.probe_timeout = sj_clock + 2; } else if (ttlfocus.probe_timeout < sj_clock) { ttlfocus.status = TTL_UNKNOWN; ttlfocus.sent_probe = 0; ttlfocus.received_probe = 0; ttlfocus.ttl_estimate = 0xFF; ttlfocus.ttl_synack = 0; ttlfocus.next_probe_time = sj_clock + TTLPROBE_RETRY_ON_UNKNOWN; } break; } else { ++ttlfocus.sent_probe; injpkt = new Packet(ttlfocus.probe_dummy, sizeof (ttlfocus.probe_dummy)); injpkt->source = TRACEROUTE; injpkt->wtf = INNOCENT; injpkt->ip->id = htons((ttlfocus.rand_key % 64) + ttlfocus.sent_probe); injpkt->ip->ttl = ttlfocus.sent_probe; injpkt->tcp->seq = htonl(ttlfocus.rand_key + ttlfocus.sent_probe); injpkt->fixIPTCPSum(); p_queue.insert(*injpkt, SEND); /* the next ttl probe schedule is forced in the next cycle */ ttlfocus.next_probe_time = sj_clock; injpkt->SELFLOG("TTL_BRUTEFORCE #sent|%u ttl_estimate|%u", ttlfocus.sent_probe, ttlfocus.ttl_estimate); break; } case TTL_KNOWN: /* TODO: Handle the KNOWN status; find a way to detect network topology changes. */ break; } } /* * verifies the need of ttl probes for active destinations */ void TCPTrack::execTTLBruteforces(void) { for (TTLFocusMap::iterator it = ttlfocus_map->begin(); it != ttlfocus_map->end(); ++it) { TTLFocus &ttlfocus = *((*it).second); if ((ttlfocus.status != TTL_KNOWN) /* 1) the ttl is BRUTEFORCE or UNKNOWN */ && (ttlfocus.access_timestamp > (sj_clock - 30)) /* 2) the destination it's used in the last 30 seconds */ && (ttlfocus.next_probe_time <= sj_clock)) /* 3) the next probe time it's passed */ { injectTTLProbe(*(*it).second); } } } /* * * extracts TTL information from an incoming packet * * the function returns TRUE if the packet has been identified as an answer to * the ttlbruteforce session and has to be removed. * * in this function we call the find() method of std::map because * we want to test the ttl existence and NEVER NEVER NEVER create a new one * to not permit an external packet to force us to activate a ttlbrouteforce session. * * the function returns TRUE if a plugins has requested the removal of the packet. */ bool TCPTrack::extractTTLinfo(const Packet &incompkt) { TTLFocusMap::iterator it; TTLFocus *ttlfocus; /* if the pkt is an ICMP TIME_EXCEEDED should contain informations useful for * discern HOP distance from a remote host. */ if (incompkt.proto == ICMP && incompkt.icmp->type == ICMP_TIME_EXCEEDED) { const struct iphdr * const badiph = (struct iphdr *) ((unsigned char *) incompkt.icmp + sizeof (struct icmphdr)); const struct tcphdr * const badtcph = (struct tcphdr *) ((unsigned char *) badiph + (badiph->ihl * 4)); /* we are looking only for our TCP expired pkts */ if (badiph->protocol != IPPROTO_TCP) return false; /* if is not tracked, the user is making a tcptraceroute */ if ((it = ttlfocus_map->find(badiph->daddr)) == ttlfocus_map->end()) return false; ttlfocus = it->second; const uint8_t expired_ttl = ntohs(badiph->id) - (ttlfocus->rand_key % 64); const uint8_t exp_double_check = ntohl(badtcph->seq) - ttlfocus->rand_key; if (expired_ttl == exp_double_check) { if (ttlfocus->status == TTL_BRUTEFORCE) { incompkt.SELFLOG("incoming ICMP EXPIRED puppet|%d expired|%d", ttlfocus->puppet_port, expired_ttl); ttlfocus->received_probe++; /* * every time a time exceded it's received. if the MAXTTLPROBE has * been reached (ttlfocus->probe_timeout != 0), the probe_timeout * it's resetted. */ if (ttlfocus->probe_timeout) ttlfocus->probe_timeout = sj_clock + 2; if (expired_ttl >= ttlfocus->ttl_estimate) { /* * if we are changing our estimation due to an expired * we have to set status = TTL_UNKNOWN * this is important to permit recalibration. */ ttlfocus->status = TTL_UNKNOWN; ttlfocus->ttl_estimate = expired_ttl + 1; } } /* the expired icmp scattered due to our ttl probes, * so we can trasparently remove it. */ return true; } } /* a tracked TCP packet contains important TTL informations */ if ((incompkt.proto != TCP || (it = ttlfocus_map->find(incompkt.ip->saddr)) == ttlfocus_map->end())) return false; ttlfocus = it->second; /* a SYN ACK will be the answer at our probe! */ if (incompkt.tcp->syn && incompkt.tcp->ack && (incompkt.tcp->dest == htons(ttlfocus->puppet_port))) { if (ttlfocus->status != TTL_BRUTEFORCE) { incompkt.SELFLOG("incoming SYN/ACK weird: puppet port in a session outside ttl bruteforce"); return false; } /* * this section analyze the TCP syn+ack: * in the ttlbruteforce stage a syn + ack will be bringer of a ttl information. * if the received packet matches the puppet port used for the current * ttlbruteforce session we can discern the ttl as: * * unsigned char discern_ttl = ntohl(pkt.tcp->ack_seq) - ttlfocus->rand_key - 1; * * this because the sequence number used in the TTL bruteforce has hardcoded the * number of the TTL. */ uint8_t discern_ttl = ntohl(incompkt.tcp->ack_seq) - ttlfocus->rand_key - 1; ++ttlfocus->received_probe; if (discern_ttl < ttlfocus->ttl_estimate) { ttlfocus->ttl_estimate = discern_ttl; ttlfocus->ttl_synack = incompkt.ip->ttl; } ttlfocus->status = TTL_KNOWN; incompkt.SELFLOG("incoming SYN/ACK puppet|%d ttl_estimate|%d ttl_synack|%d", ttlfocus->puppet_port, ttlfocus->ttl_estimate, ttlfocus->ttl_synack); ttlfocus->SELFLOG("incoming SYN/ACK puppet|%d ttl_estimate|%d ttl_synack|%d", ttlfocus->puppet_port, ttlfocus->ttl_estimate, ttlfocus->ttl_synack); return true; } else { if (ttlfocus->status == TTL_KNOWN && ttlfocus->ttl_synack != incompkt.ip->ttl) { /* probably a topology change has happened - we need a solution wtf!! */ incompkt.SELFLOG("probable net topology change! ttl_estimate|%u synack ttl|%u received_ttl|%u]", ttlfocus->ttl_estimate, ttlfocus->ttl_synack, incompkt.ip->ttl); } return false; } } /* * notifies all plugins at the arrival of an incoming packet; * if a plugin does not need this notification simply can return immediatly. * * the function returns TRUE if a plugins has requested the removal of the packet. */ #define ENABLE_INCOMING_DEBUG /* at the moment, only few plugins mangle the input packet, enable this debug when needed */ #undef ENABLE_INCOMING_DEBUG bool TCPTrack::notifyIncoming(Packet &origpkt) { bool removeOrig = false; #ifdef ENABLE_INCOMING_DEBUG origpkt.SELFLOG("orig pkt: before incoming mangle"); #endif for (vector::iterator it = plugin_pool->pool.begin(); it != plugin_pool->pool.end(); ++it) { PluginTrack *pt = *it; pt->selfObj->mangleIncoming(origpkt); /* it will be rare for a hack mangleIncoming to generate one or more packet, anyway we keep this possibility possible */ for (vector::iterator hack_it = pt->selfObj->pktVector.begin(); hack_it < pt->selfObj->pktVector.end(); ++hack_it) { Packet &injpkt = **hack_it; if (!injpkt.selfIntegrityCheck(pt->selfObj->pluginName)) { LOG_ALL("%s: invalid pkt generated", pt->selfObj->pluginName); injpkt.SELFLOG("%s: bad integrity", pt->selfObj->pluginName); /* if you are running with --debug 6, I suppose you are the developing the plugins */ if (userconf->runcfg.debug_level == PACKET_LEVEL) RUNTIME_EXCEPTION("%s: invalid pkt generated", pt->selfObj->pluginName); /* otherwise, the error was reported and sniffjoke continue to work */ delete &injpkt; continue; } /* lastPktFix is called because the checksum will not be correct */ if (!lastPktFix(injpkt)) continue; #ifdef ENABLE_INCOMING_DEBUG injpkt.SELFLOG("%s: generated packet, the original (i%u) will be %s", pt->selfObj->pluginName, origpkt.SjPacketId, pt->selfObj->removeOrigPkt ? "REMOVED" : "KEPT"); #endif /* injpkt.position is ignored in this section because mangleIncoming * is called on the YOUNG queue. * ATM we inject in the SEND queue so every packet generated * in mangleIncoming is equal to be ANTICIPATION */ p_queue.insert(injpkt, SEND); } if (pt->selfObj->removeOrigPkt == true) removeOrig = true; pt->selfObj->reset(); } #ifdef ENABLE_INCOMING_DEBUG origpkt.SELFLOG("orig pkt: after incoming mangle"); #endif return removeOrig; } /* * injectHack is one of the core function in sniffjoke and handles the hack injection. * the function returns TRUE if a plugins has requested the removal of the packet. */ bool TCPTrack::injectHack(Packet &origpkt) { bool removeOrig = false; SessionTrack &sessiontrack = sessiontrack_map->get(origpkt); vector applicable_hacks; /* * Not all time we have a scramble available, we tell to the plugin which of * them are usable, and the packets is returned. the most of the time, all of * three scramble are available, and the plugins will use pktRandomDamage() * private method. */ uint8_t availableScrambles = discernAvailScramble(origpkt); char availableScramblesStr[LARGEBUF] = {0}; snprintfScramblesList(availableScramblesStr, sizeof (availableScramblesStr), availableScrambles); /* SELECT APPLICABLE HACKS, the selection are base on: * 1) the plugin/hacks detect if the condition exists (eg: the hack wants a SYN and the packet is a RST+ACK) * 2) compute the percentage: mixing the hack-choosed and the user-choose */ for (vector::iterator it = plugin_pool->pool.begin(); it != plugin_pool->pool.end(); ++it) { PluginTrack *pt = *it; /* * this represents a preliminar check common to all hacks. * more specific ones related to the origpkt will be checked in * the condition function implemented by a specific hack. */ if ((!(availableScrambles & pt->selfObj->supportedScrambles)) && (userconf->runcfg.debug_level == PACKET_LEVEL)) { char pluginavaileScrambStr[LARGEBUF] = {0}; snprintfScramblesList(pluginavaileScrambStr, sizeof (pluginavaileScrambStr), pt->selfObj->supportedScrambles); origpkt.SELFLOG("%s: no scramble matching between system avail [%s] and plugins scramble [%s]", pt->selfObj->pluginName, availableScramblesStr, pluginavaileScrambStr); continue; } bool applicable = true; applicable &= pt->selfObj->condition(origpkt, availableScrambles); applicable &= percentage(sessiontrack.packet_number, pt->selfObj->pluginFrequency, getUserFrequency(origpkt)); if (applicable) applicable_hacks.push_back(pt); } if (!applicable_hacks.size() && (userconf->runcfg.debug_level == PACKET_LEVEL)) origpkt.SELFLOG("NONE hack plugin has been passed the selection!"); /* -- RANDOMIZE HACKS APPLICATION */ random_shuffle(applicable_hacks.begin(), applicable_hacks.end()); /* -- FINALLY, HACK THE CHOOSEN PACKET(S) */ for (vector::iterator it = applicable_hacks.begin(); it != applicable_hacks.end(); ++it) { PluginTrack *pt = *it; origpkt.SELFLOG("from %d avail plugins, %d has been selected: applying plugin [%s]", plugin_pool->pool.size(), applicable_hacks.size(), pt->selfObj->pluginName); pt->selfObj->apply(origpkt, availableScrambles); for (vector::iterator hack_it = pt->selfObj->pktVector.begin(); hack_it < pt->selfObj->pktVector.end(); ++hack_it) { Packet &injpkt = **hack_it; /* * we trust in the external developer, but it's required a * simple safety check by sniffjoke :) */ if (!injpkt.selfIntegrityCheck(pt->selfObj->pluginName)) { injpkt.SELFLOG("%s: invalid pkt generated: bad integrity", pt->selfObj->pluginName); /* if you are running with --debug 6, I suppose you are the developing the plugins */ if (userconf->runcfg.debug_level == PACKET_LEVEL) RUNTIME_EXCEPTION("%s invalid pkt generated: bad integrity", pt->selfObj->pluginName); /* otherwise, the error was reported and sniffjoke continue to work */ delete &injpkt; continue; } if (!lastPktFix(injpkt)) { continue; } /* setting for debug pourpose: sniffjokectl info will show this value */ sessiontrack.injected_pktnumber++; packet_filter.add(injpkt); injpkt.SELFLOG("NEW packet from [%s], the original (i%u) will be %s", pt->selfObj->pluginName, origpkt.SjPacketId, pt->selfObj->removeOrigPkt ? "REMOVED" : "KEPT"); switch (injpkt.position) { case ANTICIPATION: p_queue.insertBefore(injpkt, origpkt); break; case POSTICIPATION: p_queue.insertAfter(injpkt, origpkt); break; case ANY_POSITION: if (random() % 2) p_queue.insertBefore(injpkt, origpkt); else p_queue.insertAfter(injpkt, origpkt); break; case POSITIONUNASSIGNED: RUNTIME_EXCEPTION("FATAL CODE [D4L1]: please send a notification to the developers"); } } if (pt->selfObj->removeOrigPkt == true) removeOrig = true; pt->selfObj->reset(); } return removeOrig; } /* * lastPktFix is the last modification applied to outgoing packets. * modification involve only TCP/UDP packets coming from TUNNEL * and hacks injected in the queue to goes on the eth/wifi. * * p.s. if you are reading this piece of code to fix your sniffer: * we SHALL BE YOUR NIGHTMARE. * we SHALL BE YOUR NIGHTMARE. * we SHALL BE YOUR NIGHTMARE, LOSE ANY HOPE, we HAD THE RANDOMNESS IN OUR SIDE. * * * PRESCRIPTION: will EXPIRE BEFORE REACHING destination (due to ttl modification) * could be: ONLY EVIL PACKETS * GUILTY: will BE DISCARDED by destination (due to some error introduction) * at the moment the only error applied is the invalidation tcp checksum * could be: ONLY EVIL PACKETS * MALFORMED: will BE DISCARDED by destination due to misuse of ip options * could be: ONLY EVIL PACKETS * INNOCENT: will BE ACCEPTED, so, INNOCENT but EVIL cause the same treatment of a * GOOD packet. * * hacks application follows this order: PRESCRIPTION, MALFORMED, GUILTY. * a non applicable hack it's degraded to the next; * at worst GUILTY it's always applied. */ bool TCPTrack::lastPktFix(Packet &pkt) { TTLFocus &ttlfocus = ttlfocus_map->get(pkt); if (ttlfocus.status == TTL_KNOWN) { /* WHAT VALUE OF TTL GIVE TO THE PACKET ? */ if (pkt.wtf == PRESCRIPTION) { pkt.ip->ttl = ttlfocus.ttl_estimate - (1 + (random() % 2)); /* [-1, -2], 2 values */ } else { /* MISTIFICATION FOR WTF != PRESCRIPTION */ /* apply mystification if PRESCRIPTION is globally enabled */ if (ISSET_TTL(plugin_pool->enabledScrambles())) pkt.ip->ttl = ttlfocus.ttl_estimate + (random() % 4); /* [+0, +3], 4 values */ } } else { if (pkt.wtf == PRESCRIPTION) { if (ISSET_MALFORMED(pkt.choosableScramble)) { pkt.SELFLOG("failed to corrupt pkt using prescription: pkt downgraded to MALFORMED"); pkt.wtf = MALFORMED; } else if (ISSET_CHECKSUM(pkt.choosableScramble)) { pkt.SELFLOG("failed to corrupt pkt using prescription: pkt downgraded to GUILTY"); pkt.wtf = GUILTY; } else { pkt.SELFLOG("failed to corrupt pkt using prescription: pkt dropped"); goto drop_packet; } } if (pkt.wtf != PRESCRIPTION) { /* MISTIFICATION APPLY ON DOWNGRADE, RANDOMIZING A BIT THE ORIGINAL TTL VALUE */ /* apply mystification if PRESCRIPTION is globally enabled */ if (ISSET_TTL(plugin_pool->enabledScrambles())) pkt.ip->ttl += (random() % 20) - 10; /* [-10, +10 ], 20 mystification values */ } } /* * APPLY MALFORMATION OF IP/TCP OPTIONS, for good and evil packets is possible * * if wtf == MALFORMED and the scramble is not possible, wtf it's degraded to GUILTY. * * dropping when GUILTY is not supported happen only in sniffjoke-autotest */ if (pkt.wtf == MALFORMED) { bool malformed = false; /* testing at the moment: are the IP options more relaibalbe ? */ if (true /* pkt.fragment == true || pkt.proto != TCP || malformed == false */) { try { HDRoptions IPInjector(IPOPTS_INJECTOR, pkt, ttlfocus); if (IPInjector.injectRandomOpts(/* corrupt ? */ true, /* strip previous options */ true)) malformed = true; } catch (exception &e) { LOG_ALL("strip & inject IP opts (target: corrupt) fail: %s", e.what()); } } if (malformed == false /* pkt.fragment == false && ( pkt.proto == TCP || random_percent(80) ) */) { try { HDRoptions TCPInjector(TCPOPTS_INJECTOR, pkt, ttlfocus); if (TCPInjector.injectRandomOpts(/* corrupt ? */ true, /* strip previous options */ true)) malformed = true; } catch (exception &e) { LOG_ALL("strip & inject TCP opts (target: corrupt) fail: %s", e.what()); } } if (!malformed) { if (ISSET_CHECKSUM(pkt.choosableScramble)) { pkt.SELFLOG("failed to corrupt pkt using MALFORMED: pkt downgraded to GUILTY"); pkt.wtf = GUILTY; } else { pkt.SELFLOG("failed to corrupt pkt using MALFORMED: pkt dropped"); goto drop_packet; } } } if (pkt.wtf != MALFORMED) { /* MISTIFICATION OF THE PACKET NOT YET CORRUPTED BY IP/TCP OPTIONS */ /* IP/TCP options scambling enabled globally (and/or for destination) */ if (ISSET_MALFORMED(plugin_pool->enabledScrambles())) { bool optmysty = false; /* testing in MALFORMED, 66 in normal usage, autotest usage is 100% */ if ( random_percent(66) ) { try { HDRoptions IPInjector(IPOPTS_INJECTOR, pkt, ttlfocus); IPInjector.injectRandomOpts(/* corrupt ? */ false, /* strip previous options ? */ false); optmysty = true; } catch (exception &e) { LOG_DEBUG("apply mystification with IP hdr options not possible: %s", e.what()); } } if (optmysty == false /* random_percent(66) && pkt.proto == TCP */) { try { HDRoptions TCPInjector(TCPOPTS_INJECTOR, pkt, ttlfocus); TCPInjector.injectRandomOpts(/* corrupt ? */ false, /* strip previous options ? */ false); optmysty = true; } catch (exception &e) { LOG_DEBUG("apply mystification with TCP hdr options not possible: %s", e.what()); } } } } /* in this place there WAS the randomPayload filling for packet != INNOCENT, * this was not correct, because the plugins will supply a specific layer 5 * payload, for this reason I've moved the function in the plugins */ /* fixing the mangled packet */ pkt.fixSum(); /* * corrupted checksum application if required; * this is the last resort for hacks packets if neither * PRESCRIPTION nor MALFORMED are applicable. */ if (pkt.wtf == GUILTY) pkt.corruptSum(); return true; drop_packet: pkt.SELFLOG("pkt dropped during fix"); p_queue.drop(pkt); return false; } /* * here we analyze YOUNG queue * * we handle only: * * NETWORK packets: * - we analyze them searching ttl informations. * - we handle the removal of the orig packet if identified as an answer to ttlbruteforce. * - we notify all plugins of the arrival of the packet; * the packets are passed to the plugin because they will need to check * or modify some information in them, or eventually also remove them. * - after this analysis will be sent localy, because the packet * coming from the gateway mac address has been actually dropped by the firewall rules. * * TUNNEL packets: * - we analyze tcp/udp packets to see if can be moved into HACK queue or if they * need to be hold in status KEEP waiting for some conditions. * every packets from the tunnel will be associated to a session (and session counter updated) * and to a ttlfocus (if the ttlfocus not exists a new ttlbruteforce session is started). * * any other pkt->source does scatter a fatal exception. */ void TCPTrack::handleYoungPackets(void) { Packet *pkt = NULL; for (p_queue.select(YOUNG); ((pkt = p_queue.get()) != NULL);) { switch (pkt->source) { case NETWORK: /* * every incoming packet, triggered or not by our TTLBRUTEFORCE routine * will have useful informations for TTL stats. */ if (extractTTLinfo(*pkt)) { pkt->SELFLOG("removal requested by extractTTLinfo"); p_queue.drop(*pkt); continue; } if (packet_filter.match(*pkt)) { pkt->SELFLOG("removal requested by PacketFilter"); p_queue.drop(*pkt); continue; } /* here we notify each plugin of the arrival of a packet */ if (notifyIncoming(*pkt)) { pkt->SELFLOG("removal requested by notifyIncoming"); p_queue.drop(*pkt); continue; } /* packets received from network does not need to be hacked */ p_queue.insert(*pkt, SEND); break; case TUNNEL: /* SniffJoke ATM does apply to TCP/UDP traffic only */ if (pkt->proto & (TCP | UDP)) { ++(sessiontrack_map->get(*pkt).packet_number); /* * ATM we can put TCP only in KEEP status because * due to the actual ttl bruteforce implementation a * pure UDP flaw could go in starvation. */ if (pkt->proto == TCP && ttlfocus_map->get(*pkt).status == TTL_BRUTEFORCE) { p_queue.insert(*pkt, KEEP); } else { p_queue.insert(*pkt, HACK); } } else { p_queue.insert(*pkt, SEND); } break; default: RUNTIME_EXCEPTION("FATAL CODE [CYN1C]: please send a notification to the developers (%u)", pkt->source); } } } /* * here we analyze KEEP queue * * we handle only: * * TUNNEL packets: * - we analyze tcp/udp packets to see if can marked sendable or if they * need to be hold in status KEEP waiting for some conditions. * * any other pkt->source does scatter a fatal exception. */ void TCPTrack::handleKeepPackets(void) { Packet *pkt = NULL; for (p_queue.select(KEEP); ((pkt = p_queue.getSource(TUNNEL)) != NULL);) { if (ttlfocus_map->get(*pkt).status != TTL_BRUTEFORCE) p_queue.insert(*pkt, HACK); } } /* * here we analyze HACK queue * * we handle only: * * TUNNEL packets: * - we analyze every packet, we fix and insert them into the SEND queue. * - for each packet we forge hacks * - we handle the removal of the orig packet if a forged hack has requested it. * * any other pkt->source does scatter a fatal exception. */ void TCPTrack::handleHackPackets(void) { /* for every packet in HACK queue we insert some random hacks */ Packet *pkt = NULL; for (p_queue.select(HACK); ((pkt = p_queue.getSource(TUNNEL)) != NULL);) { if (!lastPktFix(*pkt)) RUNTIME_EXCEPTION("FATAL CODE [M4CH3T3]: please send a notification to the developers"); if (injectHack(*pkt)) { pkt->SELFLOG("removal requested by injectHack"); p_queue.drop(*pkt); } } if (userconf->runcfg.chaining == true) { for (p_queue.select(HACK); ((pkt = p_queue.getSource(PLUGIN)) != NULL);) { if (pkt->chainflag == REHACKABLE) { pkt->SELFLOG("proposing the packet for the second round: chaining hack"); /* only the second generation hack are used */ if (injectHack(*pkt)) { pkt->SELFLOG("removal requested by injectHack in the second round"); p_queue.drop(*pkt); } } } } for (p_queue.select(HACK); ((pkt = p_queue.get()) != NULL);) p_queue.insert(*pkt, SEND); } /* the packet is added in the packet queue here to be analyzed in a second time */ void TCPTrack::writepacket(source_t source, const unsigned char *buff, int nbyte) { try { Packet * const pkt = new Packet(buff, nbyte); pkt->source = source; pkt->wtf = INNOCENT; pkt->choosableScramble = INNOCENT; /* on innocent pkts this variable is meaningless */ /* Sniffjoke does handle only TCP, UDP and ICMP */ if (userconf->runcfg.active && (pkt->proto & mangled_proto_mask)) { if (userconf->runcfg.use_blacklist) { if (userconf->runcfg.blacklist->isPresent(pkt->ip->daddr) || userconf->runcfg.blacklist->isPresent(pkt->ip->saddr)) { p_queue.insert(*pkt, SEND); return; } } else if (userconf->runcfg.use_whitelist) { if (!userconf->runcfg.whitelist->isPresent(pkt->ip->daddr) && !userconf->runcfg.whitelist->isPresent(pkt->ip->saddr)) { p_queue.insert(*pkt, SEND); return; } } p_queue.insert(*pkt, YOUNG); return; } p_queue.insert(*pkt, SEND); } catch (exception &e) { /* anomalous/malformed packets are flushed bypassing the queue */ LOG_ALL("malformed orig pkt dropped: %s", e.what()); } } /* * this functions returns a packet from the SEND queue given a specific source */ Packet * TCPTrack::readpacket(source_t destsource) { uint8_t mask; if (destsource == NETWORK) mask = NETWORK; else mask = TUNNEL | PLUGIN | TRACEROUTE; Packet *pkt = NULL; for (p_queue.select(SEND); ((pkt = p_queue.get()) != NULL);) { if (pkt->source & mask) { p_queue.extract(*pkt); return pkt; } } return NULL; } void TCPTrack::analyzePacketQueue(void) { /* if all queues are empy we have nothing to do */ if (!p_queue.size()) goto bypass_queue_analysis; handleYoungPackets(); handleKeepPackets(); handleHackPackets(); bypass_queue_analysis: /* * here we call sessiontrack_map and ttlfocus_map manage routines. * it's fundamental to do this here after HACK last_packet_HACK() * and before ttl probes injections. * In fact the two routine, in case that their respective memory threshold * limits are passed, will delete the oldest records. * This is completely safe because send packets are just HACKed and there * is no problem if we does not schedule a ttlprobe for a cycle; * KEEP packets will scatter a new ttlfocus at the next. */ sessiontrack_map->manage(); ttlfocus_map->manage(); execTTLBruteforces(); } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/TCPTrack.h0000644000000000000000000000415113147777044017265 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2008 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_TCPTRACK_H #define SJ_TCPTRACK_H #include "Utils.h" #include "UserConf.h" #include "PortConf.h" #include "Packet.h" #include "PacketQueue.h" #include "PacketFilter.h" #include "SessionTrack.h" #include "TTLFocus.h" #include "HDRoptions.h" #include "PluginPool.h" class TCPTrack { private: uint8_t mangled_proto_mask; PacketFilter packet_filter; PacketQueue p_queue; uint32_t derivePercentage(uint32_t, uint16_t); bool percentage(uint32_t, uint16_t, uint16_t); uint16_t getUserFrequency(const Packet &); uint8_t discernAvailScramble(const Packet &); void injectTTLProbe(TTLFocus &); void execTTLBruteforces(void); bool extractTTLinfo(const Packet &); bool notifyIncoming(Packet &); bool injectHack(Packet &); bool lastPktFix(Packet &); void handleYoungPackets(void); void handleKeepPackets(void); void handleHackPackets(void); public: TCPTrack(void); ~TCPTrack(void); void writepacket(source_t, const unsigned char *, int); Packet* readpacket(source_t); void analyzePacketQueue(void); }; #endif /* SJ_TCPTRACK_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/TTLFocus.cc0000644000000000000000000002067113147777044017460 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "TTLFocus.h" TTLFocus::TTLFocus(const Packet &pkt) : access_timestamp(sj_clock), next_probe_time(sj_clock), probe_timeout(0), status(TTL_BRUTEFORCE), rand_key(random()), puppet_port(0), sent_probe(0), received_probe(0), daddr(pkt.ip->daddr), ttl_estimate(0xff), ttl_synack(0) { struct iphdr *newip = (struct iphdr *) probe_dummy; struct tcphdr *newtcp = (struct tcphdr *) (probe_dummy + sizeof (struct iphdr)); memcpy(newip, &pkt.pbuf[0], sizeof (struct iphdr) + 4); /* 4 byte for the two port TCP/UDP =) */ newip->ihl = 5; /* 20 >> 4 */ newip->protocol = IPPROTO_TCP; newip->tot_len = htons(40); newtcp->doff = 5; /* 20 >> 4 */ newtcp->fin = 0; newtcp->syn = 1; newtcp->rst = 0; newtcp->psh = 0; newtcp->ack = 0; newtcp->urg = 0; newtcp->res1 = 0; newtcp->res2 = 0; puppet_port = selectPuppetPort(ntohs(newtcp->source)); newtcp->source = htons(puppet_port); SELFLOG("Construct from Packet #%d", pkt.SjPacketId); pkt.SELFLOG("This packet has made a new Session"); } TTLFocus::TTLFocus(const struct ttlfocus_cache_record& cpy) : access_timestamp(cpy.access_timestamp), next_probe_time(sj_clock), status(TTL_KNOWN), rand_key(random()), puppet_port(0), sent_probe(0), received_probe(0), daddr(cpy.daddr), ttl_estimate(cpy.ttl_estimate), ttl_synack(cpy.ttl_synack) { memcpy(probe_dummy, cpy.probe_dummy, 40); SELFLOG("Construct from cache record"); } TTLFocus::~TTLFocus(void) { SELFLOG(""); } uint16_t TTLFocus::selectPuppetPort(uint16_t realport) { uint16_t puppet_port; do { puppet_port = (random() % (32767 - 1024)) + 1024; } while ((puppet_port >> 4) == (realport >> 4)); return puppet_port; } void TTLFocus::selflog(const char *func, const char *format, ...) const { if (debug.level() == SUPPRESS_LEVEL) return; char loginfo[LARGEBUF]; va_list arguments; va_start(arguments, format); vsnprintf(loginfo, sizeof (loginfo), format, arguments); va_end(arguments); const char *status_name = ""; switch (status) { case TTL_KNOWN: status_name = "KNOWN"; break; case TTL_BRUTEFORCE: status_name = "BRUTEFORCE"; break; case TTL_UNKNOWN: status_name = "UNKNOWN"; break; default: RUNTIME_EXCEPTION("FATAL CODE [G0ATS3] please send a notification to the developers"); } LOG_SESSION("%s daddr(%s) %s sent(%d) recv(%d) ttl_estimate(%u) ttl_synack(%u) %s", func, inet_ntoa(*((struct in_addr *) &(daddr))), status_name, sent_probe, received_probe, ttl_estimate, ttl_synack, loginfo ); } TTLFocusMap::TTLFocusMap(void) : manage_timeout(sj_clock) { LOG_DEBUG("with reference time (seconds) %u", uint32_t(sj_clock)); load(); } TTLFocusMap::~TTLFocusMap(void) { uint32_t counter = 0; dump(); for (TTLFocusMap::iterator it = begin(); it != end();) { counter++; delete &(*it->second); erase(it++); } LOG_DEBUG("dumped elements: %d", counter); } /* return a ttlfocus given a packet; return a new ttlfocus if no one exists */ TTLFocus& TTLFocusMap::get(const Packet &pkt) { TTLFocus *ttlfocus; /* check if the key it's already present */ TTLFocusMap::iterator it = find(pkt.ip->daddr); if (it != end()) /* on hit: return the ttlfocus object. */ ttlfocus = &(*it->second); else /* on miss: create a new ttlfocus and insert it into the map */ ttlfocus = &(*insert(pair(pkt.ip->daddr, new TTLFocus(pkt))).first->second); /* update access timestamp using global clock */ ttlfocus->access_timestamp = sj_clock; return *ttlfocus; } void TTLFocusMap::manage(void) { /* timeout check */ if (manage_timeout < sj_clock - TTLFOCUSMAP_MANAGE_ROUTINE_TIMER) { manage_timeout = sj_clock; /* update the next manage timeout */ for (TTLFocusMap::iterator it = begin(); it != end();) { if ((*it).second->access_timestamp + TTLFOCUS_EXPIRYTIME < sj_clock) erase(it++); else ++it; } } /* size check */ uint32_t map_size = size(); uint32_t index; if (map_size > TTLFOCUSMAP_MEMORY_THRESHOLD) { /* * we are forced to make a map cleanup. * to solve this critical condition we decide to reset half * of the map, and to do the best selection we reorder * the map by the access timestamp. * the complexity cost of this operation is O(NLogN) * due to the sort algorithm. * this is the worst case; (others operations are linear */ TTLFocus** tmp = new TTLFocus*[map_size]; index = 0; for (TTLFocusMap::iterator it = begin(); it != end(); ++it) tmp[index++] = it->second; clear(); sort(tmp, tmp + map_size, ttlfocusTimestampComparison); index = 0; do { insert(pair((tmp[index])->daddr, tmp[index])); } while (++index != TTLFOCUSMAP_MEMORY_THRESHOLD / 2); do delete tmp[index]; while (++index != map_size); delete[] tmp; } } void TTLFocusMap::load(void) { uint32_t records_num = 0; struct ttlfocus_cache_record tmp; LOG_ALL("loading ttlfocusmap from %s", FILE_TTLFOCUSMAP); FILE *loadstream = fopen(FILE_TTLFOCUSMAP, "r"); if (loadstream == NULL) { LOG_ALL("unable to access network cache: sniffjoke will start without it"); return; } while (fread(&tmp, sizeof (struct ttlfocus_cache_record), 1, loadstream) == 1) { ++records_num; TTLFocus *ttlfocus = new TTLFocus(tmp); insert(pair(ttlfocus->daddr, ttlfocus)); } fclose(loadstream); LOG_ALL("load completed: %u records loaded", records_num); } void TTLFocusMap::dump(void) { uint32_t records_num = 0; uint32_t undumped = 0; LOG_ALL("dumping ttlfocusmap to %s", FILE_TTLFOCUSMAP); FILE *dumpstream = fopen(FILE_TTLFOCUSMAP, "w"); if (dumpstream == NULL) { LOG_ALL("unable to write network cache: %s: %s", FILE_TTLFOCUSMAP, strerror(errno) ); return; } for (TTLFocusMap::iterator it = begin(); it != end(); ++it) { TTLFocus *tmp = &(*it->second); /* we saves only with TTL_KNOWN status */ if (tmp->status != TTL_KNOWN) { ++undumped; continue; } struct ttlfocus_cache_record cache_record; memset(&cache_record, 0, sizeof (struct ttlfocus_cache_record)); cache_record.access_timestamp = tmp->access_timestamp; cache_record.daddr = tmp->daddr; cache_record.ttl_estimate = tmp->ttl_estimate; cache_record.ttl_synack = tmp->ttl_synack; /* * copy the probe_dummy.pbuf vector into the cache record; * a ttlprobe packet is always 40 bytes (min iphdr + min tcphdr), * ipopts, tcpopts, and payload are stripped of on creation */ memcpy(cache_record.probe_dummy, &(tmp->probe_dummy[0]), 40); if (fwrite(&cache_record, sizeof (struct ttlfocus_cache_record), 1, dumpstream) != 1) { LOG_ALL("unable to dump ttlfocus: %s", strerror(errno)); return; } ++records_num; } fclose(dumpstream); LOG_ALL("ttlfocusmap dump completed with %u records dumped, %u where incomplete.", records_num, undumped); } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/TTLFocus.h0000644000000000000000000001062413147777044017317 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_TTLFOCUS_H #define SJ_TTLFOCUS_H #include "Utils.h" #include "Packet.h" /* IT'S FUNDAMENTAL TO HAVE ALL THIS ENUMS VALUES AS POWERS OF TWO TO PERMIT OR MASKS */ enum ttlsearch_t { TTL_KNOWN = 1, TTL_BRUTEFORCE = 2, TTL_UNKNOWN = 4 }; struct option_discovery { bool underTesting; bool confirmed; bool defaultWorking; }; class TTLFocus { public: /* timing variables */ time_t access_timestamp; /* access timestamp used to decretee expiry */ time_t next_probe_time; /* timeout value used for ttlprobe schedule */ time_t probe_timeout; /* status variables */ ttlsearch_t status; /* status of the traceroute */ uint8_t rand_key; /* random key used as try to discriminate traceroute packet */ uint16_t puppet_port; /* random port used with the aim to not disturbe a session */ uint8_t sent_probe; /* number of sent probes */ uint8_t received_probe; /* number of received probes */ /* ttl informations, results of the analysis */ const uint32_t daddr; /* destination of the traceroute */ uint8_t ttl_estimate; /* hop count estimate found during ttlbruteforce; on status KNOWN : represents the min working ttl found on status UNKNOWN : represents the max expired ttl found */ uint8_t ttl_synack; /* the value of the ttl read in the synack packet */ /* per-dest tracking of which IP|TCP options will be effective or became dropped */ struct option_discovery OptMap[SUPPORTED_OPTIONS]; unsigned char probe_dummy[40]; /* dummy ttlprobe packet generated from the packet that scattered the ttlfocus creation. the packet size is always 40 bytes long, (sizeof(struct iphdr) + sizeof(struct tcphdr)) */ TTLFocus(void); TTLFocus(const Packet &pkt); TTLFocus(const struct ttlfocus_cache_record &); ~TTLFocus(void); uint16_t selectPuppetPort(uint16_t); /* utilities */ void selflog(const char *func, const char *format, ...) const; }; class TTLFocusMap : public map { private: time_t manage_timeout; struct ttlfocus_timestamp_comparison { bool operator() (const TTLFocus *i, const TTLFocus * j) { return ( i->access_timestamp < j->access_timestamp); } } ttlfocusTimestampComparison; public: TTLFocusMap(void); ~TTLFocusMap(void); TTLFocus& get(const Packet &); void manage(void); void load(void); void dump(void); }; struct ttlfocus_cache_record { time_t access_timestamp; /* access timestamp used to decretee expiry */ uint32_t daddr; /* destination of the traceroute */ uint8_t ttl_estimate; /* hop count estimate found during ttlbruteforce; on status KNOWN : represents the min working ttl found on status UNKNOWN : represents the max expired ttl found */ uint8_t ttl_synack; /* the value of the ttl read in the synack packet */ unsigned char probe_dummy[40]; /* dummy ttlprobe packet generated from the packet that scattered the ttlfocus creation. the packet size is always 40 bytes long, (sizeof(struct iphdr) + sizeof(struct tcphdr)) */ }; #endif /* SJ_TTLFOCUS_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/UserConf.cc0000644000000000000000000005073713147777044017547 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011, 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "UserConf.h" /* * rules for parms: * sj_cmdline_opts contains only the option passed to the command line. * for uninitializated values will be used default ones. * * when a configuration file is present, the priority is given to * 1) command line options * 2) configuration files * 3) defaults */ UserConf::UserConf(const struct sj_cmdline_opts &cmdline_opts) : cmdline_opts(cmdline_opts) { LOG_DEBUG(""); const char *selected_basedir = NULL, *selected_location = NULL; /* generating referringdir and configfile (public) */ if (cmdline_opts.basedir[0]) { if (cmdline_opts.basedir[0] != '/') RUNTIME_EXCEPTION("--dir must have absolute resolution"); if (access(cmdline_opts.basedir, X_OK)) RUNTIME_EXCEPTION("--dir parameter is not accessible"); else selected_basedir = cmdline_opts.basedir; } else /* no option used, default in hardcoded-defines.h */ { selected_basedir = WORK_DIR; } if (cmdline_opts.location[0]) { selected_location = cmdline_opts.location; } else { LOG_ALL("is strongly suggest to use sniffjoke specifying a location (--location option): 'generic/' is used"); selected_location = DEFAULT_LOCATION; } /* length sanity check, the input value are MEDIUMBUF (256) the generated buf are LARGEBUF (1024) */ if (strlen(selected_basedir) + strlen(selected_location) > (LARGEBUF - strlen(FILE_CONF) - 1)) { RUNTIME_EXCEPTION("internal error: the length of --dir and --location argument is over %d byte lenght", (LARGEBUF - strlen(FILE_CONF) - 1)); } /* setting up che 'struct sj_config runconfig', the public member of UserConf class */ memset(&runcfg, 0x00, sizeof (sj_config)); memcpy(runcfg.location, selected_location, strlen(selected_location)); /* in main.cc, near getopt, basedir last char if set to be '/' */ snprintf(runcfg.working_dir, sizeof (runcfg.working_dir), "%s%s", selected_basedir, selected_location); /* checking if the option --location has sense: will be a typo! */ if (access(runcfg.working_dir, X_OK)) { RUNTIME_EXCEPTION("invalid parm: basedir (%s) and location (%s) point to a non accessible directory: %s", selected_basedir, selected_location, strerror(errno)); } else { LOG_DEBUG("checked working directory %s accessible", runcfg.working_dir); } /* generic has been make usefull again as default, but without MALfORMED attacks supports, this section of code * is kept until stabilized. */ #if 0 char generic_errormsg[MEDIUMBUF]; snprintf(generic_errormsg, sizeof (generic_errormsg), "%s%s/%s", selected_basedir, selected_location, GENERIC_MARKER_FILE); /* if the user has not specify a location, and thus we are on the generic: show them the fatal error */ if (!(access(generic_errormsg, R_OK))) { FILE *ferrormsg = fopen(generic_errormsg, "r"); while(!feof(ferrormsg)) { fgets(generic_errormsg, MEDIUMBUF, ferrormsg); fputs(generic_errormsg, stdout); } fclose(ferrormsg); LOG_ALL("The 'generic' configuration is located here: %s", selected_basedir); RUNTIME_EXCEPTION("location required: generate with sniffjoke-autotest"); } #endif snprintf(configfile, sizeof (configfile), "%s%s/%s", selected_basedir, selected_location, FILE_CONF); /* loadDiskConfiguration() use the default name defined in hardcoded-defines.h, so is required change the current working directory */ if (chdir(runcfg.working_dir)) RUNTIME_EXCEPTION("unable to chdir in the specifiy location"); /* load does NOT memset to 0 the runconfig struct! and load defaults if file are not present */ loadDiskConfiguration(); /* check integrity in the configuration loaded */ if (runcfg.no_tcp && runcfg.no_udp) RUNTIME_EXCEPTION("configuration conflict: both tcp and udp can't be disabled"); if (runcfg.use_blacklist && runcfg.use_whitelist) RUNTIME_EXCEPTION("configuration conflict: both blacklist and whitelist seem to be enabled"); if (runcfg.onlyplugin[0]) { LOG_VERBOSE("plugin %s override the plugins settings in %s", runcfg.onlyplugin, FILE_PLUGINSENABLER); } else { if (access(FILE_PLUGINSENABLER, R_OK)) { RUNTIME_EXCEPTION("unable to access to enabler file %s: %s: location unaccepted", FILE_PLUGINSENABLER, strerror(errno)); } else { LOG_VERBOSE("accepted location [%s] and related [%s]", runcfg.location, FILE_PLUGINSENABLER); } } LOG_DEBUG("runconfig pass the sanity checks"); } UserConf::~UserConf(void) { LOG_DEBUG("[pid %d], config %s", getpid(), configfile); } void UserConf::autodetectLocalInterface(void) { /* check this command: the flag value, matched in 0003, is derived from: * /usr/src/linux/include/linux/route.h */ const char *cmd = "route -n | grep ^0.0.0.0 | grep UG | awk '{print $8}'"; string imp_str; uint8_t i; LOG_ALL("detecting external gateway interface with [%s]", cmd); imp_str = execOSCmd(cmd); for (i = 0; i < strlen(imp_str.c_str()) && isalnum((imp_str.c_str())[i]); ++i) runcfg.net_iface_name[i] = (imp_str.c_str())[i]; if (i < 3) RUNTIME_EXCEPTION("default gateway not present: sniffjoke cannot be started"); else { LOG_ALL("detected external interface with default gateway: %s", runcfg.net_iface_name); } } void UserConf::autodetectLocalInterfaceIPAddress(void) { char cmd[MEDIUMBUF]; string imp_str; snprintf(cmd, MEDIUMBUF, "ifconfig %s | grep \"inet addr\" | cut -b 21- | awk '{print $1}'", runcfg.net_iface_name); LOG_ALL("detecting interface %s ip address with [%s]", runcfg.net_iface_name, cmd); imp_str = execOSCmd(cmd); strncpy(runcfg.net_iface_ip, imp_str.c_str(), sizeof (runcfg.net_iface_ip)); LOG_ALL("acquired local ip address: %s", runcfg.net_iface_ip); } void UserConf::autodetectGWIPAddress(void) { const char *cmd = "route -n | grep ^0.0.0.0 | grep UG | awk '{print $2}'"; string imp_str; LOG_ALL("detecting gateway ip address with [%s]", cmd); imp_str = execOSCmd(cmd); for (uint8_t i = 0; i < strlen(imp_str.c_str()) && (isdigit((imp_str.c_str())[i]) || (imp_str.c_str())[i] == '.'); ++i) runcfg.gw_ip_addr[i] = (imp_str.c_str())[i]; if (strlen(runcfg.gw_ip_addr) < 7) RUNTIME_EXCEPTION("unable to autodetect gateway ip address, sniffjoke cannot be started"); else { LOG_ALL("acquired gateway ip address: %s", runcfg.gw_ip_addr); } } void UserConf::importMacAddr(const char *cmd_out) { uint32_t mac[6]; uint32_t i; for (i = 0; i < strlen(cmd_out) && (isxdigit(cmd_out[i])) || (cmd_out[i] == ':'); ++i) runcfg.gw_mac_str[i] = cmd_out[i]; if (i != 17) RUNTIME_EXCEPTION("invalid mac address format: [%s] is not long 17 bytes", cmd_out); LOG_ALL("acquired gateway mac address from the arp table: %s", runcfg.gw_mac_str); sscanf(runcfg.gw_mac_str, "%2x:%2x:%2x:%2x:%2x:%2x", &mac[0], &mac[1], &mac[2], &mac[3], &mac[4], &mac[5]); for (i = 0; i < ETH_ALEN; ++i) runcfg.gw_mac_addr[i] = mac[i]; } void UserConf::autodetectGWMACAddress(void) { char cmd[MEDIUMBUF]; string cmdout_str; snprintf(cmd, MEDIUMBUF, "arp -ni %s %s | grep %s | awk '{print $3}'", runcfg.net_iface_name, runcfg.gw_ip_addr, runcfg.gw_ip_addr); LOG_ALL("detecting mac address of gateway with [%s]", cmd); cmdout_str = execOSCmd(cmd); LOG_VERBOSE("received output to detect gateway mac address: %s", cmdout_str.c_str() ); importMacAddr( cmdout_str.c_str() ); } /* this method is called by SniffJoke.cc */ void UserConf::networkSetup(void) { LOG_DEBUG("initializing network for service/child: %d", getpid()); /* autodetect is always used, but will be override by --options, for this reason is checked * the presence of previously assignments */ autodetectLocalInterface(); autodetectLocalInterfaceIPAddress(); autodetectGWIPAddress(); if(!strlen(runcfg.gw_mac_str)) autodetectGWMACAddress(); LOG_VERBOSE("* system local interface: %s, %s address", runcfg.net_iface_name, runcfg.net_iface_ip); LOG_VERBOSE("* default gateway mac address: %s", runcfg.gw_mac_str); LOG_VERBOSE("* default gateway ip address: %s", runcfg.gw_ip_addr); } /* * BELOW FOLLOW THE LIST OF PARSING METHOD. * some also low level, with strstr, memcmp, sscanf, ... * * IN THE FUTURE MAYBE SPLITTED IN ANOTHER CLASS, BUT UNTIL WE AUGMENT * THE NUMBER OF CONFIGURATION FILES, IS NOT A PRIORITY. * * BETTER WILL BE CREATE A CLASS like IPListMap, with Port instead of IP. * IS A C++ SOLUTION INSTEAD OF THIS OLDISH C-like spaghetti code. * */ /* internal function called by the overloaded parseMatch */ bool UserConf::parseKeyword(FILE *cf, char* userchoose, const char *keyword) { char line[MEDIUMBUF] = {0}; rewind(cf); do { if(fgets(line, MEDIUMBUF, cf) == NULL) break; if (line[0] == '#' || line[0] == '\n' || line[0] == ' ') continue; if (line[strlen(line) - 1] == '\n') line[strlen(line) - 1] = 0x00; if (!strncmp(keyword, line, strlen(keyword))) { if (strlen(line) > strlen(keyword)) strncpy(userchoose, (&line[strlen(keyword) + 1]), strlen(line) - strlen(keyword) - 1); return true; } } while (!feof(cf)); return false; } void UserConf::parseMatch(char *dst, const char *name, FILE *cf, const char *cmdopt, const char *difolt) { char useropt[MEDIUMBUF] = {0}; const char *debugfmt = NULL; /* command line priority always */ if (cmdopt != NULL && strncmp(cmdopt, difolt, strlen(cmdopt))) { debugfmt = "string: option %s read from command line: [%s]"; strncpy(dst, cmdopt, MEDIUMBUF); } else if (cf != NULL && parseKeyword(cf, useropt, name)) { debugfmt = "string: option %s read from config file: [%s]"; strncpy(dst, useropt, MEDIUMBUF); } else { debugfmt = "string: not found %s option in conf file, using default: [%s]"; strncpy(dst, difolt, strlen(difolt)); } LOG_DEBUG(debugfmt, name, dst); } void UserConf::parseMatch(uint16_t &dst, const char *name, FILE *cf, uint16_t cmdopt, uint16_t difolt) { char useropt[MEDIUMBUF] = {0}; const char *debugfmt = NULL; /* command line priority always */ if (cmdopt != difolt) { debugfmt = "uint16: option %s read from command line: [%d]"; dst = cmdopt; } else if (cf != NULL && parseKeyword(cf, useropt, name)) { debugfmt = "uint16: option %s read from config file: [%d]"; dst = atoi(useropt); } else { debugfmt = "uint16: not found %s option in conf file, using default: [%d]"; dst = difolt; } LOG_DEBUG(debugfmt, name, dst); } void UserConf::parseMatch(bool &dst, const char *name, FILE *cf, bool cmdopt, bool difolt) { char useropt[MEDIUMBUF] = {0}; const char *debugfmt = NULL; /* command line priority always */ if (cmdopt != difolt) { dst = cmdopt; debugfmt = "bool: option %s read from command line: [%s]"; } else if (cf != NULL && parseKeyword(cf, useropt, name)) { dst = true; debugfmt = "bool: option %s read from config file: [%s]"; } else { dst = difolt; debugfmt = "bool: not found %s option in conf file, using default: [%s]"; } LOG_DEBUG(debugfmt, name, dst ? "true" : "false"); } /* this is the function that load the settings, it merge the command line options with * the file defined in hardcoded-define.h (all the .conf files) expected in the working_dir * derived by the --dir and --location options * * are not verified the integrity of such configuration, but only loaded, the integrity * is checked in the constructor of UserConf */ bool UserConf::loadDiskConfiguration(void) { FILE *loadstream = fopen(FILE_CONF, "r"); if (loadstream == NULL) LOG_ALL("configuration file %s not accessible: %s, using default", configfile, strerror(errno)); else LOG_DEBUG("opening configuration file: %s", configfile); parseMatch(runcfg.user, "user", loadstream, cmdline_opts.user, DEFAULT_USER); parseMatch(runcfg.group, "group", loadstream, cmdline_opts.group, DEFAULT_GROUP); parseMatch(runcfg.admin_address, "management-address", loadstream, cmdline_opts.admin_address, DEFAULT_ADMIN_ADDRESS); parseMatch(runcfg.admin_port, "management-port", loadstream, cmdline_opts.admin_port, DEFAULT_ADMIN_PORT); parseMatch(runcfg.chaining, "chaining", loadstream, cmdline_opts.chaining, DEFAULT_CHAINING); parseMatch(runcfg.no_tcp, "no-tcp", loadstream, cmdline_opts.no_tcp, DEFAULT_NO_TCP); parseMatch(runcfg.no_udp, "no-udp", loadstream, cmdline_opts.no_udp, DEFAULT_NO_UDP); parseMatch(runcfg.use_whitelist, "whitelist", loadstream, cmdline_opts.use_whitelist, DEFAULT_USE_WHITELIST); parseMatch(runcfg.use_blacklist, "blacklist", loadstream, cmdline_opts.use_blacklist, DEFAULT_USE_BLACKLIST); parseMatch(runcfg.active, "active", loadstream, cmdline_opts.active, DEFAULT_START_STOPPED); parseMatch(runcfg.go_foreground, "foreground", loadstream, cmdline_opts.go_foreground, DEFAULT_GO_FOREGROUND); parseMatch(runcfg.debug_level, "debug", loadstream, cmdline_opts.debug_level, DEFAULT_DEBUG_LEVEL); parseMatch(runcfg.onlyplugin, "only-plugin", loadstream, cmdline_opts.onlyplugin, DEFAULT_ONLYPLUGIN); parseMatch(runcfg.max_ttl_probe, "max-ttl-probe", loadstream, cmdline_opts.max_ttl_probe, DEFAULT_MAX_TTLPROBE); parseMatch(runcfg.gw_mac_str, "gw-mac-addr", loadstream, cmdline_opts.gw_mac_str, DEFAULT_GW_MAC_ADDR); /* loading of IP lists, in future also the source IP address should be useful */ if (runcfg.use_blacklist) { runcfg.blacklist = new IPListMap(FILE_IPBLACKLIST); if ((*(runcfg.blacklist)).empty()) RUNTIME_EXCEPTION("requested blacklist but blacklist file not found or empty"); } /* if the network details are passed by options, complete the acquisition */ if (strlen(runcfg.gw_mac_str)) { importMacAddr(runcfg.gw_mac_str); } if (runcfg.use_whitelist) { runcfg.whitelist = new IPListMap(FILE_IPWHITELIST); if ((*(runcfg.whitelist)).empty()) RUNTIME_EXCEPTION("requested whitelist but whitelist file not found or empty"); } if (loadstream) fclose(loadstream); /* those files act in portconf[PORTNUMBER]; array, merging the ports configuration */ loadAggressivity(); return true; } /* function for loading of the TCP port files */ void UserConf::loadAggressivity(void) { for (uint32_t i = 0; i < PORTSNUMBER; i++) runcfg.portconf[i] = AGG_NONE; FILE *loadstream = fopen(FILE_AGGRESSIVITY, "r"); if (loadstream == NULL) { LOG_ALL("port aggressivity specifications in %s/%s: %s, using defaults", runcfg.working_dir, FILE_AGGRESSIVITY, strerror(errno)); /* the default is NONE. in the file port-aggrssivity.conf * the configured default is: * * 1:65535 RARE * * but is not an absolute truth, I like the user that choose for himself */ return; } uint32_t linecnt = 0; /* the minimum length of a line is 6 */ while (!feof(loadstream)) { ++linecnt; char line[MEDIUMBUF]; if(fgets(line, MEDIUMBUF, loadstream) == NULL) break; if (!strlen(line) || line[0] == '#' || line[0] == '\n') continue; if (line[strlen(line) - 1] == '\n') line[strlen(line) - 1] = 0x00; portLine pl; pl.setup(line); pl.extractPorts(); pl.extractValue(); if (pl.error_message) RUNTIME_EXCEPTION("unable to parse aggressivity file %s/%s line %d: %s", runcfg.working_dir, FILE_AGGRESSIVITY, linecnt, pl.error_message); pl.mergeLine(runcfg.portconf); } fclose(loadstream); } /* simple utiliy for dumping */ uint32_t UserConf::dumpIfPresent(FILE *out, const char *name, char *data, const char* difolt) { uint32_t written = 0; if (data != NULL && (difolt == NULL || strncmp(data, difolt, strlen(difolt)))) written = fprintf(out, "%s:%s\n", name, data); return written; } uint32_t UserConf::dumpIfPresent(FILE *out, const char *name, uint16_t data, uint16_t difolt) { uint32_t written = 0; if (data != difolt) written = fprintf(out, "%s:%u\n", name, data); return written; } uint32_t UserConf::dumpIfPresent(FILE *out, const char *name, bool data, bool difolt) { uint32_t written = 0; if (data != difolt) written = fprintf(out, "%s\n", name); return written; } bool UserConf::syncDiskConfiguration(void) { uint32_t written = 0; char tempdumpfname[LARGEBUF]; snprintf(tempdumpfname, LARGEBUF, "%s.temp", FILE_CONF); FILE *out = fopen(tempdumpfname, "w"); if (out == NULL) { LOG_ALL("unable to open new configuration file %s: %s", tempdumpfname, strerror(errno)); return false; } /* this is bad, this segment of code is more coherent in UserConf.cc */ written += fprintf(out, "# this is a dumped file by SniffJoke version %s\n", SW_VERSION); written += dumpIfPresent(out, "user", runcfg.user, DEFAULT_USER); written += dumpIfPresent(out, "group", runcfg.group, DEFAULT_GROUP); written += dumpIfPresent(out, "management-address", runcfg.admin_address, DEFAULT_ADMIN_ADDRESS); written += dumpIfPresent(out, "management-port", runcfg.admin_port, DEFAULT_ADMIN_PORT); written += dumpIfPresent(out, "chaining", runcfg.chaining, DEFAULT_CHAINING); written += dumpIfPresent(out, "no-tcp", runcfg.no_tcp, DEFAULT_NO_TCP); written += dumpIfPresent(out, "no-udp", runcfg.no_udp, DEFAULT_NO_UDP); written += dumpIfPresent(out, "whitelist", runcfg.use_whitelist, DEFAULT_USE_WHITELIST); written += dumpIfPresent(out, "blacklist", runcfg.use_blacklist, DEFAULT_USE_BLACKLIST); written += dumpIfPresent(out, "active", runcfg.active, DEFAULT_START_STOPPED); written += dumpIfPresent(out, "foreground", runcfg.go_foreground, DEFAULT_GO_FOREGROUND); written += dumpIfPresent(out, "debug", runcfg.debug_level, DEFAULT_DEBUG_LEVEL); written += dumpIfPresent(out, "max-ttl-probe", runcfg.max_ttl_probe, DEFAULT_MAX_TTLPROBE); if (!syncPortsFiles() || !syncIPListsFiles()) { LOG_ALL("interrupted dumping of running configuration in the %s location", runcfg.location); goto faultyreturn; } if ((uint32_t) ftell(out) != written) { LOG_ALL("incomplete data written for the new configuration file: %s", strerror(errno)); goto faultyreturn; } fclose(out); out = NULL; if (rename(tempdumpfname, FILE_CONF)) { LOG_ALL("unable to update the configuration file, moving the temporary %s to %s: %s", tempdumpfname, FILE_CONF, strerror(errno)); goto faultyreturn; } return true; faultyreturn: if (out != NULL) fclose(out); unlink(tempdumpfname); return false; } bool UserConf::syncPortsFiles(void) { /* TODO */ return true; } bool UserConf::syncIPListsFiles(void) { /* TODO */ return true; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/UserConf.h0000644000000000000000000001246013147777044017400 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011, 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_CONF_H #define SJ_CONF_H #include "Utils.h" #include "PortConf.h" #include "IPList.h" #include "SessionTrack.h" #include "TTLFocus.h" #include "HDRoptions.h" #include "internalProtocol.h" #include struct sj_cmdline_opts { /* these date are not present in sj_config because the * effective configuration directory is generated as private * data inside UserConf classes */ char basedir[MEDIUMBUF]; char location[MEDIUMBUF]; /* START OF COMMON PART WITH sj_config THAT WILL BE SAVED IN CONF FILE */ char user[MEDIUMBUF]; char group[MEDIUMBUF]; char admin_address[MEDIUMBUF]; uint16_t admin_port; bool no_tcp; bool no_udp; bool chaining; bool use_whitelist; bool use_blacklist; bool active; bool go_foreground; uint16_t debug_level; char onlyplugin[MEDIUMBUF]; uint16_t max_ttl_probe; char gw_mac_str[SMALLBUF]; /* END OF COMMON PART WITH sj_config THAT WILL BE SAVED IN CONF FILE */ bool force_restart; }; /* this is the struct keeping the sniffjoke variables, is loaded * by the configuration file, when a command line option is specified * the command line override the loaded data. the data here present will * be dumped overriding the previous config file */ struct sj_config { float MAGIC; /* integrity check for saved binary configuration */ char version[SMALLBUF]; /* SW_VERSION from hardcoded-defines.h */ char working_dir[LARGEBUF]; char location[MEDIUMBUF]; /* START OF COMMON PART WITH sj_cmdline_opts THAT WILL BE SAVED IN CONF FILE */ char user[MEDIUMBUF]; char group[MEDIUMBUF]; char admin_address[MEDIUMBUF]; uint16_t admin_port; bool no_tcp; bool no_udp; bool chaining; bool use_whitelist; bool use_blacklist; bool active; bool go_foreground; uint16_t debug_level; char onlyplugin[MEDIUMBUF]; uint16_t max_ttl_probe; char gw_mac_str[SMALLBUF]; /* END OF COMMON PART WITH sj_cmdline_opts THAT WILL BE SAVED IN CONF FILE */ /* mangling policies */ uint16_t portconf[PORTSNUMBER]; IPListMap *whitelist; IPListMap *blacklist; /* system informations, autodetected */ char gw_ip_addr[SMALLBUF]; char gw_mac_addr[ETH_ALEN]; char net_iface_name[SMALLBUF]; /* char tun_iface_name[SMALLBUF] statically know as TUN_IF_NAME */ char net_iface_ip[SMALLBUF]; char tun_iface_ip[SMALLBUF]; uint16_t net_iface_mtu; uint16_t tun_iface_mtu; }; class UserConf { private: /* network configuration autodetect support functions */ void autodetectLocalInterface(void); void autodetectLocalInterfaceIPAddress(void); void autodetectGWIPAddress(void); void autodetectGWMACAddress(void); void autodetectFirstAvailableTunnelInterface(void); /* network configuration, autodetect utilities */ void importMacAddr(const char*); void parseOnlyParam(const char*); /* config file load/dump support*/ bool parseKeyword(FILE *, char *, const char *); void parseMatch(char *, const char *, FILE *, const char *, const char *); void parseMatch(uint16_t &, const char *, FILE *, uint16_t, uint16_t); void parseMatch(bool &, const char *, FILE *, bool, bool); uint32_t dumpIfPresent(FILE *, const char *, char *, const char *); uint32_t dumpIfPresent(FILE *, const char *, uint16_t, uint16_t); uint32_t dumpIfPresent(FILE *, const char *, bool, bool); /* import of the file containing the port range settings, and load the * default if not present, it use portLine class in portConfParsing.cc */ void loadAggressivity(void); void initOptionLoader(const char *); void delOptionLoader(); bool syncPortsFiles(void); bool syncIPListsFiles(void); public: const struct sj_cmdline_opts &cmdline_opts; char configfile[LARGEBUF]; /* generated by runcfg.location + hardcoded-define */ struct sj_config runcfg; /* the running configuration is accessible by other class */ UserConf(const struct sj_cmdline_opts &); ~UserConf(void); /* call all the private method for setup networking -- in future need to be modify * for multi OS supports */ void networkSetup(void); /* config file load/dump interface*/ bool loadDiskConfiguration(void); bool syncDiskConfiguration(void); }; #endif /* SJ_CONF_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/Utils.cc0000644000000000000000000001002613147777044017106 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "Utils.h" /* runtime_error runtime_exception(const char* func, const char* file, uint32_t line, const char* format, ...) */ runtime_error runtime_exception(const char* func, const char* format, ...) { char error[LARGEBUF]; char complete_error[LARGEBUF]; va_list arguments; va_start(arguments, format); vsnprintf(error, sizeof (error), format, arguments); /* snprintf(complete_error, sizeof (complete_error), "%s:%d %s() [ %s ]", file, line, func, error); */ snprintf(complete_error, sizeof (complete_error), "%s() [ %s ]", func, error); va_end(arguments); stringstream stream; stream << complete_error; return std::runtime_error(stream.str()); } string execOSCmd(string cmd) { string data; char buffer[4096]; /* cmd.append("| tr -d '\n'"); */ FILE *stream = popen(cmd.c_str(), "r"); /* get only the first line, to avoid the use of "| line" at the end of every command line, * before the data.append was derived collecting */ if(fgets(buffer, sizeof (buffer), stream) == NULL) { LOG_DEBUG("command [%s] return no any answer!", cmd.c_str()); } else { /* cut the '\n' instead append "| tr -d '\n'", because this will join togheder more lines */ buffer[strlen(buffer) -1] = 0x00; data.append(buffer); } pclose(stream); return data; } void init_random() { /* random pool initialization */ srandom(time(NULL)); for (uint8_t i = 0; i < ((uint8_t) random() % 10); ++i) srandom(random()); } void* memset_random(void *s, size_t n) { /* * highly optimized memset_random * * long int random(void). * * long int is variable on different architectures; * for example on linux 64 bit is 8 chars long, * so do a while using single chars its an inefficient choice. * */ if (debug.level() == TESTING_LEVEL) { memset(s, '6', n); } else { size_t longint = n / sizeof (long int); size_t finalbytes = n % sizeof (long int); unsigned char *cp = (unsigned char*) s; while (longint-- > 0) { *((long int*) cp) = random(); cp += sizeof (long int); } while (finalbytes-- > 0) { *cp = (unsigned char) random(); ++cp; } } return s; } bool random_percent(int32_t percent) { if(debug.level() == TESTING_LEVEL) return true; return ( (random() % 100) + 1 <= percent ); } int snprintfScramblesList(char *str, size_t size, uint8_t scramblesList) { int len = snprintf(str, size, "%s%s%s%s", scramblesList & SCRAMBLE_TTL ? "PRESCRIPTION," : "", scramblesList & SCRAMBLE_MALFORMED ? "MALFORMED," : "", scramblesList & SCRAMBLE_CHECKSUM ? "GUILTY," : "", scramblesList & SCRAMBLE_INNOCENT ? "INNOCENT" : ""); if (str[strlen(str) - 1] == ',') { str[strlen(str) - 1] = '\0'; --len; } return len; } sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/Utils.h0000644000000000000000000000666213147777044016763 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011, 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * This file include the headers commonly used in every .cc file */ #ifndef SJ_UTILS_H #define SJ_UTILS_H #include "hardcodedDefines.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include using namespace std; #include #include /* required by fchmod - used for plugin logging in Debug.cc */ #include #include "Debug.h" /* * there is a single clock in sniffjoke; * it global and defined/initialized/updated by Sniffjoke.cc */ extern time_t sj_clock; extern char sj_clock_str[MEDIUMBUF]; #define ISSET_TTL(byte) (byte & SCRAMBLE_TTL) #define ISSET_CHECKSUM(byte) (byte & SCRAMBLE_CHECKSUM) #define ISSET_MALFORMED(byte) (byte & SCRAMBLE_MALFORMED) #define ISSET_INNOCENT(byte) (byte & SCRAMBLE_INNOCENT) #define RANDOM_IPOPT ((random() % (LAST_IPOPT - FIRST_IPOPT )) + FIRST_IPOPT + 1) #define RANDOM_TCPOPT ((random() % (LAST_TCPOPT - FIRST_TCPOPT )) + FIRST_TCPOPT + 1) /* std::runtime_error runtime_exception(const char *, const char *, uint32_t, const char *, ...); */ std::runtime_error runtime_exception(const char *, const char *, ...); string execOSCmd(string cmd); void init_random(void); void* memset_random(void *, size_t); int snprintfScramblesList(char *str, size_t size, uint8_t scramblesList); bool random_percent(int32_t percent); #define SELFLOG(...) selflog(__func__, __VA_ARGS__) /* #define RUNTIME_EXCEPTION(...) throw runtime_exception(__func__, __FILE__, __LINE__, __VA_ARGS__) */ #define RUNTIME_EXCEPTION(...) throw runtime_exception(__func__, __VA_ARGS__) /* * this struct is the SniffJoke executing environment, it contains pointer to * the main singleton instanced classess, and an sjEnviron is used for share * these pointer with the external loaded plugin. * * Is declared here, as void *, to (a)void: ‘BlahBlah’ was not declared in this scope */ struct sjEnviron { /* therse three is declared as private in SniffJoke class */ void * instanced_proc; void * instanced_mitm; void * instanced_ct; /* those five are global in the software */ void * instanced_ucfg; void * instanced_ttl; void * instanced_sex; void * instanced_itopts; void * instanced_plugins; }; #endif /* SJ_UTILS_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/config.h.in0000644000000000000000000000540013147777044017522 0ustar00/* Cmake rox, nothing less! Now SniffJoke will see the light at the end of the tunnel, I hope */ #ifndef CONFIG_H #define CONFIG_H /* Define to 1 if you have the `clock_gettime' function. */ #cmakedefine HAVE_CLOCK_GETTIME 1 /* "use syscall interface for clock_gettime" */ #cmakedefine HAVE_CLOCK_SYSCALL 1 /* Define to 1 if you have the `epoll_ctl' function. */ #cmakedefine HAVE_EPOLL_CTL 1 /* Define to 1 if you have the `eventfd' function. */ #cmakedefine HAVE_EVENTFD 1 /* Define to 1 if you have the `inotify_init' function. */ #cmakedefine HAVE_INOTIFY_INIT 1 /* Define to 1 if you have the `kqueue' function. */ #cmakedefine HAVE_KQUEUE 1 /* Define to 1 if you have the `nanosleep' function. */ #cmakedefine HAVE_NANOSLEEP 1 /* Define to 1 if you have the `poll' function. */ #cmakedefine HAVE_ERRNO_H #cmakedefine HAVE_ERRNO /* *** * yes yes yes: before the 1.0 release, SniffJoke will use libevent \**** ^^^^^^ ^^^ ^^^ ^^^^^^^ ^^^^^^^^^ ^^^^ ^^^ ^^^^^^^^ */ #cmakedefine HAVE_POLL 1 /* Define to 1 if you have the header file. */ #cmakedefine HAVE_POLL_H 1 /* Define to 1 if you have the `select' function. */ #cmakedefine HAVE_SELECT 1 /* Define to 1 if you have the header file. */ #cmakedefine HAVE_SYS_EPOLL_H 1 /* Define to 1 if you have the header file. */ #cmakedefine HAVE_SYS_EVENTFD_H 1 /* Define to 1 if you have the header file. */ #cmakedefine HAVE_SYS_EVENT_H 1 /* end of the libevent wishlist: hey! if you know libevent and feel * yourself strangely attracted from sniffjoke, help us! */ /* Define to 1 if you have the header file. */ #cmakedefine HAVE_SYS_INOTIFY_H 1 /* Define to 1 if you have the header file. */ #cmakedefine HAVE_SYS_QUEUE_H 1 /* Define to 1 if you have the header file. */ #cmakedefine HAVE_SYS_SELECT_H 1 /* where can I find the sniffjoke executable ? */ #cmakedefine PREFIX "@PREFIX@" #define INSTALL_BINDIR PREFIX"/bin" /* the prefix and the exec_prefix passed by configure - compatibility */ #define INSTALL_EXECPREFIX PREFIX #define INSTALL_PREFIX PREFIX /* where can I find my plugins ? */ #define INSTALL_LIBDIR PREFIX"/lib/sniffjoke/" /* where can I find my running track ? */ #define INSTALL_STATEDIR PREFIX"/var/sniffjoke/" #cmakedefine SNIFFJOKE_VERSION_MAJOR @VERSION_MAJOR@ #cmakedefine SNIFFJOKE_VERSION_MINOR @VERSION_MINOR@ #cmakedefine SNIFFJOKE_VERSION_SUFFIX @VERSION_SUFFIX@ /* Version number of package */ #ifdef SNIFFJOKE_VERSION_SUFFIX #define VERSION SNIFFJOKE_VERSION_MAJOR"."SNIFFJOKE_VERSION_MINOR"-"SNIFFJOKE_VERSION_SUFFIX #else #define VERSION SNIFFJOKE_VERSION_MAJOR"."SNIFFJOKE_VERSION_MINOR #endif /* Name of package */ #define PACKAGE PROJECT #define PACKAGENAME PACKAGE"-"VERSION #endif // CONFIG_H sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/hardcodedDefines.h0000644000000000000000000002055613147777044021074 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2010,2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /* * this is the define value used in sniffjoke. if you are making porting of sniffjoke * for a distribution, this is your file */ #ifndef SJ_DEFINES_H #define SJ_DEFINES_H #include "config.h" #define SW_NAME "SniffJoke" #define SW_VERSION "0.4.2" /* Sniffjoke defaults config values */ #define DEFAULT_DIR INSTALL_STATEDIR #define DEFAULT_LOCATION "generic" #define DEFAULT_USER "nobody" #define DEFAULT_GROUP "nogroup" #define DEFAULT_ADMIN_ADDRESS "127.0.0.1" #define DEFAULT_ADMIN_PORT 8844 #define DEFAULT_CHAINING false #define DEFAULT_NO_TCP false #define DEFAULT_NO_UDP false #define DEFAULT_USE_WHITELIST false #define DEFAULT_USE_BLACKLIST false #define DEFAULT_START_STOPPED false /* sniffjoke start stopped and is false to be true (http://freeworld.thc.org/root/phun/unmaintain.html)*/ #define DEFAULT_GO_FOREGROUND false #define DEFAULT_FORCE_RESTART false #define DEFAULT_ONLYPLUGIN "" #define DEFAULT_DEBUG_LEVEL 2 #define DEFAULT_MAX_TTLPROBE 35 #define DEFAULT_GW_MAC_ADDR "" /* this is not configurabile anyway in some (wrong) local network the * class 1.0.0.0/8 is used and should be require change this puppet-IP */ #define DEFAULT_FAKE_IPADDR "1.198.10.5" /* configuration dirs/files */ #define WORK_DIR INSTALL_STATEDIR #define SJ_PIDFILE "/var/run/sniffjoke.pid" #define FILE_CONF "sniffjoke-service.conf" #define FILE_PLUGINSENABLER "plugins-enabled.conf" #define FILE_TTLFOCUSMAP "ttlfocusmap.bin" #define FILE_IPWHITELIST "ipwhitelist.conf" #define FILE_IPBLACKLIST "ipblacklist.conf" #define FILE_AGGRESSIVITY "port-aggressivity.conf" #define FILE_LOG "sniffjoke.log" #define FILE_LOG_SESSION "sniffjoke.log.sessions" #define FILE_LOG_PACKET "sniffjoke.log.packets" #define FILE_IPTCPOPT_CONF "iptcp-options.conf" #define IPTCPOPT_TEST_PLUGIN "HDRoptions_probe" #define GENERIC_MARKER_FILE "THIS_IS_GENERIC" #define SMALLBUF 64 #define MEDIUMBUF 256 #define LARGEBUF 1024 #define HUGEBUF 4096 #define GARGANTUABUF 16384 #define SUPPRESS_LEVEL 0 #define ALL_LEVEL 1 #define ALL_LEVEL_NAME "default" #define VERBOSE_LEVEL 2 #define VERBOSE_LEVEL_NAME "verbose" #define DEBUG_LEVEL 3 #define DEBUG_LEVEL_NAME "debug" #define SESSION_LEVEL 4 #define SESSION_LEVEL_NAME "sessions" #define PACKET_LEVEL 5 #define PACKET_LEVEL_NAME "packets" #define TESTING_LEVEL 6 #define TESTING_LEVEL_NAME "testing" /* sniffoke make use of two MTU values, one real an one fake the real one is used on netfd(network real interface), the fake one instead is used on tunfd(the tun interface) the difference in values of 80 bytes is keept due to space requirements for tcp+ip options injection (40bytes + 40bytes). In fact ip header len has a minimum value of 5(20bytes) and a max value of 15(60bytes) and so tcp data offset. So the difference between min and max is 8(40bytes). */ #define TUN_IF_NAME "sniffjoke" /* this has to be checked: ADSL has an MTU of 1492, but sometime will not be understand by local interface reading */ #define NET_IF_MTU 1492 #define TUN_IF_MTU_DIFF 80 #define PORTSNUMBER 65536 #define SCRAMBLE_TTL 1 #define SCRAMBLE_TTL_STR "PRESCRIPTION" #define SCRAMBLE_CHECKSUM 2 #define SCRAMBLE_CHECKSUM_STR "GUILTY" #define SCRAMBLE_MALFORMED 4 #define SCRAMBLE_MALFORMED_STR "MALFORMED" #define SCRAMBLE_INNOCENT 8 #define SCRAMBLE_INNOCENT_STR "INNOCENT" #define AGG_NONE 1 #define AGG_N_NONE "NONE" #define AGG_VERYRARE 2 #define AGG_N_VERYRARE "VERYRARE" #define AGG_RARE 4 #define AGG_N_RARE "RARE" #define AGG_COMMON 8 #define AGG_N_COMMON "COMMON" #define AGG_HEAVY 16 #define AGG_N_HEAVY "HEAVY" #define AGG_ALWAYS 32 #define AGG_N_ALWAYS "ALWAYS" #define AGG_PACKETS10PEEK 64 #define AGG_N_PACKETS10PEEK "PEEK10PKT" #define AGG_PACKETS30PEEK 128 #define AGG_N_PACKETS30PEEK "PEEK30PKT" #define AGG_TIMEBASED5S 256 #define AGG_N_TIMEBASED5S "EVERY5SECONDS" #define AGG_TIMEBASED20S 512 #define AGG_N_TIMEBASED20S "EVERY20SECONDS" #define AGG_STARTPEEK 1024 #define AGG_N_STARTPEEK "PEEKATSTART" #define AGG_LONGPEEK 2048 #define AGG_N_LONGPEEK "LONGPEEK" #define AGG_HANDSHAKE 4096 #define AGG_N_HANDSHAKE "HANDSHAKE" /* * these are the IP/TCP options supported in detection, injection, * corruption and so on. in the start of HDRoptions.cc this index are * used for fill the description structure */ #define SJ_IPOPT_NOOP 0 #define SJ_IPOPT_EOL 1 #define SJ_IPOPT_TIMESTAMP 2 #define SJ_IPOPT_TIMESTOVERFLOW 3 #define SJ_IPOPT_LSRR 4 #define SJ_IPOPT_RR 5 #define SJ_IPOPT_RA 6 #define SJ_IPOPT_CIPSO 7 #define SJ_IPOPT_SEC 8 #define SJ_IPOPT_SID 9 #define FIRST_IPOPT SJ_IPOPT_NOOP #define LAST_IPOPT SJ_IPOPT_SID #define SJ_TCPOPT_NOP LAST_IPOPT + 1 #define SJ_TCPOPT_EOL LAST_IPOPT + 2 #define SJ_TCPOPT_MD5SIG LAST_IPOPT + 3 #define SJ_TCPOPT_PAWSCORRUPT LAST_IPOPT + 4 #define SJ_TCPOPT_TIMESTAMP LAST_IPOPT + 5 #define SJ_TCPOPT_MSS LAST_IPOPT + 6 #define SJ_TCPOPT_SACK LAST_IPOPT + 7 #define SJ_TCPOPT_SACKPERM LAST_IPOPT + 8 #define SJ_TCPOPT_WINDOW LAST_IPOPT + 9 #define FIRST_TCPOPT SJ_TCPOPT_NOP #define LAST_TCPOPT SJ_TCPOPT_WINDOW /* the last code + 1 */ #define SUPPORTED_OPTIONS (LAST_TCPOPT + 1) #define NETIOBURSTSIZE 10 /* 10 CYCLES OF I/O (10 in + 10 out pkts max) */ #define SESSIONTRACKMAP_MANAGE_ROUTINE_TIMER 300 /* (5 MINUTES */ #define TTLFOCUSMAP_MANAGE_ROUTINE_TIMER 3600 /* (1 HOUR) */ #define SESSIONTRACK_EXPIRYTIME 200 /* access expire time in seconds (5 MINUTES) */ #define TTLFOCUS_EXPIRYTIME 604800 /* access expire time in seconds (1 WEEK) */ #define PLUGINHASH_EXPIRYTIME 10 /* hash expire time in seconds since creation (10 SECONDS)*/ #define PLUGINCACHE_EXPIRYTIME 200 /* access expire time in seconds (5 MINUTES) */ #define TTLFOCUSMAP_MEMORY_THRESHOLD 1024 /* 1024 DESTINATIONS */ #define SESSIONTRACKMAP_MEMORY_THRESHOLD 1024 /* 1024 TCP SESSIONS */ #define TTLPROBE_RETRY_ON_UNKNOWN 600 /* schedule time on UNKNOWN TTL status (10 MINUTES) */ /* enable the intensive debug: DEVELOPERS AND TESTER ONLY! */ #if 0 /* = create directories of log inside the running location */ #define HEAVY_SESSION_DEBUG /* checked in SessionTrack.cc */ #define HEAVY_PACKET_DEBUG /* checked in Packet.cc */ #define HEAVY_HDROPT_DEBUG /* checked in HDRoptions.cc */ #endif #endif /* SJ_DEFINES_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/internalProtocol.h0000644000000000000000000000637513147777044021222 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #ifndef SJ_INTERNALPROTOCOL_H #define SJ_INTERNALPROTOCOL_H #include #include #define START_COMMAND_TYPE 1 #define STOP_COMMAND_TYPE 2 #define QUIT_COMMAND_TYPE 3 #define SAVECONF_COMMAND_TYPE 4 #define STAT_COMMAND_TYPE 5 #define LOGLEVEL_COMMAND_TYPE 6 #define SETPORT_COMMAND_TYPE 7 #define SHOWPORT_COMMAND_TYPE 8 #define INFO_COMMAND_TYPE 9 #define TTLMAP_COMMAND_TYPE 10 #define COMMAND_ERROR_MSG 100 /* this contain the description of the entire block */ struct command_ret { uint32_t cmd_len; uint32_t cmd_type; /* follow in non error MSG the data dump */ }; /* this is the WHO value in SJStatus */ #define STAT_ACTIVE 1 #define STAT_DEBUGL 2 #define STAT_LOCAT 3 #define STAT_MACGW 4 #define STAT_GWADDR 5 #define STAT_NETIFACENAME 6 #define STAT_NETIFACEIP 7 #define STAT_NETIFACEMTU 8 #define STAT_TUNIFACENAME 9 #define STAT_TUNIFACEIP 10 #define STAT_TUNIFACEMTU 11 #define STAT_BINDA 12 #define STAT_BINDP 13 #define STAT_USER 14 #define STAT_GROUP 15 #define STAT_CHAINING 16 #define STAT_NO_TCP 17 #define STAT_NO_UDP 18 #define STAT_WHITELIST 19 #define STAT_BLACKLIST 20 #define STAT_ONLYP 21 /* and in SJStatus are used this struct for describe the single block */ struct single_block { uint32_t len; uint32_t WHO; }; /* WHO stay for: who do you choose between Yvonne Strahovski and * Scarlett Johansson for repopulate the Heart after the * nuclear fallout ? */ /* used for SJ_PortStat */ struct port_info { uint16_t start; uint16_t end; uint16_t weight; }; /* this struct is used for Info command handling, * it contains a single session record */ struct sex_record { uint8_t proto; uint32_t daddr; uint16_t sport; uint16_t dport; uint32_t packet_number; uint32_t injected_pktnumber; }; /* this struct used for ttlmap command handling */ struct ttl_record { time_t access; time_t nextprobe; uint32_t daddr; uint8_t sentprobe; uint8_t receivedprobe; uint8_t synackval; uint8_t ttlestimate; }; #endif /* SJ_INTERNALPROTOCOL_H */ sniffjoke-0.4.1+git20170825.1.434bfb1/src/service/main.cc0000644000000000000000000002073413147777044016741 0ustar00/* * SniffJoke is a software able to confuse the Internet traffic analysis, * developed with the aim to improve digital privacy in communications and * to show and test some securiy weakness in traffic analysis software. * * Copyright (C) 2011, 2010 vecna * evilaliv3 * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include "Utils.h" #include "UserConf.h" #include "SniffJoke.h" #include #include static auto_ptr sniffjoke; /* defined here, is needed by SniffJoke.cc */ void sigtrap(int signal) { sniffjoke->alive = false; } static void sj_version(const char *pname) { printf("%s %s\n", SW_NAME, SW_VERSION); } #define SNIFFJOKE_HELP_FORMAT \ "Usage: %s [OPTION]... :\n"\ " --location \tspecify the network environment (suggested) [default: %s]\n"\ " --dir \t\tspecify the base directory where the location reside [default: %s]\n"\ "\t\t\t[using both location and dir defaults, the configuration status will not be saved]\n"\ " --user \tdowngrade priviledge to the specified user [default: %s]\n"\ " --group \tdowngrade priviledge to the specified group [default: %s]\n"\ " --no-tcp\t\tdisable tcp mangling [default: %s]\n"\ " --no-udp\t\tdisable udp mangling [default: %s]\n"\ " --whitelist\t\tinject evasion packets only in the specified ip addresses\n"\ " --blacklist\t\tinject evasion packet in all session excluding the blacklisted ip address\n"\ " --start\t\tif present, evasion i'ts activated immediatly [default: %s]\n"\ " --chain\t\tenable chained hacking, powerful and entropic effects [default: %s]\n"\ " --debug \tset verbosity level [default: %d]\n"\ "\t\t\t%d: suppress log, %d: common, %d: verbose, %d: debug, %d: session %d: packets\n"\ " --foreground\t\trunning in foreground [default:background]\n"\ " --admin [:port]\tspecify administration IP address [default: %s:%d]\n"\ " --force\t\tforce restart (usable when another sniffjoke service is running)\n"\ " --gw-mac-addr\t\tspecify default gateway mac address [default: is autodetected]\n"\ " --version\t\tshow sniffjoke version\n"\ " --help\t\t\tshow this help\n\n"\ "\t\t\thttp://www.delirandom.net/sniffjoke\n" static void sj_help(const char *pname) { printf(SNIFFJOKE_HELP_FORMAT, pname, DEFAULT_LOCATION, WORK_DIR, DEFAULT_USER, DEFAULT_GROUP, DEFAULT_NO_TCP ? "tcp not mangled" : "tcp mangled", DEFAULT_NO_UDP ? "udp not mangled" : "udp mangled", DEFAULT_START_STOPPED ? "present" : "not present", DEFAULT_CHAINING ? "enabled" : "disabled", SUPPRESS_LEVEL, PACKET_LEVEL, DEFAULT_DEBUG_LEVEL, SUPPRESS_LEVEL, ALL_LEVEL, VERBOSE_LEVEL, DEBUG_LEVEL, SESSION_LEVEL, PACKET_LEVEL, DEFAULT_ADMIN_ADDRESS, DEFAULT_ADMIN_PORT ); } int main(int argc, char **argv) { if (getuid() || geteuid()) { printf("SniffJoke is too dangerous to be run by an humble user; go to fetch daddy root, now!\n"); exit(1); } /* * set the default values in the configuration struct */ struct sj_cmdline_opts useropt; memset(&useropt, 0x00, sizeof (useropt)); /* ordered initialization of all boolean/uint values to the default */ useropt.admin_port = DEFAULT_ADMIN_PORT; useropt.chaining = DEFAULT_CHAINING; useropt.no_tcp = DEFAULT_NO_TCP; useropt.no_udp = DEFAULT_NO_UDP; useropt.use_whitelist = DEFAULT_USE_WHITELIST; useropt.use_blacklist = DEFAULT_USE_BLACKLIST; useropt.active = DEFAULT_START_STOPPED; useropt.go_foreground = DEFAULT_GO_FOREGROUND; useropt.debug_level = DEFAULT_DEBUG_LEVEL; useropt.max_ttl_probe = DEFAULT_MAX_TTLPROBE; useropt.force_restart = false; /* * no explicit inizialization needed for string values; * all will be checked with string[0] != 0 */ struct option sj_option[] = { { "dir", required_argument, NULL, 'i'}, { "location", required_argument, NULL, 'o'}, { "user", required_argument, NULL, 'u'}, { "group", required_argument, NULL, 'g'}, { "admin", required_argument, NULL, 'a'}, { "chain", no_argument, NULL, 'c'}, { "no-tcp", no_argument, NULL, 't'}, { "no-udp", no_argument, NULL, 'l'}, { "whitelist", no_argument, NULL, 'w'}, { "blacklist", no_argument, NULL, 'b'}, { "start", no_argument, NULL, 's'}, { "foreground", no_argument, NULL, 'x'}, { "force", no_argument, NULL, 'r'}, { "debug", required_argument, NULL, 'd'}, { "only-plugin", required_argument, NULL, 'p'}, /* not documented in --help */ { "max-ttl-probe", required_argument, NULL, 'm'}, /* not documented too */ { "gw-mac-addr", required_argument, NULL, 'e'}, { "version", no_argument, NULL, 'v'}, { "help", no_argument, NULL, 'h'}, { NULL, 0, NULL, 0} }; int charopt; while ((charopt = getopt_long(argc, argv, "i:o:u:g:a:ctlwbsxrd:p:m:vh", sj_option, NULL)) != -1) { switch (charopt) { case 'i': snprintf(useropt.basedir, sizeof (useropt.basedir) - 1, "%s", optarg); if (useropt.basedir[strlen(useropt.basedir) - 1] != '/') useropt.basedir[strlen(useropt.basedir)] = '/'; break; case 'o': snprintf(useropt.location, sizeof (useropt.location), "%s", optarg); break; case 'u': snprintf(useropt.user, sizeof (useropt.user), "%s", optarg); break; case 'g': snprintf(useropt.group, sizeof (useropt.group), "%s", optarg); break; case 'a': snprintf(useropt.admin_address, sizeof (useropt.admin_address), "%s", optarg); char* port; if ((port = strchr(useropt.admin_address, ':')) != NULL) { *port = 0x00; int checked_port = atoi(++port); if (checked_port >= PORTSNUMBER || checked_port < 0) goto sniffjoke_help; useropt.admin_port = (uint16_t) checked_port; } break; case 'c': useropt.chaining = true; break; case 't': useropt.no_tcp = true; break; case 'l': useropt.no_udp = true; break; case 'w': useropt.use_whitelist = true; break; case 'b': useropt.use_blacklist = true; break; case 's': useropt.active = true; break; case 'x': useropt.go_foreground = true; break; case 'r': useropt.force_restart = true; break; case 'd': useropt.debug_level = atoi(optarg); if (useropt.debug_level > TESTING_LEVEL) goto sniffjoke_help; break; case 'p': snprintf(useropt.onlyplugin, sizeof (useropt.onlyplugin), "%s", optarg); break; case 'e': snprintf(useropt.gw_mac_str, sizeof (useropt.gw_mac_str), "%s", optarg); break; case 'm': useropt.max_ttl_probe = atoi(optarg); break; case 'v': sj_version(argv[0]); return 0; sniffjoke_help: case 'h': default: sj_help(argv[0]); return -1; argc -= optind; argv += optind; } } init_random(); try { sniffjoke = auto_ptr (new SniffJoke(useropt)); sniffjoke->run(); } catch (runtime_error &exception) { LOG_ALL("[runtime exception] going shutdown: %s", exception.what()); sniffjoke.reset(); return 0; } }