1 /*
2 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
3 * All rights reserved.
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License as published by
20 * the Free Software Foundation; either version 2 of the License, or
21 * (at your option) any later version.
22 *
23 * This program is distributed in the hope that it will be useful,
24 * but WITHOUT ANY WARRANTY; without even the implied warranty of
25 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
26 * GNU General Public License for more details.
27 *
28 * You should have received a copy of the GNU General Public License
29 * along with this program; if not, write to the Free Software
30 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
31 */
32 /*
33 * Copyright 2003 Christian Kreibich <christian.kreibich@cl.cam.ac.uk>
34 * All rights reserved.
35 *
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
38 * are met:
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. The name of the author may not be used to endorse or promote products
45 * derived from this software without specific prior written permission.
46 *
47 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
48 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
49 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
50 * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
51 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
52 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
53 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
54 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
55 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
56 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
57 */
58
59 #include <sys/param.h>
60 #include <sys/types.h>
61
62 #ifdef HAVE_CONFIG_H
63 #include "config.h"
64 #endif
65
66 #include <sys/queue.h>
67
68 #include <stdio.h>
69 #include <stdlib.h>
70 #include <string.h>
71 #include <err.h>
72 #include <errno.h>
73 #include <unistd.h>
74 #include <dnet.h>
75
76 #include "hooks.h"
77
78 #define HD_HOOKS_TCP 0
79 #define HD_HOOKS_UDP 1
80 #define HD_HOOKS_ICMP 2
81 #define HD_HOOKS_OTHER 3
82 #define HD_HOOKS_LAST 4
83
84 /* Packet hooks are simply and only consist of a
85 * callback and pointers so that we can register them
86 * in tail queues.
87 */
88 struct honeyd_packet_hook
89 {
90 TAILQ_ENTRY(honeyd_packet_hook) next;
91
92 HD_PacketCallback callback;
93 void *user_data;
94 };
95
96 TAILQ_HEAD(hooksq, honeyd_packet_hook);
97
98 /*
99 * Arrays of hook tailqueues, each with HD_HOOKS_LAST elements,
100 * indexed using the HD_HOOKS_xxx constants:
101 */
102 struct hooksq *dir_hooks[HD_DIR_MAX];
103
104 void
hooks_init(void)105 hooks_init(void)
106 {
107 int i, j;
108
109 for (i = 0; i < HD_DIR_MAX; i++) {
110 dir_hooks[i] = malloc(HD_HOOKS_LAST * sizeof(struct hooksq));
111 if (dir_hooks[i] == NULL)
112 err(1, "%s: malloc", __func__);
113 }
114
115 for (i = 0; i < HD_HOOKS_LAST; i++)
116 for (j = 0; j < HD_DIR_MAX; j++)
117 TAILQ_INIT(&dir_hooks[j][i]);
118 }
119
120 void
hooks_add_packet_hook(int protocol,HD_Direction dir,HD_PacketCallback callback,void * user_data)121 hooks_add_packet_hook(int protocol, HD_Direction dir,
122 HD_PacketCallback callback,
123 void *user_data)
124 {
125 struct hooksq *hooks;
126 struct honeyd_packet_hook *hook;
127
128 if (!callback)
129 return;
130
131 if ( (hook = calloc(1, sizeof(struct honeyd_packet_hook))) == NULL)
132 return;
133
134 hook->callback = callback;
135 hook->user_data = user_data;
136
137 hooks = dir_hooks[dir];
138
139 switch (protocol) {
140 case IP_PROTO_TCP:
141 TAILQ_INSERT_HEAD(&hooks[HD_HOOKS_TCP], hook, next);
142 break;
143
144 case IP_PROTO_UDP:
145 TAILQ_INSERT_HEAD(&hooks[HD_HOOKS_UDP], hook, next);
146 break;
147
148 case IP_PROTO_ICMP:
149 TAILQ_INSERT_HEAD(&hooks[HD_HOOKS_ICMP], hook, next);
150 break;
151
152 default:
153 TAILQ_INSERT_HEAD(&hooks[HD_HOOKS_OTHER], hook, next);
154 }
155 }
156
157
158 static void
hooks_remove_impl(struct hooksq * hooks,HD_PacketCallback callback)159 hooks_remove_impl(struct hooksq *hooks, HD_PacketCallback callback)
160 {
161 struct honeyd_packet_hook *hook, *next;
162
163 for (hook = TAILQ_FIRST(hooks); hook; hook = next) {
164 next = TAILQ_NEXT(hook, next);
165
166 if (hook->callback == callback)
167 TAILQ_REMOVE(hooks, hook, next);
168 }
169 }
170
171
172 void
hooks_remove_packet_hook(int protocol,HD_Direction dir,HD_PacketCallback callback)173 hooks_remove_packet_hook(int protocol, HD_Direction dir,
174 HD_PacketCallback callback)
175 {
176 struct hooksq *hooks;
177
178 if (callback == NULL)
179 return;
180
181 hooks = dir_hooks[dir];
182
183 switch (protocol) {
184 case IP_PROTO_TCP:
185 hooks_remove_impl(&hooks[HD_HOOKS_TCP], callback);
186 break;
187
188 case IP_PROTO_UDP:
189 hooks_remove_impl(&hooks[HD_HOOKS_UDP], callback);
190 break;
191
192 case IP_PROTO_ICMP:
193 hooks_remove_impl(&hooks[HD_HOOKS_ICMP], callback);
194 break;
195
196 default:
197 hooks_remove_impl(&hooks[HD_HOOKS_OTHER], callback);
198 }
199 }
200
201
202 void
hooks_dispatch(int protocol,HD_Direction dir,struct tuple * conhdr,u_char * packet_data,u_int packet_len)203 hooks_dispatch(int protocol, HD_Direction dir, struct tuple *conhdr,
204 u_char *packet_data, u_int packet_len)
205 {
206 struct hooksq *hooks;
207 struct honeyd_packet_hook *hook;
208
209 if (packet_data == NULL)
210 return;
211
212 hooks = dir_hooks[dir];
213
214 switch (protocol) {
215 case IP_PROTO_TCP:
216 TAILQ_FOREACH(hook, &hooks[HD_HOOKS_TCP], next)
217 hook->callback(conhdr, packet_data, packet_len,
218 hook->user_data);
219 break;
220
221 case IP_PROTO_UDP:
222 TAILQ_FOREACH(hook, &hooks[HD_HOOKS_UDP], next)
223 hook->callback(conhdr, packet_data, packet_len,
224 hook->user_data);
225 break;
226
227 case IP_PROTO_ICMP:
228 TAILQ_FOREACH(hook, &hooks[HD_HOOKS_ICMP], next)
229 hook->callback(conhdr, packet_data, packet_len,
230 hook->user_data);
231 break;
232
233 default:
234 TAILQ_FOREACH(hook, &hooks[HD_HOOKS_OTHER], next)
235 hook->callback(conhdr, packet_data, packet_len,
236 hook->user_data);
237 }
238 }
239