DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

Added source port and protocol to digest tracking

Browse Source 
Added the source port and protocol fields to valid SPA packets in the digest
cache.  This can help to discover replay trends.  The format of the digest
file cache is now:

<digest> <proto> <src_ip> <src_port> <dst_ip> <dst_port> <time>
This commit is contained in:
Michael Rash
2011-08-13 21:00:54 -04:00
parent 6982a72c07
commit 941a4aa9a3
4 changed files with 56 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/replay_cache.c
+34 -4
View File
@@ -277,7 +277,9 @@ replay_check_file_cache(fko_srv_options_t *opts, fko_ctx_t ctx)
{
char *digest = NULL;
char src_ip[INET_ADDRSTRLEN+1] = {0};
char orig_src_ip[INET_ADDRSTRLEN+1] = {0};
char dst_ip[INET_ADDRSTRLEN+1] = {0};
char created[18];
int res = 0, digest_len = 0;
FILE *digest_file_cache_ptr = NULL;
@@ -300,8 +302,27 @@ replay_check_file_cache(fko_srv_options_t *opts, fko_ctx_t ctx)
digest_list_ptr != NULL;
digest_list_ptr = digest_list_ptr->next) {
if (strncmp(digest_list_ptr->cache_info.digest, digest, digest_len) == 0) {
/* Convert the IPs to a human readable form
*/
inet_ntop(AF_INET, &(opts->spa_pkt.packet_src_ip),
src_ip, INET_ADDRSTRLEN);
inet_ntop(AF_INET, &(opts->spa_pkt.packet_src_ip),
orig_src_ip, INET_ADDRSTRLEN);
strftime(created, 18, "%D %H:%M:%S",
localtime(&(digest_list_ptr->cache_info.created)));
/* Detected a replay attack - bail
*/
log_msg(LOG_WARNING,
"Replay detected from source IP: %s\n"
" Original source IP: %s\n"
" Entry created: %s\n",
src_ip,
orig_src_ip,
created
);
return(SPA_MSG_REPLAY);
}
}
@@ -326,8 +347,11 @@ replay_check_file_cache(fko_srv_options_t *opts, fko_ctx_t ctx)
}
strlcpy(digest_elm->cache_info.digest, digest, digest_len+1);
digest_elm->cache_info.src_ip = opts->spa_pkt.packet_src_ip;
digest_elm->cache_info.dst_ip = opts->spa_pkt.packet_dst_ip;
digest_elm->cache_info.proto = opts->spa_pkt.packet_proto;
digest_elm->cache_info.src_ip = opts->spa_pkt.packet_src_ip;
digest_elm->cache_info.dst_ip = opts->spa_pkt.packet_dst_ip;
digest_elm->cache_info.src_port = opts->spa_pkt.packet_src_port;
digest_elm->cache_info.dst_port = opts->spa_pkt.packet_dst_port;
digest_elm->cache_info.created = time(NULL);
/* First, add the digest at the head of the in-memory list
@@ -348,8 +372,14 @@ replay_check_file_cache(fko_srv_options_t *opts, fko_ctx_t ctx)
src_ip, INET_ADDRSTRLEN);
inet_ntop(AF_INET, &(digest_elm->cache_info.dst_ip),
dst_ip, INET_ADDRSTRLEN);
fprintf(digest_file_cache_ptr, "%s %s %s %d\n",
digest, src_ip, dst_ip, (int) digest_elm->cache_info.created);
fprintf(digest_file_cache_ptr, "%s %d %s %d %s %d %d\n",
digest,
digest_elm->cache_info.proto,
src_ip,
(int) digest_elm->cache_info.src_port,
dst_ip,
digest_elm->cache_info.dst_port,
(int) digest_elm->cache_info.created);
fclose(digest_file_cache_ptr);