diff --git a/proxy/main.go b/proxy/main.go index f1d77bd..323efe7 100644 --- a/proxy/main.go +++ b/proxy/main.go @@ -77,6 +77,8 @@ func main() { log.SetFormatter(&log.TextFormatter{ DisableTimestamp: true, }) + log.Info("Using replacement hostname " + UId) + log.Info("Using generated MAC " + NewMAC.String()) if *logFile != "" { if f, err := os.OpenFile(*logFile, os.O_WRONLY|os.O_CREATE, 0755); err != nil { log.Error("Error opening logFile ", *logFile) @@ -153,7 +155,8 @@ func pipeForward(prefix string) { // Handle Ethernet frame log.Debug("Start packet") frame := packet.Layer(layers.LayerTypeEthernet).(*layers.Ethernet) - filterMAC(prefix, &frame.DstMAC, &frame.SrcMAC, frame.LayerType()) + filterMAC(prefix, &frame.SrcMAC, "src", frame.LayerType()) + filterMAC(prefix, &frame.DstMAC, "dst", frame.LayerType()) // Handle IPv4 packet if ipv4layer := packet.Layer(layers.LayerTypeIPv4); ipv4layer != nil { @@ -166,7 +169,8 @@ func pipeForward(prefix string) { continue } - filterIP(prefix, &ipv4Packet.DstIP, &ipv4Packet.SrcIP, ipv4Packet.LayerType()) + filterIP(prefix, &ipv4Packet.SrcIP, "src", ipv4Packet.LayerType()) + filterIP(prefix, &ipv4Packet.DstIP, "dst", ipv4Packet.LayerType()) // Handle ICMP packet (based on IPv4) if icmpLayer := packet.Layer(layers.LayerTypeICMPv4); icmpLayer != nil { @@ -191,7 +195,7 @@ func pipeForward(prefix string) { if (udpPacket.SrcPort == 137 && udpPacket.DstPort == 137) || // NBNS (udpPacket.SrcPort == 138 && udpPacket.DstPort == 138) { // NBDS - log.Info(prefix, "Filtering NBNS/NBDS payload") + log.Debug(prefix, "Filtering NBNS/NBDS payload") filterPayload(prefix, &udpPacket.Payload) } } @@ -199,7 +203,7 @@ func pipeForward(prefix string) { // Drop IPv6 packets if ipv6layer := packet.Layer(layers.LayerTypeIPv6); ipv6layer != nil { - log.Info(prefix, "IPv6 packet dropped") + log.Debug(prefix, "IPv6 packet dropped") continue } @@ -207,8 +211,10 @@ func pipeForward(prefix string) { if frame.EthernetType == layers.EthernetTypeARP { arpPacket := packet.Layer(layers.LayerTypeARP).(*layers.ARP) log.Debug(prefix, "ARP Type ", arpPacket.Operation) - filterIP(prefix, &arpPacket.DstProtAddress, &arpPacket.SourceProtAddress, arpPacket.LayerType()) - filterMAC(prefix, &arpPacket.DstHwAddress, &arpPacket.SourceHwAddress, arpPacket.LayerType()) + filterIP(prefix, &arpPacket.SourceProtAddress, "src", arpPacket.LayerType()) + filterIP(prefix, &arpPacket.DstProtAddress, "dst", arpPacket.LayerType()) + filterMAC(prefix, &arpPacket.SourceHwAddress, "src", arpPacket.LayerType()) + filterMAC(prefix, &arpPacket.DstHwAddress, "dst", arpPacket.LayerType()) } log.Debug("End packet") @@ -263,30 +269,15 @@ func filterPayload(prefix string, payload *[]byte) { } // filterIP checks whether an IP target selected from src and dst equals a given value. If yes, it is changed -func filterIP(prefix string, dst interface{}, src interface{}, context gopacket.LayerType) { - var target interface{} - var condVal net.IP - var newVal net.IP - var which string - if prefix == In { - target = dst - which = "dst" - condVal = NewIP - newVal = OldIP - } else if prefix == Out { - target = src - which = "src" - condVal = OldIP - newVal = NewIP - } - ip, isIp := target.(*net.IP) - bs, isBs := target.(*[]byte) +func filterIP(prefix string, addr interface{}, which string, context gopacket.LayerType) { + ip, isIp := addr.(*net.IP) + bs, isBs := addr.(*[]byte) // If no OldIP is set yet, get it from outgoing src field if OldIP == nil { - if prefix == In { + if prefix == In || which == "dst" { return - } else if prefix == Out { + } else if prefix == Out && which == "src" { if isIp { if !ip.IsGlobalUnicast() { return @@ -296,57 +287,50 @@ func filterIP(prefix string, dst interface{}, src interface{}, context gopacket. OldIP = *bs } log.Info("OldIP set to ", OldIP) - condVal = OldIP } } - if isIp && bytes.Equal(*ip, condVal) { - *ip = newVal - log.Debugf("%s%s %s IP %s changed to %s", prefix, context, which, condVal, newVal) - } - if isBs && bytes.Equal(*bs, condVal) { - *bs = newVal - log.Debugf("%s%s %s IP %s changed to %s", prefix, context, which, condVal, newVal) + if isIp && bytes.Equal(*ip, OldIP) { + *ip = NewIP + log.Debugf("%s%s %s IP %s changed to %s", prefix, context, which, OldIP, NewIP) + } else if isBs && bytes.Equal(*bs, OldIP) { + *bs = NewIP + log.Debugf("%s%s %s IP %s changed to %s", prefix, context, which, OldIP, NewIP) + } else if isIp && bytes.Equal(*ip, NewIP) { + *ip = OldIP + log.Debugf("%s%s %s IP %s changed to %s", prefix, context, which, NewIP, OldIP) + } else if isBs && bytes.Equal(*bs, NewIP) { + *bs = OldIP + log.Debugf("%s%s %s IP %s changed to %s", prefix, context, which, NewIP, OldIP) } } // filterMAC checks whether a MAC target selected from src and dst equals a given value. If yes, it is changed -func filterMAC(prefix string, dst interface{}, src interface{}, context gopacket.LayerType) { +func filterMAC(prefix string, addr interface{}, which string, context gopacket.LayerType) { // If no OldMAC is set yet, get it from outgoing src field // Has to be HardwareAddr because this is used for ethernet frames which call this method first if OldMAC == nil { - if prefix == In { + if prefix == In || which == "dst" { return - } else if prefix == Out { - OldMAC = *src.(*net.HardwareAddr) + } else if prefix == Out && which == "src" { + OldMAC = *addr.(*net.HardwareAddr) log.Info("OldMAC set to ", OldMAC) } } - - var target interface{} - var condVal net.HardwareAddr - var newVal net.HardwareAddr - var which string - if prefix == In { - target = dst - which = "dst" - condVal = NewMAC - newVal = OldMAC - } else if prefix == Out { - target = src - which = "src" - condVal = OldMAC - newVal = NewMAC - } - mac, isMac := target.(*net.HardwareAddr) - bs, isBs := target.(*[]byte) - if isMac && bytes.Equal(*mac, condVal) { - *mac = newVal - log.Debugf("%s%s %s MAC %s changed to %s", prefix, context, which, condVal, newVal) - } - if isBs && bytes.Equal(*bs, condVal) { - *bs = newVal - log.Debugf("%s%s %s MAC %s changed to %s", prefix, context, which, condVal, newVal) + mac, isMac := addr.(*net.HardwareAddr) + bs, isBs := addr.(*[]byte) + if isMac && bytes.Equal(*mac, NewMAC) { + *mac = OldMAC + log.Debugf("%s%s %s MAC %s changed to %s", prefix, context, which, NewMAC, OldMAC) + } else if isBs && bytes.Equal(*bs, NewMAC) { + *bs = OldMAC + log.Debugf("%s%s %s MAC %s changed to %s", prefix, context, which, NewMAC, OldMAC) + } else if isMac && bytes.Equal(*mac, OldMAC) { + *mac = NewMAC + log.Debugf("%s%s %s MAC %s changed to %s", prefix, context, which, OldMAC, NewMAC) + } else if isBs && bytes.Equal(*bs, OldMAC) { + *bs = NewMAC + log.Debugf("%s%s %s MAC %s changed to %s", prefix, context, which, OldMAC, NewMAC) } } diff --git a/test-env/envctl b/test-env/envctl index af3c495..2378696 100755 --- a/test-env/envctl +++ b/test-env/envctl @@ -14,7 +14,8 @@ alpine2="$RUN/vm_alpine_2.pid" win="$RUN/vm_win_*.pid" win1="$RUN/vm_win_1.pid" win2="$RUN/vm_win_2.pid" -kali="$RUN/vm_kali.pid" +kali1="$RUN/vm_kali1.pid" +kali2="$RUN/vm_kali2.pid" proxy2="$RUN/proxy_2.pid" proxy3="$RUN/proxy_3.pid" proxies="$RUN/proxy_*.pid" @@ -35,22 +36,31 @@ start) alpine1 | alpine) $qemu -m 512 -nic vde,mac='52:54:00:12:34:56',sock=$RUN/sw_proxy1.sock -hda alpine1.qcow2 -daemonize -vnc :1 -pidfile $alpine1 ;;& - alpine2 | alpine) + alpine1b | alpine) + $qemu -m 512 -nic vde,mac='52:54:00:12:34:56',sock=$RUN/sw_proxy2.sock -hda alpine1b.qcow2 -daemonize -vnc :12 -pidfile $alpine2 + ;;& + alpine2 ) $qemu -m 512 -nic vde,mac='52:54:00:12:34:66',sock=$RUN/sw_proxy2.sock -hda alpine2.qcow2 -daemonize -vnc :2 -pidfile $alpine2 ;;& - win1 | win | vms | all) + win1 | win | vms ) $qemu -vga cirrus -smp 1 -net nic,model=rtl8139 -net vde,sock=$RUN/sw_proxy1.sock -soundhw sb16 -m 128 -usb -usbdevice tablet -drive file=images/win98.raw,format=raw,index=0,media=disk -cdrom images/Win98SE.iso -daemonize -vnc :1 -pidfile $win1 ;;& - win2 | win | vms | all) + win0 | win | vms ) + $qemu -vga cirrus -smp 1 -net nic,model=rtl8139,macaddr='52:54:00:12:34:66' -net vde,sock=$RUN/sw_proxy1.sock -soundhw sb16 -m 128 -usb -usbdevice tablet -drive file=images/win98-0.raw,format=raw,index=0,media=disk -cdrom images/Win98SE.iso -daemonize -vnc :1 -pidfile $win1 + ;;& + win2 | win | vms ) $qemu -vga cirrus -smp 1 -net nic,model=rtl8139,macaddr='52:54:00:12:34:66' -net vde,sock=$RUN/sw_proxy2.sock -soundhw sb16 -m 128 -usb -usbdevice tablet -drive file=images/win98-2.raw,format=raw,index=0,media=disk -cdrom images/Win98SE.iso -daemonize -vnc :2 -pidfile $win2 ;;& - kali | vms | all) - $qemu -m 1024 -nic user -nic vde,mac='52:54:00:12:34:76',sock=$RUN/sw_proxy3.sock -hda kali.qcow2 -daemonize -vnc :3 -pidfile $kali + kali1 | kalis | vms | all) + $qemu -m 1024 -nic user -nic vde,mac='52:54:00:12:34:76',sock=$RUN/sw_proxy1.sock -hda kali1.qcow2 -daemonize -vnc :1 -pidfile $kali1 + ;;& + kali2 | kalis | vms | all) + $qemu -m 1024 -nic user -nic vde,mac='52:54:00:12:34:76',sock=$RUN/sw_proxy2.sock -hda kali2.qcow2 -daemonize -vnc :2 -pidfile $kali2 ;;& proxy2 | proxies | all) $proxy -sproxy $RUN/sw_proxy2.sock -passthrough -logfile $RUN/proxy_2.log -pidfile $proxy2 & ;;& - proxy3 | proxies | all) + proxy3 | proxies ) $proxy -sproxy $RUN/sw_proxy3.sock -passthrough -logfile $RUN/proxy_3.log -pidfile $proxy3 & ;; *)