def main(): args = sys.argv[1:] print args # Default to listening to all devices nids.param("device", 'any') nids.param("pcap_filter", ' '.join(args) + ' and tcp') # disable portscan detection nids.param("scan_num_hosts", 0) # disable check-summing nids.chksum_ctl([('0.0.0.0/0', False)]) nids.init() (uid, gid) = pwd.getpwnam(NOTROOT)[2:4] os.setgroups([gid, ]) os.setgid(gid) os.setuid(uid) if 0 in [os.getuid(), os.getgid()] + list(os.getgroups()): print "error - drop root, please!" sys.exit(1) nids.register_tcp(handle_tcp) while True: try: nids.next() except nids.error, e: print "nids/pcap error:", e
except Exception, e: self.complete = True chop.prnt("Error initting: ", e) return nids.chksum_ctl([('0.0.0.0/0',False),]) nids.register_tcp(handleTcpStreams) nids.register_udp(handleUdpDatagrams) while(True): #This overall while prevents exceptions from halting the long running reading if self.stopped: break try: if options.longrun: #long running don't stop until the proces is killed externally while not self.stopped: if not nids.next(): time.sleep(.001) else: while not self.stopped and nids.next(): pass self.stopped = True #Force it to true and exit except Exception, e: if not options.longrun: self.stopped = True #Force it to true and exit chop.prnt("Error processing packets", e) chop.prettyprnt("RED", "Shutting Down Modules ...") #Call modules shutdown functions to do last-minute actions for module in all_modules:
class ChopCore(Thread): def __init__(self, options, module_list, chp, chophelper): Thread.__init__(self) self.options = options self.module_list = module_list self.chophelper = chophelper self.stopped = False self.complete = False self.abort = False global chop chop = chp def stop(self): self.complete = True self.stopped = True def iscomplete(self): return self.complete def getptime(self): global ptimestamp return ptimestamp def getmeta(self): global metadata return metadata def prep_modules(self): self.chophelper.set_core(self) modules = self.module_list for module in modules: code = module.code code.chop = self.chophelper.setup_module(code.moduleName) def run(self): global chop #Initialize modules to be run options = self.options modules = self.module_list #module_list module_options = {} chop.prettyprnt("RED", "Initializing Modules ...") for module in modules: name = module.name arguments = module.arguments #shlex.split(module[1]) code = module.code #module[0] #Create module_data for all modules module.module_data = {'args': arguments} module.streaminfo = {} chop.prettyprnt("CYAN", "\tInitializing module '" + name + "'") try: module_options = code.init(module.module_data) except Exception, e: chop.prnt("Error Initializing Module", code.moduleName + ":", e) self.complete = True return if 'error' in module_options: chop.prettyprnt( "GREEN", "\t\t%s init failure: %s" % (code.moduleName, module_options['error'])) continue if module.legacy: if module_options['proto'] == 'tcp': tcp_modules.append(module) all_modules.append(module) module.streaminfo['tcp'] = {} elif module_options['proto'] == 'ip': ip_modules.append(module) all_modules.append(module) module.streaminfo['ip'] = {} elif module_options['proto'] == 'udp': udp_modules.append(module) all_modules.append(module) module.streaminfo['udp'] = {} else: chop.prnt("Undefined Module Type\n") self.complete = True return else: all_modules.append(module) #Proto is an array of dictionaries if not isinstance(module_options['proto'], list): #Malformed chop.prnt("%s has malformed proto list" % module.code.moduleName) self.complete = True return for proto in module_options['proto']: #Right now (4.0) each dictionary only has one key #This might change in the future but should be easy #since it's already a separate dictionary if type(proto) is not dict: chop.prnt("%s has malformed proto list" % module.code.moduleName) self.complete = True return for input in proto.keys(): if input not in module.inputs: module.inputs[input] = [] if proto[input] != '': module.inputs[input].append(proto[input]) module.outputs.append(proto[input]) #Initialize the streaminfo array by type if input != 'any' and input != 'ip': module.streaminfo[input] = {} if input == 'tcp': tcp_modules.append(module) elif input == 'udp': udp_modules.append(module) elif input == 'ip': ip_modules.append(module) elif input == 'any': #Special input that catches all non-core types #Initialize the streaminfo for all parents of the 'any' module if not len(module.parents): chop.prettyprnt( "GREEN", "WARNING: No Parent for %s to provide data" % (module.code.moduleName)) else: for parent in module.parents: for output in parent.outputs: module.streaminfo[output] = {} else: # non-core types, e.g., 'http' or 'dns' if len(module.parents ): #Make sure parents give it what it wants for parent in module.parents: if input not in parent.outputs: chop.prettyprnt( "GREEN", "WARNING: Parent to %s not providing %s data" % (module.code.moduleName, input)) else: chop.prettyprnt( "GREEN", "WARNING: No Parent for %s providing %s data" % (module.code.moduleName, input)) if not all_modules: chop.prnt("No modules") self.complete = True return chop.prettyprnt("RED", "Running Modules ...") #Actually run the modules if options['interface']: nids.param("scan_num_hosts", 0) nids.param("device", options['interface']) if options['bpf'] is not None: nids.param("pcap_filter", options['bpf']) try: nids.init() except Exception, e: chop.prnt("Error initting on interface: ", e) self.complete = True return nids.chksum_ctl([ ('0.0.0.0/0', False), ]) nids.register_tcp(handleTcpStreams) nids.register_udp(handleUdpDatagrams) nids.register_ip(handleIpPackets) while ( True ): #This overall while prevents exceptions from halting the processing of packets if self.stopped: break try: while not self.stopped: nids.next() time.sleep(.001) #XXX is this enough or too much? except Exception, e: chop.prnt("Error processing packets", e)
nids.chksum_ctl([ ('0.0.0.0/0', False), ]) nids.register_tcp(handleTcpStreams) nids.register_udp(handleUdpDatagrams) nids.register_ip(handleIpPackets) while ( not self.stopped ): #This overall while prevents exceptions from halting the long running reading try: if options[ 'longrun']: #long running don't stop until the proces is killed externally while not self.stopped: if not nids.next(): if self.abort: #exit if sigabrt if no other data break time.sleep(.001) else: while not self.stopped and nids.next(): pass self.stopped = True #Force it to true and exit except Exception, e: chop.prnt("Error processing packets", e) if not options['longrun']: self.stopped = True #Force it to true and exit raise # only raise if not in longrun chop.prettyprnt("RED", "Shutting Down Modules ...")
class ChopCore(Thread): def __init__(self,options, module_list, chp, chophelper): Thread.__init__(self) self.options = options self.module_list = module_list self.chophelper = chophelper self.stopped = False self.complete = False global chop chop = chp def stop(self): self.complete = True self.stopped = True def iscomplete(self): return self.complete def getptime(self): global ptimestamp return ptimestamp def getmeta(self): global metadata return metadata def prep_modules(self): self.chophelper.set_core(self) modules = self.module_list for module in modules: module = module[0] module.chop = self.chophelper.setup_module(module.moduleName) def run(self): global chop #Initialize modules to be run options = self.options modules = self.module_list#module_list module_options = {} chop.prettyprnt("RED", "Initializing Modules ...") for module in modules: name = module[2] arguments = shlex.split(module[1]) module = module[0] #Create module_data for all modules module.module_data = {'args':arguments} module.streaminfo = {} chop.prettyprnt("CYAN", "\tInitializing module '" + name + "'") try: module_options = module.init(module.module_data) except Exception, e: chop.prnt("Error Initializing Module", module.moduleName + ":", e) self.complete = True return if 'error' in module_options: chop.prettyprnt("GREEN", "\t\t%s init failure: %s" % (module.moduleName, module_options['error'])) continue if module_options['proto'] == 'tcp' : tcp_modules.append(module) all_modules.append(module) elif module_options['proto'] == 'ip' : ip_modules.append(module) all_modules.append(module) elif module_options['proto'] == 'udp' : udp_modules.append(module) all_modules.append(module) else: chop.prnt("Undefined Module Type\n") self.complete = True return if not all_modules: chop.prnt("No modules") self.complete = True return chop.prettyprnt("RED", "Running Modules ...") #Actually run the modules if options['interface']: nids.param("scan_num_hosts",0) nids.param("device",options['interface']) if options['bpf'] is not None: nids.param("pcap_filter", options['bpf']) try: nids.init() except Exception, e: chop.prnt("Error initting: ", e) self.complete = True return nids.chksum_ctl([('0.0.0.0/0',False),]) nids.register_tcp(handleTcpStreams) nids.register_udp(handleUdpDatagrams) while(True): #This overall while prevents exceptions from halting the processing of packets if self.stopped: break try: while not self.stopped: nids.next() time.sleep(.001) #XXX is this enough or too much? except Exception, e: chop.prnt("Error processing packets", e)
nids.param("filename", fn) nids.param("scan_num_hosts", 0) # disable portscan detection nids.param("tcp_workarounds", 1) if filt: nids.param("pcap_filter", filt) try: nids.init() except nids.error, e: print "initialization error", e sys.exit(1) nids.register_tcp(handleTcp) for ii in xrange(0, niters): try: rc = nids.next() if rc == 0: print "nids next returned 0" except KeyboardInterrupt: break print "ldapmsgcount =", ldapmsgcount print "skipped =", skipcount print "count =", count print "pending =", pending print "euids =", euids print "opcount =", printcounts() # scapy stuff # pkts = PcapReader(fn) # for pkt in pkts: