pyscanlogger.py

#!/usr/bin/env python
"""
pyscanlogger: Simple port scan detector/logger tool, inspired
by scanlogd {http://www.openwall.com/scanlogd}


"""

# import threading
import optparse
import os
import socket
import struct
import sys
import time
import dpkt
import pcap

# UDP - in progress...

SCAN_TIMEOUT = 5
WEIGHT_THRESHOLD = 25
PIDFILE = "/var/run/pyscanlogger.pid"

# TCP flag constants
TH_URG = dpkt.tcp.TH_URG
TH_ACK = dpkt.tcp.TH_ACK
TH_PSH = dpkt.tcp.TH_PUSH
TH_RST = dpkt.tcp.TH_RST
TH_SYN = dpkt.tcp.TH_SYN
TH_FIN = dpkt.tcp.TH_FIN

# Protocols
TCP = dpkt.tcp.TCP
UDP = dpkt.udp.UDP

get_timestamp = lambda: time.strftime('%Y-%m-%d %H:%M:%S', time.localtime())


class ScanEntry(object):
    """ Port scan entry """

    def __init__(self, hash):
        self.src = 0
        self.dst = 0
        self.timestamp = 0
        self.logged = False
        self.type = ''
        self.tcpflags_or = 0
        self.weight = 0
        self.ports = []
        self.next = None
        self.hash = hash


class EntryLog(dict):
    """ Modified dictionary class with fixed size, which
    automatically removes oldest items """

    # This will work only if the value is an object storing
    # its key in the 'hash' attribute and links to other
    # objects using the 'next' attribute.
    def __init__(self, maxsz):
        self.oldest = None
        self.last = None
        self.maxsz = maxsz
        super(EntryLog, self).__init__()

    def __setitem__(self, key, value):
        if not self.__contains__(key) and len(self) == self.maxsz:
            # Remove oldest
            if self.oldest:
                self.__delitem__(self.oldest.hash)
                self.oldest = self.oldest.next

        super(EntryLog, self).__setitem__(key, value)

        if self.last:
            self.last.next = value
            self.last = value
        else:
            self.last = value
            self.oldest = self.last


class TimerList(list):
    """ List class of fixed size with entries that time out automatically """

    def __getattribute__(self, name):
        if name in ('insert', 'pop', 'extend'):
            raise NotImplementedError
        else:
            return super(TimerList, self).__getattribute__(name)

    def __init__(self, maxsz, ttl):
        # Maximum size
        self.maxsz = maxsz
        # Time to live for every entry
        self.ttl = ttl

    def append(self, item):
        """ Append an item to end """

        if len(self) < self.maxsz:
            # We append the time-stamp with the item
            super(TimerList, self).append((time.time(), item))
        else:
            n = self.collect()
            if n:
                # Some items removed, so append
                super(TimerList, self).append((time.time(), item))
            else:
                raise ValueError, 'could not append item'

    def collect(self):
        """ Collect and remove aged items """

        t = time.time()
        old = []
        for item in self:
            if (t - item[0]) > self.ttl:
                old.append(item)

        for item in old:
            self.remove(item)

        return len(old)

    # Access functions
    def __getitem__(self, index):
        item = super(TimerList, self).__getitem__(index)
        return item[1]

    def __setitem__(self, index, item):
        # Allow only tuples with time-stamps >= current time-stamp as 1st member
        if type(item) == tuple and len(item) == 2 and type(item[0]) == float and item[0] >= time.time():
            super(TimerList, self).__setitem__(index, item)
        else:
            raise TypeError, 'invalid entry'

    def __contains__(self, item):

        items = [rest for (tstamp, rest) in self]
        return item in items


class ScanLogger(object):
    """ Port scan detector/logger """

    # TCP flags to scan type mapping
    scan_types = {0: 'TCP null',
                  TH_FIN: 'TCP fin',
                  TH_SYN: 'TCP syn',
                  TH_SYN | TH_RST: 'TCP syn',
                  TH_ACK: 'TCP ack',
                  TH_URG | TH_PSH | TH_FIN: 'TCP x-mas',
                  TH_URG | TH_PSH | TH_FIN | TH_ACK: 'TCP x-mas',
                  TH_SYN | TH_FIN: 'TCP syn/fin',
                  TH_FIN | TH_ACK: 'TCP fin/ack',
                  TH_SYN | TH_ACK | TH_RST: 'TCP full-connect',
                  TH_URG | TH_PSH | TH_ACK | TH_RST | TH_SYN | TH_FIN: 'TCP all-flags'}

    def __init__(self, timeout, threshold, maxsize, daemon=True, logfile='/var/log/scanlog'):
        self.scans = EntryLog(maxsize)
        # Port scan weight threshold
        self.threshold = threshold
        # Timeout for scan entries
        self.timeout = timeout
        # Daemonize ?
        self.daemon = daemon
        # Log file
        try:
            self.scanlog = open(logfile, 'a')
        except (IOError, OSError), (errno, strerror):
            print "Error opening scan log file %s => %s" % (logfile, strerror)
            self.scanlog = None

        # Recent scans - this list allows to keep scan information
        # upto last 'n' seconds, so as to not call duplicate scans
        # in the same time-period. 'n' is 60 sec by default.

        # Since entries time out in 60 seconds, max size is equal
        # to maximum such entries possible in 60 sec - assuming
        # a scan occurs at most every 5 seconds, this would be 12.
        self.recent_scans = TimerList(12, 60.0)

    def hash_func(self, addr):
        """ Hash a host address """

        value = addr
        h = 0

        while value:
            # print value
            h ^= value
            value = value >> 9

        return h & (8192 - 1)

    def host_hash(self, src, dst):
        """ Hash mix two host addresses """

        return self.hash_func(src) ^ self.hash_func(dst)

    def log_scan(self, scan, continuation=False):
        """ Log the scan to file and/or console """

        srcip, dstip = socket.inet_ntoa(struct.pack('I', scan.src)), socket.inet_ntoa(struct.pack('I', scan.dst))
        ports = ','.join([str(port) for port in scan.ports])

        if not continuation:
            line = '[%s]: %s scan (flags:%d) from %s to %s (ports:%s)' % (get_timestamp(),
                                                                          scan.type,
                                                                          scan.tcpflags_or,
                                                                          srcip,
                                                                          dstip,
                                                                          ports)
        else:
            line = '[%s]: Continuation of %s scan from %s to %s (ports:%s)' % (get_timestamp(),
                                                                               scan.type,
                                                                               srcip,
                                                                               dstip,
                                                                               ports)

        if self.scanlog:
            self.scanlog.write(line + '\n')
            self.scanlog.flush()

        if not self.daemon:
            print line

    def process(self, pkt):

        if not hasattr(pkt, 'ip'):
            return

        ip = pkt.ip
        # Ignore non-tcp, non-udp packets
        if type(ip.data) not in (TCP, UDP):
            return

        pload = ip.data
        src, dst, dport, flags = int(struct.unpack('I', ip.src)[0]), int(struct.unpack('I', ip.dst)[0]), int(
            pload.dport), 0
        proto = type(pload)

        if proto == TCP: flags = pload.flags
        key = self.host_hash(src, dst)

        curr = time.time()

        # Keep dropping old entries
        self.recent_scans.collect()

        if key in self.scans:
            scan = self.scans[key]

            if scan.src != src:
                # Skip packets in reverse direction or invalid protocol
                return

            # Update only if not too old, else skip and remove entry
            if curr - scan.timestamp > self.timeout:
                del self.scans[key]
                return

            if scan.logged: return

            # Update TCP flags if existing port
            if dport in scan.ports:
                # Same port, update flags
                scan.tcpflags_or |= flags
                return

            scan.timestamp = curr
            scan.tcpflags_or |= flags
            scan.ports.append(dport)

            # Add weight for port
            if dport < 1024:
                scan.weight += 3
            else:
                scan.weight += 1

            if scan.weight >= self.threshold:
                scan.logged = True
                if proto == TCP:
                    scan.type = self.scan_types.get(scan.tcpflags_or, 'unknown')
                elif proto == UDP:
                    scan.type = 'UDP'
                    # Reset flags for UDP scan
                    scan.tcpflags_or = 0

                # See if this was logged recently
                scanentry = (key, scan.type, scan.tcpflags_or)

                if scanentry not in self.recent_scans:
                    self.log_scan(scan)
                    self.recent_scans.append(scanentry)
                else:
                    self.log_scan(scan, True)

        else:
            # Add new entry
            scan = ScanEntry(key)
            scan.src = src
            scan.dst = dst
            scan.timestamp = curr
            scan.tcpflags_or |= flags
            scan.ports.append(dport)
            self.scans[key] = scan

    def log(self):

        pc = pcap.pcap()
        decode = {pcap.DLT_LOOP: dpkt.loopback.Loopback,
                  pcap.DLT_NULL: dpkt.loopback.Loopback,
                  pcap.DLT_EN10MB: dpkt.ethernet.Ethernet}[pc.datalink()]

        # try:
        print 'listening on %s: %s' % (pc.name, pc.filter)
        for ts, pkt in pc:
            self.process(decode(pkt))
        # except KeyboardInterrupt:
        # if not self.daemon:
        # nrecv, ndrop, nifdrop = pc.stats()
        # print '\n%d packets received by filter' % nrecv
        # print '%d packets dropped by kernel' % ndrop

    def run_daemon(self):
        # Disconnect from tty
        try:
            pid = os.fork()
            if pid > 0:
                sys.exit(0)
        except OSError, e:
            print >> sys.stderr, "fork #1 failed", e
            sys.exit(1)

        os.setsid()
        os.umask(0)

        # Second fork
        try:
            pid = os.fork()
            if pid > 0:
                open(PIDFILE, 'w').write(str(pid))
                sys.exit(0)
        except OSError, e:
            print >> sys.stderr, "fork #2 failed", e
            sys.exit(1)

        self.log()

    def run(self):
        # If dameon, then create a new thread and wait for it
        if self.daemon:
            print 'Daemonizing...'
            self.run_daemon()
        else:
            # Run in foreground
            self.log()


def main():
    if os.geteuid() != 0:
        sys.exit("You must be super-user to run this program")

    o = optparse.OptionParser()
    o.add_option("-d", "--daemonize", dest="daemon", help="Daemonize",
                 action="store_true", default=False)
    o.add_option("-f", "--logfile", dest="logfile", help="File to save logs to",
                 default="/var/log/scanlog")

    options, args = o.parse_args()
    s = ScanLogger(SCAN_TIMEOUT, WEIGHT_THRESHOLD, 8192, options.daemon, options.logfile)
    s.run()


if __name__ == '__main__':
    try:
        while True:
            try:
                main()
            except TypeError:
                time.sleep(0.25)
                print "Continue to start the Pyscanlogger"
                continue
    except KeyboardInterrupt:
        print "Stop the Pyscanlogger!"