Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Netfilter all kernels #577

Open
wants to merge 7 commits into
base: master
Choose a base branch
from

Commits on Jan 3, 2019

  1. Netfilter plugin improvements:

     * Added LKM lookup, showing the kernel module name to which the hook belongs to.
     * If the module is part of the kernel text, it also resolves the symbol to that specific address. It is showed between square brackets, ie: [selinux_ipv4_forward]
     * All kernel exisiting protocols were added (unless until kernel v4.20). It now allows to identify for instance IPv6, ARP, BRIDGE (ebtables), etc.
     * Fixed wrong number of hooks and protos. Removed hardcoded sizes.
     * Added function to the Linux common API to find LKM module addresses, similar to the one in mac implementation but it also resolve kernel symbols.
    gcmoreira committed Jan 3, 2019
    Configuration menu
    Copy the full SHA
    833d2ad View commit details
    Browse the repository at this point in the history

Commits on Jan 7, 2019

  1. Configuration menu
    Copy the full SHA
    49d547c View commit details
    Browse the repository at this point in the history

Commits on Jan 18, 2019

  1. Netfilter plugin improvements

    - Added support for every single Netfilter implementation in every single kernel version so far (v2.6ish to v5.0-rc2).
    - It gathers Netfilter hook information for all existing protocol families: IPV4, IPv6, ARP, BRIDGE, DECNET and INGRESS hooks.
    - Two new columns were added to the output report, the network namespace id and the module name or symbol name to which the hook address belongs to, allowing us to easily identify suspicious kernel modules using network hooks.
    - If a module is part of the kernel text, it also resolves the symbol to that specific address which is showed between square brackets, ie: [selinux_ipv4_forward]
    - Added function to the Linux common API to find LKM module addresses, similar to the one in mac implementation but it also resolve kernel symbols.
    gcmoreira committed Jan 18, 2019
    Configuration menu
    Copy the full SHA
    607d25f View commit details
    Browse the repository at this point in the history

Commits on Jan 21, 2019

  1. Improved documentation and some design issues.

        - Converted unnecesary class methods to instance methods.
        - Improved docstrings documentation for some of the class methods plus an explanation how the callbacks work.
    gcmoreira committed Jan 21, 2019
    Configuration menu
    Copy the full SHA
    b1a5ced View commit details
    Browse the repository at this point in the history
  2. - Removed hook_count from all the callbacks, it's only needed once an…

    …d it could be calculated at that point using the protocol index.
    
    - Using the same argument name for "hook_container" in get_hook_ops method. It's reassigned to a more meanful variable name in every callback.
    gcmoreira committed Jan 21, 2019
    Configuration menu
    Copy the full SHA
    ca293c7 View commit details
    Browse the repository at this point in the history
  3. Removing unnecessary array creation.

    Instead, the specific pointer to nf_hook_entries is calculated.
    gcmoreira committed Jan 21, 2019
    Configuration menu
    Copy the full SHA
    251f50f View commit details
    Browse the repository at this point in the history
  4. Configuration menu
    Copy the full SHA
    2a6c87a View commit details
    Browse the repository at this point in the history