-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Netfilter all kernels #577
Open
gcmoreira
wants to merge
7
commits into
volatilityfoundation:master
Choose a base branch
from
gcmoreira:netfilter_new_kernels
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Netfilter all kernels #577
gcmoreira
wants to merge
7
commits into
volatilityfoundation:master
from
gcmoreira:netfilter_new_kernels
Commits on Jan 3, 2019
-
Netfilter plugin improvements:
* Added LKM lookup, showing the kernel module name to which the hook belongs to. * If the module is part of the kernel text, it also resolves the symbol to that specific address. It is showed between square brackets, ie: [selinux_ipv4_forward] * All kernel exisiting protocols were added (unless until kernel v4.20). It now allows to identify for instance IPv6, ARP, BRIDGE (ebtables), etc. * Fixed wrong number of hooks and protos. Removed hardcoded sizes. * Added function to the Linux common API to find LKM module addresses, similar to the one in mac implementation but it also resolve kernel symbols.
Configuration menu - View commit details
-
Copy full SHA for 833d2ad - Browse repository at this point
Copy the full SHA 833d2adView commit details
Commits on Jan 7, 2019
-
Configuration menu - View commit details
-
Copy full SHA for 49d547c - Browse repository at this point
Copy the full SHA 49d547cView commit details
Commits on Jan 18, 2019
-
- Added support for every single Netfilter implementation in every single kernel version so far (v2.6ish to v5.0-rc2). - It gathers Netfilter hook information for all existing protocol families: IPV4, IPv6, ARP, BRIDGE, DECNET and INGRESS hooks. - Two new columns were added to the output report, the network namespace id and the module name or symbol name to which the hook address belongs to, allowing us to easily identify suspicious kernel modules using network hooks. - If a module is part of the kernel text, it also resolves the symbol to that specific address which is showed between square brackets, ie: [selinux_ipv4_forward] - Added function to the Linux common API to find LKM module addresses, similar to the one in mac implementation but it also resolve kernel symbols.
Configuration menu - View commit details
-
Copy full SHA for 607d25f - Browse repository at this point
Copy the full SHA 607d25fView commit details
Commits on Jan 21, 2019
-
Improved documentation and some design issues.
- Converted unnecesary class methods to instance methods. - Improved docstrings documentation for some of the class methods plus an explanation how the callbacks work.
Configuration menu - View commit details
-
Copy full SHA for b1a5ced - Browse repository at this point
Copy the full SHA b1a5cedView commit details -
- Removed hook_count from all the callbacks, it's only needed once an…
…d it could be calculated at that point using the protocol index. - Using the same argument name for "hook_container" in get_hook_ops method. It's reassigned to a more meanful variable name in every callback.
Configuration menu - View commit details
-
Copy full SHA for ca293c7 - Browse repository at this point
Copy the full SHA ca293c7View commit details -
Removing unnecessary array creation.
Instead, the specific pointer to nf_hook_entries is calculated.
Configuration menu - View commit details
-
Copy full SHA for 251f50f - Browse repository at this point
Copy the full SHA 251f50fView commit details -
Configuration menu - View commit details
-
Copy full SHA for 2a6c87a - Browse repository at this point
Copy the full SHA 2a6c87aView commit details
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.