Initial commit - UDP corruption in IPv4 is functional.

.gitignore

@@ -0,0 +1,5 @@
+nfqueue_tamper
+*.o
+*.d
+*.log
+.vscode

LICENSE

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2021 Peter Farley <[email protected]>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Makefile

@@ -0,0 +1,33 @@
+MAINDIR	= .
+SRC		= $(MAINDIR)/src
+INC		= $(MAINDIR)/inc
+
+CXXSRC	= $(wildcard $(SRC)/*.cpp) $(wildcard $(SRC)/*/*.cpp)
+OBJ		= $(patsubst %.cpp,%.o,$(CXXSRC))
+DEPS    = $(patsubst %.cpp,%.d,$(CXXSRC))
+EXEC	= nfqueue_tamper
+
+CXXFLAGS	= -I$(INC) -Wall -Wextra -Werror -std=c++17 -O2 -g
+LDFLAGS		= -lboost_program_options -lnetfilter_queue
+
+ifeq ($(CXX), "clang++")
+  CXXFLAGS += -Weverything \
+              -Wno-c++98-compat
+endif
+
+.PHONY: all, clean
+all: $(EXEC)
+
+$(EXEC): $(OBJ)
+	@echo -e "\033[33m  \033[1mLD\033[21m    \033[34m$(EXEC)\033[0m"
+	@$(CXX) $(OBJ) $(LDFLAGS) -o $(EXEC)
+
+clean:
+	@echo -e "\033[33m  \033[1mCleaning $(EXEC)\033[0m"
+	@rm -f $(OBJ) $(EXEC)
+
+-include $(DEPS)
+
+%.o: %.cpp
+	@echo -e "\033[32m  \033[1mCXX\033[21m   \033[34m$<\033[0m"
+	@$(CXX) $(CXXFLAGS) -MMD -MP -c -o $@ $<

README.md

@@ -0,0 +1,53 @@
+NFQueue Tamper
+==============
+
+A tool to help in testing client/server robustness in the presence of malformed
+data.
+
+Building
+--------
+
+Requirements:
+ - `g++`/`clang++`
+ - `make`
+ - boost: https://www.boost.org/
+ - libnetfilter_queue: https://www.netfilter.org/projects/libnetfilter_queue/
+
+Build with `make`
+
+Usage
+-----
+
+    nfqueue_tamer -q <queue> -t "method1;opt1;opt2" -t "method2;opt1"
+
+Queue number defaults to 0. Must be run as root.
+
+To create a queue:
+
+    iptables -A <chain> [filter criteria] -j NFQUEUE --queue-num <queue>
+
+For example, to trap all outbound UDP traffic coming from port 63:
+
+    iptables -A OUTPUT -p udp --sport 63 -J NFQUEUE --queue-num 0
+
+Available methods and associated options:
+ - `rand` - Randomly tamper with data
+   - `off` - Offset, or offset range, at which to apply randomization
+     - Defaults to 0:-1 (0 - end)
+   - `con` - If offset is a range, whether or not modified bytes must be consecutive
+     - Defaults to 0 (non-consecutive allowed)
+     - NOT CURRENTLY SUPPORTED
+   - `sz`  - Number of bytes to modify, can be a range
+     - Defaults to 1
+
+Global options:
+ - `chance` - How likely the tamper method is to be used on a given packet
+   - Probability value between 0 and 1
+   - Defaults to 1
+
+Example:
+
+    nfqueue -q 0 -t "rand;chance=.5;off=0:4;sz=1:2"
+
+This will have a 50% chance on every packet of replacing one or two of the first
+five bytes in the payload (application-layer data) with a random value.

inc/NFQueue.hpp

@@ -0,0 +1,37 @@
+#ifndef _NFQUEUE_HPP_
+#define _NFQUEUE_HPP_
+
+#include <libnetfilter_queue/libnetfilter_queue.h>
+
+#include "PacketHandler.hpp"
+
+#define NFQUEUE_BUFF_SZ 4096
+
+class NFQueue {
+    private:
+        PacketHandler       &pHandler;
+
+        struct nfq_handle   *nfq_hand  = NULL;
+        struct nfq_q_handle *nfq_queue = NULL;
+        int                  _nfq_fd    = -1;
+
+        int queue;
+
+        uint8_t buff[NFQUEUE_BUFF_SZ];
+        uint8_t newPayload[NFQUEUE_BUFF_SZ];
+
+        static int handle_callback(struct nfq_q_handle *_queue, struct nfgenmsg *_nfmsg, struct nfq_data *_data, void *_class);
+
+    public:
+        NFQueue(int _queue, PacketHandler &_pHandler);
+
+        int callback(struct nfq_q_handle *_queue, struct nfgenmsg *_nfmsg, struct nfq_data *_data);
+
+        void open(void);
+
+        void run(void);
+
+        void close(void);
+};
+
+#endif /* _NFQUEUE_HPP_ */

inc/PacketHandler.hpp

@@ -0,0 +1,30 @@
+#ifndef _PACKET_HANDLER_HPP_
+#define _PACKET_HANDLER_HPP_
+
+#include <vector>
+#include <random>
+#include <netinet/ip.h>
+
+#include "TamperMethod.hpp"
+
+class PacketHandler {
+    private:
+        std::vector<TamperMethod *> meths;
+
+        std::random_device          rand_rd;
+        std::default_random_engine  rand_engine;
+
+        int handleTCPPacket(struct iphdr *_ip_head);
+        int handleUDPPacket(struct iphdr *_ip_head);
+
+        int doTamper(size_t len, uint8_t *data);
+
+    public:
+        PacketHandler();
+
+        void addTamperMethod(TamperMethod *_meth);
+
+        int handlePacket(size_t len, uint8_t *data);
+};
+
+#endif /* _PACKET_HANDLER_HPP_ */

inc/TamperMethod.hpp

@@ -0,0 +1,26 @@
+#ifndef _TAMPER_METHOD_HPP_
+#define _TAMPER_METHOD_HPP_
+
+#include <string>
+#include <map>
+
+class TamperMethod {
+    private:
+        double probability = 1; /*!< Probability between 0 and 1 that this tamper method will act on a given packet */
+
+    public:
+        TamperMethod(std::map<std::string, std::string> &_opts);
+
+        virtual int tamper(size_t len, uint8_t *data) = 0;
+
+        double getProbability(void);
+
+        static TamperMethod *create(std::string &_str);
+
+        static int parseRange(std::string &_str, int &_min, int &_max);
+        static int parseBool(std::string &_str, bool &_val);
+
+        static int randRange(int _min, int _max, int _sz);
+};
+
+#endif /* _TAMPER_METHOD_HPP_ */

inc/TamperMethods/TamperMethodRand.hpp

@@ -0,0 +1,27 @@
+#ifndef _TAMPER_METHOD_RAND_HPP_
+#define _TAMPER_METHOD_RAND_HPP_
+
+#include <random>
+
+#include "TamperMethod.hpp"
+
+class TamperMethodRand : public TamperMethod {
+    private:
+        int offset_min = 0;  /*!< Minimum offset */
+        int offset_max = -1; /*!< Maximum offset */
+
+        bool consecutive = false;
+
+        int size_min = 1;
+        int size_max = 1;
+
+        std::random_device         rand_rd;
+        std::default_random_engine rand_engine;
+
+    public:
+        TamperMethodRand(std::map<std::string, std::string> &_opts);
+
+        int tamper(size_t len, uint8_t *data);
+};
+
+#endif /* _TAMPER_METHOD_RAND_HPP_ */

src/NFQueue.cpp

@@ -0,0 +1,88 @@
+#include <iostream>
+#include <iomanip>
+#include <string.h>
+#include <netinet/in.h>
+#include <linux/netfilter.h>
+
+#include "NFQueue.hpp"
+
+int NFQueue::handle_callback(struct nfq_q_handle *_queue, struct nfgenmsg *_nfmsg, struct nfq_data *_data, void *_class) {
+    return reinterpret_cast<NFQueue *>(_class)->callback(_queue, _nfmsg, _data);
+}
+
+NFQueue::NFQueue(int _queue, PacketHandler &_pHandler) :
+pHandler(_pHandler) {
+    this->queue = _queue;
+}
+
+void NFQueue::open(void) {
+    this->nfq_hand = nfq_open();
+    if(this->nfq_hand == NULL) {
+        throw std::runtime_error("Could not open NFQ handle!");
+    }
+
+    if(nfq_unbind_pf(this->nfq_hand, AF_INET) < 0) {
+        throw std::runtime_error("nfq_unbind_pf");
+    }
+
+    if(nfq_bind_pf(this->nfq_hand, AF_INET) < 0) {
+        throw std::runtime_error("nfq_bind_pf");
+    }
+
+    this->nfq_queue = nfq_create_queue(this->nfq_hand, this->queue, NFQueue::handle_callback, this);
+    if(this->nfq_queue == NULL) {
+        throw std::runtime_error("nfq_create_queue");
+    }
+
+    if(nfq_set_mode(this->nfq_queue, NFQNL_COPY_PACKET, 0xFFFF) < 0) {
+        throw std::runtime_error("nfq_set_mode");
+    }
+
+    this->_nfq_fd = nfq_fd(this->nfq_hand);
+}
+
+void NFQueue::run(void) {
+    int len;
+    while((len = recv(this->_nfq_fd, this->buff, NFQUEUE_BUFF_SZ, 0))) {
+        nfq_handle_packet(this->nfq_hand, (char *)this->buff, len);
+    }
+}
+
+void NFQueue::close(void) {
+    if(nfq_destroy_queue(this->nfq_queue) < 0) {
+        throw std::runtime_error("nfq_destroy_queue");
+    }
+
+    if(nfq_close(this->nfq_hand) < 0) {
+        throw std::runtime_error("nfq_close");
+    }
+}
+
+
+int NFQueue::callback(struct nfq_q_handle *_queue, struct nfgenmsg *_nfmsg, struct nfq_data *_data) {
+    (void)_nfmsg;
+
+    uint32_t                     id;
+    struct nfqnl_msg_packet_hdr *head;
+    uint8_t                     *payload;
+    size_t                       payload_len;
+
+    std::cerr << "---------------------------" << std::endl;
+
+    head = nfq_get_msg_packet_hdr(_data);
+    id   = ntohl(head->packet_id);
+
+    /*std::cerr << "  Proto: " << std::hex << ntohs(head->hw_protocol) << std::dec;
+    std::cerr << ", hook: " << head->hook << ", id: " << head->packet_id << std::endl;*/
+
+    payload_len = nfq_get_payload(_data, &payload);
+
+    /*std::cerr << "  Payload size: " << payload_len << std::endl;*/
+    memcpy(this->newPayload, payload, payload_len);
+
+    this->pHandler.handlePacket(payload_len, payload);
+    /* TODO: Modify payload */
+
+    /* TODO: Accept dropping packets */
+    return nfq_set_verdict(_queue, id, NF_ACCEPT, payload_len, payload);
+}