diff --git a/dionaea/log_wardenfiler.py b/dionaea/log_wardenfiler.py index da70d1d23c7768390c8e5606960322c90bdd959a..bd60dd3cc8580866e2a5ec435c845475e6f0078f 100644 --- a/dionaea/log_wardenfiler.py +++ b/dionaea/log_wardenfiler.py @@ -128,6 +128,10 @@ class LogWardenfilerHandler(ihandler): self.nat_host = self._config.get('nat_host') if 'nat_port' in self._config: self.nat_port = self._config.get('nat_port') + if 'reported_ipv4' in self._config: + self.reported_ipv4 = self._config.get('reported_ipv4') + if 'reported_ipv6' in self._config: + self.reported_ipv6 = self._config.get('reported_ipv6') if 'anon_mask_4' in self._config: self.anon_mask_4 = self._config.get('anon_mask_4') if 'anon_mask_6' in self._config: @@ -278,7 +282,13 @@ class LogWardenfilerHandler(ihandler): if dst_ip.startswith("::ffff:"): dst_ip = dst_ip[7:] - if self.resolve_nat: + af = "IP4" if not ':' in src_ip else "IP6" + + # Test for static IP to report as attack target + if af == "IP4" and self.reported_ipv4: + dst_ip = self.reported_ipv4 + # Resolve NAT if instructed + elif af == "IP4" and self.resolve_nat: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((self.nat_host, self.nat_port)) s.sendall((','.join((src_ip, str(con.local.port))).encode("utf-8"))) @@ -289,8 +299,10 @@ class LogWardenfilerHandler(ihandler): else: logger.warn("no translation for %s:%s" % (src_ip, con.local.port)) return() + elif af == "IP6" and self.reported_ipv6: + dst_ip = self.reported_ipv6 - af = "IP4" if not ':' in src_ip else "IP6" + anon = (self.anon_mask_4 < 32) and (not ':' in dst_ip) or (self.anon_mask_6 < 128) if anon: dst_ip = [( diff --git a/dionaea/log_wardenfiler.yaml.example b/dionaea/log_wardenfiler.yaml.example index 3d96b513589b1e18965dfb27e2fccef15a30779f..2a7dfd4d87d96d1f56102a4e64f384088ae30a4f 100644 --- a/dionaea/log_wardenfiler.yaml.example +++ b/dionaea/log_wardenfiler.yaml.example @@ -4,6 +4,8 @@ resolve_nat: no # nat_host: "gateway" # nat_port: 1456 + # reported_ipv4: "198.51.100.42" + # reported_ipv6: "2001:db8:cafe:beef::42" # anon_mask_4: 24 # anon_mask_6: 64 aggr_win: 300