v1.0.0!

Makefile

@@ -1,9 +1,19 @@
+VERSION := 1.0.0
+BUILDSTRING := $(shell git log --pretty=format:'%h' -n 1)
+VERSIONSTRING := freki version $(VERSION)+$(BUILDSTRING)
 
 default: build
 
-build:
+OUTPUT = bin/freki
+
+$(OUTPUT): glide.lock app/main.go *.go netfilter/*
 	@mkdir -p bin/
-	go build -o bin/freki app/main.go
+	go build -o $(OUTPUT) -ldflags "-X \"main.VERSION=$(VERSIONSTRING)\"" app/main.go
+
+build: $(OUTPUT)
+
+upx: build
+	upx -1 bin/freki
 
 clean:
 	rm -rf bin/

app/main.go

@@ -5,9 +5,9 @@ import (
 	"os/signal"
 	"sync"
 
+	log "github.com/Sirupsen/logrus"
 	docopt "github.com/docopt/docopt-go"
 	"github.com/kung-foo/freki"
-	log "github.com/sirupsen/logrus"
 )
 
 // VERSION is set by the makefile

app/rules.yaml

@@ -1,26 +1,22 @@
-# drop -- drops everything
-# logging_tcp -- establishes a connection (3 way handshake), attempts to read X bytes, then closes the connnection. log everything
-# ignore -- simply mark the packets as accepted
-# spoof-- pretend to be something else. could come in multiple flavors like http or telnet
-# rewrite -- rewrite the destination port to target a 3rd party honeypot. we would need to expose the original source port via an api such that the external process could log it.
-# proxy -- this is slightly different from rewrite in that we could proxy the connection to an off-box addr (i.e. google.com)
 rules:
-    - match: tcp dst port 10022
-      type: rewrite
-      target: 22
-    - match: tcp dst port 9200
-      type: proxy
-      target: docker://elasticsearch:9200
-    - match: tcp dst port 666
-      type: proxy
-      target: tcp://portquiz.net:666
-    - match: tcp port 80 or tcp port 8080
-      type: log_http
-    - match: tcp portrange 5000-5010
-      type: drop
-    - match: tcp port 8888
-      type: drop
-    - match: tcp
-      type: log_tcp
-    - match:
-      type: passthrough
+  - match: tcp dst port 22 and src host 1.2.3.4
+    type: passthrough
+  - match: tcp dst port 10022
+    type: rewrite
+    target: 22
+  - match: tcp dst port 6379
+    type: proxy
+    target: docker://redis:6379
+  - match: tcp dst port 666
+    type: proxy
+    target: tcp://portquiz.net:666
+  - match: tcp port 80 or tcp port 8080
+    type: log_http
+  - match: tcp portrange 5000-5010
+    type: drop
+  - match: tcp port 8888
+    type: drop
+  - match: tcp
+    type: log_tcp
+  - match:
+    type: passthrough

freki.go

@@ -1,6 +1,7 @@
 package freki
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"strings"
@@ -10,6 +11,9 @@ import (
 
 	"golang.org/x/net/bpf"
 
+	"github.com/docker/engine-api/client"
+	"github.com/docker/engine-api/types"
+
 	"github.com/coreos/go-iptables/iptables"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
@@ -131,6 +135,41 @@ func (p *Processor) resetIPTables() (err error) {
 }
 
 func (p *Processor) Init() (err error) {
+	for _, rule := range p.rules {
+		if rule.ruleType == ProxyTCP {
+			if rule.targetURL.Scheme == "docker" {
+				p.log.Debugf("[freki   ] Creating Docker client with version: %v", client.DefaultVersion)
+				var cli *client.Client
+				cli, err = client.NewEnvClient()
+				if err != nil {
+					return err
+				}
+
+				var containers []types.Container
+				containers, err = cli.ContainerList(context.Background(), types.ContainerListOptions{})
+				if err != nil {
+					return err
+				}
+
+				found := false
+				for _, container := range containers {
+					name := container.Names[0][1:]
+					if name == rule.host {
+						addr := container.NetworkSettings.Networks["bridge"].IPAddress
+						p.log.Debugf("[freki   ] mapping docker://%s:%d to tcp://%s:%d", rule.host, rule.port, addr, rule.port)
+						rule.targetURL.Host = fmt.Sprintf("%s:%s", addr, rule.targetURL.Port())
+						rule.host = addr
+						found = true
+					}
+				}
+
+				if !found {
+					return fmt.Errorf("unabled to find a container named: %s", rule.host)
+				}
+			}
+		}
+	}
+
 	p.ipt, err = iptables.NewWithProtocol(iptables.ProtocolIPv4)
 	if err != nil {
 		return
@@ -143,7 +182,6 @@ func (p *Processor) Init() (err error) {
 	}
 
 	// TODO: check for conflicting rules
-
 	err = p.initIPTables()
 	if err != nil {
 		return

glide.yaml

@@ -6,20 +6,23 @@ owners:
 ignore:
 - golang.org/x/sys
 - golang.org/x/net
+- github.com/Microsoft/go-winio
+- github.com/opencontainers/go-digest
 import:
 - package: github.com/google/gopacket
   version: ^1.1.12
   subpackages:
   - layers
-- package: github.com/sirupsen/logrus
+- package: github.com/Sirupsen/logrus
   version: ^0.11.0
 - package: github.com/coreos/go-iptables
-- package: github.com/davecgh/go-spew
-  version: ^1.1.0
-  subpackages:
-  - spew
+  version: 5463fbac3bcc6b990663941c2e12660d19f6b36d
 - package: gopkg.in/yaml.v2
 - package: github.com/pkg/errors
   version: ^0.8.0
 - package: github.com/docopt/docopt-go
   version: ^0.6.2
+- package: github.com/docker/go-connections
+- package: github.com/docker/engine-api
+  subpackages:
+  - client

proxy_tcp.go

@@ -65,7 +65,7 @@ func (p *TCPProxy) handleConnection(conn net.Conn) {
 
 	target := md.Rule.targetURL
 
-	if target.Scheme != "tcp" {
+	if target.Scheme != "tcp" && target.Scheme != "docker" {
 		p.log.Error(fmt.Errorf("unsuppported scheme: %s", target.Scheme))
 		return
 	}