Skip to content

Commit

Permalink
warn when p0f socket_path not configured
Browse files Browse the repository at this point in the history
  • Loading branch information
msimerson committed Sep 15, 2017
1 parent ae24d9b commit afd4843
Show file tree
Hide file tree
Showing 4 changed files with 23 additions and 10 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
[![Greenkeeper badge][gk-img]][gk-url]
[![Windows Build Status][ci-win-img]][ci-win-url]
[![NPM][npm-img]][npm-url]
<!-- doesn't work in haraka plugins... yet. [![Code Coverage][cov-img]][cov-url]-->

# haraka-plugin-p0f

Expand Down Expand Up @@ -53,6 +52,7 @@ add an entry to config/plugins to enable p0f:

3. review settings in config/p0f.ini

At a minimum, [main]socket_path must be defined.

## Startup

Expand Down
2 changes: 2 additions & 0 deletions config/p0f.ini
Original file line number Diff line number Diff line change
@@ -1,2 +1,4 @@

[main]
; the path to the p0f UNIX socket
socket_path=/tmp/.p0f_socket
27 changes: 19 additions & 8 deletions index.js
Original file line number Diff line number Diff line change
Expand Up @@ -69,15 +69,16 @@ P0FClient.prototype.shutdown = function () {
}

P0FClient.prototype.decode_response = function (data) {
const decode_string = function (data2, start, end) {

function decode_string (data2, start, end) {
let str = '';
for (let a=start; a<end; a++) {
const b = data2.readUInt8(a);
let b = data2.readUInt8(a);
if (b === 0x0) break;
str = str + String.fromCharCode(b);
}
return str;
};
}

if (this.receive_queue.length <= 0) {
throw new Error('unexpected data received');
Expand All @@ -92,6 +93,7 @@ P0FClient.prototype.decode_response = function (data) {
if (data.readUInt32LE(0) !== 0x50304602) {
return item.cb(new Error('bad response magic!'));
}

// Status dword: 0x00 for 'bad query', 0x10 for 'OK', and 0x20 for 'no match'
const st = data.readUInt32LE(4);
switch (st) {
Expand Down Expand Up @@ -169,6 +171,16 @@ P0FClient.prototype.process_send_queue = function () {
}
};

function start_p0f_client (sp, server, next) {
if (!sp) {
server.logerror("main.socket_path not defined in p0f.ini!");
return next();
}
// Start p0f process
server.notes.p0f_client = new P0FClient(sp);
next();
}

exports.P0FClient = P0FClient;

exports.register = function () {
Expand Down Expand Up @@ -206,8 +218,7 @@ exports.hook_lookup_rdns = function onLookup (next, connection) {
return next();
}

const p0f_client = connection.server.notes.p0f_client;
p0f_client.query(connection.remote.ip, function (err, result) {
connection.server.notes.p0f_client.query(connection.remote.ip, (err, result) => {
if (err) {
connection.results.add(plugin, {err: err.message});
return next();
Expand All @@ -220,7 +231,7 @@ exports.hook_lookup_rdns = function onLookup (next, connection) {

connection.loginfo(plugin, format_results(result));
connection.results.add(plugin, result);
return next();
next();
});
};

Expand Down Expand Up @@ -254,5 +265,5 @@ exports.hook_data_post = function (next, connection) {
connection.logdebug(plugin, 'adding header');
connection.transaction.add_header(header_name, format_results(result));

return next();
};
next();
}
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "haraka-plugin-p0f",
"version": "1.0.0",
"version": "1.0.1",
"description": "Haraka plugin that adds TCP fingerprinting",
"main": "index.js",
"scripts": {
Expand Down

0 comments on commit afd4843

Please sign in to comment.