Skip to content

Commit e4a5654

Browse files
p1-martinp1-martin
committed
first commit
0 parents  commit e4a5654

File tree

70 files changed

+24228
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

70 files changed

+24228
-0
lines changed

‎AUTHORS

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
Original Authors
2+
-------- -------
3+
Martin Kacer <kacer.martin[AT]gmail.com>
4+
Philippe Langlois <philippe.langlois[AT]p1sec.com>
5+
6+
Special thanks to
7+
-----------------
8+
Telestax - jSS7, jDiameter opensource project
9+
10+
11+
Contributors
12+
------------
13+
14+
15+
Acknowledgements
16+
----------------
17+
The work is copyrighted also with all right by the original authors:
18+
Martin Kacer <kacer.martin[AT]gmail.com>
19+
Philippe Langlois <philippe.langlois[AT]p1sec.com>
20+
21+
Commercial license can be also obtained from P1 Security and H21 lab
22+
and the copyright, authorship and all other rights are held by both
23+
P1 Security and H21 lab. P1 Security grant to H21 lab the, transferable,
24+
irrevocable, perpetual, royalty-free right to use, modify, copy, sell,
25+
and distribute the Original work and Contributions under the terms
26+
of any OSI recognized Open Source License or any commercial use license.

‎LICENSE

+662
Large diffs are not rendered by default.

‎README.md

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# SigFW
2+
Open Source SS7/Diameter firewall
3+
4+
## Build instructions
5+
6+
### Prerequisities
7+
Install Maven
8+
9+
(Optional) Netbeans IDE for developers
10+
11+
### Clone source code
12+
git clone https://github.com/P1sec/SigFW
13+
14+
### Build SS7FW project
15+
```bash
16+
cd ./SigFW/ss7fw/ss7fw.ss7fw-core_jar_1.0.0-SNAPSHOT
17+
mvn clean install -Dmaven.test.skip=true
18+
```
19+
20+
### Run SS7FW project
21+
```bash
22+
mvn exec:java -Dexec.mainClass="ss7fw.SS7Firewall"
23+
mvn exec:java -Dexec.mainClass="ss7fw.SS7ClientLiveInput"
24+
mvn exec:java -Dexec.mainClass="ss7fw.SS7Server"
25+
```
26+
27+
### Replay traffic from pcap
28+
```bash
29+
cd ./input
30+
mkfifo pipe
31+
tshark -T ek -x -j "" -r ./input/sigtran.pcap > sigtran.json
32+
cat ./input/sigtran.json > pipe
33+
```
34+
35+
![](https://github.com/P1sec/SigFW/blob/master/docs/running_from_netbeans.gif)
36+
37+
### Build DiameterFW project
38+
```bash
39+
cd ./SigFW/diameterfw/diameterfw.diameterfw-core_jar_1.0.0-SNAPSHOT
40+
mvn clean install -Dmaven.test.skip=true
41+
```
42+
43+
### Run DiameterFW project
44+
```bash
45+
mvn exec:java -Dexec.mainClass="diameterfw.DiameterFirewall"
46+
mvn exec:java -Dexec.mainClass="diameterfw.DiameterClientLiveInput"
47+
mvn exec:java -Dexec.mainClass="diameterfw.DiameterServer"
48+
```
49+
50+
### Replay traffic from pcap
51+
```bash
52+
cd ./input
53+
mkfifo pipe
54+
tshark -T ek -x -j "" -r ./input/diameter.pcap > diameter.json
55+
cat ./input/diameter.json > pipe
56+
```
57+
58+
### Security
59+
For both SS7FW and DiameterFW before using.
60+
61+
realm.properties: Change the username, password for firewall API
62+
63+
sigfw.json: Generate new Public, Private Keys. Change the mThreat salt
64+
65+
Jetty: Change the certificate
66+
67+
### To test the encryption, signatures
68+
Instead of SS7Firewall run SS7FirewallFirstInstance and SS7FirewallSecondInstance
69+
70+
Instead of DiameterFirewall run DiameterFirewallFirstInstance and DiameterFirewallSecondInstance
71+
72+
## Limitations
73+
Program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.
74+
75+
## License
76+
SigFW is licensed under dual license policy. The default license is the Free Open Source GNU Affero GPL v3.0. Alternatively a commercial license can be obtained from P1 Security S.A.S.
77+
78+
## Attribution
79+
For the list of contributors, see the AUTHORS file.
80+
81+
Original work was created by Martin Kacer, Philippe Langlois
82+
83+
Copyright 2017, P1 Security S.A.S and individual contributors
84+
85+
We would like to thanks for everyone supporting this project.
86+

‎VM/00-header

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#!/bin/sh
2+
#
3+
# 00-header - create the header of the MOTD
4+
# Copyright (C) 2009-2010 Canonical Ltd.
5+
#
6+
# Authors: Dustin Kirkland <[email protected]>
7+
#
8+
# This program is free software; you can redistribute it and/or modify
9+
# it under the terms of the GNU General Public License as published by
10+
# the Free Software Foundation; either version 2 of the License, or
11+
# (at your option) any later version.
12+
#
13+
# This program is distributed in the hope that it will be useful,
14+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
15+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16+
# GNU General Public License for more details.
17+
#
18+
# You should have received a copy of the GNU General Public License along
19+
# with this program; if not, write to the Free Software Foundation, Inc.,
20+
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21+
22+
[ -r /etc/lsb-release ] && . /etc/lsb-release
23+
24+
if [ -z "$DISTRIB_DESCRIPTION" ] && [ -x /usr/bin/lsb_release ]; then
25+
# Fall back to using the very slow lsb_release utility
26+
DISTRIB_DESCRIPTION=$(lsb_release -s -d)
27+
fi
28+
29+
#printf "Welcome to %s (%s %s %s)\n" "$DISTRIB_DESCRIPTION" "$(uname -o)" "$(uname -r)" "$(uname -m)"
30+
31+
printf "SigFW\n"
32+
printf "Open Source SS7/Diameter firewall\n"
33+
printf "Original work was created by Martin Kacer, Philippe Langlois\n"
34+
printf "Copyright 2017, P1 Security S.A.S and individual contributors\n"
35+
printf "See the AUTHORS in the distribution for a full listing of individual contributors.\n"
36+
printf "\n"
37+
printf "SigFW is licensed under dual license policy. The default license is\n"
38+
printf "the Free Open Source GNU Affero GPL v3.0. Alternatively a commercial license\n"
39+
printf "can be obtained from P1 Security S.A.S.\n"
40+
printf "\n"
41+
printf "\n"
42+
printf "Interfaces:\n"
43+
printf " enp0s3 - management (SSH, Web)\n"
44+
printf " enp0s8 - signalling (SigFW could be reconfigured here)\n"
45+
printf " enp0s9 - passive signalling (port-mirrored traffic)\n"
46+
printf "\n"
47+
printf "To access Kibana:\n"
48+
printf " http://<host>:5601/\n"
49+
printf "\n"
50+
printf "To access API\n"
51+
printf " https://<host>:8443/ss7fw_api/1.0/get_status\n"
52+
printf "\n"
53+
printf "To check if services are running:\n"
54+
printf " sudo service tshark_to_ss7fw status\n"
55+
printf " sudo service tshark_to_ek status\n"
56+
printf " sudo service ss7fw status\n"
57+
printf " sudo service ss7server status\n"
58+
printf " sudo service ss7client status\n"
59+
printf "\n"
60+
printf "To replay the pcap on passive interface:\n"
61+
printf " sudo tcpreplay --intf1=enp0s9 sigtran.pcap\n"
62+
printf "\n"
63+
printf "Description:\n"
64+
printf " By default only SS7FW is enabled. The SS7FW is in passive mode.\n"
65+
printf " DiameterFW code is present but configured as service system service.\n"
66+
printf " Tshark is capturing traffic on enp0s9 and pushing into ElasticSearch.\n"
67+
printf " Second instance of tshark is pushing capture into named pipe of SS7FW.\n"
68+
printf " The SS7FW consist of ss7client, ss7firewall, ss7server. ss7client replay\n"
69+
printf " the captured traffic from enp0s9 towards ss7firewall and ss7server on\n"
70+
printf " localhost.\n"
71+
printf "\n"
72+
printf " SS7FW is located in /opt/SigFW/ss7fw/\n"
73+
printf " DiameterFW is located in /opt/SigFW/diameterfw/\n"
74+
printf "\n"
75+
printf " Before first run or if the IP has changed, modify /etc/kibana/kibana.yml"
76+
printf "\n"
77+
printf "\n"
78+
printf "To access logs:\n"
79+
printf " tail -f /opt/SigFW/ss7fw/ss7fw.ss7fw-core_jar_1.0.0-SNAPSHOT/ss7fw.log\n"

‎VM/line_curl.sh

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash -
2+
i=0
3+
while read line; do
4+
# process only non empty lines because of older tshark release
5+
if [ ! -z "$line" ]; then
6+
c=$(printf '%s\n%s\n' "$c" "$line")
7+
i=$((i+1))
8+
9+
# curl only every X seconds
10+
# the better solution is to use logstash or multithreaded client
11+
if !((i % 2)) && !((SECONDS % 10)) && [[ -v c ]]; then
12+
#printf '%s\n' "$c"
13+
printf '%s\n' "$c" | curl -o /dev/null --silent -XPUT http://localhost:9200/_bulk --data-binary @- &
14+
c=
15+
i=0
16+
fi
17+
fi
18+
done
19+
20+
#echo $c
21+
if [[ -v c ]]; then
22+
# #printf '%s\n' "$c"
23+
printf '%s\n' "$c" | curl -o /dev/null --silent -XPUT http://localhost:9200/_bulk --data-binary @- &
24+
fi

‎VM/mapping_template.sh

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/usr/bin/env bash
2+
3+
if [[ $# -ne 1 ]] ; then
4+
echo "usage: template.sh node"
5+
exit
6+
fi
7+
8+
curl -XPUT 'http://'$1'/_template/packets-template' -d '
9+
{
10+
"template": "packets-*",
11+
"mappings": {
12+
"_default_": {
13+
"dynamic": "true",
14+
"dynamic_date_formats" : [
15+
"yyyy-MM-dd HH:mm:SS"
16+
],
17+
"dynamic_templates": [
18+
{
19+
"string_fields": {
20+
"match": "*",
21+
"match_mapping_type": "string",
22+
"mapping": {
23+
"index": "not_analyzed",
24+
"omit_norms": true,
25+
"type": "string"
26+
}
27+
}
28+
}
29+
],
30+
"properties": {
31+
"@version": {
32+
"type": "string",
33+
"index": "not_analyzed"
34+
}
35+
}
36+
},
37+
"my_mapping": {
38+
"numeric_detection": true,
39+
"dynamic": "true",
40+
"properties": {
41+
"timestamp": {
42+
"type": "date"
43+
},
44+
"layers": {
45+
"properties": {
46+
"tcap": {
47+
"properties": {
48+
"tcap_opCode_tcap_localValue": {
49+
"type": "integer"
50+
}
51+
}
52+
},
53+
"gsm_map": {
54+
"properties": {
55+
"gsm_old_opCode_gsm_old_localValue": {
56+
"type": "integer"
57+
}
58+
}
59+
}
60+
}
61+
}
62+
}
63+
}
64+
65+
}
66+
}'
67+
68+
echo

‎VM/ss7client.service

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=SS7FW client service
3+
4+
[Service]
5+
User=p1sec
6+
Group=p1sec
7+
WorkingDirectory=/opt/SigFW/ss7fw/ss7fw.ss7fw-core_jar_1.0.0-SNAPSHOT
8+
ExecStart=/usr/bin/mvn exec:java -Dexec.mainClass="ss7fw.SS7ClientLiveInput"
9+
#Restart=always
10+
StandardOutput=null
11+
Restart=on-failure
12+
13+
[Install]
14+
WantedBy=multi-user.target

‎VM/ss7fw.service

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=SS7FW service
3+
4+
[Service]
5+
User=p1sec
6+
Group=p1sec
7+
WorkingDirectory=/opt/SigFW/ss7fw/ss7fw.ss7fw-core_jar_1.0.0-SNAPSHOT
8+
ExecStart=/usr/bin/mvn exec:java -Dexec.mainClass="ss7fw.SS7Firewall"
9+
#Restart=always
10+
StandardOutput=null
11+
Restart=on-failure
12+
13+
[Install]
14+
WantedBy=multi-user.target

‎VM/ss7server.service

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=SS7FW server service
3+
4+
[Service]
5+
User=p1sec
6+
Group=p1sec
7+
WorkingDirectory=/opt/SigFW/ss7fw/ss7fw.ss7fw-core_jar_1.0.0-SNAPSHOT
8+
ExecStart=/usr/bin/mvn exec:java -Dexec.mainClass="ss7fw.SS7Server"
9+
#Restart=always
10+
StandardOutput=null
11+
Restart=on-failure
12+
13+
[Install]
14+
WantedBy=multi-user.target

‎VM/tshark_to_ek.service

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=tshark to elasticsearch
3+
4+
[Service]
5+
User=p1sec
6+
Group=p1sec
7+
WorkingDirectory=/opt/SigFW/VM/
8+
ExecStart=/opt/SigFW/VM/tshark_to_ek.sh
9+
#Restart=always
10+
StandardOutput=null
11+
Restart=on-failure
12+
13+
[Install]
14+
WantedBy=multi-user.target

‎VM/tshark_to_ek.sh

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/bash -
2+
tshark -i enp0s9 -T ek -l | /opt/SigFW/VM/line_curl.sh

‎VM/tshark_to_ss7fw.service

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=tshark to SS7FW
3+
4+
[Service]
5+
User=p1sec
6+
Group=p1sec
7+
WorkingDirectory=/opt/SigFW/VM/
8+
ExecStart=/opt/SigFW/VM/tshark_to_ss7fw.sh
9+
#Restart=always
10+
StandardOutput=null
11+
Restart=on-failure
12+
13+
[Install]
14+
WantedBy=multi-user.target

‎VM/tshark_to_ss7fw.sh

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/bash -
2+
tshark -i enp0s9 -T ek -x -j " " -l > /opt/SigFW/ss7fw/ss7fw.ss7fw-core_jar_1.0.0-SNAPSHOT/input/pipe

‎diameterfw/diameterfw.diameterfw-core_jar_1.0.0-SNAPSHOT/.gitignore

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
target/
2+
XmlDiameterClientLiveInput/
3+
XmlDiameterFirewall/
4+
*.last
5+
input/*
6+
127*.xml
7+
server*.xml

0 commit comments

Comments
 (0)