Thanks for introducing access to packet timestamps in Haka (0.2)!

Read access works perfectly fine, but unfortunately changing timestamps does not work for PCAP files.
Here is a minimum working example ("timestamp.lua"):

local raw = require('protocol/raw')

haka.rule{
    hook = raw.events.send_packet,
    eval = function(pkt)

    print("Before: " .. pkt.timestamp.secs)
    pkt.timestamp.secs = pkt.timestamp.secs + 1
    print("After: " .. pkt.timestamp.secs)
end
}

I run hakapcap on a very short PCAP ("testin.pcap"):

hakapcap --no-pass-through -o testout.pcap timestamp.lua testin.pcap

For every packet, I see two output lines, as intented:

Before: 1434009888
After: 1434009889

However, the output PCAP file ("testout.pcap") does not reflect the changes, as the timestamp remains unchanged. In fact, hashing "testin.pcap" and "testout.pcap" results in the same hash value.

when building with gcc 6.2.1 I'm getting the following error:

[ 26%] Building C object lib/haka/CMakeFiles/libhaka.dir/luadebug/user_readline.c.o
/build/haka-git/src/haka-git/lib/haka/luadebug/user_readline.c: In function 'start':
/build/haka-git/src/haka-git/lib/haka/luadebug/user_readline.c:49:31: error: assignment from incompatible pointer type [-Werror=incompatible-pointer-types]
  rl_completion_entry_function = empty_generator;
                               ^
cc1: all warnings being treated as errors
make[2]: *** [lib/haka/CMakeFiles/libhaka.dir/build.make:934: lib/haka/CMakeFiles/libhaka.dir/luadebug/user_readline.c.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:1059: lib/haka/CMakeFiles/libhaka.dir/all] Error 2
make: *** [Makefile:161: all] Error 2
==> ERROR: A failure occurred in build().
    Aborting...

hello

the first exemple [http://doc.haka-security.org/haka/release/v0.3.0/doc/user/tutorial/hellopacket.html]

hakapcap hellopacket.pcap hellopacket.lua
info core: load module 'packet/pcap.so', Pcap Module
info core: load module 'alert/file.so', File alert
info core: setting packet mode to pass-through

info core: loading rule file 'hellopacket.pcap'
info core: initializing thread 0
info dissector: register new dissector 'raw'
info pcap: opening file 'hellopacket.lua'
error pcap: unknown file format
fatal core: unable to create packet capture state
fatal core: thread initialization error
info core: unload module 'Pcap Module'
info core: unload module 'File alert'

is in the wrong order

Usage: hakapcap [options]

hakapcap hellopacket.lua hellopacket.pcap
info core: load module 'packet/pcap.so', Pcap Module
info core: load module 'alert/file.so', File alert
info core: setting packet mode to pass-through

info core: loading rule file 'hellopacket.lua'
info core: initializing thread 0
info dissector: register new dissector 'raw'
info pcap: opening file 'hellopacket.pcap'
info dissector: register new dissector 'ipv4'
info dissector: register new dissector 'tcp'
info dissector: register new dissector 'tcp_connection'
info core: 1 rule(s) on event 'tcp_connection:new_connection'
info core: 1 rule(s) on event 'ipv4:receive_packet'
info core: 2 rule(s) registered

info core: starting single threaded processing

info external: packet from 192.168.10.1 to 192.168.10.99
info external: TCP connection from 192.168.10.1:47161 to 192.168.10.99:3000
alert: id = 1
time = Thu Jul 21 11:09:24 2016
severity = low
description = A simple alert
info external: packet from 192.168.10.99 to 192.168.10.1
info external: packet from 192.168.10.1 to 192.168.10.99
info external: packet from 192.168.10.1 to 192.168.10.99
info external: packet from 192.168.10.99 to 192.168.10.1
info external: packet from 192.168.10.1 to 192.168.10.99
info external: packet from 192.168.10.99 to 192.168.10.1
info external: packet from 192.168.10.1 to 192.168.10.99
info core: unload module 'Pcap Module'

info core: unload module 'File alert'

Dear Guy,
Now Splunk support Add-on for Norse Darklist and Norse IPViking,this function is useful for Live Attack Intelligence.

Detail info please refer to below link:
https://apps.splunk.com/app/1661/
http://pages.norse-corp.com/rs/norse/images/Norse-DS-Splunk.pdf

You absolutely must ship some sort of mechanism to detect TCP injection attacks. You should try to have feature parity with HoneyBadger (which is a working POC but still not ready for production)
https://honeybadger.readthedocs.org/
https://github.com/david415/HoneyBadger

Of course to have comprehensive TCP injection attack detection you must detect all 3 or 4 broader categories of attack:

1. segment veto: the injected packet(s) are the exact same size as those sent out by the legit party. Client and server remain in sync.
2. sloppy injection: the injected packet(s) are different sizes than that of the legit party. Client and server fall out of sync.
3. out-of-order coalesce injection: injected packets are ahead of the next sequence. Injection of data takes place during coalescence.
4. handshake hijack: the attacker responds to the SYN with a SYN/ACK before the legit party can do so. Detecting this is really simple.

There's more: such as sloppy injection that gradually brings client and server back into sequence synchronization.

I would really like to help you implement this feature.

Hi,

I'm running the following script over a pcap of 17GB(around 600k flows).

root@System-U14LTS:~/work# cat luascript/http-stream-streamed.lua
local rem = require("regexp/pcre")
local tcp_connection = require('protocol/tcp_connection')
local http = require('protocol/http')
http.install_tcp_rule(80)
http.install_tcp_rule(80)
http.install_tcp_rule(2096)
http.install_tcp_rule(8080)
local re1 = rem.re:compile('^.*%.[^%%]+$', rem.re.CASE_INSENSITIVE)
local re2 = rem.re:compile("([^%/.]+)$|([^%/]+)(%.[^%/.]+)$", rem.re.CASE_INSENSITIVE)
haka.rule {
        hook = http.events.receive_data,
        options = {
        streamed = true,
        },
        eval = function (http, iter, dir)
        if http.request ~= nil then
                local split_uri = http.request.split_uri:normalize()
                if re2:match(http.request.uri) then
                        local res, startpos, endpos = re2:match(split_uri.path)
                        filename = string.sub(split_uri.path,startpos+1,endpos)
                        local file = io.open("/root/work/download/" .. filename, "w")
                        for sub in iter:foreach_available() do
                                file:write(sub:asstring())
                        end
                        file:close()
                end
        end
end
}

I get the following error. Below you can find the backtrace.

root@System-U14LTS:~/work# gdb hakapcap
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from hakapcap...done.
(gdb) run luascript/http-stream-streamed.lua /space/roho_ro.pcap --debug > roho.out
Starting program: /root/work/haka_0.3.0_source/make/out/usr/local/bin/hakapcap luascript/ht                                                                                                  tp-stream-streamed.lua /space/roho_ro.pcap --debug > roho.out
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
hakapcap: /root/work/haka_0.3.0_source/make/modules/protocol/tcp/tcpLUA_wrap.c:3724: _wrap_                                          tcp_stream_clear: Assertion `!0x1 || usr->own == 1' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff74eacc9 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff74eacc9 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff74ee0d8 in __GI_abort () at abort.c:89
#2  0x00007ffff74e3b86 in __assert_fail_base (
    fmt=0x7ffff7634830 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
    assertion=assertion@entry=0x7ffff56608dc "!0x1 || usr->own == 1",
    file=file@entry=0x7ffff565fc88 "/root/work/haka_0.3.0_source/make/modules/protocol/tcp/                                                                                                  tcpLUA_wrap.c", line=line@entry=3724,
    function=function@entry=0x7ffff5661c70 <__PRETTY_FUNCTION__.6882> "_wrap_tcp_stream_cle                                                                                                  ar") at assert.c:92
#3  0x00007ffff74e3c32 in __GI___assert_fail (
    assertion=0x7ffff56608dc "!0x1 || usr->own == 1",
    file=0x7ffff565fc88 "/root/work/haka_0.3.0_source/make/modules/protocol/tcp/tcpLUA_wrap                                                                                                  .c", line=3724,
    function=0x7ffff5661c70 <__PRETTY_FUNCTION__.6882> "_wrap_tcp_stream_clear")
    at assert.c:101
#4  0x00007ffff5657e2a in _wrap_tcp_stream_clear (L=0x40000378)
    at /root/work/haka_0.3.0_source/make/modules/protocol/tcp/tcpLUA_wrap.c:3724
#5  0x00007ffff791521b in lj_BC_FUNCC ()
   from /root/work/haka_0.3.0_source/make/out/usr/local/lib/libhaka.so.0
#6  0x00007ffff78f6bfa in lua_pcall (L=0x40000378, nargs=1, nresults=1, errfunc=3)
    at lj_api.c:1052
---Type <return> to continue, or q <return> to quit---
#7  0x00007ffff78b8dd1 in lua_transition_callback (state_machine=0x8073160,
    _data=0x61fc50) at /root/work/haka_0.3.0_source/make/lib/haka/lua/hakaLUA_wrap.c:3637
#8  0x00007ffff78983c1 in do_transition (instance=0x8073160, trans=0x61fb78)
    at /root/work/haka_0.3.0_source/lib/haka/state_machine.c:317
#9  0x00007ffff7898d95 in state_machine_instance_finish (instance=0x8073160)
    at /root/work/haka_0.3.0_source/lib/haka/state_machine.c:512
#10 0x00007ffff78990d9 in state_machine_instance_fail (instance=0x8073160)
    at /root/work/haka_0.3.0_source/lib/haka/state_machine.c:597
#11 0x00007ffff7898e83 in state_machine_instance_update (instance=0x8073160,
    newstate=0x7ffff7bb7600 <_state_machine_fail_state>)
    at /root/work/haka_0.3.0_source/lib/haka/state_machine.c:543
#12 0x00007ffff78987d2 in state_machine_enter_state (instance=0x8073160, state=0x61fae0)
    at /root/work/haka_0.3.0_source/lib/haka/state_machine.c:392
#13 0x00007ffff7898f67 in state_machine_instance_update (instance=0x8073160,
    newstate=0x61fae0) at /root/work/haka_0.3.0_source/lib/haka/state_machine.c:558
#14 0x00007ffff78b94da in state_machine_instance__update (self=0x8073160, state=0x61fae0)
    at /root/work/haka_0.3.0_source/make/lib/haka/lua/hakaLUA_wrap.c:3799
#15 0x00007ffff78d80c5 in _wrap_state_machine_instance_update (L=0x40000378)
    at /root/work/haka_0.3.0_source/make/lib/haka/lua/hakaLUA_wrap.c:12484
#16 0x00007ffff791521b in lj_BC_FUNCC ()
   from /root/work/haka_0.3.0_source/make/out/usr/local/lib/libhaka.so.0
#17 0x00007ffff78f6bfa in lua_pcall (L=0x40000378, nargs=1, nresults=0, errfunc=6)
---Type <return> to continue, or q <return> to quit---
    at lj_api.c:1052
#18 0x0000000000403b4b in filter_wrapper (state=0x609170, pkt=0xe338fb0)
    at /root/work/haka_0.3.0_source/src/haka/thread.c:84
#19 0x00000000004046d7 in thread_main_loop (_state=0x609170)
    at /root/work/haka_0.3.0_source/src/haka/thread.c:312
#20 0x0000000000404ed0 in thread_pool_start (pool=0x609110)
    at /root/work/haka_0.3.0_source/src/haka/thread.c:509
#21 0x0000000000403870 in start () at /root/work/haka_0.3.0_source/src/haka/app.c:183
#22 0x0000000000403241 in main (argc=2, argv=0x7fffffffe358)
    at /root/work/haka_0.3.0_source/src/haka/hakapcap.c:253
(gdb)

Here you may find the last output after dropping the last packet.

debug packet:    dropping packet id=4003310
debug states:    http: leave transition on state 'response'
debug states:    http: finish from state 'response'
debug states:    http: finish transition on state 'response'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
error lua:       state machine: invalid buffer iterator
stack traceback:
        [C]: in function 'clear'
        ...aka_0.3.0_source/modules/protocol/tcp/tcp_connection.lua:472: in function 'clearstream'
        ...aka_0.3.0_source/modules/protocol/tcp/tcp_connection.lua:173: in function 'execute'
        /root/work/haka_0.3.0_source/lib/haka/lua/lua/state.lua:163: in function </root/work/haka_0.3.0_source/lib/haka/lua/lua/state.lua:159>
        [C]: in function 'update'
        ...ork/haka_0.3.0_source/lib/haka/lua/lua/state_machine.lua:142: in function 'trigger'
        ...aka_0.3.0_source/modules/protocol/tcp/tcp_connection.lua:568: in function 'drop'
        ...aka_0.3.0_source/modules/protocol/tcp/tcp_connection.lua:675: in function 'drop'
        /root/work/haka_0.3.0_source/lib/haka/lua/lua/dissector.lua:86: in function '_trigger_receive'
        ...aka_0.3.0_source/modules/protocol/tcp/tcp_connection.lua:515: in function 'push'
        ...
        /root/work/haka_0.3.0_source/lib/haka/lua/lua/dissector.lua:116: in function </root/work/haka_0.3.0_source/lib/haka/lua/lua/dissector.lua:115>
        [C]: in function 'xpcall'
        /root/work/haka_0.3.0_source/lib/haka/lua/lua/dissector.lua:90: in function 'receive'
        /root/work/haka_0.3.0_source/lib/haka/lua/lua/dissector.lua:116: in function </root/work/haka_0.3.0_source/lib/haka/lua/lua/dissector.lua:115>
        [C]: in function 'xpcall'
        /root/work/haka_0.3.0_source/lib/haka/lua/lua/dissector.lua:90: in function 'receive'
        /root/work/haka_0.3.0_source/lib/haka/lua/lua/dissector.lua:116: in function </root/work/haka_0.3.0_source/lib/haka/lua/lua/dissector.lua:115>
        [C]: in function 'xpcall'
        /root/work/haka_0.3.0_source/lib/haka/lua/lua/dissector.lua:90: in function 'receive'
        [string "raw"]:64: in function <[string "raw"]:63>
debug states:    tcp: fail transition on state 'reset'
debug states:    tcp: leave transition on state 'reset'
debug states:    http: leave transition on state 'request'
debug states:    http: finish from state 'request'
debug states:    http: finish transition on state 'request'
debug states:    tcp: finish from state 'reset'
debug states:    tcp: finish transition on state 'reset'

Could you please take a look and let me know what the problem is? If you need any other info please tell me. I did not use
cmake -DBUILD=Debug <path-to-haka-source>

If I use module = "packet/nfqueue"
and use local http = require('protocol/http')

I have error when connect to HTTP servers:
error tcp: invalid tcp establishement handshake
And I can't open web page.

If I delete string local http = require('protocol/http') I don't have this error and I can open web page.

Configuration daemon.conf:

[general]
configuration = "tcpfilter.lua"
pass-through = no

[packet]
module = "packet/nfqueue"

interfaces = "eth2"

[log]
module = "log/syslog"

Configuration tcpfilter.lua:

require('protocol/ipv4')
local tcp = require('protocol/tcp')
local http = require('protocol/http')

-- Allow only packets to/from port 80
haka.rule{
        hook = tcp.events.receive_packet,
        eval = function (pkt)
                -- The next line will generate a lua error:
                -- there is no 'destport' field. Replace 'destport' by 'dstport'
                if pkt.dstport == 80 or pkt.srcport == 80 then
                        haka.log("Authorizing trafic on port 80")
                else
                        haka.log("Trafic not authorized on port %d", pkt.dstport)
                        pkt:drop()
                end
        end
}

Hi!

While trying to compile haka on Fedora 22 I get a bunch of the following errors (actually, warnings treated as errors):

/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_iterator__insert’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3314:5: error: ‘return’ with no value, in function returning non-void [-Werror]
return;
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3319:5: error: ‘return’ with no value, in function returning non-void [-Werror]
return;
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_iterator_sub__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3384:12: error: implicit declaration of function ‘vbuffer_iterator_sub__SWIG_0’ [-Werror=implicit-function-declaration]
return vbuffer_iterator_sub__SWIG_0(self, -1, split);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3384:12: error: return makes pointer from integer without a cast [-Werror=int-conversion]
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3387:12: error: return makes pointer from integer without a cast [-Werror=int-conversion]
return vbuffer_iterator_sub__SWIG_0(self, -1, split);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_iterator_move_to__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3403:4: error: implicit declaration of function ‘vbuffer_iterator_move_to__SWIG_0’ [-Werror=implicit-function-declaration]
vbuffer_iterator_move_to__SWIG_0(self, &iter->super);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_iterator_blocking_insert’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3435:166: error: implicit declaration of function ‘vbuffer_iterator__insert’ [-Werror=implicit-function-declaration]
SWIGINTERN struct vbuffer_sub *struct_vbuffer_iterator_blocking_insert(struct vbuffer_iterator_blocking *self,struct vbuffer *data){ return vbuffer_iterator__insert(&self->super, data); }
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3435:166: error: return makes pointer from integer without a cast [-Werror=int-conversion]
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_iterator_blocking_copy’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3437:148: error: implicit declaration of function ‘vbuffer_iterator__copy’ [-Werror=implicit-function-declaration]
SWIGINTERN struct vbuffer_iterator *struct_vbuffer_iterator_blocking_copy(struct vbuffer_iterator_blocking *self){ return vbuffer_iterator__copy(&self->super); }
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3437:148: error: return makes pointer from integer without a cast [-Werror=int-conversion]
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_iterator_blocking_move_to__SWIG_0’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3438:169: error: ‘return’ with a value, in function returning void [-Werror]
SWIGINTERN void struct_vbuffer_iterator_blocking_move_to__SWIG_0(struct vbuffer_iterator_blocking *self,struct vbuffer_iterator *iter){ return vbuffer_iterator_move_to__SWIG_0(&self->super, iter); }
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_iterator_blocking_move_to__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3439:178: error: implicit declaration of function ‘vbuffer_iterator_move_to__SWIG_1’ [-Werror=implicit-function-declaration]
SWIGINTERN void struct_vbuffer_iterator_blocking_move_to__SWIG_1(struct vbuffer_iterator_blocking *self,struct vbuffer_iterator_blocking *iter){ return vbuffer_iterator_move_to__SWIG_1(&self->super, iter); }
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3439:178: error: ‘return’ with a value, in function returning void [-Werror]
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_sub_sub__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3556:12: error: implicit declaration of function ‘vbuffer_sub_sub__SWIG_0’ [-Werror=implicit-function-declaration]
return vbuffer_sub_sub__SWIG_0(self, offset, -1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3556:12: error: return makes pointer from integer without a cast [-Werror=int-conversion]
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_sub_pos__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3584:41: error: implicit declaration of function ‘vbuffer_sub_pos__SWIG_0’ [-Werror=implicit-function-declaration]
if (strcmp(pos, "begin") == 0) return vbuffer_sub_pos__SWIG_0(self, 0);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3584:41: error: return makes pointer from integer without a cast [-Werror=int-conversion]
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3585:44: error: return makes pointer from integer without a cast [-Werror=int-conversion]
else if (strcmp(pos, "end") == 0) return vbuffer_sub_pos__SWIG_0(self, -1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_pos__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3681:41: error: implicit declaration of function ‘vbuffer_pos__SWIG_0’ [-Werror=implicit-function-declaration]
if (strcmp(pos, "begin") == 0) return vbuffer_pos__SWIG_0(self, 0);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3681:41: error: return makes pointer from integer without a cast [-Werror=int-conversion]
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3682:44: error: return makes pointer from integer without a cast [-Werror=int-conversion]
else if (strcmp(pos, "end") == 0) return vbuffer_pos__SWIG_0(self, -1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_sub__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3706:12: error: implicit declaration of function ‘vbuffer_sub__SWIG_0’ [-Werror=implicit-function-declaration]
return vbuffer_sub__SWIG_0(self, offset, -1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3706:12: error: return makes pointer from integer without a cast [-Werror=int-conversion]
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘struct_vbuffer_sub__SWIG_2’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:3714:11: error: return makes pointer from integer without a cast [-Werror=int-conversion]
return vbuffer_sub__SWIG_0(self, 0, -1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_time___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:4864:3: error: implicit declaration of function ‘struct_time___getitem’ [-Werror=implicit-function-declaration]
struct_time___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_time___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:4903:3: error: implicit declaration of function ‘struct_time___setitem’ [-Werror=implicit-function-declaration]
struct_time___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator_mark’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:5162:3: error: implicit declaration of function ‘struct_vbuffer_iterator_mark’ [-Werror=implicit-function-declaration]
struct_vbuffer_iterator_mark(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator_unmark’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:5192:3: error: implicit declaration of function ‘struct_vbuffer_iterator_unmark’ [-Werror=implicit-function-declaration]
struct_vbuffer_iterator_unmark(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator_advance’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:5226:17: error: implicit declaration of function ‘struct_vbuffer_iterator_advance’ [-Werror=implicit-function-declaration]
result = (int)struct_vbuffer_iterator_advance(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator_available’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:5367:17: error: implicit declaration of function ‘struct_vbuffer_iterator_available’ [-Werror=implicit-function-declaration]
result = (int)struct_vbuffer_iterator_available(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator_split’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:5788:3: error: implicit declaration of function ‘struct_vbuffer_iterator_split’ [-Werror=implicit-function-declaration]
struct_vbuffer_iterator_split(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:5854:3: error: implicit declaration of function ‘struct_vbuffer_iterator___getitem’ [-Werror=implicit-function-declaration]
struct_vbuffer_iterator___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:5893:3: error: implicit declaration of function ‘struct_vbuffer_iterator___setitem’ [-Werror=implicit-function-declaration]
struct_vbuffer_iterator___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator_blocking_meter_set’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:6399:3: error: implicit declaration of function ‘struct_vbuffer_iterator_blocking_meter_set’ [-Werror=implicit-function-declaration]
struct_vbuffer_iterator_blocking_meter_set(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator_blocking_meter_get’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:6430:17: error: implicit declaration of function ‘struct_vbuffer_iterator_blocking_meter_get’ [-Werror=implicit-function-declaration]
result = (int)struct_vbuffer_iterator_blocking_meter_get(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator_blocking___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:6527:3: error: implicit declaration of function ‘struct_vbuffer_iterator_blocking___getitem’ [-Werror=implicit-function-declaration]
struct_vbuffer_iterator_blocking___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_iterator_blocking___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:6566:3: error: implicit declaration of function ‘struct_vbuffer_iterator_blocking___setitem’ [-Werror=implicit-function-declaration]
struct_vbuffer_iterator_blocking___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_sub_size’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:7029:17: error: implicit declaration of function ‘struct_vbuffer_sub_size’ [-Werror=implicit-function-declaration]
result = (int)struct_vbuffer_sub_size(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_sub_isflat’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:7172:18: error: implicit declaration of function ‘struct_vbuffer_sub_isflat’ [-Werror=implicit-function-declaration]
result = (bool)struct_vbuffer_sub_isflat(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_sub___getitem__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:7866:3: error: implicit declaration of function ‘struct_vbuffer_sub___getitem’ [-Werror=implicit-function-declaration]
struct_vbuffer_sub___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_sub___setitem__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:7959:3: error: implicit declaration of function ‘struct_vbuffer_sub___setitem’ [-Werror=implicit-function-declaration]
struct_vbuffer_sub___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer___getitem__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:8927:3: error: implicit declaration of function ‘struct_vbuffer___getitem’ [-Werror=implicit-function-declaration]
struct_vbuffer___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer___setitem__SWIG_1’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:9035:3: error: implicit declaration of function ‘struct_vbuffer___setitem’ [-Werror=implicit-function-declaration]
struct_vbuffer___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_stream_finish’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:9295:3: error: implicit declaration of function ‘struct_vbuffer_stream_finish’ [-Werror=implicit-function-declaration]
struct_vbuffer_stream_finish(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_stream___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:9497:3: error: implicit declaration of function ‘struct_vbuffer_stream___getitem’ [-Werror=implicit-function-declaration]
struct_vbuffer_stream___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_stream___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:9551:3: error: implicit declaration of function ‘struct_vbuffer_stream___setitem’ [-Werror=implicit-function-declaration]
struct_vbuffer_stream___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_sub_stream___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:9931:3: error: implicit declaration of function ‘struct_vbuffer_sub_stream___getitem’ [-Werror=implicit-function-declaration]
struct_vbuffer_sub_stream___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_vbuffer_sub_stream___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:9985:3: error: implicit declaration of function ‘struct_vbuffer_sub_stream___setitem’ [-Werror=implicit-function-declaration]
struct_vbuffer_sub_stream___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_packet_data_get’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:11089:12: error: implicit declaration of function ‘struct_packet_data_get’ [-Werror=implicit-function-declaration]
result = struct_packet_data_get(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:11089:10: error: incompatible types when assigning to type ‘struct lua_ref’ from type ‘int’
result = struct_packet_data_get(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_packet_drop’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:11505:3: error: implicit declaration of function ‘struct_packet_drop’ [-Werror=implicit-function-declaration]
struct_packet_drop(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_alert_node___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:11792:3: error: implicit declaration of function ‘struct_alert_node___getitem’ [-Werror=implicit-function-declaration]
struct_alert_node___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_alert_node___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:11831:3: error: implicit declaration of function ‘struct_alert_node___setitem’ [-Werror=implicit-function-declaration]
struct_alert_node___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_alert_id___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:11956:3: error: implicit declaration of function ‘struct_alert_id___getitem’ [-Werror=implicit-function-declaration]
struct_alert_id___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_alert_id___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:11995:3: error: implicit declaration of function ‘struct_alert_id___setitem’ [-Werror=implicit-function-declaration]
struct_alert_id___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_alert___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:12689:3: error: implicit declaration of function ‘struct_alert___getitem’ [-Werror=implicit-function-declaration]
struct_alert___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_alert___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:12728:3: error: implicit declaration of function ‘struct_alert___setitem’ [-Werror=implicit-function-declaration]
struct_alert___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_state___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:13101:3: error: implicit declaration of function ‘struct_state___getitem’ [-Werror=implicit-function-declaration]
struct_state___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_state___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:13140:3: error: implicit declaration of function ‘struct_state___setitem’ [-Werror=implicit-function-declaration]
struct_state___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_state_machine_initial_set’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:13350:3: error: implicit declaration of function ‘struct_state_machine_initial_set’ [-Werror=implicit-function-declaration]
struct_state_machine_initial_set(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_state_machine_initial_get’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:13381:28: error: implicit declaration of function ‘struct_state_machine_initial_get’ [-Werror=implicit-function-declaration]
result = (struct state *)struct_state_machine_initial_get(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:13381:12: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
result = (struct state *)struct_state_machine_initial_get(arg1);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_state_machine___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:13478:3: error: implicit declaration of function ‘struct_state_machine___getitem’ [-Werror=implicit-function-declaration]
struct_state_machine___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_state_machine___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:13517:3: error: implicit declaration of function ‘struct_state_machine___setitem’ [-Werror=implicit-function-declaration]
struct_state_machine___setitem(arg1,arg2,arg3);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_state_machine_instance___getitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:13799:3: error: implicit declaration of function ‘struct_state_machine_instance___getitem’ [-Werror=implicit-function-declaration]
struct_state_machine_instance___getitem(arg1,arg2);
^
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_state_machine_instance___setitem’:
/data/Security/sources/haka.git/make/lib/haka/lua/hakaLUA_wrap.c:13838:3: error: implicit declaration of function ‘struct_state_machine_instance___setitem’ [-Werror=implicit-function-declaration]
struct_state_machine_instance___setitem(arg1,arg2,arg3);
^
cc1: all warnings being treated as errors
lib/haka/CMakeFiles/libhaka.dir/build.make:965: recipe for target 'lib/haka/CMakeFiles/libhaka.dir/lua/hakaLUA_wrap.c.o' failed

i test this http://www.haka-security.org/blog/2014/04/10/defeating-nmap-scans.html,and happend problem

error lua:       /usr/share/haka/sample//ruleset/nmap.lua:4: attempt to call field 'disable_dissector' (a nil value)
fatal core:      thread initialization error

I'm using the latest git version of haka.

Config:

/etc/haka/haka.conf

[general]
configuration = "/usr/local/share/haka/sample/stats/stats.lua"

[packet]
module = "packet/pcap"

interfaces = "eth1"

[log]
module = "log/syslog"

[alert]
module = "alert/elasticsearch"

elasticsearch_server = "http://s100240.rz.babiel.com:9200"
geoip_database = "/usr/share/GeoIP/GeoIP.dat"

Added this on top of /usr/local/share/haka/sample/stats/stats.lua:

require('misc/hakabana').initialize{
elasticsearch = {
host = "127.0.0.1",
port = 9200,
},
geoip_data = '/usr/share/GeoIP/GeoIP.dat'
}

I'm using hakabana as the frontend; however "HTTP User-Agents" logs all sorts of bots, but not regular HTTP clients. To verify that it's not my setup, I've used ngrep to do: "ngrep -d eth1 -W byline Mozilla" and it shows lots of queries from Mozilla.

Hey i686 is still broken as the patch from bugreport #12 ( paulfariello/haka@6398e9f )

The patch works but is still not merged neither in develop nor in master since 1 year.

cheers
anthraxx

I would like to point out that identifiers like "_HAKA_LOG_H" and "_HAKA_PACKET_H" do not fit to the expected naming convention of the C language standard.
Would you like to adjust your selection for unique names?

Hi, on Arch Linux creating doc via 'make doc' fails, I have attached the log:
(PS: I had to replace sphinx-build with sphinx-build2 in build/FindSphinx.cmake)

No such file or directory: '../examples/specific/class/xml/index.xml

[...]
reading sources... [ 58%] doc/user/workshop/hellopacket
reading sources... [ 59%] doc/user/workshop/modif
reading sources... [ 60%] doc/user/workshop/smtp
reading sources... [ 61%] external/breathe/README
reading sources... [ 61%] external/breathe/testsuite/source/autoindex
reading sources... [ 62%] external/breathe/testsuite/source/class
reading sources... [ 63%] external/breathe/testsuite/source/codeguide
reading sources... [ 64%] external/breathe/testsuite/source/contributing
reading sources... [ 65%] external/breathe/testsuite/source/credits
reading sources... [ 66%] external/breathe/testsuite/source/customcss
reading sources... [ 66%] external/breathe/testsuite/source/define
reading sources... [ 67%] external/breathe/testsuite/source/directives
reading sources... [ 68%] external/breathe/testsuite/source/domains

Exception occurred:
  File "/usr/lib/python2.7/genericpath.py", line 62, in getmtime
    return os.stat(filename).st_mtime
OSError: [Errno 2] No such file or directory: '../examples/specific/class/xml/index.xml'
The full traceback has been saved in /tmp/sphinx-err-ogkT8g.log, if you want to report the issue to the developers.
Please also report this if it was a user error, so that a better error message can be provided next time.
A bug report can be filed in the tracker at <https://github.com/sphinx-doc/sphinx/issues>. Thanks!
doc/CMakeFiles/doc.dir/build.make:57: recipe for target 'doc/CMakeFiles/doc' failed
make[3]: *** [doc/CMakeFiles/doc] Error 1

this also happens on other places, like:

updating environment: 121 added, 0 changed, 0 removed
reading sources... [  0%] doc/developer/arch
reading sources... [  1%] doc/developer/build
reading sources... [  2%] doc/developer/contribute
reading sources... [  3%] doc/developer/devindex
reading sources... [  4%] doc/developer/devref
reading sources... [  4%] doc/developer/ref/alert

Exception occurred:
  File "/usr/lib/python2.7/genericpath.py", line 62, in getmtime
    return os.stat(filename).st_mtime
OSError: [Errno 2] No such file or directory: '/build/haka-git/src/haka-git/make/doc/xml/index.xml'

I started "hack-porting" haka to osx but gave up due to a lack of time.
If you could patch the sources to compile on osx i would highly appreciate that.

thanks

Running on a Kali Linux 2.0 Rolling distribution 32-bit. Installed all .deb packages with dpkg and resolved dependencies via apt.

Using the following commands:
# cd <install location>/share/haka/sample/gettingstarted/
# haka -c gettingstarted.conf

I get the following output.
fatal core: invalid section name

Comparing this configuration file with the default /etc/haka/haka.conf, I believe that the error is in the line
level = "warn,tcp_connection=error,ipv4=debug"

Building haka fails on OpenSUSE 13.2 due to two problems.

• function clear_error() in error.h is defined without any parameter. In src/haka/ctl.c line 125 there is a call of this function with parameter errno.
  This results in error:

haka_0.2.2_source/src/haka/ctl.c:125:3: error: call to function ‘clear_error’ without a real prototype [-Werror=unprototyped-calls]
   messagef(HAKA_LOG_DEBUG, MODULE, "failed to create thread: %s", clear_error(errno));
   ^
In file included from haka_0.2.2_source/src/haka/ctl.c:13:0:
haka_0.2.2_source/include/haka/error.h:43:13: note: ‘clear_error’ was declared here
 const char *clear_error();

Fix is to remove errno in the clear_error() function call

• function prepare_ctl_server() is defined without any parameter in src/haka/ctl.h.
  This results in error:

src/haka/haka.c:509:2: error: call to function ‘prepare_ctl_server’ without a real prototype [-Werror=unprototyped-calls]
  ret = prepare_ctl_server(ctl_file_path);
  ^
In file included from src/haka/haka.c:29:0:
src/haka/ctl.h:9:6: note: ‘prepare_ctl_server’ was declared here
 bool prepare_ctl_server();

Fix is to define the parameter in ctl.h

Hi,

I want to test the development of new dissector in Haka, so I tried to code a simple dissector in lua like the http dissector but for ssh.
Yet, it was a partial success because the -up and down seem to work (I see them when I test my code with a pcap in debug mode). But I don't know how and where my custom hooks can be called.

This is a part of my code

    if not stream.connection.data._ssh then
        local ssh = {}
        ssh.dissector = "ssh"
        ssh.next_dissector = nil
        ssh.valid = function (self)
            return self._tcp_stream:valid()
        end
        ssh.drop = function (self)
            return self._tcp_stream:drop()
        end
        ssh.forge = function (self)
            ssh._tcp_stream = nil
            return ssh._tcp_stream
        end

        ssh.connection = stream.connection
        stream.connection.data._ssh = ssh
    end

    local ssh = stream.connection.data._ssh
    ssh._tcp_stream = stream

}
return module


(Sorry for the formatting)

I supposed this code is like a squeleton of a dissector which use stream.

But my major issue is to execute a part of code only for the hook 'ssh-test' and how call him. So where i suppose to programm the ssh-test hook?

Thank you.

haka 0.3.0
hakabana 0.2.1
haka-elasticsearch 0.3.0

Hakabana.json download from https://raw.githubusercontent.com/haka-security/hakabana/develop/dashboard/Hakabana.json

Hello,

I'm running the following script with hakapcap over a pcap file of 5.5 GB (around 70000 flows).

local rem = require("regexp/pcre")
local tcp_connection = require('protocol/tcp_connection')
local http = require('protocol/http')
http.install_tcp_rule(80)
http.install_tcp_rule(8080)
haka.rule {
        hook = http.events.receive_data,
        options = {
        streamed = true,
        },
        eval = function (http, iter, dir)
        if http.request ~= nil then
                local split_uri = http.request.split_uri:normalize()
                if rem.re:match('^.*%.[^%%]+$', http.request.uri, rem.re.CASE_INSENSITIVE) then
                        local res, startpos, endpos = rem.re:match("([^%/.]+)$|([^%/]+)(%.[^%/.]+)$", split_uri.path, rem.re.CASE_INSENSITIVE)
                        filename = string.sub(split_uri.path,startpos+1,endpos)
                        local file = io.open("/root/work/download/" .. filename, "w")
                        for sub in iter:foreach_available() do
                                file:write(sub:asstring())
                        end
                        file:close()
                end
        end
end
}

I'm running it with gdb attached, so here is the backtrace.

root@System-U14LTS:~/work# gdb hakapcap
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from hakapcap...(no debugging symbols found)...done.
(gdb) run luascript/http-stream-streamed.lua pcap/serenity2.pcap > ser-gdb.out
Starting program: /usr/bin/hakapcap luascript/http-stream-streamed.lua pcap/serenity2.pcap > ser-gdb.out
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff79053d4 in vbuffer_restore () from /usr/lib/libhaka.so.0
(gdb) bt
#0  0x00007ffff79053d4 in vbuffer_restore () from /usr/lib/libhaka.so.0
#1  0x00007ffff790681d in vbuffer_sub_stream_chunk_free () from /usr/lib/libhaka.so.0
#2  0x00007ffff79061cf in vbuffer_stream_clear () from /usr/lib/libhaka.so.0
#3  0x00007ffff790ff19 in ?? () from /usr/lib/libhaka.so.0
#4  0x00007ffff790f9d0 in ?? () from /usr/lib/libhaka.so.0
#5  0x00007ffff79524bb in ?? () from /usr/lib/libhaka.so.0
#6  0x00007ffff7954899 in ?? () from /usr/lib/libhaka.so.0
#7  0x00007ffff7954986 in ?? () from /usr/lib/libhaka.so.0
#8  0x00007ffff7955520 in ?? () from /usr/lib/libhaka.so.0
#9  0x00007ffff7955a24 in ?? () from /usr/lib/libhaka.so.0
#10 0x00007ffff7940f02 in lua_pushstring () from /usr/lib/libhaka.so.0
#11 0x00007ffff7911b01 in ?? () from /usr/lib/libhaka.so.0
#12 0x00007ffff792a91a in lua_object_push () from /usr/lib/libhaka.so.0
#13 0x0000000000403dcd in ?? ()
#14 0x0000000000404724 in thread_pool_start ()
#15 0x0000000000403950 in start ()
#16 0x0000000000403241 in main ()
(gdb)

Could you please help me in finding if there is an error with the script that i'm using?
The machine where i'm running has 64GB of ram and the following ulimits.

root@System-U14LTS:~/work# ulimit -a
core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 515279
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1024
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time               (seconds, -t) unlimited
max user processes              (-u) 515279
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

Hi,

I am trying to install haka on CentOS 6 x86-64, I have installed all dependency and cmake seems to work correctly.

# cmake28 -DLUA=lua51 ..
-- The C compiler identification is GNU 4.4.7
-- Check for working C compiler: /usr/bin/gcc
-- Check for working C compiler: /usr/bin/gcc -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Build version: 0.1.0
-- Found Distrib: Redhat
-- Building configuration (BUILD): Release
-- Found SWIG: /usr/local/bin/swig (found suitable version "2.0.11", required is "2")
-- Installation prefix (PREFIX): /
-- Lua version (LUA): lua51
-- Found DL: /usr/lib64/libdl.so
-- Looking for include file pthread.h
-- Looking for include file pthread.h - found
-- Looking for pthread_create
-- Looking for pthread_create - not found.
-- Looking for pthread_create in pthreads
-- Looking for pthread_create in pthreads - not found
-- Looking for pthread_create in pthread
-- Looking for pthread_create in pthread - found
-- Found Threads: TRUE
-- Check if the system is big endian
-- Searching 16 bit integer
-- Looking for sys/types.h
-- Looking for sys/types.h - found
-- Looking for stdint.h
-- Looking for stdint.h - found
-- Looking for stddef.h
-- Looking for stddef.h - found
-- Check size of unsigned short
-- Check size of unsigned short - done
-- Using unsigned short
-- Check if the system is big endian - little endian
-- Check size of short
-- Check size of short - done
-- Check size of int
-- Check size of int - done
-- Check size of long
-- Check size of long - done
-- Check size of long long
-- Check size of long long - done
-- Found Sphinx: /usr/bin/sphinx-build
-- Found EDITLINE: /usr/lib64/libedit.so
-- Found CHECK: /usr/lib64/libcheck.so;rt;m
-- Found NETFILTERQUEUE: /usr/lib64/libnetfilter_queue.so
-- Found PCAP: /usr/lib64/libpcap.so
-- Performing Test NFQ_GET_PAYLOAD_UNSIGNED_CHAR
-- Performing Test NFQ_GET_PAYLOAD_UNSIGNED_CHAR - Success
-- Found Cppcheck: /usr/bin/cppcheck (found version "1.55")
-- Configuring done
-- Generating done
-- Build files have been written to: /usr/local/src/haka/haka_0.1.0/make

But when I compile the code with ' #make ', I get the following error:

[ 61%] Processing Swig source luadebug.i
Scanning dependencies of target libluadebug
[ 62%] Building C object lib/luadebug/CMakeFiles/libluadebug.dir/luadebugLUA_wrap.c.o
cc1: warnings being treated as errors
/usr/local/src/haka/haka_0.1.0/make/lib/luadebug/luadebugLUA_wrap.c: In function ‘lua_getpdebugger’:
/usr/local/src/haka/haka_0.1.0/make/lib/luadebug/luadebugLUA_wrap.c:1679: error: dereferencing pointer ‘dbg.43’ does break strict-aliasing rules
/usr/local/src/haka/haka_0.1.0/make/lib/luadebug/luadebugLUA_wrap.c:1672: error: dereferencing pointer ‘dbg.43’ does break strict-aliasing rules
/usr/local/src/haka/haka_0.1.0/make/lib/luadebug/luadebugLUA_wrap.c:1662: error: dereferencing pointer ‘dbg.43’ does break strict-aliasing rules
/usr/local/src/haka/haka_0.1.0/make/lib/luadebug/luadebugLUA_wrap.c:1880: note: initialized from here
make[2]: *** [lib/luadebug/CMakeFiles/libluadebug.dir/luadebugLUA_wrap.c.o] Error 1
make[1]: *** [lib/luadebug/CMakeFiles/libluadebug.dir/all] Error 2
make: *** [all] Error 2


Thank you for your time and consideration.

Hi, build is failing on an Arch Linux, removing -Werror from CMakeLists.txt works around the problem:

[ 30%] Building C object lib/haka/CMakeFiles/libhaka.dir/lua/hakaLUA_wrap.c.o
/build/haka-git/src/haka-git/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘vbuffer_iterator__insert’:
/build/haka-git/src/haka-git/make/lib/haka/lua/hakaLUA_wrap.c:3314:5: error: ‘return’ with no value, in function returning non-void [-Werror]
     return;
     ^
/build/haka-git/src/haka-git/make/lib/haka/lua/hakaLUA_wrap.c:3319:5: error: ‘return’ with no value, in function returning non-void [-Werror]
     return;
     ^
cc1: all warnings being treated as errors
lib/haka/CMakeFiles/libhaka.dir/build.make:1005: recipe for target 'lib/haka/CMakeFiles/libhaka.dir/lua/hakaLUA_wrap.c.o' failed
make[2]: *** [lib/haka/CMakeFiles/libhaka.dir/lua/hakaLUA_wrap.c.o] Error 1

haka.config
[general]

Select the haka configuration file to use.

configuration = "/etc/haka/test.lua"

Optionally select the number of thread to use. By default, all system thread

will be used.

#thread = 4

[packet]
#Select the capture model, nfqueue or pcap
module = "packet/pcap"

Select the interfaces to listen to

#interfaces = "eth0,eth1"
#interfaces = "any"
interfaces = "eth0,eth1"

Select packet dumping for nfqueue

dump = yes
dump_input = "/tmp/input.pcap"
dump_output = "/tmp/output.pcap"

[log]

Select the log module

module = "log/syslog"

Set the default logging level

#level = "info,packet=debug"

[alert]

Select the alert module

module = "alert/syslog"
#module = "alert/file"

Disable alert on standard output

#alert_on_stdout = no

alert/file module option

#file = "/dev/null"

test.lua
`local ipv4 = require("protocol/ipv4")
local tcp = require("protocol/tcp_connection")

local net = ipv4.network("2.2.2.2/32")

haka.rule{
hook = tcp.events.new_connection,
eval = function (flow, pkt)
haka.log("tcp connection %s:%i -> %s:%i",
flow.srcip, flow.srcport,
flow.dstip, flow.dstport)

    if net:contains(flow.dstip) then
        haka.alert{
            severity = "low",
            description = "connection refused",
            start_time = pkt.ip.raw.timestamp
        }
        flow:drop()
    end
end

}`

hakapcap test.lua /tmp/input.pcap
`root@server:/etc/haka# hakapcap test.lua /tmp/input.pcap
info core: load module 'packet/pcap.so', Pcap Module
info core: load module 'alert/file.so', File alert
info core: setting packet mode to pass-through

info core: loading rule file 'test.lua'
info core: initializing thread 0
info dissector: register new dissector 'raw'
info pcap: opening file '/tmp/input.pcap'
info dissector: register new dissector 'ipv4'
info dissector: register new dissector 'tcp'
info dissector: register new dissector 'tcp_connection'
info core: 1 rule(s) on event 'tcp_connection:new_connection'
info core: 1 rule(s) registered

info core: starting single threaded processing

alert: id = 1
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.5
service: tcp/22
}
targets = {
address: 10.211.55.2
service: tcp/56624
}
alert: id = 2
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.2
service: tcp/56624
}
targets = {
address: 10.211.55.5
service: tcp/22
}
alert: id = 3
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.5
service: tcp/22
}
targets = {
address: 10.211.55.2
service: tcp/56624
}
alert: id = 4
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.5
service: tcp/22
}
targets = {
address: 10.211.55.2
service: tcp/56624
}
alert: id = 5
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.2
service: tcp/56624
}
targets = {
address: 10.211.55.5
service: tcp/22
}
alert: id = 6
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.2
service: tcp/56624
}
targets = {
address: 10.211.55.5
service: tcp/22
}
alert: id = 7
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.5
service: tcp/22
}
targets = {
address: 10.211.55.2
service: tcp/56624
}
alert: id = 8
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.2
service: tcp/56624
}
targets = {
address: 10.211.55.5
service: tcp/22
}
alert: id = 9
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 2.2.2.2
service: tcp/22
}
targets = {
address: 10.211.55.2
service: tcp/60556
}
alert: id = 10
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.2
service: tcp/60556
}
targets = {
address: 2.2.2.2
service: tcp/22
}
alert: id = 11
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 2.2.2.2
service: tcp/22
}
targets = {
address: 10.211.55.2
service: tcp/60556
}
alert: id = 12
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.2
service: tcp/60556
}
targets = {
address: 2.2.2.2
service: tcp/22
}
alert: id = 13
time = Wed Aug 24 17:18:26 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 10.211.55.2
service: tcp/60556
}
targets = {
address: 2.2.2.2
service: tcp/22
}`

run this filter ok but my host can conn 2.2.2.2 . please help find where is problem.

Haka develop branch can't compile on Ubuntu14.04 due to python error.
I have to comment documentation in CMakeLists.txt in order to complete compilation.

This is error output :
" ...
Scanning dependencies of target doc
[ 5%] Generating user guide
Making output directory...
Running Sphinx v1.2.2
loading pickled environment... not yet created
building [html]: targets for 48 source files that are out of date
updating environment: 48 added, 0 changed, 0 removed
reading sources... [100%] modules/protocol/udp/doc/lua
looking for now-outdated files... none found
pickling environment... done
checking consistency... done
preparing documents... done
writing output... [ 6%] doc/developer/c/log_alert
Exception occurred:
File "/usr/lib/python2.7/dist-packages/sphinx/writers/html.py", line 155, in visit_desc_parameter
self.required_params_left -= 1
AttributeError: SmartyPantsHTMLTranslator instance has no attribute 'required_params_left'
The full traceback has been saved in /tmp/sphinx-err-NP_zMf.log, if you want to report the issue to the developers.
Please also report this if it was a user error, so that a better error message can be provided next time.
A bug report can be filed in the tracker at https://bitbucket.org/birkenfeld/sphinx/issues/. Thanks!
make[2]: *** [doc/CMakeFiles/doc] Erreur 1
make[1]: *** [doc/CMakeFiles/doc.dir/all] Erreur 2
make: *** [all] Erreur 2
"

Compiling v0.2.2 under Ubuntu 14.04.2 LTS (gcc v4.8.2) causes several compilation errors.

haka/lib/haka/state_machine.c: In function ‘state_machine_enter_state’:
haka/lib/haka/state_machine.c:410:7: error: format not a string literal and no format arguments [-Werror=format-security]
LOG_ERROR(MODULE, clear_error());
^
haka/lib/haka/state_machine.c:422:7: error: format not a string literal and no format arguments [-Werror=format-security]
LOG_ERROR(MODULE, clear_error());

Similarly there are issues in:

src/haka/app.c: 148, 162, 179
src/haka/thread.c: 251, 258, 267, 287, 296, 477, 492
src/haka/haka.c: 256, 297
src/haka/ctl.c: 100, 106, 345, 567
src/haka/hakapcap.c: 95
src/hakactl/commands.c: 195

Greetings everyone. Trying to compile Haka, I faced this:

glibc-2.24 (released Aug 5, 2016) has deprecated readdir_r and readdir64_r in favor of plain readdir and readdir64. The reasons are discussed on the updated manpage(3) and can be found on lwn as well.

From libc manual:

In POSIX.1-2008, readdir is not thread-safe. In the GNU C Library implementation, it is safe to call readdir concurrently on different dirstreams, but multiple threads accessing the same dirstream result in undefined behavior. readdir_r is a fully thread-safe alternative, but suffers from poor portability (see below). It is recommended that you use readdir, with external locking if multiple threads access the same dirstream.

I learned Haka during a practical workshop at RMLL in Montpellier. I use the virtual machine image at http://moutane.net/RMLL2014/day_4-0930-HAKA_Workshop-Live_ISO.iso to practice.

My first attempt of using a DNS dissector fails because the question section, both in queries and answers, appear to be empty. If I use these rules:

haka.rule{
    hook = dns.events.query,
    eval = function (dns, query)
        haka.log("DNS", "query %s", query.id)
        for _, qname in ipairs(query.question) do
            haka.log("DNS", "question")
        end
    end
}

haka.rule{
    hook = dns.events.response,
    eval = function (dns, response, query)
        haka.log("DNS", "response %s", query.id)
        for _, qname in ipairs(response.question) do
            haka.log("DNS", "question")
        end
        for _, qname in ipairs(response.answer) do
            haka.log("DNS", "answer")
        end
    end
}

I do get the log of the query and response, both with the ID. I also get, in the response, the answer. But nothing is logged for the question, whether in the query rule or in the response one.

After apply one rule in the haka, if haka could auto send out alarm to mail or cell phone, that's really perfect.

Just curious, is this project still active? If not, any recommendations for an alternative?

http://www.haka-security.org/hakabana.html says:
"Note: you may need to update elasticsearch setting in /usr/local/share/haka/hakabana/config.lua"
However, the correct path is: /usr/share/haka/hakabana/config.lua

I am a developer for the archassault project. We are working on getting haka and hakabana added to our repos for our users. I have been able to build the 0.2.1 version on x86 without an issue, however when I build the i686 version it has some issues. Both x86 and i686 are using the same dep versions.

Deps:
cmake 3.0.2
swig 3.0.2
wireshark-cli(provides tshark) 1.12.1-1
check 0.9.14
rsync 3.1.1
libpcap 1.6.2
gawk 4.1.1
libedit 20140620_3.1
pcre 8.36

Build logs on i686:

• The C compiler identification is GNU 4.9.1
  -- Check for working C compiler: /usr/bin/cc
  -- Check for working C compiler: /usr/bin/cc -- works
  -- Detecting C compiler ABI info
  -- Detecting C compiler ABI info - done
  -- Build system: Linux i686
  -- Build version: 0.2.1
  -- Build configuration (BUILD): Release
  -- Could NOT find LCov (missing: LCOV_EXECUTABLE)
  -- Found SWIG: /usr/bin/swig (found suitable version "3.0.2", minimum required is "2")
  -- Installation prefix (CMAKE_INSTALL_PREFIX): /usr
  -- Lua version (LUA): luajit
  -- Looking for include file pthread.h
  -- Looking for include file pthread.h - found
  -- Looking for pthread_create
  -- Looking for pthread_create - not found
  -- Looking for pthread_create in pthreads
  -- Looking for pthread_create in pthreads - not found
  -- Looking for pthread_create in pthread
  -- Looking for pthread_create in pthread - found
  -- Found Threads: TRUE
  -- Check if the system is big endian
  -- Searching 16 bit integer
  -- Looking for sys/types.h
  -- Looking for sys/types.h - found
  -- Looking for stdint.h
  -- Looking for stdint.h - found
  -- Looking for stddef.h
  -- Looking for stddef.h - found
  -- Check size of unsigned short
  -- Check size of unsigned short - done
  -- Using unsigned short
  -- Check if the system is big endian - little endian
  -- Check size of short
  -- Check size of short - done
  -- Check size of int
  -- Check size of int - done
  -- Check size of long
  -- Check size of long - done
  -- Check size of long long
  -- Check size of long long - done
  -- Could NOT find Sphinx (missing: SPHINX_EXECUTABLE)
  -- Found Doxygen: /usr/bin/doxygen (found version "1.8.8")
  Skipping documentation target (Sphinx and Doxygen not found)
  -- Found LibGeoIP: /usr/lib/libGeoIP.so
  CMake Warning (dev) at modules/CMakeLists.txt:34 (target_link_libraries):
  Policy CMP0023 is not set: Plain and keyword target_link_libraries
  signatures cannot be mixed. Run "cmake --help-policy CMP0023" for policy
  details. Use the cmake_policy command to set the policy and suppress this
  warning.

  The keyword signature for target_link_libraries has already been used with
  the target "geoip". All uses of target_link_libraries with a target should
  be either all-keyword or all-plain.

  The uses of the keyword signature are here:

  • modules/misc/geoip/CMakeLists.txt:19 (target_link_libraries)

Call Stack (most recent call first):
modules/misc/geoip/CMakeLists.txt:25 (INSTALL_MODULE)
This warning is for project developers. Use -Wno-dev to suppress it.

-- Found Jansson: /usr/lib/libjansson.so
-- Found LibCurl: /usr/lib/libcurl.so
-- Found LibUuid: /usr/lib/libuuid.so
-- Found PCRE: /usr/lib/libpcre.so
-- Found CHECK: /usr/lib/libcheck.so;rt;m
-- Found PCAP: /usr/lib/libpcap.so
-- Found NETFILTERQUEUE: /usr/lib/libnetfilter_queue.so
-- Performing Test NFQ_GET_PAYLOAD_UNSIGNED_CHAR
-- Performing Test NFQ_GET_PAYLOAD_UNSIGNED_CHAR - Success
-- Found DL: /usr/lib/libdl.so
-- Found EDITLINE: /usr/lib/libedit.so
-- Found Cppcheck: /usr/bin/cppcheck (found version "1.66")
-- Configuring done
CMake Warning (dev) in modules/misc/geoip/CMakeLists.txt:
Policy CMP0022 is not set: INTERFACE_LINK_LIBRARIES defines the link
interface. Run "cmake --help-policy CMP0022" for policy details. Use the
cmake_policy command to set the policy and suppress this warning.

Target "geoip" has an INTERFACE_LINK_LIBRARIES property which differs from
its LINK_INTERFACE_LIBRARIES properties.

INTERFACE_LINK_LIBRARIES:

libhaka

LINK_INTERFACE_LIBRARIES:

This warning is for project developers. Use -Wno-dev to suppress it.

-- Generating done
-- Build files have been written to: /build/haka/src/haka_0.2.1_source/make
Scanning dependencies of target luajit-sync
Scanning dependencies of target libiniparser
Scanning dependencies of target libhakactl
[ 0%] [ 1%] [ 1%] Building C object external/iniparser/CMakeFiles/libiniparser.dir/src/src/iniparser.c.o
Building C object external/iniparser/CMakeFiles/libiniparser.dir/src/src/dictionary.c.o
Building C object src/hakactl/CMakeFiles/libhakactl.dir/ctl_comm.c.o
[ 1%] Built target luajit-sync
Linking C static library liblibhakactl.a
Scanning dependencies of target luajit
[ 1%] Generating external/luajit/src/cmake.build
make[3]: warning: jobserver unavailable: using -j1. Add '+' to parent make rule.
[ 1%] Built target libhakactl
Linking C static library liblibiniparser.a
[ 1%] Built target libiniparser
make[3]: warning: jobserver unavailable: using -j1. Add '+' to parent make rule.
==== Building LuaJIT 2.0.3 ====
HOSTCC host/minilua.o
HOSTLINK host/minilua
DYNASM host/buildvm_arch.h
HOSTCC host/buildvm.o
HOSTCC host/buildvm_asm.o
HOSTCC host/buildvm_peobj.o
HOSTCC host/buildvm_lib.o
HOSTCC host/buildvm_fold.o
HOSTLINK host/buildvm
BUILDVM lj_vm.s
ASM lj_vm.o
CC lj_gc.o
BUILDVM lj_ffdef.h
CC lj_err.o
CC lj_char.o
BUILDVM lj_bcdef.h
CC lj_bc.o
CC lj_obj.o
CC lj_str.o
CC lj_tab.o
CC lj_func.o
CC lj_udata.o
CC lj_meta.o
CC lj_debug.o
CC lj_state.o
CC lj_dispatch.o
CC lj_vmevent.o
CC lj_vmmath.o
CC lj_strscan.o
CC lj_api.o
CC lj_lex.o
CC lj_parse.o
CC lj_bcread.o
CC lj_bcwrite.o
CC lj_load.o
CC lj_ir.o
CC lj_opt_mem.o
BUILDVM lj_folddef.h
CC lj_opt_fold.o
CC lj_opt_narrow.o
CC lj_opt_dce.o
CC lj_opt_loop.o
CC lj_opt_split.o
CC lj_opt_sink.o
CC lj_mcode.o
CC lj_snap.o
CC lj_record.o
CC lj_crecord.o
BUILDVM lj_recdef.h
CC lj_ffrecord.o
CC lj_asm.o
CC lj_trace.o
CC lj_gdbjit.o
CC lj_ctype.o
CC lj_cdata.o
CC lj_cconv.o
CC lj_ccall.o
CC lj_ccallback.o
CC lj_carith.o
CC lj_clib.o
CC lj_cparse.o
CC lj_lib.o
CC lj_alloc.o
CC lib_aux.o
BUILDVM lj_libdef.h
CC lib_base.o
CC lib_math.o
CC lib_bit.o
CC lib_string.o
CC lib_table.o
CC lib_io.o
CC lib_os.o
CC lib_package.o
CC lib_debug.o
CC lib_jit.o
CC lib_ffi.o
CC lib_init.o
AR libluajit.a
CC luajit.o
BUILDVM jit/vmdef.lua
LINK luajit
OK Successfully built LuaJIT
==== Successfully built LuaJIT 2.0.3 ====
make[3]: warning: jobserver unavailable: using -j1. Add '+' to parent make rule.
==== Installing LuaJIT 2.0.3 to /usr/share/haka/lua ====
==== Successfully installed LuaJIT 2.0.3 to /usr/share/haka/lua ====
[ 1%] Built target luajit
Scanning dependencies of target tcp-console
Scanning dependencies of target hakactl-lua
Scanning dependencies of target luaunit
[ 2%] Scanning dependencies of target haka-lua-1
Scanning dependencies of target dns
Scanning dependencies of target tcp_connection
Scanning dependencies of target http
[ 4%] [ 4%] Processing Swig source luadebug/luadebug.i
[ 5%] [ 6%] [ 7%] [ 8%] Building Lua file tcp_console.lua
[ 9%] Building Lua file lua/thread.lua
Building Lua file src/luaunit.lua
Building Lua file dns.lua
Building Lua file lua/interactive.lua
Building Lua file tcp_connection.lua
Building Lua file http.lua
[ 9%] [ 9%] [ 9%] Built target tcp-console
[ 9%] Built target luaunit
[ 9%] Building Lua file lua/event.lua
[ 9%] Built target dns
[ 10%] [ 11%] Built target haka-lua-1
[ 11%] Built target tcp_connection
[ 12%] Processing Swig source lua/hakainit.i
Building Lua file http_utils.lua
Processing Swig source lua/haka.i
[ 13%] Processing Swig source lua/swig.i
Scanning dependencies of target icmp
Building Lua file lua/rule.lua
Scanning dependencies of target udp
[ 13%] [ 14%] Built target http
[ 15%] [ 16%] Building Lua file icmp.lua
Building Lua file udp.lua
Building Lua file lua/misc.lua
Scanning dependencies of target udp-console
[ 16%] Built target icmp
[ 17%] [ 17%] [ 17%] Built target udp
Built target hakactl-lua
Building Lua file udp_console.lua
Scanning dependencies of target udp_connection
Scanning dependencies of target ipv4lua
Scanning dependencies of target libhakalua
[ 18%] [ 18%] [ 18%] Built target udp-console
[ 19%] Building Lua file udp_connection.lua
[ 20%] Building Lua file ipv4lua.lua
Building Lua file lua/lua/color.lua
Building Lua file lua/lua/class.lua
[ 21%] [ 21%] Building Lua file lua/lua/events.lua
Built target udp_connection
[ 21%] [ 21%] [ 22%] Built target ipv4lua
Scanning dependencies of target haka-lua
[ 23%] [ 24%] Building Lua file lua/lua/context.lua
Building Lua file lua/lua/parse.lua
Building Lua file lua/lua/parse_result.lua
Building Lua file lua/lua/grammar.lua
[ 25%] [ 25%] [ 25%] Building Lua file lua/rule.lua
[ 26%] Building Lua file lua/rule_group.lua
[ 27%] [ 28%] Building Lua file lua/lua/grammar_dg.lua
Building Lua file lua/lua/state_machine.lua
Building Lua file lua/lua/state.lua
[ 28%] Building Lua file lua/lua/utils.lua
[ 28%] Built target haka-lua
[ 29%] Building Lua file lua/lua/dissector.lua
[ 30%] Building Lua file lua/lua/list.lua
Building Lua file lua/lua/check.lua
[ 30%] Built target libhakalua
Scanning dependencies of target libhaka
[ 31%] [ 31%] [ 32%] [ 35%] [ 35%] [ 35%] [ 36%] [ 37%] Building C object lib/haka/CMakeFiles/libhaka.dir/packet.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/log.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/alert_module.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/error.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/log_module.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/debug.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/module.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/alert.c.o
[ 37%] Building C object lib/haka/CMakeFiles/libhaka.dir/thread.c.o
[ 38%] [ 39%] Building C object lib/haka/CMakeFiles/libhaka.dir/parameters.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/colors.c.o
[ 40%] Building C object lib/haka/CMakeFiles/libhaka.dir/time.c.o
[ 40%] Building C object lib/haka/CMakeFiles/libhaka.dir/timer.c.o
[ 41%] Building C object lib/haka/CMakeFiles/libhaka.dir/state_machine.c.o
[ 42%] Building C object lib/haka/CMakeFiles/libhaka.dir/vbuffer.c.o
[ 43%] Building C object lib/haka/CMakeFiles/libhaka.dir/vbuffer_data.c.o
[ 43%] Building C object lib/haka/CMakeFiles/libhaka.dir/vbuffer_stream.c.o
[ 44%] Building C object lib/haka/CMakeFiles/libhaka.dir/vbuffer_sub_stream.c.o
[ 45%] [ 46%] Building C object lib/haka/CMakeFiles/libhaka.dir/system.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/regexp_module.c.o
[ 46%] [ 47%] Building C object lib/haka/CMakeFiles/libhaka.dir/engine.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/container/list.c.o
[ 48%] Building C object lib/haka/CMakeFiles/libhaka.dir/container/list2.c.o
[ 49%] Building C object lib/haka/CMakeFiles/libhaka.dir/container/vector.c.o
[ 49%] Building C object lib/haka/CMakeFiles/libhaka.dir/lua/state.c.o
[ 50%] [ 51%] Building C object lib/haka/CMakeFiles/libhaka.dir/lua/ref.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/lua/lua.c.o
[ 52%] Building C object lib/haka/CMakeFiles/libhaka.dir/lua/marshal.c.o
[ 52%] Building C object lib/haka/CMakeFiles/libhaka.dir/luadebug/interactive.c.o
[ 53%] Building C object lib/haka/CMakeFiles/libhaka.dir/luadebug/complete.c.o
[ 54%] Building C object lib/haka/CMakeFiles/libhaka.dir/luadebug/debugger.c.o
[ 55%] Building C object lib/haka/CMakeFiles/libhaka.dir/luadebug/utils.c.o
[ 55%] Building C object lib/haka/CMakeFiles/libhaka.dir/luadebug/user.c.o
[ 56%] Building C object lib/haka/CMakeFiles/libhaka.dir/luadebug/user_readline.c.o
[ 57%] Building C object lib/haka/CMakeFiles/libhaka.dir/luadebug/user_remote.c.o
[ 57%] [ 58%] Building C object lib/haka/CMakeFiles/libhaka.dir/lua/hakainitLUA_wrap.c.o
Building C object lib/haka/CMakeFiles/libhaka.dir/lua/hakaLUA_wrap.c.o
[ 59%] Building C object lib/haka/CMakeFiles/libhaka.dir/lua/swigLUA_wrap.c.o
[ 60%] Building C object lib/haka/CMakeFiles/libhaka.dir/luadebug/luadebugLUA_wrap.c.o
[ 60%] Building C object lib/haka/CMakeFiles/libhaka.dir///external/lmarshal/lmarshal.c.o
Linking C shared library libhaka.so
[ 60%] Built target libhaka
[ 61%] [ 62%] [ 63%] Processing Swig source lua/hakactl.i
[ 64%] Processing Swig source raw.i
[ 64%] Processing Swig source pcre.i
Scanning dependencies of target libelasticsearch
Processing Swig source geoip.i
Scanning dependencies of target packet-pcap
Scanning dependencies of target haka-common
Processing Swig source ipv4.i
[ 65%] [ 65%] [ 67%] Building C object modules/misc/elasticsearch/CMakeFiles/libelasticsearch.dir/elasticsearch.c.o
Building C object modules/packet/pcap/CMakeFiles/packet-pcap.dir/main.c.o
Building C object src/haka/CMakeFiles/haka-common.dir/app.c.o
Scanning dependencies of target hakactl
Scanning dependencies of target pcre
Scanning dependencies of target geoip
Scanning dependencies of target raw
[ 68%] [ 69%] [ 69%] Building C object src/hakactl/CMakeFiles/hakactl.dir/hakactl.c.o
[ 70%] Building C object modules/regexp/pcre/CMakeFiles/pcre.dir/main.c.o
Building C object modules/misc/geoip/CMakeFiles/geoip.dir/main.c.o
Building C object modules/protocol/raw/CMakeFiles/raw.dir/rawLUA_wrap.c.o
[ 71%] Building C object modules/misc/geoip/CMakeFiles/geoip.dir/geoip.c.o
[ 72%] Building C object src/haka/CMakeFiles/haka-common.dir/thread.c.o
Scanning dependencies of target ipv4
[ 73%] Building C object modules/protocol/ipv4/CMakeFiles/ipv4.dir/ipv4LUA_wrap.c.o
[ 74%] Building C object modules/misc/geoip/CMakeFiles/geoip.dir/geoipLUA_wrap.c.o
[ 74%] Building C object src/hakactl/CMakeFiles/hakactl.dir/commands.c.o
[ 74%] Building C object modules/regexp/pcre/CMakeFiles/pcre.dir/pcreLUA_wrap.c.o
[ 75%] Building C object modules/packet/pcap/CMakeFiles/packet-pcap.dir/pcap.c.o
[ 76%] Building C object modules/misc/elasticsearch/CMakeFiles/libelasticsearch.dir/json.c.o
[ 77%] Building C object src/hakactl/CMakeFiles/hakactl.dir/console.c.o
Linking C static library libhaka-common.a
Linking C shared library pcap.so
Linking C shared library libelasticsearch.so
[ 77%] Built target packet-pcap
Scanning dependencies of target packet-nfqueue
[ 78%] Building C object modules/packet/nfqueue/CMakeFiles/packet-nfqueue.dir/main.c.o
[ 78%] Built target libelasticsearch
[ 79%] [ 80%] Building C object modules/protocol/ipv4/CMakeFiles/ipv4.dir/main.c.o
Building C object src/hakactl/CMakeFiles/hakactl.dir/lua/hakactlLUA_wrap.c.o
[ 88%] Built target packet-nfqueue
[ 88%] Built target alert-file
Scanning dependencies of target libhaka-vbuffer
Linking C shared module syslog.so
Scanning dependencies of target libhaka-vbuffer-stream
[ 89%] Scanning dependencies of target haka
Building C object lib/haka/test/CMakeFiles/libhaka-vbuffer.dir/vbuffer.c.o
[ 90%] [ 91%] Building C object lib/haka/test/CMakeFiles/libhaka-vbuffer-stream.dir/vbuffer_stream.c.o
Building C object src/haka/CMakeFiles/haka.dir/haka.c.o
[ 91%] Built target alert-syslog
Linking C executable hakactl
Scanning dependencies of target hakapcap
[ 91%] Building C object src/haka/CMakeFiles/hakapcap.dir/hakapcap.c.o
../../lib/haka/libhaka.so.0.2.1: undefined reference to sinh' ../../lib/haka/libhaka.so.0.2.1: undefined reference totanh'
../../lib/haka/libhaka.so.0.2.1: undefined reference to cosh' collect2: error: ld returned 1 exit status src/hakactl/CMakeFiles/hakactl.dir/build.make:171: recipe for target 'src/hakactl/hakactl' failed make[2]: *** [src/hakactl/hakactl] Error 1 CMakeFiles/Makefile2:761: recipe for target 'src/hakactl/CMakeFiles/hakactl.dir/all' failed make[1]: *** [src/hakactl/CMakeFiles/hakactl.dir/all] Error 2 make[1]: *** Waiting for unfinished jobs.... [ 91%] Building C object src/haka/CMakeFiles/haka.dir/ctl.c.o Linking C executable hakapcap ../../lib/haka/libhaka.so.0.2.1: undefined reference tosinh'
../../lib/haka/libhaka.so.0.2.1: undefined reference to tanh' ../../lib/haka/libhaka.so.0.2.1: undefined reference tocosh'
collect2: error: ld returned 1 exit status
src/haka/CMakeFiles/hakapcap.dir/build.make:87: recipe for target 'src/haka/hakapcap' failed
make[2]: *** [src/haka/hakapcap] Error 1
CMakeFiles/Makefile2:660: recipe for target 'src/haka/CMakeFiles/hakapcap.dir/all' failed
make[1]: *** [src/haka/CMakeFiles/hakapcap.dir/all] Error 2
Linking C executable libhaka-vbuffer-stream
[ 91%] Built target libhaka-vbuffer-stream
Linking C executable haka
../../lib/haka/libhaka.so.0.2.1: undefined reference to sinh' ../../lib/haka/libhaka.so.0.2.1: undefined reference totanh'
../../lib/haka/libhaka.so.0.2.1: undefined reference to `cosh'
collect2: error: ld returned 1 exit status
src/haka/CMakeFiles/haka.dir/build.make:113: recipe for target 'src/haka/haka' failed
make[2]: *** [src/haka/haka] Error 1
CMakeFiles/Makefile2:518: recipe for target 'src/haka/CMakeFiles/haka.dir/all' failed
make[1]: *** [src/haka/CMakeFiles/haka.dir/all] Error 2
Linking C executable libhaka-regexp-pcre
Linking C executable libhaka-vbuffer
[ 91%] Built target libhaka-regexp-pcre
[ 91%] Built target libhaka-vbuffer
Linking C shared library ipv4.so
[ 91%] Built target ipv4
Makefile:147: recipe for target 'all' failed
make: *** [all] Error 2

I'm going to dig into the code a bit more to see if I can find an issue. I just was curious if you have tried to build it on Archlinux or if you have any insight as to why it might be failing.

I'm getting below error when I do compile haka on Centos 6. Is there any rpm package available for Centos ?. If so, please share the file, that would be so helpful for installing haka.

[ 31%] Building C object lib/haka/CMakeFiles/libhaka.dir/lua/hakainitLUA_wrap.c.o
[ 32%] Building C object lib/haka/CMakeFiles/libhaka.dir/lua/hakaLUA_wrap.c.o
cc1: warnings being treated as errors
/root/SETUP/haka/make/lib/haka/lua/hakaLUA_wrap.c: In function ‘_wrap_alert_method_ref_set’:
/root/SETUP/haka/make/lib/haka/lua/hakaLUA_wrap.c:2461: error: dereferencing pointer ‘arg1.998’ does break strict-aliasing rules
/root/SETUP/haka/make/lib/haka/lua/hakaLUA_wrap.c:2471: error: dereferencing pointer ‘arg1.998’ does break strict-aliasing rules
/root/SETUP/haka/make/lib/haka/lua/hakaLUA_wrap.c:2478: error: dereferencing pointer ‘arg1.998’ does break strict-aliasing rules
/root/SETUP/haka/make/lib/haka/lua/hakaLUA_wrap.c:12380: note: initialized from here
make[2]: *** [lib/haka/CMakeFiles/libhaka.dir/lua/hakaLUA_wrap.c.o] Error 1
make[1]: *** [lib/haka/CMakeFiles/libhaka.dir/all] Error 2
make: *** [all] Error 2

Hi,

I just wanted to make note of this CMake warning:
Also the build instructions should include 'geoip-devel' on the list of packages for Fedora.

-- Found LibGeoIP: /usr/lib64/libGeoIP.so
CMake Warning (dev) at modules/CMakeLists.txt:34 (target_link_libraries):
Policy CMP0023 is not set: Plain and keyword target_link_libraries
signatures cannot be mixed. Run "cmake --help-policy CMP0023" for policy
details. Use the cmake_policy command to set the policy and suppress this
warning.

The keyword signature for target_link_libraries has already been used with
the target "geoip". All uses of target_link_libraries with a target should
be either all-keyword or all-plain.

The uses of the keyword signature are here:

• modules/misc/geoip/CMakeLists.txt:19 (target_link_libraries)

Call Stack (most recent call first):
modules/misc/geoip/CMakeLists.txt:25 (INSTALL_MODULE)
This warning is for project developers. Use -Wno-dev to suppress it.

[edward@tinypuppy workspace]$ cmake --help-policy CMP0023

CMP0023

Plain and keyword target_link_libraries signatures cannot be mixed.

CMake 2.8.12 introduced the target_link_libraries signature using the
PUBLIC, PRIVATE, and INTERFACE keywords to generalize the LINK_PUBLIC
and LINK_PRIVATE keywords introduced in CMake 2.8.7. Use of
signatures with any of these keywords sets the link interface of a
target explicitly, even if empty. This produces confusing behavior
when used in combination with the historical behavior of the plain
target_link_libraries signature. For example, consider the code:

::

target_link_libraries(mylib A)
target_link_libraries(mylib PRIVATE B)

After the first line the link interface has not been set explicitly so
CMake would use the link implementation, A, as the link interface.
However, the second line sets the link interface to empty. In order
to avoid this subtle behavior CMake now prefers to disallow mixing the
plain and keyword signatures of target_link_libraries for a single
target.

The OLD behavior for this policy is to allow keyword and plain
target_link_libraries signatures to be mixed. The NEW behavior for
this policy is to not to allow mixing of the keyword and plain
signatures.

This policy was introduced in CMake version 2.8.12. CMake version
3.0.2 warns when the policy is not set and uses OLD behavior. Use
the cmake_policy command to set it to OLD or NEW explicitly.

Kind Regards,
Edward

Some parameters (like "${CMAKE_BINARY_DIR}" and "${DOXYGEN_EXECUTABLE}") are passed to CMake commands in your build scripts without enclosing them by quotation marks. I see that these places will result in build difficulties if the contents of the used variables will contain special characters like semicolons.

I would recommend to apply advices from a wiki article.