Initial support for LLMNR

[defensivedepth]

Proposed changes

Adds support for Canary LLMNR. Uses Scapy to broadcast a LLMNR query for canary hostname. If it receives a LLMNR response, it confirms that it was for the canary hostname and then logs the event. The following is configurable:

• LLMNR Port (TCP/5355 by default)
• Canary LLMNR Hostame
• How often to broadcast the LLMNR query (in seconds)
• Splay time to add randomness to the broadcast (in seconds)

Sample log output, generated by using Responder to poison LLMNR request:

{"dst_host": "0.0.0.0", "dst_port": 5355, "local_time": "2024-01-20 21:41:58.716469", "local_time_adjusted": "2024-01-20 21:41:58.716499", "logdata": {"query_hostname": "DC03", "response": "DNS Ans \"10.0.0.22\" "}, "logtype": 19001, "node_id": "opencanary-1", "src_host": "192.168.16.27", "src_port": 5355, "utc_time": "2024-01-20 21:41:58.716495"}

Discussion: #335

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation Update

Checklist

I will add docs once it's confirmed that this PR will be accepted.

• Lint and unit tests pass locally with my changes (if applicable)
• I have run pre-commit (pre-commit in the repo)
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)
• Linked to the relevant github issue or github discussion

Further comments

N/A

[defensivedepth]

Anything I can do to help move this along?

[theidiotyouyellat]

@jayjb any luck in getting this included?

[jayjb]

Hi @defensivedepth, @theidiotyouyellat,

Sorry for the delay with this. We like the idea, we don't love the dependency on Scapy though (its quite a heavy dependency for what we using it for). Im trying to figure a way we can craft those Queries without it. If not, I'll likely accept this for now while we improve it.

[defensivedepth]

@jayjb Thanks for the feedback. The Scapy dep is not new - the SNMP module already requires it. What specifically is the concern?

[mclmax]

hey @defensivedepth and @theidiotyouyellat, taking a look. hit you back shortly

[mclmax]

Thanks @defensivedepth, the code looks great! Sorry about the delay here getting our feedback. We'd love to have this in. I've just left a request for a small change to how we handle the import and we should be good to go!

[defensivedepth]

I resolved the change request, thanks!

[mclmax]

awesome, thanks @defensivedepth! merged

[mclmax]

Now it's merged ;)