Changeset 1226

Timestamp:

04/21/07 00:46:03 (1 year ago)

Author:

till

Message:

samples are stored in postgres db

Files:

• honeytrap/trunk/src/attack.c (modified) (6 diffs)
• honeytrap/trunk/src/attack.h (modified) (1 diff)
• honeytrap/trunk/src/modules/Makefile.am (modified) (3 diffs)
• honeytrap/trunk/src/modules/htm_aSavePostgres.c (modified) (8 diffs)
• honeytrap/trunk/src/modules/htm_ftpDownload.c (modified) (2 diffs)
• honeytrap/trunk/src/plughook.c (modified) (3 diffs)
• honeytrap/trunk/src/plughook.h (modified) (1 diff)

honeytrap/trunk/src/attack.c

@@ -48 +48 @@
-        a->a_conn.protocol      = proto;
-        a->dl_count             = 0;
-//      memset(a->download, 0, sizeof(struct s_download));
-        a->download             = NULL;
-        if (time(&(a->start_time)) == ((time_t)-1)) 
@@ -79 +78 @@
-        memcpy(a->a_conn.payload.sha512sum, mem_sha512sum(a->a_conn.payload.data, a->a_conn.payload.size), 129);
-        memcpy(a->a_conn.payload.md5sum, mem_md5sum(a->a_conn.payload.data, a->a_conn.payload.size), 33);
+
-        /* mirror string */
-        a->p_conn.payload.size = p_size;
@@ -101 +101 @@
-        /* call plugins */
-        /* do calls even if no data received, i.e. to update connection statistics */
-*
-*
-*
-*
+
+
+
+
-
-        return(1);
@@ -110 +110 @@
-
-/* add a downloaded file to the attack instance */
-
+u_int16_t proto, 
-        if ((data == NULL) || (!size))  return(0);
-
@@ -118 +118 @@
-        }
-
-a->dl_count + 1
+sizeof(struct s_download) * (a->dl_count + 1)
-                logmsg(LOG_ERR, 1, "Error - Unable to allocate memory: %s.\n", strerror(errno));
-                return(-1);
@@ -140 +140 @@
-        memcpy(a->download[a->dl_count].dl_payload.sha512sum, mem_sha512sum(a->download->dl_payload.data, size), 129);
-
+        a->download[a->dl_count].protocol               = proto;
-        a->download[a->dl_count].dl_payload.size        = size;
-        a->download[a->dl_count].r_addr                 = r_addr;

honeytrap/trunk/src/attack.h

@@ -57 +57 @@
-Attack *new_attack(struct in_addr l_addr, struct in_addr r_addr, uint16_t l_port, uint16_t r_port, uint16_t proto);
-int process_data(u_char *a_data, uint32_t a_size, u_char *p_data, uint32_t p_size, uint16_t port, Attack *a);
-
+u_int16_t proto, 
-
-#endif

honeytrap/trunk/src/modules/Makefile.am

@@ -2 +2 @@
-
-AM_YFLAGS = -d
+
+AM_CFLAGS=-Wall -Werror
-
-INCLUDES = -I../
@@ -7 +9 @@
-libdir=$(DESTDIR)/$(sysconfdir)/honeytrap/plugins
-
-
+ htm_aSavePostgres.la
-
-htm_aSaveFile_la_SOURCES = htm_aSaveFile.c htm_aSaveFile.h
@@ -27 +29 @@
-htm_SpamSum_la_LDFLAGS = -module -no-undefined -avoid-version
-
+htm_aSavePostgres_la_SOURCES = htm_aSavePostgres.c htm_aSavePostgres.h
+htm_aSavePostgres_la_LDFLAGS = -module -no-undefined -avoid-version -lpq
+
-install-exec-am:
-        $(mkinstalldirs) $(DESTDIR)/$(sysconfdir)/honeytrap/plugins

honeytrap/trunk/src/modules/htm_aSavePostgres.c

@@ -34 +34 @@
-#include <plughook.h>
-#include <md5.h>
+#include <sha512.h>
-
-#include "htm_aSavePostgres.h"
@@ -100 +101 @@
-        }
-        logmsg(LOG_DEBUG, 1, "(Build URL): Typ: %s.\n",download->dl_type);
-3
+4
-
-        if(strlen(download->user)) {
-                logmsg(LOG_NOISY,1,"(Build URL): User: %s Pass: %s.\n", download->user, download->pass);
-2
+3
-        }
-
@@ -112 +113 @@
-        if (download->r_port) {
-                logmsg(LOG_NOISY, 1, "(Build URL): Port: %d.\n", download->r_port);
-6
+7
-                strcat(url + strlen(url), PROTO(download->protocol));
-        }
@@ -118 +119 @@
-        if (download->filename) {
-                logmsg(LOG_NOISY, 1, "(Build URL): Filename: %s.\n", download->filename);
-1
+2
-        }
-
@@ -178 +179 @@
-                        return(-1);
-                }
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-                        logmsg(LOG_ERR, 1, "Error - Could not save attack: SQL query exceeds maximum size (increase MAX_SQL_BUFFER and recompile).\n");
-                                free(url);
@@ -229 +235 @@
-                strftime(endtime, 40, "%Y-%m-%d %T %Z", localtime(&attack->end_time));
-
+
+/* FIXME: link samples to attacks */
+/*
-                if(attack->dl_count) {
-                        if (snprintf(query, MAX_SQL_BUFFER,
@@ -252 +261 @@
-                                }
-                } else {
+*/
-                        if (snprintf(query, MAX_SQL_BUFFER,
-                                "SELECT attacks.honeytrap_add_attack_string('%s'::varchar, %d::integer, '%s'::timestamptz, '%s'::timestamptz, " \
@@ -273 +283 @@
-                                        return(-1);
-                                }
-
+//
-
-                if (PQresultStatus(res = PQexec(db_connection, query)) != PGRES_TUPLES_OK) {

honeytrap/trunk/src/modules/htm_ftpDownload.c

@@ -71 +71 @@
-                        addr = (struct in_addr *) &(attack->a_conn.l_addr);
-                        get_ftpcmd(string_for_processing, attack->a_conn.payload.size, *addr,attack);
+                        return(0);
-                }
-        }
@@ -587 +588 @@
-                        }
-                        close(dumpfile_fd);
+
+                        /* add download struct to attack struct*/
+                        logmsg(LOG_DEBUG, 1, "(htm_ftp) Adding download to attack struct.\n");
+                        add_download("ftp", 6, rhost->s_addr, port, user, pass, (const char *) save_file, binary_stream, total_bytes, attack);
+
-                        logmsg(LOG_NOTICE, 1, "FTP download - %s saved.\n", save_file);
-                } else logmsg(LOG_NOISY, 1, "FTP download - No data received.\n");
-
-                /* add download struct to attack struct*/
-                logmsg(LOG_DEBUG, 1, "(htm_ftp) Adding download to attack struct.\n");
-                add_download("ftp", rhost->s_addr, port, user, pass, (const char *) save_file, binary_stream, total_bytes, attack);
-//              return(0);
-                close(data_sock_fd);
+printf("---> returning.\n");
+                return(0);
-        } else logmsg(LOG_DEBUG, 1, "FTP download - Select on FTP data channel returned but socket is not set: %s\n", strerror(errno));
-        

honeytrap/trunk/src/plughook.c

@@ -93 +93 @@
-
-
-
+*
-        PlugFuncList *func_tmp = NULL;
-
@@ -107 +107 @@
-                if (func_tmp->func) {
-                        logmsg(LOG_DEBUG, 1, "Calling %s::%s().\n", func_tmp->plugnam, func_tmp->funcnam);
-&
+
-                } else logmsg(LOG_ERR, 1, "Error - Function %s::%s is not registered.\n",
-                        func_tmp->plugnam, func_tmp->funcnam);
@@ -146 +146 @@
-
-        logmsg(LOG_DEBUG, 1, "Calling plugins for hook 'unload_plugins'.\n");
-
-/*
-        if (funclist_process_attack == NULL) {
-                logmsg(LOG_DEBUG, 1, "No plugins registered for hook 'unload_plugins'.\n");
-                return;
-        }
-*/
-
-        func_tmp = funclist_unload_plugins;

honeytrap/trunk/src/plughook.h

@@ -41 +41 @@
-
-PlugFuncList *add_attack_func_to_list(const func_prio priority, const char *plugname, const char *funcname, int (*func)(struct s_attack));
-
+*
-
-PlugFuncList *add_unload_func_to_list(const char *plugname, const char *funcname, void (*func)(void));