Changeset 1249

Timestamp:

05/02/07 21:50:56 (1 year ago)

Author:

till

Message:

make plugins optional in autotools build process

Files:

• honeytrap/trunk/ChangeLog (modified) (2 diffs)
• honeytrap/trunk/INSTALL (modified) (1 diff)
• honeytrap/trunk/configure.in (modified) (3 diffs)
• honeytrap/trunk/src/modules/Makefile.am (modified) (2 diffs)
• honeytrap/trunk/src/modules/htm_aSavePostgres.c (modified) (8 diffs)
• honeytrap/trunk/src/modules/htm_aSavePostgres.h (modified) (3 diffs)
• honeytrap/trunk/src/modules/htm_ftpDownload.c (modified) (16 diffs)
• honeytrap/trunk/src/modules/htm_ftpDownload.h (modified) (3 diffs)

honeytrap/trunk/ChangeLog

@@ -1 +1 @@
-Version 0.7.0
-tiz
+rit
-- PostgreSQL module for commits into mwcollect database
-- SHA512 hash support
@@ -6 +6 @@
-- Improved connection request handling in the nfq stream monitor
-- FTP download plugin is now source-based routing safe
+- Changed autotools process to make module builts optional
-Version 0.6.5
-- Introduced an nfnetlink_queue-based connection monitor

honeytrap/trunk/INSTALL

@@ -10 +10 @@
-   The `configure' shell script must be told which connection monitor
-should be used by honeytrap to monitor network interfaces for incoming
-
-
-
+
+
+
+
-
-   --with-ipq-mon       monitoring via netfilter/iptables ip_queue
-                        (Linux only)
+
+   --with-pcap-mon      monitoring with a PCAP-based sniffer
+
+To build additional plugins use the --with-[pluginname] options.
-
-Please refer to the generic installation instructions below for further

honeytrap/trunk/configure.in

@@ -267 +267 @@
-fi
-
+#----------------------- network stream monitors ---------------------------
-
-AC_ARG_WITH(pcap-mon,
@@ -377 +378 @@
-else with_ipfw_mon="no"
-fi
+
+
+#----------------------- optional plugins ---------------------------
+
+
+AC_ARG_WITH(spamsum,
+        [  --with-spamsum           Perform SpamSum similarity analysis for recorded attacks])
+AM_CONDITIONAL(BUILD_SPAMSUM_PLUGIN, test x$with_spamsum = xyes)
+if test "$with_spamsum" != "yes"; then
+        with_spamsum="no"
+fi
+
+
+
+AC_ARG_WITH(postgres,
+        [  --with-postgres          Store attack data in PostgreSQL database])
+AM_CONDITIONAL(BUILD_POSTGRES_PLUGIN, test x$with_postgres = xyes)
+if test "$with_postgres" = "yes"; then
+  AC_ARG_WITH(libpq_includes,
+    [  --with-libpq-includes=DIR  libpq include directory],
+    [with_libpq_includes="$withval"],[with_libpq_includes=no])
+
+  AC_ARG_WITH(libpq_libraries,
+    [  --with-libpq-libraries=DIR  libpq library directory],
+    [with_libpq_libraries="$withval"],[with_libpq_libraries=no])
+
+  if test "$with_libpq_includes" != "no"; then
+    CPPFLAGS="${CPPFLAGS} -I${with_libpq_includes}"
+  fi
+  AC_CHECK_HEADER(postgresql/libpq-fe.h,,[AC_ERROR(libpq-fe.h not found.)])
+
+  if test "$with_libpq_libraries" != "no"; then
+    LDFLAGS="${LDFLAGS}  -L${with_libpq_libraries}"
+  fi
+  LIPQ=""
+  AC_CHECK_LIB(pq, PQconnectdb,, LPQ="no")
+
+  if test "$LPQ" = "no"; then
+    echo
+    echo "   ERROR!  Libpq library/headers not found. Install it or use the"
+    echo "   --with-libpq-* options, if you have it installed in unusual place."
+    echo
+    exit
+  fi
+
+  AC_DEFINE([USE_POSTGRES_DB], [], [Define to store attacks in PostgreSQL database])
+else with_postgres="no"
+fi
+
+#-------------------------------------------------------------
+
+
-
-default_directory="/usr /usr/local"
@@ -463 +516 @@
-echo
-echo "--- honeytrap configuration ---"
-
-
-
+     
+     
+     
-echo
-echo "Connection monitor"
-
-
-
-
+
+
+
+
+
+
+
+

honeytrap/trunk/src/modules/Makefile.am

@@ -9 +9 @@
-libdir=$(DESTDIR)/$(sysconfdir)/honeytrap/plugins
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-htm_aSaveFile_la_SOURCES = htm_aSaveFile.c htm_aSaveFile.h
@@ -26 +39 @@
-htm_b64Decode_la_LDFLAGS = -module -no-undefined -avoid-version
-
+if BUILD_SPAMSUM_PLUGIN
-htm_SpamSum_la_SOURCES = htm_SpamSum.c htm_SpamSum.h
-htm_SpamSum_la_LDFLAGS = -module -no-undefined -avoid-version
+endif
-
+if BUILD_POSTGRES_PLUGIN
-htm_aSavePostgres_la_SOURCES = htm_aSavePostgres.c htm_aSavePostgres.h
-htm_aSavePostgres_la_LDFLAGS = -module -no-undefined -avoid-version -lpq
+endif
-
-install-exec-am:
-        $(mkinstalldirs) $(DESTDIR)/$(sysconfdir)/honeytrap/plugins
- | grep -v SpamSum
+
-                [ -h $$module ] || $(INSTALL_DATA) "$$module" $(DESTDIR)/$(sysconfdir)/honeytrap/plugins/ ; \
-        done
- | grep -v SpamSum
+
-                rm -f $(DESTDIR)/$(sysconfdir)/honeytrap/plugins/`basename "$$module"` ; \
-        done

honeytrap/trunk/src/modules/htm_aSavePostgres.c

@@ -13 +13 @@
- *
- * Description:
-a recorded attack
+recorded attacks
- *   
- */
+
+#ifdef USE_POSTGRES
-
-#include <stdio.h>
@@ -159 +161 @@
-                /* check if sample already exists */
-                memset(query, 0, MAX_SQL_BUFFER + 1);
-alware
+wcollect
-                        mem_sha512sum(attack->download->dl_payload.data, attack->download->dl_payload.size),
-                        mem_md5sum(attack->download->dl_payload.data, attack->download->dl_payload.size)) >= MAX_SQL_BUFFER) {
@@ -177 +179 @@
-                } else {
-                        /* escape byte data to prevent sql injection */
+logmsg(LOG_DEBUG, 1, "payload is %s.\n", attack->download->dl_payload.data);
-                        if ((esc_bytea = PQescapeByteaConn(db_connection, attack->download->dl_payload.data,
-                                                           attack->download->dl_payload.size, &length)) == NULL) {
@@ -185 +188 @@
-                                return(-1);
-                        }
+logmsg(LOG_DEBUG, 1, "esc_bytea is %s.\n", esc_bytea);
-
-                        if ((uri = build_uri(attack->download)) == NULL) {
@@ -198 +202 @@
-                        }
-                        memset(query, 0, MAX_SQL_BUFFER + 1);
-
+
+
+
+
-                                mem_sha512sum(attack->download->dl_payload.data, attack->download->dl_payload.size),
-"honeytrap-default"
-                               "dynamic-generic
-                               uri
+esc_bytea
+//                             "honeytrap-default
+//                             "dynamic-generic"
-                                inet_ntoa(*(struct in_addr*)&(attack->a_conn.l_addr)),
-                                inet_ntoa(*(struct in_addr*)&(attack->a_conn.r_addr)),
-
-
-
+
+
+
+
-                                logmsg(LOG_ERR, 1, "Postgres client error - Could not save malware: SQL query exceeds maximum size (increase MAX_SQL_BUFFER and recompile).\n");
-                                free(uri);
@@ -213 +221 @@
-                                return(-1);
-                        }
+logmsg(LOG_DEBUG, 1, "Postgres client - Query is: %s.\n", query);
-                        free(uri);
-
-                        if (PQresultStatus(res = PQexec(db_connection, query)) != PGRES_TUPLES_OK) {
-                                logmsg(LOG_ERR, 1, "Postgres client error - Malware submission failed: %s.\n", PQerrorMessage(db_connection));
+                                logmsg(LOG_DEBUG, 1, "Postgres client - Query was: %s.\n", query);
-                                PQclear(res);
-                                db_disconnect();
@@ -227 +237 @@
-
-                        /* get instance number for reference within attack_string record */
-
+
+
-
-                        PQclear(res);    
@@ -334 +345 @@
-        return(0);
-}
+
+#endif

honeytrap/trunk/src/modules/htm_aSavePostgres.h

@@ -11 +11 @@
- * implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
- */
+
+#ifdef USE_POSTGRES
-
-#ifndef __HT_MODULE_ASAVEPOSTGRES_H
@@ -30 +32 @@
-
-/* use static values for now. should be taken from configuration file */
-
+2
-
-void plugin_init(void);
@@ -42 +44 @@
-
-#endif
+
+#endif

honeytrap/trunk/src/modules/htm_ftpDownload.c

@@ -1 +1 @@
-/* htm_ftpDownload.c
-
+-2007
- *
- * This file is free software; as a special exception the author gives
@@ -227 +227 @@
-
-
-, int dumpfile_fd
+
-        char rline[MAX_LINE+1];         /* MAX_LINE plus one char for \0 */
-        int timeout = 60;
@@ -233 +233 @@
-
-        close(data_sock_fd);
-        close(dumpfile_fd);
-
-        logmsg(LOG_NOISY, 1, "FTP download - Sending 'QUIT'.\n");
@@ -252 +251 @@
-int get_ftp_resource(const char *user, const char* pass, struct in_addr *lhost, struct in_addr *rhost, const int port, const char *save_file, Attack *attack) {
-        struct sockaddr_in control_socket, local_data_socket, remote_data_socket;
- dumpfile_fd,
+
-            local_data_port, bytes_read, total_bytes, addr_len, select_return, timeout, retval;
-        uint8_t ip_octet[4], *binary_stream;
@@ -269 +268 @@
-        timeout = 60;
-        data_sock_fd = -1;
-        dumpfile_fd = -1;
-        
-        logmsg(LOG_NOTICE, 1, "FTP download - Requesting '%s' from %s:%u.\n", save_file, inet_ntoa(*rhost), port);
@@ -341 +339 @@
-        /* wait for 200 */
-        while (strstr(rline, "200") != rline) {
-
+
+
+
+
-                /* wait for 230 and send SYST and TYPE */
-                if(strstr(rline, "230") == rline) {
+
-                        /* Send SYST and switch to binary mode */
-                        /* Some buggy servers cannot handle a TYPE after SYST, so check for return value */
@@ -431 +433 @@
-                sizeof(local_data_socket))) < 0) && (local_data_port < 65535)) {
-                logmsg(LOG_DEBUG, 1,
-Port %d is already in use. Trying to bind on
+Unable to bind port %d. Trying
-                        ntohs(local_data_socket.sin_port), ntohs(local_data_socket.sin_port)+1);
-                /* check if integer was overflowed to 0 */
@@ -451 +453 @@
-                        strerror(errno));
-                close(data_sock_listen_fd);
-, dumpfile_fd
+
-                return(-1);
-        } else logmsg(LOG_DEBUG, 1, "FTP download - Initialized FTP data channel on port %u/tcp.\n",
@@ -478 +480 @@
-        if(strstr(rline, "4") == rline) {
-                logmsg(LOG_WARN, 1, "FTP download - FTP error code received: %s", rline);
-, dumpfile_fd
+
-                return(-1);
-        }
@@ -503 +505 @@
-                if(strstr(rline, "4") == rline) {
-                        logmsg(LOG_WARN, 1, "FTP download - FTP error code received: %s", rline);
-, dumpfile_fd
+
-                        return(-1);
-                }
@@ -521 +523 @@
-                if (errno != EINTR) {
-                        logmsg(LOG_ERR, 1, "FTP download error - Select on FTP data channel failed: %s.\n", strerror(errno));
-, dumpfile_fd
+
-                        return(-1);
-                }
@@ -527 +529 @@
-                logmsg(LOG_WARN, 1, "FTP download - Transfer timeout, no incoming data connection for %d seconds.\n",
-                        timeout);
-, dumpfile_fd
+
-                return(-1);
-        } else if (FD_ISSET(data_sock_listen_fd, &rfds)) { 
@@ -533 +535 @@
-                        logmsg(LOG_ERR, 1, "FTP download error - Unable to accept FTP data connection: %s\n",
-                                strerror(errno));
-, dumpfile_fd
+
-                        return(-1);
-                } else logmsg(LOG_DEBUG, 1, "FTP download - Incoming data connection from %s:%u.\n",
@@ -550 +552 @@
-                if (errno != EINTR) {
-                        logmsg(LOG_ERR, 1, "FTP download error - Select on FTP data channel failed: %s.\n", strerror(errno));
-, dumpfile_fd
+
-                        return(-1);
-                }
-        } else if (select_return == 0) {
-                logmsg(LOG_WARN, 1, "FTP download - Transfer timeout, no data to read for 10 seconds.\n");
-, dumpfile_fd
-
- 
+
+
+
-                logmsg(LOG_DEBUG, 1, "FTP download - Data available, retrieving file.\n");
-                /* receive file */
@@ -566 +568 @@
-                        total_bytes += bytes_read;
-                }
+                if (bytes_read < 0) {
+                        logmsg(LOG_ERR, 1, "FTP download error - Unable to read from data channel: %s.\n", strerror(errno));
+                        ftp_quit(control_sock_fd, data_sock_listen_fd);
+                        return(-1);
+                }
-                logmsg(LOG_NOISY, 1, "FTP download - Successfully downloaded %s.\n", save_file);
-, dumpfile_fd
+
-
-                /* add download to attack record */
-
+ 
-                        logmsg(LOG_DEBUG, 1, "FTP download - Adding download to attack record.\n");
-                        add_download("ftp", 6, rhost->s_addr, port, user, pass, (const char *) save_file, binary_stream, total_bytes, attack);
@@ -583 +590 @@
-        /* close open descriptors and return */
-        while((read_ftp_line(control_sock_fd, rline, 5) && strstr(rline, "226") != rline));
-, dumpfile_fd
+
-        return(0);
-}

honeytrap/trunk/src/modules/htm_ftpDownload.h

@@ -1 +1 @@
-/* htm_ftpDownload.h
-
+-2007
- *
- * This file is free software; as a special exception the author gives
@@ -19 +19 @@
-
-const char module_name[]="htm_ftpDownload";
-0
+1
-
-void plugin_init(void);
@@ -26 +26 @@
-int cmd_parse_for_ftp(Attack *attack);
-int read_ftp_line(int control_sock_fd, char *rline, int timeout);
-, int dumpfile_fd
+
-int get_ftp_resource(const char *user, const char* pass, struct in_addr *lhost, struct in_addr *rhost, const int port, const char *save_file, Attack *attack);
-int get_ftpcmd(char *attack_string, uint32_t string_size, struct in_addr lhost, Attack *attack);