Changeset 1345

Timestamp:

08/03/07 18:20:39 (1 year ago)

Author:

till

Message:

- fix: one signal pipe per process
- fix: consider signal pipe when select()ing in plugins
- controlled exit on SIGBUS, SIGILL
- check exit status of terminated child processes and warn in case of failures
- configuration option to replace rfc1918/invalid ip addresses
- some code cleanups

Files:

• honeytrap/trunk/src/ctrl.c (modified) (4 diffs)
• honeytrap/trunk/src/ctrl.h (modified) (2 diffs)
• honeytrap/trunk/src/dynsrv.c (modified) (5 diffs)
• honeytrap/trunk/src/modules/htm_ftpDownload.c (modified) (6 diffs)
• honeytrap/trunk/src/modules/htm_tftpDownload.c (modified) (10 diffs)
• honeytrap/trunk/src/modules/htm_tftpDownload.h (modified) (1 diff)
• honeytrap/trunk/src/proxy.c (modified) (1 diff)
• honeytrap/trunk/src/signals.c (modified) (7 diffs)
• honeytrap/trunk/src/signals.h (modified) (1 diff)
• honeytrap/trunk/src/sock.c (modified) (2 diffs)
• honeytrap/trunk/src/util.c (modified) (1 diff)

honeytrap/trunk/src/ctrl.c

@@ -20 +20 @@
-#include <sys/stat.h>
-
+#include "ctrl.h"
-#include "honeytrap.h"
+#include "logging.h"
-#include "pcapmon.h"
-#include "logging.h"
-#include "ctrl.h"
-#include "plugin.h"
-#include "response.h"
@@ -113 +113 @@
-
-        /* become session leader and loose controlling TTY */
-
+my
-                fprintf(stderr, "  Error - Unable to daemonize: %s\n", strerror(errno));
-                exit(EXIT_FAILURE);
@@ -121 +121 @@
-                
-        /* fork again, future opens must not allocate controlling TTYs */
-
+my
-                fprintf(stderr, "  Error - Unable to daemonize: %s\n", strerror(errno));
-                exit(EXIT_FAILURE);
@@ -190 +190 @@
-        return(1);
-}
+
+
+pid_t myfork(void) {
+        pid_t pid;
+
+        /* reopen signal pipe in child process */
+        if ((pid = fork()) == 0) create_sigpipe();
+        return(pid);
+}

honeytrap/trunk/src/ctrl.h

@@ -1 +1 @@
-/* ctrl.h
-
+-2007
- *
- * This file is free software; as a special exception the author gives
@@ -18 +18 @@
-int do_daemonize(void);
-int create_pid_file(void);
+pid_t myfork(void);
-
-#endif

honeytrap/trunk/src/dynsrv.c

@@ -95 +95 @@
-
-        /* fork server process */
-
+my
-                /* use this port string as log prefix */
-                memset(portstr, 0, 16);
@@ -194 +194 @@
-                                exit(EXIT_SUCCESS);
-                        default:
-
-
-
-
+
-                                if (FD_ISSET(listen_fd, &rfds)) {
-                                        logmsg(LOG_NOISY, 1,
@@ -359 +356 @@
-
-                                        /* fork connection handler */
-
+my
-                                                /* close listening socket in child */
-                                                close(listen_fd);
@@ -469 +466 @@
-                                }
-                        }
+                        break;
-                default:
-
-
+
-                        if (FD_ISSET(connection_fd, &rfds)) {
-                                /* handle data on server connection */
@@ -576 +573 @@
-                                (attack_string, total_bytes, server_string, total_from_server, dport, attack));
-                default:
-
-
+
-                        if (FD_ISSET(server_sock_fd, &rfds)) {
-                                /* read data and proxy it to client connection */

honeytrap/trunk/src/modules/htm_ftpDownload.c

@@ -32 +32 @@
-#include <md5.h>
-#include <plughook.h>
+#include <signals.h>
-#include <sock.h>
-#include <tcpip.h>
@@ -39 +40 @@
-
-const char module_name[]="ftpDownload";
-2
+3
-
-char *ftp_host = NULL;
@@ -161 +162 @@
-                                inet_ntoa(*(struct in_addr*)host->h_addr_list[0]));
-
-
+replace_private_ips && !
-                                logmsg(LOG_INFO, 1, "FTP download error - %s is not a valid ip address.\n",
-                                        inet_ntoa(*(struct in_addr*)host->h_addr_list[0]));
@@ -336 +337 @@
-
-        /* replace private ip? */
-private_ipaddr(rhost->s_addr
-
+(private_ipaddr(rhost->s_addr) || !(valid_ipaddr(rhost->s_addr))
+/invalid
-                rhost = (struct in_addr *) &attack->a_conn.r_addr;
-        }
@@ -610 +611 @@
-                timeout);
-        FD_ZERO(&rfds);
+        FD_SET(sigpipe[0], &rfds);
-        FD_SET(data_sock_listen_fd, &rfds);
-elect_return = select(data_sock_listen_fd + 1, &rfds, NULL, NULL, &r_timeout);
-if (select_return < 0) {
+witch (select_return = select(MAX(sigpipe[0], data_sock_fd) + 1, &rfds, NULL, NULL, &r_timeout)) {
+case -1:
-                if (errno != EINTR) {
-                        logmsg(LOG_ERR, 1, "FTP download error - Select on FTP data channel failed: %s.\n", strerror(errno));
@@ -618 +620 @@
-                        return(-1);
-                }
-} else if (select_return == 0) {
+case 0:
-                logmsg(LOG_WARN, 1, "FTP download - Transfer timeout, no incoming data connection for %d seconds.\n",
-                        timeout);
-                ftp_quit(control_sock_fd, data_sock_fd);
-                return(-1);
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-        /* retrieve file, read timeout is 5 seconds */
-        logmsg(LOG_DEBUG, 1, "FTP download - Waiting for data on FTP data channel, timeout is 10 seconds.\n");
-        FD_ZERO(&rfds);
+        FD_SET(sigpipe[0], &rfds);
-        FD_SET(data_sock_fd, &rfds);
-        r_timeout.tv_sec = 10;
-        r_timeout.tv_usec = 0;
-data_sock_fd
+MAX(sigpipe[0], data_sock_fd)
-        if (select_return < 0) {
-                if (errno != EINTR) {

honeytrap/trunk/src/modules/htm_tftpDownload.c

@@ -30 +30 @@
-#include <logging.h>
-#include <plughook.h>
+#include <signals.h>
-#include <util.h>
-#include <md5.h>
@@ -39 +40 @@
-
-const char module_name[]="tftpDownload";
-
+.1
-
-
@@ -112 +113 @@
-                                inet_ntoa(*(struct in_addr*)host->h_addr_list[0]));
-
-
+replace_private_ips && !
-                                logmsg(LOG_INFO, 1, "TFTP download error - %s is not a valid ip address.\n",
-                                        inet_ntoa(*(struct in_addr*)host->h_addr_list[0]));
@@ -147 +148 @@
-
-
-, int dumpfile_fd
+
-        if (data_sock_fd) close(data_sock_fd);
-        if (dumpfile_fd) close(dumpfile_fd);
-        return(0);
-}
@@ -156 +156 @@
-int get_tftp_resource(struct in_addr* host, const char *save_file, Attack *attack) {
-        struct sockaddr_in data_socket, from;
-
-
+
-            tftp_command_size, socklen, retransmissions, received_last_packet, last_ack_packet;
-        uint8_t *binary_stream;
@@ -171 +170 @@
-        binary_stream = NULL;
-        max_blockcode = 0;
-        select_return = -1;
-        dumpfile_fd = -1;
-        socklen = sizeof(struct sockaddr_in);
+        
+
+        /* replace private ip? */
+        if (replace_private_ips && (private_ipaddr(host->s_addr) || !(valid_ipaddr(host->s_addr)))) {
+                logmsg(LOG_NOISY, 1, "FTP download - Replacing private/invalid server address with attacking IP address.\n");
+                host = (struct in_addr *) &attack->a_conn.r_addr;
+        }
-        
-        logmsg(LOG_NOTICE, 1, "TFTP download - Requesting '%s' from %s.\n", save_file, inet_ntoa(*host));
@@ -214 +218 @@
-
-        FD_ZERO(&rfds);
+        FD_SET(sigpipe[0], &rfds);
-        FD_SET(data_sock_fd, &rfds);
-
-
-
+
+
-                /* send read request */
-                if ((bytes_sent = sendto(data_sock_fd, tftp_command, tftp_command_size, 0,
@@ -234 +238 @@
-                        (u_int16_t) snd_timeout.tv_sec);
-        
-
-
+
+
+
+
+
+
+
+
-                        return(-1);
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-                logmsg(LOG_ERR, 1, "TFTP download error - Connection timed out.\n");
-                return(-1);
@@ -265 +283 @@
-
-                switch(ntohs(tftp_opcode)) {
-
-
-
-
+
+
+
+
+
+
+
+
+
-                                        ntohs(tftp_blockcode), bytes_read);
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                                
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                                        }
-                                }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
-                                }
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                }
-        }
@@ -362 +397 @@
-        
-        /* close open descriptors and return */
-, dumpfile_fd
-
+
+

honeytrap/trunk/src/modules/htm_tftpDownload.h

@@ -23 +23 @@
-int cmd_parse_for_tftp(Attack *attack);
-int get_tftpcmd(char *attack_string, int string_size, Attack *attack);
-, int dumpfile_fd
+
-int get_tftp_resource(struct in_addr* host, const char *save_file, Attack *attack);
-

honeytrap/trunk/src/proxy.c

@@ -95 +95 @@
-                       sizeof(proxy_socket), timeout)) {
-                case -1:
+                        if (errno == EINPROGRESS) break;
+                        if (errno == EINTR) {
+                                if (check_sigpipe() == -1) exit(EXIT_FAILURE);
+                                break;
+                        }
-                        logmsg(LOG_ERR, 1, "%s %s  Error - select() call failed: %s \n",
-                                logpre, portstr, strerror(errno));

honeytrap/trunk/src/signals.c

@@ -34 +34 @@
-void get_signal(int sig) {
-        switch (sig) {
+#ifdef HAVE_SIGBUS
+        case SIGBUS:
+#endif
+        case SIGCHLD:
+        case SIGHUP:
+        case SIGILL:
-        case SIGINT:
-        case SIGHUP:
-        case SIGQUIT:
+        case SIGSEGV:
-        case SIGTERM:
-        case SIGCHLD:
-                /* prevent nested interrupts */
-                if (signal(sig, SIG_IGN) == SIG_IGN) return;
@@ -56 +61 @@
-
-void handle_signal(int sig) {
-
+
+
-
-        switch(sig) {
+#ifdef HAVE_SIGBUS
+        case SIGBUS:
+#endif
+        case SIGILL:
+        case SIGSEGV:
+                if (current_plugfunc)
+                        logmsg(LOG_ERR, 1, "Error - Signal %d received in process %d, %s::%s().\n",
+                                sig, getpid(), current_plugfunc->plugnam, current_plugfunc->funcnam);
+                else 
+                        logmsg(LOG_ERR, 1, "Error - Signal %d received in process %d.\n", sig, getpid());
+                _exit(EXIT_FAILURE);
-        case SIGHUP:
-                if (MASTER_PROCESS) {
@@ -79 +96 @@
-        
-                break;
-        case SIGSEGV:
-                if (current_plugfunc)
-                        logmsg(LOG_ERR, 1, "Error - Segmentation fault in process %d, %s::%s()  (SIGSEGV received).\n",
-                                getpid(), current_plugfunc->plugnam, current_plugfunc->funcnam);
-                else 
-                        logmsg(LOG_ERR, 1, "Error - Segmentation fault in process %d (SIGSEGV received).\n", getpid());
-                _exit(EXIT_FAILURE);
-        case SIGINT:
-                logmsg(LOG_DEBUG, 1, "SIGINT received.\n");
@@ -125 +135 @@
-        case SIGCHLD:
-                logmsg(LOG_DEBUG, 1, "SIGCHILD received.\n");
-
+
+
+
+
+
+
+
+
+
+
-
-                /* reinstall original signal handler */
@@ -134 +153 @@
-                break;
-        default:
+                logmsg(LOG_WARN, 1, "Warning - Don't know how to handle signal %d in process %d.\n", sig, getpid());
-                break;
-        }
@@ -141 +161 @@
-
-void install_signal_handlers(void) {
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        if (pipe(sigpipe) == -1) {
-                fprintf(stderr, "  Error - Unable to create signal pipe: %s.\n", strerror(errno));
-                exit(EXIT_FAILURE);
-        }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-
-        return;
@@ -184 +213 @@
-        int     sig, rv;
-
-
+
+
-                /* caught a signal */
-                logmsg(LOG_DEBUG, 1, "Process %d received signal %d on pipe.\n", getpid(), sig);
-                handle_signal(sig);
-
-
+
+
+
+
+
-                logmsg(LOG_ERR, 1, "Error - Unable to read signal from pipe: %s.\n", strerror(errno));
-                return(-1);

honeytrap/trunk/src/signals.h

@@ -27 +27 @@
-void handle_signal(int sig);
-void install_signal_handlers(void);
+void create_sigpipe(void);
-int check_sigpipe(void);
-

honeytrap/trunk/src/sock.c

@@ -102 +102 @@
-
-
-r
+
- * always use this function instead of connect()
- * or signal processing might get delayed */
@@ -132 +132 @@
-                switch (select(MAX(sigpipe[0], sock_fd) + 1, &rfds, &wfds, NULL, &timeout)) {
-                case -1:
+                        if (errno == EINPROGRESS) break;
-                        if (errno == EINTR) {
-                                if (check_sigpipe() == -1) exit(EXIT_FAILURE);

honeytrap/trunk/src/util.c

@@ -84 +84 @@
-                                return(-1);
-                        default:
-
-
+
-                                if (FD_ISSET(socket, &rfds)) {
-                                        if (read_chars >= len-1) {