Changeset 1564

Timestamp:

02/22/08 21:03:41 (6 months ago)

Author:

till

Message:

honeytrap
- submitNebula: HMAC protected submissions
- submitNebula: non-blocking connection handling

Files:

• honeytrap/trunk/src/modules/htm_submitNebula.c (modified) (10 diffs)

honeytrap/trunk/src/modules/htm_submitNebula.c

@@ -37 +37 @@
-#include <readconf.h>
-#include <sha512.h>
+#include <signals.h>
-#include <sock.h>
-#include <tcpip.h>
@@ -58 +59 @@
-
-
+// hmac stuff 
+#define HMAC_HASH_SIZE  128     // for sha512
+#define HMAC_BLOCK_SIZE 256     // for sha512
+#define IPAD_VAL        0x36
+#define OPAD_VAL        0x5C    
+
+u_char          k[HMAC_BLOCK_SIZE];
+u_char          k_ipad[HMAC_BLOCK_SIZE];
+u_char          k_opad[HMAC_BLOCK_SIZE];
+
+
+
-void plugin_init(void) {
+        int i;
+
-        plugin_register_hooks();
-        register_plugin_confopts(module_name, config_keywords, sizeof(config_keywords)/sizeof(char *));
@@ -65 +80 @@
-                exit(EXIT_FAILURE);
-        }
+
+        // initialize HMAC pads
+        memset(k_ipad, IPAD_VAL, HMAC_BLOCK_SIZE);
+        memset(k_opad, OPAD_VAL, HMAC_BLOCK_SIZE);
+        if (nebula_secret) for (i=0; i<strlen(nebula_secret); i++) {
+                k_ipad[i] ^= nebula_secret[i];
+                k_opad[i] ^= nebula_secret[i];
+        }
+
-        return;
-}
@@ -118 +142 @@
-}
-
+
+// calculate HMAC
+char *hmac(u_char **msg, ssize_t len) {
+        u_char  *inner, *outer;
+
+        // append inner padding to message
+        if ((*msg = realloc(*msg, len+HMAC_BLOCK_SIZE)) == NULL) {
+                fprintf(stderr, "Error - Unable to allocate memory: %s.\n", strerror(errno));
+                return(NULL);
+        }
+        memcpy(*msg+len, k_ipad, HMAC_BLOCK_SIZE);
+
+        // compute inner hash
+        if ((inner = (u_char *) mem_sha512sum(*msg, len+HMAC_BLOCK_SIZE)) == NULL) {
+                fprintf(stderr, "Error - Unable to compute inner HMAC SHA512 hash.\n");
+                return(NULL);
+        }
+
+        // append outer padding to iner hash
+        if ((inner = realloc(inner, HMAC_HASH_SIZE+HMAC_BLOCK_SIZE)) == NULL) {
+                fprintf(stderr, "Error - Unable to allocate memory: %s.\n", strerror(errno));
+                free(inner);
+                return(NULL);
+        }
+        memcpy(&inner[HMAC_HASH_SIZE], k_opad, HMAC_BLOCK_SIZE);
+
+        // compute outer hash
+        if ((outer = (u_char *) mem_sha512sum(inner, HMAC_HASH_SIZE+HMAC_BLOCK_SIZE)) == NULL)
+                fprintf(stderr, "Error - Unable to compute outer HMAC SHA512 hash.\n");
+
+        free(inner);
+        return((char *) outer);
+}
+
+
+// submit attack to a Nebula server
-int submit_nebula(Attack *attack) {
-        struct hostent          *host;
-        u_char                  *cbuf, response[9];
-
+
+
-        struct sockaddr_in      sock;
-
+, bytes_read, total_bytes
-        char                    *sha512sum;
-
-
-
-
+
+
+
+
+
+
-
-        /* no data - nothing todo */
@@ -166 +230 @@
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        if ((cbuf = malloc(strlen(nebula_secret)+4)) == NULL) {
-                logmsg(LOG_ERR, 1, "SubmitNebula Error - Unable to allocate memory: %m.\n");
@@ -177 +279 @@
-        }
-        memcpy(cbuf, nebula_secret, strlen(nebula_secret));
-rand_no
+nonce
-        if ((sha512sum = mem_sha512sum(cbuf, strlen(nebula_secret)+4)) == NULL) {
-                logmsg(LOG_ERR, 1, "SubmitNebula Error - Unable to hash secret.\n");
@@ -184 +286 @@
-        }
-
-        // send random number
-        if (write(sock_fd, &rand_no, 4) == -1) {
-                logmsg(LOG_ERR, 1, "SubmitNebula Error - Writing to socket failed: %m.\n");
-                close(sock_fd);
-                return(-1);
-        }
-
-        // send hashed secret
-        if (write(sock_fd, sha512sum, 128) == -1) {
@@ -212 +307 @@
-        }
-        if (strncmp((char *) response, "KNOWN", 5) == 0) {
-
+ to the server
-                close(sock_fd);
-                return(0);
@@ -281 +376 @@
-        }
-
+        // append protocol and port to cattack for HMAC calculation
+        if ((cbuf = realloc(cbuf, cbuf_len+3)) == NULL) {
+                logmsg(LOG_ERR, 1, "SubmitNebula Error - Unable to allocate memory: %m.\n");
+                close(sock_fd);
+                return(-1);
+        }
+        memcpy(cbuf+cbuf_len, &attack->a_conn.protocol, 1);
+        memcpy(cbuf+cbuf_len+1, &attack->a_conn.l_port, 2);
+
+        sha512sum = hmac(&cbuf, cbuf_len+3);
+        free(cbuf);
+
+        // send length of HMAC
+        hmac_len = strlen(sha512sum);
+        if (write(sock_fd, &hmac_len, sizeof(hmac_len)) == -1) {
+                logmsg(LOG_ERR, 1, "SubmitNebula Error - Writing to socket failed: %m.\n");
+                close(sock_fd);
+                return(-1);
+        }
+
+        // send HMAC
+        if (write(sock_fd, sha512sum, strlen(sha512sum)) == -1) {
+                logmsg(LOG_ERR, 1, "SubmitNebula Error - Writing to socket failed: %m.\n");
+                close(sock_fd);
+                return(-1);
+        }
+        free(sha512sum);
+
-        // wait for OK
-        logmsg(LOG_DEBUG, 1, "SubmitNebula - Attack sent, waiting for OK.\n");
-8
+9
-                logmsg(LOG_WARN, 1, "SubmitNebula Warning - Nebula server did not respond within 10 seconds.\n");
-        } else if (strlen((char *) response) != 2 || strncmp((char *) response, "OK", 2) != 0)
@@ -289 +412 @@
-
-        close(sock_fd);
-        free(cbuf);
-
-        logmsg(LOG_NOISY, 1, "SubmitNebula - Submission complete.\n");