Changeset 500

Timestamp:

04/08/06 20:57:15 (3 years ago)

Author:

common

Message:

Nepenthes
- SocketManager? remove RAWSocket support, drop the select() loop,
- RAWSocket remove the rawsocket itself
- x-7 remove the rawsocket example module

Files:

• nepenthes/trunk/configure.ac (modified) (1 diff)
• nepenthes/trunk/modules/Makefile.am (modified) (1 diff)
• nepenthes/trunk/modules/download-http/HTTPDialogue.cpp (modified) (1 diff)
• nepenthes/trunk/modules/log-irc/log-irc.cpp (modified) (1 diff)
• nepenthes/trunk/modules/shellcode-generic/shellcode-generic.cpp (modified) (1 diff)
• nepenthes/trunk/modules/x-7 (deleted)
• nepenthes/trunk/nepenthes-core/include/Makefile.am (modified) (1 diff)
• nepenthes/trunk/nepenthes-core/include/RAWSocket.hpp (deleted)
• nepenthes/trunk/nepenthes-core/include/SocketManager.hpp (modified) (1 diff)
• nepenthes/trunk/nepenthes-core/src/Makefile.am (modified) (1 diff)
• nepenthes/trunk/nepenthes-core/src/RAWSocket.cpp (deleted)
• nepenthes/trunk/nepenthes-core/src/SocketManager.cpp (modified) (12 diffs)

nepenthes/trunk/configure.ac

@@ -890 +890 @@
-                 modules/x-5/Makefile                 
-                 modules/x-6/Makefile
-                 modules/x-7/Makefile
-                 modules/x-8/Makefile
-                 modules/geolocation-hostip/Makefile

nepenthes/trunk/modules/Makefile.am

@@ -15 +15 @@
-          geolocation-hostip geolocation-geoip geolocation-ip2location \
-          dnsresolve-adns \
-7 x-
+
-          log-surfnet vuln-ftpd \
-          log-prelude shellcode-signatures

nepenthes/trunk/modules/download-http/HTTPDialogue.cpp

@@ -181 +181 @@
-        {
-                end += 2;
+                int headersize = end-start;
-                logSpam("FOUND HEADER (size %i)\n",end-start);
-                logSpam("%.*s",end-start,start);
-// FIXME PARSE HEADER
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        }
-        m_Download->getDownloadBuffer()->cutFront((uint32_t)(end-start)+2);

nepenthes/trunk/modules/log-irc/log-irc.cpp

@@ -279 +279 @@
-
-        logSpam("LogIrc DNS %s has no ip, resolve error\n", result->getDNS().c_str());
-
-
-
-
-
+
-        return true;
-}

nepenthes/trunk/modules/shellcode-generic/shellcode-generic.cpp

@@ -83 +83 @@
-
-//      m_ShellcodeHandlers.push_back(new GenericXOR(m_Nepenthes->getShellcodeMgr()));
-
+//
-//      m_ShellcodeHandlers.push_back(new GenericUrl(m_Nepenthes->getShellcodeMgr()));
-//      m_ShellcodeHandlers.push_back(new LinkXOR(m_Nepenthes->getShellcodeMgr()));

nepenthes/trunk/nepenthes-core/include/Makefile.am

@@ -18 +18 @@
-EXTRA_DIST += ModuleManager.hpp Module.hpp  
-EXTRA_DIST += Manager.hpp Nepenthes.hpp
-AWSocket.hpp R
+
-EXTRA_DIST += ShellcodeManager.hpp ShellcodeHandler.hpp 
-EXTRA_DIST += Packet.hpp

nepenthes/trunk/nepenthes-core/include/SocketManager.hpp

@@ -67 +67 @@
-                virtual Socket *connectTCPHost(uint32_t localHost, uint32_t remotehost, uint16_t localport, uint16_t remoteport,time_t connecttimeout);
-
-                virtual Socket *createRAWSocketUDP(uint16_t localport, uint16_t remoteport,time_t bindtimeout,time_t accepttimeout, DialogueFactory *diaf);
-                virtual Socket *createRAWSocketTCP(uint16_t localport, uint16_t remoteport,time_t bindtimeout,time_t accepttimeout, DialogueFactory *diaf);
-
-                virtual Socket *addPOLLSocket(POLLSocket *sock);
-

nepenthes/trunk/nepenthes-core/src/Makefile.am

@@ -23 +23 @@
-nepenthes_SOURCES += Nepenthes.cpp Manager.cpp
-nepenthes_SOURCES += Packet.cpp
-RAWSocket.cpp 
+
-nepenthes_SOURCES += Responder.cpp
-nepenthes_SOURCES += ShellcodeManager.cpp ShellcodeHandler.cpp 

nepenthes/trunk/nepenthes-core/src/SocketManager.cpp

@@ -52 +52 @@
-#include "FILESocket.hpp"
-#include "UDPSocket.hpp"
-#include "RAWSocket.hpp"
-#include "POLLSocket.hpp"
-
@@ -114 +113 @@
-bool  SocketManager::Init()
-{
-    try {
-        m_UseRawSockets = m_Nepenthes->getConfig()->getValInt("nepenthes.socketmanager.use_rawsockets");
-        if (m_UseRawSockets)
-        {
-            logInfo("%s","Using Rawsockets\n");
-        }
-    } catch ( ... ) {
-        logCrit("%s","Could not find nepenthes.socketmanager.use_rawsockets in config file, assuming no\n");
-    }
-
-
-        try {
-                string bindAddressString = m_Nepenthes->getConfig()->getValString("nepenthes.socketmanager.bind_address");
@@ -164 +152 @@
-        }
-
-
-#ifdef WIN32
-        WORD wVersionRequested;
-        WSADATA wsaData;
-        int32_t err;
- 
-        wVersionRequested = MAKEWORD( 2, 2 );
- 
-        err = WSAStartup( wVersionRequested, &wsaData );
-        if ( err != 0 ) {
-                /* Tell the user that we could not find a usable */
-                /* WinSock DLL.                                  */
-                logCrit("%s\n","Could not find good Windows Socket dll");
-                return false;
-        }else
-        {
-                logDebug("%s\n","WSAStartup worked");
-        }
-#endif
-
-
-
-    if (m_UseRawSockets == true)
-    {
-#ifdef WIN32
-        // win32 raw socket interface lookup & adding here
-        SOCKET sd = WSASocket(AF_INET, SOCK_DGRAM, 0, 0, 0, 0);
-        if (sd == SOCKET_ERROR)
-        {
-            logCrit("Failed to get a socket. Error %i\n", WSAGetLastError());
-            return false;
-        }
-
-        INTERFACE_INFO InterfaceList[20];
-        uint32_t nBytesReturned;
-        if (WSAIoctl(sd, SIO_GET_INTERFACE_LIST, 0, 0, &InterfaceList,
-                     sizeof(InterfaceList), &nBytesReturned, 0, 0) == SOCKET_ERROR)
-        {
-            logCrit("Failed calling WSAIoctl: error %i\n",WSAGetLastError());
-            return false;
-        }
-
-        int32_t nNumInterfaces = nBytesReturned / sizeof(INTERFACE_INFO);
-        logDebug("There are %i interfaces \n",nNumInterfaces);
-        int32_t i;
-        for (i = 0; i < nNumInterfaces; ++i)
-        {
-            logDebug("Interface %i \n", i);
-
-            u_long nFlags = InterfaceList[i].iiFlags;
-            if (nFlags & IFF_UP) 
-                logDebug("Iface is %s\n","up");
-            else                 
-                logDebug("Iface is %s\n","down");
-
-
-
-            sockaddr_in *pAddress;
-            pAddress = (sockaddr_in *) & (InterfaceList[i].iiAddress);
-            logDebug("\tip %s\n",inet_ntoa(pAddress->sin_addr));
-
-            pAddress = (sockaddr_in *) & (InterfaceList[i].iiBroadcastAddress);
-            logDebug("\tbcast %s\n",inet_ntoa(pAddress->sin_addr));
-
-            pAddress = (sockaddr_in *) & (InterfaceList[i].iiNetmask);
-            logDebug("\tnetmask %s\n",inet_ntoa(pAddress->sin_addr));
-
-            if (nFlags & IFF_POINTTOPOINT) 
-                logDebug("%s\n","\tis point-to-point");
-            if (nFlags & IFF_LOOPBACK)     
-                logDebug("%s\n","\tis a loopback iface");
-            
-
-            string features = "";
-            
-            if (nFlags & IFF_BROADCAST) 
-                features += "bcast ";
-            if (nFlags & IFF_MULTICAST)
-                features +=  "multicast ";
-            logDebug("\tFeatures: %s \n", features.c_str());
-        }
-
-
-        for (i = 0; i < nNumInterfaces; ++i)
-        {
-
-            sockaddr_in *pAddress;
-            pAddress = (sockaddr_in *) & (InterfaceList[i].iiAddress);
-
-            RAWSocketListener *sock = new RAWSocketListener(m_Nepenthes,*(uint32_t *)&(pAddress->sin_addr));
-            if ( sock->Init() == true )
-            {
-                m_Sockets.push_back(sock);
-            } else
-            {
-                return false;
-            }
-
-        }
-#else
-                FILE *f = fopen(PROC_NET_DEV,"r");
-                if (f== NULL)
-                {
-                        logCrit("Could not open %s \n",PROC_NET_DEV);
-                        return false;
-                }
-                char line[512];
-                memset(line,0,512);
-                bool ifaceline=false;
-
-                list <string> interfaces;
-
-                while (fgets(line,512,f) != NULL)
-                {
-                        if (ifaceline)
-                        {
-//                              printf("proc line is '%s' \n",line);
-                                char *ifacestopp=line;
-                                char *ifacestart=line;
-                                while(*ifacestopp != ':')
-                                        ifacestopp++;
-
-                                while (*ifacestart == ' ')
-                                        ifacestart++;
-
-                                logSpam("iface %.*s \n",ifacestopp-ifacestart,ifacestart);
-
-                interfaces.push_back(string(ifacestart,ifacestopp-ifacestart));
-
-                        }else
-                        if (strstr(line,"bytes") != NULL)
-                        {
-                                ifaceline = true;
-                        }
-
-                        
-
-                        memset(line,0,512);
-                }
-        fclose(f);
-
-                list<string>::iterator it;
-
-                for (it=interfaces.begin();it!= interfaces.end();it++)
-                {
-                        logDebug("Interface %s is availible for sniffing\n",it->c_str());
-                }
-
-                for ( it=interfaces.begin();it!= interfaces.end();it++ )
-                {
-                        if (strstr(it->c_str(),"eth") == NULL)
-                        {
-                                logDebug("No sniffing on %s\n",it->c_str());
-                                continue;
-                        }
-
-
-                        struct ifreq ifr;
-                        memset(&ifr,0,sizeof(struct ifreq));
-//                      struct ifconf ifc;
-
-                        uint32_t localip=0;
-                        int32_t fd = socket(AF_INET, SOCK_DGRAM, 0);
-                        if ( fd >= 0 )
-                        {
-                                strcpy(ifr.ifr_name, it->c_str());
-                                ifr.ifr_addr.sa_family = AF_INET;
-                                if ( ioctl(fd, SIOCGIFADDR, &ifr) == 0 )
-                                {
-                                        struct sockaddr_in *ssin;
-                                        ssin = (struct sockaddr_in *) &ifr.ifr_addr;
-                                        logSpam("Interface %s has ip %s \n",it->c_str(),inet_ntoa(*(in_addr *)&ssin->sin_addr.s_addr));
-
-                                        localip = ssin->sin_addr.s_addr;
-
-/*                    logSpam("Interface %s has ip %s \n",it->c_str(),inet_ntoa(*(in_addr *)&ifr.ifr_addr));
-                                        strcpy(ifr.ifr_name, it->c_str());
-                                        if ( ioctl(fd, SIOCGIFDSTADDR, &ifr) >= 0 )
-                                                logSpam("Interface %s has ... %s \n",it->c_str(),inet_ntoa(*(in_addr *)&ifr.ifr_dstaddr));
-
-                                        strcpy(ifr.ifr_name, it->c_str());
-                                        if ( ioctl(fd, SIOCGIFBRDADDR, &ifr) >= 0 )
-                                                logSpam("Interface %s has ... %s \n",it->c_str(),inet_ntoa(*(in_addr *)&ifr.ifr_broadaddr));
-
-                                        strcpy(ifr.ifr_name, it->c_str());
-                                        if ( ioctl(fd, SIOCGIFNETMASK, &ifr) >= 0 )
-                                                logSpam("Interface %s has ... %s \n",it->c_str(),inet_ntoa(*(in_addr *)&ifr.ifr_netmask));
-*/                                      
-                                } 
-//                              else
-//                                      memset(&ife->addr, 0, sizeof(struct sockaddr));
-                        }
-
-
-                        RAWSocketListener *sock;
-                        sock = new RAWSocketListener(m_Nepenthes,(char *)it->c_str(), localip, IPPROTO_TCP);
-                        if ( sock->Init() == true )
-                        {
-                                m_Sockets.push_back(sock);
-                        } else
-                        {
-                                return false;
-                        }
-                        
-/*                      sock = new RAWSocketListener(m_Nepenthes,(char *)it->c_str(), IPPROTO_UDP);
-                        if ( sock->Init() == true )
-                        {
-                                m_Sockets.push_back(sock);
-                        } else
-                        {
-                                return false;
-                        }
-*/                      
-                }
-                interfaces.clear();
-#endif
-                
-        }
-        return true;
-}
@@ -406 +176 @@
-
-/**
-checks all sockets, and polls, handles the send and receive, socket timeouts, accepting new sockets, deleting dead
+poll the
- * 
- * @param polltimeout
-
-
-
-
+
+
+
- */
-#ifdef WIN32
-        #error "i changed some stuff and found no reason to port it"
-        #error "to be precise, the setStatus thing for connected sockets"
-        
-bool SocketManager::doLoop(uint32_t polltimeout)
-// FIXME ..
+
-        list <Socket *>::iterator itSocket;
-
@@ -450 +215 @@
-        }
-
-
-
-
-
-
-
-
+
+
-        int32_t i=0;
-        for (itSocket = m_Sockets.begin();itSocket != m_Sockets.end(); itSocket++)
@@ -477 +237 @@
-                        {
-                        case 0: // der socket is soweit okay
-
-
+
+
+
+
+
+
-                                break;
-
-WSA
+
-                                (*itSocket)->unsetPolled();
-                                break;
-
-                        case WSAEISCONN:
-                                (*itSocket)->setPolled();       // der socket ist am start
-                                break;
-
-
-                        default:
@@ -497 +257 @@
-
-        i=0;
-        int32_t maxsock=-1;
-        for (itSocket = m_Sockets.begin();itSocket != m_Sockets.end(); itSocket++)
-
+
+
-                if ((*itSocket)->isPolled() == true )
-                {
-
-
-
-
-
-
+
+
-
-                        if ((*itSocket)->wantSend() == true)
-                        {
-
-
-
+
+
-                        i++;
-                }
-        }
-
-
-
-
-
-
+
-
-        if (iPollRet != 0)
@@ -537 +288 @@
-                                   )
-                                {
-
+
+
+
+
-                                        {
-                                                (*itSocket)->doRecv();
+                                                iPollRet--;
-                                        }
-                                }
@@ -552 +307 @@
-                        if ( (*itSocket)->isPolled() == true )
-                        {
-//                              logSpam(" COuld write #%i\n",1);
-                                // doRecv() can close sockets
-                                // we need a valid way to verify we dont try to send on a closed socket, 
-                                // i think wantSend() is a good option here
-                                // getStatus i just a cheap fix
-//                              logInfo("SSS %s \n",(*itSocket)->getDescription().c_str());
-                                if (
-                    ( (*itSocket)->getStatus() == SS_CONNECTED || (*itSocket)->getStatus() == SS_CLEANQUIT ) &&  
@@ -569 +318 @@
-                                   )
-                                {
-//                                      if ( iPollRet == 0 )
-//                                              continue;
-//                                      logSpam(" COuld write #%i\n",2);
-                                        if (FD_ISSET((*itSocket)->getSocket(),&wfds))
-                                        {
-//                                              logSpam(" COuld write #%i\n",3);
-                                                (*itSocket)->doSend();
-
-                                        }
-                                }
-                                i++;
-                        }
-                }
-
-
-                // accept new, non udp clients as udp does not accept()
-                i=0;
-                for (itSocket = m_Sockets.begin();itSocket != m_Sockets.end(); itSocket++)
-                {
-                                
-
-                        if ( (*itSocket)->isPolled() == true )
-                        {
-                                if ( (*itSocket)->isBind() )
-                                {
-                                        if ( !((*itSocket)->getType() & ST_UDP) ) // bound udp sockets dont accept, they recvfrom
-                                        {
-                                                if (FD_ISSET((*itSocket)->getSocket(),&rfds))
-                                                {
-                                                        logDebug("%s could Accept a Connection\n",(*itSocket)->getDescription().c_str());
-                                                        Socket * socket = (*itSocket)->acceptConnection();
-                                                        if ( socket == NULL )
-                                                        {
-                                                                logCrit("%s","Accept returned NULL ptr \n");
-                                                        } else
-                                                        {
-                                                                m_Sockets.push_back(socket);
-                                                                logDebug("Accepted Connection %s \n%i Sockets in list\n",socket->getDescription().c_str(), m_Sockets.size());
-                                                        }
-                                                }
-                                        }
-                                }
-                                i++;
-                        }
-                }
-        }
-//      free(polls);
-//      sleep(1);
-        return true;
-}
-#else
-
-/**
- * poll the sockets
- * 
- * @param polltimeout
- *               the polltimeout
- * 
- * @return returns true
- */
-bool SocketManager::doLoop(uint32_t polltimeout)
-{// FIXME ..
-
-
-
-
-        list <Socket *>::iterator itSocket;
-
-//      check socket timeouts and remove dead sockets
-        for (itSocket = m_Sockets.begin();itSocket != m_Sockets.end(); itSocket++)
-        {
-                (*itSocket)->checkTimeout();
-                if ((*itSocket)->getStatus() == SS_TIMEOUT )
-                {
-                        logDebug("Deleting Socket %s due to timeout \n",(*itSocket)->getDescription().c_str());
-                        Socket *delsocket = *itSocket;
-                        m_Sockets.erase(itSocket);
-                        delete delsocket;
-
-                        itSocket = m_Sockets.begin(); // FIXME ?
-                        if(m_Sockets.size() == 0)
-                return false;
-                        
-
-                }
-
-                if ( (*itSocket)->getStatus() == SS_CLOSED )
-                {
-                        logDebug("Deleting %s due to closed connection \n",(*itSocket)->getDescription().c_str());
-                        Socket *delsocket = *itSocket;
-                        m_Sockets.erase(itSocket);
-                        delete delsocket;
-                        itSocket = m_Sockets.begin(); // FIXME ?
-                }
-        }
-
-        pollfd *polls = (pollfd *) malloc( (m_Sockets.size())* sizeof(pollfd));
-        memset(polls,0,(m_Sockets.size())* sizeof(pollfd));
-        int32_t i=0;
-        for (itSocket = m_Sockets.begin();itSocket != m_Sockets.end(); itSocket++)
-        {
-                int32_t iError = 0;
-                int32_t iSize = sizeof(iError);
-                if((*itSocket)->getType() & ST_FILE)
-                {
-                        (*itSocket)->setPolled();
-                }else
-                if ((*itSocket)->getsockOpt(SOL_SOCKET, SO_ERROR, &iError,(socklen_t *) &iSize) != 0 )
-                {
-                        // socket is dead
-                        logSpam("Socket %s is Dead\n",(*itSocket)->getDescription().c_str());
-                        (*itSocket)->unsetPolled();
-
-                } else
-                {
-                        switch (iError)
-                        {
-                        case 0: // der socket is soweit okay
-                        case EISCONN:
-//                              logSpam("EISCONN State %i \n",(*itSocket)->getStatus());
-                                if ((*itSocket)->getStatus() == SS_CONNECTING)
-                                {
-                                        (*itSocket)->setStatus(SS_CONNECTED);
-                                }
-                                (*itSocket)->setPolled();       // der socket ist am start
-                                break;
-
-                        case EINPROGRESS: // der socket versuchts
-                                (*itSocket)->unsetPolled();
-                                break;
-
-
-                        default:
-                                (*itSocket)->unsetPolled();             // der is defekt
-                        }
-                }
-        }
-
-        i=0;
-        for (itSocket = m_Sockets.begin();itSocket != m_Sockets.end(); itSocket++)
-        {
-                polls[i].events = 0;
-                if ((*itSocket)->isPolled() == true )
-                {
-                        polls[i].fd = (*itSocket)->getSocket();
-
-                        polls[i].events = POLLIN;
-
-                        
-
-                        if ((*itSocket)->wantSend() == true)
-                        {
-//                              logSpam("polling %s read|write\n",(*itSocket)->getDescription().c_str());
-                                        
-                                polls[i].events |= POLLOUT;
-                        }/*else
-                                logSpam("polling %s readonly\n",(*itSocket)->getDescription().c_str());*/
-                        i++;
-                }
-        }
-
-        int32_t iPollRet = poll(polls,i,50);
-
-        if (iPollRet != 0)
-        {
-                // read sockets
-                i=0;
-                for (itSocket = m_Sockets.begin();itSocket != m_Sockets.end(); itSocket++)
-                {
-                        if ( (*itSocket)->isPolled() == true )
-                        {
-                                if ( 
-                                   ( (*itSocket)->isAccept()  || (*itSocket)->isConnect() ) ||
-                                   (  (*itSocket)->isBind() && (*itSocket)->getType() & ST_UDP)   // bound udp sockets dont accept, they recvfrom
-                                   )
-                                {
-                                        if ( iPollRet == 0 )
-                                                continue;
-
-                                        if ( polls[i].revents & POLLIN && polls[i].events & POLLIN )
-                                        {
-                                                (*itSocket)->doRecv();
-                                                iPollRet--;
-                                        }
-                                }
-                                i++;
-                        }
-                }
-
-                // write sockets
-                i=0;
-                for (itSocket = m_Sockets.begin();itSocket != m_Sockets.end(); itSocket++)
-                {
-                        if ( (*itSocket)->isPolled() == true )
-                        {
-//                              logSpam(" COuld write #%i\n",1);
-                                // doRecv() can close sockets
-                                // we need a valid way to verify we dont try to send on a closed socket, 
-                                // i think wantSend() is a good option here
-                                // getStatus i just a cheap fix
-//                              logDebug("SSS %s \n",(*itSocket)->getDescription().c_str());
-                                if (
-                    ( (*itSocket)->getStatus() == SS_CONNECTED || (*itSocket)->getStatus() == SS_CLEANQUIT ) &&  
-                                    (
-                                     (*itSocket)->isAccept() ||
-                                     (*itSocket)->isConnect() || 
-                                     (
-                                      (*itSocket)->isBind() && (*itSocket)->getType() & ST_UDP
-                                     )
-                                    )  
-                                   )
-                                {
-//                                      if ( iPollRet == 0 )
-//                                              continue;
-//                                      logSpam(" COuld write #%i\n",2);
-                                        if ( polls[i].revents & POLLOUT && polls[i].events & POLLOUT )
-                                        {
-//                                              logSpam(" COuld write #%i\n",3);
-                                                (*itSocket)->doSend();
-                                                iPollRet--;
@@ -832 +365 @@
-        }
-        free(polls);
-//      sleep(1);
-        return true;
-}
-
+
-
-/**
@@ -1065 +597 @@
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-