Changeset 251

Timestamp:

Oct 1, 2009, 9:42:28 PM (15 years ago)

Author:

katerina

Message:

Improved logic for interpreting /proc/net/udp,tcp

Location:

trunk

Files:

• configure.ac (modified) (1 diff)
• docs/Changelog (modified) (1 diff)
• src/sh_port2proc.c (modified) (3 diffs)
• src/sh_unix.c (modified) (2 diffs)

trunk/configure.ac

@@ -12 +12 @@
 dnl start
 dnl
-AM_INIT_AUTOMAKE(samhain, 2.5.9b)
+AM_INIT_AUTOMAKE(samhain, 2.5.9c)
 AC_DEFINE([SAMHAIN], 1, [Application is samhain])
 AC_CANONICAL_HOST

trunk/docs/Changelog

@@ +1 @@
+2.5.9c:
+        * move stale file record error message closer to problem zone
+        * sh_port2proc.c: fix flawed logic for interpreting /proc/net/udp,tcp
+        
 2.5.9b:
         * remove stale file record when creating handle, and raise diagnostic

trunk/src/sh_port2proc.c

@@ -46 +46 @@
 #if defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) || defined (SH_STANDALONE))
 
+/* #define DEBUG_P2P 1 */
+
 /****************************************************************************
  *
@@ -329 +331 @@
   *pid = 0;
 
+#ifdef DEBUG_P2P
+  {
+    char errmsg[256];
+    sl_snprintf(errmsg, sizeof(errmsg), 
+                "query, file=%s, proto=%d, port=%d, iface=%s\n",
+                file, proto, sport, inet_ntoa(*saddr));
+    fprintf(stderr, "%s", errmsg);
+  }
+#endif
+
   if (fd)
     {
-      int n, iface, port, inode;
+      unsigned int n, iface, port, inode, istatus;
       char line[512];
 
@@ -337 +349 @@
         {
         
-          if (4 == sscanf(line, 
-                          "%d: %X:%X %*X:%*X %*X %*X:%*X %*X:%*X %*X %*d %*d %d %*s",
-                          &n, &iface, &port, &inode))
+#ifdef DEBUG_P2P
+          {
+            fprintf(stderr, "%s", line);
+          }
+#endif
+
+          if (5 == sscanf(line, 
+                          "%u: %X:%X %*X:%*X %X %*X:%*X %*X:%*X %*X %*d %*d %u %*s",
+                          &n, &iface, &port, &istatus, &inode))
             {
               struct in_addr haddr;
+
               haddr.s_addr = (unsigned long)iface;
 
-              if ((proto == IPPROTO_UDP || haddr.s_addr == saddr->s_addr) && port == sport)
+#ifdef DEBUG_P2P
+              {
+                char a[32];
+                char b[32];
+
+                sl_strlcpy(a, inet_ntoa(haddr), sizeof(a));
+                sl_strlcpy(b, inet_ntoa(*saddr), sizeof(b));
+
+                fprintf(stderr, " -> inode %u, iface/port %s,%u, status %u, searching %s,%u, %u\n", 
+                        inode, a, port, istatus, b, sport, 
+                        proto == IPPROTO_TCP ? 0x0a : 0x07);
+              }
+#endif
+
+              if (proto == IPPROTO_TCP && istatus != 0x0a)
+                continue;
+              if (proto == IPPROTO_UDP && istatus == 0x01)
+                continue;
+
+#ifdef DEBUG_P2P
+              {
+                fprintf(stderr, "check iface %u..\n", iface);
+              }
+#endif
+
+              if ((proto == IPPROTO_UDP || iface == 0 || haddr.s_addr == saddr->s_addr) && port == (unsigned int)sport)
                 {
                   struct sock_store * new = socklist;
 
+#ifdef DEBUG_P2P
+                  {
+                    fprintf(stderr, "found it\n");
+                  }
+#endif
+
                   while (new)
                     {
-                      if ((unsigned int)inode == new->sock)
+#ifdef DEBUG_P2P
+                      {
+                        fprintf(stderr, "searching inode %u: %lu\n", 
+                                inode, new->sock);
+                      }
+#endif
+                      if (inode == new->sock)
                         {
+#ifdef DEBUG_P2P
+                          {
+                            fprintf(stderr, "found it: path=(%s), user=(%s)\n",
+                                    new->path == NULL ? "NULL" : new->path,
+                                    new->user == NULL ? "NULL" : new->user);
+                          }
+#endif
                           fclose(fd);
                           *pid = (unsigned long) new->pid;

trunk/src/sh_unix.c

@@ -3477 +3477 @@
         err_open = errno;
 
+      {
+        char * stale = sl_check_stale();
+
+        if (stale)
+          {
+            sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, err_open, MSG_E_SUBGEN,
+                            stale, _("sh_unix_getinfo_open"));
+          }
+      }
+
       alert_timeout = 120; /* this is per 8K block now ! */
 
@@ -3505 +3515 @@
     {
       fstat_return = retry_fstat (FIL__, __LINE__, fd, &fbuf);
+
       if (fstat_return)
-        fstat_errno = errno;
+        {
+          char * stale;
+
+          fstat_errno = errno;
+
+          stale = sl_check_stale();
+
+          if (stale)
+            {
+              sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, fstat_errno, 
+                              MSG_E_SUBGEN,
+                              stale, _("sh_unix_getinfo_fstat"));
+            }
+        }
     }
   else