char *gdaemon_process_options(gdaemon_t * gdaemon, char *string)
{
char *str = NULL;
char buf[MAX_BUF_SZ];
char *sep_ptr;
dlist_t *dl = NULL, *dptr;
debug(NULL, "gdaemon_process_options: Entered\n");
if (!gdaemon || !string)
return NULL;
sep_ptr = str_find_sep(string);
if (sep_ptr)
string = sep_ptr;
_memset(buf, 0, sizeof(buf));
dl = tokenize(NULL, string, TOKENIZE_NORMAL | TOKENIZE_LEAVEQUOTES,
"...");
if (!dl)
return NULL;
dlist_fornext(dl, dptr) {
gdaemon_process_options_parse(gdaemon,
(char *)dlist_data(dptr));
}
char *map_change_string(dlist_t * dlist_node, bot_t * bot, char *string,
int opt, char *opt_sep, char *opt_append, char *opt_str)
{
dlist_t *dl, *dptr;
char *str = NULL, *tok_ptr;
char buf[MAX_BUF_SZ];
char *sep_ptr;
if (!string || !opt_str || !opt_sep || !opt_append)
return NULL;
sep_ptr = str_find_sep(string);
if (sep_ptr)
string = sep_ptr;
dl = tokenize(bot, string,
TOKENIZE_NORMAL | TOKENIZE_LEAVEQUOTES |
TOKENIZE_LEAVESEP, opt_sep);
if (!dl)
return NULL;
_memset(buf, 0, sizeof(buf));
dlist_fornext(dl, dptr) {
tok_ptr = (char *)dlist_data(dptr);
if (!tok_ptr)
continue;
strlcatfmt_buf(buf, "%s %s%s", opt_str, tok_ptr, opt_append);
}
static void
destroy_dlist_data(Dlist_data *dd)
{
void *ddd = dlist_data(dd);
Dlist_data_destructor dddest = __dlist_data_destructor(dd);
if (ddd && dddest)
dddest(ddd);
}
void queue_foreach (Queue *queue, VisitorFunc visit, void *extra_data)
{
DList *tail = queue_tail(queue);
while (tail != NULL)
{
visit (dlist_data(tail),extra_data);
tail = dlist_previous(tail);
}
}
static pSlipEnvironment get_global_environment(pSlip gd)
{
pSlipEnvironment env;
DLElement *e;
e = dlist_head(gd->lstGlobalEnvironment);
env = dlist_data(e);
return env;
}
bot_t *gnull_run(dlist_t * dlist_node, bot_t * bot)
{
dlist_t *dptr_gmod = NULL;
bot_gmod_elm_t *gmod = NULL;
gnull_t *gnull = NULL;
char *dl_module_arg_after_options, *dl_options_ptr;
debug(bot, "gnull_run: Entered\n");
if (!dlist_node || !bot)
return NULL;
stat_inc(bot, bot->trig_called);
debug(bot,
"gnull_run: Entered: initial output buf=[%s], input buf=[%s], gmod_arg=[%s]\n",
bot->txt_data_out, bot->txt_data_in, bot->dl_module_arg);
if (_bot_shouldreturn(bot))
return NULL;
dptr_gmod =
(dlist_t *) gmodule_find_gmod_dptr(bot, gmod_gnull_info.trigger,
gmod_gnull_info.trigger_ext);
if (!dptr_gmod)
return NULL;
gmod = (bot_gmod_elm_t *) dlist_data(dptr_gmod);
if (!gmod) {
debug(NULL, "gnull_run: GNULL GMOD=NULL\n");
return NULL;
}
if (!gmod->data) {
debug(NULL, "gnull_run: GIRCD GMOD->DATA = NULL, ALLOCATING\n");
gnull_gmod_init(bot, gmod, dptr_gmod);
gnull = gmod->data;
}
MOD_OPTIONS_TOP_HALF;
gnull_process_options(gnull, dl_options_ptr);
MOD_OPTIONS_BOTTOM_HALF;
gmodule_set_can_pass_up(gmod);
gmodule_set_can_pass_down(gmod);
gnull_input(dptr_gmod, bot);
gmodule_set_has_run(gmod);
return bot;
}
static pToken peek_input(pSlip gd)
{
pToken t;
if (gd->parse_data.eCurrentToken == NULL)
return NULL;
t = dlist_data(gd->parse_data.eCurrentToken);
return t;
}
dlist_node_t *dlist_search_dlist_node(dlist_node_t **list, void *key, int (*cmp)(void *, void*))
{
dlist_node_t *p = *list;
while(p) {
if(cmp(key, dlist_data(p)) == 0)
return p;
p = dlist_next(p);
}
return NULL;
}
void
gtk_c_capturedialog_save(GtkWidget *button, gpointer userdata)
{
GtkWidget *dialog;
struct gtk_s_helper *helper;
char *filename;
u_int8_t iface;
pcap_dumper_t *pdumper;
dlist_t *p;
struct interface_data *iface_data;
helper = (struct gtk_s_helper *)userdata;
dialog = lookup_widget(GTK_WIDGET(button), "savedialog");
filename = gtk_file_chooser_get_filename (GTK_FILE_CHOOSER (dialog));
if (helper->extra == PROTO_ALL) {
pdumper = helper->node->pcap_file.pdumper;
iface = interfaces_get_last_int(PROTO_ALL);
} else {
pdumper = helper->node->protocol[helper->extra].pcap_file.pdumper;
iface = interfaces_get_last_int(helper->extra);
}
if (pdumper) {
gtk_i_create_warningdialog("%s", "Error: pcap_file is in use");
return;
}
/* Take the first active interface for saving data */
p = interfaces->list;
while(p) {
iface_data = (struct interface_data *) dlist_data(p);
if (iface_data->up) {
if (filename[0] && interfaces_pcap_file_open(helper->node, helper->extra, filename, iface_data->ifname) < 0)
{
write_log(0, "Error opening file %s to save pcap data\n", filename);
gtk_gui_th_exit(helper->node);
}
break;
}
else
p = dlist_next(interfaces->list, p);
}
/* No interface found*/
if (p == NULL)
gtk_i_create_warningdialog("%s", "Error: there is no active interface");
g_free(filename);
gtk_widget_destroy(GTK_WIDGET(dialog));
}
void *dlist_ith_elmt_data(DList *list, int index)
{
int cnt=0;
DListElmt *element;
if (!list || index < 0 || index > list->size-1) return(NULL);
element = list->head;
while (index > cnt) {
element = element->next; ++cnt;
}
return(dlist_data(element));
}
char *rant_op_list(bot_t * bot, dlist_t ** dl)
{
dlist_t *dl_bu_list = NULL, *dptr_bu = NULL;
unique_t *bu_tmp = NULL;
char *str = NULL;
dlist_fornext(dl_mod_rant_unique, dptr_bu) {
bu_tmp = (unique_t *) dlist_data(dptr_bu);
str = unique_bu2str(bu_tmp, UNIQUE_BU2STR_NEWLINE);
dlist_Dinsert_after(&dl_bu_list, str);
str = dlist_to_str(dl_bu_list);
dlist_fini(&dl_bu_list, free);
}
char *quiz_op_get(bot_t * bot, char *name, int recnum)
{
xdb_pair_t *pair = NULL, *pair_2 = NULL;
dlist_t *dptr;
DB *db = NULL;
char *str = NULL;
int count;
debug(bot, "quiz_op_get: Entered: %s, %i\n", name, recnum);
if (!bot || !name || recnum < 0) {
return NULL;
}
if (!dl_quiz_pairs)
return NULL;
if (!_strcmp(name, "*")) {
dptr = dlist_node_rand(dl_quiz_pairs);
if (!dptr)
goto cleanup;
pair = (xdb_pair_t *) dlist_data(dptr);
if (!pair)
goto cleanup;
} else {
dlist_fornext(dl_quiz_pairs, dptr) {
pair = (xdb_pair_t *) dlist_data(dptr);
if (!pair)
continue;
if (!pair->key)
continue;
if (!strcasecmp(pair->key, name)) {
break;
}
pair = NULL;
}
}
int8_t
dot1x_learn_packet(struct attacks *attacks, char *iface, u_int8_t *stop, void *data, struct pcap_pkthdr *header)
{
struct dot1x_data *dot1x_data;
struct pcap_data pcap_aux;
u_int8_t *packet, got_802_1x_pkt = 0;
u_int16_t *cursor;
dlist_t *p;
struct interface_data *iface_data;
dot1x_data = data;
if ((packet = calloc(1, SNAPLEN)) == NULL)
return -1;
if (iface) {
p = dlist_search(attacks->used_ints->list, attacks->used_ints->cmp, iface);
if (!p)
return -1;
iface_data = (struct interface_data *) dlist_data(p);
}
else
iface_data = NULL;
while (!got_802_1x_pkt && !(*stop))
{
interfaces_get_packet(attacks->used_ints, iface_data, stop, header, packet, PROTO_DOT1X, NO_TIMEOUT);
if (*stop)
{
free(packet);
return -1;
}
cursor = (u_int16_t *)(packet + 12);
pcap_aux.header = header;
pcap_aux.packet = packet;
if (!dot1x_load_values((struct pcap_data *)&pcap_aux, dot1x_data))
got_802_1x_pkt = 1;
} /* While got */
free(packet);
return 0;
}
int8_t
vtp_learn_packet(struct attacks *attacks, char *iface, u_int8_t *stop, void *data, struct pcap_pkthdr *header)
{
struct vtp_data *vtp_data;
struct pcap_data pcap_aux;
u_int8_t *packet, *cursor, got_vtp_packet = 0;
dlist_t *p;
struct interface_data *iface_data;
vtp_data = data;
if ((packet = calloc(1, SNAPLEN)) == NULL)
return -1;
if (iface) {
p = dlist_search(attacks->used_ints->list, attacks->used_ints->cmp, iface);
if (!p)
return -1;
iface_data = (struct interface_data *) dlist_data(p);
} else {
iface_data = NULL;
}
while (!got_vtp_packet && !(*stop))
{
interfaces_get_packet(attacks->used_ints, iface_data, stop, header, packet, PROTO_VTP, NO_TIMEOUT);
if (*stop)
{
free(packet);
return -1;
}
cursor = (packet + LIBNET_802_3_H + LIBNET_802_2_H);
pcap_aux.header = header;
pcap_aux.packet = packet;
if (!vtp_load_values((struct pcap_data *)&pcap_aux, vtp_data))
got_vtp_packet = 1;
} /* While got */
free(packet);
return 0;
}
int8_t hsrp_learn_packet( struct attacks *attacks, char *iface, u_int8_t *stop, void *data, struct pcap_pkthdr *header,
struct pcap_data *pcap_aux)
{
struct hsrp_data *hsrp_data = (struct hsrp_data *)data;
struct interface_data *iface_data = NULL ;
u_int8_t got_hsrp_packet = 0;
u_int8_t *packet;
dlist_t *p;
int8_t ret = -1 ;
if ( iface )
{
p = dlist_search( attacks->used_ints->list, attacks->used_ints->cmp, iface );
if ( !p )
return -1;
iface_data = (struct interface_data *) dlist_data(p);
}
packet = calloc( 1, SNAPLEN );
if ( packet )
{
while ( !got_hsrp_packet && !(*stop) )
{
interfaces_get_packet( attacks->used_ints, iface_data, stop, header, packet, PROTO_HSRP, NO_TIMEOUT );
if ( !(*stop) )
{
pcap_aux->header = header;
pcap_aux->packet = packet;
if ( !hsrp_load_values( pcap_aux, hsrp_data ) )
{
got_hsrp_packet = 1;
ret = 0 ;
}
}
}
free(packet);
}
return ret;
}
int8_t dtp_learn_packet( struct attacks *attacks, char *iface, u_int8_t *stop, void *data, struct pcap_pkthdr *header )
{
struct dtp_data *dtp_data = (struct dtp_data *)data;
struct interface_data *iface_data = NULL ;
struct pcap_data pcap_aux;
u_int8_t *packet, got_dtp_packet = 0;
dlist_t *p;
int8_t ret = -1 ;
if ( iface)
{
p = dlist_search(attacks->used_ints->list, attacks->used_ints->cmp, iface);
if ( !p )
return -1;
iface_data = (struct interface_data *) dlist_data(p);
}
packet = (u_int8_t *)calloc( 1, SNAPLEN );
if ( packet )
{
while ( !got_dtp_packet && !(*stop) )
{
interfaces_get_packet( attacks->used_ints, iface_data, stop, header, packet, PROTO_DTP, NO_TIMEOUT );
if ( !(*stop) )
{
pcap_aux.header = header;
pcap_aux.packet = packet;
if ( !dtp_load_values( (struct pcap_data *)&pcap_aux, dtp_data ) )
{
ret = 0 ;
got_dtp_packet = 1;
}
}
}
free(packet);
}
return ret ;
}
static pSlipValue ScanForVar(pSlipObject o, pSlipEnvironment env)
{
DLElement *e;
pSlipValue v;
e = dlist_head(env->lstVars);
while (e != NULL)
{
v = dlist_data(e);
e = dlist_next(e);
if (v->var == o)
{
return v;
}
}
return NULL;
}
Dlist_data *
dlist_insert_object(Dlist *dl, Dlist_data *inserted, void *d, Dlist_data_destructor dddest)
{
Dlist_data *dd;
#ifdef DEBUG
bug_on(__dlist_dlist(inserted) != dl);
#endif
dd = dlist_data_create(dl);
if (unlikely(dd == NULL))
return NULL;
dlist_data(dd) = d;
__dlist_data_destructor(dd) = dddest;
dlist_attach(dl, dd, inserted);
return dd;
}
int
spellcast_htable_remove(sp_hash_table *ht, int key, void **data)
{
int bucket = hash_key(ht, key);
listElement *element;
for (element = dlist_head(&ht->table[bucket]); element != NULL; element = dlist_next(element)) {
if (ht->match(key, dlist_data(element))) {
if (dlist_remove(&ht->table[bucket], element, data) == 0) {
ht->size--;
return 0;
}
else {
return -1;
}
}
}
return -1;
}
char *moby_get_syn(DB * db, char *tok, int opt)
{
dlist_t *dl = NULL, *dptr = NULL;
xdb_pair_t *pair = NULL;
char *str = NULL;
debug(NULL, "moby_get_syn: Entered\n");
if (!tok || !moby_info.initialized)
return NULL;
str_apply(tok, tolower);
pair = xdb_get(db, tok);
if (!pair)
return NULL;
if (opt == MOBY_SINGLE) {
dl = tokenize(NULL, pair->value,
TOKENIZE_NORMAL | TOKENIZE_EATWHITESPACE, ",");
if (!dl)
goto cleanup;
dptr = dlist_node_rand(dl);
if (!dptr)
goto cleanup;
str = str_unite_static("%s", (char *)dlist_data(dptr));
} else if (opt == MOBY_LIST) {
str = str_unite_static("%s,%s", pair->key, pair->value);
}
cleanup:
if (dl)
tokenize_destroy(NULL, &dl);
xdb_pair_destroy(pair);
return str;
}
state_t __PICK(context_t *ctx)
{
int u;
if (popnum(ctx->ds, &u))
{
dlist_elem_t *element = dlist_head(ctx->ds);
while (u >= 0 && element != NULL)
{
if (u == 0)
{
int *num = dlist_data(element);
pushnum(ctx->ds, *num);
return OK;
}
u--;
element = dlist_next(element);
}
}
return error(ctx, -11); // result out of range
}
void bot_unix_node_destroy(void *arg)
{
dlist_t *dptr;
bot_unix_node_t *bun;
if (!arg)
return;
dptr = (dlist_t *) arg;
bun = (bot_unix_node_t *) dlist_data(dptr);;
safe_event_del(&bun->ev);
safe_close(bun->ev_fd);
free(bun);
dlist_remove(&dl_bot_unix, dptr);
free(dptr);
return;
}
void zmodule_lock(void)
{
module_t *mod;
dlist_t *dl_pointer, *dlist_pointers[4], *dptr;
int i;
debug(NULL, "zmodule_lock: Entered\n");
dlist_pointers[0] = gi->dl_module;
dlist_pointers[1] = gi->dl_pmodule;
dlist_pointers[2] = gi->dl_gmodule;
dlist_pointers[3] = NULL;
for (i = 0; dlist_pointers[i] != NULL; i++) {
dl_pointer = dlist_pointers[i];
dlist_fornext(dl_pointer, dptr) {
mod = (module_t *) dlist_data(dptr);
if (!mod)
continue;
mod->locked = 1;
}
}
pSlipObject s_NewSymbol(pSlip gd, uint8_t *data)
{
pSlipObject obj;
DLElement *e;
e = dlist_head(gd->lstSymbols);
while (e != NULL)
{
obj = dlist_data(e);
e = dlist_next(e);
if (strcmp(obj->data.symbol.value, data) == 0)
return obj;
}
obj = s_NewObject(gd);
obj->type = eType_SYMBOL;
obj->data.symbol.value = strdup(data);
dlist_ins(gd->lstSymbols, obj);
return obj;
}
static void
search_dictionaries(int out, Dlist *dic_list, char *rbuf)
{
Dlist_data *dd;
Hash *word_hash;
char word[SKKSERV_WORD_SIZE];
char result[SKKSERV_RESULT_SIZE];
char tmpresult[SKKSERV_RESULT_SIZE];
char *end;
int i, p, r, len, rlen, ncandidates;
if ((end = strchr(rbuf + 1, ' ')) == NULL) {
rbuf[0] = SKKSERV_S_ERROR;
write(out, rbuf, strlen(rbuf));
return;
}
len = end - (rbuf + 1);
memcpy(word, rbuf + 1, len);
word[len] = '\0';
word_hash = hash_create(HASH_SIZE);
rlen = 1;
ncandidates = 0;
result[0] = SKKSERV_S_FOUND;
dlist_iter(dic_list, dd) {
Dictionary *dic = dlist_data(dd);
pthread_mutex_lock(&dic->mutex);
__cdb_findstart(dic);
if ((r = __cdb_findnext(dic, word, len)) == -1) {
err_message_fnc("cdb_findnext() failed.\n");
if (!ncandidates) {
rbuf[0] = SKKSERV_S_ERROR;
write(out, rbuf, strlen(rbuf));
}
pthread_mutex_unlock(&dic->mutex);
hash_destroy(word_hash);
return;
}
debug_message_fnc("word %s, len %d, r = %d\n", word, len, r);
if (r) {
int dpos = cdb_datapos(&dic->cdb);
int dlen = cdb_datalen(&dic->cdb);
debug_message_fnc("%s found, r = %d, dpos = %d, dlen = %d.\n", word, r, dpos, dlen);
if (rlen + dlen + 2 > SKKSERV_RESULT_SIZE) {
err_message_fnc("Truncated: %s\n", word);
r = SKKSERV_RESULT_SIZE - rlen - 2;
} else {
r = dlen;
}
debug_message_fnc("read %d bytes\n", r);
if (cdb_read(&dic->cdb, tmpresult, r, dpos) == -1) {
if (!ncandidates) {
err_message_fnc("cdb_read() failed.\n");
rbuf[0] = SKKSERV_S_ERROR;
write(out, rbuf, strlen(rbuf));
pthread_mutex_unlock(&dic->mutex);
hash_destroy(word_hash);
return;
} else {
result[rlen] = '\0';
continue;
}
}
/* Merge */
p = 0;
i = 1;
while (i < r) {
if (tmpresult[i] == '/') {
if (i - p - 1 > 0 &&
hash_define_value(word_hash, tmpresult + p + 1, i - p - 1, (void *)1) == 1) {
memcpy(result + rlen, tmpresult + p, i - p);
rlen += i - p;
ncandidates++;
}
p = i;
}
i++;
}
}
pthread_mutex_unlock(&dic->mutex);
}
/* Launch choosed attack... */
int8_t
attack_launch(struct term_node *node, u_int16_t proto, u_int16_t attack,
struct attack_param *attack_params, u_int8_t nparams)
{
u_int16_t i = 0;
dlist_t *p;
void *value1, *value2;
while (i < MAX_THREAD_ATTACK)
{
if (node->protocol[proto].attacks[i].up == 0)
{
node->protocol[proto].attacks[i].up = 1;
node->protocol[proto].attacks[i].mac_spoofing = node->mac_spoofing;
node->protocol[proto].attacks[i].attack = attack;
node->protocol[proto].attacks[i].params = attack_params;
node->protocol[proto].attacks[i].nparams = nparams;
/* FIXME: temporal hasta ponerlo bien, pillamos para el ataque las interfaces del usuario */
node->protocol[proto].attacks[i].used_ints = (list_t *) calloc(1, sizeof(list_t));
for (p = node->used_ints->list; p; p = dlist_next(node->used_ints->list, p)) {
value1 = dlist_data(p);
value2 = (void *) calloc(1, sizeof(struct interface_data));
memcpy((void *)value2, (void *)value1, sizeof(struct interface_data));
node->protocol[proto].attacks[i].used_ints->list =
dlist_append(node->protocol[proto].attacks[i].used_ints->list, value2);
}
node->protocol[proto].attacks[i].used_ints->cmp = interfaces_compare;
if ((node->protocol[proto].attacks[i].data = calloc(1, protocols[proto].size )) == NULL)
{
thread_error("attack_launch calloc",errno);
node->protocol[proto].attacks[i].params = NULL;
node->protocol[proto].attacks[i].nparams = 0;
node->protocol[proto].attacks[i].up = 0;
return -1;
}
memcpy(node->protocol[proto].attacks[i].data,
node->protocol[proto].tmp_data, protocols[proto].size );
if (pthread_mutex_init(&node->protocol[proto].attacks[i].attack_th.finished, NULL) != 0)
{
thread_error("attack_launch pthread_mutex_init mutex", errno);
free(node->protocol[proto].attacks[i].data);
return -1;
}
if (pthread_mutex_init(&node->protocol[proto].attacks[i].helper_th.finished, NULL) != 0)
{
thread_error("attack_launch pthread_mutex_init mutex", errno);
free(node->protocol[proto].attacks[i].data);
return -1;
}
if (thread_create(&node->protocol[proto].attacks[i].attack_th.id,
(*protocols[proto].attacks[attack].attack_th_launch),
&node->protocol[proto].attacks[i]) < 0)
{
free(node->protocol[proto].attacks[i].data);
node->protocol[proto].attacks[i].params = NULL;
node->protocol[proto].attacks[i].nparams = 0;
node->protocol[proto].attacks[i].up = 0;
return -1;
}
write_log(0, " attack_launch: %d Attack thread %ld is born!!\n", (int)pthread_self(),
(u_long) node->protocol[proto].attacks[i].attack_th.id);
return 0;
}
i++;
} /* while...*/
return -1;
}
bot_t *rf_run(dlist_t * dlist_node, bot_t * bot)
{
dlist_t *dptr;
module_t *module;
char *dl_module_arg_after_options, *dl_options_ptr;
char **array, trig_tmp[32];
int array_size;
int rand_val;
array = NULL;
array_size = 0;
debug(bot, "rf_run: Entered\n");
if (!dlist_node || !bot)
return NULL;
if (gi->mongo_isconnected == 0) {
debug(bot, "rf_run: Mongo is not connected\n");
return NULL;
}
stat_inc(bot, bot->trig_called);
debug(bot,
"rf_run: Entered: initial output buf=[%s], input buf=[%s], mod_arg=[%s]\n",
bot->txt_data_out, bot->txt_data_in, bot->dl_module_arg);
if (_bot_shouldreturn(bot))
return NULL;
MOD_OPTIONS_TOP_HALF;
array =
tokenize_array(bot, dl_options_ptr,
TOKENIZE_NORMAL | TOKENIZE_LEAVEQUOTES,
":::", &array_size);
if (!array)
return NULL;
MOD_OPTIONS_BOTTOM_HALF;
if (!array)
return NULL;
rand_val = rand() % (array_size);
strlcpy_safe(&trig_tmp[1], ret_trig(&array[rand_val][1]),
sizeof(trig_tmp) - 2);
if (!_sNULL(&trig_tmp[1]))
return NULL;
trig_tmp[0] = '^';
dptr = xmodule_find_by_trig_dptr(XMODULE_TYPE_MODULE, trig_tmp);
if (dptr) {
module = (module_t *) dlist_data(dptr);
if (module) {
if (module->run) {
strlcpy_buf(bot->txt_data_in, array[rand_val]);
bot->dl_module_arg =
bot->txt_data_in + strlen(module->trigger);
module->run(dptr, bot);
}
}
}
tokenize_destroy_array(bot, array);
return bot;
}
void bot_evhook_unix_read(int fd, short event, void *arg)
{
dlist_t *dptr;
bot_unix_node_t *bun;
struct cmsghdr *hdr;
struct msghdr msg;
char cmsg_buf[sizeof(struct cmsghdr) + sizeof(long)];
struct iovec iov[2];
int passed_fd;
int op;
char tag[132];
if (!arg) {
safe_close(fd);
return;
}
dptr = (dlist_t *) arg;
if (!dptr->data) {
safe_close(fd);
return;
}
bun = (bot_unix_node_t *) dlist_data(dptr);
debug(NULL, "bot_evhook_unix_read: Entered\n");
bz2(msg);
iov[0].iov_base = &op;
iov[0].iov_len = sizeof(op);
iov[1].iov_base = &tag;
iov[1].iov_len = sizeof(tag);
msg.msg_iov = (struct iovec *)&iov;
msg.msg_iovlen = 2;
msg.msg_control = cmsg_buf;
msg.msg_controllen = sizeof(cmsg_buf);
errno = 0;
if (recvmsg(fd, &msg, 0) < 0) {
perror("recvmsg: Entered ");
bot_unix_node_destroy(dptr);
return;
}
bz2(iov);
if (msg.msg_iovlen > 0) {
if (op == BOT_UNIX_OP_FDPASS || BOT_UNIX_OP_TAG) {
strlcpy_buf(bun->tag, tag);
bun->op = op;
} else if (op == BOT_UNIX_OP_CLOSE) {
}
}
if (op == BOT_UNIX_OP_FDPASS) {
hdr = CMSG_FIRSTHDR(&msg);
if (!hdr) {
goto fdpass_cleanup;
}
if (hdr->cmsg_level != SOL_SOCKET
|| hdr->cmsg_type != SCM_RIGHTS) {
goto fdpass_cleanup;
}
passed_fd = *(int *)CMSG_DATA(hdr);
bun->passed_fd = passed_fd;
bot_find_and_set_fd(bun->tag, bun->passed_fd);
fdpass_cleanup:
bot_unix_node_destroy(dptr);
}
sleep(1);
return;
}
int main(int argc, char **argv) {
DList list;
DListElmt *element;
int *data,
i;
/*****************************************************************************
* *
* Initialize the doubly-linked list. *
* *
*****************************************************************************/
dlist_init(&list, free);
/*****************************************************************************
* *
* Perform some doubly-linked list operations. *
* *
*****************************************************************************/
element = dlist_head(&list);
for (i = 10; i > 0; i--) {
if ((data = (int *)malloc(sizeof(int))) == NULL)
return 1;
*data = i;
if (dlist_ins_prev(&list, dlist_head(&list), data) != 0)
return 1;
}
print_list(&list);
element = dlist_head(&list);
for (i = 0; i < 8; i++)
element = dlist_next(element);
data = dlist_data(element);
fprintf(stdout, "Removing an element after the one containing %03d\n", *data);
if (dlist_remove(&list, element, (void **)&data) != 0)
return 1;
print_list(&list);
fprintf(stdout, "Inserting 011 at the tail of the list\n");
*data = 11;
if (dlist_ins_next(&list, dlist_tail(&list), data) != 0)
return 1;
print_list(&list);
fprintf(stdout, "Removing an element at the tail of the list\n");
element = dlist_tail(&list);
if (dlist_remove(&list, element, (void **)&data) != 0)
return 1;
print_list(&list);
fprintf(stdout, "Inserting 012 just before the tail of the list\n");
*data = 12;
if (dlist_ins_prev(&list, dlist_tail(&list), data) != 0)
return 1;
print_list(&list);
fprintf(stdout, "Iterating and removing the fourth element\n");
element = dlist_head(&list);
element = dlist_next(element);
element = dlist_prev(element);
element = dlist_next(element);
element = dlist_prev(element);
element = dlist_next(element);
element = dlist_next(element);
element = dlist_next(element);
if (dlist_remove(&list, element, (void **)&data) != 0)
return 1;
print_list(&list);
fprintf(stdout, "Inserting 013 before the first element\n");
*data = 13;
if (dlist_ins_prev(&list, dlist_head(&list), data) != 0)
return 1;
print_list(&list);
fprintf(stdout, "Removing an element at the head of the list\n");
if (dlist_remove(&list, dlist_head(&list), (void **)&data) != 0)
return 1;
print_list(&list);
fprintf(stdout, "Inserting 014 just after the head of the list\n");
*data = 14;
if (dlist_ins_next(&list, dlist_head(&list), data) != 0)
return 1;
print_list(&list);
fprintf(stdout, "Inserting 015 two elements after the head of the list\n");
if ((data = (int *)malloc(sizeof(int))) == NULL)
return 1;
*data = 15;
element = dlist_head(&list);
element = dlist_next(element);
if (dlist_ins_next(&list, element, data) != 0)
return 1;
print_list(&list);
i = dlist_is_head(dlist_head(&list));
fprintf(stdout, "Testing dlist_is_head...Value=%d (1=OK)\n", i);
i = dlist_is_head(dlist_tail(&list));
fprintf(stdout, "Testing dlist_is_head...Value=%d (0=OK)\n", i);
i = dlist_is_tail(dlist_tail(&list));
fprintf(stdout, "Testing dlist_is_tail...Value=%d (1=OK)\n", i);
i = dlist_is_tail(dlist_head(&list));
fprintf(stdout, "Testing dlist_is_tail...Value=%d (0=OK)\n", i);
/*****************************************************************************
* *
* Destroy the doubly-linked list. *
* *
*****************************************************************************/
fprintf(stdout, "Destroying the list\n");
dlist_destroy(&list);
return 0;
}
int8_t
vtp_send(struct attacks *attacks)
{
libnet_ptag_t t;
libnet_t *lhandler;
u_int32_t vtp_len=0, sent;
struct vtp_data *vtp_data;
struct vtp_summary *vtp_summ;
struct vtp_subset *vtp_subset;
struct vtp_request *vtp_request;
struct vtp_join *vtp_join;
u_int8_t *vtp_packet, *aux;
u_int8_t cisco_data[]={ 0x00, 0x00, 0x0c, 0x20, 0x03 };
dlist_t *p;
struct interface_data *iface_data;
struct interface_data *iface_data2;
vtp_data = attacks->data;
switch(vtp_data->code)
{
case VTP_SUMM_ADVERT:
vtp_len = sizeof(cisco_data)+sizeof(struct vtp_summary);
break;
case VTP_SUBSET_ADVERT:
vtp_len = sizeof(cisco_data)+sizeof(struct vtp_subset)+vtp_data->vlans_len;
break;
case VTP_REQUEST:
vtp_len = sizeof(cisco_data)+38;
break;
case VTP_JOIN:
vtp_len = sizeof(cisco_data)+40+126;
break;
default:
vtp_len = sizeof(cisco_data)+30;
break;
}
vtp_packet = calloc(1,vtp_len);
if (vtp_packet == NULL)
{
thread_error("vtp_send calloc error",errno);
return -1;
}
aux = vtp_packet;
memcpy(vtp_packet,cisco_data,sizeof(cisco_data));
aux+=sizeof(cisco_data);
switch(vtp_data->code)
{
case VTP_SUMM_ADVERT:
vtp_summ = (struct vtp_summary *)aux;
vtp_summ->version = vtp_data->version;
vtp_summ->code = vtp_data->code;
vtp_summ->followers = vtp_data->followers;
if (vtp_data->dom_len > VTP_DOMAIN_SIZE)
{
vtp_summ->dom_len = VTP_DOMAIN_SIZE;
memcpy(vtp_summ->domain,vtp_data->domain,VTP_DOMAIN_SIZE);
}
else
{
vtp_summ->dom_len = vtp_data->dom_len;
memcpy(vtp_summ->domain,vtp_data->domain,vtp_data->dom_len);
}
vtp_summ->revision = htonl(vtp_data->revision);
vtp_summ->updater = htonl(vtp_data->updater);
memcpy(vtp_summ->timestamp,vtp_data->timestamp,VTP_TIMESTAMP_SIZE);
memcpy(vtp_summ->md5,vtp_data->md5,16);
break;
case VTP_SUBSET_ADVERT:
vtp_subset = (struct vtp_subset *)aux;
vtp_subset->version = vtp_data->version;
vtp_subset->code = vtp_data->code;
vtp_subset->seq = vtp_data->seq;
if (vtp_data->dom_len > VTP_DOMAIN_SIZE)
{
vtp_subset->dom_len = VTP_DOMAIN_SIZE;
memcpy(vtp_subset->domain,vtp_data->domain,VTP_DOMAIN_SIZE);
}
else
{
vtp_subset->dom_len = vtp_data->dom_len;
memcpy(vtp_subset->domain,vtp_data->domain,vtp_data->dom_len);
}
vtp_subset->revision = htonl(vtp_data->revision);
if (vtp_data->vlans_len)
memcpy((vtp_subset+1),vtp_data->vlan_info,vtp_data->vlans_len);
break;
case VTP_REQUEST:
vtp_request = (struct vtp_request *)aux;
vtp_request->version = vtp_data->version;
vtp_request->code = vtp_data->code;
vtp_request->reserved = 0;
if (vtp_data->dom_len > VTP_DOMAIN_SIZE)
{
vtp_request->dom_len = VTP_DOMAIN_SIZE;
memcpy(vtp_request->domain,vtp_data->domain,VTP_DOMAIN_SIZE);
}
else
{
vtp_request->dom_len = vtp_data->dom_len;
memcpy(vtp_request->domain,vtp_data->domain,vtp_data->dom_len);
}
vtp_request->start_val = htons(vtp_data->start_val);
break;
case VTP_JOIN:
vtp_join = (struct vtp_join *)aux;
vtp_join->version = vtp_data->version;
vtp_join->code = vtp_data->code;
vtp_join->maybe_reserved = 0;
if (vtp_data->dom_len > VTP_DOMAIN_SIZE)
{
vtp_join->dom_len = VTP_DOMAIN_SIZE;
memcpy(vtp_join->domain,vtp_data->domain,VTP_DOMAIN_SIZE);
}
else
{
vtp_join->dom_len = vtp_data->dom_len;
memcpy(vtp_join->domain,vtp_data->domain,vtp_data->dom_len);
}
vtp_join->vlan = htonl(0x000003ef);
vtp_join->unknown[0] = 0x40;
break;
default:
aux[0]=vtp_data->version;
aux[1]=vtp_data->code;
break;
}
for (p = attacks->used_ints->list; p; p = dlist_next(attacks->used_ints->list, p)) {
iface_data = (struct interface_data *) dlist_data(p);
lhandler = iface_data->libnet_handler;
t = libnet_build_802_2(
0xaa, /* DSAP */
0xaa, /* SSAP */
0x03, /* control */
vtp_packet, /* payload */
vtp_len, /* payload size */
lhandler, /* libnet handle */
0); /* libnet id */
if (t == -1)
{
thread_libnet_error("Can't build ethernet header",lhandler);
libnet_clear_packet(lhandler);
free(vtp_packet);
return -1;
}
t = libnet_build_802_3(
vtp_data->mac_dest, /* ethernet destination */
(attacks->mac_spoofing) ? vtp_data->mac_source : iface_data->etheraddr,
/* ethernet source */
LIBNET_802_2_H + vtp_len, /* frame size */
NULL, /* payload */
0, /* payload size */
lhandler, /* libnet handle */
0); /* libnet id */
if (t == -1)
{
thread_libnet_error("Can't build ethernet header",lhandler);
libnet_clear_packet(lhandler);
free(vtp_packet);
return -1;
}
/*
* Write it to the wire.
*/
sent = libnet_write(lhandler);
if (sent == -1) {
thread_libnet_error("libnet_write error", lhandler);
libnet_clear_packet(lhandler);
free(vtp_packet);
return -1;
}
libnet_clear_packet(lhandler);
protocols[PROTO_VTP].packets_out++;
iface_data2 = interfaces_get_struct(iface_data->ifname);
iface_data2->packets_out[PROTO_VTP]++;
}
free(vtp_packet);
return 0;
}
