Compare commits
60 commits
epel8-play
...
rawhide
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
a476e8990d | ||
|
|
f5bd6a873d | ||
|
|
a81639dc4e | ||
|
|
2a82b655e1 | ||
|
|
0eb683f555 | ||
|
|
c3050717fe | ||
|
|
5d145534b5 | ||
|
|
310f4bc004 | ||
|
|
4f0ccc36c3 | ||
|
|
1cfcda870d | ||
|
|
da71523d43 | ||
|
|
3e34b32631 | ||
|
|
1af60d26ae | ||
|
|
9f7e9615ed | ||
|
|
61a9764dda | ||
|
|
47c99b175b | ||
|
|
29393ab3f7 | ||
|
|
c1150678db | ||
|
|
489e8b927a | ||
|
|
0bbfdd6b6d | ||
|
|
6ee706ada0 | ||
|
|
aa41d4ac69 | ||
|
|
4ac7ad3ddd | ||
|
|
26c1a4ccd4 | ||
|
|
d6e6ac61e8 | ||
|
|
7904b57be3 | ||
|
|
718aa9bd74 | ||
|
|
bc58c61121 | ||
|
|
1b5d8db46b |
||
|
|
2691a0d8fa | ||
|
|
4d4ea6e621 | ||
|
|
301d2e0e3f | ||
|
|
ce862dec59 | ||
|
|
6ea5ca562b | ||
|
|
51d6c6cf4e | ||
|
|
68330d68ee | ||
|
|
dfa94ab8c7 | ||
|
|
786d646de5 | ||
|
|
6cc4e64a70 | ||
|
|
7224f1726c | ||
|
|
2d8dbdd6e3 | ||
|
|
06440e9b1c | ||
|
|
1d7733517e | ||
|
|
cdf19c2768 | ||
|
|
dfdbb178f0 | ||
|
|
498c7eb45b | ||
|
|
af63eada3e | ||
|
|
b8691a0d36 | ||
|
|
61c1d87840 | ||
|
|
8175dc5a23 | ||
|
|
d03110ffc2 | ||
|
|
77e944f80c | ||
|
|
06fe77fa6b | ||
|
|
533be1f156 | ||
|
|
fcb477bed3 | ||
|
|
758410f07c | ||
|
|
221fa0f5c0 | ||
|
|
a2cb05a698 | ||
|
|
d187c650e7 | ||
|
|
fa493111cc |
28 changed files with 17534 additions and 21 deletions
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
pads-1.2.tar.gz
|
||||
21
Makefile
21
Makefile
|
|
@ -1,21 +0,0 @@
|
|||
# Makefile for source rpm: pads
|
||||
# $Id$
|
||||
NAME := pads
|
||||
SPECFILE = $(firstword $(wildcard *.spec))
|
||||
|
||||
define find-makefile-common
|
||||
for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
|
||||
endef
|
||||
|
||||
MAKEFILE_COMMON := $(shell $(find-makefile-common))
|
||||
|
||||
ifeq ($(MAKEFILE_COMMON),)
|
||||
# attept a checkout
|
||||
define checkout-makefile-common
|
||||
test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
|
||||
endef
|
||||
|
||||
MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
|
||||
endif
|
||||
|
||||
include $(MAKEFILE_COMMON)
|
||||
153
pads+vlan.patch
Normal file
153
pads+vlan.patch
Normal file
|
|
@ -0,0 +1,153 @@
|
|||
diff -r -c ./src/packet.c ../pads-1.2+vlan/src/packet.c
|
||||
*** ./src/packet.c 2005-02-15 20:47:35.000000000 -0500
|
||||
--- ../pads-1.2+vlan/src/packet.c 2007-08-24 10:11:59.000000000 -0400
|
||||
***************
|
||||
*** 35,59 ****
|
||||
* : 1 - Packet
|
||||
* RETURN : None!
|
||||
* ---------------------------------------------------------- */
|
||||
void process_eth (const struct pcap_pkthdr* pkthdr, const u_char* packet)
|
||||
{
|
||||
struct ether_header *ethh; /* net/ethernet.h */
|
||||
|
||||
! /* Extract the ethernet header from the packet. */
|
||||
! ethh = (struct ether_header*) packet;
|
||||
|
||||
/* Determine what type of ethernet packet this is. */
|
||||
switch (ntohs(ethh->ether_type)) {
|
||||
/* IP */
|
||||
case ETHERTYPE_IP:
|
||||
! process_ip (pkthdr, packet, sizeof(struct ether_header));
|
||||
! break;
|
||||
|
||||
/* ARP */
|
||||
case ETHERTYPE_ARP:
|
||||
! process_arp (pkthdr, packet, sizeof(struct ether_header));
|
||||
break;
|
||||
!
|
||||
/* Unknown Type */
|
||||
default:
|
||||
return;
|
||||
--- 35,72 ----
|
||||
* : 1 - Packet
|
||||
* RETURN : None!
|
||||
* ---------------------------------------------------------- */
|
||||
+
|
||||
+ /* Update - david@vorant.com 18 June 2007
|
||||
+ * Try to detect whether the packet has an 802.1Q VLAN tag on it. If so,
|
||||
+ * try to automatically skip the tag and treat it as regular TCP/IP traffic.
|
||||
+ * Otherwise the handler won't process the packet. This is useful when,
|
||||
+ * for example, you are monitoring a VLAN trunk line.
|
||||
+ */
|
||||
void process_eth (const struct pcap_pkthdr* pkthdr, const u_char* packet)
|
||||
{
|
||||
struct ether_header *ethh; /* net/ethernet.h */
|
||||
+ u_char * my_packet;
|
||||
|
||||
! my_packet = (u_char *)packet;
|
||||
|
||||
+ /* Extract the ethernet header from the packet. */
|
||||
+ ethh = (struct ether_header*) my_packet;
|
||||
+ if(ntohs(ethh->ether_type) == VLAN_ETHERTYPE) { /* strip the vlan tags */
|
||||
+ ethh = (struct ether_header*) (packet + VLAN_HDRLEN);
|
||||
+ my_packet += VLAN_HDRLEN;
|
||||
+ }
|
||||
/* Determine what type of ethernet packet this is. */
|
||||
switch (ntohs(ethh->ether_type)) {
|
||||
/* IP */
|
||||
case ETHERTYPE_IP:
|
||||
! process_ip (pkthdr, my_packet, sizeof(struct ether_header));
|
||||
! break;
|
||||
|
||||
/* ARP */
|
||||
case ETHERTYPE_ARP:
|
||||
! process_arp (pkthdr, my_packet, sizeof(struct ether_header));
|
||||
break;
|
||||
!
|
||||
/* Unknown Type */
|
||||
default:
|
||||
return;
|
||||
***************
|
||||
*** 113,120 ****
|
||||
struct ip *iph; /* netinet/ip.h */
|
||||
|
||||
/* Extract the IP header from this packet. */
|
||||
! iph = (struct ip*)(packet + len);
|
||||
!
|
||||
/* Determine what type of IP packet this is. */
|
||||
switch (iph->ip_p) {
|
||||
case IPPROTO_TCP:
|
||||
--- 126,132 ----
|
||||
struct ip *iph; /* netinet/ip.h */
|
||||
|
||||
/* Extract the IP header from this packet. */
|
||||
! iph = (struct ip*)(packet + len);
|
||||
/* Determine what type of IP packet this is. */
|
||||
switch (iph->ip_p) {
|
||||
case IPPROTO_TCP:
|
||||
diff -r -c ./src/packet.h ../pads-1.2+vlan/src/packet.h
|
||||
*** ./src/packet.h 2005-02-10 01:05:05.000000000 -0500
|
||||
--- ../pads-1.2+vlan/src/packet.h 2007-08-24 10:11:02.000000000 -0400
|
||||
***************
|
||||
*** 40,45 ****
|
||||
--- 40,51 ----
|
||||
#endif /* ifdef LINUX */
|
||||
|
||||
|
||||
+ /* 802.1Q VLAN tags are 4 bytes long. */
|
||||
+ #define VLAN_HDRLEN 4
|
||||
+
|
||||
+ /* This is the decimal equivalent of the VLAN tag's ether frame type */
|
||||
+ #define VLAN_ETHERTYPE 33024
|
||||
+
|
||||
/* INCLUDES ---------------------------------------- */
|
||||
#include "global.h"
|
||||
|
||||
***************
|
||||
*** 47,53 ****
|
||||
#include <netinet/tcp.h>
|
||||
#include <netinet/ip_icmp.h>
|
||||
|
||||
-
|
||||
/* DATA STRUCTURES --------------------------------- */
|
||||
|
||||
/*
|
||||
--- 53,58 ----
|
||||
diff -r -c ./src/pads.c ../pads-1.2+vlan/src/pads.c
|
||||
*** ./src/pads.c 2005-06-15 18:00:40.000000000 -0400
|
||||
--- ../pads-1.2+vlan/src/pads.c 2007-06-18 15:29:17.000000000 -0400
|
||||
***************
|
||||
*** 204,209 ****
|
||||
--- 204,210 ----
|
||||
void
|
||||
main_pads (void)
|
||||
{
|
||||
+ char pcap_filter[1044];
|
||||
/* Initialize */
|
||||
init_pads();
|
||||
|
||||
***************
|
||||
*** 255,262 ****
|
||||
|
||||
/* Compile libpcap filter */
|
||||
if (prog_argc > 0) {
|
||||
! log_message("Filter: %s\n", gc.pcap_filter);
|
||||
! if (pcap_compile(gc.handle, &gc.filter, gc.pcap_filter, 0, gc.net) == -1) {
|
||||
err_message("Unable to compile pcap filter! %s", pcap_geterr(gc.handle));
|
||||
}
|
||||
if (pcap_setfilter(gc.handle, &gc.filter)) {
|
||||
--- 256,269 ----
|
||||
|
||||
/* Compile libpcap filter */
|
||||
if (prog_argc > 0) {
|
||||
! if(gc.pcap_filter) {
|
||||
! strcpy(pcap_filter, "(ip or vlan) and ");
|
||||
! strncat(pcap_filter, gc.pcap_filter, 1024);
|
||||
! } else {
|
||||
! strcpy(pcap_filter, "(ip or vlan)");
|
||||
! }
|
||||
! log_message("Filter: %s\n", pcap_filter);
|
||||
! if (pcap_compile(gc.handle, &gc.filter, pcap_filter, 0, gc.net) == -1) {
|
||||
err_message("Unable to compile pcap filter! %s", pcap_geterr(gc.handle));
|
||||
}
|
||||
if (pcap_setfilter(gc.handle, &gc.filter)) {
|
||||
173
pads-1.2-arp.patch
Normal file
173
pads-1.2-arp.patch
Normal file
|
|
@ -0,0 +1,173 @@
|
|||
diff -urp pads-1.2.orig/src/mac-resolution.c pads-1.2/src/mac-resolution.c
|
||||
--- pads-1.2.orig/src/mac-resolution.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/mac-resolution.c 2008-07-07 12:07:36.000000000 -0400
|
||||
@@ -160,7 +160,7 @@ int add_vendor (char *mac, char *vendor)
|
||||
* INPUT : 0 - MAC Address
|
||||
* RETURN : Vendor Name
|
||||
* ---------------------------------------------------------- */
|
||||
-bstring get_vendor (char *m)
|
||||
+bstring get_vendor (const char *m)
|
||||
{
|
||||
Vendor *list;
|
||||
char mac[4];
|
||||
diff -urp pads-1.2.orig/src/mac-resolution.h pads-1.2/src/mac-resolution.h
|
||||
--- pads-1.2.orig/src/mac-resolution.h 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/mac-resolution.h 2008-07-07 12:07:36.000000000 -0400
|
||||
@@ -41,7 +41,7 @@
|
||||
int init_mac_resolution (void);
|
||||
int parse_raw_mac (bstring line);
|
||||
int add_vendor (char *mac, char *vendor);
|
||||
-bstring get_vendor (char *m);
|
||||
+bstring get_vendor (const char *m);
|
||||
void end_mac_resolution (void);
|
||||
|
||||
#ifdef DEBUG
|
||||
diff -urp pads-1.2.orig/src/output/output-csv.c pads-1.2/src/output/output-csv.c
|
||||
--- pads-1.2.orig/src/output/output-csv.c 2008-07-02 09:24:19.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-csv.c 2008-07-07 12:07:36.000000000 -0400
|
||||
@@ -91,6 +91,7 @@ init_output_csv (bstring filename)
|
||||
/* File does not exist, create new.. */
|
||||
if ((output_csv_conf.file = fopen((char *)bdata(output_csv_conf.filename), "w")) != NULL) {
|
||||
fprintf(output_csv_conf.file, "asset,port,proto,service,application,discovered\n");
|
||||
+ fflush(output_csv_conf.file);
|
||||
|
||||
} else {
|
||||
err_message("Cannot open file %s!", bdata(output_csv_conf.filename));
|
||||
@@ -216,8 +217,11 @@ parse_raw_report (bstring line)
|
||||
/* Add Asset to Data Structure */
|
||||
if (proto == 0 && ret != -1) {
|
||||
/* ARP */
|
||||
- mac2hex((char *)bdata(application), mac_addr, MAC_LEN);
|
||||
- add_arp_asset(ip_addr, mac_addr, discovered);
|
||||
+ if (mac2hex((char *)bdata(application), mac_addr, MAC_LEN) == 0)
|
||||
+ add_arp_asset(ip_addr, mac_addr, discovered);
|
||||
+ else
|
||||
+ log_message("Error parsing HWaddr %s - skipping",
|
||||
+ (char *)bdata(application));
|
||||
} else {
|
||||
/* Everything Else */
|
||||
add_asset(ip_addr, port, proto, service, application, discovered);
|
||||
diff -urp pads-1.2.orig/src/storage.c pads-1.2/src/storage.c
|
||||
--- pads-1.2.orig/src/storage.c 2008-06-30 17:54:33.000000000 -0400
|
||||
+++ pads-1.2/src/storage.c 2008-07-07 12:07:36.000000000 -0400
|
||||
@@ -108,7 +108,7 @@ int check_arp_asset (struct in_addr ip_a
|
||||
rec = arp_asset_list;
|
||||
while (rec != NULL) {
|
||||
if (rec->ip_addr.s_addr == ip_addr.s_addr
|
||||
- && (strcmp(rec->mac_addr, mac_addr) == 0)) {
|
||||
+ && (memcmp(rec->mac_addr, mac_addr, MAC_LEN) == 0)) {
|
||||
return 0;
|
||||
|
||||
} else {
|
||||
@@ -200,7 +200,7 @@ void add_asset (struct in_addr ip_addr,
|
||||
* : 2 - Discovered
|
||||
* RETURN : None!
|
||||
* ---------------------------------------------------------- */
|
||||
-void add_arp_asset (struct in_addr ip_addr, char mac_addr[MAC_LEN],
|
||||
+void add_arp_asset (struct in_addr ip_addr, const char *mac_addr,
|
||||
time_t discovered)
|
||||
{
|
||||
ArpAsset *list;
|
||||
diff -urp pads-1.2.orig/src/storage.h pads-1.2/src/storage.h
|
||||
--- pads-1.2.orig/src/storage.h 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/storage.h 2008-07-07 12:07:36.000000000 -0400
|
||||
@@ -52,7 +52,7 @@ int check_tcp_asset (struct in_addr ip_a
|
||||
int check_icmp_asset (struct in_addr ip_addr);
|
||||
int check_arp_asset (struct in_addr ip_addr, char mac_addr[MAC_LEN]);
|
||||
void add_asset (struct in_addr ip_addr, u_int16_t port, unsigned short proto, bstring service, bstring application, time_t discovered);
|
||||
-void add_arp_asset (struct in_addr ip_addr, char mac_addr[MAC_LEN], time_t discovered);
|
||||
+void add_arp_asset (struct in_addr ip_addr, const char *mac_addr, time_t discovered);
|
||||
unsigned short get_i_attempts (struct in_addr ip_addr, u_int16_t port, unsigned short proto);
|
||||
short update_i_attempts (struct in_addr ip_addr, u_int16_t port, unsigned short proto, unsigned short i_attempts);
|
||||
short update_asset (struct in_addr ip_addr, u_int16_t port, unsigned short proto, bstring service, bstring application);
|
||||
diff -urp pads-1.2.orig/src/util.c pads-1.2/src/util.c
|
||||
--- pads-1.2.orig/src/util.c 2008-07-02 09:24:19.000000000 -0400
|
||||
+++ pads-1.2/src/util.c 2008-07-07 12:08:00.000000000 -0400
|
||||
@@ -27,6 +27,7 @@
|
||||
**************************************************************************/
|
||||
#include <unistd.h>
|
||||
#include <ctype.h>
|
||||
+#include <errno.h>
|
||||
#include "util.h"
|
||||
#include "pads.h"
|
||||
|
||||
@@ -426,31 +427,39 @@ drop_privs (bstring newuser, bstring new
|
||||
* INPUT : 0 - MAC Address
|
||||
* : 1 - Converted
|
||||
* : 0 - Size of 1
|
||||
- * RETURN : None
|
||||
+ * RETURN : 0 - success, -1 failure
|
||||
* ---------------------------------------------------------- */
|
||||
-void
|
||||
+int
|
||||
mac2hex(const char *mac, char *dst, int len)
|
||||
{
|
||||
int i;
|
||||
- long l;
|
||||
- char *pp;
|
||||
+ unsigned long l;
|
||||
|
||||
if (len < 6)
|
||||
- return;
|
||||
+ return -1;
|
||||
|
||||
while (isspace(*mac))
|
||||
mac++;
|
||||
|
||||
/* expect 6 hex octets separated by ':' or space/NUL if last octet */
|
||||
- for (i = 0; i < 6; i++) {
|
||||
- l = strtol(mac, &pp, 16);
|
||||
- if (pp == mac || l > 0xFF || l < 0)
|
||||
- return;
|
||||
- if (!(*pp == ':' || (i == 5 && (isspace(*pp) || *pp == '\0'))))
|
||||
- return;
|
||||
- dst[i] = (u_char) l;
|
||||
- mac = pp + 1;
|
||||
+ for (i = 0; i < MAC_LEN; i++) {
|
||||
+ char tmp[3];
|
||||
+
|
||||
+ while (*mac == ':' || *mac == ' ')
|
||||
+ mac++;
|
||||
+ if (mac[0] == 0 || mac[1] == 0)
|
||||
+ return -1;
|
||||
+ tmp[0] = mac[0];
|
||||
+ tmp[1] = mac[1];
|
||||
+ tmp[2] = 0;
|
||||
+ errno = 0;
|
||||
+ l = strtoul(tmp, NULL, 16);
|
||||
+ if (errno)
|
||||
+ return -1;
|
||||
+ dst[i] = (u_char)(l & 0xFF);
|
||||
+ mac+=2;
|
||||
}
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
@@ -464,11 +473,11 @@ mac2hex(const char *mac, char *dst, int
|
||||
char *
|
||||
hex2mac(const char *mac)
|
||||
{
|
||||
- static char buf[18];
|
||||
+ static char buf[32];
|
||||
|
||||
snprintf(buf, sizeof(buf), "%02X:%02X:%02X:%02X:%02X:%02X",
|
||||
- mac[0], mac[1], mac[2],
|
||||
- mac[3], mac[4], mac[5]);
|
||||
+ (mac[0] & 0xFF) , (mac[1] & 0xFF), (mac[2] & 0xFF),
|
||||
+ (mac[3] & 0xFF), (mac[4] & 0xFF), (mac[5] & 0xFF));
|
||||
|
||||
return buf;
|
||||
}
|
||||
diff -urp pads-1.2.orig/src/util.h pads-1.2/src/util.h
|
||||
--- pads-1.2.orig/src/util.h 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/util.h 2008-07-07 12:07:36.000000000 -0400
|
||||
@@ -52,7 +52,7 @@ size_t strlcpy(char *dst, const char *sr
|
||||
size_t strlcat(char *dst, const char *src, size_t len);
|
||||
#endif
|
||||
void drop_privs (bstring newuser, bstring newgroup);
|
||||
-void mac2hex(const char *mac, char *dst, int len);
|
||||
+int mac2hex(const char *mac, char *dst, int len);
|
||||
char *hex2mac(const char *mac);
|
||||
|
||||
/* GLOBALS ----------------------------------------- */
|
||||
4671
pads-1.2-bstring.patch
Normal file
4671
pads-1.2-bstring.patch
Normal file
File diff suppressed because it is too large
Load diff
931
pads-1.2-cleanup.patch
Normal file
931
pads-1.2-cleanup.patch
Normal file
|
|
@ -0,0 +1,931 @@
|
|||
diff -urp pads-1.2.orig/src/configuration.c pads-1.2/src/configuration.c
|
||||
--- pads-1.2.orig/src/configuration.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/configuration.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -26,6 +26,9 @@
|
||||
*
|
||||
**************************************************************************/
|
||||
#include "configuration.h"
|
||||
+#include "util.h"
|
||||
+#include "bstring/util.h"
|
||||
+#include "monnet.h"
|
||||
|
||||
/* Variable Declarations */
|
||||
|
||||
@@ -44,7 +47,7 @@ void init_configuration (bstring filenam
|
||||
|
||||
verbose_message("config - Processing '%s'.", bdata(filename));
|
||||
|
||||
- if ((fp = fopen(bdata(filename), "r")) == NULL) {
|
||||
+ if ((fp = fopen((char *)bdata(filename), "r")) == NULL) {
|
||||
err_message("Unable to open configuration file - %s", bdata(filename));
|
||||
}
|
||||
|
||||
@@ -59,7 +62,7 @@ void init_configuration (bstring filenam
|
||||
/* Clean Up */
|
||||
bdestroy(filedata);
|
||||
bstrListDestroy(lines);
|
||||
- close(fp);
|
||||
+ fclose(fp);
|
||||
}
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
@@ -147,7 +150,7 @@ void parse_line (bstring line)
|
||||
|
||||
} else if ((biseqcstr(param, "network")) == 1) {
|
||||
/* NETWORK */
|
||||
- parse_networks(bdata(value));
|
||||
+ parse_networks((char *)bdata(value));
|
||||
|
||||
}
|
||||
|
||||
diff -urp pads-1.2.orig/src/global.h pads-1.2/src/global.h
|
||||
--- pads-1.2.orig/src/global.h 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/global.h 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -25,6 +25,9 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#ifndef GLOBAL_HEADER
|
||||
+#define GLOBAL_HEADER
|
||||
+
|
||||
#ifdef HAVE_CONFIG_H
|
||||
#include "config.h"
|
||||
#endif
|
||||
@@ -68,6 +71,7 @@
|
||||
#include <netinet/if_ether.h>
|
||||
#include <pcap.h>
|
||||
#include <pcre.h>
|
||||
+#include <time.h>
|
||||
|
||||
#include "bstring/bstrlib.h"
|
||||
|
||||
@@ -160,3 +164,6 @@ extern GC gc;
|
||||
|
||||
/* vim:expandtab:cindent:smartindent:ts=4:tw=0:sw=4:
|
||||
*/
|
||||
+
|
||||
+#endif
|
||||
+
|
||||
diff -urp pads-1.2.orig/src/identification.c pads-1.2/src/identification.c
|
||||
--- pads-1.2.orig/src/identification.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/identification.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -26,6 +26,9 @@
|
||||
*
|
||||
**************************************************************************/
|
||||
#include "identification.h"
|
||||
+#include "util.h"
|
||||
+#include "storage.h"
|
||||
+#include "output/output.h"
|
||||
|
||||
Signature *signature_list;
|
||||
|
||||
@@ -57,7 +60,7 @@ int init_identification()
|
||||
}
|
||||
|
||||
/* Open Signature File */
|
||||
- if ((fp = fopen(bdata(filename), "r")) == NULL) {
|
||||
+ if ((fp = fopen((char *)bdata(filename), "r")) == NULL) {
|
||||
err_message("Unable to open signature file - %s", bdata(filename));
|
||||
}
|
||||
|
||||
@@ -73,7 +76,7 @@ int init_identification()
|
||||
bdestroy(filename);
|
||||
bdestroy(filedata);
|
||||
bstrListDestroy(lines);
|
||||
- close(fp);
|
||||
+ fclose(fp);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -91,7 +94,7 @@ int init_identification()
|
||||
int parse_raw_signature (bstring line, int lineno)
|
||||
{
|
||||
struct bstrList *raw_sig;
|
||||
- struct bstrList *title;
|
||||
+ struct bstrList *title = NULL;
|
||||
Signature *sig;
|
||||
bstring pcre_string;
|
||||
const char *err; /* PCRE */
|
||||
@@ -101,7 +104,7 @@ int parse_raw_signature (bstring line, i
|
||||
|
||||
/* Check to see if this line has something to read. */
|
||||
if (line->data[0] == '\0' || line->data[0] == '#')
|
||||
- return;
|
||||
+ return -1;
|
||||
|
||||
/* Split Line */
|
||||
if ((raw_sig = bsplit(line, ',')) == NULL)
|
||||
@@ -125,8 +128,10 @@ int parse_raw_signature (bstring line, i
|
||||
|
||||
/* Split Title */
|
||||
if (raw_sig->entry[1] != NULL && ret != -1)
|
||||
- if ((title = bsplit(raw_sig->entry[1], '/')) == NULL)
|
||||
- ret = -1;
|
||||
+ title = bsplit(raw_sig->entry[1], '/');
|
||||
+ if (title == NULL)
|
||||
+ return -1;
|
||||
+
|
||||
if (title->qty < 3)
|
||||
ret = -1;
|
||||
|
||||
@@ -145,7 +150,7 @@ int parse_raw_signature (bstring line, i
|
||||
|
||||
/* PCRE */
|
||||
if (pcre_string != NULL) {
|
||||
- if ((sig->regex = pcre_compile (bdata(pcre_string), 0, &err, &erroffset, NULL)) == NULL) {
|
||||
+ if ((sig->regex = pcre_compile ((char *)bdata(pcre_string), 0, &err, &erroffset, NULL)) == NULL) {
|
||||
err_message("Unable to compile signature: %s at line %d (%s)",
|
||||
err, lineno, bdata(line));
|
||||
ret = -1;
|
||||
@@ -265,7 +270,6 @@ int pcre_identify (struct in_addr ip_add
|
||||
Signature *list = signature_list;
|
||||
int rc;
|
||||
int ovector[15];
|
||||
- int i;
|
||||
bstring app;
|
||||
|
||||
while (list != NULL) {
|
||||
@@ -312,18 +316,18 @@ bstring get_app_name (Signature *sig,
|
||||
|
||||
/* Create Application string using the values in signature[i].title. */
|
||||
if (sig->title.app != NULL) {
|
||||
- strlcpy(app, bdata(sig->title.app), MAX_APP);
|
||||
+ strlcpy(app, (char *)bdata(sig->title.app), MAX_APP);
|
||||
}
|
||||
if (sig->title.ver != NULL) {
|
||||
if (sig->title.ver->slen > 0) {
|
||||
strcat(app, " ");
|
||||
- strlcat(app, bdata(sig->title.ver), MAX_VER);
|
||||
+ strlcat(app, (char *)bdata(sig->title.ver), MAX_VER);
|
||||
}
|
||||
}
|
||||
if (sig->title.misc != NULL) {
|
||||
if (sig->title.misc->slen > 0) {
|
||||
strcat(app, " (");
|
||||
- strlcat(app, bdata(sig->title.misc), MAX_MISC);
|
||||
+ strlcat(app, (char *)bdata(sig->title.misc), MAX_MISC);
|
||||
strcat(app, ")");
|
||||
}
|
||||
}
|
||||
@@ -416,7 +420,8 @@ void print_signature()
|
||||
printf("2a: %s\n", bdata(list->title.app));
|
||||
printf("2b: %s\n", bdata(list->title.ver));
|
||||
printf("2c: %s\n", bdata(list->title.misc));
|
||||
- printf("3: %s\n", list->regex);
|
||||
+ // FIXME: This is a compiled expression
|
||||
+ // printf("3: %s\n", list->regex);
|
||||
printf("\n");
|
||||
|
||||
i++;
|
||||
diff -urp pads-1.2.orig/src/mac-resolution.c pads-1.2/src/mac-resolution.c
|
||||
--- pads-1.2.orig/src/mac-resolution.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/mac-resolution.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -32,6 +32,7 @@
|
||||
#ifndef DISABLE_VENDOR
|
||||
|
||||
#include "mac-resolution.h"
|
||||
+#include "util.h"
|
||||
|
||||
Vendor *vendor_list = NULL;
|
||||
|
||||
@@ -60,7 +61,7 @@ int init_mac_resolution (void) {
|
||||
}
|
||||
|
||||
/* Open Signature File */
|
||||
- if ((fp = fopen(bdata(filename), "r")) == NULL) {
|
||||
+ if ((fp = fopen((char *)bdata(filename), "r")) == NULL) {
|
||||
err_message("Unable to open MAC resolution file - %s", bdata(filename));
|
||||
}
|
||||
|
||||
@@ -79,7 +80,7 @@ int init_mac_resolution (void) {
|
||||
bdestroy(filedata);
|
||||
if (lines != NULL)
|
||||
bstrListDestroy(lines);
|
||||
- close(fp);
|
||||
+ fclose(fp);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -99,10 +100,8 @@ int parse_raw_mac (bstring line)
|
||||
char vendor[80];
|
||||
int m1, m2, m3;
|
||||
|
||||
- int pos;
|
||||
-
|
||||
/* Parse out the contents of the line. */
|
||||
- if (sscanf(bdata(line), "%02X:%02X:%02X %80[^,\n],\n", &m1, &m2, &m3, vendor) != 4)
|
||||
+ if (sscanf((char *)bdata(line), "%02X:%02X:%02X %80[^,\n],\n", &m1, &m2, &m3, vendor) != 4)
|
||||
return -1;
|
||||
|
||||
mac[0] = (char) (m1);
|
||||
@@ -215,7 +214,7 @@ void show_vendor (void){
|
||||
list = vendor_list;
|
||||
|
||||
while(list != NULL) {
|
||||
- printf("Mac: %s\nVendor: %s\n\n", list->mac, bdata(list->vendor));
|
||||
+ printf("Mac: %u\nVendor: %s\n\n", list->mac, bdata(list->vendor));
|
||||
list = list->next;
|
||||
}
|
||||
}
|
||||
diff -urp pads-1.2.orig/src/monnet.c pads-1.2/src/monnet.c
|
||||
--- pads-1.2.orig/src/monnet.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/monnet.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -27,7 +27,10 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#include <stdlib.h>
|
||||
+#include <arpa/inet.h>
|
||||
#include "monnet.h"
|
||||
+#include "util.h"
|
||||
|
||||
struct mon_net *mn;
|
||||
|
||||
@@ -45,7 +48,6 @@ void parse_networks (char *cmdline)
|
||||
{
|
||||
int i = 0;
|
||||
char network[16], netmask[3], tmp[16];
|
||||
- struct in_addr in_net;
|
||||
|
||||
/* Make sure something was defined. */
|
||||
if (cmdline == NULL)
|
||||
@@ -81,7 +83,7 @@ void parse_networks (char *cmdline)
|
||||
i++;
|
||||
}
|
||||
|
||||
- *cmdline++;
|
||||
+ cmdline++;
|
||||
}
|
||||
}
|
||||
|
||||
diff -urp pads-1.2.orig/src/output/output.c pads-1.2/src/output/output.c
|
||||
--- pads-1.2.orig/src/output/output.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/output/output.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -26,6 +26,10 @@
|
||||
*
|
||||
**************************************************************************/
|
||||
#include "output.h"
|
||||
+#include "output-screen.h"
|
||||
+#include "output-csv.h"
|
||||
+#include "output-fifo.h"
|
||||
+#include "storage.h"
|
||||
|
||||
/* Global Variables */
|
||||
OutputPluginList *output_plugin_list;
|
||||
@@ -149,7 +153,7 @@ int print_asset (struct in_addr ip_addr,
|
||||
|
||||
/* Make sure that a record was found. */
|
||||
if (rec == NULL)
|
||||
- return;
|
||||
+ return -1;
|
||||
|
||||
/* Cycle through output plugins and print to those that are active. */
|
||||
head = output_plugin_list;
|
||||
@@ -182,7 +186,7 @@ int print_arp_asset (struct in_addr ip_a
|
||||
|
||||
/* Find Asset */
|
||||
ArpAsset *list;
|
||||
- ArpAsset *rec;
|
||||
+ ArpAsset *rec = NULL;
|
||||
|
||||
list = (ArpAsset *)get_arp_pointer();
|
||||
while (list != NULL) {
|
||||
@@ -199,7 +203,7 @@ int print_arp_asset (struct in_addr ip_a
|
||||
|
||||
/* Make sure that a record was found. */
|
||||
if (rec == NULL)
|
||||
- return;
|
||||
+ return -1;
|
||||
|
||||
/* Cycle through output plugins and print to those that are active. */
|
||||
head = output_plugin_list;
|
||||
@@ -298,8 +302,8 @@ void end_output (void)
|
||||
#ifdef DEBUG
|
||||
int debug_output_list (void)
|
||||
{
|
||||
- OutputPluginList *head, *head2;
|
||||
- OutputPlugin *tmp, *tmp2;
|
||||
+ OutputPluginList *head;
|
||||
+ OutputPlugin *tmp;
|
||||
int i = 1;
|
||||
|
||||
printf("output_plugin_list:\n");
|
||||
diff -urp pads-1.2.orig/src/output/output-csv.c pads-1.2/src/output/output-csv.c
|
||||
--- pads-1.2.orig/src/output/output-csv.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-csv.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -24,7 +24,10 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#include <arpa/inet.h>
|
||||
#include "output-csv.h"
|
||||
+#include "util.h"
|
||||
+#include "storage.h"
|
||||
|
||||
OutputCSVConf output_csv_conf;
|
||||
|
||||
@@ -40,7 +43,6 @@ int
|
||||
setup_output_csv (void)
|
||||
{
|
||||
OutputPlugin *plugin;
|
||||
- bstring name;
|
||||
|
||||
/* Allocate and setup plugin data record. */
|
||||
plugin = (OutputPlugin*)malloc(sizeof(OutputPlugin));
|
||||
@@ -68,7 +70,7 @@ setup_output_csv (void)
|
||||
* : will read in the file and add each asset
|
||||
* : to the asset data structure.
|
||||
* INPUT : 0 - CSV filename
|
||||
- * RETURN : None!
|
||||
+ * RETURN : 0 success, -1 fail
|
||||
* --------------------------------------------------------- */
|
||||
int
|
||||
init_output_csv (bstring filename)
|
||||
@@ -84,14 +86,15 @@ init_output_csv (bstring filename)
|
||||
output_csv_conf.filename = bstrcpy(bfromcstr("assets.csv"));
|
||||
|
||||
/* Check to see if *filename exists. */
|
||||
- if ((fp = fopen(bdata(output_csv_conf.filename), "r")) == NULL) {
|
||||
+ if ((fp = fopen((char *)bdata(output_csv_conf.filename), "r")) == NULL) {
|
||||
|
||||
/* File does not exist, create new.. */
|
||||
- if ((output_csv_conf.file = fopen(bdata(output_csv_conf.filename), "w")) != NULL) {
|
||||
+ if ((output_csv_conf.file = fopen((char *)bdata(output_csv_conf.filename), "w")) != NULL) {
|
||||
fprintf(output_csv_conf.file, "asset,port,proto,service,application,discovered\n");
|
||||
|
||||
} else {
|
||||
err_message("Cannot open file %s!", bdata(output_csv_conf.filename));
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
} else {
|
||||
@@ -101,12 +104,13 @@ init_output_csv (bstring filename)
|
||||
read_report_file();
|
||||
|
||||
/* Open file and assign it to the global FILE pointer. */
|
||||
- if ((output_csv_conf.file = fopen(bdata(output_csv_conf.filename), "a")) == NULL) {
|
||||
+ if ((output_csv_conf.file = fopen((char *)bdata(output_csv_conf.filename), "a")) == NULL) {
|
||||
err_message("Cannot open file %s!", bdata(output_csv_conf.filename));
|
||||
+ return -1;
|
||||
}
|
||||
}
|
||||
|
||||
- return;
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
@@ -129,7 +133,7 @@ read_report_file (void)
|
||||
printf("[-] Processing Existing %s\n", bdata(output_csv_conf.filename));
|
||||
|
||||
/* Open Signature File */
|
||||
- if ((fp = fopen(bdata(output_csv_conf.filename), "r")) == NULL) {
|
||||
+ if ((fp = fopen((char *)bdata(output_csv_conf.filename), "r")) == NULL) {
|
||||
err_message("Unable to open CSV file - %s", bdata(output_csv_conf.filename));
|
||||
}
|
||||
|
||||
@@ -144,7 +148,7 @@ read_report_file (void)
|
||||
/* Clean Up */
|
||||
bdestroy(filedata);
|
||||
bstrListDestroy(lines);
|
||||
- close(fp);
|
||||
+ fclose(fp);
|
||||
}
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
@@ -172,7 +176,7 @@ parse_raw_report (bstring line)
|
||||
|
||||
/* Check to see if this line has something to read. */
|
||||
if (line->data[0] == '\0' || line->data[0] == '#')
|
||||
- return;
|
||||
+ return -1;
|
||||
|
||||
/* Break line apart. */
|
||||
if ((list = bsplit(line, ',')) == NULL)
|
||||
@@ -186,13 +190,13 @@ parse_raw_report (bstring line)
|
||||
}
|
||||
|
||||
/* Place data from 'list' into temporary data storage. */
|
||||
- if ((inet_aton(bdata(list->entry[0]), &ip_addr)) == -1)
|
||||
+ if ((inet_aton((char *)bdata(list->entry[0]), &ip_addr)) == -1)
|
||||
ret = -1;
|
||||
|
||||
- if ((port = htons(atoi(bdata(list->entry[1])))) == -1)
|
||||
+ if ((port = htons(atoi((char *)bdata(list->entry[1])))) == -1)
|
||||
ret = -1;
|
||||
|
||||
- if ((proto = atoi(bdata(list->entry[2]))) == -1)
|
||||
+ if ((proto = atoi((char *)bdata(list->entry[2]))) == -1)
|
||||
ret = -1;
|
||||
|
||||
if ((service = bstrcpy(list->entry[3])) == NULL)
|
||||
@@ -201,7 +205,7 @@ parse_raw_report (bstring line)
|
||||
if ((application = bstrcpy(list->entry[4])) == NULL)
|
||||
ret = -1;
|
||||
|
||||
- if ((discovered = atol(bdata(list->entry[5]))) == -1)
|
||||
+ if ((discovered = atol((char *)bdata(list->entry[5]))) == -1)
|
||||
ret = -1;
|
||||
|
||||
/* Make sure that this line contains 'good' data. */
|
||||
@@ -211,7 +215,7 @@ parse_raw_report (bstring line)
|
||||
/* Add Asset to Data Structure */
|
||||
if (proto == 0 && ret != -1) {
|
||||
/* ARP */
|
||||
- mac2hex(bdata(application), mac_addr, MAC_LEN);
|
||||
+ mac2hex((char *)bdata(application), mac_addr, MAC_LEN);
|
||||
add_arp_asset(ip_addr, mac_addr, discovered);
|
||||
} else {
|
||||
/* Everything Else */
|
||||
@@ -249,8 +253,9 @@ print_asset_csv (Asset *rec)
|
||||
if (gc.hide_unknowns == 0 || ((biseqcstr(rec->service, "unknown") != 0) &&
|
||||
(biseqcstr(rec->application, "unknown") != 0))) {
|
||||
fprintf(output_csv_conf.file, "%s,%d,%d,%s,%s,%d\n",
|
||||
- inet_ntoa(rec->ip_addr), ntohs(rec->port), rec->proto, bdata(rec->service),
|
||||
- bdata(rec->application), rec->discovered);
|
||||
+ inet_ntoa(rec->ip_addr), ntohs(rec->port), rec->proto,
|
||||
+ bdata(rec->service), bdata(rec->application),
|
||||
+ (int)rec->discovered);
|
||||
fflush(output_csv_conf.file);
|
||||
}
|
||||
} else {
|
||||
@@ -277,11 +282,13 @@ print_arp_asset_csv (ArpAsset *rec)
|
||||
/* Print to File */
|
||||
if (output_csv_conf.file != NULL) {
|
||||
if (rec->mac_resolved != NULL) {
|
||||
- fprintf(output_csv_conf.file, "%s,0,0,ARP (%s),%s,%d\n", inet_ntoa(rec->ip_addr),
|
||||
- bdata(rec->mac_resolved), hex2mac(rec->mac_addr), rec->discovered);
|
||||
+ fprintf(output_csv_conf.file, "%s,0,0,ARP (%s),%s,%d\n",
|
||||
+ inet_ntoa(rec->ip_addr), bdata(rec->mac_resolved),
|
||||
+ hex2mac(rec->mac_addr), (int)rec->discovered);
|
||||
} else {
|
||||
- fprintf(output_csv_conf.file, "%s,0,0,ARP,%s,%d\n", inet_ntoa(rec->ip_addr),
|
||||
- hex2mac(rec->mac_addr), rec->discovered);
|
||||
+ fprintf(output_csv_conf.file, "%s,0,0,ARP,%s,%d\n",
|
||||
+ inet_ntoa(rec->ip_addr), hex2mac(rec->mac_addr),
|
||||
+ (int)rec->discovered);
|
||||
}
|
||||
|
||||
fflush(output_csv_conf.file);
|
||||
@@ -311,5 +318,7 @@ end_output_csv ()
|
||||
|
||||
if (output_csv_conf.filename != NULL)
|
||||
bdestroy(output_csv_conf.filename);
|
||||
+
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
diff -urp pads-1.2.orig/src/output/output-csv.h pads-1.2/src/output/output-csv.h
|
||||
--- pads-1.2.orig/src/output/output-csv.h 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-csv.h 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -25,6 +25,8 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#ifndef OUTPUT_CSV_HEADER
|
||||
+#define OUTPUT_CSV_HEADER
|
||||
|
||||
/* DEFINES ----------------------------------------- */
|
||||
#ifdef LINUX
|
||||
@@ -64,3 +66,5 @@ int print_asset_csv (Asset *rec);
|
||||
int print_arp_asset_csv (ArpAsset *rec);
|
||||
int end_output_csv (void);
|
||||
|
||||
+#endif
|
||||
+
|
||||
diff -urp pads-1.2.orig/src/output/output-fifo.c pads-1.2/src/output/output-fifo.c
|
||||
--- pads-1.2.orig/src/output/output-fifo.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-fifo.c 2008-06-30 13:28:45.000000000 -0400
|
||||
@@ -25,7 +25,9 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#include <arpa/inet.h>
|
||||
#include "output-fifo.h"
|
||||
+#include "util.h"
|
||||
|
||||
/*
|
||||
* MODULE NOTES
|
||||
@@ -66,7 +68,6 @@ int
|
||||
setup_output_fifo (void)
|
||||
{
|
||||
OutputPlugin *plugin;
|
||||
- bstring name;
|
||||
|
||||
/* Allocate and setup plugin data record. */
|
||||
plugin = (OutputPlugin*)malloc(sizeof(OutputPlugin));
|
||||
@@ -92,15 +93,11 @@ setup_output_fifo (void)
|
||||
* DESCRIPTION : This function will initialize the FIFO
|
||||
* : file.
|
||||
* INPUT : 0 - FIFO filename
|
||||
- * RETURN : None!
|
||||
+ * RETURN : 0 success, -1 failure
|
||||
* --------------------------------------------------------- */
|
||||
int
|
||||
init_output_fifo (bstring fifo_file)
|
||||
{
|
||||
- FILE *fp;
|
||||
- register u_int len = 0;
|
||||
- char *filename;
|
||||
-
|
||||
verbose_message("Initializing FIFO output plugin.");
|
||||
|
||||
/* Make sure report_file isn't NULL. */
|
||||
@@ -109,13 +106,13 @@ init_output_fifo (bstring fifo_file)
|
||||
|
||||
output_fifo_conf.filename = bstrcpy(fifo_file);
|
||||
|
||||
- mkfifo (bdata(fifo_file), S_IFIFO | 0755);
|
||||
+ mkfifo ((char *)bdata(fifo_file), 0755);
|
||||
|
||||
verbose_message("Open FIFO File\n");
|
||||
- if ((output_fifo_conf.file = fopen(bdata(fifo_file), "w+")) == NULL)
|
||||
+ if ((output_fifo_conf.file = fopen((char*)bdata(fifo_file), "w+")) == NULL)
|
||||
err_message("Unable to open FIFO file (%s)!\n", bdata(fifo_file));
|
||||
|
||||
- return;
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
@@ -138,8 +135,9 @@ print_asset_fifo (Asset *rec)
|
||||
if (gc.hide_unknowns == 0 || ((biseq(rec->service, bfromcstr("unknown")) != 0) &&
|
||||
(biseq(rec->application, bfromcstr("unknown")) != 0))) {
|
||||
fprintf(output_fifo_conf.file, "01,%s,%d,%d,%s,%s,%d\n",
|
||||
- inet_ntoa(rec->ip_addr), ntohs(rec->port), rec->proto, bdata(rec->service),
|
||||
- bdata(rec->application), rec->discovered);
|
||||
+ inet_ntoa(rec->ip_addr), ntohs(rec->port), rec->proto,
|
||||
+ bdata(rec->service), bdata(rec->application),
|
||||
+ (int)rec->discovered);
|
||||
fflush(output_fifo_conf.file);
|
||||
}
|
||||
} else {
|
||||
@@ -165,11 +163,13 @@ print_arp_asset_fifo (ArpAsset *rec)
|
||||
/* Print to File */
|
||||
if (output_fifo_conf.file != NULL) {
|
||||
if (rec->mac_resolved != NULL) {
|
||||
- fprintf(output_fifo_conf.file, "02,%s,%s,%s,%d\n", inet_ntoa(rec->ip_addr),
|
||||
- rec->mac_resolved, hex2mac(&rec->mac_addr), rec->discovered);
|
||||
+ fprintf(output_fifo_conf.file, "02,%s,%s,%s,%d\n",
|
||||
+ inet_ntoa(rec->ip_addr), bdata(rec->mac_resolved),
|
||||
+ hex2mac(rec->mac_addr), (int)rec->discovered);
|
||||
} else {
|
||||
- fprintf(output_fifo_conf.file, "02,%s,unknown,%s,%d\n", inet_ntoa(rec->ip_addr),
|
||||
- hex2mac(&rec->mac_addr), rec->discovered);
|
||||
+ fprintf(output_fifo_conf.file, "02,%s,unknown,%s,%d\n",
|
||||
+ inet_ntoa(rec->ip_addr), hex2mac(rec->mac_addr),
|
||||
+ (int)rec->discovered);
|
||||
}
|
||||
|
||||
fflush(output_fifo_conf.file);
|
||||
@@ -196,7 +196,8 @@ print_stat_fifo (Asset *rec)
|
||||
{
|
||||
if (output_fifo_conf.file != NULL) {
|
||||
fprintf(output_fifo_conf.file, "03,%s,%d,%d,%d\n",
|
||||
- inet_ntoa(rec->ip_addr), ntohs(rec->port), rec->proto, time(NULL));
|
||||
+ inet_ntoa(rec->ip_addr), ntohs(rec->port), rec->proto,
|
||||
+ (int)time(NULL));
|
||||
fflush(output_fifo_conf.file);
|
||||
|
||||
} else {
|
||||
diff -urp pads-1.2.orig/src/output/output-fifo.h pads-1.2/src/output/output-fifo.h
|
||||
--- pads-1.2.orig/src/output/output-fifo.h 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-fifo.h 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -25,6 +25,8 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#ifndef OUTPUT_FIFO_HEADER
|
||||
+#define OUTPUT_FIFO_HEADER
|
||||
|
||||
/* DEFINES ----------------------------------------- */
|
||||
#ifdef LINUX
|
||||
@@ -56,9 +58,11 @@ typedef struct _OutputFIFOConf
|
||||
|
||||
|
||||
/* PROTOTYPES -------------------------------------- */
|
||||
+int setup_output_fifo (void);
|
||||
int init_output_fifo (bstring fifo_file);
|
||||
int print_asset_fifo (Asset *rec);
|
||||
int print_arp_asset_fifo (ArpAsset *rec);
|
||||
int print_stat_fifo (Asset *rec);
|
||||
int end_output_fifo (void);
|
||||
|
||||
+#endif
|
||||
diff -urp pads-1.2.orig/src/output/output.h pads-1.2/src/output/output.h
|
||||
--- pads-1.2.orig/src/output/output.h 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/output/output.h 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -25,6 +25,8 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#ifndef OUTPUT_HEADER
|
||||
+#define OUTPUT_HEADER
|
||||
|
||||
/* DEFINES ----------------------------------------- */
|
||||
#ifdef LINUX
|
||||
@@ -77,3 +79,4 @@ int print_arp_asset (struct in_addr ip_a
|
||||
int print_stat(struct in_addr ip_addr, u_int16_t port, unsigned short proto);
|
||||
void end_output (void);
|
||||
|
||||
+#endif
|
||||
diff -urp pads-1.2.orig/src/output/output-screen.c pads-1.2/src/output/output-screen.c
|
||||
--- pads-1.2.orig/src/output/output-screen.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-screen.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -24,7 +24,9 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#include <arpa/inet.h>
|
||||
#include "output-screen.h"
|
||||
+#include "util.h"
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : setup_output_screen
|
||||
@@ -38,7 +40,6 @@ int
|
||||
setup_output_screen (void)
|
||||
{
|
||||
OutputPlugin *plugin;
|
||||
- bstring name;
|
||||
|
||||
/* Allocate and setup plugin data record. */
|
||||
plugin = (OutputPlugin*)malloc(sizeof(OutputPlugin));
|
||||
diff -urp pads-1.2.orig/src/output/output-screen.h pads-1.2/src/output/output-screen.h
|
||||
--- pads-1.2.orig/src/output/output-screen.h 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-screen.h 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -25,6 +25,8 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#ifndef OUTPUT_SCREEN_HEADER
|
||||
+#define OUTPUT_SCREEN_HEADER
|
||||
|
||||
/* DEFINES ----------------------------------------- */
|
||||
#ifdef LINUX
|
||||
@@ -43,16 +45,12 @@
|
||||
#include "output.h"
|
||||
|
||||
|
||||
-/* TYPEDEFS ---------------------------------------- */
|
||||
-typedef struct _OutputCSVConf
|
||||
-{
|
||||
- FILE *file;
|
||||
-} OutputCSVConf;
|
||||
-
|
||||
-
|
||||
/* PROTOTYPES -------------------------------------- */
|
||||
int setup_output_screen (void);
|
||||
int init_output_screen (bstring args);
|
||||
int print_asset_screen (Asset *rec);
|
||||
int print_arp_asset_screen (ArpAsset *rec);
|
||||
int end_output_screen (void);
|
||||
+
|
||||
+#endif
|
||||
+
|
||||
diff -urp pads-1.2.orig/src/packet.c pads-1.2/src/packet.c
|
||||
--- pads-1.2.orig/src/packet.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/packet.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -26,6 +26,10 @@
|
||||
*
|
||||
**************************************************************************/
|
||||
#include "packet.h"
|
||||
+#include "output/output.h"
|
||||
+#include "storage.h"
|
||||
+#include "monnet.h"
|
||||
+#include "identification.h"
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : process_eth
|
||||
@@ -157,9 +161,9 @@ void process_arp (const struct pcap_pkth
|
||||
case ARPOP_REPLY:
|
||||
memcpy(&ip_addr.s_addr, arph->arp_spa, sizeof(u_int8_t) * 4);
|
||||
|
||||
- if (check_arp_asset(ip_addr, arph->arp_sha) == 1) {
|
||||
- add_arp_asset(ip_addr, arph->arp_sha, 0);
|
||||
- print_arp_asset (ip_addr, arph->arp_sha);
|
||||
+ if (check_arp_asset(ip_addr, (char *)arph->arp_sha) == 1) {
|
||||
+ add_arp_asset(ip_addr, (char *)arph->arp_sha, 0);
|
||||
+ print_arp_asset (ip_addr, (char *)arph->arp_sha);
|
||||
}
|
||||
|
||||
break;
|
||||
@@ -222,7 +226,7 @@ void process_tcp (const struct pcap_pkth
|
||||
* Check to see if this ACK packet needs to be
|
||||
* identified.
|
||||
*/
|
||||
- payload = (u_char *)(packet + sizeof(struct tcphdr) + len);
|
||||
+ payload = (char *)(packet + sizeof(struct tcphdr) + len);
|
||||
|
||||
/* Attempt to identify this asset. */
|
||||
if(tcp_identify(ip_src, tcph->th_sport, payload,
|
||||
diff -urp pads-1.2.orig/src/pads.c pads-1.2/src/pads.c
|
||||
--- pads-1.2.orig/src/pads.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/pads.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -26,6 +26,13 @@
|
||||
*
|
||||
**************************************************************************/
|
||||
#include "pads.h"
|
||||
+#include "util.h"
|
||||
+#include "storage.h"
|
||||
+#include "output/output.h"
|
||||
+#include "identification.h"
|
||||
+#include "mac-resolution.h"
|
||||
+#include "monnet.h"
|
||||
+#include "configuration.h"
|
||||
|
||||
/* Variable Declarations */
|
||||
GC gc; /* Global Configuration */
|
||||
@@ -34,6 +41,9 @@ proc_t processor;
|
||||
char **prog_argv;
|
||||
int prog_argc;
|
||||
|
||||
+/* Function Declarations */
|
||||
+static int process_cmdline (int argc, char *argv[]);
|
||||
+
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : process_pkt
|
||||
* DESCRIPTION : This function takes data from libpcap and
|
||||
@@ -210,7 +220,7 @@ main_pads (void)
|
||||
if (gc.pcap_file) {
|
||||
/* Read from PCAP file specified by '-r' switch. */
|
||||
log_message("Reading from file %s\n", bdata(gc.pcap_file));
|
||||
- if (!(gc.handle = pcap_open_offline(bdata(gc.pcap_file), errbuf))) {
|
||||
+ if (!(gc.handle = pcap_open_offline((char *)bdata(gc.pcap_file), errbuf))) {
|
||||
err_message("Unable to open %s. (%s)", bdata(gc.pcap_file), errbuf);
|
||||
}
|
||||
|
||||
@@ -268,7 +278,7 @@ main_pads (void)
|
||||
/* Open banner dump file if specified (-d). */
|
||||
if (gc.dump_file) {
|
||||
verbose_message("Opening Banner Dump File");
|
||||
- if (!(gc.dumper = pcap_dump_open(gc.handle, bdata(gc.dump_file))))
|
||||
+ if (!(gc.dumper = pcap_dump_open(gc.handle, (char *)bdata(gc.dump_file))))
|
||||
err_message("Cannot open dump file - %s\n", pcap_geterr(gc.handle));
|
||||
}
|
||||
|
||||
@@ -323,7 +333,7 @@ end_pads(void)
|
||||
|
||||
/* Remove PID File */
|
||||
if (gc.daemon_mode == 1)
|
||||
- if ((unlink(bdata(gc.pid_file))) != 0)
|
||||
+ if ((unlink((char *)bdata(gc.pid_file))) != 0)
|
||||
log_message("WARNING: Unable to remove PID file - %s\n", bdata(gc.pid_file));
|
||||
|
||||
/* End Modules */
|
||||
@@ -370,7 +380,7 @@ end_pads(void)
|
||||
* RETURN : 0 - Success
|
||||
* : -1 - Error
|
||||
* ---------------------------------------------------------- */
|
||||
-int
|
||||
+static int
|
||||
process_cmdline (int argc, char *argv[])
|
||||
{
|
||||
int ch;
|
||||
@@ -477,11 +487,6 @@ sig_hup_handler(int signal)
|
||||
int
|
||||
main(int argc, char *argv[])
|
||||
{
|
||||
- /* Variables */
|
||||
- int i;
|
||||
- struct pcap_pkthdr header; /* The header that pcap gives us */
|
||||
- const u_char *packet; /* The actual packet */
|
||||
-
|
||||
/* Copy Command Line Args */
|
||||
prog_argc = argc;
|
||||
prog_argv = argv;
|
||||
diff -urp pads-1.2.orig/src/storage.c pads-1.2/src/storage.c
|
||||
--- pads-1.2.orig/src/storage.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/storage.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -24,7 +24,10 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#include <arpa/inet.h>
|
||||
+#include <netinet/ether.h>
|
||||
#include "storage.h"
|
||||
+#include "mac-resolution.h"
|
||||
|
||||
Asset *asset_list;
|
||||
ArpAsset *arp_asset_list;
|
||||
@@ -400,7 +403,7 @@ inline Asset *
|
||||
find_asset (struct in_addr ip_addr, u_int16_t port, unsigned short proto)
|
||||
{
|
||||
Asset *list;
|
||||
- Asset *rec;
|
||||
+ Asset *rec = NULL;
|
||||
|
||||
list = asset_list;
|
||||
|
||||
@@ -469,7 +472,7 @@ void print_database ()
|
||||
while (rec != NULL) {
|
||||
printf("%d: %s,%d,%d,%d,%s,%s,%d\n",
|
||||
id, inet_ntoa(rec->ip_addr), ntohs(rec->port),
|
||||
- rec->proto, rec->discovered,
|
||||
+ rec->proto, (int)rec->discovered,
|
||||
bdata(rec->service), bdata(rec->application),
|
||||
rec->i_attempts);
|
||||
rec = rec->next;
|
||||
@@ -482,7 +485,7 @@ void print_database ()
|
||||
arp = arp_asset_list;
|
||||
while (arp != NULL) {
|
||||
printf("%d: %s,%s,%d\n", id, inet_ntoa(arp->ip_addr),
|
||||
- ether_ntoa(&arp->mac_addr), arp->discovered);
|
||||
+ ether_ntoa((struct ether_addr *)arp->mac_addr), (int)arp->discovered);
|
||||
arp = arp->next;
|
||||
id++;
|
||||
}
|
||||
diff -urp pads-1.2.orig/src/util.c pads-1.2/src/util.c
|
||||
--- pads-1.2.orig/src/util.c 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/util.c 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -25,8 +25,10 @@
|
||||
* $Id: pads-1.2-cleanup.patch,v 1.1 2008/08/13 17:35:11 sgrubb Exp $
|
||||
*
|
||||
**************************************************************************/
|
||||
+#include <unistd.h>
|
||||
+#include <ctype.h>
|
||||
#include "util.h"
|
||||
-
|
||||
+#include "pads.h"
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : strip_comment
|
||||
@@ -60,11 +62,12 @@ strip_comment (char *string)
|
||||
int
|
||||
chomp (char *string, int size)
|
||||
{
|
||||
- for (size; size >= 0; size--) {
|
||||
+ while (size >= 0) {
|
||||
if (string[size] == '\n') {
|
||||
string[size] = '\0';
|
||||
return 1;
|
||||
}
|
||||
+ size--;
|
||||
}
|
||||
|
||||
return 0;
|
||||
@@ -121,7 +124,7 @@ init_pid_file (bstring pid_file, bstring
|
||||
gc.pid_file = bfromcstr("/var/run/pads.pid");
|
||||
|
||||
/* Create PID File */
|
||||
- if ((fp = fopen(bdata(gc.pid_file), "w")) != NULL) {
|
||||
+ if ((fp = fopen((char *)bdata(gc.pid_file), "w")) != NULL) {
|
||||
pid = (int) getpid();
|
||||
fprintf(fp, "%d\n", pid);
|
||||
fclose(fp);
|
||||
@@ -133,11 +136,11 @@ init_pid_file (bstring pid_file, bstring
|
||||
if (user == NULL || group == NULL)
|
||||
return;
|
||||
|
||||
- if ((this_group = getgrnam(bdata(group))) == NULL)
|
||||
+ if ((this_group = getgrnam((char *)bdata(group))) == NULL)
|
||||
err_message("'%s' group does not appear to exist.", bdata(group));
|
||||
- if ((this_user = getpwnam(bdata(user))) == NULL)
|
||||
+ if ((this_user = getpwnam((char *)bdata(user))) == NULL)
|
||||
err_message("'%s' user does not appear to exist.", bdata(user));
|
||||
- if ((chown(pid_file, this_user->pw_uid, this_group->gr_gid)) != 0)
|
||||
+ if ((chown((char *)bdata(pid_file), this_user->pw_uid, this_group->gr_gid)) != 0)
|
||||
err_message("Unable to change PID file's ownership.");
|
||||
|
||||
}
|
||||
@@ -343,7 +346,7 @@ strlcpy(char *dst, const char *src, size
|
||||
size_t
|
||||
strlcat(char *dst, const char *src, size_t len) {
|
||||
char *dstptr = dst;
|
||||
- size_t dstlen, tocopy;
|
||||
+ size_t dstlen, tocopy = len;
|
||||
const char *srcptr = src;
|
||||
|
||||
while (tocopy-- && *dstptr) dstptr++;
|
||||
@@ -384,10 +387,10 @@ drop_privs (bstring newuser, bstring new
|
||||
if (newuser == NULL || newgroup == NULL)
|
||||
return;
|
||||
|
||||
- if ((this_group = getgrnam(bdata(newgroup))) == NULL)
|
||||
+ if ((this_group = getgrnam((char *)bdata(newgroup))) == NULL)
|
||||
err_message("'%s' group does not appear to exist.", bdata(newgroup));
|
||||
|
||||
- if ((this_user = getpwnam(bdata(newuser))) == NULL)
|
||||
+ if ((this_user = getpwnam((char *)bdata(newuser))) == NULL)
|
||||
err_message("'%s' user does not appear to exist.", bdata(newuser));
|
||||
|
||||
/* Set Group */
|
||||
@@ -458,7 +461,7 @@ mac2hex(const char *mac, char *dst, int
|
||||
* RETURN : 0 - MAC Address String
|
||||
* ---------------------------------------------------------- */
|
||||
char *
|
||||
-hex2mac(unsigned const char *mac)
|
||||
+hex2mac(const char *mac)
|
||||
{
|
||||
static char buf[18];
|
||||
|
||||
diff -urp pads-1.2.orig/src/util.h pads-1.2/src/util.h
|
||||
--- pads-1.2.orig/src/util.h 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/src/util.h 2008-06-30 13:28:28.000000000 -0400
|
||||
@@ -53,6 +53,6 @@ size_t strlcat(char *dst, const char *sr
|
||||
#endif
|
||||
void drop_privs (bstring newuser, bstring newgroup);
|
||||
void mac2hex(const char *mac, char *dst, int len);
|
||||
-char *hex2mac(unsigned const char *mac);
|
||||
+char *hex2mac(const char *mac);
|
||||
|
||||
/* GLOBALS ----------------------------------------- */
|
||||
102
pads-1.2-daemon.patch
Normal file
102
pads-1.2-daemon.patch
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
diff -urp pads-1.2.orig/src/configuration.c pads-1.2/src/configuration.c
|
||||
--- pads-1.2.orig/src/configuration.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/configuration.c 2008-07-15 15:59:49.000000000 -0400
|
||||
@@ -115,7 +115,7 @@ void parse_line (bstring line)
|
||||
else
|
||||
gc.daemon_mode = 0;
|
||||
}
|
||||
-
|
||||
+ become_daemon();
|
||||
} else if ((biseqcstr(param, "pid_file")) == 1) {
|
||||
/* PID FILE */
|
||||
gc.pid_file = bstrcpy(value);
|
||||
diff -urp pads-1.2.orig/src/pads.c pads-1.2/src/pads.c
|
||||
--- pads-1.2.orig/src/pads.c 2008-07-12 08:36:10.000000000 -0400
|
||||
+++ pads-1.2/src/pads.c 2008-07-15 16:02:25.000000000 -0400
|
||||
@@ -236,21 +236,13 @@ init_pads (void)
|
||||
if ((activate_output_plugin(name, gc.report_file)) == -1)
|
||||
err_message("Error: 'activate_output_plugin' in function 'init_pads' failed.");
|
||||
bdestroy(name);
|
||||
+ become_daemon();
|
||||
}
|
||||
|
||||
/* Initialize Modules */
|
||||
init_identification();
|
||||
init_mac_resolution();
|
||||
|
||||
- /* Daemon Mode: fork child process */
|
||||
- if (gc.daemon_mode) {
|
||||
- verbose_message("[-] Daemonizing...\n");
|
||||
- if (daemon(0, 0) < 0) {
|
||||
- err_message("Daemonize failed");
|
||||
- }
|
||||
- init_pid_file(gc.pid_file, gc.priv_user, gc.priv_group);
|
||||
- }
|
||||
-
|
||||
/* Signal Trapping */
|
||||
(void) signal(SIGTERM, sig_term_handler);
|
||||
(void) signal(SIGINT, sig_int_handler);
|
||||
@@ -291,9 +283,13 @@ main_pads (void)
|
||||
|
||||
/* Determine Sniffing Interface */
|
||||
if (!gc.dev) {
|
||||
+ char *dev;
|
||||
verbose_message("Looking for sniffing interface");
|
||||
- if (!(gc.dev = pcap_lookupdev(errbuf)))
|
||||
- err_message("Unable to find a sniffing interface! (%s)", errbuf);
|
||||
+ dev = pcap_lookupdev(errbuf);
|
||||
+ if (!dev)
|
||||
+ err_message("Unable to find a sniffing interface! (%s)",
|
||||
+ errbuf);
|
||||
+ gc.dev = strdup(dev);
|
||||
}
|
||||
|
||||
/* Set up libpcap connection. */
|
||||
diff -urp pads-1.2.orig/src/util.c pads-1.2/src/util.c
|
||||
--- pads-1.2.orig/src/util.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/util.c 2008-07-15 16:02:38.000000000 -0400
|
||||
@@ -81,7 +81,7 @@ chomp (char *string, int size)
|
||||
* INPUT : 0 - PID filename
|
||||
* RETURN : None!
|
||||
* ---------------------------------------------------------- */
|
||||
-void
|
||||
+static void
|
||||
init_pid_file (bstring pid_file, bstring user, bstring group)
|
||||
{
|
||||
int pid;
|
||||
@@ -116,6 +116,23 @@ init_pid_file (bstring pid_file, bstring
|
||||
}
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
+ * * FUNCTION : become_daemon
|
||||
+ * * DESCRIPTION : This function makes pads into a daemon
|
||||
+ * * RETURN : none
|
||||
+ * * ---------------------------------------------------------- */
|
||||
+void become_daemon(void)
|
||||
+{
|
||||
+ if (gc.daemon_mode) {
|
||||
+ /* Daemon Mode: fork child process */
|
||||
+ verbose_message("[-] Daemonizing...\n");
|
||||
+ if (daemon(0, 0) < 0) {
|
||||
+ err_message("Daemonize failed");
|
||||
+ }
|
||||
+ init_pid_file(gc.pid_file, gc.priv_user, gc.priv_group);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+/* ----------------------------------------------------------
|
||||
* FUNCTION : copy_argv
|
||||
* DESCRIPTION : This function will flatten argv into a
|
||||
* : single string. This function was taken
|
||||
diff -urp pads-1.2.orig/src/util.h pads-1.2/src/util.h
|
||||
--- pads-1.2.orig/src/util.h 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/util.h 2008-07-15 16:03:04.000000000 -0400
|
||||
@@ -39,7 +39,7 @@
|
||||
/* PROTOTYPES -------------------------------------- */
|
||||
void strip_comment (char *string);
|
||||
int chomp (char *string, int size);
|
||||
-void init_pid_file (bstring pid_file, bstring user, bstring group);
|
||||
+void become_daemon(void);
|
||||
char *copy_argv(register char **argv);
|
||||
void log_message (const char *msg, ...)
|
||||
#ifdef __GNUC__
|
||||
75
pads-1.2-daemonize.patch
Normal file
75
pads-1.2-daemonize.patch
Normal file
|
|
@ -0,0 +1,75 @@
|
|||
diff -urp pads-1.2.orig/etc/pads.conf pads-1.2/etc/pads.conf
|
||||
--- pads-1.2.orig/etc/pads.conf 2008-06-29 20:16:30.000000000 -0400
|
||||
+++ pads-1.2/etc/pads.conf 2008-07-01 15:54:01.000000000 -0400
|
||||
@@ -15,7 +15,7 @@
|
||||
# -------------------------
|
||||
# This parameter determines whether the application will go into the background.
|
||||
# 0 = Disable, 1 = Enable
|
||||
-daemon 0
|
||||
+daemon 1
|
||||
|
||||
# pid_file
|
||||
# -------------------------
|
||||
@@ -62,13 +62,13 @@ pid_file /var/run/pads.pid
|
||||
# -------------------------
|
||||
# This output plugin displays PADS data to the screen. It is mainly used for
|
||||
# debugging purposes.
|
||||
-output screen
|
||||
+#output screen
|
||||
|
||||
# output: csv
|
||||
# -------------------------
|
||||
# This output plugin writes PADS data to a CSV file. Optionally, a CSV filename
|
||||
# can be specified as an argument.
|
||||
-output csv: assets.csv
|
||||
+output csv: /etc/pads-assets.csv
|
||||
|
||||
# output: fifo
|
||||
# -------------------------
|
||||
diff -urp pads-1.2.orig/src/output/output-csv.c pads-1.2/src/output/output-csv.c
|
||||
--- pads-1.2.orig/src/output/output-csv.c 2008-06-30 17:54:33.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-csv.c 2008-07-01 15:53:30.000000000 -0400
|
||||
@@ -130,7 +130,8 @@ read_report_file (void)
|
||||
struct bstrList *lines;
|
||||
int i;
|
||||
|
||||
- printf("[-] Processing Existing %s\n", bdata(output_csv_conf.filename));
|
||||
+
|
||||
+ log_message("[-] Processing Existing %s\n", bdata(output_csv_conf.filename));
|
||||
|
||||
/* Open Signature File */
|
||||
if ((fp = fopen((char *)bdata(output_csv_conf.filename), "r")) == NULL) {
|
||||
diff -urp pads-1.2.orig/src/pads.c pads-1.2/src/pads.c
|
||||
--- pads-1.2.orig/src/pads.c 2008-06-30 17:54:33.000000000 -0400
|
||||
+++ pads-1.2/src/pads.c 2008-07-01 15:53:30.000000000 -0400
|
||||
@@ -195,6 +195,9 @@ init_pads (void)
|
||||
/* Process the command line parameters. */
|
||||
process_cmdline(prog_argc, prog_argv);
|
||||
|
||||
+ if (!gc.daemon_mode)
|
||||
+ print_header();
|
||||
+
|
||||
/* Initialize Output Module */
|
||||
init_output();
|
||||
|
||||
@@ -523,7 +526,6 @@ main(int argc, char *argv[])
|
||||
prog_argv = argv;
|
||||
|
||||
/* Main Program */
|
||||
- print_header();
|
||||
main_pads();
|
||||
|
||||
return(0);
|
||||
diff -urp pads-1.2.orig/src/util.c pads-1.2/src/util.c
|
||||
--- pads-1.2.orig/src/util.c 2008-07-01 12:46:15.000000000 -0400
|
||||
+++ pads-1.2/src/util.c 2008-07-01 15:53:30.000000000 -0400
|
||||
@@ -85,7 +85,8 @@ daemonize ()
|
||||
{
|
||||
pid_t pid;
|
||||
|
||||
- printf("[-] Daemonizing...\n");
|
||||
+ if (!gc.daemon_mode)
|
||||
+ printf("[-] Daemonizing...\n");
|
||||
|
||||
pid = fork();
|
||||
if (pid > 0) {
|
||||
12
pads-1.2-disable-debug.patch
Normal file
12
pads-1.2-disable-debug.patch
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
diff -ur pads-1.2.orig/src/global.h pads-1.2/src/global.h
|
||||
--- pads-1.2.orig/src/global.h 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/global.h 2008-07-01 13:57:59.000000000 -0400
|
||||
@@ -45,7 +45,7 @@
|
||||
|
||||
#define I_ATTEMPTS 4
|
||||
|
||||
-#define DEBUG
|
||||
+//#define DEBUG
|
||||
|
||||
#define PADS_SIGNATURE_LIST "pads-signature-list"
|
||||
#define PADS_ETHER_CODES "pads-ether-codes"
|
||||
6223
pads-1.2-ether-codes-update.patch
Normal file
6223
pads-1.2-ether-codes-update.patch
Normal file
File diff suppressed because it is too large
Load diff
12
pads-1.2-extra-libs.patch
Normal file
12
pads-1.2-extra-libs.patch
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
diff -ur pads-1.2.orig/src/Makefile.am pads-1.2/src/Makefile.am
|
||||
--- pads-1.2.orig/src/Makefile.am 2019-02-11 16:48:47.516302720 -0500
|
||||
+++ pads-1.2/src/Makefile.am 2019-02-11 17:49:51.772909507 -0500
|
||||
@@ -12,7 +12,7 @@
|
||||
util.c util.h \
|
||||
global.h
|
||||
pads_LDFLAGS = -pthread
|
||||
-pads_LDADD = $(top_srcdir)/lib/bstring/libbstring.a output/liboutput.a
|
||||
+pads_LDADD = $(top_srcdir)/lib/bstring/libbstring.a output/liboutput.a $(EXTRA_LIBS)
|
||||
bin_SCRIPTS = pads-report
|
||||
|
||||
EXTRA_DIST = pads-report.pl
|
||||
24
pads-1.2-inline-cleanup.patch
Normal file
24
pads-1.2-inline-cleanup.patch
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
diff -urp pads-1.2.orig/src/storage.c pads-1.2/src/storage.c
|
||||
--- pads-1.2.orig/src/storage.c 2015-08-17 10:18:51.304266249 -0400
|
||||
+++ pads-1.2/src/storage.c 2015-08-17 10:22:40.551260540 -0400
|
||||
@@ -369,7 +369,7 @@ void end_storage ()
|
||||
* : 2 - Protocol
|
||||
* RETURN : Pointer to Asset
|
||||
* ---------------------------------------------------------- */
|
||||
-inline Asset *
|
||||
+Asset *
|
||||
find_asset (struct in_addr ip_addr, u_int16_t port, unsigned short proto)
|
||||
{
|
||||
Asset *list;
|
||||
diff -urp pads-1.2.orig/src/storage.h pads-1.2/src/storage.h
|
||||
--- pads-1.2.orig/src/storage.h 2015-08-17 10:18:51.304266249 -0400
|
||||
+++ pads-1.2/src/storage.h 2015-08-17 10:21:10.412262785 -0400
|
||||
@@ -56,7 +56,7 @@ void add_arp_asset (struct in_addr ip_ad
|
||||
unsigned short get_i_attempts (struct in_addr ip_addr, u_int16_t port, unsigned short proto);
|
||||
short update_i_attempts (unsigned short i_attempts);
|
||||
short update_asset (struct in_addr ip_addr, u_int16_t port, unsigned short proto, bstring service, bstring application);
|
||||
-inline Asset *find_asset (struct in_addr ip_addr, u_int16_t port, unsigned short proto);
|
||||
+Asset *find_asset (struct in_addr ip_addr, u_int16_t port, unsigned short proto);
|
||||
Asset *get_asset_pointer (void);
|
||||
ArpAsset *get_arp_pointer (void);
|
||||
void end_storage (void);
|
||||
121
pads-1.2-leak.patch
Normal file
121
pads-1.2-leak.patch
Normal file
|
|
@ -0,0 +1,121 @@
|
|||
diff -urp pads-1.2.orig/src/monnet.c pads-1.2/src/monnet.c
|
||||
--- pads-1.2.orig/src/monnet.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/monnet.c 2008-07-11 14:06:36.000000000 -0400
|
||||
@@ -214,3 +214,23 @@ short check_monnet (const struct in_addr
|
||||
/* Asset does not fall within a monitored network. */
|
||||
return 0;
|
||||
}
|
||||
+
|
||||
+/* ----------------------------------------------------------
|
||||
+ * FUNCTION : end_monnet
|
||||
+ * DESCRIPTION : This function will free all the records
|
||||
+ * : placed in the monnet data structure.
|
||||
+ * INPUT : None!
|
||||
+ * RETURN : None!
|
||||
+ * ---------------------------------------------------------- */
|
||||
+void end_monnet (void)
|
||||
+{
|
||||
+ struct mon_net *next;
|
||||
+
|
||||
+ /* Free records in monnet list (mn). */
|
||||
+ while (mn != NULL) {
|
||||
+ next = mn->next;
|
||||
+ free (mn);
|
||||
+ mn = next;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
diff -urp pads-1.2.orig/src/monnet.h pads-1.2/src/monnet.h
|
||||
--- pads-1.2.orig/src/monnet.h 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/monnet.h 2008-07-11 14:06:36.000000000 -0400
|
||||
@@ -44,6 +44,6 @@ void parse_networks (char *cmdline);
|
||||
void init_netmasks (unsigned int nm[33]);
|
||||
void add_monnet(char *network, char *netmask);
|
||||
short check_monnet (const struct in_addr ip_addr);
|
||||
-
|
||||
+void end_monnet (void);
|
||||
|
||||
/* GLOBALS ----------------------------------------- */
|
||||
diff -urp pads-1.2.orig/src/output/output-prelude.c pads-1.2/src/output/output-prelude.c
|
||||
--- pads-1.2.orig/src/output/output-prelude.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-prelude.c 2008-07-11 14:06:49.000000000 -0400
|
||||
@@ -117,7 +117,7 @@ static int init_prelude(void)
|
||||
static int new_alert_common(idmef_message_t **idmef, idmef_alert_t **alert)
|
||||
{
|
||||
int ret;
|
||||
- idmef_time_t *ctime;
|
||||
+ idmef_time_t *dt_time, *cr_time;
|
||||
|
||||
ret = idmef_message_new(idmef);
|
||||
PRELUDE_FAIL_CHECK;
|
||||
@@ -130,10 +130,12 @@ static int new_alert_common(idmef_messag
|
||||
IDMEF_LIST_PREPEND);
|
||||
|
||||
// Set time this was created
|
||||
- ret = idmef_time_new_from_gettimeofday(&ctime);
|
||||
+ ret = idmef_time_new_from_gettimeofday(&dt_time);
|
||||
PRELUDE_FAIL_CHECK;
|
||||
- idmef_alert_set_detect_time(*alert, ctime);
|
||||
- idmef_alert_set_create_time(*alert, ctime);
|
||||
+ ret = idmef_time_clone(dt_time, &cr_time);
|
||||
+ PRELUDE_FAIL_CHECK;
|
||||
+ idmef_alert_set_detect_time(*alert, dt_time);
|
||||
+ idmef_alert_set_create_time(*alert, cr_time);
|
||||
|
||||
return 0;
|
||||
err:
|
||||
@@ -287,6 +289,7 @@ static int asset_alert(Asset *a, idmef_m
|
||||
PRELUDE_FAIL_CHECK;
|
||||
ret = prelude_string_set_dup(name, (char *)bdata(a->service));
|
||||
PRELUDE_FAIL_CHECK;
|
||||
+ idmef_service_set_name(service, name);
|
||||
if (bdata(a->application) != NULL) {
|
||||
ret = idmef_alert_new_additional_data(alert, &data,
|
||||
IDMEF_LIST_APPEND);
|
||||
@@ -508,6 +511,7 @@ end_output_prelude ()
|
||||
|
||||
if (client)
|
||||
prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
|
||||
+ prelude_deinit();
|
||||
free(profile);
|
||||
|
||||
return 0;
|
||||
diff -urp pads-1.2.orig/src/pads.c pads-1.2/src/pads.c
|
||||
--- pads-1.2.orig/src/pads.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/pads.c 2008-07-11 14:06:36.000000000 -0400
|
||||
@@ -392,6 +392,7 @@ end_pads(void)
|
||||
if (gc.handle) {
|
||||
log_message("Closing PCAP Connection");
|
||||
pcap_close(gc.handle);
|
||||
+ pcap_freecode(&gc.filter);
|
||||
}
|
||||
|
||||
/* Remove PID File */
|
||||
@@ -407,10 +408,13 @@ end_pads(void)
|
||||
#ifndef DISABLE_VENDOR
|
||||
end_mac_resolution();
|
||||
#endif
|
||||
+ end_monnet();
|
||||
|
||||
/* Garbage Collect GC Variable */
|
||||
if (gc.conf_file != NULL)
|
||||
bdestroy(gc.conf_file);
|
||||
+ if (gc.dev != NULL)
|
||||
+ free(gc.dev);
|
||||
if (gc.report_file != NULL)
|
||||
bdestroy(gc.report_file);
|
||||
if (gc.fifo_file != NULL)
|
||||
diff -urp pads-1.2.orig/src/packet.c pads-1.2/src/packet.c
|
||||
--- pads-1.2.orig/src/packet.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/packet.c 2008-07-10 13:04:38.000000000 -0400
|
||||
@@ -95,6 +95,10 @@ void process_sll (const struct pcap_pkth
|
||||
/* Extract the sll header from the packet. */
|
||||
sllh = (struct sll_header*) packet;
|
||||
|
||||
+ /* Avoid bogus packets */
|
||||
+ if (pkthdr->caplen < ETH_HLEN)
|
||||
+ return;
|
||||
+
|
||||
/* Determine what type of sll packet this is. */
|
||||
switch(ntohs(sllh->sll_protocol)) {
|
||||
/* IP */
|
||||
280
pads-1.2-memleak.patch
Normal file
280
pads-1.2-memleak.patch
Normal file
|
|
@ -0,0 +1,280 @@
|
|||
diff -urp pads-1.2.orig/src/identification.c pads-1.2/src/identification.c
|
||||
--- pads-1.2.orig/src/identification.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/identification.c 2008-06-30 16:12:11.000000000 -0400
|
||||
@@ -96,7 +96,7 @@ int parse_raw_signature (bstring line, i
|
||||
struct bstrList *raw_sig;
|
||||
struct bstrList *title = NULL;
|
||||
Signature *sig;
|
||||
- bstring pcre_string;
|
||||
+ bstring pcre_string = NULL;
|
||||
const char *err; /* PCRE */
|
||||
int erroffset; /* PCRE */
|
||||
int ret = 0;
|
||||
@@ -117,10 +117,12 @@ int parse_raw_signature (bstring line, i
|
||||
} else if (raw_sig->qty > 3) {
|
||||
pcre_string = bstrcpy(raw_sig->entry[2]);
|
||||
for (i = 3; i < raw_sig->qty; i++) {
|
||||
- if ((bconcat(pcre_string, bfromcstr(","))) == BSTR_ERR)
|
||||
+ bstring tmp = bfromcstr(",");
|
||||
+ if ((bconcat(pcre_string, tmp)) == BSTR_ERR)
|
||||
ret = -1;
|
||||
if ((bconcat(pcre_string, raw_sig->entry[i])) == BSTR_ERR)
|
||||
ret = -1;
|
||||
+ bdestroy(tmp);
|
||||
}
|
||||
} else {
|
||||
pcre_string = bstrcpy(raw_sig->entry[2]);
|
||||
@@ -129,8 +131,10 @@ int parse_raw_signature (bstring line, i
|
||||
/* Split Title */
|
||||
if (raw_sig->entry[1] != NULL && ret != -1)
|
||||
title = bsplit(raw_sig->entry[1], '/');
|
||||
- if (title == NULL)
|
||||
+ if (title == NULL) {
|
||||
+ bdestroy(pcre_string);
|
||||
return -1;
|
||||
+ }
|
||||
|
||||
if (title->qty < 3)
|
||||
ret = -1;
|
||||
@@ -139,6 +143,7 @@ int parse_raw_signature (bstring line, i
|
||||
if (ret != -1) {
|
||||
sig = (Signature*)malloc(sizeof(Signature));
|
||||
sig->next = NULL;
|
||||
+ sig->regex = NULL;
|
||||
if (raw_sig->entry[0] != NULL)
|
||||
sig->service = bstrcpy(raw_sig->entry[0]);
|
||||
if (title->entry[1] != NULL)
|
||||
@@ -280,6 +285,7 @@ int pcre_identify (struct in_addr ip_add
|
||||
if (rc != -1) {
|
||||
app = get_app_name(list, payload, ovector, rc);
|
||||
update_asset(ip_addr, port, proto, list->service, app);
|
||||
+ bdestroy(app);
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -359,7 +365,7 @@ bstring get_app_name (Signature *sig,
|
||||
}
|
||||
sub[z] = '\0';
|
||||
|
||||
- retval = bstrcpy(bfromcstr(sub));
|
||||
+ retval = bfromcstr(sub);
|
||||
return retval;
|
||||
|
||||
}
|
||||
@@ -388,6 +394,7 @@ void end_identification()
|
||||
bdestroy(signature_list->title.ver);
|
||||
if (signature_list->title.misc != NULL)
|
||||
bdestroy(signature_list->title.misc);
|
||||
+ pcre_free(signature_list->regex);
|
||||
|
||||
/* Free Record */
|
||||
if (signature_list != NULL)
|
||||
diff -urp pads-1.2.orig/src/output/output.c pads-1.2/src/output/output.c
|
||||
--- pads-1.2.orig/src/output/output.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/output/output.c 2008-06-30 16:12:11.000000000 -0400
|
||||
@@ -31,8 +31,8 @@
|
||||
#include "output-fifo.h"
|
||||
#include "storage.h"
|
||||
|
||||
-/* Global Variables */
|
||||
-OutputPluginList *output_plugin_list;
|
||||
+/* Local Variables */
|
||||
+static OutputPluginList *output_plugin_list = NULL;
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : init_output()
|
||||
@@ -77,6 +77,7 @@ int register_output_plugin (OutputPlugin
|
||||
list = (OutputPluginList*)malloc(sizeof(OutputPluginList));
|
||||
list->plugin = plugin;
|
||||
list->active = 0;
|
||||
+ list->next = NULL;
|
||||
|
||||
/* Place plugin in data structure. */
|
||||
if (output_plugin_list == NULL) {
|
||||
diff -urp pads-1.2.orig/src/output/output-csv.c pads-1.2/src/output/output-csv.c
|
||||
--- pads-1.2.orig/src/output/output-csv.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-csv.c 2008-06-30 16:12:11.000000000 -0400
|
||||
@@ -46,7 +46,7 @@ setup_output_csv (void)
|
||||
|
||||
/* Allocate and setup plugin data record. */
|
||||
plugin = (OutputPlugin*)malloc(sizeof(OutputPlugin));
|
||||
- plugin->name = bstrcpy(bfromcstr("csv"));
|
||||
+ plugin->name = bfromcstr("csv");
|
||||
plugin->init = init_output_csv;
|
||||
plugin->print_asset = print_asset_csv;
|
||||
plugin->print_arp = print_arp_asset_csv;
|
||||
@@ -83,7 +83,7 @@ init_output_csv (bstring filename)
|
||||
if (filename != NULL)
|
||||
output_csv_conf.filename = bstrcpy(filename);
|
||||
else
|
||||
- output_csv_conf.filename = bstrcpy(bfromcstr("assets.csv"));
|
||||
+ output_csv_conf.filename = bfromcstr("assets.csv");
|
||||
|
||||
/* Check to see if *filename exists. */
|
||||
if ((fp = fopen((char *)bdata(output_csv_conf.filename), "r")) == NULL) {
|
||||
diff -urp pads-1.2.orig/src/output/output-fifo.c pads-1.2/src/output/output-fifo.c
|
||||
--- pads-1.2.orig/src/output/output-fifo.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-fifo.c 2008-06-30 16:12:11.000000000 -0400
|
||||
@@ -71,7 +71,7 @@ setup_output_fifo (void)
|
||||
|
||||
/* Allocate and setup plugin data record. */
|
||||
plugin = (OutputPlugin*)malloc(sizeof(OutputPlugin));
|
||||
- plugin->name = bstrcpy(bfromcstr("fifo"));
|
||||
+ plugin->name = bfromcstr("fifo");
|
||||
plugin->init = init_output_fifo;
|
||||
plugin->print_asset = print_asset_fifo;
|
||||
plugin->print_arp = print_arp_asset_fifo;
|
||||
@@ -102,7 +102,7 @@ init_output_fifo (bstring fifo_file)
|
||||
|
||||
/* Make sure report_file isn't NULL. */
|
||||
if (fifo_file == NULL)
|
||||
- fifo_file = bstrcpy(bfromcstr("pads.fifo"));
|
||||
+ fifo_file = bfromcstr("pads.fifo");
|
||||
|
||||
output_fifo_conf.filename = bstrcpy(fifo_file);
|
||||
|
||||
diff -urp pads-1.2.orig/src/output/output-screen.c pads-1.2/src/output/output-screen.c
|
||||
--- pads-1.2.orig/src/output/output-screen.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-screen.c 2008-06-30 16:12:11.000000000 -0400
|
||||
@@ -43,7 +43,7 @@ setup_output_screen (void)
|
||||
|
||||
/* Allocate and setup plugin data record. */
|
||||
plugin = (OutputPlugin*)malloc(sizeof(OutputPlugin));
|
||||
- plugin->name = bstrcpy(bfromcstr("screen"));
|
||||
+ plugin->name = bfromcstr("screen");
|
||||
plugin->init = init_output_screen;
|
||||
plugin->print_asset = print_asset_screen;
|
||||
plugin->print_arp = print_arp_asset_screen;
|
||||
diff -urp pads-1.2.orig/src/packet.c pads-1.2/src/packet.c
|
||||
--- pads-1.2.orig/src/packet.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/packet.c 2008-06-30 16:12:11.000000000 -0400
|
||||
@@ -211,8 +211,13 @@ void process_tcp (const struct pcap_pkth
|
||||
|
||||
/* Check to see if this is a known asset. */
|
||||
if(check_tcp_asset(ip_src, tcph->th_sport)) {
|
||||
+ bstring serv, app;
|
||||
+ serv = bfromcstr("unknown");
|
||||
+ app = bfromcstr("unknown");
|
||||
add_asset(ip_src, tcph->th_sport,
|
||||
- IPPROTO_TCP, bfromcstr("unknown"), bfromcstr("unknown"), 0);
|
||||
+ IPPROTO_TCP, serv, app, 0);
|
||||
+ bdestroy(serv);
|
||||
+ bdestroy(app);
|
||||
} else {
|
||||
/* Record connection for statistical purposes. */
|
||||
print_stat(ip_src, tcph->th_sport, IPPROTO_TCP);
|
||||
@@ -269,8 +274,13 @@ void process_icmp (const struct pcap_pkt
|
||||
|
||||
if (icmp->icmp_type == ICMP_ECHOREPLY) {
|
||||
if(check_icmp_asset(ip_src)) {
|
||||
- add_asset(ip_src, 0, IPPROTO_ICMP, bfromcstr("ICMP"), bfromcstr("ICMP"), 0);
|
||||
+ bstring serv, app;
|
||||
+ serv = bfromcstr("ICMP");
|
||||
+ app = bfromcstr("ICMP");
|
||||
+ add_asset(ip_src, 0, IPPROTO_ICMP, serv, app, 0);
|
||||
print_asset(ip_src, 0, IPPROTO_ICMP);
|
||||
+ bdestroy(serv);
|
||||
+ bdestroy(app);
|
||||
}
|
||||
}
|
||||
|
||||
diff -urp pads-1.2.orig/src/pads.c pads-1.2/src/pads.c
|
||||
--- pads-1.2.orig/src/pads.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/pads.c 2008-06-30 16:23:31.000000000 -0400
|
||||
@@ -165,9 +165,33 @@ print_version (void)
|
||||
* FUNCTION : init_pads
|
||||
* DESCRIPTION : This function will initialize PADS.
|
||||
* ---------------------------------------------------------- */
|
||||
+void init_gc(void)
|
||||
+{
|
||||
+ gc.handle = NULL;
|
||||
+ gc.dev = NULL;
|
||||
+ gc.pcap_filter = NULL;
|
||||
+ gc.conf_file = NULL;
|
||||
+ gc.report_file = NULL;
|
||||
+ gc.fifo_file = NULL;
|
||||
+ gc.pcap_file = NULL;
|
||||
+ gc.dump_file = NULL;
|
||||
+ gc.pid_file = NULL;
|
||||
+ gc.sig_file = NULL;
|
||||
+ gc.mac_file = NULL;
|
||||
+ gc.priv_user = NULL;
|
||||
+ gc.priv_group = NULL;
|
||||
+}
|
||||
+
|
||||
+/* ----------------------------------------------------------
|
||||
+ * FUNCTION : init_pads
|
||||
+ * DESCRIPTION : This function will initialize PADS.
|
||||
+ * ---------------------------------------------------------- */
|
||||
void
|
||||
init_pads (void)
|
||||
{
|
||||
+ /* Init global config to known state */
|
||||
+ init_gc();
|
||||
+
|
||||
/* Process the command line parameters. */
|
||||
process_cmdline(prog_argc, prog_argv);
|
||||
|
||||
@@ -179,15 +203,22 @@ init_pads (void)
|
||||
init_configuration(gc.conf_file);
|
||||
|
||||
} else {
|
||||
- /* Default Output Plugins: These plugins are activated if a configuration
|
||||
- * file is not specified. */
|
||||
+ bstring name, args;
|
||||
+ /* Default Output Plugins: These plugins are activated if a
|
||||
+ * configuration file is not specified. */
|
||||
|
||||
/* output: screen */
|
||||
- if ((activate_output_plugin(bfromcstr("screen"), bfromcstr(""))) == -1)
|
||||
+ name = bfromcstr("screen");
|
||||
+ args = bfromcstr("");
|
||||
+ if ((activate_output_plugin(name, args)) == -1)
|
||||
log_message("warning: 'activate_output_plugin' in function 'init_pads' failed.");
|
||||
+ bdestroy(name);
|
||||
+ bdestroy(args);
|
||||
/* output: csv */
|
||||
- if ((activate_output_plugin(bfromcstr("csv"), gc.report_file)) == -1)
|
||||
+ name = bfromcstr("csv");
|
||||
+ if ((activate_output_plugin(name, gc.report_file)) == -1)
|
||||
log_message("warning: 'activate_output_plugin' in function 'init_pads' failed.");
|
||||
+ bdestroy(name);
|
||||
}
|
||||
|
||||
/* Initialize Modules */
|
||||
diff -urp pads-1.2.orig/src/storage.c pads-1.2/src/storage.c
|
||||
--- pads-1.2.orig/src/storage.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/storage.c 2008-06-30 16:12:11.000000000 -0400
|
||||
@@ -29,8 +29,8 @@
|
||||
#include "storage.h"
|
||||
#include "mac-resolution.h"
|
||||
|
||||
-Asset *asset_list;
|
||||
-ArpAsset *arp_asset_list;
|
||||
+static Asset *asset_list = NULL;
|
||||
+static ArpAsset *arp_asset_list = NULL;
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : check_tcp_asset
|
||||
@@ -343,7 +343,9 @@ short update_asset (struct in_addr ip_ad
|
||||
&& port == list->port
|
||||
&& proto == list->proto) {
|
||||
/* Found! */
|
||||
+ bdestroy(list->service);
|
||||
list->service = bstrcpy(service);
|
||||
+ bdestroy(list->application);
|
||||
list->application = bstrcpy(application);
|
||||
return 0;
|
||||
|
||||
diff -urp pads-1.2.orig/src/util.c pads-1.2/src/util.c
|
||||
--- pads-1.2.orig/src/util.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/util.c 2008-06-30 16:26:24.000000000 -0400
|
||||
@@ -120,7 +120,7 @@ init_pid_file (bstring pid_file, bstring
|
||||
struct passwd *this_user;
|
||||
|
||||
/* Default PID File */
|
||||
- if (gc.pid_file->slen >= 0)
|
||||
+ if (gc.pid_file == NULL || gc.pid_file->slen == 0)
|
||||
gc.pid_file = bfromcstr("/var/run/pads.pid");
|
||||
|
||||
/* Create PID File */
|
||||
47
pads-1.2-misc.patch
Normal file
47
pads-1.2-misc.patch
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
diff -ur pads-1.2.orig/src/configuration.c pads-1.2/src/configuration.c
|
||||
--- pads-1.2.orig/src/configuration.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/configuration.c 2008-07-01 21:11:22.000000000 -0400
|
||||
@@ -191,8 +191,10 @@
|
||||
log_message("warning: 'ptrFunc' in function 'conf_module_processor' failed.");
|
||||
} else {
|
||||
/* Input processor does not contain an argument. */
|
||||
- if (((*ptrFunc)(list->entry[0], bfromcstr(""))) == -1)
|
||||
+ bstring empty = bfromcstr("");
|
||||
+ if (((*ptrFunc)(list->entry[0], empty)) == -1)
|
||||
log_message("warning: 'ptrFunc' in function 'conf_module_processor' failed.");
|
||||
+ bdestroy(empty);
|
||||
}
|
||||
if (list != NULL)
|
||||
bstrListDestroy(list);
|
||||
diff -ur pads-1.2.orig/src/monnet.c pads-1.2/src/monnet.c
|
||||
--- pads-1.2.orig/src/monnet.c 2008-06-30 13:56:52.000000000 -0400
|
||||
+++ pads-1.2/src/monnet.c 2008-07-01 20:37:50.000000000 -0400
|
||||
@@ -32,7 +32,7 @@
|
||||
#include "monnet.h"
|
||||
#include "util.h"
|
||||
|
||||
-struct mon_net *mn;
|
||||
+static struct mon_net *mn = NULL;
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : parse_networks
|
||||
diff -ur pads-1.2.orig/src/pads.c pads-1.2/src/pads.c
|
||||
--- pads-1.2.orig/src/pads.c 2008-06-30 17:54:33.000000000 -0400
|
||||
+++ pads-1.2/src/pads.c 2008-07-01 21:35:45.000000000 -0400
|
||||
@@ -343,11 +343,11 @@
|
||||
|
||||
/* Display PCAP Statistics */
|
||||
if (!pcap_stats(gc.handle, &pstat)) {
|
||||
- log_message("\n");
|
||||
- log_message("%d Packets Received\n", pstat.ps_recv);
|
||||
- log_message("%d Packets Dropped by Software\n", pstat.ps_drop);
|
||||
- log_message("%d Packets Dropped by Interface\n", pstat.ps_ifdrop);
|
||||
- log_message("\n");
|
||||
+ verbose_message("\n");
|
||||
+ verbose_message("%d Packets Received\n", pstat.ps_recv);
|
||||
+ verbose_message("%d Packets Dropped by Software\n", pstat.ps_drop);
|
||||
+ verbose_message("%d Packets Dropped by Interface\n", pstat.ps_ifdrop);
|
||||
+ verbose_message("\n");
|
||||
}
|
||||
|
||||
/* Close banner dump file if specifed (-d). */
|
||||
12
pads-1.2-overrun.patch
Normal file
12
pads-1.2-overrun.patch
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
diff -urp pads-1.2.orig/src/util.c pads-1.2/src/util.c
|
||||
--- pads-1.2.orig/src/util.c 2008-06-30 17:54:33.000000000 -0400
|
||||
+++ pads-1.2/src/util.c 2008-06-30 17:27:44.000000000 -0400
|
||||
@@ -465,7 +465,7 @@ hex2mac(const char *mac)
|
||||
{
|
||||
static char buf[18];
|
||||
|
||||
- sprintf(buf, "%X:%02X:%02X:%02X:%02X:%02X",
|
||||
+ snprintf(buf, sizeof(buf), "%02X:%02X:%02X:%02X:%02X:%02X",
|
||||
mac[0], mac[1], mac[2],
|
||||
mac[3], mac[4], mac[5]);
|
||||
|
||||
472
pads-1.2-perf.patch
Normal file
472
pads-1.2-perf.patch
Normal file
|
|
@ -0,0 +1,472 @@
|
|||
diff -urp pads-1.2.orig/src/identification.c pads-1.2/src/identification.c
|
||||
--- pads-1.2.orig/src/identification.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/identification.c 2008-07-12 10:56:07.000000000 -0400
|
||||
@@ -30,7 +30,10 @@
|
||||
#include "storage.h"
|
||||
#include "output/output.h"
|
||||
|
||||
-Signature *signature_list;
|
||||
+static Signature *signature_list = NULL, **tail = NULL;
|
||||
+
|
||||
+/* Local Functions */
|
||||
+static void add_signature (Signature *sig);
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : init_identification
|
||||
@@ -40,7 +43,7 @@ Signature *signature_list;
|
||||
* RETURN : -1 - Error
|
||||
* : 0 - Normal Return
|
||||
* ---------------------------------------------------------- */
|
||||
-int init_identification()
|
||||
+int init_identification(void)
|
||||
{
|
||||
FILE *fp;
|
||||
bstring filename;
|
||||
@@ -191,25 +194,13 @@ int parse_raw_signature (bstring line, i
|
||||
* RETURN : 0 - Success
|
||||
* : -1 - Error
|
||||
* ---------------------------------------------------------- */
|
||||
-int add_signature (Signature *sig)
|
||||
+static void add_signature (Signature *sig)
|
||||
{
|
||||
- Signature *list;
|
||||
-
|
||||
- if (signature_list == NULL) {
|
||||
+ if (tail == NULL)
|
||||
signature_list = sig;
|
||||
- } else {
|
||||
- list = signature_list;
|
||||
- while (list != NULL) {
|
||||
- if (list->next == NULL) {
|
||||
- list->next = sig;
|
||||
- break;
|
||||
- } else {
|
||||
- list = list->next;
|
||||
- }
|
||||
- }
|
||||
- }
|
||||
-
|
||||
- return 0;
|
||||
+ else
|
||||
+ *tail = sig;
|
||||
+ tail = &sig->next;
|
||||
}
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
@@ -235,12 +226,12 @@ int tcp_identify (struct in_addr ip_addr
|
||||
|
||||
if (i_attempts > 0) {
|
||||
i_attempts--;
|
||||
- update_i_attempts(ip_addr, port, IPPROTO_TCP, i_attempts);
|
||||
+ update_i_attempts(i_attempts);
|
||||
|
||||
if (pcre_identify(ip_addr, port, IPPROTO_TCP, payload, plen) == 1) {
|
||||
/* MATCH! */
|
||||
i_attempts = 0;
|
||||
- update_i_attempts(ip_addr, port, IPPROTO_TCP, 0);
|
||||
+ update_i_attempts(0);
|
||||
}
|
||||
|
||||
/* Print asset if this is the last time to identify it. */
|
||||
diff -urp pads-1.2.orig/src/identification.h pads-1.2/src/identification.h
|
||||
--- pads-1.2.orig/src/identification.h 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/identification.h 2008-07-12 10:56:07.000000000 -0400
|
||||
@@ -39,7 +39,6 @@
|
||||
/* PROTOTYPES -------------------------------------- */
|
||||
int init_identification(void);
|
||||
int parse_raw_signature (bstring line, int lineno);
|
||||
-int add_signature (Signature *sig);
|
||||
int tcp_identify (struct in_addr ip_addr, u_int16_t port, char *payload, int plen);
|
||||
int pcre_identify (struct in_addr ip_addr, u_int16_t port, unsigned short proto, const char *payload, int plen);
|
||||
bstring get_app_name (Signature *sig, const char *payload, int *ovector, int rc);
|
||||
diff -urp pads-1.2.orig/src/mac-resolution.c pads-1.2/src/mac-resolution.c
|
||||
--- pads-1.2.orig/src/mac-resolution.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/mac-resolution.c 2008-07-12 10:56:07.000000000 -0400
|
||||
@@ -34,9 +34,14 @@
|
||||
#include "mac-resolution.h"
|
||||
#include "util.h"
|
||||
|
||||
-Vendor *vendor_list = NULL;
|
||||
+static Vendor *vendor_list = NULL;
|
||||
+static Vendor **vtail = NULL;
|
||||
|
||||
-/* ----------------------------------------------------------
|
||||
+/* Local function prototype */
|
||||
+static int parse_raw_mac (bstring line);
|
||||
+static int add_vendor (const char *mac, const char *vendor);
|
||||
+
|
||||
+ /* ----------------------------------------------------------
|
||||
* FUNCTION : init_mac_resolution
|
||||
* DESCRIPTION : This file reads in the MAC address table.
|
||||
* INPUT : None
|
||||
@@ -94,7 +99,7 @@ int init_mac_resolution (void) {
|
||||
* RETURN : 0 - Success
|
||||
* : -1 - Error
|
||||
* ---------------------------------------------------------- */
|
||||
-int parse_raw_mac (bstring line)
|
||||
+static int parse_raw_mac (bstring line)
|
||||
{
|
||||
char mac[4];
|
||||
char vendor[80];
|
||||
@@ -125,8 +130,8 @@ int parse_raw_mac (bstring line)
|
||||
* INPUT : 0 - MAC Address (bstring)
|
||||
* : 1 - Vendor (bstring)
|
||||
* ---------------------------------------------------------- */
|
||||
-int add_vendor (char *mac, char *vendor){
|
||||
- Vendor *list;
|
||||
+static int add_vendor (const char *mac, const char *vendor)
|
||||
+{
|
||||
Vendor *rec;
|
||||
|
||||
/* Assign data to temporary data structure. */
|
||||
@@ -136,19 +141,11 @@ int add_vendor (char *mac, char *vendor)
|
||||
rec->next = NULL;
|
||||
|
||||
/* Place data structure in MAC address list. */
|
||||
- if(vendor_list == NULL) {
|
||||
+ if(vtail == NULL)
|
||||
vendor_list = rec;
|
||||
- } else {
|
||||
- list = vendor_list;
|
||||
- while (list != NULL) {
|
||||
- if (list->next == NULL) {
|
||||
- list->next = rec;
|
||||
- break;
|
||||
- } else {
|
||||
- list = list->next;
|
||||
- }
|
||||
- }
|
||||
- }
|
||||
+ else
|
||||
+ *vtail = rec;
|
||||
+ vtail = &rec->next;
|
||||
|
||||
return 0;
|
||||
}
|
||||
diff -urp pads-1.2.orig/src/mac-resolution.h pads-1.2/src/mac-resolution.h
|
||||
--- pads-1.2.orig/src/mac-resolution.h 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/mac-resolution.h 2008-07-12 10:56:07.000000000 -0400
|
||||
@@ -39,8 +39,6 @@
|
||||
|
||||
/* PROTOTYPES -------------------------------------- */
|
||||
int init_mac_resolution (void);
|
||||
-int parse_raw_mac (bstring line);
|
||||
-int add_vendor (char *mac, char *vendor);
|
||||
bstring get_vendor (const char *m);
|
||||
void end_mac_resolution (void);
|
||||
|
||||
diff -urp pads-1.2.orig/src/monnet.c pads-1.2/src/monnet.c
|
||||
--- pads-1.2.orig/src/monnet.c 2008-07-12 08:36:10.000000000 -0400
|
||||
+++ pads-1.2/src/monnet.c 2008-07-12 10:56:07.000000000 -0400
|
||||
@@ -87,49 +87,41 @@ void parse_networks (char *cmdline)
|
||||
}
|
||||
}
|
||||
|
||||
-/* ----------------------------------------------------------
|
||||
- * FUNCTION : init_netmasks
|
||||
- * DESCRIPTION : This function will load netmasks into an
|
||||
- * : array.
|
||||
- * INPUT : 0 - Array
|
||||
- * RETURN : None!
|
||||
- * ---------------------------------------------------------- */
|
||||
-void init_netmasks (unsigned int nm[33])
|
||||
-{
|
||||
- nm[0] = 0x0;
|
||||
- nm[1] = 0x80000000;
|
||||
- nm[2] = 0xC0000000;
|
||||
- nm[3] = 0xE0000000;
|
||||
- nm[4] = 0xF0000000;
|
||||
- nm[5] = 0xF8000000;
|
||||
- nm[6] = 0xFC000000;
|
||||
- nm[7] = 0xFE000000;
|
||||
- nm[8] = 0xFF000000;
|
||||
- nm[9] = 0xFF800000;
|
||||
- nm[10] = 0xFFC00000;
|
||||
- nm[11] = 0xFFE00000;
|
||||
- nm[12] = 0xFFF00000;
|
||||
- nm[13] = 0xFFF80000;
|
||||
- nm[14] = 0xFFFC0000;
|
||||
- nm[15] = 0xFFFE0000;
|
||||
- nm[16] = 0xFFFF0000;
|
||||
- nm[17] = 0xFFFF8000;
|
||||
- nm[18] = 0xFFFFC000;
|
||||
- nm[19] = 0xFFFFE000;
|
||||
- nm[20] = 0xFFFFF000;
|
||||
- nm[21] = 0xFFFFF800;
|
||||
- nm[22] = 0xFFFFFC00;
|
||||
- nm[23] = 0xFFFFFE00;
|
||||
- nm[24] = 0xFFFFFF00;
|
||||
- nm[25] = 0xFFFFFF80;
|
||||
- nm[26] = 0xFFFFFFC0;
|
||||
- nm[27] = 0xFFFFFFE0;
|
||||
- nm[28] = 0xFFFFFFF0;
|
||||
- nm[29] = 0xFFFFFFF8;
|
||||
- nm[30] = 0xFFFFFFFC;
|
||||
- nm[31] = 0xFFFFFFFE;
|
||||
- nm[32] = 0xFFFFFFFF;
|
||||
-}
|
||||
+static unsigned int netmasks[33] = {
|
||||
+ 0x0,
|
||||
+ 0x80000000,
|
||||
+ 0xC0000000,
|
||||
+ 0xE0000000,
|
||||
+ 0xF0000000,
|
||||
+ 0xF8000000,
|
||||
+ 0xFC000000,
|
||||
+ 0xFE000000,
|
||||
+ 0xFF000000,
|
||||
+ 0xFF800000,
|
||||
+ 0xFFC00000,
|
||||
+ 0xFFE00000,
|
||||
+ 0xFFF00000,
|
||||
+ 0xFFF80000,
|
||||
+ 0xFFFC0000,
|
||||
+ 0xFFFE0000,
|
||||
+ 0xFFFF0000,
|
||||
+ 0xFFFF8000,
|
||||
+ 0xFFFFC000,
|
||||
+ 0xFFFFE000,
|
||||
+ 0xFFFFF000,
|
||||
+ 0xFFFFF800,
|
||||
+ 0xFFFFFC00,
|
||||
+ 0xFFFFFE00,
|
||||
+ 0xFFFFFF00,
|
||||
+ 0xFFFFFF80,
|
||||
+ 0xFFFFFFC0,
|
||||
+ 0xFFFFFFE0,
|
||||
+ 0xFFFFFFF0,
|
||||
+ 0xFFFFFFF8,
|
||||
+ 0xFFFFFFFC,
|
||||
+ 0xFFFFFFFE,
|
||||
+ 0xFFFFFFFF,
|
||||
+};
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : add_monnet
|
||||
@@ -143,12 +135,8 @@ void add_monnet(char *network, char *net
|
||||
{
|
||||
struct mon_net *rec, *data;
|
||||
struct in_addr net_addr;
|
||||
- unsigned int netmasks[33];
|
||||
int nmask;
|
||||
|
||||
- /* Fill netmasks variable. See init_netmasks in util.c. */
|
||||
- init_netmasks(netmasks);
|
||||
-
|
||||
nmask = atoi(netmask);
|
||||
|
||||
/* Ensure that the netmask is correct. */
|
||||
diff -urp pads-1.2.orig/src/monnet.h pads-1.2/src/monnet.h
|
||||
--- pads-1.2.orig/src/monnet.h 2008-07-12 08:36:10.000000000 -0400
|
||||
+++ pads-1.2/src/monnet.h 2008-07-12 10:56:07.000000000 -0400
|
||||
@@ -41,7 +41,6 @@ struct mon_net {
|
||||
|
||||
/* PROTOTYPES -------------------------------------- */
|
||||
void parse_networks (char *cmdline);
|
||||
-void init_netmasks (unsigned int nm[33]);
|
||||
void add_monnet(char *network, char *netmask);
|
||||
short check_monnet (const struct in_addr ip_addr);
|
||||
void end_monnet (void);
|
||||
diff -urp pads-1.2.orig/src/output/output-csv.c pads-1.2/src/output/output-csv.c
|
||||
--- pads-1.2.orig/src/output/output-csv.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-csv.c 2008-07-12 10:59:31.000000000 -0400
|
||||
@@ -231,10 +231,6 @@ parse_raw_report (bstring line)
|
||||
// Clean Up
|
||||
if (list != NULL)
|
||||
bstrListDestroy(list);
|
||||
- if (service != NULL)
|
||||
- bdestroy(service);
|
||||
- if (application != NULL)
|
||||
- bdestroy(application);
|
||||
|
||||
return ret;
|
||||
}
|
||||
diff -urp pads-1.2.orig/src/packet.c pads-1.2/src/packet.c
|
||||
--- pads-1.2.orig/src/packet.c 2008-07-12 08:36:10.000000000 -0400
|
||||
+++ pads-1.2/src/packet.c 2008-07-12 10:56:07.000000000 -0400
|
||||
@@ -232,8 +232,6 @@ void process_tcp (const struct pcap_pkth
|
||||
app = bfromcstr("unknown");
|
||||
add_asset(ip_src, tcph->th_sport,
|
||||
IPPROTO_TCP, serv, app, 0);
|
||||
- bdestroy(serv);
|
||||
- bdestroy(app);
|
||||
} else {
|
||||
/* Record connection for statistical purposes. */
|
||||
print_stat(ip_src, tcph->th_sport, IPPROTO_TCP);
|
||||
@@ -295,8 +293,6 @@ void process_icmp (const struct pcap_pkt
|
||||
app = bfromcstr("ICMP");
|
||||
add_asset(ip_src, 0, IPPROTO_ICMP, serv, app, 0);
|
||||
print_asset(ip_src, 0, IPPROTO_ICMP);
|
||||
- bdestroy(serv);
|
||||
- bdestroy(app);
|
||||
}
|
||||
}
|
||||
|
||||
diff -urp pads-1.2.orig/src/storage.c pads-1.2/src/storage.c
|
||||
--- pads-1.2.orig/src/storage.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/storage.c 2008-07-12 10:56:07.000000000 -0400
|
||||
@@ -29,8 +29,8 @@
|
||||
#include "storage.h"
|
||||
#include "mac-resolution.h"
|
||||
|
||||
-static Asset *asset_list = NULL;
|
||||
-static ArpAsset *arp_asset_list = NULL;
|
||||
+static Asset *asset_list = NULL, *current = NULL, **tail = NULL;
|
||||
+static ArpAsset *arp_asset_list = NULL, **arp_tail = NULL;
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : check_tcp_asset
|
||||
@@ -127,8 +127,8 @@ int check_arp_asset (struct in_addr ip_a
|
||||
* INPUT : 0 - IP Address
|
||||
* : 1 - Port
|
||||
* : 2 - Protocol
|
||||
- * : 3 - Service
|
||||
- * : 4 - Application
|
||||
+ * : 3 - Service - takes custody of this memory
|
||||
+ * : 4 - Application - takes custody of this memory
|
||||
* : 5 - Discovered
|
||||
* RETURN : None!
|
||||
* ---------------------------------------------------------- */
|
||||
@@ -140,15 +140,14 @@ void add_asset (struct in_addr ip_addr,
|
||||
time_t discovered)
|
||||
{
|
||||
Asset *rec;
|
||||
- Asset *list;
|
||||
|
||||
/* Assign list to temp structure. */
|
||||
rec = (Asset*)malloc(sizeof(Asset));
|
||||
rec->ip_addr.s_addr = ip_addr.s_addr;
|
||||
rec->port = port;
|
||||
rec->proto = proto;
|
||||
- rec->service = bstrcpy(service);
|
||||
- rec->application = bstrcpy(application);
|
||||
+ rec->service = service;
|
||||
+ rec->application = application;
|
||||
rec->next = NULL;
|
||||
|
||||
/*
|
||||
@@ -174,19 +173,11 @@ void add_asset (struct in_addr ip_addr,
|
||||
}
|
||||
|
||||
/* Find this record's location within linked list. */
|
||||
- if (asset_list == NULL) {
|
||||
+ if (tail == NULL)
|
||||
asset_list = rec;
|
||||
- } else {
|
||||
- list = asset_list;
|
||||
- while (list != NULL) {
|
||||
- if (list->next == NULL) {
|
||||
- list->next = rec;
|
||||
- break;
|
||||
- } else {
|
||||
- list = list->next;
|
||||
- }
|
||||
- }
|
||||
- }
|
||||
+ else
|
||||
+ *tail = rec;
|
||||
+ tail = &rec->next;
|
||||
|
||||
return;
|
||||
}
|
||||
@@ -203,7 +194,6 @@ void add_asset (struct in_addr ip_addr,
|
||||
void add_arp_asset (struct in_addr ip_addr, const char *mac_addr,
|
||||
time_t discovered)
|
||||
{
|
||||
- ArpAsset *list;
|
||||
ArpAsset *rec;
|
||||
bstring mac_resolved;
|
||||
|
||||
@@ -233,20 +223,11 @@ void add_arp_asset (struct in_addr ip_ad
|
||||
}
|
||||
|
||||
/* Find this record's location within linked list. */
|
||||
- if (arp_asset_list == NULL) {
|
||||
+ if (arp_tail == NULL)
|
||||
arp_asset_list = rec;
|
||||
- } else {
|
||||
- list = arp_asset_list;
|
||||
-
|
||||
- while (list != NULL) {
|
||||
- if (list->next == NULL) {
|
||||
- list->next = rec;
|
||||
- break;
|
||||
- } else {
|
||||
- list = list->next;
|
||||
- }
|
||||
- }
|
||||
- }
|
||||
+ else
|
||||
+ *arp_tail = arp_asset_list;
|
||||
+ arp_tail = &arp_asset_list->next;
|
||||
}
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
@@ -270,6 +251,7 @@ unsigned short get_i_attempts (struct in
|
||||
&& port == rec->port
|
||||
&& proto == rec->proto) {
|
||||
/* Found! */
|
||||
+ current = rec;
|
||||
return rec->i_attempts;
|
||||
|
||||
} else {
|
||||
@@ -277,13 +259,14 @@ unsigned short get_i_attempts (struct in
|
||||
}
|
||||
}
|
||||
|
||||
+ current = NULL;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* ----------------------------------------------------------
|
||||
* FUNCTION : update_i_attempts
|
||||
- * DESCRIPTION : Updates the i_attempts field for a
|
||||
- * : specified asset.
|
||||
+ * DESCRIPTION : Updates the i_attempts field of the current
|
||||
+ * : asset from previous call to get_i_attempts.
|
||||
* INPUT : 0 - IP Address
|
||||
* : 1 - Port
|
||||
* : 2 - Proto
|
||||
@@ -291,26 +274,11 @@ unsigned short get_i_attempts (struct in
|
||||
* RETURN : 0 - Success
|
||||
* : 1 - Failure
|
||||
* ---------------------------------------------------------- */
|
||||
-short update_i_attempts (struct in_addr ip_addr,
|
||||
- u_int16_t port,
|
||||
- unsigned short proto,
|
||||
- unsigned short i_attempts)
|
||||
+short update_i_attempts (unsigned short i_attempts)
|
||||
{
|
||||
- Asset *rec;
|
||||
-
|
||||
- /* Find asset within linked list. */
|
||||
- rec = asset_list;
|
||||
- while (rec != NULL) {
|
||||
- if (ip_addr.s_addr == rec->ip_addr.s_addr
|
||||
- && port == rec->port
|
||||
- && proto == rec->proto) {
|
||||
- /* Found! */
|
||||
- rec->i_attempts = i_attempts;
|
||||
- return 0;
|
||||
-
|
||||
- } else {
|
||||
- rec = rec->next;
|
||||
- }
|
||||
+ if (current) {
|
||||
+ current->i_attempts = i_attempts;
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
return 1;
|
||||
diff -urp pads-1.2.orig/src/storage.h pads-1.2/src/storage.h
|
||||
--- pads-1.2.orig/src/storage.h 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/storage.h 2008-07-12 10:56:07.000000000 -0400
|
||||
@@ -54,7 +54,7 @@ int check_arp_asset (struct in_addr ip_a
|
||||
void add_asset (struct in_addr ip_addr, u_int16_t port, unsigned short proto, bstring service, bstring application, time_t discovered);
|
||||
void add_arp_asset (struct in_addr ip_addr, const char *mac_addr, time_t discovered);
|
||||
unsigned short get_i_attempts (struct in_addr ip_addr, u_int16_t port, unsigned short proto);
|
||||
-short update_i_attempts (struct in_addr ip_addr, u_int16_t port, unsigned short proto, unsigned short i_attempts);
|
||||
+short update_i_attempts (unsigned short i_attempts);
|
||||
short update_asset (struct in_addr ip_addr, u_int16_t port, unsigned short proto, bstring service, bstring application);
|
||||
inline Asset *find_asset (struct in_addr ip_addr, u_int16_t port, unsigned short proto);
|
||||
Asset *get_asset_pointer (void);
|
||||
109
pads-1.2-prelude-cleanup.patch
Normal file
109
pads-1.2-prelude-cleanup.patch
Normal file
|
|
@ -0,0 +1,109 @@
|
|||
diff -urp pads-1.2.orig/src/output/output.c pads-1.2/src/output/output.c
|
||||
--- pads-1.2.orig/src/output/output.c 2008-07-08 10:53:14.000000000 -0400
|
||||
+++ pads-1.2/src/output/output.c 2008-07-08 10:41:13.000000000 -0400
|
||||
@@ -129,7 +129,8 @@ int activate_output_plugin (bstring name
|
||||
/* MATCH! Set record to active and run 'init' function. */
|
||||
list->active = 1;
|
||||
if (plugin != NULL && plugin->init != NULL)
|
||||
- (*plugin->init)(args);
|
||||
+ if ((*plugin->init)(args) < 0)
|
||||
+ return -1;
|
||||
break;
|
||||
}
|
||||
|
||||
diff -urp pads-1.2.orig/src/output/output-csv.c pads-1.2/src/output/output-csv.c
|
||||
--- pads-1.2.orig/src/output/output-csv.c 2008-07-07 13:56:10.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-csv.c 2008-07-08 10:44:48.000000000 -0400
|
||||
@@ -58,6 +58,7 @@ setup_output_csv (void)
|
||||
if (plugin != NULL)
|
||||
free(plugin);
|
||||
log_message("warning: 'register_output_plugin' in function 'setup_output_csv' failed.");
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
diff -urp pads-1.2.orig/src/output/output-fifo.c pads-1.2/src/output/output-fifo.c
|
||||
--- pads-1.2.orig/src/output/output-fifo.c 2008-06-30 17:54:33.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-fifo.c 2008-07-08 10:46:32.000000000 -0400
|
||||
@@ -83,6 +83,7 @@ setup_output_fifo (void)
|
||||
if (plugin != NULL)
|
||||
free(plugin);
|
||||
log_message("warning: 'register_output_plugin' in function 'setup_output_fifo' failed.");
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
@@ -109,8 +110,10 @@ init_output_fifo (bstring fifo_file)
|
||||
mkfifo ((char *)bdata(fifo_file), 0755);
|
||||
|
||||
verbose_message("Open FIFO File\n");
|
||||
- if ((output_fifo_conf.file = fopen((char*)bdata(fifo_file), "w+")) == NULL)
|
||||
+ if ((output_fifo_conf.file = fopen((char*)bdata(fifo_file), "w+")) == NULL){
|
||||
err_message("Unable to open FIFO file (%s)!\n", bdata(fifo_file));
|
||||
+ return -1;
|
||||
+ }
|
||||
|
||||
return 0;
|
||||
}
|
||||
diff -urp pads-1.2.orig/src/output/output-prelude.c pads-1.2/src/output/output-prelude.c
|
||||
--- pads-1.2.orig/src/output/output-prelude.c 2008-07-08 10:53:14.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-prelude.c 2008-07-08 10:44:25.000000000 -0400
|
||||
@@ -407,9 +407,6 @@ setup_output_prelude (void)
|
||||
OutputPlugin *plugin;
|
||||
|
||||
|
||||
- if (init_prelude() < 0)
|
||||
- return -1;
|
||||
-
|
||||
/* Allocate and setup plugin data record. */
|
||||
plugin = (OutputPlugin*)malloc(sizeof(OutputPlugin));
|
||||
plugin->name = bfromcstr("prelude");
|
||||
@@ -424,6 +421,7 @@ setup_output_prelude (void)
|
||||
if (plugin != NULL)
|
||||
free(plugin);
|
||||
log_message("warning: 'register_output_plugin' in function 'setup_output_prelude' failed.");
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
@@ -442,6 +440,10 @@ init_output_prelude (bstring args)
|
||||
{
|
||||
verbose_message("Initializing PRELUDE output processor.");
|
||||
profile = strdup((char *)bdata(args));
|
||||
+
|
||||
+ if (init_prelude() < 0)
|
||||
+ return -1;
|
||||
+
|
||||
return 0;
|
||||
}
|
||||
|
||||
diff -urp pads-1.2.orig/src/output/output-screen.c pads-1.2/src/output/output-screen.c
|
||||
--- pads-1.2.orig/src/output/output-screen.c 2008-06-30 17:54:33.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-screen.c 2008-07-08 10:45:03.000000000 -0400
|
||||
@@ -55,6 +55,7 @@ setup_output_screen (void)
|
||||
if (plugin != NULL)
|
||||
free(plugin);
|
||||
log_message("warning: 'register_output_plugin' in function 'setup_output_screen' failed.");
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
diff -urp pads-1.2.orig/src/pads.c pads-1.2/src/pads.c
|
||||
--- pads-1.2.orig/src/pads.c 2008-07-08 10:53:14.000000000 -0400
|
||||
+++ pads-1.2/src/pads.c 2008-07-08 10:42:58.000000000 -0400
|
||||
@@ -228,13 +228,13 @@ init_pads (void)
|
||||
name = bfromcstr("screen");
|
||||
args = bfromcstr("");
|
||||
if ((activate_output_plugin(name, args)) == -1)
|
||||
- log_message("warning: 'activate_output_plugin' in function 'init_pads' failed.");
|
||||
+ err_message("Error: 'activate_output_plugin' in function 'init_pads' failed.");
|
||||
bdestroy(name);
|
||||
bdestroy(args);
|
||||
/* output: csv */
|
||||
name = bfromcstr("csv");
|
||||
if ((activate_output_plugin(name, gc.report_file)) == -1)
|
||||
- log_message("warning: 'activate_output_plugin' in function 'init_pads' failed.");
|
||||
+ err_message("Error: 'activate_output_plugin' in function 'init_pads' failed.");
|
||||
bdestroy(name);
|
||||
}
|
||||
|
||||
1024
pads-1.2-prelude.patch
Normal file
1024
pads-1.2-prelude.patch
Normal file
File diff suppressed because it is too large
Load diff
40
pads-1.2-pthreads.patch
Normal file
40
pads-1.2-pthreads.patch
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
diff -ur pads-1.2.orig/lib/bstring/Makefile.am pads-1.2/lib/bstring/Makefile.am
|
||||
--- pads-1.2.orig/lib/bstring/Makefile.am 2008-10-26 09:54:10.000000000 -0400
|
||||
+++ pads-1.2/lib/bstring/Makefile.am 2008-10-28 09:40:50.000000000 -0400
|
||||
@@ -1,5 +1,6 @@
|
||||
# $Id: Makefile.am,v 1.1 2005/02/13 17:54:58 mattshelton Exp $
|
||||
AUTOMAKE_OPTIONS=foreign no-dependencies
|
||||
noinst_LIBRARIES = libbstring.a
|
||||
+libbstring_a_CFLAGS = -pthread
|
||||
libbstring_a_SOURCES = bstrlib.c bstrlib.h bstraux.c bstraux.h util.c util.h
|
||||
INCLUDES = -I$(top_srcdir) -I$(top_srcdir)/src
|
||||
diff -ur pads-1.2.orig/src/Makefile.am pads-1.2/src/Makefile.am
|
||||
--- pads-1.2.orig/src/Makefile.am 2008-10-26 09:54:10.000000000 -0400
|
||||
+++ pads-1.2/src/Makefile.am 2008-10-28 09:41:43.000000000 -0400
|
||||
@@ -1,6 +1,7 @@
|
||||
## $Id: Makefile.am,v 1.3 2005/02/17 16:29:54 mattshelton Exp $
|
||||
AUTOMAKE_OPTIONS=foreign no-dependencies
|
||||
bin_PROGRAMS = pads
|
||||
+pads_CFLAGS = -pthread
|
||||
pads_SOURCES = pads.c pads.h \
|
||||
storage.c storage.h \
|
||||
identification.c identification.h \
|
||||
@@ -10,6 +11,7 @@
|
||||
configuration.c configuration.h \
|
||||
util.c util.h \
|
||||
global.h
|
||||
+pads_LDFLAGS = -pthread
|
||||
pads_LDADD = $(top_srcdir)/lib/bstring/libbstring.a output/liboutput.a
|
||||
bin_SCRIPTS = pads-report
|
||||
|
||||
diff -ur pads-1.2.orig/src/output/Makefile.am pads-1.2/src/output/Makefile.am
|
||||
--- pads-1.2.orig/src/output/Makefile.am 2008-10-26 09:54:10.000000000 -0400
|
||||
+++ pads-1.2/src/output/Makefile.am 2008-10-28 09:40:50.000000000 -0400
|
||||
@@ -1,6 +1,7 @@
|
||||
# $Id: Makefile.am,v 1.1 2005/02/10 06:05:06 mattshelton Exp $
|
||||
AUTOMAKE_OPTIONS=foreign no-dependencies
|
||||
noinst_LIBRARIES = liboutput.a
|
||||
+liboutput_a_CFLAGS = -pthread
|
||||
liboutput_a_SOURCES = output.c output.h \
|
||||
output-screen.c output-screen.h \
|
||||
output-csv.c output-csv.h \
|
||||
153
pads-1.2-readonly.patch
Normal file
153
pads-1.2-readonly.patch
Normal file
|
|
@ -0,0 +1,153 @@
|
|||
diff -urp pads-1.2.orig/doc/pads.conf.8 pads-1.2/doc/pads.conf.8
|
||||
--- pads-1.2.orig/doc/pads.conf.8 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/doc/pads.conf.8 2008-07-08 17:36:41.000000000 -0400
|
||||
@@ -69,9 +69,12 @@ assets found in these networks will be r
|
||||
This output plugin displays PADS data to the screen. When using the
|
||||
configuration file, it defaults to off.
|
||||
|
||||
-.IP "output csv: <filename>"
|
||||
+.IP "output csv: <filename> [readonly]"
|
||||
This output plugin writes PADS data to a CSV file. Optionally, a CSV filename
|
||||
-can be specified as an argument.
|
||||
+can be specified as an argument. If you want the file used only to populate
|
||||
+the internal known assets list but never be updated, then use the readonly
|
||||
+option. This would be handy when you have a baseline and want to use it for
|
||||
+intrusion detection.
|
||||
|
||||
.IP "output fifo: <filename>"
|
||||
This output plugin writes PADS data to a FIFO file. Optionally, a FIFO
|
||||
diff -urp pads-1.2.orig/etc/pads.conf pads-1.2/etc/pads.conf
|
||||
--- pads-1.2.orig/etc/pads.conf 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/etc/pads.conf 2008-07-08 17:36:51.000000000 -0400
|
||||
@@ -67,7 +67,9 @@ pid_file /var/run/pads.pid
|
||||
# output: csv
|
||||
# -------------------------
|
||||
# This output plugin writes PADS data to a CSV file. Optionally, a CSV filename
|
||||
-# can be specified as an argument.
|
||||
+# can be specified as an argument. If you want the file used only to populate
|
||||
+# the internal known assets list but never be updated, then add the readonly
|
||||
+# option.
|
||||
output csv: /etc/pads-assets.csv
|
||||
|
||||
# output: fifo
|
||||
@@ -81,5 +83,4 @@ output csv: /etc/pads-assets.csv
|
||||
# This output plugin writes PADS data as IDMEF alerts via prelude. Optionally
|
||||
# you can add a profile name if you want something different than the default
|
||||
# of pads.
|
||||
-#
|
||||
#output prelude: pads
|
||||
diff -urp pads-1.2.orig/src/output/output-csv.c pads-1.2/src/output/output-csv.c
|
||||
--- pads-1.2.orig/src/output/output-csv.c 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-csv.c 2008-07-08 17:36:41.000000000 -0400
|
||||
@@ -60,6 +60,9 @@ setup_output_csv (void)
|
||||
log_message("warning: 'register_output_plugin' in function 'setup_output_csv' failed.");
|
||||
return -1;
|
||||
}
|
||||
+ output_csv_conf.filename = NULL;
|
||||
+ output_csv_conf.file = NULL;
|
||||
+ output_csv_conf.readonly = 0;
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -81,22 +84,39 @@ init_output_csv (bstring filename)
|
||||
verbose_message("Initializing CSV output plugin.");
|
||||
|
||||
/* Make sure filename isn't NULL. */
|
||||
- if (filename != NULL)
|
||||
- output_csv_conf.filename = bstrcpy(filename);
|
||||
- else
|
||||
+ if (filename != NULL) {
|
||||
+ /* Parse the args looking for readonly and file name */
|
||||
+ int i;
|
||||
+ struct bstrList *list = bsplit(filename, ' ');
|
||||
+ if (list->qty > 2) {
|
||||
+ err_message("Too many args for output csv");
|
||||
+ return -1;
|
||||
+ }
|
||||
+ for (i=0; i< list->qty; i++) {
|
||||
+ if (biseqcstr(list->entry[i], "readonly") == 1) {
|
||||
+ output_csv_conf.readonly = 1;
|
||||
+ verbose_message("Using csv file in read only mode.");
|
||||
+ } else if (output_csv_conf.filename == NULL)
|
||||
+ output_csv_conf.filename = bstrcpy(filename);
|
||||
+ else
|
||||
+ err_message("Unrecognized output csv option");
|
||||
+ }
|
||||
+ bstrListDestroy(list);
|
||||
+ } else
|
||||
output_csv_conf.filename = bfromcstr("assets.csv");
|
||||
|
||||
/* Check to see if *filename exists. */
|
||||
if ((fp = fopen((char *)bdata(output_csv_conf.filename), "r")) == NULL) {
|
||||
|
||||
- /* File does not exist, create new.. */
|
||||
- if ((output_csv_conf.file = fopen((char *)bdata(output_csv_conf.filename), "w")) != NULL) {
|
||||
- fprintf(output_csv_conf.file, "asset,port,proto,service,application,discovered\n");
|
||||
- fflush(output_csv_conf.file);
|
||||
-
|
||||
- } else {
|
||||
- err_message("Cannot open file %s!", bdata(output_csv_conf.filename));
|
||||
- return -1;
|
||||
+ if (output_csv_conf.readonly == 0) {
|
||||
+ /* File does not exist, create new.. */
|
||||
+ if ((output_csv_conf.file = fopen((char *)bdata(output_csv_conf.filename), "w")) != NULL) {
|
||||
+ fprintf(output_csv_conf.file, "asset,port,proto,service,application,discovered\n");
|
||||
+ fflush(output_csv_conf.file);
|
||||
+ } else {
|
||||
+ err_message("Cannot open file %s!", bdata(output_csv_conf.filename));
|
||||
+ return -1;
|
||||
+ }
|
||||
}
|
||||
|
||||
} else {
|
||||
@@ -105,11 +125,14 @@ init_output_csv (bstring filename)
|
||||
fclose(fp);
|
||||
read_report_file();
|
||||
|
||||
- /* Open file and assign it to the global FILE pointer. */
|
||||
- if ((output_csv_conf.file = fopen((char *)bdata(output_csv_conf.filename), "a")) == NULL) {
|
||||
- err_message("Cannot open file %s!", bdata(output_csv_conf.filename));
|
||||
- return -1;
|
||||
- }
|
||||
+ if (output_csv_conf.readonly == 0) {
|
||||
+ /* Open file and assign it to the global FILE pointer. */
|
||||
+ if ((output_csv_conf.file = fopen((char *)bdata(output_csv_conf.filename), "a")) == NULL) {
|
||||
+ err_message("Cannot open file %s!",
|
||||
+ bdata(output_csv_conf.filename));
|
||||
+ return -1;
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
|
||||
return 0;
|
||||
@@ -255,6 +278,9 @@ parse_raw_report (bstring line)
|
||||
int
|
||||
print_asset_csv (Asset *rec)
|
||||
{
|
||||
+ if (output_csv_conf.readonly)
|
||||
+ return 0;
|
||||
+
|
||||
if (output_csv_conf.file != NULL) {
|
||||
if (gc.hide_unknowns == 0 || ((biseqcstr(rec->service, "unknown") != 0) &&
|
||||
(biseqcstr(rec->application, "unknown") != 0))) {
|
||||
@@ -285,6 +311,9 @@ print_asset_csv (Asset *rec)
|
||||
int
|
||||
print_arp_asset_csv (ArpAsset *rec)
|
||||
{
|
||||
+ if (output_csv_conf.readonly)
|
||||
+ return 0;
|
||||
+
|
||||
/* Print to File */
|
||||
if (output_csv_conf.file != NULL) {
|
||||
if (rec->mac_resolved != NULL) {
|
||||
diff -urp pads-1.2.orig/src/output/output-csv.h pads-1.2/src/output/output-csv.h
|
||||
--- pads-1.2.orig/src/output/output-csv.h 2008-07-08 14:28:29.000000000 -0400
|
||||
+++ pads-1.2/src/output/output-csv.h 2008-07-08 17:36:41.000000000 -0400
|
||||
@@ -50,6 +50,7 @@ typedef struct _OutputCSVConf
|
||||
{
|
||||
FILE *file;
|
||||
bstring filename;
|
||||
+ int readonly;
|
||||
} OutputCSVConf;
|
||||
|
||||
|
||||
2549
pads-aarch64.patch
Normal file
2549
pads-aarch64.patch
Normal file
File diff suppressed because it is too large
Load diff
90
pads.init
Normal file
90
pads.init
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
#!/bin/sh
|
||||
# Startup script for pads
|
||||
#
|
||||
# chkconfig: - 40 60
|
||||
# description: Run pads
|
||||
# config /etc/pads/pads.conf
|
||||
|
||||
PATH=/sbin:/bin:/usr/bin:/usr/sbin
|
||||
prog="pads"
|
||||
|
||||
# Source function library.
|
||||
. /etc/rc.d/init.d/functions
|
||||
|
||||
# Allow anyone to run status
|
||||
if [ "$1" = "status" ] ; then
|
||||
status $prog
|
||||
RETVAL=$?
|
||||
exit $RETVAL
|
||||
fi
|
||||
|
||||
# Check that we are root ... so non-root users stop here
|
||||
test $EUID = 0 || exit 4
|
||||
|
||||
# Check config
|
||||
test -f /etc/sysconfig/pads && . /etc/sysconfig/pads
|
||||
|
||||
RETVAL=0
|
||||
|
||||
start() {
|
||||
test -x /usr/bin/$prog || exit 5
|
||||
test -f $CONFIG_FILE || exit 6
|
||||
|
||||
if test "x`pidof $prog`" != x; then
|
||||
echo "$prog already started"
|
||||
action $"Starting $prog: " /bin/false
|
||||
RETVAL=1
|
||||
return $RETVAL
|
||||
else
|
||||
echo -n $"Starting $prog: "
|
||||
unset HOME MAIL USER USERNAME
|
||||
daemon $prog -D -c $CONFIG_FILE $EXTRA_OPTIONS
|
||||
RETVAL=$?
|
||||
if test $RETVAL = 0 ; then
|
||||
touch /var/lock/subsys/$prog
|
||||
fi
|
||||
echo
|
||||
return $RETVAL
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
if test "x`pidof $prog`" != x; then
|
||||
echo -n $"Stopping $prog: "
|
||||
killproc $prog
|
||||
RETVAL=$?
|
||||
echo
|
||||
fi
|
||||
rm -f /var/lock/subsys/$prog
|
||||
return $RETVAL
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
|
||||
restart|reload)
|
||||
stop
|
||||
sleep 3
|
||||
start
|
||||
;;
|
||||
condrestart)
|
||||
if test "x`pidof prog`" != x; then
|
||||
stop
|
||||
start
|
||||
fi
|
||||
;;
|
||||
|
||||
*)
|
||||
echo $"Usage: $0 {start|stop|restart|condrestart|status}"
|
||||
RETVAL=3
|
||||
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
|
||||
20
pads.service
Normal file
20
pads.service
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
[Unit]
|
||||
Description=Passive Asset Detection System
|
||||
After=network.target
|
||||
Documentation=man:pads(8)
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
PIDFile=/run/pads.pid
|
||||
ExecStart=/usr/bin/pads -D -c /etc/pads.conf
|
||||
|
||||
### Security Settings ###
|
||||
MemoryDenyWriteExecute=true
|
||||
LockPersonality=true
|
||||
ProtectKernelModules=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectControlGroups=true
|
||||
RestrictRealtime=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
233
pads.spec
Normal file
233
pads.spec
Normal file
|
|
@ -0,0 +1,233 @@
|
|||
%define _default_patch_fuzz 2
|
||||
Name: pads
|
||||
Version: 1.2
|
||||
Release: 43%{?dist}
|
||||
Summary: Passive Asset Detection System
|
||||
License: GPL-2.0-or-later
|
||||
URL: http://passive.sourceforge.net/
|
||||
Source0: http://prdownloads.sourceforge.net/passive/%{name}-%{version}.tar.gz
|
||||
Source1: pads.service
|
||||
Source2: pads.sysconfig
|
||||
Patch1: pads-1.2-cleanup.patch
|
||||
Patch2: pads-1.2-memleak.patch
|
||||
Patch3: pads-1.2-overrun.patch
|
||||
Patch4: pads-1.2-disable-debug.patch
|
||||
Patch5: pads-1.2-daemonize.patch
|
||||
Patch6: pads-1.2-ether-codes-update.patch
|
||||
Patch7: pads-1.2-misc.patch
|
||||
Patch8: pads-1.2-arp.patch
|
||||
Patch9: pads-1.2-prelude.patch
|
||||
Patch10: pads+vlan.patch
|
||||
Patch11: pads-1.2-prelude-cleanup.patch
|
||||
Patch12: pads-1.2-readonly.patch
|
||||
Patch13: pads-1.2-bstring.patch
|
||||
Patch14: pads-1.2-leak.patch
|
||||
Patch15: pads-1.2-perf.patch
|
||||
Patch16: pads-1.2-daemon.patch
|
||||
Patch17: pads-1.2-pthreads.patch
|
||||
Patch18: pads-aarch64.patch
|
||||
Patch19: pads-1.2-inline-cleanup.patch
|
||||
Patch20: pads-1.2-extra-libs.patch
|
||||
BuildRequires: make
|
||||
BuildRequires: gcc
|
||||
BuildRequires: automake autoconf
|
||||
BuildRequires: pcre-devel libpcap-devel
|
||||
BuildRequires: perl-generators
|
||||
BuildRequires: systemd
|
||||
Requires(post): systemd-units
|
||||
Requires(preun): systemd-units
|
||||
Requires(postun): systemd-units
|
||||
|
||||
|
||||
%description
|
||||
PADS is a libpcap based detection engine used to passively
|
||||
detect network assets.
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
%patch 1 -p1
|
||||
%patch 2 -p1
|
||||
%patch 3 -p1
|
||||
%patch 4 -p1
|
||||
%patch 5 -p1
|
||||
%patch 6 -p1
|
||||
%patch 7 -p1
|
||||
%patch 8 -p1
|
||||
%patch 9 -p1
|
||||
%patch 10 -p1
|
||||
%patch 11 -p1
|
||||
%patch 12 -p1
|
||||
%patch 13 -p1
|
||||
%patch 14 -p1
|
||||
%patch 15 -p1
|
||||
%patch 16 -p1
|
||||
%patch 17 -p1
|
||||
%patch 18 -p1
|
||||
%patch 19 -p1
|
||||
%patch 20 -p1
|
||||
|
||||
%build
|
||||
autoreconf -fv --install
|
||||
%configure
|
||||
make %{?_smp_mflags}
|
||||
|
||||
%install
|
||||
rm -rf %{buildroot}
|
||||
mkdir -p %{buildroot}%{_unitdir}
|
||||
mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
|
||||
make install DESTDIR=%{buildroot}
|
||||
install -m 644 %SOURCE1 %{buildroot}%{_unitdir}/pads.service
|
||||
install -m 640 %SOURCE2 %{buildroot}%{_sysconfdir}/sysconfig/%{name}
|
||||
# Remove installed docs since we pick this up another way
|
||||
rm -rf $RPM_BUILD_ROOT/usr/share/pads/
|
||||
|
||||
%post
|
||||
%systemd_post pads.service
|
||||
|
||||
%preun
|
||||
%systemd_preun pads.service
|
||||
|
||||
%postun
|
||||
%systemd_postun_with_restart pads.service
|
||||
|
||||
%files
|
||||
%doc doc/AUTHORS doc/COPYING doc/README doc/ChangeLog
|
||||
%{_sysconfdir}/pads-ether-codes
|
||||
%{_sysconfdir}/pads-signature-list
|
||||
%config(noreplace) %attr(0640,root,root) %{_sysconfdir}/pads.conf
|
||||
%config(noreplace) %attr(0640,root,root) %{_sysconfdir}/sysconfig/%{name}
|
||||
%{_unitdir}/pads.service
|
||||
%{_bindir}/pads
|
||||
%{_bindir}/pads-report
|
||||
%{_mandir}/*/*
|
||||
|
||||
%changelog
|
||||
* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-43
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-42
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-41
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
||||
|
||||
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-40
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-39
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Tue Nov 14 2023 Steve Grubb <sgrubb@redhat.com> - 1.2-38
|
||||
- Fix patching and improve security settings in service file
|
||||
|
||||
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-37
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-36
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Thu Dec 22 2022 Steve Grubb <sgrubb@redhat.com> - 1.2-35
|
||||
- SPDX Migration
|
||||
|
||||
* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-34
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-33
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-32
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.2-31
|
||||
- Rebuilt for updated systemd-rpm-macros
|
||||
See https://pagure.io/fesco/issue/2583.
|
||||
|
||||
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-30
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-29
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-28
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
|
||||
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-27
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||
|
||||
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-26
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
|
||||
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-25
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||
|
||||
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-24
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||
|
||||
* Thu Sep 21 2017 Steve Grubb <sgrubb@redhat.com> 1.2-23
|
||||
- Add systemd macros. (#850262)
|
||||
|
||||
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-22
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
|
||||
|
||||
* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-21
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
|
||||
|
||||
* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-20
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
|
||||
|
||||
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.2-19
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
|
||||
|
||||
* Mon Aug 17 2015 Steve Grubb <sgrubb@redhat.com> 1.2-18
|
||||
- Fix bad inline keyword use (#1239755)
|
||||
|
||||
* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-17
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
|
||||
|
||||
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-16
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
|
||||
|
||||
* Fri Jun 06 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-15
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
|
||||
|
||||
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-14
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
|
||||
|
||||
* Wed Jul 17 2013 Petr Pisar <ppisar@redhat.com> - 1.2-13
|
||||
- Perl 5.18 rebuild
|
||||
|
||||
* Fri Jun 21 2013 Steve Grubb <sgrubb@redhat.com> 1.2-12
|
||||
- Drop prelude support
|
||||
|
||||
* Sun Jun 02 2013 Steve Grubb <sgrubb@redhat.com> 1.2-11
|
||||
- Support Aarch64 (#926298)
|
||||
|
||||
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-10
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
|
||||
|
||||
* Fri Jul 20 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-9
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
|
||||
|
||||
* Mon Feb 20 2012 Jon Ciesla <limburgher@gmail.com> - 1.2-8
|
||||
- Migrate to systemd, BZ 661632.
|
||||
|
||||
* Fri Feb 10 2012 Petr Pisar <ppisar@redhat.com> - 1.2-7
|
||||
- Rebuild against PCRE 8.30
|
||||
|
||||
* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-6
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
|
||||
|
||||
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
|
||||
|
||||
* Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
|
||||
|
||||
* Thu Feb 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
|
||||
|
||||
* Tue Oct 28 2008 Steve Grubb <sgrubb@redhat.com> 1.2-2
|
||||
- Update CFLAGS for newer libprelude (#465964)
|
||||
|
||||
* Tue Aug 12 2008 Steve Grubb <sgrubb@redhat.com> 1.2-1
|
||||
Initial rpm build with many bug fixes
|
||||
6
pads.sysconfig
Normal file
6
pads.sysconfig
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
# Config file location
|
||||
CONFIG_FILE="/etc/pads.conf"
|
||||
|
||||
# Add extra options here
|
||||
EXTRA_OPTIONS=""
|
||||
|
||||
1
sources
1
sources
|
|
@ -0,0 +1 @@
|
|||
2a366195c55ad6b6859c4c84ce877ee8 pads-1.2.tar.gz
|
||||
Loading…
Add table
Add a link
Reference in a new issue