Compare commits

..

No commits in common. "rawhide" and "f37" have entirely different histories.

12 changed files with 953 additions and 1 deletions

1
.gitignore vendored Normal file
View file

@ -0,0 +1 @@
/unicornscan-*.tar.bz2

View file

@ -1 +0,0 @@
Retired: Long term failure to build

1
sources Normal file
View file

@ -0,0 +1 @@
SHA512 (unicornscan-0.4.7-2.tar.bz2) = e952bad280b0f926cca2eb0dd960114f45da497f56c4a20a939b42eefb0c515c0613ca7271709778f83a8de5819a64c42616e38a73ef67fe08c44157c812d230

View file

@ -0,0 +1,56 @@
--- unicornscan-0.4.7/etc/modules.conf 2006-10-18 18:57:05.000000000 +0200
+++ unicornscan-0.4.7/etc/modules.conf.config 2009-12-05 20:34:31.000000000 +0100
@@ -1,16 +1,9 @@
module "pgsqldb" {
- dbconf: "user=scan password=scanit! host=localhost dbname=scan";
+ dbconf: "user=unicornscan password=scanit! host=localhost dbname=unicornscan";
logpacket: "true";
};
-module "mysqldb" {
- username: "scan";
- password: "scanit!";
- hostname: "localhost";
- dbname: "foo";
-};
-
module "osdetect" {
/* Stim TCPFLG TTL DF WS TOS Misc */
/* tcpopts type desc */
--- unicornscan-0.4.7/www-front-end/config.php 2007-11-27 11:23:35.000000000 +0100
+++ unicornscan-0.4.7/www-front-end/config.php.config 2009-12-05 20:35:13.000000000 +0100
@@ -4,16 +4,16 @@
define("config_master_include", 1);
// Web Server location stuff
- $PHPLIB["uri_base"]="http://localhost/unicornscan/"; // http://vhost.domain.tld/something/
+ $PHPLIB["uri_base"]="/unicornscan/"; // http://vhost.domain.tld/something/
- $PHPLIB["filesystem_base"]="/var/www/htdocs/unicornscan/"; // Base directory content is in
- $PHPLIB["filesystem_phplib"]="/var/www/htdocs/unicornscan/lib/"; // Where phplib is
- $PHPLIB["filesystem_temporary"]="/tmp/"; // Where can i write files to?
+ $PHPLIB["filesystem_base"]="/usr/share/unicornscan/"; // Base directory content is in
+ $PHPLIB["filesystem_phplib"]="/usr/share/unicornscan/lib/"; // Where phplib is
+ $PHPLIB["filesystem_temporary"]="/var/lib/unicornscan/web/"; // Where can i write files to?
// DataBase Variables
- $PHPLIB["database_name"]="scan"; // change this for sure , its the database name
- $PHPLIB["database_type"]="pgsql"; // pgsql, mysql, youll need the right class though
- $PHPLIB["database_username"]="scan";
+ $PHPLIB["database_name"]="unicornscan"; // change this for sure , its the database name
+ $PHPLIB["database_type"]="pgsql"; // and something else isn't supported right now
+ $PHPLIB["database_username"]="unicornscan";
$PHPLIB["database_password"]="scanit!";
$PHPLIB["database_host"]="127.0.0.1";
$PHPLIB["database_db"]["default"]="";
@@ -24,6 +24,9 @@
// formclass2.php stuff
$PHPLIB["formclass_warnimage"]="exl.gif"; // warning image for invalid forms
+ // No PHP error reporting
+ error_reporting(0);
+
} // Double Inclusion detection
require("./lib/connect_todb.php");

View file

@ -0,0 +1,51 @@
Patch by Robert Scheck <robert@fedoraproject.org> for unicornscan >= 0.4.7 to avoid
build failures with GCC 5.x such as "unicornscan-0.4.7/src/unilib/tsc.c:163:
undefined reference to `get_tsc'" (occurring in some different source code lines).
--- unicornscan-0.4.7/src/unilib/tsc.c 2006-10-18 18:57:05.000000000 +0200
+++ unicornscan-0.4.7/src/unilib/tsc.c.gcc5 2015-06-20 19:57:35.000000000 +0200
@@ -30,7 +30,7 @@
return 1;
}
-inline tsc_t get_tsc(void) {
+tsc_t get_tsc(void) {
tsc_t j;
asm volatile ( "pause\n"
"nop\n"
@@ -52,7 +52,7 @@
* by Matteo Frigo
*/
-inline tsc_t get_tsc(void) {
+tsc_t get_tsc(void) {
uint32_t tbl, tbu0, tbu1;
asm volatile("nop");
@@ -75,7 +75,7 @@
return 1;
}
-inline tsc_t get_tsc(void) {
+tsc_t get_tsc(void) {
tsc_t j;
asm volatile (
@@ -96,7 +96,7 @@
return 1;
}
-inline tsc_t get_tsc(void) {
+tsc_t get_tsc(void) {
uint32_t j;
/*
@@ -144,7 +144,7 @@
return 0;
}
-inline tsc_t get_tsc(void) {
+tsc_t get_tsc(void) {
PANIC("Your CPU is not supported by the `tsc' delay, use -d2 or -d3 or edit your config file to use gtod or sleep");
}

View file

@ -0,0 +1,47 @@
Patch by Robert Scheck <robert@fedoraproject.org> for unicornscan >= 0.4.7, which
adds support for x86_64, ppc64 or other 64 bit architectures using /usr/lib64 for
their libraries. Having lib64 in front of lib is mandatory, as 64 bit systems are
likely to run with multi-lib, that means 32 bit libraries are parallel in use. If
you apply this patch, don't run autoconf > 2.6.3, as it will break, because whole
autotools stuff from upstream is unfortunately a bit broken.
--- unicornscan-0.4.7/configure.ac 2007-11-29 15:51:20.000000000 +0100
+++ unicornscan-0.4.7/configure.ac.lib64 2009-11-16 23:32:27.000000000 +0100
@@ -269,7 +269,7 @@
AC_MSG_RESULT(no)
fi
else
- for i in lib lib/mysql; do
+ for i in lib64 lib lib64/mysql lib/mysql; do
str="$MYSQL_DIR/$i/libmysqlclient.*"
for j in `echo $str`; do
if test -r $j; then
@@ -331,7 +331,7 @@
AC_MSG_RESULT(no)
fi
else
- for i in lib lib/postgresql; do
+ for i in lib64 lib lib64/postgresql lib/postgresql; do
str="$PGSQL_DIR/$i/libpq.*"
for j in `echo $str`; do
if test -r $j; then
--- unicornscan-0.4.7/configure 2007-12-18 16:26:12.000000000 +0100
+++ unicornscan-0.4.7/configure.lib64 2009-12-05 12:04:32.000000000 +0100
@@ -26275,7 +26275,7 @@
echo "${ECHO_T}no" >&6; }
fi
else
- for i in lib lib/mysql; do
+ for i in lib64 lib lib64/mysql lib/mysql; do
str="$MYSQL_DIR/$i/libmysqlclient.*"
for j in `echo $str`; do
if test -r $j; then
@@ -26438,7 +26438,7 @@
echo "${ECHO_T}no" >&6; }
fi
else
- for i in lib lib/postgresql; do
+ for i in lib64 lib lib64/postgresql lib/postgresql; do
str="$PGSQL_DIR/$i/libpq.*"
for j in `echo $str`; do
if test -r $j; then

View file

@ -0,0 +1,395 @@
Patch by Robert Scheck <robert@fedoraproject.org> for unicornscan >= 0.4.7, which adds support for
MaxMind GeoIP2 and GeoLite2 databases because GeoIP Legacy has been retired by MaxMind as upstream
in May 2022.
Unicornscan upstream expects /etc/unicornscan/GeoIP.dat rather system-wide GeoIP Legacy, GeoIP2 or
GeoLite2 databases, thus this patch extends the lookups to /usr/share/GeoIP while keeping backward
compatibility.
To avoid "undefined reference to `GeoIP_open'" build time errors, the missing linking with -lGeoIP
or -lmaxminddb is added as well.
When applying this patch, do not run autoconf > 2.6.3 as it will break, because the whole autotools
stuff from upstream is unfortunately very old and partially maybe even simply broken.
--- unicornscan-0.4.7/configure 2007-12-18 16:26:12.000000000 +0100
+++ unicornscan-0.4.7/configure.maxminddb 2022-05-06 03:29:54.050661427 +0200
@@ -26472,92 +26472,149 @@
fi
-{ echo "$as_me:$LINENO: checking for GeoIP_open in -lGeoIP" >&5
-echo $ECHO_N "checking for GeoIP_open in -lGeoIP... $ECHO_C" >&6; }
-if test "${ac_cv_lib_GeoIP_GeoIP_open+set}" = set; then
- echo $ECHO_N "(cached) $ECHO_C" >&6
-else
+# as_fn_set_status STATUS
+# -----------------------
+# Set $? to STATUS, without forking.
+as_fn_set_status ()
+{
+ return $1
+} # as_fn_set_status
+
+# ac_fn_c_try_link LINENO
+# -----------------------
+# Try to link conftest.$ac_ext, and return whether this succeeded.
+ac_fn_c_try_link ()
+{
+ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+ rm -f conftest.$ac_objext conftest.beam conftest$ac_exeext
+ if { { ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+printf "%s\n" "$ac_try_echo"; } >&5
+ (eval "$ac_link") 2>conftest.err
+ ac_status=$?
+ if test -s conftest.err; then
+ grep -v '^ *+' conftest.err >conftest.er1
+ cat conftest.er1 >&5
+ mv -f conftest.er1 conftest.err
+ fi
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ test $ac_status = 0; } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext && {
+ test "$cross_compiling" = yes ||
+ test -x conftest$ac_exeext
+ }
+then :
+ ac_retval=0
+else $as_nop
+ printf "%s\n" "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_retval=1
+fi
+ # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
+ # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
+ # interfere with the next link command; also delete a directory that is
+ # left behind by Apple's compiler. We do this before executing the actions.
+ rm -rf conftest.dSYM conftest_ipa8_conftest.oo
+ eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+ as_fn_set_status $ac_retval
+
+} # ac_fn_c_try_link
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for MMDB_open in -lmaxminddb" >&5
+printf %s "checking for MMDB_open in -lmaxminddb... " >&6; }
+if test ${ac_cv_lib_maxminddb_MMDB_open+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
ac_check_lib_save_LIBS=$LIBS
-LIBS="-lGeoIP $LIBS"
-cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h. */
+LIBS="-lmaxminddb $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+
+/* Override any GCC internal prototype to avoid an error.
+ Use char because int might match the return type of a GCC
+ builtin and then its argument prototype would still apply. */
+char MMDB_open ();
+int
+main (void)
+{
+return MMDB_open ();
+ ;
+ return 0;
+}
_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+ ac_cv_lib_maxminddb_MMDB_open=yes
+else $as_nop
+ ac_cv_lib_maxminddb_MMDB_open=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+ conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_maxminddb_MMDB_open" >&5
+printf "%s\n" "$ac_cv_lib_maxminddb_MMDB_open" >&6; }
+if test "x$ac_cv_lib_maxminddb_MMDB_open" = xyes
+then :
+ printf "%s\n" "#define HAVE_LIBMAXMINDDB 1" >>confdefs.h
+
+ LIBS="-lmaxminddb $LIBS"
+
+else $as_nop
+
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for GeoIP_open in -lGeoIP" >&5
+printf %s "checking for GeoIP_open in -lGeoIP... " >&6; }
+if test ${ac_cv_lib_GeoIP_GeoIP_open+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ ac_check_lib_save_LIBS=$LIBS
+LIBS="-lGeoIP $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
Use char because int might match the return type of a GCC
builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
-char GeoIP_open ();
+char GeoIP_open ();
int
-main ()
+main (void)
{
return GeoIP_open ();
;
return 0;
}
_ACEOF
-rm -f conftest.$ac_objext conftest$ac_exeext
-if { (ac_try="$ac_link"
-case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
- (eval "$ac_link") 2>conftest.er1
- ac_status=$?
- grep -v '^ *+' conftest.er1 >conftest.err
- rm -f conftest.er1
- cat conftest.err >&5
- echo "$as_me:$LINENO: \$? = $ac_status" >&5
- (exit $ac_status); } &&
- { ac_try='test -z "$ac_c_werror_flag" || test ! -s conftest.err'
- { (case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
- (eval "$ac_try") 2>&5
- ac_status=$?
- echo "$as_me:$LINENO: \$? = $ac_status" >&5
- (exit $ac_status); }; } &&
- { ac_try='test -s conftest$ac_exeext'
- { (case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
- (eval "$ac_try") 2>&5
- ac_status=$?
- echo "$as_me:$LINENO: \$? = $ac_status" >&5
- (exit $ac_status); }; }; then
+if ac_fn_c_try_link "$LINENO"
+then :
ac_cv_lib_GeoIP_GeoIP_open=yes
-else
- echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
- ac_cv_lib_GeoIP_GeoIP_open=no
+else $as_nop
+ ac_cv_lib_GeoIP_GeoIP_open=no
fi
-
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+ conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
-{ echo "$as_me:$LINENO: result: $ac_cv_lib_GeoIP_GeoIP_open" >&5
-echo "${ECHO_T}$ac_cv_lib_GeoIP_GeoIP_open" >&6; }
-if test $ac_cv_lib_GeoIP_GeoIP_open = yes; then
- cat >>confdefs.h <<_ACEOF
-#define HAVE_LIBGEOIP 1
-_ACEOF
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_GeoIP_GeoIP_open" >&5
+printf "%s\n" "$ac_cv_lib_GeoIP_GeoIP_open" >&6; }
+if test "x$ac_cv_lib_GeoIP_GeoIP_open" = xyes
+then :
+ printf "%s\n" "#define HAVE_LIBGEOIP 1" >>confdefs.h
LIBS="-lGeoIP $LIBS"
fi
+fi
+
@@ -28164,7 +28221,8 @@
echo "prefix: ${prefix}"
echo "PostgreSQL Support: $pgsql"
echo "MySQL Support: $mysql"
-echo "GeoIP support: $ac_cv_lib_GeoIP_GeoIP_open"
+echo "MaxMind DB support: ${ac_cv_lib_maxminddb_MMDB_open:-no}"
+echo "GeoIP Legacy support: ${ac_cv_lib_GeoIP_GeoIP_open:-no}"
echo "SELinux Support: $selinux"
echo "Listen User: (non-selinux) $listen_user"
echo "libraries missing that will be built: \`$NEED_AUX_LIBS'"
--- unicornscan-0.4.7/configure.ac 2007-11-29 15:51:20.000000000 +0100
+++ unicornscan-0.4.7/configure.ac.maxminddb 2022-05-06 03:28:44.532146008 +0200
@@ -357,7 +357,8 @@
fi
fi
-AC_CHECK_LIB([GeoIP], [GeoIP_open], [], [], [])
+AC_CHECK_LIB([maxminddb], [MMDB_open], [], [
+ AC_CHECK_LIB([GeoIP], [GeoIP_open], [], [], [])], [])
AC_SUBST(DESTDIR)
AC_SUBST(DBTYPES)
@@ -433,7 +434,8 @@
echo "prefix: ${prefix}"
echo "PostgreSQL Support: $pgsql"
echo "MySQL Support: $mysql"
-echo "GeoIP support: $ac_cv_lib_GeoIP_GeoIP_open"
+echo "MaxMind DB support: ${ac_cv_lib_maxminddb_MMDB_open:-no}"
+echo "GeoIP Legacy support: ${ac_cv_lib_GeoIP_GeoIP_open:-no}"
echo "SELinux Support: $selinux"
echo "Listen User: (non-selinux) $listen_user"
echo "libraries missing that will be built: \`$NEED_AUX_LIBS'"
--- unicornscan-0.4.7/src/config.h.in 2006-10-18 18:57:05.000000000 +0200
+++ unicornscan-0.4.7/src/config.h.in.maxminddb 2022-05-06 03:00:23.957528819 +0200
@@ -59,6 +59,7 @@
/* XXX */
#undef CPU_BIGENDIAN
#undef CPU_LITTLEENDIAN
+#undef HAVE_LIBMAXMINDDB
#undef HAVE_LIBGEOIP
#undef STDC_HEADERS
--- unicornscan-0.4.7/src/FMTCAT_ARGS 2006-10-18 18:57:05.000000000 +0200
+++ unicornscan-0.4.7/src/FMTCAT_ARGS.maxminddb 2022-05-06 01:26:54.505694783 +0200
@@ -1,5 +1,5 @@
%% = %
-%C = Country ( Via GeoIP )
+%C = Country (via MaxMind DB or GeoIP Legacy)
%h or %hn ip or hostname
%L or %Ln local port or local service name
%M link address
--- unicornscan-0.4.7/src/scan_progs/Makefile.in 2007-12-18 17:02:36.000000000 +0100
+++ unicornscan-0.4.7/src/scan_progs/Makefile.in.maxminddb 2022-05-06 01:10:27.444543726 +0200
@@ -23,7 +23,7 @@
all: $(L_LIBNAME) @sendername@ @listenername@
$(LS_LIBNAME): $(LS_OBJS) $(LS_HDRS)
- $(LIBTOOL) --mode=link $(CC) $(CFLAGS) -o $(LS_LIBNAME) $(LS_OBJS)
+ $(LIBTOOL) --mode=link $(CC) $(CFLAGS) -o $(LS_LIBNAME) $(LS_OBJS) $(LDFLAGS)
@sendername@: $(S_OBJS) $(LS_LIBNAME) $(S_HDRS) ../unilib/libunilib.la ../parse/libparse.la $(ENTRY)
$(LIBTOOL) --mode=clean rm -f $(ENTRY:.c=.lo)
--- unicornscan-0.4.7/src/scan_progs/report.c 2006-10-18 18:57:05.000000000 +0200
+++ unicornscan-0.4.7/src/scan_progs/report.c.maxminddb 2022-05-06 01:32:15.801075983 +0200
@@ -39,7 +39,12 @@
#include <scan_progs/master.h>
-#ifdef HAVE_LIBGEOIP
+#if defined(HAVE_LIBMAXMINDDB)
+#include <maxminddb.h>
+
+MMDB_s m_mmdb;
+
+#elif defined(HAVE_LIBGEOIP)
#include <GeoIP.h>
static GeoIP *gi=NULL;
@@ -67,10 +72,45 @@
report_t=rbinit(123);
-#ifdef HAVE_LIBGEOIP
- gi=GeoIP_open(CONF_DIR "/GeoIP.dat", GEOIP_MEMORY_CACHE);
- if (gi == NULL) {
- ERR("error opening geoip database `%s/%s': %s", CONF_DIR, "/GeoIP.dat", strerror(errno));
+#if defined(HAVE_LIBMAXMINDDB)
+ int status;
+ if (access("/usr/share/GeoIP/GeoIP2-Country.mmdb", F_OK) == 0) {
+ status=MMDB_open("/usr/share/GeoIP/GeoIP2-Country.mmdb", MMDB_MODE_MMAP, &m_mmdb);
+ if (status != MMDB_SUCCESS) {
+ ERR("error opening MaxMind GeoIP2 standard database `/usr/share/GeoIP/GeoIP2-Country.mmdb': %s", strerror(errno));
+ }
+ }
+ else if (access(CONF_DIR "/GeoIP2-Country.mmdb", F_OK) == 0) {
+ status=MMDB_open(CONF_DIR "/GeoIP2-Country.mmdb", MMDB_MODE_MMAP, &m_mmdb);
+ if (status != MMDB_SUCCESS) {
+ ERR("error opening MaxMind GeoIP2 database `%s/%s': %s", CONF_DIR, "/GeoIP2-Country.mmdb", strerror(errno));
+ }
+ }
+ else if (access("/usr/share/GeoIP/GeoLite2-Country.mmdb", F_OK) == 0) {
+ status=MMDB_open("/usr/share/GeoIP/GeoLite2-Country.mmdb", MMDB_MODE_MMAP, &m_mmdb);
+ if (status != MMDB_SUCCESS) {
+ ERR("error opening MaxMind GeoLite2 standard database `/usr/share/GeoIP/GeoLite2-Country.mmdb': %s", strerror(errno));
+ }
+ }
+ else {
+ status=MMDB_open(CONF_DIR "/GeoLite2-Country.mmdb", MMDB_MODE_MMAP, &m_mmdb);
+ if (status != MMDB_SUCCESS) {
+ ERR("error opening MaxMind GeoLite2 database `%s/%s': %s", CONF_DIR, "/GeoLite2-Country.mmdb", strerror(errno));
+ }
+ }
+
+#elif defined(HAVE_LIBGEOIP)
+ if (access("/usr/share/GeoIP/GeoIP.dat", F_OK) == 0) {
+ gi=GeoIP_open("/usr/share/GeoIP/GeoIP.dat", GEOIP_MEMORY_CACHE);
+ if (gi == NULL) {
+ ERR("error opening GeoIP Legacy standard database `/usr/share/GeoIP/GeoIP.dat': %s", strerror(errno));
+ }
+ }
+ else {
+ gi=GeoIP_open(CONF_DIR "/GeoIP.dat", GEOIP_MEMORY_CACHE);
+ if (gi == NULL) {
+ ERR("error opening GeoIP Legacy database `%s/%s': %s", CONF_DIR, "/GeoIP.dat", strerror(errno));
+ }
}
#endif
@@ -104,7 +144,9 @@
report_t=NULL;
-#ifdef HAVE_LIBGEOIP
+#if defined(HAVE_LIBMAXMINDDB)
+ MMDB_close(&m_mmdb);
+#elif defined(HAVE_LIBGEOIP)
if (gi != NULL) {
GeoIP_delete(gi);
}
@@ -517,12 +559,24 @@
break;
}
strcat(ofmt, "s");
-#ifdef HAVE_LIBGEOIP
+#if defined(HAVE_LIBMAXMINDDB)
+ int gai_error, mmdb_error, status;
+ MMDB_lookup_result_s result=MMDB_lookup_string(&m_mmdb, inet_ntoa(ia), &gai_error, &mmdb_error);
+ if (gai_error == 0 && mmdb_error == MMDB_SUCCESS) {
+ MMDB_entry_data_s entry_data;
+ status=MMDB_get_value(&result.entry, &entry_data, "country", "iso_code", NULL);
+ if (status == MMDB_SUCCESS && entry_data.has_data) {
+ tptr=strndup(entry_data.utf8_string, entry_data.data_size);
+ }
+ }
+ snprintf(tmp, sizeof(tmp) -1, ofmt, tptr != NULL ? tptr : "??");
+ KEHSTR(tmp);
+#elif defined(HAVE_LIBGEOIP)
tptr=GeoIP_country_code_by_addr(gi, inet_ntoa(ia));
snprintf(tmp, sizeof(tmp) -1, ofmt, tptr != NULL ? tptr : "??");
KEHSTR(tmp);
#else
- ERR("no GeoIP support compiled in!");
+ ERR("no MaxMind DB and no GeoIP Legacy support compiled in!");
#endif
break;

81
unicornscan-README.fedora Normal file
View file

@ -0,0 +1,81 @@
Unicornscan and PostgreSQL
--------------------------
1. The PostgreSQL service has to be up and running. Depending on the exact
version of Fedora or Red Hat Enterprise Linux, on the first PostgreSQL
startup, a "service postgresql initdb" is maybe required for initializing.
[root@tux ~]# service postgresql start
Starting postgresql service: [ OK ]
[root@tux ~]#
2. Switch to the PostgreSQL user.
[root@tux ~]# su - postgres
-bash-4.0$
3. Create an own PostgreSQL database user for unicornscan. Don't forget to set
a password, e.g. "scanit!" as it is used in all examples.
-bash-4.0$ createuser --no-superuser --no-createrole --no-createdb --pwprompt unicornscan
Enter password for new role:
Enter it again:
-bash-4.0$
4. Create an own PostgreSQL database for unicornscan linked with the previous
generated database user for unicornscan.
-bash-4.0$ createdb --owner unicornscan unicornscan
-bash-4.0$
5. Switch back to the root user.
-bash-4.0$ exit
exit
[root@tux ~]#
6. Edit PostgreSQL client authentication file /var/lib/pgsql/data/pg_hba.conf
file with a text editor, insert the following lines before the other already
existing rules.
# TYPE DATABASE USER CIDR-ADDRESS METHOD
local unicornscan unicornscan md5
host unicornscan unicornscan 127.0.0.1/32 md5
host unicornscan unicornscan ::1/128 md5
7. Edit PostgreSQL server configuration in /var/lib/pgsql/data/postgresql.conf
and set the configuration variable as follows:
escape_string_warning = off
8. Restart the PostgreSQL service to enable the previous performed changes.
[root@tux ~]# service postgresql restart
Stopping postgresql service: [ OK ]
Starting postgresql service: [ OK ]
[root@tux ~]#
9. Create the required tables for unicornscan inside of PostgreSQL database,
there will be some error messages displayed after entering the password for
psql. These error messages are normal and expected, because the SQL dump
contains a SQL DROP of all tables before the SQL CREATE is performed.
[root@tux ~]# psql --username unicornscan --password unicornscan < /usr/share/doc/unicornscan-0.*/pgsql_schema.sql
Password for user unicornscan:
[...]
[root@tux ~]#
10. Edit the unicornscan configuration file /etc/unicornscan/modules.conf and
check or correct the PostgreSQL database connection settings.
module "pgsqldb" {
dbconf: "user=unicornscan password=scanit! host=localhost dbname=unicornscan";
logpacket: "true";
};
11. Perform a small sample scan and write the output to PostgreSQL database.
[root@tux ~]# unicornscan www.google.com -e pgsqldb
TCP open http[ 80] from 209.85.129.104 ttl 52
TCP open https[ 443] from 209.85.129.104 ttl 52
[root@tux ~]#

View file

@ -0,0 +1,45 @@
Unicornscan and PostgreSQL
--------------------------
1. Follow the /usr/share/doc/unicornscan-0.*/README.fedora file, so that the
PostgreSQL service is up and running already.
2. Start (or restart) the Apache HTTP webserver, to ensure that configuration
file for Apache gets active.
[root@tux ~]# service httpd start
Starting httpd: [ OK ]
[root@tux ~]#
3. Create the required tables for unicornscan inside of PostgreSQL database,
there will be some error messages displayed after entering the password for
psql. These error messages are normal and expected, because the SQL dump
contains a SQL DROP of all tables before the SQL CREATE is performed.
[root@tux ~]# psql --username unicornscan --password unicornscan < /usr/share/doc/unicornscan-web-0.*/session.sql
Password for user unicornscan:
[...]
[root@tux ~]#
4. If you've got SELinux enabled, make sure, that SELinux allows Apache/PHP to
connect to the PostgreSQL database. If you don't have SELinux enabled, just
skip this step.
setsebool -P httpd_can_network_connect_db=1
5. Edit the unicornscan configuration file /etc/unicornscan/web.php and check
or correct the PostgreSQL database connection settings.
$PHPLIB["database_name"]="unicornscan";
$PHPLIB["database_username"]="unicornscan";
$PHPLIB["database_password"]="scanit!";
$PHPLIB["database_host"]="127.0.0.1";
6. Perform a small sample scan and write the output to PostgreSQL database.
[root@tux ~]# unicornscan www.google.com -e pgsqldb
TCP open http[ 80] from 209.85.129.104 ttl 52
TCP open https[ 443] from 209.85.129.104 ttl 52
[root@tux ~]#
7. Open a webbrowser and switch to: http://localhost/unicornscan/

5
unicornscan.conf Normal file
View file

@ -0,0 +1,5 @@
#
# Scalable, accurate, flexible and efficient network probing
#
Alias /unicornscan /usr/share/unicornscan

269
unicornscan.spec Normal file
View file

@ -0,0 +1,269 @@
# Disable automatic .la file removal
%global __brp_remove_la_files %nil
Summary: Scalable, accurate, flexible and efficient network probing
Name: unicornscan
Version: 0.4.7
Release: 31%{?dist}
License: GPLv2+
URL: https://sourceforge.net/projects/osace/
Source0: https://downloads.sourceforge.net/sourceforge/osace/unicornscan/unicornscan%20-%200.4.7%20source/%{name}-%{version}-2.tar.bz2
Source1: unicornscan.sysusersd
Source2: unicornscan.conf
Source3: unicornscan-README.fedora
Source4: unicornscan-web-README.fedora
Patch0: unicornscan-0.4.7-lib64.patch
Patch1: unicornscan-0.4.7-maxminddb.patch
Patch2: unicornscan-0.4.7-config.patch
Patch3: unicornscan-0.4.7-gcc5.patch
BuildRequires: gcc-c++
BuildRequires: make
BuildRequires: flex
BuildRequires: bison
BuildRequires: libpcap-devel
BuildRequires: libtool-ltdl-devel
BuildRequires: libdnet-devel
BuildRequires: libmaxminddb-devel
%if 0%{?fedora} || 0%{?rhel} > 7
BuildRequires: libpq-devel
Recommends: geolite2-country
%else
BuildRequires: postgresql-devel
Requires: geolite2-country
%endif
BuildRequires: systemd-rpm-macros
%if 0%{?fedora} || 0%{?rhel} > 7
Obsoletes: unicornscan-web < 0.4.7-24
%endif
%{?sysusers_requires_compat}
%description
Unicornscan is an attempt at a user-land distributed TCP/IP stack. It is
intended to provide a researcher a superior interface for introducing a
stimulus into and measuring a response from a TCP/IP enabled device or
network. Although it currently has hundreds of individual features, a main
set of abilities include: Asynchronous stateless TCP scanning with all
variations of TCP flags, asynchronous stateless TCP banner grabbing,
asynchronous protocol specific UDP scanning (sending enough of a signature
to elicit a response), active and passive remote OS, application and
component identification by analyzing responses, PCAP file logging and
filtering, relational database output, custom module support, customized
data-set views.
%if 0%{?rhel} && 0%{?rhel} < 8
%package web
Summary: Web-based front-end for unicornscan database results
Requires: %{name} = %{version}-%{release}, php-pgsql, httpd
BuildArch: noarch
%description web
Unicornscan provides support to write results into a database. And with the
web-based front-end for unicornscan, which is written in PHP, these results
can be easily interpreted and visualized.
%endif
%prep
%setup -q
%patch0 -p1 -b .lib64
%patch1 -p1 -b .maxminddb
%patch2 -p1 -b .config
%patch3 -p1 -b .gcc5
cp -pf %{SOURCE3} README.fedora
%if 0%{?rhel} && 0%{?rhel} < 8
cp -pf %{SOURCE4} www-front-end/README.fedora
%endif
%build
# - _GNU_SOURCE is required for "ucred" from <bits/socket.h> via <sys/socket.h>
# - Use classical non-SELinux permission schema once SELinux Reference Policy is
# including unicornscan support directly, maybe with Fedora 13 and/or RHEL 6
# - MySQL support is only available in ./configure as inside broken and disabled
export CFLAGS="$RPM_OPT_FLAGS -D_GNU_SOURCE -fPIC"
%configure --localstatedir=%{_localstatedir}/lib --with-pgsql --with-listen-user=%{name}
%make_build
%install
%make_install
# Declarative allocation of system users and groups
install -D -p -m 0644 %{SOURCE1} $RPM_BUILD_ROOT%{_sysusersdir}/%{name}.conf
# Remove the static library files
rm -f $RPM_BUILD_ROOT%{_libdir}/%{name}/modules/*.a
# Correct permissions and timestamps
chmod 644 $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/*
touch -c -r etc/modules.conf.config $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/modules.conf
%if 0%{?rhel} && 0%{?rhel} < 8
# Install web files into destination
cp -af www-front-end $RPM_BUILD_ROOT%{_datadir}/%{name}/
rm -rf $RPM_BUILD_ROOT%{_datadir}/%{name}/attic
rm -f $RPM_BUILD_ROOT%{_datadir}/%{name}/{config.php.config,README.fedora,TODO}
rm -f $RPM_BUILD_ROOT%{_datadir}/%{name}/lib/{session.sql,.htaccess}
# Move configuration file to its place
mv -f $RPM_BUILD_ROOT%{_datadir}/%{name}/config.php $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/web.php
touch -c -r www-front-end/config.php.config $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/web.php
ln -sf ../../..%{_sysconfdir}/%{name}/web.php $RPM_BUILD_ROOT%{_datadir}/%{name}/config.php
# Install the apache configuration file
mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/
install -p -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/%{name}.conf
# Create temporary directory for packaging
mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/%{name}/web/
%endif
%pre
%sysusers_create_compat %{SOURCE1}
%files
%license LICENSE
%doc AUTHORS README README.database README.fedora README.security THANKS
%doc TODO UDP_PAYLOADS_NEEDED docs/Unicornscan-Getting_Started.pdf src/FMTCAT_ARGS
%doc src/output_modules/database/sql/pgsql_schema.sql src/parse/example_confs
%dir %{_sysconfdir}/%{name}/
%config(noreplace) %attr(0640,root,%{name}) %{_sysconfdir}/%{name}/modules.conf
%config(noreplace) %{_sysconfdir}/%{name}/oui.txt
%config(noreplace) %{_sysconfdir}/%{name}/payloads.conf
%config(noreplace) %{_sysconfdir}/%{name}/ports.txt
%config(noreplace) %{_sysconfdir}/%{name}/unicorn.conf
%{_bindir}/fantaip
%{_bindir}/unibrow
%{_bindir}/unicfgtst
%{_bindir}/%{name}
%{_bindir}/us
%dir %{_libdir}/%{name}/
%dir %{_libdir}/%{name}/modules/
# *.la files are referenced by the shared objects and required
%{_libdir}/%{name}/modules/httpexp.la
%{_libdir}/%{name}/modules/httpexp.so
%{_libdir}/%{name}/modules/http.la
%{_libdir}/%{name}/modules/http.so
%{_libdir}/%{name}/modules/ntalk.la
%{_libdir}/%{name}/modules/ntalk.so
%{_libdir}/%{name}/modules/osdetect.la
%{_libdir}/%{name}/modules/osdetect.so
%{_libdir}/%{name}/modules/pgsqldb.la
%{_libdir}/%{name}/modules/pgsqldb.so
%{_libdir}/%{name}/modules/rdns.la
%{_libdir}/%{name}/modules/rdns.so
%{_libdir}/%{name}/modules/sip.la
%{_libdir}/%{name}/modules/sip.so
%{_libdir}/%{name}/modules/upnp.la
%{_libdir}/%{name}/modules/upnp.so
%dir %{_libexecdir}/%{name}/
%{_libexecdir}/%{name}/unilisten
%{_libexecdir}/%{name}/unisend
%{_sysusersdir}/%{name}.conf
%{_mandir}/man1/%{name}.1*
%dir %{_localstatedir}/lib/%{name}/
%if 0%{?rhel} && 0%{?rhel} < 8
%files web
%doc www-front-end/README.fedora www-front-end/lib/session.sql
%config(noreplace) %{_sysconfdir}/httpd/conf.d/%{name}.conf
%config(noreplace) %attr(640,apache,apache) %{_sysconfdir}/%{name}/web.php
%{_datadir}/%{name}
%attr(-,apache,apache) %dir %{_localstatedir}/lib/%{name}/web
%endif
%changelog
* Sun Jul 31 2022 Robert Scheck <robert@fedoraproject.org> 0.4.7-31
- Added sysusers.d file to achieve user() and group() provides
* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-30
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Fri May 06 2022 Robert Scheck <robert@fedoraproject.org> 0.4.7-29
- Added patch to support MaxMind GeoIP2 and GeoLite2 databases
* Mon Jan 24 2022 Timm Bäder <tbaeder@redhat.com> - 0.4.7-28
- Disable automatic .la file removal
- https://fedoraproject.org/wiki/Changes/RemoveLaFiles
* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-27
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-26
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Mon Feb 08 2021 Pavel Raiskup <praiskup@redhat.com> - 0.4.7-25
- rebuild for libpq ABI fix rhbz#1908268
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-24
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-23
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Thu Jul 09 2020 Jeff Law <law@redhat.com> - 0.4.7-22
- Disable LTO
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-21
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-20
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-19
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Thu Oct 11 2018 Robert Scheck <robert@fedoraproject.org> 0.4.7-18
- Add missing linking to -lGeoIP (#1623468)
* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-17
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-16
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-13
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Fri Feb 05 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.4.7-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
* Sat Jun 20 2015 Robert Scheck <robert@fedoraproject.org> 0.4.7-11
- Added patch to make rebuilding with GCC 5 working
* Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.7-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
* Mon Aug 18 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.7-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.7-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.7-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Fri Feb 15 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.7-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
* Sun Jul 22 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.7-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.7-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4.7-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
* Sat Dec 05 2009 Robert Scheck <robert@fedoraproject.org> 0.4.7-2
- Added unicornscan-web subpackage (#538190 #c3, Robert E. Lee)
- Updated the patch for 64 bit support in configure (#538190 #c6)
* Tue Nov 17 2009 Robert Scheck <robert@fedoraproject.org> 0.4.7-1
- Upgrade to 0.4.7
- Initial spec file for Fedora and Red Hat Enterprise Linux (spec
file is based on a try by Robert E. Lee and Manuel Wolfshant)

2
unicornscan.sysusersd Normal file
View file

@ -0,0 +1,2 @@
#Type Name ID GECOS Home directory Shell
u unicornscan - "Unicornscan listener" /var/lib/unicornscan /sbin/nologin