Changeset 5518

Timestamp:

02/08/10 15:00:14 (6 months ago)

Author:

nopper

Message:

Readapting injector audit to respect the new engine.

Files:

• pm/trunk/audits/active/injector/sources/main.py (modified) (22 diffs)

pm/trunk/audits/active/injector/sources/main.py

@@ -1 +1 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
-# Copyright (C) 2008 Adriano Monteiro Marques
+# Copyright (C) 2008, 2010 Adriano Monteiro Marques
 #
 # Author: Francesco Piccinno <stack.box@gmail.com>
@@ -20 +20 @@
 
 import gtk
+import pango
 import gobject
 
@@ -36 +37 @@
 
 from umit.pm.manager.auditmanager import *
+from umit.pm.manager.sessionmanager import TCPIdent, SessionManager
 
 from umit.pm.backend import MetaPacket
@@ -48 +50 @@
 COLUMN_OBJECT = range(8)
 
-# Special constant to track idle connections
-CONN_IDLE = CONN_TIMED_OUT + 1
-
 escape_table = '.........\t\n\x0b\x0c\r..................' \
                ' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFG' \
@@ -61 +60 @@
 escape_raw = lambda x: string.translate(x, escape_table)
 
-def _kill_stream_seq(ctx, stream, seqoff):
-    pkt = MetaPacket.new('ip') / MetaPacket.new('tcp')
-    pkt.set_field('ip.src', stream.get_source())
-    pkt.set_field('ip.dst', stream.get_dest())
-    pkt.set_field('tcp.sport', stream.sport)
-    pkt.set_field('tcp.dport', stream.dport)
-    pkt.set_field('tcp.seq', stream.client.first_data_seq + \
-                  stream.server.count + stream.server.urg_count + \
-                  (seqoff and stream.server.window / 2 or 0))
-    pkt.set_field('tcp.flags', TH_RST)
-
-    ctx.si_l3(pkt)
-
-    pkt = MetaPacket.new('ip') / MetaPacket.new('tcp')
-    pkt.set_field('ip.src', stream.get_dest())
-    pkt.set_field('ip.dst', stream.get_source())
-    pkt.set_field('tcp.sport', stream.dport)
-    pkt.set_field('tcp.dport', stream.sport)
-    pkt.set_field('tcp.seq', stream.server.first_data_seq + \
-                  stream.client.count + stream.client.urg_count + \
-                  (seqoff and stream.client.window / 2 or 0))
-    pkt.set_field('tcp.flags', TH_RST)
-
-    ctx.si_l3(pkt)
-
-def kill_stream(ctx, stream):
-    _kill_stream_seq(ctx, stream, False)
-    _kill_stream_seq(ctx, stream, True)
+def inject_buffer(ctx, conn, index, buff):
+    if conn.l4_proto == NL_TYPE_TCP:
+        proto = 'tcp'
+    elif conn.l4_proto == NL_TYPE_UDP:
+        proto = 'udp'
+    else:
+        return False
+
+    mpkt = MetaPacket.new('ip') / MetaPacket.new(proto)
+
+    if index == 0:
+        mpkt.l3_src = conn.l3_addr1
+        mpkt.l3_dst = conn.l3_addr2
+
+        mpkt.l4_src = conn.l4_addr1
+        mpkt.l4_dst = conn.l4_addr2
+    else:
+        mpkt.l3_src = conn.l3_addr2
+        mpkt.l3_dst = conn.l3_addr1
+
+        mpkt.l4_src = conn.l4_addr2
+        mpkt.l4_dst = conn.l4_addr1
+
+    mpkt.l4_proto = conn.l4_proto
+
+    mpkt.set_fields('ip', {
+        'src' : mpkt.l3_src,
+        'dst' : mpkt.l3_dst})
+    mpkt.set_fields(proto, {
+        'sport' : mpkt.l4_src,
+        'dport' : mpkt.l4_dst})
+
+    mpkt.inject = buff
+    mpkt.inject_len = len(buff)
+
+    index += 2
+    conn.flags = CN_INJECTED
+    conn.buffers.append((index, buff))
+
+    ctx.inject_buffer(mpkt)
+
+    return True
+
+def send_tcpkill(ctx, src, dst, sport, dport, seq):
+    mpkt = MetaPacket.new('ip') / MetaPacket.new('tcp')
+
+    mpkt.set_fields('ip', {
+        'src' : src,
+        'dst' : dst})
+
+    mpkt.set_fields('tcp', {
+        'sport' : sport,
+        'dport' : dport,
+        'seq' : seq,
+        'ack' : 0,
+        'flags' : TH_RST})
+
+    ctx.si_l3(mpkt)
+
+def kill_connection(ctx, conn):
+    if conn.l4_proto != NL_TYPE_TCP:
+        log.debug('I can kill only TCP connections')
+        return False
+
+    ident = TCPIdent(conn.l3_addr1, conn.l3_addr2,
+                     conn.l4_addr1, conn.l4_addr2)
+
+    sess = SessionManager().get_session(ident)
+
+    if not sess:
+        log.debug('Cannot find the TCP session')
+        return False
+
+    if ident.l3_src == sess.ident.l3_src:
+        status = sess.data[1]
+        ostatus = sess.data[0]
+    else:
+        status = sess.data[0]
+        ostatus = sess.data[1]
+
+    send_tcpkill(ctx, conn.l3_addr1, conn.l3_addr2,
+                 conn.l4_addr1, conn.l4_addr2, ostatus.last_ack)
+    send_tcpkill(ctx, conn.l3_addr2, conn.l3_addr1,
+                 conn.l4_addr2, conn.l4_addr1, status.last_ack)
+
+    return True
 
 class InjectDialog(gtk.Dialog):
-    def __init__(self, stream, inj_file=False):
+    def __init__(self, conn, inj_file=False):
         gtk.Dialog.__init__(self, _('Active connections'), PMApp().main_window,
                             gtk.DIALOG_DESTROY_WITH_PARENT,
@@ -99 +156 @@
         tbl = gtk.Table(2, 2, False)
 
-        self.rsrc = gtk.RadioButton(None, '%s:%d' % (stream.get_source(),
-                                                     stream.sport))
-        self.rdst = gtk.RadioButton(self.rsrc, '%s:%d' % (stream.get_dest(),
-                                                          stream.dport))
+        self.rsrc = gtk.RadioButton(None, '%s:%d' % (conn.l3_addr1,
+                                                     conn.l4_addr1))
+        self.rdst = gtk.RadioButton(self.rsrc, '%s:%d' % (conn.l3_addr2,
+                                                          conn.l4_addr2))
         self.rdst.set_active(True)
 
@@ -147 +204 @@
 
     def get_inject_data(self):
-        is_client = self.rsrc.get_active()
+        if self.rsrc.get_active():
+            index = 1
+        else:
+            index = 0
 
         if hasattr(self, 'entry'):
@@ -153 +213 @@
 
             try:
-                return is_client, open(fname, 'r').read()
+                return index, open(fname, 'r').read()
             except:
-                return is_client, None
+                return index, None
         else:
-            return is_client, self.view.get_buffer().get_text(
+            return index, self.view.get_buffer().get_text(
                 *self.view.get_buffer().get_bounds()
             )
@@ -164 +224 @@
     tagtable = None
 
-    def __init__(self, connw, stream):
+    def __init__(self, connw, conn):
         gtk.VBox.__init__(self, False, 2)
 
-        self.stream = stream
         self.connw = connw
-
-        # This is for data collected
-        # Everything is saved in the form (is_client : bool, data : str)
-        self.data_frags = []
-
-        # This is for data to inject
-        self.client_inj_frags = []
-        self.server_inj_frags = [
-            #'USER test injection test :Tester\r\n',
-            #'PING :pingthis\r\n'
-        ]
+        self.conn = conn
+        self.conn.flags |= CN_VIEWING
+        self.index = 0
 
         if not self.tagtable:
+            # Create tag table if not yet allocated
             self.tagtable = gtk.TextTagTable()
 
             tag = gtk.TextTag('src')
             tag.set_property('foreground', 'blue')
-            tag.set_property('font', 'Monospace 9')
             self.tagtable.add(tag)
 
             tag = gtk.TextTag('dst')
             tag.set_property('foreground', 'red')
-            tag.set_property('font', 'Monospace 9')
+            self.tagtable.add(tag)
+
+            tag = gtk.TextTag('srcinj')
+            tag.set_property('weight', pango.WEIGHT_BOLD)
+            tag.set_property('foreground', 'blue')
+            self.tagtable.add(tag)
+
+            tag = gtk.TextTag('dstinj')
+            tag.set_property('weight', pango.WEIGHT_BOLD)
+            tag.set_property('foreground', 'red')
             self.tagtable.add(tag)
 
@@ -198 +258 @@
         self.view.set_wrap_mode(gtk.WRAP_CHAR)
         self.view.set_editable(False)
+        self.view.modify_font(pango.FontDescription('Monospace 9'))
 
         sw = gtk.ScrolledWindow()
@@ -240 +301 @@
 
     def __on_kill(self, btn):
-        kill_stream(self.connw.session.context, self.stream)
+        kill_connection(self.connw.session.context, self.conn)
 
     def __on_inject(self, btn, is_file):
-        dialog = InjectDialog(self.stream, is_file)
+        dialog = InjectDialog(self.conn, is_file)
 
         if dialog.run() == gtk.RESPONSE_ACCEPT:
-            is_client, data = dialog.get_inject_data()
+            index, data = dialog.get_inject_data()
 
             if data:
-                if is_client:
-                    self.client_inj_frags.append(data)
-                else:
-                    self.server_inj_frags.append(data)
+                inject_buffer(self.connw.session.context, self.conn, index, data)
 
         dialog.hide()
         dialog.destroy()
 
+    def update(self):
+        if not self.conn:
+            return
+
+        tags = ('src', 'dst', 'dstinj', 'srcinj')
+
+        if self.index > len(self.conn.buffers):
+            self.index = 0
+            self.buff.set_text('')
+
+        while self.index < len(self.conn.buffers):
+            is_client, buff = self.conn.buffers[self.index]
+            self.buff.insert_with_tags(self.buff.get_end_iter(),
+                                       escape_raw(buff),
+                                       self.tagtable.lookup(tags[is_client]))
+
+            self.index += 1
+
 class ConnectionsWindow(gtk.Dialog):
-    def __init__(self, reassembler):
-        self.session = None
-        self.reassembler = reassembler
-
-        self.stream_dict = {}
+    def __init__(self, session):
+        self.session = session
+
         self.following = {}
-
-        self.status_string = (_('established'), _('active'), _('reset'),
-                              _('closed'), _('timed out'), _('idle'))
 
         gtk.Dialog.__init__(self, _('Active connections'), PMApp().main_window,
@@ -330 +401 @@
 
         self.update_id = None
+        self.last_conn = None
         self.set_size_request(400, 200)
 
@@ -336 +408 @@
             gobject.timeout_add(1000, self.__on_update_tree)
 
-    def add_connection(self, stream):
-        if stream in self.stream_dict and self.stream_dict[stream][0] is stream:
-            self.remove_connection(stream)
-
+    def add_connection(self, conn):
         self.store.append(
-            [stream.get_source(), stream.sport, stream.get_dest(), stream.dport,
-             'TCP', stream.state, stream.get_bytes(), stream]
+            [conn.l3_addr1, conn.l4_addr1,
+             conn.l3_addr2, conn.l4_addr2,
+             conn.l4_proto == NL_TYPE_TCP and 'TCP' or 'UDP',
+             conn.status, conn.xferred, conn]
         )
-
-        path = self.store.iter_n_children(None) - 1
-        self.stream_dict[stream] = (stream, path)
-
-        # DEBUG: remove me after injection is complete
-        #if stream.sport in (6667, 80) or stream.dport in (6667, 80):
-            #details = TabDetails(self.session, stream)
-            #details.show_all()
-
-            #self.following[stream] = details
-
-            #self.notebook.append_page(details, gtk.Label('%s:%d <-> %s:%d' \
-                #% (stream.get_source(), stream.sport,
-                   #stream.get_dest(), stream.dport)))
-
-        log.debug('Connection added')
-
-    def remove_connection(self, stream):
-        if stream in self.stream_dict:
-            return
-
-        idx = self.stream_dict[stream][1]
-
-        del self.stream_dict[stream]
-
-        self.store[idx][COLUMN_OBJECT] = (stream.get_bytes(), stream.state)
-
-        log.debug('Reference removed')
+        self.last_conn = conn
 
     def remove_tab_details(self, tab):
@@ -379 +423 @@
         self.notebook.remove_page(pagenum)
 
-        if tab.stream in self.following:
-            del self.following[tab.stream]
+        if tab.conn in self.following:
+            tab.conn &= ~CN_VIEWING
+            del self.following[tab.conn]
 
     def get_extern_iter(self, top=True):
@@ -406 +451 @@
 
         if iter:
-            stream = self.store.get_value(iter, COLUMN_OBJECT)
-
-            if stream and not isinstance(stream, (tuple, int)):
-                details = TabDetails(self, stream)
+            conn = self.store.get_value(iter, COLUMN_OBJECT)
+
+            if conn and not isinstance(conn, (tuple, int)):
+                details = TabDetails(self, conn)
                 details.show_all()
 
-                self.following[stream] = details
+                self.following[conn] = details
 
                 self.notebook.append_page(details, gtk.Label('%s:%d <-> %s:%d' \
-                    % (stream.get_source(), stream.sport,
-                       stream.get_dest(), stream.dport)))
+                    % (conn.l3_addr1, conn.l4_addr1,
+                       conn.l3_addr2, conn.l4_addr2)))
 
     def __on_kill(self, action):
@@ -423 +468 @@
 
         if iter:
-            stream = self.store.get_value(iter, COLUMN_OBJECT)
-
-            if stream and not isinstance(stream, (tuple, int)):
-                kill_stream(self.session.context, stream)
+            conn = self.store.get_value(iter, COLUMN_OBJECT)
+
+            if conn and not isinstance(conn, (tuple, int)):
+                kill_connection(self.session.context, conn)
 
     def __on_clear(self, action):
-        self.stream_dict.clear()
         self.store.clear()
+        self.last_conn = None
 
     def __on_button_pressed(self, widget, evt):
@@ -440 +485 @@
 
         if iter:
-            stream = self.store.get_value(iter, COLUMN_OBJECT)
-
-            if stream and not isinstance(stream, (tuple, int)):
+            conn = self.store.get_value(iter, COLUMN_OBJECT)
+
+            if conn and not isinstance(conn, (tuple, int)):
                 self.menu.show()
                 self.menu.popup(None, None, None, evt.button, evt.time, None)
@@ -450 +495 @@
 
         if page == 0:
-            #log.debug('Updating tree view (%d connections)' % \
-            #          self.store.iter_n_children(None))
+            log.debug('Updating tree view (%d connections)' % \
+                      self.store.iter_n_children(None))
+
+            for row in self.store:
+                if row[COLUMN_OBJECT] is None:
+                    self.store.remove(row.iter)
 
             start, end = self.get_extern_iter(), self.get_extern_iter(False)
 
-            if not start:
-                return True
-
-            while start != end:
+            while start and start != end:
                 try:
-                    stream = self.store.get_value(start, COLUMN_OBJECT)
+                    conn = self.store.get_value(start, COLUMN_OBJECT)
                 except Exception, err:
-                    return True
-
-                if isinstance(stream, tuple):
-                    self.store.set_value(start, COLUMN_BYTES, stream[0])
-                    self.store.set_value(start, COLUMN_STATUS, stream[1])
+                    break
+
+                if isinstance(conn, tuple):
+                    self.store.set_value(start, COLUMN_BYTES, conn[0])
+                    self.store.set_value(start, COLUMN_STATUS, conn[1])
                     self.store.set_value(start, COLUMN_OBJECT, None)
-                elif stream is not None:
-                    old_bytes = self.store.get_value(start, COLUMN_BYTES)
-                    new_bytes = stream.get_bytes()
-
-                    if old_bytes == new_bytes:
-                        self.store.set_value(start, COLUMN_STATUS, CONN_IDLE)
-                    else:
-                        self.store.set_value(start, COLUMN_STATUS, stream.state)
-                        self.store.set_value(start, COLUMN_BYTES, new_bytes)
+                elif conn is not None:
+                    self.store.set_value(start, COLUMN_BYTES, conn.xferred)
+                    self.store.set_value(start, COLUMN_STATUS, conn.status)
 
                 start = self.store.iter_next(start)
+
+            # Ok now let's add newer connections
+            conn_man = self.session.context.audit_dispatcher.\
+                     get_connection_manager()
+
+            try:
+                idx = conn_man.conn_list.index(self.last_conn) + 1
+            except ValueError, exc:
+                idx = 0
+
+            while idx < len(conn_man.conn_list):
+                self.add_connection(conn_man.conn_list[idx])
+                idx += 1
+
         else:
             page = self.notebook.get_nth_page(page)
@@ -485 +539 @@
                 return True
 
-            #log.debug('Adding missing fragments %s' % page.data_frags)
-
-            while page.data_frags:
-                is_client, data = page.data_frags.pop(0)
-
-                page.buff.insert_with_tags(
-                    page.buff.get_end_iter(), escape_raw(data),
-                    page.tagtable.lookup((is_client and 'src' or 'dst')),
-                )
+            page.update()
 
         return True
@@ -500 +546 @@
         idx = model.get_value(iter, COLUMN_STATUS)
 
-        assert idx >= 0 and idx <= 5, 'Status id cannot be %d' % idx
-
-        cell.set_property('text', self.status_string[idx])
+        if idx == CN_IDLE:      out = 'idle'
+        elif idx == CN_OPENING: out = 'opening'
+        elif idx == CN_OPEN:    out = 'open'
+        elif idx == CN_ACTIVE:  out = 'active'
+        elif idx == CN_CLOSING: out = 'closing'
+        elif idx == CN_CLOSED:  out = 'closed'
+        elif idx == CN_KILLED:  out = 'killed'
+
+        cell.set_property('text', out)
 
     def __on_response(self, dialog, rid):
@@ -513 +565 @@
 class Injector(Plugin, ActiveAudit):
     def start(self, reader):
-        tcpdecoder = Core().get_need(reader, 'TCPDecoder')
-
-        if not tcpdecoder:
-            raise PMErrorException('TCPDecoder plugin not loaded.')
-
-        if not tcpdecoder.reassembler:
-            raise PMErrorException('TCP segments reassembling disabled '
-                                   'in TCPDecoder.')
-
-        tcpdecoder.reassembler.analyzers.insert(0, self.__tcp_callback)
-
         self.item = self.add_menu_entry('Injector', _('Active connections'),
                                         _('View active connections or inject '
                                           'data in active one'),
                                         gtk.STOCK_INDEX)
-
-        self.window = ConnectionsWindow(tcpdecoder.reassembler)
-        # DEBUG:
-        #self.window.show()
-        #self.window.start_update()
+        self.window = None
 
     def stop(self):
@@ -539 +576 @@
 
     def execute_audit(self, sess, inp_dict):
-        self.window.session = sess
+        if self.window is None:
+            self.window = ConnectionsWindow(sess)
 
         if not self.window.flags() & gtk.VISIBLE:
             self.window.show()
             self.window.start_update()
-
-    def __tcp_callback(self, stream, mpkt):
-        # DEBUG: remove me
-        #if stream.sport in (6667, 80) or stream.dport in (6667, 80):
-        self.window.add_connection(stream)
-        stream.listeners.append(self.__follow_connection)
-
-    def __follow_connection(self, stream, mpkt, rcv):
-        if stream.state != CONN_DATA:
-            self.window.remove_connection(stream)
-
-        elif stream in self.window.following:
-            page = self.window.following[stream]
-
-            log.debug('Collecting data for %s' % stream)
-
-            if rcv is stream.server:
-                data = stream.server.data[-stream.server.count_new:]
-
-                if data:
-                    page.data_frags.append((0, data))
-
-                if page.server_inj_frags:
-                    inj_data = page.server_inj_frags.pop(0)
-                    mpkt.set_cfield('inj::payload', inj_data)
-
-                    return INJ_MODIFIED
-            else:
-                data = stream.client.data[-stream.client.count_new:]
-
-                if data:
-                    page.data_frags.append((1, data))
-
-                if page.client_inj_frags:
-                    inj_data = page.client_inj_frags.pop(0)
-                    mpkt.set_cfield('inj::payload', inj_data)
-
-                    return INJ_MODIFIED
-
-            return INJ_COLLECT_DATA
-
-        return INJ_COLLECT_STATS
 
 __plugins__ = [Injector]