path: root/package/osiris/patches/mod_if.patch

Description: 	The mod_if module monitors various aspects of network 
		interfaces for change, including IP, Hardware Address, 
		broadcast, MTU, metric, and promiscuous mode.
Version: 	0.2

diff -ruN osiris-4.1.9-old/src/osirisd/modules/mod_if/Makefile osiris-4.1.9-new/src/osirisd/modules/mod_if/Makefile
--- osiris-4.1.9-old/src/osirisd/modules/mod_if/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ osiris-4.1.9-new/src/osirisd/modules/mod_if/Makefile	2005-10-07 02:19:17.000000000 +0200
@@ -0,0 +1,16 @@
+
+include ../Makefile
+
+SRCS=mod_if.c
+OBJS=$(SRCS:.c=.o)
+
+module: ${SRCS} ${OBJS}
+
+INCS=-I../.. -I../../../libosiris -I../../../libfileapi -I../../../..
+
+# meta-rule for compiling any "C" source file.
+$(OBJS): $(SRCS)
+	$(CC) $(DEFS) $(DEFAULT_INCLUDES) ${INCLUDES} ${INCS} $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS)  $(CFLAGS) -c $(SRCS)
+	cp $@ ..
+
diff -ruN osiris-4.1.9-old/src/osirisd/modules/mod_if/README osiris-4.1.9-new/src/osirisd/modules/mod_if/README
--- osiris-4.1.9-old/src/osirisd/modules/mod_if/README	1970-01-01 01:00:00.000000000 +0100
+++ osiris-4.1.9-new/src/osirisd/modules/mod_if/README	2005-10-07 02:19:17.000000000 +0200
@@ -0,0 +1,42 @@
+
+Module: mod_if
+Author: Brian Wotring (brian@hostintegrity.com)
+
+
+
+DESCRIPTION:
+
+The mod_if module is designed originally to monitor the promisc flag
+on network interfaces, but quickly turned into being able to monitor
+various aspects of network interfaces including hardware address,
+IP address, broadcast, MTU, and metric.
+
+This module is somewhat different in that each record is an element
+about a network interface as opposed to one record per interface. This
+will make it easier to add more elements to be monitored, easier to
+filter, and easier to understand alerts.
+
+USE:
+
+To use this module, all  that is needed is to include it in the Modules
+block of a scan configuration, e.g.:
+
+    <Modules>
+    ...
+    Include mod_if
+    ...
+    </Modules>
+
+
+PARAMETERS:
+
+There are no parameters for this module.
+
+PLATFORMS:
+
+Currently, this module is only implemented for Linux.    
+
+NOTES:
+
+
+
diff -ruN osiris-4.1.9-old/src/osirisd/modules/mod_if/mod_if.c osiris-4.1.9-new/src/osirisd/modules/mod_if/mod_if.c
--- osiris-4.1.9-old/src/osirisd/modules/mod_if/mod_if.c	1970-01-01 01:00:00.000000000 +0100
+++ osiris-4.1.9-new/src/osirisd/modules/mod_if/mod_if.c	2005-10-07 02:19:17.000000000 +0200
@@ -0,0 +1,317 @@
+
+/******************************************************************************
+**
+**  Copyright (C) 2005 Brian Wotring.
+**
+**  This program is free software; you can redistribute it and/or
+**  modify it, however, you cannot sell it.
+**
+**  This program is distributed in the hope that it will be useful,
+**  but WITHOUT ANY WARRANTY; without even the implied warranty of
+**  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+**
+**  You should have received a copy of the license attached to the
+**  use of this software.  If not, view a current copy of the license
+**  file here:
+**
+**      http://www.hostintegrity.com/osiris/LICENSE
+**
+******************************************************************************/
+
+/*****************************************************************************
+**
+**  File:    mod_if.c
+**  Date:    September 23, 2005
+**
+**  Author:  Brian Wotring
+**  Purpose: platform specific methods for monitoring network devices.
+**
+******************************************************************************/
+
+
+/* CODE USED IN THIS MODULE WAS ORIGINALLY TAKEN FROM: 
+*
+*   http://mail.nl.linux.org/kernelnewbies/2003-05/msg00090.html
+*/
+
+static const char *MODULE_NAME = "mod_if";
+
+
+#ifndef WIN32
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#ifndef WIN32
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <net/if.h>
+#endif
+
+#include <sys/ioctl.h>
+#include <net/if_arp.h>
+#include <arpa/inet.h>
+
+
+#include "libosiris.h"
+#include "libfileapi.h"
+#include "rootpriv.h"
+#include "common.h"
+#include "version.h"
+
+#include "scanner.h"
+#include "logging.h"
+
+
+#define inaddrr(x) (*(struct in_addr *) &ifr->x[sizeof sa.sin_port])
+#define IFRSIZE   ((int)(size * sizeof (struct ifreq)))
+
+void process_if_unix( SCANNER *scanner )
+{
+    unsigned char*u;
+    int    sockfd, size  = 1;
+    struct ifreq *ifr;
+    struct ifconf ifc;
+    struct sockaddr_in sa;
+
+    SCAN_RECORD_TEXT_1 record;
+
+    /* Make sure we are able to create sockets */
+    
+    if ( (sockfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_IP)) < 0 )
+    {
+        log_error( "mod_if unable to create socket!" );
+        return;
+    }
+
+    ifc.ifc_len = IFRSIZE;
+    ifc.ifc_req = NULL;
+
+    do
+    {
+        ++size;
+
+        /* realloc buffer size until no overflow occurs  */
+        
+        if ((ifc.ifc_req = realloc(ifc.ifc_req, IFRSIZE)) == NULL )
+        {
+            log_error( "out of memory!!!" );
+            return;
+        }
+
+        ifc.ifc_len = IFRSIZE;
+
+        if (ioctl(sockfd, SIOCGIFCONF, &ifc))
+        {
+            log_error("ioctl failure: SIOCFIFCONF");
+            return;
+        }
+
+    } while (IFRSIZE <= ifc.ifc_len);
+
+    ifr = ifc.ifc_req;
+
+    for (;(char *) ifr < (char *) ifc.ifc_req + ifc.ifc_len; ++ifr)
+    {
+        if (ifr->ifr_addr.sa_data == (ifr+1)->ifr_addr.sa_data)
+        {
+            continue;  /* duplicate, skip it */
+        }
+
+        if (ioctl(sockfd, SIOCGIFFLAGS, ifr))
+        {
+            continue;  /* failed to get flags, skip it */
+        }
+
+        initialize_scan_record( (SCAN_RECORD *)&record,
+                                SCAN_RECORD_TYPE_TEXT_1 );
+
+        osi_strlcpy( record.module_name, MODULE_NAME,
+                     sizeof( record.module_name ) );
+
+        osi_snprintf( record.name, sizeof( record.name ),
+                      "if:%s:IP", ifr->ifr_name );
+
+        osi_snprintf( record.data, sizeof( record.data ),
+                      "%s", inet_ntoa(inaddrr(ifr_addr.sa_data)));
+
+        send_scan_data( scanner, (SCAN_RECORD *)&record );
+
+    /*
+     * This won't work on HP-UX 10.20 as there's no SIOCGIFHWADDR ioctl. You'll
+     * need to use DLPI or the NETSTAT ioctl on /dev/lan0, etc (and you'll need
+     *  to be root to use the NETSTAT ioctl. Also this is deprecated and doesn't
+     *     work on 11.00).
+     *
+     * On Digital Unix you can use the SIOCRPHYSADDR ioctl according to an old
+     * utility I have. Also on SGI I think you need to use a raw socket, e.g. s
+     * = socket(PF_RAW, SOCK_RAW, RAWPROTO_SNOOP)
+     *
+     * Dave
+     *
+     * From: David Peter <dave.peter@eu.citrix.com>
+     **/
+
+        if ( ioctl(sockfd, SIOCGIFHWADDR, ifr) == 0 )
+        {
+            /* Select which  hardware types to process.
+             **
+             **    See list in system include file included from
+             **    /usr/include/net/if_arp.h  (For example, on
+             **    Linux see file /usr/include/linux/if_arp.h to
+             **    get the list.)
+             **/
+
+            switch (ifr->ifr_hwaddr.sa_family)
+            {
+                default:
+                    continue;
+
+                case  ARPHRD_NETROM:
+                case  ARPHRD_ETHER:
+                case  ARPHRD_PPP:
+                case  ARPHRD_EETHER:
+                case  ARPHRD_IEEE802:
+                    break;
+            }
+
+            u = (unsigned char *) &ifr->ifr_addr.sa_data;
+
+            /* send record for MAC for this interface */
+
+            if (u[0] + u[1] + u[2] + u[3] + u[4] + u[5])
+            {
+                initialize_scan_record( (SCAN_RECORD *)&record,
+                                    SCAN_RECORD_TYPE_TEXT_1 );
+
+                osi_strlcpy( record.module_name, MODULE_NAME,
+                         sizeof( record.module_name ) );
+
+                osi_snprintf( record.name, sizeof( record.name ),
+                    "if:%s:MAC", ifr->ifr_name );
+
+                osi_snprintf( record.data, sizeof( record.data ),
+                        "%2.2x.%2.2x.%2.2x.%2.2x.%2.2x.%2.2x",
+                        u[0], u[1], u[2], u[3], u[4], u[5]);
+
+                send_scan_data( scanner, (SCAN_RECORD *)&record );
+            }
+        }
+
+        if ( ioctl(sockfd, SIOCGIFNETMASK, ifr) == 0 &&
+             strcmp("255.255.255.255", inet_ntoa(inaddrr(ifr_addr.sa_data))))
+        {
+            initialize_scan_record( (SCAN_RECORD *)&record,
+                                SCAN_RECORD_TYPE_TEXT_1 );
+
+            osi_strlcpy( record.module_name, MODULE_NAME,
+                         sizeof( record.module_name ) );
+
+            osi_snprintf( record.name, sizeof( record.name ),
+                "if:%s:NETMASK", ifr->ifr_name );
+
+            osi_snprintf( record.data, sizeof( record.data ),
+                "%s", inet_ntoa(inaddrr(ifr_addr.sa_data)));
+
+            send_scan_data( scanner, (SCAN_RECORD *)&record );
+        }
+
+        if (ifr->ifr_flags & IFF_BROADCAST)
+        {
+            if ( ioctl(sockfd, SIOCGIFBRDADDR, ifr) == 0 &&
+                 strcmp("0.0.0.0", inet_ntoa(inaddrr(ifr_addr.sa_data))))
+            {
+
+                initialize_scan_record( (SCAN_RECORD *)&record,
+                                        SCAN_RECORD_TYPE_TEXT_1 );
+
+                osi_strlcpy( record.module_name, MODULE_NAME,
+                     sizeof( record.module_name ) );
+
+                osi_snprintf( record.name, sizeof( record.name ),
+                    "if:%s:BROADCAST", ifr->ifr_name );
+
+                osi_snprintf( record.data, sizeof( record.data ),
+                    "%s",inet_ntoa(inaddrr(ifr_addr.sa_data)));
+
+                send_scan_data( scanner, (SCAN_RECORD *)&record );
+            }
+        }
+
+        /* Added by David Vasil to check for Promiscuous mode */
+
+        initialize_scan_record( (SCAN_RECORD *)&record,
+                                SCAN_RECORD_TYPE_TEXT_1 );
+
+        osi_strlcpy( record.module_name, MODULE_NAME,
+                     sizeof( record.module_name ) );
+
+
+        osi_snprintf( record.name, sizeof( record.name ),
+                      "if:%s:PROMISC", ifr->ifr_name );
+
+        if ( ioctl(sockfd, SIOCGIFFLAGS, ifr) == 0 &&
+             ifr->ifr_flags & IFF_PROMISC)
+        {
+            osi_strlcpy( record.data, "ENABLED", sizeof( record.data ) );
+        }
+
+        else
+        {
+            osi_strlcpy( record.data, "DISABLED", sizeof( record.data ) );
+        }
+
+        send_scan_data( scanner, (SCAN_RECORD *)&record );
+
+
+        if ( ioctl(sockfd, SIOCGIFMTU, ifr) == 0 )
+        {
+            initialize_scan_record( (SCAN_RECORD *)&record,
+                                    SCAN_RECORD_TYPE_TEXT_1 );
+
+            osi_strlcpy( record.module_name, MODULE_NAME,
+                         sizeof( record.module_name ) );
+
+            osi_snprintf( record.name, sizeof( record.name ),
+                "if:%s:MTU", ifr->ifr_name );
+
+            osi_snprintf( record.data, sizeof( record.data ),
+                "%u", ifr->ifr_mtu );
+
+            send_scan_data( scanner, (SCAN_RECORD *)&record );
+        }
+
+        if ( ioctl(sockfd, SIOCGIFMETRIC, ifr) == 0 )
+        {
+            initialize_scan_record( (SCAN_RECORD *)&record,
+                                    SCAN_RECORD_TYPE_TEXT_1 );
+
+            osi_strlcpy( record.module_name, MODULE_NAME,
+                         sizeof( record.module_name ) );
+
+            osi_snprintf( record.name, sizeof( record.name ),
+                "if:%s:METRIC", ifr->ifr_name );
+
+            osi_snprintf( record.data, sizeof( record.data ),
+                "%u", ifr->ifr_metric );
+
+            send_scan_data( scanner, (SCAN_RECORD *)&record );
+        }
+    }
+
+    close(sockfd);
+}
+
+void mod_if( SCANNER *scanner )
+{
+#if defined(SYSTEM_LINUX)
+    process_if_unix( scanner );
+#endif
+
+}