33 #include <arpa/inet.h> 39 #include <openvas/base/openvas_hosts.h> 40 #include <openvas/base/openvas_networking.h> 41 #include <openvas/misc/openvas_proctitle.h> 42 #include <openvas/base/kb.h> 43 #include <openvas/misc/network.h> 44 #include <openvas/misc/nvt_categories.h> 45 #include <openvas/misc/pcap_openvas.h> 46 #include <openvas/misc/prefs.h> 47 #include <openvas/misc/internal_com.h> 49 #include <openvas/base/nvticache.h> 65 #define ERR_HOST_DEAD -1 66 #define ERR_CANT_FORK -2 68 #define MAX_FORK_RETRIES 10 77 #define PROGRESS_BAR_STYLE 1 109 comm_send_status (
int soc,
char *
hostname,
int curr,
int max)
113 if (soc < 0 || soc > 1024)
116 if (strlen (
hostname) > (
sizeof (buffer) - 50))
119 snprintf (buffer,
sizeof (buffer),
120 "SERVER <|> STATUS <|> %s <|> %d/%d <|> SERVER\n",
123 internal_send (soc, buffer, INTERNAL_COMM_MSG_TYPE_DATA);
129 error_message_to_client (
int soc,
const char *msg,
const char *
hostname,
132 send_printf (soc,
"SERVER <|> ERRMSG <|> %s <|> %s <|> %s <|> <|> SERVER\n",
134 msg ? msg :
"No error.");
138 report_kb_failure (
int soc,
int errcode)
142 errcode = abs (errcode);
143 msg = g_strdup_printf (
"WARNING: Cannot connect to KB at '%s': %s'",
144 prefs_get (
"kb_location"), strerror (errcode));
146 error_message_to_client (soc, msg, NULL, NULL);
155 now = then = time (NULL);
156 while (now - then < n)
158 waitpid (-1, NULL, WNOHANG);
165 network_scan_status (
struct arglist *globals)
169 nss = arg_get_value (globals,
"network_scan_status");
173 if (g_ascii_strcasecmp (nss,
"busy") == 0)
175 else if (g_ascii_strcasecmp (nss,
"done") == 0)
192 all_scans_are_stopped ()
205 nvti_category_is_safe (
int category)
208 if (category == ACT_DESTRUCTIVE_ATTACK || category == ACT_KILL_HOST
209 || category == ACT_FLOOD || category == ACT_DENIAL)
228 char *
hostname,
struct host_info *hostinfos, kb_t kb)
230 int optimize = prefs_get_bool (
"optimize_test");
233 gboolean network_scan = FALSE;
236 category = nvticache_get_category (oid);
237 name = nvticache_get_filename (oid);
238 if (scan_is_stopped () || all_scans_are_stopped())
240 if (category != ACT_LAST)
247 log_write (
"Stopped scan wrap-up: Launching %s (%s)", name, oid);
250 if (network_scan_status (globals) ==
NSS_BUSY)
258 if (prefs_get_bool (
"safe_checks") && !nvti_category_is_safe (category))
260 if (prefs_get_bool (
"log_whole_attack"))
262 (
"Not launching %s (%s) against %s because safe checks are" 263 " enabled (this is not an error)", name, oid,
hostname);
274 snprintf (asc_id,
sizeof (asc_id),
"Launched/%s", oid);
276 if (kb_item_get_int (kb, asc_id) > 0)
278 if (prefs_get_bool (
"log_whole_attack"))
279 log_write (
"Not launching %s against %s because it has already " 280 "been lanched in the past (this is not an error)",
288 kb_item_add_int (kb, asc_id, 1);
297 error =
"because a mandatory key is missing";
300 if (kb_item_get_int (kb,
"Host/dead") > 0)
316 src = nvticache_get_src (oid);
327 if (prefs_get_bool (
"log_whole_attack"))
334 if (prefs_get_bool (
"log_whole_attack"))
336 (
"Not launching %s (%s) against %s %s (this is not an error)",
348 kb_duplicate(kb_t dst, kb_t src,
const gchar *filter)
350 struct kb_item *items, *p_itm;
352 items = kb_item_get_pattern(src, filter ? filter :
"*");
353 for (p_itm = items; p_itm != NULL; p_itm = p_itm->next)
357 newname = strstr(p_itm->name,
"/");
359 newname = p_itm->name;
363 kb_item_add_str(dst, newname, p_itm->v_str);
381 init_host_kb (
struct arglist *globals,
char *
hostname,
382 struct host_info *hostinfos, kb_t *network_kb)
385 gchar *vhosts, *hostname_pattern, *hoststr;
387 const gchar *kb_path = prefs_get (
"kb_location");
389 struct in6_addr *hostip;
391 nss = network_scan_status (globals);
392 soc = arg_get_value_int (globals,
"global_socket");
396 rc = kb_new (&kb, kb_path);
399 report_kb_failure (soc, rc);
403 hostname_pattern = g_strdup_printf (
"%s/*",
hostname);
404 kb_duplicate(kb, *network_kb, hostname_pattern);
405 g_free(hostname_pattern);
409 assert (network_kb != NULL);
410 assert (*network_kb != NULL);
415 rc = kb_new (&kb, kb_path);
418 report_kb_failure (soc, rc);
424 hoststr = hostinfos->fqdn;
426 kb_item_add_str (kb,
"Hostname", hoststr);
427 hostip = hostinfos->ip;
430 char ipstr[INET6_ADDRSTRLEN];
432 if (IN6_IS_ADDR_V4MAPPED (hostip))
433 inet_ntop (AF_INET, ((
char *) (hostip)) + 12, ipstr,
sizeof (ipstr));
435 inet_ntop (AF_INET6, hostip, ipstr,
sizeof (ipstr));
436 kb_item_add_str (kb,
"Host-IP", ipstr);
440 vhosts = hostinfos->vhosts;
443 gchar **vhosts_array = g_strsplit (vhosts,
",", 0);
446 for (i = 0; vhosts_array[i] != NULL; i++)
447 kb_item_add_str (kb,
"hostinfos/vhosts", vhosts_array[i]);
449 g_strfreev (vhosts_array);
459 attack_host (
struct arglist *globals,
struct host_info *hostinfos,
463 int num_plugs, forks_retry = 0, global_socket;
466 proctitle_set (
"openvassd: testing %s", hostinfos->name);
468 global_socket = arg_get_value_int (globals,
"global_socket");
469 kb = init_host_kb (globals,
hostname, hostinfos, net_kb);
495 static int last_status = 0, cur_plug = 0;
498 e = launch_plugin (globals, plugin,
hostname, hostinfos, kb);
508 (buffer,
sizeof (buffer),
509 "SERVER <|> LOG <|> %s <|> general/Host_Details" 510 " <|> <host><detail><name>Host dead</name>" 511 "<value>1</value><source><description/><type/>" 512 "<name/></source></detail></host> <|> <|> SERVER\n",
514 #if (PROGRESS_BAR_STYLE == 1) 518 comm_send_status(global_socket,
hostname, 0, -1);
520 internal_send (global_socket, buffer,
521 INTERNAL_COMM_MSG_TYPE_DATA);
529 log_write (
"fork() failed - sleeping %d seconds (%s)",
530 forks_retry, strerror (errno));
531 fork_sleep (forks_retry);
536 log_write (
"fork() failed too many times - aborting");
542 if ((cur_plug * 100) / num_plugs >= last_status
543 && !scan_is_stopped () && !all_scans_are_stopped())
545 last_status = (cur_plug * 100) / num_plugs + 2;
547 (global_socket,
hostname, cur_plug, num_plugs) < 0)
555 else if (plugin == NULL)
562 if (!scan_is_stopped () && !all_scans_are_stopped())
563 comm_send_status (global_socket,
hostname, num_plugs, num_plugs);
569 if (net_kb == NULL || kb != *net_kb)
585 host_authorized (
const openvas_host_t *
host,
const struct in6_addr *addr,
586 const openvas_hosts_t *hosts_allow,
587 const openvas_hosts_t *hosts_deny)
593 if (hosts_deny && openvas_host_in_hosts (
host, addr, hosts_deny))
595 if (hosts_allow && !openvas_host_in_hosts (
host, addr, hosts_allow))
607 struct arglist *globals = args->
globals;
609 struct in6_addr hostip;
610 struct host_info *hostinfos;
611 const char *non_simult = prefs_get (
"non_simult_ports");
612 const char *vhosts = prefs_get (
"vhosts");
613 const char *vhosts_ip = prefs_get (
"vhosts_ip");
617 kb_t *net_kb = args->
net_kb;
618 openvas_hosts_t *hosts_allow, *hosts_deny;
619 openvas_hosts_t *sys_hosts_allow, *sys_hosts_deny;
625 gettimeofday (&then, NULL);
627 arg_add_value (preferences_get (),
"non_simult_ports_list", ARG_ARGLIST,
631 close (arg_get_value_int (globals,
"parent_socket"));
632 arg_del_value (globals,
"parent_socket");
633 openvas_deregister_connection (arg_get_value_int (globals,
"global_socket"));
634 arg_set_value (globals,
"global_socket", GSIZE_TO_POINTER (thread_socket));
639 if (openvas_host_get_addr6 (args->
host, &hostip) == -1)
642 error_message_to_client (thread_socket,
"Couldn't resolve hostname.",
648 hosts_allow = openvas_hosts_new (prefs_get (
"hosts_allow"));
649 hosts_deny = openvas_hosts_new (prefs_get (
"hosts_deny"));
650 if (!host_authorized (args->
host, &hostip, hosts_allow, hosts_deny))
652 error_message_to_client
653 (thread_socket,
"Host access denied.",
hostname, NULL);
657 sys_hosts_allow = openvas_hosts_new (prefs_get (
"sys_hosts_allow"));
658 sys_hosts_deny = openvas_hosts_new (prefs_get (
"sys_hosts_deny"));
659 if (!host_authorized (args->
host, &hostip, sys_hosts_allow, sys_hosts_deny))
661 error_message_to_client
662 (thread_socket,
"Host access denied (system-wide restriction.)",
664 log_write (
"Host %s access denied (sys_* preference restriction.)",
668 openvas_hosts_free (hosts_allow);
669 openvas_hosts_free (hosts_deny);
670 openvas_hosts_free (sys_hosts_allow);
671 openvas_hosts_free (sys_hosts_deny);
673 host_str = addr6_as_str (&hostip);
674 if (vhosts == NULL || vhosts_ip == NULL)
675 hostinfos = host_info_init (host_str, &hostip, NULL,
hostname);
680 txt_ip = addr6_as_str (&hostip);
681 if (strcmp (vhosts_ip, txt_ip) != 0)
684 hostinfos = host_info_init (host_str, &hostip, vhosts,
hostname);
690 attack_host (globals, hostinfos, host_str, sched, net_kb);
691 host_info_free (hostinfos);
693 if (!scan_is_stopped () && !all_scans_are_stopped ())
698 gettimeofday (&now, NULL);
699 if (now.tv_usec < then.tv_usec)
702 now.tv_usec += 1000000;
704 log_write (
"Finished testing %s (%s). Time : %ld.%.2ld secs",
705 hostname, host_str, (
long) (now.tv_sec - then.tv_sec),
706 (
long) ((now.tv_usec - then.tv_usec) / 10000));
708 shutdown (thread_socket, 2);
709 close (thread_socket);
715 apply_hosts_preferences (openvas_hosts_t *hosts)
717 const char *ordering = prefs_get (
"hosts_ordering"),
718 *exclude_hosts = prefs_get (
"exclude_hosts");
726 if (!strcmp (ordering,
"random"))
728 openvas_hosts_shuffle (hosts);
731 else if (!strcmp (ordering,
"reverse"))
733 openvas_hosts_reverse (hosts);
738 log_write (
"hosts_ordering: Sequential.");
744 int ret = openvas_hosts_exclude (hosts, exclude_hosts, 1);
747 log_write (
"exclude_hosts: Skipped %d host(s).", ret);
753 if (prefs_get_bool (
"reverse_lookup_unify"))
754 log_write (
"reverse_lookup_unify: Skipped %d host(s).",
755 openvas_hosts_reverse_lookup_unify (hosts));
758 if (prefs_get_bool (
"reverse_lookup_only"))
759 log_write (
"reverse_lookup_only: Skipped %d host(s).",
760 openvas_hosts_reverse_lookup_only (hosts));
764 str_in_comma_list (
const char *str,
const char *comma_list)
766 gchar **element, **split;
768 if (str == NULL || comma_list == NULL)
771 split = g_strsplit (comma_list,
",", 0);
775 gchar *stripped = g_strstrip (*element);
777 if (stripped && strcmp (stripped, str) == 0)
797 iface_authorized (
const char *iface)
799 const char *ifaces_list;
804 ifaces_list = prefs_get (
"ifaces_deny");
805 if (ifaces_list && str_in_comma_list (iface, ifaces_list))
807 ifaces_list = prefs_get (
"ifaces_allow");
808 if (ifaces_list && !str_in_comma_list (iface, ifaces_list))
811 ifaces_list = prefs_get (
"sys_ifaces_deny");
812 if (ifaces_list && str_in_comma_list (iface, ifaces_list))
814 ifaces_list = prefs_get (
"sys_ifaces_allow");
815 if (ifaces_list && !str_in_comma_list (iface, ifaces_list))
829 apply_source_iface_preference (
int soc)
831 const char *source_iface = prefs_get (
"source_iface");
834 if (source_iface == NULL)
837 ret = iface_authorized (source_iface);
840 gchar *msg = g_strdup_printf (
"Unauthorized source interface: %s",
842 log_write (
"source_iface: Unauthorized source interface %s.",
844 error_message_to_client (soc, msg, NULL, NULL);
851 gchar *msg = g_strdup_printf (
"Unauthorized source interface: %s" 852 " (system-wide restriction.)",
854 log_write (
"source_iface: Unauthorized source interface %s." 855 " (sys_* preference restriction.)",
857 error_message_to_client (soc, msg, NULL, NULL);
863 if (openvas_source_iface_init (source_iface))
865 gchar *msg = g_strdup_printf (
"Erroneous source interface: %s",
867 log_write (
"source_iface: Error with %s interface.", source_iface);
868 error_message_to_client (soc, msg, NULL, NULL);
875 char *ipstr, *ip6str;
876 ipstr = openvas_source_addr_str ();
877 ip6str = openvas_source_addr6_str ();
878 log_write (
"source_iface: Using %s (%s / %s).", source_iface,
888 check_kb_access (
int soc)
893 rc = kb_new (&kb, prefs_get (
"kb_location"));
895 report_kb_failure (soc, rc);
903 handle_scan_stop_signal ()
910 handle_stop_all_scans_signal ()
922 int max_hosts = 0, max_checks;
923 const char *hostlist;
924 openvas_host_t *
host;
925 int global_socket = -1;
927 int fork_retries = 0;
929 struct timeval then, now;
930 openvas_hosts_t *hosts;
932 const gchar *network_targets, *port_range;
933 gboolean network_phase = FALSE;
934 gboolean do_network_scan = FALSE;
936 gettimeofday (&then, NULL);
938 if (prefs_get_bool (
"network_scan"))
939 do_network_scan = TRUE;
941 do_network_scan = FALSE;
943 network_targets = prefs_get (
"network_targets");
944 if (network_targets != NULL)
945 arg_add_value (globals,
"network_targets", ARG_STRING,
946 (
char *) network_targets);
952 nss = network_scan_status (globals);
956 network_phase = FALSE;
960 network_phase = TRUE;
964 arg_add_value (globals,
"network_scan_status", ARG_STRING,
966 network_phase = TRUE;
973 global_socket = arg_get_value_int (globals,
"global_socket");
974 if (check_kb_access(global_socket))
978 hostlist = prefs_get (
"TARGET");
979 if (hostlist == NULL)
981 error_message_to_client (global_socket,
"Missing target hosts", NULL,
987 port_range = prefs_get (
"port_range");
988 if (validate_port_range (port_range))
990 error_message_to_client (global_socket,
"Invalid port range", NULL,
997 (prefs_get (
"plugin_set"), prefs_get_bool (
"auto_enable_dependencies"),
1005 if (network_targets == NULL)
1007 log_write (
"WARNING: In network phase, but without targets! Stopping.");
1014 log_write (
"Start a new scan. Target(s) : %s, " 1015 "in network phase with target %s",
1016 hostlist, network_targets);
1018 rc = kb_new (network_kb, prefs_get (
"kb_location"));
1021 report_kb_failure (global_socket, rc);
1025 kb_lnk_reset (*network_kb);
1030 log_write (
"Starts a new scan. Target(s) : %s, with max_hosts = %d and " 1031 "max_checks = %d", hostlist, max_hosts, max_checks);
1034 hosts = openvas_hosts_new (hostlist);
1036 apply_hosts_preferences (hosts);
1039 if (apply_source_iface_preference (global_socket) != 0)
1041 openvas_hosts_free (hosts);
1042 error_message_to_client
1043 (global_socket,
"Interface not authorized for scanning", NULL, NULL);
1046 host = openvas_hosts_next (hosts);
1055 while (
host && !scan_is_stopped () && !all_scans_are_stopped())
1062 host_str = openvas_host_value_str (
host);
1063 if (socketpair (AF_UNIX, SOCK_STREAM, 0, soc) < 0
1070 if (scan_is_stopped () || all_scans_are_stopped ())
1082 args.
net_kb = network_kb;
1094 log_write (
"fork() failed - %s. %s won't be tested",
1095 strerror (errno), host_str);
1101 "sleeping %d seconds and trying again...",
1103 fork_sleep (fork_retries);
1108 log_write (
"Testing %s (network level) [%d]",
1109 network_targets, pid);
1114 arg_set_value (
globals,
"network_scan_status",
"done");
1117 host = openvas_hosts_next (hosts);
1130 files = arg_get_value (
globals,
"files_translation");
1132 g_hash_table_destroy (files);
1135 if (all_scans_are_stopped ())
1137 error_message_to_client
1138 (global_socket,
"The whole scan was stopped. " 1139 "Fatal Redis connection error.",
"", NULL);
1143 gettimeofday (&now, NULL);
1144 log_write (
"Total time to scan all hosts : %ld seconds",
1145 now.tv_sec - then.tv_sec);
1147 if (do_network_scan && network_phase &&
1148 !scan_is_stopped () && !all_scans_are_stopped ())
int process_alive(pid_t pid)
void(*)(int) openvas_signal(int signum, void(*handler)(int))
void hosts_stop_all(void)
void log_write(const char *str,...)
Write into the logfile / syslog.
void send_printf(int soc, char *data,...)
Writes data to a socket.
plugins_scheduler_t plugins_scheduler_init(const char *plugins_list, int autoload, int only_network)
struct scheduler_plugin * plugins_scheduler_next(plugins_scheduler_t h)
int ntp_timestamp_host_scan_starts(int soc, char *host)
void plugins_scheduler_free(plugins_scheduler_t sched)
void attack_network(struct arglist *globals, kb_t *network_kb)
Attack a whole network.
int global_stop_all_scans
int mandatory_requirements_met(kb_t kb, struct scheduler_plugin *plugin)
Check whether mandatory requirements for plugin are met.
int hosts_new(struct arglist *globals, char *name, int soc)
int plugins_scheduler_count_active(plugins_scheduler_t sched)
void pluginlaunch_wait_for_free_process(void)
Waits and 'pushes' processes until the number of running processes has changed.
int hosts_init(int soc, int max_hosts)
#define PLUGIN_STATUS_DONE
int ntp_timestamp_host_scan_ends(int soc, char *host)
int plugin_launch(struct arglist *globals, struct scheduler_plugin *plugin, struct host_info *hostinfo, kb_t kb, char *name)
Host information, implemented as doubly linked list.
plugins_scheduler_t sched
int get_max_hosts_number(void)
void pluginlaunch_wait(void)
Waits and 'pushes' processes until num_running_processes is 0.
void(* process_func_t)(void *)
int hosts_set_pid(char *name, pid_t pid)
void pluginlaunch_stop(int soft_stop)
#define PLUGIN_STATUS_UNRUN
int hosts_read(struct arglist *globals)
Returns -1 if client asked to stop all tests or connection was lost or error. 0 otherwise.
pid_t create_process(process_func_t function, void *argument)
Create a new process (fork).
struct arglist * list2arglist(char *list)
char * requirements_plugin(kb_t kb, struct scheduler_plugin *plugin)
Determine if the plugin requirements are met.
int get_max_checks_number(void)
void pluginlaunch_init(const char *host)