OpenVAS Scanner  5.1.3
attack.c
Go to the documentation of this file.
1 /* OpenVAS
2 * $Id$
3 * Description: Launches the plugins, and manages multithreading.
4 *
5 * Authors: - Renaud Deraison <deraison@nessus.org> (Original pre-fork develoment)
6 * - Tim Brown <mailto:timb@openvas.org> (Initial fork)
7 * - Laban Mwangi <mailto:labanm@openvas.org> (Renaming work)
8 * - Tarik El-Yassem <mailto:tarik@openvas.org> (Headers section)
9 * - Geoff Galitz <mailto:geoff@eifel-consulting.eu (Minor debug edits)
10 *
11 * Copyright:
12 * Portions Copyright (C) 2006 Software in the Public Interest, Inc.
13 * Based on work Copyright (C) 1998 - 2006 Tenable Network Security, Inc.
14 *
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License version 2,
17 * as published by the Free Software Foundation
18 *
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, write to the Free Software
26 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
27 */
28 
29 #include <string.h> /* for strlen() */
30 #include <unistd.h> /* for close() */
31 #include <errno.h> /* for errno() */
32 #include <sys/wait.h> /* for waitpid() */
33 #include <arpa/inet.h> /* for inet_ntoa() */
34 #include <stdlib.h> /* for exit() */
35 
36 #include <glib.h>
37 #include <fcntl.h>
38 
39 #include <openvas/base/openvas_hosts.h>
40 #include <openvas/base/openvas_networking.h>
41 #include <openvas/misc/openvas_proctitle.h>
42 #include <openvas/base/kb.h>
43 #include <openvas/misc/network.h> /* for auth_printf */
44 #include <openvas/misc/nvt_categories.h> /* for ACT_INIT */
45 #include <openvas/misc/pcap_openvas.h> /* for v6_is_local_ip */
46 #include <openvas/misc/prefs.h> /* for prefs_get() */
47 #include <openvas/misc/internal_com.h>
48 
49 #include <openvas/base/nvticache.h> /* for nvticache_t */
50 
51 #include "attack.h"
52 #include "comm.h"
53 #include "hosts.h"
54 #include "log.h"
55 #include "ntp.h"
56 #include "pluginlaunch.h"
57 #include "pluginload.h"
58 #include "pluginscheduler.h"
59 #include "plugs_req.h"
60 #include "processes.h"
61 #include "sighand.h"
62 #include "utils.h"
63 
64 
65 #define ERR_HOST_DEAD -1
66 #define ERR_CANT_FORK -2
67 
68 #define MAX_FORK_RETRIES 10
69 
77 #define PROGRESS_BAR_STYLE 1
78 
84 {
85  struct arglist *globals;
89  kb_t *net_kb;
90  openvas_host_t *host;
91 };
92 
94  NSS_NONE = 0,
97 };
98 
99 /*******************************************************
100 
101  PRIVATE FUNCTIONS
102 
103 ********************************************************/
104 
108 static int
109 comm_send_status (int soc, char *hostname, int curr, int max)
110 {
111  char buffer[2048];
112 
113  if (soc < 0 || soc > 1024)
114  return -1;
115 
116  if (strlen (hostname) > (sizeof (buffer) - 50))
117  return -1;
118 
119  snprintf (buffer, sizeof (buffer),
120  "SERVER <|> STATUS <|> %s <|> %d/%d <|> SERVER\n",
121  hostname, curr, max);
122 
123  internal_send (soc, buffer, INTERNAL_COMM_MSG_TYPE_DATA);
124 
125  return 0;
126 }
127 
128 static void
129 error_message_to_client (int soc, const char *msg, const char *hostname,
130  const char *port)
131 {
132  send_printf (soc, "SERVER <|> ERRMSG <|> %s <|> %s <|> %s <|> <|> SERVER\n",
133  hostname ? hostname : "", port ? port : "",
134  msg ? msg : "No error.");
135 }
136 
137 static void
138 report_kb_failure (int soc, int errcode)
139 {
140  gchar *msg;
141 
142  errcode = abs (errcode);
143  msg = g_strdup_printf ("WARNING: Cannot connect to KB at '%s': %s'",
144  prefs_get ("kb_location"), strerror (errcode));
145  log_write ("%s", msg);
146  error_message_to_client (soc, msg, NULL, NULL);
147  g_free (msg);
148 }
149 
150 static void
151 fork_sleep (int n)
152 {
153  time_t then, now;
154 
155  now = then = time (NULL);
156  while (now - then < n)
157  {
158  waitpid (-1, NULL, WNOHANG);
159  usleep (10000);
160  now = time (NULL);
161  }
162 }
163 
164 static enum net_scan_status
165 network_scan_status (struct arglist *globals)
166 {
167  gchar *nss;
168 
169  nss = arg_get_value (globals, "network_scan_status");
170  if (nss == NULL)
171  return NSS_NONE;
172 
173  if (g_ascii_strcasecmp (nss, "busy") == 0)
174  return NSS_BUSY;
175  else if (g_ascii_strcasecmp (nss, "done") == 0)
176  return NSS_DONE;
177  else
178  return NSS_NONE;
179 }
180 
182 
183 static int
184 scan_is_stopped ()
185 {
186  return global_scan_stop;
187 }
188 
190 
191 static int
192 all_scans_are_stopped ()
193 {
194  return global_stop_all_scans;
195 }
196 
204 static int
205 nvti_category_is_safe (int category)
206 {
207  /* XXX: Duplicated from openvas-libraries. */
208  if (category == ACT_DESTRUCTIVE_ATTACK || category == ACT_KILL_HOST
209  || category == ACT_FLOOD || category == ACT_DENIAL)
210  return 0;
211  return 1;
212 }
213 
214 
226 static int
227 launch_plugin (struct arglist *globals, struct scheduler_plugin *plugin,
228  char *hostname, struct host_info *hostinfos, kb_t kb)
229 {
230  int optimize = prefs_get_bool ("optimize_test");
231  int category;
232  char *oid, *name;
233  gboolean network_scan = FALSE;
234 
235  oid = plugin->oid;
236  category = nvticache_get_category (oid);
237  name = nvticache_get_filename (oid);
238  if (scan_is_stopped () || all_scans_are_stopped())
239  {
240  if (category != ACT_LAST)
241  {
243  g_free (name);
244  return 0;
245  }
246  else
247  log_write ("Stopped scan wrap-up: Launching %s (%s)", name, oid);
248  }
249 
250  if (network_scan_status (globals) == NSS_BUSY)
251  network_scan = TRUE;
252 
253  /* can we launch it ? */
254  if (plugin->enabled)
255  {
256  char *error;
257 
258  if (prefs_get_bool ("safe_checks") && !nvti_category_is_safe (category))
259  {
260  if (prefs_get_bool ("log_whole_attack"))
261  log_write
262  ("Not launching %s (%s) against %s because safe checks are"
263  " enabled (this is not an error)", name, oid, hostname);
265  g_free (name);
266  return 0;
267  }
268 
269  if (network_scan)
270  {
271  char asc_id[100];
272 
273  assert (oid);
274  snprintf (asc_id, sizeof (asc_id), "Launched/%s", oid);
275 
276  if (kb_item_get_int (kb, asc_id) > 0)
277  {
278  if (prefs_get_bool ("log_whole_attack"))
279  log_write ("Not launching %s against %s because it has already "
280  "been lanched in the past (this is not an error)",
281  oid, hostname);
283  g_free (name);
284  return 0;
285  }
286  else
287  {
288  kb_item_add_int (kb, asc_id, 1);
289  }
290  }
291 
292  /* Do not launch NVT if mandatory key is missing (e.g. an important tool
293  * was not found). This is ignored during network wide scanning phases. */
294  if (network_scan || mandatory_requirements_met (kb, plugin))
295  error = NULL;
296  else
297  error = "because a mandatory key is missing";
298 
299  /* Stop the test if the host is 'dead' */
300  if (kb_item_get_int (kb, "Host/dead") > 0)
301  {
302  log_write ("The remote host %s (%s) is dead", hostinfos->fqdn, hostname);
303  pluginlaunch_stop (1);
305  g_free (name);
306  return ERR_HOST_DEAD;
307  }
308 
309  if (!error
310  && (!optimize
311  || !(error = requirements_plugin (kb, plugin))))
312  {
313  int pid;
314  char *src;
315 
316  src = nvticache_get_src (oid);
317  /* Start the plugin */
318  pid = plugin_launch (globals, plugin, hostinfos, kb, src);
319  g_free (src);
320  if (pid < 0)
321  {
323  g_free (name);
324  return ERR_CANT_FORK;
325  }
326 
327  if (prefs_get_bool ("log_whole_attack"))
328  log_write ("Launching %s (%s) against %s [%d]", name, oid, hostname,
329  pid);
330  }
331  else /* requirements_plugin() failed */
332  {
334  if (prefs_get_bool ("log_whole_attack"))
335  log_write
336  ("Not launching %s (%s) against %s %s (this is not an error)",
337  name, oid, hostname, error);
338  }
339  } /* if(plugins->launch) */
340  else
342 
343  g_free (name);
344  return 0;
345 }
346 
347 static int
348 kb_duplicate(kb_t dst, kb_t src, const gchar *filter)
349 {
350  struct kb_item *items, *p_itm;
351 
352  items = kb_item_get_pattern(src, filter ? filter : "*");
353  for (p_itm = items; p_itm != NULL; p_itm = p_itm->next)
354  {
355  gchar *newname;
356 
357  newname = strstr(p_itm->name, "/");
358  if (newname == NULL)
359  newname = p_itm->name;
360  else
361  newname += 1; /* Skip the '/' */
362 
363  kb_item_add_str(dst, newname, p_itm->v_str);
364  }
365  return 0;
366 }
367 
380 static kb_t
381 init_host_kb (struct arglist *globals, char *hostname,
382  struct host_info *hostinfos, kb_t *network_kb)
383 {
384  kb_t kb;
385  gchar *vhosts, *hostname_pattern, *hoststr;
386  enum net_scan_status nss;
387  const gchar *kb_path = prefs_get ("kb_location");
388  int rc, soc;
389  struct in6_addr *hostip;
390 
391  nss = network_scan_status (globals);
392  soc = arg_get_value_int (globals, "global_socket");
393  switch (nss)
394  {
395  case NSS_DONE:
396  rc = kb_new (&kb, kb_path);
397  if (rc)
398  {
399  report_kb_failure (soc, rc);
400  return NULL;
401  }
402 
403  hostname_pattern = g_strdup_printf ("%s/*", hostname);
404  kb_duplicate(kb, *network_kb, hostname_pattern);
405  g_free(hostname_pattern);
406  break;
407 
408  case NSS_BUSY:
409  assert (network_kb != NULL);
410  assert (*network_kb != NULL);
411  kb = *network_kb;
412  break;
413 
414  default:
415  rc = kb_new (&kb, kb_path);
416  if (rc)
417  {
418  report_kb_failure (soc, rc);
419  return NULL;
420  }
421  }
422 
423  /* Add Hostname and Host-IP */
424  hoststr = hostinfos->fqdn;
425  if (hoststr)
426  kb_item_add_str (kb, "Hostname", hoststr);
427  hostip = hostinfos->ip;
428  if (hostip)
429  {
430  char ipstr[INET6_ADDRSTRLEN];
431 
432  if (IN6_IS_ADDR_V4MAPPED (hostip))
433  inet_ntop (AF_INET, ((char *) (hostip)) + 12, ipstr, sizeof (ipstr));
434  else
435  inet_ntop (AF_INET6, hostip, ipstr, sizeof (ipstr));
436  kb_item_add_str (kb, "Host-IP", ipstr);
437  }
438 
439  /* If vhosts is set, split it and put it in the KB. */
440  vhosts = hostinfos->vhosts;
441  if (vhosts)
442  {
443  gchar **vhosts_array = g_strsplit (vhosts, ",", 0);
444  int i;
445 
446  for (i = 0; vhosts_array[i] != NULL; i++)
447  kb_item_add_str (kb, "hostinfos/vhosts", vhosts_array[i]);
448 
449  g_strfreev (vhosts_array);
450  }
451 
452  return kb;
453 }
454 
458 static void
459 attack_host (struct arglist *globals, struct host_info *hostinfos,
460  char *hostname, plugins_scheduler_t sched, kb_t *net_kb)
461 {
462  /* Used for the status */
463  int num_plugs, forks_retry = 0, global_socket;
464  kb_t kb;
465 
466  proctitle_set ("openvassd: testing %s", hostinfos->name);
467 
468  global_socket = arg_get_value_int (globals, "global_socket");
469  kb = init_host_kb (globals, hostname, hostinfos, net_kb);
470  if (kb == NULL)
471  return;
472 
473  kb_lnk_reset (kb);
474 
475  /* launch the plugins */
476  pluginlaunch_init (hostinfos->name);
477  num_plugs = plugins_scheduler_count_active (sched);
478  for (;;)
479  {
480  struct scheduler_plugin *plugin;
481  pid_t parent;
482 
483  /* Check that our father is still alive */
484  parent = getppid ();
485  if (parent <= 1 || process_alive (parent) == 0)
486  {
487  pluginlaunch_stop (1);
488  return;
489  }
490 
491  plugin = plugins_scheduler_next (sched);
492  if (plugin != NULL && plugin != PLUG_RUNNING)
493  {
494  int e;
495  static int last_status = 0, cur_plug = 0;
496 
497  again:
498  e = launch_plugin (globals, plugin, hostname, hostinfos, kb);
499  if (e < 0)
500  {
501  /*
502  * Remote host died
503  */
504  if (e == ERR_HOST_DEAD)
505  {
506  char buffer[2048];
507  snprintf
508  (buffer, sizeof (buffer),
509  "SERVER <|> LOG <|> %s <|> general/Host_Details"
510  " <|> <host><detail><name>Host dead</name>"
511  "<value>1</value><source><description/><type/>"
512  "<name/></source></detail></host> <|> <|> SERVER\n",
513  hostname ?: "");
514 #if (PROGRESS_BAR_STYLE == 1)
515  /* In case of a dead host, it sends max_ports = -1 to the
516  manager. The host will not be taken into account to
517  calculate the scan progress. */
518  comm_send_status(global_socket, hostname, 0, -1);
519 #endif
520  internal_send (global_socket, buffer,
521  INTERNAL_COMM_MSG_TYPE_DATA);
522  goto host_died;
523  }
524  else if (e == ERR_CANT_FORK)
525  {
526  if (forks_retry < MAX_FORK_RETRIES)
527  {
528  forks_retry++;
529  log_write ("fork() failed - sleeping %d seconds (%s)",
530  forks_retry, strerror (errno));
531  fork_sleep (forks_retry);
532  goto again;
533  }
534  else
535  {
536  log_write ("fork() failed too many times - aborting");
537  goto host_died;
538  }
539  }
540  }
541 
542  if ((cur_plug * 100) / num_plugs >= last_status
543  && !scan_is_stopped () && !all_scans_are_stopped())
544  {
545  last_status = (cur_plug * 100) / num_plugs + 2;
546  if (comm_send_status
547  (global_socket, hostname, cur_plug, num_plugs) < 0)
548  {
549  pluginlaunch_stop (1);
550  goto host_died;
551  }
552  }
553  cur_plug++;
554  }
555  else if (plugin == NULL)
556  break;
557  else
559  }
560 
562  if (!scan_is_stopped () && !all_scans_are_stopped())
563  comm_send_status (global_socket, hostname, num_plugs, num_plugs);
564 
565 host_died:
566  pluginlaunch_stop (1);
567  plugins_scheduler_free (sched);
568 
569  if (net_kb == NULL || kb != *net_kb)
570  kb_delete (kb);
571 }
572 
573 /*
574  * Checks if a host is authorized to be scanned.
575  *
576  * @param[in] host Host to check access to.
577  * @param[in] addr Pointer to address so a hostname isn't resolved multiple
578  * times.
579  * @param[in] hosts_allow Hosts whitelist.
580  * @param[in] hosts_deny Hosts blacklist.
581  *
582  * @return 1 if host authorized, 0 otherwise.
583  */
584 static int
585 host_authorized (const openvas_host_t *host, const struct in6_addr *addr,
586  const openvas_hosts_t *hosts_allow,
587  const openvas_hosts_t *hosts_deny)
588 {
589  /* Check Hosts Access. */
590  if (host == NULL)
591  return 0;
592 
593  if (hosts_deny && openvas_host_in_hosts (host, addr, hosts_deny))
594  return 0;
595  if (hosts_allow && !openvas_host_in_hosts (host, addr, hosts_allow))
596  return 0;
597 
598  return 1;
599 }
600 
604 static void
605 attack_start (struct attack_start_args *args)
606 {
607  struct arglist *globals = args->globals;
608  char *host_str, *hostname;
609  struct in6_addr hostip;
610  struct host_info *hostinfos;
611  const char *non_simult = prefs_get ("non_simult_ports");
612  const char *vhosts = prefs_get ("vhosts");
613  const char *vhosts_ip = prefs_get ("vhosts_ip");
614  int thread_socket;
615  struct timeval then;
616  plugins_scheduler_t sched = args->sched;
617  kb_t *net_kb = args->net_kb;
618  openvas_hosts_t *hosts_allow, *hosts_deny;
619  openvas_hosts_t *sys_hosts_allow, *sys_hosts_deny;
620 
621 
622  nvticache_reset ();
623  close (args->parent_socket);
624  thread_socket = args->thread_socket;
625  gettimeofday (&then, NULL);
626 
627  arg_add_value (preferences_get (), "non_simult_ports_list", ARG_ARGLIST,
628  (void *) list2arglist ((char *)non_simult));
629 
630  /* Options regarding the communication with our parent */
631  close (arg_get_value_int (globals, "parent_socket"));
632  arg_del_value (globals, "parent_socket");
633  openvas_deregister_connection (arg_get_value_int (globals, "global_socket"));
634  arg_set_value (globals, "global_socket", GSIZE_TO_POINTER (thread_socket));
635 
636  hostname = openvas_host_reverse_lookup (args->host);
637  if (!hostname)
638  hostname = openvas_host_value_str (args->host);
639  if (openvas_host_get_addr6 (args->host, &hostip) == -1)
640  {
641  log_write ("Couldn't resolve target %s", hostname);
642  error_message_to_client (thread_socket, "Couldn't resolve hostname.",
643  hostname, NULL);
644  return;
645  }
646 
647  /* Do we have the right to test this host ? */
648  hosts_allow = openvas_hosts_new (prefs_get ("hosts_allow"));
649  hosts_deny = openvas_hosts_new (prefs_get ("hosts_deny"));
650  if (!host_authorized (args->host, &hostip, hosts_allow, hosts_deny))
651  {
652  error_message_to_client
653  (thread_socket, "Host access denied.", hostname, NULL);
654  log_write ("Host %s access denied.", hostname);
655  return;
656  }
657  sys_hosts_allow = openvas_hosts_new (prefs_get ("sys_hosts_allow"));
658  sys_hosts_deny = openvas_hosts_new (prefs_get ("sys_hosts_deny"));
659  if (!host_authorized (args->host, &hostip, sys_hosts_allow, sys_hosts_deny))
660  {
661  error_message_to_client
662  (thread_socket, "Host access denied (system-wide restriction.)",
663  hostname, NULL);
664  log_write ("Host %s access denied (sys_* preference restriction.)",
665  hostname);
666  return;
667  }
668  openvas_hosts_free (hosts_allow);
669  openvas_hosts_free (hosts_deny);
670  openvas_hosts_free (sys_hosts_allow);
671  openvas_hosts_free (sys_hosts_deny);
672 
673  host_str = addr6_as_str (&hostip);
674  if (vhosts == NULL || vhosts_ip == NULL)
675  hostinfos = host_info_init (host_str, &hostip, NULL, hostname);
676  else
677  {
678  char *txt_ip;
679 
680  txt_ip = addr6_as_str (&hostip);
681  if (strcmp (vhosts_ip, txt_ip) != 0)
682  vhosts = NULL;
683  g_free (txt_ip);
684  hostinfos = host_info_init (host_str, &hostip, vhosts, hostname);
685  }
686  ntp_timestamp_host_scan_starts (thread_socket, host_str);
687  log_write ("Testing %s (%s) [%d]", hostname, host_str, getpid ());
688 
689  // Start scan
690  attack_host (globals, hostinfos, host_str, sched, net_kb);
691  host_info_free (hostinfos);
692 
693  if (!scan_is_stopped () && !all_scans_are_stopped ())
694  {
695  struct timeval now;
696 
697  ntp_timestamp_host_scan_ends (thread_socket, host_str);
698  gettimeofday (&now, NULL);
699  if (now.tv_usec < then.tv_usec)
700  {
701  then.tv_sec++;
702  now.tv_usec += 1000000;
703  }
704  log_write ("Finished testing %s (%s). Time : %ld.%.2ld secs",
705  hostname, host_str, (long) (now.tv_sec - then.tv_sec),
706  (long) ((now.tv_usec - then.tv_usec) / 10000));
707  }
708  shutdown (thread_socket, 2);
709  close (thread_socket);
710  g_free (hostname);
711  g_free (host_str);
712 }
713 
714 static void
715 apply_hosts_preferences (openvas_hosts_t *hosts)
716 {
717  const char *ordering = prefs_get ("hosts_ordering"),
718  *exclude_hosts = prefs_get ("exclude_hosts");
719 
720  if (hosts == NULL)
721  return;
722 
723  /* Hosts ordering strategy: sequential, random, reversed... */
724  if (ordering)
725  {
726  if (!strcmp (ordering, "random"))
727  {
728  openvas_hosts_shuffle (hosts);
729  log_write ("hosts_ordering: Random.");
730  }
731  else if (!strcmp (ordering, "reverse"))
732  {
733  openvas_hosts_reverse (hosts);
734  log_write ("hosts_ordering: Reverse.");
735  }
736  }
737  else
738  log_write ("hosts_ordering: Sequential.");
739 
740  /* Exclude hosts ? */
741  if (exclude_hosts)
742  {
743  /* Exclude hosts, resolving hostnames. */
744  int ret = openvas_hosts_exclude (hosts, exclude_hosts, 1);
745 
746  if (ret >= 0)
747  log_write ("exclude_hosts: Skipped %d host(s).", ret);
748  else
749  log_write ("exclude_hosts: Error.");
750  }
751 
752  /* Reverse-lookup unify ? */
753  if (prefs_get_bool ("reverse_lookup_unify"))
754  log_write ("reverse_lookup_unify: Skipped %d host(s).",
755  openvas_hosts_reverse_lookup_unify (hosts));
756 
757  /* Hosts that reverse-lookup only ? */
758  if (prefs_get_bool ("reverse_lookup_only"))
759  log_write ("reverse_lookup_only: Skipped %d host(s).",
760  openvas_hosts_reverse_lookup_only (hosts));
761 }
762 
763 static int
764 str_in_comma_list (const char *str, const char *comma_list)
765 {
766  gchar **element, **split;
767 
768  if (str == NULL || comma_list == NULL)
769  return 0;
770 
771  split = g_strsplit (comma_list, ",", 0);
772  element = split;
773  while (*element)
774  {
775  gchar *stripped = g_strstrip (*element);
776 
777  if (stripped && strcmp (stripped, str) == 0)
778  {
779  g_strfreev (split);
780  return 1;
781  }
782 
783  element++;
784  }
785 
786  g_strfreev (split);
787  return 0;
788 }
789 
790 /*
791  * Checks if a network interface is authorized to be used as source interface.
792  *
793  * @return 0 if iface is NULL, -1 if unauthorized by ifaces_deny/ifaces_allow,
794  * -2 if by sys_ifaces_deny/sys_ifaces_allow, 1 otherwise.
795  */
796 static int
797 iface_authorized (const char *iface)
798 {
799  const char *ifaces_list;
800 
801  if (iface == NULL)
802  return 0;
803 
804  ifaces_list = prefs_get ("ifaces_deny");
805  if (ifaces_list && str_in_comma_list (iface, ifaces_list))
806  return -1;
807  ifaces_list = prefs_get ("ifaces_allow");
808  if (ifaces_list && !str_in_comma_list (iface, ifaces_list))
809  return -1;
810  /* sys_* preferences are similar, but can't be overriden by the client. */
811  ifaces_list = prefs_get ("sys_ifaces_deny");
812  if (ifaces_list && str_in_comma_list (iface, ifaces_list))
813  return -2;
814  ifaces_list = prefs_get ("sys_ifaces_allow");
815  if (ifaces_list && !str_in_comma_list (iface, ifaces_list))
816  return -2;
817 
818  return 1;
819 }
820 
821 /*
822  * Applies the source_iface scanner preference, if allowed by ifaces_allow and
823  * ifaces_deny preferences.
824  *
825  * @return 0 if source_iface preference applied or not found, -1 if
826  * unauthorized value, -2 if iface can't be used.
827  */
828 static int
829 apply_source_iface_preference (int soc)
830 {
831  const char *source_iface = prefs_get ("source_iface");
832  int ret;
833 
834  if (source_iface == NULL)
835  return 0;
836 
837  ret = iface_authorized (source_iface);
838  if (ret == -1)
839  {
840  gchar *msg = g_strdup_printf ("Unauthorized source interface: %s",
841  source_iface);
842  log_write ("source_iface: Unauthorized source interface %s.",
843  source_iface);
844  error_message_to_client (soc, msg, NULL, NULL);
845 
846  g_free (msg);
847  return -1;
848  }
849  else if (ret == -2)
850  {
851  gchar *msg = g_strdup_printf ("Unauthorized source interface: %s"
852  " (system-wide restriction.)",
853  source_iface);
854  log_write ("source_iface: Unauthorized source interface %s."
855  " (sys_* preference restriction.)",
856  source_iface);
857  error_message_to_client (soc, msg, NULL, NULL);
858 
859  g_free (msg);
860  return -1;
861  }
862 
863  if (openvas_source_iface_init (source_iface))
864  {
865  gchar *msg = g_strdup_printf ("Erroneous source interface: %s",
866  source_iface);
867  log_write ("source_iface: Error with %s interface.", source_iface);
868  error_message_to_client (soc, msg, NULL, NULL);
869 
870  g_free (msg);
871  return -2;
872  }
873  else
874  {
875  char *ipstr, *ip6str;
876  ipstr = openvas_source_addr_str ();
877  ip6str = openvas_source_addr6_str ();
878  log_write ("source_iface: Using %s (%s / %s).", source_iface,
879  ipstr, ip6str);
880 
881  g_free (ipstr);
882  g_free (ip6str);
883  return 0;
884  }
885 }
886 
887 static int
888 check_kb_access (int soc)
889 {
890  int rc;
891  kb_t kb;
892 
893  rc = kb_new (&kb, prefs_get ("kb_location"));
894  if (rc)
895  report_kb_failure (soc, rc);
896  else
897  kb_delete (kb);
898 
899  return rc;
900 }
901 
902 static void
903 handle_scan_stop_signal ()
904 {
905  pluginlaunch_stop (0);
906  global_scan_stop = 1;
907 }
908 
909 static void
910 handle_stop_all_scans_signal ()
911 {
913  hosts_stop_all ();
914 }
915 
919 void
920 attack_network (struct arglist *globals, kb_t *network_kb)
921 {
922  int max_hosts = 0, max_checks;
923  const char *hostlist;
924  openvas_host_t *host;
925  int global_socket = -1;
926  plugins_scheduler_t sched;
927  int fork_retries = 0;
928  GHashTable *files;
929  struct timeval then, now;
930  openvas_hosts_t *hosts;
931 
932  const gchar *network_targets, *port_range;
933  gboolean network_phase = FALSE;
934  gboolean do_network_scan = FALSE;
935 
936  gettimeofday (&then, NULL);
937 
938  if (prefs_get_bool ("network_scan"))
939  do_network_scan = TRUE;
940  else
941  do_network_scan = FALSE;
942 
943  network_targets = prefs_get ("network_targets");
944  if (network_targets != NULL)
945  arg_add_value (globals, "network_targets", ARG_STRING,
946  (char *) network_targets);
947 
948  if (do_network_scan)
949  {
950  enum net_scan_status nss;
951 
952  nss = network_scan_status (globals);
953  switch (nss)
954  {
955  case NSS_DONE:
956  network_phase = FALSE;
957  break;
958 
959  case NSS_BUSY:
960  network_phase = TRUE;
961  break;
962 
963  default:
964  arg_add_value (globals, "network_scan_status", ARG_STRING,
965  "busy");
966  network_phase = TRUE;
967  break;
968  }
969  }
970  else
971  network_kb = NULL;
972 
973  global_socket = arg_get_value_int (globals, "global_socket");
974  if (check_kb_access(global_socket))
975  return;
976 
977  /* Init and check Target List */
978  hostlist = prefs_get ("TARGET");
979  if (hostlist == NULL)
980  {
981  error_message_to_client (global_socket, "Missing target hosts", NULL,
982  NULL);
983  return;
984  }
985 
986  /* Verify the port range is a valid one */
987  port_range = prefs_get ("port_range");
988  if (validate_port_range (port_range))
989  {
990  error_message_to_client (global_socket, "Invalid port range", NULL,
991  port_range);
992  return;
993  }
994 
995  /* Initialize the attack. */
996  sched = plugins_scheduler_init
997  (prefs_get ("plugin_set"), prefs_get_bool ("auto_enable_dependencies"),
998  network_phase);
999 
1000  max_hosts = get_max_hosts_number ();
1001  max_checks = get_max_checks_number ();
1002 
1003  if (network_phase)
1004  {
1005  if (network_targets == NULL)
1006  {
1007  log_write ("WARNING: In network phase, but without targets! Stopping.");
1008  host = NULL;
1009  }
1010  else
1011  {
1012  int rc;
1013 
1014  log_write ("Start a new scan. Target(s) : %s, "
1015  "in network phase with target %s",
1016  hostlist, network_targets);
1017 
1018  rc = kb_new (network_kb, prefs_get ("kb_location"));
1019  if (rc)
1020  {
1021  report_kb_failure (global_socket, rc);
1022  host = NULL;
1023  }
1024  else
1025  kb_lnk_reset (*network_kb);
1026  }
1027  }
1028  else
1029  {
1030  log_write ("Starts a new scan. Target(s) : %s, with max_hosts = %d and "
1031  "max_checks = %d", hostlist, max_hosts, max_checks);
1032  }
1033 
1034  hosts = openvas_hosts_new (hostlist);
1035  /* Apply Hosts preferences. */
1036  apply_hosts_preferences (hosts);
1037 
1038  /* Don't start if the provided interface is unauthorized. */
1039  if (apply_source_iface_preference (global_socket) != 0)
1040  {
1041  openvas_hosts_free (hosts);
1042  error_message_to_client
1043  (global_socket, "Interface not authorized for scanning", NULL, NULL);
1044  return;
1045  }
1046  host = openvas_hosts_next (hosts);
1047  if (host == NULL)
1048  goto stop;
1049  hosts_init (global_socket, max_hosts);
1050  /*
1051  * Start the attack !
1052  */
1053  openvas_signal (SIGUSR1, handle_scan_stop_signal);
1054  openvas_signal (SIGUSR2, handle_stop_all_scans_signal);
1055  while (host && !scan_is_stopped () && !all_scans_are_stopped())
1056  {
1057  int pid;
1058  struct attack_start_args args;
1059  char *host_str;
1060  int soc[2];
1061 
1062  host_str = openvas_host_value_str (host);
1063  if (socketpair (AF_UNIX, SOCK_STREAM, 0, soc) < 0
1064  || hosts_new (globals, host_str, soc[1]) < 0)
1065  {
1066  g_free (host_str);
1067  goto scan_stop;
1068  }
1069 
1070  if (scan_is_stopped () || all_scans_are_stopped ())
1071  {
1072  close (soc[0]);
1073  close (soc[1]);
1074  g_free (host_str);
1075  continue;
1076  }
1077  args.host = host;
1078  args.globals = globals;
1079  args.sched = sched;
1080  args.thread_socket = soc[0];
1081  args.parent_socket = soc[1];
1082  args.net_kb = network_kb;
1083 
1084  forkagain:
1085  pid = create_process ((process_func_t) attack_start, &args);
1086  /* Close child process' socket. */
1087  close (args.thread_socket);
1088  if (pid < 0)
1089  {
1090  fork_retries++;
1091  if (fork_retries > MAX_FORK_RETRIES)
1092  {
1093  /* Forking failed - we go to the wait queue. */
1094  log_write ("fork() failed - %s. %s won't be tested",
1095  strerror (errno), host_str);
1096  g_free (host_str);
1097  goto stop;
1098  }
1099 
1100  log_write ("fork() failed - "
1101  "sleeping %d seconds and trying again...",
1102  fork_retries);
1103  fork_sleep (fork_retries);
1104  goto forkagain;
1105  }
1106  hosts_set_pid (host_str, pid);
1107  if (network_phase)
1108  log_write ("Testing %s (network level) [%d]",
1109  network_targets, pid);
1110 
1111  if (network_phase)
1112  {
1113  host = NULL;
1114  arg_set_value (globals, "network_scan_status", "done");
1115  }
1116  else
1117  host = openvas_hosts_next (hosts);
1118  g_free (host_str);
1119  }
1120 
1121  /* Every host is being tested... We have to wait for the processes
1122  * to terminate. */
1123  while (hosts_read (globals) == 0)
1124  ;
1125 
1126  log_write ("Test complete");
1127 
1128 scan_stop:
1129  /* Free the memory used by the files uploaded by the user, if any. */
1130  files = arg_get_value (globals, "files_translation");
1131  if (files)
1132  g_hash_table_destroy (files);
1133 
1134 stop:
1135  if (all_scans_are_stopped ())
1136  {
1137  error_message_to_client
1138  (global_socket, "The whole scan was stopped. "
1139  "Fatal Redis connection error.", "", NULL);
1140  }
1142 
1143  gettimeofday (&now, NULL);
1144  log_write ("Total time to scan all hosts : %ld seconds",
1145  now.tv_sec - then.tv_sec);
1146 
1147  if (do_network_scan && network_phase &&
1148  !scan_is_stopped () && !all_scans_are_stopped ())
1149  attack_network (globals, network_kb);
1150 }
int process_alive(pid_t pid)
Definition: utils.c:180
#define ERR_HOST_DEAD
Definition: attack.c:65
void(*)(int) openvas_signal(int signum, void(*handler)(int))
Definition: sighand.c:92
void hosts_stop_all(void)
Definition: hosts.c:230
openvas_host_t * host
Definition: attack.c:90
void log_write(const char *str,...)
Write into the logfile / syslog.
Definition: log.c:140
void send_printf(int soc, char *data,...)
Writes data to a socket.
Definition: utils.c:276
plugins_scheduler_t plugins_scheduler_init(const char *plugins_list, int autoload, int only_network)
struct scheduler_plugin * plugins_scheduler_next(plugins_scheduler_t h)
#define MAX_FORK_RETRIES
Definition: attack.c:68
int ntp_timestamp_host_scan_starts(int soc, char *host)
Definition: ntp.c:431
void plugins_scheduler_free(plugins_scheduler_t sched)
void attack_network(struct arglist *globals, kb_t *network_kb)
Attack a whole network.
Definition: attack.c:920
int global_stop_all_scans
Definition: attack.c:189
int parent_socket
Definition: attack.c:88
int mandatory_requirements_met(kb_t kb, struct scheduler_plugin *plugin)
Check whether mandatory requirements for plugin are met.
Definition: plugs_req.c:299
int hosts_new(struct arglist *globals, char *name, int soc)
Definition: hosts.c:178
int global_scan_stop
Definition: attack.c:181
int plugins_scheduler_count_active(plugins_scheduler_t sched)
struct arglist * globals
Definition: attack.c:85
void pluginlaunch_wait_for_free_process(void)
Waits and 'pushes' processes until the number of running processes has changed.
Definition: pluginlaunch.c:499
int hosts_init(int soc, int max_hosts)
Definition: hosts.c:168
#define PLUGIN_STATUS_DONE
int ntp_timestamp_host_scan_ends(int soc, char *host)
Definition: ntp.c:437
int thread_socket
Definition: attack.c:87
int plugin_launch(struct arglist *globals, struct scheduler_plugin *plugin, struct host_info *hostinfo, kb_t kb, char *name)
Definition: pluginlaunch.c:414
Host information, implemented as doubly linked list.
Definition: hosts.c:44
plugins_scheduler_t sched
Definition: attack.c:86
int get_max_hosts_number(void)
Definition: utils.c:120
void pluginlaunch_wait(void)
Waits and 'pushes' processes until num_running_processes is 0.
Definition: pluginlaunch.c:470
void(* process_func_t)(void *)
Definition: processes.h:31
int hosts_set_pid(char *name, pid_t pid)
Definition: hosts.c:204
void pluginlaunch_stop(int soft_stop)
Definition: pluginlaunch.c:379
kb_t * net_kb
Definition: attack.c:89
#define PLUG_RUNNING
#define PLUGIN_STATUS_UNRUN
int hosts_read(struct arglist *globals)
Returns -1 if client asked to stop all tests or connection was lost or error. 0 otherwise.
Definition: hosts.c:357
const char * hostname
Definition: pluginlaunch.c:81
pid_t create_process(process_func_t function, void *argument)
Create a new process (fork).
Definition: processes.c:77
struct arglist * list2arglist(char *list)
Definition: utils.c:81
char * requirements_plugin(kb_t kb, struct scheduler_plugin *plugin)
Determine if the plugin requirements are met.
Definition: plugs_req.c:320
#define ERR_CANT_FORK
Definition: attack.c:66
int get_max_checks_number(void)
Definition: utils.c:150
net_scan_status
Definition: attack.c:93
void pluginlaunch_init(const char *host)
Definition: pluginlaunch.c:344