+++ /dev/null
-diff -urN portsentry-1.0.orig/portsentry.c portsentry-1.0/portsentry.c
---- portsentry-1.0.orig/portsentry.c Sun Nov 14 23:43:06 1999
-+++ portsentry-1.0/portsentry.c Sat May 19 14:23:17 2001
-@@ -326,7 +326,7 @@
- if ((ipPtr->ihl < 5) || (ipPtr->ihl > 15))
- {
- addr.s_addr = (u_int) ipPtr->saddr;
-- Log ("attackalert: Illegal IP header length detected: %d from (possible) host: %s\n",
-+ LogAttack ("attackalert: Illegal IP header length detected: %d from (possible) host: %s\n",
- ipPtr->ihl, inet_ntoa (addr));
- return (FALSE);
- }
-@@ -358,7 +358,7 @@
- if ((ipPtr->ihl < 5) || (ipPtr->ihl > 15))
- {
- addr.s_addr = (u_int) ipPtr->saddr;
-- Log ("attackalert: Illegal IP header length detected: %d from (possible) host: %s\n",
-+ LogAttack ("attackalert: Illegal IP header length detected: %d from (possible) host: %s\n",
- ipPtr->ihl, inet_ntoa (addr));
- return (FALSE);
- }
-@@ -485,7 +485,7 @@
-
- if (result == ERROR)
- {
-- Log ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
-+ LogAttack ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
- result = FALSE;
- }
-
-@@ -505,12 +505,12 @@
-
-
- packetType = ReportPacketType (tcp);
-- Log ("attackalert: %s from host: %s/%s to TCP port: %d",
-+ LogAttack ("attackalert: %s from host: %s/%s to TCP port: %d",
- packetType, resolvedHost, target,
- ports2[count]);
- /* Report on options present */
- if (ip.ihl > 5)
-- Log ("attackalert: Packet from host: %s/%s to TCP port: %d has IP options set (detection avoidance technique).",
-+ LogAttack ("attackalert: Packet from host: %s/%s to TCP port: %d has IP options set (detection avoidance technique).",
- resolvedHost, target, ports2[count]);
-
- /* check if this target is already blocked */
-@@ -518,7 +518,7 @@
- {
- /* toast the prick */
- if (DisposeTCP (target, ports2[count]) != TRUE)
-- Log ("attackalert: ERROR: Could not block host %s/%s !!",
-+ LogAttack ("attackalert: ERROR: Could not block host %s/%s !!",
- resolvedHost, target);
- else
- WriteBlocked (target, resolvedHost,
-@@ -526,7 +526,7 @@
- gblHistoryFile, "TCP");
- } /* end IsBlocked check */
- else
-- Log ("attackalert: Host: %s/%s is already blocked Ignoring",
-+ LogAttack ("attackalert: Host: %s/%s is already blocked Ignoring",
- resolvedHost, target);
- } /* end if(scanDetectTrigger) */
- } /* end if(never block) check */
-@@ -664,7 +664,7 @@
-
- if (result == ERROR)
- {
-- Log ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
-+ LogAttack ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
- result = FALSE;
- }
-
-@@ -684,11 +684,11 @@
- snprintf (resolvedHost, DNSMAXBUF, "%s", target);
-
- packetType = ReportPacketType (tcp);
-- Log ("attackalert: %s from host: %s/%s to TCP port: %d",
-+ LogAttack ("attackalert: %s from host: %s/%s to TCP port: %d",
- packetType, resolvedHost, target, incomingPort);
- /* Report on options present */
- if (ip.ihl > 5)
-- Log ("attackalert: Packet from host: %s/%s to TCP port: %d has IP options set (detection avoidance technique).",
-+ LogAttack ("attackalert: Packet from host: %s/%s to TCP port: %d has IP options set (detection avoidance technique).",
- resolvedHost, target, incomingPort);
-
- /* check if this target is already blocked */
-@@ -696,7 +696,7 @@
- {
- /* toast the prick */
- if (DisposeTCP (target, incomingPort) != TRUE)
-- Log ("attackalert: ERROR: Could not block host %s/%s!!",
-+ LogAttack ("attackalert: ERROR: Could not block host %s/%s!!",
- resolvedHost, target);
- else
- WriteBlocked (target, resolvedHost,
-@@ -704,7 +704,7 @@
- gblHistoryFile, "TCP");
- } /* end IsBlocked check */
- else
-- Log ("attackalert: Host: %s/%s is already blocked Ignoring",
-+ LogAttack ("attackalert: Host: %s/%s is already blocked Ignoring",
- resolvedHost, target);
- } /* end if(scanDetectTrigger) */
- } /* end if(never block) check */
-@@ -825,7 +825,7 @@
-
- if (result == ERROR)
- {
-- Log ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
-+ LogAttack ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
- result = FALSE;
- }
-
-@@ -843,18 +843,18 @@
- else
- snprintf (resolvedHost, DNSMAXBUF, "%s", target);
-
-- Log ("attackalert: UDP scan from host: %s/%s to UDP port: %d",
-+ LogAttack ("attackalert: UDP scan from host: %s/%s to UDP port: %d",
- resolvedHost, target, ports2[count]);
- /* Report on options present */
- if (ip.ihl > 5)
-- Log ("attackalert: Packet from host: %s/%s to UDP port: %d has IP options set (detection avoidance technique).",
-+ LogAttack ("attackalert: Packet from host: %s/%s to UDP port: %d has IP options set (detection avoidance technique).",
- resolvedHost, target, incomingPort);
-
- /* check if this target is already blocked */
- if (IsBlocked (target, gblBlockedFile) == FALSE)
- {
- if (DisposeUDP (target, ports2[count]) != TRUE)
-- Log ("attackalert: ERROR: Could not block host %s/%s!!",
-+ LogAttack ("attackalert: ERROR: Could not block host %s/%s!!",
- resolvedHost, target);
- else
- WriteBlocked (target, resolvedHost, ports2[count],
-@@ -862,7 +862,7 @@
- } /* end IsBlocked check */
- else
- {
-- Log ("attackalert: Host: %s/%s is already blocked Ignoring",
-+ LogAttack ("attackalert: Host: %s/%s is already blocked Ignoring",
- resolvedHost, target);
- }
- } /* end if(scanDetectTrigger) */
-@@ -998,7 +998,7 @@
-
- if (result == ERROR)
- {
-- Log ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
-+ LogAttack ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
- result = FALSE;
- }
-
-@@ -1017,25 +1017,25 @@
- else
- snprintf (resolvedHost, DNSMAXBUF, "%s", target);
-
-- Log ("attackalert: UDP scan from host: %s/%s to UDP port: %d",
-+ LogAttack ("attackalert: UDP scan from host: %s/%s to UDP port: %d",
- resolvedHost, target, incomingPort);
- /* Report on options present */
- if (ip.ihl > 5)
-- Log ("attackalert: Packet from host: %s/%s to UDP port: %d has IP options set (detection avoidance technique).",
-+ LogAttack ("attackalert: Packet from host: %s/%s to UDP port: %d has IP options set (detection avoidance technique).",
- resolvedHost, target, incomingPort);
-
- /* check if this target is already blocked */
- if (IsBlocked (target, gblBlockedFile) == FALSE)
- {
- if (DisposeUDP (target, incomingPort) != TRUE)
-- Log ("attackalert: ERROR: Could not block host %s/%s!!",
-+ LogAttack ("attackalert: ERROR: Could not block host %s/%s!!",
- resolvedHost, target);
- else
- WriteBlocked (target, resolvedHost, incomingPort,
- gblBlockedFile, gblHistoryFile, "UDP");
- } /* end IsBlocked check */
- else
-- Log ("attackalert: Host: %s/%s is already blocked Ignoring",
-+ LogAttack ("attackalert: Host: %s/%s is already blocked Ignoring",
- resolvedHost, target);
- } /* end if(scanDetectTrigger) */
- } /* end if(never block) check */
-@@ -1173,7 +1173,7 @@
- &length);
- if (incomingSockfd < 0)
- {
-- Log ("attackalert: Possible stealth scan from unknown host to TCP port: %d (accept failed)",
-+ LogAttack ("attackalert: Possible stealth scan from unknown host to TCP port: %d (accept failed)",
- ports[count]);
- break;
- }
-@@ -1186,7 +1186,7 @@
-
- if (result == ERROR)
- {
-- Log ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
-+ LogAttack ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
- result = FALSE;
- }
-
-@@ -1211,14 +1211,14 @@
- else
- snprintf (resolvedHost, DNSMAXBUF, "%s", target);
-
-- Log ("attackalert: Connect from host: %s/%s to TCP port: %d",
-+ LogAttack ("attackalert: Connect from host: %s/%s to TCP port: %d",
- resolvedHost, target, ports[count]);
-
- /* check if this target is already blocked */
- if (IsBlocked (target, gblBlockedFile) == FALSE)
- {
- if (DisposeTCP (target, ports[count]) != TRUE)
-- Log ("attackalert: ERROR: Could not block host %s !!",
-+ LogAttack ("attackalert: ERROR: Could not block host %s !!",
- target);
- else
- WriteBlocked (target, resolvedHost,
-@@ -1226,7 +1226,7 @@
- gblHistoryFile, "TCP");
- }
- else
-- Log ("attackalert: Host: %s is already blocked. Ignoring",
-+ LogAttack ("attackalert: Host: %s is already blocked. Ignoring",
- target);
- }
- }
-@@ -1380,7 +1380,7 @@
- result = NeverBlock (target, gblIgnoreFile);
- if (result == ERROR)
- {
-- Log ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
-+ LogAttack ("attackalert: ERROR: cannot open ignore file. Blocking host anyway.\n");
- result = FALSE;
- }
- if (result == FALSE)
-@@ -1410,7 +1410,7 @@
- if (IsBlocked (target, gblBlockedFile) == FALSE)
- {
- if (DisposeUDP (target, ports[count]) != TRUE)
-- Log ("attackalert: ERROR: Could not block host %s !!",
-+ LogAttack ("attackalert: ERROR: Could not block host %s !!",
- target);
- else
- WriteBlocked (target, resolvedHost,
-@@ -1418,7 +1418,7 @@
- gblHistoryFile, "UDP");
- }
- else
-- Log ("attackalert: Host: %s is already blocked. Ignoring",
-+ LogAttack ("attackalert: Host: %s is already blocked. Ignoring",
- target);
- }
- }
-@@ -1469,7 +1469,7 @@
- status = FALSE;
- }
- else
-- Log ("attackalert: Ignoring TCP response per configuration file setting.");
-+ LogAttack ("attackalert: Ignoring TCP response per configuration file setting.");
-
- return (status);
- }
-@@ -1508,7 +1508,7 @@
- status = FALSE;
- }
- else
-- Log ("attackalert: Ignoring UDP response per configuration file setting.");
-+ LogAttack ("attackalert: Ignoring UDP response per configuration file setting.");
-
- return (status);
- }
-diff -urN portsentry-1.0.orig/portsentry_config.h portsentry-1.0/portsentry_config.h
---- portsentry-1.0.orig/portsentry_config.h Tue Mar 7 20:45:13 2000
-+++ portsentry-1.0/portsentry_config.h Sat May 19 14:23:17 2001
-@@ -40,7 +40,7 @@
- /* any of the facilities from syslog.h to send messages to (LOCAL0, etc) */
- #define SYSLOG_FACILITY LOG_DAEMON
- #define SYSLOG_LEVEL LOG_NOTICE
--
-+#define SYSLOG_LEVEL_ATTACK LOG_ALERT
-
- /* the maximum number of hosts to keep in a "previous connect" state engine*/
- #define MAXSTATE 50
-diff -urN portsentry-1.0.orig/portsentry_io.c portsentry-1.0/portsentry_io.c
---- portsentry-1.0.orig/portsentry_io.c Sun Nov 14 23:43:06 1999
-+++ portsentry-1.0/portsentry_io.c Sat May 19 14:30:09 2001
-@@ -34,22 +34,34 @@
-
- /* Main logging function to surrogate syslog */
- void
--Log (char *logentry, ...)
-+DoLog (int priority, char *logentry, va_list argsPtr)
- {
- char logbuffer[MAXBUF];
-
-- va_list argsPtr;
-- va_start (argsPtr, logentry);
--
- vsnprintf (logbuffer, MAXBUF, logentry, argsPtr);
-
-- va_end(argsPtr);
--
- openlog ("portsentry", LOG_PID, SYSLOG_FACILITY);
-- syslog (SYSLOG_LEVEL, "%s", logbuffer);
-+ syslog (priority, "%s", logbuffer);
- closelog ();
- }
-
-+void
-+Log (char *logentry, ...)
-+{
-+ va_list argsPtr;
-+ va_start (argsPtr, logentry);
-+ DoLog (SYSLOG_LEVEL, logentry, argsPtr);
-+ va_end(argsPtr);
-+}
-+
-+void
-+LogAttack (char *logentry, ...)
-+{
-+ va_list argsPtr;
-+ va_start (argsPtr, logentry);
-+ DoLog (SYSLOG_LEVEL_ATTACK, logentry, argsPtr);
-+ va_end(argsPtr);
-+}
-
- void
- Exit (int status)
-@@ -460,7 +472,7 @@
- }
- else
- {
-- Log ("attackalert: Host %s has been blocked via dropped route using command: \"%s\"", target,
-+ LogAttack ("attackalert: Host %s has been blocked via dropped route using command: \"%s\"", target,
- commandStringFinal);
- return (TRUE);
- }
-@@ -508,7 +520,7 @@
- else
- {
- /* report success */
-- Log ("attackalert: External command run for host: %s using command: \"%s\"", target,
-+ LogAttack ("attackalert: External command run for host: %s using command: \"%s\"", target,
- commandStringFinal);
- return (TRUE);
- }
-@@ -568,7 +580,7 @@
- {
- fprintf (output, "%s\n", commandStringFinal);
- fclose (output);
-- Log ("attackalert: Host %s has been blocked via wrappers with string: \"%s\"", target, commandStringFinal);
-+ LogAttack ("attackalert: Host %s has been blocked via wrappers with string: \"%s\"", target, commandStringFinal);
- return (TRUE);
- }
- }
-diff -urN portsentry-1.0.orig/portsentry_io.h portsentry-1.0/portsentry_io.h
---- portsentry-1.0.orig/portsentry_io.h Sun Nov 14 23:43:06 1999
-+++ portsentry-1.0/portsentry_io.h Sat May 19 14:23:17 2001
-@@ -31,6 +31,7 @@
- /* prototypes */
- int WriteBlocked (char *, char *, int, char *, char *, char *);
- void Log (char *,...);
-+void LogAttack (char *,...);
- void Exit (int);
- void Start (void);
- int DaemonSeed (void);
projects / packages / portsentry.git / commitdiff