diff -Naurb scanlogd-2.2.5.orig/in_nids.c scanlogd-2.2.6/in_nids.c --- scanlogd-2.2.5.orig/in_nids.c 2004-06-02 03:58:23.000000000 +0400 +++ scanlogd-2.2.6/in_nids.c 2006-03-05 13:12:16.000000000 +0300 @@ -22,7 +22,7 @@ static void nids_process_packet(struct ip *packet) { /* Sanity check to make sure we calculate the packet size correctly. We - * don't expect any fragments here, as libnids should have defragmented + * don't expect any fragments here since libnids should have defragmented * stuff for us; this is for testing with nids_register_ip_frag(). */ if (packet->ip_off & htons(IP_MF | IP_OFFMASK)) return; diff -Naurb scanlogd-2.2.5.orig/Makefile scanlogd-2.2.6/Makefile --- scanlogd-2.2.5.orig/Makefile 2000-11-10 05:47:04.000000000 +0300 +++ scanlogd-2.2.6/Makefile 2006-03-05 13:03:15.000000000 +0300 @@ -1,7 +1,7 @@ CC = gcc -LD = gcc +LD = $(CC) RM = rm -f -CFLAGS = -c -Wall -O2 -fomit-frame-pointer +CFLAGS = -Wall -O2 -fomit-frame-pointer LDFLAGS = -s PCAP_H = -I/usr/include/pcap @@ -32,16 +32,16 @@ $(LD) $(LDFLAGS) $(OBJS_COMMON) in_pcap.o $(PCAP_L) -o scanlogd in_pcap.o: params.h in.h - $(CC) $(CFLAGS) $(PCAP_H) in_pcap.c + $(CC) $(CFLAGS) $(PCAP_H) -c in_pcap.c in_nids.o: params.h in.h - $(CC) $(CFLAGS) $(NIDS_H) in_nids.c + $(CC) $(CFLAGS) $(NIDS_H) -c in_nids.c scanlogd.o: params.h in.h in_linux.o: params.h in.h .c.o: - $(CC) $(CFLAGS) $*.c + $(CC) $(CFLAGS) -c $*.c clean: $(RM) $(PROJ) $(OBJS) diff -Naurb scanlogd-2.2.5.orig/params.h scanlogd-2.2.6/params.h --- scanlogd-2.2.5.orig/params.h 2004-06-02 04:22:23.000000000 +0400 +++ scanlogd-2.2.6/params.h 2006-03-05 13:13:56.000000000 +0300 @@ -11,8 +11,7 @@ /* * An unprivileged dummy user to run as. The user and its UID must not be * used for any other purpose (that is, don't use "nobody" here). You can - * #undef this to let scanlogd run as root, but I recommend against doing - * so. + * #undef this to let scanlogd run as root, but this is not recommended. */ #define SCANLOGD_USER "scanlogd" @@ -57,19 +56,20 @@ /* * Port scan detection thresholds: at least COUNT ports need to be scanned - * from the same source, with no longer than DELAY ticks between ports. + * from the same source, with no longer than DELAY seconds between ports. */ #define SCAN_MIN_COUNT 7 #define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV) #define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT -#define SCAN_DELAY_THRESHOLD (CLK_TCK * 3) +#define SCAN_DELAY_THRESHOLD 3 /* * Log flood detection thresholds: temporarily stop logging if more than - * COUNT port scans are detected with no longer than DELAY between them. + * COUNT port scans are detected with no longer than DELAY seconds between + * them. */ #define LOG_COUNT_THRESHOLD 5 -#define LOG_DELAY_THRESHOLD (CLK_TCK * 20) +#define LOG_DELAY_THRESHOLD 20 /* * Log line length limit, such as to fit into one SMS message. #undef this diff -Naurb scanlogd-2.2.5.orig/scanlogd.c scanlogd-2.2.6/scanlogd.c --- scanlogd-2.2.5.orig/scanlogd.c 2004-06-10 17:20:55.000000000 +0400 +++ scanlogd-2.2.6/scanlogd.c 2006-03-05 13:19:51.000000000 +0300 @@ -33,6 +33,8 @@ #include "params.h" #include "in.h" +static clock_t scan_delay_threshold, log_delay_threshold; + #define HF_DADDR_CHANGING 0x01 #define HF_SPORT_CHANGING 0x02 #define HF_TOS_CHANGING 0x04 @@ -178,7 +180,7 @@ clock_t now; now = info->timestamp; - if (now - last > LOG_DELAY_THRESHOLD || now < last) count = 0; + if (now - last > log_delay_threshold || now < last) count = 0; if (++count <= LOG_COUNT_THRESHOLD + 1) last = now; if (count <= LOG_COUNT_THRESHOLD) @@ -236,7 +238,7 @@ /* We know this address, and the entry isn't too old. Update it. */ if (current) - if (now - current->timestamp <= SCAN_DELAY_THRESHOLD && + if (now - current->timestamp <= scan_delay_threshold && now >= current->timestamp) { /* Just update the TCP flags if we've seen this port already */ for (index = 0; index < current->count; index++) @@ -259,7 +261,7 @@ current->flags_or |= flags; current->flags_and &= flags; -/* Specify if destination address, source port, TOS or TTL are not fixed */ +/* Specify if destination address, source port, TOS, or TTL are not fixed */ if (current->daddr.s_addr != ip->ip_dst.s_addr) current->flags |= HF_DADDR_CHANGING; if (current->sport != tcp->th_sport) @@ -286,7 +288,7 @@ return; } -/* We know this address, but the entry is outdated. Mark it unused, and +/* We know this address, but the entry is outdated. Mark it unused and * remove from the hash table. We'll allocate a new entry instead since * this one might get re-used too soon. */ if (current) { @@ -399,6 +401,7 @@ int main(void) { int dev_null_fd; + clock_t clk_tck; /* Initialize the packet capture interface */ if (in_init()) return 1; @@ -412,6 +415,15 @@ openlog(SYSLOG_IDENT, LOG_NDELAY, SYSLOG_FACILITY); dev_null_fd = open("/dev/null", O_RDONLY); +/* Also do this early - who knows what this system's sysconf() relies upon */ +#if defined(_SC_CLK_TCK) || !defined(CLK_TCK) + clk_tck = sysconf(_SC_CLK_TCK); +#else + clk_tck = CLK_TCK; +#endif + scan_delay_threshold = SCAN_DELAY_THRESHOLD * clk_tck; + log_delay_threshold = LOG_DELAY_THRESHOLD * clk_tck; + /* We can drop root now */ #ifdef SCANLOGD_USER drop_root(); diff -Naurb scanlogd-2.2.5.orig/scanlogd.init scanlogd-2.2.6/scanlogd.init --- scanlogd-2.2.5.orig/scanlogd.init 2004-06-02 04:58:16.000000000 +0400 +++ scanlogd-2.2.6/scanlogd.init 2005-11-16 16:31:51.000000000 +0300 @@ -1,5 +1,5 @@ #!/bin/sh -# $Id: scanlogd.init,v 1.2 2004/06/02 00:58:16 solar Exp $ +# $Owl: Owl/packages/scanlogd/scanlogd/scanlogd.init,v 1.3 2005/11/16 13:31:51 solar Exp $ # # chkconfig: - 35 85 # description: \ diff -Naurb scanlogd-2.2.5.orig/scanlogd.spec scanlogd-2.2.6/scanlogd.spec --- scanlogd-2.2.5.orig/scanlogd.spec 2004-06-10 17:34:05.000000000 +0400 +++ scanlogd-2.2.6/scanlogd.spec 2006-03-05 13:08:25.000000000 +0300 @@ -1,8 +1,8 @@ -# $Id: scanlogd.spec,v 1.6 2004/06/10 13:34:05 solar Exp $ +# $Owl: Owl/packages/scanlogd/scanlogd/scanlogd.spec,v 1.11 2006/03/05 10:08:25 solar Exp $ Summary: A tool to detect and log TCP port scans. Name: scanlogd -Version: 2.2.5 +Version: 2.2.6 Release: owl1 License: relaxed BSD and (L)GPL-compatible Group: System Environment/Daemons @@ -20,15 +20,15 @@ %setup -q %build -make linux CFLAGS="-c -Wall $RPM_OPT_FLAGS" +%__make linux CFLAGS="-Wall %optflags" %install -rm -rf $RPM_BUILD_ROOT -mkdir -p $RPM_BUILD_ROOT{%_sbindir,%_mandir/man8,/etc/rc.d/init.d} +rm -rf %buildroot +mkdir -p %buildroot{%_sbindir,%_mandir/man8,/etc/rc.d/init.d} -install -m 700 scanlogd $RPM_BUILD_ROOT%_sbindir/ -install -m 644 scanlogd.8 $RPM_BUILD_ROOT%_mandir/man8/ -install -m 700 scanlogd.init $RPM_BUILD_ROOT/etc/rc.d/init.d/scanlogd +install -m 700 scanlogd %buildroot%_sbindir/ +install -m 644 scanlogd.8 %buildroot%_mandir/man8/ +install -m 700 scanlogd.init %buildroot/etc/rc.d/init.d/scanlogd %pre grep -q ^scanlogd: /etc/group || groupadd -g 199 scanlogd @@ -58,16 +58,20 @@ %config /etc/rc.d/init.d/scanlogd %changelog -* Thu Jun 10 2004 Solar Designer 2.2.5-owl1 +* Sun Mar 05 2006 Solar Designer 2.2.6-owl1 +- Use sysconf(_SC_CLK_TCK) instead of CLK_TCK when _SC_CLK_TCK is known to be +available or CLK_TCK is not. + +* Thu Jun 10 2004 Solar Designer 2.2.5-owl1 - Dropped the cleanup() stuff because it was not async-signal-safe and to implement it properly would depend on pcap_breakloop() and on a non-existent(?) equivalent for it with libnids; this code was only used when running as root which is something to not do anyway. -* Thu Jun 03 2004 Solar Designer 2.2.4-owl1 +* Thu Jun 03 2004 Solar Designer 2.2.4-owl1 - Detach from the tty by opening /dev/null on fd 0, 1, 2. -* Wed Jun 02 2004 Solar Designer 2.2.3-owl1 +* Wed Jun 02 2004 Solar Designer 2.2.3-owl1 - When built with libnids or direct libpcap support, use Pavel Kankovsky's smart pcap expression, with a minor enhancement. - Explained "any" and "all" magic device names in a comment in params.h. @@ -78,17 +82,17 @@ - Moved this spec file and the init script to under scanlogd/ to include them in the non-Owl-specific distribution of scanlogd. -* Sun May 23 2004 Solar Designer 2.2.2-owl1 +* Sun May 23 2004 Solar Designer 2.2.2-owl1 - #include for exit(3) (apparently this is actually needed on FreeBSD). - Obfuscated e-mail addresses in the man page and sources. -* Wed May 08 2002 Solar Designer 2.2.1-owl1 +* Wed May 08 2002 Solar Designer 2.2.1-owl1 - Start after syslogd. - Don't abuse glibc-internal __feature macros. -* Wed Feb 06 2002 Solar Designer +* Wed Feb 06 2002 Solar Designer - Enforce our new spec file conventions. -* Thu Jul 12 2001 Solar Designer +* Thu Jul 12 2001 Solar Designer - Packaged scanlogd for Owl.