Nessus KB saving filename issue [PATCH]
Hubert Seiwert <[email protected]> Tue, 16 Jan 2007 12:54:18 +0000
| Newsgroups | gmane.comp.security.nessus.devel |
|---|---|
| Organization | Westpoint Ltd. |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------010308040100010502030206
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Hi,
the KB files saved by Nessus 2.2.9 in /var/nessus/users/[user]/kbs (if
save_knowledge_base is enabled in the Nessusrc) are named according to the
hostname of the target being scanned.
This can cause problems if several different targets with different IPs, but
sharing the same hostnames (e.g. load balanced servers) are scanned from one
Nessusd host, as the KB files overwrite each other and so scan results are lost
or potentially mixed up if the KB files are needed for later processing (e.g.
for parsing information out of them or for the "resume scans" Nessus feature).
To address this Richard Moore and I developed the attached patches for Nessus
2.2.9 which change the naming to /var/nessus/users/[user]/kbs/[host]_[ip] to
avoid any ambiguity.
Technical details are as follows:
In nessus-core/nessusd/save_kb.c:
Added function kb_fname_ip(global, hostname, ip) which is a clone of kb_fname
but with added IP argument. kb_fname() was left in but is now unused.
Patched functions in save_kb.c:
save_kb_new
save_kb_close
save_kb_exists
save_kb_restore_backup
save_kb_backup
save_kb_load_kb
Added IP argument to each one and made them call kb_fname_ip with IP arg instead
of kb_fname.
In nessus-core/nessusd/attack.c:
Modified every call to one of the above save_kb functions to give the IP
argument. We retrieve the IP using arg_get_value(hostinfos, "IP") and from the
host_ip variable where available.
We have tested normal scanning using this patch and the KB files are now saved
under the expected filenames, and this is also logged correctly. However we have
not tested any "resume scans" or related functionality where Nessus itself reads
old KB files.
Will the developer team consider this patch for inclusion in the next Nessus 2.2
release and/or Nessus 3?
--
Hubert Seiwert
Internet Security Specialist, Westpoint Ltd
Albion Wharf, 19 Albion Street, Manchester M1 5LN, United Kingdom
Web: www.westpoint.ltd.uk
Tel: +44-161-2371028
--------------010308040100010502030206
Content-Type: text/plain;
name="attack.c.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="attack.c.patch"
--- nessus-2.2.9/nessus-core/nessusd/attack.c 2006-01-30 20:56:53.000000000 +0000
+++ nessus-2.2.9/nessus-core/nessusd/attack.c.patched 2007-01-15 18:24:42.000000000 +0000
@@ -282,10 +282,10 @@
attack_user_name(globals),
hostname);
pluginlaunch_stop();
- if(new_kb)save_kb_close(globals, hostname);
+ if(new_kb)save_kb_close(globals, hostname, inet_ntoa(*(struct in_addr *)arg_get_value(hostinfos, "IP")));
if(kb_item_get_int(kb, "Host/ping_failed") > 0)
{
- save_kb_restore_backup(globals, hostname);
+ save_kb_restore_backup(globals, hostname, inet_ntoa(*(struct in_addr *)arg_get_value(hostinfos, "IP")));
}
plugin_set_running_state(sched, plugin, PLUGIN_STATUS_DONE);
@@ -342,16 +342,16 @@
if(save_kb(globals))
{
- if( save_kb_exists(globals, hostname) != 0 &&
+ if( save_kb_exists(globals, hostname, inet_ntoa(*(struct in_addr *)arg_get_value(hostinfos, "IP"))) != 0 &&
save_kb_pref_restore(globals) != 0 )
{
- save_kb_backup(globals, hostname);
- kb = save_kb_load_kb(globals, hostname);
+ save_kb_backup(globals, hostname, inet_ntoa(*(struct in_addr *)arg_get_value(hostinfos, "IP")));
+ kb = save_kb_load_kb(globals, hostname, inet_ntoa(*(struct in_addr *)arg_get_value(hostinfos, "IP")));
kb_restored = 1;
}
else
{
- save_kb_new(globals, hostname);
+ save_kb_new(globals, hostname, inet_ntoa(*(struct in_addr *)arg_get_value(hostinfos, "IP")));
kb = kb_new();
new_kb = 1;
}
@@ -422,7 +422,7 @@
arg_free(tmp);
pluginlaunch_stop();
plugins_scheduler_free(sched);
- if(new_kb)save_kb_close(globals, hostname);
+ if(new_kb)save_kb_close(globals, hostname, inet_ntoa(*(struct in_addr *)arg_get_value(hostinfos, "IP")));
}
/*-----------------------------------------------------------------
@@ -697,7 +697,6 @@
{
nthread_t pid;
-
/*
* nessusd offers the ability to either test
* only the hosts we tested in the past, or only
@@ -707,7 +706,7 @@
{
if(save_kb_pref_tested_hosts_only(globals))
{
- if(!save_kb_exists(globals, hostname))
+ if(!save_kb_exists(globals, hostname, inet_ntoa(host_ip)))
{
log_write("user %s : not testing %s because it has never been tested before\n",
attack_user_name(globals),
@@ -724,7 +723,7 @@
else if(save_kb_pref_untested_hosts_only(globals))
{
/* XXX */
- if(save_kb_exists(globals, hostname))
+ if(save_kb_exists(globals, hostname, inet_ntoa(host_ip)))
{
log_write("user %s : not testing %s because it has already been tested before\n",
attack_user_name(globals),
--------------010308040100010502030206
Content-Type: text/plain;
name="save_kb.c.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="save_kb.c.patch"
--- nessus-2.2.9/nessus-core/nessusd/save_kb.c 2006-01-30 20:56:57.000000000 +0000
+++ nessus-2.2.9/nessus-core/nessusd/save_kb.c.patched 2007-01-15 18:05:51.000000000 +0000
@@ -121,10 +121,30 @@
/*----------------------------------------------------------------
From <hostname>, return
- /path/to/var/nessus/<username>/kb/<hostname>
+ /path/to/var/nessus/<username>/kb/<hostname>_<ip>
+ added _<ip> to the above, Hubert Seiwert 2006-01-15
------------------------------------------------------------------*/
static char*
+kb_fname_ip(globals, hostname, ip)
+ struct arglist * globals;
+ char * hostname;
+ char * ip;
+{
+ char * dir = kb_dirname(globals);
+ char * ret;
+ char * hn = strdup(hostname);
+
+ hn = filter_odd_name(hn);
+
+ ret = emalloc(strlen(dir) + strlen(hn) + strlen(ip) + 3);
+ sprintf(ret, "%s/%s_%s", dir, hn, ip);
+ efree(&dir);
+ efree(&hn);
+ return ret;
+}
+
+static char*
kb_fname(globals, hostname)
struct arglist * globals;
char * hostname;
@@ -395,9 +415,10 @@
-------------------------------------------------------------------*/
int
-save_kb_new(globals, hostname)
+save_kb_new(globals, hostname, ip)
struct arglist * globals;
char * hostname;
+ char * ip;
{
char * fname;
char * dir;
@@ -411,7 +432,7 @@
kb_mkdir(dir);
efree(&dir);
- fname = kb_fname(globals, hostname);
+ fname = kb_fname_ip(globals, hostname, ip);
if(file_locked(fname))
{
@@ -441,12 +462,13 @@
void
-save_kb_close(globals, hostname)
+save_kb_close(globals, hostname, ip)
struct arglist * globals;
char * hostname;
+ char * ip;
{
int fd = (int)arg_get_value(globals, "save_kb");
- char* fname = kb_fname(globals, hostname);
+ char* fname = kb_fname_ip(globals, hostname, ip);
if(fd > 0)close(fd);
file_unlock(fname);
efree(&fname);
@@ -459,11 +481,12 @@
* (returns true if a knowledge base exists)
*/
int
-save_kb_exists(globals, hostname)
+save_kb_exists(globals, hostname, ip)
struct arglist * globals;
char * hostname;
+ char * ip;
{
- char * fname = kb_fname(globals, hostname);
+ char * fname = kb_fname_ip(globals, hostname, ip);
FILE *f;
if(file_locked(fname))
@@ -517,11 +540,12 @@
* Restores a copy of the knowledge base
*/
int
-save_kb_restore_backup(globals, hostname)
+save_kb_restore_backup(globals, hostname, ip)
struct arglist * globals;
char*hostname;
+ char *ip;
{
- char * fname = kb_fname(globals, hostname);
+ char * fname = kb_fname_ip(globals, hostname, ip);
char * bakname;
int fd;
@@ -542,11 +566,12 @@
*/
int
-save_kb_backup(globals, hostname)
+save_kb_backup(globals, hostname, ip)
struct arglist * globals;
char* hostname;
+ char* ip;
{
- char * fname = kb_fname(globals, hostname);
+ char * fname = kb_fname_ip(globals, hostname, ip);
char * newname = NULL;
int fd_src = -1, fd_dst = -1;
@@ -618,11 +643,12 @@
* entries starting by '/tmp/'
*/
struct kb_item **
-save_kb_load_kb(globals, hostname)
+save_kb_load_kb(globals, hostname, ip)
struct arglist * globals;
char * hostname;
+ char * ip;
{
- char * fname = kb_fname(globals, hostname);
+ char * fname = kb_fname_ip(globals, hostname, ip);
FILE * f;
int fd;
struct kb_item ** kb;
--------------010308040100010502030206
Content-Type: text/plain;
name="save_kb.h.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="save_kb.h.patch"
--- nessus-2.2.9/nessus-core/nessusd/save_kb.h 2004-06-12 15:12:49.000000000 +0100
+++ nessus-2.2.9/nessus-core/nessusd/save_kb.h.patched 2007-01-15 18:05:51.000000000 +0000
@@ -2,17 +2,17 @@
#define SAVE_KB_H__
-int save_kb_new(struct arglist*, char *);
-void save_kb_close(struct arglist*, char*);
+int save_kb_new(struct arglist*, char *, char *);
+void save_kb_close(struct arglist*, char*, char *);
-int save_kb_backup(struct arglist*, char*);
-int save_kb_restore_backup(struct arglist*, char*);
+int save_kb_backup(struct arglist*, char*, char *);
+int save_kb_restore_backup(struct arglist*, char*, char *);
int save_kb_write_int(struct arglist*, char*, char*, int);
int save_kb_write_str(struct arglist*, char*, char*, char*);
-int save_kb_exists(struct arglist*, char*);
-struct kb_item ** save_kb_load_kb(struct arglist*, char*);
+int save_kb_exists(struct arglist*, char*, char *);
+struct kb_item ** save_kb_load_kb(struct arglist*, char*, char*);
/*
* Preferences set by the user
--------------010308040100010502030206
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel
--------------010308040100010502030206--