BackDoor.cc

Go to the documentation of this file.

// $Id: BackDoor.cc,v 1.6 2005/09/13 05:22:49 vern Exp $
//
// Copyright (c) 1999, 2000, 2001, 2002
//      The Regents of the University of California.  All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that: (1) source code distributions
// retain the above copyright notice and this paragraph in its entirety, (2)
// distributions including binary code include the above copyright notice and
// this paragraph in its entirety in the documentation or other materials
// provided with the distribution, and (3) all advertising materials mentioning
// features or use of this software display the following acknowledgement:
// ``This product includes software developed by the University of California,
// Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
// the University nor the names of its contributors may be used to endorse
// or promote products derived from this software without specific prior
// written permission.
// THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
// WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

#include "config.h"

#include "BackDoor.h"
#include "Event.h"
#include "Net.h"
#include "TCP.h"

BackDoorEndpoint::BackDoorEndpoint(TCP_Endpoint* e)
: TCP_EndpointAnalyzer(e)
        {
        is_partial = 0;
        max_top_seq = 0;

        rlogin_checking_done = 0;
        rlogin_string_separator_pos = 0;
        rlogin_num_null = 0;
        rlogin_slash_seen = 0;

        num_pkts = num_8k0_pkts = num_8k4_pkts =
                num_lines = num_normal_lines = num_bytes = num_7bit_ascii = 0;
        }

#define NORMAL_LINE_LENGTH 80

#define TELNET_IAC 255
#define IS_TELNET_NEGOTIATION_CMD(c) ((c) >= 251 && (c) <= 254)

#define DEFAULT_MTU 512

#define RLOGIN_MAX_SIGNATURE_LENGTH 256

void BackDoorEndpoint::FinalCheckForRlogin()
        {
        if ( ! rlogin_checking_done )
                {
                rlogin_checking_done = 1;

                if ( rlogin_num_null > 0 )
                        RloginSignatureFound(0);
                }
        }

int BackDoorEndpoint::DataSent(double /* t */, int seq,
                                int len, int caplen, const u_char* data,
                                const IP_Hdr* /* ip */,
                                const struct tcphdr* /* tp */)
        {
        if ( caplen < len )
                len = caplen;

        if ( len <= 0 )
                return 0;

        if ( Endpoint()->state == TCP_PARTIAL )
                is_partial = 1;

        int ack = Endpoint()->AckSeq() - Endpoint()->StartSeq();
        int top_seq = seq + len;

        if ( top_seq <= ack || top_seq <= max_top_seq )
                // There is no new data in this packet.
                return 0;

        if ( rlogin_signature_found )
                CheckForRlogin(seq, len, data);

        if ( telnet_signature_found )
                CheckForTelnet(seq, len, data);

        if ( ssh_signature_found )
                CheckForSSH(seq, len, data);

        if ( ftp_signature_found )
                CheckForFTP(seq, len, data);

        if ( root_backdoor_signature_found )
                CheckForRootBackdoor(seq, len, data);

        if ( napster_signature_found )
                CheckForNapster(seq, len, data);

        if ( gnutella_signature_found )
                CheckForGnutella(seq, len, data);

        if ( kazaa_signature_found )
                CheckForKazaa(seq, len, data);

        if ( http_signature_found || http_proxy_signature_found )
                CheckForHTTP(seq, len, data);

        if ( smtp_signature_found )
                CheckForSMTP(seq, len, data);

        if ( irc_signature_found )
                CheckForIRC(seq, len, data);

        if ( gaobot_signature_found )
                CheckForGaoBot(seq, len, data);

        max_top_seq = top_seq;

        return 1;
        }

RecordVal* BackDoorEndpoint::BuildStats()
        {
        RecordVal* stats = new RecordVal(backdoor_endp_stats);

        stats->Assign(0, new Val(is_partial, TYPE_BOOL));
        stats->Assign(1, new Val(num_pkts, TYPE_COUNT));
        stats->Assign(2, new Val(num_8k0_pkts, TYPE_COUNT));
        stats->Assign(3, new Val(num_8k4_pkts, TYPE_COUNT));
        stats->Assign(4, new Val(num_lines, TYPE_COUNT));
        stats->Assign(5, new Val(num_normal_lines, TYPE_COUNT));
        stats->Assign(6, new Val(num_bytes, TYPE_COUNT));
        stats->Assign(7, new Val(num_7bit_ascii, TYPE_COUNT));

        return stats;
        }

void BackDoorEndpoint::CheckForRlogin(int seq, int len, const u_char* data)
        {
        if ( rlogin_checking_done )
                return;

        // Looking for pattern:
        //      <null>string<null>string<null>string/string<null>
        // where all string's are non-empty 7-bit-ascii string
        //
        // To avoid having to reassemble, we keep testing each byte until
        // one of the following happens:
        //
        //      - A gap in sequence number occurs
        //      - Four null's have been found
        //      - The number of bytes we examined reaches RLOGIN_MAX_SIGNATURE_LENGTH
        //      - An empty or non-7-bit-ascii string is found
        //
        if ( seq == 1 )
                { // Check if first byte is a NUL.
                if ( data[0] == 0 )
                        {
                        rlogin_num_null = 1;

                        if ( ! Endpoint()->IsOrig() )
                                {
                                RloginSignatureFound(len);
                                return;
                                }

                        rlogin_string_separator_pos = 1;

                        ++seq;  // move past the byte
                        ++data;
                        --len;
                        }
                else
                        {
                        rlogin_checking_done = 1;
                        return;
                        }
                }

        if ( seq > max_top_seq && max_top_seq != 0 )
                { // A gap! Since we don't reassemble things, stop now.
                RloginSignatureFound(0);
                return;
                }

        if ( seq + len <= max_top_seq )
                return; // nothing new

        if ( seq < max_top_seq )
                { // trim to just the new data
                int delta = max_top_seq - seq;
                seq += delta;
                data += delta;
                len -= delta;
                }

        // Search for rlogin signature.
        for ( int i = 0; i < len && rlogin_num_null < 4; ++i )
                {
                if ( data[i] == 0 )
                        {
                        if ( i + seq == rlogin_string_separator_pos + 1 )
                                { // Empty string found.
                                rlogin_checking_done = 1;
                                return;
                                }
                        else
                                {
                                rlogin_string_separator_pos = i + seq;
                                ++rlogin_num_null;
                                }
                        }

                else if ( data[i] == '/' )
                        {
                        if ( rlogin_num_null == 3 )
                                {
                                if ( i + seq == rlogin_string_separator_pos + 1 )
                                        { // Empty terminal type.
                                        rlogin_checking_done = 1;
                                        return;
                                        }

                                rlogin_string_separator_pos = i + seq;
                                rlogin_slash_seen = 1;
                                }
                        }

                else if ( data[i] >= 128 )
                        { // Non-7-bit-ascii
                        rlogin_checking_done = 1;
                        return;
                        }
                }

        if ( rlogin_num_null == 4 )
                {
                if ( rlogin_slash_seen )
                        RloginSignatureFound(0);
                else
                        rlogin_checking_done = 1;

                return;
                }

        if ( seq + len > RLOGIN_MAX_SIGNATURE_LENGTH )
                { // We've waited for too long
                RloginSignatureFound(0);
                return;
                }
        }

void BackDoorEndpoint::RloginSignatureFound(int len)
        {
        if ( rlogin_checking_done )
                return;

        rlogin_checking_done = 1;

        val_list* vl = new val_list;
        vl->append(Conn()->BuildConnVal());
        vl->append(new Val(Endpoint()->IsOrig(), TYPE_BOOL));
        vl->append(new Val(rlogin_num_null, TYPE_COUNT));
        vl->append(new Val(len, TYPE_COUNT));

        Conn()->ConnectionEvent(rlogin_signature_found, vl);
        }

void BackDoorEndpoint::CheckForTelnet(int /* seq */, int len, const u_char* data)
        {
        if ( len >= 3 &&
             data[0] == TELNET_IAC && IS_TELNET_NEGOTIATION_CMD(data[1]) )
                {
                TelnetSignatureFound(len);
                return;
                }

        // Note, we do the analysis per-packet rather than on the reassembled
        // stream.  This is a lot more efficient as then we don't need to
        // do stream reassembly; but it's potentially less accurate, and
        // subject to evasion.  *But*: backdoor detection is inherently
        // subject to a wide variety of evasion, so allowing this form
        // (which is a pain to exploit) costs little.

        num_bytes += len;

        int last_char = 0;
        int offset = 0; // where we consider the latest line to have begun
        int option_length = 0; // length of options in a line

        for ( int i = 0; i < len; ++i )
                {
                unsigned int c = data[i];

                if ( c == '\n' && last_char == '\r' )
                        {
                        // Compress CRLF to just one line termination.
                        last_char = c;
                        continue;
                        }

                if ( c == '\n' || c == '\r' )
                        {
                        ++num_lines;

                        if ( i - offset - option_length <= NORMAL_LINE_LENGTH )
                                ++num_normal_lines;

                        option_length = 0;
                        offset = i;
                        }

                else if ( c == TELNET_IAC )
                        {
                        ++option_length;
                        --num_bytes;

                        if ( ++i < len )
                                {
                                unsigned int code = data[i];
                                if ( code == TELNET_IAC )
                                        // Escaped IAC.
                                        last_char = code;

                                else if ( code >= 251 && code <= 254 )
                                        { // 3-byte option: ignore next byte
                                        ++i;
                                        option_length += 2;
                                        num_bytes -= 2;
                                        }

                                else
                                        // XXX: We don't deal with sub option for simplicity
                                        // although we SHOULD!
                                        {
                                        ++option_length;
                                        --num_bytes;
                                        }
                                }
                        continue;
                        }

                else if ( c != 0 && c < 128 )
                        ++num_7bit_ascii;

                last_char = c;
                }
        }

void BackDoorEndpoint::TelnetSignatureFound(int len)
        {
        val_list* vl = new val_list;
        vl->append(Conn()->BuildConnVal());
        vl->append(new Val(Endpoint()->IsOrig(), TYPE_BOOL));
        vl->append(new Val(len, TYPE_COUNT));

        Conn()->ConnectionEvent(telnet_signature_found, vl);
        }

void BackDoorEndpoint::CheckForSSH(int seq, int len, const u_char* data)
        {
        if ( seq == 1 && CheckForString("SSH-", data, len) && len > 4 &&
             (data[4] == '1' || data[4] == '2') )
                {
                SignatureFound(ssh_signature_found, 1);
                return;
                }

        // Check for length pattern.

        if ( seq < max_top_seq || max_top_seq == 0 )
                // Retransmission involved, or first pkt => size info useless.
                return;

        if ( seq > max_top_seq )
                { // Estimate number of packets in the sequence gap
                int gap = seq - max_top_seq;
                num_pkts += int((gap + DEFAULT_MTU - 1) / DEFAULT_MTU);
                }

        ++num_pkts;

        // According to the spec:
        //      SSH 1.x pkts have size 8k+4
        //      SSH 2.x pkts have size 8k >= 16 (most cipher blocks are 8n)
        if ( len <= 127 )
                switch ( len & 7 ) {
                case 0:
                        if ( len >= 16 )
                                ++num_8k0_pkts;
                        break;

                case 4:
                        ++num_8k4_pkts;
                        break;
                }
        else
                { // len is likely to be some MTU.
                }
        }

void BackDoorEndpoint::CheckForRootBackdoor(int seq, int len, const u_char* data)
        {
        // Check for root backdoor signature: an initial payload of
        // exactly "# ".
        if ( seq == 1 && len == 2 && ! Endpoint()->IsOrig() &&
             data[0] == '#' && data[1] == ' ' )
                SignatureFound(root_backdoor_signature_found);
        }

void BackDoorEndpoint::CheckForFTP(int seq, int len, const u_char* data)
        {
        // Check for FTP signature
        //
        // Currently, the signatures include: "220 ", "220-"
        //
        // For a day's worth of LBNL FTP activity (7,229 connections),
        // the distribution of the code in the first line returned by
        // the server (the lines always began with a code) is:
        //
        //      220: 6685
        //      421: 535
        //      226: 7
        //      426: 1
        //      200: 1
        //
        // The 421's are all "host does not have access" or "timeout" of
        // some form, so it's not big deal with we miss them (if that helps
        // keep down the false positives).

        if ( seq != 1 || Endpoint()->IsOrig() || len < 4 )
                return;

        if ( CheckForString("220", data, len) &&
             (data[3] == ' ' || data[3] == '-') )
                SignatureFound(ftp_signature_found);

        else if ( CheckForString("421", data, len) &&
                  (data[3] == '-' || data[3] == ' ') )
                SignatureFound(ftp_signature_found);
        }

void BackDoorEndpoint::CheckForNapster(int seq, int len, const u_char* data)
        {
        // Check for Napster signature "GETfoobar" or "SENDfoobar" where
        // "foobar" is the Napster handle associated with the request
        // (so pretty much any arbitrary identifier, but sent adjacent
        // to the GET or SEND with no intervening whitespace; but also
        // sent in a separate packet.

        if ( seq != 1 || ! Endpoint()->IsOrig() )
                return;

        if ( len == 3 && CheckForString("GET", data, len) )
                // GETfoobar.
                SignatureFound(napster_signature_found);

        else if ( len == 4 && CheckForString("SEND", data, len) )
                // SENDfoobar.
                SignatureFound(napster_signature_found);
        }

void BackDoorEndpoint::CheckForSMTP(int seq, int len, const u_char* data)
        {
        const char* smtp_handshake[] = { "HELO", "EHLO", 0 };

        if ( seq != 1 )
                return;

        if ( CheckForStrings(smtp_handshake, data, len) )
                SignatureFound(smtp_signature_found);
        }

void BackDoorEndpoint::CheckForIRC(int seq, int len, const u_char* data)
        {
        // Look for any of the following exchange in the initial (15) packets
        // of a connection.
        //
        // WHO  : (C->S) client query for name
        // PING : (S->C) test for presence of client at other end
        // PONG : (C->S) reply to PING message
        // MODE : (C->S)
        // IRCX : (C->S) ?? Not in RFC
        // NICK : (C->S) user nickname

        const char* irc_indicator[] = {
                "WHO", "PING", "PONG", "NODE", "IRCX", "NICK", 0
        };

        if ( num_pkts > 15 || len < 5 )
                return;

        if ( CheckForStrings(irc_indicator, data, len) )
                SignatureFound(irc_signature_found);
        }

void BackDoorEndpoint::CheckForGnutella(int seq, int len, const u_char* data)
        {
        // After connecting to the server, the connecting client says:
        //
        //              GNUTELLA CONNECT/<version>\n\n
        //
        // The accepting server responds:
        //
        //              GNUTELLA OK\n\n
        //
        // We find checking the first 8 bytes suffices, and that will
        // also catch variants that use something other than "CONNECT".

        if ( seq == 1 && CheckForString("GNUTELLA ", data, len) )
                SignatureFound(gnutella_signature_found);
        }

void BackDoorEndpoint::CheckForGaoBot(int seq, int len, const u_char* data)
        {
        if ( seq == 1 && CheckForString("220 Bot Server (Win32)", data, len) )
                SignatureFound(gaobot_signature_found);
        }

void BackDoorEndpoint::CheckForKazaa(int seq, int len, const u_char* data)
        {
        // *Some*, though not all, KaZaa connections begin with:
        //
        //              GIVE<space>

        if ( seq == 1 && CheckForString("GIVE ", data, len) )
                SignatureFound(kazaa_signature_found);
        }


int is_http_whitespace(const u_char ch)
        {
        return ! isprint(ch) || isspace(ch);
        }

int skip_http_whitespace(const u_char* data, int len, int max)
        {
        int k;
        for ( k = 0; k < len; ++k )
                {
                if ( ! is_http_whitespace(data[k]) )
                        break;

                // Here we do not go beyond CR -- this is OK for
                // processing first line of HTTP requests. However, it
                // cannot be used to process multiple-line headers.

                if ( data[k] == '\015' || k == max )
                        return -1;
                }

        return k < len ? k : -1;
        }

int is_absolute_url(const u_char* data, int len)
        {
        // Look for '://' in the URL.
        const char* abs_url_sig = "://";
        const char* abs_url_sig_pos = abs_url_sig;

        // Warning: the following code is NOT general for any signature string,
        // but only works for specific strings like "://".

        for ( int pos = 0; pos < len; ++pos )
                {
                if ( *abs_url_sig_pos == '\0' )
                        return 1;

                if ( data[pos] == *abs_url_sig_pos )
                        ++abs_url_sig_pos;

                else
                        {
                        if ( is_http_whitespace(data[pos]) )
                                return 0;

                        abs_url_sig_pos = abs_url_sig;
                        if ( *abs_url_sig != '\0' &&
                             *abs_url_sig_pos == data[pos] )
                                ++abs_url_sig_pos;
                        }
                }

        return *abs_url_sig_pos == '\0';
        }

void BackDoorEndpoint::CheckForHTTP(int seq, int len, const u_char* data)
        {
        // According to the RFC, we should look for
        // '<method> SP <url> SP HTTP/<version> CR LF'
        // where:
        //
        //      <method> = GET | HEAD | POST
        //
        // (i.e., HTTP 1.1 methods are ignored for now)
        // <version> = 1.0 | 1.1.
        //
        // However, this is probably too restrictive to catch 'non-standard'
        // requests. Instead, we look for certain methods only in the first
        // line of the first packet only.
        //
        // "The method is case-sensitive." -- RFC 2616

        const char* http_method[] = { "GET", "HEAD", "POST", 0 };

        if ( seq != 1 )
                return; // first packet only

        // Pick up the method.
        int pos = skip_http_whitespace (data, len, 0);
        if ( pos < 0 )
                return;

        int method;
        for ( method = 0; http_method[method]; ++method )
                {
                const char* s = http_method[method];
                int i;
                for ( i = pos; i < len; ++i, ++s )
                        if ( data[i] != *s )
                                break;

                if ( *s == '\0' )
                        {
                        pos = i;
                        break;
                        }
                }

        if ( ! http_method[method] )
                return;

        if ( pos >= len || ! is_http_whitespace(data[pos]) )
                return;

        if ( http_signature_found )
                SignatureFound(http_signature_found);

        if ( http_proxy_signature_found )
                {
                const u_char* rest = data + pos;
                int rest_len = len - pos;

                pos = skip_http_whitespace(rest, rest_len, rest_len);

                if ( pos >= 0 )
                        CheckForHTTPProxy(seq, rest_len - pos, rest + pos);
                }
        }

void BackDoorEndpoint::CheckForHTTPProxy(int /* seq */, int len,
                                        const u_char* data)
        {
        // Proxy ONLY accepts absolute URI's: "The absoluteURI form is
        // REQUIRED when the request is being made to a proxy." -- RFC 2616

        if ( is_absolute_url(data, len) )
                SignatureFound(http_proxy_signature_found);
        }


void BackDoorEndpoint::SignatureFound(EventHandlerPtr e, int do_orig)
        {
        val_list* vl = new val_list;
        vl->append(Conn()->BuildConnVal());

        if ( do_orig )
                vl->append(new Val(Endpoint()->IsOrig(), TYPE_BOOL));

        Conn()->ConnectionEvent(e, vl);
        }


int BackDoorEndpoint::CheckForStrings(const char** strs,
                                        const u_char* data, int len)
        {
        for ( ; *strs; ++strs )
                if ( CheckForString(*strs, data, len) )
                        return 1;

        return 0;
        }

int BackDoorEndpoint::CheckForString(const char* str,
                                        const u_char* data, int len)
        {
        for ( ; len > 0 && *str; --len, ++data, ++str )
                if ( *str != *data )
                        return 0;

        return *str == 0;
        }


BackDoorAnalyzer::BackDoorAnalyzer(TCP_Connection* c)
: TCP_Analyzer(c)
        {
        orig_endp = new BackDoorEndpoint(conn->Orig());
        resp_endp = new BackDoorEndpoint(conn->Resp());

        timeout = backdoor_stat_period;
        backoff = backdoor_stat_backoff;

        timer_mgr->Add(new BackDoorTimer(network_time + timeout, this));
        }

BackDoorAnalyzer::~BackDoorAnalyzer()
        {
        Done();

        Unref(orig_endp);
        Unref(resp_endp);
        }

void BackDoorAnalyzer::Done()
        {
        if ( ! done )
                {
                orig_endp->FinalCheckForRlogin();
                resp_endp->FinalCheckForRlogin();

                if ( ! Conn()->Skipping() )
                        StatEvent();

                RemoveEvent();
                done = 1;
                }
        }

void BackDoorAnalyzer::StatTimer(double t, int is_expire)
        {
        if ( done || Conn()->Skipping() )
                return;

        StatEvent();

        if ( ! is_expire )
                {
                timeout *= backoff;
                timer_mgr->Add(new BackDoorTimer(t + timeout, this));
                }
        }

void BackDoorAnalyzer::StatEvent()
        {
        val_list* vl = new val_list;
        vl->append(Conn()->BuildConnVal());
        vl->append(orig_endp->BuildStats());
        vl->append(resp_endp->BuildStats());

        Conn()->ConnectionEvent(backdoor_stats, vl);
        }

void BackDoorAnalyzer::RemoveEvent()
        {
        val_list* vl = new val_list;
        vl->append(Conn()->BuildConnVal());

        Conn()->ConnectionEvent(backdoor_remove_conn, vl);
        }

BackDoorTimer::BackDoorTimer(double t, BackDoorAnalyzer* a)
: Timer(t, TIMER_BACKDOOR)
        {
        analyzer = a;
        Ref(a);
        }

BackDoorTimer::~BackDoorTimer()
        {
        Unref(analyzer);
        }

void BackDoorTimer::Dispatch(double t, int is_expire)
        {
        analyzer->StatTimer(t, is_expire);
        }

---