11 #define LIX_FDTABLE_MAX_FDS_CAP 2048u 43 WARNING(
"[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
91 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for GVA 0x%016llx: 0x%08x\n",
92 SocketGva +
LIX_FIELD(Socket, Sk), status);
99 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for GVA 0x%016llx: 0x%08x\n",
106 WARNING(
"[WARNING] Sock 0x%016llx has NULL proto pointer.", sock);
110 for (iProto = 0; iProto <
ARRAYSIZE(protos); iProto++)
112 if (proto == protos[iProto].
Gva)
123 ERROR(
"[ERROR] IntKernVirtMemRead failed for GVA 0x%016llx: 0x%08x\n",
124 proto +
LIX_FIELD(Ungrouped, ProtoName), status);
128 for (iProto = 0; iProto <
ARRAYSIZE(protos); iProto++)
130 if (!strcmp(protos[iProto].
Name, protoName))
132 protos[iProto].
Gva = proto;
146 ERROR(
"[ERROR] IntKernVirtMemRead failed for GVA 0x%016llx: 0x%08x\n",
153 Connection->Endpoint = sock;
155 memset(&Connection->LocalAddress, 0,
sizeof(Connection->LocalAddress));
156 memset(&Connection->RemoteAddress, 0,
sizeof(Connection->RemoteAddress));
163 ERROR(
"[ERROR] IntKernVirtMemRead failed for GVA 0x%016llx: 0x%08x\n",
164 sock +
LIX_FIELD(Sock, V6RcvSaddr), status);
171 ERROR(
"[ERROR] IntKernVirtMemRead failed for GVA 0x%016llx: 0x%08x\n",
172 sock +
LIX_FIELD(Sock, V6RcvSaddr), status);
181 ERROR(
"[ERROR] IntKernVirtMemRead failed for GVA 0x%016llx: 0x%08x\n",
182 sock +
LIX_FIELD(Sock, RcvSaddr), status);
189 ERROR(
"[ERROR] IntKernVirtMemRead failed for GVA 0x%016llx: 0x%08x\n",
190 sock +
LIX_FIELD(Sock, RcvSaddr), status);
198 ERROR(
"[ERROR] IntKernVirtMemRead failed for GVA 0x%016llx: 0x%08x\n",
206 ERROR(
"[ERROR] IntKernVirtMemRead failed for GVA 0x%016llx: 0x%08x\n",
240 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for GVA 0x%016llx: 0x%08x\n",
241 StructFileGva +
LIX_FIELD(Ungrouped, FileDentry), status);
248 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for GVA 0x%016llx: 0x%08x\n",
249 dentry +
LIX_FIELD(Dentry, Inode), status);
256 ERROR(
"[ERROR] IntKernVirtMemRead failed for GVA 0x%016llx: 0x%08x\n",
257 dentry +
LIX_FIELD(Dentry, Inode), status);
266 *SocketGva = inode -
LIX_FIELD(Ungrouped, SocketAllocVfsInode);
296 QWORD files, fdt, fd;
316 if (NULL == Callback)
324 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for %llx: 0x%08x\n",
325 Task->Gva +
LIX_FIELD(TaskStruct, Files), status);
332 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for %llx: 0x%08x\n", files +
LIX_FIELD(Files, Fdt), status);
339 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for %llx: 0x%08x\n", fdt +
LIX_FIELD(FdTable, MaxFds), status);
346 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for %llx: 0x%08x\n", files +
LIX_FIELD(FdTable, Fd), status);
353 for (
DWORD iFd = 0; iFd < maxFds; iFd++)
361 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for %llx: 0x%08x\n", fd + iFd * 8ull, status);
373 ERROR(
"[ERROR] IntLixSocketGetConnection failed for socket %llx : 0x%08x\n", socketGva, status);
406 TRACE(
"[CONNECTION] Owner %s | Family: %u | State %s | LocalPort: %hu | RemoteAddress: %s | Endpoint %016llx\n",
464 ERROR(
"[ERROR] IntLixTaskIterateTasks failed: 0x%08x\n", status);
void(* PFUNC_IterateConnectionsCallback)(INTRONET_ENDPOINT *Endpoint)
EVENT_CONNECTION_EVENT Connection
#define INT_STATUS_SUCCESS
INTRONET_PORT LocalPort
Local port.
An internal structure used to cache the "struct proto" addresses of required connection types...
CHAR Name[32]
The protocol name as defined in Linux kernel.
#define INT_SUCCESS(Status)
static void IntLixNetProcessConnection(INTRONET_ENDPOINT *Endpoint)
Callback for IntLixNetIterateTaskConnections that processes each TCP/IP connection.
struct _SOCK_PROTO SOCK_PROTO
An internal structure used to cache the "struct proto" addresses of required connection types...
#define INT_STATUS_NOT_NEEDED_HINT
INTRO_NET_AF AddressFamily
Address family.
int INTSTATUS
The status data type.
LIX_TASK_OBJECT * OwnerTask
Pointer to the task that owns the connection.
const char * IntNetStateToString(INTRO_NET_STATE State)
Converts a connection state to a string.
INTRO_GUEST_TYPE OSType
The type of the guest.
#define INTRO_OPT_EVENT_CONNECTIONS
Enable connection events.
static INTSTATUS IntLixNetGetConnectionFromSocket(QWORD SocketGva, INTRONET_ENDPOINT *Connection)
Fills an INTRONET_ENDPOINT structure from a TCP/IP socket GVA.
static BOOLEAN IntLixNetFileIsSocket(QWORD StructFileGva, QWORD *SocketGva)
Check if a give file object is a socked and return the socket GVA.
#define INTRONET_MIN_BUFFER_SIZE
The minimum buffer size needed for the textual representation of an IP address.
GENERIC_ALERT gAlert
Global alert buffer.
INTSTATUS IntKernVirtMemFetchDword(QWORD GuestVirtualAddress, DWORD *Data)
Reads 4 bytes from the guest kernel memory.
#define IS_KERNEL_POINTER_LIX(p)
INTSTATUS IntKernVirtMemFetchQword(QWORD GuestVirtualAddress, QWORD *Data)
Reads 8 bytes from the guest kernel memory.
INTSTATUS IntNotifyIntroEvent(INTRO_EVENT_TYPE EventClass, void *Param, size_t EventSize)
Notifies the integrator about an introspection alert.
DWORD IntNetAddrToStr(const INTRO_NET_AF Family, const INTRONET_ADDRESS *Address, CHAR *String)
Converts an IP address to a string.
QWORD Current
The currently used options.
#define LIX_FDTABLE_MAX_FDS_CAP
The maximum number of file descriptors to be iterated.
#define LIX_FIELD(Structure, Field)
Macro used to access fields inside the LIX_OPAQUE_FIELDS structure.
INTRO_NET_STATE State
Connection state.
Informational event containing the connections opened by a process. See EVENT_CONNECTION_EVENT.
static void IntLixNetSendConnectionEvent(INTRONET_ENDPOINT *Connection)
Sends a connection event to the integrator.
char Comm[LIX_COMM_SIZE]
The short name of the executable.
GUEST_STATE gGuest
The current guest state.
INTSTATUS IntLixNetSendGuestConnections(void)
Sends all active in-guest TCP/IP connections as events to the integrator.
INTRONET_ADDRESS RemoteAddress
Remote address.
INTSTATUS IntKernVirtMemRead(QWORD KernelGva, DWORD Length, void *Buffer, DWORD *RetLength)
Reads data from a guest kernel virtual memory range.
INTSTATUS IntLixNetIterateTaskConnections(LIX_TASK_OBJECT *Task, PFUNC_IterateConnectionsCallback Callback)
Iterates all TCP/IP connections of a process and supplies them to callback.
#define INT_STATUS_INVALID_PARAMETER_1
#define INT_STATUS_NOT_SUPPORTED
INTSTATUS IntLixTaskIterateTasks(PFUNC_LixTaskIterateTasks Callback)
Call the Callback parameter for each task saved internally.
Event structure for connections.
INTSTATUS IntLixNetSendTaskConnections(LIX_TASK_OBJECT *Task)
Logs and sends to the integrator all connections opened by a Linux proces..
void IntAlertFillConnection(const INTRONET_ENDPOINT *Connection, EVENT_CONNECTION_EVENT *Event)
Saves information about a guest connection in an event.
QWORD Gva
The GVA of the "struct proto" object.
QWORD Endpoint
Guest virtual address of the endpoint/socket object.
#define INT_STATUS_INVALID_PARAMETER_2
INTRO_PROT_OPTIONS CoreOptions
The activation and protection options for this guest.
INTRO_NET_STATE IntNetConvertState(const DWORD State)
Converts a guest connection state to an Introcore connection state.
Status values returned by most functions that can signal different success or failure states...