Using a Linux machine as a router

Here are simple commands to make a Linux machine as router.

1. Assuming eth1 is private network and eth0 is connected to public network (internet)
2. Assuming you want to access internet from prviate network connected to eth1.
3. On all machines in private network, set IP address of eth1 as default gatteway in network settings on internal machines
4. Run following 4 commands on Linux machine

echo 1 > /proc/sys/net/ipv4/ip_forward
/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

5. To save the settings to become persistent across reboots, run command
/sbin/iptables-save > /etc/sysconfig/iptables

Please note: above instructions are tested on Fedora 9. Please change paths or specific commands for other Linux distributions

Read More...

Making e1000e work on a small Linux appliance

I got a small appliance (x86 based desktop appliance) where I was installing our custom fedora 9 distribution. Everything was fine except that the

network card drivers failed to load.

lspci>
02:00.0 Ethernet controller: Intel Corporation Unknown device 10d3
03:00.0 Ethernet controller: Intel Corporation Unknown device 10d3
04:00.0 Ethernet controller: Intel Corporation Unknown device 10d3
05:00.0 Ethernet controller: Intel Corporation Unknown device 10d3

Checked that the e1000 and e1000e drivers are very old and are not getting loaded for the NICs this appliance has.
Mine was older that 7.2.xxx. And I should be running 8.xx for these NICs

Here is an excellent readme about how to do this: http://downloadmirror.intel.com/15817/eng/README.txt

Here is the summary:

1. Download latest code from Intel website. Search fro e1000 source and you will find the link

2. Build them. Ensure that you are building it on machine which has the same kernel version and type (UP/SMP).

3. You will get e1000.ko and e1000e.ko.

4. Copy these files to your target appliance at path /lib/modules//kernel/drivers/net/e1000 and

/lib/modules//kernel/drivers/net/e1000e .

5. For me the e1000e driver worked. So I am not very interested in e1000.

6. Now fire the command modprobe e1000e.

7. If you get an error like:
FATAL: Error inserting e1000e (/lib/modules/2.6.25-14.fc9.i686/kernel/drivers/ne
t/e1000e/e1000e.ko): Invalid module format

then go and check /var/log/message file.

If should have reported an error like :
kernel: e1000e: version magic '2.6.25 SMP mod_unload 686 4KSTACKS ' should be '2.6.25-14.fc9.i686 SMP mod
_unload 686 4KSTACKS '

Note: the version string (or to be specic the two version magic no. could be diferent as per your platform).

Now I dont see any different between the vermagic of my module and of this kernel. So simply I can use

modprobe--force to insert this module forcibily.

If you get the above error: fire modprobe --force e1000e.

NOte: Please know that if you see different in vermagic like completely different kernel version or a differet architecture,

you should recompile the modules on a matching kernel/architecture.

you can get vermagic of a module using 'modinfo | grep vermagic

9. To make this process automatic on every reboot I added following commands to rc.local

modprobe --force e1000e
service network restart

10. Thats it.

Read More...

How did I spent (wasted) my evening!

After working as part of sales team I have become more result oriented. I weigh every second in terms of how much I have progressed towards the final result. Sometimes I think that I have become more greedy and impatient. But I am not worried about that right now.

So what did I achieve today evening. Nothing yet. I started working on my website today morning at 10 AM planning to customize snoopy (http://snoopy.sourceforge.net) as per my needs.

I got stuck by 4 am when I thought I need to research on the debugging mechanisms available for PhP.  I found that xdebug has been marketed as the swiss knife for PhP developers. I got the tarred installer , ran it and damn.  I was missing phpize which comes as a part of PhP development environment.

ok I figured I need to get latest PhP (5.x) and build it to get phpize. No problem. code downloaded, extract...wow the PhP make script reports that there was no support for --enable-modules=so and apxs in my apache server.

So now I got to upgrade my apache server. done.

Next error from PhP installer: It needs libxml2 ver 2.6.11 or higher.

I got the required rpm, but then it needed higher version of libc ... I immediately realized that I am on a wrong track. Updating my OS to Fedora 9 would have been easier than updating libc and its dependencies.

Finally I downloaded the src of libxml2 and just built it successfully. It has taken me 5 hours to get to here. Oh, I still have to first upgrade my PhP, get phpize and install xdebug and then start debugging my 20 line PhP file.

I think thats one of the positives of Windows over Linux. For Windows you get one tool: VisualStudio and you dont need to worry about anything. Though it was a nightmare last year building a WinCE app but i think I was very new to WinCE and Microsoft puzzled me a lot with changing terminologies.

For Linux, you got to love your search engine.

Finally i got xdebug working!

phew!

Let start debugging....arrr sorry ...start learning xdebug!

Read More...

Debug your applications without recompilation

Scenario:
You wanna debug an application but you dont have the code for it?
You suspect some functions that are failing, you dont feel like recompiling whole stuff in debug mode or put in print statements.

Solution:
Hook the APIs using LD_PRELOAD. (refer to my earlier post on hooking Linux)

Here is the code that I compiled into a .so which help me debug an issue in a binary. I wanted to get debug prints of a function that copies files to a directory. I needed to put print statements in the function, rather than that I used this method to get all copy commands being executed.

#include
#include
#include

#if defined(RTLD_NEXT)
#define REAL_LIBC RTLD_NEXT
#else
#define REAL_LIBC ((void *) -1L)
#endif

int system(char * command){
printf("Vij: system called - hacked\n");
static int (*o_dlconnect) ( char *command )=0;
o_dlconnect = (int(*)( char * )) dlsym(REAL_LIBC,"system"); printf("\n%s",command);
return (*o_dlconnect)( command );
}

Read More...

Linux API Hooking

Had some success today hooking APIs on linux.
Don't think that this is going to be a techy blog-site. Just pasting here for later references. Looks like blog site is quite handy repository.

Keywords: LD_PRELOAD, dlsym
http://sourceware.org/ml/libc-alpha/2001-05/msg00321.html

One more note:
LD_PRELOAD is supported for most of the UNIX flavors. I had tried it on HPUX in patni and it worked there.
read that it will work for SOLARIS and AIX also.

-----------------------------------------------------------

follow these 3 simple steps to hook APIs in Linux.

Step1: create a file with following code..say preload.c

//the blogger treats < as tags..removing < from include statements
#include dlfcn.h
#include stdio.h
#include sys/types.h
#include sys/socket.h

#if defined(RTLD_NEXT)
#define REAL_LIBC RTLD_NEXT
#else
#define REAL_LIBC ((void *) -1L)
#endif


int connect(int sockfd, const struct sockaddr *serv_addr, socklen_t
addrlen)
{
printf("NEOACCEL: connect hacked\n");
static int (*o_dlconnect) ( int sockfd, const struct sockaddr *serv_addr, socklen_t addrlen )=0;

printf( "dlopen was called\n" );
o_dlconnect = (int(*)( int sockfd, const struct sockaddr *serv_addr, socklen_t addrlen )) dlsym(REAL_LIBC,"connect");
return (*o_dlconnect)( sockfd, serv_addr, addrlen );

}

Step2: compile it using cmd line
gcc -Wall -fPIC -shared -o preload.so preload.c -ldl

Step3: Define env variable LD_PRELOAD as:
export LD_PRELOAD=absolute file-path of preload.so, inclding filename

and you are done....


some good respources:
http://neworder.box.sk/newsread.php?newsid=13857

http://www.security.nnov.ru/articles/reveng/

www.phrack.org

Read More...