sleuthkit-users

[sleuthkit-users] autopsy opens socket with INADDR_ANY

[Dr. M. W. <wa...@gm...>]

Hi,

due to the missing SSL support I use autopsy only on the localhost.

I notived that even in this case port 9999 is opened on every interface.

I wrote a small patch for autopsy 2.08 to fix this behavior if no remote address is specified.

--- autopsy     2007-01-23 16:07:09.000000000 +0100
+++ autopsy_patched     2007-01-23 16:06:21.000000000 +0100
@@ -334,8 +334,15 @@
 setsockopt(Server, SOL_SOCKET, SO_KEEPALIVE, 1)
   or die "Error setting network socket options (keep alive): $!";
 
-bind(Server, sockaddr_in($port, INADDR_ANY))
-  or die "Error binding to port $port (is Autopsy already running?): $!";
+if ($rema eq "localhost") {
+  my $ip = '127.0.0.1';
+  my $binary = inet_aton($ip);
+  bind(Server, sockaddr_in($port, $binary))
+}
+else {
+  bind(Server, sockaddr_in($port, INADDR_ANY))
+    or die "Error binding to port $port (is Autopsy already running?): $!";
+}
 
 listen(Server, SOMAXCONN)
   or die "Error listening to socket for connections: $!";

Thanks!

Dr. Markus Waldeck

-- 
Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! 
Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

Re: [sleuthkit-users] autopsy opens socket with INADDR_ANY

[Tim <tim...@se...>]

Hello,

> due to the missing SSL support I use autopsy only on the localhost.
>
> I notived that even in this case port 9999 is opened on every
interface.
>
> I wrote a small patch for autopsy 2.08 to fix this behavior if no
remote address is specified.


My personal preference is in line with Dr. Waldeck's.  It would be
nice if the default was to listen only on localhost.



> --- autopsy     2007-01-23 16:07:09.000000000 +0100
> +++ autopsy_patched     2007-01-23 16:06:21.000000000 +0100
> @@ -334,8 +334,15 @@
>  setsockopt(Server, SOL_SOCKET, SO_KEEPALIVE, 1)
>    or die "Error setting network socket options (keep alive): $!";
>
> -bind(Server, sockaddr_in($port, INADDR_ANY))
> -  or die "Error binding to port $port (is Autopsy already running?): $!";
> +if ($rema eq "localhost") {
> +  my $ip = '127.0.0.1';
> +  my $binary = inet_aton($ip);
> +  bind(Server, sockaddr_in($port, $binary))

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
However, I think you might want to check the return value of this bind()
call, just in case the localhost port is already taken.



> +}
> +else {
> +  bind(Server, sockaddr_in($port, INADDR_ANY))
> +    or die "Error binding to port $port (is Autopsy already running?): $!";
> +}



tim

Re: [sleuthkit-users] autopsy opens socket with INADDR_ANY

[Dr. M. W. <wa...@gm...>]

Hello Tim,



> My personal preference is in line with Dr. Waldeck's.  It would be

> nice if the default was to listen only on localhost.



Fine!



> > +  bind(Server, sockaddr_in($port, $binary))

> 

> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

> However, I think you might want to check the return value of this bind()

> call, just in case the localhost port is already taken.



Sorry, copy and WASTE!



I checked the patch and decided to avoid code duplication.



--- autopsy	2007-01-24 09:44:26.000000000 +0100

+++ autopsy_patched	2007-01-24 09:44:12.000000000 +0100

@@ -334,7 +334,12 @@

 setsockopt(Server, SOL_SOCKET, SO_KEEPALIVE, 1)

   or die "Error setting network socket options (keep alive): $!";

 

-bind(Server, sockaddr_in($port, INADDR_ANY))

+my $bindaddr = INADDR_ANY;

+

+if ($rema eq "localhost") {

+  $bindaddr = inet_aton('127.0.0.1');

+}

+bind(Server, sockaddr_in($port, $bindaddr))

   or die "Error binding to port $port (is Autopsy already running?): $!";

 

 listen(Server, SOMAXCONN)



Thanks



Dr. Markus Waldeck



-- 

"Feel free" - 5 GB Mailbox, 50 FreeSMS/Monat ...
Jetzt GMX ProMail testen: http://www.gmx.net/de/go/promail

Re: [sleuthkit-users] autopsy opens socket with INADDR_ANY

[Brian C. <ca...@sl...>]

On Jan 23, 2007, at 1:21 PM, Dr. Markus Waldeck wrote:

> Hi,
>
> due to the missing SSL support I use autopsy only on the localhost.
>
> I notived that even in this case port 9999 is opened on every  
> interface.
>
> I wrote a small patch for autopsy 2.08 to fix this behavior if no  
> remote address is specified.

Thanks.  I just added a variation of this in.

brian