DataSoft/Honeyd — Issue #3: Honeyd script lag/delay when waiting for input
Author: PherricOxide
Created: 2012-01-26 21:12:23+00:00
State: open

Background

Honeyd scripts that don't send anything to stdout before waiting for something on stdin will lag for about 2.5 seconds before input sent to the socket gets forwarded to the script's stdin. A script like telnet that sends information first will respond to input right away. However, a script like apache.sh which waits for input after the connection is established, such as "GET / /HTTP/1.1", will hang for several seconds before the "GET / /HTTP/1.1" is actually sent to the script's stdin and processed.

Reproduction

Set up the apache.sh or apache.tcl script on a port and bind that profile to an IP address.
View it in a web browser and you will notice the delay.

To reproduce using just telnet,

telnet ip 80
Enter any text and press return
Press return again to send a blank line
You'll notice a delay before the webserver script responds.

Debugging so far

Relevant functions that were identified,

command.c/cmd_fork executes the script
command.c/cmd_trigger_write seems to trigger the function to write to the script's stdin

Call trace to cmd_trigger_write,

Thread [1] 18424 (Suspended : Breakpoint)
cmd_trigger_write() at command.c:92 0x8059740
tcp_add_readbuf() at tcp.c:130 0x806cb7e
tcp_recv_cb() at honeyd.c:2,181 0x80576ae
honeyd_dispatch() at honeyd.c:2,779 0x80586eb
honeyd_delay_cb() at honeyd.c:766 0x8058c93
honeyd_delay_packet() at honeyd.c:833 0x80533fe
honeyd_input()at honeyd.c:3,008 0x8058fbf
honeyd_recv_cb() at honeyd.c:3,163 0x8059558	0x152d44
pcap_dispatch() at 0x155548
interface_recv() at interface.c:516 0x807106b
event_base_loop()at 0x136114
event_loop() at 0x136267
event_dispatch() at 0x13628b
main() at honeyd.c:3,622 0x8051c6c

I found through manually going through the call trace that the delay seems to happen somewhere inside honeyd_recv_cb. If you put a breakpoint in honeyd_input, there is already a few second delay before that breakpoint gets hit. honeyd_recv_cb seems to be getting hit as soon as the packet is received though.