honeyd with python extensions

["WiM" <vulndev () vision rma ac be>]

There is a problem with connection termination when using python extensions
with honeyd.

Example:

In "honeyd.conf" I write the following line:
add netbsd tcp port 7 internal "echo"

The service echo.py is the basic echo example from the man page:
import honeyd
import sys

def honeyd_init(data):
  mydata = {}
  honeyd.read_selector(honeyd.EVENT_ON)
  return mydata

def honeyd_readdata(mydata, data):
  honeyd.read_selector(honeyd.EVENT_ON)
  honeyd.write_selector(honeyd.EVENT_ON)
  mydata["write"] = data
  return 0

def honeyd_writedata(mydata):
  data = mydata["write"]
  del mydata["write"]
  return data

def honeyd_end(mydata):
  del mydata
  return 0


You can connect to the echo service on port 7 only once. After that, no new
connections are possible. The incoming SYN packets are ignored by honeyd.

Furthermore, the first connection is not properly terminated, as is shown in
the following packet trace (with 172.16.100.100 being the honeypot):

15:41:41.216261 172.16.29.122.3215 > 172.16.100.100.7: P 3:5(2) ack 3 win
65533 <nop,nop,timestamp 839059 1335652> (DF)
15:41:41.216546 172.16.100.100.7 > 172.16.29.122.3215: . ack 5 win 32766
<timestamp 1335652 0,nop,nop>
15:41:41.217095 172.16.100.100.7 > 172.16.29.122.3215: . 3:5(2) ack 5 win
32768 <timestamp 1335652 0,nop,nop>
15:41:41.416460 172.16.29.122.3215 > 172.16.100.100.7: . ack 5 win 65531
<nop,nop,timestamp 839061 1335652> (DF)
15:41:44.197053 172.16.29.122.3215 > 172.16.100.100.7: F 5:5(0) ack 5 win
65531 <nop,nop,timestamp 839088 1335652> (DF)
15:41:44.197426 172.16.100.100.7 > 172.16.29.122.3215: . ack 6 win 32768
<timestamp 1335652 0,nop,nop>
15:41:44.197807 172.16.100.100.7 > 172.16.29.122.3215: F 5:5(0) ack 6 win
32768 <timestamp 1335652 0,nop,nop>
15:41:44.198454 172.16.29.122.3215 > 172.16.100.100.7: . ack 6 win 65531
<nop,nop,timestamp 839088 1335652> (DF)

At 15:44 the client terminates the connection by sending a FIN packet.
Honeyd however simply acks the FIN packets yet doesn't terminate the
connection.

Wim