@ -67,9 +67,9 @@ static void fill_tcphdr(
uint8_t t = 0 ;
memset ( tcp , 0 , sizeof ( * tcp ) ) ;
tcp - > th_sport = nsport ;
tcp - > th_dport = ndport ;
if ( fooling & TCP_ FOOL_BADSEQ)
tcp - > th_sport = nsport ;
tcp - > th_dport = ndport ;
if ( fooling & FOOL_BADSEQ )
{
tcp - > th_seq = net32_add ( nseq , badseq_increment ) ;
tcp - > th_ack = net32_add ( nack_seq , badseq_ack_increment ) ;
@ -82,7 +82,7 @@ static void fill_tcphdr(
tcp - > th_off = 5 ;
* ( ( uint8_t * ) tcp + 13 ) = tcp_flags ;
tcp - > th_win = nwsize ;
if ( fooling & TCP_ FOOL_MD5SIG)
if ( fooling & FOOL_MD5SIG )
{
tcpopt [ 0 ] = 19 ; // kind
tcpopt [ 1 ] = 18 ; // len
@ -92,13 +92,13 @@ static void fill_tcphdr(
* ( uint32_t * ) ( tcpopt + 14 ) = random ( ) ;
t = 18 ;
}
if ( timestamps | | ( fooling & TCP_ FOOL_TS) )
if ( timestamps | | ( fooling & FOOL_TS ) )
{
tcpopt [ t ] = 8 ; // kind
tcpopt [ t + 1 ] = 10 ; // len
// forge only TSecr if orig timestamp is present
* ( uint32_t * ) ( tcpopt + t + 2 ) = timestamps ? timestamps [ 0 ] : - 1 ;
* ( uint32_t * ) ( tcpopt + t + 6 ) = ( timestamps & & ! ( fooling & TCP_ FOOL_TS) ) ? timestamps [ 1 ] : - 1 ;
* ( uint32_t * ) ( tcpopt + t + 6 ) = ( timestamps & & ! ( fooling & FOOL_TS ) ) ? timestamps [ 1 ] : - 1 ;
t + = 10 ;
}
if ( scale_factor ! = SCALE_NONE )
@ -109,239 +109,84 @@ static void fill_tcphdr(
}
while ( t & 3 ) tcpopt [ t + + ] = 1 ; // noop
tcp - > th_off + = t > > 2 ;
tcp - > th_sum = 0 ;
}
static uint16_t tcpopt_len ( uint8_t fooling , const uint32_t * timestamps , uint8_t scale_factor )
{
uint16_t t = 0 ;
if ( fooling & TCP_ FOOL_MD5SIG) t = 18 ;
if ( ( fooling & TCP_ FOOL_TS) | | timestamps ) t + = 10 ;
if ( fooling & FOOL_MD5SIG ) t = 18 ;
if ( ( fooling & FOOL_TS ) | | timestamps ) t + = 10 ;
if ( scale_factor ! = SCALE_NONE ) t + = 3 ;
return ( t + 3 ) & ~ 3 ;
}
static int rawsend_sock4 = - 1 , rawsend_sock6 = - 1 ;
static void rawsend_clean_sock ( int * sock )
{
if ( sock & & * sock ! = - 1 )
{
close ( * sock ) ;
* sock = - 1 ;
}
}
void rawsend_cleanup ( )
{
rawsend_clean_sock ( & rawsend_sock4 ) ;
rawsend_clean_sock ( & rawsend_sock6 ) ;
}
static int * rawsend_family_sock ( sa_family_t family )
// n prefix (nsport, nwsize) means network byte order
static void fill_udphdr ( struct udphdr * udp , uint16_t nsport , uint16_t ndport , uint16_t len_payload )
{
switch ( family )
{
case AF_INET : return & rawsend_sock4 ;
case AF_INET6 : return & rawsend_sock6 ;
default : return NULL ;
}
udp - > uh_sport = nsport ;
udp - > uh_dport = ndport ;
udp - > uh_ulen = htons ( len_payload + sizeof ( struct udphdr ) ) ;
udp - > uh_sum = 0 ;
}
# ifdef BSD
static int rawsend_socket_divert ( sa_family_t family )
static void fill_iphdr ( struct ip * ip , const struct in_addr * src , const struct in_addr * dst , uint16_t pktlen , uint8_t proto , uint8_t ttl )
{
// HACK HACK HACK HACK HACK HACK HACK HACK
// FreeBSD doesnt allow IP_HDRINCL for IPV6
// OpenBSD doesnt allow rawsending tcp frames
// we either have to go to the link layer (its hard, possible problems arise, compat testing, ...) or use some HACKING
// from my point of view disabling direct ability to send ip frames is not security. its SHIT
int fd = socket ( family , SOCK_RAW , IPPROTO_DIVERT ) ;
if ( ! set_socket_buffers ( fd , 4096 , RAW_SNDBUF ) )
{
close ( fd ) ;
return - 1 ;
}
return fd ;
ip - > ip_off = 0 ;
ip - > ip_v = 4 ;
ip - > ip_hl = 5 ;
ip - > ip_len = htons ( pktlen ) ;
ip - > ip_id = 0 ;
ip - > ip_ttl = ttl ;
ip - > ip_p = proto ;
ip - > ip_src = * src ;
ip - > ip_dst = * dst ;
}
static int rawsend_sendto_divert ( sa_family_t family , int sock , const void * buf , size_t len )
static void fill_ip6hdr ( struct ip6_hdr * ip6 , const struct in6_addr * src , const struct in6_addr * dst , uint16_t payloadlen , uint8_t proto , uint8_t ttl )
{
struct sockaddr_storage sa ;
socklen_t slen ;
memset ( & sa , 0 , sizeof ( sa ) ) ;
sa . ss_family = family ;
switch ( family )
{
case AF_INET :
slen = sizeof ( struct sockaddr_in ) ;
break ;
case AF_INET6 :
slen = sizeof ( struct sockaddr_in6 ) ;
break ;
default :
return - 1 ;
}
return sendto ( sock , buf , len , 0 , ( struct sockaddr * ) & sa , slen ) ;
ip6 - > ip6_ctlun . ip6_un1 . ip6_un1_flow = htonl ( 0x60000000 ) ;
ip6 - > ip6_ctlun . ip6_un1 . ip6_un1_plen = htons ( payloadlen ) ;
ip6 - > ip6_ctlun . ip6_un1 . ip6_un1_nxt = proto ;
ip6 - > ip6_ctlun . ip6_un1 . ip6_un1_hlim = ttl ;
ip6 - > ip6_src = * src ;
ip6 - > ip6_dst = * dst ;
}
# endif
static int rawsend_socket_raw ( int domain , int proto )
bool prepare_tcp_segment4 (
const struct sockaddr_in * src , const struct sockaddr_in * dst ,
uint8_t tcp_flags ,
uint32_t nseq , uint32_t nack_seq ,
uint16_t nwsize ,
uint8_t scale_factor ,
uint32_t * timestamps ,
uint8_t ttl ,
uint8_t fooling ,
uint32_t badseq_increment ,
uint32_t badseq_ack_increment ,
const void * data , uint16_t len ,
uint8_t * buf , size_t * buflen )
{
int fd = socket ( domain , SOCK_RAW , proto ) ;
if ( fd ! = - 1 )
{
# ifdef __linux__
int s = RAW_SNDBUF / 2 ;
int r = 2048 ;
# else
int s = RAW_SNDBUF ;
int r = 4096 ;
# endif
if ( ! set_socket_buffers ( fd , r , s ) )
{
close ( fd ) ;
return - 1 ;
}
}
return fd ;
}
uint16_t tcpoptlen = tcpopt_len ( fooling , timestamps , scale_factor ) ;
uint16_t ip_payload_len = sizeof ( struct tcphdr ) + tcpoptlen + len ;
uint16_t pktlen = sizeof ( struct ip ) + ip_payload_len ;
if ( pktlen > * buflen ) return false ;
static int rawsend_socket ( sa_family_t family , uint32_t fwmark )
{
int yes = 1 ;
int * sock = rawsend_family_sock ( family ) ;
if ( ! sock ) return - 1 ;
if ( * sock = = - 1 )
{
int yes = 1 , pri = 6 ;
//printf("rawsend_socket: family %d",family);
struct ip * ip = ( struct ip * ) buf ;
struct tcphdr * tcp = ( struct tcphdr * ) ( ip + 1 ) ;
uint8_t * payload = ( uint8_t * ) ( tcp + 1 ) + tcpoptlen ;
# ifdef __FreeBSD__
// IPPROTO_RAW with ipv6 in FreeBSD always returns EACCES on sendto.
// must use IPPROTO_TCP for ipv6. IPPROTO_RAW works for ipv4
// divert sockets are always v4 but accept both v4 and v6
* sock = ( family = = AF_INET ) ? rawsend_socket_raw ( family , IPPROTO_TCP ) : rawsend_socket_divert ( AF_INET ) ;
# elif defined(__OpenBSD__) || defined (__APPLE__)
// OpenBSD does not allow sending TCP frames through raw sockets
// I dont know about macos. They have dropped ipfw in recent versions and their PF does not support divert-packet
* sock = rawsend_socket_divert ( family ) ;
# else
* sock = rawsend_socket_raw ( family , IPPROTO_RAW ) ;
# endif
if ( * sock = = - 1 )
{
perror ( " rawsend: socket() " ) ;
return - 1 ;
}
# ifdef BSD
# if !(defined(__OpenBSD__) || defined (__APPLE__))
// HDRINCL not supported for ipv6 in any BSD
if ( family = = AF_INET & & setsockopt ( * sock , IPPROTO_IP , IP_HDRINCL , & yes , sizeof ( yes ) ) = = - 1 )
{
perror ( " rawsend: setsockopt(IP_HDRINCL) " ) ;
goto exiterr ;
}
# endif
# ifdef SO_USER_COOKIE
if ( setsockopt ( * sock , SOL_SOCKET , SO_USER_COOKIE , & fwmark , sizeof ( fwmark ) ) = = - 1 )
{
perror ( " rawsend: setsockopt(SO_MARK) " ) ;
goto exiterr ;
}
# endif
# endif
# ifdef __linux__
if ( setsockopt ( * sock , SOL_SOCKET , SO_MARK , & fwmark , sizeof ( fwmark ) ) = = - 1 )
{
perror ( " rawsend: setsockopt(SO_MARK) " ) ;
goto exiterr ;
}
if ( setsockopt ( * sock , SOL_SOCKET , SO_PRIORITY , & pri , sizeof ( pri ) ) = = - 1 )
{
perror ( " rawsend: setsockopt(SO_PRIORITY) " ) ;
goto exiterr ;
}
# endif
}
return * sock ;
exiterr :
rawsend_clean_sock ( sock ) ;
return - 1 ;
}
bool rawsend_preinit ( uint32_t fwmark )
{
return rawsend_socket ( AF_INET , fwmark ) ! = - 1 & & rawsend_socket ( AF_INET6 , fwmark ) ! = - 1 ;
}
bool rawsend ( const struct sockaddr * dst , uint32_t fwmark , const void * data , size_t len )
{
int sock = rawsend_socket ( dst - > sa_family , fwmark ) ;
if ( sock = = - 1 ) return false ;
int salen = dst - > sa_family = = AF_INET ? sizeof ( struct sockaddr_in ) : sizeof ( struct sockaddr_in6 ) ;
struct sockaddr_storage dst2 ;
memcpy ( & dst2 , dst , salen ) ;
if ( dst - > sa_family = = AF_INET6 )
( ( struct sockaddr_in6 * ) & dst2 ) - > sin6_port = 0 ; // or will be EINVAL in linux
# ifdef BSD
/*
// this works only for local connections and not working for transit : cant spoof source addr
if ( len > = sizeof ( struct ip6_hdr ) )
{
// BSD ipv6 raw socks are limited. cannot pass the whole packet with ip6 header.
struct sockaddr_storage sa_src ;
int v ;
extract_endpoints ( NULL , ( struct ip6_hdr * ) data , NULL , & sa_src , NULL ) ;
v = ( ( struct ip6_hdr * ) data ) - > ip6_ctlun . ip6_un1 . ip6_un1_hlim ;
if ( setsockopt ( sock , IPPROTO_IPV6 , IPV6_UNICAST_HOPS , & v , sizeof ( v ) ) = = - 1 )
perror ( " rawsend: setsockopt(IPV6_HOPLIMIT) " ) ;
[ 5 ~ // the only way to control source address is bind. make it equal to ip6_hdr
if ( bind ( sock , ( struct sockaddr * ) & sa_src , salen ) < 0 )
perror ( " rawsend bind: " ) ;
//printf("BSD v6 RAWSEND "); print_sockaddr((struct sockaddr*)&sa_src); printf(" -> "); print_sockaddr((struct sockaddr*)&dst2); printf("\n");
proto_skip_ipv6 ( ( uint8_t * * ) & data , & len , NULL ) ;
}
*/
fill_iphdr ( ip , & src - > sin_addr , & dst - > sin_addr , pktlen , IPPROTO_TCP , ttl ) ;
fill_tcphdr ( tcp , fooling , tcp_flags , nseq , nack_seq , src - > sin_port , dst - > sin_port , nwsize , scale_factor , timestamps , badseq_increment , badseq_ack_increment ) ;
# if !(defined(__OpenBSD__) || defined (__APPLE__))
// OpenBSD doesnt allow rawsending tcp frames. always use divert socket
if ( dst - > sa_family = = AF_INET6 )
# endif
{
ssize_t bytes = rawsend_sendto_divert ( dst - > sa_family , sock , data , len ) ;
if ( bytes = = - 1 )
{
perror ( " rawsend: sendto_divert " ) ;
return false ;
}
return true ;
}
# endif
memcpy ( payload , data , len ) ;
tcp4_fix_checksum ( tcp , ip_payload_len , & ip - > ip_src , & ip - > ip_dst ) ;
if ( fooling & FOOL_BADSUM ) tcp - > th_sum ^ = htons ( 0xBEAF ) ;
# if defined(__FreeBSD__) && __FreeBSD__<=10
// old FreeBSD requires some fields in the host byte order
if ( dst - > sa_family = = AF_INET & & len > = sizeof ( struct ip ) )
{
( ( struct ip * ) data ) - > ip_len = htons ( ( ( struct ip * ) data ) - > ip_len ) ;
( ( struct ip * ) data ) - > ip_off = htons ( ( ( struct ip * ) data ) - > ip_off ) ;
}
# endif
// normal raw socket sendto
ssize_t bytes = sendto ( sock , data , len , 0 , ( struct sockaddr * ) & dst2 , salen ) ;
# if defined(__FreeBSD) && __FreeBSD__<=10
// restore byte order
if ( dst - > sa_family = = AF_INET & & len > = sizeof ( struct ip ) )
{
( ( struct ip * ) data ) - > ip_len = htons ( ( ( struct ip * ) data ) - > ip_len ) ;
( ( struct ip * ) data ) - > ip_off = htons ( ( ( struct ip * ) data ) - > ip_off ) ;
}
# endif
if ( bytes = = - 1 )
{
perror ( " rawsend: sendto " ) ;
return false ;
}
* buflen = pktlen ;
return true ;
}
bool prepare_tcp_segment4 (
const struct sockaddr_in * src , const struct sockaddr_in * dst ,
bool prepare_tcp_segment6 (
const struct sockaddr_in6 * src , const struct sockaddr_in6 * dst ,
uint8_t tcp_flags ,
uint32_t nseq , uint32_t nack_seq ,
uint16_t nwsize ,
@ -354,40 +199,28 @@ bool prepare_tcp_segment4(
const void * data , uint16_t len ,
uint8_t * buf , size_t * buflen )
{
uint16_t tcpoptlen = tcpopt_len ( fooling , timestamps , scale_factor ) ;
uint16_t pktlen = sizeof ( struct ip ) + sizeof ( struct tcphdr ) + tcpoptlen + len ;
if ( pktlen > * buflen )
{
fprintf ( stderr , " prepare_tcp_segment : packet len cannot exceed %zu \n " , * buflen ) ;
return false ;
}
uint16_t tcpoptlen = tcpopt_len ( fooling , timestamps , scale_factor ) ;
uint16_t ip_payload_len = sizeof ( struct tcphdr ) + tcpoptlen + len ;
uint16_t pktlen = sizeof ( struct ip6_hdr ) + ip_payload_len ;
if ( pktlen > * buflen ) return false ;
struct ip * ip = ( struct ip * ) buf ;
struct tcphdr * tcp = ( struct tcphdr * ) ( ip + 1 ) ;
struct ip6_hdr * ip6 = ( struct ip6_hdr * ) buf ;
struct tcphdr * tcp = ( struct tcphdr * ) ( ip6 + 1 ) ;
uint8_t * payload = ( uint8_t * ) ( tcp + 1 ) + tcpoptlen ;
ip - > ip_off = 0 ;
ip - > ip_v = 4 ;
ip - > ip_hl = 5 ;
ip - > ip_len = htons ( pktlen ) ;
ip - > ip_id = 0 ;
ip - > ip_ttl = ttl ;
ip - > ip_p = IPPROTO_TCP ;
ip - > ip_src = src - > sin_addr ;
ip - > ip_dst = dst - > sin_addr ;
fill_tcphdr ( tcp , fooling , tcp_flags , nseq , nack_seq , src - > sin_port , dst - > sin_port , nwsize , scale_factor , timestamps , badseq_increment , badseq_ack_increment ) ;
fill_ip6hdr ( ip6 , & src - > sin6_addr , & dst - > sin6_addr , ip_payload_len , IPPROTO_TCP , ttl ) ;
fill_tcphdr ( tcp , fooling , tcp_flags , nseq , nack_seq , src - > sin6_port , dst - > sin6_port , nwsize , scale_factor , timestamps , badseq_increment , badseq_ack_increment ) ;
memcpy ( ( char * ) tcp + sizeof ( struct tcphdr ) + tcpoptlen , data , len ) ;
tcp4 _fix_checksum ( tcp , sizeof ( struct tcphdr ) + tcpoptlen + len , & ip - > ip_src , & ip - > ip_dst ) ;
if ( fooling & TCP_ FOOL_BADSUM) tcp - > th_sum ^ = 0xBEAF ;
memcpy ( payload , data , len ) ;
tcp6_fix_checksum ( tcp , ip_payload_len , & ip6 - > ip6_src , & ip6 - > ip6_dst ) ;
if ( fooling & FOOL_BADSUM ) tcp - > th_sum ^ = htons ( 0xBEAF ) ;
* buflen = pktlen ;
return true ;
}
bool prepare_tcp_segment6 (
const struct sockaddr_in6 * src , const struct sockaddr_in6 * dst ,
bool prepare_tcp_segment (
const struct sockaddr * src , const struct sockaddr * dst ,
uint8_t tcp_flags ,
uint32_t nseq , uint32_t nack_seq ,
uint16_t nwsize ,
@ -400,58 +233,88 @@ bool prepare_tcp_segment6(
const void * data , uint16_t len ,
uint8_t * buf , size_t * buflen )
{
uint16_t tcpoptlen = tcpopt_len ( fooling , timestamps , scale_factor ) ;
uint16_t payloadlen = sizeof ( struct tcphdr ) + tcpoptlen + len ;
uint16_t pktlen = sizeof ( struct ip6_hdr ) + payloadlen ;
if ( pktlen > * buflen )
{
fprintf ( stderr , " prepare_tcp_segment : packet len cannot exceed %zu \n " , * buflen ) ;
return false ;
}
return ( src - > sa_family = = AF_INET & & dst - > sa_family = = AF_INET ) ?
prepare_tcp_segment4 ( ( struct sockaddr_in * ) src , ( struct sockaddr_in * ) dst , tcp_flags , nseq , nack_seq , nwsize , scale_factor , timestamps , ttl , fooling , badseq_increment , badseq_ack_increment , data , len , buf , buflen ) :
( src - > sa_family = = AF_INET6 & & dst - > sa_family = = AF_INET6 ) ?
prepare_tcp_segment6 ( ( struct sockaddr_in6 * ) src , ( struct sockaddr_in6 * ) dst , tcp_flags , nseq , nack_seq , nwsize , scale_factor , timestamps , ttl , fooling , badseq_increment , badseq_ack_increment , data , len , buf , buflen ) :
false ;
}
struct ip6_hdr * ip6 = ( struct ip6_hdr * ) buf ;
struct tcphdr * tcp = ( struct tcphdr * ) ( ip6 + 1 ) ;
ip6 - > ip6_ctlun . ip6_un1 . ip6_un1_flow = htonl ( 0x60000000 ) ;
ip6 - > ip6_ctlun . ip6_un1 . ip6_un1_plen = htons ( payloadlen ) ;
ip6 - > ip6_ctlun . ip6_un1 . ip6_un1_nxt = IPPROTO_TCP ;
ip6 - > ip6_ctlun . ip6_un1 . ip6_un1_hlim = ttl ;
ip6 - > ip6_src = src - > sin6_addr ;
ip6 - > ip6_dst = dst - > sin6_addr ;
bool prepare_udp_segment4 (
const struct sockaddr_in * src , const struct sockaddr_in * dst ,
uint8_t ttl ,
uint8_t fooling ,
const void * data , uint16_t len ,
uint8_t * buf , size_t * buflen )
{
uint16_t ip_payload_len = sizeof ( struct udphdr ) + len ;
uint16_t pktlen = sizeof ( struct ip ) + ip_payload_len ;
if ( pktlen > * buflen ) return false ;
struct ip * ip = ( struct ip * ) buf ;
struct udphdr * udp = ( struct udphdr * ) ( ip + 1 ) ;
uint8_t * payload = ( uint8_t * ) ( udp + 1 ) ;
fill_iphdr ( ip , & src - > sin_addr , & dst - > sin_addr , pktlen , IPPROTO_UDP , ttl ) ;
fill_udphdr ( udp , src - > sin_port , dst - > sin_port , len ) ;
memcpy ( payload , data , len ) ;
udp4_fix_checksum ( udp , ip_payload_len , & ip - > ip_src , & ip - > ip_dst ) ;
if ( fooling & FOOL_BADSUM ) udp - > uh_sum ^ = htons ( 0xBEAF ) ;
* buflen = pktlen ;
return true ;
}
bool prepare_udp_segment6 (
const struct sockaddr_in6 * src , const struct sockaddr_in6 * dst ,
uint8_t ttl ,
uint8_t fooling ,
const void * data , uint16_t len ,
uint8_t * buf , size_t * buflen )
{
uint16_t ip_payload_len = sizeof ( struct udphdr ) + len ;
uint16_t pktlen = sizeof ( struct ip6_hdr ) + ip_payload_len ;
if ( pktlen > * buflen ) return false ;
fill_tcphdr ( tcp , fooling , tcp_flags , nseq , nack_seq , src - > sin6_port , dst - > sin6_port , nwsize , scale_factor , timestamps , badseq_increment , badseq_ack_increment ) ;
struct ip6_hdr * ip6 = ( struct ip6_hdr * ) buf ;
struct udphdr * udp = ( struct udphdr * ) ( ip6 + 1 ) ;
uint8_t * payload = ( uint8_t * ) ( udp + 1 ) ;
memcpy ( ( char * ) tcp + sizeof ( struct tcphdr ) + tcpoptlen , data , len ) ;
tcp6_fix_checksum ( tcp , sizeof ( struct tcphdr ) + tcpoptlen + len , & ip6 - > ip6_src , & ip6 - > ip6_dst ) ;
if ( fooling & TCP_FOOL_BADSUM ) tcp - > th_sum ^ = 0xBEAF ;
fill_ip6hdr ( ip6 , & src - > sin6_addr , & dst - > sin6_addr , ip_payload_len , IPPROTO_UDP , ttl ) ;
fill_udphdr ( udp , src - > sin6_port , dst - > sin6_port , len ) ;
memcpy ( payload , data , len ) ;
udp6_fix_checksum ( udp , ip_payload_len , & ip6 - > ip6_src , & ip6 - > ip6_dst ) ;
if ( fooling & FOOL_BADSUM ) udp - > uh_sum ^ = htons ( 0xBEAF ) ;
* buflen = pktlen ;
return true ;
}
bool prepare_tcp_segment (
bool prepare_udp_segment (
const struct sockaddr * src , const struct sockaddr * dst ,
uint8_t tcp_flags ,
uint32_t nseq , uint32_t nack_seq ,
uint16_t nwsize ,
uint8_t scale_factor ,
uint32_t * timestamps ,
uint8_t ttl ,
uint8_t fooling ,
uint32_t badseq_increment ,
uint32_t badseq_ack_increment ,
const void * data , uint16_t len ,
uint8_t * buf , size_t * buflen )
{
return ( src - > sa_family = = AF_INET & & dst - > sa_family = = AF_INET ) ?
prepare_tcp_segment4 ( ( struct sockaddr_in * ) src , ( struct sockaddr_in * ) dst , tcp_flags , nseq , nack_seq , nwsize , scale_factor , timestamps , ttl , fooling , badseq_increment , badseq_ack_increment , data , len , buf , buflen ) :
prepare_ud p_segment4 ( ( struct sockaddr_in * ) src , ( struct sockaddr_in * ) dst , ttl , fooling , data , len , buf , buflen ) :
( src - > sa_family = = AF_INET6 & & dst - > sa_family = = AF_INET6 ) ?
prepare_tcp_segment6 ( ( struct sockaddr_in6 * ) src , ( struct sockaddr_in6 * ) dst , tcp_flags , nseq , nack_seq , nwsize , scale_factor , timestamps , ttl , fooling , badseq_increment , badseq_ack_increment , data , len , buf , buflen ) :
prepare_ud p_segment6 ( ( struct sockaddr_in6 * ) src , ( struct sockaddr_in6 * ) dst , ttl , fooling , data , len , buf , buflen ) :
false ;
}
void extract_endpoints ( const struct ip * ip , const struct ip6_hdr * ip6hdr , const struct tcphdr * tcphdr , struct sockaddr_storage * src , struct sockaddr_storage * dst )
void extract_ports ( const struct tcphdr * tcphdr , const struct udphdr * udphdr , uint8_t * proto , uint16_t * sport , uint16_t * dport )
{
if ( sport ) * sport = htons ( tcphdr ? tcphdr - > th_sport : udphdr ? udphdr - > uh_sport : 0 ) ;
if ( dport ) * dport = htons ( tcphdr ? tcphdr - > th_dport : udphdr ? udphdr - > uh_dport : 0 ) ;
if ( proto ) * proto = tcphdr ? IPPROTO_TCP : udphdr ? IPPROTO_UDP : - 1 ;
}
void extract_endpoints ( const struct ip * ip , const struct ip6_hdr * ip6hdr , const struct tcphdr * tcphdr , const struct udphdr * udphdr , struct sockaddr_storage * src , struct sockaddr_storage * dst )
{
if ( ip )
{
@ -461,7 +324,7 @@ void extract_endpoints(const struct ip *ip,const struct ip6_hdr *ip6hdr,const st
{
si = ( struct sockaddr_in * ) dst ;
si - > sin_family = AF_INET ;
si - > sin_port = tcphdr ? tcphdr - > th_dport : 0 ;
si - > sin_port = tcphdr ? tcphdr - > th_dport : udphdr ? udphdr - > uh_dport : 0 ;
si - > sin_addr = ip - > ip_dst ;
}
@ -469,7 +332,7 @@ void extract_endpoints(const struct ip *ip,const struct ip6_hdr *ip6hdr,const st
{
si = ( struct sockaddr_in * ) src ;
si - > sin_family = AF_INET ;
si - > sin_port = tcphdr ? tcphdr - > th_sport : 0 ;
si - > sin_port = tcphdr ? tcphdr - > th_sport : udphdr ? udphdr - > uh_sport : 0 ;
si - > sin_addr = ip - > ip_src ;
}
}
@ -481,7 +344,7 @@ void extract_endpoints(const struct ip *ip,const struct ip6_hdr *ip6hdr,const st
{
si = ( struct sockaddr_in6 * ) dst ;
si - > sin6_family = AF_INET6 ;
si - > sin6_port = tcphdr ? tcphdr - > th_dport : 0 ;
si - > sin6_port = tcphdr ? tcphdr - > th_dport : udphdr ? udphdr - > uh_dport : 0 ;
si - > sin6_addr = ip6hdr - > ip6_dst ;
si - > sin6_flowinfo = 0 ;
si - > sin6_scope_id = 0 ;
@ -491,7 +354,7 @@ void extract_endpoints(const struct ip *ip,const struct ip6_hdr *ip6hdr,const st
{
si = ( struct sockaddr_in6 * ) src ;
si - > sin6_family = AF_INET6 ;
si - > sin6_port = tcphdr ? tcphdr - > th_sport : 0 ;
si - > sin6_port = tcphdr ? tcphdr - > th_sport : udphdr ? udphdr - > uh_sport : 0 ;
si - > sin6_addr = ip6hdr - > ip6_src ;
si - > sin6_flowinfo = 0 ;
si - > sin6_scope_id = 0 ;
@ -499,7 +362,7 @@ void extract_endpoints(const struct ip *ip,const struct ip6_hdr *ip6hdr,const st
}
}
static const char * proto_name ( uint8_t proto )
const char * proto_name ( uint8_t proto )
{
switch ( proto )
{
@ -517,6 +380,10 @@ static const char *proto_name(uint8_t proto)
return " ah " ;
case IPPROTO_IPV6 :
return " 6in4 " ;
case IPPROTO_IPIP :
return " 4in4 " ;
case IPPROTO_GRE :
return " gre " ;
# ifdef IPPROTO_SCTP
case IPPROTO_SCTP :
return " sctp " ;
@ -533,6 +400,15 @@ static void str_proto_name(char *s, size_t s_len, uint8_t proto)
else
snprintf ( s , s_len , " %u " , proto ) ;
}
uint16_t family_from_proto ( uint8_t l3proto )
{
switch ( l3proto )
{
case IPPROTO_IP : return AF_INET ;
case IPPROTO_IPV6 : return AF_INET6 ;
default : return - 1 ;
}
}
static void str_srcdst_ip ( char * s , size_t s_len , const void * saddr , const void * daddr )
{
@ -576,7 +452,6 @@ void print_ip6hdr(const struct ip6_hdr *ip6hdr, uint8_t proto)
str_ip6hdr ( s , sizeof ( s ) , ip6hdr , proto ) ;
printf ( " %s " , s ) ;
}
static void str_tcphdr ( char * s , size_t s_len , const struct tcphdr * tcphdr )
{
char flags [ 7 ] , * f = flags ;
@ -595,6 +470,16 @@ void print_tcphdr(const struct tcphdr *tcphdr)
str_tcphdr ( s , sizeof ( s ) , tcphdr ) ;
printf ( " %s " , s ) ;
}
static void str_udphdr ( char * s , size_t s_len , const struct udphdr * udphdr )
{
snprintf ( s , s_len , " sport=%u dport=%u " , htons ( udphdr - > uh_sport ) , htons ( udphdr - > uh_dport ) ) ;
}
void print_udphdr ( const struct udphdr * udphdr )
{
char s [ 30 ] ;
str_udphdr ( s , sizeof ( s ) , udphdr ) ;
printf ( " %s " , s ) ;
}
@ -615,7 +500,7 @@ void proto_skip_ipv4(uint8_t **data, size_t *len)
}
bool proto_check_tcp ( const uint8_t * data , size_t len )
{
return len > = 20 & & len > = ( ( data [ 12 ] & 0xF0 ) > > 2 ) ;
return len > = 20 & & len > = ( ( data [ 12 ] & 0xF0 ) > > 2 ) ;
}
void proto_skip_tcp ( uint8_t * * data , size_t * len )
{
@ -624,6 +509,15 @@ void proto_skip_tcp(uint8_t **data, size_t *len)
* data + = l ;
* len - = l ;
}
bool proto_check_udp ( const uint8_t * data , size_t len )
{
return len > = 8 & & len > = ( data [ 4 ] < < 8 | data [ 5 ] ) ;
}
void proto_skip_udp ( uint8_t * * data , size_t * len )
{
* data + = 8 ;
* len - = 8 ;
}
bool proto_check_ipv6 ( const uint8_t * data , size_t len )
{
@ -722,3 +616,229 @@ void tcp_rewrite_winsize(struct tcphdr *tcp, uint16_t winsize, uint8_t scale_fac
tcp_rewrite_wscale ( tcp , scale_factor ) ;
}
static int rawsend_sock4 = - 1 , rawsend_sock6 = - 1 ;
static void rawsend_clean_sock ( int * sock )
{
if ( sock & & * sock ! = - 1 )
{
close ( * sock ) ;
* sock = - 1 ;
}
}
void rawsend_cleanup ( )
{
rawsend_clean_sock ( & rawsend_sock4 ) ;
rawsend_clean_sock ( & rawsend_sock6 ) ;
}
static int * rawsend_family_sock ( sa_family_t family )
{
switch ( family )
{
case AF_INET : return & rawsend_sock4 ;
case AF_INET6 : return & rawsend_sock6 ;
default : return NULL ;
}
}
# ifdef BSD
static int rawsend_socket_divert ( sa_family_t family )
{
// HACK HACK HACK HACK HACK HACK HACK HACK
// FreeBSD doesnt allow IP_HDRINCL for IPV6
// OpenBSD doesnt allow rawsending tcp frames
// we either have to go to the link layer (its hard, possible problems arise, compat testing, ...) or use some HACKING
// from my point of view disabling direct ability to send ip frames is not security. its SHIT
int fd = socket ( family , SOCK_RAW , IPPROTO_DIVERT ) ;
if ( ! set_socket_buffers ( fd , 4096 , RAW_SNDBUF ) )
{
close ( fd ) ;
return - 1 ;
}
return fd ;
}
static int rawsend_sendto_divert ( sa_family_t family , int sock , const void * buf , size_t len )
{
struct sockaddr_storage sa ;
socklen_t slen ;
memset ( & sa , 0 , sizeof ( sa ) ) ;
sa . ss_family = family ;
switch ( family )
{
case AF_INET :
slen = sizeof ( struct sockaddr_in ) ;
break ;
case AF_INET6 :
slen = sizeof ( struct sockaddr_in6 ) ;
break ;
default :
return - 1 ;
}
return sendto ( sock , buf , len , 0 , ( struct sockaddr * ) & sa , slen ) ;
}
# endif
static int rawsend_socket_raw ( int domain , int proto )
{
int fd = socket ( domain , SOCK_RAW , proto ) ;
if ( fd ! = - 1 )
{
# ifdef __linux__
int s = RAW_SNDBUF / 2 ;
int r = 2048 ;
# else
int s = RAW_SNDBUF ;
int r = 4096 ;
# endif
if ( ! set_socket_buffers ( fd , r , s ) )
{
close ( fd ) ;
return - 1 ;
}
}
return fd ;
}
static int rawsend_socket ( sa_family_t family , uint32_t fwmark )
{
int yes = 1 ;
int * sock = rawsend_family_sock ( family ) ;
if ( ! sock ) return - 1 ;
if ( * sock = = - 1 )
{
int yes = 1 , pri = 6 ;
//printf("rawsend_socket: family %d",family);
# ifdef __FreeBSD__
// IPPROTO_RAW with ipv6 in FreeBSD always returns EACCES on sendto.
// must use IPPROTO_TCP for ipv6. IPPROTO_RAW works for ipv4
// divert sockets are always v4 but accept both v4 and v6
* sock = ( family = = AF_INET ) ? rawsend_socket_raw ( family , IPPROTO_TCP ) : rawsend_socket_divert ( AF_INET ) ;
# elif defined(__OpenBSD__) || defined (__APPLE__)
// OpenBSD does not allow sending TCP frames through raw sockets
// I dont know about macos. They have dropped ipfw in recent versions and their PF does not support divert-packet
* sock = rawsend_socket_divert ( family ) ;
# else
* sock = rawsend_socket_raw ( family , IPPROTO_RAW ) ;
# endif
if ( * sock = = - 1 )
{
perror ( " rawsend: socket() " ) ;
return - 1 ;
}
# ifdef BSD
# if !(defined(__OpenBSD__) || defined (__APPLE__))
// HDRINCL not supported for ipv6 in any BSD
if ( family = = AF_INET & & setsockopt ( * sock , IPPROTO_IP , IP_HDRINCL , & yes , sizeof ( yes ) ) = = - 1 )
{
perror ( " rawsend: setsockopt(IP_HDRINCL) " ) ;
goto exiterr ;
}
# endif
# ifdef SO_USER_COOKIE
if ( setsockopt ( * sock , SOL_SOCKET , SO_USER_COOKIE , & fwmark , sizeof ( fwmark ) ) = = - 1 )
{
perror ( " rawsend: setsockopt(SO_MARK) " ) ;
goto exiterr ;
}
# endif
# endif
# ifdef __linux__
if ( setsockopt ( * sock , SOL_SOCKET , SO_MARK , & fwmark , sizeof ( fwmark ) ) = = - 1 )
{
perror ( " rawsend: setsockopt(SO_MARK) " ) ;
goto exiterr ;
}
if ( setsockopt ( * sock , SOL_SOCKET , SO_PRIORITY , & pri , sizeof ( pri ) ) = = - 1 )
{
perror ( " rawsend: setsockopt(SO_PRIORITY) " ) ;
goto exiterr ;
}
# endif
}
return * sock ;
exiterr :
rawsend_clean_sock ( sock ) ;
return - 1 ;
}
bool rawsend_preinit ( uint32_t fwmark )
{
return rawsend_socket ( AF_INET , fwmark ) ! = - 1 & & rawsend_socket ( AF_INET6 , fwmark ) ! = - 1 ;
}
bool rawsend ( const struct sockaddr * dst , uint32_t fwmark , const void * data , size_t len )
{
int sock = rawsend_socket ( dst - > sa_family , fwmark ) ;
if ( sock = = - 1 ) return false ;
int salen = dst - > sa_family = = AF_INET ? sizeof ( struct sockaddr_in ) : sizeof ( struct sockaddr_in6 ) ;
struct sockaddr_storage dst2 ;
memcpy ( & dst2 , dst , salen ) ;
if ( dst - > sa_family = = AF_INET6 )
( ( struct sockaddr_in6 * ) & dst2 ) - > sin6_port = 0 ; // or will be EINVAL in linux
# ifdef BSD
/*
// this works only for local connections and not working for transit : cant spoof source addr
if ( len > = sizeof ( struct ip6_hdr ) )
{
// BSD ipv6 raw socks are limited. cannot pass the whole packet with ip6 header.
struct sockaddr_storage sa_src ;
int v ;
extract_endpoints ( NULL , ( struct ip6_hdr * ) data , NULL , NULL , & sa_src , NULL ) ;
v = ( ( struct ip6_hdr * ) data ) - > ip6_ctlun . ip6_un1 . ip6_un1_hlim ;
if ( setsockopt ( sock , IPPROTO_IPV6 , IPV6_UNICAST_HOPS , & v , sizeof ( v ) ) = = - 1 )
perror ( " rawsend: setsockopt(IPV6_HOPLIMIT) " ) ;
[ 5 ~ // the only way to control source address is bind. make it equal to ip6_hdr
if ( bind ( sock , ( struct sockaddr * ) & sa_src , salen ) < 0 )
perror ( " rawsend bind: " ) ;
//printf("BSD v6 RAWSEND "); print_sockaddr((struct sockaddr*)&sa_src); printf(" -> "); print_sockaddr((struct sockaddr*)&dst2); printf("\n");
proto_skip_ipv6 ( ( uint8_t * * ) & data , & len , NULL ) ;
}
*/
# if !(defined(__OpenBSD__) || defined (__APPLE__))
// OpenBSD doesnt allow rawsending tcp frames. always use divert socket
if ( dst - > sa_family = = AF_INET6 )
# endif
{
ssize_t bytes = rawsend_sendto_divert ( dst - > sa_family , sock , data , len ) ;
if ( bytes = = - 1 )
{
perror ( " rawsend: sendto_divert " ) ;
return false ;
}
return true ;
}
# endif
# if defined(__FreeBSD__) && __FreeBSD__<=10
// old FreeBSD requires some fields in host byte order
if ( dst - > sa_family = = AF_INET & & len > = sizeof ( struct ip ) )
{
( ( struct ip * ) data ) - > ip_len = htons ( ( ( struct ip * ) data ) - > ip_len ) ;
( ( struct ip * ) data ) - > ip_off = htons ( ( ( struct ip * ) data ) - > ip_off ) ;
}
# endif
// normal raw socket sendto
ssize_t bytes = sendto ( sock , data , len , 0 , ( struct sockaddr * ) & dst2 , salen ) ;
# if defined(__FreeBSD) && __FreeBSD__<=10
// restore byte order
if ( dst - > sa_family = = AF_INET & & len > = sizeof ( struct ip ) )
{
( ( struct ip * ) data ) - > ip_len = htons ( ( ( struct ip * ) data ) - > ip_len ) ;
( ( struct ip * ) data ) - > ip_off = htons ( ( ( struct ip * ) data ) - > ip_off ) ;
}
# endif
if ( bytes = = - 1 )
{
perror ( " rawsend: sendto " ) ;
return false ;
}
return true ;
}
bol-van
3 years ago