src/layer4.c

   1 /*
   2  * Mausezahn - A fast versatile traffic generator
   3  * Copyright (C) 2008-2010 Herbert Haas
   4  *
   5  * This program is free software; you can redistribute it and/or modify it under
   6  * the terms of the GNU General Public License version 2 as published by the
   7  * Free Software Foundation.
   8  *
   9  * This program is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  11  * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
  12  * details.
  13  *
  14  * You should have received a copy of the GNU General Public License along with
  15  * this program; if not, see http://www.gnu.org/licenses/gpl-2.0.html
  16  *
  17 */
  18
  19
  20
  21 ////////////////////////////////////////////////////////////////////
  22 //
  23 // Layer 4 packet types
  24 //
  25 // 1. UDP
  26 // 2. ICMP
  27 // 3. TCP
  28 //
  29 ////////////////////////////////////////////////////////////////////
  30
  31 #include "mz.h"
  32 #include "cli.h"
  33
  34
  35 #define MZ_UDP_HELP \
  36                 "| UDP type: Send raw UDP packets.\n"  \
  37                 "|\n" \
  38                 "| Parameters: \n" \
  39                 "|\n" \
  40                 "|  sp          0-65535\n" \
  41                 "|  dp          0-65535\n" \
  42                 "|  len         0-65535\n" \
  43                 "|  udp_sum     0-65535\n" \
  44                 "|  payload|p   <hex payload>\n" \
  45                 "|\n" \
  46                 "| Optionally the port numbers can be specified as ranges, e. g. \"dp=1023-33700\",\n" \
  47                 "| in which case one packet per port number is sent.\n" \
  48                 "|\n" \
  49                 "| Note that the UDP length must include the header length. If you do NOT specify the len\n" \
  50                 "| parameter (or specify len=0) then Mausezahn will compute the correct length.\n" \
  51                 "|\n" \
  52                 "| Note that all IP parameters can be modified (see IP help, i. e. '-t ip \"help\")\n" \
  53                 "| except that (to avoid confusion) the IP length is 'iplen' and the IP checksum is 'ipsum'.\n" \
  54                 "| Of course all Ethernet fields can also be accessed.\n" \
  55                 "|\n" \
  56                 "\n"
  57
  58
  59 #define MZ_ICMP_HELP \
  60                 "| ICMP type: Send raw ICMP packets.\n" \
  61                 "|\n" \
  62                 "| ARGUMENT SYNTAX: [type] <optional parameters> \n" \
  63                 "| \n" \
  64                 "| Per default an echo reply is sent (type=0, code=0)\n" \
  65                 "|\n" \
  66                 "| TYPE         OPTIONAL PARAMETERS\n" \
  67                 "| ===========  ====================================================================\n" \
  68                 "| Ping:       \"ping\" or \"echoreq\" \n" \
  69                 "|              'id' (0-65535) is the optional identification number\n" \
  70                 "|              'seq' (0-65535) is the optional packet sequence number\n" \
  71                 "|\n" \
  72                 "| Redirect:   \"redir, code=0, gw=192.168.1.10, p=aa:bb:cc\"\n" \
  73                 "|              'gw' (or 'gateway') is the announced gateway, by default your own\n" \
  74                 "|              IP address.\n" \
  75                 "|              'code' can be:\n" \
  76                 "|                  0 ... redirect datagram for the network\n" \
  77                 "|                  1 ... redirect datagram for the host\n" \
  78                 "|                  2 ... redirect datagram for ToS and network\n" \
  79                 "|                  3 ... redirect datagram for ToS and host\n" \
  80                 "|              'p' (or 'payload') is the payload of the ICMP packet, tpyically an IP\n" \
  81                 "|              header. Note that - at the moment - you must prepare this payload by\n"  \
  82                 "|              yourself.\n" \
  83                 "|\n" \
  84                 "| Unreachable \"unreach, code=2\"\n" \
  85                 "|              'code' can be:\n" \
  86                 "|                  0 ... network unreachable\n" \
  87                 "|                  1 ... host unreachable\n" \
  88                 "|                  2 ... protocol unreachable\n" \
  89                 "|                  3 ... port unreachable\n" \
  90                 "|                  4 ... fragmentation needed but DF-bit is set\n" \
  91                 "|                  5 ... source route failed\n" \
  92                 "|\n" \
  93                 "|\n" \
  94                 "| (other ICMP types will follow)\n" \
  95                 "|\n" \
  96                 "\n"
  97
  98 #define MZ_ICMP6_HELP \
  99                 "| ICMPv6 type: Send raw ICMPv6 packets.\n" \
 100                 "|\n" \
 101                 "| Parameters  Values                               Explanation \n"  \
 102                 "| ----------  ------------------------------------ -------------------\n" \
 103                 "|  type       0-255                                ICMPv6 Type\n" \
 104                 "|  code       0-255                                ICMPv6 Code\n" \
 105                 "|  id         0-65535                              optional identification number\n" \
 106                 "|  seq        0-65535                              optional packet sequence number\n" \
 107                 "|  icmpv6_sum 0-65535                              optional checksum\n" \
 108                 "\n"
 109
 110 #define MZ_TCP_HELP \
 111                 "| TCP type: Send raw TCP packets.\n" \
 112                 "|\n" \
 113                 "| Parameters  Values                               Explanation \n"  \
 114                 "| ----------  ------------------------------------ -------------------\n" \
 115                 "|  sp         0-65535                              Source Port\n" \
 116                 "|  dp         0-65535                              Destination Port\n" \
 117                 "|  flags      fin|syn|rst|psh|ack|urg|ecn|cwr\n" \
 118                 "|  s          0-4294967295                         Sequence Nr.\n" \
 119                 "|  a          0-4294967295                         Acknowledgement Nr.\n" \
 120                 "|  win        0-65535                              Window Size\n" \
 121                 "|  urg        0-65535                              Urgent Pointer\n" \
 122                 "|  tcp_sum    0-65535                              Checksum\n" \
 123                 "|\n" \
 124                 "| The port numbers can be specified as ranges, e. g. \"dp=1023-33700\".\n" \
 125                 "| Multiple flags can be specified such as \"flags=syn|ack|urg\".\n" \
 126                 "|\n" \
 127                 "| Also the sequence number can be specified as a range, for example:\n" \
 128                 "|\n" \
 129                 "|   s=10000-50000 ... send 40000 packets with SQNRs in that range. If the second\n" \
 130                 "|                     value is lower than the first then it is assumed that the\n" \
 131                 "|                     SQNRs should 'wrap around'.\n" \
 132                 "|   ds=30000 ........ use this increment within a SQNR-range.\n" \
 133                 "|\n" \
 134                 "| Note that all IP parameters can be modified (see IP help, i. e. '-t ip \"help\")\n" \
 135                 "| except that (to avoid confusion) the IP length is 'iplen' and the IP checksum is 'ipsum'.\n" \
 136                 "| Of course all Ethernet fields can also be accessed.\n"\
 137                 "|\n"
 138
 139
 140
 141 // Note: If another function specified tx.udp_payload then it must also
 142 // set tx.udp_payload_s AND tx.udp_len = tx.udp_payload_s + 8
 143 libnet_ptag_t  create_udp_packet (libnet_t *l)
 144 {
 145    libnet_ptag_t  t;
 146    char argval[MAX_PAYLOAD_SIZE];
 147    int T; // only an abbreviation for tx.packet_mode
 148    int i;
 149
 150    /////////////////////////////
 151    // Default UDP header fields
 152    // Already reset in init.c
 153    /////////////////////////////
 154
 155    T = tx.packet_mode; // >0 means automatic L2 creation
 156
 157    if ( (getarg(tx.arg_string,"help", NULL)==1) && (mode==UDP) )
 158      {
 159         if (mz_port)
 160           {
 161              cli_print(gcli, "%s", MZ_UDP_HELP);
 162              return -1;
 163           }
 164         else
 165           {
 166
 167              fprintf(stderr,"\n"
 168                      MAUSEZAHN_VERSION
 169                      "\n%s", MZ_UDP_HELP);
 170
 171              exit(0);
 172           }
 173
 174      }
 175
 176
 177    // Evaluate CLI parameters:
 178
 179    if (getarg(tx.arg_string,"dp", argval)==1)
 180      {
 181         if (get_port_range (DST_PORT, argval)) // problem
 182           {
 183              tx.dp = 0;
 184           }
 185      }
 186
 187    if (getarg(tx.arg_string,"sp", argval)==1)
 188      {
 189         if (get_port_range (SRC_PORT, argval)) // problem
 190           {
 191              tx.sp = 0;
 192           }
 193      }
 194
 195
 196    // Check if hex_payload already specified (externally)
 197    if (tx.hex_payload_s)
 198      {
 199         memcpy( (void*) tx.udp_payload, (void*) tx.hex_payload, tx.hex_payload_s);
 200         tx.udp_payload_s = tx.hex_payload_s;
 201      }
 202
 203    if ( (getarg(tx.arg_string,"payload", argval)==1) || (getarg(tx.arg_string,"p", argval)==1))
 204      {
 205         tx.udp_payload_s = str2hex (argval, tx.udp_payload, MAX_PAYLOAD_SIZE);
 206      }
 207
 208
 209
 210    if (getarg(tx.arg_string,"sum", argval)==1)
 211      {
 212         if (T) fprintf(stderr, " IP_Warning: 'sum' cannot be set in this mode.\n");
 213         tx.ip_sum = (u_int16_t) str2int(argval);
 214      }
 215
 216    if (getarg(tx.arg_string,"udp_sum", argval)==1)
 217      {
 218         tx.udp_sum = (u_int16_t) str2int(argval);
 219      }
 220
 221
 222    if (tx.ascii) // ASCII PAYLOAD overrides hex payload
 223      {
 224         strncpy((char *)tx.udp_payload, (char *)tx.ascii_payload, MAX_PAYLOAD_SIZE);
 225         tx.udp_payload_s = strlen((char *)tx.ascii_payload);
 226         printf("[%s]\n", tx.ascii_payload);
 227      }
 228
 229
 230    /////////
 231    // Want some padding? The specified number of padding bytes are ADDED to the
 232    // payload.
 233    // (Note the difference in send_eth() where you specified the total number
 234    // of bytes in the frame)
 235    //
 236    if (tx.padding)
 237      {
 238         for (i=0; i<tx.padding; i++)
 239           {
 240              tx.udp_payload[tx.udp_payload_s+i] = 0x42; // pad with THE ANSWER (why random?)
 241           }
 242         tx.udp_payload_s += tx.padding;
 243      }
 244
 245
 246
 247    ////////
 248    // The following is VERY IMPORTANT because the ip_payload_s is also set!
 249    if (getarg(tx.arg_string,"len", argval)==1)
 250      {
 251         tx.udp_len = (u_int16_t) str2int(argval);
 252         tx.ip_payload_s = tx.udp_len;
 253      }
 254    else // len NOT specified by user
 255      {
 256         if (tx.udp_len == 0) // len also not specified by another function (e. g. create_dns_packet...)
 257           {
 258              tx.udp_len = 8 + tx.udp_payload_s;
 259              tx.ip_payload_s = tx.udp_len;
 260           }
 261         else // len (and payload and payload_s) has been specified by another function
 262           {
 263              tx.ip_payload_s = tx.udp_len;
 264           }
 265
 266      }
 267
 268
 269
 270    t = libnet_build_udp(tx.sp,
 271                         tx.dp,
 272                         tx.udp_len,
 273                         tx.udp_sum,
 274                         (tx.udp_payload_s) ? tx.udp_payload : NULL,
 275                         tx.udp_payload_s,
 276                         l,
 277                         0);
 278
 279    // Checksum overwrite? Libnet IPv6 checksum calculation can't deal with extension headers, we have to do it ourself...
 280    libnet_toggle_checksum(l, t, (tx.udp_sum || ipv6_mode) ? LIBNET_OFF : LIBNET_ON);
 281
 282    if (t == -1)
 283      {
 284         fprintf(stderr, " mz/create_udp_packet: Can't build UDP header: %s\n", libnet_geterror(l));
 285         exit (0);
 286      }
 287
 288
 289
 290    return t;
 291
 292 }
 293
 294
 295
 296
 297
 298
 299
 300
 301 ///////////////////////////////////////////////////
 302 ///////////////////////////////////////////////////
 303 ///////////////////////////////////////////////////
 304 ///////////////////////////////////////////////////
 305 ///////////////////////////////////////////////////
 306
 307
 308
 309 libnet_ptag_t  create_icmp_packet (libnet_t *l)
 310 {
 311
 312    libnet_ptag_t  t;
 313    char argval[MAX_PAYLOAD_SIZE];
 314    unsigned char *x;
 315
 316    int i;
 317
 318    enum
 319      {
 320         NONE,
 321         ECHO_REQUEST,
 322         REDIRECT,
 323         UNREACHABLE
 324      }
 325    icmp;           // which ICMP Type?
 326
 327
 328    if ( (getarg(tx.arg_string,"help", NULL)==1) && (mode==ICMP) )
 329      {
 330         if (mz_port)
 331           {
 332              cli_print(gcli, "%s", MZ_ICMP_HELP);
 333              return -1;
 334           }
 335         else
 336           {
 337
 338              fprintf(stderr,"\n"
 339                      MAUSEZAHN_VERSION
 340                      "\n%s", MZ_ICMP_HELP);
 341              exit(0);
 342           }
 343      }
 344
 345
 346    /////////////////////////////////////////
 347    //
 348    // Which ICMP Type has been specified?
 349    //
 350    // Note: to allow invalid type values we need the enum 'icmp' tp specify the sending function
 351    //       and the 'type' variable seperately.
 352
 353    if ( (getarg(tx.arg_string,"redirect", NULL)==1) || (getarg(tx.arg_string,"redir", NULL)==1) )
 354      {
 355         icmp = REDIRECT;
 356         tx.icmp_type = ICMP_REDIRECT;
 357         tx.icmp_code=ICMP_REDIRECT_HOST;
 358      }
 359
 360
 361    if ( (getarg(tx.arg_string,"ping", NULL)==1) || (getarg(tx.arg_string,"echoreq", NULL)==1) )
 362      {
 363         icmp = ECHO_REQUEST;
 364         tx.icmp_type = ICMP_ECHO;
 365         tx.icmp_code = 0;
 366      }
 367
 368
 369    if (getarg(tx.arg_string,"unreach", NULL)==1)
 370      {
 371         icmp = UNREACHABLE;
 372         tx.icmp_type = ICMP_UNREACH;
 373         tx.icmp_code = 0; // network unreachable
 374      }
 375
 376
 377    /////////////////////////////////////////
 378    //
 379    // Which parameters have been specified?
 380
 381
 382    if (getarg(tx.arg_string,"type", argval)==1)
 383      {
 384         tx.icmp_type = (u_int8_t) str2int(argval);
 385      }
 386
 387    if (getarg(tx.arg_string,"code", argval)==1)
 388      {
 389         tx.icmp_code = (u_int8_t) str2int(argval);
 390      }
 391    else
 392      {
 393         // Use appropriate defaults depending on ICMP type
 394      }
 395
 396
 397    if (getarg(tx.arg_string,"icmp_sum", argval)==1)
 398      {
 399         tx.icmp_chksum = (u_int16_t) str2int(argval);
 400      }
 401
 402    if ( (getarg(tx.arg_string,"gateway", argval)==1) || (getarg(tx.arg_string,"gw", argval)==1) )
 403      {
 404         tx.icmp_gateway = str2ip32 (argval);
 405      }
 406    else
 407      {
 408         tx.icmp_gateway = tx.ip_src;  // prefer own address
 409      }
 410
 411
 412    if (getarg(tx.arg_string,"id", argval)==1)
 413      {
 414         tx.icmp_ident = (u_int16_t) str2int(argval);
 415      }
 416
 417    if (getarg(tx.arg_string,"seq", argval)==1)
 418      {
 419         tx.icmp_sqnr = (u_int16_t) str2int(argval);
 420      }
 421
 422
 423    // Check if hex_payload already specified (externally)
 424    if (tx.hex_payload_s)
 425      {
 426         memcpy( (void*) tx.icmp_payload, (void*) tx.hex_payload, tx.hex_payload_s);
 427         tx.icmp_payload_s = tx.hex_payload_s;
 428      }
 429
 430
 431    if ( (getarg(tx.arg_string,"payload", argval)==1) || (getarg(tx.arg_string,"p", argval)==1))
 432      {
 433         tx.icmp_payload_s = str2hex (argval, tx.icmp_payload, MAX_PAYLOAD_SIZE);
 434      }
 435    else
 436      {
 437         tx.icmp_payload_s = 0;
 438      }
 439
 440
 441    if (tx.ascii) // ASCII PAYLOAD overrides hex payload
 442      {
 443         strncpy((char *)tx.icmp_payload, (char *)tx.ascii_payload, MAX_PAYLOAD_SIZE);
 444         tx.icmp_payload_s = strlen((char *)tx.ascii_payload);
 445      }
 446
 447
 448    /////////
 449    // Want some padding? The specified number of padding bytes are ADDED to the
 450    // payload.
 451    // (Note the difference in send_eth() where you specified the total number
 452    // of bytes in the frame)
 453    //
 454    if (tx.padding)
 455      {
 456         for (i=0; i<tx.padding; i++)
 457           {
 458              tx.icmp_payload[tx.icmp_payload_s+i] = 0x42; // pad with THE ANSWER (why random?)
 459           }
 460         tx.icmp_payload_s += tx.padding;
 461      }
 462
 463
 464    ////////////////////////////////////////////////////////////////////////////////////////////
 465    //
 466    // Now determine which type of ICMP packet to send.
 467    //
 468    // NOTE: Every section (icmp-type) must provide
 469    //
 470    //        1. a build function
 471    //        2. tx.ip_payload_s which indicates the whole ICMP packet size
 472    //        3. tx.icmp_verbose_string containing details about the ICMP packet (verbose mode)
 473    //
 474    ////////////////////////////////////////////////////////////////////////////////////////////
 475
 476    switch (icmp)
 477      {
 478       case REDIRECT: // +++++++++++++++
 479         t = libnet_build_icmpv4_redirect (tx.icmp_type,
 480                                           tx.icmp_code,
 481                                           tx.icmp_chksum,
 482                                           tx.icmp_gateway,
 483                                           (tx.icmp_payload_s) ? tx.icmp_payload : NULL,
 484                                           tx.icmp_payload_s,
 485                                           l,
 486                                           0);
 487         tx.ip_payload_s = LIBNET_ICMPV4_REDIRECT_H + tx.icmp_payload_s;  // for send_ip
 488         if (verbose)
 489           {
 490              x = (unsigned char*) &tx.icmp_gateway;
 491              sprintf(tx.icmp_verbose_txt,"ICMP Redirect, GW=%u.%u.%u.%u",
 492                      *(x),*(x+1),*(x+2),*(x+3));
 493           }
 494         break; // ++++++++++++++++++++++
 495       case NONE:
 496       case ECHO_REQUEST:
 497         t = libnet_build_icmpv4_echo(tx.icmp_type,
 498                                      tx.icmp_code,
 499                                      tx.icmp_chksum,
 500                                      tx.icmp_ident,
 501                                      tx.icmp_sqnr,
 502                                      (tx.icmp_payload_s) ? tx.icmp_payload : NULL,
 503                                      tx.icmp_payload_s,
 504                                      l,
 505                                      0);
 506         tx.ip_payload_s = LIBNET_ICMPV4_REDIRECT_H + tx.icmp_payload_s;  // for send_ip
 507         if (verbose)
 508           {
 509              if (icmp == NONE)
 510                 sprintf(tx.icmp_verbose_txt,"ICMP Type %u Code %u\n",tx.icmp_type,tx.icmp_code);
 511              else
 512                 sprintf(tx.icmp_verbose_txt,"ICMP Echo Request (id=%u seq=%u)\n",tx.icmp_ident,tx.icmp_sqnr);
 513           }
 514         break; // ++++++++++++++++++++++
 515       case UNREACHABLE:
 516         t = libnet_build_icmpv4_unreach(tx.icmp_type,
 517                                         tx.icmp_code,
 518                                         tx.icmp_chksum,
 519                                         (tx.icmp_payload_s) ? tx.icmp_payload : NULL,
 520                                         tx.icmp_payload_s,
 521                                         l,
 522                                         0);
 523         if (verbose)
 524           {
 525              sprintf(tx.icmp_verbose_txt,"ICMP unreachable (code=%u)\n",tx.icmp_code);
 526           }
 527         break; // ++++++++++++++++++++++
 528       default:
 529         (void) fprintf(stderr," mz/icmp: unknown mode! Stop.\n");
 530         return (1);
 531      }
 532
 533    libnet_toggle_checksum(l, t, tx.icmp_chksum ? LIBNET_OFF : LIBNET_ON);
 534
 535    if (t == -1)
 536      {
 537         fprintf(stderr, " mz/create_icmp_packet: Can't build ICMP header: %s\n", libnet_geterror(l));
 538         exit (0);
 539      }
 540
 541
 542    return t;
 543 }
 544
 545 libnet_ptag_t  create_icmp6_packet (libnet_t *l)
 546 {
 547    libnet_ptag_t  t;
 548    char argval[MAX_PAYLOAD_SIZE];
 549
 550    int i;
 551    tx.icmp_ident = 0;
 552    tx.icmp_sqnr = 0;
 553
 554    if ( (getarg(tx.arg_string,"help", NULL)==1) && (mode==ICMP) )
 555      {
 556         if (mz_port)
 557           {
 558              cli_print(gcli, "%s", MZ_ICMP6_HELP);
 559              return -1;
 560           }
 561         else
 562           {
 563              fprintf(stderr,"\n"
 564                      MAUSEZAHN_VERSION
 565                      "\n%s", MZ_ICMP6_HELP);
 566              exit(0);
 567           }
 568      }
 569
 570
 571    /////////////////////////////////////////
 572    //
 573    // Which parameters have been specified?
 574
 575
 576    if (getarg(tx.arg_string,"type", argval)==1)
 577      {
 578         tx.icmp_type = (u_int8_t) str2int(argval);
 579      }
 580
 581    if (getarg(tx.arg_string,"code", argval)==1)
 582      {
 583         tx.icmp_code = (u_int8_t) str2int(argval);
 584      }
 585
 586    if (getarg(tx.arg_string,"id", argval)==1)
 587      {
 588         tx.icmp_ident = (u_int16_t) str2int(argval);
 589      }
 590
 591    if (getarg(tx.arg_string,"seq", argval)==1)
 592      {
 593         tx.icmp_sqnr = (u_int16_t) str2int(argval);
 594      }
 595
 596    if (getarg(tx.arg_string,"icmpv6_sum", argval)==1)
 597      {
 598         tx.icmp_chksum = (u_int16_t) str2int(argval);
 599      }
 600
 601    // Check if hex_payload already specified (externally)
 602    if (tx.hex_payload_s)
 603      {
 604         memcpy( (void*) tx.icmp_payload, (void*) tx.hex_payload, tx.hex_payload_s);
 605         tx.icmp_payload_s = tx.hex_payload_s;
 606      }
 607
 608    if ( (getarg(tx.arg_string,"payload", argval)==1) || (getarg(tx.arg_string,"p", argval)==1))
 609      {
 610         tx.icmp_payload_s = str2hex (argval, tx.icmp_payload, MAX_PAYLOAD_SIZE);
 611      }
 612    else
 613      {
 614         tx.icmp_payload_s = 0;
 615      }
 616
 617    if (tx.ascii) // ASCII PAYLOAD overrides hex payload
 618      {
 619         strncpy((char *)tx.icmp_payload, (char *)tx.ascii_payload, MAX_PAYLOAD_SIZE);
 620         tx.icmp_payload_s = strlen((char *)tx.ascii_payload);
 621      }
 622
 623    /////////
 624    // Want some padding? The specified number of padding bytes are ADDED to the
 625    // payload.
 626    // (Note the difference in send_eth() where you specified the total number
 627    // of bytes in the frame)
 628    //
 629    if (tx.padding)
 630      {
 631         for (i=0; i<tx.padding; i++)
 632           {
 633              tx.icmp_payload[tx.icmp_payload_s+i] = 0x42; // pad with THE ANSWER (why random?)
 634           }
 635         tx.icmp_payload_s += tx.padding;
 636      }
 637
 638    sprintf(tx.icmp_verbose_txt,"ICMPv6 Type %u Code %u\n",tx.icmp_type,tx.icmp_code);
 639
 640    t = libnet_build_icmpv4_echo (tx.icmp_type,
 641                                     tx.icmp_code,
 642                                     tx.icmp_chksum,
 643                                     tx.icmp_ident,
 644                                     tx.icmp_sqnr,
 645                                     tx.icmp_payload_s ? tx.icmp_payload : NULL,
 646                                     tx.icmp_payload_s,
 647                                     l,
 648                                     0);
 649    tx.ip_payload_s = LIBNET_ICMPV6_H + tx.icmp_payload_s;  // for send_ip
 650
 651    // Libnet IPv6 checksum calculation can't deal with extension headers, we have to do it ourself...
 652    libnet_toggle_checksum(l, t, (tx.icmp_chksum || ipv6_mode) ? LIBNET_OFF : LIBNET_ON);
 653
 654    if (t == -1)
 655      {
 656         fprintf(stderr, " mz/create_icmp_packet: Can't build ICMPv6 header: %s\n", libnet_geterror(l));
 657         exit (0);
 658      }
 659
 660    return t;
 661 }
 662
 663
 664
 665 ///////////////////////////////////////////////////
 666 ///////////////////////////////////////////////////
 667 ///////////////////////////////////////////////////
 668 ///////////////////////////////////////////////////
 669 ///////////////////////////////////////////////////
 670
 671
 672 // Note: If another function specified tx.tcp_payload then it must also
 673 // set tx.tcp_payload_s AND tx.tcp_len = tx.tcp_payload_s + 20
 674 libnet_ptag_t  create_tcp_packet (libnet_t *l)
 675 {
 676    libnet_ptag_t  t, t2;
 677    char argval[MAX_PAYLOAD_SIZE], *dummy1, *dummy2;
 678    int T; // only an abbreviation for tx.packet_mode
 679    int i;
 680
 681    u_int8_t tcp_default_options[] =
 682      {
 683           0x02, 0x04, 0x05, 0xac,                                     // MSS
 684           0x04, 0x02,                                                 // SACK permitted
 685           0x08, 0x0a, 0x19, 0x35, 0x90, 0xc3, 0x00, 0x00, 0x00, 0x00, // Timestamps
 686           0x01,                                                       // NOP
 687           0x03, 0x03, 0x05                                            // Window Scale 5
 688      };
 689
 690
 691
 692    /////////////////////////////
 693    // Default TCP header fields
 694    // Already reset in init.c
 695    /////////////////////////////
 696
 697    T = tx.packet_mode; // >0 means automatic L2 creation
 698
 699    if ( (getarg(tx.arg_string,"help", NULL)==1) && (mode==TCP) )
 700      {
 701         if (mz_port)
 702           {
 703              cli_print(gcli, "%s", MZ_TCP_HELP);
 704              return -1;
 705           }
 706         else
 707           {
 708              fprintf(stderr,"\n"
 709                      MAUSEZAHN_VERSION
 710                      "\n%s", MZ_TCP_HELP);
 711              exit(0);
 712           }
 713      }
 714
 715
 716    // Evaluate CLI parameters:
 717
 718    if (getarg(tx.arg_string,"dp", argval)==1)
 719      {
 720         if (get_port_range (DST_PORT, argval)) // problem
 721           {
 722              tx.dp = 0;
 723           }
 724      }
 725
 726
 727    if (getarg(tx.arg_string,"sp", argval)==1)
 728      {
 729         if (get_port_range (SRC_PORT, argval)) // problem
 730           {
 731              tx.sp = 0;
 732           }
 733      }
 734
 735
 736    if (getarg(tx.arg_string,"s", argval)==1)
 737      {
 738         //check whether a range has been specified:
 739         dummy1 = strtok(argval, "-");
 740         tx.tcp_seq = (u_int32_t) str2int (dummy1);
 741         if (  (dummy2 = strtok(NULL, "-")) == NULL ) // no additional value
 742           {
 743              tx.tcp_seq_stop = tx.tcp_seq;
 744           }
 745         else // range
 746           {
 747              tx.tcp_seq_stop = (u_int32_t) str2int (dummy2);
 748              tx.tcp_seq_start = tx.tcp_seq;          // initially tcp_seq = tcp_seq_start
 749              tx.tcp_seq_delta = 1;                   // an initialization only in case 'ds' not specified
 750           }
 751      }
 752
 753    if (getarg(tx.arg_string,"ds", argval)==1)
 754      {
 755         tx.tcp_seq_delta = (u_int32_t) str2int (argval);
 756      }
 757
 758    if (getarg(tx.arg_string,"a", argval)==1)
 759      {
 760         tx.tcp_ack = (u_int32_t) str2int (argval);
 761      }
 762
 763    if (getarg(tx.arg_string,"win", argval)==1)
 764      {
 765         tx.tcp_win = (u_int16_t) str2int (argval);
 766      }
 767
 768    if (getarg(tx.arg_string,"urg", argval)==1)
 769      {
 770         tx.tcp_urg = (u_int16_t) str2int (argval);
 771      }
 772
 773
 774    if ( (getarg(tx.arg_string,"flags", argval)==1) ||
 775         (getarg(tx.arg_string,"flag", argval)==1) ) // because everybody confuses this
 776      {
 777         if (get_tcp_flags(argval)) // problem
 778           {
 779              tx.tcp_control=2; // Assume SYN as default
 780           }
 781      }
 782
 783    if (getarg(tx.arg_string,"tcp_sum", argval)==1)
 784      {
 785         tx.tcp_sum = (u_int16_t) str2int(argval);
 786      }
 787
 788    // Check if hex_payload already specified (externally)
 789    if (tx.hex_payload_s)
 790      {
 791         memcpy( (void*) tx.tcp_payload, (void*) tx.hex_payload, tx.hex_payload_s);
 792         tx.tcp_payload_s = tx.hex_payload_s;
 793      }
 794
 795
 796    if ( (getarg(tx.arg_string,"payload", argval)==1) || (getarg(tx.arg_string,"p", argval)==1))
 797      {
 798         tx.tcp_payload_s = str2hex (argval, tx.tcp_payload, MAX_PAYLOAD_SIZE);
 799      }
 800
 801
 802    if (tx.ascii) // ASCII PAYLOAD overrides hex payload
 803      {
 804         strncpy((char *)tx.tcp_payload, (char *)tx.ascii_payload, MAX_PAYLOAD_SIZE);
 805         tx.tcp_payload_s = strlen((char *)tx.ascii_payload);
 806         tx.tcp_len = 20 + tx.tcp_payload_s;   // only needed by libnet to calculate checksum
 807         tx.ip_payload_s = tx.tcp_len;         // for create_ip_packet
 808      }
 809
 810
 811
 812    /////////
 813    // Want some padding? The specified number of padding bytes are ADDED to the
 814    // payload.
 815    // (Note the difference in send_eth() where you specified the total number
 816    // of bytes in the frame)
 817    //
 818    if (tx.padding)
 819      {
 820         for (i=0; i<tx.padding; i++)
 821           {
 822              tx.tcp_payload[tx.tcp_payload_s+i] = 0x42; // pad with THE ANSWER (why random?)
 823           }
 824         tx.tcp_payload_s += tx.padding;
 825
 826      }
 827
 828
 829
 830    tx.tcp_len = 20 + tx.tcp_payload_s;       // only needed by libnet to calculate checksum
 831    tx.ip_payload_s = tx.tcp_len;         // for create_ip_packet
 832
 833    if (tx.tcp_control & 0x02) // packets with syn require an MSS option
 834      {
 835         t2 = libnet_build_tcp_options(tcp_default_options,
 836                                      20,
 837                                      l,
 838                                      0);
 839
 840         if (t2 == -1)
 841           {
 842              fprintf(stderr, " mz/create_tcp_packet: Can't build TCP options: %s\n", libnet_geterror(l));
 843              exit (0);
 844           }
 845
 846         tx.tcp_len += 20;
 847         tx.tcp_offset = 10;
 848         tx.ip_payload_s = tx.tcp_len;   // for create_ip_packet
 849         tx.tcp_sum_part = libnet_in_cksum((u_int16_t *) tcp_default_options, 20);
 850      }
 851    else
 852      {
 853        tx.tcp_offset = 5;
 854        tx.tcp_sum_part = 0;
 855      }
 856
 857    t = libnet_build_tcp (tx.sp,
 858                          tx.dp,
 859                          tx.tcp_seq,
 860                          tx.tcp_ack,
 861                          tx.tcp_control,
 862                          tx.tcp_win,
 863                          tx.tcp_sum,
 864                          tx.tcp_urg,
 865                          tx.tcp_len,
 866                          (tx.tcp_payload_s) ? tx.tcp_payload : NULL,
 867                          tx.tcp_payload_s,
 868                          l,
 869                          0);
 870
 871
 872
 873    // Libnet IPv6 checksum calculation can't deal with extension headers, we have to do it ourself...
 874    libnet_toggle_checksum(l, t, (tx.tcp_sum || ipv6_mode) ? LIBNET_OFF : LIBNET_ON);
 875
 876    if (t == -1)
 877      {
 878         fprintf(stderr, " mz/create_tcp_packet: Can't build TCP header: %s\n", libnet_geterror(l));
 879         exit (0);
 880      }
 881
 882
 883    return t;
 884 }