/* Copyright (C) 2013-2015 P.D. Buchan (pdbuchan@yahoo.com) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ // Send an IPv6 TCP packet via raw socket at the link layer (ethernet frame). // with a large payload requiring fragmentation. Include a hop-by-hop options // extension header with a router alert option. Include an authentication // extension header (with some random bogus integrity check value (ICV)). // See Section 3 of RFC 2402 for information on properly calculating ICV. // The authentication header is used here in transport mode. // Need to have destination MAC address. #include #include #include // close() #include // strcpy, memset(), and memcpy() #include // struct addrinfo #include // needed for socket(), uint8_t, uint16_t, uint32_t #include // needed for socket() #include // IPPROTO_HOPOPTS, IPPROTO_AH, IPPROTO_TCP, IPPROTO_FRAGMENT, INET6_ADDRSTRLEN #include // IP_MAXPACKET (which is 65535) #include // struct ip6_hdr #define __FAVOR_BSD // Use BSD format of tcp header #include // struct tcphdr #include // inet_pton() and inet_ntop() #include // macro ioctl is defined #include // defines values for argument "request" of ioctl. #include // struct ifreq #include // ETH_P_IP = 0x0800, ETH_P_IPV6 = 0x86DD #include // struct sockaddr_ll (see man 7 packet) #include #include // errno, perror() // Define a struct for hop-by-hop header, excluding options. typedef struct _hop_hdr hop_hdr; struct _hop_hdr { uint8_t nxt_hdr; uint8_t hdr_len; }; // Define a struct for authentication header, excluding authentication data. typedef struct _auth_hdr auth_hdr; struct _auth_hdr { uint8_t nxt_hdr; uint8_t pay_len; u_int16_t reserved; u_int32_t spi; u_int32_t seq; }; // Define some constants. #define ETH_HDRLEN 14 // Ethernet header length #define IP6_HDRLEN 40 // IPv6 header length #define HOP_HDRLEN 2 // Hop-by-hop header length, excluding options #define TCP_HDRLEN 20 // TCP header length, excludes options data #define FRG_HDRLEN 8 // IPv6 fragment header #define MAX_FRAGS 3119 // Maximum number of packet fragments #define MAX_HBHOPTIONS 10 // Maximum number of extension header options #define MAX_HBHOPTLEN 256 // Maximum length of a hop-by-hop option (some large value) #define ATH_HDRLEN 12 // Authentication header length, excludes authentication data // Function prototypes uint16_t checksum (uint16_t *, int); uint16_t tcp6_checksum (struct ip6_hdr, struct tcphdr, uint8_t *, int); int option_pad (int *, uint8_t *, int *, int, int); char *allocate_strmem (int); uint8_t *allocate_ustrmem (int); uint8_t **allocate_ustrmemp (int); int *allocate_intmem (int); int main (int argc, char **argv) { int i, j, n, indx, status, frame_length, sd, bytes; int hoplen, mtu, *frag_flags, *tcp_flags, c, nframes, offset[MAX_FRAGS], len[MAX_FRAGS]; hop_hdr hophdr; auth_hdr authhdr; int hbh_optpadlen; int *hbh_x, *hbh_y; // Alignment requirements for hop-by-hop options: hbh_x[option #] = int, hbh_y[option #] = int char *interface, *target, *src_ip, *dst_ip; struct ip6_hdr iphdr; struct tcphdr tcphdr; struct ip6_frag fraghdr; int payloadlen, fragbufferlen; uint8_t *payload, *fragbuffer, *src_mac, *dst_mac, *ether_frame; struct addrinfo hints, *res; struct sockaddr_in6 *ipv6; struct sockaddr_ll device; struct ifreq ifr; void *tmp; FILE *fi; int hbh_nopt; // Number of hop-by-hop options int hbh_opt_totlen; // Total length of hop-by-hop options int *hbh_optlen; // Hop-by-hop option length: hbh_optlen[option #] = int uint8_t **hbh_options; // Hop-by-hop options data: hbh_options[option #] = uint8_t * uint8_t *auth_data; // Authentication header data (integrity check value (ICV)): auth_data = uint8_t * int auth_len; // Authentication header data length // Allocate memory for various arrays. hbh_optlen = allocate_intmem (MAX_HBHOPTIONS); // hbh_optlen[option #] = int hbh_options = allocate_ustrmemp (MAX_HBHOPTIONS); // hbh_options[option #] = uint8_t * for (i=0; i 0) { indx += HOP_HDRLEN; // Account for hop-by-hop header (Next Header and Header Length) for (i=0; iai_addr; tmp = &(ipv6->sin6_addr); if (inet_ntop (AF_INET6, tmp, dst_ip, INET6_ADDRSTRLEN) == NULL) { status = errno; fprintf (stderr, "inet_ntop() failed for target.\nError message: %s", strerror (status)); exit (EXIT_FAILURE); } freeaddrinfo (res); // Fill out sockaddr_ll. device.sll_family = AF_PACKET; memcpy (device.sll_addr, src_mac, 6 * sizeof (uint8_t)); device.sll_halen = 6; // Get TCP data. i = 0; fi = fopen ("data", "r"); if (fi == NULL) { printf ("Can't open file 'data'.\n"); exit (EXIT_FAILURE); } while ((n=fgetc (fi)) != EOF) { payload[i] = n; i++; } fclose (fi); payloadlen = i; printf ("Upper layer protocol header length (bytes): %i\n", TCP_HDRLEN); printf ("Payload length (bytes): %i\n", payloadlen); // Length of fragmentable portion of packet. fragbufferlen = ATH_HDRLEN + auth_len + TCP_HDRLEN + payloadlen; printf ("Total fragmentable data (bytes): %i\n", fragbufferlen); // Allocate memory for the fragmentable portion. fragbuffer = allocate_ustrmem (fragbufferlen); // Length of hop-by-hop header, options, and padding. hoplen = HOP_HDRLEN + hbh_opt_totlen + hbh_optpadlen; // Determine how many ethernet frames we'll need. // Hop-by-hop header and its options are part of unfragmentable portion of packet. memset (len, 0, MAX_FRAGS * sizeof (int)); memset (offset, 0, MAX_FRAGS * sizeof (int)); i = 0; c = 0; // Variable c is index to buffer, which contains upper layer protocol header and data. while (c < fragbufferlen) { // Do we still need to fragment remainder of fragmentable portion? if ((fragbufferlen - c)> (mtu - IP6_HDRLEN - hoplen - FRG_HDRLEN)) { // Yes len[i] = mtu - IP6_HDRLEN - hoplen - FRG_HDRLEN; // len[i] is amount of fragmentable part we can include in this frame. } else { // No len[i] = fragbufferlen - c; // len[i] is amount of fragmentable part we can include in this frame. } c += len[i]; // If not last fragment, make sure we have an even number of 8-byte blocks. // Reduce length as necessary. if (c < (fragbufferlen - 1)) { while ((len[i]%8)> 0) { len[i]--; c--; } } printf ("Frag: %i, Data (bytes): %i, Data Offset (8-byte blocks): %i\n", i, len[i], offset[i]); i++; offset[i] = (len[i-1] / 8) + offset[i-1]; } nframes = i; printf ("Total number of frames to send: %i\n", nframes); // IPv6 header // IPv6 version (4 bits), Traffic class (8 bits), Flow label (20 bits) iphdr.ip6_flow = htonl ((6 << 28) | (0 << 20) | 0); // Payload length (16 bits) // iphdr.ip6_plen is set for each fragment in loop below. // Next header (8 bits): 6 for TCP // We'll change this later, otherwise TCP checksum will be wrong. iphdr.ip6_nxt = IPPROTO_TCP; // Hop limit (8 bits): default to maximum value iphdr.ip6_hops = 255; // Source IPv6 address (128 bits) if ((status = inet_pton (AF_INET6, src_ip, &(iphdr.ip6_src))) != 1) { fprintf (stderr, "inet_pton() failed for source address.\nError message: %s", strerror (status)); exit (EXIT_FAILURE); } // Destination IPv6 address (128 bits) if ((status = inet_pton (AF_INET6, dst_ip, &(iphdr.ip6_dst))) != 1) { fprintf (stderr, "inet_pton() failed for destination address.\nError message: %s", strerror (status)); exit (EXIT_FAILURE); } // TCP header // Source port number (16 bits) tcphdr.th_sport = htons (80); // Destination port number (16 bits) tcphdr.th_dport = htons (80); // Sequence number (32 bits) tcphdr.th_seq = htonl (0); // Acknowledgement number (32 bits): 0 in first packet of SYN/ACK process tcphdr.th_ack = htonl (0); // Reserved (4 bits): should be 0 tcphdr.th_x2 = 0; // Data offset (4 bits): size of TCP header in 32-bit words tcphdr.th_off = TCP_HDRLEN / 4; // Flags (8 bits) // FIN flag (1 bit) tcp_flags[0] = 0; // SYN flag (1 bit): set to 1 tcp_flags[1] = 1; // RST flag (1 bit) tcp_flags[2] = 0; // PSH flag (1 bit) tcp_flags[3] = 0; // ACK flag (1 bit) tcp_flags[4] = 0; // URG flag (1 bit) tcp_flags[5] = 0; // ECE flag (1 bit) tcp_flags[6] = 0; // CWR flag (1 bit) tcp_flags[7] = 0; tcphdr.th_flags = 0; for (i=0; i<8; i++) { tcphdr.th_flags += (tcp_flags[i] << i); } // Window size (16 bits) tcphdr.th_win = htons (65535); // Urgent pointer (16 bits): 0 (only valid if URG flag is set) tcphdr.th_urp = htons (0); // TCP checksum (16 bits) tcphdr.th_sum = tcp6_checksum (iphdr, tcphdr, payload, payloadlen); // Authentication extension header authhdr.nxt_hdr = IPPROTO_TCP; authhdr.reserved = htons (0u); authhdr.spi = htonl (51413ul); // Security parameters index (Section 2.4 of RFC 2402): you set this authhdr.seq = htonl (31415ul); // Sequence number (Section 2.5 of RFC 2402): you set this // Build buffer array containing fragmentable portion. // Authentication extension header memcpy (fragbuffer, &authhdr, ATH_HDRLEN * sizeof (uint8_t)); // Authentication header, excluding authentication data memcpy (fragbuffer + ATH_HDRLEN, auth_data, auth_len * sizeof (uint8_t)); // Authentication data // TCP header memcpy (fragbuffer + ATH_HDRLEN + auth_len, &tcphdr, TCP_HDRLEN * sizeof (uint8_t)); // TCP data memcpy (fragbuffer + ATH_HDRLEN + auth_len + TCP_HDRLEN, payload, payloadlen * sizeof (uint8_t)); // IPv6 next header (8 bits) if (hbh_nopt> 0) { iphdr.ip6_nxt = IPPROTO_HOPOPTS; if (nframes == 1) { hophdr.nxt_hdr = IPPROTO_AH; // 51 for authentication extension header } else { hophdr.nxt_hdr = IPPROTO_FRAGMENT; // 44 for Fragmentation extension header } } else { if (nframes == 1) { iphdr.ip6_nxt = IPPROTO_AH; // 51 for authentication extension header } else { iphdr.ip6_nxt = IPPROTO_FRAGMENT; // 44 for Fragmentation extension header } } // Submit request for a raw socket descriptor. if ((sd = socket (PF_PACKET, SOCK_RAW, htons (ETH_P_ALL))) < 0) { perror ("socket() failed "); exit (EXIT_FAILURE); } // Loop through fragments. for (i=0; i 0) { // Copy hop-by-hop extension header (without options) to ethernet frame. memcpy (ether_frame + c, &hophdr, HOP_HDRLEN * sizeof (uint8_t)); c += HOP_HDRLEN; indx += HOP_HDRLEN; // Copy hop-by_hop extension header options to ethernet frame. for (j=0; j 1) { fraghdr.ip6f_nxt = IPPROTO_AH; // Next header is authentication header. fraghdr.ip6f_reserved = 0; // Reserved frag_flags[1] = 0; // Reserved if (i < (nframes - 1)) { frag_flags[0] = 1; // More fragments to follow } else { frag_flags[0] = 0; // This is the last fragment } fraghdr.ip6f_offlg = htons ((offset[i] << 3) + frag_flags[0] + (frag_flags[1] <<1)); fraghdr.ip6f_ident = htonl (31415); memcpy (ether_frame + c, &fraghdr, FRG_HDRLEN * sizeof (uint8_t)); c += FRG_HDRLEN; } // Copy fragmentable portion of packet to ethernet frame. memcpy (ether_frame + c, fragbuffer + (offset[i] * 8), len[i] * sizeof (uint8_t)); c += len[i]; // Ethernet frame length frame_length = c; // Send ethernet frame to socket. printf ("Sending fragment: %i\n", i); if ((bytes = sendto (sd, ether_frame, frame_length, 0, (struct sockaddr *) &device, sizeof (device))) <= 0) { perror ("sendto() failed"); exit (EXIT_FAILURE); } } // Close socket descriptor. close (sd); // Free allocated memory. free (src_mac); free (dst_mac); free (ether_frame); free (interface); free (target); free (src_ip); free (dst_ip); free (tcp_flags); free (payload); free (frag_flags); free (fragbuffer); free (hbh_optlen); for (i=0; i 1) { sum += *(addr++); count -= 2; } // Add left-over byte, if any. if (count> 0) { sum += *(uint8_t *) addr; } // Fold 32-bit sum into 16 bits; we lose information by doing this, // increasing the chances of a collision. // sum = (lower 16 bits) + (upper 16 bits shifted right 16 bits) while (sum>> 16) { sum = (sum & 0xffff) + (sum>> 16); } // Checksum is one's compliment of sum. answer = ~sum; return (answer); } // Build IPv6 TCP pseudo-header and call checksum function (Section 8.1 of RFC 2460). uint16_t tcp6_checksum (struct ip6_hdr iphdr, struct tcphdr tcphdr, uint8_t *payload, int payloadlen) { uint32_t lvalue; char buf[IP_MAXPACKET], cvalue; char *ptr; int chksumlen = 0; int i; memset (buf, 0, IP_MAXPACKET * sizeof (uint8_t)); ptr = &buf[0]; // ptr points to beginning of buffer buf // Copy source IP address into buf (128 bits) memcpy (ptr, &iphdr.ip6_src.s6_addr, sizeof (iphdr.ip6_src.s6_addr)); ptr += sizeof (iphdr.ip6_src.s6_addr); chksumlen += sizeof (iphdr.ip6_src.s6_addr); // Copy destination IP address into buf (128 bits) memcpy (ptr, &iphdr.ip6_dst.s6_addr, sizeof (iphdr.ip6_dst.s6_addr)); ptr += sizeof (iphdr.ip6_dst.s6_addr); chksumlen += sizeof (iphdr.ip6_dst.s6_addr); // Copy TCP length to buf (32 bits) lvalue = htonl (sizeof (tcphdr) + payloadlen); memcpy (ptr, &lvalue, sizeof (lvalue)); ptr += sizeof (lvalue); chksumlen += sizeof (lvalue); // Copy zero field to buf (24 bits) *ptr = 0; ptr++; *ptr = 0; ptr++; *ptr = 0; ptr++; chksumlen += 3; // Copy next header field to buf (8 bits) memcpy (ptr, &iphdr.ip6_nxt, sizeof (iphdr.ip6_nxt)); ptr += sizeof (iphdr.ip6_nxt); chksumlen += sizeof (iphdr.ip6_nxt); // Copy TCP source port to buf (16 bits) memcpy (ptr, &tcphdr.th_sport, sizeof (tcphdr.th_sport)); ptr += sizeof (tcphdr.th_sport); chksumlen += sizeof (tcphdr.th_sport); // Copy TCP destination port to buf (16 bits) memcpy (ptr, &tcphdr.th_dport, sizeof (tcphdr.th_dport)); ptr += sizeof (tcphdr.th_dport); chksumlen += sizeof (tcphdr.th_dport); // Copy sequence number to buf (32 bits) memcpy (ptr, &tcphdr.th_seq, sizeof (tcphdr.th_seq)); ptr += sizeof (tcphdr.th_seq); chksumlen += sizeof (tcphdr.th_seq); // Copy acknowledgement number to buf (32 bits) memcpy (ptr, &tcphdr.th_ack, sizeof (tcphdr.th_ack)); ptr += sizeof (tcphdr.th_ack); chksumlen += sizeof (tcphdr.th_ack); // Copy data offset to buf (4 bits) and // copy reserved bits to buf (4 bits) cvalue = (tcphdr.th_off << 4) + tcphdr.th_x2; memcpy (ptr, &cvalue, sizeof (cvalue)); ptr += sizeof (cvalue); chksumlen += sizeof (cvalue); // Copy TCP flags to buf (8 bits) memcpy (ptr, &tcphdr.th_flags, sizeof (tcphdr.th_flags)); ptr += sizeof (tcphdr.th_flags); chksumlen += sizeof (tcphdr.th_flags); // Copy TCP window size to buf (16 bits) memcpy (ptr, &tcphdr.th_win, sizeof (tcphdr.th_win)); ptr += sizeof (tcphdr.th_win); chksumlen += sizeof (tcphdr.th_win); // Copy TCP checksum to buf (16 bits) // Zero, since we don't know it yet *ptr = 0; ptr++; *ptr = 0; ptr++; chksumlen += 2; // Copy urgent pointer to buf (16 bits) memcpy (ptr, &tcphdr.th_urp, sizeof (tcphdr.th_urp)); ptr += sizeof (tcphdr.th_urp); chksumlen += sizeof (tcphdr.th_urp); // Copy payload to buf memcpy (ptr, payload, payloadlen * sizeof (uint8_t)); ptr += payloadlen; chksumlen += payloadlen; // Pad to the next 16-bit boundary i = 0; while (((payloadlen+i)%2) != 0) { i++; chksumlen++; ptr++; } return checksum ((uint16_t *) buf, chksumlen); } // Provide padding as needed to achieve alignment requirements of hop-by-hop or destination option. int option_pad (int *indx, uint8_t *padding, int *c, int x, int y) { int needpad; // Find number of padding bytes needed to achieve alignment requirements for option (Section 4.2 of RFC 2460). // Alignment is expressed as xN + y, which means the start of the option must occur at xN + y bytes // from the start of the hop-by-hop or destination header, where N is integer 0, 1, 2, ...etc. needpad = 0; while (((*indx + needpad) % x) != y) { needpad++; } // If required padding = 1 byte, we use Pad1 option. if (needpad == 1) { padding[*c] = 0; // Padding option type: Pad1 (*indx)++; (*c)++; // If required padding is> 1 byte, we use PadN option. } else if (needpad> 1) { padding[*c] = 1; // Padding option type: PadN (*indx)++; (*c)++; padding[*c] = needpad - 2; // PadN length: N - 2 (*indx)++; (*c)++; memset (padding + (*c), 0, (needpad - 2) * sizeof (uint8_t)); (*indx) += needpad - 2; (*c) += needpad - 2; } return (EXIT_SUCCESS); } // Allocate memory for an array of chars. char * allocate_strmem (int len) { void *tmp; if (len <= 0) { fprintf (stderr, "ERROR: Cannot allocate memory because len = %i in allocate_strmem().\n", len); exit (EXIT_FAILURE); } tmp = (char *) malloc (len * sizeof (char)); if (tmp != NULL) { memset (tmp, 0, len * sizeof (char)); return (tmp); } else { fprintf (stderr, "ERROR: Cannot allocate memory for array allocate_strmem().\n"); exit (EXIT_FAILURE); } } // Allocate memory for an array of unsigned chars. uint8_t * allocate_ustrmem (int len) { void *tmp; if (len <= 0) { fprintf (stderr, "ERROR: Cannot allocate memory because len = %i in allocate_ustrmem().\n", len); exit (EXIT_FAILURE); } tmp = (uint8_t *) malloc (len * sizeof (uint8_t)); if (tmp != NULL) { memset (tmp, 0, len * sizeof (uint8_t)); return (tmp); } else { fprintf (stderr, "ERROR: Cannot allocate memory for array allocate_ustrmem().\n"); exit (EXIT_FAILURE); } } // Allocate memory for an array of pointers to arrays of unsigned chars. uint8_t ** allocate_ustrmemp (int len) { void *tmp; if (len <= 0) { fprintf (stderr, "ERROR: Cannot allocate memory because len = %i in allocate_ustrmemp().\n", len); exit (EXIT_FAILURE); } tmp = (uint8_t **) malloc (len * sizeof (uint8_t *)); if (tmp != NULL) { memset (tmp, 0, len * sizeof (uint8_t *)); return (tmp); } else { fprintf (stderr, "ERROR: Cannot allocate memory for array allocate_ustrmemp().\n"); exit (EXIT_FAILURE); } } // Allocate memory for an array of ints. int * allocate_intmem (int len) { void *tmp; if (len <= 0) { fprintf (stderr, "ERROR: Cannot allocate memory because len = %i in allocate_intmem().\n", len); exit (EXIT_FAILURE); } tmp = (int *) malloc (len * sizeof (int)); if (tmp != NULL) { memset (tmp, 0, len * sizeof (int)); return (tmp); } else { fprintf (stderr, "ERROR: Cannot allocate memory for array allocate_intmem().\n"); exit (EXIT_FAILURE); } }

AltStyle によって変換されたページ (->オリジナル) /