blob: baedc92c5d9fbb199b2d638b082e217afd9b0cf8 [file] [log] [blame]
/*
* Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*/
#include <stdlib.h>
#include <stdbool.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <getopt.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <pcap/pcap.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
static const char *iface = "lo";
static uint16_t port;
static const char *chain = "SYNPROXY";
static int parse_packet(const char *host, const uint8_t *data)
{
const struct iphdr *iph = (void *)data + 14;
const struct tcphdr *th = (void *)iph + iph->ihl * 4;
int length;
uint8_t *ptr;
if (!th->syn || !th->ack)
return 0;
printf("-A %s -d %s -p tcp --dport %u "
"-m state --state UNTRACKED,INVALID "
"-j SYNPROXY ", chain, host, port);
/* ECE && !CWR */
if (th->res2 == 0x1)
printf("--ecn ");
length = th->doff * 4 - sizeof(*th);
ptr = (uint8_t *)(th + 1);
while (length > 0) {
int opcode = *ptr++;
int opsize;
switch (opcode) {
case TCPOPT_EOL:
return 1;
case TCPOPT_NOP:
length--;
continue;
default:
opsize = *ptr++;
if (opsize < 2)
return 1;
if (opsize > length)
return 1;
switch (opcode) {
case TCPOPT_MAXSEG:
if (opsize == TCPOLEN_MAXSEG)
printf("--mss %u ", ntohs(*(uint16_t *)ptr));
break;
case TCPOPT_WINDOW:
if (opsize == TCPOLEN_WINDOW)
printf("--wscale %u ", *ptr);
break;
case TCPOPT_TIMESTAMP:
if (opsize == TCPOLEN_TIMESTAMP)
printf("--timestamp ");
break;
case TCPOPT_SACK_PERMITTED:
if (opsize == TCPOLEN_SACK_PERMITTED)
printf("--sack-perm ");
break;
}
ptr += opsize - 2;
length -= opsize;
}
}
printf("\n");
return 1;
}
static void probe_host(const char *host)
{
struct sockaddr_in sin;
char pcap_errbuf[PCAP_ERRBUF_SIZE];
struct pcap_pkthdr pkthdr;
const uint8_t *data;
struct bpf_program fp;
pcap_t *ph;
int fd;
ph = pcap_create(iface, pcap_errbuf);
if (ph == NULL) {
perror("pcap_create");
goto err1;
}
if (pcap_setnonblock(ph, 1, pcap_errbuf) == -1) {
perror("pcap_setnonblock");
goto err2;
}
if (pcap_setfilter(ph, &fp) == -1) {
pcap_perror(ph, "pcap_setfilter");
goto err2;
}
if (pcap_activate(ph) != 0) {
pcap_perror(ph, "pcap_activate");
goto err2;
}
if (pcap_compile(ph, &fp, "src host 127.0.0.1 and tcp and src port 80",
1, PCAP_NETMASK_UNKNOWN) == -1) {
pcap_perror(ph, "pcap_compile");
goto err2;
}
fd = socket(AF_INET, SOCK_STREAM, 0);
if (fd < 0) {
perror("socket");
goto err3;
}
memset(&sin, 0, sizeof(sin));
sin.sin_family = AF_INET;
sin.sin_port = htons(port);
sin.sin_addr.s_addr = inet_addr(host);
if (connect(fd, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
perror("connect");
goto err4;
}
for (;;) {
data = pcap_next(ph, &pkthdr);
if (data == NULL)
break;
if (parse_packet(host, data))
break;
}
close(fd);
err4:
close(fd);
err3:
pcap_freecode(&fp);
err2:
pcap_close(ph);
err1:
return;
}
enum {
OPT_HELP = 'h',
OPT_IFACE = 'i',
OPT_PORT = 'p',
OPT_CHAIN = 'c',
};
static const struct option options[] = {
{ .name = "help", .has_arg = false, .val = OPT_HELP },
{ .name = "iface", .has_arg = true, .val = OPT_IFACE },
{ .name = "port" , .has_arg = true, .val = OPT_PORT },
{ .name = "chain", .has_arg = true, .val = OPT_CHAIN },
{ }
};
static void print_help(const char *name)
{
printf("%s [ options ] address...\n"
"\n"
"Options:\n"
" -i/--iface Outbound interface\n"
" -p/--port Port number to probe\n"
" -c/--chain Chain name to use for rules\n"
" -h/--help Show this help\n",
name);
}
int main(int argc, char **argv)
{
int optidx = 0, c;
for (;;) {
c = getopt_long(argc, argv, "hi:p:c:", options, &optidx);
if (c == -1)
break;
switch (c) {
case OPT_IFACE:
iface = optarg;
break;
case OPT_PORT:
port = atoi(optarg);
break;
case OPT_CHAIN:
chain = optarg;
break;
case OPT_HELP:
print_help(argv[0]);
exit(0);
case '?':
print_help(argv[0]);
exit(1);
}
}
argc -= optind;
argv += optind;
while (argc > 0) {
probe_host(*argv);
argc--;
argv++;
}
return 0;
}