OpenVAS Libraries  9.0.3
ids_send.c
Go to the documentation of this file.
1 /* OpenVAS
2  * $Id$
3  * Description: IDS stressing functions.
4  *
5  * ids_send() sends data spliced into several packets, with bad packets
6  * between them, thus making bad NIDSes reassemble the tcp stream awkwardly;
7  *
8  * ids_open_sock_tcp() opens a tcp socket and immediately sends a badly
9  * formed RST packet to the remote host, thus making bad NIDSes think
10  * the connection was immediately dropped on our end.
11  *
12  * Authors:
13  * Renaud Deraison <deraison@nessus.org> (Original pre-fork development)
14  *
15  * Copyright:
16  * Based on work Copyright (C) 1998 - 2002 Renaud Deraison
17  *
18  * This library is free software; you can redistribute it and/or
19  * modify it under the terms of the GNU Library General Public
20  * License as published by the Free Software Foundation; either
21  * version 2 of the License, or (at your option) any later version.
22  *
23  * This library is distributed in the hope that it will be useful,
24  * but WITHOUT ANY WARRANTY; without even the implied warranty of
25  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
26  * Library General Public License for more details.
27  *
28  * You should have received a copy of the GNU General Public License
29  * along with this program; if not, write to the Free Software
30  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
31  */
32 
33 #include <stdarg.h>
34 #include <string.h>
35 #include <stdio.h>
36 #include <unistd.h>
37 #include <stdlib.h>
38 #include <arpa/inet.h>
39 
40 #include "arglists.h"
41 #include "bpf_share.h"
42 #include "ids_send.h"
43 #include "network.h"
44 #include "pcap_openvas.h"
45 #include "plugutils.h"
46 #include "openvas_logging.h"
47 #include "support.h"
48 
51 #ifdef BSD_BYTE_ORDERING
52 # define FIX(n) (n)
53 # define UNFIX(n) (n)
54 #else
55 # define FIX(n) htons(n)
56 # define UNFIX(n) ntohs(n)
57 #endif
58 
59 /*
60  * We define our own packet structs (they'll be defined in libnasl later
61  * on, and I feel lazy today)
62  */
63 struct ip_packet
64 {
65 #if !WORDS_BIGENDIAN
66  u_char ip_hl:4, /* header length */
67  ip_v:4; /* version */
68 #else
69  u_char ip_v:4, /* version */
70  ip_hl:4; /* header length */
71 #endif
72  u_char ip_tos; /* type of service */
73  u_short ip_len; /* total length */
74  u_short ip_id; /* identification */
75  u_short ip_off; /* fragment offset field */
76  u_char ip_ttl; /* time to live */
77  u_char ip_p; /* protocol */
78  u_short ip_sum; /* checksum */
79  struct in_addr ip_src, ip_dst; /* source and dest address */
80 };
81 
82 struct tcp_packet
83 {
84  u_short th_sport; /* source port */
85  u_short th_dport; /* destination port */
86  u_long th_seq; /* sequence number */
87  u_long th_ack; /* acknowledgement number */
88 #if !WORDS_BIGENDIAN
89  u_int th_x2:4, /* (unused) */
90  th_off:4; /* data offset */
91 #endif
92 #if WORDS_BIGENDIAN
93  u_int th_off:4, /* data offset */
94  th_x2:4; /* (unused) */
95 #endif
96  u_char th_flags;
97 
98  u_short th_win; /* window */
99  u_short th_sum; /* checksum */
100  u_short th_urp; /* urgent pointer */
101 };
102 
103 
105 {
106  union
107  {
108  struct ip6_hdrctl
109  {
110  uint32_t ip6_un1_flow; /* 24 bits of flow-ID */
111  uint16_t ip6_un1_plen; /* payload length */
112  uint8_t ip6_un1_nxt; /* next header */
113  uint8_t ip6_un1_hlim; /* hop limit */
114  } ip6_un1;
115  uint8_t ip6_un2_vfc; /* 4 bits version, 4 bits priority */
116  } ip6_ctlun;
117  struct in6_addr ip6_src; /* source address */
118  struct in6_addr ip6_dst; /* destination address */
119 };
120 
121 
122 /*
123  * our own definition of the tcp flags
124  */
125 #define TCP_FLAG_RST 0x0004
126 #define TCP_FLAG_ACK 0x0010
127 #define TCP_FLAG_PUSH 0x0008
128 
129 
130 struct pseudohdr
131 {
132  struct in_addr saddr;
133  struct in_addr daddr;
134  u_char zero;
135  u_char protocol;
136  u_short length;
138 };
139 
140 union sockaddr_u {
141  struct sockaddr_in in;
142  struct sockaddr_in6 in6;
144 };
145 
146 /*
147  * This function returns the TTL we should use when forging our own
148  * IP packets. If <method & OPENVAS_CNX_IDS_EVASION_SHORT_TTL>, then
149  * it returns an estimation of the number of hops between us and the
150  * remote host (see comment), minus 1.
151  *
152  * By default, it returns the TTL our OS usually returns (to be improved)
153  *
154  */
155 static int
156 which_ttl (method, old_ttl)
157  int method, old_ttl;
158 {
159  int ttl;
160 
162  {
163  /*
164  * XXXX
165  * To find out the number of hops to the remote host,
166  * we assume that the TTL set remotely is one of {32,64,128,255}.
167  * (by default, I know of no OS which uses a different value)
168  *
169  * We could fine grain that by reading Host/OS or even by
170  * computing the traceroute by ourselves (especially since we're
171  * not sure that our packets will go through the same path as those
172  * we receive) however this will do for now.
173  */
174  int num_hops = old_ttl;
175  if (num_hops < 32)
176  {
177  ttl = 32 - num_hops;
178  }
179  else if (num_hops < 64)
180  {
181  ttl = 64 - num_hops;
182  }
183  else if (num_hops < 128)
184  {
185  ttl = 128 - num_hops;
186  }
187  else
188  ttl = 255 - num_hops;
189  }
190  /*
191  * We try to set up a 'normal' TTL
192  */
193  else /* if(method & OPENVAS_CNX_IDS_EVASION_INJECT) */
194  {
195 #ifdef LINUX
196  int f;
197  f = open ("/proc/sys/net/ipv4/ip_default_ttl", O_RDONLY);
198  if (f >= 0)
199  {
200  char rd[20];
201 
202  /* RATS issues the following warning for this line:
203  * "Check buffer boundaries if calling this function in a loop and make sure
204  * you are not in danger of writing past the allocated space."
205  * This warning can IMHO be ignored as long as the buffer size of rd is
206  * hardcoded since we will read at most sizeof(rd)-1 bytes into rd.
207  * -mwiegand, 20090205
208  */
209  read (f, rd, sizeof (rd) - 1);
210  close (f);
211  ttl = atoi (rd);
212  }
213  else
214  {
215  ttl = 64;
216  }
217 #else
218  /*
219  * TODO :
220  * XXX sysctl support (BSD)
221  * XXX Solaris support...
222  */
223  ttl = 64;
224 #endif
225  }
226 
227  return ttl;
228 }
229 
230 
231 static int
232 in_cksum (p, n)
233  u_short *p;
234  int n;
235 {
236  register u_short answer;
237  register long sum = 0;
238  u_short odd_byte = 0;
239 
240  while (n > 1)
241  {
242  sum += *p++;
243  n -= 2;
244  }
245 
246  /* mop up an odd byte, if necessary */
247  if (n == 1)
248  {
249  *(u_char *) (&odd_byte) = *(u_char *) p;
250  sum += odd_byte;
251  }
252 
253  sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
254  sum += (sum >> 16); /* add carry */
255  answer = (int) ~sum; /* ones-complement, truncate */
256  return (answer);
257 }
258 
259 
260 static int
261 tcp_cksum (packet, len)
262  char *packet;
263  int len;
264 {
265  struct pseudohdr pseudoheader;
266  char *tcpsumdata = g_malloc0 (sizeof (struct pseudohdr) + len + 1);
267  struct in_addr source, dest;
268  struct ip_packet *ip = (struct ip_packet *) packet;
269  struct tcp_packet *tcp = (struct tcp_packet *) (packet + ip->ip_hl * 4);
270  char *data = (char *) (packet + ip->ip_hl * 4 + tcp->th_off * 4);
271 
272  source.s_addr = ip->ip_src.s_addr;
273  dest.s_addr = ip->ip_dst.s_addr;
274 
275  bzero (&pseudoheader, 12 + sizeof (struct tcp_packet));
276  pseudoheader.saddr.s_addr = source.s_addr;
277  pseudoheader.daddr.s_addr = dest.s_addr;
278 
279  pseudoheader.protocol = IPPROTO_TCP;
280  pseudoheader.length = htons (sizeof (struct tcp_packet) + len);
281  bcopy ((char *) tcp, (char *) &pseudoheader.tcpheader,
282  sizeof (struct tcp_packet));
283  /* fill tcpsumdata with data to checksum */
284  bcopy ((char *) &pseudoheader, tcpsumdata, sizeof (struct pseudohdr));
285  bcopy ((char *) data, tcpsumdata + sizeof (struct pseudohdr), len);
286  tcp->th_sum =
287  in_cksum ((unsigned short *) tcpsumdata,
288  12 + sizeof (struct tcp_packet) + len);
289  g_free (tcpsumdata);
290  return 0;
291 }
292 
293 
294 /*
295  * This function injects a tcp packet in a stream. If
296  * method & OPENVAS_CNX_IDS_EVASION_SHORT_TTL != 0, then
297  * the injected tcp packet will be completely valid but will
298  * have a short TTL (so that it does not reach the remote host).
299  *
300  * If method & OPENVAS_CNX_IDS_EVASION_INJECT != 0, then
301  * the injected tcp packet will have a normal TTL but will
302  * have a bad checksum.
303  *
304  * <orig_packet> is the capture of the last packet sent by the
305  * remote host (hopefully a ACK). We use it to obtain the th_seq
306  * and th_ack elements that are being waited for by the remote
307  * host.
308  *
309  * <packet_len> is the size of the captured packet
310  *
311  *
312  * We also use the ttl of the packet to determine the number
313  * of hops between us and the remote host (see the function
314  * which_ttl()).
315  *
316  * <flags> are the flags of the tcp packet we should send (RST, ...)
317  *
318  * <data> is the data we should append to our tcp packet. This can
319  * be NULL
320  * <data_len> is the length of the data.
321  *
322  *
323  * Note that this function opens a raw socket each time it's called, which
324  * is highly inefficient.
325  */
326 static int
327 inject (orig_packet, packet_len, method, flags, data, data_len)
328  char *orig_packet;
329  unsigned int packet_len;
330  int method;
331  int flags;
332  char *data;
333  int data_len;
334 {
335  int soc;
336  char *packet;
337  struct ip_packet *ip, *old_ip;
338  struct tcp_packet *tcp, *old_tcp;
339  int tot_len =
340  sizeof (struct ip_packet) + sizeof (struct tcp_packet) + data_len;
341  int i;
342  int one = 1;
343  struct sockaddr_in sockaddr;
344 
345  if (packet_len < sizeof (struct ip_packet) + sizeof (struct tcp_packet))
346  return -1;
347 
348 
349 
350  old_ip = (struct ip_packet *) orig_packet;
351 
352  if ((old_ip->ip_hl * 4) + sizeof (struct tcp_packet) > packet_len)
353  return -1;
354 
355  old_tcp = (struct tcp_packet *) (orig_packet + (old_ip->ip_hl * 4));
356 
357 
358  soc = socket (AF_INET, SOCK_RAW, IPPROTO_RAW);
359  if (soc < 0)
360  return -1;
361 
362  setsockopt (soc, IPPROTO_IP, IP_HDRINCL, &one, sizeof (one));
363  packet = g_malloc0 (tot_len);
364 
365  /*
366  * Copy data, if any
367  */
368  for (i = 0; i < data_len; i++)
369  packet[i + sizeof (struct ip_packet)] = data[i];
370 
371  ip = (struct ip_packet *) packet;
372  tcp = (struct tcp_packet *) (packet + sizeof (struct ip_packet));
373 
374  /*
375  * for the sake of code shortness, we copy the header of the
376  * received packet into the packet we forge, and we'll change
377  * some stuff in it.
378  */
379  memcpy (ip, old_ip, sizeof (struct ip_packet));
380 
381  ip->ip_len = FIX (tot_len);
382  ip->ip_hl = 5;
383  ip->ip_off = 0;
384  ip->ip_src.s_addr = old_ip->ip_dst.s_addr;
385  ip->ip_dst.s_addr = old_ip->ip_src.s_addr;
386  ip->ip_id = rand ();
387  ip->ip_ttl = which_ttl (method, old_ip->ip_ttl);
388  ip->ip_sum = in_cksum ((u_short *) packet, sizeof (struct ip_packet));
389 
390  memcpy (tcp, old_tcp, sizeof (struct tcp_packet));
391  tcp->th_flags = flags;
392  if ((flags & TCP_FLAG_RST) && (method & OPENVAS_CNX_IDS_EVASION_FAKE_RST))
393  tcp->th_ack = htonl (ntohl (old_tcp->th_seq) + 1);
394  else
395  tcp->th_ack = old_tcp->th_seq;
396 
397  tcp->th_seq = old_tcp->th_ack;
398  tcp->th_sport = old_tcp->th_dport;
399  tcp->th_dport = old_tcp->th_sport;
400  tcp->th_off = 5;
401  tcp->th_sum = 0;
403  tcp_cksum (packet, data_len);
404  else
405  tcp->th_sum = rand (); /* bad checksum - packet will be dropped */
406 
407 
408  /*
409  * Sending the packet now
410  */
411  bzero (&sockaddr, sizeof (sockaddr));
412  sockaddr.sin_family = AF_INET;
413  sockaddr.sin_addr.s_addr = ip->ip_dst.s_addr;
414 
415 
416  if (sendto
417  (soc, packet, tot_len, 0, (struct sockaddr *) &sockaddr,
418  sizeof (sockaddr)) < 0)
419  {
420  perror
421  ("openvas-libraries : libopenvas : ids_send.c : inject() : sendto() ");
422  }
423  g_free (packet);
424  close (soc);
425  return 0;
426 }
427 
428 
429 static int
430 injectv6 (orig_packet, packet_len, method, flags, data, data_len)
431  char *orig_packet;
432  unsigned int packet_len;
433  int method;
434  int flags;
435  char *data;
436  int data_len;
437 {
438  int soc;
439  char *packet;
440  struct ipv6_header *ip6, *old_ip6;
441  struct tcp_packet *tcp, *old_tcp;
442  int tot_len =
443  sizeof (struct ipv6_header) + sizeof (struct tcp_packet) + data_len;
444  int i;
445  struct sockaddr_in6 sockaddr6;
446 
447  if (packet_len < sizeof (struct ipv6_header) + sizeof (struct tcp_packet))
448  return -1;
449 
450  old_ip6 = (struct ipv6_header *) orig_packet;
451  old_tcp = (struct tcp_packet *) (orig_packet + 40);
452 
453  soc = socket (AF_INET6, SOCK_RAW, IPPROTO_RAW);
454  if (soc < 0)
455  return -1;
456 
457  packet = g_malloc0 (tot_len);
458 
459  /*
460  * Copy data, if any
461  */
462  for (i = 0; i < data_len; i++)
463  {
464  packet[i + sizeof (struct ipv6_header)] = data[i];
465  }
466 
467  ip6 = (struct ipv6_header *) packet;
468  tcp = (struct tcp_packet *) (packet + sizeof (struct ipv6_header));
469 
470  /*
471  * for the sake of code shortness, we copy the header of the
472  * received packet into the packet we forge, and we'll change
473  * some stuff in it.
474  */
475  memcpy (ip6, old_ip6, sizeof (struct ipv6_header));
476 
477  ip6->ip6_ctlun.ip6_un1.ip6_un1_flow = old_ip6->ip6_ctlun.ip6_un1.ip6_un1_flow;
478  ip6->ip6_ctlun.ip6_un1.ip6_un1_plen = data_len;
479  ip6->ip6_ctlun.ip6_un1.ip6_un1_nxt = old_ip6->ip6_ctlun.ip6_un1.ip6_un1_nxt;
480  ip6->ip6_ctlun.ip6_un1.ip6_un1_hlim =
481  which_ttl (method, old_ip6->ip6_ctlun.ip6_un1.ip6_un1_hlim);
482  memcpy (&ip6->ip6_src, &old_ip6->ip6_dst, sizeof (struct in6_addr));
483  memcpy (&ip6->ip6_dst, &old_ip6->ip6_src, sizeof (struct in6_addr));
484 
485  memcpy (tcp, old_tcp, sizeof (struct tcp_packet));
486  tcp->th_flags = flags;
487  if ((flags & TCP_FLAG_RST) && (method & OPENVAS_CNX_IDS_EVASION_FAKE_RST))
488  tcp->th_ack = htonl (ntohl (old_tcp->th_seq) + 1);
489  else
490  tcp->th_ack = old_tcp->th_seq;
491 
492  tcp->th_seq = old_tcp->th_ack;
493  tcp->th_sport = old_tcp->th_dport;
494  tcp->th_dport = old_tcp->th_sport;
495  tcp->th_off = 5;
496  tcp->th_sum = 0;
498  tcp_cksum (packet, data_len);
499  else
500  tcp->th_sum = rand (); /* bad checksum - packet will be dropped */
501 
502 
503  /*
504  * Sending the packet now
505  */
506  bzero (&sockaddr6, sizeof (sockaddr6));
507  sockaddr6.sin6_family = AF_INET6;
508  sockaddr6.sin6_addr = ip6->ip6_dst;
509 
510  if (sendto
511  (soc, packet, tot_len, 0, (struct sockaddr *) &sockaddr6,
512  sizeof (sockaddr6)) < 0)
513  {
514  perror
515  ("openvas-libraries : libopenvas : ids_send.c : inject() : sendto() ");
516  }
517  g_free (packet);
518  close (soc);
519  return 0;
520 }
521 
522 
523 int
524 ids_send (fd, buf0, n, method)
525  int fd;
526  void *buf0;
527  int n;
528  int method;
529 {
530  struct in_addr dst, src;
531  struct in6_addr dst6, src6;
532  struct sockaddr_in6 sockaddr6;
533  struct sockaddr_in *saddr;
534  struct sockaddr *sa;
535  union sockaddr_u *su = NULL;
536  char *iface;
537  char filter[255];
538  char *src_host, *dst_host;
539  int port;
540  int ret = 0;
541  int len;
542  char *buf = (char *) buf0;
543  unsigned int sz = sizeof (sockaddr6);
544  int e;
545  unsigned char *packet;
546  int bpf;
547  char hostname[INET6_ADDRSTRLEN];
548  int family;
549 
550  if (getpeername (fd, &(su->sockaddr), &sz) < 0)
551  {
552  perror ("getpeername() ");
553  return -1;
554  }
555  sa = &(su->sockaddr);
556  if (sa->sa_family == AF_INET)
557  {
558  family = AF_INET;
559  saddr = &(su->in);
560  port = ntohs (saddr->sin_port);
561  dst.s_addr = saddr->sin_addr.s_addr;
562  src.s_addr = 0;
563  iface = routethrough (&dst, &src);
564 
565  src_host = g_strdup (inet_ntoa (src));
566  dst_host = g_strdup (inet_ntoa (dst));
567 
568  snprintf (filter, sizeof (filter),
569  "tcp and (src host %s and dst host %s and src port %d)",
570  dst_host, src_host, port);
571  g_free (src_host);
572  g_free (dst_host);
573  }
574  else
575  {
576  sockaddr6 = su->in6;
577  family = AF_INET6;
578  port = ntohs (sockaddr6.sin6_port);
579  memcpy (&dst6, &sockaddr6.sin6_addr, sizeof (struct in6_addr));
580  bzero (&src6, sizeof (src6));
581  iface = v6_routethrough (&dst6, &src6);
582 
583  src_host =
584  g_strdup (inet_ntop (AF_INET6, &src6, hostname, sizeof (hostname)));
585  dst_host =
586  g_strdup (inet_ntop (AF_INET6, &dst6, hostname, sizeof (hostname)));
587  snprintf (filter, sizeof (filter),
588  "tcp and (src host %s and dst host %s and src port %d)",
589  dst_host, src_host, port);
590  g_free (src_host);
591  g_free (dst_host);
592  }
593 
594  bpf = bpf_open_live (iface, filter);
595  if (bpf >= 0)
596  {
597  e = send (fd, buf + ret, 1, 0);
598  packet = bpf_next (bpf, &len);
599  if (e < 0)
600  return -1;
601  else
602  ret += e;
603  /*
604  * We can start to send stuff now
605  */
606  while (ret < n)
607  {
608  if (packet)
609  {
610  char *pkt_ip;
611  int num_before = (rand () / 1000) % 3;
612  int num_after = (rand () / 1000) % 3;
613  int i;
614 
615  if (!num_before && !num_after)
616  {
617  if (rand () % 2)
618  num_before = 1;
619  else
620  num_after = 1;
621  }
622  pkt_ip =
623  (char *) (packet + get_datalink_size (bpf_datalink (bpf)));
624 
625  /*
626  * send bogus data before
627  */
628  for (i = 0; i < num_before; i++)
629  {
630  int j;
631  char data[10];
632  for (j = 0; j < 10; j++)
633  data[j] = rand ();
634  if (family == AF_INET)
635  inject (pkt_ip,
636  len - get_datalink_size (bpf_datalink (bpf)),
637  method, TCP_FLAG_ACK | TCP_FLAG_PUSH, data,
638  (rand () % 9) + 1);
639  else
640  injectv6 (pkt_ip,
641  len - get_datalink_size (bpf_datalink (bpf)),
642  method, TCP_FLAG_ACK | TCP_FLAG_PUSH, data,
643  (rand () % 9) + 1);
644 
645  }
646  e = send (fd, buf + ret, 1, 0);
647  packet = bpf_next (bpf, &len);
648  /*
649  * send bogus data after
650  */
651  for (i = 0; i < num_after; i++)
652  {
653  int j;
654  char data[10];
655  for (j = 0; j < 10; j++)
656  data[j] = rand ();
657  if (family == AF_INET)
658  inject (pkt_ip,
659  len - get_datalink_size (bpf_datalink (bpf)),
660  method, TCP_FLAG_ACK | TCP_FLAG_PUSH, data,
661  (rand () % 9) + 1);
662  else
663  injectv6 (pkt_ip,
664  len - get_datalink_size (bpf_datalink (bpf)),
665  method, TCP_FLAG_ACK | TCP_FLAG_PUSH, data,
666  (rand () % 9) + 1);
667  }
668  }
669  else
670  {
671  e = send (fd, buf + ret, 1, 0);
672  packet = bpf_next (bpf, &len);
673  }
674  if (e < 0)
675  return -1;
676  else
677  ret += e;
678  }
679  bpf_close (bpf);
680  return ret;
681  }
682  else
683  return send (fd, buf, n, 0);
684 }
685 
686 
687 int
688 ids_open_sock_tcp (args, port, method, timeout)
689  struct arglist *args;
690  int port;
691  int method;
692  int timeout;
693 {
694  int bpf;
695  struct in_addr dst, src;
696  struct in6_addr *dst6 = NULL, src6;
697  char *iface;
698  char filter[255];
699  char *src_host, *dst_host;
700  int ret = 0;
701  int len;
702  char hostname[INET6_ADDRSTRLEN];
703  int family;
704 
705  dst6 = plug_get_host_ip (args);
706  if (!dst6)
707  {
708  log_legacy_write ("Error - no address associated with name\n");
709  return -1;
710  }
711  if (IN6_IS_ADDR_V4MAPPED (dst6))
712  {
713  family = AF_INET;
714  dst.s_addr = dst6->s6_addr32[3];
715  src.s_addr = 0;
716  iface = routethrough (&dst, &src);
717  src_host = g_strdup (inet_ntoa (src));
718  dst_host = g_strdup (inet_ntoa (dst));
719  }
720  else
721  {
722  family = AF_INET6;
723  iface = v6_routethrough (dst6, &src6);
724  src_host =
725  g_strdup (inet_ntop (AF_INET6, &src6, hostname, sizeof (hostname)));
726  dst_host =
727  g_strdup (inet_ntop (AF_INET6, dst6, hostname, sizeof (hostname)));
728  }
729 
730  snprintf (filter, sizeof (filter),
731  "tcp and (src host %s and dst host %s and src port %d)", dst_host,
732  src_host, port);
733 
734  g_free (src_host);
735  g_free (dst_host);
736 
737 
738  bpf = bpf_open_live (iface, filter);
739  if (bpf >= 0)
740  {
741  ret = open_sock_tcp (args, port, timeout);
742  if (ret >= 0)
743  {
744  unsigned char *packet = bpf_next (bpf, &len);
745  if (packet)
746  {
747  char *pkt_ip;
748  pkt_ip =
749  (char *) (packet + get_datalink_size (bpf_datalink (bpf)));
750 
751  if (family == AF_INET)
752  inject (pkt_ip, len - get_datalink_size (bpf_datalink (bpf)),
753  method, TCP_FLAG_RST, NULL, 0);
754  else
755  injectv6 (pkt_ip, len - get_datalink_size (bpf_datalink (bpf)),
756  method, TCP_FLAG_RST, NULL, 0);
757  }
758  }
759  bpf_close (bpf);
760  return ret;
761  }
762  else
763  return open_sock_tcp (args, port, timeout);
764 }
#define TCP_FLAG_RST
Definition: ids_send.c:125
u_short th_sum
Definition: ids_send.c:99
u_short ip_id
Definition: ids_send.c:74
u_char ip_v
Definition: ids_send.c:66
char * v6_routethrough(struct in6_addr *dest, struct in6_addr *source)
An awesome function to determine what interface a packet to a given destination should be routed thro...
Definition: pcap.c:1061
u_char ip_tos
Definition: ids_send.c:72
u_int th_x2
Definition: ids_send.c:89
u_char th_flags
Definition: ids_send.c:96
struct sockaddr_in6 in6
Definition: ids_send.c:142
struct in_addr saddr
Definition: ids_send.c:132
struct in6_addr ip6_dst
Definition: ids_send.c:118
uint8_t ip6_un1_hlim
Definition: ids_send.c:113
#define OPENVAS_CNX_IDS_EVASION_SHORT_TTL
Definition: ids_send.h:47
int ids_open_sock_tcp(struct arglist *args, int port, int method, int timeout)
Definition: ids_send.c:688
struct tcp_packet tcpheader
Definition: ids_send.c:137
void log_legacy_write(const char *format,...)
Legacy function to write a log message.
u_short th_dport
Definition: ids_send.c:85
void bpf_close(int bpf)
Definition: bpf_share.c:153
struct in_addr daddr
Definition: ids_send.c:133
int get_datalink_size(int datalink)
Definition: pcap.c:442
#define TCP_FLAG_PUSH
Definition: ids_send.c:127
u_short length
Definition: ids_send.c:136
int bpf_datalink(int bpf)
Definition: bpf_share.c:146
u_char zero
Definition: ids_send.c:134
int open_sock_tcp(struct arglist *args, unsigned int port, int timeout)
Definition: network.c:1918
struct sockaddr_in in
Definition: ids_send.c:141
struct in_addr ip_src ip_dst
Definition: ids_send.c:79
u_short ip_len
Definition: ids_send.c:73
u_char protocol
Definition: ids_send.c:135
int ids_send(int fd, void *buf0, int n, int method)
Definition: ids_send.c:524
int bpf_open_live(char *iface, char *filter)
Definition: bpf_share.c:40
uint8_t ip6_un2_vfc
Definition: ids_send.c:115
u_int th_off
Definition: ids_send.c:89
struct in6_addr * plug_get_host_ip(struct arglist *desc)
Definition: plugutils.c:216
#define FIX(n)
Definition: ids_send.c:55
uint8_t ip6_un1_nxt
Definition: ids_send.c:112
struct ipv6_header::@4::ip6_hdrctl ip6_un1
u_short th_urp
Definition: ids_send.c:100
struct sockaddr sockaddr
Definition: ids_send.c:143
#define TCP_FLAG_ACK
Definition: ids_send.c:126
u_long th_ack
Definition: ids_send.c:87
union ipv6_header::@4 ip6_ctlun
u_short ip_off
Definition: ids_send.c:75
char * routethrough(struct in_addr *dest, struct in_addr *source)
An awesome function to determine what interface a packet to a given destination should be routed thro...
Definition: pcap.c:1244
u_long th_seq
Definition: ids_send.c:86
#define OPENVAS_CNX_IDS_EVASION_FAKE_RST
Definition: ids_send.h:48
u_char * bpf_next(int bpf, int *caplen)
Definition: bpf_share.c:137
u_char ip_ttl
Definition: ids_send.c:76
uint16_t ip6_un1_plen
Definition: ids_send.c:111
u_short ip_sum
Definition: ids_send.c:78
u_short th_win
Definition: ids_send.c:98
u_char ip_p
Definition: ids_send.c:77
uint32_t ip6_un1_flow
Definition: ids_send.c:110
u_short th_sport
Definition: ids_send.c:84
struct in6_addr ip6_src
Definition: ids_send.c:117
u_char ip_hl
Definition: ids_send.c:66