ec_inet_linux.c

Ettercap最初设计为交换网上的sniffer

/*
    ettercap -- inet utilities -- Module for LINUX 2.0.x  FULL
                                                   2.2.x  FULL
                                                   2.4.x  FULL

    Copyright (C) 2001  ALoR <[e-mail]>, NaGA <[e-mail]>

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

    $Id: ec_inet_linux.c,v 1.12 2002/05/13 20:22:31 alor Exp $
*/

#include "../../include/ec_main.h"

#include <ctype.h>
#include <sys/ioctl.h>
#include <fcntl.h>

#include "../../include/ec_thread.h"
#include "../../include/ec_inet.h"
#include "../../include/ec_inet_forge.h"
#include "../../include/ec_inet_structures.h"

struct ifreq old_ifr;      // old iface flags
char IpForward_status;     // old ipforward status

static char ETH_BROADCAST[6] = {0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
static char ARP_BROADCAST[6] = {0x0,0x0,0x0,0x0,0x0,0x0};

// protos...

int Inet_FindIFace(char *iface);
int Inet_CorrectIface(char *iface);
int Inet_GetIfaceInfo(char *iface, int *MTU, char *MyMAC, u_long *IP, u_long *NetMask);
int Inet_SetPromisc(char *iface);
int Inet_OpenRawSock(char *iface);
void Inet_CloseRawSock(int sock);
int Inet_GetRawPacket(int sock, char *buffer, int MTU, short *type);
int Inet_SendRawPacket(int sock, char *buffer, int len);
void Inet_SetNonBlock(int sock);
void Inet_Restore_ifr(void);
void Inet_DisableForwarding(void);
void Inet_RestoreForwarding(void);
char *Inet_MacFromIP(unsigned long ip);
#ifdef PERMIT_HTTPS
   void Inet_UnSetARPEntry(void);
   int Inet_SetARPEntry(unsigned long IP, char MAC[6]);
   void Inet_UnsetRoute(void);
   void Inet_SetRoute(void);
#endif


// ----------------------------------------------

int Inet_FindIFace(char *iface)     // adapded from pcap_lookupdev
{
   int fd, minunit, n;
   char *cp;
   struct ifreq *ifrp, *ifend, *ifnext, *mp;
   struct ifconf ifc;
   char *buf;
   struct ifreq ifr;
   unsigned int buf_size;

   fd = socket(AF_INET, SOCK_DGRAM, 0);
   if (fd < 0)
      ERROR_MSG("socket()");

   buf_size = 8192;

   for (;;) {
      buf = malloc (buf_size);
      if (buf == NULL)
         ERROR_MSG("malloc()");

      ifc.ifc_len = buf_size;
      ifc.ifc_buf = buf;
      memset (buf, 0, buf_size);
      if (ioctl(fd, SIOCGIFCONF, (char *)&ifc) < 0 && errno != EINVAL)
         ERROR_MSG("ioctl(SIOCGIFCONF)");

      if (ifc.ifc_len < buf_size)
         break;

      free (buf);
      buf_size *= 2;
   }

   ifrp = (struct ifreq *)buf;
   ifend = (struct ifreq *)(buf + ifc.ifc_len);

   mp = NULL;
   minunit = 666;
   for (; ifrp < ifend; ifrp = ifnext)
   {
      const char *endcp;

#ifdef HAVE_SOCKADDR_SA_LEN
   n = ifrp->ifr_addr.sa_len + sizeof(ifrp->ifr_name);
   if (n < sizeof(*ifrp))
      ifnext = ifrp + 1;
   else
      ifnext = (struct ifreq *)((char *)ifrp + n);
   if (ifrp->ifr_addr.sa_family != AF_INET)
      continue;
#else
   ifnext = ifrp + 1;
#endif

      strncpy(ifr.ifr_name, ifrp->ifr_name, sizeof(ifr.ifr_name));

      if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0)
      {
         if (errno == ENXIO)
            continue;

         ERROR_MSG("ioctl(SIOCGIFFLAGS)");
      }

      DEBUG_MSG("Inet_FindIFace -- check for [%s]", ifr.ifr_name);

      /* Must be up and not the loopback */
      if ((ifr.ifr_flags & IFF_UP) == 0 || (ifr.ifr_flags & IFF_LOOPBACK) != 0)
         continue;

      if ( ioctl(fd, SIOCGIFHWADDR, &ifr) < 0 )
         ERROR_MSG("ioctl(SIOCGIFHWADDR)");

      /* Must be ethernet */
      if ( ifr.ifr_hwaddr.sa_family != ARPHRD_ETHER )
         continue;

      endcp = ifrp->ifr_name + strlen(ifrp->ifr_name);
      for (cp = ifrp->ifr_name; cp < endcp && !isdigit(*cp); ++cp)
         continue;

      if (isdigit (*cp)) {
         n = atoi(cp);
      } else {
         n = 0;
      }
      if (n < minunit) {
         minunit = n;
         mp = ifrp;
      }
   }

   close(fd);

   if (mp == NULL)   // no device found
   {
      free(buf);
      return -1;
   }

   strlcpy(iface, mp->ifr_name, sizeof(Options.netiface));

   free(buf);

   DEBUG_MSG("Inet_FindIFace\t\tIface: %s", iface);

   return 0;

}


int Inet_CorrectIface(char *iface)
{
   int sock;
   struct ifreq ifr;

   DEBUG_MSG("Inet_CorrectIface\t\tIface: %s", iface);

   sock = socket(AF_INET, SOCK_DGRAM, 0);
   if (sock < 0)
      ERROR_MSG("socket()");

   memset(&ifr, 0, sizeof(ifr));
   strncpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name));
   if ( ioctl(sock, SIOCGIFFLAGS, &ifr) < 0)             // check for iface
   {
      close(sock);
      return -1;
   }

   if (!(ifr.ifr_flags & IFF_UP ))                       // check for flag UP
   {
      close(sock);
      return -1;
   }

   if (ifr.ifr_flags & IFF_LOOPBACK )                    // check for loopback
   {
      Options.normal = 1;
      Error_msg("Ettercap can't be run on loopback device");
   }

   if ( ioctl(sock, SIOCGIFADDR, &ifr) < 0 )             // check for alias
   {
      close(sock);
      return -1;
   }

   if ( ioctl(sock, SIOCGIFHWADDR, &ifr) < 0 )
      ERROR_MSG("ioctl(SIOCGIFHWADDR)");

   switch (ifr.ifr_hwaddr.sa_family)
   {
        case ARPHRD_ETHER:    // only ethernet is supported
            break;

        default:
            Error_msg("Device type not supported (only ethernet)");
   }

   close(sock);

   return 0;

}


int Inet_GetIfaceInfo(char *iface, int *MTU, char *MyMAC, unsigned long *IP, unsigned long *NetMask)
{
   int sock;
   struct ifreq ifr;

   sock = Inet_OpenRawSock(iface);

   memset(&ifr, 0, sizeof(ifr));
   strncpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name));

   if (MTU != NULL)
   {
      if ( ioctl(sock, SIOCGIFMTU, &ifr) < 0)
      {
         DEBUG_MSG("Inet_IPBased_Run -- MTU FAILED... assuming 1500");
         *MTU = 1500;
      }
      else
         *MTU = ifr.ifr_mtu;
   }


   if (MyMAC != NULL)
   {
      if ( ioctl(sock, SIOCGIFHWADDR, &ifr) < 0 )
         ERROR_MSG("ioctl(SIOCGIFHWADDR)");
      memcpy(MyMAC, ifr.ifr_hwaddr.sa_data, 6);
   }

   if (IP != NULL)
   {
      if ( ioctl(sock, SIOCGIFADDR, &ifr) < 0 )
         ERROR_MSG("ioctl(SIOCGIFADDR)");
      memcpy((char *)IP, ifr.ifr_addr.sa_data+2, 4);
   }

   if (NetMask != NULL)
   {
      if ( ioctl(sock, SIOCGIFNETMASK, &ifr) < 0 )
         ERROR_MSG("ioctl(SIOCGIFNETMASK)");
      memcpy((char *)NetMask, ifr.ifr_addr.sa_data+2, 4);
      if (strcmp(Options.netmask, ""))       // specified on command line
         *NetMask = inet_addr(Options.netmask);
   }

   Inet_CloseRawSock(sock);

   return 0;

}


void Inet_SetNonBlock(int sock)
{
   DEBUG_MSG("Inet_SetNonBlock fd = %d", sock);

   fcntl(sock, F_SETFL, O_NONBLOCK);

}


void Inet_CloseRawSock(int sock)
{

   DEBUG_MSG("Inet_CloseRawSock \t fd = %d", sock);

   close(sock);

}



int Inet_OpenRawSock(char *iface)
{
   int sock;
#if defined (HAVE_PF_PACKET) && defined (NETPACKET_PACKET_H)
   struct ifreq ifr;
   struct sockaddr_ll sll;
#else
   struct sockaddr sa;
#endif

#if defined (HAVE_PF_PACKET) && defined (NETPACKET_PACKET_H)
   sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
#else
   sock = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL));
#endif
   if (sock < 0)
      ERROR_MSG("socket()");

   DEBUG_MSG("Inet_OpenRawSock %s \t fd = %d", iface, sock);

#if defined (HAVE_PF_PACKET) && defined (NETPACKET_PACKET_H)

   memset(&ifr, 0, sizeof(ifr));
   strncpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name));

   if ( ioctl(sock, SIOCGIFINDEX, &ifr) < 0)
      ERROR_MSG("ioctl(SIOCGIFINDEX)");

   memset(&sll, 0, sizeof(sll));
   sll.sll_family = AF_PACKET;
   sll.sll_ifindex = ifr.ifr_ifindex;
   sll.sll_protocol = htons(ETH_P_ALL);

   if ( bind(sock, (struct sockaddr *) &sll, sizeof(sll)) == -1)
      ERROR_MSG("bind()");
#else

   memset(&sa, 0, sizeof(sa));
   strncpy(sa.sa_data, iface, sizeof(sa.sa_data));
   if ( bind(sock, &sa, sizeof(sa)) == -1)
      ERROR_MSG("bind()");

#endif

   return sock;
}



int Inet_GetRawPacket(int sock, char *buffer, int MTU, short *type)
{
   int len = 0;
   socklen_t fromlen;
   struct sockaddr from;
   static char MyMAC[6]={0x65,0x74,0x74,0x65,0x72,0x63};

   fromlen = sizeof(from);
   len = recvfrom(sock, buffer, MTU+64, MSG_TRUNC, (struct sockaddr *)&from, &fromlen);

   if (len > MTU + ETH_HEADER) len = MTU + ETH_HEADER;   // workaround for bugged kernel (2.2.14)
                                                         // this kernel passes us the MTU + ETH_HEADER + FCS
                                                         // for a total of 1518 byte !!!

   // the address returned for SOCK_PACKET lacks the packet type information.
   if (type != NULL)
   {
       if (!strncmp(MyMAC,"etterc",6))    // only the first time...
           Inet_GetIfaceInfo(Options.netiface, NULL, MyMAC, NULL, NULL);
       if (!memcmp(MyMAC,buffer,6))
           *type = 0; // PACKET_HOST
       else
           *type = 1; // !PACKET_HOST
   }

   // TODO
   // handle fragmented packets...

   return len;
}



int Inet_SendRawPacket(int sock, char *buffer, int len)
{
   int sent;
   static char first_time = 1;
#if defined (HAVE_PF_PACKET) && defined (NETPACKET_PACKET_H)