1313#include "tcphalfopen.h"
1414#include "net.h"
1515#include "common.h"
16+ #include "threads.h"
1617
1718struct in_addr g_dest_ip ;
1819static int g_spoofing = 0 ;
@@ -34,11 +35,52 @@ static void get_random_ip(char* ip, size_t n)
3435 sprintf (ip , "%d.%d.%d.%d" , a , b , c , d );
3536}
3637
37- int half_open ( const char * ip , port_t port )
38+ void * wait_for_syn_ack ( void * data )
3839{
39- int s ;
40- socklen_t sl ;
40+ struct thread_retval * rv = (struct thread_retval * ) data ;
4141 ssize_t data_size ;
42+ int sniff_socket ;
43+ socklen_t sl ;
44+ struct sockaddr saddr ;
45+ uint8_t * recvbuff ;
46+
47+ recvbuff = (uint8_t * ) malloc (USHRT_MAX );
48+
49+ // Open this socket
50+ if ( (sniff_socket = socket (AF_INET , SOCK_RAW , IPPROTO_TCP ) ) < 0 )
51+ {
52+ perror ("socket() failed" );
53+ free (recvbuff );
54+ return NULL ;
55+ }
56+
57+ // Receive from buffer, await until done
58+ while (1 )
59+ {
60+ if ( (data_size = recvfrom (sniff_socket , recvbuff , USHRT_MAX , 0 , & saddr , & sl )) < 0 )
61+ {
62+ perror ("recvfrom() error" );
63+ free (recvbuff );
64+ close (sniff_socket );
65+ return NULL ;
66+ }
67+
68+ rv -> port_status = process_packet (recvbuff , data_size );
69+ //Now process the packet
70+ if ( rv -> port_status == PHSCAN_PORT_OPEN || rv -> port_status == PHSCAN_PORT_CLOSED )
71+ {
72+ free (recvbuff );
73+ close (sniff_socket );
74+ pthread_exit ( (void * )rv );
75+ }
76+ }
77+ free (recvbuff );
78+ close (sniff_socket );
79+ return (void * )rv ;
80+ }
81+ int half_open (const char * ip , port_t port )
82+ {
83+ int s , ret ;
4284 //Datagram to represent the packet
4385 char datagram [4096 ];
4486 //IP header
@@ -48,12 +90,8 @@ int half_open(const char* ip, port_t port)
4890 struct pseudo_header psh ;
4991
5092 struct sockaddr_in dest ;
51- struct sockaddr saddr ;
52-
5393 char source_ip [16 ];
5494
55- unsigned char * buffer = (unsigned char * )malloc (65536 ); //Its Big!
56-
5795 //Create a raw socket
5896 if ( (s = socket (AF_INET , SOCK_RAW , IPPROTO_TCP )) < 0 )
5997 {
@@ -117,6 +155,19 @@ int half_open(const char* ip, port_t port)
117155 return 1 ;
118156 }
119157
158+ pthread_t rsp ;
159+ pthread_attr_t attrs ;
160+
161+ pthread_attr_init (& attrs );
162+ struct thread_retval rv ;
163+
164+ // Start thread that will get the answer
165+ if ( (ret = pthread_create (& rsp , & attrs , wait_for_syn_ack , (void * )& rv )) != 0 )
166+ {
167+ perror ("pthread_create() failed" );
168+ return PHSCAN_ERROR ;
169+ }
170+
120171 dest .sin_family = AF_INET ;
121172 dest .sin_addr .s_addr = g_dest_ip .s_addr ;
122173
@@ -140,55 +191,88 @@ int half_open(const char* ip, port_t port)
140191 return 1 ;
141192 }
142193
143- int ret ;
144- // Receive from buffer, await until done
145- while (1 )
194+ // Receive from thread, await until done
195+ void * retval ;
196+ pthread_join (rsp , & retval );
197+
198+ return ((struct thread_retval * )retval )-> port_status ;
199+ }
200+
201+
202+ void dump_packet (uint8_t * buffer , size_t size , size_t width )
203+ {
204+ size_t i ;
205+ size_t current_width = 0 ;
206+ for (i = 0 ; i < size ; ++ i )
146207 {
147- if ( (data_size = recvfrom (s , buffer , 65536 , 0 , & saddr , & sl )) < 0 )
208+ if (current_width + 3 < width )
209+ current_width += 3 ;
210+ else
148211 {
149- perror ("recvfrom() error" );
150- fflush (stdout );
151- return 1 ;
212+ current_width = 0 ;
213+ printf ("\n" );
152214 }
153215
154- ret = process_packet (buffer , data_size );
155- //Now process the packet
156- if ( ret == PHSCAN_PORT_OPEN || ret == PHSCAN_PORT_CLOSED )
157- break ;
216+ printf ("%02x " , buffer [i ]);
158217 }
159- return ret ;
218+ printf ("\n" );
219+ }
220+ void dump_ip_packet (struct iphdr * iph )
221+ {
222+ if (!iph )
223+ return ;
224+
225+ printf ("iph->ihl = %u\n" , iph -> ihl );
226+ printf ("iph->version = %u\n" , iph -> version );
227+ printf ("iph->tos = %u\n" , iph -> tos );
228+ printf ("iph->tot_len = %u\n" , iph -> tot_len );
229+ printf ("iph->id = 0x%x\n" , iph -> id );
230+ printf ("iph->frag_off = 0x%x\n" , iph -> frag_off );
231+ printf ("iph->ttl = %u\n" , iph -> ttl );
232+ printf ("iph->protocol = %d\n" , iph -> protocol );
233+ printf ("iph->check = 0x%x\n" , iph -> check );
234+ printf ("iph->saddr = %u\n" , iph -> saddr );
235+ printf ("iph->daddr = %u\n" , iph -> daddr );
160236}
161237
162238/*
163239 Method to sniff incoming packets and look for Ack replies
164240 */
165- int process_packet (unsigned char * buffer , int size )
241+ int process_packet (uint8_t * buffer , int size )
166242{
167243 //Get the IP Header part of this packet
168244 struct iphdr * iph = (struct iphdr * )buffer ;
245+ struct tcphdr * tcph ;
169246 struct sockaddr_in source ,dest ;
170247 unsigned short iphdrlen ;
248+
171249 if (size < 0 || !buffer )
172250 return PHSCAN_PKT_UNRELATED ;
173251
174- if (iph -> protocol == 6 )
252+ if (iph -> protocol == IPPROTO_TCP )
175253 {
176- struct iphdr * iph = (struct iphdr * )buffer ;
177254 iphdrlen = iph -> ihl * 4 ;
178255
179- struct tcphdr * tcph = (struct tcphdr * )(buffer + iphdrlen );
256+ tcph = (struct tcphdr * )(buffer + iphdrlen );
257+
258+ // Dump this packet
259+ // dump_packet(buffer, size, 30);
260+ // dump_ip_packet(iph);
180261
181262 memset (& source , 0 , sizeof (source ));
182263 source .sin_addr .s_addr = iph -> saddr ;
183-
184264 memset (& dest , 0 , sizeof (dest ));
185265 dest .sin_addr .s_addr = iph -> daddr ;
186266
187267 if (tcph -> syn == 1 && tcph -> ack == 1
188268 && source .sin_addr .s_addr == g_dest_ip .s_addr )
269+ {
189270 return PHSCAN_PORT_OPEN ;
271+ }
190272 else
273+ {
191274 return PHSCAN_PORT_CLOSED ;
275+ }
192276 }
193277 return PHSCAN_PKT_UNRELATED ;
194278}
0 commit comments