nasl_frame_forgery.c File Reference

Functions to forge and manipulate datalink layer frames. More...

#include "nasl_frame_forgery.h"
#include "../misc/bpf_share.h"
#include "../misc/pcap_openvas.h"
#include "../misc/plugutils.h"
#include "capture_packet.h"
#include "nasl_debug.h"
#include <errno.h>
#include <gvm/base/networking.h>
#include <linux/if_packet.h>
#include <net/ethernet.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <netinet/ether.h>
#include <netinet/if_ether.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <unistd.h>

Include dependency graph for nasl_frame_forgery.c:

Go to the source code of this file.

Data Structures
struct	pseudo_eth_arp
struct	pseudo_frame

Macros
#define	G_LOG_DOMAIN   "lib misc"
	GLib logging domain.

Functions
struct pseudo_eth_arp	__attribute__ ((packed))
static void	dump_frame (const u_char *frame, int frame_sz)
	Dump a datalink layer frame.
static void	prepare_sockaddr_ll (struct sockaddr_ll *soc_addr_ll, int ifindex, const u_char *ether_dst_addr)
	Prepare message header to be sent with sendmsg().
static void	prepare_message (u_char *msg, struct sockaddr_ll *soc_addr_ll, u_char *payload, int payload_sz)
	Prepare message header to be sent with sendmsg().
static int	send_frame (const u_char *frame, int frame_sz, int use_pcap, int timeout, char *filter, struct in6_addr *ipaddr, u_char **answer)
	Send a frame and listen to the answer.
static int	forge_frame (const u_char *ether_src_addr, const u_char *ether_dst_addr, int ether_proto, u_char *payload, int payload_sz, struct pseudo_frame **frame)
	Forge a datalink layer frame.
tree_cell *	nasl_forge_frame (lex_ctxt *lexic)
	Forge a datalink layer frame.
tree_cell *	nasl_send_frame (lex_ctxt *lexic)
	Send a frame and listen to the answer.
tree_cell *	nasl_dump_frame (lex_ctxt *lexic)
	Dump a datalink layer frame.
static int	get_local_mac_address_from_ip (char *ip_address, u_char *mac)
	Get the MAC address of host.
tree_cell *	nasl_get_local_mac_address_from_ip (lex_ctxt *lexic)
	Get the MAC address of host.
tree_cell *	nasl_send_arp_request (lex_ctxt *lexic)
	Send an arp request to an IP host.

Variables
struct arphdr	arp_header
u_char	__ar_sha [ETH_ALEN]
u_char	__ar_sip [4]
u_char	__ar_tha [ETH_ALEN]
u_char	__ar_tip [4]
u_char	__zero_padding [18]
struct ethhdr	framehdr
u_char *	payload

Detailed Description

Functions to forge and manipulate datalink layer frames.

Definition in file nasl_frame_forgery.c.

Macro Definition Documentation

G_LOG_DOMAIN

#define G_LOG_DOMAIN   "lib misc"

GLib logging domain.

Definition at line 38 of file nasl_frame_forgery.c.

Function Documentation

__attribute__()

struct pseudo_eth_arp __attribute__

(

(packed)

)

dump_frame()

void dump_frame ( const u_char * frame, int frame_sz )

static

Dump a datalink layer frame.

Parameters

frame	The frame to be dumped.
frame_sz	The frame's size.

Definition at line 63 of file nasl_frame_forgery.c.

{
  int f = 0;
 
  printf ("\nThe Frame:\n");
  while (f < frame_sz)
    {
      printf ("%02x%02x ", ((u_char *) frame)[f], ((u_char *) frame)[f + 1]);
      f += 2;
      if (f % 16 == 0)
        printf ("\n");
    }
  printf ("\n\n");
}

Referenced by nasl_dump_frame().

Here is the caller graph for this function:

forge_frame()

int forge_frame ( const u_char * ether_src_addr, const u_char * ether_dst_addr, int ether_proto, u_char * payload, int payload_sz, struct pseudo_frame ** frame )

static

Forge a datalink layer frame.

Parameters

[in]	src_haddr	Source MAC address to use.
[in]	dst_haddr	Destination MAC address to use.
[in]	ether_proto	Ethernet type integer in hex format. Default 0x0800 (ETHER_P_IP)
[in]	payload	Payload to be attached to the frame. E.g a forged tcp datagram, or arp header
[out]	frame	the forge frame

Returns

the forged frame size.

Definition at line 230 of file nasl_frame_forgery.c.

{
  int frame_sz;
 
  *frame = (struct pseudo_frame *) g_malloc0 (sizeof (struct pseudo_frame)
                                              + payload_sz);
 
  memcpy ((*frame)->framehdr.h_dest, ether_dst_addr, ETHER_ADDR_LEN);
  memcpy ((*frame)->framehdr.h_source, ether_src_addr, ETHER_ADDR_LEN);
  (*frame)->framehdr.h_proto = htons (ether_proto);
  (*frame)->payload = payload;
 
  frame_sz = ETH_HLEN + payload_sz;
  memcpy ((char *) *frame + ETH_HLEN, payload, payload_sz);
 
  return frame_sz;
}

References payload.

Referenced by nasl_forge_frame(), and nasl_send_arp_request().

Here is the caller graph for this function:

get_local_mac_address_from_ip()

int get_local_mac_address_from_ip ( char * ip_address, u_char * mac )

static

Get the MAC address of host.

Parameters

[in]	ip_address	Local IP address
[out]	mac	The MAC address

Returns

0 on success. MAC address is put into buffer. -1 on error.

Definition at line 389 of file nasl_frame_forgery.c.

{
  struct ifreq ifr;
  int sock;
  char *if_name = NULL;
 
  if_name = get_iface_from_ip (ip_address);
  if (!if_name)
    {
      g_debug ("%s: Missing interface name", __func__);
      return -1;
    }
 
  strncpy (ifr.ifr_name, if_name, sizeof (ifr.ifr_name) - 1);
  g_free (if_name);
  ifr.ifr_name[sizeof (ifr.ifr_name) - 1] = '\0';
 
  sock = socket (PF_INET, SOCK_STREAM, 0);
  if (-1 == sock)
    {
      perror ("socket() ");
      return -1;
    }
 
  if (-1 == ioctl (sock, SIOCGIFHWADDR, &ifr))
    {
      g_debug ("%s: ioctl(SIOCGIFHWADDR)", __func__);
      return -1;
    }
 
  memcpy (mac, (u_char *) ifr.ifr_hwaddr.sa_data, ETHER_ADDR_LEN);
  close (sock);
 
  return 0;
}

References get_iface_from_ip(), and mac().

Referenced by nasl_get_local_mac_address_from_ip(), and nasl_send_arp_request().

Here is the call graph for this function:

Here is the caller graph for this function:

nasl_dump_frame()

tree_cell * nasl_dump_frame

(

lex_ctxt *

lexic

)

Dump a datalink layer frame.

@naslparam

• 
  frame The frame to be dumped.

Parameters

lexic

Lexical context of NASL interpreter.

Returns

Null

Definition at line 363 of file nasl_frame_forgery.c.

{
  u_char *frame = (u_char *) get_str_var_by_name (lexic, "frame");
  int frame_sz = get_var_size_by_name (lexic, "frame");
 
  if (frame == NULL || frame_sz <= 0)
    {
      nasl_perror (lexic, "%s usage: frame is a mandatory parameters.\n",
                   __func__);
      return NULL;
    }
 
  dump_frame (frame, frame_sz);
  return NULL;
}

References dump_frame(), get_str_var_by_name(), get_var_size_by_name(), and nasl_perror().

Here is the call graph for this function:

nasl_forge_frame()

tree_cell * nasl_forge_frame

(

lex_ctxt *

lexic

)

Forge a datalink layer frame.

@naslparams

• 
  src_haddr Source MAC address to use.
• 
  dst_haddr Destination MAC address to use.
• 
  ether_proto Ethernet type integer in hex format. Default 0x0800 (ETHER_P_IP)
• 
  payload Payload to be attached to the frame. E.g a forged tcp datagram.
• @naslreturn the forged frame.

Parameters

lexic

Lexical context of NASL interpreter.

Returns

tree_cell element or null.

Definition at line 268 of file nasl_frame_forgery.c.

{
  tree_cell *retc;
  struct pseudo_frame *frame;
  int frame_sz;
  u_char *payload = (u_char *) get_str_var_by_name (lexic, "payload");
  int payload_sz = get_var_size_by_name (lexic, "payload");
  char *ether_src_addr = get_str_var_by_name (lexic, "src_haddr");
  char *ether_dst_addr = get_str_var_by_name (lexic, "dst_haddr");
  int ether_proto = get_int_var_by_name (lexic, "ether_proto", 0x0800);
 
  if (ether_src_addr == NULL || ether_dst_addr == NULL || payload == NULL)
    {
      nasl_perror (lexic,
                   "%s usage: payload, src_haddr and dst_haddr are mandatory "
                   "parameters.\n",
                   __func__);
      return NULL;
    }
 
  frame_sz = forge_frame ((u_char *) ether_src_addr, (u_char *) ether_dst_addr,
                          ether_proto, payload, payload_sz, &frame);
 
  retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = (char *) frame;
  retc->size = frame_sz;
  return retc;
}

References alloc_typed_cell(), CONST_DATA, forge_frame(), get_int_var_by_name(), get_str_var_by_name(), get_var_size_by_name(), nasl_perror(), payload, TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

nasl_get_local_mac_address_from_ip()

tree_cell * nasl_get_local_mac_address_from_ip

(

lex_ctxt *

lexic

)

Get the MAC address of host.

@naslparam

• ip_address Local IP address

  @naslreturn The MAC address of the host. NULL otherwise

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Definition at line 438 of file nasl_frame_forgery.c.

{
  tree_cell *retc = NULL;
  char *buffer = NULL;
  u_char *mac;
 
  char *ip_address = get_str_var_by_num (lexic, 0);
 
  mac = g_malloc0 (sizeof (u_char) * ETHER_ADDR_LEN);
  get_local_mac_address_from_ip (ip_address, mac);
  if (mac != NULL)
    {
      buffer = g_strdup_printf ("%02x:%02x:%02x:%02x:%02x:%02x", mac[0], mac[1],
                                mac[2], mac[3], mac[4], mac[5]);
      g_free (mac);
      retc = alloc_typed_cell (CONST_DATA);
      retc->x.str_val = buffer;
      retc->size = 17;
    }
 
  return retc;
}

References alloc_typed_cell(), CONST_DATA, get_local_mac_address_from_ip(), get_str_var_by_num(), mac(), TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

nasl_send_arp_request()

tree_cell * nasl_send_arp_request

(

lex_ctxt *

lexic

)

Send an arp request to an IP host.

NASL Returns:\n The MAC address of the target. NULL otherwise

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

A tree cell or NULL.

Definition at line 471 of file nasl_frame_forgery.c.

{
  tree_cell *retc = NULL;
  struct in6_addr src, *dst = plug_get_host_ip (lexic->script_infos);
  struct in_addr dst_inaddr, src_inaddr;
  struct pseudo_eth_arp eth_arp;
  struct pseudo_frame *frame;
  int frame_sz;
  char ip_src_str[INET6_ADDRSTRLEN];
  u_char mac_broadcast_addr[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
  u_char mac[6], *mac_aux;
  char filter[255];
  u_char *answer = NULL;
  int answer_sz;
  int to = get_int_var_by_name (lexic, "pcap_timeout", 5);
 
  /* Get source IP address via routethrough. We need it to find our mac address.
   */
  if (dst == NULL || (IN6_IS_ADDR_V4MAPPED (dst) != 1))
    return retc;
 
  memset (&dst_inaddr, '\0', sizeof (struct in_addr));
  dst_inaddr.s_addr = dst->s6_addr32[3];
  routethrough (&dst_inaddr, &src_inaddr);
  ipv4_as_ipv6 (&src_inaddr, &src);
 
  /* Getting target IP address  as string, to get the mac address */
  addr6_to_str (&src, ip_src_str);
 
  mac_aux = (u_char *) g_malloc0 (sizeof (u_char) * 6);
  get_local_mac_address_from_ip (ip_src_str, mac_aux);
  mac[0] = mac_aux[0];
  mac[1] = mac_aux[1];
  mac[2] = mac_aux[2];
  mac[3] = mac_aux[3];
  mac[4] = mac_aux[4];
  mac[5] = mac_aux[5];
  g_free (mac_aux);
 
  /* Building ARP header */
  memset (&eth_arp, '\0', sizeof (struct pseudo_eth_arp));
  eth_arp.arp_header.ar_hrd = htons (ARPHRD_ETHER);
  eth_arp.arp_header.ar_pro = htons (ETHERTYPE_IP);
  eth_arp.arp_header.ar_hln = ETH_ALEN;
  eth_arp.arp_header.ar_pln = 4;
  eth_arp.arp_header.ar_op = htons (ARPOP_REQUEST);
 
  memcpy (&(eth_arp.__ar_sha), mac, ETH_ALEN);
  memcpy (&(eth_arp.__ar_sip), &src_inaddr, 4);
  memcpy (&(eth_arp.__ar_tha), mac_broadcast_addr, ETH_ALEN);
  memcpy (&(eth_arp.__ar_tip), &dst_inaddr, 4);
 
  frame_sz =
    forge_frame (mac, mac_broadcast_addr, ETH_P_ARP, (u_char *) &eth_arp,
                 sizeof (struct pseudo_eth_arp), &frame);
 
  /* Prepare filter */
  snprintf (filter, sizeof (filter), "arp and src host %s",
            inet_ntoa (dst_inaddr));
 
  answer_sz =
    send_frame ((const u_char *) frame, frame_sz, 1, to, filter, dst, &answer);
  g_free (frame);
  if (answer_sz == -2)
    {
      g_message ("%s: Not possible to send the frame", __func__);
      return NULL;
    }
 
  if (answer && answer_sz > -1)
    {
      char *daddr;
      struct ether_header *answer_aux;
 
      answer_aux = (struct ether_header *) answer;
      daddr = g_strdup_printf (
        "%02x:%02x:%02x:%02x:%02x:%02x", (u_int) answer_aux->ether_shost[0],
        (u_int) answer_aux->ether_shost[1], (u_int) answer_aux->ether_shost[2],
        (u_int) answer_aux->ether_shost[3], (u_int) answer_aux->ether_shost[4],
        (u_int) answer_aux->ether_shost[5]);
 
      retc = alloc_typed_cell (CONST_DATA);
      retc->x.str_val = daddr;
      retc->size = strlen (daddr);
    }
  else
    g_debug ("%s: No answer received.", __func__);
 
  return retc;
}

References pseudo_eth_arp::__ar_sha, pseudo_eth_arp::__ar_sip, pseudo_eth_arp::__ar_tha, pseudo_eth_arp::__ar_tip, alloc_typed_cell(), pseudo_eth_arp::arp_header, CONST_DATA, daddr, forge_frame(), get_int_var_by_name(), get_local_mac_address_from_ip(), mac(), plug_get_host_ip(), routethrough(), struct_lex_ctxt::script_infos, send_frame(), TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

nasl_send_frame()

tree_cell * nasl_send_frame

(

lex_ctxt *

lexic

)

Send a frame and listen to the answer.

@naslparams

• 
  frame The frame to be sent.
• 
  pcap_active TRUE by default. Otherwise, NASL does not listen for the answers.
• 
  pcap_filter BPF filter.
• 
  pcap_timeout Capture timeout. 5 by default.
• @naslreturn Sniffed answer.

Parameters

lexic

Lexical context of NASL interpreter.

Returns

tree_cell element or null.

Definition at line 314 of file nasl_frame_forgery.c.

{
  tree_cell *retc = NULL;
  struct script_infos *script_infos = lexic->script_infos;
  struct in6_addr *ipaddr = plug_get_host_ip (script_infos);
  u_char *frame = (u_char *) get_str_var_by_name (lexic, "frame");
  int frame_sz = get_var_size_by_name (lexic, "frame");
  int use_pcap = get_int_var_by_name (lexic, "pcap_active", 1);
  int to = get_int_var_by_name (lexic, "pcap_timeout", 5);
  char *filter = get_str_var_by_name (lexic, "pcap_filter");
  u_char *answer = NULL;
  int answer_sz;
 
  if (frame == NULL || frame_sz <= 0)
    {
      nasl_perror (lexic, "%s usage: frame is a mandatory parameters.\n",
                   __func__);
      return NULL;
    }
 
  answer_sz =
    send_frame (frame, frame_sz, use_pcap, to, filter, ipaddr, &answer);
  if (answer_sz == -2)
    {
      g_message ("%s: Not possible to send the frame", __func__);
      return NULL;
    }
 
  if (answer && answer_sz > -1)
    {
      retc = alloc_typed_cell (CONST_DATA);
      retc->x.str_val = (char *) answer;
      retc->size = answer_sz;
    }
 
  return retc;
}

References alloc_typed_cell(), CONST_DATA, get_int_var_by_name(), get_str_var_by_name(), get_var_size_by_name(), nasl_perror(), plug_get_host_ip(), struct_lex_ctxt::script_infos, send_frame(), TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

prepare_message()

void prepare_message ( u_char * msg, struct sockaddr_ll * soc_addr_ll, u_char * payload, int payload_sz )

static

Prepare message header to be sent with sendmsg().

Parameters

[out]	msg	The packaged messages to be sent
[in]	soc_addr_ll	The sockaddr_ll structure for capturing
[in]	payload	The payload, a datalink layer frame with payload
[in]	payload_sz	The payload size.

Definition at line 103 of file nasl_frame_forgery.c.

{
  struct iovec iov;
  struct msghdr *message;
 
  iov.iov_base = payload;
  iov.iov_len = payload_sz;
 
  message = g_malloc0 (sizeof (struct msghdr) + payload_sz);
 
  message->msg_name = soc_addr_ll;
  message->msg_namelen = sizeof (struct sockaddr_ll);
  message->msg_iov = &iov;
  message->msg_iovlen = 1;
  message->msg_control = 0;
  message->msg_controllen = 0;
 
  memcpy (msg, (u_char *) message, sizeof (struct msghdr) + payload_sz);
  g_free (message);
}

References payload.

Referenced by send_frame().

Here is the caller graph for this function:

prepare_sockaddr_ll()

void prepare_sockaddr_ll ( struct sockaddr_ll * soc_addr_ll, int ifindex, const u_char * ether_dst_addr )

static

Prepare message header to be sent with sendmsg().

Parameters

[out]	soc_addr_ll	The sockaddr_ll structure to be prepared
[in]	ifindex	The interface index to be use for capturing.
[in]	ether_dst_addr	The dst MAC address.

Definition at line 85 of file nasl_frame_forgery.c.

{
  soc_addr_ll->sll_family = AF_PACKET;
  soc_addr_ll->sll_ifindex = ifindex;
  soc_addr_ll->sll_halen = ETHER_ADDR_LEN;
  soc_addr_ll->sll_protocol = htons (ETH_P_ALL);
  memcpy (soc_addr_ll->sll_addr, ether_dst_addr, ETHER_ADDR_LEN);
}

Referenced by send_frame().

Here is the caller graph for this function:

send_frame()

int send_frame ( const u_char * frame, int frame_sz, int use_pcap, int timeout, char * filter, struct in6_addr * ipaddr, u_char ** answer )

static

Send a frame and listen to the answer.

Parameters

[in]

The frame to be sent.

Parameters

[in]

The frame's size.

Parameters

[in]

TRUE by default. Otherwise, NASL does not listen for the answers.

Parameters

[in]

BPF filter.

Parameters

[in]

Capture timeout. 5 by default.

Parameters

[in]

Destination address, used for calculating the ethernet index

Parameters

[out]

Sniffed answer.

Returns

Bits received in the answer or 0 on success, -1 if no answer, -2 error sending the message.

Definition at line 141 of file nasl_frame_forgery.c.

{
  int soc;
  u_char *message;
  int ifindex;
  int bpf = -1;
  int frame_and_payload = 0;
  int answer_sz = -1;
 
  // Create the raw socket
  soc = socket (AF_PACKET, SOCK_RAW, htons (ETH_P_ALL));
  if (soc == -1)
    {
      g_debug ("%s: %s", __func__, strerror (errno));
      return -1;
    }
 
  // We will need the eth index. We get it depending on the target's IP..
  if (get_iface_index (ipaddr, &ifindex) < 0)
    {
      g_message ("%s: Missing interface index\n", __func__);
      return -1;
    }
 
  // Prepare sockaddr_ll. This is necessary for further captures
  u_char dst_haddr[ETHER_ADDR_LEN];
  memcpy (&dst_haddr, (struct pseudo_frame *) frame, ETHER_ADDR_LEN);
 
  struct sockaddr_ll soc_addr;
  memset (&soc_addr, '\0', sizeof (struct sockaddr_ll));
  prepare_sockaddr_ll (&soc_addr, ifindex, dst_haddr);
 
  /* Init capture */
  if (use_pcap != 0 && bpf < 0)
    {
      if (IN6_IS_ADDR_V4MAPPED (ipaddr))
        {
          struct in_addr sin, this_host;
          memset (&sin, '\0', sizeof (struct in_addr));
          memset (&this_host, '\0', sizeof (struct in_addr));
          sin.s_addr = ipaddr->s6_addr32[3];
          bpf = init_capture_device (sin, this_host, filter);
        }
      else
        {
          struct in6_addr this_host;
          memset (&this_host, '\0', sizeof (struct in6_addr));
          bpf = init_v6_capture_device (*ipaddr, this_host, filter);
        }
    }
 
  // Prepare the message and send it
  message = g_malloc0 (sizeof (struct msghdr) + frame_sz);
  prepare_message (message, &soc_addr, (u_char *) frame, frame_sz);
 
  int b = sendmsg (soc, (struct msghdr *) message, 0);
  g_free (message);
  if (b == -1)
    {
      g_message ("%s: Error sending message: %s", __func__, strerror (errno));
      return -2;
    }
  if (bpf >= 0)
    {
      *answer = (u_char *) capture_next_frame (bpf, timeout, &answer_sz,
                                               frame_and_payload);
      bpf_close (bpf);
      close (soc);
      return answer_sz;
    }
 
  close (soc);
  return 0;
}

References bpf_close(), capture_next_frame(), get_iface_index(), init_capture_device(), init_v6_capture_device(), prepare_message(), and prepare_sockaddr_ll().

Referenced by nasl_send_arp_request(), and nasl_send_frame().

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

__ar_sha

u_char __ar_sha[ETH_ALEN]

Definition at line 1 of file nasl_frame_forgery.c.

__ar_sip

u_char __ar_sip[4]

Definition at line 2 of file nasl_frame_forgery.c.

__ar_tha

u_char __ar_tha[ETH_ALEN]

Definition at line 3 of file nasl_frame_forgery.c.

__ar_tip

u_char __ar_tip[4]

Definition at line 4 of file nasl_frame_forgery.c.

__zero_padding

u_char __zero_padding[18]

Definition at line 5 of file nasl_frame_forgery.c.

arp_header

struct arphdr arp_header

Definition at line 0 of file nasl_frame_forgery.c.

framehdr

struct ethhdr framehdr

Definition at line 0 of file nasl_frame_forgery.c.

payload

u_char* payload

Definition at line 1 of file nasl_frame_forgery.c.

Referenced by forge_frame(), nasl_forge_frame(), prepare_message(), and run_table_driven_lsc().