nasl_frame_forgery.h File Reference

Header file for module nasl_frame_forgery. More...

#include "nasl_lex_ctxt.h"

Include dependency graph for nasl_frame_forgery.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
tree_cell *	nasl_send_arp_request (lex_ctxt *)
	Send an arp request to an IP host.
tree_cell *	nasl_get_local_mac_address_from_ip (lex_ctxt *)
	Get the MAC address of host.
tree_cell *	nasl_forge_frame (lex_ctxt *)
	Forge a datalink layer frame.
tree_cell *	nasl_send_frame (lex_ctxt *)
	Send a frame and listen to the answer.
tree_cell *	nasl_dump_frame (lex_ctxt *)
	Dump a datalink layer frame.

Detailed Description

Header file for module nasl_frame_forgery.

Definition in file nasl_frame_forgery.h.

Function Documentation

nasl_dump_frame()

tree_cell * nasl_dump_frame

(

lex_ctxt *

lexic

)

Dump a datalink layer frame.

@naslparam

• 
  frame The frame to be dumped.

Parameters

lexic

Lexical context of NASL interpreter.

Returns

Null

Definition at line 363 of file nasl_frame_forgery.c.

{
  u_char *frame = (u_char *) get_str_var_by_name (lexic, "frame");
  int frame_sz = get_var_size_by_name (lexic, "frame");
 
  if (frame == NULL || frame_sz <= 0)
    {
      nasl_perror (lexic, "%s usage: frame is a mandatory parameters.\n",
                   __func__);
      return NULL;
    }
 
  dump_frame (frame, frame_sz);
  return NULL;
}

References dump_frame(), get_str_var_by_name(), get_var_size_by_name(), and nasl_perror().

Here is the call graph for this function:

nasl_forge_frame()

tree_cell * nasl_forge_frame

(

lex_ctxt *

lexic

)

Forge a datalink layer frame.

@naslparams

• 
  src_haddr Source MAC address to use.
• 
  dst_haddr Destination MAC address to use.
• 
  ether_proto Ethernet type integer in hex format. Default 0x0800 (ETHER_P_IP)
• 
  payload Payload to be attached to the frame. E.g a forged tcp datagram.
• @naslreturn the forged frame.

Parameters

lexic

Lexical context of NASL interpreter.

Returns

tree_cell element or null.

Definition at line 268 of file nasl_frame_forgery.c.

{
  tree_cell *retc;
  struct pseudo_frame *frame;
  int frame_sz;
  u_char *payload = (u_char *) get_str_var_by_name (lexic, "payload");
  int payload_sz = get_var_size_by_name (lexic, "payload");
  char *ether_src_addr = get_str_var_by_name (lexic, "src_haddr");
  char *ether_dst_addr = get_str_var_by_name (lexic, "dst_haddr");
  int ether_proto = get_int_var_by_name (lexic, "ether_proto", 0x0800);
 
  if (ether_src_addr == NULL || ether_dst_addr == NULL || payload == NULL)
    {
      nasl_perror (lexic,
                   "%s usage: payload, src_haddr and dst_haddr are mandatory "
                   "parameters.\n",
                   __func__);
      return NULL;
    }
 
  frame_sz = forge_frame ((u_char *) ether_src_addr, (u_char *) ether_dst_addr,
                          ether_proto, payload, payload_sz, &frame);
 
  retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = (char *) frame;
  retc->size = frame_sz;
  return retc;
}

References alloc_typed_cell(), CONST_DATA, forge_frame(), get_int_var_by_name(), get_str_var_by_name(), get_var_size_by_name(), nasl_perror(), payload, TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

nasl_get_local_mac_address_from_ip()

tree_cell * nasl_get_local_mac_address_from_ip

(

lex_ctxt *

lexic

)

Get the MAC address of host.

@naslparam

• ip_address Local IP address

  @naslreturn The MAC address of the host. NULL otherwise

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Definition at line 438 of file nasl_frame_forgery.c.

{
  tree_cell *retc = NULL;
  char *buffer = NULL;
  u_char *mac;
 
  char *ip_address = get_str_var_by_num (lexic, 0);
 
  mac = g_malloc0 (sizeof (u_char) * ETHER_ADDR_LEN);
  get_local_mac_address_from_ip (ip_address, mac);
  if (mac != NULL)
    {
      buffer = g_strdup_printf ("%02x:%02x:%02x:%02x:%02x:%02x", mac[0], mac[1],
                                mac[2], mac[3], mac[4], mac[5]);
      g_free (mac);
      retc = alloc_typed_cell (CONST_DATA);
      retc->x.str_val = buffer;
      retc->size = 17;
    }
 
  return retc;
}

References alloc_typed_cell(), CONST_DATA, get_local_mac_address_from_ip(), get_str_var_by_num(), mac(), TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

nasl_send_arp_request()

tree_cell * nasl_send_arp_request

(

lex_ctxt *

lexic

)

Send an arp request to an IP host.

NASL Returns:\n The MAC address of the target. NULL otherwise

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

A tree cell or NULL.

Definition at line 471 of file nasl_frame_forgery.c.

{
  tree_cell *retc = NULL;
  struct in6_addr src, *dst = plug_get_host_ip (lexic->script_infos);
  struct in_addr dst_inaddr, src_inaddr;
  struct pseudo_eth_arp eth_arp;
  struct pseudo_frame *frame;
  int frame_sz;
  char ip_src_str[INET6_ADDRSTRLEN];
  u_char mac_broadcast_addr[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
  u_char mac[6], *mac_aux;
  char filter[255];
  u_char *answer = NULL;
  int answer_sz;
  int to = get_int_var_by_name (lexic, "pcap_timeout", 5);
 
  /* Get source IP address via routethrough. We need it to find our mac address.
   */
  if (dst == NULL || (IN6_IS_ADDR_V4MAPPED (dst) != 1))
    return retc;
 
  memset (&dst_inaddr, '\0', sizeof (struct in_addr));
  dst_inaddr.s_addr = dst->s6_addr32[3];
  routethrough (&dst_inaddr, &src_inaddr);
  ipv4_as_ipv6 (&src_inaddr, &src);
 
  /* Getting target IP address  as string, to get the mac address */
  addr6_to_str (&src, ip_src_str);
 
  mac_aux = (u_char *) g_malloc0 (sizeof (u_char) * 6);
  get_local_mac_address_from_ip (ip_src_str, mac_aux);
  mac[0] = mac_aux[0];
  mac[1] = mac_aux[1];
  mac[2] = mac_aux[2];
  mac[3] = mac_aux[3];
  mac[4] = mac_aux[4];
  mac[5] = mac_aux[5];
  g_free (mac_aux);
 
  /* Building ARP header */
  memset (&eth_arp, '\0', sizeof (struct pseudo_eth_arp));
  eth_arp.arp_header.ar_hrd = htons (ARPHRD_ETHER);
  eth_arp.arp_header.ar_pro = htons (ETHERTYPE_IP);
  eth_arp.arp_header.ar_hln = ETH_ALEN;
  eth_arp.arp_header.ar_pln = 4;
  eth_arp.arp_header.ar_op = htons (ARPOP_REQUEST);
 
  memcpy (&(eth_arp.__ar_sha), mac, ETH_ALEN);
  memcpy (&(eth_arp.__ar_sip), &src_inaddr, 4);
  memcpy (&(eth_arp.__ar_tha), mac_broadcast_addr, ETH_ALEN);
  memcpy (&(eth_arp.__ar_tip), &dst_inaddr, 4);
 
  frame_sz =
    forge_frame (mac, mac_broadcast_addr, ETH_P_ARP, (u_char *) &eth_arp,
                 sizeof (struct pseudo_eth_arp), &frame);
 
  /* Prepare filter */
  snprintf (filter, sizeof (filter), "arp and src host %s",
            inet_ntoa (dst_inaddr));
 
  answer_sz =
    send_frame ((const u_char *) frame, frame_sz, 1, to, filter, dst, &answer);
  g_free (frame);
  if (answer_sz == -2)
    {
      g_message ("%s: Not possible to send the frame", __func__);
      return NULL;
    }
 
  if (answer && answer_sz > -1)
    {
      char *daddr;
      struct ether_header *answer_aux;
 
      answer_aux = (struct ether_header *) answer;
      daddr = g_strdup_printf (
        "%02x:%02x:%02x:%02x:%02x:%02x", (u_int) answer_aux->ether_shost[0],
        (u_int) answer_aux->ether_shost[1], (u_int) answer_aux->ether_shost[2],
        (u_int) answer_aux->ether_shost[3], (u_int) answer_aux->ether_shost[4],
        (u_int) answer_aux->ether_shost[5]);
 
      retc = alloc_typed_cell (CONST_DATA);
      retc->x.str_val = daddr;
      retc->size = strlen (daddr);
    }
  else
    g_debug ("%s: No answer received.", __func__);
 
  return retc;
}

References pseudo_eth_arp::__ar_sha, pseudo_eth_arp::__ar_sip, pseudo_eth_arp::__ar_tha, pseudo_eth_arp::__ar_tip, alloc_typed_cell(), pseudo_eth_arp::arp_header, CONST_DATA, daddr, forge_frame(), get_int_var_by_name(), get_local_mac_address_from_ip(), mac(), plug_get_host_ip(), routethrough(), struct_lex_ctxt::script_infos, send_frame(), TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

nasl_send_frame()

tree_cell * nasl_send_frame

(

lex_ctxt *

lexic

)

Send a frame and listen to the answer.

@naslparams

• 
  frame The frame to be sent.
• 
  pcap_active TRUE by default. Otherwise, NASL does not listen for the answers.
• 
  pcap_filter BPF filter.
• 
  pcap_timeout Capture timeout. 5 by default.
• @naslreturn Sniffed answer.

Parameters

lexic

Lexical context of NASL interpreter.

Returns

tree_cell element or null.

Definition at line 314 of file nasl_frame_forgery.c.

{
  tree_cell *retc = NULL;
  struct script_infos *script_infos = lexic->script_infos;
  struct in6_addr *ipaddr = plug_get_host_ip (script_infos);
  u_char *frame = (u_char *) get_str_var_by_name (lexic, "frame");
  int frame_sz = get_var_size_by_name (lexic, "frame");
  int use_pcap = get_int_var_by_name (lexic, "pcap_active", 1);
  int to = get_int_var_by_name (lexic, "pcap_timeout", 5);
  char *filter = get_str_var_by_name (lexic, "pcap_filter");
  u_char *answer = NULL;
  int answer_sz;
 
  if (frame == NULL || frame_sz <= 0)
    {
      nasl_perror (lexic, "%s usage: frame is a mandatory parameters.\n",
                   __func__);
      return NULL;
    }
 
  answer_sz =
    send_frame (frame, frame_sz, use_pcap, to, filter, ipaddr, &answer);
  if (answer_sz == -2)
    {
      g_message ("%s: Not possible to send the frame", __func__);
      return NULL;
    }
 
  if (answer && answer_sz > -1)
    {
      retc = alloc_typed_cell (CONST_DATA);
      retc->x.str_val = (char *) answer;
      retc->size = answer_sz;
    }
 
  return retc;
}

References alloc_typed_cell(), CONST_DATA, get_int_var_by_name(), get_str_var_by_name(), get_var_size_by_name(), nasl_perror(), plug_get_host_ip(), struct_lex_ctxt::script_infos, send_frame(), TC::size, TC::str_val, and TC::x.

Here is the call graph for this function: