[PATCH] sebek builder

--- libnet/src/libnet_build_sebek.c	1970-01-01 01:00:00.000000000 +0100
+++ libnet-fr/src/libnet_build_sebek.c	2004-03-10 12:55:36.000000000 +0100
@@ -0,0 +1,148 @@
+/*
+ *  libnet
+ *  libnet_build_sebek.c - sebek packet assembler
+ *
+ *  Copyright (c) 2004 Frédéric Raynal <[email protected]>
+ *  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#if (HAVE_CONFIG_H)
+#include "../include/config.h"
+#endif
+#if (!(_WIN32) || (__CYGWIN__)) 
+#include "../include/libnet.h"
+#else
+#include "../include/win32/libnet.h"
+#endif
+
+
+/*
+
+There is currently no RFC for the sebek protocol, but header is described on honeynet website:
+
+http://projects.honeynet.org/tools/sebek/
+
+
+		                   1              3
+		   0               6              2
+		   +------------------------------+
+		   |         Magic value          |
+		   +------------------------------+
+		   |     Version   |     Type     |
+		   +------------------------------+
+		   |            Counter           |
+		   +------------------------------+
+		   |         Time seconds         |
+		   +------------------------------+
+		   |      Time Microsecond        |
+		   +------------------------------+
+		   |              PID             |
+		   +------------------------------+
+		   |              UID             |
+		   +------------------------------+
+		   |       File descriptor        |
+		   +------------------------------+
+		   |                              |
+		   |        Command name          |
+		   |                              |
+		   +------------------------------+
+		   |           length             |
+		   +------------------------------+
+		   |                              |
+		   |          data ...            |
+		   |                              |
+				   
+
+ */
+
+
+
+libnet_ptag_t
+libnet_build_sebek(u_int32_t magic, u_int16_t version, u_int16_t type, u_int32_t counter, 
+u_int32_t time_sec, u_int32_t time_usec, 
+u_int32_t pid, u_int32_t uid, u_int32_t fd, u_int8_t cmd[SEBEK_CMD_LENGTH], u_int32_t length, 
+u_int8_t *payload, u_int32_t payload_s, libnet_t *l, libnet_ptag_t ptag)
+{
+    u_int32_t n;
+    libnet_pblock_t *p;
+    struct libnet_sebek_hdr sebek_hdr;
+
+    if (l == NULL)
+    { 
+        return (-1);
+    } 
+
+    n = LIBNET_SEBEK_H + payload_s;               /* size of memory block */
+
+    /*
+     *  Find the existing protocol block if a ptag is specified, or create
+     *  a new one.
+     */
+    p = libnet_pblock_probe(l, ptag, n, LIBNET_PBLOCK_SEBEK_H);
+    if (p == NULL)
+    {
+        return (-1);
+    }
+
+    memset(&sebek_hdr, 0, sizeof(sebek_hdr));
+    sebek_hdr.magic     = htonl(magic);
+    sebek_hdr.version   = htons(version);
+    sebek_hdr.type      = htons(type);
+    sebek_hdr.counter   = htonl(counter);
+    sebek_hdr.time_sec  = htonl(time_sec);
+    sebek_hdr.time_usec = htonl(time_usec);
+    sebek_hdr.pid       = htonl(pid);
+    sebek_hdr.uid       = htonl(uid);
+    sebek_hdr.fd        = htonl(fd);
+    memcpy(sebek_hdr.cmd, cmd, SEBEK_CMD_LENGTH*sizeof(u_int8_t));
+    sebek_hdr.length = htonl(length);
+
+    n = libnet_pblock_append(l, p, (u_int8_t *)&sebek_hdr, LIBNET_SEBEK_H);
+    if (n == -1)
+    {
+        goto bad;
+    }
+
+    if ((payload && !payload_s) || (!payload && payload_s))
+    {
+        snprintf(l->err_buf, LIBNET_ERRBUF_SIZE,
+			    "%s(): payload inconsistency\n", __func__);
+        goto bad;
+    }
+ 
+    if (payload && payload_s)
+    {
+        n = libnet_pblock_append(l, p, payload, payload_s);
+        if (n == -1)
+        {
+            goto bad;
+        }
+    }
+ 
+    return (ptag ? ptag : libnet_pblock_update(l, p, 0, LIBNET_PBLOCK_SEBEK_H));
+bad:
+    libnet_pblock_delete(l, p);
+    return (-1);
+}
--- libnet/src/Makefile.am	2004-03-10 10:18:42.000000000 +0100
+++ libnet-fr/src/Makefile.am	2004-03-10 10:25:42.000000000 +0100
@@ -34,6 +34,7 @@
 			libnet_build_ospf.c \
 			libnet_build_rip.c \
 			libnet_build_rpc.c \
+			libnet_build_sebek.c \
 			libnet_build_snmp.c \
 			libnet_build_stp.c \
 			libnet_build_tcp.c \
--- libnet/include/libnet/libnet-functions.h	2004-03-10 10:18:17.000000000 +0100
+++ libnet-fr/include/libnet/libnet-functions.h	2004-03-10 11:02:56.000000000 +0100
@@ -1625,6 +1625,35 @@
 u_int8_t *payload, u_int32_t payload_s, libnet_t *l, libnet_ptag_t ptag);
 
 /**
+ * Build a sebek packet.
+ * See http://projects.honeynet.org/tools/sebek/ for a description 
+ *
+ * @param
+ * @param magic           identify packets that should be hidden 
+ * @param version         protocol version, currently 1 
+ * @param type            type of record (read data is type 0, write data is type 1) 
+ * @param counter          PDU counter used to identify when packet are lost 
+ * @param time_sec        seconds since EPOCH according to the honeypot 
+ * @param time_usec       residual microseconds 
+ * @param pid             PID 
+ * @param uid             UID 
+ * @param fd              FD 
+ * @param cmd[SEBEK_CMD_LENGTH] 12 first characters of the command 
+ * @param length          length in bytes of the PDU's body 
+ * @param payload optional payload or NULL
+ * @param payload_s payload length or 0
+ * @param l pointer to a libnet context
+ * @param ptag protocol tag to modify an existing header, 0 to build a new one
+ * @return protocol tag value on success, -1 on error
+ */
+libnet_ptag_t
+libnet_build_sebek(u_int32_t magic, u_int16_t version, u_int16_t type, u_int32_t counter, 
+u_int32_t time_sec, u_int32_t time_usec, 
+u_int32_t pid, u_int32_t uid, u_int32_t fd, u_int8_t cmd[SEBEK_CMD_LENGTH], u_int32_t length, 
+		   u_int8_t *payload, u_int32_t payload_s, libnet_t *l, libnet_ptag_t ptag);
+
+
+/**
  * Builds a link layer header for an initialized l. The function
  * determines the proper link layer header format from how l was initialized.
  * The function current supports Ethernet and Token Ring link layers.
--- libnet/include/libnet/libnet-headers.h	2004-03-10 10:18:17.000000000 +0100
+++ libnet-fr/include/libnet/libnet-headers.h	2004-03-10 10:50:33.000000000 +0100
@@ -98,6 +98,7 @@
 #define LIBNET_RPC_CALL_TCP_H   0x2c    /**< RPC header:          44 bytes
                                          * (with record marking)
                                          */
+#define LIBNET_SEBEK_H          0x30    /* sebek header:          48 bytes */   
 #define LIBNET_STP_CONF_H       0x23    /**< STP conf header:     35 bytes */
 #define LIBNET_STP_TCN_H        0x04    /**< STP tcn header:       4 bytes */
 #define LIBNET_TOKEN_RING_H     0x16    /**< Token Ring header:   22 bytes */
@@ -1598,6 +1599,30 @@
     u_int16_t uh_sum;         /* checksum */
 };
 
+/*
+ *  Sebek header
+ *  Static header size: 48 bytes
+ */
+struct libnet_sebek_hdr
+{
+    u_int32_t magic;           /* identify packets that should be hidden */
+    u_int16_t version;         /* protocol version, currently 1 */
+#define SEBEK_PROTO_VERSION 1
+    u_int16_t type;            /* type of record (read data is type 0, write data is type 1) */
+#define SEBEK_TYPE_READ     0  /* Currently, only read is supported */
+#define SEBEK_TYPE_WRITE    1
+    u_int32_t counter;         /*  PDU counter used to identify when packet are lost */
+    u_int32_t time_sec;        /* seconds since EPOCH according to the honeypot */
+    u_int32_t time_usec;       /* residual microseconds */
+    u_int32_t pid;             /* PID */
+    u_int32_t uid;             /* UID */
+    u_int32_t fd;              /* FD */
+#define SEBEK_CMD_LENGTH   12
+    u_int8_t cmd[SEBEK_CMD_LENGTH]; /* 12 first characters of the command */
+    u_int32_t length;          /* length in bytes of the PDU's body */
+
+};
+
 
 /*
  *  VRRP header
--- libnet/include/libnet/libnet-structures.h	2004-03-10 10:18:17.000000000 +0100
+++ libnet-fr/include/libnet/libnet-structures.h	2004-03-10 12:38:45.000000000 +0100
@@ -144,6 +144,7 @@
 #define LIBNET_PBLOCK_IPV6_ROUTING_H    0x3c    /* IPv6 routing header */
 #define LIBNET_PBLOCK_IPV6_DESTOPTS_H   0x3d    /* IPv6 dest opts header */
 #define LIBNET_PBLOCK_IPV6_HBHOPTS_H    0x3e    /* IPv6 hop/hop opts header */
+#define LIBNET_PBLOCK_SEBEK_H           0x3f    /* Sebek header */
     u_int8_t flags;                             /* control flags */
 #define LIBNET_PBLOCK_DO_CHECKSUM       0x01    /* needs a checksum */
     libnet_ptag_t ptag;                 /* protocol block tag */
--- libnet/sample/sebek.c	1970-01-01 01:00:00.000000000 +0100
+++ libnet-fr/sample/sebek.c	2004-03-10 14:42:53.000000000 +0100
@@ -0,0 +1,292 @@
+/*
+ *
+ *  libnet 1.1
+ *  Build a Sebek packet
+ *
+ *  Copyright (c) 2004 Frédéric Raynal <[email protected]>
+ *  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#if (HAVE_CONFIG_H)
+#if ((_WIN32) && !(__CYGWIN__)) 
+#include "../include/win32/config.h"
+#else
+#include "../include/config.h"
+#endif
+#endif
+#include "./libnet_test.h"
+
+void usage(char *name)
+{
+    fprintf(stderr,
+	    "usage: %s [-D eth_dst] [-s source_ip] [-d destination_ip]"
+	    "-u [UDP port]"
+	    " [-i iface] [-p payload]\n",
+	    name);
+}
+
+
+int
+main(int argc, char *argv[])
+{
+    int c, port = 1101;
+    libnet_t *l;
+    char *device = NULL;
+    char *eth_dst = "11:11:11:11:11:11";
+    char *dst = "2.2.2.2", *src = "1.1.1.1";
+    u_long src_ip, dst_ip;
+    char errbuf[LIBNET_ERRBUF_SIZE];
+    libnet_ptag_t ptag = 0;
+    u_char *payload = 0;
+    char payload_flag = 0;
+    u_long payload_s = 0;
+    unsigned int magic = 0x0defaced, 
+	counter = 0x12345678,
+	sec = 0, usec = 0,
+	pid = 1,
+	uid = 666,
+	fd = 2;
+    char *cmd = "./h4ckw0r1D";
+    unsigned int length = strlen(cmd)+1;
+    unsigned short version = SEBEK_PROTO_VERSION, type = SEBEK_TYPE_READ;
+
+    printf("libnet 1.1 packet shaping: Sebek[link]\n"); 
+
+
+    /*
+     * handle options
+     */ 
+    while ((c = getopt(argc, argv, "D:d:s:u:m:v:t:S:U:P:I:f:c:p:i:h")) != EOF)
+    {
+        switch (c)
+        {
+            case 'D':
+		eth_dst = optarg;
+                break;
+            case 'd':
+		dst = optarg;
+                break;
+
+            case 's':
+		src = optarg;
+                break;
+
+	    case 'i':
+		device = optarg;
+		break;
+
+	    case 'u':
+		port = atoi(optarg);
+		break;
+
+	    case 'm':
+		magic = strtoul(optarg, NULL, 10);
+		break;
+
+	    case 'v':
+		version = (unsigned short) strtoul(optarg, NULL, 10);
+		break;
+
+	    case 't':
+		type = (unsigned short) strtoul(optarg, NULL, 10);
+		break;
+
+	    case 'S':
+		sec = strtoul(optarg, NULL, 10);
+		break;
+
+	    case 'U':
+		usec = strtoul(optarg, NULL, 10);
+		break;
+
+	    case 'P':
+		pid = strtoul(optarg, NULL, 10);
+		break;
+
+	    case 'I':
+		uid = strtoul(optarg, NULL, 10);
+		break;
+
+	    case 'f':
+		fd = strtoul(optarg, NULL, 10);
+		break;
+
+	    case 'c':
+		cmd = optarg; 
+		length = strlen(cmd);
+		break;
+
+
+	    case 'p':
+		payload_flag = 1;
+		payload = optarg; 
+		payload_s = strlen(payload);
+		break;
+
+	    case 'h':
+		usage(argv[0]);
+		exit(EXIT_SUCCESS);
+
+            default:
+                exit(EXIT_FAILURE);
+        }
+    }
+
+  
+    /*
+     *  Initialize the library.  Root priviledges are required.
+     */
+    l = libnet_init(
+	    LIBNET_LINK_ADV,                        /* injection type */
+	    device,                                 /* network interface */
+            errbuf);                                /* error buffer */
+
+    if (l == NULL)
+    {
+        fprintf(stderr, "libnet_init() failed: %s", errbuf);
+        exit(EXIT_FAILURE); 
+    }
+
+    printf("Using device %s\n", l->device);
+
+
+    if (payload_flag)
+    {
+	memset(cmd, 0, sizeof(cmd));
+	memcpy(cmd, payload, (payload_s < 12 ? payload_s : 12));
+	length = payload_s;
+    }
+
+
+    if ((dst_ip = libnet_name2addr4(l, dst, LIBNET_RESOLVE)) == -1)
+    {
+	fprintf(stderr, "Bad destination IP address: %s\n", dst);
+	exit(EXIT_FAILURE);
+    }
+    
+    if ((src_ip = libnet_name2addr4(l, src, LIBNET_RESOLVE)) == -1)
+    {
+	fprintf(stderr, "Bad source IP address: %s\n", src);
+	exit(EXIT_FAILURE);
+    }
+
+    if (!payload)
+    {
+	payload = cmd;
+	payload_s = length;
+    }
+
+
+    ptag = libnet_build_sebek(
+	magic,
+	version,
+	type,
+	counter,
+	sec,
+	usec,
+	pid,
+	uid,
+	fd,
+	cmd,
+	/* LIBNET_ETH_H + LIBNET_IPV4_H + LIBNET_UDP_H + LIBNET_SEBEK_H +*/ length,
+	payload,
+	payload_s,
+	l,
+	0
+	);
+
+    ptag = libnet_build_udp(
+	port,                                      /* source port */
+	port,                                      /* destination port */
+	LIBNET_UDP_H + LIBNET_SEBEK_H + payload_s, /* packet length */
+	0,                                         /* checksum */
+	NULL,                                      /* payload */
+	0,                                         /* payload size */
+	l,                                         /* libnet handle */
+	0);                                        /* libnet id */
+
+    if (ptag == -1)
+    {
+	fprintf(stderr, "Can't build UDP header: %s\n", libnet_geterror(l));
+	goto bad;
+    }
+
+    ptag = libnet_build_ipv4(
+	LIBNET_IPV4_H + LIBNET_UDP_H + LIBNET_SEBEK_H + payload_s,/* length */
+	0,                                          /* TOS */
+	242,                                        /* IP ID */
+	0,                                          /* IP Frag */
+	64,                                         /* TTL */
+	IPPROTO_UDP,                                /* protocol */
+	0,                                          /* checksum */
+	src_ip,                                     /* source IP */
+	dst_ip,                                     /* destination IP */
+	NULL,                                       /* payload */
+	0,                                          /* payload size */
+	l,                                          /* libnet handle */
+	0);                                         /* libnet id */
+    
+    if (ptag == -1)
+    {
+	fprintf(stderr, "Can't build IP header: %s\n", libnet_geterror(l));
+	exit(EXIT_FAILURE);
+    }
+
+    
+    eth_dst = libnet_hex_aton(eth_dst, &c);
+    ptag = libnet_autobuild_ethernet(
+	eth_dst,                                /* ethernet destination */
+	ETHERTYPE_IP,                           /* protocol type */
+	l);                                     /* libnet handle */
+    free(eth_dst);
+    if (ptag == -1)
+    {
+        fprintf(stderr, "Can't build ethernet header: %s\n",
+                libnet_geterror(l));
+        goto bad;
+    }
+
+
+    /*
+     * write to the wire
+     */
+    c = libnet_write(l);
+    if (c == -1)
+    {
+        fprintf(stderr, "Write error: %s\n", libnet_geterror(l));
+        goto bad;
+    }
+    else
+    {
+        fprintf(stderr, "Wrote %d byte DNS packet; check the wire.\n", c);
+    }
+    libnet_destroy(l);
+    return (EXIT_SUCCESS);
+  bad:
+    libnet_destroy(l);
+    return (EXIT_FAILURE);
+
+    return 0;
+}
--- libnet/sample/Makefile.am	2004-03-10 10:18:25.000000000 +0100
+++ libnet-fr/sample/Makefile.am	2004-03-10 11:06:09.000000000 +0100
@@ -14,7 +14,7 @@
                   smurf dot1x dns rpc_tcp rpc_udp mpls icmp_timeexceed \
                   fddi_tcp1 fddi_tcp2 tring_tcp1 tring_tcp2 icmp_redirect \
                   bgp4_hdr bgp4_open bgp4_update bgp4_notification gre \
-                  synflood6_frag tftp ip_link ip_raw
+                  synflood6_frag tftp ip_link ip_raw sebek
 
 arp_SOURCES             = arp.c
 cdp_SOURCES             = cdp.c
@@ -58,6 +58,6 @@
 gre_SOURCES		= gre.c
 ip_raw_SOURCES          = ip_raw.c
 ip_link_SOURCES		= ip_link.c
-
+sebek_SOURCES           = sebek.c
 
 LDADD = $(top_srcdir)/src/libnet.a