masscan-mark-ii/src/stack-arpv4.c

/*
    handle ARP

    Usage #1:
        At startup, we make a synchronous request for the local router.
        We'll wait several seconds for a response, but abort the program
        if we don't receive a response.

    Usage #2:
        While running, we'll need to respond to ARPs. That's because we
        may be bypassing the stack of the local machine with a "spoofed"
        IP address. Every so often, the local router may drop it's route
        entry and re-request our address.
*/
#include "rawsock.h"
#include "rawsock-adapter.h"
#include "stack-src.h"
#include "stack-arpv4.h"
#include "stack-queue.h"
#include "util-safefunc.h"
#include "util-logger.h"
#include "pixie-timer.h"
#include "proto-preprocess.h"
#include "util-checksum.h"

#define VERIFY_REMAINING(n) if (offset+(n) > max) return;

/**
 * A structure representing the information parsed from an incoming
 * ARP packet. Note: unlike normal programming style, this isn't
 * overlayed on the incoming ARP header, but instead each field
 * is parsed one-by-one and converted into this internal structure.
 */
struct ARP_IncomingRequest
{
    unsigned is_valid;
    unsigned opcode;
    unsigned hardware_type;
    unsigned protocol_type;
    unsigned hardware_length;
    unsigned protocol_length;
    unsigned ip_src;
    unsigned ip_dst;
    const unsigned char *mac_src;
    const unsigned char *mac_dst;
};


/****************************************************************************
 ****************************************************************************/
static void
proto_arp_parse(struct ARP_IncomingRequest *arp,
                const unsigned char px[], unsigned offset, unsigned max)
{

    /*
     * parse the header
     */
    VERIFY_REMAINING(8);
    arp->is_valid = 0; /* not valid yet */

    arp->hardware_type = px[offset]<<8 | px[offset+1];
    arp->protocol_type = px[offset+2]<<8 | px[offset+3];
    arp->hardware_length = px[offset+4];
    arp->protocol_length = px[offset+5];
    arp->opcode = px[offset+6]<<8 | px[offset+7];
    offset += 8;

    /* We only support IPv4 and Ethernet addresses */
    if (arp->protocol_length != 4 && arp->hardware_length != 6)
        return;
    if (arp->protocol_type != 0x0800)
        return;
    if (arp->hardware_type != 1 && arp->hardware_type != 6)
        return;

    /*
     * parse the addresses
     */
    VERIFY_REMAINING(2 * arp->hardware_length + 2 * arp->protocol_length);
    arp->mac_src = px+offset;
    offset += arp->hardware_length;

    arp->ip_src = px[offset+0]<<24 | px[offset+1]<<16 | px[offset+2]<<8 | px[offset+3];
    offset += arp->protocol_length;

    arp->mac_dst = px+offset;
    offset += arp->hardware_length;

    arp->ip_dst = px[offset+0]<<24 | px[offset+1]<<16 | px[offset+2]<<8 | px[offset+3];
    //offset += arp->protocol_length;

    arp->is_valid = 1;
}


/****************************************************************************
 * Resolve the IP address into a MAC address. Do this synchronously, meaning,
 * we'll stop and wait for the response. This is done at program startup,
 * but not during then normal asynchronous operation during the scan.
 ****************************************************************************/
int
stack_arp_resolve(struct Adapter *adapter,
    ipv4address_t my_ipv4, macaddress_t my_mac_address,
    ipv4address_t your_ipv4, macaddress_t *your_mac_address)
{
    unsigned char xarp_packet[64];
    unsigned char *arp_packet = &xarp_packet[0];
    unsigned i;
    time_t start;
    unsigned is_arp_notice_given = 0;
    struct ARP_IncomingRequest response;
    int is_delay_reported = 0;

    /*
     * [KLUDGE]
     *  If this is a VPN connection
     */
    if (stack_if_datalink(adapter) == 12) {
        memcpy(your_mac_address->addr, "\0\0\0\0\0\2", 6);
        return 0; /* success */
    }

    memset(&response, 0, sizeof(response));

    /* zero out bytes in packet to avoid leaking stuff in the padding
     * (ARP is 42 byte packet, Ethernet is 60 byte minimum) */
    memset(arp_packet, 0, sizeof(xarp_packet));

    /*
     * Create the request packet
     */
    memcpy(arp_packet +  0, "\xFF\xFF\xFF\xFF\xFF\xFF", 6);
    memcpy(arp_packet +  6, my_mac_address.addr, 6);
    
    if (adapter->is_vlan) {
        memcpy(arp_packet + 12, "\x81\x00", 2);
        arp_packet[14] = (unsigned char)(adapter->vlan_id>>8);
        arp_packet[15] = (unsigned char)(adapter->vlan_id&0xFF);
        arp_packet += 4;
    }
    
    memcpy(arp_packet + 12, "\x08\x06", 2);

    
    memcpy(arp_packet + 14,
            "\x00\x01" /* hardware = Ethernet */
            "\x08\x00" /* protocol = IPv4 */
            "\x06\x04" /* MAC length = 6, IPv4 length = 4 */
            "\x00\x01" /* opcode = request */
            , 8);

    memcpy(arp_packet + 22, my_mac_address.addr, 6);
    arp_packet[28] = (unsigned char)(my_ipv4 >> 24);
    arp_packet[29] = (unsigned char)(my_ipv4 >> 16);
    arp_packet[30] = (unsigned char)(my_ipv4 >>  8);
    arp_packet[31] = (unsigned char)(my_ipv4 >>  0);

    memcpy(arp_packet + 32, "\x00\x00\x00\x00\x00\x00", 6);
    arp_packet[38] = (unsigned char)(your_ipv4 >> 24);
    arp_packet[39] = (unsigned char)(your_ipv4 >> 16);
    arp_packet[40] = (unsigned char)(your_ipv4 >>  8);
    arp_packet[41] = (unsigned char)(your_ipv4 >>  0);


    /* Kludge: handle VLNA header if it exists. This is probably
     * the wrong way to handle this. */
    if (adapter->is_vlan)
        arp_packet -= 4;
    
    /*
     * Now loop for a few seconds looking for the response
     */
    rawsock_send_packet(adapter, arp_packet, 60, 1);
    start = time(0);
    i = 0;
    for (;;) {
        unsigned length;
        unsigned secs;
        unsigned usecs;
        const unsigned char *px;
        int err;

        if (time(0) != start) {
            start = time(0);
            rawsock_send_packet(adapter, arp_packet, 60, 1);
            if (i++ >= 10)
                break; /* timeout */

            /* It's taking too long, so notify the user */
            if (!is_delay_reported) {
                ipaddress_formatted_t fmt = ipv4address_fmt(your_ipv4);
                LOG(0, "[+] resolving router %s with ARP (may take some time)...\n", fmt.string);
                is_delay_reported = 1;
            }
        }

        /* If we aren't getting a response back to our ARP, then print a
         * status message */
        if (time(0) > start+1 && !is_arp_notice_given) {
            ipaddress_formatted_t fmt = ipv4address_fmt(your_ipv4);
            LOG(0, "[+] arping local router %s\n", fmt.string);
            is_arp_notice_given = 1;
        }

        err =  rawsock_recv_packet(
                    adapter,
                    &length,
                    &secs,
                    &usecs,
                    &px);

        if (err != 0)
            continue;

        if (adapter->is_vlan && px[17] != 6)
            continue;
        if (!adapter->is_vlan && px[13] != 6)
            continue;


        /*
         * Parse the response as an ARP packet
         */
        if (adapter->is_vlan)
            proto_arp_parse(&response, px, 18, length);
        else
            proto_arp_parse(&response, px, 14, length);

        /* Is this an ARP packet? */
        if (!response.is_valid) {
            LOG(2, "[-] arp: etype=0x%04x, not ARP\n", px[12]*256 + px[13]);
            continue;
        }

        /* Is this an ARP "reply"? */
        if (response.opcode != 2) {
            LOG(2, "[-] arp: opcode=%u, not reply(2)\n", response.opcode);
            continue;
        }

        /* Is this response directed at us? */
        if (response.ip_dst != my_ipv4) {
            LOG(2, "[-] arp: dst=%08x, not my ip 0x%08x\n", response.ip_dst, my_ipv4);
            continue;
        }
        if (memcmp(response.mac_dst, my_mac_address.addr, 6) != 0)
            continue;

        /* Is this the droid we are looking for? */
        if (response.ip_src != your_ipv4) {
            ipaddress_formatted_t fmt1 = ipv4address_fmt(response.ip_src);
            ipaddress_formatted_t fmt2 = ipv4address_fmt(your_ipv4);
            LOG(2, "[-] arp: target=%s, not desired %s\n", fmt1.string, fmt2.string);
            continue;
        }

        /*
         * GOT IT!
         *  we've got a valid response, so save the results and
         *  return.
         */
        memcpy(your_mac_address->addr, response.mac_src, 6);
        {
            ipaddress_formatted_t fmt1 = ipv4address_fmt(response.ip_src);
            ipaddress_formatted_t fmt2 = macaddress_fmt(*your_mac_address);
            LOG(1, "[+] arp: %s == %s\n", fmt1.string, fmt2.string);
        }
        return 0;
    }

    return 1;
}

    


/****************************************************************************
 * Handle an incoming ARP request.
 ****************************************************************************/
int
stack_arp_incoming_request( struct stack_t *stack,
    ipv4address_t my_ip, macaddress_t my_mac,
    const unsigned char *px, unsigned length)
{
    struct PacketBuffer *response = 0;
    struct ARP_IncomingRequest request;

    memset(&request, 0, sizeof(request));


    /* Get a buffer for sending the response packet. This thread doesn't
     * send the packet itself. Instead, it formats a packet, then hands
     * that packet off to a transmit thread for later transmission. */
    response = stack_get_packetbuffer(stack);
    if (response == NULL)
        return -1;

    /* ARP packets are too short, so increase the packet size to
     * the Ethernet minimum */
    response->length = 60;

    /* Fill the padded area with zeroes to avoid leaking data */
    memset(response->px, 0, response->length);

    /*
     * Parse the response as an ARP packet
     */
    proto_arp_parse(&request, px, 14, length);

    /* Is this an ARP packet? */
    if (!request.is_valid) {
        LOG(2, "arp: etype=0x%04x, not ARP\n", px[12]*256 + px[13]);
        return -1;
    }

    /* Is this an ARP "request"? */
    if (request.opcode != 1) {
        LOG(2, "arp: opcode=%u, not request(1)\n", request.opcode);
        return -1;
    }

    /* Is this response directed at us? */
    if (request.ip_dst != my_ip) {
        LOG(2, "arp: dst=%08x, not my ip 0x%08x\n", request.ip_dst, my_ip);
        return -1;
    }

    /*
     * Create the response packet
     */
    memcpy(response->px +  0, request.mac_src, 6);
    memcpy(response->px +  6, my_mac.addr, 6);
    memcpy(response->px + 12, "\x08\x06", 2);

    memcpy(response->px + 14,
            "\x00\x01" /* hardware = Ethernet */
            "\x08\x00" /* protocol = IPv4 */
            "\x06\x04" /* MAC length = 6, IPv4 length = 4 */
            "\x00\x02" /* opcode = reply(2) */
            , 8);

    memcpy(response->px + 22, my_mac.addr, 6);
    response->px[28] = (unsigned char)(my_ip >> 24);
    response->px[29] = (unsigned char)(my_ip >> 16);
    response->px[30] = (unsigned char)(my_ip >>  8);
    response->px[31] = (unsigned char)(my_ip >>  0);

    memcpy(response->px + 32, request.mac_src, 6);
    response->px[38] = (unsigned char)(request.ip_src >> 24);
    response->px[39] = (unsigned char)(request.ip_src >> 16);
    response->px[40] = (unsigned char)(request.ip_src >>  8);
    response->px[41] = (unsigned char)(request.ip_src >>  0);


    /*
     * Now queue the packet up for transmission
     */
    stack_transmit_packetbuffer(stack, response);

    return 0;
}