Functions to forge and manipulate datalink layer frames. More...

#include "nasl_frame_forgery.h"
#include "../misc/bpf_share.h"
#include "../misc/pcap_openvas.h"
#include "../misc/plugutils.h"
#include "capture_packet.h"
#include "nasl_debug.h"
#include <errno.h>
#include <gvm/base/networking.h>
#include <linux/if_packet.h>
#include <net/ethernet.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <netinet/ether.h>
#include <netinet/if_ether.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <unistd.h>

Include dependency graph for nasl_frame_forgery.c:

Go to the source code of this file.

Data Structures
struct	pseudo_eth_arp

struct	pseudo_frame

Macros
#define	G_LOG_DOMAIN "lib misc"
	GLib logging domain. More...

Functions
struct pseudo_eth_arp	__attribute__ ((packed))

static void	dump_frame (const u_char *frame, int frame_sz)
	Dump a datalink layer frame. More...

static void	prepare_sockaddr_ll (struct sockaddr_ll soc_addr_ll, int ifindex, const u_char ether_dst_addr)
	Prepare message header to be sent with sendmsg(). More...

static void	prepare_message (u_char msg, struct sockaddr_ll soc_addr_ll, u_char *payload, int payload_sz)
	Prepare message header to be sent with sendmsg(). More...

static int	send_frame (const u_char frame, int frame_sz, int use_pcap, int timeout, char filter, struct in6_addr ipaddr, u_char *answer)
	Send a frame and listen to the answer. More...

static int	forge_frame (const u_char ether_src_addr, const u_char ether_dst_addr, int ether_proto, u_char payload, int payload_sz, struct pseudo_frame *frame)
	Forge a datalink layer frame. More...

tree_cell *	nasl_forge_frame (lex_ctxt *lexic)
	Forge a datalink layer frame. More...

tree_cell *	nasl_send_frame (lex_ctxt *lexic)
	Send a frame and listen to the answer. More...

tree_cell *	nasl_dump_frame (lex_ctxt *lexic)
	Dump a datalink layer frame. More...

static int	get_local_mac_address_from_ip (char ip_address, u_char mac)
	Get the MAC address of host. More...

tree_cell *	nasl_get_local_mac_address_from_ip (lex_ctxt *lexic)
	Get the MAC address of host. More...

tree_cell *	nasl_send_arp_request (lex_ctxt *lexic)
	Send an arp request to an IP host. More...

Variables
struct arphdr	arp_header

u_char	__ar_sha [ETH_ALEN]

u_char	__ar_sip [4]

u_char	__ar_tha [ETH_ALEN]

u_char	__ar_tip [4]

u_char	__zero_padding [18]

struct ethhdr	framehdr

u_char *	payload

Detailed Description

Functions to forge and manipulate datalink layer frames.

Definition in file nasl_frame_forgery.c.

Macro Definition Documentation

◆ G_LOG_DOMAIN

#define G_LOG_DOMAIN "lib misc"

GLib logging domain.

Definition at line 38 of file nasl_frame_forgery.c.

Function Documentation

◆ attribute()

struct pseudo_eth_arp __attribute__ ( (packed) )

◆ dump_frame()

static void dump_frame	(	const u_char *	frame,
		int	frame_sz
	)

static

Dump a datalink layer frame.

Parameters

frame	The frame to be dumped.
frame_sz	The frame's size.

Definition at line 63 of file nasl_frame_forgery.c.

 {
   int f = 0;
  
   printf ("\nThe Frame:\n");
   while (f < frame_sz)
     {
       printf ("%02x%02x ", ((u_char *) frame)[f], ((u_char *) frame)[f + 1]);
       f += 2;
       if (f % 16 == 0)
         printf ("\n");
     }
   printf ("\n\n");
 }

Referenced by nasl_dump_frame().

Here is the caller graph for this function:

◆ forge_frame()

static int forge_frame	(	const u_char *	ether_src_addr,
		const u_char *	ether_dst_addr,
		int	ether_proto,
		u_char *	payload,
		int	payload_sz,
		struct pseudo_frame **	frame
	)

static

Forge a datalink layer frame.

Parameters

[in]	src_haddr	Source MAC address to use.
[in]	dst_haddr	Destination MAC address to use.
[in]	ether_proto	Ethernet type integer in hex format. Default 0x0800 (ETHER_P_IP)
[in]	payload	Payload to be attached to the frame. E.g a forged tcp datagram, or arp header
[out]	frame	the forge frame

Returns: the forged frame size.

Definition at line 230 of file nasl_frame_forgery.c.

 {
   int frame_sz;
  
   *frame = (struct pseudo_frame *) g_malloc0 (sizeof (struct pseudo_frame)
                                               + payload_sz);
  
   memcpy ((*frame)->framehdr.h_dest, ether_dst_addr, ETHER_ADDR_LEN);
   memcpy ((*frame)->framehdr.h_source, ether_src_addr, ETHER_ADDR_LEN);
   (*frame)->framehdr.h_proto = htons (ether_proto);
   (*frame)->payload = payload;
  
   frame_sz = ETH_HLEN + payload_sz;
   memcpy ((char *) *frame + ETH_HLEN, payload, payload_sz);
  
   return frame_sz;
 }

References payload.

Referenced by nasl_forge_frame(), and nasl_send_arp_request().

Here is the caller graph for this function:

◆ get_local_mac_address_from_ip()

static int get_local_mac_address_from_ip	(	char *	ip_address,
		u_char *	mac
	)

static

Get the MAC address of host.

Parameters

[in]	ip_address	Local IP address
[out]	mac	The MAC address

Returns: 0 on success. MAC address is put into buffer. -1 on error.

Definition at line 389 of file nasl_frame_forgery.c.

 {
   struct ifreq ifr;
   int sock;
   char *if_name = NULL;
  
   if_name = get_iface_from_ip (ip_address);
   if (!if_name)
     {
       g_debug ("%s: Missing interface name", __func__);
       return -1;
     }
  
   strncpy (ifr.ifr_name, if_name, sizeof (ifr.ifr_name) - 1);
   g_free (if_name);
   ifr.ifr_name[sizeof (ifr.ifr_name) - 1] = '\0';
  
   sock = socket (PF_INET, SOCK_STREAM, 0);
   if (-1 == sock)
     {
       perror ("socket() ");
       return -1;
     }
  
   if (-1 == ioctl (sock, SIOCGIFHWADDR, &ifr))
     {
       g_debug ("%s: ioctl(SIOCGIFHWADDR)", __func__);
       return -1;
     }
  
   memcpy (mac, (u_char *) ifr.ifr_hwaddr.sa_data, ETHER_ADDR_LEN);
   close (sock);
  
   return 0;
 }

References get_iface_from_ip(), and mac().

Referenced by nasl_get_local_mac_address_from_ip(), and nasl_send_arp_request().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ nasl_dump_frame()

tree_cell* nasl_dump_frame ( lex_ctxt * lexic )

Dump a datalink layer frame.

@naslparam

frame The frame to be dumped.

Parameters

lexic Lexical context of NASL interpreter.

Returns: Null

Definition at line 363 of file nasl_frame_forgery.c.

 {
   u_char *frame = (u_char *) get_str_var_by_name (lexic, "frame");
   int frame_sz = get_var_size_by_name (lexic, "frame");
  
   if (frame == NULL || frame_sz <= 0)
     {
       nasl_perror (lexic, "%s usage: frame is a mandatory parameters.\n",
                    __func__);
       return NULL;
     }
  
   dump_frame (frame, frame_sz);
   return NULL;
 }

References dump_frame(), get_str_var_by_name(), get_var_size_by_name(), and nasl_perror().

Here is the call graph for this function:

◆ nasl_forge_frame()

tree_cell* nasl_forge_frame ( lex_ctxt * lexic )

Forge a datalink layer frame.

@naslparams

src_haddr Source MAC address to use.
dst_haddr Destination MAC address to use.
ether_proto Ethernet type integer in hex format. Default 0x0800 (ETHER_P_IP)
payload Payload to be attached to the frame. E.g a forged tcp datagram.
@naslreturn the forged frame.

Parameters

lexic Lexical context of NASL interpreter.

Returns: tree_cell element or null.

Definition at line 268 of file nasl_frame_forgery.c.

 {
   tree_cell *retc;
   struct pseudo_frame *frame;
   int frame_sz;
   u_char *payload = (u_char *) get_str_var_by_name (lexic, "payload");
   int payload_sz = get_var_size_by_name (lexic, "payload");
   char *ether_src_addr = get_str_var_by_name (lexic, "src_haddr");
   char *ether_dst_addr = get_str_var_by_name (lexic, "dst_haddr");
   int ether_proto = get_int_var_by_name (lexic, "ether_proto", 0x0800);
  
   if (ether_src_addr == NULL || ether_dst_addr == NULL || payload == NULL)
     {
       nasl_perror (lexic,
                    "%s usage: payload, src_haddr and dst_haddr are mandatory "
                    "parameters.\n",
                    __func__);
       return NULL;
     }
  
   frame_sz = forge_frame ((u_char *) ether_src_addr, (u_char *) ether_dst_addr,
                           ether_proto, payload, payload_sz, &frame);
  
   retc = alloc_typed_cell (CONST_DATA);
   retc->x.str_val = (char *) frame;
   retc->size = frame_sz;
   return retc;
 }

References alloc_typed_cell(), CONST_DATA, forge_frame(), get_int_var_by_name(), get_str_var_by_name(), get_var_size_by_name(), nasl_perror(), payload, TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

◆ nasl_get_local_mac_address_from_ip()

tree_cell* nasl_get_local_mac_address_from_ip ( lex_ctxt * lexic )

Get the MAC address of host.

@naslparam

ip_address Local IP address

@naslreturn The MAC address of the host. NULL otherwise

Parameters

[in] lexic Lexical context of NASL interpreter.

Definition at line 438 of file nasl_frame_forgery.c.

 {
   tree_cell *retc = NULL;
   char *buffer = NULL;
   u_char *mac;
  
   char *ip_address = get_str_var_by_num (lexic, 0);
  
   mac = g_malloc0 (sizeof (u_char) * ETHER_ADDR_LEN);
   get_local_mac_address_from_ip (ip_address, mac);
   if (mac != NULL)
     {
       buffer = g_strdup_printf ("%02x:%02x:%02x:%02x:%02x:%02x", mac[0], mac[1],
                                 mac[2], mac[3], mac[4], mac[5]);
       g_free (mac);
       retc = alloc_typed_cell (CONST_DATA);
       retc->x.str_val = buffer;
       retc->size = 17;
     }
  
   return retc;
 }

References alloc_typed_cell(), CONST_DATA, get_local_mac_address_from_ip(), get_str_var_by_num(), mac(), TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

◆ nasl_send_arp_request()

tree_cell* nasl_send_arp_request ( lex_ctxt * lexic )

Send an arp request to an IP host.

NASL Returns:\n The MAC address of the target. NULL otherwise

Parameters

[in] lexic Lexical context of NASL interpreter.

Returns: A tree cell or NULL.

Definition at line 471 of file nasl_frame_forgery.c.

 {
   tree_cell *retc = NULL;
   struct in6_addr src, *dst = plug_get_host_ip (lexic->script_infos);
   struct in_addr dst_inaddr, src_inaddr;
   struct pseudo_eth_arp eth_arp;
   struct pseudo_frame *frame;
   int frame_sz;
   char ip_src_str[INET6_ADDRSTRLEN];
   u_char mac_broadcast_addr[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
   u_char mac[6], *mac_aux;
   char filter[255];
   u_char *answer = NULL;
   int answer_sz;
   int to = get_int_var_by_name (lexic, "pcap_timeout", 5);
  
   /* Get source IP address via routethrough. We need it to find our mac address.
    */
   if (dst == NULL || (IN6_IS_ADDR_V4MAPPED (dst) != 1))
     return retc;
  
   memset (&dst_inaddr, '\0', sizeof (struct in_addr));
   dst_inaddr.s_addr = dst->s6_addr32[3];
   routethrough (&dst_inaddr, &src_inaddr);
   ipv4_as_ipv6 (&src_inaddr, &src);
  
   /* Getting target IP address  as string, to get the mac address */
   addr6_to_str (&src, ip_src_str);
  
   mac_aux = (u_char *) g_malloc0 (sizeof (u_char) * 6);
   get_local_mac_address_from_ip (ip_src_str, mac_aux);
   mac[0] = mac_aux[0];
   mac[1] = mac_aux[1];
   mac[2] = mac_aux[2];
   mac[3] = mac_aux[3];
   mac[4] = mac_aux[4];
   mac[5] = mac_aux[5];
   g_free (mac_aux);
  
   /* Building ARP header */
   memset (&eth_arp, '\0', sizeof (struct pseudo_eth_arp));
   eth_arp.arp_header.ar_hrd = htons (ARPHRD_ETHER);
   eth_arp.arp_header.ar_pro = htons (ETHERTYPE_IP);
   eth_arp.arp_header.ar_hln = ETH_ALEN;
   eth_arp.arp_header.ar_pln = 4;
   eth_arp.arp_header.ar_op = htons (ARPOP_REQUEST);
  
   memcpy (&(eth_arp.__ar_sha), mac, ETH_ALEN);
   memcpy (&(eth_arp.__ar_sip), &src_inaddr, 4);
   memcpy (&(eth_arp.__ar_tha), mac_broadcast_addr, ETH_ALEN);
   memcpy (&(eth_arp.__ar_tip), &dst_inaddr, 4);
  
   frame_sz =
     forge_frame (mac, mac_broadcast_addr, ETH_P_ARP, (u_char *) &eth_arp,
                  sizeof (struct pseudo_eth_arp), &frame);
  
   /* Prepare filter */
   snprintf (filter, sizeof (filter), "arp and src host %s",
             inet_ntoa (dst_inaddr));
  
   answer_sz =
     send_frame ((const u_char *) frame, frame_sz, 1, to, filter, dst, &answer);
   g_free (frame);
   if (answer_sz == -2)
     {
       g_message ("%s: Not possible to send the frame", __func__);
       return NULL;
     }
  
   if (answer && answer_sz > -1)
     {
       char *daddr;
       struct ether_header *answer_aux;
  
       answer_aux = (struct ether_header *) answer;
       daddr = g_strdup_printf (
         "%02x:%02x:%02x:%02x:%02x:%02x", (u_int) answer_aux->ether_shost[0],
         (u_int) answer_aux->ether_shost[1], (u_int) answer_aux->ether_shost[2],
         (u_int) answer_aux->ether_shost[3], (u_int) answer_aux->ether_shost[4],
         (u_int) answer_aux->ether_shost[5]);
  
       retc = alloc_typed_cell (CONST_DATA);
       retc->x.str_val = daddr;
       retc->size = strlen (daddr);
     }
   else
     g_debug ("%s: No answer received.", __func__);
  
   return retc;
 }

References pseudo_eth_arp::__ar_sha, pseudo_eth_arp::__ar_sip, pseudo_eth_arp::__ar_tha, pseudo_eth_arp::__ar_tip, alloc_typed_cell(), pseudo_eth_arp::arp_header, CONST_DATA, daddr, forge_frame(), get_int_var_by_name(), get_local_mac_address_from_ip(), mac(), plug_get_host_ip(), routethrough(), struct_lex_ctxt::script_infos, send_frame(), TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

◆ nasl_send_frame()

tree_cell* nasl_send_frame ( lex_ctxt * lexic )

Send a frame and listen to the answer.

@naslparams

frame The frame to be sent.
pcap_active TRUE by default. Otherwise, NASL does not listen for the answers.
pcap_filter BPF filter.
pcap_timeout Capture timeout. 5 by default.
@naslreturn Sniffed answer.

Parameters

lexic Lexical context of NASL interpreter.

Returns: tree_cell element or null.

Definition at line 314 of file nasl_frame_forgery.c.

 {
   tree_cell *retc = NULL;
   struct script_infos *script_infos = lexic->script_infos;
   struct in6_addr *ipaddr = plug_get_host_ip (script_infos);
   u_char *frame = (u_char *) get_str_var_by_name (lexic, "frame");
   int frame_sz = get_var_size_by_name (lexic, "frame");
   int use_pcap = get_int_var_by_name (lexic, "pcap_active", 1);
   int to = get_int_var_by_name (lexic, "pcap_timeout", 5);
   char *filter = get_str_var_by_name (lexic, "pcap_filter");
   u_char *answer = NULL;
   int answer_sz;
  
   if (frame == NULL || frame_sz <= 0)
     {
       nasl_perror (lexic, "%s usage: frame is a mandatory parameters.\n",
                    __func__);
       return NULL;
     }
  
   answer_sz =
     send_frame (frame, frame_sz, use_pcap, to, filter, ipaddr, &answer);
   if (answer_sz == -2)
     {
       g_message ("%s: Not possible to send the frame", __func__);
       return NULL;
     }
  
   if (answer && answer_sz > -1)
     {
       retc = alloc_typed_cell (CONST_DATA);
       retc->x.str_val = (char *) answer;
       retc->size = answer_sz;
     }
  
   return retc;
 }

References alloc_typed_cell(), CONST_DATA, get_int_var_by_name(), get_str_var_by_name(), get_var_size_by_name(), nasl_perror(), plug_get_host_ip(), struct_lex_ctxt::script_infos, send_frame(), TC::size, TC::str_val, and TC::x.

Here is the call graph for this function:

◆ prepare_message()

static void prepare_message	(	u_char *	msg,
		struct sockaddr_ll *	soc_addr_ll,
		u_char *	payload,
		int	payload_sz
	)

static

Prepare message header to be sent with sendmsg().

Parameters

[out]	msg	The packaged messages to be sent
[in]	soc_addr_ll	The sockaddr_ll structure for capturing
[in]	payload	The payload, a datalink layer frame with payload
[in]	payload_sz	The payload size.

Definition at line 103 of file nasl_frame_forgery.c.

 {
   struct iovec iov;
   struct msghdr *message;
  
   iov.iov_base = payload;
   iov.iov_len = payload_sz;
  
   message = g_malloc0 (sizeof (struct msghdr) + payload_sz);
  
   message->msg_name = soc_addr_ll;
   message->msg_namelen = sizeof (struct sockaddr_ll);
   message->msg_iov = &iov;
   message->msg_iovlen = 1;
   message->msg_control = 0;
   message->msg_controllen = 0;
  
   memcpy (msg, (u_char *) message, sizeof (struct msghdr) + payload_sz);
   g_free (message);
 }

References payload.

Referenced by send_frame().

Here is the caller graph for this function:

◆ prepare_sockaddr_ll()

static void prepare_sockaddr_ll	(	struct sockaddr_ll *	soc_addr_ll,
		int	ifindex,
		const u_char *	ether_dst_addr
	)

static

Prepare message header to be sent with sendmsg().

Parameters

[out]	soc_addr_ll	The sockaddr_ll structure to be prepared
[in]	ifindex	The interface index to be use for capturing.
[in]	ether_dst_addr	The dst MAC address.

Definition at line 85 of file nasl_frame_forgery.c.

 {
   soc_addr_ll->sll_family = AF_PACKET;
   soc_addr_ll->sll_ifindex = ifindex;
   soc_addr_ll->sll_halen = ETHER_ADDR_LEN;
   soc_addr_ll->sll_protocol = htons (ETH_P_ALL);
   memcpy (soc_addr_ll->sll_addr, ether_dst_addr, ETHER_ADDR_LEN);
 }

Referenced by send_frame().

Here is the caller graph for this function:

◆ send_frame()

static int send_frame	(	const u_char *	frame,
		int	frame_sz,
		int	use_pcap,
		int	timeout,
		char *	filter,
		struct in6_addr *	ipaddr,
		u_char **	answer
	)

static

Send a frame and listen to the answer.

Parameters

[in]

Definition at line 141 of file nasl_frame_forgery.c.

 {
   int soc;
   u_char *message;
   int ifindex;
   int bpf = -1;
   int frame_and_payload = 0;
   int answer_sz = -1;
  
   // Create the raw socket
   soc = socket (AF_PACKET, SOCK_RAW, htons (ETH_P_ALL));
   if (soc == -1)
     {
       g_debug ("%s: %s", __func__, strerror (errno));
       return -1;
     }
  
   // We will need the eth index. We get it depending on the target's IP..
   if (get_iface_index (ipaddr, &ifindex) < 0)
     {
       g_message ("%s: Missing interface index\n", __func__);
       return -1;
     }
  
   // Prepare sockaddr_ll. This is necessary for further captures
   u_char dst_haddr[ETHER_ADDR_LEN];
   memcpy (&dst_haddr, (struct pseudo_frame *) frame, ETHER_ADDR_LEN);
  
   struct sockaddr_ll soc_addr;
   memset (&soc_addr, '\0', sizeof (struct sockaddr_ll));
   prepare_sockaddr_ll (&soc_addr, ifindex, dst_haddr);
  
   /* Init capture */
   if (use_pcap != 0 && bpf < 0)
     {
       if (IN6_IS_ADDR_V4MAPPED (ipaddr))
         {
           struct in_addr sin, this_host;
           memset (&sin, '\0', sizeof (struct in_addr));
           memset (&this_host, '\0', sizeof (struct in_addr));
           sin.s_addr = ipaddr->s6_addr32[3];
           bpf = init_capture_device (sin, this_host, filter);
         }
       else
         {
           struct in6_addr this_host;
           memset (&this_host, '\0', sizeof (struct in6_addr));
           bpf = init_v6_capture_device (*ipaddr, this_host, filter);
         }
     }
  
   // Prepare the message and send it
   message = g_malloc0 (sizeof (struct msghdr) + frame_sz);
   prepare_message (message, &soc_addr, (u_char *) frame, frame_sz);
  
   int b = sendmsg (soc, (struct msghdr *) message, 0);
   g_free (message);
   if (b == -1)
     {
       g_message ("%s: Error sending message: %s", __func__, strerror (errno));
       return -2;
     }
   if (bpf >= 0)
     {
       *answer = (u_char *) capture_next_frame (bpf, timeout, &answer_sz,
                                                frame_and_payload);
       bpf_close (bpf);
       close (soc);
       return answer_sz;
     }
  
   close (soc);
   return 0;
 }

References bpf_close(), capture_next_frame(), get_iface_index(), init_capture_device(), init_v6_capture_device(), prepare_message(), and prepare_sockaddr_ll().

Referenced by nasl_send_arp_request(), and nasl_send_frame().

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

◆ __ar_sha

u_char __ar_sha[ETH_ALEN]

Definition at line 1 of file nasl_frame_forgery.c.

◆ __ar_sip

u_char __ar_sip[4]

Definition at line 2 of file nasl_frame_forgery.c.

◆ __ar_tha

u_char __ar_tha[ETH_ALEN]

Definition at line 3 of file nasl_frame_forgery.c.

◆ __ar_tip

u_char __ar_tip[4]

Definition at line 4 of file nasl_frame_forgery.c.

◆ __zero_padding

u_char __zero_padding[18]

Definition at line 5 of file nasl_frame_forgery.c.

◆ arp_header

struct arphdr arp_header

Definition at line 47 of file nasl_frame_forgery.c.

◆ framehdr

struct ethhdr framehdr

Definition at line 53 of file nasl_frame_forgery.c.

◆ payload

u_char* payload

Definition at line 1 of file nasl_frame_forgery.c.

Referenced by forge_frame(), nasl_forge_frame(), prepare_message(), and run_table_driven_lsc().

Data Structures

Macros

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ G_LOG_DOMAIN

Function Documentation

◆ __attribute__()

◆ dump_frame()

◆ forge_frame()

◆ get_local_mac_address_from_ip()

◆ nasl_dump_frame()

◆ nasl_forge_frame()

◆ nasl_get_local_mac_address_from_ip()

◆ nasl_send_arp_request()

◆ nasl_send_frame()

◆ prepare_message()

◆ prepare_sockaddr_ll()

◆ send_frame()

Variable Documentation

◆ __ar_sha

◆ __ar_sip

◆ __ar_tha

◆ __ar_tip

◆ __zero_padding

◆ arp_header

◆ framehdr

◆ payload

◆ attribute()