/*
 * Nagini v0.01 - simple TCP packetlogger by sacrine
 * .. 1 kleine neger ..
 * NETRIC SECURITY 2003
 * 
 * includes:
 *  - Log functionality
 *  - Can run in background
 *  
 * More options will be included in (if it depends on me) next versions
 * 
 * <cliche>
 * 
 * Special Thanks go to:
 * gloomy, eSDee, ilja, ntronic
 * 
 * Greets:
 * atje, The_Itch, ThePike, Laurens, powerpork,
 * psycoder, Remy, {}, Scrippie and whole #netric :)
 * 
 * </cliche>
 * 
 * If there are any questions/remarks or even bugs that you discovered,
 * Please mail me at sacrine@netric.org
 * 
 * Weetjes en Nieuwtjes:
 * 
 *  - Je bent gespuis als je niet af en toe samba(l) eet
 *  - The_Itch stemt SP
 *  - soul en gloomy zijn tegen een jointje op Rock Werchter
 *  - atje is gestopt met drinken
 *  - Xatr0z heeft wel degelijk de nederlandse nationaliteit
 *  
 * Volgende keer weer meer nieuwtjes en weetjes uit Netric land,
 * Tot ziens ;)
 * 
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>
#include <netdb.h>
#include <signal.h>
#include <errno.h>
#include <fcntl.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <getopt.h>
#include <linux/ip.h>
#include <linux/tcp.h>

#define LOG_SIZE  50
#define JUNK_SIZE 1024
#define BUF_SIZE  1024
#define PCKT_SIZE 65535

#define VERSION "Nagini v0.01"
#define BACKGROUND 0

struct
  pckts_list
{
   char p_size[PCKT_SIZE];
   int bytes;
   int from_lenght;
   struct iphdr  *ip;
   struct tcphdr *tcp;
} pckts;

struct
  ip_list
{
   unsigned int		ip_lenght:4;
   unsigned int		ip_version:4;
   unsigned char	ip_tos;
   unsigned short       ip_total_lenght;
   unsigned short       ip_id;
   unsigned short       ip_flags;
   unsigned char        ip_ttl;
   unsigned char        ip_protocol;
   unsigned short       ip_cksum;
   unsigned int   	ip_source;
} ip;

struct
  tcp_list
{
   unsigned short	tcp_source_port;
   unsigned short	tcp_dest_port;
   unsigned int     	tcp_seqno;
   unsigned int		tcp_ackno;
   unsigned int		tcp_res1:4,
			tcp_hlen:4,
			tcp_fin:1,
			tcp_syn:1,
			tcp_rst:1,
			tcp_psh:1,
			tcp_ack:1,
			tcp_urg:1,
			tcp_res2:2;
   unsigned short	tcp_winsize;
   unsigned short	tcp_cksum;
   unsigned short	tcp_urgent;
} tcp;

int 
  bground(void)
{
   pid_t dummy;
   int fdescr;
   int vorkje;

   if((dummy = getppid()) != 1)
     {
	signal(SIGTTOU, SIG_IGN);
	signal(SIGTTIN, SIG_IGN);
	signal(SIGTSTP, SIG_IGN);
	
	vorkje = fork();
	
	if(vorkje < 0)
	  {
	     perror("fork()");
	     exit(-1);
	  }
	if(vorkje > 0)
	  {
	     fprintf(stdout,"[+] Now running in background.. pid=[%u]\n\n",vorkje);
	     exit(0);
	  }
	setpgrp();
	fdescr=open("/dev/tty", O_RDWR);
	if(fdescr >= 0)
	  {
	     ioctl(fdescr, TIOCNOTTY, (char *)NULL);
	     close(fdescr);
	  }
     }
   for(fdescr = 0;fdescr < 1024;fdescr++) 
   errno = 0;
   chdir("/");
   umask(0);
}
   
void 
  usage(char *x)
{
   fprintf(stdout,"Usage: %s [l:Bvh]\n"
	   "\t-l\t-\tspecified logfile\n"
	   "\t-B\t-\trun in background\n"
	   "\t-v\t-\tdisplay version info\n"
	   "\t-h\t-\tshows this help function\n\n",x);
   exit(0);
}

int 
  main(int c, char *v[])
{
   char pfile[LOG_SIZE];
   int opts;
   int sock;
   FILE *LOG=NULL;
   static char junk[JUNK_SIZE];
   static char buf[BUF_SIZE];   
   struct ip_list  *iph;
   struct tcp_list *tcph;
   struct sockaddr_in ader;
   
   short int          sin_family;
   unsigned short int sin_port;
   struct in_addr     sin_addr;
   unsigned char      sin_zero[8];

   struct protoent *pe; 
   struct servent  *pnr;
   struct servent  *pnr2;
   
   char timebuf[50];
   
   time_t curtime;
   struct tm *loctime;
   curtime = time (NULL);
   loctime = localtime (&curtime);
   
   int i;
   int on=0;
   
   fprintf(stdout,"\n%s TCP packetlogger by sacrine\n"
	   "NETRIC SECURITY 2003 - sacrine@netric.org\n\n",VERSION);
      
   if (getuid() != 0) 
     {	
	fprintf(stderr,"This program requires root priviledges\n..aborting\n");
        exit(-1);
     }
   else
     {	
	fprintf(stdout,"[+] Logged in as root\n\n");
     }
   while((opts=getopt(c,v,"Bhl:v"))!=EOF)
     {
	switch(opts)
	  {
	   case 'l':
	     memset(pfile,0x00,sizeof(pfile));
	     strncpy(pfile,optarg,sizeof(pfile)-1);
	     LOG=fopen(pfile,"w+");
	     if(!LOG)
	       {
		  perror("file()");
		  exit(-1);
	       }
	     fprintf(stdout,"[+] Writing results to: %s\n",pfile);
	     break;
	   case 'B':
	     on=1;
	     break;
	   case 'v':
	     fprintf(stdout,"%s\n",VERSION);
	     break;
	   case 'h':
	     usage(v[0] == NULL ? "help function:" : v[0]);
	     exit(0);
	     break;
	   default:
	     break;
	  }
     }
 
   if(!LOG)
     {
	if(on)
	  {
	     fprintf(stderr,"Sorry, you need to specify a logfile with the -l option for this!\n"
		     "..Aborting\n\n");
	     exit(-1);
	  }
	else
	  {
	     LOG = stdout;
	  }
	
     }
   else if(on && LOG)
     {
	bground();
     }
   
   if((sock=socket(AF_INET, SOCK_RAW, 0x06))<0)  
     {
	perror("socket()");
	exit(-1);
     }
      
   while(1)
     {
	pckts.from_lenght = sizeof ader;
	memset(pckts.p_size,0x00,sizeof(pckts.p_size));
	pckts.bytes = recvfrom( sock, pckts.p_size,
			        sizeof (pckts.p_size)-1, 0,
			        (struct sockaddr *)&ader, &pckts.from_lenght
				);
				     
	memset(timebuf,0x00,sizeof(timebuf));
	snprintf(timebuf,sizeof(timebuf)-1,"%s", asctime (loctime));
	
	for(i = 0; i < sizeof(timebuf); i++) if (timebuf[i] == 0x0a) timebuf[i] = 0x00;
	fprintf(LOG,"[%s]",timebuf);
	
	fprintf(LOG," Recieved %d bytes from ", pckts.bytes); 
	fflush(LOG);
	fprintf(LOG,"%s ", inet_ntoa(ader.sin_addr)); 
	fflush(LOG);
	
	(struct ip *) iph = (struct ip *)pckts.p_size;
	pe =  getprotobynumber(iph->ip_protocol); 
	if (pe == NULL) 
	  {
	     perror("protocol()");
	     return(-1);
	  }  
	fprintf(LOG,"- IP hdr lenght=[%d] ", iph->ip_lenght); 
	fflush(LOG);
	fprintf(LOG,"(%s)", pe->p_name); 
	fflush(LOG);
	
	(struct tcp *) tcph = (struct tcp *)(pckts.p_size + (4*iph->ip_lenght));
        pnr = getservbyport(tcph->tcp_source_port,pe->p_name);
	        
	if(pnr == NULL)
	  {
	     fprintf(LOG," src port:%d ",ntohs(tcph->tcp_source_port)); 
	     fflush(LOG);
	  }
	else 
	  {
	     fprintf(LOG," src port:%s ", pnr->s_name); 
	     fflush(LOG);
	  }
	
	pnr2 = getservbyport(tcph->tcp_dest_port,pe->p_name);
	      
	if(pnr2 == NULL)
	  {     
	     fprintf(LOG," dest port:%d\n",ntohs(tcph->tcp_dest_port)); 
	     fflush(LOG);
	  }
	else 
	  {
	     fprintf(LOG," dest port:%s\n", pnr2->s_name); 
	     fflush(LOG);
	  }
     }
   
   return(0);
}