Redes_Defensor.c

#include <arpa/inet.h>
#include <linux/if_packet.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <net/if.h>
#include <netinet/ether.h>
#include <my_global.h>
#include <mysql.h>

int escucharRed(int packet_socket, MYSQL *con, long mtime);
void finish_with_error(MYSQL *con);
void defensa(int packet_socket, unsigned char MACIntruso[6], unsigned char IPDefensa[4], char MACDefensa[18]);
unsigned char ctouc(char str[18]);
void enviarTrama(int packet_socket, unsigned char * trama);
void valida(int packet_socket, unsigned char IPDefensa[4], unsigned char MACDefensa[6]);

int indice;
struct ifreq net;

int main(int argc, char *argv[]){
	MYSQL *con = mysql_init(NULL);
	int packet_socket;

	if (mysql_real_connect(con, "localhost", "root", "root", "MAC", 0, NULL, 0) == NULL) finish_with_error(con);
	if (con == NULL) {
		fprintf(stderr, "%s\n", mysql_error(con)); exit(1);
	}

	if ((packet_socket = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) == -1)
		perror("Error en el socket");
	else{
		printf("Exito al abrir el socket\n");
		if (argc > 1)
			strcpy(net.ifr_name, argv[1]);
		else{
			printf("Introduzca nombre de la interfaz: ");
			scanf("%s", net.ifr_name);
		}
		if (ioctl(packet_socket, SIOCGIFINDEX, &net) < 0) perror("Error al obtener el indice");
		else indice = net.ifr_ifindex;
		struct timeval start, end;
		long mtime = 0, seconds, useconds;

		gettimeofday(&start, NULL);
		while (1) {
			gettimeofday(&end, NULL);
			seconds  = end.tv_sec  - start.tv_sec;
			useconds = end.tv_usec - start.tv_usec;
			mtime = ((seconds) * 1000 + useconds / 1000.0) + 0.5;
			//printf("\033[1;1H%c[2KElapsed Time: %ld\n",27,mtime); // Prints to coords
			//printf("\033[2;1H============================\n");
			escucharRed(packet_socket, con, mtime);
			//printf("Elapsed time: %ld milliseconds\n", mtime);
		}
		mysql_close(con);
		close(packet_socket);
		return 0;
	}
}

void finish_with_error(MYSQL *con){
	fprintf(stderr, "%s\n", mysql_error(con));
	mysql_close(con);
	exit(1);
}

unsigned char ctouc(char str[18]){
	char * pch;

	printf("Splitting string \"%s\" into tokens:\n", str);
	pch = strtok(str, ":");
	while (pch != NULL) {
		printf("%s\n", pch);
		pch = strtok(NULL, ":");
	}
}

void enviarTrama(int packet_socket, unsigned char * trama){
	struct sockaddr_ll interfaz;

	//Reseteamos la struct
	memset(&interfaz, 0, sizeof(interfaz));
	interfaz.sll_family = AF_PACKET;
	interfaz.sll_protocol = htons(ETH_P_ALL);
	interfaz.sll_ifindex = indice;

	if (sendto(packet_socket, trama, 60, 0, (struct sockaddr *)&interfaz, sizeof(interfaz)) < 0) perror("Error al enviar");
	//else printf("\nExito al enviar\n");
}

void defensa(int packet_socket, unsigned char MACIntruso[6], unsigned char IPDefensa[4], char MACDefensa[18]){

	char *pch, *p; char actual[10];
	int i = 0;
	unsigned char MACDefensa_u[6];

	pch = strtok(MACDefensa, ":");
	while (pch != NULL) {
		sprintf(actual, "0x%s", pch);
		MACDefensa_u[i++] = strtoul(actual, &p, 16);
		pch = strtok(NULL, ":");
	}

	unsigned char raw[1514]; bzero(&raw, 1514);
	unsigned char arpData[] = { 0x08, 0x06, 0x00, 0x01, 0x08, 0x00, 0x06, 0x04, 0x00, 0x02 };
	//Estructura Respuesta
	memcpy(raw + 0, MACIntruso, 6);
	memcpy(raw + 6, MACDefensa_u, 6);
	memcpy(raw + 12, arpData, 10);
	memcpy(raw + 22, MACDefensa_u, 6);
	memcpy(raw + 28, IPDefensa, 4);
	memcpy(raw + 32, MACIntruso, 6);
	memcpy(raw + 38, IPDefensa, 4);
	/* Print packet */
	printf("\n\tData:");
	for (i = 0; i < 64; i++) printf("%02x:", raw[i]);
	enviarTrama(packet_socket, raw);
	valida(packet_socket, IPDefensa, MACDefensa_u);
}

void valida(int packet_socket, unsigned char IPDefensa[4], unsigned char MACDefensa[6]){
	unsigned char raw[1514]; bzero(&raw, 1514);
	unsigned char arpData[] = { 0x08, 0x06, 0x00, 0x01, 0x08, 0x00, 0x06, 0x04, 0x00, 0x01 };
	//Estructura Respuesta
	unsigned char MACDestino[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; // Broadcast

	memcpy(raw + 0, MACDestino, 6);
	memcpy(raw + 6, MACDefensa, 6);
	memcpy(raw + 12, arpData, 10);
	memcpy(raw + 22, MACDefensa, 6);
	memcpy(raw + 28, IPDefensa, 4);
	memcpy(raw + 38, IPDefensa, 4);
	enviarTrama(packet_socket, raw);
}

int escucharRed(int packet_socket, MYSQL *con, long mtime){
	unsigned char replySHA[6], replySPA[4];
	char s_replySHA[18], s_replySPA[16];

	unsigned char server_reply[1514], server_request[1514];
	char query[25];

	int i = 0, j = 0;
	ssize_t numbytes;

	numbytes = recvfrom(packet_socket, server_reply, 1514, MSG_DONTWAIT, NULL, NULL);
	if (numbytes > 0) {
		//printf("Recibi algo. Tamaño %lu bytes. ", numbytes);
		unsigned char comp[6] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
		if (!memcmp(server_reply, comp, 6)) {
			//printf("\nDST: Broadcast")
			if (server_reply[12] == 0x08 && server_reply[13] == 0x06) {
//                printf("[%ld] DST: Broadcast, Packete recibido es ARP... ",mtime);
				/* Print packet
				   printf("\n\tData:");
				   for (i=0; i<numbytes; i++) printf("%02x:", server_reply[i]);*/
				memcpy(replySHA, server_reply + 22, 6);
				sprintf(s_replySHA, "%02x:%02x:%02x:%02x:%02x:%02x", replySHA[0], replySHA[1], replySHA[2], replySHA[3], replySHA[4], replySHA[5]);
				memcpy(replySPA, server_reply + 28, 4);
				sprintf(s_replySPA, "%d.%d.%d.%d", replySPA[0], replySPA[1], replySPA[2], replySPA[3]);
				sprintf(query, "SELECT * FROM dir WHERE ip=\"%s\"", s_replySPA);
				//printf("%s\n", query);
				if (mysql_query(con, query)) finish_with_error(con);
				MYSQL_RES *result = mysql_store_result(con);
				if (result == NULL) finish_with_error(con);
				int num_fields = mysql_num_fields(result);
				int num_rows = mysql_num_rows(result);
				if (num_rows == 0) {
					int j;
					j++;
				}
//                    printf("\n\tNo se encontro en BD\n");
				else{
					MYSQL_ROW row;
					while ((row = mysql_fetch_row(result))) {
						printf("\n\tComparando %s con %s", row[2], s_replySHA);
						if (!strcmp(row[2], s_replySHA)) {
							int j;
							j++;
						}
//                            printf("\n\tSon iguales... No hago nada");
						else{
							//Enviar ARP Respuesta
							printf("Ataque detectado. Defendiendo...\n");
							defensa(packet_socket, replySHA, replySPA, row[2]);
						}
					}
					mysql_free_result(result);
				}
			}else{
				//printf(", Packete recibido no es ARP..." );
			}
		}else{  // No es para broadcast
//            printf("[%ld] DST: %.2x:%.2x:%.2x:%.2x:%.2x:%.2x\n",mtime,server_reply[0],server_reply[1],server_reply[2],server_reply[3],server_reply[4],server_reply[5]);
		}
	}
}