/* 
	An example RAW socket program for Linux 2.4.xx

	By j00n1x (c) 2003

	Greetz: sk4zi cr3w for pr0v1d1ng fr13nd5h1p

	Rantz: H4ppy B1rthd4y elus1v3. I h0p3 m0mmy b4k3d j00 a n1ce c4k3.

	This program requires superuser (root). Spoofs an ICMP echo reply
	(not ICMP echo, which smurf and other malicious programs would use.)

	<standard disclaimer>
	NO WARRANTY ON THIS PROGRAM. THIS IS A TUTORIAL PROGRAM
	AND SHOULD NOT BE USED FOR MALICIOUS PURPOSES! YOU HAVE
	BEEN WARNED!
*/

#define SOURCE "127.0.0.1"
#define DEST "127.0.0.1"
#define SPORT 54321
#define DPORT 1234
// can't be larger than MTU because we don't fragment
#define PACKETSIZE 500

// standard C include files
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// unix header files
#include <unistd.h> // for write(), close()

// BSD socket header files
#include <sys/socket.h>
#include <sys/types.h>

// resolver header files
#include <netdb.h>
#include <netinet/in.h>

// hostname to ip address conversion functions
#include <arpa/inet.h>

// raw packet files - IP / ICMP
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>

int main(int argc, char **argv)
{
	int fd, r; 
	char buf[1024*64];
	struct iphdr *iph;
	struct icmphdr *icmph;
	char *data;
	struct sockaddr_in to;

	// grab raw socket
	fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
	if (fd < 0) { 
		perror("socket");
		exit(1);
	}

	// enable IP_HDRINCL
	r = 1;
	if (setsockopt(fd, IPPROTO_IP, IP_HDRINCL, &r, sizeof(r)) < 0) {
		perror("setsockopt");
		exit(1);
	}

	// setup pointers to point inside buffer
	iph = (void *) buf;
	icmph = (void *) buf + sizeof(struct iphdr);
	data = (void *) buf + sizeof(struct iphdr) + sizeof(struct icmphdr);

	// setup IP header data
	iph->version = 4; // version 4 = IPv4
	iph->ihl = sizeof(struct iphdr) / 4; // ip header length in # of 32bits

	iph->tos = 0; // type of service (not used)
	iph->tot_len = htons(0); // filled in by kernel (man 7 raw)
	iph->id = htons(0); // let it fill by kernel 
	iph->frag_off = htons(0|0x4000); // fragment offset; 0 = first fragment,
					// 0x4000 = DF flag
	iph->ttl = 64; // time to live
	iph->protocol = IPPROTO_ICMP; // protocol number for ICMP
				// cat /etc/protocols for more info
	iph->check = htons(0); // filled in by kernel
	iph->saddr = inet_addr(SOURCE); // source (spoofed) address
	iph->daddr = inet_addr(DEST); // destination address

	// setup ICMP header
	icmph->type = ICMP_ECHOREPLY; 
	icmph->code = 0; // no (sub) code needed for ICMP_ECHOREPLY
	icmph->checksum = htons(0); // DIY.. but we don't care.
	icmph->un.echo.id = htons(0);
	icmph->un.echo.sequence = htons(0);

	// setup data - set "AAAA.." as data

	memset(data, 'A', PACKETSIZE);

	// setup our socket address -- should be the same as destination
	to.sin_family = AF_INET;
	to.sin_port = 0; // not required with raw sockets
	to.sin_addr.s_addr = inet_addr(DEST);

	// fire packets away..

	while (1) {
		if (sendto(fd, buf, (data - buf) + PACKETSIZE, 0, 
			(struct sockaddr *) &to, sizeof(to)) < 0) {
			perror("sendto");
		}
		sleep(1);
	}

	close(fd);

	return 0;
}