/* 
	An example RAW socket program for Linux 2.4.xx

	By j00n1x (c) 2003

	Greetz: sk4zi cr3w for pr0v1d1ng fr13nd5h1p

	Hatez: elus1ve for being an arrogant lamer! This program is f0r j00
	s0 j00 d0nt have t0 j00se netcat anym0re.	

	This program requires superuser (root). Spoofs a UDP packet.

	Update: clarified some fields and used appropriate wrapping.

	<standard disclaimer>
	NO WARRANTY ON THIS PROGRAM. THIS IS A TUTORIAL PROGRAM
	AND SHOULD NOT BE USED FOR MALICIOUS PURPOSES! YOU HAVE
	BEEN WARNED!
*/

#define SOURCE "127.0.0.1"
#define DEST "127.0.0.1"
#define SPORT 54321
#define DPORT 1234
// can't be larger than MTU because we don't fragment
#define PACKETSIZE 500

// standard C include files
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// unix header files
#include <unistd.h> // for write(), close()

// BSD socket header files
#include <sys/socket.h>
#include <sys/types.h>

// resolver header files
#include <netdb.h>
#include <netinet/in.h>

// hostname to ip address conversion functions
#include <arpa/inet.h>

// raw packet files - IP / UDP
#include <netinet/ip.h>
#include <netinet/udp.h>

int main(int argc, char **argv)
{
	int fd, r; 
	char buf[1024*64];
	struct iphdr *iph;
	struct udphdr *udph;
	char *data;
	struct sockaddr_in to;

	// grab raw socket
	fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
	if (fd < 0) { 
		perror("socket");
		exit(1);
	}

	// enable IP_HDRINCL
	r = 1;
	if (setsockopt(fd, IPPROTO_IP, IP_HDRINCL, &r, sizeof(r)) < 0) {
		perror("setsockopt");
		exit(1);
	}

	// setup pointers to point inside buffer
	iph = (void *) buf;
	udph = (void *) buf + sizeof(struct iphdr);
	data = (void *) buf + sizeof(struct iphdr) + sizeof(struct udphdr);

	// setup IP header data
	iph->version = 4; // version 4 = IPv4
	iph->ihl = sizeof(struct iphdr) / 4; // ip header length in # of 32bits

	iph->tos = 0; // type of service (not used)
	iph->tot_len = htons(0); // filled in by kernel (man 7 raw)
	iph->id = htons(0); // let it fill by kernel 
	iph->frag_off = htons(0|0x4000); // fragment offset; 0 = first fragment,
					// 0x4000 = DF flag
	iph->ttl = 64; // time to live
	iph->protocol = IPPROTO_UDP; // protocol number for UDP
				// cat /etc/protocols for more info
	iph->check = htons(0); // filled in by kernel
	iph->saddr = inet_addr(SOURCE); // source (spoofed) address
	iph->daddr = inet_addr(DEST); // destination address

	// setup UDP header
	udph->source = htons(SPORT); // source port
	udph->dest = htons(DPORT); // dest port
	udph->len = htons(PACKETSIZE + 
		sizeof(struct udphdr)); // size of packet + udp header
	udph->check = htons(0); // DIY. But we don't need it, 
			// although other apps might.

	// setup data - set "AAAA.." as data

	memset(data, 'A', PACKETSIZE);

	// setup our socket address -- should be the same as destination
	to.sin_family = AF_INET;
	to.sin_port = 0; // not required with raw sockets
	to.sin_addr.s_addr = inet_addr(DEST);

	// fire packets away..

	while (1) {
		if (sendto(fd, buf, (data - buf) + PACKETSIZE, 0, 
			(struct sockaddr *) &to, sizeof(to)) < 0) {
			perror("sendto");
		}
		sleep(1);
	}

	close(fd);

	return 0;
}