--- Begin Message ---
Package: ngrep
Version: 1.40.1-3
Severity: wishlist
Tags: patch
The patch below adds tcpkill support to ngrep. Use the new -K option
to kill matching TCP connections.
This approach is rather crude, but it seems quite effective.
diff -u --recursive --new-file original/ngrep-1.40.1/COPYRIGHT
hacks/ngrep-1.40.1/COPYRIGHT
--- original/ngrep-1.40.1/COPYRIGHT 2001-04-24 07:14:30.000000000 +0200
+++ hacks/ngrep-1.40.1/COPYRIGHT 2004-03-25 14:58:36.000000000 +0100
@@ -35,3 +35,32 @@
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Portions were copied from tcpkill (part of dsniff), which has the
+following copyright:
+
+ Copyright (c) 1999, 2000 Dug Song <[EMAIL PROTECTED]>
+ All rights reserved, all wrongs reversed.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+
+ 1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+ 3. The name of author may not be used to endorse or promote products
+ derived from this software without specific prior written permission.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+ OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff -u --recursive --new-file original/ngrep-1.40.1/Makefile.in
hacks/ngrep-1.40.1/Makefile.in
--- original/ngrep-1.40.1/Makefile.in 2004-03-25 16:19:25.000000000 +0100
+++ hacks/ngrep-1.40.1/Makefile.in 2004-03-25 15:17:39.000000000 +0100
@@ -9,15 +9,17 @@
[EMAIL PROTECTED]@
[EMAIL PROTECTED]@ @PCAP_INCLUDE@
[EMAIL PROTECTED]@ @DEFS@
+CFLAGS_LIBNET := $(shell libnet-config --defines ; libnet-config --cflags)
[EMAIL PROTECTED]@ @DEFS@ $(CFLAGS_LIBNET)
[EMAIL PROTECTED]@ @PCAP_LINK@
# Modified for Debian --NES
#LIBS=-lpcap @EXTRA_LIBS@
-LIBS=-lpcap -lpcre @EXTRA_LIBS@
+LIBNET := $(shell libnet-config --libs)
+LIBS=-lpcap -lpcre @EXTRA_LIBS@ $(LIBNET)
[EMAIL PROTECTED]@
-SRC=ngrep.c
-OBJS=ngrep.o
+SRC=ngrep.c tcpkill.c
+OBJS=ngrep.o tcpkill.o
TARGET=ngrep
MANPAGE=ngrep.8
diff -u --recursive --new-file original/ngrep-1.40.1/debian/control
hacks/ngrep-1.40.1/debian/control
--- original/ngrep-1.40.1/debian/control 2004-03-25 16:19:25.000000000
+0100
+++ hacks/ngrep-1.40.1/debian/control 2004-03-25 15:10:34.000000000 +0100
@@ -2,7 +2,7 @@
Section: net
Priority: optional
Maintainer: Nathan Sandver <[EMAIL PROTECTED]>
-Build-Depends: debhelper (>> 3.0.0), libpcap-dev, libpcre3-dev
+Build-Depends: debhelper (>> 3.0.0), libpcap-dev, libpcre3-dev, libnet0-dev
Standards-Version: 3.5.8
Package: ngrep
diff -u --recursive --new-file original/ngrep-1.40.1/ngrep.8
hacks/ngrep-1.40.1/ngrep.8
--- original/ngrep-1.40.1/ngrep.8 2001-12-31 23:07:02.000000000 +0100
+++ hacks/ngrep-1.40.1/ngrep.8 2004-03-25 16:11:25.000000000 +0100
@@ -118,6 +118,10 @@
.IP "-A num"
Dump \fInum\fP packets of trailing context after matching a packet.
+.IP "-K num"
+Kill TCP matching tcp connections (like tcpkill). The numeric
+argument controls how many RST segments are sent.
+
.IP "\fI match expression\fP"
A match expression is either an extended regular expression, or if the
\fI-X\fP option is specified, a string signifying a hexadecimal value.
diff -u --recursive --new-file original/ngrep-1.40.1/ngrep.c
hacks/ngrep-1.40.1/ngrep.c
--- original/ngrep-1.40.1/ngrep.c 2004-03-25 16:19:25.000000000 +0100
+++ hacks/ngrep-1.40.1/ngrep.c 2004-03-25 16:05:34.000000000 +0100
@@ -72,6 +72,8 @@
int matches = 0, max_matches = 0;
int live_read = 1, want_delay = 0;
+int tcpkill_active = 0;
+
char pc_err[PCAP_ERRBUF_SIZE];
#ifdef USE_PCRE
int err_offset;
@@ -117,7 +119,7 @@
signal(SIGPIPE, clean_exit);
signal(SIGWINCH, update_windowsize);
- while ((c = getopt(argc, argv, "hXViwqpevxlDtTs:n:d:A:I:O:")) != EOF) {
+ while ((c = getopt(argc, argv, "hXViwqpevxlDtTK:s:n:d:A:I:O:")) != EOF) {
switch (c) {
case 'I':
read_file = optarg;
@@ -175,6 +177,9 @@
case 'X':
bin_match++;
break;
+ case 'K':
+ tcpkill_active = atoi(optarg);
+ break;
case 'h':
usage(0);
default:
@@ -207,6 +212,10 @@
clean_exit(-1);
}
+ if (tcpkill_active) {
+ tcpkill_init();
+ }
+
if (pcap_lookupnet(dev, &net.s_addr, &mask.s_addr, pc_err) == -1) {
perror(pc_err);
memset(&net, 0, sizeof(net));
@@ -482,6 +491,10 @@
pcap_dump((u_char*)pd_dump, h, p);
if (!quiet) dump(data, len);
} else dump(data, len);
+
+ if (tcpkill_active) {
+ tcpkill_kill(h, p, link_offset, tcpkill_active);
+ }
}
}
break;
diff -u --recursive --new-file original/ngrep-1.40.1/tcpkill.c
hacks/ngrep-1.40.1/tcpkill.c
--- original/ngrep-1.40.1/tcpkill.c 1970-01-01 01:00:00.000000000 +0100
+++ hacks/ngrep-1.40.1/tcpkill.c 2004-03-25 16:05:14.000000000 +0100
@@ -0,0 +1,87 @@
+/*
+ * tcpkill.c
+ *
+ * Kill TCP connections already in progress.
+ *
+ * Copyright (c) 2000 Dug Song <[EMAIL PROTECTED]>
+ *
+ * $Id: tcpkill.c,v 1.17 2001/03/17 08:10:43 dugsong Exp $
+ */
+
+#include <sys/types.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <libnet.h>
+#include <pcap.h>
+
+#include "tcpkill.h"
+
+// #include "pcaputil.h"
+// #include "version.h"
+
+static int sock;
+
+void
+tcpkill_kill(const struct pcap_pkthdr *pcap, const u_char *pkt, unsigned
pcap_off, unsigned kill_count)
+{
+ struct libnet_ip_hdr *ip;
+ struct libnet_tcp_hdr *tcp;
+ u_char ctext[64], buf[IP_H + TCP_H];
+ u_int32_t seq, win;
+ int i, len;
+
+ pkt += pcap_off;
+ len = pcap->caplen - pcap_off;
+
+ ip = (struct libnet_ip_hdr *)pkt;
+ if (ip->ip_p != IPPROTO_TCP)
+ return;
+
+ tcp = (struct libnet_tcp_hdr *)(pkt + (ip->ip_hl << 2));
+ if (tcp->th_flags & (TH_SYN|TH_FIN|TH_RST))
+ return;
+
+ libnet_build_ip(TCP_H, 0, 0, 0, 64, IPPROTO_TCP,
+ ip->ip_dst.s_addr, ip->ip_src.s_addr,
+ NULL, 0, buf);
+
+ libnet_build_tcp(ntohs(tcp->th_dport), ntohs(tcp->th_sport),
+ 0, 0, TH_RST, 0, 0, NULL, 0, buf + IP_H);
+
+ seq = ntohl(tcp->th_ack);
+ win = ntohs(tcp->th_win);
+
+ snprintf(ctext, sizeof(ctext), "%s:%d > %s:%d:",
+ libnet_host_lookup(ip->ip_src.s_addr, 0),
+ ntohs(tcp->th_sport),
+ libnet_host_lookup(ip->ip_dst.s_addr, 0),
+ ntohs(tcp->th_dport));
+
+ ip = (struct libnet_ip_hdr *)buf;
+ tcp = (struct libnet_tcp_hdr *)(ip + 1);
+
+ for (i = 0; i < kill_count; i++) {
+ ip->ip_id = libnet_get_prand(PRu16);
+ seq += (i * win);
+ tcp->th_seq = htonl(seq);
+
+ libnet_do_checksum(buf, IPPROTO_TCP, TCP_H);
+
+ if (libnet_write_ip(sock, buf, sizeof(buf)) < 0)
+ warn("write_ip");
+
+ fprintf(stderr, "%s R %lu:%lu(0) win 0\n", ctext, seq, seq);
+ }
+}
+
+void
+tcpkill_init(void)
+{
+ if ((sock = libnet_open_raw_sock(IPPROTO_RAW)) == -1)
+ errx(1, "couldn't initialize sending");
+
+ libnet_seed_prand();
+}
diff -u --recursive --new-file original/ngrep-1.40.1/tcpkill.h
hacks/ngrep-1.40.1/tcpkill.h
--- original/ngrep-1.40.1/tcpkill.h 1970-01-01 01:00:00.000000000 +0100
+++ hacks/ngrep-1.40.1/tcpkill.h 2004-03-25 16:04:44.000000000 +0100
@@ -0,0 +1,7 @@
+#ifndef TCPKILL_H
+#define TCPKILL_H
+
+void tcpkill_init(void);
+void tcpkill_kill(const struct pcap_pkthdr *pcap, const u_char *pkt, unsigned
pcap_off, unsigned kill_count);
+
+#endif
--- End Message ---
