/*
 * Name: ANTi SP00FiNG VIA SETSOCKOPT() ( fbsdnospoof.c )
 * Date: Fri Feb 18 14:45:01 2000
 * Author: pIGpEN [pigpen@s0ftpj.org, deadhead@sikurezza.org]
 *
 * SoftProject Digital Security for Y2K (www.s0ftpj.org)
 * Sikurezza.org Italian Security MailingList (www.sikurezza.org)
 * 
 * COFFEE-WARE LICENSE - This source code is like "THE BEER-WARE LICENSE" by
 * Poul-Henning Kamp <phk@FreeBSD.ORG> but you can give me in return a coffee.
 * 
 * Tested on: FreeBSD 4.0-19990705-CURRENT FreeBSD 4.0-19990705-CURRENT #6 i386
 *        FreeBSD 3.4-RELEASE FreeBSD 3.4-RELEASE #0: Tue Dec i386
 *
 * Thanks to: del0rean / s0ftPj for cd with 3.4 release 
 *            Lynyrd Skynyrd for Sweet Home Alabama
 *
 * Use a kld Makefile.. ( put in append ) 
 */

/*
 * This kld detects type of ip spoofing based on setsockopt()... with IP_HDRINCL
 * It works monitoring setsockopt() system call 
 *
 * example of detection:
 *
 * ./DoS -s 666.666.666.666 -d 192.168.1.4
 * IP_HDRINCL: Invalid argument
 *
 * syslog:
 *
 * Feb 18 14:44:25 storpio /kernel: Detect IP_HDRINCL invoked by d0s
 * Feb 18 14:44:25 storpio /kernel: IP header manipulation... DENIED!
 *
 */

/*
 * Define DONT_PERMIT  ->  if you want to forbid IP header manipulation
 *         and so the chance of IP Spoofing from your
 *         BOX
 */

#define DONT_PERMIT

#include <sys/types.h>
#include <sys/param.h>
#include <sys/proc.h>
#include <sys/module.h>
#include <sys/syscall.h>
#include <sys/sysent.h> 
#include <sys/kernel.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
#include <sys/socket.h>
#include <sys/socketvar.h>

#include <sys/syslog.h>
#include <sys/file.h> 

#include <netinet/in.h>    /* IP_HDRINCL */




static int  
  my_setsockopt  __P((struct proc *, register struct setsockopt_args *));

static int
my_setsockopt(p, uap)
  struct proc *p;
  register struct setsockopt_args *uap;
{
  struct file *fp;
  struct sockopt sopt;
  int error;

  if (uap->val == 0 && uap->valsize != 0)
    return (EFAULT);
  if (uap->valsize < 0)
    return (EINVAL);

  error = getsock(p->p_fd, uap->s, &fp);
  if (error)
    return (error);
 

  if((uap->level == IPPROTO_IP) && (uap->name == IP_HDRINCL)) { 
    log(LOG_INFO, "Detect IP_HDRINCL invoked by %s\n", p->p_comm);
#ifdef  DONT_PERMIT
    log(LOG_INFO, "IP header manipulation... DENIED!\n");
    return (EINVAL);
#endif
  }

  sopt.sopt_dir = SOPT_SET;
  sopt.sopt_level = uap->level;
  sopt.sopt_name = uap->name;
  sopt.sopt_val = uap->val;
  sopt.sopt_valsize = uap->valsize;
  sopt.sopt_p = p;

  return (sosetopt((struct socket *)fp->f_data, &sopt));

}



static int
module_handler(module_t mod, int cmd, void *arg) {

  switch(cmd) {
   case MOD_LOAD:
    sysent[SYS_setsockopt].sy_call = (sy_call_t *) my_setsockopt;  
    break;

  case MOD_UNLOAD:
    sysent[SYS_setsockopt].sy_call = (sy_call_t *) setsockopt;
    break;
  }

   return 0;
}

static moduledata_t SetSock = {
  "SetSockOpt",
  module_handler,
  NULL
};

DECLARE_MODULE(SetSockOpt, SetSock, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);

/* Makefile for this kld...

# SoftProject 2000 - Digital Sekurity for Y2k
# Sikurezza.org - Italian Security MailingList
#
# COFFEE-WARE LICENSE - This source code is like "THE BEER-WARE LICENSE" by
# Poul-Henning Kamp <phk@FreeBSD.ORG> but you can give me in return a coffee.
#
# Tested on: FreeBSD 3.4-RELEASE FreeBSD 3.4-RELEASE #3: Thu Mar i386
# < pigpen@s0ftpj.org > 

.PATH: /sys/kern
SRCS  = fbsdnospoof.c 
CFLAGS+= -I/sys
KMOD  = nospoof 
NOMAN  = t
KLDMOD  = t

KLDLOAD    = /sbin/kldload
KLDUNLOAD  = /sbin/kldunload

CLEANFILES+= ${KMOD}

load:
  ${KLDLOAD} -v ./${KMOD}

unload:
  ${KLDUNLOAD} -v -n ${KMOD}

.include <bsd.kmod.mk>

*/