/*
**
** ICMPSpewf v1 by Max0r
**
** Small tool to let you creating spoofed ICMP packets.
** 
** Contact: max0r@digitalsamurai.org
**
**
** [FCS] Regulate [FCS]        
*/


#include <stdio.h>
#include <netinet/ip.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <netinet/ip_icmp.h>
#include <stdlib.h>
#include <sys/types.h>
#include <asm/types.h>

#define SEQ 20985

/*---------------IP Checksum Calculation Routine----------------- */

unsigned short in_cksum(unsigned short *addr, int len)
{
  register int nleft = len;
  register unsigned short *w = addr;
  register int sum = 0;
  unsigned short answer = 0;

  while (nleft > 1)
  {
  sum += *w++;
  nleft -= 2;
  }
  if (nleft == 1)
  {
  *(u_char *)(&answer) = *(u_char *)w;
  sum += answer;
  }
  sum = (sum >> 16) + (sum & 0xffff);
  sum += (sum >> 16);
  answer = ~sum;
  return(answer);
}

void usage(char *s) {
  fprintf(stderr,"\nICMPSpewf v1 by Max0r of FCS\n");
  fprintf(stderr,"usage: %s <source> <destination> <num packets> <type>\n", s);
  fprintf(stderr,"Type Can Be:\n");
  fprintf(stderr,"\t -r [Echo Reply]\n");
  fprintf(stderr,"\t -u [Dest. Unreachable] <subtype>\n");
  fprintf(stderr,"\t -s [Source Quench]\n");
  fprintf(stderr,"\t -k [Redirect] <subtype>\n");
  fprintf(stderr,"\t -e [Echo Request]\n");
  fprintf(stderr,"\t -t [Time Exceeded] <subtype>\n");
  fprintf(stderr,"\t -p [Parameter Problem]\n");
  fprintf(stderr,"\t -i [Timestamp]\n");
  fprintf(stderr,"\t -x [Timestamp Reply]\n");
  fprintf(stderr,"\t -q [Information Request]\n");
  fprintf(stderr,"\t -m [Information Reply]\n");
  fprintf(stderr,"\t -a [Address Mask Request]\n");
  fprintf(stderr,"\t -n [Address Mask Reply]\n\n");
  fprintf(stderr,"To get <subtype> consult ip_icmp.h !\n");
  }



/* ----------------end ripped checksum code------------*/
int send_packet(int sfd, unsigned int src, unsigned short src_p,
    unsigned int dst, unsigned short dst_p, unsigned long
    seq, unsigned long ack, u_char flags, char *buffer, int
    len, int type, int stype)
{
    struct sockaddr_in target;
    char packet[2048];
    int i;

    struct ip_hdr {
  u_int    ip_hl:4,
      ip_v:4;
  u_char    ip_tos;
        u_short    ip_len;
  u_short    ip_id;
  u_short    ip_off;
  u_char    ip_ttl;
  u_char    ip_p;
  u_short    ip_sum;
  u_long    saddr, daddr;

} ip_head;

    struct icmphdr {
  u_char    type;
  u_char    code;
  u_long    checksum;

} icmp_head;

   /* IP Header */

   ip_head.ip_hl    = 5;
   ip_head.ip_v      = 4;
   ip_head.ip_tos    = 0;
   ip_head.ip_len    = htons(sizeof(struct iphdr)+sizeof(struct icmphdr)+len);
   ip_head.ip_id    = htons(31337 + (rand()%100));
   ip_head.ip_off    = 0;
   ip_head.ip_ttl    = 255;
   ip_head.ip_p      = IPPROTO_ICMP;
   ip_head.saddr    = src;
   ip_head.daddr    = dst;
   ip_head.ip_sum    = in_cksum((unsigned short *)&ip_head, sizeof(struct iphdr));

   /* ICMP HEADER */
   icmp_head.type    = type;
   icmp_head.code    = stype;
   icmp_head.checksum    = in_cksum((unsigned short *)&icmp_head, sizeof(struct icmphdr));

   /* PACKET ASSEMBLY, ChAChInG */
   memcpy(packet,(char *)&ip_head, sizeof(ip_head));
   memcpy(packet+sizeof(ip_head), (char *)&icmp_head, sizeof(icmp_head));
   memcpy(packet+sizeof(ip_head)+sizeof(icmp_head), buffer, len);


   /* send it out */
   
   target.sin_family    = AF_INET;
   target.sin_addr.s_addr  = ip_head.daddr;
   
   i = sendto(sfd, packet, sizeof(struct iphdr)+sizeof(struct icmphdr)+len,
    0,(struct sockaddr *)&target, sizeof(struct sockaddr_in));
   if(i < 0) {
  perror("sendto()");
  return(-1);
   }
   else {
  return(i);
 }
}

main(int argc, char **argv)
{
  extern char *optarg;
  extern int optind;
  int i, opt, type, stype, curcount = 1, count = 0;
  unsigned int source, target;
  
  if(argc < 3)
  {
    usage(argv[0]);
    return(-1);
  }
  
  while ((opt = getopt(argc, argv, "ru:sk:et:pixqman")) != EOF)
  {
  switch(opt){
   case 'r':
    type = 0;
    break;
   case 'u':
    type = 3;
    stype = atoi(optarg);
    break;
   case 's':
    type = 4;
    break;
   case 'k':
    type = 5;
    stype = atoi(optarg);
    break;
   case 'e':
    type = 8;
     break;
   case 't':
    type = 11;
    stype = atoi(optarg);
    break;
   case 'p':
    type = 12;
    break;
   case 'i':
    type = 13;
    break;
   case 'x':
    type = 14;
    break;
   case 'q':
    type = 15;
    break;
   case 'm':
    type = 16;
    break;
   case 'a':
    type = 17;
    break;
   case 'n':
    type = 18;
    break;
   default:
    usage(argv[1]);
    return(-1);
  }
  }  


  source = inet_addr(argv[optind]);
  target = inet_addr(argv[optind+1]);
  count = atoi(argv[optind+2]);

  if((i = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {
       perror("socket()");
       return(-1);
    }
  while(curcount < count+1) {
  send_packet(i, source, 0, target, 0, SEQ, 0, 0, NULL, 0, type, stype);
  printf("Sent Packet #%d\n", curcount);
  curcount++;
  }
  printf("FINISHED!\n");
  close(i);
}