arpCounterattack/arpCounterattack-1.2.0/arpCounterattack.cpp

/*
 * Copyright 2007-2010 Boris Kochergin. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *
 * 1. Redistributions of source code must retain the above copyright notice,
 *    this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright notice,
 *    this list of conditions and the following disclaimer in the documentation
 *    and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include <fstream>
#include <iostream>
#include <queue>
#include <unordered_map>
#include <vector>

#ifdef __FreeBSD__
  #include <sys/ioctl.h>
#endif

#include <sys/types.h>
#include <net/bpf.h>
#include <errno.h>
#include <pcap.h>
#include <signal.h>
#include <stdint.h>
#include <string.h>
#include <unistd.h>

#include "address.hpp"
#include "arpCounterattack.hpp"
#include "configuration.hpp"
#include "ethernetInfo.hpp"
#include "logger.hpp"
#include "string.hpp"

using namespace std;

const string programName = "ARP Counterattack 1.2.0";
string pidFileName = "/var/run/arpCounterattack.pid";
Logger logger;
vector <Interface> interfaces;
EthernetInfo ethernetInfo;
queue <ARPCorrection> corrections;
size_t maxQueueSize;
bool responseStatus;
pthread_mutex_t responseStatusLock, responseLock, correctionsLock;
pthread_cond_t responseCondition;

void signalHandler(int signal) {
  switch (signal) {
    case SIGTERM:
      logger.lock();
      logger << logger.time() << "Caught SIGTERM; exiting." << endl;
      logger.unlock();
      pthread_mutex_lock(&correctionsLock);
      unlink(pidFileName.c_str());
      exit(0);
  }
}

/*
 * If "interface" is in aggressive mode, sends out a gratuitous ARP request and
 * a gratuitous ARP reply with the "correct" Ethernet/IP address mapping in
 * order to restore the ARP tables of victim machines to the correct state.
 * Linux will not update the Ethernet address of an IP address in its ARP table
 * more than once per second by way of gratuitous ARP requests, so we also
 * schedule a gratuitous ARP request to be sent from the delayedResponse()
 * thread at least 1.5 seconds from the time of the attack. Lastly, if logging
 * is enabled, we log the attack and our response to it.
 */
void respond(Interface &interface, const u_char *packet,
             const AttackType &type, const string &sha) {
  ARPCorrection correction;
  string ethernetAddress, manufacturer;
  /*
   * Initialize this to false to stop g++ from complaining about the possible
   * use of uninitialized variables when compiling with -O1 or higher.
   */
  bool corrected = false, queued = false;
  if (interface.mode == AGGRESSIVE_MODE) {
    ethernetAddress = getEthernetAddress(interface.name);
    if (ethernetAddress != "") {
      corrected = sendGratuitousARPPacket(interface.replyDescriptor,
                                          ethernetAddress,
                                          sha.c_str(), *getARPSPA(packet),
                                          ARP_REQUEST) &&
                  sendGratuitousARPPacket(interface.replyDescriptor,
                                          ethernetAddress,
                                          sha.c_str(), *getARPSPA(packet),
                                          ARP_REPLY);
    }
    /*
     * Lock the correction queue to prevent interference with the
     * delayedResponse() thread, then add the correction to it.
     */
    pthread_mutex_lock(&correctionsLock);
    if (corrections.size() < maxQueueSize) {
      correction.interface = &interface;
      memcpy(correction.sha, sha.c_str(), sha.length());
      correction.spa = *getARPSPA(packet);
      gettimeofday(&(correction.attackTime), NULL);
      corrections.push(correction);
      queued = true;
    }
    else {
      queued = false;
    }
    pthread_mutex_unlock(&correctionsLock);
    /*
     * Lock the delayedResponse() thread's status to prevent interference with
     * that thread.
     */
    pthread_mutex_lock(&responseStatusLock);
    /*
     * Wake up the delayedResponse() thread if it is sleeping, as there is now
     * work for it to do.
     */
    if (responseStatus == false) {
      pthread_cond_broadcast(&responseCondition);
    }
    pthread_mutex_unlock(&responseStatusLock);
  }
  if (logger) {
    manufacturer = ethernetInfo.find(getEthernetSourceAddress(packet));
    if (manufacturer == "") {
      manufacturer = "unknown manufacturer";
    }
    logger.lock();
    logger << logger.time() << "ARP attack detected:" << endl << endl
           << "\tInterface:\t\t" << interface.name << endl << "\tType:\t\t\t";
    switch (type) {
      case GRATUITOUS_ARP_REQUEST_ATTACK:
        logger << "gratuitous ARP request";
        break;
      case GRATUITOUS_ARP_REPLY_ATTACK:
        logger << "gratuitous ARP reply";
        break;
      case ARP_REPLY_ATTACK:
        logger << "ARP reply";
        break;
    }
    logger << endl << "\tTarget:\t\t\t" << ipToText(*getARPSPA(packet)) << endl
           << "\tAttacker:\t\t" << ethernetToText(getEthernetSourceAddress(packet))
           << " (" << manufacturer << ')' << endl << "\tCorrected:\t\t";
    if (interface.mode == PASSIVE_MODE) {
      logger << "no (interface is in passive mode)";
    }
    else {
      if (ethernetAddress == "") {
        logger << "no (getEthernetAddress(): " << strerror(errno) << ')';
      }
      else {
        if (corrected == false) {
          logger << "no (pcap_inject(): "
                 << pcap_geterr(interface.replyDescriptor) << ')';
        }
        else {
          logger << "yes (interface is in aggressive mode)";
        }
      }
    }
    logger << endl << "\tDelayed correction:\t";
    if (queued == true) {
      logger << "queued";
    }
    else {
      logger << "not queued (queue is full)";
    }
    logger << endl << endl;
    logger.unlock();
  }
}

/*
 * Iterates through the correction queue and sends out a corrective gratuitous
 * ARP request at least 1.5 seconds after each respective attack, logging only
 * problems with doing so. A one-second delay is too short to guarantee that a
 * Linux machine's ARP table will be updated. For example, an ARP attack may
 * arrive at a Linux machine a little late due to adverse 802.11 network
 * conditions. If we see the attack on time and respond one second later, the
 * Linux machine's ARP table will not be updated.
 */
void *delayedResponse(void*) {
  ARPCorrection correction;
  timeval time;
  suseconds_t microDelay;
  timespec nanoDelay;
  string ethernetAddress;
  /*
   * Initialize this to false to stop g++ from complaining about the possible
   * use of uninitialized variables when compiling with -O1 or higher.
   */
  bool corrected = false;
  nanoDelay.tv_sec = 0;
  /*
   * Allows the signal handler to terminate this thread gracefully by locking
   * "responseLock".
   */
  while (pthread_mutex_trylock(&responseLock) == 0) {
    /* Wait to be woken up by the listen() thread. */
    pthread_cond_wait(&responseCondition, &responseLock);
    /* Lock this thread's status to prevent a race with the listen() thread. */
    pthread_mutex_lock(&responseStatusLock);
    /* Indicate that this thread is now running. */
    responseStatus = true;
    pthread_mutex_unlock(&responseStatusLock);
    /*
     * Lock the correction queue to prevent a race with the listen() thread.
     */
    pthread_mutex_lock(&correctionsLock);
    while (!corrections.empty()) {
      correction = corrections.front();
      corrections.pop();
      pthread_mutex_unlock(&correctionsLock);
      gettimeofday(&time, NULL);
      microDelay = ((time.tv_sec - correction.attackTime.tv_sec) * 1000000) +
                   (time.tv_usec - correction.attackTime.tv_usec);
      if (microDelay < 1500000) {
        nanoDelay.tv_nsec = (1500000 - microDelay) * 1000;
        if (nanoDelay.tv_nsec > 1000000000) {
          nanoDelay.tv_sec = 1;
          nanoDelay.tv_nsec -= 1000000000;
        }
        nanosleep(&nanoDelay, NULL);
      }
      ethernetAddress = getEthernetAddress(correction.interface -> name);
      if (ethernetAddress != "") {
        corrected = sendGratuitousARPPacket(correction.interface -> replyDescriptor,
                                             ethernetAddress, correction.sha,
                                             correction.spa, ARP_REQUEST);
      }
      if (ethernetAddress == "" || corrected == false) {
        logger.lock();
        logger << logger.time() << "Delayed correction failure:" << endl
               << endl << "\tInterface:\t\t"
               << correction.interface -> replyName << endl
               << "\tError:\t\t\t";
        if (ethernetAddress == "") {
          logger << "getEthernetAddress(): " << strerror(errno);
        }
        else {
          if (corrected == false) {
            logger << "pcap_inject(): "
                   << pcap_geterr(correction.interface -> replyDescriptor);
          }
        }
        logger << endl << endl;
        logger.unlock();
      }
    }
    pthread_mutex_unlock(&correctionsLock);
    /* Lock this thread's status to prevent a race with the listen() thread. */
    pthread_mutex_lock(&responseStatusLock);
    /* Indicate that this thread is now sleeping. */
    responseStatus = false;
    pthread_mutex_unlock(&responseStatusLock);
    pthread_mutex_unlock(&responseLock);
  }
  return NULL;
}

/*
 * Examines ARP traffic on "interface" for attacks, responds to them if the
 * interface is in aggressive mode, and logs them if logging is enabled.
 */
void *listen(void *interface) {
  Interface *_interface = (Interface*)interface;
  const u_char *packet = NULL;
  pcap_pkthdr header;
  unordered_map <uint32_t, string>::const_iterator itr;
  while (1) {
    packet = pcap_next(_interface -> descriptor, &header);
    if (packet != NULL && header.caplen >= 42 &&
        /* Check that the hardware type is Ethernet. */
        ntohs(*(uint16_t*)(packet + 14)) == 0x0001 &&
        /* Check that the protocol is IPv4. */
        ntohs(*(uint16_t*)(packet + 16)) == 0x0800) {
      switch (ntohs(*(uint16_t*)(packet + 20))) {
        /* ARP request. */
        case 0x0001:
          /* Gratuitous ARP request. */
          if (*getARPSPA(packet) == *getARPTPA(packet)) {
            itr = _interface -> pairs.find(*getARPSPA(packet));
            if (itr != _interface -> pairs.end() &&
                string((const char*)getARPSHA(packet),
                       ETHER_ADDR_LEN) != itr -> second) {
              respond(*_interface, packet, GRATUITOUS_ARP_REQUEST_ATTACK,
                      itr -> second);
            }
          }
          break;
        /* ARP reply. */
        case 0x0002:
          itr = _interface -> pairs.find(*getARPSPA(packet));
          if (itr != _interface -> pairs.end() &&
              string((const char*)getARPSHA(packet),
                     ETHER_ADDR_LEN) != itr -> second &&
              memcmp((itr -> second).c_str(),
                     getEthernetDestinationAddress(packet),
                     ETHER_ADDR_LEN) != 0) {
            /*
             * We'll call an ARP reply with a multicast Ethernet destination
             * address a gratuitous ARP reply.
             */
            if ((getEthernetDestinationAddress(packet)[0] & 0x01) == 1) {
              respond(*_interface, packet, GRATUITOUS_ARP_REPLY_ATTACK,
                      itr -> second);
            }
            else {
              respond(*_interface, packet, ARP_REPLY_ATTACK, itr -> second);
            }
          }
          break;
      }
    }
  }
  /* Not reached. */
  return NULL;
}

int main(int argc, char *argv[]) {
  string configFileName = "/usr/local/etc/arpCounterattack/arpCounterattack.conf",
         ouiFileName = "/usr/local/etc/arpCounterattack/oui.txt";
  Configuration conf;
  vector <string> interfaceNames, addressPair;
  char option, errorBuffer[PCAP_ERRBUF_SIZE];
  bpf_program bpfProgram;
#ifdef __FreeBSD__
  u_int immediate = 1;
#endif
  ofstream pidFile;
  pid_t pid;
  pthread_t delayedResponseThread;
  int error;
  signal(SIGTERM, signalHandler);
  while ((option = getopt(argc, argv, "c:o:p:")) != -1) {
    switch (option) {
      case 'c':
        configFileName = optarg;
        break;
      case 'o':
        ouiFileName = optarg;
        break;
      case 'p':
        pidFileName = optarg;
        break;
      default:
        return 1;
    }
  }
  if ((error = pthread_mutex_init(&responseStatusLock, NULL)) != 0 ||
      (error = pthread_mutex_init(&responseLock, NULL)) != 0 ||
      (error = pthread_mutex_init(&correctionsLock, NULL)) != 0) {
    cerr << argv[0] << ": pthread_mutex_init(): " << strerror(error) << endl;
    return 1;
  }
  if ((error = pthread_cond_init(&responseCondition, NULL)) != 0) {
    cerr << argv[0] << ": pthread_cond_init(): " << strerror(error) << endl;
    return 1;
  }
  if (!conf.initialize(configFileName)) {
    cerr << argv[0] << ": " << conf.error() << endl;
    return 1;
  }
  if (!ethernetInfo.initialize(ouiFileName)) {
    cerr << argv[0] << ": " << ethernetInfo.error() << endl;
    return 1;
  }
  if (conf.getString("interfaces") == "") {
    cerr << argv[0] << ": no interfaces specified" << endl;
    return 1;
  }
  if (conf.getString("maxQueueSize") == "") {
    cerr << argv[0] << ": no maximum delayed correction queue size set"
         << endl;
    return 1;
  }
  maxQueueSize = conf.getNumber("maxQueueSize");
  if (conf.getString("logging") == "") {
    cerr << argv[0] << ": no logging mode specified" << endl;
    return 1;
  }
  else {
    if (conf.getString("logging") != "on" &&
        conf.getString("logging") != "off") {
      cerr << argv[0] << ": " << conf.fileName() << ": "
           << "unknown logging mode \"" << conf.getString("logging")
           << "\" specified" << endl;
      return 1;
    }
  }
  if (conf.getString("logging") == "on") {
    if (conf.getString("log") == "") {
      cerr << argv[0] << ": " << conf.fileName() << ": no log file specified"
           << endl;
      return 1;
    }
    logger.initialize(conf.getString("log"), "[%F %T] ");
    if (!logger) {
      cerr << argv[0] << ": " << logger.error() << endl;
      return 1;
    }
  }
  interfaceNames = explodeString(conf.getString("interfaces"));
  interfaces.resize(interfaceNames.size());
  for (size_t i = 0; i < interfaceNames.size(); ++i) {
    interfaces[i].index = i;
    interfaces[i].name = interfaceNames[i];
    if (conf.getString("mode_" + interfaceNames[i]) == "") {
      cerr << argv[0] << ": " << conf.fileName()
           << ": no mode specified for " << interfaceNames[i] << endl;
      return 1;
    }
    if (conf.getString("mode_" + interfaceNames[i]) == "passive") {
      interfaces[i].mode = PASSIVE_MODE;
    }
    else {
      if (conf.getString("mode_" + interfaceNames[i]) == "aggressive") {
        interfaces[i].mode = AGGRESSIVE_MODE;
      }
      else {
        cerr << argv[0] << ": " << conf.fileName() << ": unknown mode \""
             << conf.getString("mode_" + interfaceNames[i])
             << "\" specified for " << interfaceNames[i] << endl;
        return 1;
      }
    }
    for (size_t j = 0; j < conf.getStrings("pair_" +
         interfaceNames[i]).size(); ++j) {
      addressPair = explodeString(conf.getStrings("pair_" +
                                                  interfaceNames[i])[j]);
      if (addressPair.size() != 2) {
        cerr << argv[0] << ": " << conf.fileName()
             << ": malformed address pair \""
             << conf.getStrings("pair_" + interfaceNames[i])[j] << '"' << endl;
        return 1;
      }
      interfaces[i].pairs[textToIP(addressPair[0])] = textToEthernet(addressPair[1]);
      interfaces[i].descriptor = pcap_open_live(interfaceNames[i].c_str(),
                                                65535, 1, 0, errorBuffer);
      if (interfaces[i].descriptor == NULL) {
        cerr << argv[0] << ": " << errorBuffer << endl;
        return 1;
      }
      if (interfaces[i].mode == AGGRESSIVE_MODE) {
        if (conf.getString("reply_" + interfaces[i].name) == "" ||
            conf.getString("reply_" + interfaces[i].name) == interfaces[i].name) {
          interfaces[i].replyName = interfaces[i].name;
          interfaces[i].replyDescriptor = interfaces[i].descriptor;
        }
        else {
          interfaces[i].replyName = conf.getString("reply_" + interfaces[i].name);
          interfaces[i].replyDescriptor = pcap_open_live(interfaces[i].replyName.c_str(),
                                                         65535, 1, 0, errorBuffer);
          if (interfaces[i].replyDescriptor == NULL) {
            cerr << argv[0] << ": " << errorBuffer << endl;
            return 1;
          }
        }
      }
      /*
       * Older versions of libpcap expect the third argument of pcap_compile()
       * to be of type "char*".
       */
     if (pcap_compile(interfaces[i].descriptor, &bpfProgram, (char*)"arp", 0,
                      0) == -1) {
        cerr << argv[0] << ": " << pcap_geterr(interfaces[i].descriptor)
             << endl;
        return 1;
      }
      if (pcap_setfilter(interfaces[i].descriptor, &bpfProgram) == -1) {
        cerr << argv[0] << ": " << pcap_geterr(interfaces[i].descriptor)
             << endl;
        return 1;
      }
/* If running on FreeBSD, put the BPF device into immediate mode. */
#ifdef __FreeBSD__
      if (ioctl(pcap_fileno(interfaces[i].descriptor), BIOCIMMEDIATE,
                &immediate) == -1) {
        cerr << argv[0] << ": " << strerror(errno) << endl;
        return 1;
      }
#endif
    }
  }
  pid = fork();
  if (pid < 0) {
    cerr << argv[0] << ": fork(): " << strerror(errno) << endl;
    return 1;
  }
  /* If this is the child process... */
  if (pid == 0) {
    /* Write our PID to the PID file. */
    pidFile.open(pidFileName.c_str());
    if (!pidFile) {
      cerr << argv[0] << ": open(): " << pidFileName << ": " << strerror(errno)
           << endl;
      return 1;
    }
    pidFile << getpid() << endl;
    pidFile.close();
    if (chdir("/") != 0) {
      cerr << argv[0] << ": chdir(): /: " << strerror(errno) << endl;
      return 1;
    }
    /* Close unneeded file descriptors. */
    if (close(STDIN_FILENO) != 0) {
      cerr << argv[0] << ": close(): STDIN_FILENO: " << strerror(errno) << endl;
      return 1;
    }
    if (close(STDOUT_FILENO) != 0) {
      cerr << argv[0] << ": close(): STDOUT_FILENO: " << strerror(errno) << endl;
      return 1;
    }
    if (close(STDERR_FILENO) != 0) {
      cerr << argv[0] << ": close(): STDERR_FILENO: " << strerror(errno) << endl;
      return 1;
    }
  }
  /* Otherwise, if this is the parent process, exit. */
  else {
    return 0;
  }
  logger << logger.time() << programName << " starting." << endl;
  /* Start listener threads. */
  for (size_t i = 0; i < interfaces.size(); ++i) {
    /*
     * Don't bother starting a listener thread for an interface with no address
     * pairs configured.
     */
    if (interfaces[i].pairs.size() > 0) {
      error = pthread_create(&(interfaces[i].thread), NULL, &listen,
                             &(interfaces[i]));
      if (error != 0) {
        logger.lock();
        logger << logger.time() << "pthread_create(): " << strerror(error)
               << "; exiting." << endl;
        logger.unlock();
        return 1;
      }
    }
  }
  /* Start delayed response thread. */
  error = pthread_create(&delayedResponseThread, NULL, &delayedResponse, NULL);
  if (error != 0) {
    logger.lock();
    logger << logger.time() << "pthread_create(): " << strerror(error)
           << "; exiting." << endl;
    logger.unlock();
    return 1;
  }
  /* Wait forever for listener threads to return. */
  for (size_t i = 0; i < interfaces.size(); ++i) {
    if (interfaces[i].pairs.size() > 0) {
      error = pthread_join(interfaces[i].thread, NULL);
      if (error != 0) {
        logger.lock();
        logger << logger.time() << "pthread_join(): " << strerror(error)
               << "; exiting." << endl;
        logger.unlock();
        return 1;
      }
    }
  }
  /* Wait forever for delayed response thread to return. */
  error = pthread_join(delayedResponseThread, NULL);
  if (error != 0) {
    logger.lock();
    logger << logger.time() << "pthread_join(): " << strerror(error)
           << "; exiting." << endl;
    logger.unlock();
    return 1;
  }
  /* Not reached. */
  return 0;
}