public void ReceivePackets()
{
// Retrieve the device list from the local machine
IList<LivePacketDevice> allDevices = LivePacketDevice.AllLocalMachine;
// Find the NPF device of the TAP interface
PacketDevice selectedDevice = null;
for (int i = 0; i != allDevices.Count; ++i)
{
LivePacketDevice device = allDevices[i];
if (device.Name.ToUpper().Contains(Guid.ToString().ToUpper()))
{
selectedDevice = device;
break;
}
}
if (selectedDevice == null)
{
Initialized.Set();
Global.ShowTrayTip("Load Balancer", "Interface " + Name + " not captured by WinPcap.", System.Windows.Forms.ToolTipIcon.Warning);
Global.WriteLog("Load Balancer: Interface " + Name + " not captured by WinPcap.");
return;
}
try
{
using (communicator = selectedDevice.Open(65536, PacketDeviceOpenAttributes.MaximumResponsiveness, 1000))
{
Global.WriteLog("Load Balancer: Listening on " + Name + "...");
communicator.SetFilter("(ether dst " + ownHardwareAddressString + " and ((ip and (tcp or udp or icmp)) or arp)) or (ether dst FF:FF:FF:FF:FF:FF and arp)");
Initialized.Set();
communicator.ReceivePackets(0, (packet) =>
{
if (!ThreadActive.IsSet)
{
communicator.Break();
return;
}
if (packet.Ethernet.EtherType == EthernetType.Arp)
{
if (packet.Ethernet.Arp.TargetProtocolAddress.SequenceEqual(ownProtocolAddressByte) && packet.Ethernet.Arp.Operation == ArpOperation.Request)
{
EthernetLayer ethernetLayer = new EthernetLayer
{
Source = ownHardwareAddress,
Destination = packet.Ethernet.Source,
EtherType = EthernetType.None,
};
ArpLayer arpLayer = new ArpLayer
{
ProtocolType = EthernetType.IpV4,
Operation = ArpOperation.Reply,
SenderHardwareAddress = ownHardwareAddressByte.AsReadOnly(),
SenderProtocolAddress = packet.Ethernet.Arp.TargetProtocolAddress,
TargetHardwareAddress = packet.Ethernet.Arp.SenderHardwareAddress,
TargetProtocolAddress = packet.Ethernet.Arp.SenderProtocolAddress,
};
PacketBuilder builder = new PacketBuilder(ethernetLayer, arpLayer);
SendPacket(builder.Build(DateTime.Now));
}
}
else if (packet.Ethernet.EtherType.ToString() == "IpV4")
{
if (packet.Ethernet.IpV4.Fragmentation.Options == IpV4FragmentationOptions.DoNotFragment ||
packet.Ethernet.IpV4.Fragmentation.Options == IpV4FragmentationOptions.None && packet.Ethernet.IpV4.Fragmentation.Offset == 0)
{
IpV4Handler(packet);
}
else if (packet.Ethernet.IpV4.Fragmentation.Options == IpV4FragmentationOptions.MoreFragments ||
packet.Ethernet.IpV4.Fragmentation.Options == IpV4FragmentationOptions.None && packet.Ethernet.IpV4.Fragmentation.Offset > 0)
{
// TODO: fix warning spam
if (Global.Config.LoadBalancer.ShowTrayTipsWarnings)
Global.ShowTrayTip("Load Balancer", "IP fragmentation detected on " + Name + ".\n\nIP fragmentation is not supported.", ToolTipIcon.Warning);
Global.WriteLog("Load Balancer: IP fragmentation detected on " + Name);
//fragments = fragBuffer.Add(packet);
//if (fragments != null)
// for (int i = 0; i < fragments.Count; i++)
// {
// IpV4Handler(fragments[i], fragments);
// }
}
}
});
}
}
catch (Exception e)
{
if (ThreadActive.IsSet)
{
ThreadActive.Reset();
Global.WriteLog("Load Balancer: " + Name + " has disconnected");
if (Global.Config.Gadget.Debug)
Global.WriteLog(e.ToString());
Global.ShowTrayTip("Load Balancer", Name + " has disconnected", System.Windows.Forms.ToolTipIcon.Warning);
}
}
}
public bool Equals(ArpLayer other)
{
if (other != null && this.ProtocolType == other.ProtocolType && (this.Operation == other.Operation && Enumerable.SequenceEqual <byte>((IEnumerable <byte>) this.SenderHardwareAddress, (IEnumerable <byte>)other.SenderHardwareAddress)) && (Enumerable.SequenceEqual <byte>((IEnumerable <byte>) this.SenderProtocolAddress, (IEnumerable <byte>)other.SenderProtocolAddress) && Enumerable.SequenceEqual <byte>((IEnumerable <byte>) this.TargetHardwareAddress, (IEnumerable <byte>)other.TargetHardwareAddress)))
{
return(Enumerable.SequenceEqual <byte>((IEnumerable <byte>) this.TargetProtocolAddress, (IEnumerable <byte>)other.TargetProtocolAddress));
}
return(false);
}
/// <summary>
/// True iff the two ARP layers have equal protocol type, operation and addresses.
/// </summary>
/// <param name="other">The ARP layer to compare the layer to.</param>
/// <returns>True iff the two layers are equal.</returns>
public bool Equals(ArpLayer other)
{
return(other != null &&
ProtocolType == other.ProtocolType && Operation == other.Operation &&
SenderHardwareAddress.SequenceEqual(other.SenderHardwareAddress) &&
SenderProtocolAddress.SequenceEqual(other.SenderProtocolAddress) &&
TargetHardwareAddress.SequenceEqual(other.TargetHardwareAddress) &&
TargetProtocolAddress.SequenceEqual(other.TargetProtocolAddress));
}
public void SendGratuitousArpRequest()
{
PcapDotNet.Packets.Arp.ArpLayer arpLayer =
new PcapDotNet.Packets.Arp.ArpLayer
{
ProtocolType = PcapDotNet.Packets.Ethernet.EthernetType.IpV4,
Operation = ArpOperation.Request,
SenderHardwareAddress = _client.Configuration.MacAddress.AsBytes.AsReadOnly(),
SenderProtocolAddress = _client.Configuration.IpAddress.AsBytes.AsReadOnly(),
TargetHardwareAddress = Common.MacAddress.Broadcast.AsBytes.AsReadOnly(),
TargetProtocolAddress = _client.Configuration.IpAddress.AsBytes.AsReadOnly(),
};
OSI.Layer2Packet packet = new OSI.Layer2Packet();
packet.DestinationMac = Common.MacAddress.Broadcast;
packet.SourceMac = _client.Configuration.MacAddress;
packet.NextLayers.Add(arpLayer);
SendPacket(packet);
}
private void SendArpReplyPacket(Common.IPv4Address ip)
{
PcapDotNet.Packets.Arp.ArpLayer arpLayer =
new PcapDotNet.Packets.Arp.ArpLayer
{
ProtocolType = PcapDotNet.Packets.Ethernet.EthernetType.IpV4,
Operation = ArpOperation.Reply,
SenderHardwareAddress = _client.Configuration.MacAddress.AsBytes.AsReadOnly(),
SenderProtocolAddress = _client.Configuration.IpAddress.AsBytes.AsReadOnly(),
TargetHardwareAddress = ArpCache[ip.AsString].Mac.AsBytes.AsReadOnly(),
TargetProtocolAddress = ip.AsBytes.AsReadOnly(),
};
OSI.Layer2Packet packet = new OSI.Layer2Packet();
packet.DestinationMac = ArpCache[ip.AsString].Mac;
packet.SourceMac = _client.Configuration.MacAddress;
packet.NextLayers.Add(arpLayer);
SendPacket(packet);
}
public OwnPacketBuilder(PacketType packetType)
{
GetLocalInformation.LocalMacAndIPAddress( out _ownIpAddress, out _ownMacAddress );
ethernetLayer = null;
ipV4Layer = null;
tcpLayer = null;
arpLayer = null;
switch(packetType)
{
case PacketType.ARP :
BuildingArpPacket();
break;
case PacketType.TCP :
BuildingTcpPacket();
break;
case PacketType.Unknown :
break;
default :
break;
}
}
void BuildingArpPacket()
{
ethernetLayer = new EthernetLayer
{
Source = new MacAddress( ToMac( _ownMacAddress.ToString() ) ),
Destination = new MacAddress( "FF:FF:FF:FF:FF:FF" ),
EtherType = EthernetType.None, // Will be filled automatically.
};
arpLayer = new ArpLayer
{
ProtocolType = EthernetType.IpV4,
Operation = ArpOperation.Request,
SenderHardwareAddress = Array.AsReadOnly( _ownMacAddress.GetAddressBytes().ToArray() ), // 03:03:03:03:03:03.
SenderProtocolAddress = Array.AsReadOnly( _ownIpAddress ), // 1.2.3.4.
TargetHardwareAddress = Array.AsReadOnly( new byte[] { 0, 0, 0, 0, 0, 0 } ), // 00:00:00:00:00:00.
};
}
/// <summary>
/// True iff the two ARP layers have equal protocol type, operation and addresses.
/// </summary>
/// <param name="other">The ARP layer to compare the layer to.</param>
/// <returns>True iff the two layers are equal.</returns>
public bool Equals(ArpLayer other)
{
return other != null &&
ProtocolType == other.ProtocolType && Operation == other.Operation &&
SenderHardwareAddress.SequenceEqual(other.SenderHardwareAddress) &&
SenderProtocolAddress.SequenceEqual(other.SenderProtocolAddress) &&
TargetHardwareAddress.SequenceEqual(other.TargetHardwareAddress) &&
TargetProtocolAddress.SequenceEqual(other.TargetProtocolAddress);
}
/// <summary>
/// This function build an ARP over Ethernet packet.
/// </summary>
private static Packet BuildArpPacket()
{
EthernetLayer ethernetLayer =
new EthernetLayer
{
Source = new MacAddress("01:01:01:01:01:01"),
Destination = new MacAddress("02:02:02:02:02:02"),
EtherType = EthernetType.None, // Will be filled automatically.
};
ArpLayer arpLayer =
new ArpLayer
{
ProtocolType = EthernetType.IpV4,
Operation = ArpOperation.Request,
SenderHardwareAddress = new byte[] {3, 3, 3, 3, 3, 3}.AsReadOnly(), // 03:03:03:03:03:03.
SenderProtocolAddress = new byte[] {1, 2, 3, 4}.AsReadOnly(), // 1.2.3.4.
TargetHardwareAddress = new byte[] {4, 4, 4, 4, 4, 4}.AsReadOnly(), // 04:04:04:04:04:04.
TargetProtocolAddress = new byte[] {11, 22, 33, 44}.AsReadOnly(), // 11.22.33.44.
};
PacketBuilder builder = new PacketBuilder(ethernetLayer, arpLayer);
return builder.Build(DateTime.Now);
}
private Packet BuildArpPacketReply(IpV4Address victimIp, MacAddress victimMac, IpV4Address ipToSpoof, MacAddress newSourceMac)
{
EthernetLayer ethernetLayer = new EthernetLayer
{
Source = newSourceMac,
Destination = victimMac,
EtherType = EthernetType.None // Will be filled automatically
};
ArpLayer arpLayer = new ArpLayer
{
ProtocolType = EthernetType.IpV4,
Operation = ArpOperation.Reply,
SenderHardwareAddress = Helper.MacAddressToBytes(newSourceMac),
SenderProtocolAddress = Helper.IpAddressToBytes(ipToSpoof),
TargetHardwareAddress = Helper.MacAddressToBytes(victimMac),
TargetProtocolAddress = Helper.IpAddressToBytes(victimIp)
};
PacketBuilder builder = new PacketBuilder(ethernetLayer, arpLayer);
return builder.Build(DateTime.Now);
}
private Packet BuildArpPacketRequest(IpV4Address targetIp)
{
EthernetLayer ethernetLayer =
new EthernetLayer
{
Source = _ownMacAddr,
Destination = _macBroadcastAddr, //broadcast
EtherType = EthernetType.None, // Will be filled automatically.
};
ArpLayer arpLayer =
new ArpLayer
{
ProtocolType = EthernetType.IpV4,
Operation = ArpOperation.Request,
SenderHardwareAddress = Array.AsReadOnly(_ownMacAddrByte), // self mac-address
SenderProtocolAddress = Array.AsReadOnly(_ownIpAddrByte), // self ip-address
TargetHardwareAddress = Array.AsReadOnly(_targetMacAddr), // Not Yet known
TargetProtocolAddress = Helper.IpAddressToBytes(targetIp) // ip we want to get the mac for
};
PacketBuilder builder = new PacketBuilder(ethernetLayer, arpLayer);
return builder.Build(DateTime.Now);
}
