diff --git a/nselib/packet.lua b/nselib/packet.lua index e343eb6f5..3e9260089 100644 --- a/nselib/packet.lua +++ b/nselib/packet.lua @@ -120,83 +120,6 @@ IPPROTO_COMP = 108 -- Compression Header protocol IPPROTO_SCTP = 132 -- Stream Control Transport Protocol IPPROTO_UDPLITE = 136 -- UDP-Lite (RFC 3828) -IPPROTO_ICMPV6 = 58 -IPV6_HOPBYHOP_OPTION = 0 -IPV6_DESTINATION_OPTION = 60 -IP_PROTO_ICMPV6 = 58 - -ICMP6_ECHO_REQUEST = 128 -ICMP6_ECHO_REPLY = 129 -MLD_LISTENER_QUERY = 130 -MLD_LISTENER_REPORT = 131 -MLD_LISTENER_REDUCTION = 132 -ND_ROUTER_SOLICIT = 133 -ND_ROUTER_ADVERT = 134 -ND_NEIGHBOR_SOLICIT = 135 -ND_NEIGHBOR_ADVERT = 136 -ND_REDIRECT = 137 - -ND_OPT_SOURCE_LINKADDR = 1 -ND_OPT_TARGET_LINKADDR = 2 -ND_OPT_PREFIX_INFORMATION = 3 -ND_OPT_REDIRECTED_HEADER = 4 -ND_OPT_MTU = 5 -ND_OPT_RTR_ADV_INTERVAL = 7 -ND_OPT_HOME_AGENT_INFO = 8 - ----------------------------------------------------------------------------------------------------------------- --- Frame is a class -Frame = {} - -function Frame:new(frame, force_continue) - local packet = nil - local packet_len = 0 - if frame and #frame > 14 then - packet = string.sub(frame, 15, -1) - packet_len = #frame - 14 - end - local o = Packet:new(packet, packet_len, force_continue) - - o.build_ether_frame = self.build_ether_frame - o.ether_parse = self.ether_parse - o.frame_buf = frame - o:ether_parse() - return o -end ---- Build an Ethernet frame. --- @param mac_dst six-byte string of the destination MAC address. --- @param mac_src six-byte string of the source MAC address. --- @param packet string of the payload. --- @return frame string of the Ether frame. -function Frame:build_ether_frame(mac_dst, mac_src, packet) - self.mac_dst = mac_dst or self.mac_dst - self.mac_src = mac_src or self.mac_src - self.buf = packet or self.buf - local l3_type - if self.ip_v == 4 then - l3_type = string.char(0x08, 0x00) - elseif self.ip_v == 6 then - l3_type = string.char(0x86, 0xdd) - else - return nil, "Unknown packet." - end - self.frame_buf = self.mac_dst..self.mac_src..l3_type..self.buf -end ---- Parse an Ethernet frame. --- @param frame string of the Ether frame. --- @return mac_dst six-byte string of the destination MAC address. --- @return mac_src six-byte string of the source MAC address. --- @return packet string of the payload. -function Frame:ether_parse() - if not self.frame_buf then - return false - end - if #self.frame_buf < 14 then -- too short - return false - end - self.mac_dst = string.sub(self.frame_buf, 1, 6) - self.mac_src = string.sub(self.frame_buf, 7, 12) -end ---------------------------------------------------------------------------------------------------------------- -- Packet is a class @@ -213,27 +136,11 @@ Packet = {} -- @return A new Packet. function Packet:new(packet, packet_len, force_continue) local o = setmetatable({}, {__index = Packet}) - if not packet then - return o - end o.buf = packet o.packet_len = packet_len - o.ip_v = bit.rshift(string.byte(o.buf), 4) - if o.ip_v == 4 and not o:ip_parse(force_continue) then - return nil - elseif o.ip_v == 6 and not o:ip6_parse(force_continue) then + if not o:ip_parse(force_continue) then return nil end - - if o.ip_v == 6 then - while o.ip6_nhdr ~= IPPROTO_TCP and o.ip6_nhdr ~= IPPROTO_UDP and o.ip6_nhdr ~= IPPROTO_ICMPV6 do - if not o:ipv6_ext_header_parse(force_continue) then - return nil - end - end - o.ip_p = o.ip6_nhdr - end - if o.ip_p == IPPROTO_TCP then if not o:tcp_parse(force_continue) then stdnse.print_debug("Error while parsing TCP packet\n") @@ -246,151 +153,9 @@ function Packet:new(packet, packet_len, force_continue) if not o:icmp_parse(force_continue) then stdnse.print_debug("Error while parsing ICMP packet\n") end - elseif o.ip_p == IPPROTO_ICMPV6 then - if not o:icmpv6_parse(force_continue) then - stdnse.print_debug("Error while parsing ICMPv6 packet\n") - end end return o end ---- Build an IPv6 packet. --- @param src 16-byte string of the source IPv6 address. --- @param dsr 16-byte string of the destination IPv6 address. --- @param nx_hdr integer that represents next header. --- @param h_limit integer that represents hop limit. --- @param t_class integer that represents traffic class. --- @param f_label integer that represents flow label. -function Packet:build_ipv6_packet(src, dst, nx_hdr, payload, h_limit, t_class, f_label) - self.ip_v = 6 - self.ip6_src = src or self.ip6_src - self.ip6_dst = dst or self.ip6_dst - self.ip6_nhdr = nx_hdr or self.ip6_nhdr - self.l4_packet = payload or self.l4_packet - self.ip6_tc = t_class or self.ip6_tc or 1 - self.ip6_fl = f_label or self.ip6_fl or 1 - self.ip6_hlimit = h_limit or self.ip6_hlimit or 255 - - local ver_tc_fl = bit.lshift(bit.band(self.ip_v, 0xF), 28) + - bit.lshift(bit.band(self.ip6_tc, 0xFF), 20) + - bit.band(self.ip6_fl, 0xFFFFF) - - self.buf = - set_u32("....",0,ver_tc_fl) .. - set_u16("..",0,#(self.exheader or "")+#(self.l4_packet or "")) ..--string.char(0x00,0x10) .. --payload length - string.char(self.ip6_nxt_hdr) .. --next header - string.char(self.ip6_hlimit) .. --hop limit - self.ip6_src .. --Source - self.ip6_dst ..--dest - (self.exheader or "").. - (self.l4_packet or "") -end ---- Build an IPv6 invalid extension header. --- @param exheader integer that represents extension header's type -function Packet:build_invalid_extension_header(exheader_type) - local ex_invalid_opt = string.char(0x80,0x01,0xfe,0x18,0xfe,0x18,0xfe,0x18,0x0,0x0,0x0,0x0,0x0,0x0) - local ext_header = - string.char(self.ip6_nxt_hdr) .. --next header - string.char(#ex_invalid_opt/16) .. --length (16bytes) - ex_invalid_opt - self.exheader = ext_header..(self.exheader or "") - self.ip6_nxt_hdr = exheader_type -end ---- Count IPv6 checksum. --- @return the checksum. -function Packet:count_ipv6_pseudoheader_cksum() - local pseudoheader = self.ip6_src .. self.ip6_dst .. set_u16("..",0,#self.l4_packet) .. string.char(0x0,0x0,0x0) .. string.char(self.ip6_nxt_hdr) - local ck_content = pseudoheader .. self.l4_packet - return in_cksum(ck_content) -end ---- Set ICMPv6 checksum. -function Packet:set_icmp6_cksum(check_sum) - self.l4_packet = set_u16(self.l4_packet, 2, check_sum) -end ---- Build an ICMPv6 header. --- @param icmpv6_type integer that represent ICMPv6 type. --- @param icmpv6_code integer that represent ICMPv6 code. --- @param icmpv6_payload string of the payload --- @param ip6_src 16-byte string of the source IPv6 address. --- @param ip6_dst 16-byte string of the destination IPv6 address. -function Packet:build_icmpv6_header(icmpv6_type, icmpv6_code, icmpv6_payload, ip6_src, ip6_dst) - self.ip6_nxt_hdr = IPPROTO_ICMPV6 - self.icmpv6_type = icmpv6_type or self.icmpv6_type - self.icmpv6_code = icmpv6_code or self.icmpv6_code - self.icmpv6_payload = icmpv6_payload or self.icmpv6_payload - self.ip6_src = ip6_src or self.ip6_src - self.ip6_dst = ip6_dst or self.ip6_dst - - self.l4_packet = - string.char(self.icmpv6_type,self.icmpv6_code) .. - string.char(0x00,0x00) .. --checksum - (self.icmpv6_payload or "") - local check_sum = self:count_ipv6_pseudoheader_cksum() - self:set_icmp6_cksum(check_sum) -end ---- Build an ICMPv6 Echo Request frame. --- @param mac_src six-byte string of source MAC address. --- @param mac_dst sis-byte string of destination MAC address. --- @param ip6_src 16-byte string of source IPv6 address. --- @param ip6_dst 16-byte string of destinatiion IPv6 address. --- @param id integer that represents Echo ID. --- @param sequence integer that represents Echo sequence. --- @param data string of Echo data. --- @param tc integer that represents traffic class of IPv6 packet. --- @param fl integer that represents flow label of IPv6 packet. --- @param hop-limit integer that represents hop limit of IPv6 packet. -function Packet:build_icmpv6_echo_request(id, sequence, data, mac_src, mac_dst, ip6_src, ip6_dst, tc, fl, hop_limit) - self.mac_src = mac_src or self.mac_src - self.mac_dst = mac_dst or self.mac_dst - - self.ip6_src = ip6_src or self.ip6_src - self.ip6_dst = ip6_dst or self.ip6_dst - self.traffic_class = tc or 1 - self.flow_label = fl or 1 - self.ip6_hlimit = hop_limit or 255 - - self.icmpv6_type = ICMP6_ECHO_REQUEST - self.icmpv6_code = 0 - - self.echo_id = id or self.echo_id or 0xdead - self.echo_seq = sequence or self.echo_seq or 0xbeef - self.echo_data = data or self.echo_data or "" - - self.icmpv6_payload = set_u16("..",0,self.echo_id) .. set_u16("..",0,self.echo_seq) .. self.echo_data -end ---- Set an ICMPv6 option message. -function Packet:set_icmpv6_option(opt_type,msg) - return string.char(opt_type, (#msg+2)/8) .. msg -end ---- Build an Router Advertisement frame. --- @param mac_src six-byte string of the source MAC address. --- @param prefix 16-byte string of IPv6 address. --- @param prefix_len integer that represents the length of the prefix. --- @param valid_time integer that represents the valid time of the prefix. --- @param preferred_time integer that represents the preferred time of the prefix. -function Packet:build_router_advert(mac_src,prefix,prefix_len,valid_time,preferred_time) - self.ip6_src = mac_to_lladdr(mac_src) - self.ip6_dst = ipv6tobin("ff02::1") - self.mac_src = mac_src - self.mac_dst = mactobin("33:33:00:00:00:01") - - local ra_msg = string.char(0x0, --cur hop limit - 0x08, --flags - 0x00,0x00, --router lifetime - 0x00,0x00,0x00,0x00, --reachable time - 0x00,0x00,0x00,0x00) --retrans timer - local prefix_option_msg = string.char(prefix_len, - 0xc0) .. --flags: Onlink, Auto - packet.set_u32("....",0,valid_time) .. - packet.set_u32("....",0,preferred_time) .. - string.char(0,0,0,0) .. --unknown - prefix - local icmpv6_prefix_option = self:set_icmpv6_option(ND_OPT_PREFIX_INFORMATION,prefix_option_msg) - local icmpv6_src_link_option = self:set_icmpv6_option(ND_OPT_SOURCE_LINKADDR,mac_src) - self.icmpv6_payload = ra_msg .. icmpv6_prefix_option .. icmpv6_src_link_option - - self.icmpv6_type = ND_ROUTER_ADVERT - self.icmpv6_code = 0 -end -- Helpers @@ -406,73 +171,6 @@ function iptobin(str) end return ret end -function inet6_pton_simple(str) - local addr_hex = "" - if str==nil then - return addr_hex - end - local unit16 - for unit16 in string.gmatch(str, "%x+") do - local h8 = string.sub(unit16,-4,-3) - local l8 = string.sub(unit16,-2,-1) - local unit8 - for _,unit8 in pairs({h8,l8}) do - if (unit8 == "") then - addr_hex = addr_hex .. string.char(0x00) - else - addr_hex = addr_hex .. string.char("0x"..unit8) - end - end - end - return addr_hex -end ---- Convert an IPv6 address string (like "fe80:21::1") to a raw --- string 16 bytes long. --- @param str IPv6 address string. --- @return 16-byte string. -function ipv6tobin(str) - if not str then - return nil - end - local check_str = string.gsub(str,":","f") - if string.match(check_str,"[%X]") then - return nil,"Invalid IPv6 address: unknown character." - end - local i,j - i,j = string.find(str,"::") - if not i then - return inet6_pton_simple(str) - end - local lpart - local rpart - lpart = string.match(str,"([%x:]-)::") - rpart = string.match(str,"::([%x:]+)") - local lpart_hex = inet6_pton_simple(lpart) - local rpart_hex = inet6_pton_simple(rpart) - if (#lpart_hex+#rpart_hex~=16) then - local filler_num = 16 - #lpart_hex - #rpart_hex - local i - for i=1,filler_num do - lpart_hex = lpart_hex .. string.char(0x00) - end - end - return lpart_hex .. rpart_hex -end ---- Convert a MAC address string (like "00:23:ae:5d:3b:10") to --- a raw six-byte long. --- @param str MAC address string. --- @return Six-byte string. -function mactobin(str) - if not str then - return mactobin("00:00:00:00:00:00") - end - local unit8 - local addr_hex = "" - for unit8 in string.gmatch(str,"%x+") do - addr_hex = addr_hex .. string.char("0x"..unit8) - end - return addr_hex -end --- Convert a four-byte raw string to a dotted-quad IP address string. -- @param raw_ip_addr Four-byte string. -- @return IP address string. @@ -482,27 +180,6 @@ function toip(raw_ip_addr) end return string.format("%i.%i.%i.%i", string.byte(raw_ip_addr,1,4)) end ---- Convert a 16-byte raw string to an IPv6 address string. --- @param raw_ipv6_addr 16-byte string. --- @return IPv6 address string. -function toipv6(raw_ipv6_addr) - if not raw_ipv6_addr then - return "?::?" - end - return string.format("%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x", - string.byte(raw_ipv6_addr,1,16)) -end ---- Generate the link-local IPv6 address from the MAC address. --- @param mac MAC address string. --- @return Link-local IPv6 address string. -function mac_to_lladdr(mac) - if not mac then - return "?::?" - end - local interfier = string.char(bit.bor(string.byte(mac,1),0x02))..string.sub(mac,2,3)..string.char(0xff,0xfe)..string.sub(mac,4,6) - local ll_prefix = ipv6tobin("fe80::") - return string.sub(ll_prefix,1,8)..interfier -end --- Get an 8-bit integer at a 0-based byte offset in the packet. -- @param index Offset. -- @return An 8-bit integer. @@ -592,38 +269,6 @@ function Packet:ip_parse(force_continue) self.ip_data_offset = self.ip_offset + self.ip_hl*4 return true end ---- Parse an IPv6 packet header. --- @param force_continue Ignored. --- @return Whether the parsing succeeded. -function Packet:ip6_parse(force_continue) - self.ip6_offset = 0 - if #self.buf < 40 then -- too short - return false - end - self.ip_v = bit.rshift(bit.band(self:u8(self.ip6_offset + 0), 0xF0), 4) - if self.ip_v ~= 6 then -- not ipv6 - return false - end - self.ip6 = true - self.ip6_tc = bit.rshift(bit.band(self:u16(self.ip6_offset + 0), 0x0FF0), 4) - self.ip6_fl = bit.band(self:u8(self.ip6_offset + 1), 0x0F)*65536 + self:u16(self.ip6_offset + 2) - self.ip6_plen = self:u16(self.ip6_offset + 4) - self.ip6_nhdr = self:u8(self.ip6_offset + 6) - self.ip6_hlimt = self:u8(self.ip6_offset + 7) - self.ip6_src = self:raw(self.ip6_offset + 8, 16) - self.ip6_dst = self:raw(self.ip6_offset + 24, 16) - self.ip6_data_offset = 40 - return true -end ---- Pare an IPv6 extension header. Just jump over it at the moment. --- @param force_continue Ignored. --- @return Whether the parsing succeeded. -function Packet:ipv6_ext_header_parse(force_continue) - local ext_hdr_len = self.u8(self.ip6_data_offset + 1) - ext_hdr_len = ext_hdr_len*8 + 8 - self.ip6_data_offset = self.ip6_data_offset + ext_hdr_len - self.ip6_nhdr = self.u8(self.ip6_data_offset) -end --- Set the header length field. function Packet:ip_set_hl(len) self:set_u8(self.ip_offset + 0, bit.bor(bit.lshift(self.ip_v, 4), bit.band(len, 0x0F))) @@ -775,25 +420,6 @@ function Packet:icmp_tostring() return self:ip_tostring() .. " ICMP(" .. self.icmp_payload:tostring() .. ")" end ----------------------------------------------------------------------------------------------------------------- ---- Parse an ICMPv6 packet header. --- @param force_continue Ignored. --- @return Whether the parsing succeeded. -function Packet:icmpv6_parse(force_continue) - self.icmpv6_offset = self.ip6_data_offset - if #self.buf < self.icmpv6_offset + 8 then -- let's say 8 bytes minimum - return false - end - self.icmpv6 = true - self.icmpv6_type = self:u8(self.icmpv6_offset + 0) - self.icmpv6_code = self:u8(self.icmpv6_offset + 1) - - if self.icmpv6_type == ND_NEIGHBOR_SOLICIT then - self.ns_target = self:raw(self.icmpv6_offset + 8, 16) - end - return true -end - ---------------------------------------------------------------------------------------------------------------- -- Parse a TCP packet header. -- @param force_continue Whether a short packet causes parsing to fail.