/*
 *  TCP Portscan Detector v0.8
 *  os: Linux, FreeBSD, OpenBSD
 *  author: dodo <dodo@darkwired.org>
 *  date: 23-dec-2003
 *
 *  description:
 *   this tool can detect TCP portscans and alerts them
 *   check -h for more info
 *   tested on: FreeBSD 5.1, OpenBSD 3.3, Slackware linux 9.0
 *
 *  license:
 *   this code is licensed under the GNU GPL
 *   by compiling this, you agree to this license
 *
 *  compilation:
 *   gcc PScanDetect.c -o pscandetect -lpcap
 *
 *  todo:
 *   SCAN_INSPECT detection
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <time.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <net/if.h>

  #ifndef __OpenBSD__
  #include <net/ethernet.h>
  #endif

#include <netinet/in.h>
#include <netinet/if_ether.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <pcap.h>

  #ifdef __Win32__
  #error "you idiot, I did not code this for Win32!"  
  #endif

  #ifdef __Linux__
  #include <netinet/ether.h>
  #endif

/* define the scan types */
#define SCAN_SINGLESTEP    0x1
#define SCAN_LARGESTEP    0x2
#define SCAN_INSPECT    0x3
#define SCAN_MANYHIGH    0x4

/* define boundaries */
#define MAX_BLASTERS     20
#define MAX_SCANNERS     20
#define MAX_PORTS     20
#define BOUNDARY_MANYHIGH  5000

/* define misc constants */
#define VERSION      0.8
#define NUM_TYPES    4
#define NUM_DROP_SECS    5
#define NAME_SCAN_SINGLESTEP  "SCAN_SINGLESTEP"
#define NAME_SCAN_LARGESTEP  "SCAN_LARGESTEP"
#define NAME_SCAN_INSPECT  "SCAN_INSPECT"
#define NAME_SCAN_MANYHIGH  "SCAN_MANYHIGH"

struct my_ip {
  u_int8_t  ip_vhl;    /* header length, version */
#define IP_V(ip)  (((ip)->ip_vhl & 0xf0) >> 4)
#define IP_HL(ip)  ((ip)->ip_vhl & 0x0f)
  u_int8_t  ip_tos;    /* type of service */
  u_int16_t  ip_len;    /* total length */
  u_int16_t  ip_id;    /* identification */
  u_int16_t  ip_off;    /* fragment offset field */
#define  IP_DF 0x4000      /* dont fragment flag */
#define  IP_MF 0x2000      /* more fragments flag */
#define  IP_OFFMASK 0x1fff    /* mask for fragmenting bits */
  u_int8_t  ip_ttl;    /* time to live */
  u_int8_t  ip_p;    /* protocol */
  u_int16_t  ip_sum;    /* checksum */
  struct  in_addr ip_src,ip_dst;  /* source and dest address */
};

struct BlastRadius {
  unsigned short  id;      /* identifier */
  unsigned short  ports[MAX_PORTS];  /* ports accessed */
  unsigned short  portsn;      /* port pointer */
  unsigned long  birth;      /* since when? */
  unsigned long   lporttime;    /* time when last added port */
  unsigned short  active;      /* recycling? */
  struct in_addr  host;      /* the bastard */
};

struct Scanner {
  unsigned short  id;      /* identifier */
  unsigned short  portsn;      /* num ports accessed */
  unsigned char  type;      /* scan type */
  unsigned long   lporttime;    /* time when last added port */
  struct in_addr  host;      /* the bastard */
};


  /* interface attributes */
   char *dev;
  char *logfile = NULL;
  FILE *logfd;
  unsigned short int level = 3;
  unsigned char promiscuous = 0;
  unsigned char verbose = 0;

  /* internal attributes */
  char selfhost[20];
  char errbuf[PCAP_ERRBUF_SIZE];
  pcap_t *handle;
        struct pcap_pkthdr header;
        const u_char *packet;
  struct ether_header *data_ether;
  const struct my_ip* data_ip;
  const struct tcphdr* data_tcp;
  struct BlastRadius *blasters[MAX_BLASTERS];
  struct Scanner *scanners[MAX_SCANNERS];
  unsigned long int blastsize = 0;
  unsigned long int scanrsize = 0;
  int h;

  /* methods */
  void initPcap();
  char *getDevice();
  void getDeviceIP();
  void setFilter();
  void openLive();
  void closeLive();
  void doLoop();
  void nibblePacket();
  void inspectBlast(struct in_addr blasthost, unsigned int port);
  char addBR(struct in_addr blasthost, unsigned short int port);
  void replaceBR(struct in_addr blasthost, unsigned int port);
  void updateBR(struct in_addr blasthost, unsigned short int port);
  char checkBR(struct in_addr blasthost);
  char checkBRPort(struct BlastRadius *br, unsigned short int port);
  char checkBRPortMax(struct BlastRadius *br);
  void outputAlert(struct BlastRadius *br, char type);
  void dumpBR();
  void cleanBR();
  char checkSelf(struct in_addr blasthost);
  char checkScanner(struct in_addr blasthost);
  char addScanner(struct in_addr blasthost, unsigned short portsn, unsigned char type);
  char updateScanner(struct in_addr blasthost);
  void dumpScanners();
  void usage(char *self);
  char parseOptions(int argc, char *argv[]);


int main(int argc, char *argv[])
{
int i;
dev = getDevice();
  if(parseOptions(argc, argv)==0) usage(argv[0]);
  getDeviceIP();
  openLive();
  setFilter();
  doLoop();
  closeLive();
  dumpBR();
}

void usage(char *self)
{
fprintf(stdout, 
  "\nTCP Portscan Detector v%2.1f\n"
  "https://www.darkwired.org/\n\n"
  "usage: %s [options]\n"
  "options:\n"
  "  -l <file>  output to logfile\n"
  "  -a <level>  alert when scan alert type <= then <level> (default 3)\n"
  "  -d <device>  use this device to detect scans on\n"
  "  -p    enable promiscuous mode (detect scans in all traffic on line)\n"
  "  -v    enable verbose mode\n"
  "  -h    show this\n"
  "scan alert types:\n"
  "  0x1  SCAN_SINGLESTEP\n"
  "  0x2  SCAN_LARGESTEP\n"
  "  0x3  SCAN_INSPECT\n"
  "  0x4  SCAN_MANYHIGH\n",
VERSION, self);
exit(-1);
}

char parseOptions(int argc, char *argv[])
/* this will be messy :] */
{
int i;
  for(i=0; argc > i; i++) {

    if(argv[i][0]=='-') {
      switch(argv[i][1]) {
        case 'l': {
        if((i+1)>=argc) return 0;  /* option requires param */
        logfile = argv[i+1]; i++;
        break;
        }

        case 'd': {
        if((i+1)>=argc) return 0;   /* option requires param */
        dev = argv[i+1]; i++;
        break;
        }

        case 'a': {
        if((i+1)>=argc) return 0;   /* option requires param */
        level = atoi(argv[i+1]); i++;
          if(level<1 || level>NUM_TYPES) {
          fprintf(stderr, "bad alert level: %d\n", level);
          return 0;
          }
        break;
        }

        case 'h': {
        return 0;
        break;
        }

        case 'p': {
        promiscuous = 1;
        break;
        }

        case 'v': {
        verbose = 1;
        break;
        }
      }
    }
  }
  
  if(verbose==1) {
    printf("device: %s\n", dev);
    if(logfile == NULL) {
    printf("logfile: stdout\n");
    } else {
    printf("logfile: %s\n", logfile);
    }

    printf("alertlevel: %d\n", level);
    printf("promiscuous: %d\n", promiscuous);
  }
return 1;
}

char *getDevice()
{
     char *dev;
     dev = pcap_lookupdev(errbuf);
  return dev;
}

void getDeviceIP()
{
  struct sockaddr_in *ssin;
  struct ifreq ifr;
  unsigned long int ip;
  int fd;

  fd = socket(PF_INET, SOCK_DGRAM, 0);  

  /* ripped this peace of code somewhere using google */
  memset(&ifr, 0, sizeof(ifr));
  ssin = (struct sockaddr_in *)&ifr.ifr_addr;
  strncpy(ifr.ifr_name, dev, sizeof(ifr.ifr_name));
  ifr.ifr_addr.sa_family = AF_INET;

    if (ioctl(fd, SIOCGIFADDR, (char*) &ifr) < 0)
    {
    fprintf(stderr, "unable to get IP address of device: %s\n", dev);
    close(fd);
    exit(-1);
        }

  *ssin = * ( (struct sockaddr_in *)&ifr.ifr_addr);
  if(verbose==1)
  printf("device ip address: %s\n", inet_ntoa(ssin->sin_addr));  
  strncpy(selfhost, inet_ntoa(ssin->sin_addr), sizeof(selfhost));
}

void setFilter()
{
   struct bpf_program filter;
   char filter_app[] = "";
   bpf_u_int32 mask;
   bpf_u_int32 net;
   pcap_lookupnet(dev, &net, &mask, errbuf);
   pcap_compile(handle, &filter, filter_app, 0, net);
   pcap_setfilter(handle, &filter);
}

void openLive() 
{
  if(dev == NULL) {
  fprintf(stderr, "could not get network device (check permissions)\n");
  exit(-1);
  }
   handle = pcap_open_live(dev, BUFSIZ, promiscuous, 0, errbuf);
}

void closeLive() 
{
   pcap_close(handle);
}

void nibblePacket
  (
  u_char *user, 
  struct pcap_pkthdr *phrd, 
  u_char *packet
  )
{
data_ether = (struct ether_header *)packet;

  if(ntohs(data_ether->ether_type)==ETHERTYPE_IP)
  {
  data_ip = (struct my_ip *)(packet+sizeof(struct ether_header));
  data_tcp = (struct tcphdr *)(packet+sizeof(struct ether_header)+sizeof(struct my_ip));

  #ifdef __FreeBSD__ 
  inspectBlast(data_ip->ip_src, ntohs(data_tcp->th_dport));
  #elif defined __OpenBSD__
  inspectBlast(data_ip->ip_src, ntohs(data_tcp->th_dport));
  #elif defined __linux__
  inspectBlast(data_ip->ip_src, ntohs(data_tcp->dest));
  #endif
  
  /*printf("%s:%d -> %s:%d\n", //debugging
    inet_ntoa(data_ip->ip_src), 
    ntohs(data_tcp->source),
    inet_ntoa(data_ip->ip_dst),
    ntohs(data_tcp->dest)
        );
  */

  }
}

void doLoop()
{
pcap_loop(handle, -1, (pcap_handler)nibblePacket, 0);
}



void inspectBlast(struct in_addr blasthost, unsigned int port)
{
  if(checkSelf(blasthost)) {
  return;
  }


  if(checkScanner(blasthost)==1) {
    updateScanner(blasthost);
  return;
  }


  if(checkBR(blasthost)==0) {
    if(addBR(blasthost, port)==0) {
    replaceBR(blasthost, port);
    }
  } else {
  updateBR(blasthost, port);
  }

  /* now we check wether someone scanned us */
  cleanBR();
}

void dumpBR()
{
int i=0, a=0;
  for(i=0; blastsize>i; i++) {
printf("%d BlastRadius->host: %s (%d ports in %d secs) [%d]\n", blasters[i]->id, inet_ntoa(blasters[i]->host), blasters[i]->portsn, (int)(time(NULL) - blasters[i]->lporttime), blasters[i]->active);
    for(a=0; blasters[i]->portsn>a; a++) {
      printf("%d,", blasters[i]->ports[a]);
    }
    printf("\n");
  }
}

char addBR(struct in_addr blasthost, unsigned short int port)
{
  if(blastsize==MAX_BLASTERS) {
  return 0;
  }
  blasters[blastsize] = malloc(sizeof(struct BlastRadius));
  blasters[blastsize]->id = blastsize;
  blasters[blastsize]->portsn = 0;
  blasters[blastsize]->active = 1;
  blasters[blastsize]->birth = time(NULL);
  blasters[blastsize]->lporttime = time(NULL);
  blasters[blastsize]->host = blasthost;
  blastsize++;
return 1;
}

void replaceBR(struct in_addr blasthost, unsigned int port)
{
int i;
  for(i=0; blastsize>i; i++) {
    if(blasters[i]->active==0) {
    blasters[i]->portsn = 0;
    blasters[i]->active = 1;
    blasters[i]->birth = time(NULL);
    blasters[i]->lporttime = time(NULL);
    blasters[i]->host = blasthost;

    break;
    }
  }


}


void updateBR(struct in_addr blasthost, unsigned short int port)
{
char bh[20];
int i;
strncpy(bh, inet_ntoa(blasthost), (sizeof(bh)-1)); 
  for(i=0; blastsize>i; i++) {
    if(
      strcmp(inet_ntoa(blasters[i]->host), bh) == 0
      &&
      blasters[i]->active == 1
      )  {
        if(blasters[i]->portsn < MAX_PORTS) {
         if(checkBRPort(blasters[i], port)==0) {
           /* update last_portadd field */
           blasters[i]->lporttime = time(NULL);
           blasters[i]->ports[(blasters[i]->portsn)] = port;
           blasters[i]->portsn++;
         }
        }
      }
  }
}

char checkBRPort(struct BlastRadius *br, unsigned short int port)
{
int i;
  for(i=0; br->portsn > i; i++) {
    if(br->ports[i] == port) {
    return 1;
    }
  }
return 0;
}

char checkBRPortMax(struct BlastRadius *br)
{
  if(br->portsn==MAX_PORTS) return 1;
  return 0;
}

char checkBRPortScan(struct BlastRadius *br, char type)
{
    if(type==SCAN_LARGESTEP) {

      if(checkBRPortScan(br, SCAN_MANYHIGH)==1) 
      return 0;

      if(br->portsn > 8  &&  checkBRPortScan(br, SCAN_MANYHIGH)==0)
      return 1;  
    }

    if(type==SCAN_SINGLESTEP) {
    int i;
    int cport = br->ports[0];

      if(br->portsn < 8) {
      return 0;
      }

      if(checkBRPortScan(br, SCAN_MANYHIGH)==1) {
      return 0;
      }

      for(i=1; br->portsn > i; i++) {
        if( (cport+1) == br->ports[i] ) {
        cport++;  
        } else {
        return 0;
        }
      }
    return 1;
    }

    if(type==SCAN_MANYHIGH) {
    int i;
      if(br->portsn < 8)
      return 0;

      for(i=1; br->portsn > i; i++) {
        if(br->ports[i] < BOUNDARY_MANYHIGH) 
        return 0;
      }

      return 1;
    }

return 0;
}

char checkBR(struct in_addr blasthost) 
{
char bh[20];
int i;
strncpy(bh, inet_ntoa(blasthost), (sizeof(bh)-1)); 
  for(i=0; blastsize>i; i++) {
    if(
      strcmp(inet_ntoa(blasters[i]->host), bh) == 0
      &&
      blasters[i]->active == 1
      )
    return 1;
  }
return 0;
}

char checkBRNoSuspect(struct BlastRadius *br)
{
  if((*br).portsn < 4) {
    /* thanks to ilja for reminding me :p */
    if((int)(time(NULL) - br->lporttime) > NUM_DROP_SECS)
    return 1;
  }

return 0;
}

void cleanBR()
{
int i;
  for(i=0; blastsize>i; i++) {

      if(checkBRNoSuspect(blasters[i])) {
      blasters[i]->active = 0;
      }

    if(blasters[i]->portsn > 2 && blasters[i]->active==1) {
    
    
      if(checkBRPortMax(blasters[i])==1) {
      blasters[i]->active = 0;
      }

      if(checkBRPortScan(blasters[i], SCAN_LARGESTEP)) {
      blasters[i]->active = 0;
      addScanner(blasters[i]->host, blasters[i]->portsn, SCAN_LARGESTEP);
      outputAlert(blasters[i], SCAN_LARGESTEP);  
      }

      if(checkBRPortScan(blasters[i], SCAN_SINGLESTEP)) {
      blasters[i]->active = 0;
      addScanner(blasters[i]->host, blasters[i]->portsn, SCAN_SINGLESTEP);
      outputAlert(blasters[i], SCAN_SINGLESTEP);
      }

      if(checkBRPortScan(blasters[i], SCAN_MANYHIGH)) {
      blasters[i]->active = 0;
      addScanner(blasters[i]->host, blasters[i]->portsn, SCAN_MANYHIGH);
      outputAlert(blasters[i], SCAN_MANYHIGH);  
      }
    }
  }
}

void outputAlert(struct BlastRadius *br, char type)
{
char *scanname;

  if(type > level) return;

  if(logfile == NULL) {
    logfd = fopen("/dev/stdout", "a");
  } else {
    logfd = fopen(logfile, "a");
  }
    if(!logfd) {
    fprintf(stderr, "unable to open logfile\n");
    exit(-1);
    }
  
  switch(type) {
    case SCAN_SINGLESTEP:
     scanname = NAME_SCAN_SINGLESTEP;
     break;
    case SCAN_LARGESTEP:
     scanname = NAME_SCAN_LARGESTEP;
     break;
    case SCAN_MANYHIGH:
     scanname = NAME_SCAN_MANYHIGH;
     break;
    case SCAN_INSPECT:
     scanname = NAME_SCAN_INSPECT;
     break;
  }
  
  fprintf(logfd, "detected scan from %s, type: %s\n", inet_ntoa(br->host), scanname);
  fclose(logfd);
  /* good place to use debugging functions */
}

char checkSelf(struct in_addr blasthost)
{

  if(
    strcmp(selfhost, inet_ntoa(blasthost)) == 0
    )
  return 1;

return 0;
}


char checkScanner(struct in_addr blasthost)
{
char bh[20];
int i;
strncpy(bh, inet_ntoa(blasthost), (sizeof(bh)-1)); 
  for(i=0; scanrsize>i; i++) {
    if(
      strcmp(inet_ntoa(scanners[i]->host), bh) == 0
      )
    return 1;
  }

return 0;
}


char addScanner(struct in_addr blasthost, unsigned short portsn, unsigned char type)
{
  if(scanrsize==MAX_SCANNERS) {
  return 0;
  }
  scanners[scanrsize] = malloc(sizeof(struct Scanner));
  scanners[scanrsize]->id = scanrsize;
  scanners[scanrsize]->type = type;
  scanners[scanrsize]->portsn = portsn;
  scanners[scanrsize]->lporttime = time(NULL);
  scanners[scanrsize]->host = blasthost;
  scanrsize++;
return 1;
}



char updateScanner(struct in_addr blasthost)
{
char bh[20];
int i;
strncpy(bh, inet_ntoa(blasthost), (sizeof(bh)-1)); 

  for(i=0; scanrsize>i; i++) {
    if(
      strcmp(inet_ntoa(scanners[i]->host), bh) == 0
      ) {
    scanners[i]->lporttime = time(NULL);
    return 1;
    }
  }



return 0;
}

void dumpScanners()
{
int i=0;
  for(i=0; scanrsize>i; i++) {
printf("%d Scanner->host: %s (%d ports, last hit: %d secs)\n", scanners[i]->id, inet_ntoa(scanners[i]->host), scanners[i]->portsn, (int)(time(NULL) - scanners[i]->lporttime));
  }
}