fuzz_dhcps6.c

/*
 * Contributed by:
 *  Brandon Hutcheson, Graeme Neilson and Ryan Ko
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <sys/wait.h>
#include <time.h>
#include <pcap.h>
#include <netinet/in.h>
#include <sys/select.h>
#include "thc-ipv6.h"

#define COUNT_FLAG 11
#define COUNT_BYTE 4
#define COUNT_WORD 16
#define COUNT_XOR 2
#define COUNT_EXTEND 256
#define COUNT_DWORD 256

#define NEVER 2000000000
#define TEST_MAX (NEVER - 1)

#define DO_SOL 1
#define DO_REQ 2
#define DO_CON 3
#define DO_REN 4
#define DO_REB 5
#define DO_DEC 6
#define DO_REL 7
#define DO_INF 8

#define STATELESS 0
#define STATEFULL 1

/*
 * Fuzzing data types:
 *  F = flags = 1 byte = 8 bits | flags | 8 ; 256
 *  B = byte = 1 byte | 0 1 254 255 xor XOR | 6 ; 256
 *  X = byte = 1 byte | all values from 0 to 255
 *  W = word = 2 bytes | 0,1,254,255^2 xor XOR | 18 ; 65536
 *  D = double word = 4 bytes | {0,1,254,255}^4 xor XOR | 258 ; 4294967295
 *  . = byte = ignore, jump over
 *
 */
char fuzztype_ether[] = "..............";  // 14 byte header
char fuzztype_ip6[] =
    "........................................";  // 40 byte header
char fuzztype_udp[] = "........";                // 8 byte header
char fuzztype_dhcp6[] = "X...";    // 4 byte header (fuzz message type)
char fuzztype_dhcp6no[] = "....";  // 4 byte header (don't fuzz message type)

// OPTION HEADERS
char fuzztype_elapsed_time[] = "WWW";            // 6 byte header
char fuzztype_client_identifier[] = "WWWWDWWW";  // 18 byte header
char fuzztype_server_identifier[] = "WWWWDWWW";  // 18 byte header
char fuzztype_IA_NA[] = "WWDDD";                 // 16 byte header
char fuzztype_IA_Address[] = "WWXX..............DD";
char fuzztype_FQDN[] = "WWF";  // 5 byte header + length of domain string to be
                               // added in programatically
char fuzztype_option_request[] =
    "WWW";  // 6 byte header (add extra W for each additional option)
char fuzztype_prefixdele[] = "WWDDDWWDDFW............W";  // 45 bytes
char fuzztype_reconfig[] = "WW";                          // 4 bytes
char fuzztype_option_options[] = "WWWXXXXXXXXXXXXXX";     // 20 bytes
// //Matched solicit from RF manual
// char fuzztype_solicit[] = ".......FFFFFFFFF................BBBXXXX";
// //Still have to add in other types.
// char fuzztype_tran_id[] = "XF..WXBXX..............XX..............";
// char fuzztype_options[] = "........................................";

unsigned char      flags[] = {0, 1, 2, 4, 8, 16, 32, 64, 128, 254, 255};  // 11
unsigned char      bytes[] = {0, 1, 254, 255};                            // 4
unsigned short int words[] = {0x0000, 0x0001, 0x00fe, 0x00ff, 0x0100, 0x0101,
                              0x01fe, 0x01ff, 0xfe00, 0xfe01, 0xfefe, 0xfeff,
                              0xff00, 0xff01, 0xfffe, 0xffff};  // 16
unsigned int       xors[] = {0, 0xffffffff};                    // 2
unsigned char      extends[] = {
    0,   1,   2,   3,   4,   5,   6,   7,   8,   9,   10,  11,  12,  13,  14,
    15,  16,  17,  18,  19,  20,  21,  22,  23,  24,  25,  26,  27,  28,  29,
    30,  31,  32,  33,  34,  35,  36,  37,  38,  39,  40,  41,  42,  43,  44,
    45,  46,  47,  48,  49,  50,  51,  52,  53,  54,  55,  56,  57,  58,  59,
    60,  61,  62,  63,  64,  65,  66,  67,  68,  69,  70,  71,  72,  73,  74,
    75,  76,  77,  78,  79,  80,  81,  82,  83,  84,  85,  86,  87,  88,  89,
    90,  91,  92,  93,  94,  95,  96,  97,  98,  99,  100, 101, 102, 103, 104,
    105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119,
    120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134,
    135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149,
    150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164,
    165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179,
    180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194,
    195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209,
    210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224,
    225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239,
    240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254,
    255};  // 256
unsigned int dwords[] = {
    0x00000000, 0x00000001, 0x000000fe, 0x000000ff, 0x00000100, 0x00000101,
    0x000001fe, 0x000001ff, 0x0000fe00, 0x0000fe01, 0x0000fefe, 0x0000feff,
    0x0000ff00, 0x0000ff01, 0x0000fffe, 0x0000ffff, 0x00010000, 0x00010001,
    0x000100fe, 0x000100ff, 0x00010100, 0x00010101, 0x000101fe, 0x000101ff,
    0x0001fe00, 0x0001fe01, 0x0001fefe, 0x0001feff, 0x0001ff00, 0x0001ff01,
    0x0001fffe, 0x0001ffff, 0x00fe0000, 0x00fe0001, 0x00fe00fe, 0x00fe00ff,
    0x00fe0100, 0x00fe0101, 0x00fe01fe, 0x00fe01ff, 0x00fefe00, 0x00fefe01,
    0x00fefefe, 0x00fefeff, 0x00feff00, 0x00feff01, 0x00fefffe, 0x00feffff,
    0x00ff0000, 0x00ff0001, 0x00ff00fe, 0x00ff00ff, 0x00ff0100, 0x00ff0101,
    0x00ff01fe, 0x00ff01ff, 0x00fffe00, 0x00fffe01, 0x00fffefe, 0x00fffeff,
    0x00ffff00, 0x00ffff01, 0x00fffffe, 0x00ffffff, 0x01000000, 0x01000001,
    0x010000fe, 0x010000ff, 0x01000100, 0x01000101, 0x010001fe, 0x010001ff,
    0x0100fe00, 0x0100fe01, 0x0100fefe, 0x0100feff, 0x0100ff00, 0x0100ff01,
    0x0100fffe, 0x0100ffff, 0x01010000, 0x01010001, 0x010100fe, 0x010100ff,
    0x01010100, 0x01010101, 0x010101fe, 0x010101ff, 0x0101fe00, 0x0101fe01,
    0x0101fefe, 0x0101feff, 0x0101ff00, 0x0101ff01, 0x0101fffe, 0x0101ffff,
    0x01fe0000, 0x01fe0001, 0x01fe00fe, 0x01fe00ff, 0x01fe0100, 0x01fe0101,
    0x01fe01fe, 0x01fe01ff, 0x01fefe00, 0x01fefe01, 0x01fefefe, 0x01fefeff,
    0x01feff00, 0x01feff01, 0x01fefffe, 0x01feffff, 0x01ff0000, 0x01ff0001,
    0x01ff00fe, 0x01ff00ff, 0x01ff0100, 0x01ff0101, 0x01ff01fe, 0x01ff01ff,
    0x01fffe00, 0x01fffe01, 0x01fffefe, 0x01fffeff, 0x01ffff00, 0x01ffff01,
    0x01fffffe, 0x01ffffff, 0xfe000000, 0xfe000001, 0xfe0000fe, 0xfe0000ff,
    0xfe000100, 0xfe000101, 0xfe0001fe, 0xfe0001ff, 0xfe00fe00, 0xfe00fe01,
    0xfe00fefe, 0xfe00feff, 0xfe00ff00, 0xfe00ff01, 0xfe00fffe, 0xfe00ffff,
    0xfe010000, 0xfe010001, 0xfe0100fe, 0xfe0100ff, 0xfe010100, 0xfe010101,
    0xfe0101fe, 0xfe0101ff, 0xfe01fe00, 0xfe01fe01, 0xfe01fefe, 0xfe01feff,
    0xfe01ff00, 0xfe01ff01, 0xfe01fffe, 0xfe01ffff, 0xfefe0000, 0xfefe0001,
    0xfefe00fe, 0xfefe00ff, 0xfefe0100, 0xfefe0101, 0xfefe01fe, 0xfefe01ff,
    0xfefefe00, 0xfefefe01, 0xfefefefe, 0xfefefeff, 0xfefeff00, 0xfefeff01,
    0xfefefffe, 0xfefeffff, 0xfeff0000, 0xfeff0001, 0xfeff00fe, 0xfeff00ff,
    0xfeff0100, 0xfeff0101, 0xfeff01fe, 0xfeff01ff, 0xfefffe00, 0xfefffe01,
    0xfefffefe, 0xfefffeff, 0xfeffff00, 0xfeffff01, 0xfefffffe, 0xfeffffff,
    0xff000000, 0xff000001, 0xff0000fe, 0xff0000ff, 0xff000100, 0xff000101,
    0xff0001fe, 0xff0001ff, 0xff00fe00, 0xff00fe01, 0xff00fefe, 0xff00feff,
    0xff00ff00, 0xff00ff01, 0xff00fffe, 0xff00ffff, 0xff010000, 0xff010001,
    0xff0100fe, 0xff0100ff, 0xff010100, 0xff010101, 0xff0101fe, 0xff0101ff,
    0xff01fe00, 0xff01fe01, 0xff01fefe, 0xff01feff, 0xff01ff00, 0xff01ff01,
    0xff01fffe, 0xff01ffff, 0xfffe0000, 0xfffe0001, 0xfffe00fe, 0xfffe00ff,
    0xfffe0100, 0xfffe0101, 0xfffe01fe, 0xfffe01ff, 0xfffefe00, 0xfffefe01,
    0xfffefefe, 0xfffefeff, 0xfffeff00, 0xfffeff01, 0xfffefffe, 0xfffeffff,
    0xffff0000, 0xffff0001, 0xffff00fe, 0xffff00ff, 0xffff0100, 0xffff0101,
    0xffff01fe, 0xffff01ff, 0xfffffe00, 0xfffffe01, 0xfffffefe, 0xfffffeff,
    0xffffff00, 0xffffff01, 0xfffffffe, 0xffffffff};  // 256
char solicit[] = {
    0x01, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01,
    0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x19, 0x00, 0x29,
    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x1a, 0x00, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x06, 0x00,
    0x10, 0x00, 0x15, 0x00, 0x17, 0x00, 0x1f, 0x00, 0x38, 0x00, 0x40, 0x00,
    0x63, 0x00, 0x7b, 0x00, 0xc7};

int port = -1;

void help(char *prg) {
  printf("%s %s (c) 2022 by %s %s\n\n", prg, VERSION,
         "Brandon Hutcheson, Graeme Neilson and Ryan Ko", RESOURCE);
  printf(
      "Syntax: %s [-t number | -T number] [-e number | -T number] [-p number] "
      "[-md] [-1|-2|-3|-4|-5|-6|-7|-8] interface [domain-name]\n\n",
      prg);
  printf("Options:\n");
  printf(" -1         fuzz DHCPv6 Solicit (default)\n");
  printf(" -2         fuzz DHCPv6 Request\n");
  printf(" -3         fuzz DHCPv6 Confirm\n");
  printf(" -4         fuzz DHCPv6 Renew\n");
  printf(" -5         fuzz DHCPv6 Rebind\n");
  printf(" -6         fuzz DHCPv6 Release\n");
  printf(" -7         fuzz DHCPv6 Decline\n");
  printf(" -8         fuzz DHCPv6 Information Request\n");
  printf(" -m         fuzz the message type as well\n");
  printf(" -t number  continue from test no. number\n");
  printf(" -e number  continue to test no. number\n");
  printf(" -T number  only performs test no. number\n");
  printf(" -n number  how many times to send each packet (default: 1)\n");
  printf(" -f         spoof mac\n");
  printf(" -F         spoof link address\n");
  printf(" -w sec     wait number of seconds between packets (default: 0)\n");
  printf(
      " -p number  perform an alive check every number of tests (default: "
      "none)\n");
  printf(
      " -d         Use -d to force DNS updates, you can specify a domain name "
      "on the commandline.\n");
  printf("\nFuzzes a DHCPv6 packets to a server\n");
  printf("You can only define one of -0 ... -4 types, defaults to -1.\n");
  printf(
      "Returns -1 on error, 0 on tests done and targt alive or 1 on target "
      "crash.\n");
  exit(-1);
}

char  dnsupdate1[] = {0, 39, 0, 8, 1, 6, 122, 97, 97, 97, 97, 97};
char  dnsupdate2[] = {0, 6, 0, 2, 0, 39};
char  dns_option_hdr[256];
int   dns_option_hdr_len = 0, waittime = 0;
char  fuzzbuf[256];
char *interface = NULL, *dns_name = NULL, elapsed[6] = {0, 8, 0, 2, 0, 0};
int do_dns = 0, test_start = 0, test_end = TEST_MAX, ping = NEVER, no_send = 1,
    got_packet = 0;
pcap_t *p = NULL;
int     do_type = DO_SOL, fuzz_msg_type = 0;
int     timeout = 4;

void ignoreit(u_char *foo, const struct pcap_pkthdr *header,
              const unsigned char *data) {
  return;
}

int try_send_pkt(char *interface, char *pkt, int *pkt_len) {
  // Try send packet
  int    retry_send = 1;
  time_t start_time = time(NULL);
  while (time(NULL) - start_time < timeout && retry_send) {
    if (thc_send_pkt(interface, pkt, pkt_len) < 0)
      retry_send = 1;
    else
      retry_send = 0;
  }
  if (retry_send) {
    fprintf(
        stderr,
        "Timeout error: Unable to send check alive packet within timeout\n");
    exit(-1);
  }
  if (waittime > 0) sleep(waittime);
  return 0;
}

int check_alive(pcap_t *p) {
  int            ret = -2, len, pkt_len = 0, i;
  time_t         t;
  char           wdatabuf[1024];
  char *         pkt = NULL;
  unsigned char *dst = thc_resolve6("ff02::1:2");
  unsigned char *mac6 = thc_get_own_mac(interface);

  len = sizeof(solicit);
  memcpy(wdatabuf, solicit, len);
  // start0: 1-3 rand, 18-21 rand, 22-27 mac, 32-35 rand
  for (i = 0; i < 3; i++) {
    wdatabuf[i + 1] = rand() % 256;
    wdatabuf[i + 18] = rand() % 256;
    wdatabuf[i + 32] = rand() % 256;
  }
  memcpy(wdatabuf + 22, mac6, 6);

  if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, NULL,
                                      dst, 1, 0, 0, 0, 0)) == NULL) {
    fprintf(stderr,
            "Error: Failed to create check allive ivp6 packet header\n");
    exit(-1);
  }

  if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, wdatabuf, len) < 0) {
    fprintf(stderr, "Error: Failed to create check allive udp packet header\n");
    exit(-1);
  }

  if (thc_generate_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) {
    fprintf(stderr, "Error: Failed to create check allive packet header\n");
    exit(-1);
  }

  // debug = 1;

  // Empty packet capture queue
  while (thc_pcap_check(p, (char *)ignoreit, NULL) > 0)
    ;

  // Send initial solicit request
  try_send_pkt(interface, pkt, &pkt_len);

  // Check for response in loop and timeout if we don't get one
  t = time(NULL);
  while (ret < 0) {
    // Got reply packet; server alive!
    if (thc_pcap_check(p, (char *)ignoreit, NULL) > 0) ret = 1;

    // If we still haven't received a packet after 1 second resend the solicit
    if (time(NULL) > t + 1 && ret == -2) {
      if (thc_send_pkt(interface, pkt, &pkt_len) <
          0) {  // Don't want to use try_send_pkt as it could take longer than
                // timeout
        usleep(75);
        thc_send_pkt(interface, pkt, &pkt_len);  // Retry sending packet after
                                                 // short time if sending failed
      }
      ret = -1;
    }

    // Fail after 4 seconds
    if (time(NULL) > t + timeout && ret < 0) ret = 0;
  }
  if (ret == 0) {
    fprintf(stderr,
            "Timeout: Failed to receive dhcp solicitation replay in check "
            "alive function within %d seconds\n",
            timeout);
  }

  // debug = 0;

  thc_destroy_packet(pkt);

  return ret > 0 ? 1 : 0;
}

int fuzz_loop(char *pkt, int *pkt_len) {
  int do_fuzz = 1;
  int test_pos = 0, test_ptr = 0, test_cnt = 0, test_current = 0;
  int do_it;
  int i;
  unsigned short int *sip;
  unsigned int *      intp;
  int                 fragment = 0, frag_offset = 0;
  unsigned char *     pkt_bak;
  thc_ipv6_hdr *      hdr = (thc_ipv6_hdr *)pkt;

  // backup of generated packet
  pkt_bak = malloc(hdr->pkt_len);
  memcpy(pkt_bak, hdr->pkt, hdr->pkt_len);

  printf("Fuzzing packet, starting at fuzz case %d, ending at fuzz case %d:\n",
         test_start, test_end);
  printf("fuzzbuf(%lu): %s\n", strlen(fuzzbuf), fuzzbuf);
  while (do_fuzz) {
    if (test_cnt == 0)
      while (fuzzbuf[test_ptr] == '.') {
        test_ptr++;
        test_pos++;
      }

    if (fuzzbuf[test_ptr] == 0) do_fuzz = 0;

    test_cnt++;
    do_it = 1;

    switch (fuzzbuf[test_ptr]) {
      case 0:
        break;
      case 'X':
        if (test_cnt <= COUNT_EXTEND) {
          if (pkt_bak[test_pos] != extends[test_cnt - 1])
            hdr->pkt[test_pos] = extends[test_cnt - 1];
          else
            do_it = 0;
        } else {
          test_cnt = 0;
          test_ptr++;
          test_pos++;
        }
        break;
      case 'B':
        if (test_cnt <= COUNT_BYTE) {
          if (pkt_bak[test_pos] != bytes[test_cnt - 1])
            hdr->pkt[test_pos] = bytes[test_cnt - 1];
          else
            do_it = 0;
        } else {
          i = 0;
          while (i < COUNT_BYTE && do_it) {
            if (bytes[i] == pkt_bak[test_pos]) do_it = 0;
            i++;
          }
          if (do_it)
            hdr->pkt[test_pos] =
                hdr->pkt[test_pos] ^ xors[test_cnt - COUNT_BYTE - 1];
        }
        if (test_cnt == COUNT_BYTE + COUNT_XOR) {
          test_cnt = 0;
          test_ptr++;
          test_pos++;
        }
        break;
      case 'F':
        if (test_cnt <= COUNT_FLAG) {
          if (pkt_bak[test_pos] != flags[test_cnt - 1])
            hdr->pkt[test_pos] = flags[test_cnt - 1];
          else
            do_it = 0;
        } else {
          i = 0;
          while (i < COUNT_FLAG && do_it) {
            if (bytes[i] == pkt_bak[test_pos])  // yes, bytes[] is the right one
                                                // even for flags
              do_it = 0;
            i++;
          }
          if (do_it)
            hdr->pkt[test_pos] =
                hdr->pkt[test_pos] ^ xors[test_cnt - COUNT_BYTE - 1];
        }
        if (test_cnt == COUNT_FLAG + COUNT_XOR) {
          test_cnt = 0;
          test_ptr++;
          test_pos++;
        }
        break;
      case 'W':
        sip = (unsigned short int *)&pkt_bak[test_pos];
        if (test_cnt <= COUNT_WORD) {
          if (*sip != words[test_cnt - 1])
            memcpy((char *)&hdr->pkt[test_pos], (char *)&words[test_cnt - 1],
                   2);
          else
            do_it = 0;
        } else {
          i = 0;
          while (i < COUNT_WORD && do_it) {
            if (words[i] == *sip) do_it = 0;
            i++;
          }
          if (do_it) {
            i = *sip ^ xors[test_cnt - COUNT_WORD - 1];
            sip = (unsigned short int *)&hdr->pkt[test_pos];
            *sip = i % 65536;
          }
        }
        if (test_cnt == COUNT_WORD + COUNT_XOR) {
          test_cnt = 0;
          test_ptr++;
          test_pos += 2;
        }
        break;
      case 'D':
        intp = (unsigned int *)&pkt_bak[test_pos];
        if (test_cnt <= COUNT_DWORD) {
          if (*intp != dwords[test_cnt - 1])
            memcpy((char *)&hdr->pkt[test_pos], (char *)&dwords[test_cnt - 1],
                   4);
          else
            do_it = 0;
        } else {
          i = 0;
          while (i < COUNT_DWORD && do_it) {
            if (dwords[i] == *intp) do_it = 0;
            i++;
          }
          if (do_it) {
            i = *intp ^ xors[test_cnt - COUNT_DWORD - 1];
            intp = (unsigned int *)&hdr->pkt[test_pos];
            *intp = (unsigned int)i;
            //          *intp = (unsigned int) (i % 4294967295);
          }
        }
        if (test_cnt == COUNT_DWORD + COUNT_XOR) {
          test_cnt = 0;
          test_ptr++;
          test_pos += 4;
        }
        break;
      default:
        fprintf(stderr,
                "This character should not be in the fuzz string, shoot the "
                "programmer: %c(%d) position %d string %s\n",
                fuzzbuf[test_ptr], fuzzbuf[test_ptr], test_ptr, fuzzbuf);
        return -1;
        break;
    }

    if (do_it && do_fuzz) {
      if (test_current >= test_start && test_current <= test_end && do_fuzz) {
        printf("[%s] pos[%d]=%c -> %d | pkt[%d] | %d (%d=>%d)| \n",
               /*fuzzbuf*/ "", test_ptr, fuzzbuf[test_ptr], test_cnt, test_pos,
               test_current, test_start, test_end);

        // Generate new transaction id
        int three_byte_test_current = test_current % 0x1000000;
        memcpy(hdr->pkt + 63, (char *)&three_byte_test_current, 3);

        // Regenerate UDP checksum
        hdr->pkt[60] = 0;
        hdr->pkt[61] = 0;
        i = checksum_pseudo_header(hdr->original_src, hdr->final_dst, NXT_UDP,
                                   &hdr->pkt[54], hdr->pkt_len - 54);
        hdr->pkt[60] = i / 256;
        hdr->pkt[61] = i % 256;

        // send packets
        int k;
        for (k = 0; k < no_send; k++) {
          while (thc_send_pkt(interface, pkt, pkt_len) < 0)
            usleep(1);
          if (waittime) sleep(waittime);
        }
        // printf(".");
        usleep(250);

        // TODO: Server up check
        if ((test_current - test_start) % ping == 0 && test_current != 0 &&
            test_start != test_current)
          if (check_alive(p) == 0) {
            i = ((((test_current - test_start) / ping) - 1) * ping) +
                test_start + 1;
            printf(
                "\nResult: target %s crashed during fuzzing, offending test "
                "case no. could be %d to %d\n",
                thc_ipv62notation(hdr->final_dst), i < 0 ? 0 : i, test_current);
            exit(1);
          }
      }

      // reset to basic packet
      memcpy(hdr->pkt, pkt_bak, hdr->pkt_len);
      test_current++;
    }
  }
  return 0;
}

void construct_from_adv_and_fuzz(u_char *foo, const struct pcap_pkthdr *header,
                                 const unsigned char *data) {
  int            len = header->caplen, pkt_len = 0, mlen = 10, olen;
  unsigned char *ptr = (unsigned char *)data, *pkt = NULL;
  char *         smac, mac[6] = {0, 0x0d, 0, 0x0d, 0x0d, 0x0e};
  char           mybuf[1024] = {0x03, 0, 0, 0, 0, 8, 0, 2, 0, 0};
  int            done_dns = 0, i;

  // Begin fuzz buffer
  strcat(fuzzbuf, fuzztype_elapsed_time);

  // Set message type
  switch (do_type) {
    case DO_REQ:
      mybuf[0] = 0x03;
      break;
    case DO_CON:
      mybuf[0] = 0x04;
      break;
    case DO_REN:
      mybuf[0] = 0x05;
      break;
    case DO_REL:
      mybuf[0] = 0x08;
      break;
    case DO_DEC:
      mybuf[0] = 0x09;
      break;
    case DO_INF:
      mybuf[0] = 0x0B;
      break;
    default:
      fprintf(stderr, "Error: Unknown do type %d\n", do_type);
      exit(-1);
      break;
  }

  // Skip over header to dhcp header
  if (do_hdr_size) {
    data += do_hdr_size;
    len -= do_hdr_size;
    if ((data[0] & 240) != 0x60) return;
  } else {
    data += 14;
    len -= 14;
  }

  if (len < 126 || data[6] != NXT_UDP || data[48] != 2) return;

  data += 48;
  len -= 48;

  // Copy transaction id and skip to message options
  memcpy(mybuf + 1, data + 1, 3);
  data += 4;
  len -= 4;

  // Loop over options till reach end of header
  while (len >= 4) {
    // Set olen to the option length minus type and length fields and check for
    // bogus packet
    if ((olen = data[2] * 256 + data[3]) > len - 4 ||
        olen < 0) {  // the 4 here is the 4 bytes for the option type and option
                     // length fields
      printf("Information: evil packet received\n");
      olen = 0;
      len = -1;
    } else {
      // Copy server identifier or IA_NA to message
      if (data[1] > 1 && data[1] <= 3 && !(data[1] == 2 && do_type == DO_CON) &&
          !(data[1] == 3 &&
            do_type == DO_INF)) {  // skip copying server identifier for confirm
                                   // or IA_NA for information request messages
        memcpy(mybuf + mlen, data, olen + 4);
        mlen += olen + 4;

        // Append server identifier fuzzing
        if (data[1] == 2) strcat(fuzzbuf, fuzztype_server_identifier);
        // Append IA_NA fuzzing + IA Address fuzzing
        else if (data[1] == 3) {
          strcat(fuzzbuf, fuzztype_IA_NA);
          if (olen > 12) strcat(fuzzbuf, fuzztype_IA_Address);
        }
        // printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf);
      }
      // Copy client identifier to message
      else if (data[1] == 1) {
        memcpy(mybuf + mlen, data, olen + 4);
        mlen += olen + 4;
        // smac auf client mac in paket setzen
        if (olen == 14)
          smac = (char *)(data + 12);
        else
          smac = mac;

        // Append client identifier fuzzing
        strcat(fuzzbuf, fuzztype_client_identifier);
        // printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf);
      }
      // Copy dns option
      else if (data[1] == 39 && do_dns) {
        memcpy(mybuf + mlen, data, olen + 4);
        mybuf[mlen + 4] = 1;  // force server to write dns entry
        mlen += olen + 4;

        // Append dns fuzzing
        strcat(fuzzbuf, fuzztype_FQDN);
        for (i = 0; i < olen - 1; ++i)
          strcat(fuzzbuf, "B");  // Fuzz the domain name string
        strcat(fuzzbuf, fuzztype_option_request);
        // printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf);

        // Make sure we don't add dns twice
        done_dns = 1;
      }
      data += olen + 4;
      len -= olen + 4;
      if (len < 0) {
        printf("Information: evil packet received\n");
        len = -1;
      }
    }
  }

  // Add saved dns option onto this packet
  if (do_dns && !done_dns) {
    memcpy(mybuf + mlen, dns_option_hdr, dns_option_hdr_len);
    mlen += dns_option_hdr_len;

    // Append dns fuzzing
    olen = dns_option_hdr[2] * 256 + dns_option_hdr[3];
    strcat(fuzzbuf, fuzztype_FQDN);
    for (i = 0; i < olen - 1; ++i)
      strcat(fuzzbuf, "B");  // Fuzz the domain name string
    strcat(fuzzbuf, fuzztype_option_request);
    // printf("buf(%d): %s\n", strlen(fuzzbuf), fuzzbuf);
  }

  // Build and send fuzzed message packets
  if (len >= 0) {
    unsigned char *dst = thc_resolve6("ff02::1:2");

    if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len,
                                        ptr + 38, dst, 1, 0, 0, 0, 0)) ==
        NULL) {
      fprintf(stderr, "Error: Couldn't create dhcp requests ipv6 header\n");
      exit(-1);
    }

    if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, mybuf, mlen) < 0) {
      fprintf(stderr, "Error: Couldn't create dhcp requests udp header\n");
      exit(-1);
    }

    if (thc_generate_pkt(interface, smac, ptr + 6, pkt, &pkt_len) < 0) {
      fprintf(stderr, "Error: Couldn't create dhcp requests ethernet header\n");
      exit(-1);
    }

    if (fuzz_loop(pkt, &pkt_len) < 0) {
      fprintf(stderr, "Error: Fuzzing request packet failed\n");
      exit(-1);
    } else {
      got_packet = 1;  // Used to suppress timeout error
    }

    pkt = thc_destroy_packet(pkt);
  }

  // Truncate the fuzz buffer back to it's original length
  fuzzbuf[66] = 0;
  // printf("Trunc fuzzbuf: %s\n", fuzzbuf);
}

int main(int argc, char *argv[]) {
  char mac[6] = {0, 0x0c, 0, 0, 0, 0}, *pkt = NULL;
  // defines mac as 6 pieces and defines pkt as null.
  char wdatabuf[1024];
  // builds data buffer and sets memory size at 1024mb
  unsigned char *mac6 = mac, *src, *dst;
  // creates mac6 address usuing
  int i, s, len, pkt_len = 0, dlen = 0;
  int do_all = 1, use_real_mac = 1, use_real_link = 1;
  int state;

  if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) help(argv[0]);

  if (getenv("THC_IPV6_PPPOE") != NULL || getenv("THC_IPV6_6IN4") != NULL)
    printf("WARNING: %s is not working with injection!\n", argv[0]);

  // Parse options
  while ((i = getopt(argc, argv, "123456789mn:t:e:T:dFp:frw:")) >= 0) {
    switch (i) {
      case 'w':
        waittime = atoi(optarg);
        break;
      case '1':
        do_type = DO_SOL;
        break;
      case '2':
        do_type = DO_REQ;
        break;
      case '3':
        do_type = DO_CON;
        break;
      case '4':
        do_type = DO_REN;
        break;
      case '5':
        do_type = DO_REB;
        break;
      case '6':
        do_type = DO_REL;
        break;
      case '7':
        do_type = DO_DEC;
        break;
      case '8':
        do_type = DO_INF;
        break;
      case 'm':
        fuzz_msg_type = 1;
        break;
      case 'n':
        no_send = atoi(optarg);
        break;
      case 't':
        test_start = atoi(optarg);
        break;
      case 'e':
        test_end = atoi(optarg);
        break;
      case 'T':
        test_end = test_start = atoi(optarg);
        break;
      case 'F':
        use_real_link = 0;  // no break
      case 'f':
        use_real_mac = 0;
        break;
      case 'p':
        ping = atoi(optarg);
        break;
      case 'd':
        do_dns = 1;
        break;
      case 'r':
        i = 0;
        break;  // just to ignore -r
      default:
        fprintf(stderr, "Error: unknown option -%c\n", i);
        exit(-1);
    }
  }

  // Check options
  if (no_send < 1) {
    fprintf(stderr, "ERROR: -n number must be between one and 2 billion\n");
    exit(-1);
  }

  if (test_end < test_start) {
    printf("don't fuck up the command line options!\n");
    exit(-1);
  }

  memset(mac, 0, sizeof(mac));
  interface = argv[optind];
  dns_name = argv[optind + 1];
  if (use_real_link)
    src = thc_get_own_ipv6(interface, NULL, PREFER_LINK);
  else
    src = thc_resolve6("fe80::");
  if (use_real_mac) {
    mac6 = thc_get_own_mac(interface);
    memcpy(mac, mac6, sizeof(mac));
  }
  dst = thc_resolve6("ff02::1:2");
  setvbuf(stdout, NULL, _IONBF, 0);
  setvbuf(stderr, NULL, _IONBF, 0);

  // only to prevent our system to send icmp port unreachable messages
  if ((s = thc_bind_udp_port(546)) < 0)
    fprintf(stderr, "Warning: could not bind to 546/udp\n");
  if ((p = thc_pcap_init_promisc(interface, "ip6 and udp and dst port 546")) ==
      NULL) {
    fprintf(stderr, "Error: can not open interface %s in promisc mode\n",
            interface);
    exit(-1);
  }

  // Establish state
  if (do_type == DO_SOL || do_type == DO_REB)
    state = STATELESS;
  else
    state = STATEFULL;

  // generate full fuzz mask for stateless types and partial for statefull types
  strcpy(fuzzbuf, fuzztype_ether);
  strcat(fuzzbuf, fuzztype_ip6);
  strcat(fuzzbuf, fuzztype_udp);
  if (fuzz_msg_type)
    strcat(fuzzbuf, fuzztype_dhcp6);
  else
    strcat(fuzzbuf, fuzztype_dhcp6no);
  if (state == STATELESS) {
    strcat(fuzzbuf, fuzztype_elapsed_time);
    strcat(fuzzbuf, fuzztype_client_identifier);
    strcat(fuzzbuf, fuzztype_IA_NA);
    strcat(fuzzbuf, fuzztype_prefixdele);
    strcat(fuzzbuf, fuzztype_reconfig);
    strcat(fuzzbuf, fuzztype_option_options);
    if (do_dns) strcat(fuzzbuf, fuzztype_FQDN);
  }

  /** Generate packet **/
  len = sizeof(solicit);
  memcpy(wdatabuf, solicit, len);
  // printf("%d : %s\n", len, fuzzbuf);

  // Add dns option
  if (do_dns) {
    memcpy(wdatabuf + len, dnsupdate1, sizeof(dnsupdate1));
    memcpy(dns_option_hdr + dns_option_hdr_len, dnsupdate1, sizeof(dnsupdate1));
    dlen = len + 8;
    len += sizeof(dnsupdate1);
    dns_option_hdr_len += sizeof(dnsupdate1);

    // Append domain string prefix fuzz mask
    if (state == STATELESS) {  //<-- Do fuzzbuffer later
      for (i = 0; i < 7; ++i)  // 7 == Length of hard coded domain prefix
        strcat(fuzzbuf, "B");
    }

    if (dns_name != NULL && strlen(dns_name) < 240) {
      if (dns_name[0] != '.') {
        wdatabuf[len] = '.';
        wdatabuf[dlen - 5]++;
        wdatabuf[dlen - 3]++;
        len++;
      }
      memcpy(wdatabuf + len, dns_name, strlen(dns_name) + 1);
      memcpy(dns_option_hdr + dns_option_hdr_len, dns_name,
             strlen(dns_name) + 1);
      wdatabuf[dlen - 5] += strlen(dns_name) + 1;
      wdatabuf[dlen - 3] += strlen(dns_name) + 1;
      len += strlen(dns_name) + 1;
      dns_option_hdr_len += strlen(dns_name) + 1;

      // Append variable length domain string suffix fuzz mask
      if (state == STATELESS) {
        for (i = 0; i < strlen(dns_name) + 1; ++i)
          strcat(fuzzbuf, "B");
      }
    }
    memcpy(wdatabuf + len, dnsupdate2, sizeof(dnsupdate2));
    memcpy(dns_option_hdr + dns_option_hdr_len, dnsupdate2, sizeof(dnsupdate2));
    len += sizeof(dnsupdate2);
    dns_option_hdr_len += sizeof(dnsupdate2);

    // Append option request (FQDN request) fuzz mask
    if (state == STATELESS) { strcat(fuzzbuf, fuzztype_option_request); }
  }

  // Set message type
  if (state == STATELESS) {
    switch (do_type) {
      case DO_SOL:
        wdatabuf[0] = 0x01;
        break;
      case DO_REB:
        wdatabuf[0] = 0x06;
        break;
      default:
        break;
    }
  }

  // random src mac
  if (!use_real_link)
    for (i = 0; i < 8; i++)
      src[i + 8] = rand() % 256;

  // start0: 1-3 rand, 18-21 rand, 22-27 mac, 32-35 rand
  for (i = 0; i < 3; i++) {
    wdatabuf[i + 1] = rand() % 256;
    wdatabuf[i + 18] = rand() % 256;
    wdatabuf[i + 32] = rand() % 256;
    if (!use_real_mac) {
      mac[i * 2] = rand() % 256;
      mac[i * 2 + 1] = rand() % 256;
    }
    if (do_dns) wdatabuf[i + dlen] = 'a' + rand() % 26;
  }
  memcpy(wdatabuf + 22, mac, 6);

  if ((pkt = thc_create_ipv6_extended(interface, PREFER_LINK, &pkt_len, src,
                                      dst, 1, 0, 0, 0, 0)) == NULL)
    return -1;
  if (thc_add_udp(pkt, &pkt_len, 546, 547, 0, wdatabuf, len) < 0) return -1;

  if (thc_generate_pkt(interface, mac6, NULL, pkt, &pkt_len) < 0) return -1;

  // Fuzz solicit packet
  if (state == STATELESS) {
    if (fuzz_loop(pkt, &pkt_len) < 0) return -1;
  }

  // Fuzz request, confirm or renew paket
  else if (state == STATEFULL) {
    // Send a dhcp solicit to discover dhcpv6 servers
    if (thc_send_pkt(interface, pkt, &pkt_len) < 0) {
      fprintf(stderr, "Error: Failed to send initial solicit packet\n");
      return -1;
    }

    usleep(75);  //<-- I don't really know why this is neccessary but it seems
                 //to be

    // Construct and fuzz packets using server identifier
    got_packet = 0;
    time_t start_time = time(NULL);
    while (time(NULL) - start_time < timeout) {
      while (thc_pcap_check(p, (char *)construct_from_adv_and_fuzz, NULL) > 0)
        ;  // got_packet set in callback function
      if (got_packet) break;
    }
    if (!got_packet)
      fprintf(stderr,
              "Timeout: Didn't receive solicited advertisement packet within "
              "timeout. Is server down?\n");
  }

  pkt = thc_destroy_packet(pkt);

  // printf("fuzzbuf: %s\n", fuzzbuf);

  return 0;
}