/* Minimal version of Stella Firewall, protection to query flood for SA-MP 0.3e */
/* By Kevin R.V <[email protected]> <[email protected]> */

#include<stdio.h>	//For standard things
#include<stdlib.h>	//malloc
#include<string.h>	//memset
#include<netinet/ip_icmp.h>	//Provides declarations for icmp header
#include<netinet/udp.h>	//Provides declarations for udp header
#include<netinet/tcp.h>	//Provides declarations for tcp header
#include<netinet/ip.h>	//Provides declarations for ip header
#include<sys/socket.h>
#include<arpa/inet.h>
#include<pthread.h>
//V2
#define MAX_QUERYS 350
#define MAX_INCOMINGS 12

void ProcessPacket(unsigned char* , int);
void print_ip_header(unsigned char* , int);
void process_udp_packet(unsigned char * , int);
void *TimerCheck( void *ptr );
void SampQueryPacket(char * szHost, u_short port);
void SampIncomingPackets(char * szHost, u_short port);
void AddIncomingPacket(char * szHost);
int sock_raw;
void Ban(char * szHost);
void Reload();
int CheckIfExists(char * szHost);
void AddQueryPacket(char * szHost);
int tcp=0,udp=0,icmp=0,others=0,igmp=0,total=0,j;
struct sockaddr_in source,dest;

struct userPackets
{
	char              szHost[30];
	long int   IncomingPackets;
	long int      QueryPackets;

};

struct userPackets ddosInfo[700];

int main()
{
	Reload();
	pthread_t thread1;
	pthread_create( &thread1, NULL, TimerCheck, NULL);
	int saddr_size , data_size;
	struct sockaddr saddr;
	struct in_addr in;

	unsigned char *buffer = (unsigned char *)malloc(65536); //Its Big!


	printf("Starting Stella Firewall BETA v0.1...\n");
	sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_UDP);
	if(sock_raw < 0)
	{
		printf("Socket Error\n");
		return 1;
	}
	while(1)
	{
		saddr_size = sizeof saddr;
		data_size = recvfrom(sock_raw , buffer , 65536 , 0 , &saddr , &saddr_size);
		if(data_size <0 )
		{
			printf("Recvfrom error , failed to get packets\n");
			return 1;
		}
		ProcessPacket(buffer , data_size);
	}
	close(sock_raw);
	return 0;
}

void ProcessPacket(unsigned char* buffer, int size)
{
	struct iphdr *iph = (struct iphdr*)buffer;
	++total;
	switch (iph->protocol)
	{

		case 17: //UDP Protocol
			++udp;
			process_udp_packet(buffer , size);
			break;

		default:
		break;
	}
}

void process_udp_packet(unsigned char *Buffer , int Size)
{

	unsigned short iphdrlen;

	struct iphdr *iph = (struct iphdr *)Buffer;
	iphdrlen = iph->ihl*4;

	memset(&source, 0, sizeof(source));
	source.sin_addr.s_addr = iph->saddr;

	memset(&dest, 0, sizeof(dest));
	dest.sin_addr.s_addr = iph->daddr;
	struct udphdr *udph = (struct udphdr*)(Buffer + iphdrlen);
	char * Packet = &Buffer[4] + iphdrlen + sizeof udph;
	int len_pkt = ( Size - sizeof udph - iph->ihl * 4 );
	Packet[len_pkt] = '\0';

	if (Packet[0] == 0x28)
	{
			if ( ntohs(udph->len) == 12 )
			{
				SampIncomingPackets(inet_ntoa(source.sin_addr),ntohs(udph->dest));
			}
	}

	else if ( Packet[0] == 'S' && Packet[1] == 'A' && Packet[2] == 'M' && Packet[3] == 'P' )
	{
		SampQueryPacket(inet_ntoa(source.sin_addr),ntohs(udph->dest));
	}
}

void Reload()
{
	int i = 0;
	for(i = 0; i<700; i++)
	{
		strcpy(ddosInfo[i].szHost, "127.0.0.1");
		ddosInfo[i].IncomingPackets = 0;
		ddosInfo[i].QueryPackets = 0;
	}


}
int CheckIfExists(char * szHost)
{
	int i = 0;
	for(i = 0; i<700; i++)
	{
		if ( strcmp(ddosInfo[i].szHost, szHost) == 0 )
		return i;
	}
	return -1;
}

void *TimerCheck( void *ptr )
{
	while(1)
	{
		sleep(6);
		Reload();
	}

}

void Ban(char * szHost)
{
	printf("Attack from: %s, blocking it...\n", szHost);
	char cmd[50];
	memset(cmd, 0, sizeof(cmd));
	sprintf(cmd, "iptables -A INPUT -s %s -j DROP", szHost);
	system(cmd);
}


void AddQueryPacket(char * szHost)
{

	int check = CheckIfExists(szHost);
	if ( check != -1)
	{
		ddosInfo[check].QueryPackets++;
		if ( ddosInfo[check].QueryPackets > MAX_QUERYS )
		Ban(ddosInfo[check].szHost);
	}
	else
	{
		int i = 0;
		for(i = 0; i<700; i++)
		{
			if ( strcmp(ddosInfo[i].szHost, "127.0.0.1") == 0 )
			{
				strcpy(ddosInfo[i].szHost, szHost);
				ddosInfo[i].IncomingPackets = 0;
				ddosInfo[i].QueryPackets = 1;
				break;
			}
		}

	}


}

void AddIncomingPacket(char * szHost)
{

	int check = CheckIfExists(szHost);
	if ( check != -1)
	{
		ddosInfo[check].IncomingPackets++;

		if ( ddosInfo[check].IncomingPackets > MAX_INCOMINGS )
		Ban(ddosInfo[check].szHost);
	}
	else
	{
		int i = 0;
		for(i = 0; i<700; i++)
		{
			if ( strcmp(ddosInfo[i].szHost, "127.0.0.1") == 0 )
			{
				strcpy(ddosInfo[i].szHost, szHost);
				ddosInfo[i].IncomingPackets = 1;
				ddosInfo[i].QueryPackets = 0;
				break;
			}
		}

	}


}

void SampQueryPacket(char * szHost, u_short port)
{
	if ( port == 9355 )
	{
		AddQueryPacket(szHost);
	}

}

void SampIncomingPackets(char * szHost, u_short port)
{
	if ( port == 9355 )
	{
		AddIncomingPacket(szHost);
	}
}