bypassing ip spoof creation about torwall HOT 5 CLOSED

    static int handle_dns(HANDLE handle, PWINDIVERT_ADDRESS addr,
    PWINDIVERT_IPHDR iphdr, PWINDIVERT_UDPHDR udphdr, char *data,
    size_t data_len)
{
    // We only handle standard DNS queries.

    if (data_len <= sizeof(struct dnshdr))
        return -1;
    if (data_len > 512)                     // Max DNS packet size.
        return -1;

    struct dnshdr *dnshdr = (struct dnshdr *)data;
    data += sizeof(struct dnshdr);
    data_len -= sizeof(struct dnshdr);

    // Check request:
    if (ntohs(dnshdr->options) != 0x0100)   // Standard query
        return -1;
    if (ntohs(dnshdr->qdcount) != 1)        // Only 1 req-per-packet supported
        return -1;
    if (ntohs(dnshdr->ancount) != 0)
        return -1;
    if (ntohs(dnshdr->nscount) != 0)
        return -1;
    if (ntohs(dnshdr->arcount) != 0)
        return -1;

    char name[DNS_MAX_NAME + 8];            // 8 bytes extra.
    size_t i = 0;
    while (i < data_len && data[i] != 0)
    {
        size_t len = data[i];
        if (i + len >= DNS_MAX_NAME)
            return -1;
        name[i++] = '.';
        for (size_t j = 0; j < len; j++, i++)
            name[i] = data[i];
    }
    if (i >= data_len)
        return -1;
    name[i++] = '\0';
    if (data_len - i != sizeof(struct dnsq))
        return -1;

    // Generate a fake IP address and associate it with this domain name:
    uint32_t fake_addr = domain_lookup_addr(name);
    if (fake_addr == 0)
    {

        // This domain is blocked; so ignore the request.
        // Construct a query response:
    size_t len = sizeof(struct dnshdr) + data_len + sizeof(struct dnsa);
    if (len > 512)                          // Max DNS packet size.
        return -1;
    len += sizeof(WINDIVERT_IPHDR) + sizeof(WINDIVERT_UDPHDR) + len;

    char buf[len + 8];                      // 8 bytes extra.
    PWINDIVERT_IPHDR riphdr = (PWINDIVERT_IPHDR)buf;
    PWINDIVERT_UDPHDR rudphdr = (PWINDIVERT_UDPHDR)(riphdr + 1);
    struct dnshdr *rdnshdr = (struct dnshdr *)(rudphdr + 1);
    char *rdata = (char *)(rdnshdr + 1);

    memset(riphdr, 0, sizeof(WINDIVERT_IPHDR));
    riphdr->Version   = 4;
    riphdr->HdrLength = sizeof(WINDIVERT_IPHDR) / sizeof(uint32_t);
    riphdr->Length    = htons(len);
    riphdr->Id        = htons(0xF00D);
    WINDIVERT_IPHDR_SET_DF(riphdr, 1);
    riphdr->TTL       = 64;
    riphdr->Protocol  = IPPROTO_UDP;
    riphdr->SrcAddr   = iphdr->DstAddr;
    riphdr->DstAddr   = iphdr->SrcAddr;

    memset(rudphdr, 0, sizeof(WINDIVERT_UDPHDR));
    rudphdr->SrcPort  = htons(53);          // DNS
    rudphdr->DstPort  = udphdr->SrcPort;
    rudphdr->Length   = htons(len - sizeof(WINDIVERT_IPHDR));

    rdnshdr->id = dnshdr->id;
    rdnshdr->options = htons(0x8180);       // Standard DNS response.
    rdnshdr->qdcount = htons(1);
    rdnshdr->ancount = htons(1);
    rdnshdr->nscount = 0;
    rdnshdr->arcount = 0;

    memcpy(rdata, data, data_len);
    struct dnsa *rdnsa = (struct dnsa *)(rdata + data_len);
    rdnsa->name   = htons(0xC00C);
    rdnsa->type   = htons(0x0001);          // (A)
    rdnsa->class  = htons(0x0001);          // (IN)
    rdnsa->ttl    = htonl(1) ;              // 1 second
    rdnsa->length = htons(4);
    rdnsa->addr   = htonl(0x7F000001);       // Fake address

    send_packet(handle, &buf, len, addr);
        return 1;


    debug("Intercept DNS %s\n", (name[0] == '.'? name+1: name));
    }
    // Re-inject the matching packet.


    /*
    /
    */
    return 0;
}

// Lookup an address given a domain name.  If the name does not exist then
// create one.
extern uint32_t domain_lookup_addr(const char *name0)
{
    if (name0[0] == '.')
        name0++;

    if (domain_blacklist_lookup(blacklist, name0))
    {
        debug("Block %s\n", name0);
        return 0;       // Blocked!
    }
    uint64_t idx0 = (uint64_t)InterlockedIncrement64(&counter);
    uint16_t idx = domain_encrypt((uint16_t)idx0);
    uint8_t msb = sbox1[(idx0 >> 16) & 0xFF];
    uint32_t addr = ADDR_BASE;

    if (names[idx] != NULL)
    {
        // Name table is full!
        debug("Block %s (name entry is full)\n", name0);
        return 0;
    }

    size_t len = strlen(name0);
    size_t size = sizeof(struct name) + (len + 1) * sizeof(char);
    struct name *name = (struct name *)malloc(size);
    if (name == NULL)
    {
        warning("failed to allocate %u bytes for domain name", size);
        exit(EXIT_FAILURE);
    }



    name->ref_count = 1;
    name->msb = msb;
    memcpy(name->name, name0, len+1);

    names[idx] = name;

    return addr;
}