365 Days of Code - Day 038

1
2
3
4
5
6

#include <stdio.h>
#include <stdint.h>      // fixed type sizes (uint8_t, etc)
#include <assert.h>      // turn assumptions into assertions
#include <stddef.h>      // offsetof()
#include <arpa/inet.h>   // htons(), ntohs(), inet_pton(), AF_INET
#include <string.h>      // memcpy()

1
2
3
4

const struct proto_ops inet_stream_ops = {
  .family = PF_INET,
  // ...
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107

  // Building a socket, transmit the packet

  // Why is root required to run this code now? Short answer, because we are using raw sockets
  // In standard network programs, the kernel abstracts away the IP layer, and generates the headers
  // This prevents spoofing or other unsafe operations
  // In this instance, we are specifically telling the kernel that we will provide all header information
  // Standard users cannot do this, and root privileges must be used to perform these operations

  // Create a raw socket explicitly bound to the ICMP protocol (so we can receive replies)
  int raw_socket = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
  if (raw_socket < 0)
  {
    perror("Socket creation failed. Are you running as root?");
    return -1;
  }

  // Manually instruct the kernel that we are providing our own IPv4 Header (IP_HDRINCL)
  int hdr_incl = 1;
  if (setsockopt(raw_socket, IPPROTO_IP, IP_HDRINCL, &hdr_incl, sizeof(hdr_incl)) < 0)
  {
    perror("Failed to set IP_HDRINCL");
    close(raw_socket);
    return -1;
  }

  printf("Phase 4: Raw socket successfully created with IP_HDRINCL (fd: %d).\n", raw_socket);

  // Construct the targeting structure for the kernel's routing table
  struct sockaddr_in dest_info = {0};

  dest_info.sin_family = AF_INET;
  dest_info.sin_port = htons(0); // ICMP does not use Layer 4 ports
  inet_pton(AF_INET, "127.0.0.1", &dest_info.sin_addr.s_addr);

  // Test 21: Validate the kernel routing structure
  assert(dest_info.sin_family == AF_INET);
  assert(dest_info.sin_port == 0);
  assert(ntohl(dest_info.sin_addr.s_addr) == 0x7F000001);
  printf("Test 21 Passed: Kernel routing structure (sockaddr_in) populated.\n");

  // Inject the packet_buffer onto the wire
  ssize_t bytes_sent = sendto(raw_socket, packet_buffer, ntohs(ip->total_length), 0,
                (struct sockaddr *)&dest_info, sizeof(dest_info));

  if (bytes_sent < 0)
  {
    perror("Failed to send packet");
    close(raw_socket);
    return -1;
  }

  // Test 22: Validate transmission size
  assert(bytes_sent == ntohs(ip->total_length));
  printf("Test 22 Passed: Successfully injected %zd bytes onto the wire.\n", bytes_sent);
  printf("Use `sudo tcpdump -vv -i lo -n icmp` to see the results.\n");

  uint8_t recv_buffer[1024] = {0};
  struct sockaddr_in sender_info;
  socklen_t sender_len = sizeof(sender_info);

  struct ipv4_header *recv_ip = NULL;
  struct icmp_header *recv_icmp = NULL;

  printf("Listening for Echo Reply...\n");

  while (1)
  {
    ssize_t bytes_received = recvfrom(raw_socket, recv_buffer, sizeof(recv_buffer), 0,
                      (struct sockaddr *)&sender_info, &sender_len);
    if (bytes_received < 0)
      continue; // Skip socket read errors

    recv_ip = (struct ipv4_header *)recv_buffer;

    // Ensure it's ICMP and from 127.0.0.1
    if (recv_ip->protocol != IP_PROTO_ICMP || ntohl(recv_ip->src_addr) != 0x7F000001)
    {
      continue;
    }

    uint8_t recv_ihl = recv_ip->version_ihl & 0x0F;
    size_t ip_header_bytes = recv_ihl * 4;
    recv_icmp = (struct icmp_header *)(recv_buffer + ip_header_bytes);

    // If it is our Echo Request reflecting back, ignore it. We only want the Reply.
    if (recv_icmp->type == ECHO_REPLY)
    {
      printf("Test 25 Passed: Ignored our own request and caught the true Echo Reply!\n");
      break; // We found the target packet, exit the loop!
    }
  }

  // Map the Echo-specific fields immediately after the baseline ICMP header
  struct icmp_echo *recv_echo = (struct icmp_echo *)((uint8_t *)recv_icmp + sizeof(struct icmp_header));

  // Test 26: Validate the Identifier and Sequence
  assert(ntohs(recv_echo->identifier) == 0x1234);
  assert(ntohs(recv_echo->sequence) == 0x0001);
  printf("Test 26 Passed: Echo Reply Identifier and Sequence match our Request.\n");

  // Map a pointer to the start of the returned payload
  uint8_t *recv_payload = (uint8_t *)recv_echo + sizeof(struct icmp_echo);

  // Test 27: Validate the payload content
  // memcmp returns 0 if the memory blocks are identical
  assert(memcmp(recv_payload, "HELLO", 5) == 0);
  printf("Test 27 Passed: Payload successfully extracted and verified as 'HELLO'.\n");