Re: icmp redirect at layer 3

Alberto Ornaghi wrote:
> 
> is it possible to inject ICMP redirect messages at LIBNET_RAW4 level ?
> 
> I remember to have tried it, but I got an "operation not permitted" 
> error from the kernel. so I've opted for the LIBNET_LINK level which, in 
> turn, works fine.
> 
> is this correct ?  is this a kernel limitation ?

following is a short summary of what frederic and me have emailed:

--- frederic ---
I checked with that program, and it works fine on my Mac OS X and
Linux (2.4.22). However, I had a look in Linux kernel sources, and
found that in net/ipv4/route.c :

raynal@batman tmp >>sysctl -A| grep eth0 | grep redirec
net.ipv4.conf.eth0.send_redirects = 1
net.ipv4.conf.eth0.secure_redirects = 1
net.ipv4.conf.eth0.accept_redirects = 1

I played with those flags, and even we I set them to 0, I can still
send redirects with the RAW interface.

--- me ---

my system is 2.4.26.

./icmp_redirect_raw -s 1.1.1.1 -d 2.2.2.2 -g 3.3.3.3
libnet 1.1 packet shaping: ICMP redirect[raw4]
Write error: libnet_write_raw_ipv4(): -1 bytes written (Operation not 
permitted)

here is a strace output (if needed):

socket(PF_INET, SOCK_RAW, IPPROTO_RAW)  = 3
setsockopt(3, SOL_IP, IP_HDRINCL, [1], 4) = 0
getsockopt(3, SOL_SOCKET, SO_SNDBUF, [106496], [4]) = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [106624], 4) = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [106752], 4) = 0
[... lof of setsockopt ...]
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [1048320], 4) = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [1048448], 4) = 0
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1048576], 4) = 0
sendto(3, "E\30\0008\0\356\0\0@\1s\272\1\1\1\1\2\2\2\2\5\1\373\27"..., 
56, 0, {sa_family=AF_INET, sin_port=htons(0), 
sin_addr=inet_addr("2.2.2.2")}, 16) = -1 EPERM (Operation not permitted)


--- frederic ----

Grrrrrhhh ... I have the same problem @home on a 2.4.25 ...

It is definitely a kernel problem :

alfred:/tmp/libnet-1.1.2-icmp/sample# uname -a
Linux alfred 2.4.25-1-686 #3 Wed Apr 14 21:56:44 EST 2004 i686 GNU/Linux

alfred:/tmp/libnet-1.1.2-icmp/sample# strace -e trace=network -s 72
./icmp_redirect_raw4 -s 1.1.1.1 -d 2.2.2.2 -g 3.3.3.3
libnet 1.1 packet shaping: ICMP redirect[raw4]
socket(PF_INET, SOCK_RAW, IPPROTO_RAW)  = 3
setsockopt(3, SOL_IP, IP_HDRINCL, [1], 4) = 0
getsockopt(3, SOL_SOCKET, SO_SNDBUF, [65535], [4]) = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [66559], 4) = 0
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [66559], 4) = 0
sendto(3,
"E\30\0008\0\356\0\0@\1s\272\1\1\1\1\2\2\2\2\5\1\373\27\3\3\3\3E\30\0\34\0B\0\0@\1t\202\2\2\2\2\1\1\1\1\21\21\"\"\0\10\306\245",
56, 0, {sa_family=AF_INET, sin_port=htons(0),
sin_addr=inet_addr("2.2.2.2")}, 16) = -1 EPERM (Operation not
permitted)
Write error: libnet_write_raw_ipv4(): -1 bytes written (Operation not
permitted)

And on another box:

batman:/tmp/libnet-1.1.2-icmp/sample# uname -a
Linux batman 2.4.25-1-k7 #2 Thu Apr 15 01:19:15 EST 2004 i686 GNU/Linux

batman:/tmp/libnet-1.1.2-icmp/sample# strace -e trace=network -s 72
./icmp_redirect_raw4 -s 1.1.1.1 -d 2.2.2.2 -g 3.3.3.3
libnet 1.1 packet shaping: ICMP redirect[raw4]
socket(PF_INET, SOCK_RAW, IPPROTO_RAW)  = 3
setsockopt(3, SOL_IP, IP_HDRINCL, [1], 4) = 0
getsockopt(3, SOL_SOCKET, SO_SNDBUF, [65535], [4]) = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [66559], 4) = 0
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [66559], 4) = 0
sendto(3,
"E\30\0008\0\356\0\0@\1s\272\1\1\1\1\2\2\2\2\5\1\373\27\3\3\3\3E\30\0\34\0B\0\0@\1t\202\2\2\2\2\1\1\1\1\21\21\"\"\0\10\306\245",
56, 0, {sa_family=AF_INET, sin_port=htons(0),
sin_addr=inet_addr("2.2.2.2")}, 16) = 56
Wrote 56 byte ICMP packet; check the wire.


I am convinced it comes from some kernel configuration option, but
which one !

----------------------

anyone can report successful/failed tests ?

-- 

    --==> ALoR <==---------------------- -  -   -

  There are only 10 types of people in this world...
  Those who understand binary, and those who don't.