Re: icmp redirect at layer 3

On Mon, May 10, 2004 at 04:54:32PM +0200, Alberto Ornaghi wrote:
> 
> is it possible to inject ICMP redirect messages at LIBNET_RAW4 level ?
> 
> I remember to have tried it, but I got an "operation not permitted" 
> error from the kernel. so I've opted for the LIBNET_LINK level which, in 
> turn, works fine.
> 
> is this correct ?  is this a kernel limitation ?
> 


I looked in kernel today, and started to trace what's going on :



---------------- USER SPACE ---------------

                 sendto() == -1

---------------- KERNEL SPACE ---------------

net/socket.c:     sys_sendto()                             
                       |                                           
                       |                                           
                  sock_sendmsg()                                   
                       |                                           
                       | if (scm_send() >= 0)                      
                       |                                         
                  sock->ops->sendmsg() [pointer to raw_sendmsg()]
                       |
raw.c:                 |
                       |
                 raw_sendmsg()  [return -ENETUNREACH    101     /* Network is unreachable */]
                       |
net/ipv4/route.c:      |      <----- BELOW HERE, IT IS JUST ASSUMPTION, NOT CONFIRMED YET
                       |
              ip_route_output_slow()
                       |
net/ipv4/fib_rules.c   |
                       |
                   fib_lookup()


I did not look at a diff to notice the changes. However, on the same
box, I could send icmp redirect, depending on the supplied addresses
(address outside the network causes an error):

batman# route del default
batman# netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window irtt Iface
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0      0    eth0
batman# # ./icmp_redirect_raw4 -g 3.3.3.3 -s 2.2.2.2 -d 1.1.1.1
libnet 1.1 packet shaping: ICMP redirect[raw4]
Write error: libnet_write_raw_ipv4(): -1 bytes written (Network is unreachable)

Normal, that packet is aimed at 1.1.1.1 ... and batman does not know
any route to there.

batman# ./icmp_redirect_raw4 -g 3.3.3.3 -s 2.2.2.2 -d 192.168.0.42
libnet 1.1 packet shaping: ICMP redirect[raw4]
Wrote 56 byte ICMP packet; check the wire.

Fine, the kernel found a route for our packet :)

However, once routing is done in kernel,  netfilter's hooks are called:

batman# iptables -A OUTPUT -p icmp -j DROP
batman# ./icmp_redirect_raw4 -g 3.3.3.3 -s 2.2.2.2 -d 192.168.0.42
libnet 1.1 packet shaping: ICMP redirect[raw4]
Write error: libnet_write_raw_ipv4(): -1 bytes written (Operation not permitted)

Héhé :-) It works just before ... and no more now !

Look at the error message: it has changed to become "Operation not
permitted". It means Netfilter is doing his job.

I guess (I am really not sure as I am not a netfilter expert at all)
it is due to the hook NF_IP_LOCAL_OUT  or NF_IP_LOCAL_OUT, but that
latter is not in the table "filter".

That's all folks


	Fred Raynal

PS: special UNgreetz to Alberto for that interesting question: I'm
late now on other stuffs