Re: tcp checksum

Hi Fred,

Thank you for pointing out these. Please see inline...


> Re,
>
> On Thu, May 27, 2004 at 06:19:10PM +0100, Jee J.Z. wrote:
> >
> > Thank you for your reply. Yes, I didn't call enough functions before
> > libnet_write(). I used to use only libnet_build_tcp() and then
> > libnet_build_ipv4(), however, I missed libnet_build_tcp_options(),
because
> > the packets I captured and wish to reinject include 8-byte tcp header
> > option. And I figured out the proper sequence of using these functions
are:
> >
libnet_build_tcp_options()->libnet_build_tcp()->libnet_build_ipv4()->libnet_
> > write(); otherwise things would happen weird.
>
> Seems ok :)
>
> > On the other hand, are there any relatively complete tutorials on the
newest
> > version libnet? I never found one, and many instructions on web are
still
> > for old versions and therefore are somewhat misleading. I never came
across
> > libnet_build_tcp_options() until looked into the source codes at
> > libnet_build_tcp.c, and I never knew the sequence of using these "build"
> > functions until I tried it, which is clearly hard for a new user to
grasp
> > libnet. Anybody has the same problem?
>
> <adv>
> http://www.security-labs.org/index.php3?page=libnet
> </adv>
>
> The build function is very logical as it is excactly the same as the
> one used by your system: you start from the higher layer (eg dns), and
> go down the the lower ones (eth for instance).

Right. Actually I saw this before, but I might not have read it very
carefully. At least we even don't have a list of introduction of all
functions libnet provides. But anyway...

> > Amit, what do you think it happens when a packet with a dst address of
> > another machine is injected into the kernel? Will it hit the POST
routing
> > hook? I am asking this because my SNAT on POSTROUTING seems invalid to
my
> > injected packets. What do you think?
>
> Look at a thread called "icmp redirect at layer 3" started by Alberto
> Ornaghi: we explore the travel of a packet through the Linux kernel.
> However, we still havent found the solution to Alberto's problem.

Right. It seems to prove that injected packets will hit NF_IP_LOCAL_OUT --- 
no problem. I checked a linux kernel 2.4 packet handling flow chart and a
netfilter packet handling flow chart, it looks like locally generated
packets will hit both NF_IP_LOCAL_OUT and NF_IP_POST_ROUTING. There must be
a bug, either ours (most probably I think), or netfilter's. :(

> BTW, do I have a problem with my browser or hav the archives on
> securityfocus for the latest weeks disappeared ?

I didn't notice that...

Jee

> Fred
>