Re: libnet_write
[email protected] Wed, 23 Jun 2004 20:20:10 +0530
| Newsgroups | gmane.comp.security.libnet |
|---|---|
| Message-ID | <[email protected]> |
Hi,
This is the program that is causing trouble, and also attached is strace
output, after libnet is initialized using libnet_init(), the raw socket id
for it is 3, when libipq is initialized the raw socket id for it is 4, and
between these two initializations, some how libnet calls a lot of
setsockopts for its raw sock fd of 3, and just keeps trying to increase the
buffer size ... it it overflows(all the setsockopts are successful, they
return 0), finally the when libnet_write is called(it is called for only
one packet) ... it fails(the sendto returns with an error code EPERM--
opertion not permitted. Whereas the recvfrom and sendmsg for the netlink
raw sock being used by libipq is called hundreds of times but it still
works fine, have a look at the logs.
while I tried to run the same libnet calls in a program that does not have
libipq calls and everything runs absolutely fine.
***************code fragment causing trouble ****************
int main(int argc, char **argv)
{
int status, len_ip,c=0;
char buf[BUFSIZE];
struct ipq_handle *h;
static int p=0;
u16 csum, tcp_csum;
unsigned char *tmp_ip_header;
unsigned short see=0;
unsigned long temp_src_addr_changed;
struct udphdr *uhead;
struct iphdr *iphead;
unsigned char *packet_all;
unsigned short ip_header_len;
int protocol;
unsigned long dst_ip, src_ip;
lh=libnet_init(LIBNET_RAW4,NULL, err_buf); /**** LIBNET_INIT ****************/
if((dst_ip=libnet_name2addr4(lh, dst, LIBNET_DONT_RESOLVE))==-1)
{
fprintf(stderr, "Bad dst IP address: %s\n", dst);
exit(EXIT_FAILURE);
}
if((src_ip=libnet_name2addr4(lh, src, LIBNET_DONT_RESOLVE))==-1)
{
fprintf(stderr, "Bad src IP address: %s\n", dst);
exit(EXIT_FAILURE);
}
h = ipq_create_handle(0, PF_INET); /*************ipqs create_handle , ********************/
if (!h)
die(h);
status = ipq_set_mode(h, IPQ_COPY_PACKET, BUFSIZE);
if (status < 0)
die(h);
do{
status = ipq_read(h, buf, BUFSIZE, 0);
//printf("got here");
if (status < 0)
die(h);
//if (p)
// {
*************************************************************
/*************************************STRACE LOGS
*********************************/
t", ["./libipq_prob.out"], [/* 29 vars */]) = 0
13897 uname({sysname="Linux", nodename="prms1", release="2.4.20-8", version="#1 Thu Mar 13 17:54:28 EST 2003", machine="i686"}) = 0
13897 brk(0) = 0x80509e0
13897 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40016000
13897 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory)
13897 open("/etc/ld.so.cache", O_RDONLY) = 3
13897 fstat64(3, {st_dev=makedev(104, 1), st_ino=216653, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=240,
st_size=115094, st_atime=2004/06/23-12:21:42, st_mtime=2004/05/12-10:14:19, st_ctime=2004/05/12-10:14:19}) = 0
13897 old_mmap(NULL, 115094, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40017000
13897 close(3) = 0
13897 open("/lib/tls/libc.so.6", O_RDONLY) = 3
13897 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`V\1B4\0"..., 512) = 512
13897 fstat64(3, {st_dev=makedev(104, 1), st_ino=422718, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=3000,
st_size=1531064, st_atime=2004/06/23-12:21:42, st_mtime=2003/03/14-06:13:10, st_ctime=2004/05/11-18:59:41}) = 0
13897 old_mmap(0x42000000, 1257224, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x42000000
13897 old_mmap(0x4212e000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x12e000) = 0x4212e000
13897 old_mmap(0x42131000, 7944, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x42131000
13897 close(3) = 0
13897 set_thread_area({entry_number:-1 -> 6, base_addr:0x40016a00, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1,
seg_not_present:0, useable:1}) = 0
13897 munmap(0x40017000, 115094) = 0
13897 getuid32() = 0
13897 brk(0) = 0x80509e0
13897 brk(0x80519e0) = 0x80519e0
13897 brk(0) = 0x80519e0
13897 brk(0x8052000) = 0x8052000
13897 socket(PF_INET, SOCK_RAW, IPPROTO_RAW) = 3
13897 setsockopt(3, SOL_IP, IP_HDRINCL, [1], 4) = 0
13897 getsockopt(3, SOL_SOCKET, SO_SNDBUF, [65535], [4]) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [65663], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [65791], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [65919], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [66047], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [66175], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [66303], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [66431], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [66559], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [66687], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [66815], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [66943], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [67071], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [67199], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [67327], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [67455], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [67583], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [67711], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [67839], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [67967], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [68095], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [68223], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [68351], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [68479], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [68607], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [68735], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [68863], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [68991], 4) = 0
13897 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [69119], 4) = 0
all these setsockopts are called when not even one packet has been sent on this socket, and in all only one packet is ever sent on this.
.............HUNDREDS more such setsockopts ...................................
then ipq_create_handle is called
socket(PF_NETLINK, SOCK_RAW, 3) = 4
13897 getpid() = 13897
13897 bind(4, {sa_family=AF_NETLINK, sa_data="\0\0I6\0\0\0\0\0\0\0\0\0\0"}, 12) = 0
13897 sendto(4, ",\0\0\0\21\0\1\0\0\0\0\0I6\0\0\2\0\0\0\0\10\0\0\0\0\0\0"..., 44, 0, {sa_family=AF_NETLINK, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"},
12) = 44
13897 recvfrom(4, "\200\0\0\0\23\0\0\0\0\0\0\0\0\0\0\0\300q\320\347\0\0\0"..., 2048, 0, {sa_family=AF_NETLINK,
sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, [12]) = 128
13897 sendmsg(4, {msg_name(12)={sa_family=AF_NETLINK, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(2)=[{"\34\0\0\0\22\0\1\0\0\0\0\0I6\0\0", 16},
{"\1\0\0\0\300q\320\347\0\0\0\0", 12}], msg_controllen=0, msg_flags=0}, 0) = 28
13897 recvfrom(4, "\200\0\0\0\23\0\0\0\0\0\0\0\0\0\0\0\0t\320\347\0\0\0\0"..., 2048, 0, {sa_family=AF_NETLINK,
sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, [12]) = 128
13897 sendmsg(4, {msg_name(12)={sa_family=AF_NETLINK, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(2)=[{"\34\0\0\0\22\0\1\0\0\0\0\0I6\0\0", 16},
{"\1\0\0\0\0t\320\347\0\0\0\0", 12}], msg_controllen=0, msg_flags=0}, 0) = 28
13897 recvfrom(4, "\240\0\0\0\23\0\0\0\0\0\0\0\0\0\0\0\300q\320\347\0\0\0"..., 2048, 0, {sa_family=AF_NETLINK,
sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, [12]) = 160
13897 sendmsg(4, {msg_name(12)={sa_family=AF_NETLINK, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(2)=[{"\34\0\0\0\22\0\1\0\0\0\0\0I6\0\0", 16},
{"\1\0\0\0\300q\320\347\0\0\0\0", 12}], msg_controllen=0, msg_flags=0}, 0) = 28
13897 recvfrom(4, "\240\0\0\0\23\0\0\0\0\0\0\0\0\0\0\0\0t\320\347\0\0\0\0"..., 2048, 0, {sa_family=AF_NETLINK,
sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, [12]) = 160
13897 sendmsg(4, {msg_name(12)={sa_family=AF_NETLINK, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(2)=[{"\34\0\0\0\22\0\1\0\0\0\0\0I6\0\0", 16},
{"\1\0\0\0\0t\320\347\0\0\0\0", 12}], msg_controllen=0, msg_flags=0}, 0) = 28
13897 recvfrom(4, "\340\0\0\0\23\0\0\0\0\0\0\0\0\0\0\0\300q\320\347\0\0\0"..., 2048, 0, {sa_family=AF_NETLINK,
sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, [12]) = 224
13897 sendmsg(4, {msg_name(12)={sa_family=AF_NETLINK, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(2)=[{"\34\0\0\0\22\0\1\0\0\0\0\0I6\0\0", 16},
{"\1\0\0\0\300q\320\347\0\0\0\0", 12}], msg_controllen=0, msg_flags=0}, 0) = 28
13897 recvfrom(4, "\240\0\0\0\23\0\0\0\0\0\0\0\0\0\0\0@t\320
...........all recvfroms and sendmsgs for the nelink socket succeed ...........
.................then sendto for the libnet raw socket is called, fails returning EPERM ...............
sendto(3, "E\0\0(\0\362\0\0@\6\3U\300\250\372>\300\250\372\371\0<"..., 40, 0,
{sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.250.249")}, 16) = -1 EPERM (Operation not permitted)
13897 write(2, "Write error: libnet_write_raw_ip"..., 82) = 82
13897 sendmsg(4, {msg_name(12)={sa_family=AF_NETLINK, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(2)=[{"\34\0\0\0\22\0\1\0\0\0\0\0I6\0\0", 16},
{"\0\0\0\0@}\320\347\0\0\0\0", 12}], msg_controllen=0, msg_flags=0}, 0) = 28
13897 recvfrom(4, "\200\0\0\0\23\0\0\0\0\0\0\0\0\0\0\0\0}\320\347\0\0\0\0"..., 2048, 0, {sa_family=AF_NETLINK,
sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, [12]) = 128
13897 sendmsg(4, {msg_name(12)={sa_family=AF_NETLINK, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(2)=[{"\34\0\0\0\22\0\1\0\0\0\0\0I6\0\0", 16},
{"\1\0\0\0\0}\320\347\0\0\0\0", 12}], msg_controllen=0, msg_flags=0}, 0) = 28
13897 recvfrom(4, "\200\0\0\0\23\0\0\0\0\0\0\0\0\0\0\0\300v\320\347\0\0\0"..., 2048, 0, {sa_family=AF_NETLINK,
sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, [12])
/******************************************************************************************/
Amit Kumar Singh
06/23/2004 03:51 PM
To: "Jee J.Z." <[email protected]>
cc: <[email protected]>
Subject: libnet_write (Document link: Amit Kumar Singh)
Hi,
facing a problem using libnet_write ....
I do a libnet_build_tcp then a libnet_build_ipv4 then write using
libnet_write() .... In one of these programs I am also using libipq library
function calls .. here when libnet_write is executed it returns an error
code of -1, (with the error string as Operation not permitted).
tried running only a simple libnet program that builds and sends a tcp
packet exactly as in the previous case, but this function didnt have any
libipq calls, here libnet_write succeeds, I get "written these many bytes
to wrire", but even in this case I am not able to catch the packet on
tcpdump
?????
Amit