Re: Any way to automatically change arbitrary headers of IP packets on-the-fly?

If you are willing to write some code, then you can write a small
kernel module which will collect all the packets from ethernet card.
You get the packet, manipulate it, recalculate the checksum and push
it back to the card. I have tried doing this to manipulate some other
fields. It works.

For reference see the following article from phrack:
http://www.phrack.org/phrack/55/P55-12

cheers,
~Manu

On 4/15/05, Jo=E3o Paulo Caldas Campello <[email protected]> wrote:
> On 4/14/05, [email protected] <[email protected]> wrote:
>=20
> > Currently, iptables doesn't seem to support that, probably to keep you =
from
> > shooting yourself in the foot.  Consider for example how fast the kerne=
l will
> > fold up if you change that first nybble of the packet from an x'4' to a=
n x'6'
> > without changing the rest of the packet to match.  Suddenly, that sk_bu=
ff is
> > a lot too short.. ;)
>=20
> Yeah, maybe, who knows :P
>=20
> Well, I've did some searching last days and found a couple ways to
> achieve what I've described in my email.
>=20
> One is using "DIVERT sockets" and other is the use of the "-j QUEUE"
> target of iptables/netfilter. Both approaches are similar: you match a
> packet using iptables to flush them to userspace, where you can mangle
> the entire packet as you like and send it back to iptables, who will
> put it again onto the stack.
>=20
> The "-j QUEUE" approach is manipulated through the "libipq" API:
>=20
> - netfilter can feed userspace using IPQUEUE:
>   * http://www.crhc.uiuc.edu/~grier/projects/libipq.html
>=20
> - Perl:
>   * http://www.intercode.com.au/jmorris/perlipq/
>=20
> - Python:
>   * http://woozle.org/~neale/src/ipqueue/
>=20
> As you can see, there's already libraries written in Perl and Python
> to query IPQUEUE, so the effort of writing userspace code to deal with
> IP packets wiil be much more easier.
>=20
> That's it =3D)
>=20
> Cheers,
>=20
> Jo=E3o Paulo.
>=20


--=20
Manu Garg
http://manugarg.freezope.org
"Truth will set you free!"