Hi kernel experts,
I’m trying to modify the IP packet src & dest address after receiving from the wire and reconstruct the packet at kernel layer without going to apps layer and ultimately send out the packet. So, the recommended API to be used is ip_finish_output() (as it is the only exported symbol to send UDP packets). However, since the IP header content are changed, the system must automatically recalculate checksum and needs mac address as well, and most of the time mac address of unknown hosts.
Currently, when I try, I need to invoke mac address resolution via arp by manually calling neigh_lookup of existing arp entry before sending the packet by calling dev_queue_xmit().
My questions is how can I change (dest/src IP and port number) at before ip_finish_output() by accessing specific struct should I want to send the packet to unknown hosts (unknown means remote hosts that do not have an arp entry in local host's arp table) by calling ip_finish_output().
Thank you very much for your advice.
Ever heard Divert-Socket?
Maybe divert-sockets can help you.
What do you think?
Thanks for your suggestion.
Thanks for your suggestion. But I might not work for me because the control of the socket is not on my side, which means I don't control the opening and closing of socket, and hence I don't reserve the right to open IPPROTO_DIVERT. I just intercept at the IP stack and do my work.
Any other suggestions?
'control of the socket'
your answer seems to imply that the user space programs who's traffic you want to intercept have to set IPPROTO_DIVERT and you have no control over these programs.
but it is the other way round, you write a user space program like the example in the (slightly old, but you can google yourself, i think) howto http://www.faqs.org/docs/Linux-mini/Divert-Sockets-mini-HOWTO.html
that opens a divert socket to get the packets you want to mangle, and reinjects the mangled packets. so you open the divert socket in the interceptor program. you don't have to write a single line of kernel code. but if you are allowed to even run your own kernel code on the machine you should also have root rights needed for opening divert sockets.
strcmp Is Right
Yes, strcmp is right.
Using IPPROTO_DIVERT will be much easier for you.
Cogito ergo...
I think that you could do your packet handling as a Netfilter target.
Sorry. can you elaborate
Sorry. can you elaborate more on your point? I can't quite get it. Do you mean that I should process my packets in netfilter?
Thank you.
RTFriendlyM
Netfilter documentation.
These docs are over 5 years
These docs are over 5 years old and most likely do not lead to working code. Try searching for that "Writing your own Netfilter modules".
netfiler.org "how-to" read
netfiler.org
"how-to" read it u will find how to intercept packets??
read about hooks in above :::
And you, my foreposter, read
And you, my foreposter, read about writing proper phrases.
Ugh
If you're going to be a dick, at least be productive. If you don't have anything to add, please, just keep your hands off of the keyboard.