Prevent the kernel from handling raw TCP socket segments

Question

According to http://linux.die.net/man/7/raw , raw_socket = socket(AF_INET, SOCK_RAW, int protocol); is a way to create a raw socket.

• I assume that raw sockets are created at level-3, so the protocol should not be IPPROTO_TCP / IPPROTO_UDP , but it should be IPPROTO_IP . Is this understanding correct?

• But when I create a raw socket with a protocol like IPPROTO_IP ( *socketFd = socket(AF_INET, SOCK_RAW, IPPROTO_IP); ), socket creation fails with an error Protocol is not supported

• When I create a raw socket with a protocol like IPPROTO_RAW ( *socketFd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); ), my application does not receive any packets

• When I create a raw socket with a protocol like IPPROTO_TCP ( socketFd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP); ), my application receives TCP packets, but the kernel also responds to these packets (and in my case it is an RST link). I assume this is because the kernel thinks that no one is listening on the port this packet is destined for.

My intention is to simply send replies to messages arriving in my application with a fake IP and TCP header. Since none of the above attempts worked for me, how can I create a raw socket and make the TCP layer for the kernel quiet only for this connection?

EDIT: Please skip questions 1-3. Filipe already answered. For questions 4, we have a workaround. But, keeping the question open, if someone here has an answer and would like to answer it.

Answer 1

I assume that raw sockets are created at level-3 and therefore the protocol should not be IPPROTO_TCP / IPPROTO_UDP, but it should be IPPROTO_IP. Is this understanding correct?

No. You are right that raw sockets are basically layer 3 packets, but the protocol should not be IPPROTO_IP . The protocol argument in the case of raw sockets indicates what type of packets you want to receive on this socket. Remember that the protocol essentially performs demultiplexing at the transport level, so you need to specify what type of protocol your raw socket is interested in. This is clearly seen in man 7 raw :

All packets or errors corresponding to the protocol number specified for the raw socket are sent to this socket. For a list of allowed protocols, see RFC 1700, Assigned Numbers, and getprotobyname (3).

Since you are interested in receiving IP packets for a TCP connection, you should use IPPROTO_TCP .

But when I create a raw socket with a protocol like IPPROTO_IP (* socketFd = socket (AF_INET, SOCK_RAW, IPPROTO_IP);), creating sockets with an error Protocol is not supported.

Yes, this is expected: the IP protocol is not a layer 4 protocol. As I said, the protocol field is used for demultiplexing at the transport level, so it makes no sense to use IPPROTO_IP .

When I create a raw socket with a protocol like IPPROTO_RAW (* socketFd = socket (AF_INET, SOCK_RAW, IPPROTO_RAW);), my application does not receive any of the packets

This means that IPPROTO_RAW means that you are interested in sending all types of protocol packets (TCP, UDP, or any other protocol). But with IPPROTO_RAW you cannot do the opposite: IPPROTO_RAW means that you can get any protocol in this raw socket that is not supported. This is also shown in man 7 raw :

The IPPROTO_RAW protocol implies the inclusion of IP_HDRINCL and can send any IP protocol specified in the transmitted header. receiving all IP protocols through IPPROTO_RAW is not possible using raw sockets.

In other words, IPPROTO_RAW gives you the ability to send packets that match any protocol, but at the cost of not receiving a response. You could create other specific raw protocol-bound sockets to get the answers as workarounds, but this complicates the design because you have to manage the socket pool and this is definitely not what you want to do here.

When I create a raw socket with a protocol like IPPROTO_TCP (socketFd = socket (AF_INET, SOCK_RAW, IPPROTO_TCP);), my application receives TCP, but the kernel also responds to these packets (and in my case it passes an RST link). I assume this is because the kernel thinks that there is no one listening on the port this packet is destined for.

You cannot prevent the kernel from doing its work. From the raw sockets man page:

When a packet is received, it is sent to any raw sockets that have been associated with its protocol before it is transferred to another handler protocol (for example, kernel protocol modules).

So, you are right that the kernel sends the RST packet because it does not know the active TCP sockets or connections on the specified port. As I said, you cannot stop the kernel from doing your work, but a relatively quick (and possibly ugly) hack is to drop RST packets using iptables:

 iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP 

Yes, not very elegant, but I think that little can be done here.

As pointed out in the comments, you can also create a fictitious TCP socket bound to the same port and address where you just received and dropped the messages. Thus, the kernel will not send RST responses, and you do not need to bother with iptables.

Also remember that since you need to specify IPPROTO_TCP for your raw socket, you must set IP_HDRINCL to the socket using setsockopts(2) so that you can create your own IP header.

Finally, make sure that this process has an effective user ID of 0 or CAP_NET_RAW (in practice: run it as root).

Answer 2

[this is a comment on Jonathan Reinhart's comment, but I don't have enough reputation]

relative to AF-PACKET sockets

Creating raw sockets with AF_PACKET is described in man packet . The value for the protocol variable must be the ethertype value in network byte order. These values ​​are defined in <linux/if_ether.h> (in host byte order). So, to open a raw socket, you do

socketFd = socket ( AF_PACKET , SOCK_RAW , htons ( ETH_P_IP ) );

If you need AF_PACKET sockets, you can also use libpcap / tcpdump. This will allow you to capture Ethernet frames and send raw network frames. To capture, you can set a filter on what frames you want (for example, TCP port X). (basically with libpcap you can do the same as with AF_PACKET sockets, but easier)

links to capture guide and send help page

Answer 3

The following link here http://www.tenouk.com/Module43a.html was obtained from the answer to this question Simple socket server in C / C ++ on Linux And this assumes that you must be root or run as setuid0 to use raw socket

 /* Must be root or SUID 0 to open RAW socket */ ... /* Create RAW socket */ if((s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) { perror("socket() error"); /* If something wrong, just exit */ exit(1); }