Raw Socket Linux sends / receives a packet

Question

There were problems receiving the packages. I can receive and read incoming packets, but I think that I do not receive a handshake with any host. I just want to send the packet to a remote computer with an open port when I receive a response, to see the TTL (lifetime) and window size. Does anyone have an idea where the errors are? (I don't have very deep knowledge in C programming)

CODE:

#include <sys/types.h> #include <stdio.h> #include <stdlib.h> #include <sys/socket.h> #include <errno.h> #include <unistd.h> #include <arpa/inet.h> #include <net/ethernet.h> #include <netinet/in.h> #include <netinet/ip.h> #include <netinet/tcp.h> struct pseudohdr { u_int32_t src_addr; u_int32_t dst_addr; u_int8_t padding; u_int8_t proto; u_int16_t length; }; struct data_4_checksum { struct pseudohdr pshd; struct tcphdr tcphdr; char payload[1024]; }; unsigned short comp_chksum(unsigned short *addr, int len) { long sum = 0; while (len > 1) { sum += *(addr++); len -= 2; } if (len > 0) sum += *addr; while (sum >> 16) sum = ((sum & 0xffff) + (sum >> 16)); sum = ~sum; return ((u_short) sum); } int main(int argc, char *argv[]) { int sock, bytes, on = 1; char buffer[1024]; struct iphdr *ip; struct tcphdr *tcp; struct sockaddr_in to; struct pseudohdr pseudoheader; struct data_4_checksum tcp_chk_construct; if (argc != 2) { fprintf(stderr, "Usage: %s ", argv[0]); fprintf(stderr, "<dest-addr>\n"); return 1; } sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP); if (sock == -1) { perror("socket() failed"); return 1; }else{ printf("socket() ok\n"); } if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on)) == -1) { perror("setsockopt() failed"); return 2; }else{ printf("setsockopt() ok\n"); } ip = (struct iphdr*) buffer; tcp = (struct tcphdr*) (buffer + sizeof(struct tcphdr)); int iphdrlen = sizeof(struct iphdr); int tcphdrlen = sizeof(struct tcphdr); int datalen = 0; printf("Typecasting ok\n"); ip->frag_off = 0; ip->version = 4; ip->ihl = 5; ip->tot_len = htons(iphdrlen + tcphdrlen); ip->id = 0; ip->ttl = 40; ip->protocol = IPPROTO_TCP; ip->saddr = inet_addr("192.168.165.135"); ip->daddr = inet_addr(argv[1]); ip->check = 0; tcp->source = htons(12345); tcp->dest = htons(80); tcp->seq = random(); tcp->doff = 5; tcp->ack = 0; tcp->psh = 0; tcp->rst = 0; tcp->urg = 0; tcp->syn = 1; tcp->fin = 0; tcp->window = htons(65535); pseudoheader.src_addr = ip->saddr; pseudoheader.dst_addr = ip->daddr; pseudoheader.padding = 0; pseudoheader.proto = ip->protocol; pseudoheader.length = htons(tcphdrlen + datalen); tcp_chk_construct.pshd = pseudoheader; tcp_chk_construct.tcphdr = *tcp; int checksum = comp_chksum((unsigned short*) &tcp_chk_construct, sizeof(struct pseudohdr) + tcphdrlen + datalen); tcp->check = checksum; printf("TCP Checksum: %i\n", checksum); printf("Destination : %i\n", ntohs(tcp->dest)); printf("Source: %i\n", ntohs(tcp->source)); to.sin_addr.s_addr = ip->daddr; to.sin_family = AF_INET; to.sin_port = tcp->dest; bytes = sendto(sock, buffer, ntohs(ip->tot_len), 0, (struct sockaddr*) &to, sizeof(to)); if (bytes == -1) { perror("sendto() failed"); return 1; } recv(sock, buffer, sizeof(buffer), 0); printf("TTL= %d\n", ip->ttl); printf("Window= %d\n", tcp->window); printf("ACK= %d\n", tcp->ack); printf("%s:%d\t --> \t%s:%d \tSeq: %d \tAck: %d\n", inet_ntoa(*(struct in_addr*) &ip->saddr), ntohs(tcp->source), inet_ntoa(*(struct in_addr *) &ip->daddr), ntohs(tcp->dest), ntohl(tcp->seq), ntohl(tcp->ack_seq)); return 0; } 

Answer 1

• You receive and save packets in buffer , but you print data from ip and tcp without parsing this buffer. You must parse the packet from buffer upon receipt and before printing .
• Your code assumes that all packets are TCP, which is not the case. RAW sockets only support layer 3 protocols (IP, ICMP, etc.). In other words, using IPPROTO_TCP is misleading when creating a RAW socket. Attach to IPPROTO_IP and add the necessary conditions for your code for each of your protocols (TCP, UDP, etc.). This happens because the Linux kernel checks the protocol number and falls back to IPPROTO_IP . However, this may not work on other systems.
• See if your network connection uses the correct byte order. The network byte order is Big-Endian, and the host byte order depends on your architecture, so you may need to convert multi-byte fields back and forth.
• Your tcp->seq may have an invalid value, since TCP takes values ​​up to 65535, and random() returns values ​​from 0 to RAND_MAX (0x7fffffff). Try tcp->seq = htonl(random() % 65535);
• Invalid offset calculation for TCP header. It should be sizeof(struct iphdr) , not sizeof(struct tcphdr) .

Answer 2

 ip = (struct iphdr*) buffer; tcp = (struct tcphdr*) (buffer + sizeof(struct tcphdr)); 

Here, to get the index of the tcp header array in buffer , you need to add sizeof(struct iphdr) to buffer , as follows.

 ip = (struct iphdr*) buffer; tcp = (struct tcphdr*) (buffer + sizeof(struct iphdr));