Raw sockets. – Debugging Everything

Approximately year ago I wrote an article “Wiresharking TCP Split Handshake Attack“. Normally client/server application written on socket level does not permit to split handshaking. For example TCP client connect function initiates a connection on a socket and performs all 3 handshaking step. Handshaking process is hidden in Transport layer of ISO model. To manipulate with handshaking signals application must be able to send and receive raw packets and for this purpose raw socket is used.
There is opinion that raw socket is source of malicious software. Yes it is true, but it the same time raw socket opens opportunity to learn protocol internals, experimenting, test firewall and routers.
Here is c++ example of raw socket application (rawsock.cpp) which sends SYN signal to server and does not wait for ACK-SYN response, besides it specifies real source IP with loopback IP address – 127.0 0.1:

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <unistd.h>
int main(int n, char ** s)
{
   if(n<3)
   {
      printf("Arguments are required: destination ip and destination port, space separated, order is important\n");
      return -1;
   }
   int destport = atoi(s[2]);
   printf("Destination end point: %s:%d\n", s[1], destport);
   int sckt;
   struct sockaddr_in saddr;
   struct send_tcp
   {
      struct iphdr ip;
      struct tcphdr tcp;
   } packtcp;

   packtcp.ip.version = 4; /* version of IP used */
   packtcp.ip.ihl = 5; /* Internet Header Length (IHL) */
   packtcp.ip.tos = 0; /* Type Of Service (TOS) */
   packtcp.ip.tot_len = htons(40); /* total length of the IP datagram */
   packtcp.ip.id = 1; /* identification */
   packtcp.ip.frag_off = 0; /* fragmentation flag */
   packtcp.ip.ttl = 255; /* Time To Live (TTL) */
   packtcp.ip.protocol = IPPROTO_TCP; /* protocol used (TCP in this case) */
   packtcp.ip.check = 14536; /* IP checksum */
   packtcp.ip.saddr = inet_addr("127.0.0.1"); /* source address */
   packtcp.ip.daddr = inet_addr(s[1]); /* destination address */

   packtcp.tcp.source = htons(2000); /* source port */
   packtcp.tcp.dest = htons(destport); /* destination port */
   packtcp.tcp.seq = 1; /* sequence number */
   packtcp.tcp.ack_seq = 2; /* acknowledgement number */
   packtcp.tcp.doff = 5; /* data offset */
   packtcp.tcp.res1 = 0; /* reserved for future use (must be 0) */
   packtcp.tcp.fin = 0; /* FIN flag */
   packtcp.tcp.syn = 1; /* SYN flag */
   packtcp.tcp.rst = 0; /* RST flag */
   packtcp.tcp.psh = 0; /* PSH flag */
   packtcp.tcp.ack = 0; /* ACK flag */
   packtcp.tcp.urg = 0; /* URG flag */
   packtcp.tcp.res2 = 0; /* reserved (must be 0) */
   packtcp.tcp.window = htons(512); /* window */
   packtcp.tcp.check = 8889; /* TCP checksum */
   packtcp.tcp.urg_ptr = 0; /* urgent pointer */

   saddr.sin_family = AF_INET;
   saddr.sin_port = htons(destport);
   saddr.sin_addr.s_addr = inet_addr(s[1]);

   sckt = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
   if(sckt == -1)
   {
      printf("Error code: %d\n", errno);
      perror("socket error");
      return -1;
   }

   if(sendto(sckt, &packtcp, sizeof(packtcp), 0, (struct sockaddr *)&saddr, sizeof(saddr)) == -1)
   {
      close(sckt);
      printf("Error code: %d\n", errno);
      perror("sendto error");
      return -1;
   }

close(sckt);
return 0;
}

Testing using tcpdump:
From one Linux box I ran 3 time rawsock application:

# ./rawsock 192.168.2.59 22
Destination end point: 192.168.2.59:22
# ./rawsock 192.168.2.59 22
Destination end point: 192.168.2.59:22
# ./rawsock 192.168.2.59 22
Destination end point: 192.168.2.59:22

Other Linux box tcpdump captured SYN signals:

# tcpdump -n src 127.0.0.1 && 'tcp[13] & 12!=0' && 'ip[8]==255'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens160, link-type EN10MB (Ethernet), capture size 262144 bytes
16:22:44.486301 IP 127.0.0.1.2000 > 192.168.2.59.22: Flags [S], seq 16777216, win 512, length 0
16:22:45.588872 IP 127.0.0.1.2000 > 192.168.2.59.22: Flags [S], seq 16777216, win 512, length 0
16:22:46.514978 IP 127.0.0.1.2000 > 192.168.2.59.22: Flags [S], seq 16777216, win 512, length 0

Explanation of tcpdump parameters:

Parameter	Line of c++ code	Comment
src 127.0.0.1	inet_addr("127.0.0.1");
tcp[13] & 12!=0	packtcp.tcp.syn = 1;	rawsock sends SYN only, tcpdump checks SYN and ACK
ip[8]==255	packtcp.ip.ttl = 255;	tcpdump verifies also TTL

Leave a Reply Cancel reply