customized ip stack over ethernet

Hi,

I'd like to hook a custermized IP stack with an ethernet card on a
linux
box. So I need to access all ethernet device driver interface for
ether frame
send/receive. I'd like to use the custermized statck as application so
that I
can use gdb to step thru the stack and modify the packet forwarding
accordingly. Has anybody had experience in that? Thanks for your
advice.
I am new to linux.

- Sherman

My specific question is, how should the application talk to
the ether driver to transmit an ether frame, and get notified
when an ether frame is received? Thanks,

- Sherman

(E-Mail Removed) (Sherman) wrote in message news:<(E-Mail Removed). com>...
> Hi,
>
> I'd like to hook a custermized IP stack with an ethernet card on a
> linux
> box. So I need to access all ethernet device driver interface for
> ether frame
> send/receive. I'd like to use the custermized statck as application so
> that I
> can use gdb to step thru the stack and modify the packet forwarding
> accordingly. Has anybody had experience in that? Thanks for your
> advice.
> I am new to linux.
>
> - Sherman

(E-Mail Removed) (Sherman) writes:

> My specific question is, how should the application talk to
> the ether driver to transmit an ether frame, and get notified
> when an ether frame is received? Thanks,

raw sockets

--
Måns Rullgård
(E-Mail Removed)

Måns Rullgård <(E-Mail Removed)> wrote in message news:<(E-Mail Removed)>...
> (E-Mail Removed) (Sherman) writes:
>
> > My specific question is, how should the application talk to
> > the ether driver to transmit an ether frame, and get notified
> > when an ether frame is received? Thanks,
>
> raw sockets

raw socket is fine but it involves the ip stack in kernel. I would like to
dis-associate the kernel ip stack with the ether driver, and intercept the
packets with my customized ip stack, for performance reason. Is there any
way to do that? Do I have to rewrite the device driver for the particular
NIC card, or there is any universal driver interface to do that?

- Sherman

Sherman schrieb:
> Måns Rullgård <(E-Mail Removed)> wrote in message news:<(E-Mail Removed)>...
>
>>(E-Mail Removed) (Sherman) writes:
>>
>>
>>>My specific question is, how should the application talk to
>>>the ether driver to transmit an ether frame, and get notified
>>>when an ether frame is received? Thanks,
>>
>>raw sockets
>
>
> raw socket is fine but it involves the ip stack in kernel. I would like to
> dis-associate the kernel ip stack with the ether driver, and intercept the
> packets with my customized ip stack, for performance reason. Is there any
> way to do that? Do I have to rewrite the device driver for the particular
> NIC card, or there is any universal driver interface to do that?
>
> - Sherman

you're going to do a LOT of work.
Do yourself a favor and use the kernel IP Stack. I can't imagine such
serious performance issues as that you would have to rewrite the stack

Sherman wrote:
> My specific question is, how should the application talk to
> the ether driver to transmit an ether frame, and get notified
> when an ether frame is received? Thanks,

You must use raw sockets programming to do this.

--

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
(E-Mail Removed)
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"

Sherman wrote:
> Måns Rullgård <(E-Mail Removed)> wrote in message news:<(E-Mail Removed)>...
>
>>(E-Mail Removed) (Sherman) writes:
>>
>>
>>>My specific question is, how should the application talk to
>>>the ether driver to transmit an ether frame, and get notified
>>>when an ether frame is received? Thanks,
>>
>>raw sockets
>
> raw socket is fine but it involves the ip stack in kernel. I would like to
> dis-associate the kernel ip stack with the ether driver, and intercept the
> packets with my customized ip stack, for performance reason. Is there any
> way to do that? Do I have to rewrite the device driver for the particular
> NIC card, or there is any universal driver interface to do that?

As you have been told you may use raw sockets:

int fd;
int if_index;
struct sockaddr_ll sockaddr;
socklen_t len = sizeof (struct sockaddr_ll);

fd = socket (PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if (fd == -1) {
return -1;
}

// Obtain interface index number
if_index = if_nametoindex ("eth0");

memset (&sockaddr, 0, sizeof (struct sockaddr_ll));
sockaddr.sll_family = AF_PACKET;
// ETH_P_ALL means listen to ALL ethernet protocols
sockaddr.sll_protocol = htons (ETH_P_ALL);
sockaddr.sll_ifindex = if_index;

// Bind raw socket to ethernet device
if (bind (s, (struct sockaddr *)&sockaddr, len) == -1) {
return -1;
}

Now by using socket fd in a poll() or blocking read() you will get all
ethernet packets (including the ethernet header) coming in from your
interface "eth0".

The packets received by eth0 device driver is first filtered by the BPF
(packet filter) in Linux before one copy of the packet is sendt to the
standard network stack and another copy is sent to your socket fd from
code above. And you may do whatever you vant to do with this packet.

Link:
http://www.fedchik.org.ua/linux/netf...ing-bytes.html

Quote from this page:
"In recent versions of the Linux kernel (post-2.0 releases) a new
protocol family has been introduced, named PF_PACKET. This family allows
an application to send and receive packets dealing directly with the
network card driver, thus avoiding the usual protocol stack-handling
(e.g., IP/TCP or IP/UDP processing). That is, any packet sent through
the socket will be directly passed to the Ethernet interface, and any
packet received through the interface will be directly passed to the
application.

The PF_PACKET family supports two slightly different socket types,
SOCK_DGRAM and SOCK_RAW. The former leaves to the kernel the burden of
adding and removing Ethernet level headers. The latter gives the
application complete control over the Ethernet header. The protocol
field in the socket() call must match one of the Ethernet IDs defined in
/usr/include/linux/if_ether.h, which represents the registered protocols
that can be shipped in an Ethernet frame. Unless dealing with very
specific protocols, you typically use ETH_P_IP, which encompasses all of
the IP-suite protocols (e.g., TCP, UDP, ICMP, raw IP and so on)."

Otherwise, Google is your friend...
(I have seen at least one project to implement a TCP/IP stack in
userspace on Linux using raw sockets, but don't have a link ready or
time to search for it again..).

--
Roar B. Rotvik

hi!
i want to send and receive raw packets(etherne hdr + ip+ tcp +
payload) to port 25..and handle the incoming packets sent by port 25
myself bypassing the kernel..iam using PF_PACKET and RAW_SOCK as i want
to send and receive ..
folowing code sends the sync packet(whicj i am reading from trace
file...) and i see the packet going to network by tcpdump..but i am
seeing any syn-ack packet coming back...
please do help...
im having hard time since weeks..

Thanks


source....


int main()
{

struct sockaddr_ll mysocket,to,from;
int fromlen;
struct tcphdr *tcp;
int sockd, i,n,sd,on = 1;
unsigned char rbuf[1500];
char errbuf[PCAP_ERRBUF_SIZE];
pcap_t* descr;
const u_char *packet;
struct pcap_pkthdr hdr; /* pcap.h */
struct ether_header *eptr; /* net/ethernet.h */
u_char *ptr; /* printing out hardware header info */
struct iphdr *ip;
struct ifreq ifr;

descr = pcap_open_offline("/root/s1.trace",errbuf);
if(descr == NULL)
{
printf("pcap_open_offline(): %s\n",errbuf);
exit(1);
}
packet = pcap_next(descr,&hdr);
if(packet == NULL)
{
printf("Didn't grab packet\n");
exit(1);
}
if((sockd = socket(PF_PACKET,SOCK_RAW,PROTO)) < 0)
{
perror("socket");
exit(1);
}

strncpy(ifr.ifr_name, "lo", sizeof(ifr.ifr_name));
if (ioctl(sockd, SIOCGIFINDEX, &ifr) == -1)
{

fprintf(stderr, "SIOCGIFINDEX on %s failed: %s\n",
"lo",strerror(errno));
printf("my error\n");
return 1;
}
memset(&mysocket,'\0',sizeof(mysocket));
mysocket.sll_family = AF_PACKET;
mysocket.sll_protocol =htons(ETH_P_ALL);
mysocket.sll_ifindex = ifr.ifr_ifindex;

if (bind(sockd,(struct sockaddr *)&mysocket, sizeof(mysocket)) <0)
{
perror("Bind");
exit(1);
}
printf("Bind succecced \n");

memset(&to , 0,sizeof(to));
to.sll_family = AF_PACKET;
to.sll_protocol =htons(ETH_P_ALL);
to.sll_ifindex = ifr.ifr_ifindex;
to.sll_halen = ETH_ALEN;
memcpy(to.sll_addr,packet,ETH_ALEN);


ip = (struct iphdr *) packet;
printf("Id1 %d\n",ip->ttl);
ip->id=htons(getuid());
printf("ID2 %d\n",(ip->id));
n = sendto(sockd,packet,74,0x0,(struct sockaddr *)&to,sizeof(to));
if(n < 0)
{
perror("sendto");
exit(1);
}
else printf("Packet send %d bytes \n",n);


printf("Now recev\n");
bzero(rbuf,sizeof(rbuf));
fromlen = sizeof(from);
n = recvfrom(sockd,rbuf,sizeof(rbuf),0,(struct sockaddr
*)&from,&fromlen);

if(n < 0) printf("ERROR\n");
else printf("RECEived %dbytes\n",n);

printf("Souce %04d and destn port %04d\n", ntohs(tcp->source),
ntohs(tcp->dest));

exit(0);
}