Question

I’m tring to experiment with the ICMP protocol and have created a kernel-module for linux that analyses ICMP packet ( Processes the packet only if if the ICMP code field is a magic number ) . Now to test this module , i have to create a an ICMP packet and send it to the host where this analysing module is running . In fact it would be nice if i could implement it the kernel itself (as a module ) . I am looking for something like a packetcrafter in kernel , I googled it found a lot of articles explaining the lifetime of a packet , rather than tutorials of creating it . User space packetcrafters would be my last resort, that too those which are highly flexible like where i’ll be able to set ICMP code etc . And I’m not wary of kernel panics 🙂 !!!!! Any packet crafting ideas are welcome .

Answer 1

Sir, I strongly advice you against using the kernel module to build ICMP packets.

You can use user-space raw-sockets to craft ICMP packets, even build the IP-header itself byte by byte.
So you can get as flexible as it can get using that.

Please, take a look at this

ip = (struct iphdr*) packet;
    icmp = (struct icmphdr*) (packet + sizeof(struct iphdr));

    /*  
     *  here the ip packet is set up except checksum
     */
    ip->ihl         = 5;
    ip->version         = 4;
    ip->tos         = 0;
    ip->tot_len         = sizeof(struct iphdr) + sizeof(struct icmphdr);
    ip->id          = htons(random());
    ip->ttl         = 255;
    ip->protocol        = IPPROTO_ICMP;
    ip->saddr           = inet_addr(src_addr);
    ip->daddr           = inet_addr(dst_addr);


    if ((sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP)) == -1)
    {
    perror("socket");
    exit(EXIT_FAILURE);
    }

    /* 
     *  IP_HDRINCL must be set on the socket so that
     *  the kernel does not attempt to automatically add
     *  a default ip header to the packet
     */

    setsockopt(sockfd, IPPROTO_IP, IP_HDRINCL, &optval, sizeof(int));

    /*
     *  here the icmp packet is created
     *  also the ip checksum is generated
     */
    icmp->type          = ICMP_ECHO;
    icmp->code          = 0;
    icmp->un.echo.id        = 0;
    icmp->un.echo.sequence  = 0;
    icmp->checksum      = 0;
    icmp-> checksum     = in_cksum((unsigned short *)icmp, sizeof(struct icmphdr));

    ip->check           = in_cksum((unsigned short *)ip, sizeof(struct iphdr));

If this part of code looks flexible enough, then read about raw sockets 😀 maybe they’re the easiest and safest answer to your need.

Please check the following links for further info
http://courses.cs.vt.edu/~cs4254/fall04/slides/raw_6.pdf
http://www.cs.binghamton.edu/~steflik/cs455/rawip.txt
http://cboard.cprogramming.com/networking-device-communication/107801-linux-raw-socket-programming.html a very nice topic, pretty useful imo