September 2004 - Darwin-kernel

Re: dlil_inject_if_input
by Matt Jaffa 19 Sep '04

19 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com char * httpresponse = (*)_MALLOC(0000,0000,FFFF">180,M_FREE,M_NOWAIT); sprintf(httpresponse,"HTTP/1.1 200 OK\r\nCache-Control: no-store, no-cache\r\nContent-Type: text/html\r\n\r\n <HTML><BODY>This is the block page</BODY></HTML>"); struct mbuf * testin; MGET(testin,M_NOWAIT,M_MBUF); struct ip newip;// = (struct ip*)_MALLOC(sizeof(struct ip),M_FREE,M_NOWAIT); u_char vhl = 0x45; memcpy(&newip, &vhl,1); newip.ip_hl = 5; printf("ipHeader version: %d\n", ipHeader->ip_v); printf("ipHeader hdrleng: %d\n", ipHeader->ip_hl); printf("newipheader: %d\n", newip.ip_v); printf("newipheader: %d\n", newip.ip_hl); newip.ip_v = ;2323,6E6E,2525">//ipHeader->ip_v; newip.ip_tos = ;2323,6E6E,2525">//ipHeader->ip_tos; int data_len = strlen(httpresponse); newip.ip_len = (7676,0F0F,5050">struct ip) + (7676,0F0F,5050">struct tcphdr) + data_len; newip.ip_id = 34234; newip.ip_off = 0x0000; newip.ip_ttl = 35; newip.ip_p = ipHeader->ip_p; newip.ip_sum = 0; memcpy(&(newip.ip_src), &(ipHeader->ip_dst), (7676,0F0F,5050">struct in_addr)); memcpy(&(newip.ip_dst), &(ipHeader->ip_src), (7676,0F0F,5050">struct in_addr)); struct tcphdr newtcp;// = (struct tcphdr*)_MALLOC(sizeof(struct tcphdr),M_FREE,M_NOWAIT); newtcp.th_sport = tester->th_dport; newtcp.th_dport = tester->th_sport; newtcp.th_ack = tester->th_seq; newtcp.th_seq = htons(tester->th_seq +1); newtcp.th_flags = (TH_ACK|TH_FIN|TH_PUSH); newtcp.th_off = (7676,0F0F,5050">struct tcphdr); newtcp.th_x2 = 0; newtcp.th_win = 65535; newtcp.th_sum = 0; newtcp.th_urp = 0; testin->m_data += 20; memcpy(testin->m_data,&newip,(7676,0F0F,5050">struct ip)); testin->m_len = (7676,0F0F,5050">struct ip); testin->m_pkthdr.len = (7676,0F0F,5050">struct ip); testin->m_data += (7676,0F0F,5050">struct ip); memcpy(testin->m_data,&newtcp,(7676,0F0F,5050">struct tcphdr)); testin->m_data += (7676,0F0F,5050">struct tcphdr); memcpy(testin->m_data,httpresponse,data_len); testin->m_len = ((7676,0F0F,5050">struct ip) + (7676,0F0F,5050">struct tcphdr) + data_len); testin->m_pkthdr.len = ((7676,0F0F,5050">struct ip) + (7676,0F0F,5050">struct tcphdr) + data_len); testin->m_data -= ((7676,0F0F,5050">struct ip) + (7676,0F0F,5050">struct tcphdr)); unsigned char * test = mtod(testin, unsigned char*); int i = 0; while(i < testin->m_pkthdr.len) { printf("%x ",test[i]); i++; } printf("\n"); int testing = dlil_inject_if_input(testin,frame_type,ipv4ID); printf("Here is the result: %d\n", testing);

1 0

Re: dlil_inject_if_input
by Justin Walker 18 Sep '04

18 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 18, 2004, at 16:05, Adrian Bool wrote: Keep in mind that _IP_VHL *is* defined when it is used in the kernel. struct xx { unsigned int xa:4; unsigned int xb:4; char xc; }; struct xx XX; main() { XX.xa = 4; XX.xb = 5; XX.xc = 255; printf("%x\n",*(int *)&XX); } PPC: 45ff0000 x86: ff54 Cheers, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | When LuteFisk is outlawed | Only outlaws will have | LuteFisk *--------------------------------------*-------------------------------* _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On 18 Sep 2004, at 06:55, Matt Jaffa wrote: despite the fact that some of the other stuff might be wrong, why wouldn't the ip_v be the right version? The output does print out 4 like it should be. I had a look at /usr/include/netinit.h for the definition of struct ip, struct ip { #ifdef _IP_VHL u_char ip_vhl; /* version << 4 | header length >> 2 */ #else #if BYTE_ORDER == LITTLE_ENDIAN u_int ip_hl:4, /* header length */ ip_v:4; /* version */ #endif #if BYTE_ORDER == BIG_ENDIAN u_int ip_v:4, /* version */ ip_hl:4; /* header length */ #endif I am confused now, as I thought that ENDIANness was the ordering of bytes. I that were the case then there would be no need to change round the nibbles depending upon the ENDIANness of the local machine. Try something like this on big-endian (PPC) and little-endian (x86) machines: The bit-ordering is the same, but the layout of bit-fields within a "storage unit" follows the layout in the source...(it makes sense, really). That's why the endianness distinction is made when using bitfields. You want the 'first' byte to show '45' in both orientations (my code doesn't distinguish, hence one is the reverse of the other). This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Adrian Bool 18 Sep '04

18 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com I had a look at /usr/include/netinit.h for the definition of struct ip, Matt, an interesting test would be to do, newip->ip_hl = 4; /* IP version 4 */ newip->ip_v = 5; /* header length of 5 */ ie. just reverse them. Can anybody spread any light on this? Thanks aid _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On 18 Sep 2004, at 06:55, Matt Jaffa wrote: despite the fact that some of the other stuff might be wrong, why wouldn't the ip_v be the right version? The output does print out 4 like it should be. struct ip { #ifdef _IP_VHL u_char ip_vhl; /* version << 4 | header length >> 2 */ #else #if BYTE_ORDER == LITTLE_ENDIAN u_int ip_hl:4, /* header length */ ip_v:4; /* version */ #endif #if BYTE_ORDER == BIG_ENDIAN u_int ip_v:4, /* version */ ip_hl:4; /* header length */ #endif I am confused now, as I thought that ENDIANness was the ordering of bytes. I that were the case then there would be no need to change round the nibbles depending upon the ENDIANness of the local machine. I realise that bits can be stored either most significant bit first or least significant bit first. However if the bits in the bytes were flipped when accessing a normal byte (ie. a char) then one could read 97 (1100001) when 67 (1000011) was transmitted - which is obviously not the case. I presume the NIC is swapping the bits in the bytes before the byte hits the CPU / RAM. It feels to me like the above is compensating for something that has already been compensated. This email sent to site_archiver(a)lists.apple.com

1 0

handling the stack?
by Mauricio David Cerda Villablanca 18 Sep '04

18 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, my first post here, soo, if this is not the appropiate list sorry, just tell me I will move the question to the rigth mail list :) thanks for any help! ah!!!!, here is the assembler code for sparc and x86 http://www.dcc.uchile.cl/~mcerda/sparc.txt http://www.dcc.uchile.cl/~mcerda/x86.txt Mauricio Cerda V. mcerda(a)dcc.uchile.cl -------------------- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… here is the deal, I'm a computer science student, and use a small toy operatin system (to test different proccess estragies, like monitors, signal, some OS thread strategies, etc, etc), well, it's small and just for education purpose (very cool by the way), it's name, Nano System. (http://www.dcc.uchile.cl/~lmateu/CC41B/download/nSystem2001.tgz) Ok here comes the problem, it's a very low level program, soo, a small part is writted directly in assembler, and has versions for Solaris (sparc) and Linux (x86). This assebler code is the only part that is no ANSI C, and it's for handling the memory stack, my idea is to port this assembler part into Mac OS X :) .... Where in darwin can I see the code for the memory stack handling?, there is some library, or file where i can find the assembler code, for something like that (handle memory stack), for adapt a version using the PPC processor registers, and any hardware specific code?, I guest just need a simplify version, but the mac os x version should be similar to the code i'm looking for... This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Justin Walker 18 Sep '04

18 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 17, 2004, at 21:55, Matt Jaffa wrote: Here is how I am formulating my IP header: newip->ip_hl = 5; newip->ip_v = ipHeader->ip_v; printf("ipHeader version: %d\n", ipHeader->ip_v); printf("ipHeader hdrleng: %d\n", ipHeader->ip_hl); printf("newipheader: %d\n", newip->ip_v); printf("newipheader: %d\n", newip->ip_hl); BTW, I would set ip_off to zero. newip->ip_ttl = 35; newip->ip_p = ipHeader->ip_p; newip->ip_sum = 0; You compute the checksum later, right? Regards, Justin _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… ipHeader is the ip header pulled out from the mbuf that I am not letting out into the internet. struct ip* newip = (struct ip*)_MALLOC(sizeof(struct ip),M_FREE,M_NOWAIT); Why are you using _MALLOC instead of (say) MGET? You may be asking for trouble here, unless you are taking care of properly releasing this storage. Well, what do the printf's say? FWIW, the kernel code defines _IP_VHL, and refers to the two fields as the combined field 'ip_vhl'. Why not print a hex dump of the first few bytes of the two IP headers? That may provide a clue (and it avoids any funky behavior based on bit-field operations). newip->ip_tos = 0; int data_len = strlen(httpresponse); // this is the HTTP/1.1 response length of the tcp data I will inject into the input I assume the length of this canned response is small enough that you don't have to worry about overflowing whatever you are using for buffers. newip->ip_len = sizeof(struct ip) + sizeof(struct tcphdr) + data_len; newip->ip_id = 34234; newip->ip_off = 0x4000; memcpy(&(newip->ip_src), &(ipHeader->ip_dst), sizeof(struct in_addr)); memcpy(&(newip->ip_dst), &(ipHeader->ip_src), sizeof(struct in_addr)); For correctness, you might want to assure that the values you are copying are in network order (since the IP stack has set it up that way on output). For PowerPC, host order and network order are the same, but it pays to keep this straight in your code. despite the fact that some of the other stuff might be wrong, why wouldn't the ip_v be the right version? The output does print out 4 like it should be. Any number of things could be wrong. One obvious possibility is that when you finally cons up the frame you inject, you aren't matching the assumptions of the input processing, so that when that code looks looks at the IP header, it's not seeing your IP header (e.g., there should be an ethernet header, but isn't; or there is an ethernet header, but there should not be one). To emphasize a point above, do *not* allocate mbufs other than by MGET (or similar call) unless you are actually obeying all the rules for supplying your own buffers (and freeing same). -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | "Weaseling out of things is what | separates us from the animals. | Well, except the weasel." | - Homer J Simpson *--------------------------------------*-------------------------------* This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Matt Jaffa 18 Sep '04

18 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com struct ip* newip = (struct ip*)_MALLOC((7676,0F0F,5050">struct ip),M_FREE,M_NOWAIT); newip->ip_hl = 5; newip->ip_v = ipHeader->ip_v; printf("ipHeader version: %d\n", ipHeader->ip_v); printf("ipHeader hdrleng: %d\n", ipHeader->ip_hl); printf("newipheader: %d\n", newip->ip_v); printf("newipheader: %d\n", newip->ip_hl); newip->ip_tos = 0; int data_len = strlen(httpresponse); // this is the HTTP/1.1 response length of the tcp data I will inject into the input newip->ip_len = (7676,0F0F,5050">struct ip) + (7676,0F0F,5050">struct tcphdr) + data_len; newip->ip_id = 34234; newip->ip_off = 0x4000; newip->ip_ttl = 35; newip->ip_p = ipHeader->ip_p; newip->ip_sum = 0; memcpy(&(newip->ip_src), &(ipHeader->ip_dst), (7676,0F0F,5050">struct in_addr)); memcpy(&(newip->ip_dst), &(ipHeader->ip_src), (7676,0F0F,5050">struct in_addr));

1 0

Re: dlil_inject_if_input
by Justin Walker 18 Sep '04

18 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 17, 2004, at 18:40, Matt Jaffa wrote: Hi, Ha! Nothing like good stats to point the way. Cheers, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | If you're not confused, | You're not paying attention *--------------------------------------*-------------------------------* _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… It seems that when I do netstat -s, I am noticing that when I try to go to a blocked site and it trys to inject my packet it increments the bad version number in the ip section. But I am properly putting in the right version number in my tcp header. As Sherlock might say, "When you have eliminated the impossible, what remains is ...". I have to believe that you are not formatting your injected packet correctly. Perhaps if you logged the hex values of the IP header before injecting it, you could verify what is happening... Could having a bad version number for the ip header cause it to be discarded, and why is it not accepting the value, The point of the version number is to accomodate multiple versions of the IP header. If the system (stack) doesn't recognize the version, it can't decode the header, so it dumps it. One way I could see this happening is if it is incorrectly matching up the right bytes to my header. I think you should consider this as "you are incorrectly formatting the appropriate bytes of the header". I believe that you are better served by assuming that, when plugging your new code into code that has been working without a problem for a long time, the likelihood is that your code is in error. It's possible that there is a bug in the system, but that's not the way to bet. This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Matt Jaffa 18 Sep '04

18 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, Matt On Sep 17, 2004, at 5:40 PM, Justin Walker wrote: On Sep 17, 2004, at 16:22, Matt Jaffa wrote: On Sep 17, 2004, at 3:53 PM, Justin Walker wrote: Regards, Justin This email sent to matt(a)knowligent.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… It seems that when I do netstat -s, I am noticing that when I try to go to a blocked site and it trys to inject my packet it increments the bad version number in the ip section. But I am properly putting in the right version number in my tcp header. Could having a bad version number for the ip header cause it to be discarded, and why is it not accepting the value, One way I could see this happening is if it is incorrectly matching up the right bytes to my header. On Sep 17, 2004, at 13:32, Matthew Jaffa wrote: [snip] Now the problem is, is inserting my own HTTP/1.1 response into the input stream of the machine that made the request. [snip] I am doing the checksumming correct now for the ipheader and tcpheader, If you literally mean you checksummed the tcpheader, then you have a problem: the TCP checksum covers all the TCP data. I read on the internet that the TCP checksum is calculated with the tcphdr, pseudo header that has IP elements in it, and the TCP data. I threw all of the in a mbuf and then used in_cksum and it calculates it. Depending on where you inject your frames, you may be able to see the packet with tcpdump; have you tried that? Also, the pseudo header is kind of tricky, so you should look at code that computes it to be sure... -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | When LuteFisk is outlawed | Only outlaws will have | LuteFisk *-------------------------------------- *-------------------------------* _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/ matt%40knowligent.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Justin Walker 17 Sep '04

17 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 17, 2004, at 16:22, Matt Jaffa wrote: On Sep 17, 2004, at 3:53 PM, Justin Walker wrote: Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | When LuteFisk is outlawed | Only outlaws will have | LuteFisk *--------------------------------------*-------------------------------* _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Sep 17, 2004, at 13:32, Matthew Jaffa wrote: [snip] Now the problem is, is inserting my own HTTP/1.1 response into the input stream of the machine that made the request. [snip] I am doing the checksumming correct now for the ipheader and tcpheader, If you literally mean you checksummed the tcpheader, then you have a problem: the TCP checksum covers all the TCP data. I read on the internet that the TCP checksum is calculated with the tcphdr, pseudo header that has IP elements in it, and the TCP data. I threw all of the in a mbuf and then used in_cksum and it calculates it. Depending on where you inject your frames, you may be able to see the packet with tcpdump; have you tried that? Also, the pseudo header is kind of tricky, so you should look at code that computes it to be sure... This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Matt Jaffa 17 Sep '04

17 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 17, 2004, at 3:53 PM, Justin Walker wrote: On Sep 17, 2004, at 13:32, Matthew Jaffa wrote: Yeah. Cheers, Justin This email sent to matt(a)knowligent.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I have interecepted an outgoing HTTP request using a dlil interface filter. I return EJUSTRETURN in the dlil_if_output function to let it know to not let this packet go out, but to still think it sent it out. The connection has been successfully set up with a SYN/SYN-ACK/ACK exchange, correct? Now the problem is, is inserting my own HTTP/1.1 response into the input stream of the machine that made the request. [snip] I am doing the checksumming correct now for the ipheader and tcpheader, If you literally mean you checksummed the tcpheader, then you have a problem: the TCP checksum covers all the TCP data. I read on the internet that the TCP checksum is calculated with the tcphdr, pseudo header that has IP elements in it, and the TCP data. I threw all of the in a mbuf and then used in_cksum and it calculates it. but still no results. When I call dlil_inject_if_input am I supposed to have a ethernet header on the mbuf I am injecting??? That might be the problem, but don't know. One way to determine what the IP stack is seeing is to review the IP statistics before and after trying out a connection that should be blocked (see, e.g., the lines "discarded for bad checksums", "bad header checksums"; there are other counters that might shed light as well. This is seen with "netstat -s"). Wow never knew the -s option to this tool provided this great information, thanks. It will help if your test network is lightly loaded so you can more easily isolate the counters that are changing due to problems in your implementation. Also, check to see whether you see any RST packets being generated or received by your stack (apropos of Josh's comments). -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | It's not whether you win or lose... | It's whether *I* win or lose. *-------------------------------------- *-------------------------------* _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/ matt%40knowligent.com This email sent to site_archiver(a)lists.apple.com

1 0