Modify packets using netfilter

Modify packets using netfilter

[Jee J.Z.]

Hi all,

I am wondering whether we can modify one or more bits in a packet using netfilter? Could anybody help? Thanks in advance!

Regards,
Jee

Re: Modify packets using netfilter

[Antony Stone]

On Saturday 13 December 2003 3:44 pm, Jee J.Z. wrote:

> Hi all,
>
> I am wondering whether we can modify one or more bits in a packet using
> netfilter? Could anybody help? Thanks in advance!

Which bits?

The mangle tables can do some, but not many.   Writing your own target to 
fiddle with other bits shouldn't be hard.

Antony.

-- 
G- GIT/E d- s+:--(-) a+ C++++$ UL++++$ P+(---)>++ L+++(++++)$ !E W(-) N(-) o? 
w-- O !M V+++(--) !PS !PE Y+ PGP+> t- tv@ b+++ DI++ D--- e++>+++ h++ r@? 5? 
!X- !R K--?

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Modify packets using netfilter

[Jee J.Z.]

Hi Antony and all,

Thanks for your reply. What I am trying to do is to get the whole packets including their payloads and store them into a self defined queue, and randomly modify some bits in each packet. I am using iptables userspace programming. Does anybody have some good idea how to achieve this? Thank you.

Regards,
Jee

Re: Modify packets using netfilter

[Antony Stone]

On Saturday 13 December 2003 4:45 pm, Jee J.Z. wrote:

> Hi Antony and all,
>
> Thanks for your reply. What I am trying to do is to get the whole packets
> including their payloads and store them into a self defined queue, and
> randomly modify some bits in each packet. I am using iptables userspace
> programming. Does anybody have some good idea how to achieve this? Thank
> you.

I am fascinated at the use of the word "randomly" in the above description.   
However, maybe someone here with more experience of netfilter programming 
than I have can help with your request.

Antony.

-- 
All matter in the Universe can be placed into one of two categories:

1. Things which need to be fixed.
2. Things which need to be fixed once you've had a few minutes to play with 
them.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Modify packets using netfilter

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 796 bytes --]

Le sam 13/12/2003 à 17:45, Jee J.Z. a écrit :
> Hi Antony and all,
> 
> Thanks for your reply. What I am trying to do is to get the whole packets including their payloads and store them into a self defined queue, and randomly modify some bits in each packet. 
> I am using iptables userspace programming. Does anybody have some good idea how to achieve this? Thank you.

with libipq you can modify the payload of the packet :

Take from man page :
int ipq_set_verdict(const struct ipq_handle *h, ipq_id_t  id,  unsigned
       int verdict, size_t data_len, unsigned char *buf);

if data_len is not 0 and buf is not NULL, the header and payload of the
packet get replaced by the datas pointed by buf.

BR,
-- 
Eric Leblond
Nufw, Now User Filtering Works (http://www.nufw.org)

[-- Attachment #2: Ceci est une partie de message numériquement signée. --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Modify packets using netfilter

[Jee J.Z.]

Hi Eric and all,

Thank you again. I have a few further questions:
1. How many packets can ip_queue queue for userspace? How can we change the
size of QUEUE?
2. Can we use ipq_read() and ipq_set_verdict() to access and process queued
packets in any order?
    More specifically, for example, I wish to ipq_read() a number of packets
from QUEUE before ipq_set_verdict() any of them, and then ipq_set_verdict()
in whichever order I want. It is possible?

Cheers,
Jee


----- Original Message ----- 
From: "Eric Leblond" <eric@regit.org>
To: "Jee J.Z." <jz105@york.ac.uk>
Cc: <netfilter@lists.netfilter.org>
Sent: Saturday, December 13, 2003 8:21 PM
Subject: Re: Modify packets using netfilter

Le sam 13/12/2003 à 17:45, Jee J.Z. a écrit :
> Hi Antony and all,
>
> Thanks for your reply. What I am trying to do is to get the whole packets
including their payloads and store them into a self defined queue, and
randomly modify some bits in each packet.
> I am using iptables userspace programming. Does anybody have some good
idea how to achieve this? Thank you.

with libipq you can modify the payload of the packet :

Take from man page :
int ipq_set_verdict(const struct ipq_handle *h, ipq_id_t  id,  unsigned
       int verdict, size_t data_len, unsigned char *buf);

if data_len is not 0 and buf is not NULL, the header and payload of the
packet get replaced by the datas pointed by buf.

BR,
-- 
Eric Leblond
Nufw, Now User Filtering Works (http://www.nufw.org)

Re: Modify packets using netfilter

[Josh Berry]

Snort-Inline is able to do this: http://snort-inline.sourceforge.net.  You
can have it modify (it calls it replacing) packets.  The main caveat to
this is that you have to replace data with the same amount of data
example:

Replacing the string "hacker" with "hack" would not work.

> Hi Antony and all,
>
> Thanks for your reply. What I am trying to do is to get the whole packets
> including their payloads and store them into a self defined queue, and
> randomly modify some bits in each packet. I am using iptables userspace
> programming. Does anybody have some good idea how to achieve this? Thank
> you.
>
> Regards,
> Jee


Thanks,
Josh Berry, CTO
LinkNet-Solutions
469-831-8543
josh.berry@linknet-solutions.com