[Solved] Q: How to use a raw socket to send hand crafted...

[therealjrd]

This is likely not really a gentoo issue, but y'all have been so helpful with other questions I've had, I bet somebody here will have useful ideas.

I have a wierd use case for which I'm trying to write a little software widget. I have some devices on my network which ignore DHCP's handed out DNS server address, and just go straight to google. The names they need to resolve are internal only, google won't resolve them. I hacked my firewall such that if it sees DNS traffic from those devices to google, those packets get redirected to my internal server. That works for some of them, but some reject the reply, because it comes from an internal server, not 8.8.8.8. So to handle those, I've written a little thing which receives the DNS traffic, rewrites the sender address to be itself, forwards it to my internal DNS, captures the reply, rewrites that sender address to make it look like it came from google, and sends it back to the device. That's the background to this little saga.

The problem I have is that when my widget sends its rewritten packet to my DNS server, nothing happens. Wireshark reveals that the packet arrives. It appears to have all the right values, including the IP and UDP headers. I'm setting the checksums. The widget uses a (PF_INET, SOCK_RAW, IPPROTO_UDP) socket for both sending and receiving. I'm setting sockopt IP_HDRINCL to 1. I've tried powerdns and dnsmasq on the receiving end, on the off chance that something in the app layer is silently throwing input on the floor, but neither one sees anything incoming. It's acting like something in the network stack is disliking something about my packet, and refusing to deliver it.

Granted this is a somewhat twisted solution. I thought it would be a quick hack, but I've spent a day on it, and I'm still missing something. I'd be happy to hear about a better overall solution for my use case, but I'd also like to understand why my little hack isn't working.

Thanks in advance for any hints.

[mike155]

Try to find out where your UDP packets get lost. A good point to start is

[therealjrd]

[Hu]

There may be an easier solution. A Linux firewall can not only filter traffic, it can also rewrite the headers. A common use case for home users is to have the firewall NAT outbound traffic so that it appears to come from their single public IP, rather than the private range IP assigned to the individual hosts on the LAN. Netfilter can also change the destination address, so that traffic originally destined for that public IP is instead further routed to a specific internal host. Your use case is a bit backward of that, but the principals should hold. I think you could use the firewall to DNAT traffic that was destined for Google to instead go to your internal host, then SNAT the responses to claim to be from Google. If you do this, and it works, then the Linux kernel would handle the details around checksums.

Or you could raise a support case with the vendor who sold you garbage that doesn't understand DHCP properly. If they can't even get that right, I wouldn't be surprised if they managed to include at least a few security vulnerabilities too.

[pietinger]

[mike155]

[therealjrd]