search

JulianSchmid / etherparse

A rust library for parsing ethernet & ethernet using protocols.
Apache License 2.0
286 stars 54 forks source link

Modifying existing ip packets #29

Open shriphani opened 2 years ago

shriphani commented 2 years ago

Thank you very much for your work on this awesome library.

I need to alter a packet that I am able to parse (using SlicedPacket::from_ip). Specifically, I need to be able to (i) alter the source IP, (ii) alter the source port, (iii) recompute the checksum and obtain a valid packet.

I can see some references to PacketBuilder, update_checksum_ipv4 and so on but I am curious what is the recommended (and most convenient) way to do this.

Warmest regards, Shriphani

JulianSchmid commented 2 years ago

Hi @shriphani ,

Currently the library does not support an efficient way of changing data and re-calculating checksums.

Probably the easiest way is to decode the headers via PacketHeaders::from_ethernet_slice or PacketHeaders::from_ip_slice modify the decoded data and then updating the checksums via update checksum methods in the ip & transport headers (e.g. Ipv4Header::calc_header_checksum, TransportHeader::update_checksum_ipv4 TransportHeader::update_checksum_ipv6. Finally you will have to write the headers one-by-one.

I will see if I can add methods to simplify the checksum updating & writing in the future. But currently other features have a higher priority (or have been waiting for a longer time).

Greets Julian

robs-zeynet commented 1 year ago

@JulianSchmid - this is related to the issue I was looking at. One thing that occurred to me was adding PacketBuilder::From<SlidedPacket> and PacketBuilder::From<ParsedHeaders> methods. It's more computationally expensive than just "change the IPs and recalculate the checksums" but is probably more general as well. Thoughts?