mfontanini / libtins

High-level, multiplatform C++ network packet sniffing and crafting library.
http://libtins.github.io/
BSD 2-Clause "Simplified" License
1.89k stars 374 forks source link

arpspoofing example has weird results on macOS #172

Open wputnam opened 7 years ago

wputnam commented 7 years ago

I'm on an iMac with macOS Sierra 10.12 (16A323) and Xcode 8.0 (8A218a) with command-line tools. I cloned the libtins project onto my machine and built it, the examples, and the tests as per the installation instructions without issue. Also ran multiple tests, including ArpTest, under the tests directory and returned no errors.

The arpspoofing example on my machine would always throw a "Runtime error: Could not resolve hardware address" (even under sudo) when trying to resolve the hardware for the gateway address. I dug into the source code and tried applying the functions from Utils::resolve_hwaddr(const NetworkInterface& iface, IPv4Address ip, PacketSender& sender)directly into this function, like so:

// Resolves gateway's hardware address.
//gw_hw = Utils::resolve_hwaddr(iface, gw, sender);
EthernetII packet = ARP::make_arp_request(gw, info.ip_addr, info.hw_addr);
Internals::smart_ptr<PDU>::type response(sender.send_recv(packet, iface));
if (response.get()) {
    const ARP* arp_resp = response->find_pdu<ARP>();
    if (arp_resp) { gw_hw = arp_resp->sender_hw_addr(); }
    else throw ("Error");
}

and compiled the examples with

g++ fixedarpspoofer.cpp -o fixedarpspoofer -O3 -std=c++11 -lpthread -ltins

This fixes the issue, and the code runs as intended. There may be something going on involving the code layout for that function, as I know that there's an #if/#endif declaration mixed in there.

mfontanini commented 7 years ago

I think this is mostly some timing issue. The code is exactly the same so there should be no difference. I actually tried this and it works 95% of the time for me, then on some cases I see the packet being sent and the response coming back but for some reason it doesn't capture it.