セキュリティ・キャンプ事前課題2

byte_order.md

Byte-order

複数バイトを並べる時の順序がプロセッサによって違う。

Little Endian(host-byte-order)

• LeastSignficantByteから低いアドレスに保存
• Intel系プロセッサー(x86)、DECのAlpha
• 利点: どの長さでメモリから値を取得しても読み始めるアドレスを変えなくてよい

Big Endian(network-byte-order)

• MostSignficantByteから低いアドレスに保存
• ネットワークでの送受信はこちらで統一。Motorola系プロセッサー(MC680x0)、ルネサスのSuperH、SunのSPARC
• 利点: 直感的に読める

Conversion in C

• ntohs: network-to-host short
• ntohl: network-to-host long
• htons: host-to-network short
• htonl: host-to-network long

main.c

#include <stdio.h>
#include <stdint.h>
#include <arpa/inet.h>

static const unsigned char pkt131[66] = {
  0x00, 0xe0, 0x4d, 0x10, 0x15, 0x0c, 0x00, 0x23,
  0xdf, 0xff, 0xa8, 0xa7, 0x08, 0x00, 0x45, 0x00,
  0x00, 0x34, 0x8c, 0x98, 0x40, 0x00, 0x40, 0x06,
  0x00, 0x00, 0xc0, 0xa8, 0x00, 0x84, 0xc0, 0xe5,
  0xed, 0x60, 0xe2, 0xea, 0x01, 0xbb, 0x70, 0x27,
  0x09, 0x7d, 0x05, 0x77, 0x78, 0x12, 0x80, 0x10,
  0x0f, 0x7d, 0x6f, 0x99, 0x00, 0x00, 0x01, 0x01,
  0x08, 0x0a, 0x3e, 0xc9, 0x69, 0xdf, 0x6d, 0xe7,
  0x40, 0x35
};

enum eth_type {
  eth_ipv4 = 0x0800,
  eth_arp  = 0x0806,
  eth_ipv6 = 0x86dd,
};

struct eth_hdr {
  uint8_t  dst[6];
  uint8_t  src[6];
  uint16_t type;
} __attribute__((__packed__));

enum ip_proto {
  ipproto_icmp = 1,
  ipproto_tcp  = 6,
  ipproto_udp  = 17,
};

struct ip4_hdr {
  uint8_t  version_ihl;
  uint8_t  tos;
  uint16_t totlen;
  uint16_t id;
  uint16_t flag_off;
  uint8_t  ttl;
  uint8_t  proto;
  uint16_t checksum;
  uint8_t  src[4];
  uint8_t  dst[4];
} __attribute__((__packed__));

int main()
{
  struct eth_hdr * a;
  a = (struct eth_hdr *)(pkt131);
  printf("---ETHERNET HEADER---\nDestination Address - ");
  for(int i=0;i<6;i++){
    printf(i!=5 ? "%02x:" : "%02x", a->dst[i]);
  }
  printf("\nSource Address - ");
  for(int i=0;i<6;i++){
    printf(i!=5 ? "%02x:" : "%02x", a->src[i]);
  }
  printf("\nType - ");
  switch(ntohs(a->type)){
    case eth_ipv4: printf("IPv4");break;
    case eth_arp: printf("ARP");break;
    case eth_ipv6: printf("IPv6");break;
    default: printf("unknown");break;
  }
  //printf("\n**DEBUG:%04x\n", a->type);

  struct ip4_hdr * b;
  b = (struct ip4_hdr *)(pkt131 + sizeof(struct eth_hdr));
  printf("\n---NETWORK HEADER---\n");
  printf("Version - %02x\n", b->version_ihl);
  printf("TypeOfService - %02x\n", b->tos);
  printf("TotalLength - %04x\n", ntohs(b->totlen));
  printf("Identification - %04x\n", ntohs(b->id));
  printf("Flag - %04x\n", ntohs(b->flag_off));
  printf("TimeToLive - %02x\n", b->ttl);
  printf("Protocol - ");
  switch(b->proto){
    case ipproto_icmp: printf("ICMP");break;
    case ipproto_tcp: printf("TCP");break;
    case ipproto_udp: printf("UDP");break;
    default: printf("unknown");break;
  }
  //printf("\n**DEBUG:%02x\n", b->proto);
  printf("Checksum - %04x\n", ntohs(b->checksum));
  printf("Source - ");
  for(int i=0;i<4;i++){
    printf(i!=3 ? "%03d." : "%03d", b->src[i]);
  }
  printf("\nDestination - ");
  for(int i=0;i<4;i++){
    printf(i!=3 ? "%03d." : "%03d", b->dst[i]);
  }
  printf("\n");

  return 0;
}

output

---ETHERNET HEADER---
Destination Address - 00:e0:4d:10:15:0c
Source Address - 00:23:df:ff:a8:a7
Type - IPv4
---NETWORK HEADER---
Version - 45
TypeOfService - 00
TotalLength - 0034
Identification - 8c98
Flag - 4000
TimeToLive - 40
Protocol - TCPChecksum - 0000
Source - 192.168.000.132
Destination - 192.229.237.096