黑客之旅――原始套接字（Raw Socket）透析(3)－－用Raw Socket实现Ping

/article/4307836.html

3.用Raw Socket实现Ping

极其常用的Ping命令通过向计算机发送ICMP Echo请求报文并且监听回应报文的返回，以校验与远程计算机或本地计算机的连接。

3.1 使用ICMP.DLL实现Ping

在Windows平台编程中实现Ping的一个最简单方法是调用ICMP.DLL这个动态链接库，引用ICMP.DLL中的三个函数即可：

HANDLE IcmpCreateFile(void);

这个函数打开个ICMP Echo请求能使用的句柄；

BOOL IcmpCloseHandle(HANDLE IcmpHandle);

这个函数关闭由IcmpCreateFile打开的句柄；

DWORD IcmpSendEcho(

HANDLE IcmpHandle, // IcmpCreateFile打开的句柄

IPAddr DestinationAddress, //Echo请求的目的地址

LPVOID RequestData, //发送数据buffer

WORD RequestSize, //发送数据长度

PIP_OPTION_INFORMATION RequestOptions, // IP_OPTION_INFORMATION指针

LPVOID ReplyBuffer, //接收回复buffer

DWORD ReplySize, //接收回复buffer大小

DWORD Timeout //等待超时

);

这个函数发送Echo请求并等待回复或超时。

把这个函数和相关数据封装成一个类CPing，CPing类的头文件如下：

class CPing

{

public:

CPing();

~CPing();

BOOL Ping(char* strHost);

private:

// ICMP.DLL 导出函数指针

HANDLE (WINAPI *pIcmpCreateFile)(VOID);

BOOL (WINAPI *pIcmpCloseHandle)(HANDLE);

DWORD (WINAPI *pIcmpSendEcho)

(HANDLE,DWORD,LPVOID,WORD,PIPINFO,LPVOID,DWORD,DWORD);

HANDLE hndlIcmp; // 加载ICMP.DLL库句柄

BOOL bValid; //是否构造（获得ICMP.DLL导出函数指针和初始化WinSock）成功

};

CPing类的构造函数获得ICMP.DLL中导出函数的指针并初始化WinSock：

CPing::CPing()

{

bValid = FALSE;

WSADATA wsaData;

int nRet;

// 动态加载ICMP.DLL

hndlIcmp = LoadLibrary("ICMP.DLL");

if (hndlIcmp == NULL)

{

::MessageBox(NULL, "Could not load ICMP.DLL", "Error:", MB_OK);

return;

}

// 获得ICMP.DLL中导出函数指针

pIcmpCreateFile = (HANDLE (WINAPI *)(void))

GetProcAddress((HMODULE)hndlIcmp,"IcmpCreateFile");

pIcmpCloseHandle = (BOOL (WINAPI *)(HANDLE))

GetProcAddress((HMODULE)hndlIcmp,"IcmpCloseHandle");

pIcmpSendEcho = (DWORD (WINAPI *)

(HANDLE,DWORD,LPVOID,WORD,PIPINFO,LPVOID,DWORD,DWORD))

GetProcAddress((HMODULE)hndlIcmp,"IcmpSendEcho");

// 检查所有的指针

if (pIcmpCreateFile == NULL ||

pIcmpCloseHandle == NULL ||

pIcmpSendEcho == NULL)

{

::MessageBox(NULL, "Error loading ICMP.DLL", "Error:", MB_OK);

FreeLibrary((HMODULE)hndlIcmp);

return;

}

// 初始化WinSock

nRet = WSAStartup(0x0101, &wsaData );

if (nRet)

{

::MessageBox(NULL, "WSAStartup() error:", "Error:", MB_OK);

WSACleanup();

FreeLibrary((HMODULE)hndlIcmp);

return;

}

// 检查WinSock的版本

if (0x0101 != wsaData.wVersion)

{

::MessageBox(NULL, "No WinSock version 1.1 support found", "Error:", MB_OK);

WSACleanup();

FreeLibrary((HMODULE)hndlIcmp);

return;

}

bValid = TRUE;

}

CPing类的析构函数完成相反的动作：

CPing::~CPing()

{

WSACleanup();

FreeLibrary((HMODULE)hndlIcmp);

}

CPing类的Ping函数是最核心的函数，实现真正的ping操作：

int CPing::Ping(char *strHost)

{

struct in_addr iaDest; // Internet地址结构体

LPHOSTENT pHost; // 主机入口结构体指针

DWORD *dwAddress; // IP地址

IPINFO ipInfo; // IP选项结构体

ICMPECHO icmpEcho; // ICMP Echo回复buffer

HANDLE hndlFile; // IcmpCreateFile函数打开的句柄

if (!bValid)

{

return FALSE;

}

//使用inet_addr()以判定ping目标为地址还是名称

iaDest.s_addr = inet_addr(strHost);

if (iaDest.s_addr == INADDR_NONE)

pHost = gethostbyname(strHost);

else

pHost = gethostbyaddr((const char*) &iaDest, sizeof(struct in_addr),

AF_INET);

if (pHost == NULL)

{

return FALSE;

}

// 拷贝IP地址

dwAddress = (DWORD*)(*pHost->h_addr_list);

// 获得ICMP Echo句柄

hndlFile = pIcmpCreateFile();

// 设置发送信息缺省值

ipInfo.Ttl = 255;

ipInfo.Tos = 0;

ipInfo.IPFlags = 0;

ipInfo.OptSize = 0;

ipInfo.Options = NULL;

icmpEcho.Status = 0;

// 请求一个ICMP echo

pIcmpSendEcho(hndlFile, *dwAddress, NULL, 0, &ipInfo, &icmpEcho, sizeof

(struct tagICMPECHO), 1000);

//设置结果

iaDest.s_addr = icmpEcho.Source;

if (icmpEcho.Status)

{

return FALSE;

}

// 关闭ICMP Echo句柄

pIcmpCloseHandle(hndlFile);

return TRUE;

}

其中所使用的相关结构体定义为：

typedef struct tagIPINFO

{

u_char Ttl; // TTL

u_char Tos; // 服务类型

u_char IPFlags; // IP标志

u_char OptSize; // 可选数据大小

u_char *Options; // 可选数据buffer

} IPINFO, *PIPINFO;

typedef struct tagICMPECHO

{

u_long Source; // 源地址

u_long Status; // IP状态

u_long RTTime; // RTT

u_short DataSize; // 回复数据大小

u_short Reserved; // 保留

void *pData; // 回复数据buffer

IPINFO ipInfo; // 回复IP选项

} ICMPECHO, *PICMPECHO;

3.2 使用Raw Socket实现Ping

仅仅采用ICMP.DLL并不能完全实现ICMP灵活多变的各类报文，只有使用Raw Socket才是ICMP的终极解决之道。

使用Raw Socket发送ICMP报文前，我们要完全依靠自己的代码组装报文：

//功能：初始化ICMP的报头, 给data部分填充数据, 计算校验和

void init_ping_packet(ICMPHeader *icmp_hdr, int packet_size, int seq_no)

{

//设置ICMP报头字段

icmp_hdr->type = ICMP_ECHO_REQUEST;

icmp_hdr->code = 0;

icmp_hdr->checksum = 0;

icmp_hdr->id = (unsigned short)GetCurrentProcessId();

icmp_hdr->seq = seq_no;

icmp_hdr->timestamp = GetTickCount();

// 填充data域

const unsigned long int deadmeat = 0xDEADBEEF;

char *datapart = (char*)icmp_hdr + sizeof(ICMPHeader);

int bytes_left = packet_size - sizeof(ICMPHeader);

while (bytes_left > 0)

{

memcpy(datapart, &deadmeat, min(int(sizeof(deadmeat)), bytes_left));

bytes_left -= sizeof(deadmeat);

datapart += sizeof(deadmeat);

}

// 计算校验和

icmp_hdr->checksum = ip_checksum((unsigned short*)icmp_hdr, packet_size);

}

计算校验和（Checksum）的函数为：

//功能：计算ICMP包的校验和

unsigned short ip_checksum(unsigned short *buffer, int size)

{

unsigned long cksum = 0;

// 将所有的16数相加

while (size > 1)

{

cksum += *buffer++;

size -= sizeof(unsigned short);

}

if (size) //加上最后一个BYTE

{

cksum += *(unsigned char*)buffer;

}

//和的前16位和后16位相加

cksum = (cksum >> 16) + (cksum &0xffff);

cksum += (cksum >> 16);

return (unsigned short)(~cksum);

}

在真正发送Ping报文前，需要先初始化Raw Socket：

// 功能：初始化RAW Socket, 设置ttl, 初始化目标地址

// 返回值：<0 失败

int setup_for_ping(char *host, int ttl, SOCKET &sd, sockaddr_in &dest)

{

// 创建原始套接字

sd = WSASocket(AF_INET, SOCK_RAW, IPPROTO_ICMP, 0, 0, 0);

if (sd == INVALID_SOCKET)

{

cerr << "Failed to create raw socket: " << WSAGetLastError() << endl;

return - 1;

}

if (setsockopt(sd, IPPROTO_IP, IP_TTL, (const char*) &ttl, sizeof(ttl)) ==

SOCKET_ERROR)

{

cerr << "TTL setsockopt failed: " << WSAGetLastError() << endl;

return - 1;

}

// 初始化目标主机信息块

memset(&dest, 0, sizeof(dest));

// 将第1个参数转换为目标IP地址

unsigned int addr = inet_addr(host);

if (addr != INADDR_NONE)

{

// 为IP地址

dest.sin_addr.s_addr = addr;

dest.sin_family = AF_INET;

}

else

{

// 非IP地址，进行主机名和IP地址的转换

hostent *hp = gethostbyname(host);

if (hp != 0)

{

// 查找主机名对应的IP地址

memcpy(&(dest.sin_addr), hp->h_addr, hp->h_length);

dest.sin_family = hp->h_addrtype;

}

else

{

// 不能识别的主机名

cerr << "Failed to resolve " << host << endl;

return - 1;

}

}

return 0;

}

下面可以利用Raw Socket发送生成的ICMP报文：

//功能：发送生成的ICMP包

//返回值：<0 发送失败

int send_ping(SOCKET sd, const sockaddr_in &dest, ICMPHeader *send_buf, int

packet_size)

{

// 发送send_buf缓冲区中的报文

cout << "Sending " << packet_size << " bytes to " << inet_ntoa(dest.sin_addr)

<< "..." << flush;

int bwrote = sendto(sd, (char*)send_buf, packet_size, 0, (sockaddr*) &dest,

sizeof(dest));

if (bwrote == SOCKET_ERROR)

{

cerr << "send failed: " << WSAGetLastError() << endl;

return - 1;

}

else if (bwrote < packet_size)

{

cout << "sent " << bwrote << " bytes..." << flush;

}

return 0;

}

发送Ping报文后，我们需要接收Ping回复ICMP报文：

//功能：接收Ping回复

//返回值： <0 接收失败

int recv_ping(SOCKET sd, sockaddr_in &source, IPHeader *recv_buf, int

packet_size)

{

// 等待Ping回复

int fromlen = sizeof(source);

int bread = recvfrom(sd, (char*)recv_buf, packet_size + sizeof(IPHeader), 0,

(sockaddr*) &source, &fromlen);

if (bread == SOCKET_ERROR)

{

cerr << "read failed: ";

if (WSAGetLastError() == WSAEMSGSIZE)

{

cerr << "buffer too small" << endl;

}

else

{

cerr << "error #" << WSAGetLastError() << endl;

}

return - 1;

}

return 0;

}

并使用如下函数对接收到的报文进行解析：

// 功能：解析接收到的ICMP报文

// 返回值： -2忽略, -1失败, 0 成功

int decode_reply(IPHeader *reply, int bytes, sockaddr_in *from)

{

// 偏移到ICMP报头

unsigned short header_len = reply->h_len *4;

ICMPHeader *icmphdr = (ICMPHeader*)((char*)reply + header_len);

// 报文太短

if (bytes < header_len + ICMP_MIN)

{

cerr << "too few bytes from " << inet_ntoa(from->sin_addr) << endl;

return - 1;

}

// 解析回复报文类型

else if (icmphdr->type != ICMP_ECHO_REPLY)

{

//非正常回复

if (icmphdr->type != ICMP_TTL_EXPIRE)

{

//ttl减为零

if (icmphdr->type == ICMP_DEST_UNREACH)

{

//主机不可达

cerr << "Destination unreachable" << endl;

}

else

{

//非法的ICMP包类型

cerr << "Unknown ICMP packet type " << int(icmphdr->type) <<

" received" << endl;

}

return - 1;

}

}

else if (icmphdr->id != (unsigned short)GetCurrentProcessId())

{

//不是本进程发的包, 可能是同机的其它ping进程发的

return - 2;

}

// 指出往返时间TTL

int nHops = int(256-reply->ttl);

if (nHops == 192)

{

// TTL came back 64, so ping was probably to a host on the

// LAN -- call it a single hop.

nHops = 1;

}

else if (nHops == 128)

{

// Probably localhost

nHops = 0;

}

// 输出信息

cout << endl << bytes << " bytes from " << inet_ntoa(from->sin_addr) <<

", icmp_seq " << icmphdr->seq << ", ";

if (icmphdr->type == ICMP_TTL_EXPIRE)

{

cout << "TTL expired." << endl;

}

else

{

cout << nHops << " hop" << (nHops == 1 ? "" : "s");

cout << ", time: " << (GetTickCount() - icmphdr->timestamp) << " ms." <<

endl;

}

return 0;

}

为了在Visual C++中更加方便地使用发送和接收ICMP报文，我们可以使用由Jay Wheeler编写的CIcmp（An ICMP Class For MFC）类，在著名的开发网站的如下地址可以下载：

http://www.codeguru.com/cpp/i-n/internet/network/article.php/c3395/

这个类的简要框架如下：

class CIcmp: public CSocket

{

// Attributes

public:

BOOL OpenNewSocket(HWND hWnd, unsigned int NotificationMessage, long

NotifyEvents);

BOOL OpenNewSocket(HWND hWnd, unsigned int NotificationMessage, long

NotifyEvents, int AFamily, int AType, int AProtocol);

int CloseIcmpSocket(void);

BOOL Connect(int ReceiveTimeout, int SendTimeout);

BOOL Connect(LPINT ReceiveTimeout, LPINT SendTimeout, int AFamily, int

AType, int AProtocol);

int SetTTL(int TTL);

int SetAsynchNotification(HWND hWnd, unsigned int Message, long Events);

int Receive(LPSTR pIcmpBuffer, int IcmpBufferSize);

unsigned long GetIPAddress(LPSTR iHostName);

int Ping(LPSTR pIcmpBuffer, int IcmpBufferSize);

unsigned short IcmpChecksum(unsigned short FAR *lpBuf, int Len);

void DisplayError(CString ErrorType, CString FunctionName);

// Operations

public:

CIcmp(void);

CIcmp(CIcmp ©);

~CIcmp(void);

public:

// I/O Buffer Pointers

LPIcmpHeader pIcmpHeader;

LPIpHeader pIpHeader;

SOCKET icmpSocket;

SOCKADDR_IN icmpSockAddr;

SOCKADDR_IN rcvSockAddr;

DWORD icmpRoundTripTime;

DWORD icmpPingSentAt;

DWORD icmpPingReceivedAt;

int icmpRcvLen;

int icmpHops;

int icmpMaxHops;

int icmpCurSeq;

int icmpCurId;

int icmpPingTimer;

int icmpSocketError;

int icmpSocketErrorMod;

unsigned long icmpHostAddress;

protected:

};

初始化网络连接的函数：

BOOL CIcmp::Connect(LPINT ReceiveTimeout, LPINT SendTimeout, int AFamily, int

AType, int AProtocol)

{

int Result;

icmpSocket = NULL;

icmpSocket = socket(AFamily, AType, AProtocol);

if (icmpSocket == INVALID_SOCKET)

{

icmpSocketError = WSAGetLastError();

icmpSocketErrorMod = 1;

return FALSE;

}

//

// Set receive timeout

//

Result = setsockopt(icmpSocket, SOL_SOCKET, SO_RCVTIMEO, (char*)

ReceiveTimeout, sizeof(int));

if (Result == SOCKET_ERROR)

{

icmpSocketError = WSAGetLastError();

icmpSocketErrorMod = 2;

closesocket(icmpSocket);

icmpSocket = INVALID_SOCKET;

return FALSE;

}

//

// Set send timeout

//

Result = setsockopt(icmpSocket, SOL_SOCKET, SO_SNDTIMEO, (char*)SendTimeout,

sizeof(int));

if (Result == SOCKET_ERROR)

{

icmpSocketError = WSAGetLastError();

icmpSocketErrorMod = 3;

closesocket(icmpSocket);

icmpSocket = INVALID_SOCKET;

return FALSE;

}

icmpCurSeq = 0;

icmpCurId = (USHORT)GetCurrentProcessId();

icmpHops = 0;

return TRUE;

}

接收的函数：

int CIcmp::Receive(LPSTR pIcmpBuffer, int IcmpBufferSize)

{

LPSOCKADDR pRcvSockAddr = (LPSOCKADDR)&rcvSockAddr;

int Result;

int RcvIpHdrLen;

icmpPingReceivedAt = GetTickCount();

icmpCurId = 0;

rcvSockAddr.sin_family = AF_INET;

rcvSockAddr.sin_addr.s_addr = INADDR_ANY;

rcvSockAddr.sin_port = 0;

RcvIpHdrLen = sizeof rcvSockAddr;

Result = recvfrom (icmpSocket,

pIcmpBuffer,

IcmpBufferSize,

0,

pRcvSockAddr,

&RcvIpHdrLen);

if (Result == SOCKET_ERROR)

{

icmpSocketError = WSAGetLastError();

icmpSocketErrorMod = 1;

DisplayError ("Receive","CIcmp::Receive");

return Result;

}

icmpRcvLen = Result;

pIpHeader = (LPIpHeader)pIcmpBuffer;

RcvIpHdrLen = pIpHeader->HeaderLength * 4;

if (Result < RcvIpHdrLen + ICMP_MIN)

{

//

// Too few bytes received

//

MessageBox(NULL,

"Short message!",

"CIcmp::Receive",

MB_OK|MB_SYSTEMMODAL);

icmpSocketErrorMod = 2;

return Result;

}

pIcmpHeader = (LPIcmpHeader)(pIcmpBuffer + RcvIpHdrLen);

icmpCurId = pIcmpHeader->IcmpId;

icmpRoundTripTime = icmpPingReceivedAt - pIcmpHeader->IcmpTimestamp;

if (pIcmpHeader->IcmpType != ICMP_ECHOREPLY)

{

//

// Not an echo response!

//

return Result;

}

icmpCurSeq = pIcmpHeader->IcmpSeq;

return Result;

}

异步通知主窗口：

int CIcmp::SetAsynchNotification(HWND hWnd, unsigned int Message, long Events)

{

int Result = WSAAsyncSelect (icmpSocket,

hWnd,

Message,

Events);

if (Result == SOCKET_ERROR)

{

icmpSocketError = WSAGetLastError();

icmpSocketErrorMod = 1;

icmpSocket = INVALID_SOCKET;

}

return Result;

}

设置TTL：

int CIcmp::SetTTL(int TTL)

{

int Result;

Result = setsockopt (icmpSocket, IPPROTO_IP, IP_TTL, (LPSTR)&TTL, sizeof(int));

if (Result == SOCKET_ERROR)

{

icmpSocketErrorMod = 1;

icmpSocketError = WSAGetLastError();

}

return Result;

}

Ping命令的函数：

int CIcmp::Ping (LPSTR pIcmpBuffer, int DataLen)

{

int Result;

int IcmpBufferSize = DataLen + IcmpHeaderLength;

pIcmpHeader = (LPIcmpHeader)pIcmpBuffer;

memset (pIcmpBuffer, 'E', IcmpBufferSize);

memset (pIcmpHeader, 0, IcmpHeaderLength);

pIcmpHeader->IcmpType = ICMP_ECHO;

pIcmpHeader->IcmpCode = 0;

pIcmpHeader->IcmpChecksum = 0;

pIcmpHeader->IcmpId = icmpCurId;

pIcmpHeader->IcmpSeq = icmpCurSeq;

pIcmpHeader->IcmpTimestamp = GetCurrentTime();

pIcmpHeader->IcmpChecksum = IcmpChecksum ((USHORT FAR *)pIcmpBuffer,

IcmpBufferSize);

icmpPingSentAt = GetCurrentTime();

Result = sendto (icmpSocket,

pIcmpBuffer,

IcmpBufferSize,

0,

(LPSOCKADDR)&icmpSockAddr,

sizeof icmpSockAddr);

if (Result == SOCKET_ERROR)

{

icmpSocketError = WSAGetLastError();

icmpSocketErrorMod = 1;

}

return Result;

}