2

I need to inspect and modify the IPv6 extension headers. So I set up a raw socket to listen for all IP packets on the local address.

package main

import (
    "log"
    "net"
)

func main() {
    c, err := net.ListenIP("ip6:tcp", &net.IPAddr{
        IP:   net.IPv6loopback,
        Zone: "",
    })
    if err != nil {
        panic(err)
    }

    buf := make([]byte, 1024)
    for {
        numRead, ipaddr, err := c.ReadFromIP(buf)
        log.Print(numRead, ipaddr, err)
        log.Printf("% X\n", buf[:numRead])
    }
}

I tried all the Read*() methods on the connection but it seems like they just return the payload without the header. So my question is: How can I access the IPv6 header of a packet?

1
  • One thing to note is that IPv6 extension headers are rarely used, and, unfortunately, many ISPs in a path will either block or strip extension headers because they can be used for attacks.
    – Ron Maupin
    Jul 17, 2016 at 16:59

1 Answer 1

3

Raw sockets with IPv6 are different compared to IPv4. Relevant for your case is RFC 3542. Note:

Another difference from IPv4 raw sockets is that complete packets (that is, IPv6 packets with extension headers) cannot be sent or received using the IPv6 raw sockets API. Instead, ancillary data objects are used to transfer the extension headers and hoplimit information, as described in Section 6. Should an application need access to the complete IPv6 packet, some other technique, such as the datalink interfaces BPF or DLPI, must be used.


You can find this out on your own. By running (and strace'ing) your program on my box for every packet I get:

recvfrom(3, "\x45\x00\x00\x3c\x6a\x7d...
               ^^

This means IP version = 4, IHL = 5 (20 bytes).

When I try the same thing with IPv6 (i.e. your original code), I get something different every time:

recvfrom(3, "\xc6\x22\x00\x50\x4d

In this case every time the kernel is returning stuff starting directly with TCP (in this case the port is 50722, i.e 0xC622).

Another interesting part should be noted in the sources:

switch sa := sa.(type) {
case *syscall.SockaddrInet4:
    addr = &IPAddr{IP: sa.Addr[0:]}
    n = stripIPv4Header(n, b)
case *syscall.SockaddrInet6:
    addr = &IPAddr{IP: sa.Addr[0:], Zone: zoneToString(int(sa.ZoneId))}
}

The header is stripped manually for IPv4 but not for IPv6: for IPv6 there is nothing to remove.


Note, there are mechanisms that will return extra information (but by no means the whole packet). For example the IPV6_RECVPKTINFO socket option will give you access to:

struct in6_pktinfo {
    struct in6_addr ipi6_addr;    /* src/dst IPv6 address */
    unsigned int    ipi6_ifindex; /* send/recv interface index */
};

Similar options exist for the routing header option, hop limit etc.

2
  • Thanks for your answer. I already noticed the part in the sources where the header is stripped but didn't know the reason for it. So i guess it's just not possible to do with the net package?!
    – fl0cke
    Jul 17, 2016 at 12:02
  • @fl0cke I think the net package is not sufficient here. You might get away with the Linux-specific PF_PACKET or BPF (available on a number of Unixes).
    – cnicutar
    Jul 17, 2016 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.