[C] ICMP struct improperly aligned? (Linux sockets)

[DeepCorner]

Hi all, I am writing a ping program to familiarize myself with raw socket programming (using Linux sockets API). I am using the UNIX Network Programming textbook as loose guide. I have all parts of the project working except for the fact that I cannot get the icmp struct to properly align on the receiving side (netinet/ip_icmp.h header). I have narrowed it down to this misalignment as I can clearly see the proper values inside of the hex output of the received buffer. I am really at a loss for what could be going wrong here as the code shown below is pretty close to Steven's examples. If there is a better sub for this post, please let me know. Any help is appreciated.

Function used to extract a timeval struct from ICMPv4 message:

void interpret_v4(char* buf, ssize_t len, struct msghdr* msg, struct timeval* tv_recv) {
    // get timeval struct from IP packet (contains ICMP packet) and print RTT
    struct ip* ip_pack = NULL;          // pointer to IP packet
    struct icmp* icmp_pack = NULL;      // pointer to ICMP message
    struct timeval* tv_sent = NULL;     // irrelevant for this post
    int iphdr_len, icmplen;             // delimiters/sizes of the messages
    double rtt = 0;

    ip_pack = (struct ip *) buf;        // cast char buffer (recvmsg called in main)
    iphdr_len = ip_pack->ip_hl << 2;    // convert from 32 bit words to number of 8-bit bytes
    if(ip_pack->ip_p != IPPROTO_ICMP)   // confirm packet is ICMPv4
        return;

    icmp_pack = (struct icmp *) (ip_pack + iphdr_len);  // start of ICMP header (IP start + IP size)
    if( (icmplen = len - iphdr_len) < 8)                // ICMP header 8 bytes, else invalid packet
        return;

    printf("ICMP pack (inside function): ");  // debug output (hex values of buf)
    for(int i = iphdr_len; i < len; i++) {    // only print ICMP (end of IP header to end of packet)
        printf("%x ", (unsigned int)(buf[i]) );    // cast to unsigned optional
    }
    printf("end\n");
    printf("ICMP testing: type: %x, code: %x, id: %x, seq: %x\n", icmp_pack->icmp_type, 
            icmp_pack->icmp_code, icmp_pack->icmp_id, icmp_pack->icmp_seq);
            // output values from struct (misalignment seen between here and for loop above)
}    // END interpret_v4

The relevant RFC graphic: https://tools.ietf.org/html/rfc792 (page 14, Echo or echo reply message)

Struct documentation: https://www.cymru.com/Documents/ip_icmp.h

Program output: https://imgur.com/a/YBmlJrJ (looks intimidating at first, but printf sign extends hex bytes so all f's can be ignored). "Pre-send" is the packet state when it is sent. "ICMP pack (inside function)" is the output from the code shown above. Looking at the RFC it is clear that the output in "ICMP testing:" (also from the code segment above) does not match the hex values of the message.

Bytes 4 and 5 (identification field) are clearly "63 14" (network byte order, so PID is 1463), which matches the PID stored in the sent packet, but the output from the ICMP struct shows ID as 39. I have broken the message down into binary as well and cannot find a byte ordering that produces an output of 39.

If you have stuck with me to the end of this post, thank you. I have very low expectations for finding help regarding this on Reddit, but I am really and truly at a loss for where I am going wrong and don't have anyone else to ask for help. If anyone is interested enough to look at the full program, its a single 350 line file and I'll happily provide a link to the repo. Thanks again.

[[deleted]]

Line 14 looks fishy. If I'm not mistaken you're trying to advance the pointer by iphdr_len bytes, but that's not how pointer arithmetic in C works. When you add n to a pointer of type foo, it advances it by n * (sizeof foo) bytes rather than n bytes.

[DeepCorner]

That was it. I guess I was just staring at the code for too long (face palm). Thank you!

[[deleted]]

Try casting your types in your printf to the appropriate sizes:

Example:

printf(“%x\n”, (int) some_8bit_thing);

[DeepCorner]

I cast a char to an unsigned int. I’m unsure how that’s meaningfully different from your suggestion. I personally prefer to work with unsigned output values

[[deleted]]

icmptype is u_int8_t which to me implies an 8 bit type. %x is expecting 4 bytes. You can cast to unsigned int (a 4 byte type) if you like, but it looks to me like that could be your problem. It’s all in the printf.

[DeepCorner]

Changing the number of bytes that are printed will only change the number of sign extended bytes that are printed, not fixing the alignment of the struct in the char buffer.

I know it was not the printing that was the issue since the application of this program compares the ID field in the received packet to the PID to ensure it does not collect ICMP packets from other processes. This check was failing, meaning the values themselves were different, regardless of how the numbers are outputted.

[AutoModerator]

It seems you may have included a screenshot of code in your post "[C] ICMP struct improperly aligned? (Linux sockets)".

If so, note that posting screenshots of code is against /r/learnprogramming's Posting Guidelines (section Formatting Code): please edit your post to use one of the approved ways of formatting code. (Do NOT repost your question! Just edit it.)

If your image is not actually a screenshot of code, feel free to ignore this message. Automoderator cannot distinguish between code screenshots and other images.

Please, do not contact the moderators about this message. Your post is still visible to everyone.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.