4727550 Advanced & Raw Socket Support (ICMP, ICMPv6, ping, traceroute, ...)

Hi All,
4727550 was a long standing RFE. Before we take any action, I'd like to ask you guys what the requirements are. E.g., do you plan to use raw socket in what kind of application? What features do you want the most? Which platform do you plan to use? etc.
Feel free to add your comments here.
Thanks,
Edward

sjasja wrote:
Its sad to realize at different occasions, that Java
is just not usable for this type of application, e.g.
writing a firewall...Sure it is! You just need some glue between operating system specific APIs and Java.
This is not really a language issue. It's an issue of what language APIs a given OS supports out of the box. Want to write a firewall using C and deploy it on a LISP machine? Be prepared to write some C/LISP glue, just like you'd write Java/C glue to access APIs written in a C-based OS.
C is so widespread, and so many OSes offer C APIs that C seems "universal". But that's just an illusion. The OSes that happen to be most popular at this time in history happen to provide C APIs to most of their functionality (even then you may occasionally need C/assembly glue for some things).
More and more APIs, such as low level TCP access, will eventually migrate to Java. But ther is no "universal" language, magically able to access any API written in any other language.I think you are missing the point. In order to write a firewall in Java, you have to have raw socket support - IE: be able to specify the data going over the transport. Java currently supports TCP and UDP, but does not support any others (IPX, ICMP, etc).
The reason these things are not available at the Java layer is because the underlying C code in the JVM is specifying the constants to pass to the socket library at the C level rather than letting the Java layer pass those parameters down. You can currently do it yourself by doing a bootstrap replacement for the JVM classes, or using a 3rd party library -- but you shouldn't need to. The underlying library should be rewritten as raw socket, and allow the existing libraries to be built as pure-java implementations on top of it.
The reason that raw sockets were not around to begin with was that everyone was afraid it was a security risk. It is unfortunate that in order to protect us, they keep us from writing security software.
As a side note, I think these two comments on the bug ( http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4727550 ) are interesting:
4093850 "ICMP protocol support a.k.a. PING applets" was a long
standing RFE seeking ICMP/raw sockets support. It attracted approximately
250 votes on the JDC. It became clear from the feedback to the RFE
that there were broadly two requirements :-
In about one month (from 2006-08-23 to 2006-09-20), we don't see enough input in the SDN forum thread for this RFE. Seems there's no enough interest for it.
If it "became clear" that people wanted this functionality, why post a brand new link somewhere and monitor it for one month to determine if anyone wanted the functionality. I didn't even know about this link until a friend mentioned that the bug had been updated.
So, enough of a rant. I think that if we could write a full-fledged software firewall in Java without using a 3rd party library or JNI, then we'd be on the right track for requirements.

Similar Messages

Raw Sockets and Root Administration

I've been reading the DOS articles on grc.com. Quite a cool website with lots of interesting information.
I was wondering if there is a way to remove raw socket support from the kernel. I assume that that must be where that support is implemented, and I'm wondering if a way to prevent ip spoofing and other abusive techniques has been developed. The articles on grc.com are unclear as to whether the raw sockets support is required for ICMP, but it seems as though it is required. Basically, is there a way to prevent ip spoofing in the linux kernel?
Also, it is mentioned that *nix tries to minimize abuse of the raw sockets system by only allowing the root user to make use of it. How would one go about setting up another user to administrate the system? The default way would seem to be setting up sudo access, but then you're basically giving that user root privileges for everything, which really doesn't seem to solve this problem to me.
My understanding of this is somewhat limited, but I like to think that I comprehended the information about all this. If I have something wrong, tell me, I'm not one of those idiots that refuses to be told he is wrong.

Could you please clarify me whether you could finally execute your program or not?
I am also facing the same kind of problem.
I have some RAW socket user level SCTP implementation which I am trying to run on SOlaris 10.But when I run user level SCTP program, its giving always "Cann't assign Address" i.e ERRNO : 126.
Any clue from everybody...

Why does not java support raw sockets?

Java does not have support for raw sockets, that means it cannot receive the packet header, just the payload data.
But the header data of an ICMP packet consists of 20 bytes, and you can still write single bytes in Java, so why isn´t is possible to write a header for an ICMP packet in Java?
Can someone explain how it all works?
Thanks!

You can do raw sockets with third party libraries. They won't be pure java - but you didn't really expect to do raw sockets on your cell phone or TV set top box, or spy and spoof someone's network using an applet.
The FAQ for one such library hints what kind of a mess raw sockets are due to differences in common operating systems; see http://www.savarese.com/software/rocksaw/

Raw Socket: Protocol Not Supported

OS Solaris 10, using Zones
I have one zone set up which houses HP Openview NNM 7.5
Inside of the application you should be able to right click on a node and do a traceroute or telnet to the node.
Neither works. Get error:
raw socket: Protocol not supported
Can anyone tell me if this is an OS issue or HP Openview issue?
Any assistance will be greatly appreciated!!!

This is known issue in zone. Please see http://developers.sun.com/solaris/articles/application_in_zone.html about socket function.
But if you really need traceroute in nnm, you can use /usr/sbin/traceroute.
Here's how:
manager@ov:~$ diff /root/old-NNM-IP.tbl $OV_REGISTRATION/C/ovip/NNM-IP.tbl
473c473
< -cmd ovtraceroute ";
-cmd traceroute "; You can always add something like "xterm -e telnet" instead of "not working" menu item in registration file. Please see "Creating and Using Registration Files" guide on http://docs.hp.com.
nice nnm-ing :)
Message was edited by:
Porky@Pig

Does Java2 support raw socket programming?

Hi,
Does Java2 support raw socket programming? If not, are there any third-party libraries providing such support? Thanks for any comments!
Yong

no,
first result on google would suggest so.
http://www.google.com/search?q=raw%20socket%20java%20lib&sourceid=mozilla-search&start=0&start=0&ie=utf-8&oe=utf-8

Raw Socket in Java

Hello everybody. Since 2 years ago, I was looking for the Java RAWSOCKET class, and I read that it was possible....Up to now I did not read nothing about this...So, when could I find the Java RawSocket? Many thanx...
Ivano

I talking to Java developers....but they didn't answer
me! I need a response... I wanna know why there is not
a Java Raw Socket Class....or a Java ICMP Socket (NOT
NATIVE, NOT IN C, NOT JNI, OK?). First of all the socket classes that already exist in java already DO use JNI. You just don't see it.
I know that icmp
socket require root privilege, but, for example, in
PDA or cellular phone (J2ME) it doesn't need about
root privilege to "make ping" (Icmp echo).
Will they answer me ? Hoping.....If you give Sun a lot of money then they will be happy to add almost anything you want to java.
But if not then Sun is going to add what they feel is important.

Camera RAW image support for Pentax K100D

Hi,
Firstly, let me just say I have a MacBook Pro which came preloaded with Tiger. A month or so ago I upgraded to Leopard and I have applied all the available Apple software update.
I recently got a Pentax K100D digital SLR camera capable of taking images in RAW format (the pentax saves these with a .PEF file extension) and I have been trying to view these images in Leopard. I read the article below, which says that Leopard provides system-level support for the Pentax K100D camera RAW format.
*Digital camera RAW formats supported by Mac OS X 10.5*
http://docs.info.apple.com/article.html?artnum=306835
Now, my problem is that I cannot seem to be able to open the .PEF files with neither Quick Look, Preview, iPhoto or Aperture. Basically, none of these programs seem to be able to display my .PEF files. Aperture says 'unsupported image format'.
I have installed the software that came with my Pentax (i.e. Pentax Photo Browser and Pentax Photo Laboratory) and these applications can display the .PEF images just fine. For what it's worth, I installed this software before I upgraded to Leopard.
If I right-click on a .PEF file in Finder, the only programs listed in the Open context menu are the above two Pentax applications.
So, what am I missing? Clearly something seems to be screwy in my Leopard set up. Is there some way to 'repair' the RAW image support in Leopard??
I would appreciate any help in fixing this as I would really like to start working with RAW images in Aperture and iPhoto.
Finally, just be aware that I am not an experienced Mac user. I have always used Windows until now and so... if you have a fix for this I would really appreciate a slightly more elaborate response.
Thanks in advance,
Eddie

I have done a little more research on this...
As it turns out, my camera is a Pentax K100D Super - not a K100D. The K100D Super is not listed as one of the supported camera RAW formats in the aforementioned article. So I guess this means that my camera is as yet unsupported. Sigh...

Panic with Raw Socket-Page fault in module "ip" due to a NULL pointer deref

I see a panic when using raw sockets with Solaris 10 10/09 (u8). I included a sample program that can cause this issue (panic happens when a udp datagram is received on port 60000). This sample code works as expected with the previous version I was using - 5/08. If I bind with a port number of 0 I don't see the panic but I don't receive anything either.
I believe I have all the latest patches installed. I'd appreciate any assistance in resolving this. Thanks...
^Mpanic[cpu11]/thread=fffffe8000916c60:
BAD TRAP: type=e (#pf Page fault) rp=fffffe80009166c0 addr=83 occurred in module "ip" due to a NULL pointer dereference
sched:
#pf Page fault
Bad kernel fault at addr=0x83
pid=0, pc=0xffffffffedf86a10, sp=0xfffffe80009167b0, eflags=0x10246
cr0: 8005003b<pg,wp,ne,et,ts,mp,pe> cr4: 6f8<xmme,fxsr,pge,mce,pae,pse,de>
cr2: 83 cr3: 1a345000 cr8: c
rdi: ffffffffa7092808 rsi: ffffffffb0094e00 rdx: ffffffffa73c9d40
rcx: 0 r8: fffffe8000916878 r9: fffffe8000916880
rax: 0 rbx: ffffffffb0094e00 rbp: fffffe8000916800
r10: ffffffffa7c18840 r11: ffffffffa73c9d40 r12: fffffe8000916880
r13: ffffffff9b314000 r14: ffffffff9a70b000 r15: 0
fsb: ffffffff80000000 gsb: ffffffff9c52d800 ds: 43
es: 43 fs: 0 gs: 1c3
trp: e err: 0 rip: ffffffffedf86a10
cs: 28 rfl: 10246 rsp: fffffe80009167b0
ss: 30
fffffe80009165d0 unix:die+da ()
fffffe80009166b0 unix:trap+5e6 ()
fffffe80009166c0 unix:_cmntrap+140 ()
fffffe8000916800 ip:ip_udp_check+b0 ()
fffffe80009168b0 ip:ip_udp_input+15a ()
fffffe80009169d0 ip:ip_input+c7c ()
fffffe8000916aa0 dls:i_dls_link_rx+32e ()
fffffe8000916af0 mac:mac_rx+71 ()
fffffe8000916b90 bnx:bnx_recv_ring_recv+113 ()
fffffe8000916ba0 bnx:bnx_rxpkts_intr+17 ()
fffffe8000916bc0 bnx:bnx_intr_recv+58 ()
fffffe8000916bf0 bnx:bnx_intr_1lvl+120 ()
fffffe8000916c40 unix:av_dispatch_autovect+78 ()
fffffe8000916c50 unix:intr_thread+5f ()
EXAMPLE USED TO CAUSE ABOVE PANIC
#include        <unistd.h>
#include        <stdio.h>
#include        <stdlib.h>
#include        <sys/socket.h>
#include        <arpa/inet.h>
#define BUFFER_SIZE 2048
int main(int argc, char *argv[])
        int                     i, j, sd, iosize;
        char                    *ipbuffer;
        struct sockaddr_in      saddr, daddr;
        ipbuffer = calloc( 1, BUFFER_SIZE );
        //if ( ( sd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) ) < 0 ) {        // Works
        if ( ( sd = socket(PF_INET, SOCK_RAW, IPPROTO_UDP) ) < 0 ) {            // Fails
                perror("socket() error");
                exit(-1);
        saddr.sin_family = AF_INET;
        saddr.sin_addr.s_addr = inet_addr( "0.0.0.0" );
        saddr.sin_port = htons( 60000 );
        if ( bind( sd, (struct sockaddr *) &saddr, sizeof( saddr ) ) < 0 ) {
                perror("bind() error");
                exit(-1);
        printf( "Awaiting inbound datagrams...\n" );
        for ( i = 1; i <= 10; i++ ) {
                j = sizeof( daddr );
                iosize = recvfrom( sd, ipbuffer, BUFFER_SIZE, 0, (struct sockaddr *) &daddr, &j );
                printf( "Received %d bytes from %s\n", iosize, inet_ntoa( daddr.sin_addr ) );
        close( sd );
        return( 0 );
}------------------------------------------------------------------

This issue could be related. Recommend you open a call with support.
http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6882984

Raw socket programming is avilable in java

hello,
I want to reset my target device using device
MAC address (not IP address).
Is java support raw socket programming.
can i send packets using MAC address in Java like C.
I search in google. but, it shows there is no raw socket pgm support in java.
any one help me this issue.

JPCap

Opening a RAW socket - how to become superuser to do so ?

Hi, I'm writing my first test application, so I thought I'd convert an easy known quantity like ping. My problem here seems to be that to open a RAW socket I need to have a UID of 0, and I haven't got that or can I set it. So how is it done ? My various printf's to the console show me -
[Session started at 2008-09-20 00:17:47 +0100.]
Running pingmain
Running as UID 501
Running as EUID 501
Have set UID to 0, result code: -1
Have set EUID to 0, result code: -1
PING (null) (192.168.1.100): 56 data bytes
socket error: Operation not permitted
Failed to launch simulated application: Unknown error.
501 also happens to be the UID I'm assigned on my iMac, is it simply the case of su;ing to root and then starting xcode.. doesn't seem to be the right thing to do somehow.
Can anyone give me any hints onto what I should be doing here ?

Doing this the right way is a very messy process:
http://developer.apple.com/documentation/Security/Reference/authorizationref/Reference/reference.html#//appleref/c/func/AuthorizationExecuteWithPrivileges
or
http://developer.apple.com/samplecode/BetterAuthorizationSample/listing6.html

About Data Socket support in Appl. Builder

Hi,
I'm writing a program that uses Data Sockets. When I plan to distribute the application, using the Create Installer option, I guess I'll have to switch ON the "Data Socket support" in the advanced page. How does it work, when I install the application? Will that option make the Data Server to be installed in the target machine?
Thanks,
Marce

Great reply, 'tst'!
Here are a few more tips.
Remember that a DataSocket network is consisting of one DataSocket Server and one or several DataSocket Clients (applications using DataSocket Read or Write functions). The Server stores the data items and controls read and write access to the different data items, the Clients read from and write to the different data items. Therefore it is NOT ALWAYS necessary to launch the Server on the same machine as the Client.
Running the executable does not automatically launch the DataSocket Server. If you need to have the DataSocket Server running on the same machine as the executable, you can do as described by 'tst' to manually launch the Server.
What I prefer is to automatically launch the DataSocket Server when the executable is launched. Use the VI described in this KnowledgeBase to launch the Server.
If you are using the DataSocket functions, and NOT the Front Panel DataSocket connections, to connect to your DataSocket items, you will get an error 56 or 63 if the DataSocket Server is closed prematurely and you are trying to read or write to it. By using a Case Structure to check for these errors, you can restart the DataSocket Server again in the case it was accidentally closed.
Good luck!
- Philip Courtois, Thinkbot Solutions

Future raw socket capability in Java?

Is there raw socket capability with Java now? As I recall, Java only supports TCP and UDP sockets, right? I hope Java will include support for raw sockets, especially since Windows XP will support it as a standard.

I agree; I wouldn't mind some restrictions (to prevent IP spoofing) but developers should definitely have access to the don't fragment bit, the protocol field and the entire payload. Sometimes neither TCP nor UDP will get the job done...

Raw Socket always drop packets and return Destination Unreachable

Ho folks,
I have an application program that opens a raw socket to expect for UDP message incoming from the network.
However everytime I receive a package the Solaris 10 OS return a ICMP - Destination (port) unreachable, and no message
is send to my application.
I did test the same application in linux and it worked well, all that I have to do was disable ICMP responses using iptables.
Just to make things clear:
In linux the OS was sending the ICMP - Destionation (port) unreachable, however my program was
receiving the packets anyway. So just to stop those messages I did use the iptables. However, in
Solaris 10 the ICMP response is sending back and no message is forward to my application.
Would your guys help me to solve that?
Thanks in advance

Folks, here I go again...:-)
I have been spent some time, trying to figure out why it is not work. I read in books and internet, that BSD raw sockets DO NOT allow us to receive TCP/UDP packages. However the linux implementation DOES allow. That is because it work in linux but not in solaris.
Given that, such information is 100% true (book: Unix NetworkProgramming, 3rd edition), I would like to ask your guys what I can do to solve my problem.
Basically what I need is create an application that:
1) Allows to bind thousand of sockets at the same time (it is a media server that handles thousand of RTP connections)
This I believe I can do using socket multiplexing (e.g. select() )
2) Read not only the packet data, I need to retrieve the whole packet address (including IP, UDP, Upper Layers...)
When using SOCK_DGRAM with IPPROTO_UDP, I can get the messages but I can't get the IP header
3) Uses something like raw socket to send messages, here I believe I can use raw socket with no problem, is just sending messages
Thanks and Regards

Java sockets and raw sockets

Hello!
I have made my own file sharing program with Java sockets
and i have read a litle bit about raw sockets also.
What are the differences between Java sockets and raw sockets?

raw socket can have packet types which Java does not.
Generally if you need something useful which Java cannot do there is a utility already written which does what you want, e.g. ping and you can call that.

I need help! when I am importing my NEF files from my D3300 camera into lightroom 5 and try to use the "copy as DNG" button I always get an error message saying that "saying the file is not recognized by the raw format support"

I need help! when I am importing my NEF Raw files from my D3300 camera into lightroom 5 and try to use the "copy as DNG" button I always get an error message saying that "saying the file is not recognized by the raw format support". The whole purpose of that button is so that the file can be recognized... How can I make the "copy as DNG" button work as it is supposed too?? Thank you

Thank you for responding. So I essentially will never be able to use that button in lightroom 5? do I need to get LR 6? Will there ever be an update for LR 5 that will enable me to use it?
Does DNG Converter work within LR or do I have to upload pictures to my computer and then make a second copy in DNG format. and then go into LR and use them?
Thank you @dj_paige

4727550 Advanced & Raw Socket Support (ICMP, ICMPv6, ping, traceroute, ...)

Similar Messages

Maybe you are looking for