Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rootless Pings in Rust

bou.ke

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Rootless Pings in Rust

#41

Post by erk__ »

the8472 wrote: post #37
erk__ wrote: post #30

Earlier quoted context omitted.

The std api can only create UdpSockets, the trick here is that you use Socket2 which allows more kinds of sockets and then you tell UdpSocket that some raw file descriptor is a upd socket through a unsafe api with no checks and I guess it works because they use the same api on posix. Edit: It is possible in safe rust as well, see child comment. The macro used by socket2: https://docs.rs/socket2/0.6.1/src/socket2/lib.…

From/Into conversion via OwnedFd is the safe API, RawFd is the older and lower-level one.

Ahh I guess that means that its possible in safe rust to cast a file descriptor to a different type. I was just looking at how socket2 did it and forgot to have a proper look.

Re: Rootless Pings in Rust

#42

Post by messe »

stavros wrote: post #39
jdndbdbd wrote: post #36

Earlier quoted context omitted.

No? Why would you think a datagram socket is UDP?

What a reasonable question to be asked today.

What networks are you using without ICMP?

Presumably you're also using systems that don't support Unix Domain Sockets which can be configured as SOCK_STREAM, SOCK_DGRAM, and even gasp SOCK_SEQPACKET (equivalent to SOCK_DGRAM in this case admittedly).

Re: Rootless Pings in Rust

#43

Post by champtar »

raesene9 wrote: post #28
vbezhenar wrote: post #24

Earlier quoted context omitted.

> You can just add the capability CAP_NET_RAW to your process, at which point it can ping freely What are consequences of this capability? Seems like restricting this to root was done for a reason?

It lets you send raw sockets, and has some dangers (e.g. packet forgery). It's included in pretty much every container in existence (if you're running as root in the container or have ambient capabilities setup). The goal of the capabilities system was to allow processes and users to gain a small portion of root privileges without giving them all. In the "old days" ping on a Linux host would be setuid root, so it ess…

CAP_NET_RAW also allow to capture packets (tcpdump) so you really can have some fun like running a TCP stack in user space or MITM http connections: https://blog.champtar.fr/IPv6_RA_MITM/ / https://blog.champtar.fr/Metadata_MITM_root_EKS_GKE/

Re: Rootless Pings in Rust

#44

Post by Sharlin »

IshKebab wrote: post #35
krater23 wrote: post #33

Earlier quoted context omitted.

That happens when someones learning project ("I rewrite a library in the new language I want to learn") ends up in productive code.

This is in the standard library; it's not a learning project. And it also isn't even incorrect - see erk__'s comment. Rust is an excellent language and fully capable of production use.

It's not, it's the `socket2` library. The standard sockets don't allow (ab)using actual `UdpSocket`s as a different kind of datagram socket.

Re: Rootless Pings in Rust

#45

Post by DrNefario »

krater23 wrote: post #34
messe wrote: post #25

> It turns out you can create a UDP socket with a protocol flag, which allows you to send the ping rootless This is wrong, despite the Rust library in question's naming convention. You're not creating a UDP socket. You're creating an IP (AF_INET), datagram socket (SOCK_DGRAM), using protocol ICMP (IPPROTO_ICMP). The issue is that the rust library apparently conflates datagram and UDP, when they're not the same thing.…

[flagged]

You're using a single instance of poor API naming in a 3rd-party library (which is marked as beta) to dismiss the entire Rust language?

Re: Rootless Pings in Rust

#46

Post by Quarrel »

messe wrote: post #25

> It turns out you can create a UDP socket with a protocol flag, which allows you to send the ping rootless This is wrong, despite the Rust library in question's naming convention. You're not creating a UDP socket. You're creating an IP (AF_INET), datagram socket (SOCK_DGRAM), using protocol ICMP (IPPROTO_ICMP). The issue is that the rust library apparently conflates datagram and UDP, when they're not the same thing.…

Thank you.

I assumed this was what was happening, but conflating network layer protocols with transport layer ones isn't great.

I'm surprised that pedantic zealots, like me in my youth, haven't risen up and flooded rust with issues over it way before this though.

Re: Rootless Pings in Rust

#47

Post by Quarrel »

stavros wrote: post #27
vbezhenar wrote: post #21

Earlier quoted context omitted.

ICMP is just different protocol from UDP. There's field "Protocol" in IP packet. 0x01 = ICMP, 0x06 = TCP, 0x11 = UDP. I think that this article gets terminology wrong. It's not UDP socket that gets created here, but Datagram socket. Seems to be bad API naming in Rust library.

> It's not UDP socket that gets created here, but Datagram socket A datagram socket is a UDP socket, though. That's what the D stands for.

To give a more nuanced reply versus the "you're wrong" ones already here, the difference is that UDP adds send and receive ports, enabling most modern users (& uses) of UDP. Hence, it is the "User" datagram protocol.

(it also adds a checksum, which used to be more important than it is nowadays, but still well worth it imho.)

Re: Rootless Pings in Rust

#48

Post by GTP »

messe wrote: post #25

> It turns out you can create a UDP socket with a protocol flag, which allows you to send the ping rootless This is wrong, despite the Rust library in question's naming convention. You're not creating a UDP socket. You're creating an IP (AF_INET), datagram socket (SOCK_DGRAM), using protocol ICMP (IPPROTO_ICMP). The issue is that the rust library apparently conflates datagram and UDP, when they're not the same thing.…

Could you please explain me the difference? As UDP is the "User Datagram Protocol" when I read about datagrams I always think about UDP and though it was just a different way of saying the same thing. Maybe "datagram" is supposed to be the packet itself, but you're still sending it via UDP, right?

Re: Rootless Pings in Rust

#50

Post by cetra3 »

GTP wrote: post #48
messe wrote: post #25

> It turns out you can create a UDP socket with a protocol flag, which allows you to send the ping rootless This is wrong, despite the Rust library in question's naming convention. You're not creating a UDP socket. You're creating an IP (AF_INET), datagram socket (SOCK_DGRAM), using protocol ICMP (IPPROTO_ICMP). The issue is that the rust library apparently conflates datagram and UDP, when they're not the same thing.…

Could you please explain me the difference? As UDP is the "User Datagram Protocol" when I read about datagrams I always think about UDP and though it was just a different way of saying the same thing. Maybe "datagram" is supposed to be the packet itself, but you're still sending it via UDP, right?

UDP and TCP are Layer 3 protocols, and so is ICMP. They all fill the same bits within network packets, like at the same level. So sending an ICMP packet (protocol 1) is not the same as sending a UDP packet (protocol 17).

You can see a list of network protocols in /etc/protocols actually, or here: https://www.iana.org/assignments/protocol-numbers/protocol-n...

Post reply on HN