Today I spent a bunch of time writing READMEs for the projects I’ve been working on at Hacker School, and putting together a project page with screenshots and explanations.

While doing that, I discovered that it was impossible to explain my TCP fun project because it was, er, mostly not working. So I fixed it up and wrote a finicky and unreliable version of curl using it, which made me happy.

The curl example is quite finicky – it uses ARP spoofing to bypass the kernel’s TCP stack, which sometimes results in it just Not Working. Running it a few times sometimes fixes this problem. I found that if I ran it 5 times then it would work. Mostly.

I ran it using

$ git clone http://github.com/jvns/teeceepee
$ cd teeceepee
$ sudo python examples/curl.py 10.0.4.4 example.com

You’ll notice that I’m supplying an extra local IP address, which seems like a weird thing to give curl. The reason for this is that it needs to bypass the kernel, since normally the TCP one has there will intercept any incoming packets and reset the connection. So we listen on a fake IP address and send gratuitous ARPs to the router.

This IP address needs to be in my subnet and should not belong to anyone else, because it would do bad things to them.

Features

• Can connect to hosts, send packets, and reassemble the replies in the correct order
• Will ignore out-of-order packets

Missing features

• Breaking up sent data into more than one packet.
• Resending packets that haven’t been ACKed
• Handling more than one incoming connection at once
• bind() hasn’t been tested in the wild at all, just unit tested. So it probably doesn’t work.
• Basically it is a marginally acceptable client and a totally ineffective server

Difficulties

• It needs to run as root because it needs to use raw sockets.
• TCP stacks aren’t really supposed to start and stop. In principle this should really run as a daemon, but it doesn’t.
• It needs to do ARP spoofing in order to receive any packets at all, as I explained earlier
• It’s slow, because Python. If you watch it in Wireshark, it does a hilarious thing where it gets backed up sending ACKs and then sends a load of ACKs at the end and takes forever to close the connection.
• Sometimes the ARP spoofing and packet sniffing doesn’t quite work. Usually if I run it 5 times it will work.