GoKawiilBad Apple!! but it's traceroute
As a follow-up to my post about how to make traceroute tools show arbitrary content and inspired by the release of another Bad Apple cover the other day I simply had to.
Of course, I'm not the first one to do this. That couldn't stop me though.
How it works
In the post I linked above, I had demonstrated how to inject fake hops into traceroute output.
Using the numgen feature of nftables, we can make the hops vary every time an ICMPv6 packet is generated. numgen gets us either random numbers or a monotonic counter. With a counter, we can easily make each hop return a different IPv6 address each time a response packet is generated. Using the playground from the other post:
ip netns exec tracemess nft -f - <<EOF destroy table inet tracemess table inet tracemess { chain prerouting { type filter hook prerouting priority raw; ip6 daddr fd00::1 ip6 hoplimit 1 reject with icmpv6 admin-prohibited; } chain postrouting { type filter hook postrouting priority raw; icmpv6 type destination-unreachable icmpv6 code admin-prohibited ip6 saddr fd00::1 @th,120,8 1 ip6 saddr set numgen inc mod 3 map { 0: fd00::2, 1: fd00::3, 2: fd00::4 } icmpv6 type set 3 icmpv6 code set 0 accept; } } EOF
Two other things were needed to make this happen. First of all, we need to disable the kernel's rate limit (by default, 1/s) for ICMPv6 egress using sysctl net.ipv6.icmp.ratelimit=0 , otherwise the party will be over really quick.
The second problem is that mtr will normally show multiple addresses for each hop, because that indicates that multiple different paths are in use for a packet and that is normally useful information. In this case, however, that's rather annoying:
In order to fix that, we have to apply a one-line patch to mtr:
... continue reading