I'm trying to create a bridge in C Language that uses two protocols : OPC-UA and MODBUS.
Between the client and the bridge I used the protocol open62541 to ask for some data of any type. When the bridge receive the request, the memory requests start, from the brigde with the protocol MODBUS, to the MODBUS server, that should send back those memory variable asked.
My problem is that I cannot find any way to see the point in the code, where the Server recieve the Client request.
I need to find how to send those memory variables back from the server to the Client.
I would be glad if someone has the solution.
By guessing I assume you mean a ReadRequest and you want to find out where this read request is handled in the server?
It could be this one: Service_Read
https://github.com/open62541/open62541/blob/71e9a44d1aec5bc0cce465c8daefe47883b25f6c/src/server/ua_services_attribute.c#L394
Or also the Operation_Read:
https://github.com/open62541/open62541/blob/71e9a44d1aec5bc0cce465c8daefe47883b25f6c/src/server/ua_services_attribute.c#L394
you are looking for?!
Related
I have a simple networking program for sending and responding to HTTP requests/responses. However, if I wanted to send a HTTP or another request via a SOCKS5 proxy, how would I go about this? I'm using C Unix sockets.
I could solve this by creating a proxy server in Linux. However, my intention is so that I can send this to a proxy server I do not own so that it can be forwarded to the destination server. I couldn't seem to find a library. I found an RFC for it which I've read https://www.rfc-editor.org/rfc/rfc1928.txt , but i'm still not 100% unsure how to format my request.
Am I supposed to send the segments for the handshakes as hex? If so, would I send a string of hex 0F3504 or \x0F \x35 \x04 or 0x0F3504? Another question is do i need to denote that header = value in the message, or does the SOCKS5 server know what header i am referring to by the position of the byte it is looking at from the message I've sent?
Any clear up would be very much appreciated
Some time ago I wrote an open source C library that may help you: https://github.com/brechtsanders/proxysocket
Maybe you can use the library. Its quite easy, just replace the connect() with stuff from the library and for the rest you can keep the rest of your code that uses the socket that is returned.
Or you can take a peek in the code to see how it's done there.
There's something that bothers me: I'd like to distinguish between a packet coming from Youtube and a packet coming from Wikipedia: they both travel on HTTPS and they both come from the port 443.
Since they travel on HTTPS, their payload is not understandable and I can't do a full Deep Packet Inspection: I can only look at Ethernet, IP and TCP struct headers. I may look at the IP address source of both packets and see where they actually come from, but to know if they are from Youtube or Wikipedia I should already know the IP addresses of these two sites.
What I'm trying to figure out is a way to tell from a streaming over HTTP (like Youtube does) and a simple HTML transport (Wikipedia) without investigating the payload.
Edit 1: in a Wireshark session started during a reproducing video I got tons of packets. Maybe I should start looking at the timeout between packets coming from the same address.
If you are just interested in following the data stream in Wireshark you can use the TCP stream index, filter would be something like tcp.stream == 12
The stream index starts at zero with the first stream that wireshark encounters and increments for each new stream (persistent connection).
So two different streams between the same IPs would have two different numbers. For example a video stream might be 12 and an audio stream, between the same IP addresses, might be 13.
If you started the capture before the stream was initiated you'll be able to see the original traffic setting up the SSL connection (much of this is in clear text)
You may consider looking at the server certificate. It will tell you whether it's youtube (google) or facebook.
That would give you an idea whether SSL connection is to youtube, which one is to facebook.
You can try looking at the TCP header options, but generally the traffic is encrypted for a reason... so that it wouldn't be seen by man-in-the-middle. If it were possible, it would be, by definition, a poor encryption standard. Since you have the capture and all the information known to the user agent, you are not "in-the-middle". But you will need to use the user agent info to do the decryption before you can really see inside the stream.
this link: Reverse ip, find domain names on ip address
indicates several methods.
Suggest running nslookup on the IP from within a C program.
And remembering that address/ip values can be nested within the data of the packet, it may (probably will) take some investigation of the packet data to get to the originator of the packet
Well, you have encountered a dilema. How to get the info users are interchanging with their servers when they have explicitly encrypted the information to get anonymity. The quick response is you can't. But only if you can penetrate on the SSL connection you'll get more information.
Even the SSL certificate interchanged between server and client will be of not help, as it only identifies the server (and not the virtual host you'll try behind this connecton), and more than one SSL server (with the feature known as HTTP virtual host) several servers can be listening for connections on the same port of the same address.
SSL parameters are negotiated just after connection, and virtual server is normally selected with the Host http header field of the request (see RFC-2616) but these ocurr after the SSL negotiation has been finished, so you don't have access to them.
The only thing you can do for sure is to try to identify connections for youtube by the amounts and connection patterns this kind of traffic exhibit.
I'm writing a port scanner in C and i want to detect what service is running on an open port and its version.I've already wrote the scanner code but now i have no idea about how to detect running service.
What can i do?
If you are determined to do it in your own code, you can connect to the port, see if you get any data on it, if nothing then send a few bytes, and check again.
Then match that against expected response.
to get an idea what you are looking for, you can connect manually to the port with telnet and poke at it. In many cases (a web server is an easy example) you must send some correctly formatted data in order to get a usable response.
nmap has done all this and much more (e.g. extensive checks such as looking for byte order and timing of arp traffic)
UPDATE: several people have mentioned well known ports, but that won't help you discover standard services running on nonstandard ports, such as ssh or http servers running on custom ports.
If server sends something first, use that to identify protocol.
If not, send something according to some protocol, such as http, and see what server sends back (valid response or error). You may need to make several attempts with different protocols, and a good order is important to minimize connection count.
Some protocols may be very hard to identify, and it is easy to make custom server with unique protocol you don't know about, or even hide real server under simple fake server of other proto such as http.
If you just want to know what the port usually is, check "well known ports" and official reserved ports.
Also check nmap source code.
I am developing a server application that needs to send a lot of data to the client. However, client can get disconnected at any time and send()/write() on socket will return an error in this case. I would like to check how much data has been actually delivered before a client get disconnected to be able to continue sending data from the place where it left off when the client reconnect.
Is it possible to check it using sockets API?
No, the sockets API does not give you this information. In fact, it is not possible in general to know this. Depending on the particular way in which the connection failed, the TCP stack on one side generally can't know how much data successfully made it to the other side. The only thing it can know is how much data was acknowledged, which is not the same thing. And considering that other things than TCP/IP might have failed (the local OS, the remote OS, the remote process, the remote application logic), the amount of data that has been acknowledged at the TCP level probably doesn't mean much anyway.
You need to use an end-to-end application protocol to have the remote end acknowledge the data it has received and successfully processed (and committed, if applicable).
So, i am assuming that i will need to use sockets(i am a newbie to C).
The program will be for Windows(in pure C). And i shall be using these examples
http://cs.baylor.edu/~donahoo/practical/CSockets/winsock.html
My question is, instead of the client program connecting via TCP, i want the server to accept connections via a web browser i.e via HTTP.
So if the server program is running you type http://yourip:port/?gettemps and the server responds, but how do i do it?
As you might have guessed, this program will be for monitoring temps, remotely, via a web browser. But not for the CPU, for the GPU using AMD's ADL library(so yeah, only AMD cards).
The simplest option that is supported by most web servers is CGI - Common Gateway Interface.
Microsoft, of cource, has their own way of running web apps - ISAPI.
HTTP is quite a big standard, you might want to use some library such as libcurl to handle the details for you.
If you decide to code it yourself, HTTP is running over TCP so you first need to open a TCP socket at the standard HTTP port 80. Then simply listen on the socket and parse the incoming HTTP data - a great summary is given here: http://www.jmarshall.com/easy/http/.
Web browsers sends http get request to the server via tcp. If you are writing a web server from scratch than, you will need to parse data from web browser. http get request are string like for example GET /images/logo.png HTTP/1.1. So tokenize that string as it comes through tcp and get the command.
As you received your commands to the server call appropriate functions to handle your request.
Here is an great example of simple http server. You might want to make server multi-threaded as you may have multiple simultaneous users.
If you have already set up your web server to run the app on the appropriate port you can use getenv("QUERY_STRING") to access the web equivalent of command line parameters.
It would be better to call your program directly rather than just using the server to access a single default program as your example does, thus you could use http://yourip:port/yourprogram?cmd=gettemps. In this example getenv("QUERY_STRING") would return 'cmd=gettemps'.