                   +--------------+                              +----...
                   |              |                             /
--------+----------+    Firewall  +----------+-----------------<-----...
         \         |              |          /                  \
          \        +--------------+         /                    +----...
           \     _____________________     /
            +--<|     ICMP Tunnel     |<--+
                |_____________________|



Preface
^^^^^^^
This package provides you with four simple functions which allow you
to set up a ICMP tunnel.

Earlier versions of this tunnel have had dynamic RTT calculation, ACKing and
sequence numbers. Some problems occur and so I decided to remove this stuff.
Now only simple ICMP packet transfer is possible... but if I have time I
will try to solve these problems.


What is a ICMP tunnel?
^^^^^^^^^^^^^^^^^^^^^^
Most firewalls permit ICMP traffic because it's very basic and sometimes
usefull.
Two types of ICMP messages have a data portion to carry stuff like
timestamps. These ICMP messages are ECHO and ECHO REPLY.
Noone denys us to use other stuff than timestamps as data, i.e. we could
include sniffer output, passwd entries or commands.


Howto to use these functions
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
First call 'void tunnel_init(void)' - it does only open a raw ICMP socket and
set some global var.s. You MUST be 'root' to get a raw ICMP socket!

To send data use 'int tunnel_send(char *send_mesg, size_t mesglen, u_long
srv_ip)'. 'tunnel_send()' uses ICMP ECHO REPLY messages.

To receive data use 'int tunnel_recv(char *recv_mesg, size_t mesglen)'.
'tunnel_recv()'. After the first 'tunnel_recv()' call the clients IP is
written in 'struct sockaddr_in clisrc'.

Yepp and 'void tunnel_reset(void)' just closes the ICMP socket.

I use ECHO REPLY for sending because it will not be written to the logs
(i.e., Linux) and the kernel will not respond to it. But it looks
suspicious - especially for statefull inspection machines.


Return Values
^^^^^^^^^^^^^
If the 'tunnel_xxx()' functions give back -1 check out the 'eit_errno'
(look at 'icmp_tunnel.h' for description of the error values).


Example
^^^^^^^
I wrote a small chat prog... look at the source.
The prog. could run in client- and in server-mode.

server: icmp-chat -s -n TICK
        Now the prog. waits for icmp messages.

client: icmp-chat -c -n vanHauser -h wallace.the_phake.org
        The prog. ask the user to type in some stuff.

To abort the chat just type '/bye' - like the 'irc' trash.


    TICK (t_i_c_k@hotmail.com)

