Re: How to take over TCP connection from userspace process?

[Harald Welte <laforge@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 2264 bytes --]

On Wed, Oct 22, 2003 at 11:44:56AM +0800, yangrunhua wrote:

> What I need is: after I authenticated TCP connection A(host A
> connected to me) and TCP connection B(host B connected to me), then
> let what host A send (through TCP connection A)directly forward to
> host B(through TCP connection B) in the kernel ,meanwhile, what host B
> send directly forward to host A in the kernel.

> That's much like MSN Messenger Server's relaying webcam video stream
> between two peers after authenticated them. I want to do this relay in
> kernel space and auth in the userspace. It's much like NGN
> softswitch's theory: control and auth separate from transfer.

> 
> That's much useful functionality. Can netfilter/iptables help this?
> done this by writing a new target or something?

no, it doesn't help.  What you are trying is intermixing of
packet-oriented paradigm with connection/stream oriented paradigm.

netfilter/iptables deals with individual packets.  So if you do NAT or
something, every packet that we receive is transmited  as another
packet.  

If you accept a socket from userspace, than there's no more packets.  At
socket level you have a bidirectional stream of bytes.  So in order to
send the same data oever another socket, you need to re-packetize that
stream. In the end, you will have different packets with different
flags, sequencenumber, and eventually size (depending on mtu), window
scaling, options, ...

so _either_ you authenticate based on layer2 - layer4 addresses, and you
deal with packets, _or_ you authenticate somehow witin the TCP stream,
but than you don't have packets of a single connection, but rather two
seperate connections with each a stream of bytes in each direction.

This is not a limitation by netfitler/iptables.  It's about the
fundamentals of networking protocol layers.

> Thanks,
> 	Runhua Yang

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]