From: "Valdis Klētnieks" <valdis.kletnieks@vt.edu>
To: Yadunandan Pillai <thesw4rm@pm.me>
Cc: "kernelnewbies@kernelnewbies.org" <kernelnewbies@kernelnewbies.org>
Subject: Re: Query TCP states/connection tracking table in Linux Kernel Module
Date: Thu, 19 Sep 2019 20:20:29 -0400 [thread overview]
Message-ID: <238014.1568938829@turing-police> (raw)
In-Reply-To: <9kdclOrd9niFe_UB06HreTsvZDIfcz9cz0f2rGf53zMFQTfgPzmmSZfzNkSe7wSos9bOPkl60xMCP00TRM_gOKhWm7iwA3kGBCi3qGbjk_o=@pm.me>
[-- Attachment #1.1: Type: text/plain, Size: 1104 bytes --]
On Thu, 19 Sep 2019 06:12:46 -0000, Yadunandan Pillai said:
> I'm developing a proxy system for TCP handshakes.
The programmer's version of "I'm writing the Great American Novel". :)
> However, I'm unable to find a way to verify an incoming ACK packet.
That will depend on exactly what you mean by "verify". Are you just concerned
with the TCP 4-tuple (source/dest port, source/dest address)? Or are you also
checking that things like the sequence number match? (Bonus points for doing
the right thing on a kernel that has syncookies enabled, and still work correctly
if syncookies aren't in use)
> I then ensure that they don't have a payload (therefore , confirming it is a
> handshake packet with ACK flag.
Note that ACK packets with no payload don't mean they're handshake packets.
Look at any FTP transfer - you'll see packets going one way with data, and
just ACK going back the other way.
You need both SYN and ACK for it to be a handshake packet.
iptables --tcp-flags SYN,ACK,... ACK <- isn't doing what you think it does.
I'm wondering if you may be in over your head on this one...
[-- Attachment #1.2: Type: application/pgp-signature, Size: 832 bytes --]
[-- Attachment #2: Type: text/plain, Size: 170 bytes --]
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
next prev parent reply other threads:[~2019-09-20 0:21 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-19 6:12 Query TCP states/connection tracking table in Linux Kernel Module Yadunandan Pillai
2019-09-20 0:20 ` Valdis Klētnieks [this message]
2019-09-20 0:35 ` Yadunandan Pillai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=238014.1568938829@turing-police \
--to=valdis.kletnieks@vt.edu \
--cc=kernelnewbies@kernelnewbies.org \
--cc=thesw4rm@pm.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).