Re: Suppress / delay SYN-ACK

Eric Dumazet
2006-10-13T20:13:46Z

Rick Jones a écrit :
> Eric Dumazet wrote:
>> Rick Jones a écrit :
>>
>>>> More to the point, on what basis would the application be rejecting a
>>>> connection request based solely on the SYN?
>>>
>>>
>>> True, it isn't like there would suddenly be any call user data as in
>>> XTI/TLI.
>>
>>
>> DATA payload could be included in the SYN packet. TCP specs allow this
>> AFAIK.
>
> Yes, but it isn't supposed to be delivered until the 3-way handshake is
> complete right?

Are you speaking of 20 years old BSD API ? :)

Martin, I played with libnetfilter_queue
(http://www.netfilter.org/projects/libnetfilter_queue/index.html)

With this single iptables rules, I was able to do what you want : transmit the
SYN message to a user application, that may DROP this packet or let it pass
normal TCP stack.

iptables -A INPUT -p tcp --dport 333 --syn -j QUEUE

Then hack nfqnl_test.c to meet your needs (see nfq_set_verdict(),
nfq_get_payload())

Be prepared to receive the 'same SYN' several time if your X.25 call attempt
is too long.

(You have to be root unfortunatly)

Eric