Query TCP states/connection tracking table in Linux Kernel Module

[Valdis Kl=?utf-8?Q?=c4=93?=tnieks]

On Thu, 19 Sep 2019 06:12:46 -0000, Yadunandan Pillai said:
> I'm developing a proxy system for TCP handshakes.

The programmer's version of "I'm writing the Great American Novel". :)

> However, I'm unable to find a way to verify an incoming ACK packet.

That will depend on exactly what you mean by "verify". Are you just concerned
with the TCP 4-tuple (source/dest port, source/dest address)?  Or are you also
checking that things like the sequence number match?  (Bonus points for doing
the right thing on a kernel that has syncookies enabled, and still work correctly
if syncookies aren't in use)

> I then ensure that they don't have a payload (therefore , confirming it is a
> handshake packet with ACK flag.

Note that ACK packets with no payload don't mean they're handshake packets.

Look at any FTP transfer - you'll see packets going one way with data, and
just ACK going back the other way.

You need both SYN and ACK for it to be a handshake packet.

iptables --tcp-flags SYN,ACK,... ACK  <- isn't doing what you think it does.

I'm wondering if you may be in over your head on this one...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 832 bytes
Desc: not available
URL: <http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20190919/afbe78cf/attachment.sig>