On Thu, 19 Sep 2019 06:12:46 -0000, Yadunandan Pillai said:
I'm developing a proxy system for TCP handshakes.
The programmer's version of "I'm writing the Great American Novel". :)
However, I'm unable to find a way to verify an incoming ACK packet.
That will depend on exactly what you mean by "verify". Are you just concerned with the TCP 4-tuple (source/dest port, source/dest address)? Or are you also checking that things like the sequence number match? (Bonus points for doing the right thing on a kernel that has syncookies enabled, and still work correctly if syncookies aren't in use)
I then ensure that they don't have a payload (therefore , confirming it is a handshake packet with ACK flag.
Note that ACK packets with no payload don't mean they're handshake packets. Look at any FTP transfer - you'll see packets going one way with data, and just ACK going back the other way. You need both SYN and ACK for it to be a handshake packet. iptables --tcp-flags SYN,ACK,... ACK <- isn't doing what you think it does. I'm wondering if you may be in over your head on this one...