Clever Geek Handbook

Multiple TCP packets using NFQUEUE

I am trying to solve the problem below,

  • I have an iptables rule in my output chain that says if a packet meets certain criteria, leave it in the queue and submit to user space using NFQUEUE

  • A user-space program gets it, and after getting it, it checks if the package is a tcp package, and if so, it changes the contents of the package

  • After changing it, it is sent and I can see that so far it is working correctly, I was able to recalculate the checksum and check it and update the packet length and everything will be reflected correctly and I can confirm this with wireshark and I also I can see the packet is reaching its destination. The package I am modifying is the HTTP GET Packet.

  • Intial TCP sequential handshake happens and after the initial handshake I send a modified HTTP GET packet and I get a response from the server, but after that the client generates a TCP RST packet for some reason and sends it to the destination, I'm not sure why it happens. Earlier while searching on Google, people reported that this might be due to a mess in the sequence of numbers, but in my case, since I change the first packet after the TCP handshake, the sequence number will be the same as my last ACK packet belonging to TCP handshake.

  • I suspect that some part of the kernel module caches the length of the HTTP GET request packet, and as soon as I modify it and update the length, the cached part is not updated and as a reason, the client sends a TCP RST packet.

Can anyone help me in this case.

+3


source to share


1 answer


The problem is that changing the length of a TCP packet that is part of an active stream distorts the sequence number code that causes some side of the connection to reset the connection. See RFC 793 3.4 for details.



+1


source






More articles:


All Articles