Question

我是网络编程新手。在过去的几天里，我正在学习。今天我试着玩原始套接字。一切顺利。但是Ip校验和并没有帮助我。无论我手动给iph-＆gt;检查的价值是什么，同时接收校验和不同的东西。

实际上我做的是创建了一个原始套接字C程序，它将使用原始套接字创建一个发送到回送接口的TCP数据包。我用wireshark捕获了数据包。但是当我解释收到的数据包时，我发现无论我在程序中为校验和赋予了什么价值，它都显示了一些不同的常数值。

这是我的代码

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <errno.h>
//#include <linux/in.h>

unsigned short calculate_check_sum (unsigned short *buf, int nwords) {
unsigned long sum;
for (sum = 0; nwords > 0; nwords--) {
    sum += *buf++;
}
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
return ~sum;
}

int main () {
int sockfd = socket (PF_INET, SOCK_RAW, 6);
if (sockfd < 0) {
    perror ("socket failed: ");
    return -1;
}
char packet[4096];

struct iphdr *iph = (struct iphdr *) packet;
struct tcphdr *tcph = (struct tcphdr *) packet + sizeof (struct iphdr);
//char *payload = packet + sizeof (struct iphdr) + sizeof (struct tcphdr);

memset (packet, 0, 4096);

//strcpy (payload, "helllo");

struct sockaddr_in sin;
sin.sin_family = AF_INET;
sin.sin_port = htons (1330);
inet_pton (AF_INET, "127.0.0.1", &(sin.sin_addr));

/* TESTING
char var[123];
inet_ntop (AF_INET, &(sin.sin_addr), var, INET_ADDRSTRLEN);
printf ("%s\n", var);
*/

//WRITING ON IP HEADER
iph->ihl = 5;
iph->version = 4;
iph->tos = 0;
iph->tot_len = sizeof (struct iphdr) + sizeof (struct tcphdr); //+ strlen (payload);
iph->id = htons (1234);
iph->frag_off = 0;
iph->ttl = 225;
iph->protocol = 6;
iph->check = 0;
iph->saddr = inet_addr ("43.88.80.72");
iph->daddr = sin.sin_addr.s_addr;

//WRITING TCP HEADER
tcph->source = htons (1234);
tcph->dest = htons (1330);
tcph->seq = random ();
tcph->ack_seq = 0;
tcph->res1 = 0;
tcph->doff = 0;
tcph->syn = 1;
tcph->window = htons (1000);
tcph->check = 0;
tcph->urg_ptr = 0;

//CALCULATE CHECK SUM AND PUT IN THEIR PLACES
//iph->check = calculate_check_sum ((unsigned short *) packet, iph->tot_len >> 1);
iph->check = 0xffff;

int one = 1;
if (setsockopt (sockfd, 0, IP_HDRINCL, &one, sizeof (one)) < 0) {
    perror ("setsockopt faild: ");
    return -1;
}

int ret = sendto (sockfd, packet, iph->tot_len, 0, (struct sockaddr *) &sin, sizeof (sin));
if (ret < 0) {
    perror ("sendto failed: ");
    return -1;
}
return 0;
}

这是wireshark捕获的流 00000000000000000000000008004500002804d20000e106 * da5c * 2b5850487f0000010000000000000000000000000000000000000000

这里的5cda（astric之间）是我得到的校验和。

我还创建了自己的捕获程序，而不是wireshark，

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <netinet/tcp.h>
#include <netinet/ip.h>
#include <string.h>
#include <errno.h>

int main () {
int fd = socket (PF_INET, SOCK_RAW, 6);
int len_msg;
if (fd < 0)
    perror ("socket failed: ");
char buf [8192];
memset (buf, 0, 8192);
struct sockaddr_in sock_addr;
inet_pton (AF_INET, "127.0.0.1", &(sock_addr.sin_addr));
int len = sizeof (struct sockaddr);
printf ("%s\n",inet_ntoa(sock_addr.sin_addr.s_addr));
if (bind (fd, (struct sockaddr *) &sock_addr, len)) {
    perror ("bind failed: ");
    return -1;
}
while ((len_msg = recvfrom (fd, buf, 8192, 0, (struct sockaddr *) &sock_addr, (socklen_t *)&len)) != -1) {
    //printf ("%s\n", buf+sizeof(struct iphdr)+sizeof(struct tcphdr));
    //printf ("%s\n", buf);
    int i;
    printf ("%d\n", len_msg);
    for (i = 0; i < len_msg; i += 1)
        printf ("%x ", (unsigned char) *(buf + i));
    printf ("\n");

    printf ("*****************************************\n");
    struct iphdr *iph = (struct iphdr *) buf;
    printf ("checksum: %x\n", iph->check);
    break;
}
printf ("%s\n",inet_ntoa(sock_addr.sin_addr.s_addr));
return 0;
}

我仍然得到相同的支票价值。无论我在第一个程序中输入什么值，作为校验和，捕获的数据包只有值0x5cda作为其校验和。

我正在使用CentOS。内核本身是否对我的数据包进行了任何更改？请帮帮我。

先谢谢

Answer 1

根据您的描述，您似乎在发送代码中放置了伪造的IP校验和。根据RFC 1122，这是无效的。我怀疑Linux原始套接字处理代码更宽松，并且接受具有无效IP校验和的数据包将覆盖您的校验和。

看看：

http://lxr.linux.no/linux+v3.4.1/net/ipv4/raw.c#L458 （这是发送消息时调用的内容）

IP校验和自动更改

1 个答案: