1

I'm working on Linux 4.13.x. And I'm considering to send a packet response in the kernel.

Consider an echo TCP or UDP server running in the userland and there is also another node running a TCP or UDP client. Clients are sending requests to the server. I want to send the packet response back to the client without any involvement of server application running at userspace.

Here is my thoughts about this problem:

I started thinking how it is possible and I come across to a solution like netfilter. If I can capture the packets in NF_INET_PRE_ROUTING and then try to swap the source and destination IP addresses of IP header and also swapping the ports in the TCP header, then according to this answers and this presumably modified packet should be forwarded to the originator throughout the routing system.

Actually, I tried this scenario and it seems it is not possible to do so from netfilter hooks, however, I'm not sure of it. I thought that it is not working since it has problem with checksums because I'm manipulating packets so I did another experiment to figure this issue out. I just change the packet data and everything worked well. I think checksums don't have any problem since they will be check at NIC while receiving and also same situation while sending so manipulation in between doesn't make anything wrong. I also activate the IPv4 forwarding at the server host(sysctl.config) still nothing changes.

I don't want to create new packet, I only want to alter this packet and send it back. There is another similar question which is creating another packet. Moreover, I'm just thinking why this scenario is not working? But based on the netfilter's architecture it should work.

Thank you

Alireza Sanaee
  • 465
  • 1
  • 7
  • 21
  • Just a guess; try setting `skb->pkt_type = PACKET_OTHERHOST` and `skb->_skb_refdst = 0`. I haven't read through all the routing code but this might take care of it. This may or may not break your routing stack; I have no idea. – Joel C Mar 13 '18 at 01:28
  • @JoelC thank you for your comment, I tried your idea but it didn't work. Just one question where did you check exactly for routing code at kernel?! – Alireza Sanaee Mar 16 '18 at 07:41

1 Answers1

0

I am also working on this, actually kernel validate the source ip address after ip_rcv function in NF_HOOK which check the source ip address. So just try below command:-

sudo sysctl -w "net.ipv4.conf.all.rp_filter=0"

after doing this also disable your interface from which you send and receive packet just like below:-

sudo sysctl -w "net.ipv4.conf.enp2s0.rp_filter=0"
Adil Siddiqui
  • 13
  • 3