Most efficient way to manipulate ISN numbers in TC

问题:

I am currently trying to write a program that will be able to create stable a TCP connection and have complete control over the ISN numbers. I've been writing in C and I am at a point where my very limited knowledge has reached its limits and I was wondering if there's a better way of doing it.

What I tried was building the headers manually, using raw sockets to send and recieve the packets without the kernel interfering, which is a challenge.

So regardless of language, what do you reckon is the most efficient and easiest way of manipulating the ISN?

回答1:

Well, ISN is generatred in a random way to prevent ISN perediction attack (http://www.thegeekstuff.com/2012/01/tcp-sequence-number-attacks/).

The Linux Network stack, use the function tcp_v4_init_sequence to generate the ISN (http://lxr.free-electrons.com/source/net/ipv4/tcp_ipv4.c#L101), this function call secure_tcp_sequence_number function (http://lxr.free-electrons.com/source/net/core/secure_seq.c#L106) to do the job. Take a look at this function and try to clone it so can use it with your code from userspace.

If you have enough time you can look at section 3 of the RFC 6528 (http://www.rfc-editor.org/rfc/rfc6528.txt), it describe an algorithm on how to generate ISN:

ISN = M + F(localip, localport, remoteip, remoteport, secretkey)

And try to implement it, if you want :)