2

我是网络编程的新手。在过去的几天里，我正在学习这一点。今天我试着玩原始套接字。一切顺利。但是 Ip 校验和并没有很好地帮助我。无论我手动给 iph->check 的值是多少，但在接收校验和时会有所不同。

实际上我所做的是我创建了一个原始套接字 C 程序，它将创建一个使用原始套接字发送到环回接口的 TCP 数据包。我用wireshark捕获了数据包。但是当我解释接收到的数据包时，我发现无论我在程序中为校验和提供什么值，它都会显示一些不同的常数值。

这是我的代码

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <errno.h>
//#include <linux/in.h>

unsigned short calculate_check_sum (unsigned short *buf, int nwords) {
unsigned long sum;
for (sum = 0; nwords > 0; nwords--) {
    sum += *buf++;
}
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
return ~sum;
}

int main () {
int sockfd = socket (PF_INET, SOCK_RAW, 6);
if (sockfd < 0) {
    perror ("socket failed: ");
    return -1;
}
char packet[4096];

struct iphdr *iph = (struct iphdr *) packet;
struct tcphdr *tcph = (struct tcphdr *) packet + sizeof (struct iphdr);
//char *payload = packet + sizeof (struct iphdr) + sizeof (struct tcphdr);

memset (packet, 0, 4096);

//strcpy (payload, "helllo");

struct sockaddr_in sin;
sin.sin_family = AF_INET;
sin.sin_port = htons (1330);
inet_pton (AF_INET, "127.0.0.1", &(sin.sin_addr));

/* TESTING
char var[123];
inet_ntop (AF_INET, &(sin.sin_addr), var, INET_ADDRSTRLEN);
printf ("%s\n", var);
*/

//WRITING ON IP HEADER
iph->ihl = 5;
iph->version = 4;
iph->tos = 0;
iph->tot_len = sizeof (struct iphdr) + sizeof (struct tcphdr); //+ strlen (payload);
iph->id = htons (1234);
iph->frag_off = 0;
iph->ttl = 225;
iph->protocol = 6;
iph->check = 0;
iph->saddr = inet_addr ("43.88.80.72");
iph->daddr = sin.sin_addr.s_addr;

//WRITING TCP HEADER
tcph->source = htons (1234);
tcph->dest = htons (1330);
tcph->seq = random ();
tcph->ack_seq = 0;
tcph->res1 = 0;
tcph->doff = 0;
tcph->syn = 1;
tcph->window = htons (1000);
tcph->check = 0;
tcph->urg_ptr = 0;

//CALCULATE CHECK SUM AND PUT IN THEIR PLACES
//iph->check = calculate_check_sum ((unsigned short *) packet, iph->tot_len >> 1);
iph->check = 0xffff;

int one = 1;
if (setsockopt (sockfd, 0, IP_HDRINCL, &one, sizeof (one)) < 0) {
    perror ("setsockopt faild: ");
    return -1;
}

int ret = sendto (sockfd, packet, iph->tot_len, 0, (struct sockaddr *) &sin, sizeof (sin));
if (ret < 0) {
    perror ("sendto failed: ");
    return -1;
}
return 0;
}

这是wireshark 000000000000000000000000008004500002804d20000e106*da5c*2b5850487f0000010000000000000000000000000000000000000000 捕获的流

这里的 5cda（在 astrics 之间）是我得到的校验和。

另外，我创建了自己的捕获程序，而不是wireshark，如下所示，

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <netinet/tcp.h>
#include <netinet/ip.h>
#include <string.h>
#include <errno.h>

int main () {
int fd = socket (PF_INET, SOCK_RAW, 6);
int len_msg;
if (fd < 0)
    perror ("socket failed: ");
char buf [8192];
memset (buf, 0, 8192);
struct sockaddr_in sock_addr;
inet_pton (AF_INET, "127.0.0.1", &(sock_addr.sin_addr));
int len = sizeof (struct sockaddr);
printf ("%s\n",inet_ntoa(sock_addr.sin_addr.s_addr));
if (bind (fd, (struct sockaddr *) &sock_addr, len)) {
    perror ("bind failed: ");
    return -1;
}
while ((len_msg = recvfrom (fd, buf, 8192, 0, (struct sockaddr *) &sock_addr, (socklen_t *)&len)) != -1) {
    //printf ("%s\n", buf+sizeof(struct iphdr)+sizeof(struct tcphdr));
    //printf ("%s\n", buf);
    int i;
    printf ("%d\n", len_msg);
    for (i = 0; i < len_msg; i += 1)
        printf ("%x ", (unsigned char) *(buf + i));
    printf ("\n");

    printf ("*****************************************\n");
    struct iphdr *iph = (struct iphdr *) buf;
    printf ("checksum: %x\n", iph->check);
    break;
}
printf ("%s\n",inet_ntoa(sock_addr.sin_addr.s_addr));
return 0;
}

我仍然得到相同的支票价值。无论我在第一个程序中输入什么值，作为校验和，捕获的数据包只有值 0x5cda 作为其校验和。

我正在使用 CentOS。内核本身是否会对我的数据包进行任何更改？请帮我。

提前致谢

4

1 回答 1

2

根据您的描述，您似乎在发送代码中放入了虚假的 IP 校验和。根据 RFC 1122，这是无效的。我怀疑 Linux 原始套接字处理代码更宽松，并且会接受具有无效 IP 校验和的数据包将覆盖您的校验和。

看一眼：

http://lxr.linux.no/linux+v3.4.1/net/ipv4/raw.c#L458 （当您发送消息时会调用它）

于 2012-06-10T11:38:58.000 回答