为什么系统会自动回复RST报文呢？

先附代码

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 


#define IP_DF        0x4000      /* Flag: "Don't Fragment"   */


//tcp 协议首部
typedef struct tcphdr {
    unsigned short  sport;//源端口号
    unsigned short  dport;//目的端口号
    unsigned int    seq;//32位序列号
    unsigned int    ack_seq;//32位确认号
    unsigned char   len; // 首部长度
    unsigned char   flag; // 标志位
    unsigned short  window; //16位窗口大小
    unsigned short check; //16位校验和
    unsigned short  urg_ptr; //16位紧急指针

}TCPHDR;


//伪首部
typedef struct pseudohdr {
    unsigned int        saddr; //源ip
    unsigned int        daddr; //目的ip
    char                zeros; // 8为保留字节，为0
    char                protocol; //传输层协议号，tcp为6
    unsigned short      length; //16位tcp报文长度(tcp首部 + 数据) 
}PSEUDOHDR;



// ip 协议首部
typedef struct iphdr {
    unsigned char   ver_and_hdrLen; // 版本号和ip头部长度
    unsigned char   tos; // 服务类型
    unsigned short  tot_len; // 总长度(首部和数据之和的长度)
    unsigned short  id; // IP包ID
    unsigned short  frag_off; // 标志位(包括分片偏移量)
    unsigned char   ttl; // 生命周期
    unsigned char   protocol; // 上层协议
    unsigned short  check; // 校验和
    unsigned int    saddr; // 源IP地址
    unsigned int    daddr; // 目标IP地址
}IPHDR;



//生成校验和，tcp校验和的计算包括: 12字节的伪首部 + tcp首部 + tcp数据
unsigned short  checkSum(unsigned short *buffer, unsigned short size)     
{  
    unsigned long cksum = 0;

    while (size > 1) {
        cksum += *buffer++;
        size  -= sizeof(unsigned short);
    }

    if (size) {
        cksum += *(unsigned char *)buffer;
    }

    cksum = (cksum >> 16) + (cksum & 0xffff);
    cksum += (cksum >> 16);     

    return (unsigned short )(~cksum);
}



//ip头部初始化

void initIpHeader(IPHDR *iph, unsigned int saddr, unsigned int daddr)
{
    //syn 包只占用一个标记，不占用实际数据，因此报文中真实数据也就只是tcp首部
    int len = sizeof(IPHDR) + sizeof(TCPHDR);
    iph->ver_and_hdrLen = (4 << 4 | sizeof(IPHDR) / sizeof(unsigned int));
    iph->tos = 0;
    iph->tot_len = htons(len);
    iph->id = htons(1);
    //iph->frag_off = 0x40;
    iph->frag_off = htons(IP_DF);
    iph->ttl      = 255;
    iph->check = 0;
    iph->protocol = IPPROTO_TCP;
    iph->saddr = saddr;
    iph->daddr = daddr;
}


//tcp首部初始化
void initTcpHeader(TCPHDR *tcph, unsigned short sport, unsigned short dport)
{
    tcph->sport = htons(sport);
    tcph->dport = htons(dport);
    tcph->seq = htonl(rand() % 90000000 + 1234 );
    tcph->ack_seq = 0;
    //长度占4位
    tcph->len = (sizeof(TCPHDR)/4 << 4 | 0);
    //设置syn标记，其占第二个bit位
    tcph->flag = 0x02;
    tcph->window = htons(1024);
    tcph->check = 0;
    tcph->urg_ptr = 0;
}

//初始化tcp伪首部
void initPseudoHeader(PSEUDOHDR *phdr, unsigned int srcaddr, unsigned int dstaddr)
{
    phdr->zeros = 0;
    phdr->protocol = IPPROTO_TCP;
    phdr->length = htons(sizeof(struct tcphdr));
    phdr->saddr = srcaddr;
    phdr->daddr = dstaddr;
}


//构建 SYN 包
int createSynPacket(char *packet, int pkt_len, unsigned int saddr, unsigned short sport,
                    unsigned int daddr, unsigned short dport)
{
    char buf[512] = {0};
    int len = 0;
    IPHDR iph;             // IP 头部
    TCPHDR tcph;           // TCP 头部
    PSEUDOHDR pseudoh;     // TCP 伪头部


    memset(&iph, 0, sizeof(iph));
    memset(&tcph, 0, sizeof(tcph));
    memset(&pseudoh, 0, sizeof(pseudoh));

    len = sizeof(iph) + sizeof(tcph);

    // 初始化头部信息
    initIpHeader(&iph, saddr, daddr);
    initTcpHeader(&tcph, sport, dport);
    initPseudoHeader(&pseudoh, saddr, daddr);

    //计算IP校验和
    iph.check = checkSum((u_short *)&iph, sizeof(iph));

    // 计算TCP校验和
    memcpy(buf , &pseudoh, sizeof(pseudoh));           // 复制TCP伪头部
    memcpy(buf + sizeof(pseudoh), &tcph, sizeof(tcph)); // 复制TCP头部
    tcph.check = checkSum((u_short *)buf, sizeof(pseudoh) + sizeof(tcph));

    memset(packet, 0, pkt_len);
    memcpy(packet, &iph, sizeof(iph));
    memcpy(packet + sizeof(iph), &tcph, sizeof(tcph));


    return len;
}


//创建原始套接字
int createRawSocket(unsigned int saddr, unsigned short sport)
{
    int fd;
    int on = 1;
    struct sockaddr_in addr;

    // 创建一个原始套接字, 指定其关注TCP协议
    fd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
    if (fd == -1) {
        return -1;
    }

    addr.sin_family = AF_INET;
    addr.sin_port = htons(sport);
    addr.sin_addr.s_addr = saddr;
    /// 绑定
    int ret = bind(fd, (struct sockaddr*)&addr, sizeof(addr));
    if(-1 == ret)
    {
        printf("bind error\\n");
        return -1;
    }


    // 设置需要手动构建IP头部
    if (setsockopt(fd, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on)) < 0) {
        close(fd);
        return -1;
    }

    return fd;
}


void analyIPPack(IPHDR *ip)
{
    unsigned char *p = (unsigned char*)&ip->saddr;
    printf("Source IP : %u.%u.%u.%u\\n", p[0],p[1],p[2],p[3]);

    p = (unsigned char*)&ip->daddr;
    printf("dest IP : %u.%u.%u.%u\\n", p[0],p[1],p[2],p[3]);

}


void analyTCPPack(TCPHDR *tcp)
{

    printf("Source port : %u\\n", ntohs(tcp->sport));
    printf("Dest port : %u\\n", ntohs(tcp->dport));
    printf("Seq : %u\\n", ntohl(tcp->seq));
    printf("Ack seq : %u\\n", ntohl(tcp->ack_seq));
    printf("flag : %x\\n", tcp->flag);

    return; 
}


//发送SYN包
int sendSynPacket(int sockfd, unsigned int saddr, unsigned short sport,
                         unsigned int daddr, unsigned short dport)
{
    struct sockaddr_in skaddr;
    char packet[256] = {0};
    int pkt_len = 0;

    memset(&skaddr, 0, sizeof(skaddr));

    skaddr.sin_family = AF_INET;
    skaddr.sin_port = htons(dport);
    skaddr.sin_addr.s_addr = daddr;

    pkt_len = createSynPacket(packet, 256, saddr, sport, daddr, dport);

    printf("send syn packet\\n");

    analyIPPack((IPHDR *)packet);
    analyTCPPack((TCPHDR *)(packet + sizeof(IPHDR)));

    return sendto(sockfd, packet, pkt_len, 0, (struct sockaddr *)&skaddr,
                  sizeof(struct sockaddr));
}



int main(int argc, char *argv[])
{
    unsigned int saddr;
    unsigned short sport;
    unsigned int daddr;
    unsigned short dport;
    int sockfd;
    char buf[1024] = {0};
    int len = 0;
    IPHDR * iphd = NULL;
    TCPHDR * tcphd = NULL;

    if (argc < 5) {
        fprintf(stderr, "Usage: syn );
        exit(1);
    }

    saddr = inet_addr(argv[1]);  // 获取源IP
    sport = atoi(argv[2]);       // 获取源端口

    daddr = inet_addr(argv[3]);  // 获取目的IP
    dport = atoi(argv[4]);       // 获取目的端口

    sockfd = createRawSocket(saddr, sport); // 创建原始socket
    if (sockfd == -1) {
        fprintf(stderr, "Failed to make raw socket\\n");
        exit(1);
    }

    if (sendSynPacket(sockfd, saddr, sport, daddr, dport) < 0) { // 发送SYN包
            fprintf(stderr, "Failed to send syn packet\\n");
    }

    while(1)
    {
        len = recv(sockfd, buf, sizeof(buf), 0);
        if(len == -1)
        {
            fprintf(stderr, "recv error %d %s\\n", errno, strerror(errno));
            return 0;
        }
        else if(len == 0)
        {
            continue;
        }
        else 
        {
            break;
        }   
    }

    printf("\\n recv msg len %d \\n", len);

    iphd = (IPHDR *)buf;
    tcphd = (TCPHDR *)(iphd + 1);

    analyIPPack(iphd);

    if(iphd->protocol == IPPROTO_TCP)
    {
        analyTCPPack(tcphd);
    }


    close(sockfd);

    return 0;
}

运行结果：

# ./synack  10.223.12.10 1234  10.223.12.20 4567
send syn packet
Source IP : 10.223.12.10
dest Ip : 10.223.12.20
Source port : 1234
Dest port : 4567
Seq : 4290617
Ack seq : 0
flag : 2

recv msg len 44
Source IP : 10.223.12.20
dest Ip : 10.223.12.10
Source port : 4567
Dest port : 1234
Seq : 1510433077
Ack seq : 4290618
flag : 12

在 10.223.12.20 上抓包结果

# tcpdump -i eth0 port 4567
...

02:03:04.641657 IP 10.223.12.10.dbm > localhost.localdomain.personal-agent: 
Flags [S], seq 4290617, win 1024, length 0

02:03:04.641707 IP localhost.localdomain.personal-agent > 10.223.12.10.dbm: 
Flags [S .], seq 1510433077, ack 4290618, win 29200, options [mss  1460], length 0

02:03:04.641812 IP 10.223.12.10.dbm > localhost.localdomain.personal-agent: 
Flags [R], seq 4290618 win 0, length 0

从结果中可以看到 10.223.12.10 在接收到对端回应的 syn + ack 后，系统会自动给对端回应一个 RST 复位报文，导致二者的链路断开。

为什么系统会自动回复 RST 报文呢？

首先先分析客户端收到对端回应的 syn+ack 会发生什么。

在网络层把数据包发送到传输层时，会调用 ip_local_deliver_finish ，在该函数中会将报文复制一份给 RAW 套接口，然后会继续往下处理，最终会进入到 tcp 的接收函数 tcp_v4_rcv，在该函数中会进行套接字的查找。

int tcp_v4_rcv(struct sk_buff *skb)
{
    ...

    /*从ehash或bhash中根据地址和端口查找传输控制块。
    若在ehash中找到，表示3次握手后已建立起了连接，可以正常通信。
    若在bhash中找到，表示已经绑定了端口，处于监听状态。
    若都找不到，说明对应的传输控制块还没有创建，跳转*/
    sk = __inet_lookup(&tcp_hashinfo, skb->nh.iph->saddr, th->source,
               skb->nh.iph->daddr, th->dest,
               inet_iif(skb));

    if (!sk)
        goto no_tcp_socket;

...

//处理没有创建传输控制块收到的报文情况，通常给对方发送RST段
no_tcp_socket:
    //查找IPSec策略数据库，查找失败跳转
    if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
        goto discard_it;

    /* 检测报文的长度和校验和，若有异常说明报文已损坏，统计后丢弃，
       否则给对端发送rst段后丢弃*/
    if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) {
bad_packet:
        TCP_INC_STATS_BH(TCP_MIB_INERRS);
    } else {
        tcp_v4_send_reset(NULL, skb);
    }

// 丢弃数据包
discard_it:
    /* Discard frame. */
    kfree_skb(skb);
      return 0;

discard_and_relse:
    sock_put(sk);
    goto discard_it;

//处理传输层控制块处于TIME_WAIT状态的情况
do_time_wait:
    ...
}

从上述代码可知，当客户端接收到报文后，先调用 __inet_lookup 查找传输控制块，由于原始套接字没有创建传输控制块，因此会跳到 no_tcp_socket 处发送 RST 报文给对端。

在 TCP 中，对于客户端来讲，当客户端调用 connect 时，会在 hash 表tcp_hashinfo 中加入传输控制块，以便后续接收报文中能够找到对应的套接字。

tcp_v4_connect
   -> inet_hash_connect
      -> __inet_check_established

对于原始套接字，其没有端口号的概念，因此也就不会再hash表中存放传输控制块，收到报文也就找不到对应的socket，所以收到 SYN 报文后，系统会自动给对端恢复 RST 复位报文。

审核编辑：刘清