ewust / forge_socket Goto Github PK

make
make -C /lib/modules/2.6.32-504.el6.x86_64/build M=/home/zmap/forge_socket modules
make: *** /lib/modules/2.6.32-504.el6.x86_64/build: not found file or directory 。stop。
make: *** [all] error 2
what is wrong? please help. my os is centos6.5

this is using forge_socket as part of zmap:

prereq: kernel >=3.9
executing make in zmap/forge_socket/
raises errors, as zmap/forge_socket/forge_socket.c
includes these lines:
tp->bytes_acked = 0;
tp->frto_counter = 0;
tp->frto_highmark = 0;

frto_counter, frto_highmark and bytes_acked
have been removed from struct tcp_sock in include/linux/tcp.h
git.kernel.org:
commit 9b44190dc and commit ca2eb5679

when kernel 2.6.32-573,

#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33)
                __inet_hash_nolisten(sk);
#else
                __inet_hash_nolisten(sk, NULL);
#endif

should use __inet_hash_nolisten(sk, NULL)

A server has a default interface (eth0 10.0.0.5/24 with default gw 10.0.0.1), and a tap interface (eth1 192.168.0.5/24 with no gw) which is receiving traffic on a mirror port from a switch.

The server observes a flow on the tap interface, and decides to interject itself using forge_socket, and creates the requisite flows. If the server sends data through this forge_socket, the packets will leave eth0 (the default route) with correct IP/TCP parameters. However, any ACKs or responses that come back for this socket will arrive on eth1, the tap interface, for a MAC address that does not belong to either of our interfaces.

Disabling rp_filter, and/or enabling ip_forward do not seem to solve this problem, nor does setting eth1's MAC address to the expected value.

Hi,

I believe that most (if not all) options that can be queried and set using the interface provided by forge_socket are exposed by the TCP_REPAIR feature that was introduced in Linux 3.5 and extended to support inspecting/setting window parameters in Linux 4.8. Documentation is sparse, but there is a good overview of the feature in https://lwn.net/Articles/495304/. I have successfully used TCP_REPAIR for handing off TCP connections from zmap to a custom scan process.

Cheers,
-Hilko