Linux accept tcp,Linux TCP accept without SYN|ACK

问题

I'm trying to write a TCP transparent proxy to run on Linux.

I want to, upon receipt of an incoming connection, initiate a corresponding outgoing connection, but only accept (SYN|ACK) the incoming connection if the outgoing connection is successful.

TCP_DEFERRED_ACCEPT doesn't do what I want -- it always sends a SYN|ACK.

The question is: how do I accept TCP connections, but defer the SYN|ACK, with the Linux sockets API?

回答1:

You can do that with Linux, but not via the socket API. You would use the NFQUEUE target which allows you to redirect some packets to userspace and decide their fate from within your program.

Obiously, you'd still have to parse the packet in userspace, but searching for a few TCP flags should not be that hard and not require a complete TCP stack. And this way Linux still does the whole network job.

In your case, it would seem possible that you both use NFQUEUE and classical sockets API. The first will give you early decisions, the latter TCP stream data access. Although I never tried it.

See https://home.regit.org/netfilter-en/using-nfqueue-and-libnetfilter_queue/ for instance.

来源：https://stackoverflow.com/questions/28932015/linux-tcp-accept-without-synack