DPDK usage discussions
 help / color / mirror / Atom feed
From: Stephen Hemminger <stephen@networkplumber.org>
To: Konstantinos Schoinas <ece8537@upnet.gr>
Cc: users@dpdk.org
Subject: Re: [dpdk-users] Sequence Number /More info on the Subject
Date: Wed, 15 Aug 2018 07:52:06 -0700	[thread overview]
Message-ID: <20180815075206.72e6b45d@xeon-e3> (raw)
In-Reply-To: <b92bb27254547759f874adbb7dffe1a0@upnet.gr>

On Wed, 15 Aug 2018 17:17:48 +0300
Konstantinos Schoinas <ece8537@upnet.gr> wrote:

> Στις 2018-08-15 12:22, Konstantinos Schoinas έγραψε:
> > -------- Αρχικό μήνυμα --------
> > Θέμα: Sequence Number
> > Ημερομηνία: 2018-08-15 12:21
> > Αποστολέας: Konstantinos Schoinas <ece8537@upnet.gr>
> > Παραλήπτης: users <users-bounces@dpdk.org>
> > 
> > Hello,
> > 
> > I am building an application blocks TLS session if i find a sepcific
> > forbidden Server Name Indication.
> > According to RFC i must make a response with Fatal Error (2)
> > unrecognized name(112).
> > 
> > When i receive the Client Hello and after i Extract the SNI and check
> > it against a black list i do process the client hello in order to
> > response to client and terminate the session.
> > 
> > Although i am getting a lot of retransmit packets on wireshark so i
> > suppose i am doing something wrong.
> > 
> > I think i mights have seq and ack number wrong or something.If anyone
> > could help i would appreciate.
> > Here is the process of the packet after i check for the forbidden SNI:
> > 
> > uint32_t client_receive_ack = ntohl(th-⁠>recv_ack);
> > uint32_t client_send_seq = ntohl(th-⁠>sent_seq);
> > 
> > th-⁠>sent_seq = th-⁠>recv_ack;
> > th-⁠>recv_ack = htonl(client_send_seq + ntohs(iphdr-⁠>total_length));
> > 
> > 
> > uint16_t l = ntohs(ssl-⁠>length)-⁠0x02;
> > uint16_t ip_l = ntohs(iphdr-⁠>total_length) -⁠ l;
> > 
> > rte_pktmbuf_trim(m,l);
> > iphdr-⁠>total_length = htons(ip_l);
> > ssl-⁠>length = htons(2);
> > 
> > alert = (struct Alert *)((uint8_t *)ssl + 5);
> > 
> > 
> > iphdr-⁠>src_addr = dst_ip;
> > iphdr-⁠>dst_addr = src_ip;
> > th-⁠>src_port = dst_port;
> > th-⁠>dst_port = src_port;
> > ssl-⁠>type = 21; //alert message
> > alert-⁠>type = 2; // fatal error
> > alert-⁠>description = 112; // Unrecognized name
> > 
> > iphdr-⁠>hdr_checksum = 0;
> > th-⁠>cksum = 0;
> > iphdr-⁠>hdr_checksum = rte_ipv4_cksum(iphdr);
> > 
> > th-⁠>cksum = rte_ipv4_udptcp_cksum(iphdr,th);
> > 
> > 
> > 
> > 
> > Thanks for your time  
> 
> 
> 
> 
> I wanted to give some more information on the subject.I am adding a 
> picture of wireshark with the mail to give more info.The problem of the 
> retransmitted packet is that it doesnt end the TLS session even though i 
> am sending a fatal-error alert with dpdk.
> 
> I believe that i do something wrong with the process of client hello so 
> it doesnt have the right format in order to get recognized by the client 
> and end the tls Session.
> 
> If you see my code above i change the source ,dest ip and port the seq 
> and ack value.In addition i am cutting from SSL Record the data that it 
> had and i am adding the alert message according to RFC.
> 
> Is there any field i must change according to dpdk?
> 
> 
> 
> 

With wireshark, the easiest thing to attach is a pcap file with the flow
in question.

  reply	other threads:[~2018-08-15 14:52 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <259d01f7a94e1c4eadf9e57fe89be7cc@upnet.gr>
2018-08-15  9:22 ` [dpdk-users] Sequence Number Konstantinos Schoinas
2018-08-15 14:17   ` [dpdk-users] Sequence Number /More info on the Subject Konstantinos Schoinas
2018-08-15 14:52     ` Stephen Hemminger [this message]
2018-08-15 15:02     ` Shyam Shrivastav

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180815075206.72e6b45d@xeon-e3 \
    --to=stephen@networkplumber.org \
    --cc=ece8537@upnet.gr \
    --cc=users@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).