WinXP SP2的socket限制

最新推荐文章于 2018-06-02 10:05:08 发布

原创最新推荐文章于 2018-06-02 10:05:08 发布 · 1.1k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#socket #sockets #tcp #windows #security #interface

VC 专栏收录该内容

6 篇文章

订阅专栏

本文探讨了在Windows系统中使用RAW套接字时遇到的问题，包括无法通过RAW套接字发送TCP数据，以及无法发送带有无效源地址的UDP数据包。文章详细解释了这些限制的原因及其背后的安全考量。

不能在SOCK_RAW上的socket发送数据包.居然有这样的限制,怪不得总是发送错误呢,现在只好针对TCP和UDP的数据包,分别建立相应的SOCK_STREAM,和SOCK_DGRAM的套接字来发送.

但是出现两个错误:

1.对TCP包,当目的地址为本机地址时, connect出错.(TCP,照例先connect然后用send)

2.对UDP包,当源地址为本机地址时,sendto失败.(因为UDP,不connect了就,就sendto发送)

原因:

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2netwk.mspx#XSLTsection127121120120

找到了这样一段
Restricted traffic over raw sockets
Detailed description

A very small number of Windows applications make use of raw IP sockets, which provide an industry-standard way for applications to create TCP/IP packets with fewer integrity and security checks by the TCP/IP stack. The Windows implementation of TCP/IP still supports receiving traffic on raw IP sockets. However, the ability to send traffic over raw sockets has been restricted in two ways:

• TCP data cannot be sent over raw sockets.

• UDP datagrams with invalid source addresses cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped.

Why is this change important? What threats does it help mitigate?

This change limits the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets, which are TCP/IP packets with a forged source IP address.

大致意思是没法再通过raw socket发送tcp数据了，没法再通过raw socket发送源地址不合法的udp报文了