Windows(Win32)下TCP/IP互联网层操作与自定义TCP协议技术问询

Hey there! Reimplementing TCP from scratch on Windows is no small feat—props for diving into this deep dive. Let's tackle each of your questions with practical, Windows-specific details:

1. Accessing Internet Layer Libraries on Windows #

Windows provides two primary API sets for interacting with the internet layer:

• Winsock 2: The core networking API that lets you work with sockets, including raw sockets for low-level IP/TCP operations. You'll need to link against Ws2_32.lib and include headers like winsock2.h and ws2tcpip.h.
• IP Helper API: For querying and managing network configuration (like IP addresses, routing tables, and interfaces). Include iphlpapi.h and link against Iphlpapi.lib.

Quick Setup in Visual Studio: #

• Add Ws2_32.lib and Iphlpapi.lib to your project's Additional Dependencies (under Linker > Input).
• Include the required headers at the top of your code:

  #include <winsock2.h>
  #include <ws2tcpip.h>
  #include <iphlpapi.h>
  

• Initialize Winsock before using any functions with WSAStartup().

2. Integrating Other RFC Standards into Your TCP Implementation #

TCP is built on a foundation of RFCs, and extending it with additional standards involves implementing specific options and behaviors. Here's how to approach it:

• Start with the base: RFC 793 is the original TCP specification—make sure your core implementation (handshake, sequencing, flow control, retransmissions) aligns with this first.
• Add optional features via TCP options:
  • RFC 1323 (Window Scaling & Timestamps): Add window scaling options in SYN/SYN-ACK packets to support larger window sizes, and timestamps to improve RTT calculation and prevent sequence number wrap-around.
  • RFC 2018 (Selective Acknowledgments - SACK): Implement SACK options to let receivers acknowledge non-consecutive segments, reducing unnecessary retransmissions. You'll need to parse SACK blocks from incoming packets and adjust your retransmission queue accordingly.
  • RFC 6528 (TCP Option Registry): Refer to this for all valid TCP option codes and formats to ensure your option handling is compliant.
• Validate with tools: Use Wireshark to capture your custom TCP packets and verify that options are correctly formatted and behaviors match the RFC requirements. For example, check that window scaling factors are negotiated properly during the handshake.

3. Directly Manipulating the TCP/IP Internet Layer on Win32 #

To work directly with IP/TCP packets (bypassing the OS's TCP stack), you have two main approaches:

Raw Sockets #

Raw sockets let you construct and send custom IP and TCP headers directly. Note that Windows imposes restrictions (e.g., requires admin privileges, limits on forging source IPs post-Windows XP SP2).

Example Code Snippet for Raw Socket Setup:

#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdio.h>

#pragma comment(lib, "Ws2_32.lib")

int main() {
    WSADATA wsaData;
    if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) {
        printf("WSAStartup failed: %d\n", WSAGetLastError());
        return 1;
    }

    // Create raw socket for TCP
    SOCKET rawSock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
    if (rawSock == INVALID_SOCKET) {
        printf("Raw socket creation failed: %d\n", WSAGetLastError());
        WSACleanup();
        return 1;
    }

    // Enable IP header inclusion (we'll construct our own IP header)
    int optVal = 1;
    if (setsockopt(rawSock, IPPROTO_IP, IP_HDRINCL, (char*)&optVal, sizeof(optVal)) == SOCKET_ERROR) {
        printf("setsockopt IP_HDRINCL failed: %d\n", WSAGetLastError());
        closesocket(rawSock);
        WSACleanup();
        return 1;
    }

    // From here, you'll construct your custom IP and TCP headers:
    // - Fill IP header fields (version, IHL, total length, protocol=6 for TCP, checksum)
    // - Fill TCP header fields (src/dst ports, sequence/ack numbers, flags, window size, checksum)
    // - Use htons()/htonl() to convert values to network byte order
    // - Send with sendto() to your target address

    closesocket(rawSock);
    WSACleanup();
    return 0;
}

Windows Filtering Platform (WFP) or NDIS Drivers #

For more advanced operations (like intercepting or modifying existing packets), use WFP (user-mode) or NDIS (kernel-mode) drivers:

• WFP: Lets you hook into network stack layers to filter, inspect, or modify packets without writing a full driver. Use the fwpm* functions from fwpmu.h.
• NDIS Drivers: For kernel-level access to the network adapter. This requires the Windows Driver Kit (WDK) and is more complex, but gives full control over packet processing.

Key Notes: #

• Always run your application with administrator privileges—raw sockets and WFP operations require elevated rights.
• Calculate checksums correctly: IP header checksums and TCP checksums (which include a pseudo-header with IP source/dest addresses) are mandatory for packets to be processed correctly by network devices.
• Handle network byte order: Windows uses little-endian, while the network uses big-endian—use htons() for 16-bit values and htonl() for 32-bit values.

内容的提问来源于stack exchange，提问作者hiostreas unkown