title: Using socket AF_PACKET / SOCK_RAW but tell kernel to not send RST
body: <p>My question has roughly been discussed <a href="https://stackoverflow.com/questions/31762305/prevent-kernel-from-processing-tcp-segments-bound-to-a-raw-socket">here</a>.</p>
  
  <p>And the tl;dr solution is to do:</p>
  
  <pre><code>iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP
  </code></pre>
  
  <p>And you could modify this to only block the port you're actively listening after.<br>
  But as mentioned in the above question, and <a href="https://stackoverflow.com/questions/33741002/hping-send-syn-how-not-to-send-rst-after-receiving-syn-ack">here</a>, these are not elegant solutions.</p>
  
  <p>Now, I don't really care about the elegance of things.<br>
  But I do care about learning. So I've dug deep into the Linux source code <em>(mostly interested in Linux based machines for now)</em> and sorted through what I think is the <a href="https://elixir.bootlin.com/linux/v4.2/source/net/socket.c#L1369" rel="nofollow noreferrer">socket.bind</a> method in order to find anything related to instructing the kernel that "we" are actively monitoring a TCP port.</p>
  
  <p>I assumed that the socket library informed the kernel some how about a specific port being bound to a application, this so that the kernel don't automatically respond with a <code>RST</code> packet to the client connecting, prompting a <em>"Connection refused"</em>.</p>
  
  <p>However, I find no such code in the source code.<br>
  Nor does the <a href="http://man7.org/linux/man-pages/man7/packet.7.html" rel="nofollow noreferrer">packet</a> man page tell me anything about how to inform the kernel to ignore/accept packets coming in on a specific port.</p>
  
  <p>I've got a pretty <a href="https://github.com/Torxed/Scripts/blob/master/python/Laboratory/switch.py" rel="nofollow noreferrer">basic socket</a> set up to listen with promiscuous mode <em>(that is a tale of it's own)</em>.</p>
  
  <p>However, my problem is that as soon as a client connects, on any given port - the kernel sends the incoming <code>Ethernet+IP+TCP</code> data frame my way as expected - but it also instantly sends out a response with "reversed" source and destination ports and the <code>RST</code> flag set. Which it should, but not on a specific port I tell it to. Problem is, how do I tell the kernel I'm monitoring a specific port?</p>
  
  <p>One option would be to <em>(as discussed in some other forums and on other various SO threads)</em> - create a dummy socket on that port.</p>
  
  <pre><code>s = socket()
  s.bind(('', &lt;port&gt;))
  </code></pre>
  
  <p>However, that causes a bunch of other problems <em>(one of which is that this will have a buffer that will quickly be filled)</em> and most importantly, still doesn't teach me how all this magic happens. The two above solutions are last resort if there's no other ways, but I feel I'm closer than ever yet more stuck than ever too in finding a proper solution to this problem.</p>
  
  <p>The solution or tips could be in <strong>C as well</strong>, and/<strong>or a kernel module</strong> just for the sake of instructing the kernel of the needed information. I knew all this was going down in the kernel, and after the comments below and a much appreciate solution idea, I now get that there's no userspace function for this very thing. I could probably/easily port it to a cPython module or warp it around to Python code easily enough with a kernel module/extension. But I really have no idea where the kernel functions for setting these things are, or what they are called.</p>
  
  <p>I've dug deep, far and shallow.. But it doesn't appear anyone else has had the need to do this. Mostly because a promiscuous socket is meant to pick up traffic and analyze it. But also the <code>.bind((interface, protocol))</code> is out there and it faces the same issue, a way of not going into promiscuous mode but instead just receive TCP packets for instance by doing <code>.bind((interface, 0x0800))</code>.</p>
  
  <p>I might be out on a limb here, but maybe <code>man 7 netdevice</code> just gave me an idea. I'm trying to setup <a href="https://wiki.archlinux.org/index.php/SystemTap" rel="nofollow noreferrer">SystemTap</a> to check what calls <code>ioctl()</code> does and how <code>socket()</code> object asks for a file descriptor. Might be a clue as to how this all goes down. Tricky getting SystemTap to work tho.</p>
  
  <p>Anyone have any other clues how to go about this problem or have bumped into this before?</p>
  
  <p>Ps. Sorry for a fuzzy question, I have no idea what the correct terminology is for these lower level things. As they are quite new to me.</p>
  
  <p>Edit: I might have been looking in the wrong place for <code>bind()</code>, according to the <a href="https://elixir.bootlin.com/linux/v4.13/source/net/ipv4/af_inet.c#L431" rel="nofollow noreferrer">ipv4.af_inet</a> implementation it will try to call the sockets <code>bind()</code> function, but if not, it will try to setup a lot of magic in here. And <a href="https://elixir.bootlin.com/linux/v4.13/source/net/ipv4/raw.c#L703" rel="nofollow noreferrer">here</a> they clank down on <code>af_inet</code> and does a lot of table junk.. I still haven't found a solution, but a step on the way perhaps... Or worst case, another goose hunt.</p>
  
  <p>Going further down the rabbit hole, <a href="https://github.com/torvalds/linux/blob/6363b3f3ac5be096d08c8c504128befa0c033529/security/selinux/hooks.c#L4409" rel="nofollow noreferrer">selinux/hooks.c</a> contains some bind functionality as well. Maybe more security related, but still worth my investigation. Still no where near solving this darn riddle.</p>