TCP协议笔记-01

 1package main                                                                 
 2                                                                             
 3import (                                                                     
 4        "context"                                                            
 5        "log"                                                                
 6        "net"                                                                
 7        "time"
 8        "fmt"                                                               
 9)                                                                            
10                                                                             
11func main() {                                                                
12        var d net.Dialer                                                     
13        ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
14        defer cancel()                                                       
15                                                                             
16        conn, err := d.DialContext(ctx, "tcp", "localhost:12345")            
17        if err != nil {                                                      
18                log.Fatalf("Failed to dial: %v", err)                        
19        }                                                                    
20        defer conn.Close()                                                   
21        fmt.Println("conn established: ", conn)                                                                     
22        if _, err := conn.Write([]byte("Hello, World!")); err != nil {       
23                log.Fatal(err)                                               
24        }                                                                    
25        reply := make([]byte, 512)                                           
26        n, err := conn.Read(reply)                                           
27        if err != nil {                                                      
28                log.Fatal(err)                                               
29        }                                                                    
30        log.Printf("received %q (%d bytes)\n", string(reply[:n]), n)         
31}     

 1package main                                                       
 2                                                                   
 3import (                                                           
 4        "io"                                                       
 5        "log"                                                      
 6        "net"
 7        "fmt"                                                      
 8)                                                                  
 9                                                                   
10func main() {                                                      
11        // Listen on TCP port 12345 on all available unicast and   
12        // anycast IP addresses of the local system.               
13        l, err := net.Listen("tcp", ":12345")                      
14        if err != nil {                                            
15                log.Fatal(err)                                     
16        }                                                          
17        defer l.Close()                                            
18        for {                                                      
19                // Wait for a connection.                          
20                conn, err := l.Accept()                            
21                if err != nil {                                    
22                        log.Fatal(err)                             
23                }
24                fmt.Println("new conn: ", conn)                                                  
25                // Handle the connection in a new goroutine.       
26                // The loop then returns to accepting, so that     
27                // multiple connections may be served concurrently.
28                go func(c net.Conn) {                              
29                        // Echo all incoming data.                 
30                        io.Copy(c, c)                     
31                        fmt.Println("close conn: ", conn)         
32                        // Shut down the connection.               
33                        c.Close()                                  
34                }(conn)                                            
35        }                                                          
36}                                                                  

 1// CloseRead shuts down the reading side of the TCP connection.
 2// Most callers should just use Close.
 3func (c *TCPConn) CloseRead() error {
 4	if !c.ok() {
 5		return syscall.EINVAL
 6	}
 7	if err := c.fd.closeRead(); err != nil {
 8		return &OpError{Op: "close", Net: c.fd.net, Source: c.fd.laddr, Addr: c.fd.raddr, Err: err}
 9	}
10	return nil
11}
12
13// CloseWrite shuts down the writing side of the TCP connection.
14// Most callers should just use Close.
15func (c *TCPConn) CloseWrite() error {
16	if !c.ok() {
17		return syscall.EINVAL
18	}
19	if err := c.fd.closeWrite(); err != nil {
20		return &OpError{Op: "close", Net: c.fd.net, Source: c.fd.laddr, Addr: c.fd.raddr, Err: err}
21	}
22	return nil
23}
24/ SetLinger sets the behavior of Close on a connection which still
25// has data waiting to be sent or to be acknowledged.
26//
27// If sec < 0 (the default), the operating system finishes sending the
28// data in the background.
29//
30// If sec == 0, the operating system discards any unsent or
31// unacknowledged data.
32//
33// If sec > 0, the data is sent in the background as with sec < 0. On
34// some operating systems after sec seconds have elapsed any remaining
35// unsent data may be discarded.
36func (c *TCPConn) SetLinger(sec int) error {
37	if !c.ok() {
38		return syscall.EINVAL
39	}
40	if err := setLinger(c.fd, sec); err != nil {
41		return &OpError{Op: "set", Net: c.fd.net, Source: c.fd.laddr, Addr: c.fd.raddr, Err: err}
42	}
43	return nil
44}
45
46// SetKeepAlive sets whether the operating system should send
47// keep-alive messages on the connection.
48func (c *TCPConn) SetKeepAlive(keepalive bool) error {
49	if !c.ok() {
50		return syscall.EINVAL
51	}
52	if err := setKeepAlive(c.fd, keepalive); err != nil {
53		return &OpError{Op: "set", Net: c.fd.net, Source: c.fd.laddr, Addr: c.fd.raddr, Err: err}
54	}
55	return nil
56}
57
58// SetKeepAlivePeriod sets period between keep-alives.
59func (c *TCPConn) SetKeepAlivePeriod(d time.Duration) error {
60	if !c.ok() {
61		return syscall.EINVAL
62	}
63	if err := setKeepAlivePeriod(c.fd, d); err != nil {
64		return &OpError{Op: "set", Net: c.fd.net, Source: c.fd.laddr, Addr: c.fd.raddr, Err: err}
65	}
66	return nil
67}
68
69// SetNoDelay controls whether the operating system should delay
70// packet transmission in hopes of sending fewer packets (Nagle's
71// algorithm).  The default is true (no delay), meaning that data is
72// sent as soon as possible after a Write.
73func (c *TCPConn) SetNoDelay(noDelay bool) error {
74	if !c.ok() {
75		return syscall.EINVAL
76	}
77	if err := setNoDelay(c.fd, noDelay); err != nil {
78		return &OpError{Op: "set", Net: c.fd.net, Source: c.fd.laddr, Addr: c.fd.raddr, Err: err}
79	}
80	return nil
81}

1sysctl net.ipv4.tcp_syn_retries
2cat /proc/sys/net/ipv4/tcp_syn_retries

1sysctl net.ipv4.tcp_synack_retries
2cat /proc/sys/net/ipv4/tcp_synack_retries

1sysctl net.ipv4.tcp_max_syn_backlog
2cat /proc/sys/net/ipv4/tcp_max_syn_backlog

1iptables -A OUTPUT -p tcp --tcp-flags ALL ACK --dport 12345 -j DROP

1iptables -A OUTPUT -p tcp --tcp-flags ALL PSH,ACK --dport 12345 -j DROP

1iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED --tcp-flags ALL FIN,ACK --dport 12345 -j DROP

1iptables -A OUTPUT -p tcp -m state --state RELATED,ESTABLISHED --tcp-flags ALL ACK --sport 12345 -j DROP
2iptables -A OUTPUT -p tcp -m state --state RELATED,ESTABLISHED --tcp-flags ALL FIN,ACK --sport 12345 -j DROP

1iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED --tcp-flags ALL FIN --sport 12345 -j DROP
2iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED --tcp-flags ALL FIN,ACK --sport 12345 -j DROP

 1/*
 2 * Sender's congestion state indicating normal or abnormal situations
 3 * in the last round of packets sent. The state is driven by the ACK
 4 * information and timer events.
 5 */
 6enum tcp_ca_state {
 7	/*
 8	 * Nothing bad has been observed recently.
 9	 * No apparent reordering, packet loss, or ECN marks.
10	 */
11	TCP_CA_Open = 0,
12#define TCPF_CA_Open	(1<<TCP_CA_Open)
13	/*
14	 * The sender enters disordered state when it has received DUPACKs or
15	 * SACKs in the last round of packets sent. This could be due to packet
16	 * loss or reordering but needs further information to confirm packets
17	 * have been lost.
18	 */
19	TCP_CA_Disorder = 1,
20#define TCPF_CA_Disorder (1<<TCP_CA_Disorder)
21	/*
22	 * The sender enters Congestion Window Reduction (CWR) state when it
23	 * has received ACKs with ECN-ECE marks, or has experienced congestion
24	 * or packet discard on the sender host (e.g. qdisc).
25	 */
26	TCP_CA_CWR = 2,
27#define TCPF_CA_CWR	(1<<TCP_CA_CWR)
28	/*
29	 * The sender is in fast recovery and retransmitting lost packets,
30	 * typically triggered by ACK events.
31	 */
32	TCP_CA_Recovery = 3,
33#define TCPF_CA_Recovery (1<<TCP_CA_Recovery)
34	/*
35	 * The sender is in loss recovery triggered by retransmission timeout.
36	 */
37	TCP_CA_Loss = 4
38#define TCPF_CA_Loss	(1<<TCP_CA_Loss)
39};

 1static struct tcp_congestion_ops tcp_bbr_cong_ops __read_mostly = {
 2	.flags		= TCP_CONG_NON_RESTRICTED,
 3	.name		= "bbr",
 4	.owner		= THIS_MODULE,
 5	.init		= bbr_init,
 6	.cong_control	= bbr_main,
 7	.sndbuf_expand	= bbr_sndbuf_expand,
 8	.undo_cwnd	= bbr_undo_cwnd,
 9	.cwnd_event	= bbr_cwnd_event,
10	.ssthresh	= bbr_ssthresh,
11	.min_tso_segs	= bbr_min_tso_segs,
12	.get_info	= bbr_get_info,
13	.set_state	= bbr_set_state,
14};
15
16static int __init bbr_register(void)
17{
18	BUILD_BUG_ON(sizeof(struct bbr) > ICSK_CA_PRIV_SIZE);
19	return tcp_register_congestion_control(&tcp_bbr_cong_ops);
20}
21
22static void __exit bbr_unregister(void)
23{
24	tcp_unregister_congestion_control(&tcp_bbr_cong_ops);
25}
26
27module_init(bbr_register);
28module_exit(bbr_unregister);

 1/*
 2 * Attach new congestion control algorithm to the list
 3 * of available options.
 4 */
 5int tcp_register_congestion_control(struct tcp_congestion_ops *ca)
 6{
 7	int ret = 0;
 8
 9	/* all algorithms must implement these */
10	if (!ca->ssthresh || !ca->undo_cwnd ||
11	    !(ca->cong_avoid || ca->cong_control)) {
12		pr_err("%s does not implement required ops\n", ca->name);
13		return -EINVAL;
14	}
15
16	ca->key = jhash(ca->name, sizeof(ca->name), strlen(ca->name));
17
18	spin_lock(&tcp_cong_list_lock);
19	if (ca->key == TCP_CA_UNSPEC || tcp_ca_find_key(ca->key)) {
20		pr_notice("%s already registered or non-unique key\n",
21			  ca->name);
22		ret = -EEXIST;
23	} else {
24		list_add_tail_rcu(&ca->list, &tcp_cong_list);
25		pr_debug("%s registered\n", ca->name);
26	}
27	spin_unlock(&tcp_cong_list_lock);
28
29	return ret;
30}

 1static void bbr_main(struct sock *sk, const struct rate_sample *rs)
 2{
 3	struct bbr *bbr = inet_csk_ca(sk);
 4	u32 bw;
 5
 6	bbr_update_model(sk, rs);
 7
 8	bw = bbr_bw(sk);
 9	bbr_set_pacing_rate(sk, bw, bbr->pacing_gain);
10	bbr_set_cwnd(sk, rs, rs->acked_sacked, bw, bbr->cwnd_gain);
11}

 1/* The "ultimate" congestion control function that aims to replace the rigid
 2 * cwnd increase and decrease control (tcp_cong_avoid,tcp_*cwnd_reduction).
 3 * It's called toward the end of processing an ACK with precise rate
 4 * information. All transmission or retransmission are delayed afterwards.
 5 */
 6static void tcp_cong_control(struct sock *sk, u32 ack, u32 acked_sacked,
 7			     int flag, const struct rate_sample *rs)
 8{
 9	const struct inet_connection_sock *icsk = inet_csk(sk);
10
11	if (icsk->icsk_ca_ops->cong_control) {
12		icsk->icsk_ca_ops->cong_control(sk, rs);
13		return;
14	}
15
16	if (tcp_in_cwnd_reduction(sk)) {
17		/* Reduce cwnd if state mandates */
18		tcp_cwnd_reduction(sk, acked_sacked, flag);
19	} else if (tcp_may_raise_cwnd(sk, flag)) {
20		/* Advance cwnd if state allows */
21		tcp_cong_avoid(sk, ack, acked_sacked);
22	}
23	tcp_update_pacing_rate(sk);
24}

1iptables -t filter -A INPUT -p tcp --dport 443
2iptables -t filter -A OUTPUT -p tcp --sport 443

1iptables -n -v -L -t filter

 1Chain INPUT (policy ACCEPT 195K packets, 145M bytes)
 2 pkts bytes target     prot opt in     out     source               destination
 3 2365  118K            tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
 4
 5Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 6 pkts bytes target     prot opt in     out     source               destination
 7
 8Chain OUTPUT (policy ACCEPT 1426K packets, 4834M bytes)
 9 pkts bytes target     prot opt in     out     source               destination
10 2076   20M            tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:443