TCP fingerprint simulation method and device based on eBPF, equipment and medium

Abstract

The invention provides a TCP fingerprint simulation method and device based on an eBPF, equipment and a medium. The method comprises the steps that calling of a tcpconnect kernel function is tracked through kprobe of the eBPF; if calling exists, the TC of the eBPF is used for capturing a TCP data packet which is about to be sent out; analyzing the TCP data packet to obtain an SYN message, obtaining a corresponding original fingerprint, and replacing the original fingerprint with a simulation fingerprint of a prefabricated template; the checksum of the TCP data packet is recalculated, then a new TCP data packet is assembled, and the new TCP data packet is sent out; tCP fingerprint simulation is rapidly carried out, so that the simulation efficiency is improved, and normal TCP connection is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, and in particular to a TCP fingerprint simulation method and device based on eBPF, equipment and medium. BACKGROUND

[0002] In network security and protocol analysis, TCP fingerprint simulation is a technique that identifies network devices or operating systems by analyzing specific characteristics of the TCP / IP protocol. These characteristics include, but are not limited to, the initial sequence number (ISN) of a TCP connection, window size, MSS (maximum segment size), etc. By simulating these characteristics, security researchers and system administrators can identify specific devices or operating system types in the network, which is very useful for network diagnosis, vulnerability scanning, or intrusion detection scenarios.

[0003] Basic principles of TCP fingerprint simulation

[0004] Initial Sequence Number (ISN): Each TCP connection has a unique initial sequence number. Different operating systems and devices may use different algorithms to generate ISN. For example, the ISN generated by Linux and Windows systems may be different.

[0005] Window Size: The TCP window size reflects the size of the receiving buffer. Different operating systems and network devices may have different default window size settings.

[0006] Maximum Segment Size (MSS): MSS refers to the maximum amount of data that can be carried by each TCP segment in a TCP connection. Different network devices and operating systems may have different default MSS values.

[0007] The existing TCP fingerprint simulation is slow and requires high hardware performance requirements. Otherwise, during the TCP fingerprint simulation process, the speed is too slow, resulting in TCP connection failure. SUMMARY

[0008] The technical problem to be solved by the present application is to provide a TCP fingerprint simulation method, device, equipment and medium based on eBPF, which can quickly simulate TCP fingerprint and improve simulation efficiency to ensure normal TCP connection.

[0009] In a first aspect, the present application provides a TCP fingerprint simulation method based on eBPF, comprising the following steps:

[0010] Step 1: Track the call of the tcp_connect kernel function through eBPF kprobe;

[0011] Step 2, if there is a call, use eBPF TC to capture the TCP packet about to be sent out;

[0012] Step 3, parse the TCP packet to get the SYN message, get the corresponding original fingerprint, and replace the original fingerprint with the simulated fingerprint of the prefabricated template;

[0013] Step 4, recalculate the checksum of the TCP packet, then assemble it into a new TCP packet, and send out the new TCP packet.

[0014] In a second aspect, the present application provides an eBPF-based TCP fingerprint simulation device, comprising:

[0015] A tracking module tracks the call of the tcp_connect kernel function through eBPF kprobe;

[0016] A capture module uses eBPF TC to capture the TCP packet about to be sent out if there is a call;

[0017] A simulation module parses the TCP packet to get the SYN message, gets the corresponding original fingerprint, and replaces the original fingerprint with the simulated fingerprint of the prefabricated template;

[0018] A retransmission module recalculates the checksum of the TCP packet, then assembles it into a new TCP packet, and sends out the new TCP packet.

[0019] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the method of the first aspect.

[0020] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method of the first aspect.

[0021] The one or more technical solutions provided by the present application have at least the following technical effects or advantages:

[0022] 1. High performance

[0023] Kernel mode operation: eBPF programs run directly in the kernel mode, avoiding frequent switching between user mode and kernel mode, reducing the overhead of context switching. This makes the efficiency of packet processing very high, enabling real-time processing of large amounts of network traffic.

[0024] Zero-copy: eBPF programs can directly manipulate the memory of network packets without copying them from kernel space to user space, further reducing data transfer overhead and improving processing speed.

[0025] Parallel processing: eBPF programs can run in parallel on multiple CPU cores, fully utilizing the performance advantages of multi-core processors and further enhancing processing capabilities.

[0026] 2. Flexibility

[0027] Dynamic loading and updating: eBPF programs can be dynamically loaded and updated at runtime without the need to restart the system or network services. This allows for quick adjustments to packet processing logic, such as modifying fingerprint features or adjusting processing strategies, according to different needs.

[0028] Programmability: eBPF provides a powerful programming interface that allows developers to write complex logic to process network packets. For example, conditional judgments and modifications can be made based on specific fields of the packet (such as IP address, port number, protocol type, etc.), enabling customized network behavior.

[0029] 3. Security

[0030] Kernel protection mechanisms: eBPF programs run in a restricted environment within the kernel, and the kernel strictly limits the execution of the program to prevent malicious code from causing damage to the system. For example, eBPF programs cannot directly access sensitive kernel data or perform illegal operations.

[0031] Fine-grained control: Through eBPF, network packets can be controlled in a fine-grained manner, such as modifying only specific types of traffic or traffic from specific sources, thereby reducing the impact on normal network communication.

[0032] 4. Low latency

[0033] Direct manipulation of packets: eBPF programs can directly manipulate packets on the transmission path without passing them to user-space programs for processing, reducing packet processing latency. This is very helpful for application scenarios that require low latency, such as real-time network monitoring and high-performance network services.

[0034] 5. Low resource consumption

[0035] Lightweight: eBPF programs generally have small code size and low resource consumption. Compared with traditional user-space network processing programs, eBPF programs do not require complex thread management, memory allocation, etc., so they consume less system resources.

[0036] Efficient use of system resources: Since eBPF programs run directly in the kernel, they can fully utilize various optimization mechanisms provided by the kernel (such as cache, DMA, etc.), further improving resource utilization efficiency.

[0037] 6. Integration with existing systems

[0038] Seamless integration: eBPF programs can be seamlessly integrated into existing Linux network stacks without major modifications to the kernel or network services. This makes it easy to apply eBPF technology to existing network systems for functional expansion or performance optimization.

[0039] Strong compatibility: eBPF programs can work with existing network protocols and tools (such as TCP / IP, iptables, etc.), without disrupting existing network architectures.

[0040] In summary, the present application can quickly simulate TCP fingerprinting, improving simulation efficiency and ensuring normal TCP connection.

[0041] The above description is only a summary of the technical solutions of the present application. In order to better understand the technical means of the present application, the content of the specification can be implemented, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0042] The present application will be further described below with reference to the accompanying drawings and embodiments.

[0043] Figure 1 The flowchart in the method of the first embodiment of the present application is shown.

[0044] Figure 2 The structure of the device in the second embodiment of the present application is shown. DETAILED DESCRIPTION

[0045] The embodiments of the present application provide an eBPF-based TCP fingerprinting simulation method, device, equipment and medium, which has high processing speed and is convenient for users to use.

[0046] The technical solutions in the embodiments of the present application have the following general ideas:

[0047] 1. Use eBPF kprobe to track the call of the tcp_connect kernel function

[0048] 2. Use eBPF tc to capture the TCP packet about to be sent out

[0049] 3. Analyze the SYN message in the outgoing TCP packet, match the pre-configured TCP fingerprint template corresponding to the pid, and modify the tcp options to simulate the fingerprint into the pre-made template

[0050] 4. Recalculate the checksum, and then send out the modified TCP packet.

[0051] Process flow:

[0052] Modify the TCP packet to the TCP SYN packet characteristics of macOS.

[0053] Process flow:

[0054] 1. Modify the packet length

[0055]

[0056]

[0057] Use the bpf_skb_change_tail function to extend the tail of the packet to the length of the macOS TCP packet (MACOS_HEADER_LEN).

[0058] 2. Modify the IP header field

[0059] rust

[0060] ctx.store(ETH_HEADER_LEN+2,&64_u16.to_be(),2)?;

[0061] ctx.store(ETH_HEADER_LEN+8,&64_u8,2)?;

[0062] Set the total length field of the IP header to 64.

[0063] Set the TTL field of the IP header to 64.

[0064] 3. Modify the TCP header field

[0065] rust

[0066] ctx.store(ETH_HEADER_LEN+IPV4_HEADER_LEN+12,&0xb0_u8,2)?;

[0067] ctx.store(ETH_HEADER_LEN+IPV4_HEADER_LEN+14,&65535_u16.to_be(),2)?;

[0068] Set the length field of the TCP header to 44.

[0069] Set the window size field of the TCP header to 65535.

[0070] 4、Set TCP options

[0071]

[0072]

[0073] Get the current timestamp in milliseconds.

[0074] Construct the TCP options field for macOS, including MSS, window scale factor, timestamp, etc.

[0075] Write the TCP options field to the packet.

[0076] 5、Update checksum

[0077] rust

[0078] tcp_update_checksum(&mut ctx, 44, &options)?;

[0079] ip_update_checksum(&mut ctx);

[0080] Update the TCP checksum.

[0081] Update the IP checksum.

[0082] 6、Return the result

[0083] rust

[0084] Ok(())

[0085] If the modification is successful, return Ok(()).

[0086] Modify the TCP packet to the TCP SYN packet characteristics of Windows.

[0087] Process flow:

[0088] 1、Modify the packet length

[0089]

[0090] Use the bpf_skb_change_tail function to expand the tail of the packet to the length of the Windows TCP packet (WINDOWS_HEADER_LEN).

[0091] 2. Modify IP header fields

[0092] rust

[0093] ctx.store(ETH_HEADER_LEN+2,&52_u16.to_be(),2)?;

[0094] ctx.store(ETH_HEADER_LEN+8,&64_u8,2)?;

[0095] Set the total length field of the IP header to 52.

[0096] Set the TTL field of the IP header to 64.

[0097] 3. Modify TCP header fields

[0098] rust

[0099] ctx.store(ETH_HEADER_LEN+IPV4_HEADER_LEN+12,&0x80_u8,2)?;

[0100] ctx.store(ETH_HEADER_LEN+IPV4_HEADER_LEN+14,&64240_u16.to_be(),2)?;

[0101] Set the length field of the TCP header to 32.

[0102] Set the window size field of the TCP header to 64240.

[0103] 4. Set TCP options

[0104]

[0105] Construct the TCP options field for Windows.

[0106] Write the TCP options field to the packet.

[0107] 5. Update checksum

[0108] rust

[0109] tcp_update_checksum(&mut ctx, 32, &OPTIONS)?;

[0110] ip_update_checksum(&mut ctx);

[0111] Update the TCP checksum.

[0112] Update IP checksum.

[0113] 6、Return result

[0114] rust

[0115] Ok(())

[0116] If the modification is successful, return Ok(()).

[0117] Embodiment one

[0118] As Figure 1 shown, the embodiment provides an eBPF-based TCP fingerprint simulation method, comprising the following steps:

[0119] Step 1, track the call of the tcp_connect kernel function through the kprobe of eBPF;

[0120] Step 2, if there is a call, use the TC of eBPF to capture the TCP packet about to be sent out;

[0121] Step 3, parse the TCP packet to obtain the SYN message, obtain the corresponding original fingerprint, and replace the original fingerprint with the simulation fingerprint of the prefabricated template;

[0122] Step 4, recalculate the checksum of the TCP packet, and then assemble it into a new TCP packet and send out the new TCP packet.

[0123] In the embodiment, preferably, step 3 is specifically: parsing the TCP packet to obtain the SYN message, obtaining the corresponding original fingerprint, selecting a prefabricated template, and replacing the original fingerprint with the simulation fingerprint of the prefabricated template.

[0124] In the embodiment, preferably, the prefabricated template includes: a simulation Windows fingerprint, which is specifically:

[0125] The original fingerprint is modified,

[0126] The IP length is set to 52 bytes;

[0127] The TTL (Time To Live) is set to 64;

[0128] TCP data offset: set to 32 bytes, indicating that there are 12 bytes of TCP options;

[0129] Window size: set to 64240,

[0130] TCP options include: MSS, window scaling, SACK, and NOP padding.

[0131] In this embodiment, preferably, the prefabricated template comprises: a simulated macOS fingerprint, specifically:

[0132] The original fingerprint is modified,

[0133] IP length is set to 64 bytes;

[0134] TTL: set to 64;

[0135] TCP data offset: set to 44 bytes, indicating that there are 24 bytes of TCP options;

[0136] Window size: set to 65535;

[0137] TCP options include: MSS (maximum segment size), window scaling, SACK (selective acknowledgement), timestamp, and NOP padding.

[0138] Based on the same inventive concept, the application also provides a device corresponding to the method in embodiment one, which is described in detail in embodiment two.

[0139] Embodiment two

[0140] As Figure 2 shown, in this embodiment, an eBPF-based TCP fingerprint simulation device is provided, which comprises:

[0141] A tracking module tracks the invocation of the tcp_connect kernel function through eBPF kprobe;

[0142] A capturing module captures the TCP data packet about to be sent out using eBPF TC if there is an invocation;

[0143] A simulation module analyzes the TCP data packet to obtain a SYN message, acquires a corresponding original fingerprint, and replaces the original fingerprint with a simulated fingerprint of a prefabricated template;

[0144] A retransmission module recalculates the checksum of the TCP data packet, and then assembles a new TCP data packet and sends out the new TCP data packet.

[0145] In this embodiment, preferably, the simulation module specifically comprises: analyzing the TCP data packet to obtain a SYN message, acquiring a corresponding original fingerprint, selecting a prefabricated template, and replacing the original fingerprint with a simulated fingerprint of the prefabricated template.

[0146] In this embodiment, preferably, the prefabricated template comprises: a simulated Windows fingerprint, specifically:

[0147] The original fingerprint is modified,

[0148] IP length is set to 52 bytes;

[0149] TTL (Time To Live) is set to 64;

[0150] TCP data offset is set to 32 bytes, indicating 12 bytes of TCP options;

[0151] Window size is set to 64240,

[0152] TCP options include: MSS, window scale, SACK, and NOP padding.

[0153] In this embodiment, preferably, the prefabricated template comprises: a simulated macOS fingerprint, specifically:

[0154] The original fingerprint is modified,

[0155] IP length is set to 64 bytes;

[0156] TTL: set to 64;

[0157] TCP data offset is set to 44 bytes, indicating 24 bytes of TCP options;

[0158] Window size is set to 65535;

[0159] TCP options include: MSS (maximum segment size), window scale, SACK (selective acknowledgement), timestamp, and NOP padding.

[0160] Since the device introduced in Embodiment Two of the present application is a device used to implement the method of Embodiment One of the present application, the specific structure and modifications of the device can be understood by those skilled in the art based on the method introduced in Embodiment One of the present application, and thus will not be described here. Any device used by the method of Embodiment One of the present application belongs to the scope of the present application.

[0161] Based on the same inventive concept, the present application provides an electronic device embodiment corresponding to Embodiment One, which is described in detail in Embodiment Three.

[0162] Embodiment Three

[0163] The present embodiment provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the embodiments of Embodiment One can be implemented.

[0164] Since the electronic device introduced in the embodiment is the device used for implementing the method in Embodiment One of the present application, the specific implementation of the electronic device of the present embodiment and its various forms can be understood by those skilled in the art based on the method introduced in Embodiment One of the present application, and therefore the implementation of the method in the present embodiment by the electronic device will not be described in detail here. As long as the device used for implementing the method in the present embodiment is implemented by those skilled in the art, it belongs to the scope of the present application.

[0165] Based on the same inventive concept, the present application provides a storage medium corresponding to Embodiment One, which is described in detail in Embodiment Four.

[0166] Embodiment Four

[0167] The present embodiment provides a computer-readable storage medium having a computer program stored thereon, which can implement any of the embodiments in Embodiment One when executed by a processor.

[0168] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0169] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The function specified in one flow or multiple flows and / or blocks Figure 1 The function specified in one flow or multiple flows and / or blocks

[0170] These computer program instructions can also be stored in a computer-readable storage medium that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable storage medium produce a manufactured product including instruction devices that implement the functions specified in the flowcharts and / or block diagrams. Figure 1 The function specified in one flow or multiple flows and / or blocks Figure 1 The function specified in one flow or multiple flows and / or blocks

[0171] These computer program instructions can also be loaded into computer or other programmable data processing devices, so that a series of operation steps are performed on the computer or other programmable data processing devices to generate computer-implemented processes, thus the instructions executed on the computer or other programmable data processing devices provide processes for implementing the flow Figure 1 one or more flows and / or blocks Figure 1 one or more blocks or steps of the functions specified in the flow

[0172] Although the specific embodiments of the present application are described above, it should be understood by those skilled in the art that the specific embodiments described are merely illustrative, and not intended to limit the scope of the present application, and equivalent modifications and variations made in accordance with the spirit of the present application should be covered by the scope of the claims of the present application.

Claims

1. A TCP fingerprint simulation method based on eBPF, characterized by: The steps include: Step 1: Use eBPF kprobe to track the call of tcp_connect kernel function; Step 2: If there is a call, use eBPF TC to capture the TCP data packet to be sent; Step 3: Parse the TCP data packet to obtain the SYN message, obtain the corresponding original fingerprint, and replace the original fingerprint with the simulated fingerprint of the prefabricated template; Step 4: Recalculate the checksum of the TCP data packet, assemble it into a new TCP data packet, and send the new TCP data packet.

2. The eBPF-based TCP fingerprint simulation method according to claim 1, wherein: The step 3 specifically includes: parsing the TCP data packet to obtain a SYN message, acquiring a corresponding original fingerprint, selecting a prefabricated template, and replacing the original fingerprint with a simulated fingerprint of the prefabricated template.

3. The eBPF-based TCP fingerprint simulation method according to claim 1, wherein: The prefabricated template includes: simulating Windows fingerprint, specifically: Modify the original fingerprint. The IP length is set to 52 bytes; TTL is set to 64; TCP Data Offset: Set to 32 bytes, indicating a 12-byte TCP option. Window size: set to 64240, TCP options include: MSS, window scaling, SACK, and NOP padding.

4. The eBPF-based TCP fingerprint simulation method according to claim 1, wherein: The prefabricated template includes: simulating macOS fingerprint, specifically: Modify the original fingerprint. The IP length is set to 64 bytes; TTL: set to 64; TCP Data Offset: Set to 44 bytes, indicating 24 bytes of TCP options; Window size: set to 65535; TCP options include: MSS, window scaling, SACK, timestamp, and NOP padding.

5. A TCP fingerprint simulation device based on eBPF, characterized by: include: The tracing module uses eBPF's kprobe to trace the call of the tcp_connect kernel function; The capture module, if called, uses eBPF's TC to capture the TCP data packets to be sent; The simulation module parses the TCP data packet, obtains the SYN message, obtains the corresponding original fingerprint, and replaces the original fingerprint with the simulated fingerprint of the prefabricated template; The resend module recalculates the checksum of the TCP data packet, then assembles it into a new TCP data packet and sends the new TCP data packet.

6. The eBPF-based TCP fingerprint simulation device according to claim 5, characterized in that: The simulation module specifically parses the TCP data packet to obtain a SYN message, acquires a corresponding original fingerprint, selects a prefabricated template, and replaces the original fingerprint with a simulated fingerprint of the prefabricated template.

7. The eBPF-based TCP fingerprint simulation device according to claim 5, wherein: The prefabricated template includes: simulating Windows fingerprint, specifically: Modify the original fingerprint. The IP length is set to 52 bytes; TTL is set to 64; TCP Data Offset: Set to 32 bytes, indicating a 12-byte TCP option. Window size: set to 64240; TCP options include: MSS, window scaling, SACK, and NOP padding.

8. The eBPF-based TCP fingerprint simulation device according to claim 5, wherein: The prefabricated template includes: simulating macOS fingerprint, specifically: Modify the original fingerprint. The IP length is set to 64 bytes; TTL: set to 64; TCP Data Offset: Set to 44 bytes, indicating 24 bytes of TCP options; Window size: set to 65535; TCP options include: MSS, window scaling, SACK, timestamp, and NOP padding.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images