netdev - : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <MWHPR16MB1502F6F7D906B1C7117189DFEDB20@MWHPR16MB1502.namprd16.prod.outlook.com>
Date:   Mon, 31 Dec 2018 06:20:32 +0000
From:   "Mohandass, Roobesh" <Roobesh_Mohandass@...fee.com>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in
 fact sometimes returning the source IP instead the destination IP

(email is bouncing due to URL in the body of the message, so using hash instead).

Hi Netdev,

Issue: getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

Using below version of,
~# lsb_release -rd
Description: Ubuntu 18.04.1 LTS
Release: 18.04

What you expected to happen:
getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) - should return always destination IP(connected IP).

What happened instead:
getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP. Using getsockname() instead looks like solving the issue.

For just an example: 
Out of 6569124 requests , 4 requests were wrong 0.000060891 % (this is just an rough estimate to give you idea on frequency)

Some old reference: (similar behavior observed) 
MD5: 60059ae4a3d912d4745ca66630b9b949   (convert this hash into string for URL).

Side Note: (about how we identified this behavior)
We were using haproxy-version 1.8.14-1 which is using this kernel function getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) to get the destination IP details/connected address details. But instead we are getting very occasional source IP address instead of destination(Connected IP).

Thanks for your attention on this message.

With kind regards,
RGM(Roobesh Mohandass)
Cloud Security Platform