netdev - RE: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 7 Jan 2019 07:58:49 +0000
From:   "Mohandass, Roobesh" <Roobesh_Mohandass@...fee.com>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is
 in fact sometimes returning the source IP instead the destination IP

Hi Netdev,

Any help, much appreciated.

-Roobesh G M

From: Mohandass, Roobesh 
Sent: Monday, December 31, 2018 1:13 PM
To: netdev@...r.kernel.org
Cc: Willy Tarreau <w@....eu>
Subject: RE: [NETDEV]: getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

(email is bouncing due to URL in the body of the message and my signature adjusted, so using hash instead).

Hi Netdev,

Issue: getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

Using below version of,
~# lsb_release -rd
Description: Ubuntu 18.04.1 LTS
Release: 18.04

What you expected to happen:
getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) - should return always destination IP(connected IP).

What happened instead:
getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP. Using getsockname() instead looks like solving the issue.

For just an example: 
Out of 6569124 requests , 4 requests were wrong 0.000060891 % (this is just an rough estimate to give you idea on frequency)

Some old reference: (similar behavior observed) 
Base64 encode: aHR0cHM6Ly9zdGFja292ZXJmbG93LmNvbS9xdWVzdGlvbnMvMTE0MTcxODcvZ2V0c29ja29wdC1zby1vcmlnaW5hbC1kc3Qtb2NjYXNpb25hbGx5LXJldHVybnMtY2xpZW50LWFkZHJlc3M=
(use above to convert URL for reference).

Side Note: (about how we identified this behavior)
We were using haproxy-version 1.8.14-1 which is using this kernel function getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) to get the destination IP details/connected address details. But instead we are getting very occasional source IP address instead of destination(Connected IP).

Thanks for your attention on this message.

With kind regards,
RGM(Roobesh Mohandass)
Cloud Security Platform