netdev - RE: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 7 Jan 2019 14:57:54 +0000
From:   "Mohandass, Roobesh" <Roobesh_Mohandass@...fee.com>
To:     Florian Westphal <fw@...len.de>, Willy Tarreau <w@....eu>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is
 in fact sometimes returning the source IP instead the destination IP

+Willy 

Willy,

Do you mind looking into Florian comments below ? 

-Roobesh G M

-----Original Message-----
From: Florian Westphal <fw@...len.de> 
Sent: Monday, January 7, 2019 4:48 PM
To: Mohandass, Roobesh <Roobesh_Mohandass@...fee.com>
Cc: netdev@...r.kernel.org
Subject: Re: [NETDEV]: getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

Mohandass, Roobesh <Roobesh_Mohandass@...fee.com> wrote:
> Issue: getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact 
> sometimes returning the source IP instead the destination IP

SO_ORIGINAL_DST returns the original address (before DNAT/REDIRECT rewrite) that conntrack believes to be the originator.

> What you expected to happen:
> getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) - should return always destination IP(connected IP).
> 
> What happened instead:
> getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP. Using getsockname() instead looks like solving the issue.
> 
> For just an example: 
> Out of 6569124 requests , 4 requests were wrong 0.000060891 % (this is 
> just an rough estimate to give you idea on frequency)
> 
> Some old reference: (similar behavior observed) 
> https://stackoverflow.com/questions/11417187/getsockopt-so-original-ds
> t-occasionally-returns-client-address

I ask exactly same question as in your url.
If you use TPROXY, why do you use SO_ORIGINAL_DST?

Its only required with -j REDIRECT.

If you need to use REDIRECT for some reason, make sure you limit REDIRECT to -p tcp --syn to prevent it from triggering on other packets.

You might also want to turn off midstream pickup (sysctl
nf_conntrack_tcp_loose=0) in conntrack.