netdev - Re: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2e83651c-df8b-8341-4170-df328e3d756a@ltri.eu>
Date:   Sat, 12 Jan 2019 15:37:11 +0100
From:   Lukas Tribus <lists@...i.eu>
To:     Florian Westphal <fw@...len.de>
Cc:     Mohandass Roobesh <Roobesh_Mohandass@...fee.com>,
        Willy Tarreau <w@....eu>, netdev@...r.kernel.org
Subject: Re: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is
 in fact sometimes returning the source IP instead the destination IP

Hello,


>> getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes
>> returning the source IP instead the destination IP. Using getsockname()
>> instead looks like solving the issue.
>>
>> For just an example:
>> Out of 6569124 requests , 4 requests were wrong 0.000060891 % (this is just
>> an rough estimate to give you idea on frequency)
>>
>> Some old reference: (similar behavior observed)
>> stackoverflow-link (see earlier)
>
> I ask exactly same question as in your url.
> If you use TPROXY, why do you use SO_ORIGINAL_DST?
>
> Its only required with -j REDIRECT.

TPROXY is not used in the OP's scenario. The stackoverflow question was
an example.

The application (haproxy) needs to know the original destination IP
address, however it does not know whether -j REDIRECT was used or not.
Because of this the application always queries SO_ORIGINAL_DST, and
this includes configurations without -j REDIRECT.

Are you saying the behavior of SO_ORIGINAL_DST is undefined when not
used with -j REDIRECT and that this issue does not happen when -j
REDIRECT is actually used?

That would mean the application would have to expose a new configuration
knob to the user, and require the user to toggle the knob based on
-j REDIRECT usage.



Thanks,
Lukas