* SO_ORIGINAL_DST returning bogus port number
@ 2010-04-19 19:36 Jeff Saremi
2010-04-19 20:09 ` Jan Engelhardt
0 siblings, 1 reply; 4+ messages in thread
From: Jeff Saremi @ 2010-04-19 19:36 UTC (permalink / raw)
To: netfilter
I’m not sure what i’m doing wrong or whether my expectations of netfilter
are correct or not.
But i basically had the NAT extension forward all incoming tcp traffic to a
local socket. I tested it and it worked fine.
However I still need the original destination IP and port number for my code
to function properly.
I get the original destination IP correctly but the port number is never
what I expect.
Below are the setup steps, my code and tracing that I did:
Setup:
iptables -A INPUT -p tcp -i eth0 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp -j REDIRECT --to-port 9000
Code:
cli_fd = accept(fd, (struct sockaddr *) &cli_addr, &cli_len);
dst_len = sizeof(dst_addr);
if(getsockopt(cli_fd, IPPROTO_IP, SO_ORIGINAL_DST, &dst_addr, &dst_len)
!= 0)
printf("getsockopt() returned error");
else
printf("original destination address: %s:%d\n",
inet_ntoa(dst_addr.sin_addr), dst_addr.sin_port);
The above server is listening on port 9000 on ANY address. When hit by a
call from a telnet client (telnet 10.10.10.1 33000) it prints the following:
original destination address: 10.10.10.1:59520
I have tried changing the port in the telnet command but everytime I do that
a completely different value is reported out.
While the listening socket was running and the telnet client was
communicating, I ran “tcpdump” and below are a few lines from that which
confirm the ports I expected.
There are no traces of port number 59520! (note that 192.168.1.100 is the
telnet machine and 192.168.1.101 is the “intercepting” machine running
netfilter:
Trace:
13:45:01.688156 IP 192.168.1.100.51961 > 10.10.10.1.33000: P 1:2(1) ack 1
win 256
13:45:01.688256 IP 10.10.10.1.33000 > 192.168.1.100.51961: . ack 2 win 183
13:45:01.688418 IP 10.10.10.1.33000 > 192.168.1.100.51961: P 1:19(18) ack 2
win 183
13:45:01.688585 IP 10.10.10.1.33000 > 192.168.1.100.51961: F 19:19(0) ack 2
win 183
13:45:01.688750 IP 192.168.1.100.51961 > 10.10.10.1.33000: . ack 20 win 256
13:45:01.693081 IP 192.168.1.100.51961 > 10.10.10.1.33000: F 2:2(0) ack 20
win 256
13:45:01.693130 IP 10.10.10.1.33000 > 192.168.1.100.51961: . ack 3 win 183
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: SO_ORIGINAL_DST returning bogus port number
2010-04-19 19:36 SO_ORIGINAL_DST returning bogus port number Jeff Saremi
@ 2010-04-19 20:09 ` Jan Engelhardt
2010-04-19 20:12 ` Jan Engelhardt
0 siblings, 1 reply; 4+ messages in thread
From: Jan Engelhardt @ 2010-04-19 20:09 UTC (permalink / raw)
To: Jeff Saremi; +Cc: netfilter
On Monday 2010-04-19 21:36, Jeff Saremi wrote:
>
>Setup:
>
>iptables -A INPUT -p tcp -i eth0 -j ACCEPT
>iptables -t nat -A PREROUTING -i eth0 -p tcp -j REDIRECT --to-port 9000
>
>Code:
>
> cli_fd = accept(fd, (struct sockaddr *) &cli_addr, &cli_len);
> dst_len = sizeof(dst_addr);
> if(getsockopt(cli_fd, IPPROTO_IP, SO_ORIGINAL_DST, &dst_addr, &dst_len)
>!= 0)
> printf("getsockopt() returned error");
> else
> printf("original destination address: %s:%d\n",
>inet_ntoa(dst_addr.sin_addr), dst_addr.sin_port);
You have to use
else {
char buf[16];
inet_ntop(AF_INET, &dst_addr.sin_addr, dst, sizeof(dst));
printf("%s:%hu\n", buf, ntohs(dst_addr.sin_port));
}
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: SO_ORIGINAL_DST returning bogus port number
2010-04-19 20:09 ` Jan Engelhardt
@ 2010-04-19 20:12 ` Jan Engelhardt
2010-04-19 21:30 ` Jeff Saremi
0 siblings, 1 reply; 4+ messages in thread
From: Jan Engelhardt @ 2010-04-19 20:12 UTC (permalink / raw)
To: Jeff Saremi; +Cc: netfilter
On Monday 2010-04-19 22:09, Jan Engelhardt wrote:
>
>On Monday 2010-04-19 21:36, Jeff Saremi wrote:
>>
>>Setup:
>>
>>iptables -A INPUT -p tcp -i eth0 -j ACCEPT
>>iptables -t nat -A PREROUTING -i eth0 -p tcp -j REDIRECT --to-port 9000
>>
>>Code:
>>
>> cli_fd = accept(fd, (struct sockaddr *) &cli_addr, &cli_len);
>> dst_len = sizeof(dst_addr);
>> if(getsockopt(cli_fd, IPPROTO_IP, SO_ORIGINAL_DST, &dst_addr, &dst_len)
>>!= 0)
>> printf("getsockopt() returned error");
>> else
>> printf("original destination address: %s:%d\n",
>>inet_ntoa(dst_addr.sin_addr), dst_addr.sin_port);
>
>You have to use
>
>else {
> char buf[16];
> inet_ntop(AF_INET, &dst_addr.sin_addr, dst, sizeof(dst));
^ buf, not dst
> printf("%s:%hu\n", buf, ntohs(dst_addr.sin_port));
>}
>--
>To unsubscribe from this list: send the line "unsubscribe netfilter" in
>the body of a message to majordomo@vger.kernel.org
>More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: SO_ORIGINAL_DST returning bogus port number
2010-04-19 20:12 ` Jan Engelhardt
@ 2010-04-19 21:30 ` Jeff Saremi
0 siblings, 0 replies; 4+ messages in thread
From: Jeff Saremi @ 2010-04-19 21:30 UTC (permalink / raw)
To: 'Jan Engelhardt'; +Cc: netfilter
Thanks a lot for responding.
The key was " ntohs()" which i didn't have and you mentioned. It works properly now.
>
>You have to use
>
>else {
> char buf[16];
> inet_ntop(AF_INET, &dst_addr.sin_addr, dst, sizeof(dst));
^ buf, not dst
> printf("%s:%hu\n", buf, ntohs(dst_addr.sin_port));
>}
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-04-19 21:30 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-04-19 19:36 SO_ORIGINAL_DST returning bogus port number Jeff Saremi
2010-04-19 20:09 ` Jan Engelhardt
2010-04-19 20:12 ` Jan Engelhardt
2010-04-19 21:30 ` Jeff Saremi
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.