From mboxrd@z Thu Jan  1 00:00:00 1970
From: Florian Westphal <fw@strlen.de>
Subject: Re: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is
 in fact sometimes returning the source IP instead the destination IP
Date: Mon, 7 Jan 2019 12:17:53 +0100
Message-ID: <20190107111753.aiabujukqx3eteqb@breakpoint.cc>
References: <MWHPR16MB1502549F7BAAE102EF1D5DF4EDB50@MWHPR16MB1502.namprd16.prod.outlook.com>
 <MWHPR16MB150233EF69CFD4562BFA65ABEDB60@MWHPR16MB1502.namprd16.prod.outlook.com>
 <MWHPR16MB1502DC55542EBA8121631B16EDB20@MWHPR16MB1502.namprd16.prod.outlook.com>
 <MWHPR16MB1502F6F7D906B1C7117189DFEDB20@MWHPR16MB1502.namprd16.prod.outlook.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: "netdev@vger.kernel.org" <netdev@vger.kernel.org>
To: "Mohandass, Roobesh" <Roobesh_Mohandass@McAfee.com>
Return-path: <netdev-owner@vger.kernel.org>
Received: from Chamillionaire.breakpoint.cc ([146.0.238.67]:59792 "EHLO
        Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK)
        by vger.kernel.org with ESMTP id S1726798AbfAGLR5 (ORCPT
        <rfc822;netdev@vger.kernel.org>); Mon, 7 Jan 2019 06:17:57 -0500
Content-Disposition: inline
In-Reply-To: <MWHPR16MB1502F6F7D906B1C7117189DFEDB20@MWHPR16MB1502.namprd16.prod.outlook.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

Mohandass, Roobesh <Roobesh_Mohandass@McAfee.com> wrote:
> Issue: getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

SO_ORIGINAL_DST returns the original address (before DNAT/REDIRECT rewrite)
that conntrack believes to be the originator.

> What you expected to happen:
> getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) - should return always destination IP(connected IP).
> 
> What happened instead:
> getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP. Using getsockname() instead looks like solving the issue.
> 
> For just an example: 
> Out of 6569124 requests , 4 requests were wrong 0.000060891 % (this is just an rough estimate to give you idea on frequency)
> 
> Some old reference: (similar behavior observed) 
> https://stackoverflow.com/questions/11417187/getsockopt-so-original-dst-occasionally-returns-client-address

I ask exactly same question as in your url.
If you use TPROXY, why do you use SO_ORIGINAL_DST?

Its only required with -j REDIRECT.

If you need to use REDIRECT for some reason, make sure you limit
REDIRECT to -p tcp --syn to prevent it from triggering on other packets.

You might also want to turn off midstream pickup (sysctl
nf_conntrack_tcp_loose=0) in conntrack.