From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lukas Tribus Subject: Re: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP Date: Sat, 12 Jan 2019 15:37:11 +0100 Message-ID: <2e83651c-df8b-8341-4170-df328e3d756a@ltri.eu> References: <20190107111753.aiabujukqx3eteqb@breakpoint.cc> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: Mohandass Roobesh , Willy Tarreau , netdev@vger.kernel.org To: Florian Westphal Return-path: Received: from z8.mailgun.us ([104.130.96.8]:53824 "EHLO z8.mailgun.us" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725831AbfALOmQ (ORCPT ); Sat, 12 Jan 2019 09:42:16 -0500 In-Reply-To: <20190107111753.aiabujukqx3eteqb@breakpoint.cc> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: Hello, >> getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes >> returning the source IP instead the destination IP. Using getsockname() >> instead looks like solving the issue. >> >> For just an example: >> Out of 6569124 requests , 4 requests were wrong 0.000060891 % (this is just >> an rough estimate to give you idea on frequency) >> >> Some old reference: (similar behavior observed) >> stackoverflow-link (see earlier) > > I ask exactly same question as in your url. > If you use TPROXY, why do you use SO_ORIGINAL_DST? > > Its only required with -j REDIRECT. TPROXY is not used in the OP's scenario. The stackoverflow question was an example. The application (haproxy) needs to know the original destination IP address, however it does not know whether -j REDIRECT was used or not. Because of this the application always queries SO_ORIGINAL_DST, and this includes configurations without -j REDIRECT. Are you saying the behavior of SO_ORIGINAL_DST is undefined when not used with -j REDIRECT and that this issue does not happen when -j REDIRECT is actually used? That would mean the application would have to expose a new configuration knob to the user, and require the user to toggle the knob based on -j REDIRECT usage. Thanks, Lukas From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 587A0C43387 for ; Sat, 12 Jan 2019 14:42:21 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0F18820835 for ; Sat, 12 Jan 2019 14:42:20 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=ltri.eu header.i=@ltri.eu header.b="OBr6GlqS" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725842AbfALOmQ (ORCPT ); Sat, 12 Jan 2019 09:42:16 -0500 Received: from z8.mailgun.us ([104.130.96.8]:53824 "EHLO z8.mailgun.us" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725831AbfALOmQ (ORCPT ); Sat, 12 Jan 2019 09:42:16 -0500 X-Greylist: delayed 301 seconds by postgrey-1.27 at vger.kernel.org; Sat, 12 Jan 2019 09:42:16 EST DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=ltri.eu; q=dns/txt; s=mailo; t=1547304135; h=Content-Transfer-Encoding: Content-Type: MIME-Version: Date: Message-ID: Cc: In-Reply-To: To: Subject: From: Sender; bh=IzjEKxT0Wi78fdr/VPUqT9MXhW8aIHRVIrtlNWuXByQ=; b=OBr6GlqS0W3QMrtBvc/meDAPEA9CN1r5JpTO5QDp6KRIc6XFXZTsWb1m16CiPMfqrPeJVnUm 6isgBvUlyWkEHEwzTsDmxLU8oTHfOrGlsGBRxQgs7TjdFAGKlSJpQZFb60MYPbU9b6iZREB1 Ya1hqBuJGVcR3ZsmPYHaTH5GP0A= X-Mailgun-Sending-Ip: 104.130.96.8 X-Mailgun-Sid: WyI2NjYyYyIsICJuZXRkZXZAdmdlci5rZXJuZWwub3JnIiwgIjRmNGFmZiJd Received: from [10.0.0.4] (site-0.ltri.eu [95.171.32.30]) by mxa.mailgun.org with ESMTP id 5c39fb9a.7fc680853900-smtp-out-n02; Sat, 12 Jan 2019 14:37:14 -0000 (UTC) From: Lukas Tribus Subject: Re: [NETDEV]: getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP To: Florian Westphal In-Reply-To: <20190107111753.aiabujukqx3eteqb@breakpoint.cc> Cc: Mohandass Roobesh , Willy Tarreau , netdev@vger.kernel.org Message-ID: <2e83651c-df8b-8341-4170-df328e3d756a@ltri.eu> Date: Sat, 12 Jan 2019 15:37:11 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Content-Language: en-US Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Message-ID: <20190112143711.frj-f3u63lWMfUMSUTht5Fnc7LC7sFpwZnsCJS_ur1g@z> Hello, >> getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes >> returning the source IP instead the destination IP. Using getsockname() >> instead looks like solving the issue. >> >> For just an example: >> Out of 6569124 requests , 4 requests were wrong 0.000060891 % (this is just >> an rough estimate to give you idea on frequency) >> >> Some old reference: (similar behavior observed) >> stackoverflow-link (see earlier) > > I ask exactly same question as in your url. > If you use TPROXY, why do you use SO_ORIGINAL_DST? > > Its only required with -j REDIRECT. TPROXY is not used in the OP's scenario. The stackoverflow question was an example. The application (haproxy) needs to know the original destination IP address, however it does not know whether -j REDIRECT was used or not. Because of this the application always queries SO_ORIGINAL_DST, and this includes configurations without -j REDIRECT. Are you saying the behavior of SO_ORIGINAL_DST is undefined when not used with -j REDIRECT and that this issue does not happen when -j REDIRECT is actually used? That would mean the application would have to expose a new configuration knob to the user, and require the user to toggle the knob based on -j REDIRECT usage. Thanks, Lukas