SO_ORIGINAL_DST returning bogus port number

["Jeff Saremi" <jeffsaremi@yahoo.com>]

I’m not sure what i’m doing wrong or whether my expectations of netfilter
are correct or not.
But i basically had the NAT extension forward all incoming tcp traffic to a
local socket. I tested it and it worked fine.
However I still need the original destination IP and port number for my code
to function properly.
I get the original destination IP correctly but the port number is never
what I expect.
Below are the setup steps, my code and tracing that I did:

Setup:

iptables -A INPUT -p tcp -i eth0 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp -j REDIRECT --to-port 9000

Code:

    cli_fd = accept(fd, (struct sockaddr *) &cli_addr, &cli_len);

    dst_len = sizeof(dst_addr);
    if(getsockopt(cli_fd, IPPROTO_IP, SO_ORIGINAL_DST, &dst_addr, &dst_len)
!= 0)
        printf("getsockopt() returned error");
    else
        printf("original destination address: %s:%d\n",
inet_ntoa(dst_addr.sin_addr), dst_addr.sin_port);

The above server is listening on port 9000 on ANY address. When hit by a
call from a telnet client (telnet 10.10.10.1 33000) it prints the following:
                original destination address: 10.10.10.1:59520

I have tried changing the port in the telnet command but everytime I do that
a completely different value is reported out.

While the listening socket was running and the telnet client was
communicating, I ran “tcpdump” and below are a few lines from that which
confirm the ports I expected.
There are no traces of port number 59520! (note that 192.168.1.100 is the
telnet machine and 192.168.1.101 is the “intercepting” machine running
netfilter:

Trace:

13:45:01.688156 IP 192.168.1.100.51961 > 10.10.10.1.33000: P 1:2(1) ack 1
win 256
13:45:01.688256 IP 10.10.10.1.33000 > 192.168.1.100.51961: . ack 2 win 183
13:45:01.688418 IP 10.10.10.1.33000 > 192.168.1.100.51961: P 1:19(18) ack 2
win 183
13:45:01.688585 IP 10.10.10.1.33000 > 192.168.1.100.51961: F 19:19(0) ack 2
win 183
13:45:01.688750 IP 192.168.1.100.51961 > 10.10.10.1.33000: . ack 20 win 256
13:45:01.693081 IP 192.168.1.100.51961 > 10.10.10.1.33000: F 2:2(0) ack 20
win 256
13:45:01.693130 IP 10.10.10.1.33000 > 192.168.1.100.51961: . ack 3 win 183