SO_ORIGINAL_DST returning bogus port number

SO_ORIGINAL_DST returning bogus port number

[Jeff Saremi]

I’m not sure what i’m doing wrong or whether my expectations of netfilter
are correct or not.
But i basically had the NAT extension forward all incoming tcp traffic to a
local socket. I tested it and it worked fine.
However I still need the original destination IP and port number for my code
to function properly.
I get the original destination IP correctly but the port number is never
what I expect.
Below are the setup steps, my code and tracing that I did:

Setup:

iptables -A INPUT -p tcp -i eth0 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp -j REDIRECT --to-port 9000

Code:

    cli_fd = accept(fd, (struct sockaddr *) &cli_addr, &cli_len);

    dst_len = sizeof(dst_addr);
    if(getsockopt(cli_fd, IPPROTO_IP, SO_ORIGINAL_DST, &dst_addr, &dst_len)
!= 0)
        printf("getsockopt() returned error");
    else
        printf("original destination address: %s:%d\n",
inet_ntoa(dst_addr.sin_addr), dst_addr.sin_port);

The above server is listening on port 9000 on ANY address. When hit by a
call from a telnet client (telnet 10.10.10.1 33000) it prints the following:
                original destination address: 10.10.10.1:59520

I have tried changing the port in the telnet command but everytime I do that
a completely different value is reported out.

While the listening socket was running and the telnet client was
communicating, I ran “tcpdump” and below are a few lines from that which
confirm the ports I expected.
There are no traces of port number 59520! (note that 192.168.1.100 is the
telnet machine and 192.168.1.101 is the “intercepting” machine running
netfilter:

Trace:

13:45:01.688156 IP 192.168.1.100.51961 > 10.10.10.1.33000: P 1:2(1) ack 1
win 256
13:45:01.688256 IP 10.10.10.1.33000 > 192.168.1.100.51961: . ack 2 win 183
13:45:01.688418 IP 10.10.10.1.33000 > 192.168.1.100.51961: P 1:19(18) ack 2
win 183
13:45:01.688585 IP 10.10.10.1.33000 > 192.168.1.100.51961: F 19:19(0) ack 2
win 183
13:45:01.688750 IP 192.168.1.100.51961 > 10.10.10.1.33000: . ack 20 win 256
13:45:01.693081 IP 192.168.1.100.51961 > 10.10.10.1.33000: F 2:2(0) ack 20
win 256
13:45:01.693130 IP 10.10.10.1.33000 > 192.168.1.100.51961: . ack 3 win 183

Re: SO_ORIGINAL_DST returning bogus port number

[Jan Engelhardt]

On Monday 2010-04-19 21:36, Jeff Saremi wrote:
>
>Setup:
>
>iptables -A INPUT -p tcp -i eth0 -j ACCEPT
>iptables -t nat -A PREROUTING -i eth0 -p tcp -j REDIRECT --to-port 9000
>
>Code:
>
>    cli_fd = accept(fd, (struct sockaddr *) &cli_addr, &cli_len);
>    dst_len = sizeof(dst_addr);
>    if(getsockopt(cli_fd, IPPROTO_IP, SO_ORIGINAL_DST, &dst_addr, &dst_len)
>!= 0)
>        printf("getsockopt() returned error");
>    else
>        printf("original destination address: %s:%d\n",
>inet_ntoa(dst_addr.sin_addr), dst_addr.sin_port);

You have to use

else {
	char buf[16];
	inet_ntop(AF_INET, &dst_addr.sin_addr, dst, sizeof(dst));
	printf("%s:%hu\n", buf, ntohs(dst_addr.sin_port));
}

Re: SO_ORIGINAL_DST returning bogus port number

[Jan Engelhardt]

On Monday 2010-04-19 22:09, Jan Engelhardt wrote:

>
>On Monday 2010-04-19 21:36, Jeff Saremi wrote:
>>
>>Setup:
>>
>>iptables -A INPUT -p tcp -i eth0 -j ACCEPT
>>iptables -t nat -A PREROUTING -i eth0 -p tcp -j REDIRECT --to-port 9000
>>
>>Code:
>>
>>    cli_fd = accept(fd, (struct sockaddr *) &cli_addr, &cli_len);
>>    dst_len = sizeof(dst_addr);
>>    if(getsockopt(cli_fd, IPPROTO_IP, SO_ORIGINAL_DST, &dst_addr, &dst_len)
>>!= 0)
>>        printf("getsockopt() returned error");
>>    else
>>        printf("original destination address: %s:%d\n",
>>inet_ntoa(dst_addr.sin_addr), dst_addr.sin_port);
>
>You have to use
>
>else {
>	char buf[16];
>	inet_ntop(AF_INET, &dst_addr.sin_addr, dst, sizeof(dst));
                                               ^ buf, not dst

>	printf("%s:%hu\n", buf, ntohs(dst_addr.sin_port));
>}
>--
>To unsubscribe from this list: send the line "unsubscribe netfilter" in
>the body of a message to majordomo@vger.kernel.org
>More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

RE: SO_ORIGINAL_DST returning bogus port number

[Jeff Saremi]

Thanks a lot for responding.
The key was " ntohs()" which i didn't have and you mentioned. It works properly now.

>
>You have to use
>
>else {
>	char buf[16];
>	inet_ntop(AF_INET, &dst_addr.sin_addr, dst, sizeof(dst));
                                               ^ buf, not dst

>	printf("%s:%hu\n", buf, ntohs(dst_addr.sin_port));
>}