From: Amos Jeffries <squid3@treenet.co.nz>
To: Brian <unixman83@gmail.com>
Cc: netfilter@vger.kernel.org
Subject: Re: TPROXY getting the remote/destination address via sockets API
Date: Sun, 27 Nov 2011 16:56:29 +1300 [thread overview]
Message-ID: <4ED1B4ED.4090808@treenet.co.nz> (raw)
In-Reply-To: <4ED1A034.9030802@gmail.com>
On 27/11/2011 3:28 p.m., Brian wrote:
> Using the latest TPROXY, how does one accurately get the
> destination/remote (and the source/localish) addresses of the
> transparent proxy connection?
Very reliable. At least we (Squid proxy) have had no problems with the
kernel 2.6.39+ TPROXY. Just some screwups on our side of the implementation.
>
> I would assume one address would be returned by the accept() call,
> which one, and how do I get the other?
You assume correct. The other is available from getsockname() on the new FD.
With TPROXY the IPs are reversed. That is; the IP which for normal
traffic would arrive on accept() appears instead on getsockname(), and
vice versa. So any software receiving TPROXY traffic is required to
isolate the listening port from normal traffic listening ports to avoid
problems interpreting the IPs.
HTH
AYJ
prev parent reply other threads:[~2011-11-27 3:56 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-27 2:28 TPROXY getting the remote/destination address via sockets API Brian
2011-11-27 3:56 ` Amos Jeffries [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4ED1B4ED.4090808@treenet.co.nz \
--to=squid3@treenet.co.nz \
--cc=netfilter@vger.kernel.org \
--cc=unixman83@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox