Re: SO_ORIGINAL_DST failed with ENOENT

[Kai Wang <w2w2k2k2@xxxxxxxxx>]

Hi everyone,

I'm new to iptables and recently met a problem when trying to get
original IP address with getsockopt.

I'm using iptables 1.3.3. Here's the rule:
iptables -t nat -A OUTPUT -m owner  --uid-owner <my_user_name>  -p tcp
-d 10.0.0.0/8 -j REDIRECT --to-port 9000

It will redirect all tcp packages to my proxy process listening on
9000 port. And my proxy will handles the real connection with out
world.
Here's my code snippet of my proxy app to get the original destination address:

  struct sockaddr_in addr;
  socklen_t addr_sz = sizeof(addr);

  bzero(reinterpret_cast<char*>(
&addr), addr_sz);
  addr.sin_family = AF_INET;

  if (getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, &addr, &addr_sz) != 0) {
    int err = errno;
    LOG << "Couldn't read SO_ORIGINAL_DST from socket " << fd
              << " Detail: " << strerror(err);
    return false;
  }

For most connections this works well. But it randomly gives ENOENT
error: "No such file or directory"...  I totally don't know why this
happens. Could anyone enlighten me?

Thanks in advance!


--
Best Regards!

   王凯 Kai Wang
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html