From owner-freebsd-net@freebsd.org Mon Nov 25 23:44:09 2019 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 64B771BDE95 for ; Mon, 25 Nov 2019 23:44:09 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "vps1.elischer.org", Issuer "CA Cert Signing Authority" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 47MNsj0WRJz44tm for ; Mon, 25 Nov 2019 23:44:08 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from Julian-MBP3.local (c-73-225-95-104.hsd1.wa.comcast.net [73.225.95.104]) (authenticated bits=0) by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id xAPNi0iN097351 (version=TLSv1.2 cipher=AES128-SHA bits=128 verify=NO); Mon, 25 Nov 2019 15:44:01 -0800 (PST) (envelope-from julian@freebsd.org) Subject: Re: SOCK_RAW && SO_DONTROUTE doesn't work To: Colin Percival , "freebsd-net@freebsd.org" References: <0100016ea42871c1-492a3b9f-be05-4e4b-8ab4-8710ea36cdc2-000000@email.amazonses.com> From: Julian Elischer Message-ID: <63cdda3a-8078-7e1a-6a59-614ed6785e88@freebsd.org> Date: Mon, 25 Nov 2019 15:43:55 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.9.1 MIME-Version: 1.0 In-Reply-To: <0100016ea42871c1-492a3b9f-be05-4e4b-8ab4-8710ea36cdc2-000000@email.amazonses.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-Rspamd-Queue-Id: 47MNsj0WRJz44tm X-Spamd-Bar: - Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-1.42 / 15.00]; local_wl_from(0.00)[freebsd.org]; NEURAL_HAM_MEDIUM(-0.71)[-0.708,0]; NEURAL_HAM_LONG(-0.71)[-0.713,0]; ASN(0.00)[asn:36236, ipnet:204.109.60.0/22, country:US] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Nov 2019 23:44:09 -0000 On 11/25/19 12:02 PM, Colin Percival wrote: > Hi networky people, > > I'm not sure if this was deliberate or if it's a bug. > > If you create a raw IP socket, turn on IP_HDRINCL and SO_DONTROUTE, and > then use sendto(2) to send a packet, the destination address provided to > sendto(2) is ignored; instead, the destination is taken from the packet's > ip_dst field. > > It looks like this happens because rip_output calls ip_output with a NULL > value for ro, prompting ip_output to look up the destination from the IP > packet, rather than the destination passed to sendto (which never made its > way out of rip_output). > > I tripped over this because I was trying to have a userland process which > routes (some) packets differently from how the routing tables specify; but > my "no really, go out THAT interface" wasn't being respected. :-( > > (Full background: I want to make a transparent proxy which intercepts > outgoing connections to 169.254.169.254, allowing some of them through and > redirecting others for special handling. I created a tun which outgoing > packets get routed into; but I ran into problems when I wanted to forward > some of the packets out of the external interface since they ignored my > attempts to route them and came straight back into the tun instead.) > I have always achieved this sort of thing using ipfw fwd rules, rather than trying to bend the IP stack to do it.