We are using haproxy version 1.8.14-1 in a docker container running ubuntu 
14.04 / kernel: 4.15.0-39-generic (Base host where container is running 18.04 / 
kernel 4.15.0-39-generic)
getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes 
returning the source IP instead the destination IP.
Using getsockname() instead looks like solving the issue.

For example: Out of 6569124 requests , 4 requests were wrong 0.000060891 %

Can we file this as bug ? Get the fixed version in next release ?
Also getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is used only for 
send-proxy feature (for connected proxy IP) or any other feature in haproxy 
also using this ?

Thanks for your help.

-Roobesh G M
From: Mohandass, Roobesh
Sent: Wednesday, December 19, 2018 11:36 AM
To: haproxy@formilux.org
Subject: Send-proxy not modifying some traffic with proxy ip/port details 
instead retaining same client ip port

Hi Team,
We have send-proxy configured and running fine all these days. Noticed when we 
started logging, some traffic which passed from haproxy to backend server 
noticed that send-proxy is not actually modifying the proxy ip/port, instead 
retaining same client ip/port like below,

PROXY TCP4 45066 45066
PROXY TCP4 45075 45075

We tried to sniff the packet the moment it leaves haproxy and above is what we 
see. This is only happening only sometimes for some traffic and rest of the 
traffic properly looks good.

Could you please see this is a known bug in the version we running or something 
known issue with send-proxy v1 ?

We are running below version of code,

haproxy -vv

HA-Proxy version 1.8.14-1ppa1~trusty 2018/09/23
Copyright 2000-2018 Willy Tarreau wi...@haproxy.org<mailto:wi...@haproxy.org>

Build options :
TARGET = linux2628
CPU = generic
CC = gcc
CFLAGS = -g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat 
-Werror=format-security -D_FORTIFY_SOURCE=2

Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with OpenSSL version : OpenSSL 1.0.1f 6 Jan 2014
Running on OpenSSL version : OpenSSL 1.0.1f 6 Jan 2014
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : SSLv3 TLSv1.0 TLSv1.1 TLSv1.2
Built with Lua version : Lua 5.3.1
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT 
Encrypted password support via crypt(3): yes
Built with multi-threading support.
Built with PCRE version : 8.31 2012-07-06
Running on PCRE version : 8.31 2012-07-06
PCRE library supports JIT : no (libpcre build without JIT?)
Built with zlib version : 1.2.8
Running on zlib version : 1.2.8
Compression algorithms supported : identity("identity"), deflate("deflate"), 
raw-deflate("deflate"), gzip("gzip")
Built with network namespace support.

Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.

Available filters :
[SPOE] spoe
[COMP] compression
[TRACE] trace

Thanks for your help.

-Roobesh G M

Reply via email to