sshttpd[2818]: sshttp::loop::NS_Socket::dstaddr::getsockopt:Protocol not available about sshttp HOT 8 CLOSED

[root@test netfilter]# lsmod | grep -i prox
xt_TPROXY              20480  0
nf_defrag_ipv6         36864  2 xt_socket,xt_TPROXY
nf_defrag_ipv4         16384  3 xt_socket,nf_conntrack_ipv4,xt_TPROXY
[root@test netfilter]# lsmod | grep -i sock
xt_socket              16384  0
nf_socket_ipv4         16384  1 xt_socket
nf_socket_ipv6         16384  1 xt_socket
nf_defrag_ipv6         36864  2 xt_socket,xt_TPROXY
nf_defrag_ipv4         16384  3 xt_socket,nf_conntrack_ipv4,xt_TPROXY
[root@test netfilter]#

strace: Process 16599 attached
restart_syscall(<... resuming interrupted poll ...>) = 0
poll([{fd=-1}, {fd=-1}, {fd=-1}, {fd=-1}, {fd=4, events=POLLIN|POLLOUT}], 5, 1000) = 0 (Timeout)
poll([{fd=-1}, {fd=-1}, {fd=-1}, {fd=-1}, {fd=4, events=POLLIN|POLLOUT}], 5, 1000) = 0 (Timeout)
poll([{fd=-1}, {fd=-1}, {fd=-1}, {fd=-1}, {fd=4, events=POLLIN|POLLOUT}], 5, 1000) = 1 ([{fd=4, revents=POLLIN}])
accept4(4, {sa_family=AF_INET, sa_data="\304\\\n\0070\217"}, [8->16], SOCK_NONBLOCK) = 7
setsockopt(7, SOL_TCP, TCP_NODELAY, [1], 4) = 0
accept4(4, 0x7ffe56345e10, [16], SOCK_NONBLOCK) = -1 EAGAIN (Resource temporarily unavailable)
poll([{fd=-1}, {fd=-1}, {fd=-1}, {fd=-1}, {fd=4, events=POLLIN|POLLOUT}, {fd=-1}, {fd=-1}, {fd=7, events=POLLIN}], 8, 1000) = 1 ([{fd=7, revents=POLLIN}])
getsockopt(7, SOL_IP, 0x50 /* IP_??? */, 0x7ffe56345e20, [16]) = -1 ENOENT (No such file or directory)
close(7)                                = 0
getpid()                                = 16599
sendto(3, "<27>Mar 13 19:36:16 sshttpd[1659"..., 106, MSG_NOSIGNAL, NULL, 0) = 106
poll([{fd=-1}, {fd=-1}, {fd=-1}, {fd=-1}, {fd=4, events=POLLIN|POLLOUT}, {fd=-1}, {fd=-1}], 7, 1000) = 0 (Timeout)
poll([{fd=-1}, {fd=-1}, {fd=-1}, {fd=-1}, {fd=4, events=POLLIN|POLLOUT}], 5, 1000) = 0 (Timeout)
poll([{fd=-1}, {fd=-1}, {fd=-1}, {fd=-1}, {fd=4, events=POLLIN|POLLOUT}], 5, 1000) = 0 (Timeout)

#!/bin/sh

# sshttp netfilter rules
#

# If you mux SSH/SMTP (rather than HTTP), then HTTP_PORT is your
# alternate SMTP port. e.g. 2525 and sshttp needs to be started with
# '-L 25 -H 2525'

DEV=en0

# The ports you want to mux:
# -S <port> -H <port> and any other -N SNI:<ports> (in case of HTTPS)
# do NOT add the -L port here
# standard SSH / HTTP mux looks like this (sshttpd -S 22 -H 8080 -L 80)
PORTS="222 9200"

# a SSH / HTTPS mux with https server on port 4433 and a drops
# on port 7350 looks like this (sshttpd -S 22 -H 4433 -L 443 -N drops.v2:7350)
#PORTS="22 4433 7350"

# SNI-only mux without SSH (sshttpd -S 0 -H 4433 -L 443 -N drops.v2:7350)
#PORTS="4433 7350"

#if it clashes with complex NATing rules, try this
iptables -t mangle -F
iptables -t nat -F
iptables -t raw -F

modprobe nf_conntrack_ipv4 || true
iptables -t mangle -N DIVERT || true

echo "Using network device $DEV"

for p in $PORTS; do
        echo "Setting up port $p ..."

        # block direct access from outside
        iptables -A INPUT -i $DEV -p tcp --dport $p -j DROP

        # and divert anything back to sshttpd that comes from the muxed services
        # so sshttpd can see it
        iptables -t mangle -A OUTPUT -p tcp -o $DEV --sport $p -j DIVERT
done

iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT

iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT

ip rule add fwmark 1 lookup 123 || true
ip route add local 0.0.0.0/0 dev lo table 123