FR: set source ip about host-sflow

[sflow]

An sFlow collector should never pay much attention to the IP source address of the sFlow datagrams. The collector should only look at the sFlow agent address, which is a field in the sFlow payload that is intended to be the unique identifier for the agent. This allows for the sFlow to take any available route, or be forwarded on without spoofing or tunneling.

If your question is really about avoiding untrusted paths, then I think it would work just as well to use a VRF (which you can specify in the collector{} spec in hsflowd.conf), or add an extra route to the routing table, or even add an iptables rule. An option to call bind() on the socket in the hsflowd code is certainly possible, but it seems to me like it might cause as many problems as it solves.

What do you think?

[asy972]

The collector can be protected by a firewall. UDP packets may have a spoofed source IP address, but nevertheless firewall can be used sometime. One fixed IP is more usable in this case.

An option to call bind() on the socket in the hsflowd code is certainly possible, but it seems to me like it might cause as many problems as it solves.

If there is an opportunity then there is a choice. What problems do you expect when using bind()?

[sflow]

Well, I'd forgotten we did this, but if you specify something like this:

collector { ip=10.1.2.3 dev=eth0 }

then I believe it will effectively bind to eth0. It's just that it happens not with bind() but with this call:
https://github.com/sflow/host-sflow/blob/master/src/Linux/hsflowd.c#L1116

So please try adding the dev=IF setting and let me know if that works the way you want it to. (You can also specify a namespace in the collector{} section if you need to).

[asy972]

So please try adding the dev=IF setting and let me know if that works the way you

I try "collector { ip=x.x.x.x dev=lo2 }". IP of lo2 is used, but packets are also sent to lo2. The point of this FR is not to be tied to interfaces through which traffic can send from host.