<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body style="background-color: rgb(255, 255, 255); color: rgb(0, 0,
0);" bgcolor="#FFFFFF" text="#000000">
On 05/12/2016 13:27, Maxim Dounin wrote:<br>
<blockquote cite="mid:20161205132706.GF18639@mdounin.ru" type="cite">
<pre wrap="">Hello!
On Sun, Dec 04, 2016 at 09:39:59PM +0000, Steven Hartland wrote:
</pre>
<blockquote type="cite">
<pre wrap="">We've used nginx for years and never had an issue with nginx upgrade
until today where the upgrade command ran but almost instantly after the
new process exited.
/usr/local/etc/rc.d/nginx upgrade
Performing sanity check on nginx configuration:
nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful
Upgrading nginx binary:
Stopping old binary:
In the default nginx log we had:
2016/12/04 21:18:22 [emerg] 25435#0: bind() to 127.0.0.1:81 failed (48:
Address already in use)
nginx: [emerg] bind() to 127.0.0.1:81 failed (48: Address already in use)
2016/12/04 21:18:22 [emerg] 25435#0: bind() to 127.0.0.1:81 failed (48:
Address already in use)
nginx: [emerg] bind() to 127.0.0.1:81 failed (48: Address already in use)
2016/12/04 21:18:22 [emerg] 25435#0: bind() to 127.0.0.1:81 failed (48:
Address already in use)
nginx: [emerg] bind() to 127.0.0.1:81 failed (48: Address already in use)
2016/12/04 21:18:22 [emerg] 25435#0: bind() to 127.0.0.1:81 failed (48:
Address already in use)
nginx: [emerg] bind() to 127.0.0.1:81 failed (48: Address already in use)
2016/12/04 21:18:22 [emerg] 25435#0: bind() to 127.0.0.1:81 failed (48:
Address already in use)
nginx: [emerg] bind() to 127.0.0.1:81 failed (48: Address already in use)
2016/12/04 21:18:22 [emerg] 25435#0: still could not bind()
nginx: [emerg] still could not bind()
Running the start just after resulted in a running version but is
obviously unexpected to have upgrade result in a failure.
I believe the change to add a localhost bind to the server in question
was relatively recent so I suspect it has something to do with that.
The config for this is simply:
server {
listen 127.0.0.1:81;
server_name localhost;
location /status {
stub_status;
}
}
The upgrade in this case was:
nginx: 1.10.1_1,2 -> 1.10.2_2,2
Now this server is running under FreeBSD in a jail (10.2-RELEASE) and it
has 127.0.0.1 available yet it seems nginx has incorrectly bound the
address:
netstat -na | grep LIST | grep 81
tcp4 0 0 10.10.96.146.81 *.* LISTEN
</pre>
</blockquote>
<pre wrap="">
In a FreeBSD jail with a single IP address any listening address
is implicitly converted to the jail address. As a result, if you
write in config "127.0.0.1" - upgrade won't work, as it will see
inherited socket listening on the jail address (10.10.96.146 in
your case) and will try to create a new listening socket with the
address from the configuration and this will fail.</pre>
</blockquote>
<br>
Thanks for the response Maxim.<br>
<br>
In our case we don't have a single IP in the jail we have 4
addresses:<br>
1 x localhost address (127.0.0.1)<br>
2 x external<br>
1 x private address (10.10.96.146)<br>
<br>
We have a number of binds the externals are just port binds the
internal a localhost e.g.<br>
listen 443 default_server accept_filter=httpready ssl;<br>
listen 80 default_server accept_filter=httpready;<br>
...<br>
listen 80;<br>
listen 443 ssl;<br>
...<br>
listen 127.0.0.1:81;<br>
<br>
We're expecting the none IP specified listens to bind to * (this is
what happens)<br>
<br>
But the "listen 127.0.0.1:81" results in "10.10.96.146:81" instead.<br>
<br>
Given your description I would only expect this 127.0.0.1 wasn't
present in the jail and 10.10.96.146 was the only IP available.<br>
<br>
Did I miss-understand your description?<br>
<blockquote cite="mid:20161205132706.GF18639@mdounin.ru" type="cite">
<pre wrap="">There are two possible solutions for this problem:
- configure listening on the jail IP address to avoid this
implicit conversion;</pre>
</blockquote>
As above I'm not sure I follow you correctly as 127.0.0.1 is one of
the IP's available in the jail.<br>
<blockquote cite="mid:20161205132706.GF18639@mdounin.ru" type="cite">
<pre wrap="">
- configure listening on "*" and use multiple addresses in the jail.</pre>
</blockquote>
Unfortunately this is something we want to explicitly prevent with
this bind, its an internal service only.<br>
<blockquote cite="mid:20161205132706.GF18639@mdounin.ru" type="cite">
<pre wrap="">In both cases there will be no implicit conversion and as a result
everything will work correctly.
</pre>
</blockquote>
Regards<br>
Steve<br>
</body>
</html>