<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body style="background-color: rgb(255, 255, 255); color: rgb(0, 0,
0);" bgcolor="#FFFFFF" text="#000000">
On 05/12/2016 17:12, Maxim Dounin wrote:<br>
<blockquote cite="mid:20161205171206.GJ18639@mdounin.ru" type="cite">
<pre wrap="">Hello!
On Mon, Dec 05, 2016 at 02:40:27PM +0000, Steven Hartland wrote:
</pre>
</blockquote>
snip...<br>
<blockquote cite="mid:20161205171206.GJ18639@mdounin.ru" type="cite">
<pre wrap="">Given that the real local address of the listening socket as shown
by netstat is 10.10.96.146, it means that the socket was created
when there were no explicit 127.0.0.1 in the jail.</pre>
</blockquote>
<br>
This didn't appear to be the case as nginx was restarted after the
failure of upgrade and currently shows:<br>
netstat -na | grep LIST<br>
tcp4 0 0 10.10.96.146.81 *.*
LISTEN<br>
<br>
The jail does indeed have an explicit 127.0.0.1 as reported by
ifconfig from within said jail.<br>
ifconfig lo0<br>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu
16384<br>
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6><br>
inet 127.0.0.1 netmask 0xffffffff <br>
<br>
/etc/jail.conf includes:<br>
jailXYZ {<br>
path = "/data/jails/XYZ";<br>
ip4.addr = "10.10.96.146";<br>
ip4.addr += "vlan96|A.B.C.D";<br>
ip4.addr += "lo0|127.0.0.1";<br>
}<br>
<br>
This is what we see when 127.0.0.1 is not exposed to the jail, which
is where I would expect the behaviour you describe:<br>
ifconfig lo0<br>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu
16384<br>
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6><br>
groups: lo <br>
<br>
Digging into to source of jails I found the offending code:<br>
ia0.s_addr = ntohl(ia->s_addr);<br>
if (ia0.s_addr == INADDR_LOOPBACK) {<br>
ia->s_addr = pr->pr_ip4[0].s_addr;<br>
mtx_unlock(&pr->pr_mtx);<br>
return (0);<br>
}<br>
...<br>
if (ntohl(ia->s_addr) == INADDR_LOOPBACK) {<br>
ia->s_addr = pr->pr_ip4[0].s_addr;<br>
mtx_unlock(&pr->pr_mtx);<br>
return (0);<br>
}<br>
<br>
This uses the first IP of the jail as loopback even if there is an
address which explicitly matches.<br>
<br>
So the workaround would be to change the order of the IP's in our
jail config making 127.0.0.1 the first IP.<br>
<br>
However this doesn't seem to be documented in jail man page so quite
possibly needs fixing.<br>
<br>
Thanks for pointing me in the right direction.<br>
<br>
I'll talk to the jail / net guys and get that fixed. At the very
least it should be clearly documented in JAIL(8) but ideally it
should do the right thing when the jail has an address which matches
INADDR_LOOPBACK.<br>
<br>
Regards<br>
Steve<br>
<br>
</body>
</html>