Bug 168678
| Summary: | [jail] raw sockets incorrectly choose source address when jail has multiple subnets | ||
|---|---|---|---|
| Product: | Base System | Reporter: | Mark Felder <feld> |
| Component: | kern | Assignee: | Bjoern A. Zeeb <bz> |
| Status: | Open --- | ||
| Severity: | Affects Only Me | CC: | bz, dch, info, ports, thy295, wblock |
| Priority: | Normal | ||
| Version: | Unspecified | ||
| Hardware: | Any | ||
| OS: | Any | ||
|
Description
Mark Felder
2012-06-04 19:50:17 UTC
Responsible Changed From-To: freebsd-bugs->freebsd-jail Fix assignment per submitter request Responsible Changed From-To: freebsd-jail->bz bz feels the bugs. The ping patch has been living in my browser window for weeks now; I should get the kernel fix done as well. http://people.freebsd.org/~bz/20120407-01-ping-source-addr.diff The problem is described here: http://svnweb.freebsd.org/base/head/sys/netinet/raw_ip.c?annotate=229265#l461 Responsible Changed From-To: bz->gnn I shall not use bugzilla (at least until we will have a CLI). This also affects jails on machines with more than one network interface and gateway_enable="YES". If the jail is given a unique loopback interface, pings fail with "Can't assign requested address". ezjail-admin create examplejail "lo1|127.0.1.2,fxp0|192.168.1.101" sed -i'' -e 's/parameters=""/parameters="allow.raw_sockets=1"/' /usr/local/etc/ezjail/examplejail ezjail-admin start examplejail ezjail-admin console examplejail # ping 192.168.1.101 (jail address) PING 192.168.1.101 (192.168.1.101): 56 data bytes 64 bytes from 192.168.1.101: icmp_seq=0 ttl=64 time=0.122 ms ^C --- 192.168.1.101 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss # ping 8.8.178.110 # (freebsd.org) PING 8.8.178.110 (8.8.178.110): 56 data bytes ping: sendto: Can't assign requested address ping: sendto: Can't assign requested address ^C 2 packets transmitted, 0 packets received, 100.0% packet loss If the jail uses the host's loopback, it works. Change /usr/local/etc/ezjail/examplejail from export jail_examplejail_ip="lo1|127.0.1.2,fxp0|192.168.1.101" export jail_examplejail_ip="fxp0|192.168.1.101" Or set gateway_enable="NO". My tests were on 10-STABLE r269604 amd64. Yes I should really fix this (I am sure I did) but it might have never made it into the kernel. This is still an issue on 10.3-RELEASE and doesn't seem to be limited to raw sockets. More specifically, if I try to assign both a global IPv4 as well as an address in the RFC 1918 range (both on the same interface), then the first assigned address gets chosen regardless of the target network. In particular, the jail will either only use the local address for outgoing connections (if the local address was assigned first) or will fail to connect to addresses in the local network (if the global address was assigned first), e.g. for resolving DNS queries via a local DNS resolver or delivering emails to an internal host. This kind of breaks most setups that rely on internal services. :/ batch change: For bugs that match the following - Status Is In progress AND - Untouched since 2018-01-01. AND - Affects Base System OR Documentation DO: Reset to open status. Note: I did a quick pass but if you are getting this email it might be worthwhile to double check to see if this bug ought to be closed. This is one of my favorite jail bugs and I still think about it a few times a year. Big thanks for help diagnosing it that night back in 2012. I think this rarely hits anyone, but would love someone to confirm it's finally fixed. Maybe a christmas present this year? :-) |