Date: Wed, 16 Apr 2003 14:02:59 +0200 From: Pawel Jakub Dawidek <nick@garage.freebsd.pl> To: Jan Grant <Jan.Grant@bristol.ac.uk> Cc: Poul-Henning Kamp <phk@FreeBSD.org> Subject: Re: Multiple ip-numbers in jails (fixed INADDR_ANY behaviour). Message-ID: <20030416120259.GB92137@garage.freebsd.pl> In-Reply-To: <Pine.GSO.4.44.0304161221370.14291-100000@mail.ilrt.bris.ac.uk> References: <20030415171757.GU52293@garage.freebsd.pl> <Pine.GSO.4.44.0304161221370.14291-100000@mail.ilrt.bris.ac.uk>
next in thread | previous in thread | raw e-mail | index | archive | help
--WhfpMioaduB5tiZL Content-Type: text/plain; charset=iso-8859-2 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Apr 16, 2003 at 12:25:11PM +0100, Jan Grant wrote: +> > Another thing are priorities. +> > When port X is opened on main host and in jail as INADDR_ANY, current +> > implementation of jail converts INADDR_ANY to jail's IP. +> > When we're connecting to this port we will connect to jail's daemon, +> > because "exactly match" is there. +> > In my solution looking for opened port is in this order: +> > 1. non-jailed, non-wild. +> > 2. non-jailed, wild. +> > 3. jailed, non-wild. +> > 4. jailed, wild. +>=20 +> Hang on, so you're saying that if my machine has (say) 4 IP addresses, +> and the jail has two of them, and I've a process listening on INADDR_ANY +> in a non-jail, and one listening on INADDR_ANY in a jail, then a +> connection to one of the jailed IPs will wind up with the non-jail +> process? In current implelentation - yes, becuase there is no INADDR_ANY in jail, becuase INADDR_ANY address is translated to jail's ip when bind(2) is called. When connection arrives kernel choosing "exactly match" first and "exactly match" is real ip number. If there is no "exactly match" INADDR_ANY is taken. But check this out by yourself: # /usr/sbin/sshd -p 666 # jail / temp <yourip> /usr/sbin/sshd -p 666 # ssh -p 666 <yourip> # hostname (sshd binds to INADDR_ANY by default) --=20 Pawel Jakub Dawidek pawel@dawidek.net UNIX Systems Programmer/Administrator http://garage.freebsd.pl Am I Evil? Yes, I Am! http://cerber.sourceforge.net --WhfpMioaduB5tiZL Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (FreeBSD) iQCVAwUBPp1Gcz/PhmMH/Mf1AQFF1AP/dhwjLFRYRUhA+xitP6Jlsbpph7ugXzDF n89Fvm5IE8BVxI4MY1RJnkx0H7eaCQlDpzGBDF0RhYOMncb3SMFFDzc4GlyiJC8k QU3E40mtAgy3qSSeXiaMoPm2fOt3dhTjdf2tcN/1QdleAvSRNcmCsfFljxNtBkeV F1Hwu3yQQyc= =Hgq8 -----END PGP SIGNATURE----- --WhfpMioaduB5tiZL--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030416120259.GB92137>