From nobody Tue Feb 22 21:30:21 2022 X-Original-To: freebsd-jail@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 0FFFA19D21F9; Tue, 22 Feb 2022 21:30:35 +0000 (UTC) (envelope-from sodynet1@gmail.com) Received: from mail-qv1-xf34.google.com (mail-qv1-xf34.google.com [IPv6:2607:f8b0:4864:20::f34]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1D4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4K3C5635nGz4qHs; Tue, 22 Feb 2022 21:30:34 +0000 (UTC) (envelope-from sodynet1@gmail.com) Received: by mail-qv1-xf34.google.com with SMTP id o5so3076025qvm.3; Tue, 22 Feb 2022 13:30:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:from:date:message-id:subject:to; bh=n3LscQcDRA+v4tjDyFVMynDA7lNyzUO1Ng9mlnCudmU=; b=CiKXEW0S5U4z57w7syhGgTmS+hsbs+EDHtlAdJ/dW0qImqfFX8412kBIjui/+ZDf6C pdqoWTWIWdQJAU7Q+KG0+BZHW8IoALZlpg6/t8aYwbbTmMBFX5BEUgoqUjqWTqMWxEgy mGo0McI8teDnZ0szWqAxW8iGOLX7V4pHmXbpILfpjkVrU9FJG2517A+zxVUkn/w7mEzf N7MT3r5bVkBNV3ha30leiD9LohWFVz6GsTpxmWihtsc06NSKILUJuu6nCqtooyW7B1Ox 7ZFNNJeLYjLX6ZXAvblprP0zy5ZGDBG9jerp8ViL7CIRHrFqFlN9CBlCumxjENjqW/Ji 3ynQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=n3LscQcDRA+v4tjDyFVMynDA7lNyzUO1Ng9mlnCudmU=; b=VjyrflB9VWbz115nnD8vw/rOX1cKo0P8+l97A53lF0LgeI1dG+r6HP1/kysPtmonjo Bws5f4kLz7Iqz1hUqjeEXzBgF12Y7DHgQwSPvMjUubvXozdfxdqy30+okZoJ5g0R1xdN SjbX+NY8lYEtDVFTiIl8/wxtbN9SScLHzk2jI+vCEOBKCYpmS1TKblUPsOaLlpmhLt80 h8ttxvttkJ6HIQ10G28UnL5vrtTX+YRIg2VGaIgfN+dZeUDqGvl0QNXKrpP8iDV7YX0N Dm18clcvBiUMAiXTT48E0vrlrPhroaUAI9AgJKl7SwROKk3B9m5S1fO7vEPWOqAzAG54 RMeA== X-Gm-Message-State: AOAM532OfNybMYnR0aOgnpuu3W2XqTh8OflaYztTwf14aKhe21gz+0Mi 6qm97ZxIeRrEh7Q6q+MiLEpfUB2vJfJcPZ8SR9a/VLyvupA= X-Google-Smtp-Source: ABdhPJyhyE513GaclIIRmhIn9lxmNsWltqXB2D/egd8Up0+bTB75kchZJoatfJDLWpwH4EvtR/PyitGNCsZHdi4OYM4= X-Received: by 2002:ac8:13c1:0:b0:2d5:3c22:8e22 with SMTP id i1-20020ac813c1000000b002d53c228e22mr23715493qtj.306.1645565432126; Tue, 22 Feb 2022 13:30:32 -0800 (PST) List-Id: Discussion about FreeBSD jail(8) List-Archive: https://lists.freebsd.org/archives/freebsd-jail List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-jail@freebsd.org MIME-Version: 1.0 From: Sami Halabi Date: Tue, 22 Feb 2022 23:30:21 +0200 Message-ID: Subject: linux debian jail - network problems To: freebsd-jail@freebsd.org, freebsd-net@freebsd.org, freebsd-emulation@freebsd.org Content-Type: multipart/alternative; boundary="0000000000000960bf05d8a20fa9" X-Rspamd-Queue-Id: 4K3C5635nGz4qHs X-Spamd-Bar: - Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20210112 header.b=CiKXEW0S; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of sodynet1@gmail.com designates 2607:f8b0:4864:20::f34 as permitted sender) smtp.mailfrom=sodynet1@gmail.com X-Spamd-Result: default: False [-2.00 / 15.00]; FREEMAIL_FROM(0.00)[gmail.com]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36]; TO_DN_NONE(0.00)[]; URI_COUNT_ODD(1.00)[5]; MID_RHS_MATCH_FROMTLD(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; NEURAL_HAM_SHORT(-1.00)[-1.000]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; FREEMAIL_ENVFROM(0.00)[gmail.com]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20210112]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; TO_MATCH_ENVRCPT_ALL(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::f34:from]; HTTP_TO_IP(1.00)[]; MLMMJ_DEST(0.00)[freebsd-jail,freebsd-net,freebsd-emulation]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[] X-ThisMailContainsUnwantedMimeParts: N --0000000000000960bf05d8a20fa9 Content-Type: text/plain; charset="UTF-8" Hi all, sorry for the cross post but I need help and I'm not sure where it hangs. I create linux jail (debian bullseye) via cbsd. the jail is being populated with the debian userland.. so far so good... services running (sshd) and I can login to the jail, I also can update packages and I can install apache httpd and all works fine (apt install or make from src). I also manage to install packages even if their scripts depend on "ip" command that fails: cbsd@j2> ip Cannot open netlink socket: Address family not supported by protocol ifconfig show empty interfaces: cbsd@j2> ifconfig eth0: flags=4163 mtu 1500 ether 00:50:56:0a:b3:a0 (Ethernet) RX packets 139798314 bytes 12029597009 (11.2 GiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 26879143 bytes 34400160833 (32.0 GiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo0: flags=4169 mtu 16384 loop (Local Loopback) RX packets 28548 bytes 160312960 (152.8 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 28548 bytes 160312960 (152.8 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 I know linux emulation doesn't implement netlink.. so what I do is fake the response by replacing /bin/ip by a bash script that prints the correct IP and fakes some other (needed by packages i Installed): #!/bin/bash if [ "$1" = "-o" ]; then echo "1: eth0 inet 192.168.1.2/24 brd 192.168.1.255 scope global eth0" elif [ "$1" = "route" ]; then if [ "$2" = "get" ]; then echo "8.8.8.8 via 192.168.1.2 dev eth0 src 192.168.1.2 " else echo "default via 192.168.1.2 dev eth0" fi else echo "1: eth0: mtu 1500 qdisc mq state UP qlen 1000" echo " inet 192.168.1.2 /24 brd 192.168.1.255 scope global eth0" still ifconfig shows no IP... its time to say it a regular jail and *NOT* VNET. *however* package that pull ips via libraries fail.. eg: installed bind916 (name) in the logs I see these errors (relevant only): cbsd@j2> service named start Starting domain name service...: namednamed: prctl(PR_SET_DUMPABLE) failed: Invalid argument cbsd@j2> log file shows: 22-Feb-2022 23:11:58.705 general: notice: BIND 9 is maintained by Internet Systems Consortium, 22-Feb-2022 23:11:58.705 general: notice: Inc. (ISC), a non-profit 501(c)(3) public-benefit 22-Feb-2022 23:11:58.705 general: notice: corporation. Support and training for BIND 9 are 22-Feb-2022 23:11:58.705 general: notice: available at https://www.isc.org/support 22-Feb-2022 23:11:58.705 general: notice: ---------------------------------------------------- 22-Feb-2022 23:11:58.705 general: info: found 6 CPUs, using 6 worker threads 22-Feb-2022 23:11:58.705 general: info: using 6 UDP listeners per interface 22-Feb-2022 23:11:58.705 general: info: using up to 21000 sockets 22-Feb-2022 23:11:58.715 general: info: loading configuration from '/etc/bind/named.conf' 22-Feb-2022 23:11:58.715 general: info: reading built-in trust anchors from file '/etc/bind/bind.keys' 22-Feb-2022 23:11:58.715 general: info: looking for GeoIP2 databases in '/usr/share/GeoIP' 22-Feb-2022 23:11:58.715 general: info: using default UDP/IPv4 port range: [1024, 65535] 22-Feb-2022 23:11:58.715 general: info: using default UDP/IPv6 port range: [1024, 65535] 22-Feb-2022 23:11:58.715 network: info: no IPv6 interfaces found 22-Feb-2022 23:11:58.715 general: error: ifiter_getifaddrs.c:79: unexpected error: 22-Feb-2022 23:11:58.715 general: error: getting interface addresses: getifaddrs: Address family not supported by protocol 22-Feb-2022 23:11:58.715 network: warning: not listening on any interfaces *snip* *snip* 22-Feb-2022 23:11:58.735 general: error: socket.c:2405: unexpected error: 22-Feb-2022 23:11:58.735 general: error: setsockopt(50, IP_RECVTOS) failed: Protocol not available 22-Feb-2022 23:11:58.735 general: notice: couldn't add command channel 127.0.0.1#953: permission denied 22-Feb-2022 23:11:58.735 general: error: socket.c:2405: unexpected error: 22-Feb-2022 23:11:58.735 general: error: setsockopt(50, IP_RECVTOS) failed: Protocol not available 22-Feb-2022 23:11:58.735 general: notice: couldn't add command channel 127.0.0.1#953: permission denied 22-Feb-2022 23:11:58.735 zoneload: info: managed-keys-zone: loaded serial 24 22-Feb-2022 23:11:58.735 zoneload: info: zone 0.in-addr.arpa/IN: loaded serial 1 22-Feb-2022 23:11:58.735 general: error: socket.c:2405: unexpected error: 22-Feb-2022 23:11:58.735 general: error: setsockopt(512, IP_RECVTOS) failed: Protocol not available 22-Feb-2022 23:11:58.735 general: error: socket.c:2405: unexpected error: 22-Feb-2022 23:11:58.735 general: error: setsockopt(513, IP_RECVTOS) failed: Protocol not available 22-Feb-2022 23:11:58.745 zoneload: info: zone 255.in-addr.arpa/IN: loaded serial 1 22-Feb-2022 23:11:58.745 zoneload: info: zone j1.royalshells.com/IN: loaded serial 2022022106 22-Feb-2022 23:11:58.745 notify: info: zone j1.royalshells.com/IN: sending notifies (serial 2022022106) 22-Feb-2022 23:11:58.745 general: error: socket.c:2405: unexpected error: 22-Feb-2022 23:11:58.745 general: error: setsockopt(514, IP_RECVTOS) failed: Protocol not available 22-Feb-2022 23:11:58.745 zoneload: info: zone localhost/IN: loaded serial 2 22-Feb-2022 23:11:58.745 general: error: socket.c:2405: unexpected error: 22-Feb-2022 23:11:58.745 general: error: setsockopt(515, IP_RECVTOS) failed: Protocol not available 22-Feb-2022 23:11:58.745 zoneload: info: zone 127.in-addr.arpa/IN: loaded serial 1 22-Feb-2022 23:11:58.745 general: notice: all zones loaded 22-Feb-2022 23:11:58.745 general: notice: running 22-Feb-2022 23:11:58.795 general: error: socket.c:2405: unexpected error: 22-Feb-2022 23:11:58.795 general: error: setsockopt(50, IP_RECVTOS) failed: Protocol not available 22-Feb-2022 23:12:58.811 general: error: ifiter_getifaddrs.c:79: unexpected error: 22-Feb-2022 23:12:58.811 general: error: getting interface addresses: getifaddrs: Address family not supported by protocol 22-Feb-2022 23:12:58.811 network: warning: not listening on any interfaces Any Idea how to fix this?? cbsd@j2> named -V BIND 9.16.22-Debian (Extended Support Version) running on Linux x86_64 3.2.0 FreeBSD 12.3-RELEASE-p1 GENERIC installing newer versions I have also problems with dovecot mail package.. but will leave it for now Thanks in advance, Sami --0000000000000960bf05d8a20fa9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,
sorry for the cross post but I need help and I= 'm not sure where it hangs.

I create linux jai= l (debian bullseye) via cbsd.
the jail is being populated with th= e debian userland..
so far so good... services running (sshd) and= I can login to the jail, I also can update packages=C2=A0and I can install= apache httpd and all works fine (apt install or make from src).
= I also manage to install packages even if their scripts depend on "ip&= quot; command that fails:
cbsd@j2> ip
Cannot open netlink s= ocket: Address family not supported by protocol

ifconfig show empty interfaces:
cbsd@j2> ifconfig
eth0: f= lags=3D4163<UP,BROADCAST,RUNNING,MULTICAST> =C2=A0mtu 1500
=C2=A0 = =C2=A0 =C2=A0 =C2=A0 ether 00:50:56:0a:b3:a0 =C2=A0(Ethernet)
=C2=A0 =C2= =A0 =C2=A0 =C2=A0 RX packets 139798314 =C2=A0bytes 12029597009 (11.2 GiB)=C2=A0 =C2=A0 =C2=A0 =C2=A0 RX errors 0 =C2=A0dropped 0 =C2=A0overruns 0 = =C2=A0frame 0
=C2=A0 =C2=A0 =C2=A0 =C2=A0 TX packets 26879143 =C2=A0byte= s 34400160833 (32.0 GiB)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 TX errors 0 =C2=A0d= ropped 0 overruns 0 =C2=A0carrier 0 =C2=A0collisions 0

lo0: flags=3D= 4169<UP,LOOPBACK,RUNNING,MULTICAST> =C2=A0mtu 16384
=C2=A0 =C2=A0 = =C2=A0 =C2=A0 loop =C2=A0(Local Loopback)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 RX= packets 28548 =C2=A0bytes 160312960 (152.8 MiB)
=C2=A0 =C2=A0 =C2=A0 = =C2=A0 RX errors 0 =C2=A0dropped 0 =C2=A0overruns 0 =C2=A0frame 0
=C2=A0= =C2=A0 =C2=A0 =C2=A0 TX packets 28548 =C2=A0bytes 160312960 (152.8 MiB)=C2=A0 =C2=A0 =C2=A0 =C2=A0 TX errors 0 =C2=A0dropped 0 overruns 0 =C2=A0c= arrier 0 =C2=A0collisions 0

I know linux emula= tion doesn't implement netlink.. so what I do is fake the response by r= eplacing /bin/ip by a bash script that prints the correct IP and fakes some= other (needed by packages i Installed):
#!/bin/bash
if [ = "$1" =3D "-o" ]; then
echo "1: eth0 inet 192.168.1.2/24 brd 192.168.1.255 scope glob= al eth0"
elif [ "$1" =3D "route" ]; then
=C2= =A0 =C2=A0 =C2=A0 =C2=A0 if [ "$2" =3D "get" ]; then=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 echo "8.8.8.8= via=C2=A0 192.168.1.2=C2=A0=C2=A0=C2=A0dev eth0 =C2=A0src=C2=A0 192.168.1.2=C2=A0 "
=C2=A0 =C2=A0 =C2=A0 =C2=A0 else
=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 echo "default via=C2=A0 192.168.1.2=C2=A0=C2=A0=C2=A0dev eth0"
=C2=A0 =C2=A0 =C2=A0 =C2=A0 = fi
else
echo "1: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> m= tu 1500 qdisc mq state UP qlen 1000"
echo " =C2=A0inet=C2=A0 192.168.1.2=C2=A0 /24 brd=C2=A0 192.168.1.255 scope global eth0"

still ifconfig shows no IP... its time to say it a regular jail= and *NOT* VNET.

*however* package that pull ips v= ia libraries fail..
eg: installed bind916 (name) in the logs I se= e these errors (relevant only):
cbsd@j2> service named startStarting domain name service...: namednamed: prctl(PR_SET_DUMPABLE) faile= d: Invalid argument
cbsd@j2>


<= div>log file shows:
22-Feb-2022 23:11:58.705 general: notice: BIN= D 9 is maintained by Internet Systems Consortium,
22-Feb-2022 23:11:58.7= 05 general: notice: Inc. (ISC), a non-profit 501(c)(3) public-benefit
22= -Feb-2022 23:11:58.705 general: notice: corporation.=C2=A0 Support and trai= ning for BIND 9 are
22-Feb-2022 23:11:58.705 general: notice: available = at https://www.isc.org/support<= br>22-Feb-2022 23:11:58.705 general: notice: ------------------------------= ----------------------
22-Feb-2022 23:11:58.705 general: info: found 6 C= PUs, using 6 worker threads
22-Feb-2022 23:11:58.705 general: info: usin= g 6 UDP listeners per interface
22-Feb-2022 23:11:58.705 general: info: = using up to 21000 sockets
22-Feb-2022 23:11:58.715 general: info: loadin= g configuration from '/etc/bind/named.conf'
22-Feb-2022 23:11:58= .715 general: info: reading built-in trust anchors from file '/etc/bind= /bind.keys'
22-Feb-2022 23:11:58.715 general: info: looking for GeoI= P2 databases in '/usr/share/GeoIP'
22-Feb-2022 23:11:58.715 gene= ral: info: using default UDP/IPv4 port range: [1024, 65535]
22-Feb-2022 = 23:11:58.715 general: info: using default UDP/IPv6 port range: [1024, 65535= ]
22-Feb-2022 23:11:58.715 network: info: no IPv6 interfaces found
22= -Feb-2022 23:11:58.715 general: error: ifiter_getifaddrs.c:79: unexpected e= rror:
22-Feb-2022 23:11:58.715 general: error: getting interface address= es: getifaddrs: Address family not supported by protocol
22-Feb-2022 23:= 11:58.715 network: warning: not listening on any interfaces
*= snip*
*snip*
22-Feb-2022 23:11:58.735 general: error: s= ocket.c:2405: unexpected error:
22-Feb-2022 23:11:58.735 general: error:= setsockopt(50, IP_RECVTOS) failed: Protocol not available
22-Feb-2022 2= 3:11:58.735 general: notice: couldn't add command channel 127.0.0.1#953= : permission denied
22-Feb-2022 23:11:58.735 general: error: = socket.c:2405: unexpected error:
22-Feb-2022 23:11:58.735 general: error= : setsockopt(50, IP_RECVTOS) failed: Protocol not available
22-Feb-2022 = 23:11:58.735 general: notice: couldn't add command channel 127.0.0.1#95= 3: permission denied
22-Feb-2022 23:11:58.735 zoneload: info: managed-ke= ys-zone: loaded serial 24
22-Feb-2022 23:11:58.735 zoneload: info: zone = 0.in-addr.arpa/IN: loaded serial 1
22-Feb-2022 23:11:58.735 general: err= or: socket.c:2405: unexpected error:
22-Feb-2022 23:11:58.735 general: e= rror: setsockopt(512, IP_RECVTOS) failed: Protocol not available
22-Feb-= 2022 23:11:58.735 general: error: socket.c:2405: unexpected error:
22-Fe= b-2022 23:11:58.735 general: error: setsockopt(513, IP_RECVTOS) failed: Pro= tocol not available
22-Feb-2022 23:11:58.745 zoneload: info: zone 255.in= -addr.arpa/IN: loaded serial 1
22-Feb-2022 23:11:58.745 zoneload: info: = zone j1.royalshells.com/IN: lo= aded serial 2022022106
22-Feb-2022 23:11:58.745 notify: info: zone j1.royalshells.com/IN: sending noti= fies (serial 2022022106)
22-Feb-2022 23:11:58.745 general: error: socket= .c:2405: unexpected error:
22-Feb-2022 23:11:58.745 general: error: sets= ockopt(514, IP_RECVTOS) failed: Protocol not available
22-Feb-2022 23:11= :58.745 zoneload: info: zone localhost/IN: loaded serial 2
22-Feb-2022 2= 3:11:58.745 general: error: socket.c:2405: unexpected error:
22-Feb-2022= 23:11:58.745 general: error: setsockopt(515, IP_RECVTOS) failed: Protocol = not available
22-Feb-2022 23:11:58.745 zoneload: info: zone 127.in-addr.= arpa/IN: loaded serial 1
22-Feb-2022 23:11:58.745 general: notice: all z= ones loaded
22-Feb-2022 23:11:58.745 general: notice: running
22-Feb-= 2022 23:11:58.795 general: error: socket.c:2405: unexpected error:
22-Fe= b-2022 23:11:58.795 general: error: setsockopt(50, IP_RECVTOS) failed: Prot= ocol not available
22-Feb-2022 23:12:58.811 general: error: i= fiter_getifaddrs.c:79: unexpected error:
22-Feb-2022 23:12:58.811 genera= l: error: getting interface addresses: getifaddrs: Address family not suppo= rted by protocol
22-Feb-2022 23:12:58.811 network: warning: n= ot listening on any interfaces

Any Idea how to= fix this??

cbsd@j2> named -V
BIND 9.16.22-D= ebian (Extended Support Version) <id:59bfaba>
running on Linux x86= _64 3.2.0 FreeBSD 12.3-RELEASE-p1 GENERIC

inst= alling newer=C2=A0versions=C2=A0

I have also probl= ems with dovecot mail package.. but will leave it for now

Thanks in advance,
Sami

--0000000000000960bf05d8a20fa9--