Date: Fri, 25 Feb 2022 10:18:22 +0800 From: Zhenlei Huang <zlei.huang@gmail.com> To: Sami Halabi <sodynet1@gmail.com> Cc: freebsd-jail@freebsd.org, freebsd-net@freebsd.org, freebsd-emulation@freebsd.org, FreeBSD Current <freebsd-current@freebsd.org> Subject: Re: linux debian jail - network problems Message-ID: <8020452A-63EA-4424-8D20-CC9B9397B603@gmail.com> In-Reply-To: <CAEW%2BogZTfDYOm9dfkrp=Go5tAY2FsGuM2zTDRVcH41WNG2eR6A@mail.gmail.com> References: <CAEW%2BogZpopx%2B9EPDY5hddqh5BfsVmZcZJrYtYLRF7gPgvHg%2BvA@mail.gmail.com> <CAEW%2BogZTfDYOm9dfkrp=Go5tAY2FsGuM2zTDRVcH41WNG2eR6A@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--Apple-Mail=_DAE7983B-1529-4D05-912B-E3DE644CF417 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, You can also track the WIP netlink feature, = https://reviews.freebsd.org/D33975 > On Feb 25, 2022, at 4:05 AM, Sami Halabi <sodynet1@gmail.com> wrote: >=20 > Hi, > Added Current, maybe will be lucky ;) >=20 > Anyone have idea how approach and fix this? >=20 > Sami >=20 > =D7=91=D7=AA=D7=90=D7=A8=D7=99=D7=9A =D7=99=D7=95=D7=9D =D7=92=D7=B3, = 22 =D7=91=D7=A4=D7=91=D7=A8=D7=B3 2022, 23:30, =D7=9E=D7=90=D7=AA Sami = Halabi =E2=80=8F<sodynet1@gmail.com <mailto:sodynet1@gmail.com>>: > Hi all, > sorry for the cross post but I need help and I'm not sure where it = hangs. >=20 > I create linux jail (debian bullseye) via cbsd. > the jail is being populated with the debian userland.. > so far so good... services running (sshd) and I can login to the jail, = I also can update packages and I can install apache httpd and all works = fine (apt install or make from src). > I also manage to install packages even if their scripts depend on "ip" = command that fails: > cbsd@j2> ip > Cannot open netlink socket: Address family not supported by protocol >=20 > ifconfig show empty interfaces: > cbsd@j2> ifconfig > eth0: flags=3D4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 > ether 00:50:56:0a:b3:a0 (Ethernet) > RX packets 139798314 bytes 12029597009 (11.2 GiB) > RX errors 0 dropped 0 overruns 0 frame 0 > TX packets 26879143 bytes 34400160833 (32.0 GiB) > TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 >=20 > lo0: flags=3D4169<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 > loop (Local Loopback) > RX packets 28548 bytes 160312960 (152.8 MiB) > RX errors 0 dropped 0 overruns 0 frame 0 > TX packets 28548 bytes 160312960 (152.8 MiB) > TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 >=20 > I know linux emulation doesn't implement netlink.. so what I do is = fake the response by replacing /bin/ip by a bash script that prints the = correct IP and fakes some other (needed by packages i Installed): > #!/bin/bash > if [ "$1" =3D "-o" ]; then > echo "1: eth0 inet 192.168.1.2/24 <http://192.168.1.2/24>; brd = 192.168.1.255 scope global eth0" > elif [ "$1" =3D "route" ]; then > if [ "$2" =3D "get" ]; then > echo "8.8.8.8 via 192.168.1.2 dev eth0 src = 192.168.1.2 " > else > echo "default via 192.168.1.2 dev eth0" > fi > else > echo "1: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq = state UP qlen 1000" > echo " inet 192.168.1.2 /24 brd 192.168.1.255 scope global eth0" >=20 >=20 > still ifconfig shows no IP... its time to say it a regular jail and = *NOT* VNET. >=20 > *however* package that pull ips via libraries fail.. > eg: installed bind916 (name) in the logs I see these errors (relevant = only): > cbsd@j2> service named start > Starting domain name service...: namednamed: prctl(PR_SET_DUMPABLE) = failed: Invalid argument > cbsd@j2> >=20 >=20 > log file shows: > 22-Feb-2022 23:11:58.705 general: notice: BIND 9 is maintained by = Internet Systems Consortium, > 22-Feb-2022 23:11:58.705 general: notice: Inc. (ISC), a non-profit = 501(c)(3) public-benefit > 22-Feb-2022 23:11:58.705 general: notice: corporation. Support and = training for BIND 9 are > 22-Feb-2022 23:11:58.705 general: notice: available at = https://www.isc.org/support <https://www.isc.org/support>; > 22-Feb-2022 23:11:58.705 general: notice: = ---------------------------------------------------- > 22-Feb-2022 23:11:58.705 general: info: found 6 CPUs, using 6 worker = threads > 22-Feb-2022 23:11:58.705 general: info: using 6 UDP listeners per = interface > 22-Feb-2022 23:11:58.705 general: info: using up to 21000 sockets > 22-Feb-2022 23:11:58.715 general: info: loading configuration from = '/etc/bind/named.conf' > 22-Feb-2022 23:11:58.715 general: info: reading built-in trust anchors = from file '/etc/bind/bind.keys' > 22-Feb-2022 23:11:58.715 general: info: looking for GeoIP2 databases = in '/usr/share/GeoIP' > 22-Feb-2022 23:11:58.715 general: info: using default UDP/IPv4 port = range: [1024, 65535] > 22-Feb-2022 23:11:58.715 general: info: using default UDP/IPv6 port = range: [1024, 65535] > 22-Feb-2022 23:11:58.715 network: info: no IPv6 interfaces found > 22-Feb-2022 23:11:58.715 general: error: ifiter_getifaddrs.c:79: = unexpected error: > 22-Feb-2022 23:11:58.715 general: error: getting interface addresses: = getifaddrs: Address family not supported by protocol > 22-Feb-2022 23:11:58.715 network: warning: not listening on any = interfaces > *snip* > *snip* > 22-Feb-2022 23:11:58.735 general: error: socket.c:2405: unexpected = error: > 22-Feb-2022 23:11:58.735 general: error: setsockopt(50, IP_RECVTOS) = failed: Protocol not available > 22-Feb-2022 23:11:58.735 general: notice: couldn't add command channel = 127.0.0.1#953: permission denied > 22-Feb-2022 23:11:58.735 general: error: socket.c:2405: unexpected = error: > 22-Feb-2022 23:11:58.735 general: error: setsockopt(50, IP_RECVTOS) = failed: Protocol not available > 22-Feb-2022 23:11:58.735 general: notice: couldn't add command channel = 127.0.0.1#953: permission denied > 22-Feb-2022 23:11:58.735 zoneload: info: managed-keys-zone: loaded = serial 24 > 22-Feb-2022 23:11:58.735 zoneload: info: zone 0.in-addr.arpa/IN: = loaded serial 1 > 22-Feb-2022 23:11:58.735 general: error: socket.c:2405: unexpected = error: > 22-Feb-2022 23:11:58.735 general: error: setsockopt(512, IP_RECVTOS) = failed: Protocol not available > 22-Feb-2022 23:11:58.735 general: error: socket.c:2405: unexpected = error: > 22-Feb-2022 23:11:58.735 general: error: setsockopt(513, IP_RECVTOS) = failed: Protocol not available > 22-Feb-2022 23:11:58.745 zoneload: info: zone 255.in-addr.arpa/IN: = loaded serial 1 > 22-Feb-2022 23:11:58.745 zoneload: info: zone j1.royalshells.com/IN = <http://j1.royalshells.com/IN>: loaded serial 2022022106 > 22-Feb-2022 23:11:58.745 notify: info: zone j1.royalshells.com/IN = <http://j1.royalshells.com/IN>: sending notifies (serial 2022022106) > 22-Feb-2022 23:11:58.745 general: error: socket.c:2405: unexpected = error: > 22-Feb-2022 23:11:58.745 general: error: setsockopt(514, IP_RECVTOS) = failed: Protocol not available > 22-Feb-2022 23:11:58.745 zoneload: info: zone localhost/IN: loaded = serial 2 > 22-Feb-2022 23:11:58.745 general: error: socket.c:2405: unexpected = error: > 22-Feb-2022 23:11:58.745 general: error: setsockopt(515, IP_RECVTOS) = failed: Protocol not available > 22-Feb-2022 23:11:58.745 zoneload: info: zone 127.in-addr.arpa/IN: = loaded serial 1 > 22-Feb-2022 23:11:58.745 general: notice: all zones loaded > 22-Feb-2022 23:11:58.745 general: notice: running > 22-Feb-2022 23:11:58.795 general: error: socket.c:2405: unexpected = error: > 22-Feb-2022 23:11:58.795 general: error: setsockopt(50, IP_RECVTOS) = failed: Protocol not available > 22-Feb-2022 23:12:58.811 general: error: ifiter_getifaddrs.c:79: = unexpected error: > 22-Feb-2022 23:12:58.811 general: error: getting interface addresses: = getifaddrs: Address family not supported by protocol > 22-Feb-2022 23:12:58.811 network: warning: not listening on any = interfaces >=20 > Any Idea how to fix this?? >=20 > cbsd@j2> named -V > BIND 9.16.22-Debian (Extended Support Version) <id:59bfaba> > running on Linux x86_64 3.2.0 FreeBSD 12.3-RELEASE-p1 GENERIC >=20 > installing newer versions=20 >=20 > I have also problems with dovecot mail package.. but will leave it for = now >=20 > Thanks in advance, > Sami >=20 --Apple-Mail=_DAE7983B-1529-4D05-912B-E3DE644CF417 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" = class=3D"">Hi,<div class=3D"">You can also track the WIP netlink = feature, <a href=3D"https://reviews.freebsd.org/D33975" = class=3D"">https://reviews.freebsd.org/D33975</a><br class=3D""><div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On Feb = 25, 2022, at 4:05 AM, Sami Halabi <<a = href=3D"mailto:sodynet1@gmail.com" class=3D"">sodynet1@gmail.com</a>> = wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div = dir=3D"auto" class=3D"">Hi,<div dir=3D"auto" class=3D"">Added Current, = maybe will be lucky ;)</div><div dir=3D"auto" class=3D""><br = class=3D""></div><div dir=3D"auto" class=3D"">Anyone have idea how = approach and fix this?</div><div dir=3D"auto" class=3D""><br = class=3D""></div><div dir=3D"auto" class=3D"">Sami</div></div><br = class=3D""><div class=3D"gmail_quote"><div dir=3D"ltr" = class=3D"gmail_attr">=D7=91=D7=AA=D7=90=D7=A8=D7=99=D7=9A =D7=99=D7=95=D7=9D= =D7=92=D7=B3, 22 =D7=91=D7=A4=D7=91=D7=A8=D7=B3 2022, 23:30, =D7=9E=D7=90= =D7=AA Sami Halabi =E2=80=8F<<a href=3D"mailto:sodynet1@gmail.com" = class=3D"">sodynet1@gmail.com</a>>:<br class=3D""></div><blockquote = class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc = solid;padding-left:1ex"><div dir=3D"ltr" class=3D"">Hi all,<div = class=3D"">sorry for the cross post but I need help and I'm not sure = where it hangs.</div><div class=3D""><br class=3D""></div><div = class=3D"">I create linux jail (debian bullseye) via cbsd.</div><div = class=3D"">the jail is being populated with the debian = userland..</div><div class=3D"">so far so good... services running = (sshd) and I can login to the jail, I also can update packages and = I can install apache httpd and all works fine (apt install or make from = src).</div><div class=3D"">I also manage to install packages even if = their scripts depend on "ip" command that fails:</div><div = class=3D"">cbsd@j2> ip<br class=3D"">Cannot open netlink socket: = Address family not supported by protocol<br class=3D""></div><div = class=3D""><br class=3D""></div><div class=3D"">ifconfig show empty = interfaces:</div><div class=3D"">cbsd@j2> ifconfig<br class=3D"">eth0: = flags=3D4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500<br = class=3D""> ether 00:50:56:0a:b3:a0 = (Ethernet)<br class=3D""> RX packets = 139798314 bytes 12029597009 (11.2 GiB)<br class=3D""> = RX errors 0 dropped 0 overruns 0 frame = 0<br class=3D""> TX packets 26879143 = bytes 34400160833 (32.0 GiB)<br class=3D""> = TX errors 0 dropped 0 overruns 0 carrier 0 = collisions 0<br class=3D""><br class=3D"">lo0: = flags=3D4169<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384<br = class=3D""> loop (Local Loopback)<br = class=3D""> RX packets 28548 bytes = 160312960 (152.8 MiB)<br class=3D""> RX = errors 0 dropped 0 overruns 0 frame 0<br = class=3D""> TX packets 28548 bytes = 160312960 (152.8 MiB)<br class=3D""> TX = errors 0 dropped 0 overruns 0 carrier 0 collisions = 0<br class=3D""></div><div class=3D""><br class=3D""></div><div = class=3D"">I know linux emulation doesn't implement netlink.. so what I = do is fake the response by replacing /bin/ip by a bash script that = prints the correct IP and fakes some other (needed by packages i = Installed):<br class=3D""></div><div class=3D"">#!/bin/bash<br = class=3D"">if [ "$1" =3D "-o" ]; then<br class=3D"">echo "1: eth0 inet = <a href=3D"http://192.168.1.2/24" target=3D"_blank" rel=3D"noreferrer" = class=3D"">192.168.1.2/24</a> brd 192.168.1.255 scope global eth0"<br = class=3D"">elif [ "$1" =3D "route" ]; then<br class=3D""> = if [ "$2" =3D "get" ]; then<br class=3D""> = echo "8.8.8.8 via 192.168.1.2 dev eth0 src 192.168.1.2 "<br class=3D""> else<br = class=3D""> echo = "default via 192.168.1.2 dev eth0"<br class=3D""> = fi<br class=3D"">else<br class=3D"">echo "1: eth0: = <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen = 1000"<br class=3D"">echo " inet 192.168.1.2 /24 brd 192.168.1.255 scope global eth0"<br class=3D""></div><div class=3D""><div = class=3D""><br class=3D""></div><div class=3D""><br class=3D""></div><div = class=3D"">still ifconfig shows no IP... its time to say it a regular = jail and *NOT* VNET.</div><div class=3D""><br class=3D""></div><div = class=3D"">*however* package that pull ips via libraries = fail..</div><div class=3D"">eg: installed bind916 (name) in the logs I = see these errors (relevant only):</div><div class=3D"">cbsd@j2> = service named start<br class=3D"">Starting domain name service...: = namednamed: prctl(PR_SET_DUMPABLE) failed: Invalid argument<br = class=3D"">cbsd@j2><br class=3D""></div><div class=3D""><br = class=3D""></div><div class=3D""><br class=3D""></div><div class=3D"">log = file shows:</div><div class=3D"">22-Feb-2022 23:11:58.705 general: = notice: BIND 9 is maintained by Internet Systems Consortium,<br = class=3D"">22-Feb-2022 23:11:58.705 general: notice: Inc. (ISC), a = non-profit 501(c)(3) public-benefit<br class=3D"">22-Feb-2022 = 23:11:58.705 general: notice: corporation. Support and training = for BIND 9 are<br class=3D"">22-Feb-2022 23:11:58.705 general: notice: = available at <a href=3D"https://www.isc.org/support" target=3D"_blank" = rel=3D"noreferrer" class=3D"">https://www.isc.org/support</a><br = class=3D"">22-Feb-2022 23:11:58.705 general: notice: = ----------------------------------------------------<br = class=3D"">22-Feb-2022 23:11:58.705 general: info: found 6 CPUs, using 6 = worker threads<br class=3D"">22-Feb-2022 23:11:58.705 general: info: = using 6 UDP listeners per interface<br class=3D"">22-Feb-2022 = 23:11:58.705 general: info: using up to 21000 sockets<br = class=3D"">22-Feb-2022 23:11:58.715 general: info: loading configuration = from '/etc/bind/named.conf'<br class=3D"">22-Feb-2022 23:11:58.715 = general: info: reading built-in trust anchors from file = '/etc/bind/bind.keys'<br class=3D"">22-Feb-2022 23:11:58.715 general: = info: looking for GeoIP2 databases in '/usr/share/GeoIP'<br = class=3D"">22-Feb-2022 23:11:58.715 general: info: using default = UDP/IPv4 port range: [1024, 65535]<br class=3D"">22-Feb-2022 = 23:11:58.715 general: info: using default UDP/IPv6 port range: [1024, = 65535]<br class=3D"">22-Feb-2022 23:11:58.715 network: info: no IPv6 = interfaces found<br class=3D"">22-Feb-2022 23:11:58.715 general: error: = ifiter_getifaddrs.c:79: unexpected error:<br class=3D"">22-Feb-2022 = 23:11:58.715 general: error: getting interface addresses: getifaddrs: = Address family not supported by protocol<br class=3D"">22-Feb-2022 = 23:11:58.715 network: warning: not listening on any interfaces<br = class=3D""></div><div class=3D"">*snip*</div><div = class=3D"">*snip*</div><div class=3D"">22-Feb-2022 23:11:58.735 general: = error: socket.c:2405: unexpected error:<br class=3D"">22-Feb-2022 = 23:11:58.735 general: error: setsockopt(50, IP_RECVTOS) failed: Protocol = not available<br class=3D"">22-Feb-2022 23:11:58.735 general: notice: = couldn't add command channel 127.0.0.1#953: permission denied<br = class=3D""></div><div class=3D"">22-Feb-2022 23:11:58.735 general: = error: socket.c:2405: unexpected error:<br class=3D"">22-Feb-2022 = 23:11:58.735 general: error: setsockopt(50, IP_RECVTOS) failed: Protocol = not available<br class=3D"">22-Feb-2022 23:11:58.735 general: notice: = couldn't add command channel 127.0.0.1#953: permission denied<br = class=3D"">22-Feb-2022 23:11:58.735 zoneload: info: managed-keys-zone: = loaded serial 24<br class=3D"">22-Feb-2022 23:11:58.735 zoneload: info: = zone 0.in-addr.arpa/IN: loaded serial 1<br class=3D"">22-Feb-2022 = 23:11:58.735 general: error: socket.c:2405: unexpected error:<br = class=3D"">22-Feb-2022 23:11:58.735 general: error: setsockopt(512, = IP_RECVTOS) failed: Protocol not available<br class=3D"">22-Feb-2022 = 23:11:58.735 general: error: socket.c:2405: unexpected error:<br = class=3D"">22-Feb-2022 23:11:58.735 general: error: setsockopt(513, = IP_RECVTOS) failed: Protocol not available<br class=3D"">22-Feb-2022 = 23:11:58.745 zoneload: info: zone 255.in-addr.arpa/IN: loaded serial = 1<br class=3D"">22-Feb-2022 23:11:58.745 zoneload: info: zone <a = href=3D"http://j1.royalshells.com/IN" target=3D"_blank" rel=3D"noreferrer"= class=3D"">j1.royalshells.com/IN</a>: loaded serial 2022022106<br = class=3D"">22-Feb-2022 23:11:58.745 notify: info: zone <a = href=3D"http://j1.royalshells.com/IN" target=3D"_blank" rel=3D"noreferrer"= class=3D"">j1.royalshells.com/IN</a>: sending notifies (serial = 2022022106)<br class=3D"">22-Feb-2022 23:11:58.745 general: error: = socket.c:2405: unexpected error:<br class=3D"">22-Feb-2022 23:11:58.745 = general: error: setsockopt(514, IP_RECVTOS) failed: Protocol not = available<br class=3D"">22-Feb-2022 23:11:58.745 zoneload: info: zone = localhost/IN: loaded serial 2<br class=3D"">22-Feb-2022 23:11:58.745 = general: error: socket.c:2405: unexpected error:<br class=3D"">22-Feb-2022= 23:11:58.745 general: error: setsockopt(515, IP_RECVTOS) failed: = Protocol not available<br class=3D"">22-Feb-2022 23:11:58.745 zoneload: = info: zone 127.in-addr.arpa/IN: loaded serial 1<br class=3D"">22-Feb-2022 = 23:11:58.745 general: notice: all zones loaded<br class=3D"">22-Feb-2022 = 23:11:58.745 general: notice: running<br class=3D"">22-Feb-2022 = 23:11:58.795 general: error: socket.c:2405: unexpected error:<br = class=3D"">22-Feb-2022 23:11:58.795 general: error: setsockopt(50, = IP_RECVTOS) failed: Protocol not available<br class=3D""></div><div = class=3D"">22-Feb-2022 23:12:58.811 general: error: = ifiter_getifaddrs.c:79: unexpected error:<br class=3D"">22-Feb-2022 = 23:12:58.811 general: error: getting interface addresses: getifaddrs: = Address family not supported by protocol<br class=3D""></div><div = class=3D"">22-Feb-2022 23:12:58.811 network: warning: not listening on = any interfaces<br class=3D""></div><div class=3D""><br = class=3D""></div><div class=3D"">Any Idea how to fix this??</div><div = class=3D""><br class=3D""></div><div class=3D"">cbsd@j2> named -V<br = class=3D"">BIND 9.16.22-Debian (Extended Support Version) = <id:59bfaba><br class=3D"">running on Linux x86_64 3.2.0 FreeBSD = 12.3-RELEASE-p1 GENERIC<br class=3D""></div><div class=3D""><br = class=3D""></div><div class=3D"">installing = newer versions </div><div class=3D""><br class=3D""></div><div = class=3D"">I have also problems with dovecot mail package.. but will = leave it for now</div><div class=3D""><br class=3D""></div><div = class=3D"">Thanks in advance,</div><div class=3D"">Sami</div><br = class=3D""></div></div> </blockquote></div> </div></blockquote></div><br class=3D""></div></body></html>= --Apple-Mail=_DAE7983B-1529-4D05-912B-E3DE644CF417--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?8020452A-63EA-4424-8D20-CC9B9397B603>