Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 13 Feb 2004 21:34:26 -0700 (MST)
From:      Jim Prewett <download@hpc.unm.edu>
To:        Robert Watson <rwatson@freebsd.org>
Cc:        freebsd-stable@freebsd.org
Subject:   Re: jail issue
Message-ID:  <Pine.LNX.4.44.0402132114030.11414-100000@lcws.hpc.unm.edu>
In-Reply-To: <Pine.NEB.3.96L.1040213201810.29948G-100000@fledge.watson.org>

next in thread | previous in thread | raw e-mail | index | archive | help

Hi Robert,

I've been using jails (very happily) for quite some time and have *never*
had a problem like this.  I really don't have a clue what to look for :)  

I'm getting complaints from fellow keyserver ops as my IP seems to
sometimes be the jail and sometimes the host, so some of my packets get
rejected as that IP has not been configured (by the remote host) to be a
peer.  (how strange is that?!)

Here is an email I recieved.  I cvsup'd this morning, rebuilt everything, 
and did a final clean reboot before starting up the pgp jail.  I recieved 
this email from one of my peer sites (the timestamps confirm this was 
after starting the jail after rebuilding):

To: download@hpc.unm.edu
Subject: PGP/nox again

2004-02-13 10:52:01 Enabling gossip                                             
2004-02-13 10:52:02 Reconciliation attempt from unauthorized host 
<ADDR_INET
129
.24.244.72:2040>.  Ignoring                                                     

the host (nox) is 129.24.244.72, the jail (pgp) is 129.24.244.40.

On Fri, 13 Feb 2004, Robert Watson wrote:

> 
> On Fri, 13 Feb 2004, Jim Prewett wrote:
> 
> > I run a PGP key server (SKS 1.0.6) inside of a jail.  However, my key
> > server seems to be getting confused as to its IP address and is sending
> > packets as the host environment (not as the jail environment). 
> 
> Could you show the output of sockstat as run in the host environment? 
> Likewise, the output of ps ax.  I'd like to see what the socket is bound
> to, as the theory goes that jail modifies the bind requests from the
> process to set them to the IP in the jail. Either we have a bug in socket
> handling, or the process isn't running in the jail. 

I'm really afraid I may have inadvertantly found a bug!  It is definantly
in the jail environment (I've included the ps output below).  The SKS
daemons definantly answer on the jail environment IP (i've included the 
output of nmap against both the host and the jail below)!

here are the sockets related to the sks process:

nox# sockstat | grep sks
root     sks        276    5 tcp4   129.24.244.40:11371   *:*                  
root     sks        271    4 tcp4   129.24.244.40:11370   *:*                  
root     sks        276    6 stream ./db_com_sock                              
root     sks        271    5 stream ./recon_com_sock                

and sks processes:
nox# ps ax | grep sks
 5804  p2  S+     0:00.00 grep sks
  271 con- S+J    0:03.29 sks recon
  276 con- S+J    0:11.50 sks db

nmap of host (nox) and jail (pgp):

nox# nmap nox pgp  -p 11370-11371

Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-02-13 21:21 
MST
Interesting ports on nox.hpc.unm.edu (129.24.244.72):
PORT      STATE  SERVICE
11370/tcp closed unknown
11371/tcp closed pksd

Interesting ports on pgp.hpc.unm.edu (129.24.244.40):
PORT      STATE SERVICE
11370/tcp open  unknown
11371/tcp open  pksd

Nmap run completed -- 2 IP addresses (2 hosts up) scanned in 0.339 seconds

ifconfig from the host:
nox# ifconfig -a
fxp0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
        inet6 fe80::2d0:b7ff:fe7f:f678%fxp0 prefixlen 64 scopeid 0x1 
        ether 00:d0:b7:7f:f6:78
        media: Ethernet autoselect (none)
        status: no carrier
vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet 129.24.244.72 netmask 0xfffffc00 broadcast 129.24.247.255
        inet6 fe80::210:dcff:fedf:1a01%vr0 prefixlen 64 scopeid 0x2 
        inet 129.24.244.40 netmask 0xffffffff broadcast 129.24.244.40
        ether 00:10:dc:df:1a:01
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
lp0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500
ppp0: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
sl0: flags=c010<POINTOPOINT,LINK2,MULTICAST> mtu 552
faith0: flags=8002<BROADCAST,MULTICAST> mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
        inet6 ::1 prefixlen 128 
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x7 
        inet 127.0.0.1 netmask 0xff000000 

ifconfig from the jail:
pgp# ifconfig -a
fxp0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        ether 00:d0:b7:7f:f6:78
        media: Ethernet autoselect (none)
        status: no carrier
vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet 129.24.244.40 netmask 0xffffffff broadcast 129.24.244.40
        ether 00:10:dc:df:1a:01
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
lp0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500
ppp0: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
sl0: flags=c010<POINTOPOINT,LINK2,MULTICAST> mtu 552
faith0: flags=8002<BROADCAST,MULTICAST> mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384

If there is anything else that I can provide, please let me know.  I'm 
*very* interested in resolving this.

Thanks,
Jim

-- 
James Prewett                           OpenPGP key: pub  1024D/31816D93
Systems Team Leader		 	  Designated Security Officer
HPC Systems Engineer III @ HPC@UNM -- download@hpc.unm.edu Jim@Prewett.org




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.LNX.4.44.0402132114030.11414-100000>