From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id A657178375 for ; Thu, 29 Apr 2021 15:37:15 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id A227D1DA67 for ; Thu, 29 Apr 2021 15:37:15 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 718BC1DA5C for ; Thu, 29 Apr 2021 15:37:14 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 4743C464A6 for ; Thu, 29 Apr 2021 15:37:14 +0200 (CEST) From: Stoiko Ivanov To: pve-devel@lists.proxmox.com Date: Thu, 29 Apr 2021 15:37:00 +0200 Message-Id: <20210429133702.23584-1-s.ivanov@proxmox.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.015 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [pveproxy.pm, proxmox.com, spiceproxy.pm, tools.pm] Subject: [pve-devel] [RFC common/manger] use appropriate wildcard address for pveproxy/spiceproxy X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Apr 2021 13:37:15 -0000 The following patchset tries to address the small regression reported in our forums [0,1], resulting from defaulting to '::' as listen-address in pveproxy/spiceproxy. The issue also affects proxmox-backup-proxy in PBS - and should this approach be accepted I'll try to port it over to PBS as well. (ftr: pmgproxy was not affected, since the patch for pmg-api was not applied) In all cases the issue is only exhibited if ipv6 is diabled via kernel commandline [2], not via sysctl [3]. * The patchset keeps the fix for pveproxy not starting if the /etc/hosts entry is not matching with a configured IP-address (I noticed and was pleasantly surprised while testing a v6only host and forgetting to set the entry) I tested it in the following scenarios: * ipv6 disabled via kernel commandline (listen on 0.0.0.0) * ipv6 disabled via sysctl (listen on 0.0.0.0) * no settings dual-stacked (listen on *) * no settings v6 only (listen on *) AFAICT listening on :: as long as possible is the best option, since it makes the service available on all address-families (doing away, with having a v4 only /etc/hosts entry, but a DNS AAAA record pointing to the node for external access). Took a quick look at how sshd [4,5] handles this (in the assumption that they have to get it as right as possible), but it listens on multiple sockets, something which I'd like to avoid for our proxy-daemons. Sending as RFC, because whenever I come near getaddrinfo/getnameinfo I'm certain to miss quite a few common cases. [0] https://forum.proxmox.com/threads/connection-refused-595-nach-update-auf-pve-6-4.88347/#post-387034 [1] https://forum.proxmox.com/threads/ipv6-komplett-deaktivieren.88210/#post-387116 [2] https://www.kernel.org/doc/html/latest/networking/ipv6.html [3] https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html [4] https://github.com/openssh/openssh-portable/blob/master/servconf.c [5] https://github.com/openssh/openssh-portable/blob/master/sshd.c pve-common: Stoiko Ivanov (1): tools: add get_wildcard_address src/PVE/Tools.pm | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) pve-manager: Stoiko Ivanov (1): proxy: fix wildcard address use PVE/Service/pveproxy.pm | 2 +- PVE/Service/spiceproxy.pm | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.20.1