From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id ECB31795B1 for ; Tue, 4 May 2021 13:29:05 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id E3B808CD2 for ; Tue, 4 May 2021 13:28:35 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 622698CBD for ; Tue, 4 May 2021 13:28:35 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 33140429F5 for ; Tue, 4 May 2021 13:28:35 +0200 (CEST) Date: Tue, 4 May 2021 13:28:34 +0200 From: Wolfgang Bumiller To: Stoiko Ivanov Cc: pve-devel@lists.proxmox.com Message-ID: <20210504112834.by4ugiqr2ts5kc2z@olga.proxmox.com> References: <20210504101222.21276-1-s.ivanov@proxmox.com> <20210504101222.21276-3-s.ivanov@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210504101222.21276-3-s.ivanov@proxmox.com> User-Agent: NeoMutt/20180716 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.019 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [daemon.pm] Subject: Re: [pve-devel] [PATCH common 2/2] daemon: explicitly bind to wildcard address. X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 May 2021 11:29:06 -0000 On Tue, May 04, 2021 at 12:12:16PM +0200, Stoiko Ivanov wrote: > with the recent change in pve-manager pveproxy (and spiceproxy) > try binding to '::' per default. This fails for hosts having disabled > ipv6 via kernel commandline. > > Our desired behavior of binding on '::' and only falling back to > '0.0.0.0' in case this is not supported is not directly possible with > IO::Socket::IP->new (or rather by Socket::GetAddrInfo, which at least > on my system always returns the v4 wildcard-address first). > > the code now binds to: > * the provided $host if not undef > * '::' if $host is not set > * '0.0.0.0' if $host is not set and binding on '::' yields an error > > Signed-off-by: Stoiko Ivanov > --- > src/PVE/Daemon.pm | 18 ++++++++++++++---- > 1 file changed, 14 insertions(+), 4 deletions(-) > > diff --git a/src/PVE/Daemon.pm b/src/PVE/Daemon.pm > index 79b90ad..f4786b8 100644 > --- a/src/PVE/Daemon.pm > +++ b/src/PVE/Daemon.pm > @@ -819,14 +819,24 @@ sub create_reusable_socket { > $socket->fcntl(Fcntl::F_SETFD(), Fcntl::FD_CLOEXEC); > } else { > > - $socket = IO::Socket::IP->new( > - LocalHost => $host, > + my %sockargs = ( > LocalPort => $port, > Listen => SOMAXCONN, > Proto => 'tcp', > GetAddrInfoFlags => 0, > - ReuseAddr => 1) || > - die "unable to create socket - $@\n"; > + ReuseAddr => 1, > + ); > + if (defined($host)) { > + $socket = IO::Socket::IP->new( LocalHost => $host, %sockargs) || > + die "unable to create socket - $@\n"; > + } else { > + # disabling AF_INET6 (by adding ipv6.disable=1 to the kernel cmdline) > + # causes bind on :: to fail, try 0.0.0.0 in that case > + $socket = IO::Socket::IP->new( LocalHost => '::', %sockargs); > + > + $socket = IO::Socket::IP->new( LocalHost => '0.0.0.0', %sockargs) if $@; So apparently this doesn't *die* but just returns `undef` on error. But we also should not rely on internal implementation details, so we cannot assume that $@ will be cleared on success. So we should probably bind the two calls together via `//` (or clear $@ before the first call?) $socket = IO::Socket::IP->new( LocalHost => '::', %sockargs) // IO::Socket::IP->new( LocalHost => '0.0.0.0', %sockargs); > + die "unable to create socket - $@\n" if !$socket; > + } > > # we often observe delays when using Nagle algorithm, > # so we disable that to maximize performance > -- > 2.20.1