Hi, our production server binds to 0.0.0.0:1812 according to netstat. Now I wanted to add a FR 2.0 on a specific IPv6 address on the same port, but that fails. I used to think these bindings should not conflict, and a netcat session can easily do it. Details: - netcat before start: /usr/local/freeradius/2.0.0-cvs/sbin # netstat -tunelup Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name tcp 0 0 0.0.0.0:5666 0.0.0.0:* LISTEN 0 209295 9124/xinetd tcp 0 0 0.0.0.0:8525 0.0.0.0:* LISTEN 0 267899 9931/tina_daemon tcp 0 0 :::22 :::* LISTEN 0 5711 2771/sshd udp 0 0 0.0.0.0:1812 0.0.0.0:* 1001 1254100 16368/radiusd udp 0 0 0.0.0.0:1813 0.0.0.0:* 1001 1254101 16368/radiusd udp 0 0 0.0.0.0:8526 0.0.0.0:* 0 267902 9931/tina_daemon udp 0 0 127.0.0.1:123 0.0.0.0:* 0 5741 2778/ntpd udp 0 0 158.64.1.220:123 0.0.0.0:* 0 5738 2778/ntpd udp 0 0 0.0.0.0:123 0.0.0.0:* 0 5732 2778/ntpd udp 0 0 :::123 :::* 0 5733 2778/ntpd Addresses are: # ifconfig eth0 Link encap:Ethernet HWaddr 00:16:35:3C:32:E4 inet addr:158.64.1.220 Bcast:158.64.1.223 Mask:255.255.255.224 inet6 addr: 2001:a18:1:6::220/64 Scope:Global inet6 addr: fe80::216:35ff:fe3c:32e4/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:73884754 errors:0 dropped:0 overruns:0 frame:0 TX packets:113377902 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:23763202028 (22662.3 Mb) TX bytes:50454772482 (48117.4 Mb) Interrupt:25 attempting to start with two listen directives on port 0, once for auth, once for acct: radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipv6addr = 2001:a18:1:6::220 IPv6 address [2001:a18:1:6::220] port = 0 ERROR: Failed to open socket: /usr/local/freeradius/config2//sites-enabled/default[38]: Error binding to port for 2001:a18:1:6::220 port 1812 (which should be fine, according to the binding list of netstat) Using other ports works, here auth configured as 5000, acct as 5001: radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipv6addr = 2001:a18:1:6::220 IPv6 address [2001:a18:1:6::220] port = 5000 } listen { type = "acct" ipv6addr = 2001:a18:1:6::220 IPv6 address [2001:a18:1:6::220] port = 5001 } Listening on authentication address 2001:a18:1:6::220 port 5000 Listening on accounting address 2001:a18:1:6::220 port 5001 Ready to process requests. -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
Stefan Winter wrote:
our production server binds to
0.0.0.0:1812 according to netstat.
Now I wanted to add a FR 2.0 on a specific IPv6 address on the same port, but that fails. I used to think these bindings should not conflict, and a netcat session can easily do it.
Hmm... the opposite is possible. i.e. listening on ::0 (v6), and 192.168.1.2. The code in src/lib/packet.c sets the "IPV6 ONLY" flag for IPv6 sockets. I don't think there's a similar flag for IPv4. From what I understand, v4 IP's only affect v6 IP's when the v6 IP's do 6-to-4 mapping, OR v6 is listening on ::0. Maybe that's wrong, but I can't find a way to force v4 sockets to not affect v6 ones. Just the other way around. Alan DeKok.
Hi,
Hmm... the opposite is possible. i.e. listening on ::0 (v6), and 192.168.1.2. The code in src/lib/packet.c sets the "IPV6 ONLY" flag for IPv6 sockets. I don't think there's a similar flag for IPv4.
From what I understand, v4 IP's only affect v6 IP's when the v6 IP's do 6-to-4 mapping, OR v6 is listening on ::0.
Maybe that's wrong, but I can't find a way to force v4 sockets to not affect v6 ones. Just the other way around.
A colleague of mine played around with netcat and FR and straced both. There is one difference in the socket() call: netcat, IPv4, UDP: socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 3 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 bind(3, {sa_family=AF_INET, sin_port=htons(1802), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 freeradius, IPv4, UDP: socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 bind(3, {sa_family=AF_INET, sin_port=htons(1812), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 The difference being: socket(..., IPPROTO_UDP <-> IPPROTO_IP) (the setsockopt looks harmless, but not sure). Why that would be a difference is not clear to me. A wild guess is that SOCK_DGRAM+IPPROTO_IP binds to all datagram-based IP payload protocols, which may be more than UDP, and that one of those non-UDP bindings clashes when trying to bind, even to an IPv6 address. Weird. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
Stefan Winter wrote:
A colleague of mine played around with netcat and FR and straced both. There is one difference in the socket() call:
netcat, IPv4, UDP: socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 3 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
Ah. SO_REUSEADDR means "allow multiple programs to listen on the same address"
The difference being: socket(..., IPPROTO_UDP <-> IPPROTO_IP) (the setsockopt looks harmless, but not sure).
I don't think that's it.
Why that would be a difference is not clear to me. A wild guess is that SOCK_DGRAM+IPPROTO_IP binds to all datagram-based IP payload protocols, which may be more than UDP, and that one of those non-UDP bindings clashes when trying to bind, even to an IPv6 address. Weird.
If netcat is listening on IP sockets, there are less issues with conflicts. Alan DeKok.
participants (2)
-
Alan DeKok -
Stefan Winter