Connection to debugger fails due to user verification #1835
Comments
|
cc @stapelberg |
|
It would be nice to have an option disabling the check entirely. I wonder if the use case of debugging a production server on a machine with non-trusted users is common enough to make the check enabled by default? It looks like one can configure a firewall to reject connection to a certain port by specific users, so IMHO the check should be opt-in. |
|
I've found mentions on the web that in some cases one has to parse /proc/net/tcp6 instead of /proc/net/tcp for ipv4 addresses (http://lkml.iu.edu/hypermail/linux/net/0701.0/0008.html). I've run test again, connection was from 127.0.0.1:52700 (0100007F:CDDC or 0000000000000000FFFF00000100007F:CDDC), delve is listening at localhost:40981 (0100007F:A015) /proc/net/tcp didn't contain such a local_address: but /proc/net/tcp6 did: |
aarzilli
added a commit
to aarzilli/delve
that referenced
this issue
Jan 20, 2020
When checking if the user is allowed to connect to this Delve instance also search IPv6 connections even though the local address is IPv4. Fixes go-delve#1835
aarzilli
added a commit
to aarzilli/delve
that referenced
this issue
Jan 20, 2020
aarzilli
added a commit
to aarzilli/delve
that referenced
this issue
Jan 20, 2020
|
In your initial post, the connection is present in /proc/net/tcp:
|
|
Okay, the connection is only present from the remote side (99ad→88a4), not the local side (88a4→99ad), which dlv is looking for. To me, this sounds like the connection might already be closed for a different reason when it gets to that check? Ideally, we’d need an strace log file with timestamps, covering both processes, to see what’s happening. |
|
@stapelberg what do you think about the output in the second post? It looks like one half of the connection is in tcp and the other half in tcp6? |
|
Ah, maybe GoLand sets up an ipv4-mapped ipv6 socket to connect! That would explain it. |
cgxxv
pushed a commit
to cgxxv/delve
that referenced
this issue
Mar 25, 2022
* service: also search IPv6 connections when checking user When checking if the user is allowed to connect to this Delve instance also search IPv6 connections even though the local address is IPv4. Fixes go-delve#1835 * cmd: add flag to disable same-user check Fixes go-delve#1835
abner-chenc
pushed a commit
to loongson/delve
that referenced
this issue
Mar 1, 2024
* service: also search IPv6 connections when checking user When checking if the user is allowed to connect to this Delve instance also search IPv6 connections even though the local address is IPv4. Fixes go-delve#1835 * cmd: add flag to disable same-user check Fixes go-delve#1835
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
dlv version)?go version)?Debug from GoLand (delve is started with
dlv --log --log-output rpc --listen=localhost:39341 --headless=true --api-version=2 --check-go-version=false exec <binary> --command). The program itself doesn't matter, result is the same. Delve is started under the same user as the IDE.A successful connection.
Connection rejected. Delve logs contain:
Content of the /proc/net/tcp at the moment of connection failure (my uid is 1000):
The text was updated successfully, but these errors were encountered: