Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conn proxy support of UNIX Sockets #37

Closed
xSmurf opened this issue Feb 10, 2016 · 5 comments
Closed

Conn proxy support of UNIX Sockets #37

xSmurf opened this issue Feb 10, 2016 · 5 comments

Comments

@xSmurf
Copy link
Collaborator

xSmurf commented Feb 10, 2016

UNIX Sockets are currently broken in the connection proxy.

@xSmurf xSmurf added the bug label Feb 10, 2016
@xSmurf xSmurf added this to the Urgent milestone Feb 10, 2016
@xSmurf xSmurf modified the milestones: Moderate, Urgent Mar 20, 2016
@david415
Copy link
Contributor

@david415
Copy link
Contributor

another work-in-progress branch here:
https://github.com/david415/oz/tree/37.proxy_UNIX_sockets.1

i removed the assertions that the specified UNIX domain sockets for proxying are abstract sockets; i do in fact want to proxy unix sockets that are present on the filesystem. unfortunately this didn't work:

May 25 16:11:08 subgraph oz-daemon[7506]: 2016/05/25 16:11:08 Starting socket client forwarding: unix:///var/run/tor/control.
May 25 16:11:08 subgraph oz-daemon[7506]: 2016/05/25 16:11:08 Unable to create connection proxy: {Nettype:client Proto:unix Port:0 Destination:/var/r
un/tor/control}, listen unix /var/run/tor/control: bind: address already in use

@david415
Copy link
Contributor

after chatting with Smurf and reading this blog post:
https://integratedcode.us/2016/04/08/user-namespaces-sharing-the-docker-unix-socket/

i'm now convinced that what we must do is:

  1. oz-init creates an abstract UNIX domain socket in the sandbox and proxies this to the filesystem UNIX domain socket on the host (e.g. /var/run/tor/control);
  2. another proxy daemon inside the sandbox creates the filesystem UNIX domain socket (e.g. /var/run/tor/control) and proxies connections to oz-init's abstract UNIX domain socket which then proxies to the host's socket.

@david415
Copy link
Contributor

here's a pull-request for a "good enough" solution; proxy TCP from inside Oz to a UNIX socket on the host --> #65
please review this. maybe don't just merge it... i removed some of the proto prefix checking and i guess maybe we might want to keep that logic if we want to support TCP/IPv6? seems unlikely but just maybe i broke something... though it works for me.

@dma
Copy link
Contributor

dma commented Feb 4, 2017

This works and has been deployed for some time, closed.

@dma dma closed this as completed Feb 4, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants