Re: 8.0 still allow creating ipv6 udp socket in jail without ipv6 ip

 Jamie Gritton wrote:
> Bjoern A. Zeeb wrote:
> > On Wed, 29 Jul 2009, Mykola Dzham wrote:
> >> Bjoern A. Zeeb wrote:
> >>> On Sat, 25 Jul 2009, Mykola Dzham wrote:
> >>>> After r188146 creating tcp ipv6 socket in jail without ipv6 ip is not
> >>>> allowed, but udp socket is allowed.
> >>>
> >>> I cannot really follow what you are trying to say as wrt IPv4 and IPv6
> >>> sockets and what about UDP.
> >>>
> >>> Your sample further down is trying to use an IPv4 address on an IPv6
> >>> Datagram socket which is an error either way.
> >>
> >> Some java programms attempt to use ipv6 sockets, then use ipv4 if
> >> socket(AF_INET6,...) fail. My sample imitate this
> >>
> >>> Prior to FreeBSD 7.2 IPv6 hadn't been supported at all for jails.
> >>>
> >>> With 7.2 it was possible to create IPv6 sockets (but only shortly and
> >>> then fail on bind/connect/...).  With the commit you reference the
> >>> "Protocol not supported" came back in case there was no address of
> >>> that address family for a given jail.
> >>>
> >>> With 8 the primary syntax for jails has changed and the "backward
> >>> compat mode" again allows you to create a socket on a jail even if
> >>> no address of the same family was configured for the jail.
> >>>
> >>> This should be addressed by the following patch:
> >>> http://people.freebsd.org/~bz/20090727-01-jail8-legacy.diff
> >>>
> >>> Can you give it a try and report if that fixes your problem?
> >>
> >> Patch aplied cleanly on r195820 , but jail can not start after patching:
> >>
> >> # jail -l -U root -i /usr/home/d/guests/tap2 tap2.my.domain.com 
> >> 10.112.0.151 /bin/sh /etc/rc
> >> jail: ip6: unknown boolean value "disable"
> > 
> > r195820 is too old; but Jamie has a better solution; I would suggest
> > to backout the jail(8) patch and wait for the next two commits of
> > Jamie to HEAD and then update the machine again.
> 
> OK, with r195945 things should be back to disallowing sockets when no 
> addresses were assigned for that family.  You'll need to rebuild the 
> kernel for the fix, and libjail and possibly jail(8) to get past the 
> "unknown boolean value" error.

On r195949 test program work correctly: it fail on socket(AF_INET6,...)
on jail without ipv6 address.
Thanks!

-- 
Mykola Dzham, LEFT-(UANIC|RIPE)
JID: levsha_at_jabber.net.ua