connect to 0.0.0.0 vs ::

[Manuel Bouyer]

Hello,
while trying to understand what apache is doing with pipes and why it
could end up hanging:
http://mail-index.netbsd.org/current-users/2015/02/13/msg026686.html

I though that maybe it could be related to these messages in the
logs:
[Sat Feb 15 14:18:42 2014] [warn] (51)Network is unreachable: connect to listener on [::]:80
[Sat Feb 15 14:18:43 2014] [warn] (51)Network is unreachable: connect to listener on [::]:80
[Sat Feb 15 14:18:44 2014] [warn] (51)Network is unreachable: connect to listener on [::]:80
[Sat Feb 15 14:18:45 2014] [warn] (51)Network is unreachable: connect to listener on [::]:80
[Sat Feb 15 14:18:46 2014] [warn] (51)Network is unreachable: connect to listener on [::]:80

After more analisis of the apache code, it turns out the master
connects to its own listeing socket as a way to wake up one of its
childs (this is dummy_connection() in mpm_common.c, called from
ap_mpm_pod_signal() and ap_mpm_pod_killpg()).

We have a different behavior for ipv4 and ipv6:
antioche:/tmp#telnet :: 80
Trying ::...
telnet: Unable to connect to remote host: Network is unreachable
antioche:/tmp#telnet 0.0.0.0 80
Trying 0.0.0.0...
Connected to 0.0.0.0.
Escape character is '^]'.

and this cause apache to fail to wake its childs (and eventually fill up the
pipe, causing the problem I'm seeing now). Is it expected behavior ?
On a linux system, both 0.0.0.0 and :: connects to localhost if
a socket has been open on these addresses.

[Dennis Ferguson]

Post by Manuel Bouyer
After more analisis of the apache code, it turns out the master
connects to its own listeing socket as a way to wake up one of its
childs (this is dummy_connection() in mpm_common.c, called from
ap_mpm_pod_signal() and ap_mpm_pod_killpg()).
antioche:/tmp#telnet :: 80
Trying ::...
telnet: Unable to connect to remote host: Network is unreachable
antioche:/tmp#telnet 0.0.0.0 80
Trying 0.0.0.0...
Connected to 0.0.0.0.
Escape character is '^]'.
and this cause apache to fail to wake its childs (and eventually fill up the
pipe, causing the problem I'm seeing now). Is it expected behavior ?
On a linux system, both 0.0.0.0 and :: connects to localhost if
a socket has been open on these addresses.

I wouldn't have expected this to work for either protocol. The only
standard use of 0.0.0.0 and :: is as a source address, never a
destination (though standards for on-the-wire behaviour don't
necessarily dictate what goes on inside a host), while 127.0.0.1
and ::1 are explicitly meant to be used for this so I don't quite
get why it would want to use something else. I'm struggling to
think of a problem that allowing this behaviour would solve.

Is this a linux-ism and, if so, can you tell what it actually does
with the address? In particular, if you open a connection to 0.0.0.0
and then look for the connection in netstat output does it show a
connection to 0.0.0.0 or does it translate the address to a "real"
local address before connecting?

It would be nice to know if this use actually needs to be supported
now, and if so how, since if I had noticed this working I think I
would have taken it to be a bug and fixed it.

Dennis Ferguson
--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Mouse]

Post by Manuel Bouyer
antioche:/tmp#telnet :: 80
Trying ::...
telnet: Unable to connect to remote host: Network is unreachable
antioche:/tmp#telnet 0.0.0.0 80
Trying 0.0.0.0...
Connected to 0.0.0.0.
Escape character is '^]'.

4291 says

2.5.2. The Unspecified Address

The address 0:0:0:0:0:0:0:0 is called the unspecified address. It
must never be assigned to any node. It indicates the absence of an
address. One example of its use is in the Source Address field of
any IPv6 packets sent by an initializing host before it has learned
its own address.

The unspecified address must not be used as the destination address
of IPv6 packets or in IPv6 Routing headers. An IPv6 packet with a
source address of unspecified must never be forwarded by an IPv6
router.

Apache should be using ::1, not ::, and IMO Linux is broken for
treating :: as usable. (Surprise surprise, Linux misbehaving. :-þ)

The case for v4 is less clear. Numerous protocols use 0.0.0.0 as
indicating the lack of any address; those which include a mask (eg,
RIP) use 0.0.0.0 mask 0.0.0.0 for a default route (which makes at least
some sense) and some RFCs speak of 0.0.0.0 as an obsolete form of the
limited local broadcast address 255.255.255.255 and clearly state that
routers must not pass it along. 1700 says, early in page 4,

Special Addresses
...
There are certain special cases for IP addresses. These special cases
can be concisely summarized using the earlier notation for an IP
address:

IP-address ::= { <Network-number>, <Host-number> }
...
(a) {0, 0}

This host on this network. Can only be used as a source
address (see note later).

(However, I've been unable to find the "note later".) This seems to me
to be an argument, but I'm not sure which way; FWLIMBW, I prefer the
interpretation that forbids use of 0.0.0.0 as a loopback address.

/~\ The ASCII Mouse
\ / Ribbon Campaign
X Against HTML ***@rodents-montreal.org
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Manuel Bouyer]

Post by Dennis Ferguson
I wouldn't have expected this to work for either protocol. The only
standard use of 0.0.0.0 and :: is as a source address, never a
destination (though standards for on-the-wire behaviour don't
necessarily dictate what goes on inside a host), while 127.0.0.1
and ::1 are explicitly meant to be used for this so I don't quite
get why it would want to use something else. I'm struggling to
think of a problem that allowing this behaviour would solve.

It's lasyness from the apache developers I guess.
But connecting to 127.0.0.1 or ::1 isn't guaranteed to work either:
the httpd server may listen on a public address but not on the localhost
addresses, depending on what's in the configuration.

What they to is to connect to one of the listen address (the last one from
the list it seems). You can specify the listen address as 0.0.0.0 or ::,
if you don't want to restrict to a speicific address. The apache
developers assume using this as destination address will also connect to
one of the local addresses.

Post by Dennis Ferguson
Is this a linux-ism and, if so, can you tell what it actually does
with the address? In particular, if you open a connection to 0.0.0.0
and then look for the connection in netstat output does it show a
connection to 0.0.0.0 or does it translate the address to a "real"
local address before connecting?

linux translates to 127.0.0.1 or ::1, so does NetBSD with 0.0.0.0.
But on NetBSD, :: is not translated to ::1.

Post by Dennis Ferguson
It would be nice to know if this use actually needs to be supported
now, and if so how, since if I had noticed this working I think I
would have taken it to be a bug and fixed it.

If you remove it you'll have to fix apache at last.
Right now it's broken for v6 addresses, but a workaround it to use
Listen [::]:80
Listen 0.0.0.0:80

instead of
Listen 0.0.0.0:80
Listen [::]:80

(i.e. but the wilcard v4 address last)

[Roy Marples]

Post by Manuel Bouyer
If you remove it you'll have to fix apache at last.
Right now it's broken for v6 addresses, but a workaround it to use
Listen [::]:80
Listen 0.0.0.0:80
instead of
Listen 0.0.0.0:80
Listen [::]:80
(i.e. but the wilcard v4 address last)

That's fine, you're binding to the wildcard address, or all source
addresses.
What mouse is saying is that you cannot use at as the destination
address.

Roy

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Dennis Ferguson]

Post by Manuel Bouyer

Post by Dennis Ferguson
I wouldn't have expected this to work for either protocol. The only
standard use of 0.0.0.0 and :: is as a source address, never a
destination (though standards for on-the-wire behaviour don't
necessarily dictate what goes on inside a host), while 127.0.0.1
and ::1 are explicitly meant to be used for this so I don't quite
get why it would want to use something else. I'm struggling to
think of a problem that allowing this behaviour would solve.

It's lasyness from the apache developers I guess.
the httpd server may listen on a public address but not on the localhost
addresses, depending on what's in the configuration.
What they to is to connect to one of the listen address (the last one from
the list it seems). You can specify the listen address as 0.0.0.0 or ::,
if you don't want to restrict to a speicific address. The apache
developers assume using this as destination address will also connect to
one of the local addresses.

Got it. As soon as I sent the last note I figured out why this is probably
a good idea. If you run on a host without a loopback address for whatever
reason (if you use multiple routing tables/vrf's/domains it can be boring
to configure a loopback in every one) there should still be a way to
connect to local services without having to parse interface configuration
to find an address to connect to. I think IPv6 should work this way
too.

I'm still wondering about the exact semantics, though. If you restrict
your service to a local address that isn't 127.0.0.1, does telnet 0.0.0.0 80
still pick 127.0.0.1 for the connection, or does it find an address that
the port 80 service is actually listening for? That is, is the 0.0.0.0
replaced by just any address, or does it actually go and look for addresses
bound to the port 80 listener?

Dennis Ferguson

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Gert Doering]

Hi,

Post by Dennis Ferguson
I'm still wondering about the exact semantics, though. If you restrict
your service to a local address that isn't 127.0.0.1, does telnet 0.0.0.0 80
still pick 127.0.0.1 for the connection, or does it find an address that
the port 80 service is actually listening for? That is, is the 0.0.0.0
replaced by just any address, or does it actually go and look for addresses
bound to the port 80 listener?

And if there are different port 80 listeners on different IP addresses
on that machine, which one will it talk to?

(No particular opinion, just something that needs to be decided)

gert

[Mouse]

What they [do] is to connect to one of the listen address [...]

As soon as I sent the last note I figured out why this is probably a
good idea.

I'm of two minds as to whether this actually is a good idea. On the
one hand....

If you run on a host without a loopback address for whatever reason

...then a bunch of other stuff will break too.

(if you use multiple routing tables/vrf's/domains it can be boring to
configure a loopback in every one)

It's boring to have to set up a default route in each one, too. Should
apache include a full routing engine to make up for that (potential)
defect as well?!

If you don't want to have to configure something manually for every
routing domain, it seems to me the sensible thing is to make routing
domain setup configure it automatically.

But, on the other hand...

It _is_ logically coherent to want a way to say "connect to the local
wildcard listener bound to this port", if there is such a listener.
That's the only thing I can think of that using :: or 0.0.0.0 as a
connect-to address could reasonably do, and that is the most sensible
way I can think of offhand to express that desire. And the specs I
cited upthread, as someone else already indirectly pointed out,
constrain behaviour on the wire but not behaviour internal to a host.

So, depending on exactly what it is that Linux does with such
connection attempts, I may want to retract my remarks about it being
broken, and I think making connection attempts to :: or 0.0.0.0 connect
to the wildcard listener for the port in question, or fail if there is
no such, would be a sane thing for NetBSD to do.

I would still call Apache broken in the portability sense that there
are relatively popular IP stacks that don't work that way, but that's a
separate issue.

/~\ The ASCII Mouse
\ / Ribbon Campaign
X Against HTML ***@rodents-montreal.org
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Manuel Bouyer]

Post by Mouse
[...]
So, depending on exactly what it is that Linux does with such
connection attempts, I may want to retract my remarks about it being
broken, and I think making connection attempts to :: or 0.0.0.0 connect
to the wildcard listener for the port in question, or fail if there is
no such, would be a sane thing for NetBSD to do.

and you be compatible with the way apache uses it. I don't know what
linux exactly does.

[Mouse]

Post by Manuel Bouyer

[...], and I think making connection attempts to :: or 0.0.0.0
connect to the wildcard listener for the port in question, or fail
if there is no such, would be a sane thing for NetBSD to do.

and you be compatible with the way apache uses it.

Yes.

The only issue I have with what apache does is that it's (obviously)
not as portable as it probably should be for something intended to be
as portable as apache, since there is at least one relatively popular
IP stack that doesn't work that way.

/~\ The ASCII Mouse
\ / Ribbon Campaign
X Against HTML ***@rodents-montreal.org
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de