-
Notifications
You must be signed in to change notification settings - Fork 473
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
GOnetstat/port resource fail to notice net.ipv6.bindv6only - validation fails when dual mode ipv4/6 port is available #149
Comments
GOnetstat isn't really "netstat" per say, but rather a low level library that parses I'll look into the impact of That said, if you or anyone else knows how |
Maybe it will be useful:
Convert decimal 2200 to hex
Find out information about 0898 in /proc/net/tcp
And in /proc/net/tcp6
Headers of /proc/net/tcp
Headers of /proc/net/tcp6
st value for LISTENING state is 0A and local_address keep IP:PORT data in hex so try to find out listening ipv6 ports from /proc/net/tcp6:
and verify this information with netstat:
similar approach with /proc/net/tcp for ipv4 And with docker ports
|
netstat:
ss:
|
Copied from duplicate thread: We can collapse the tests into two categories: The only downside is if a user wants to test one or the other, it would be an awkward syntax:
Thoughts on this approach? I'm just thinking out-loud on this.. not 100% sure it's a good idea yet. @frezbo Brought up a good point about this complicating the syntax. It seems like a trade off, the syntax would be simpler for just checking if a port is listening, but more complicated if you're trying to test that it's listening only tcp but not tcp6 and vice versa. |
Okay, I have an idea: Things we know: If Processes bound to specific addresses aren't bound to both IPv6 and IPv4 unless specified. So, my thought is that the simplest way to get the expected behaviour from Goss would be to do something like this in the port code: ....
v6only, _ := sysctl.Get("net.ipv6.bindv6only")
....
net = "tcp6"
for _, entry := range netstat {
if entry.State == "LISTEN" {
port := strconv.FormatInt(entry.Port, 10)
ports[net+":"+port] = append(ports[net+":"+port], entry)
if entry.Ip == "::" && v6only == "0" {
entry.Ip = "0.0.0.0"
ports["tcp:"+port] = append(ports["tcp:"+port], entry)
}
}
}
.... I know this may not look ideal immediately, but considering the alternatives (try to find and integrate another go package or use the above syntax) I think it probably is the MVP of achieving the output we expect from the test. I would need to investigate around the errors thrown by Any thoughts or critique? |
Are you sure this is true? I haven't tinkered enough with it to know.. but if the bindv6only affects only wildcard IPs, then your solution would be sufficient. |
By that statement I mean that if I run say tomcat bound to an interface such as: I may have to do some testing around this though tbh. Maybe it's possible to bind to a specific IPv4 address but bind to all IPv6 interfaces which would result in "::" but shouldn't output I'll double check it, I'm confused too now... |
After added the "spew.Dump(system.Ports())" in the system/port.go file then could get all ports information on the machine.
For example, the output of the ss command:
the above will print like as the flowing:
So the goss.yaml could as
|
With the default install on GKE 1.13 the default bound port is now ipv4 instead of ipv6. There is an open issue in goss goss-org/goss#149 to allow testing for situations like this where it is listening on both ports. However the only important thing to test is to make sure that this this port is listening publicly and that the service actually works. Also switched the security example to test against the service to make sure we don't hit the same kibana bug as in #156
With the default install on GKE 1.13 the default bound port is now ipv4 instead of ipv6. There is an open issue in goss goss-org/goss#149 to allow testing for situations like this where it is listening on both ports. However the only important thing to test is to make sure that this this port is listening publicly and that the service actually works. Also switched the security example to test against the service to make sure we don't hit the same kibana bug as in #156
Goss port test for `tcp:9600` is failing on GKE 1.12 due to goss-org/goss#149. We already had this issue with Elasticsearch goss tests in elastic@de1fef3.
Is it finally implemented ? |
I've marked this ticket as "help wanted" a while back. I would be interested in knowing which tools handle this correctly. See my comment above regarding netstat and ss #149 (comment) |
When
sysctl net.ipv6.bindv6only
is0
(the default value), ports shown astcp6
innetstat
outputaremay be actually listening on both protocols. If I start with a Goss check like this:And I then create a simple container, exposing a port on all interfaces (ipv4 and ipv6), like so:
Then I'll find that I can correctly use the listening port via ipv4:
However, goss will not validate the port correctly:
What this boils down to is: goss is ensuring netstat's output, not the actual state of the ports.
Isn't
netstat
generally deprecated in favour ofss
, becausess
does a better job of not confusing the user in ipv6 situations like this one? e.g.versus
(ss is more correct; this is a tcp port, not a tcp6 specific one)
The text was updated successfully, but these errors were encountered: