Conversation
Fix an issue where tsi_create may attempt to exit releasing sockets that hasn't been allocated. While there, make "tsi_hijack" also hijack AF_INET6 sockets. Some applications (like ones built with recent Go libraries) attempt to bind to AF_INET6 sockets only, relying on the kernel's ability to bind on AF_INET transparently. For TSI, this means those sockets won't be hijacked and exposed to the host. By hijacking AF_INET6 sockets, the application receives EAFNOSUPPORT when binding the socket, leading to it attempting again to bind using AF_INET. Fixes: libkrun#99 Signed-off-by: Sergio Lopez <slp@redhat.com>
|
This works for me now, thanks a lot! Starting the API as usual, which would normally bring up MPTCP and dual-stack socket. With this patch in place, I get only IPv4 TCP, as expected. # ss -ltnp sport 3000
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 4096 0.0.0.0:3000 0.0.0.0:* users:(("VM:nuc",pid=72134,fd=566)) |
slp
marked this pull request as draft
September 12, 2025 16:05
Collaborator
Author
|
Turns our hijacking AF_INET6 and returning EAFNOSUPPORT breaks many applications, such as nginx. So we need to do the right thing and implement transparency support for AF_INET6 too. Closing this one in favor of #101 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix an issue where tsi_create may attempt to exit releasing sockets that hasn't been allocated.
While there, make "tsi_hijack" also hijack AF_INET6 sockets. Some applications (like ones built with recent Go libraries) attempt to bind to AF_INET6 sockets only, relying on the kernel's ability to bind on AF_INET transparently. For TSI, this means those sockets won't be hijacked and exposed to the host.
By hijacking AF_INET6 sockets, the application receives EAFNOSUPPORT when binding the socket, leading to it attempting again to bind using AF_INET.
Fixes: #99