OpenVZ Forum: Support » *BUG REPORTED* Cannot configure VRRPD inside a VE

Home » General » Support » *BUG REPORTED* Cannot configure VRRPD inside a VE

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

*BUG REPORTED* Cannot configure VRRPD inside a VE [message #12853]

Fri, 11 May 2007 17:42

oviney
Messages: 17
Registered: April 2007
Location: Ottawa

Junior Member

Hi All:

I have recently been testing VRRPD () on a RHEL4 update 4 VE and ran into the following error when trying to configure...

Error:

<snippet>
cant open raw socket. errno=97. (try to run it as root)
</snippet>

Here is the command that I ran:

<snippet>
vrrpd -i eth0 -p 25 -v 1 172.17.8.181
</snippet>

So at a first guess, it would appear that the VE doesn't have promiscuous access to the Ethernet device.

Any help would be much appreciated.

[Updated on: Thu, 07 June 2007 07:43] by Moderator

Report message to a moderator

Re: Cannot configure VRRPD inside a VE [message #12877 is a reply to message #12853]

Mon, 14 May 2007 08:42

Vasily Tarasov
Messages: 1345
Registered: January 2006

Senior Member

Hello,

How do you use the network from your VE? I mean, do you have a veth device or venet or probably you utilize a real network card in VE using --netdev_add option?

Thank you.

Report message to a moderator

Re: Cannot configure VRRPD inside a VE [message #12897 is a reply to message #12877]

Mon, 14 May 2007 13:31

oviney
Messages: 17
Registered: April 2007
Location: Ottawa

Junior Member

Hi:

Inside the VE we are using a real device using the following command:

vzctl set ${VPS_UID} --netif_add eth0 --hostname ${VPS_HOSTNAME} --save

Here is a view of the network config:

[root@caotta000807lvz-1 ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:18:51:AA:3B:B0
inet addr:172.17.8.185 Bcast:172.17.8.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:219407258 errors:0 dropped:0 overruns:0 frame:0
TX packets:22664160 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:4058108292 (3.7 GiB) TX bytes:2943543110 (2.7 GiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1404231735 errors:0 dropped:0 overruns:0 frame:0
TX packets:1805380421 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2380079327 (2.2 GiB) TX bytes:2334986944 (2.1 GiB)

Report message to a moderator

Re: Cannot configure VRRPD inside a VE [message #12900 is a reply to message #12897]

Mon, 14 May 2007 13:42

Vasily Tarasov
Messages: 1345
Registered: January 2006

Senior Member

Can you please, strace vrrpd (http://wiki.openvz.org/Stracing_a_program) and send the output to us.

Thank you!

Report message to a moderator

Re: Cannot configure VRRPD inside a VE [message #13724 is a reply to message #12900]

Mon, 04 June 2007 12:15

Tellerdreher
Messages: 13
Registered: October 2005

Junior Member

I do not use vrrpd but keepalived and have the same problem. The process cannot open the socket to send the multicast VRRP keepalive messages:

Jun  4 14:10:21 keepalived1 Keepalived_vrrp: cant open raw socket. errno=97

[pid 32119] socket(PF_INET, SOCK_RAW, 0x70 /* IPPROTO_??? */) = -1 EAFNOSUPPORT (Address family not supported by protocol)

I am using 2.6.18-8.1.3.el5.028stab033.1

PS: /etc/protocols: 0x70 == 112 == VRRP

PPS: I think here is the "problem" (net/socket.c):

int vz_security_proto_check(int family, int type, int protocol)
...
        switch (family) {
        case PF_UNSPEC:
        case PF_PACKET:
        case PF_NETLINK:
        case PF_UNIX:
                break;
        case PF_INET:
                switch (protocol) {
                case  IPPROTO_IP:
                case  IPPROTO_ICMP:
                case  IPPROTO_TCP:
                case  IPPROTO_UDP:
                case  IPPROTO_RAW:
                        break;
                default:
                        return -EAFNOSUPPORT;
                }
                break;
...

Is this really only a security check (you can only open sockets with protocl == 0(ip), 1(icmp), 6(tcp), 17(udp), 255(??) inside a VE)? Shouldn't this be configurable (with a Capability or so?)?

[Updated on: Tue, 05 June 2007 08:43]

Report message to a moderator