46
Altough in the time, when the question was asked, it was really impossible,
but it is possible nowadays.
You can to both: UNIX=>TCP and UNIX=>UNIX forwarding.
For example:
ssh \
-R/var/run/mysql.sock:/var/run/mysql.sock \
-R127.0.0.1:3306:/var/run/mysql.sock \
somehost
It is possible since OpenSSH 6.7.
40
Use Rewrite conditions to match for this special case:
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/socket.io [NC]
RewriteCond %{QUERY_STRING} transport=websocket [NC]
RewriteRule /(.*) ws://localhost:8082/$1 [P,L]
ProxyPass /socket.io http://localhost:8082/socket.io
ProxyPassReverse /socket.io http://localhost:8082/socket....
32
Only answering the service restart part. I came across Monit as well, but on CentOS 7 systemd takes care of all that for you. You just need to add these two lines to the .service file (if they're not there already):
Restart=always
RestartSec=3
See https://jonarcher.info/2015/08/ensure-systemd-services-restart-on-failure/ for reference.
If you want to create ...
26
What's the difference between Unix socket and TCP/IP socket?
A TCP/IP socket is used for communication across TCP/IP networks. A connected TCP socket is identified by the combination of local IP, local port, remote IP and remote port. A listening TCP socket is identified by local port and possibly local IP. AIUI at least on linux TCP/IP sockets always ...
17
A terribly written question, but the term I was looking for was reverse proxy.
Basically, just like how nginx can forward different request to several instances of the web app based on the path or hostname, it can also be configured to "forward" the request to a websocket server instance. e.g.:
location /socket {
proxy_pass http://websocket;
...
17
Run mysqld --help and check, if it reports any problems with config
Check logs in /var/log/mysql
Try runnig it directly and check errors:
mkdir /var/run/mysqld/
chown mysql: /var/run/mysqld/
mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --socket=/var/run/mysqld/mysqld.sock
16
Actually, ss from iproute2 (replacement for netstat, ifconfig, etc.) can show this information.
Here is an example showing an ssh-agent unix domain socket to which a ssh process has connected:
$ sudo ss -a --unix -p
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
u_str ESTAB 0 0 /...
16
You can use python:
python -c "import socket as s; sock = s.socket(s.AF_UNIX); sock.bind('/tmp/test.sock')"
Also C, see this answer.
14
Short answer: Yes, since version 1.5.
Let's have a look at server keyword arguments documentation:
<address> is the IPv4 or IPv6 address of the server. Alternatively, a
resolvable hostname is supported, but this name will be resolved
during start-up. Address "0.0.0.0" or "*" has a special meaning.
It indicates that the ...
13
Let's look into source code, as it's the best documentation in the world of open source.
net/ipv4/tcp_diag.c:
if (sk->sk_state == TCP_LISTEN) {
r->idiag_rqueue = sk->sk_ack_backlog;
r->idiag_wqueue = sk->sk_max_ack_backlog;
} else {
r->idiag_rqueue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
r->idiag_wqueue ...
12
Its now 2015 and I assume the kernel patch the Michael mentions has now made it's way into the stable kernel. I have a working example of 2 docker containers one with php-fpm and the other with nginx talking to each other via a unix socket.
See: https://github.com/brad-jones/conductor/tree/master/example-project
The key to it working though was to open up ...
11
I simply use netcat and stay listening in such a case:
nc -lkU aSocket.sock
you should use netcat-openbsd. netcat-traditional does not have -U switch which is for Unix Domain socket.
11
Yes, this is a valid way to check that the socket is non-blocking.
The value for a non-blocking socket is 04000, non-blocking sockets in /proc/<pid>/fdinfo are represented in octal.
You can validate this behaviour with python.
Python 2.7.5 (default, Feb 19 2014, 13:47:28)
[GCC 4.8.2 20131212 (Red Hat 4.8.2-7)] on linux2
Type "help", "copyright", "...
11
To solve this problem for myself, I had to adjust the OS "ulimit" setting:
ulimit -a -- Check current setting
ulimit -n 10000 -- Edit setting value
Source: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=595527
11
Note to future travelers: It depends on your specific configuration but this is very likely an issue with apparmor. If you don't want to disable locking take a look at syslog and see if you're getting apparmor denies on that file.
You'll see something like: apparmor="DENIED" operation="open" parent=29871 profile="/usr/sbin/mysqld" name="/run/mysqld/mysqld....
10
This can happen because of just about any piece of software that incorrectly holds network buffers without releasing them. It just happened to me in Win7 64bit. Chrome and Firefox stopped being able to connect to any web pages, windows file sharing stopped working, and WinSCP and PuTTY both gave errors that included the words No buffer space available. ...
9
netstat -an | grep ESTABLISHED | wc -l
This will count all opened sockets in the system and will output just the total.
You can of course also change ESTABLISHED for whatever you need, for example a port or a communication status like CONNECTED or LISTENING.
9
No more socat is needed since ssh 6.7. You can forward unix domain sockets directly like:
ssh -nNT -L $(pwd)/docker.sock:/var/run/docker.sock user@someremote
More info: https://medium.com/@dperny/forwarding-the-docker-socket-over-ssh-e6567cfab160
9
I wrote a tool which uses MvG's gdb method to reliably get socket peer information, kernel debug symbols not needed.
To get the process connected to a given socket, pass it the inode number:
# socket_peer 1013410
3703 thunderbird
To find out for all processes at once use netstat_unix, it adds a column to netstat's output:
# netstat_unix
Proto RefCnt ...
9
how can I check the maximum permitted length of a path of a Unix
domain socket, on a Linux
On Linux, this length is usually defined as 108.
It is defined by the UNIX_PATH_MAX variable in the /usr/include/linux/un.h header file :
cat /usr/include/linux/un.h | grep "define UNIX_PATH_MAX"
#define UNIX_PATH_MAX 108
You could find further info here :
...
9
You can communicate the host machine or even two containers using the same socket. In the general case of two containers, you should start the two dockers from the host machine sharing a volume that should be created in the host machine.
docker run --name "containerA" -v /var/run/common_socket_dir:/var/run/common_socket_dir...
docker run --name "containerB"...
8
For closure: the problem was a stupid bug in my code (in the client).
The client in this case uses nonblocking sockets, so the connect() call will return immediately while the kernel keeps waiting for the SYN,ACK packet from server. Unfortunately the client code was very impatient: if the connection wasn't established after a few hundred milliseconds, the ...
8
For netcat in listen mode you should use -p flag to choose listening port, e.g. nc -vvv -l -p 5349.
the second error: nnetfd reuseport failed : Protocol not available
is related to SO_REUSEPORT socket option. It was introduced in linux kernel version 3.9 and netcat version using it will not work with earlier kernel release. You can either upgrade your ...
8
You will need to set the socket file in spool dir of postfix, e.g:
/var/spool/postfix/var/run/opendkim
After changing that, you might see problem about permission, then just change group owner of that dir to postfix and it will work.
See https://unix.stackexchange.com/a/74491/22454
7
From the LARTC HOWTO:
/proc/sys/net/ipv4/tcp_max_orphans
Maximal number of TCP sockets not attached to any user file handle,
held by system. If this number is exceeded orphaned connections are
reset immediately and warning is printed. This limit exists only to
prevent simple DoS attacks, you _must_ not rely on this or lower the
limit artificially, but ...
6
The file descriptor is used by application to read/write from the socket. Thus if the application call close(), the file descriptor is immediately released.
On the other hand, if the application call shutdown(), file descriptor will remain effective so that application can still read/write from/to the socket.
Quotes from https://oroboro.com/file-handle-leaks-...
6
I just had this bite me, so perhaps someone might benefit from my pain and suffering.
First, an involved link with lots of info:
http://vincent.bernat.im/en/blog/2014-tcp-time-wait-state-linux.html
In particular:
The mere result of this lack of documentation is that we find numerous tuning guides advising to set both these settings to 1 to reduce the ...
6
added to /etc/default/memcached:
[ ENABLE_MEMCACHED = yes ] && install -d -o memcache -g www-data -m 0770 /var/run/memcached
# or use setfacl and whatever user/group you want
true # because set -e in init-scripts
added to /etc/memcached.conf:
-s /var/run/memcached/memcached.sock
-a 0666
6
Different containers cannot talk to each other via UNIX domain sockets when they are in different network namespaces. There is an unofficial kernel patch that allows this, but you're on your own if you use it.
6
When the socket is in TIME_WAIT, there is no process attached to it anymore and the kernel is just holding it in case some other packet arrives. At this point, the software the originally opened this socket does not have a open file description to it anymore. That's why you can't find any relation to it. The socket that existed in /proc/$PID/fd is not there ...
Only top voted, non community-wiki answers of a minimum length are eligible