Repository navigation
TCP port conflict by Ports Manager #7412
Description
After installing Webtop and Roundcube during a NS7 migration (thus at the same time), a VMWare virtual-machine with 8 Intel-i7 processors allocated the same port to both modules.
Steps to reproduce
The issue may be difficult to reproduce. Two instance must be installed at the same time to generate two concurrent port requests.
Expected behavior
SQLite locking should ensure distinct ports are allocated.
Actual behavior
It happened that port 20003 was allocated to two distinct modules:
[root@host ~]# podman run -i --rm --volume /var/lib/nethserver/node/state/ports.sqlite:/srv/ports.sqlite:z alpine ash -c 'apk add sqlite ; sqlite3 /srv/ports.sqlite' <<<"SELECT *, 'tcp' FROM TCP_PORTS UNION SELECT *, 'udp' FROM UDP_PORTS;"
fetch https://dl-cdn.alpinelinux.org/alpine/v3.21/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.21/community/x86_64/APKINDEX.tar.gz
(1/4) Installing ncurses-terminfo-base (6.5_p20241006-r3)
(2/4) Installing libncursesw (6.5_p20241006-r3)
(3/4) Installing readline (8.2.13-r0)
(4/4) Installing sqlite (3.48.0-r1)
Executing busybox-1.37.0-r12.trigger
OK: 9 MiB in 19 packages
20000|20000|ldapproxy1|tcp
20001|20001|nextcloud1|tcp
20002|20002|nextcloud1_rsync|tcp
20003|20003|roundcubemail1|tcp
20003|20003|webtop1|tcp
20004|20004|roundcubemail1_rsync|tcp
20005|20005|mail1_rsync|tcp
20006|20006|webtop1_rsync|tcp
20007|20007|ejabberd1_rsync|tcp
20008|20009|openldap1|tcp
20010|20010|openldap1_rsync|tcp
20011|20012|crowdsec1|tcp
21024|21024|loki1|tcp
Note the timestamp of agent.env, proving that the two modules were installed at the same time:
[root@host ~]# stat ~webtop1/.config/state/agent.env ~roundcubemail1/.config/state/agent.env
File: /home/webtop1/.config/state/agent.env
Dim.: 275 Blocchi: 8 Blocco di IO: 4096 file regolare
Device: fd02h/64770d Inode: 24228741 Coll.: 1
Accesso: (0600/-rw-------) Uid: ( 1007/ webtop1) Gid: ( 1007/ webtop1)
Contesto: system_u:object_r:config_home_t:s0
Accesso : 2025-04-16 10:06:32.099627213 +0200
Modifica : 2025-03-21 17:41:57.837803339 +0100
Cambio : 2025-04-16 10:06:30.219618199 +0200
Creazione: 2025-03-21 17:41:57.837803339 +0100
File: /home/roundcubemail1/.config/state/agent.env
Dim.: 296 Blocchi: 8 Blocco di IO: 4096 file regolare
Device: fd02h/64770d Inode: 555664129 Coll.: 1
Accesso: (0600/-rw-------) Uid: ( 1006/roundcubemail1) Gid: ( 1006/roundcubemail1)
Contesto: system_u:object_r:config_home_t:s0
Accesso : 2025-04-16 10:04:36.739135958 +0200
Modifica : 2025-03-21 17:41:57.828803295 +0100
Cambio : 2025-03-21 17:41:57.900803650 +0100
Creazione: 2025-03-21 17:41:57.828803295 +0100
Components
- Core 3.6.1
See also
Discussion https://mattermost.nethesis.it/nethesis/pl/8yxa5zeu43gxdd4yqrapmd3sko
Thanks to @nrauso
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
- Status
Activity
tommaso-ascani commentedon Apr 16, 2025
Probably there's something wrong with 'exclusive' access to sqlite dabatase, so i think the first step is to esnure that the ports manager lock the sqlite file correctly, dening the access to others processes.
stephdl commentedon Jun 25, 2025
relevant to this https://github.com/NethServer/ns8-core/blob/f2c7f97af7a2659d3e8d4fa3a99311061eff308b/core/imageroot/usr/local/agent/pypkg/node/ports_manager.py#L73
we are using the EXCLUSIVE mode with a timeout of 30s, so it should be strong enough
Do we have other cases @nrauso @DavidePrincipi
stephdl commentedon Jun 25, 2025
I tried to reproduce but unfortunately it was not possible
&at the endwe could try also with xarg maybe
Each time a unique port has been allocated to the module