painless-security / trust-router

Moonshot Trust Router
0 stars 0 forks source link

Error message for TIDS port already in use is misleading #93

Closed meadmaker closed 6 years ago

meadmaker commented 6 years ago

When I tried to restart the trust router, I got an error message that ended in:

tr_mons_event_init: monitoring is disabled, not enabling events or opening sockets
tids_get_listener: Error opening port 4397136
Error opening TID server socket.
Error initializing Trust Path Query Server instance.

After trying in vain to figure out why it was attempting to open port 4397136, I eventually ran strace. Its output includes:

19188 socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 8
19188 setsockopt(8, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
19188 bind(8, {sa_family=AF_INET, sin_port=htons(12309), sin_addr=inet_addr("0.0.0.0")}, 16) = -1 EADDRINUSE (Address already in use)
19188 close(8)                          = 0
19188 socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP) = 8
19188 setsockopt(8, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
19188 setsockopt(8, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0
19188 bind(8, {sa_family=AF_INET6, sin6_port=htons(12309), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = -1 EADDRINUSE (Address already in use)
19188 close(8)                          = 0
19188 write(2, "tids_get_listener: Error opening"..., 45) = 45

It looks like the trust_router reacts to its ports already being in use by printing out a message about an unrelated port.

(And in fact if I track down and kill the other process, the trust_router starts successfully. So, this is the problem causing the trust_router to shut down.)

jennifer-richards commented 6 years ago

Oops. I had forgotten the parameter for a %d in logging messages. This should be fixed by a6b70c983165f3c50265b55a4b09264fdd0dfff0

jennifer-richards commented 6 years ago

Test

Steps

  1. Configure a trust router using a conflicting port. Be creative. Some options:
    • Use port 80 on a machine with a web server
    • Specify the same port for tids, trps, and/or monitoring
  2. Start the trust router and examine the output
  3. (extra but encouraged credit) Configure invalid ports (> 65535 or <= 0) and repeat

Expected results

  1. The trust router should refuse to start if a port is in conflict, either with an outside process or between its own services
  2. There should be an error message indicating the correct port that caused the conflict.
  3. If a port > 65535 or <= 0 is specified, the trust router should refuse to start and a reasonable error message should indicate the problem.

(If specifying port 0 causes the system to start up with the default port, please file this as a bug.)

meadmaker commented 6 years ago

The extra credit fails, so passing this back to @jennifer-richards.

meadmaker commented 6 years ago

Passed!