KSchopmeyer
commented
1 year ago 0.Closing as incomplete and possible incorrect. Will resubmit when confirmed. Later reopened.
The proposed fix is a: remove local host as the default listener host parameter (the host is the host name or IP address to which the listener binds.
The second part of this issue is that we need the flexibility to set the bind address as part of setting up a listener. Since a bind address of 0.0.0.0 forces the server to accept indications on any system network interfaces and that are addressed to any address known to the server, this is the logical default address.
However, it is also logical to allow the user to set a particular host IP or host name as the bind address so that indications could only be accepted when addressed to that particular host name or IP address.
Therefore we will add a new option to the pywbem listener and host commands to set the bind address for the listener being started/run. The value of this option could be either a host name or and IP address. This will be an optional option with the default value being '0.0.0.0' the IP address value for which the listener will accept indications on any network interface in the system and for any destination IP address.
We cannot send indications from a docker container WBEM server to a docker host pywbemlistener because the the docker network (on linux with docker bridge network this is docker0) is used for the docker/host communication and that is a different network than the standard network interface for the host system while we define the pywbemlistener host as the localhost address.pywbemlistener. Generally the response returned to the indication sender is:
The pywbemlistener is defined as:
Looking at this with the netstat utility shows:
The "Local address" in the table above defines both the port and the host upon which pywbemlistener will listen. Thus we are limited to listening on the host server defined network because of the address 127.0.0.1 in the "Local Address" field, and not on any other WBEM servers. However, the standard way that docker containers send http(s) to the host system is through a Docker defined network (Typically defined as a bridge network Docker0 on linux systems. Thus the test environment network configurations with docker installed and using ifconfig utility shows the following:
Since we have defined the host for the pywbemlistener as "localhost" in pywbemlistener function "cmd_listener_run()" and "cmd_listener_start()":
I changed the line to:
And we can not accept indications from any WBEM server on the pywbemlistener.
CONCLUSION: We have an issue in pywbemlistener in defining parameters for a pywbemlistener that disallows sending from a container without more complex logistics than just using "localhost" as the host definition in the indication destination.
Note that there are several possible network types supported by docker including:
Bridge network - The bridge networking for a docker container is to define a separate network (defaults to separate network Docker0 (default for ip4 is may be 172.17.0.x where the host is represented by 271.17.0.1 and each container is a member of this network (ex. 172.17.0.2, etc. that it appears that this setup of an additional network for the docker containers appears to be normal in Docker world. the .0.1 address is the address of the host. Thus indications from containers come from addresses like 172.17.0.2, etc. This also means that localhost within the container is different than localhost for the host system. Bridge is the default network type
Host network - the containers share existing host network. This form is limited because the port-mapping parameters that are part of the current docker container (assign port 5988 to port 15988) definition are not allowed (we use port mapping to reassign the standard WBEM server ports to alternate ports so that host wbem servers can exist along with the container basedWBEM server.
Therefore, if bridge networking is used using "localhost" as the definition of the host for the listener does not work since indications are being sent from the Docker0 network, not from the host network and localhost is different in the container than in the host system. If host networking is used for the containers, the port reassignment of the WBEM servers cannot be used.
There is a further question in the use of the host IP address as part of the listener definition in that this parameter means that a particular listener rejects indications that are not from the defined IP address whereas if no IP address is defined for a listener indications are accepted from any WBEM server IP.
POSSIBLE SOLUTIONS;
Either of the above solutions is clearly incompatible with the current code since the current code limits indications to be from the host machine "localhost" since the current code is to only accept indications from localhost.