In-Reply-To: <rt-3237-14981.18.4507250690781@krbdev.mit.edu>
References: <rt-3237-14981.18.4507250690781@krbdev.mit.edu>
MIME-Version: 1.0 (Apple Message framework v734)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <F650395C-E207-4BB1-B4AA-C25B1DED6F14@mit.edu>
Content-Transfer-Encoding: 7bit
From: Ken Raeburn <raeburn@MIT.EDU>
Subject: Re: [krbdev.mit.edu #3237] Kerberos does not work inside Linux vservers
Date: Wed, 16 Nov 2005 19:15:55 -0500
To: rt-comment@krbdev.mit.edu
RT-Send-Cc: 
Content-Length: 1088

On Nov 16, 2005, at 17:07, Christophe Nowicki via RT wrote:
> Here is the output :

Thanks!  That output looks good.  Well, maybe... did you run it in  
the same vserver environment that the KDC would run in?  I'm guessing  
that, in that case, we would only want to return one address.  It  
sort of depends -- does the vserver environment hide the other  
addresses, or just not permit you access to them?

If you run the 1.4.2 KDC in the vserver environment, does it bind to  
the correct addresses?

> The first interfaces (--> family 17 <getnameinfo error -6:  
> ai_family not supported>)
> Seams to be the loopback interface.

According to my Linux system headers, it's the "packet family"  
address type, which I'm not at all familiar with.

The loopback interface should be probed, the "loopback" flag found,  
and the address dropped from the list before it's printed.  (Maybe I  
should've had you turn on the DEBUG flag when building, that might've  
produced a little more output.  Though looking at the code, there's  
one major path where DEBUG doesn't add anything.)

Ken