Odd interface binding observations

[Christopher Schultz <ch...@christopherschultz.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

All,

During a recent production deployment (Debian Linux), we added a
localhost-only connector like this:

    <Connector port="8187"
               protocol="org.apache.coyote.http11.Http11NioProtocol"
               address="127.0.0.1" secure="true"
               URIEncoding="UTF-8" executor="tomcatThreadPool" />

(We use secure="true" because we have security-constraints that
require it, but we want to avoid the cost of SSL setup when
communicating locally).

/etc/hosts contains this:

127.0.0.1	localhost

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
==== end of /etc/hosts =====

When I use netstat to show me what's bound to what, I see this:

$ netstat -plan | grep 8187
tcp6       0      0 ::ffff:127.0.0.1:8187   :::*
LISTEN     2737/java

Also:

$ host localhost
localhost.chadis.com	A	[my public ip]

I'm using "localhost:8187" as my host:port in my connection URL and
everything seems to work. Do I just not know how to read netstat's
output (I don't know much about the way Linux does IPv6)?

Anyone have any idea why 'host' returns my public IP for 'localhost'?
Or, when I use "localhost:8187" (which probably resolves to my public
IP), I can establish a connection?

Thanks,
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8wHeIACgkQ9CaO5/Lv0PBd5ACeLOlU9y1mdtTrzYRVQqxgK1fy
NigAoKeTZ4Rs0caRmq7lsXS6IHj36Ksj
=Aupx
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Odd interface binding observations

[Konstantin Kolinko <kn...@gmail.com>]

2012/2/6 Christopher Schultz <ch...@christopherschultz.net>:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> All,
>
> During a recent production deployment (Debian Linux), we added a
> localhost-only connector like this:
>
>    <Connector port="8187"
>               protocol="org.apache.coyote.http11.Http11NioProtocol"
>               address="127.0.0.1" secure="true"
>               URIEncoding="UTF-8" executor="tomcatThreadPool" />
>
> (We use secure="true" because we have security-constraints that
> require it, but we want to avoid the cost of SSL setup when
> communicating locally).
>
> /etc/hosts contains this:
>
> 127.0.0.1       localhost
>
> # The following lines are desirable for IPv6 capable hosts
> ::1     ip6-localhost ip6-loopback
> fe00::0 ip6-localnet
> ff00::0 ip6-mcastprefix
> ff02::1 ip6-allnodes
> ff02::2 ip6-allrouters
> ff02::3 ip6-allhosts
> ==== end of /etc/hosts =====
>
> When I use netstat to show me what's bound to what, I see this:
>
> $ netstat -plan | grep 8187
> tcp6       0      0 ::ffff:127.0.0.1:8187   :::*

The above is ipv6 representation of an ip4 address.
BTW, maybe you can try with address="::1" in your <Connector>?

> LISTEN     2737/java
>
> Also:
>
> $ host localhost
> localhost.chadis.com    A       [my public ip]
>

I suspect that
1. Something adds "domain suffix", thus the name becomes "localhost.chadis.com"
2. DNS server is asked about "localhost.chadis.com" and finds wildcard
record for "*..chadis.com". The IP in that wildcard record in your
public IP.

The host command always performs a DNS query, ignoring the /etc/hosts
file.  (An evidence:  use -v (verbose) flag).

Try "ping localhost". It prints the IP where it connects to.

> I'm using "localhost:8187" as my host:port in my connection URL and
> everything seems to work. Do I just not know how to read netstat's
> output (I don't know much about the way Linux does IPv6)?
>
> Anyone have any idea why 'host' returns my public IP for 'localhost'?
> Or, when I use "localhost:8187" (which probably resolves to my public
> IP), I can establish a connection?
>

Best regards,
Konstantin Kolinko

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org