Hi again,
At 17:22 12/12/2007, plutonium239(at)free.fr wrote:[...]
I said there could be an OS-specific solution (and indeed I was
thinking of iptables or something equivalent, but since I don't use
Linux boxes I'm not familiar with the ways to do that), or one could
patch pound to do so.
Actually, here's the patch (against 2.3.2, very little testing done):
diff -u Pound-2.3.2.orig/config.c Pound-2.3.2/config.c
--- Pound-2.3.2.orig/config.c Fri May 18 10:34:53 2007
+++ Pound-2.3.2/config.c Thu Dec 13 00:23:54 2007
(at)(at) -79,7 +79,7 (at)(at)
static regex_t Service, ServiceName, URL, HeadRequire, HeadDeny,
BackEnd, Emergency, Priority, HAport, HAportAddr;
static regex_t Redirect, TimeOut, Session, Type, TTL, ID, DynScale;
static regex_t ClientCert, AddHeader, Ciphers, CAlist, VerifyList,
CRLlist, NoHTTPS11;
-static regex_t Grace;
+static regex_t Grace, BindAddress;
static regmatch_t matches[5];
(at)(at) -189,6 +189,15 (at)(at)
}
memcpy(&res->HA.sin_addr.s_addr, host->h_addr_list[0],
sizeof(res->HA.sin_addr.s_addr));
res->HA.sin_port = (in_port_t)htons(atoi(lin +
matches[2].rm_so));
+ } else if(!regexec(&BindAddress, lin, 4, matches, 0)) {
+ lin[matches[1].rm_eo] = '\0';
+ if((host = gethostbyname(lin + matches[1].rm_so)) ==
NULL || host->h_addr_list[0] == NULL) {
+ logmsg(LOG_ERR, "line %d: could not resolve BackEnd
BindAddress: %s - aborted", n_lin, lin + matches[1].rm_so);
+ exit(1);
+ } else {
+ res->bindaddr.sin_family = AF_INET;
+ memcpy(&res->bindaddr.sin_addr.s_addr,
host->h_addr_list[0], sizeof(res->bindaddr.sin_addr.s_addr));
+ }
} else if(!regexec(&End, lin, 4, matches, 0)) {
if(!has_addr) {
logmsg(LOG_ERR, "line %d: BackEnd missing Address -
aborted", n_lin);
(at)(at) -1096,6 +1105,7 (at)(at)
|| regcomp(&VerifyList, "^[ \t]*VerifyList[ \t]+\"(.+)\"[
\t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
|| regcomp(&CRLlist, "^[ \t]*CRLlist[ \t]+\"(.+)\"[ \t]*$",
REG_ICASE | REG_NEWLINE | REG_EXTENDED)
|| regcomp(&NoHTTPS11, "^[ \t]*NoHTTPS11[ \t]+([0-2])[ \t]*$",
REG_ICASE | REG_NEWLINE | REG_EXTENDED)
+ || regcomp(&BindAddress, "^[ \t]*BindAddress[ \t]+([^ \t]+)[
\t]*$", REG_ICASE | REG_NEWLINE | REG_EXTENDED)
) {
logmsg(LOG_ERR, "bad config Regex - aborted");
exit(1);
(at)(at) -1241,6 +1251,7 (at)(at)
regfree(&VerifyList);
regfree(&CRLlist);
regfree(&NoHTTPS11);
+ regfree(&BindAddress);
/* set the facility only here to ensure the syslog gets opened
if necessary */
log_facility = def_facility;
diff -u Pound-2.3.2.orig/http.c Pound-2.3.2/http.c
--- Pound-2.3.2.orig/http.c Fri May 18 10:34:53 2007
+++ Pound-2.3.2/http.c Thu Dec 13 00:23:32 2007
(at)(at) -743,6 +743,16 (at)(at)
clean_all();
pthread_exit(NULL);
}
+ if(bind(sock, (struct sockaddr *)&backend->bindaddr,
(socklen_t)sizeof(backend->bindaddr)) < 0) {
+ addr2str(caddr, MAXBUF - 1,
&backend->addr.in.sin_addr);
+ logmsg(LOG_WARNING, "backend %s:%hd bind: %s",
+ caddr, ntohs(backend->addr.in.sin_port),
strerror(errno));
+ close(sock);
+ err_reply(cl, h503, lstn->err503);
+ free_headers(headers);
+ clean_all();
+ pthread_exit(NULL);
+ }
if(connect_nb(sock, (struct sockaddr
*)&backend->addr.in, (socklen_t)sizeof(backend->addr.in),
backend->to) < 0) {
addr2str(caddr, MAXBUF - 1,
&backend->addr.in.sin_addr);
logmsg(LOG_WARNING, "backend %s:%hd connect: %s",
diff -u Pound-2.3.2.orig/pound.h Pound-2.3.2/pound.h
--- Pound-2.3.2.orig/pound.h Fri May 18 10:34:53 2007
+++ Pound-2.3.2/pound.h Thu Dec 13 00:22:53 2007
(at)(at) -285,6 +285,7 (at)(at)
struct sockaddr_in in; /* IPv4 address */
struct sockaddr_un un; /* UNIX "address" */
} addr;
+ struct sockaddr_in bindaddr; /* address to bind to */
int priority; /* priority */
int to;
struct sockaddr_in HA; /* HA address & port */
diff -u Pound-2.3.2.orig/svc.c Pound-2.3.2/svc.c
--- Pound-2.3.2.orig/svc.c Fri May 18 10:34:53 2007
+++ Pound-2.3.2/svc.c Thu Dec 13 00:24:39 2007
(at)(at) -868,6 +868,10 (at)(at)
/* try connecting */
if((sock = socket(PF_INET, SOCK_STREAM, 0)) < 0)
continue;
+ if(bind(sock, (struct sockaddr *)&be->bindaddr,
(socklen_t)sizeof(be->bindaddr)) < 0) {
+ close(sock);
+ continue;
+ }
if(connect_nb(sock, (struct sockaddr *)&be->HA,
(socklen_t)sizeof(be->HA), be->to) != 0) {
kill_be(svc, be);
addr2str(buf, MAXBUF - 1, &be->HA.sin_addr);
(at)(at) -890,6 +894,10 (at)(at)
/* try connecting */
if((sock = socket(PF_INET, SOCK_STREAM, 0)) < 0)
continue;
+ if(bind(sock, (struct sockaddr *)&be->bindaddr,
(socklen_t)sizeof(be->bindaddr)) < 0) {
+ close(sock);
+ continue;
+ }
if(connect_nb(sock, (struct sockaddr *)&be->HA,
(socklen_t)sizeof(be->HA), be->to) != 0) {
kill_be(svc, be);
addr2str(buf, MAXBUF - 1, &be->HA.sin_addr);
(at)(at) -909,6 +917,10 (at)(at)
continue;
if((sock = socket(PF_INET, SOCK_STREAM, 0)) < 0)
continue;
+ if(be->domain == PF_INET && bind(sock, (struct sockaddr
*)&be->bindaddr, (socklen_t)sizeof(be->bindaddr)) < 0) {
+ close(sock);
+ continue;
+ }
if(memcmp(&(be->HA), &z_addr, sizeof(z_addr)) == 0)
if(be->domain == PF_INET)
addr = (struct sockaddr *)&be->addr.in;
(at)(at) -945,6 +957,10 (at)(at)
continue;
if((sock = socket(PF_INET, SOCK_STREAM, 0)) < 0)
continue;
+ if(be->domain == PF_INET && bind(sock, (struct sockaddr
*)&be->bindaddr, (socklen_t)sizeof(be->bindaddr)) < 0) {
+ close(sock);
+ continue;
+ }
if(memcmp(&(be->HA), &z_addr, sizeof(z_addr)) == 0)
if(be->domain == PF_INET)
addr = (struct sockaddr *)&be->addr.in;
diff -u Pound-2.3.2.orig/pound.8 Pound-2.3.2/pound.8
--- Pound-2.3.2.orig/pound.8 Fri May 18 10:34:53 2007
+++ Pound-2.3.2/pound.8 Thu Dec 13 00:38:08 2007
(at)(at) -651,6 +651,9 (at)(at)
.B Pound
uses the same address as the back-end server, but you may use a
separate address
if you wish. This directive applies only to non Unix-domain servers.
+.TP
+\fBBindAddress\fR address
+An address to be used as the source address for connections to this backend.
.SH "Emergency"
The emergency server will be used once all existing back-ends are "dead".
All configuration directives enclosed between
[...]
As I said, there's certainly nothing stupid there, and there are many
reasons for pound not to do so by default.
Jacques.
|
