is there a benefit over socat?
It is faster because socat creates additional copies/context switches when forwarding data. This tool changes the bind syscall so it becomes a unix socket in the first place.
Show HN: ip2unix – Turn IP sockets into Unix domain sockets
11–20 of 24 posts
Re: Show HN: ip2unix – Turn IP sockets into Unix domain sockets
#12This is kinda awesome... Only request is a ptrace version, that will work on all binaries.
Re: Show HN: ip2unix – Turn IP sockets into Unix domain sockets
#13This is kinda awesome... Only request is a ptrace version, that will work on all binaries.
https://github.com/nixcloud/ip2unix/commit/00dddf228a70ad230...
That's what I had in mind someday™. Unfortunately, this has to wait for version 4.x maybe :-/
Re: Show HN: ip2unix – Turn IP sockets into Unix domain sockets
#14very interesting. A docker integration would be fun too (something like "docker run -p /tmp/socket:8080 ...") :)
I'm not very familiar with Docker, but wouldn't something like "docker run some_image ip2unix -r /tmp/socket:8080 ..." work?
You could but it means:
- you need to add ip2unix in your images, which is not always convenient
- you still need to expose the socket outside the container (which is doable with volumes, but permissions can be a mess, especially if you use user namespaces)
Re: Show HN: ip2unix – Turn IP sockets into Unix domain sockets
#15Very nice!
// "LD_PRELOAD" should've been in the submission title to avoid the "socat" questions
Re: Show HN: ip2unix – Turn IP sockets into Unix domain sockets
#16Do any programs get confused when they call getsockname() and the result is an AF_UNIX they weren't expecting?
Re: Show HN: ip2unix – Turn IP sockets into Unix domain sockets
#17Very nice! // "LD_PRELOAD" should've been in the submission title to avoid the "socat" questions
Thanks a lot for the suggestion. While I can't change the title here on HN, the README now mentions LD_PRELOAD in the first paragraph and I also added a small FAQ[1] section about socat.
[1]: https://github.com/nixcloud/ip2unix/tree/d7d297ed68cdadc65dc...
Re: Show HN: ip2unix – Turn IP sockets into Unix domain sockets
#18Do any programs get confused when they call getsockname() and the result is an AF_UNIX they weren't expecting?
If programs call getsockname() the result is not a sockaddr_un, but instead sockaddr_in(6) is used from the original call to bind(). If the socket was implicitly bound, a random[1] address is generated.
Things are a bit trickier if it gets to getpeername(), since we want to have somewhat stable addresses. This is done by querying SO_PEERCRED and encoding[2] the pid for IPv4 or pid, uid and gid for IPv6 into the address.
In summary: Programs shouldn't get confused, but if they do, it's certainly a bug in ip2unix. Feel free to open an issue :-)
[1]: https://github.com/nixcloud/ip2unix/blob/d7d297ed68cdadc65dc...
[2]: https://github.com/nixcloud/ip2unix/blob/d7d297ed68cdadc65dc...
Re: Show HN: ip2unix – Turn IP sockets into Unix domain sockets
#19This is really cool. I run a lot of different services on my home server and don't trust them to the internet. Everything is accessed via a reverse proxy with authentication that I trust.
While listening on localhost is some level of security it still means that lateral movement is possible if one of the services is compromised. It also means that if I give give someone else a user account or similarly run any less trusted code then they can access all of the services without authentication.
I'm going to look into this an apply this so that these services aren't accessible by other users.
Re: Show HN: ip2unix – Turn IP sockets into Unix domain sockets
#20So how do I access a unix socket in my browser? Be nice if "unix://file/path.html" worked.