Pim van Pelt
df05bae8a3
Nginx's config-level duplicate-listen check rejected the documented pattern of `listen 80 device=X ipng_source_tag=A; listen 80 device=Y ipng_source_tag=B;` with "a duplicate listen 0.0.0.0:80", and even when the dedup was bypassed the kernel refused the second bind() because the first socket was already holding the port without SO_BINDTODEVICE. The listen wrapper now detects same-sockaddr duplicates before the core handler sees them and records them with `needs_clone=1`. In init_module, phase 1 clones an ngx_listening_t for each such duplicate, phase 3 closes every inherited naked fd, and phase 4 rebinds every target with SO_REUSEADDR + SO_REUSEPORT + SO_BINDTODEVICE set before bind(). SO_REUSEPORT keeps `nginx -s reload` from colliding with the still-bound sockets held by old workers during graceful drain; IPV6_V6ONLY matches nginx's default so the IPv6 listen doesn't claim the IPv4 wildcard and collide with sibling IPv4-specific listens. Restructure 01-module to cover the pattern end-to-end: four device-pinned listens on port 8080 (eth1 shares tag `tag1` across v4 and v6; eth2 splits into `tag2-v4` / `tag2-v6`), clients and server both get IPv6 addresses, and a new "Per-(device, family) request count accuracy" case proves that 10 requests on each of the four combinations yields tag1=20, tag2-v4=10, tag2-v6=10. Mgmt/direct traffic moves to port 9180 so it no longer clashes with the shared-port wildcards. Document the constraint in docs/user-guide.md: all listens on a given port must carry `device=`, and direct traffic belongs on a separate port. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
45 lines
1.5 KiB
Bash
45 lines
1.5 KiB
Bash
#!/bin/bash
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
# Server container entrypoint: installs nginx + module, waits for
|
|
# containerlab to create data-plane interfaces, starts the slow
|
|
# Python backend, and runs nginx in the foreground.
|
|
|
|
# Suppress automatic service start/restart during apt/dpkg.
|
|
printf '#!/bin/sh\nexit 101\n' > /usr/sbin/policy-rc.d
|
|
chmod +x /usr/sbin/policy-rc.d
|
|
|
|
apt-get update -qq
|
|
apt-get install -y -qq nginx python3 procps iproute2 ncat > /dev/null 2>&1
|
|
|
|
# Install the module .deb built by `make pkg-deb`.
|
|
dpkg -i /opt/build/libnginx-mod-http-ipng-stats_*.deb 2>/dev/null || true
|
|
|
|
# Re-enable module symlink in case postinst disabled it.
|
|
ln -sf /etc/nginx/modules-available/50-mod-http-ipng-stats.conf \
|
|
/etc/nginx/modules-enabled/50-mod-http-ipng-stats.conf
|
|
|
|
# Remove the policy block now that packages are installed.
|
|
rm -f /usr/sbin/policy-rc.d
|
|
|
|
# Wait for containerlab to attach the data-plane veth pairs.
|
|
for iface in eth1 eth2; do
|
|
echo "Waiting for $iface ..."
|
|
while ! ip link show "$iface" > /dev/null 2>&1; do
|
|
sleep 0.2
|
|
done
|
|
ip link set "$iface" up
|
|
done
|
|
|
|
ip addr add 10.0.1.1/24 dev eth1
|
|
ip addr add 10.0.2.1/24 dev eth2
|
|
ip -6 addr add 2001:db8:1::1/64 dev eth1 nodad
|
|
ip -6 addr add 2001:db8:2::1/64 dev eth2 nodad
|
|
|
|
# Slow backend: 50 ms sleep per request.
|
|
python3 /opt/config/slow-backend.py &
|
|
|
|
# UDP logtail listener — captures datagrams to a file for test validation.
|
|
ncat -u -l -k 127.0.0.1 9514 --recv-only >> /var/log/nginx/logtail-udp.log &
|
|
|
|
exec nginx -g 'daemon off;' -c /opt/config/nginx.conf
|