pmirror: Add option --unix-socket #109
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
immediately |
pmenzel
approved these changes
Dec 16, 2019
pmirror/pmirror
Outdated
| @@ -1094,5 +1117,9 @@ if ($slave_mode) { | |||
| $>==0 or $slave_user='whatever'; # if we are not root, the local slave will also no be root | |||
| } | |||
|
|
|||
| if ($unix_socket && !defined $unix_socket_name) { | |||
| $unix_socket_name=sprintf '/tmp/pmirror_setup_%s_%05d',$ENV{'USER'},int(rand(100000)); | |||
donald
force-pushed
the
pmirror-named-sockets
branch
from
d11c3c5
to
d497662
Compare
Currently the sender (master) and the receiver (slave) establish a separate TCP connection for the file data. This requires that the master can connect to a random TCP port which the slave creates, which might not be possible if the systems are separated by a firewall. We can ask ssh to forward another TCP connection, but we'd need to define the port number from the master not knowing, which ports are free on the slave. The port namespace is very limited, so collisions are not unlikely. To avoid that, we use the ability of ssh to use AF_UNIX sockets for a forwarded channel. These have a much bigger namespace, so collisions can be better avoided. Add a option --unix-socket to use a ssh channel for the data connection. Use /tmp/pmirror_USER_NNNNN as the default socket name, where USER is the username (on the master) and NNNNN is a 5 digit random value. This can be overwritten with --unix-socket-name=PATH. The same name is used on the master and on the server. The name is removed immediately after the data channel ist established to reduce the time frame for collisions. Unlike the TCP based data channel, the unix-socket based data channel is forwarded by ssh and so is encrypted. Usage: If your systems are seperated by a firewall or you want encryption on the data channel, add --unix-socket to the pmirror command line.
donald
force-pushed
the
pmirror-named-sockets
branch
from
d497662
to
ca4337b
Compare
|
Thanks. Addressed both comments. |
Sign in
to join this conversation on GitHub.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently the sender (master) and the receiver (slave) establish a
separate TCP connection for the file data. This requires that the
master can connect to a random TCP port which the slave creates, which
might not be possible if the systems are separated by a firewall.
We can ask ssh to forward another TCP connection, but we'd need to
define the port number from the master not knowing, which ports are free
on the slave. The port namespace is very limited, so collisions are not
unlikely. To avoid that, we use the ability of ssh to use AF_UNIX
sockets for a forwarded channel. These have a much bigger namespace, so
collisions can be better avoided.
Add a option --unix-socket to use a ssh channel for the data connection.
Use /tmp/pmirror_USER_NNNNN as the default socket name, where USER is
the username (on the master) and NNNNN is a 5 digit random value. This
can be overwritten with --unix-socket-name=PATH. The same name is used
on the master and on the server. The name is removed immediately after
the data channel ist established to reduce the time frame for
collisions.
Unlike the TCP based data channel, the unix-socket based data channel is
forwarded by ssh and so is encrypted.
Usage:
If your systems are seperated by a firewall or you want encryption on
the data channel, add --unix-socket to the pmirror command line.