For quite some time modern versions of
JFFNMS have had a problem. In large installations hosts would randomly appear as down with the reachability interface going red. All other interface types worked, just this one.
Reachability interfaces are odd, because they call fping or fping6 do to the work. The reason is because to run a ping program you need to have root access to a socket and to do that is far too difficult and scary in
PHP which is what JFFNMS is written in.
To capture the output of fping, the program is executed and the output captured to a temporary file. For my tiny setup this worked fine, for a lot of small setups this was also fine. For larger setups, it was not fine at all. Random failed interfaces and, most bizzarely of all, even though a file disappearing. The program checked for a file to exist and then ran
stat in a loop to see if data was there. The file exist check worked but the stat said file not found.
At first I thought it was some odd load related problem, perhaps the filesystem not being happy and having a file there but not really there. That was, until someone said Are these numbers supposed to be the same?
The numbers he was referring to was the filename id of the temporary file. They were most DEFINITELY not supposed to be the same. They were supposed to be unique. Why were they always unique for me and not for large setups?
The problem is with the
uniqid() function. It is basically a hex representation of the time. Large setups often have large numbers of child processes for polling devices. As the number of poller children increases, the chance that two child processes start the reachability poll at the same time and have the same uniqid increases. It s why the problem happened, but not all the time.
The stat error was another symptom of this bug, what would happen was:
- Child 1 starts the poll, temp filename abc123
- Child 2 starts the poll in the same microsecond, temp filename is also abc123
- Child 1 and 2 wait poller starts, sees that the temp file exists and goes into a loop of stat and wait until there is a result
- Child 1 finishes, grabs the details, deletes the temporary file
- Child 2 loops, tries to run stat but finds no file
Who finishes first is entirely dependent on how quickly the fping returns and that is dependent on how quicky the remote host responds to pings, so its kind of random.
A minor patch to use
tempnam() instead of uniqid() and adding the interface ID in the mix for good measure (no two children will poll the same interface, the parent s scheduler makes sure of that.) The initial responses is that it is looking good.
I found an interesting side-effect of the Juniper firewalls when you introduce IPv6. In hindsight it appears perfectly reasonable but if you are not aware of it in the first place you may have a much more permissive firewall than you thought. My setup is such that my internet address changes every time I connect to an ISP. I have services behind the Juniper that I want to expose onto the Internet, in this case a mailserver.
Most of the documentation states to have a reasonably open firewall rule and a nat rule.
If you're looking to get started at packaging free software for