mirror of
https://github.com/jellyfin/jellyfin.git
synced 2026-01-23 23:20:51 +01:00
Unable to bind to loopback #2915
Labels
No labels
area:database
awaiting-feedback
backend
blocked
breaking change: web api
bug
build
ci
confirmed
discussion needed
dotnet future
downstream
duplicate
EFjellyfin.db
enhancement
feature
future
github-actions
good first issue
hdr
help wanted
invalid
investigation
librarydb
live-tv
lyrics
media playback
music
needs testing
nuget
performance
platform
pull-request
question
regression
release critical
requires-web
roadmap
security
security
stale
support
syncplay
ui & ux
upstream
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: starred/jellyfin#2915
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @BaronGreenback on GitHub (Apr 10, 2021).
I'm having the same issue described in the original post. I am trying to bind to localhost but instead Jellyfin is binding to all addresses. This is a security and privacy issue.
I was looking at the code and it appears as though the config isn't getting parsed correctly:
0e5d4a3bcf/Jellyfin.Networking/Manager/NetworkManager.cs (L926-L950). All that code should do is take the addresses provided and add to them, but the result is empty. So I would think that somehow the values aren't being read from the config as expected.It appears as though a lot of network settings are written to both config files. It is confusing to me which is used. (Although in this case it appears that none are).
The fact that this accidentally included all addresses is also concerning. Maybe the configuration should be updated to require an explicit
0.0.0.0or::to listen on all addresses? That way this can't happen again and it will be harder to misconfigure.@BaronGreenback commented on GitHub (Apr 10, 2021):
@KevinCox Could you let me know what version of JF you are running and your platform please?
The settings in system.xml are obsolete. There is a PR in to remove them.
@BaronGreenback commented on GitHub (Apr 10, 2021):
Have just run your config here - and it working as expected. First thing that springs to mind is that .net isn't returning the localhost address as being active on any of the interfaces. ("invalid" interfaces addresses are removed as part of the startup).
@kevincox commented on GitHub (Apr 10, 2021):
I am running
10.7.1.My full network.xml:
Log:
@kevincox commented on GitHub (Apr 10, 2021):
Is there a reason to remove invalid interface addresses? It seems like that will be "handled" when Jellyfin tries to bind and it fails. No need to try and be "smart" about it.
@3sychk commented on GitHub (Apr 10, 2021):
Possible workaround is to run Jellyfin in a docker and only expose the Web to localhost ( -p 127.0.0.1:8096:8096). This will still make it accessible through LAN.
@BaronGreenback commented on GitHub (Apr 10, 2021):
Haved tested this on my system as well as mocking you network settings - and localhost is being selected correctly.
The onlly thing that it can be is _bindAddresses = CreateIPCollection(lanAddresses).Union(_interfaceAddresses);
I''ll throw some more test units up (which are run cross platform) to see if i can trace down the issue.
@kevincox commented on GitHub (Apr 10, 2021):
Hmm, it appears that
Unionactually performs an intersection...a890a85092/MediaBrowser.Common/Net/NetworkExtensions.cs (L232-L255)@kevincox commented on GitHub (Apr 10, 2021):
I'm still kind of bewildered by all of this code. I can't find out why it is doing what it is doing. It seems to me it should be simple. I give it an IP and it calls bind with that address. Instead the code is looping around in circles doing IDK what and ultimately failing. Am I missing a reason for this or can most of this code just be removed?
@BaronGreenback commented on GitHub (Apr 11, 2021):
It's validating the addresses that have been entered actually exist in the address ranges on the network cards.
Stops the system from crashing when an invalid ip is entered - which in turn reduces the number of support calls here.
@BaronGreenback commented on GitHub (Apr 11, 2021):
Can you enable debug logging, restart JF and re-upload the startup log please?
Network debugging is enabled by editting logging.default.json and adding the line "Jellyfin.Networking.Manager.NetworkManager": "Debug", under Override
@kevincox commented on GitHub (Apr 11, 2021):
This will be done by the OS when you try to bind the socket.
Crashing due to invalid configuration is much preferable to falling back to a less secure configuration.
Not getting support calls because people don't know that something is broken isn't exactly solving the problem.
@kevincox commented on GitHub (Apr 11, 2021):
@kevincox commented on GitHub (Jul 7, 2021):
This is still present on 10.7.6. Can we please address this security vulnrability?
@crobibero commented on GitHub (Jul 7, 2021):
A PR was merged and released that fixed this error. If you’re still having this error, please open a new issue.
@kevincox commented on GitHub (Jul 8, 2021):
Well apparently it wasn't fixed because it is still happening. Ah well, 3rd issue lucky https://github.com/jellyfin/jellyfin/issues/6272