From 5f4ac38434e1c6e5873be357aa6caa6213fe2014 Mon Sep 17 00:00:00 2001 From: YueGuobin Date: Thu, 6 Aug 2026 21:33:38 +0800 Subject: [PATCH] ubridge: default the control transport to unix Switch ubridge_control_transport from tcp (-H) to unix (-U), the AF_UNIX + SO_PEERCRED channel recommended on Linux for kernel-level peer authentication. tcp is retained as an opt-in for backward compatibility. Existing deployments that set the key explicitly are unaffected; only fresh installs / unset keys pick up the new default. --- gns3server/config_samples/gns3_server.conf | 9 +++++---- gns3server/schemas/config.py | 9 +++++---- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/gns3server/config_samples/gns3_server.conf b/gns3server/config_samples/gns3_server.conf index 04ed81e85..50a6ca01a 100644 --- a/gns3server/config_samples/gns3_server.conf +++ b/gns3server/config_samples/gns3_server.conf @@ -92,10 +92,11 @@ udp_end_port_range = 30000 ; uBridge executable location, default: search in PATH ;ubridge_path = ubridge -; uBridge control channel transport: "tcp" (-H host:port, default) or "unix" -; (-U socket_path; AF_UNIX + SO_PEERCRED, recommended on Linux for kernel-level -; peer authentication). TCP now binds loopback by default. -;ubridge_control_transport = tcp +; uBridge control channel transport: "unix" (-U socket_path; AF_UNIX + +; SO_PEERCRED, default — recommended on Linux for kernel-level peer +; authentication) or "tcp" (-H host:port; retained for backward compatibility, +; binds loopback). +;ubridge_control_transport = unix ; Marker (traffic-insight) UDP sink: one listener per compute process that ; receives uBridge MARK signals from every uBridge on this host. diff --git a/gns3server/schemas/config.py b/gns3server/schemas/config.py index af920c099..0c712b351 100644 --- a/gns3server/schemas/config.py +++ b/gns3server/schemas/config.py @@ -164,10 +164,11 @@ class ServerSettings(BaseModel): udp_start_port_range: int = Field(10000, gt=0, le=65535) udp_end_port_range: int = Field(30000, gt=0, le=65535) ubridge_path: str = "ubridge" - # Transport for the uBridge hypervisor control channel. "tcp" (-H) is the - # historical default; "unix" (-U, AF_UNIX + SO_PEERCRED) is recommended on - # Linux for kernel-level peer authentication. - ubridge_control_transport: UbridgeControlTransport = UbridgeControlTransport.tcp + # Transport for the uBridge hypervisor control channel. "unix" (-U, + # AF_UNIX + SO_PEERCRED) is the default — recommended on Linux for + # kernel-level peer authentication. "tcp" (-H) is retained for backward + # compatibility. + ubridge_control_transport: UbridgeControlTransport = UbridgeControlTransport.unix # Marker (traffic-insight) UDP sink: one listener per compute process that # receives ubridge MARK signals from every ubridge on this host. The host # defaults to loopback because ubridge runs on the same host as the compute.