Patches

Duo prefer to run their UNIX domain socket using Linux's abstract namespace [1] feature. When opening a UNIX domain socket, if the name begins with a NULL eg. \0/path/to/socket the UDS socket is opened in kernel memory rather than on the filesystem.

Nginx abstracts the socket calls and by default won't pass the NULL through, Duo have patched this in their internal Nginx build. They have kindly provided the diff against Nginx 1.8.0 (see nginx-abstract-namespace.diff)

Golang supports Linux abstract namespace for UDS by default, if you prefix the path with @ it will be opened in the abstract namespace.

I tested Nginx 1.8.0 with the Duo patch, module tests passed and functionally it appears to work just fine.

• marcus 12/8/2015

[1] http://blog.eduardofleury.com/archives/2007/09/13