Nsis_Imp June 2007

nsis_imp@informatik.uni-goettingen.de

6 participants
4 discussions

NSIS socket creation failed
by Mikael Henriksson 28 Jun '07

28 Jun '07

Hello, I've set up a virtual network and installed NSIS on two nodes, of which one acts as a NAT, lets call it node B. The other one is neither a NAT or a firewall; lets call it node A. The network is configured correctly, and the NSIS-PING and NSIS-DIAG utilities work fine. I'm running as root NSIS-NATFW on node A, and it encounters a critical error stating that it cannot create the socket. I presume this is the unix socket mentioned in the man pages. I have had a difficult time trying to figure out why it cannot create that socket, and this seems to be a dead end for me. Any help is deeply appreciated. Here is an example of running natfw with proxy mode on. 192.168.1.1 is node A, and 192.168.1.3 is node B, on which I want to try to open a hole in the NAT. ./nsis-natfw --create -s 192.168.1.1 -d 192.168.1.3 -sport 24323 -dport 434 -x --debug=0 proxy [9] (info) (NatFw) debug level: 0 [9] (info) (NatFw) message type: CREATE [9] (all) (NatFw) -------------------- [9] (all) (NatFw) apirev = 1 [9] (all) (NatFw) type = 2 [9] (all) (NatFw) proxy = 1 [9] (all) (NatFw) mode = 1 [9] (all) (NatFw) lifetime = 600 [9] (all) (NatFw) policy = 1 [9] (all) (NatFw) subports = 0 [9] (all) (NatFw) opp_address: (null) [9] (all) (NatFw) ds_address: (null) [9] (all) (NatFw) ds_prefix = -1 [9] (all) (NatFw) ds_protocol = -1 [9] (all) (NatFw) ds_port = -1 [9] (all) (NatFw) saddr: 192.180.6.8 [9] (all) (NatFw) daddr: 192.180.6.8 [9] (all) (NatFw) sport = -1 [9] (all) (NatFw) dport = -1 [9] (all) (NatFw) sid = d415e5b7 2000000f40ff8b76cced1b7 [9] (crit) (NatFw) socket creation failed With kind regards, Mikael Henriksson

3 2

RE: [Nsis_imp] problem marking the packets
by Christian Dickmann 28 Jun '07

28 Jun '07

> > QoSFsm::idle__rx_reserve() > Reserving 10000bps... > (TC) Running "tc class add dev eth0 parent 1:1 classid 1:6 htb rate > 10000bps ceil 10000bps" > (TC) Running "tc qdisc add dev eth0 parent 1:6 handle 6: sfq perturb > 10" > (Ip6Tables) Running "ip6tables -t mangle -A PREROUTING --src > 2001:690:2380:7777:211:2fff:fea6:644/128 --dst > 2001:690:2380:777c:20a:e4ff:fe03:73f5/128 -j MARK --set-mark 0x0006" > (TC) Running "tc filter add dev eth0 protocol ip parent 1:0 prio 1 > handle 6 fw classid 1:6" > mtu: 1500Reserving 10000bps... > (TC) Running "tc class add dev eth1 parent 1:1 classid 1:6 htb rate > 10000bps ceil 10000bps" > (TC) Running "tc qdisc add dev eth1 parent 1:6 handle 6: sfq perturb > 10" > (Ip6Tables) Running "ip6tables -t mangle -A PREROUTING --src > 2001:690:2380:7777:211:2fff:fea6:644/128 --dst > 2001:690:2380:777c:20a:e4ff:fe03:73f5/128 -j MARK --set-mark 0x0006" > (TC) Running "tc filter add dev eth1 protocol ip parent 1:0 prio 1 > handle 6 fw classid 1:6" > mtu: 1500++ V:Id:M_Seq:O_Cmb : 0:0:0:3 > Looks good. > > However, none of the ping6 packets are marked for the reservation, as > you can see, > > > root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# ip6tables -t mangle -L -v > Chain PREROUTING (policy ACCEPT 47M packets, 68G bytes) > pkts bytes target prot opt in out source > destination > 390 40560 MARK all any any asus/128 > acer/128 MARK set 0x6 > 390 40560 MARK all any any asus/128 > acer/128 MARK set 0x6 If I read this correctly, 390 packets have been marked! > No packets using 6 MARK are sent > > root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# tc -s -d qdisc show dev > eth0 > qdisc htb 1: r2q 10 default 2 direct_packets_stat 149 ver 3.17 > Sent 105983536 bytes 72502 pkts (dropped 662328, overlimits 527419) > backlog 126p > qdisc sfq 2: parent 1:2 limit 128p quantum 1514b flows 128/1024 perturb > 10sec > Sent 105656048 bytes 72278 pkts (dropped 662328, overlimits 0) > backlog 126p > qdisc sfq 6: parent 1:6 limit 128p quantum 1514b flows 128/1024 perturb > 10sec > Sent 0 bytes 0 pkts (dropped 0, overlimits 0) > root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# That is strange. The packets are marked (I think) but not ending up in the qdisc) What about dev1? Are the packets from asus to acer leaving the QNE on eth0 or eth1? > So, this is almost working, but something is still missing. > > > Please reply as soon as you can. > Thanks in advance. I really don't know why this is not working. Seems to be a problem with TC/Iptables and not related to NSIS itself anymore. You might have to play around with those two a little bit. Regards, Christian

2 1

problem marking the packets
by Fabio 26 Jun '07

26 Jun '07

I think there is still a bug. first of all, with this 2007-06-26 I couldn't see nothing when running: ip6tables -t mangle -L -v so, I picked up the IpTablesWrapper.cpp file of the 2007-06-26 version and i put it on the version i have. After starting ./nsis -qos -debug 5 on all nodes, I start on QNI a nsis-qos and a ping6 to the QNR. On a QNE (dogpoo) I can see the following, QoSFsm::idle__rx_reserve() Reserving 10000bps... (TC) Running "tc class add dev eth0 parent 1:1 classid 1:6 htb rate 10000bps ceil 10000bps" (TC) Running "tc qdisc add dev eth0 parent 1:6 handle 6: sfq perturb 10" (Ip6Tables) Running "ip6tables -t mangle -A PREROUTING --src 2001:690:2380:7777:211:2fff:fea6:644/128 --dst 2001:690:2380:777c:20a:e4ff:fe03:73f5/128 -j MARK --set-mark 0x0006" (TC) Running "tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 6 fw classid 1:6" mtu: 1500Reserving 10000bps... (TC) Running "tc class add dev eth1 parent 1:1 classid 1:6 htb rate 10000bps ceil 10000bps" (TC) Running "tc qdisc add dev eth1 parent 1:6 handle 6: sfq perturb 10" (Ip6Tables) Running "ip6tables -t mangle -A PREROUTING --src 2001:690:2380:7777:211:2fff:fea6:644/128 --dst 2001:690:2380:777c:20a:e4ff:fe03:73f5/128 -j MARK --set-mark 0x0006" (TC) Running "tc filter add dev eth1 protocol ip parent 1:0 prio 1 handle 6 fw classid 1:6" mtu: 1500++ V:Id:M_Seq:O_Cmb : 0:0:0:3 However, none of the ping6 packets are marked for the reservation, as you can see, root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# ip6tables -t mangle -L -v Chain PREROUTING (policy ACCEPT 47M packets, 68G bytes) pkts bytes target prot opt in out source destination 390 40560 MARK all any any asus/128 acer/128 MARK set 0x6 390 40560 MARK all any any asus/128 acer/128 MARK set 0x6 Chain INPUT (policy ACCEPT 69222 packets, 7100K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 47M packets, 68G bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 24121 packets, 3289K bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 47M packets, 68G bytes) pkts bytes target prot opt in out source destination root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# tc -s -d filter show dev eth0 parent 1: filter protocol ip pref 1 fw filter protocol ip pref 1 fw handle 0x6 classid 1:6 root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# No packets using 6 MARK are sent root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# tc -s -d qdisc show dev eth0 qdisc htb 1: r2q 10 default 2 direct_packets_stat 149 ver 3.17 Sent 105983536 bytes 72502 pkts (dropped 662328, overlimits 527419) backlog 126p qdisc sfq 2: parent 1:2 limit 128p quantum 1514b flows 128/1024 perturb 10sec Sent 105656048 bytes 72278 pkts (dropped 662328, overlimits 0) backlog 126p qdisc sfq 6: parent 1:6 limit 128p quantum 1514b flows 128/1024 perturb 10sec Sent 0 bytes 0 pkts (dropped 0, overlimits 0) root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# tc -s class show dev eth0 class htb 1:1 root rate 10000Kbit ceil 10000Kbit burst 15Kb cburst 2848b Sent 115512344 bytes 79254 pkts (dropped 0, overlimits 0) rate 9341Kbit 801pps lended: 78424 borrowed: 0 giants: 0 tokens: 7317 ctokens: -2931 class htb 1:2 parent 1:1 leaf 2: prio 0 rate 100000bit ceil 10000Kbit burst 1611b cburst 2848b Sent 116146134 bytes 79455 pkts (dropped 727403, overlimits 0) rate 9348Kbit 801pps backlog 126p lended: 830 borrowed: 78424 giants: 0 tokens: -166073 ctokens: -2931 class htb 1:6 parent 1:1 leaf 6: prio 0 rate 80000bit ceil 80000bit burst 1609b cburst 1609b Sent 0 bytes 0 pkts (dropped 0, overlimits 0) lended: 0 borrowed: 0 giants: 0 tokens: 164864 ctokens: 164864 root@dogpoo:/usr/src/nsis-0.5.1-dev-old/bin# So, this is almost working, but something is still missing. Please reply as soon as you can. Thanks in advance. Fábio Ferreira University of Aveiro Instituto de Telecomunicações

1 0

NSIS: SimpleRMF doesn't work with IPv6
by Fábio 22 Jun '07

22 Jun '07

Hi, I believe that this program doesn't work for IPv6. I'm using an IPv6 testbed with one QNI, one QNR and 2 QNE. On both QNE i'm using SimpleRMF. I get the following log when I put nsis running: root@dogpoo:/usr/src/nsis-0.5.1-dev/bin# ./nsis -qos -debug 5 (err) Configuration: Using 2001:690:2380:777a:20c:6eff:feda:1988 as local IPv6 address (err) Configuration: Using 2001:690:2380:777c:260:8ff:fe81:6e77 as local IPv6 address NSIS daemon v0.5.1-dev starting ... My PID id = 5696 FD is -1 TEST: no Starting pingServer (pid: 5697) ... Starting qosServer (pid: 5698) ... SimpleRMF::device = eth0, mtu = 1500 overall_rate 10mbit default_rate 100kbit default_max_rate 10mbit float max_bw 10485760.000000 (TC) Running "tc qdisc delete dev eth0 root handle 1:" Starting diagServer (pid: 5699) ... RTNETLINK answers: Invalid argument (IpTables) Running "iptables -t mangle -F PREROUTING" (TC) Running "tc qdisc add dev eth0 root handle 1: htb default 2" (TC) Running "tc class add dev eth0 parent 1: classid 1:1 htb rate 10mbit burst 15k" (TC) Running "tc class add dev eth0 parent 1:1 classid 1:2 htb rate 100kbit ceil 10mbit" (TC) Running "tc qdisc add dev eth0 parent 1:2 handle 2: sfq perturb 10" SimpleRMF::device = eth1, mtu = 1500 overall_rate 100mbit default_rate 100kbit default_max_rate 100mbit float max_bw 104857600.000000 (TC) Running "tc qdisc delete dev eth1 root handle 1:" RTNETLINK answers: Invalid argument (IpTables) Running "iptables -t mangle -F PREROUTING" (TC) Running "tc qdisc add dev eth1 root handle 1: htb default 2" (TC) Running "tc class add dev eth1 parent 1: classid 1:1 htb rate 100mbit burst 15k" (TC) Running "tc class add dev eth1 parent 1:1 classid 1:2 htb rate 100kbit ceil 100mbit" (TC) Running "tc qdisc add dev eth1 parent 1:2 handle 2: sfq perturb 10" QoSServer: connected to GIST server First of all, I can see that there is a call for IPtables, where I believe that should be a call for IP6Tables (IPv6). Despite of establishing with TC the reservation properties, I believe that it isn't created. On the QNI I get the following message: root@asus:/usr/src# ./ping6-qos.sh 2001:690:2380:777c:20a:e4ff:fe03:73f5 Received response: 2 QOS_ERRORCLASS_SUCCESS However, on the QNE nodes there is no filter to classify the traffic, as you can see below, root@dogpoo:/usr/src# ip6tables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination root@dogpoo:/usr/src# root@dogpoo:/usr/src# root@dogpoo:/usr/src# ip6tables -t mangle -L Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination root@dogpoo:/usr/src# root@dogpoo:/usr/src# root@dogpoo:/usr/src# tc -s -d filter root@dogpoo:/usr/src# So, this seems like a bug of the NSIS implementation. I believe that those who use IPv4 may not have this problem. I really need an answer to this mail as soon as possible, since that i'm running out of time. Best regards, Fabio Ferreira University of Aveiro - Portugal Instituto de Telecomunicações

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Nsis_Imp June 2007