Nsis_Imp July 2007

nsis_imp@informatik.uni-goettingen.de

7 participants
9 discussions

Receiver initiated reservation
by Bertrand Goareguer 31 Jul '07

31 Jul '07

Hi, I'm trying to make a bidirectional reservation. I first do a sender initiated reservation followed by a receiver initiated reservation. But when I look at the rules created in iptables, they are the same for both reservations (with a different marker). Maybe I'm wrong with the commands I run on the sender : 1st reservation : ./nsis_qos receiver_IP -res -bw 10000000 -sid 789a 2nd reservation : ./nsis_qos receiver_IP -rir -bw 10000000 -sid 789b Or maybe I need to bind the two reservations ? Does anyone have a clue ? Thanks, Bertrand

2 1

Re: [Nsis_imp] Could somebody answer me please?
by kalin lagno 27 Jul '07

27 Jul '07

Hi, I've already have a patch not for just for this case but also for some other cases like lifetime 0,.. but I've just tested it in my virtual enviorment and I haven't documented anything yet, but you can download it from my webpage, and with 'diff' see differences there. If you need document for changes I will prepare one next week for myself and I will send a copy of it to you. But anyway I need more tests and I will be happy if you do that on my code also :) Download "changedNsis-03.tar.gz" from: http://www.tml.tkk.fi/~arianfar/ Regards --- Jan Demter <jan-mailinglists(a)demter.de> wrote: > Hi Kalin, > > please excuse that nobody answered you so far. > The guy who mainly did our NAT/FW NSLP is no longer > a member of our > group, so it might just be the case that nobody has > an adequate > answer to your question. > Maybe you can fix this? If you'd send back patches, > we'd be very > thankful. > > Greetings > Jan > ____________________________________________________________________________________ Yahoo! oneSearch: Finally, mobile search that gives answers, not web links. http://mobile.yahoo.com/mobileweb/onesearch?refer=1ONXIC

1 0

Could somebody answer me please?
by kalin lagno 27 Jul '07

27 Jul '07

Hi, I have a question about nsis code developement, Why for create messages there is no difference between proxy mode and nonproxy mode in the code, my mean why we don't have for instance something like ni_tg_create_proxy (like the one for rea messages : nr_tg_reaproxy) Without that how nsis handels create responses in proxy mode because even in proxy mode nsis send create messages from NAT to not nsis enable receiver which can't response to them. (Sorry for resending) Regards Kalin ____________________________________________________________________________________ Sick sense of humor? Visit Yahoo! TV's Comedy with an Edge to see what's on, when. http://tv.yahoo.com/collections/222

1 0

making a simple reservation
by Bertrand Goareguer 26 Jul '07

26 Jul '07

Hello, I'm trying to make a resource reservation using NSIS but I have a few problems. So far I've got 2 computers running Linux on a 100Mbps link. The ping tool is working fine. What doesn't work is the QoS module. I configured the interfaces in the config files, iptables and TC are installed and not reporting any error. But when I try to reserve a bandwidth of 150mbit (greater than the total bandwidth), I obtain the "Resources available" message from QoSFsm::tg_reserve. I tried to go deeper into the code and found that the function SimpleRMF::isQoSAvailable always returns true (the return value is set to true at the beginning and never changed). It seems to be the same in the lattest development version. I uncommentted the return value affectation in SimpleRMF::isQoSAvailable but now all the reservations are rejected ("No resources available"). The (*iter)->current_bandwidth is equal to 0 (and hence always less than bw). I wonder if anyone ever managed to make a resource reservation without modifying the code. I hope this can help improving the software. Bertrand

2 1

Fwd: [Nsis_imp] ni_tg_create
by kalin lagno 26 Jul '07

26 Jul '07

Note: forwarded message attached. ____________________________________________________________________________________ Got a little couch potato? Check out fun summer activities for kids. http://search.yahoo.com/search?fr=oni_on_mail&p=summer+activities+for+kids&…

1 0

NSIS Suite version 0.5.0 testing problem
by Nguyen Le Chau 25 Jul '07

25 Jul '07

Hi, I had tested NSIS 0.5.0 and find some errors relate to ping command with IPv6, after that, I tried with NSIS 0.5.1 -dev, and I have problem like Mr Janusz's Here is the error message in destination host when using nsis-ping IPv6: ***** sockData = NULL - This should not happen **** > No ping client found that matches the SID Could you give me some advice to fix these bugs ? My OS: Linux Fedora 7, kernel 2.6.21 It's wonderful if the fixed packet NSIS 0.5.1 have released Thank you, Le Chau.

2 1

ni_tg_create
by kalin lagno 13 Jul '07

13 Jul '07

Hi, I have a question about nsis code developement, Why for create messages there is no difference between proxy mode and nonproxy mode in the code, my mean why we don't have for instance something like ni_tg_create_proxy (like the one for rea messages : nr_tg_reaproxy) Without that how nsis handels create responses in proxy mode because even in proxy mode nsis send create messages from NAT to not nsis enable receiver which can't response to them. Regards Kalin ____________________________________________________________________________________ Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, news, photos & more. http://mobile.yahoo.com/go?refer=1GNXIC

1 0

RE: [Nsis_imp] Configuring natfwd )
by Christian Dickmann 05 Jul '07

05 Jul '07

Hi, The message you see is not indicating a bug. It's is just a left over from a debugging session. Did you fix the Nat Traversal problem (or better the problem that GIST was complaining about a NAT without any NAT being present)? How? >From your mails I can't really tell to which extend your test is working and where it breaks. What is happening, what do you expect to happen? With more debug output (start ./nsis with -debug 3 or -debug 2) I might be able to help. Thank you for your interest and I am confident that we will make this work for you. Regards, Christian Dickmann > -----Original Message----- > From: nsis_imp-bounces(a)informatik.uni-goettingen.de [mailto:nsis_imp- > bounces(a)informatik.uni-goettingen.de] On Behalf Of Mikael Henriksson > Sent: Wednesday, July 04, 2007 2:42 PM > To: Niklas Steinleitner > Cc: nsis_imp(a)informatik.uni-goettingen.de > Subject: [Nsis_imp] Configuring natfwd ) > > I looked up that GistMAEntry again. It's in GistMAEntry.cpp in this > method: > > void GistMAEntry::setSock(Socket * sock) { > DebugLogger::print(5, "void GistMAEntry::setSock(Socket * > sock)\n"); > theSock = sock; > if (dynamic_cast<TCPTLSSocket*>(sock) != 0) { > profileLength = 2; > profile[0] = GIST_STACK_PROTO_TLS; > profile[1] = GIST_STACK_PROTO_TCP; > } else if (dynamic_cast<TCPSocket*>(sock) != 0) { > profileLength = 1; > profile[0] = GIST_STACK_PROTO_TCP; > } > #ifdef SCTP_SUPPORT_FOUND > else if (dynamic_cast<SCTPSocket*>(sock) != 0) { > profileLength = 1; > profile[0] = GIST_STACK_PROTO_SCTP; > } > #endif // SCTP_SUPPORT_FOUND > } > > It seems only to be a debug printout, but I wonder what the purpose is > of that printout is. I bet it is for debugging, but is the bug fixed? > Simply put, is there some bug that prevents me from using NSIS to > configure the NATFW box? > > As stated, what I want is to be able to create a NAT-mapping in a NATFW > virtual machine using NSIS, so that the other NSIS-enabled box can > accept incoming connection attempts. Basically dynamically mapping > opening ports. > > Mikael > > > > On Wed, 4 Jul 2007, Niklas Steinleitner wrote: > > > Please try with a real public address, not with a private one as > > 10.0.0.0/8 as public. I belief the NAT part does not work with > private addresses. > > Do you still have the "Legacy NAT detected" problem? > > > > Niklas > > > > Mikael Henriksson schrieb: > >> Got past that problem, now on to the next one. I keep getting odd > >> errors half the time. Can somebody just please explain how to > >> configure the NATFW box as an edge router between the private > network > >> 192.168.1.X and the public network 10.0.0.X. This is a virtual > >> network with virtual machines, hence using in truth private LAN > >> topologies and treating them as public Internet. What I want is the > >> NATFW box to act as a proxy between NSIS-enabled private network and > NSIS-disabled public network. > >> > >> Mikael > >> > >> On Wed, 4 Jul 2007, Mikael Henriksson wrote: > >> > >>> Hello, > >>> > >>> It seems that I've got trouble configuring the NSIS NATFWD. The FW > >>> part seems to work, but I can't get the NAT part working. > >>> > >>> Oddly enough, I get the GistException: Legacy NAT detected. I dug > up > >>> on the Internet a draft, which implies that the NAT device is not > >>> NSIS-enabled, though it very well should be. I figured out that the > >>> cause may be that NSIS does not have explicit access to iptables, > at > >>> least as far as I know. I do not know how to give NSIS explicit > >>> access to iptables, other than running nsis as root. > >>> > >>> I have however noticed that when having the FWon switched to true, > >>> NSIS creates it's own chains in iptables filter table. But the nat > >>> table remains untouched, as if NSIS did not have access to it. I've > >>> configured the settings as far as I can tell correctly. I'll paste > them both below: > >>> > >>> NATFW device configuration file: > >>> > >>> # ******************************************* > >>> # ***** General Configuration ***** > >>> # ******************************************* > >>> > >>> # Start Ping and Diagnostics NSLP daemon together with GIST > >>> nslp.startPing = yes nslp.startQoS = no nslp.startNatFw = yes > >>> nslp.startDiag = yes > >>> > >>> # Accept explicitly routed messages (default is yes) > >>> gist.acceptExplicitMessages = yes > >>> > >>> # Accept GIST DATA messages that do not relate to any GIST state > >>> (default is yes) gist.acceptStatelessGistMessage = yes > >>> > >>> # ******************************************* > >>> # ***** GIST Transport Configuration ***** > >>> # ******************************************* > >>> > >>> ## Policies which transport protocols are offered to peers. > >>> # Offer SCTP as transport to peers? > >>> gist.offerSCTP = no > >>> > >>> # Offer TLS over TCP as transport to peers? > >>> gist.offerTLS = no > >>> > >>> ## Policies > >>> # Prefer SCTP over TCP as transfer protocol? > >>> gist.useSCTP = no > >>> > >>> > >>> # ******************************************* > >>> # ***** GIST Timer Configuration ***** > >>> # ******************************************* > >>> > >>> ## All Timeouts are measured in milliseconds > >>> > >>> # How long do we wait for a Response to out initial Query? > >>> # On retransmission, this value is doubled each time. (default: > >>> 10000 > >>> ms) > >>> gist.timeout.waitForInitialResponse = 10000 > >>> > >>> # How long do we wait for a Confirm on the Receiver-Side? (default: > >>> 10000 ms) > >>> gist.timeout.waitForConfirm = 10000 > >>> > >>> # How long do we wait between sending refreshing Queries? (default: > >>> 30000 ms) > >>> gist.timeout.refreshInterval = 30000 > >>> > >>> # How long do we wait for a Response to a refreshing Query # until > >>> state is removed? (default: 100000 ms) > >>> gist.timeout.queryingNodeStateExpiration = 100000 > >>> > >>> # How long do we wait for a refreshing Query # until state is > >>> removed? (default: 100000 ms) > >>> gist.timeout.respondingNodeStateExpiration = 100000 > >>> > >>> > >>> # ******************************************* > >>> # ***** IP address/routing configurtion ***** # > >>> ******************************************* > >>> > >>> # If readRoutingTable is set to yes, all IP address configuration # > >>> used by NSIS is derived from the local IP routing tables and # > >>> interface information. > >>> # NOTE: If readRoutingTable is set to yes, all remaining IP address > >>> # configuration in this file is NOT used by NSIS. > >>> readRoutingTable = no > >>> > >>> # CAUTION: The address configuration is like a routing table. > >>> > >>> # This example IPv4 configuration contains a default route # as > well > >>> as special configuration for two network segments # (i.e > >>> 192.168.0.0/24 and 192.168.1.0/24) IPv4.entries = 2 > >>> > >>> # This is the only route that is secured by NSIS. > >>> # DEFAULT ROUTE NEEDS TO BE FIRST IN LIST! > >>> IPv4[1].addr = 10.0.0.2 > >>> IPv4[1].net = 0.0.0.0 > >>> IPv4[1].mask = 0 > >>> # This address is the extrernal address to the public network. > >>> IPv4[1].natfw.useAsExternalAddress = yes # Network is public (i.e. > >>> the global internet) # IPv4[1].natfw.isPrivateNet = no > >>> > >>> # This is the only route that is secured by NSIS. > >>> IPv4[0].addr = 192.168.1.3 > >>> IPv4[0].net = 192.168.1.0 > >>> IPv4[0].mask = 24 > >>> # This addrss is not the external address to the public network. > >>> # IPv4[0].natfw.useAsExternalAddress = no # Network is private # > >>> IPv4[0].natfw.isPrivateNet = yes > >>> > >>> > >>> > >>> # ******************************************* > >>> # ***** NatFW NSLP Configuration ***** > >>> # ******************************************* > >>> > >>> # This host runs a NAT and a firewall. Exclusive access to iptables > >>> is # recommended... How to enable that? > >>> natfw.isNAT = yes > >>> natfw.isFW = yes > >>> > >>> # Hosts inside the private network can reserve external > addresses/ports. > >>> # As the above configuration shows, 10.0.0.1 is the only external > >>> address this # router has to offer: > >>> natfw.resources.IPv4.entries = 1 > >>> natfw.resources.IPv4[0].addr = 192.168.1.3 > >>> > >>> > >>> ------------------------------------------------------------------- > - > >>> - > >>> > >>> NSIS-enabled host behind NAT, trying to access public network: > >>> > >>> # ******************************************* > >>> # ***** General Configuration ***** > >>> # ******************************************* > >>> > >>> # Start Ping and Diagnostics NSLP daemon together with GIST > >>> nslp.startPing = yes nslp.startQoS = no nslp.startNatFw = yes > >>> nslp.startDiag = yes > >>> > >>> # Accept explicitly routed messages (default is yes) > >>> gist.acceptExplicitMessages = yes > >>> > >>> # Accept GIST DATA messages that do not relate to any GIST state > >>> (default is yes) gist.acceptStatelessGistMessage = yes > >>> > >>> > >>> # ******************************************* > >>> # ***** GIST Transport Configuration ***** > >>> # ******************************************* > >>> > >>> ## Policies which transport protocols are offered to peers. > >>> # Offer SCTP as transport to peers? > >>> gist.offerSCTP = no > >>> > >>> # Offer TLS over TCP as transport to peers? > >>> gist.offerTLS = no > >>> > >>> ## Policies > >>> # Prefer SCTP over TCP as transfer protocol? > >>> gist.useSCTP = no > >>> > >>> > >>> # ******************************************* > >>> # ***** GIST Timer Configuration ***** > >>> # ******************************************* > >>> > >>> ## All Timeouts are measured in milliseconds > >>> > >>> # How long do we wait for a Response to out initial Query? > >>> # On retransmission, this value is doubled each time. (default: > >>> 10000 > >>> ms) > >>> gist.timeout.waitForInitialResponse = 10000 > >>> > >>> # How long do we wait for a Confirm on the Receiver-Side? (default: > >>> 10000 ms) > >>> gist.timeout.waitForConfirm = 10000 > >>> > >>> # How long do we wait between sending refreshing Queries? (default: > >>> 30000 ms) > >>> gist.timeout.refreshInterval = 30000 > >>> > >>> # How long do we wait for a Response to a refreshing Query # until > >>> state is removed? (default: 100000 ms) > >>> gist.timeout.queryingNodeStateExpiration = 100000 > >>> > >>> # How long do we wait for a refreshing Query # until state is > >>> removed? (default: 100000 ms) > >>> gist.timeout.respondingNodeStateExpiration = 100000 > >>> > >>> > >>> # ******************************************* > >>> # ***** IP address/routing configurtion ***** # > >>> ******************************************* > >>> > >>> # If readRoutingTable is set to yes, all IP address configuration # > >>> used by NSIS is derived from the local IP routing tables and # > >>> interface information. > >>> # NOTE: If readRoutingTable is set to yes, all remaining IP address > >>> # configuration in this file is NOT used by NSIS. > >>> readRoutingTable = no > >>> > >>> # CAUTION: The address configuration is like a routing table. > >>> > >>> # This example IPv4 configuration contains a default route # as > well > >>> as special configuration for two network segments # (i.e > >>> 192.168.0.0/24 and 192.168.1.0/24) IPv4.entries = 1 > >>> > >>> # The first entry is meant as a default route. It is used when # no > >>> subsequent entry matches. > >>> IPv4[0].addr = 192.168.1.1 > >>> IPv4[0].net = 0.0.0.0 > >>> IPv4[0].mask = 0 > >>> IPv4[0].natfw.useAsExternalAddress = yes # > >>> IPv4[0].natfw.isPrivateNet = yes > >>> > >>> > >>> > >>> > >>> # ******************************************* > >>> # ***** NatFW NSLP Configuration ***** > >>> # ******************************************* > >>> > >>> # Not a NAT nor a firewall. > >>> natfw.isNAT = no > >>> natfw.isFW = no > >>> > >>> _______________________________________________ > >>> Nsis_Imp mailing list > >>> Nsis_Imp(a)informatik.uni-goettingen.de > >>> https://user.informatik.uni-goettingen.de/mailman/listinfo/nsis_imp > >>> > >> _______________________________________________ > >> Nsis_Imp mailing list > >> Nsis_Imp(a)informatik.uni-goettingen.de > >> https://user.informatik.uni-goettingen.de/mailman/listinfo/nsis_imp > > > > -- > > Niklas Steinleitner Tel: +49 551 3913583 > > Institute for Informatics steinleitner(a)cs.uni-goettingen.de > > University of Göttingen http://www.tmg.informatik.uni- > goettingen.de > > Lotzestrasse 16-18 > > D-37083 Göttingen, Germany > > > >

2 2

Explicit access to iptables & configuring natfwd (fwd)
by Mikael Henriksson 04 Jul '07

04 Jul '07

Hello, It seems that I've got trouble configuring the NSIS NATFWD. The FW part seems to work, but I can't get the NAT part working. Oddly enough, I get the GistException: Legacy NAT detected. I dug up on the Internet a draft, which implies that the NAT device is not NSIS-enabled, though it very well should be. I figured out that the cause may be that NSIS does not have explicit access to iptables, at least as far as I know. I do not know how to give NSIS explicit access to iptables, other than running nsis as root. I have however noticed that when having the FWon switched to true, NSIS creates it's own chains in iptables filter table. But the nat table remains untouched, as if NSIS did not have access to it. I've configured the settings as far as I can tell correctly. I'll paste them both below: NATFW device configuration file: # ******************************************* # ***** General Configuration ***** # ******************************************* # Start Ping and Diagnostics NSLP daemon together with GIST nslp.startPing = yes nslp.startQoS = no nslp.startNatFw = yes nslp.startDiag = yes # Accept explicitly routed messages (default is yes) gist.acceptExplicitMessages = yes # Accept GIST DATA messages that do not relate to any GIST state (default is yes) gist.acceptStatelessGistMessage = yes # ******************************************* # ***** GIST Transport Configuration ***** # ******************************************* ## Policies which transport protocols are offered to peers. # Offer SCTP as transport to peers? gist.offerSCTP = no # Offer TLS over TCP as transport to peers? gist.offerTLS = no ## Policies # Prefer SCTP over TCP as transfer protocol? gist.useSCTP = no # ******************************************* # ***** GIST Timer Configuration ***** # ******************************************* ## All Timeouts are measured in milliseconds # How long do we wait for a Response to out initial Query? # On retransmission, this value is doubled each time. (default: 10000 ms) gist.timeout.waitForInitialResponse = 10000 # How long do we wait for a Confirm on the Receiver-Side? (default: 10000 ms) gist.timeout.waitForConfirm = 10000 # How long do we wait between sending refreshing Queries? (default: 30000 ms) gist.timeout.refreshInterval = 30000 # How long do we wait for a Response to a refreshing Query # until state is removed? (default: 100000 ms) gist.timeout.queryingNodeStateExpiration = 100000 # How long do we wait for a refreshing Query # until state is removed? (default: 100000 ms) gist.timeout.respondingNodeStateExpiration = 100000 # ******************************************* # ***** IP address/routing configurtion ***** # ******************************************* # If readRoutingTable is set to yes, all IP address configuration # used by NSIS is derived from the local IP routing tables and # interface information. # NOTE: If readRoutingTable is set to yes, all remaining IP address # configuration in this file is NOT used by NSIS. readRoutingTable = no # CAUTION: The address configuration is like a routing table. # This example IPv4 configuration contains a default route # as well as special configuration for two network segments # (i.e 192.168.0.0/24 and 192.168.1.0/24) IPv4.entries = 2 # This is the only route that is secured by NSIS. # DEFAULT ROUTE NEEDS TO BE FIRST IN LIST! IPv4[1].addr = 10.0.0.2 IPv4[1].net = 0.0.0.0 IPv4[1].mask = 0 # This address is the extrernal address to the public network. IPv4[1].natfw.useAsExternalAddress = yes # Network is public (i.e. the global internet) # IPv4[1].natfw.isPrivateNet = no # This is the only route that is secured by NSIS. IPv4[0].addr = 192.168.1.3 IPv4[0].net = 192.168.1.0 IPv4[0].mask = 24 # This addrss is not the external address to the public network. # IPv4[0].natfw.useAsExternalAddress = no # Network is private # IPv4[0].natfw.isPrivateNet = yes # ******************************************* # ***** NatFW NSLP Configuration ***** # ******************************************* # This host runs a NAT and a firewall. Exclusive access to iptables is # recommended... How to enable that? natfw.isNAT = yes natfw.isFW = yes # Hosts inside the private network can reserve external addresses/ports. # As the above configuration shows, 10.0.0.1 is the only external address this # router has to offer: natfw.resources.IPv4.entries = 1 natfw.resources.IPv4[0].addr = 192.168.1.3 --------------------------------------------------------------------- NSIS-enabled host behind NAT, trying to access public network: # ******************************************* # ***** General Configuration ***** # ******************************************* # Start Ping and Diagnostics NSLP daemon together with GIST nslp.startPing = yes nslp.startQoS = no nslp.startNatFw = yes nslp.startDiag = yes # Accept explicitly routed messages (default is yes) gist.acceptExplicitMessages = yes # Accept GIST DATA messages that do not relate to any GIST state (default is yes) gist.acceptStatelessGistMessage = yes # ******************************************* # ***** GIST Transport Configuration ***** # ******************************************* ## Policies which transport protocols are offered to peers. # Offer SCTP as transport to peers? gist.offerSCTP = no # Offer TLS over TCP as transport to peers? gist.offerTLS = no ## Policies # Prefer SCTP over TCP as transfer protocol? gist.useSCTP = no # ******************************************* # ***** GIST Timer Configuration ***** # ******************************************* ## All Timeouts are measured in milliseconds # How long do we wait for a Response to out initial Query? # On retransmission, this value is doubled each time. (default: 10000 ms) gist.timeout.waitForInitialResponse = 10000 # How long do we wait for a Confirm on the Receiver-Side? (default: 10000 ms) gist.timeout.waitForConfirm = 10000 # How long do we wait between sending refreshing Queries? (default: 30000 ms) gist.timeout.refreshInterval = 30000 # How long do we wait for a Response to a refreshing Query # until state is removed? (default: 100000 ms) gist.timeout.queryingNodeStateExpiration = 100000 # How long do we wait for a refreshing Query # until state is removed? (default: 100000 ms) gist.timeout.respondingNodeStateExpiration = 100000 # ******************************************* # ***** IP address/routing configurtion ***** # ******************************************* # If readRoutingTable is set to yes, all IP address configuration # used by NSIS is derived from the local IP routing tables and # interface information. # NOTE: If readRoutingTable is set to yes, all remaining IP address # configuration in this file is NOT used by NSIS. readRoutingTable = no # CAUTION: The address configuration is like a routing table. # This example IPv4 configuration contains a default route # as well as special configuration for two network segments # (i.e 192.168.0.0/24 and 192.168.1.0/24) IPv4.entries = 1 # The first entry is meant as a default route. It is used when # no subsequent entry matches. IPv4[0].addr = 192.168.1.1 IPv4[0].net = 0.0.0.0 IPv4[0].mask = 0 IPv4[0].natfw.useAsExternalAddress = yes # IPv4[0].natfw.isPrivateNet = yes # ******************************************* # ***** NatFW NSLP Configuration ***** # ******************************************* # Not a NAT nor a firewall. natfw.isNAT = no natfw.isFW = no

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Nsis_Imp July 2007