search

NICMx / Jool

SIIT and NAT64 for Linux
GNU General Public License v2.0
326 stars 66 forks source link

SIIT-EAMT not working on centos8 with netfilter #339

Closed ruben-herold closed 4 years ago

ruben-herold commented 4 years ago

hi,

seems something is complete broken in 4.1.2 SIIT on centos 8 with kernel 4.18.0-193.14.2.el8_2.x86_64. I installed 4.1.2 via dkms.

bash-4.4# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 185.137.128.18/32 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 2a:6a:90:a2:8a:1c brd ff:ff:ff:ff:ff:ff
    inet 185.137.128.40/28 brd 185.137.128.47 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
    inet6 2a0c:a980:1000:4::18/64 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::286a:90ff:fea2:8a1c/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
bash-4.4# 
bash-4.4# ip route
default via 185.137.128.33 dev eth0 proto static metric 100 
185.137.128.32/28 dev eth0 proto kernel scope link src 185.137.128.40 metric 100 
bash-4.4# ip -6 route 
::1 dev lo proto kernel metric 256 pref medium
2a0c:a980:1000:4::/64 dev eth0 proto kernel metric 100 pref medium
fe80::/64 dev eth0 proto kernel metric 100 pref medium
default via 2a0c:a980:1000:4::1 dev eth0 proto static metric 100 pref medium
bash-4.4# 
bash-4.4# sysctl -a |grep forwar
net.ipv4.conf.all.bc_forwarding = 0
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.bc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.eth0.bc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.lo.bc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.mc_forwarding = 0
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.default.mc_forwarding = 0
net.ipv6.conf.eth0.forwarding = 0
net.ipv6.conf.eth0.mc_forwarding = 0
net.ipv6.conf.lo.forwarding = 1
net.ipv6.conf.lo.mc_forwarding = 0
bash-4.4# 

bash-4.4# ping -c 3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=4.85 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=4.28 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=117 time=4.21 ms

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 5ms
rtt min/avg/max/mdev = 4.213/4.446/4.846/0.293 ms
bash-4.4# modprobe jool_siit
bash-4.4# ping -c 3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=4.73 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=4.33 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=117 time=4.16 ms

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 6ms
rtt min/avg/max/mdev = 4.161/4.404/4.727/0.243 ms
bash-4.4# /usr/local/bin/jool_siit instance add "default" --netfilter --pool6 64:ff9b:1::/96
bash-4.4# ping -c 3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 27ms

bash-4.4#

As you can see teh system looses ipv4 connectivity as soon I add the pool.

ydahhrk commented 4 years ago

Ahhhhhhhhhh, the generic blacklist is probably the problem.

Ok, hang on.

ydahhrk commented 4 years ago

Hmm... never mind; couldn't reproduce.

Sorry; I'll dig deeper tomorrow.

ydahhrk commented 4 years ago

Now that I think about it, since you have 4.1.2, can you please enable debug and post what it's doing?

jool_siit -i "default" global update logging-debug true
ping -c 1 8.8.8.8
dmesg

On Thu, Aug 6, 2020, 5:47 PM Ruben Herold notifications@github.com wrote:

hi,

seems something is complete broken in 4.1.2 SIIT on centos 8 with kernel 4.18.0-193.14.2.el8_2.x86_64. I installed 4.1.2 via dkms.

bash-4.4# ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet 185.137.128.18/32 scope global lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 2a:6a:90:a2:8a:1c brd ff:ff:ff:ff:ff:ff inet 185.137.128.40/28 brd 185.137.128.47 scope global noprefixroute eth0 valid_lft forever preferred_lft forever inet6 2a0c:a980:1000:4::18/64 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::286a:90ff:fea2:8a1c/64 scope link noprefixroute valid_lft forever preferred_lft forever bash-4.4#

bash-4.4# ip route default via 185.137.128.33 dev eth0 proto static metric 100 185.137.128.32/28 dev eth0 proto kernel scope link src 185.137.128.40 metric 100 bash-4.4# ip -6 route ::1 dev lo proto kernel metric 256 pref medium 2a0c:a980:1000:4::/64 dev eth0 proto kernel metric 100 pref medium fe80::/64 dev eth0 proto kernel metric 100 pref medium default via 2a0c:a980:1000:4::1 dev eth0 proto static metric 100 pref medium bash-4.4#

bash-4.4# sysctl -a |grep forwar net.ipv4.conf.all.bc_forwarding = 0 net.ipv4.conf.all.forwarding = 1 net.ipv4.conf.all.mc_forwarding = 0 net.ipv4.conf.default.bc_forwarding = 0 net.ipv4.conf.default.forwarding = 1 net.ipv4.conf.default.mc_forwarding = 0 net.ipv4.conf.eth0.bc_forwarding = 0 net.ipv4.conf.eth0.forwarding = 1 net.ipv4.conf.eth0.mc_forwarding = 0 net.ipv4.conf.lo.bc_forwarding = 0 net.ipv4.conf.lo.forwarding = 1 net.ipv4.conf.lo.mc_forwarding = 0 net.ipv4.ip_forward = 1 net.ipv4.ip_forward_update_priority = 1 net.ipv4.ip_forward_use_pmtu = 0 net.ipv6.conf.all.forwarding = 1 net.ipv6.conf.all.mc_forwarding = 0 net.ipv6.conf.default.forwarding = 1 net.ipv6.conf.default.mc_forwarding = 0 net.ipv6.conf.eth0.forwarding = 0 net.ipv6.conf.eth0.mc_forwarding = 0 net.ipv6.conf.lo.forwarding = 1 net.ipv6.conf.lo.mc_forwarding = 0 bash-4.4#

bash-4.4# ping -c 3 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=4.85 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=4.28 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=117 time=4.21 ms

--- 8.8.8.8 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 5ms rtt min/avg/max/mdev = 4.213/4.446/4.846/0.293 ms bash-4.4# modprobe jool_siit bash-4.4# ping -c 3 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=4.73 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=4.33 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=117 time=4.16 ms

--- 8.8.8.8 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 6ms rtt min/avg/max/mdev = 4.161/4.404/4.727/0.243 ms bash-4.4# /usr/local/bin/jool_siit instance add "default" --netfilter --pool6 64:ff9b:1::/96 bash-4.4# ping -c 3 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. ^C --- 8.8.8.8 ping statistics --- 3 packets transmitted, 0 received, 100% packet loss, time 27ms

bash-4.4#

As you can see teh system looses ipv4 connectivity as soon I add the pool.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/NICMx/Jool/issues/339, or unsubscribe https://github.com/notifications/unsubscribe-auth/AASHNF6UJA5TI7DFKTQFBOTR7MXGTANCNFSM4PXBOQNQ .

ydahhrk commented 4 years ago

Hello?

ruben-herold commented 4 years ago

Sorry I'm currently away cause of holidays. I could fix it by adding the eth0 Ipv4 to the blacklist. But I run into an other issue which I could not debug in the moment. I have two vyos routers and behin this boxes I have two centos 8 vms doing SIIT-DC with EAM with ECMP. But somthing went wrong. I hope I can debug in the next three day'S

ydahhrk commented 4 years ago

Ok, thank you

ruben-herold commented 4 years ago

Now that I think about it, since you have 4.1.2, can you please enable debug and post what it's doing? jool_siit -i "default" global update logging-debug true ping -c 1 8.8.8.8 dmesg

Can 't enable it:

sudo /usr/local/bin/jool_siit -i "default" global update logging-debug true Unexpected token: 'logging-debug' Available options: manually-enabled pool6 debug trace zeroize-traffic-class override-tos tos lowest-ipv6-mtu mtu-plateaus amend-udp-checksum-zero eam-hairpin-mode randomize-rfc6791-addresses rfc6791v6-prefix rfc6791v4-prefix

ydahhrk commented 4 years ago

What does jool_siit --version print?

How about this then:

jool_siit -i "default" stats display
ping -c 1 8.8.8.8
jool_siit -i "default" stats display
ruben-herold commented 4 years ago

Yes I fixed it I don't know why the binary was not overwriten by make install. I will try to debug it today or tomorrow. With the blacklist entry it runs without any problem so far

ydahhrk commented 4 years ago

It seems this is the same bug as #338, which has been found and squashed.

Closing tentatively. Feel free to reopen if the problem persists in version 4.1.3.