Experimental Physics and
Industrial Control System

Michael Davidsaver via Core-talk <core-talk at aps.anl.gov> · Fri, 20 Nov 2020 07:37:28 -0800

On 11/20/20 1:16 AM, Ralph Lange via Core-talk wrote:
> Hm.
> 
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
> DROP       udp  --  anywhere             anywhere             udp dpt:ca-1
> 
> Wouldn't that drop all incoming CA name resolution requests?
> But earlier, you said that printed channel names correspond to CA name resolution broadcasts coming in over the "real" interface.

It is better to run 'iptables-save', which prints all of the conditions
associated with a rule.  eg. plain 'iptables -L' doesn't show input interfaces
restrictions, which presumably this rule has.  Note that 'iptables-save' only
prints, and does _not_ write any files.

> Puzzled,
> ~Ralph
> 
> 
> On Fri, 20 Nov 2020 at 09:36, Zimoch Dirk (PSI) via Core-talk <core-talk at aps.anl.gov <mailto:core-talk at aps.anl.gov>> wrote:
> 
>     Bringing the virbr0 interface down makes the test succeed.
> 
>     iptables -L reports:
>     Chain INPUT (policy ACCEPT)
>     target     prot opt source               destination
>     ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
>     ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
>     ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
>     ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps
>     DROP       udp  --  anywhere             anywhere             udp dpt:ca-1
>     ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
>     ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
>     ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
>     ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps
> 
>     Chain FORWARD (policy ACCEPT)
>     target     prot opt source               destination
>     ACCEPT     all  --  anywhere             192.168.122.0/24 <http://192.168.122.0/24>     ctstate RELATED,ESTABLISHED
>     ACCEPT     all  --  192.168.122.0/24 <http://192.168.122.0/24>     anywhere
>     ACCEPT     all  --  anywhere             anywhere
>     REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
>     REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
>     ACCEPT     all  --  anywhere             192.168.122.0/24 <http://192.168.122.0/24>     ctstate RELATED,ESTABLISHED
>     ACCEPT     all  --  192.168.122.0/24 <http://192.168.122.0/24>     anywhere
>     ACCEPT     all  --  anywhere             anywhere
>     REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
>     REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
> 
>     Chain OUTPUT (policy ACCEPT)
>     target     prot opt source               destination
>     ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpc
>     ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpc
> 
>     > -----Ursprüngliche Nachricht-----
>     > Von: Michael Davidsaver <mdavidsaver at gmail.com <mailto:mdavidsaver at gmail.com>>
>     > Gesendet: Donnerstag, 19. November 2020 19:11
>     > An: Zimoch Dirk (PSI) <dirk.zimoch at psi.ch <mailto:dirk.zimoch at psi.ch>>
>     > Cc: 'core-talk at aps.anl.gov <mailto:core-talk at aps.anl.gov>' <core-talk at aps.anl.gov <mailto:core-talk at aps.anl.gov>>
>     > Betreff: Re: AW: Problems with hanging osiSockTest
>     >
>     > On 11/19/20 2:11 AM, Zimoch Dirk (PSI) via Core-talk wrote:
>     > > I have just noticed that I had sent this only to Andrew, not to the core-talk list.
>     > >
>     > > The problematic interface is "virbr0" which may have something to do with
>     > VmWare being installed on the system. or maybe docker?
>     >
>     > Have you checked for firewall (iptables or nft) rules for this interface?
>     >
>     > The fact that all the packet counters are zero suggests that it isn't
>     > being used so often.  Can you try to disable it temporarily?  ("ifconfig virbr0
>     > down")
>     > Let's make sure we're chasing the real problem.
>     >
>     >
>     > > *Von:*Zimoch Dirk (PSI)
>     > > *Gesendet:* Mittwoch, 18. November 2020 13:34
>     > > *An:* Zimoch Dirk (PSI) <dirk.zimoch at psi.ch <mailto:dirk.zimoch at psi.ch>>; Johnson, Andrew N.
>     > <anj at anl.gov <mailto:anj at anl.gov>>
>     > > *Betreff:* AW: Problems with hanging osiSockTest
>     > >
>     > >
>     > >
>     > > $ ifconfig
>     > >
>     > > enp0s31f6: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
>     > >
>     > >         inet 129.129.130.117  netmask 255.255.255.0  broadcast 129.129.130.255
>     > >
>     > >         inet6 fe80::42b0:34ff:feea:5428  prefixlen 64  scopeid 0x20<link>
>     > >
>     > >         ether 40:b0:34:ea:54:28  txqueuelen 1000  (Ethernet)
>     > >
>     > >         RX packets 54764087  bytes 24015803269 (22.3 GiB)
>     > >
>     > >         RX errors 0  dropped 0  overruns 0  frame 0
>     > >
>     > >         TX packets 55167521  bytes 54881613829 (51.1 GiB)
>     > >
>     > >         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>     > >
>     > >         device interrupt 16  memory 0xe1200000-e1220000
>     > >
>     > >
>     > >
>     > > lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
>     > >
>     > >         inet 127.0.0.1  netmask 255.0.0.0
>     > >
>     > >         inet6 ::1  prefixlen 128  scopeid 0x10<host>
>     > >
>     > >         loop  txqueuelen 1000  (Local Loopback)
>     > >
>     > >         RX packets 1322943  bytes 739804353 (705.5 MiB)
>     > >
>     > >         RX errors 0  dropped 0  overruns 0  frame 0
>     > >
>     > >         TX packets 1322943  bytes 739804353 (705.5 MiB)
>     > >
>     > >         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>     > >
>     > >
>     > >
>     > > virbr0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
>     > >
>     > >         inet 192.168.122.1  netmask 255.255.255.0  broadcast 192.168.122.255
>     > >
>     > >         ether 52:54:00:15:9b:3e  txqueuelen 1000  (Ethernet)
>     > >
>     > >         RX packets 0  bytes 0 (0.0 B)
>     > >
>     > >         RX errors 0  dropped 0  overruns 0  frame 0
>     > >
>     > >         TX packets 0  bytes 0 (0.0 B)
>     > >
>     > >         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>     > >
>     > >
>     > >
>     > >
>     > >
>     > > *Von:*Core-talk <core-talk-bounces at aps.anl.gov <mailto:core-talk-bounces at aps.anl.gov> <mailto:core-talk- <mailto:core-talk->
>     > bounces at aps.anl.gov <mailto:bounces at aps.anl.gov>>> *Im Auftrag von *Zimoch Dirk (PSI) via Core-talk
>     > > *Gesendet:* Mittwoch, 18. November 2020 13:33
>     > > *An:* Johnson, Andrew N. <anj at anl.gov <mailto:anj at anl.gov> <mailto:anj at anl.gov <mailto:anj at anl.gov>>>
>     > > *Cc:* EPICS core-talk <core-talk at aps.anl.gov <mailto:core-talk at aps.anl.gov> <mailto:core- <mailto:core->
>     > talk at aps.anl.gov <mailto:talk at aps.anl.gov>>>
>     > > *Betreff:* AW: Problems with hanging osiSockTest
>     > >
>     > >
>     > >
>     > > After this:
>     > >
>     > > 1..24
>     > >
>     > > ok  1 - osiSockAttach
>     > >
>     > > # udpSockTest()
>     > >
>     > > ok  2 - epicsSocketCreate INET, DGRAM, 0
>     > >
>     > > ok  3 - setsockopt BROADCAST := 1
>     > >
>     > > ok  4 - getsockopt BROADCAST => 1
>     > >
>     > > ok  5 - setsockopt BROADCAST := 0
>     > >
>     > > ok  6 - getsockopt BROADCAST => 0
>     > >
>     > > ok  7 - setsockopt MULTICAST_LOOP := 1
>     > >
>     > > ok  8 - getsockopt MULTICAST_LOOP => 1
>     > >
>     > > ok  9 - setsockopt MULTICAST_LOOP := 0
>     > >
>     > > ok 10 - getsockopt MULTICAST_LOOP => 0
>     > >
>     > > ok 11 - setsockopt IP_MULTICAST_TTL := 2
>     > >
>     > > ok 12 - getsockopt IP_MULTICAST_TTL => 2
>     > >
>     > > ok 13 - setsockopt IP_MULTICAST_TTL := 1
>     > >
>     > > ok 14 - getsockopt IP_MULTICAST_TTL => 1
>     > >
>     > > # udpSockFanoutBindTest()
>     > >
>     > > # First test if epicsSocketEnableAddressUseForDatagramFanout() is necessary
>     > >
>     > > ok 15 - bind() to port 43731
>     > >
>     > > ok 16 - bind() to 43731 error -1, 98
>     > >
>     > > # Now the real test
>     > >
>     > > ok 17 - bind() to port 43731
>     > >
>     > > ok 18 - bind() to port 43731
>     > >
>     > > # udpSockFanoutTest()
>     > >
>     > > # Interface 129.129.130.255:5064 <http://129.129.130.255:5064>
>     > >
>     > > # Not LO
>     > >
>     > > # RX1 start
>     > >
>     > > # RX2 start
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX2 success 0
>     > >
>     > > # RX1 success 0
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX2 success 1
>     > >
>     > > # RX1 success 1
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX2 success 2
>     > >
>     > > # RX1 success 2
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX2 success 3
>     > >
>     > > # RX1 success 3
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX1 success 4
>     > >
>     > > # RX2 success 4
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX ignore
>     > >
>     > > # RX1 success 5
>     > >
>     > > # RX1 end
>     > >
>     > > # RX2 success 5
>     > >
>     > > # RX2 end
>     > >
>     > > # Result: RX1 3f:0 RX2 3f:0
>     > >
>     > > # Interface 192.168.122.255:5064 <http://192.168.122.255:5064>
>     > >
>     > > # Not LO
>     > >
>     > > # RX1 start
>     > >
>     > > # RX2 start
>     > >
>     > > # RX ignore
>     > >
>     > > [...]
>     > >
>     > > Now it repeatedly prints "# RX ignore" forever...
>     > >
>     > >
>     > >
>     > >
>     > >
>     > >
>     > >
>     > >
>     > >
>     > > *Von:*Johnson, Andrew N. <anj at anl.gov <mailto:anj at anl.gov> <mailto:anj at anl.gov <mailto:anj at anl.gov>>>
>     > > *Gesendet:* Dienstag, 17. November 2020 18:11
>     > > *An:* Zimoch Dirk (PSI) <dirk.zimoch at psi.ch <mailto:dirk.zimoch at psi.ch> <mailto:dirk.zimoch at psi.ch <mailto:dirk.zimoch at psi.ch>>>
>     > > *Cc:* EPICS core-talk <core-talk at aps.anl.gov <mailto:core-talk at aps.anl.gov> <mailto:core- <mailto:core->
>     > talk at aps.anl.gov <mailto:talk at aps.anl.gov>>>
>     > > *Betreff:* Re: Problems with hanging osiSockTest
>     > >
>     > >
>     > >
>     > > Dirk,
>     > >
>     > >
>     > >
>     > > What happens if you run that test manually? All EPICS unit tests can be run
>     > individually without using the test harness to see more details as the test
>     > proceeds. This is my output on RHEL-7.8, which takes about 6 seconds to run:
>     > >
>     > >
>     > >
>     > >     *tux% *cd modules/libcom/test/O.linux-x86_64/
>     > >
>     > >     *tux% *./osiSockTest
>     > >
>     > >     1..24
>     > >
>     > >     ok  1 - osiSockAttach
>     > >
>     > >     # udpSockTest()
>     > >
>     > >     ok  2 - epicsSocketCreate INET, DGRAM, 0
>     > >
>     > >     ok  3 - setsockopt BROADCAST := 1
>     > >
>     > >     ok  4 - getsockopt BROADCAST => 1
>     > >
>     > >     ok  5 - setsockopt BROADCAST := 0
>     > >
>     > >     ok  6 - getsockopt BROADCAST => 0
>     > >
>     > >     ok  7 - setsockopt MULTICAST_LOOP := 1
>     > >
>     > >     ok  8 - getsockopt MULTICAST_LOOP => 1
>     > >
>     > >     ok  9 - setsockopt MULTICAST_LOOP := 0
>     > >
>     > >     ok 10 - getsockopt MULTICAST_LOOP => 0
>     > >
>     > >     ok 11 - setsockopt IP_MULTICAST_TTL := 2
>     > >
>     > >     ok 12 - getsockopt IP_MULTICAST_TTL => 2
>     > >
>     > >     ok 13 - setsockopt IP_MULTICAST_TTL := 1
>     > >
>     > >     ok 14 - getsockopt IP_MULTICAST_TTL => 1
>     > >
>     > >     # udpSockFanoutBindTest()
>     > >
>     > >     # First test if epicsSocketEnableAddressUseForDatagramFanout() is
>     > necessary
>     > >
>     > >     ok 15 - bind() to port 55467
>     > >
>     > >     ok 16 - bind() to 55467 error -1, 98
>     > >
>     > >     # Now the real test
>     > >
>     > >     ok 17 - bind() to port 55467
>     > >
>     > >     ok 18 - bind() to port 55467
>     > >
>     > >     # udpSockFanoutTest()
>     > >
>     > >     # Interface 164.54.11.255:5064 <http://164.54.11.255:5064>
>     > >
>     > >     # Not LO
>     > >
>     > >     # RX1 start
>     > >
>     > >     # RX2 start
>     > >
>     > >     # RX2 success 0
>     > >
>     > >     # RX1 success 0
>     > >
>     > >     # RX2 success 1
>     > >
>     > >     # RX1 success 1
>     > >
>     > >     # RX2 success 2
>     > >
>     > >     # RX1 success 2
>     > >
>     > >     # RX ignore
>     > >
>     > >     # RX ignore
>     > >
>     > >     # RX1 success 3
>     > >
>     > >     # RX2 success 3
>     > >
>     > >     # RX2 success 4
>     > >
>     > >     # RX1 success 4
>     > >
>     > >     # RX1 success 5
>     > >
>     > >     # RX1 end
>     > >
>     > >     # RX2 success 5
>     > >
>     > >     # RX2 end
>     > >
>     > >     # Result: RX1 3f:0 RX2 3f:0
>     > >
>     > >     # Interface 192.168.122.255:5064 <http://192.168.122.255:5064>
>     > >
>     > >     # Not LO
>     > >
>     > >     # RX1 start
>     > >
>     > >     # RX2 start
>     > >
>     > >     # RX1 success 0
>     > >
>     > >     # RX2 success 0
>     > >
>     > >     # RX1 success 1
>     > >
>     > >     # RX2 success 1
>     > >
>     > >     # RX1 success 2
>     > >
>     > >     # RX2 success 2
>     > >
>     > >     # RX ignore
>     > >
>     > >     # RX ignore
>     > >
>     > >     # RX1 success 3
>     > >
>     > >     # RX2 success 3
>     > >
>     > >     # RX1 success 4
>     > >
>     > >     # RX2 success 4
>     > >
>     > >     # RX1 success 5
>     > >
>     > >     # RX1 end
>     > >
>     > >     # RX2 success 5
>     > >
>     > >     # RX2 end
>     > >
>     > >     # Result: RX1 3f:0 RX2 3f:0
>     > >
>     > >     ok 19 - Found non-loopback interface
>     > >
>     > >     ok 20 - Successes 2
>     > >
>     > >     # tcpSockReuseBindTest(0)
>     > >
>     > >     ok 21 - bind() to port 53058
>     > >
>     > >     ok 22 - bind() to 53058 error -1, 98
>     > >
>     > >     # tcpSockReuseBindTest(1)
>     > >
>     > >     # epicsSocketEnableAddressReuseDuringTimeWaitState
>     > >
>     > >     ok 23 - bind() to port 34068
>     > >
>     > >     ok 24 - bind() to 34068 error -1, 98
>     > >
>     > >
>     > >
>     > >         Results
>     > >
>     > >         =======
>     > >
>     > >            Tests: 24
>     > >
>     > >           Passed:  24 = 100.00%
>     > >
>     > >
>     > >
>     > >
>     > >
>     > > - Andrew
>     > >
>     > >
>     > >
>     > >
>     > >
>     > >
>     > >
>     > >
>     > >
>     > >     On Nov 17, 2020, at 4:47 AM, Zimoch Dirk (PSI) via Core-talk <core-
>     > talk at aps.anl.gov <mailto:talk at aps.anl.gov> <mailto:core-talk at aps.anl.gov <mailto:core-talk at aps.anl.gov>>> wrote:
>     > >
>     > >
>     > >
>     > >     Hello everybody,
>     > >
>     > >     I have problems with a test in EPICS 7 commit
>     > 8fd36d8eef3420b42e7936e949928a6b43df7e15.
>     > >
>     > >     osiSockTest seems to take forever.
>     > >
>     > >     'make runtests' hangs here:
>     > >     osiSockTest.t ................. 1/24
>     > >
>     > >     'make tapfiles' hangs here:
>     > >     perl -CSD osiSockTest.t -tap > osiSockTest.tap
>     > >
>     > >     I am testing on RedHat 7 (linux-x86_64).
>     > >
>     > >     Any ideas?
>     > >
>     > >     Dirk
>     > >
>     > >
>     > >
>     > > --
>     > >
>     > > Complexity comes for free, simplicity you have to work for.
>     > >
>     > >
>     > >
> 

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System