Re: [EXTERNAL] PVA connection problem

[Ignacio Arriagada via Tech-talk <tech-talk at aps.anl.gov>]

Thank you everyone for your responses!

I tried enabling the ports 5075 and 5076 in VM1, but no luck. However, what I find interesting is that disabling the firewall on VM2 (the client) allows me to execute a successful pvget testSCS:gcbTx. Even without the ports being added on VM1 (the server).

Also, I'm not concerned about the UDF message, the IOC is not doing much at the moment.

Some more info that might be relevant

Current VM1 firewall configuration:

$ sudo firewall-cmd --list-all
[sudo] password for iarriagada:
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp0s3
  sources:
  services: cockpit dhcpv6-client ssh
  ports: 8888/tcp 8888/udp 5064/tcp 5065/tcp 5064/udp 5065/udp 5075/tcp 5075/udp 5076/tcp 5076/udp
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

nmap output from VM2:

$ sudo nmap 192.168.1.140 -sUT -p 5075-5076
Starting Nmap 7.70 ( https://nmap.org ) at 2023-09-15 10:29 -03
Nmap scan report for 192.168.1.140
Host is up (0.00069s latency).

PORT     STATE         SERVICE
5075/tcp open          pvaccess
5076/tcp closed        unknown
5075/udp closed        unknown
5076/udp open|filtered unknown
MAC Address: 08:00:27:1F:69:28 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 1.55 seconds

 

$ sudo nmap 192.168.1.140 -sUT -p 5064-5065
Starting Nmap 7.70 ( https://nmap.org ) at 2023-09-15 10:29 -03
Nmap scan report for 192.168.1.140
Host is up (-0.15s latency).

PORT     STATE         SERVICE
5064/tcp open          ca-1
5065/tcp closed        ca-2
5064/udp open|filtered ca-1
5065/udp open|filtered ca-2
MAC Address: 08:00:27:1F:69:28 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 1.51 seconds

Also, when I execute the nmap for ports 5075 and 5076, I get the following message on the ioc running on VM1

2023-09-15T10:25:08.452 Error fetching socket remote address: Transport endpoint is not connected.
2023-09-15T10:27:15.862 Error fetching socket remote address: Transport endpoint is not connected.
2023-09-15T10:27:28.302 Error fetching socket remote address: Transport endpoint is not connected.
2023-09-15T10:29:12.204 Error fetching socket remote address: Transport endpoint is not connected.

I think the issue is very likely related to what Jure and Michael are pointing out (thanks!). I will try with PVXS as well. But if anybody has any more ideas, I'm all ears.

Thank you all for your help!

On Fri, Sep 15, 2023 at 9:45 AM Kasemir, Kay <kasemirk at ornl.gov> wrote:

In your firewall, you open the 506* ports used by Channel Access:

 

  Ports…   5064/tcp 5065/tcp 5064/udp 5065/udp

That’s great for channel access, but PV access uses ports 5075 and 5076:

EPICS_PVAS_BROADCAST_PORT = 5076
EPICS_PVAS_SERVER_PORT = 5075

2023-09-14T17:27:50.066 Sending 59 …-> …:5076.

 Update your firewall config to include uses ports 5075 and 5076

 

 

From: Tech-talk <tech-talk-bounces at aps.anl.gov> on behalf of Ignacio Arriagada via Tech-talk <tech-talk at aps.anl.gov>
Date: Thursday, September 14, 2023 at 4:53 PM
To: tech-talk at aps.anl.gov <tech-talk at aps.anl.gov>
Subject: [EXTERNAL] PVA connection problem

Hello Tech-talk,

I'm running into an issue trying to communicate between 2 VMs using pva. In VM1 I have a softIOC running with PVAccess enabled with the following standard configuration.

 

epics> pvasr
pvAccess Server v7.1.6
Active configuration (w/ defaults)
EPICS_PVAS_INTF_ADDR_LIST = 0.0.0.0:5075
EPICS_PVAS_BEACON_ADDR_LIST =
EPICS_PVAS_AUTO_BEACON_ADDR_LIST = YES
EPICS_PVAS_BEACON_PERIOD = 15
EPICS_PVAS_BROADCAST_PORT = 5076
EPICS_PVAS_SERVER_PORT = 5075
EPICS_PVAS_PROVIDER_NAMES = QSRV

epics> pval
testSCS:TX
testSCS:RX
testSCS:gcbTx
testSCS:page0

epics>

 

From VM2, I'm trying to execute pvget to get the testSCS:gcbTx. I have set the address using EPICS_PVA_ADDR_LIST, but this doesn't work, with the following debug log

 

$ pvget testSCS:gcbTx
2023-09-14T17:27:50.066 Creating datagram socket from: 0.0.0.0:54661.
2023-09-14T17:27:50.066 Broadcast address #0: 192.168.1.140:5076. (unicast)
2023-09-14T17:27:50.066 Broadcast address #1: 192.168.1.255:5076. (not unicast)
2023-09-14T17:27:50.066 Broadcast address #2: 192.168.122.255:5076. (not unicast)
2023-09-14T17:27:50.066 Setting up UDP for interface 192.168.1.138/255.255.255.0, broadcast 192.168.1.255, dest <none>.
2023-09-14T17:27:50.066 Creating datagram socket from: 192.168.1.138:5076.
2023-09-14T17:27:50.066 Creating datagram socket from: 192.168.1.255:5076.
2023-09-14T17:27:50.066 Setting up UDP for interface 192.168.122.1/255.255.255.0, broadcast 192.168.122.255, dest <none>.
2023-09-14T17:27:50.066 Creating datagram socket from: 192.168.122.1:5076.
2023-09-14T17:27:50.066 Creating datagram socket from: 192.168.122.255:5076.
2023-09-14T17:27:50.066 Creating datagram socket from: 224.0.0.128:5076.
2023-09-14T17:27:50.066 Local multicast enabled on 127.0.0.1/224.0.0.128:5076.
2023-09-14T17:27:50.066 Sending 59 bytes 0.0.0.0:54661 -> 192.168.1.140:5076.
2023-09-14T17:27:50.066 Sending 59 bytes 0.0.0.0:54661 -> 192.168.1.255:5076.
2023-09-14T17:27:50.067 Sending 59 bytes 0.0.0.0:54661 -> 192.168.122.255:5076.
2023-09-14T17:27:50.296 Sending 59 bytes 0.0.0.0:54661 -> 192.168.1.140:5076.
2023-09-14T17:27:50.296 Sending 59 bytes 0.0.0.0:54661 -> 192.168.1.255:5076.
2023-09-14T17:27:50.296 Sending 59 bytes 0.0.0.0:54661 -> 192.168.122.255:5076.
2023-09-14T17:27:50.754 Sending 59 bytes 0.0.0.0:54661 -> 192.168.1.140:5076.
2023-09-14T17:27:50.754 Sending 59 bytes 0.0.0.0:54661 -> 192.168.1.255:5076.
2023-09-14T17:27:50.754 Sending 59 bytes 0.0.0.0:54661 -> 192.168.122.255:5076.
2023-09-14T17:27:51.670 Sending 59 bytes 0.0.0.0:54661 -> 192.168.1.140:5076.
2023-09-14T17:27:51.670 Sending 59 bytes 0.0.0.0:54661 -> 192.168.1.255:5076.
2023-09-14T17:27:51.670 Sending 59 bytes 0.0.0.0:54661 -> 192.168.122.255:5076.
^CtestSCS:gcbTx 2023-09-14T17:27:52.545 UDP socket 0.0.0.0:0 closed.
2023-09-14T17:27:52.545 UDP Client Rx (0) 0.0.0.0:54661 <- <Ukn Addr Type>
2023-09-14T17:27:52.545 UDP socket 192.168.1.138:5076 closed.
2023-09-14T17:27:52.545 UDP Client Rx (0) 192.168.1.138:5076 <- <Ukn Addr Type>
2023-09-14T17:27:52.546 UDP socket 192.168.1.255:5076 closed.
2023-09-14T17:27:52.546 UDP Client Rx (0) 192.168.1.255:5076 <- <Ukn Addr Type>
2023-09-14T17:27:52.546 UDP socket 192.168.122.1:5076 closed.
2023-09-14T17:27:52.546 UDP Client Rx (0) 192.168.122.1:5076 <- <Ukn Addr Type>
2023-09-14T17:27:52.546 UDP socket 192.168.122.255:5076 closed.
2023-09-14T17:27:52.546 UDP Client Rx (0) 192.168.122.255:5076 <- <Ukn Addr Type>
2023-09-14T17:27:52.546 UDP socket 224.0.0.128:5076 closed.
2023-09-14T17:27:52.547 UDP Client Rx (0) 224.0.0.128:5076 <- <Ukn Addr Type>

 

I can get it to work by disabling the firewall (systemctl stop firewalld). Then I get the following

 

$ pvget testSCS:gcbTx
2023-09-14T17:26:43.289 Creating datagram socket from: 0.0.0.0:37793.
2023-09-14T17:26:43.289 Broadcast address #0: 192.168.1.140:5076. (unicast)
2023-09-14T17:26:43.289 Broadcast address #1: 192.168.1.255:5076. (not unicast)
2023-09-14T17:26:43.289 Broadcast address #2: 192.168.122.255:5076. (not unicast)
2023-09-14T17:26:43.289 Setting up UDP for interface 192.168.1.138/255.255.255.0, broadcast 192.168.1.255, dest <none>.
2023-09-14T17:26:43.289 Creating datagram socket from: 192.168.1.138:5076.
2023-09-14T17:26:43.289 Creating datagram socket from: 192.168.1.255:5076.
2023-09-14T17:26:43.290 Setting up UDP for interface 192.168.122.1/255.255.255.0, broadcast 192.168.122.255, dest <none>.
2023-09-14T17:26:43.290 Creating datagram socket from: 192.168.122.1:5076.
2023-09-14T17:26:43.290 Creating datagram socket from: 192.168.122.255:5076.
2023-09-14T17:26:43.290 Creating datagram socket from: 224.0.0.128:5076.
2023-09-14T17:26:43.290 Local multicast enabled on 127.0.0.1/224.0.0.128:5076.
2023-09-14T17:26:43.290 Sending 59 bytes 0.0.0.0:37793 -> 192.168.1.140:5076.
2023-09-14T17:26:43.290 Sending 59 bytes 0.0.0.0:37793 -> 192.168.1.255:5076.
2023-09-14T17:26:43.290 Sending 59 bytes 0.0.0.0:37793 -> 192.168.122.255:5076.
2023-09-14T17:26:43.290 UDP Client Rx (59) 192.168.1.255:5076 <- 192.168.1.138:37793
2023-09-14T17:26:43.290 UDP Client Rx (59) 192.168.122.255:5076 <- 192.168.122.1:37793
2023-09-14T17:26:43.291 UDP Client Rx (53) 0.0.0.0:37793 <- 192.168.1.140:60446
2023-09-14T17:26:43.291 Connecting to PVA server: 192.168.1.140:5075.
2023-09-14T17:26:43.291 Opening socket to PVA server 192.168.1.140:5075, attempt 1.
2023-09-14T17:26:43.292 Socket connected to PVA server: 192.168.1.140:5075.
2023-09-14T17:26:43.292 Acquiring transport to 192.168.1.140:5075.
2023-09-14T17:26:43.298 Connected to PVA server: 192.168.1.140:5075.
2023-09-14T17:26:43.298 UDP Client Rx (53) 0.0.0.0:37793 <- 192.168.1.140:60446
testSCS:gcbTx <undefined>              0 INVALID DRIVER UDF
2023-09-14T17:26:43.303 Releasing TCP transport to 192.168.1.140:5075.
2023-09-14T17:26:43.303 TCP socket to 192.168.1.140:5075 is to be closed.
2023-09-14T17:26:43.303 UDP socket 0.0.0.0:0 closed.
2023-09-14T17:26:43.303 UDP Client Rx (0) 0.0.0.0:37793 <- 192.168.1.140:60446
2023-09-14T17:26:43.303 UDP socket 192.168.1.138:5076 closed.
2023-09-14T17:26:43.303 UDP Client Rx (0) 192.168.1.138:5076 <- <Ukn Addr Type>
2023-09-14T17:26:43.303 UDP socket 192.168.1.255:5076 closed.
2023-09-14T17:26:43.303 UDP Client Rx (0) 192.168.1.255:5076 <- 192.168.1.138:37793
2023-09-14T17:26:43.303 UDP socket 192.168.122.1:5076 closed.
2023-09-14T17:26:43.303 UDP Client Rx (0) 192.168.122.1:5076 <- <Ukn Addr Type>
2023-09-14T17:26:43.303 UDP socket 192.168.122.255:5076 closed.
2023-09-14T17:26:43.303 UDP Client Rx (0) 192.168.122.255:5076 <- 192.168.122.1:37793
2023-09-14T17:26:43.303 UDP socket 224.0.0.128:5076 closed.
2023-09-14T17:26:43.303 UDP Client Rx (0) 224.0.0.128:5076 <- <Ukn Addr Type>

 

From VM2, caget works without issues, with and without the firewall enabled

 

$ caget testSCS:gcbTx
testSCS:gcbTx                  0

$ cainfo testSCS:gcbTx
testSCS:gcbTx
    State:            connected
    Host:             192.168.1.140:5064
    Access:           read, write
    Native data type: DBF_LONG
    Request type:     DBR_LONG
    Element count:    1

 

The firewall config for the VMs is the following

 

VM1:

$ sudo firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp0s3
  sources:
  services: cockpit dhcpv6-client ssh
  ports: 8888/tcp 8888/udp 5064/tcp 5065/tcp 5064/udp 5065/udp
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

 

VM2:

$ sudo firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp0s3
  sources:
  services: cockpit dhcpv6-client ssh
  ports: 8888/tcp 8888/udp
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

 

For security reasons I need to be able to find a configuration for the firewall that works with PVAccess. Any idea what I could be missing?