Re: [nox-dev] IP header rewriting in PySwitch
hi McCauley, By original connection I mean that the connection is to a machine on port 2 (so no header rewriting to the machine on port 2), but i am trying to interpret it and send it to a machine on port 3. I am trying to do this in the mininet, so is it possible to achieve the approach you have mentioned in mininet? regards, kalapriya. From: Murphy McCauley To: Kalapriya Kannan1/India/IBM@IBMIN Cc: nox-dev@noxrepo.org Date: 08/24/2011 07:30 AM Subject:Re: [nox-dev] IP header rewriting in PySwitch It's difficult to guess from here. One thing that strikes me is that you say that it works if you send it to a machine on port 2, but not to a machine on port 3. I assume you mean if you change the destination IP address and destination ethernet address AND send it out port 2. I'm not sure what you're trying to accomplish, but one thing to consider might be to actually create a proxy process. Have it listen on some port. When you see a connection you want to proxy, install a flow to rewrite the header and output port so it ends up at the proxy. Then have the proxy connect to the remote host. This is going to be way more efficient than having every packet from the flow go through OpenFlow and NOX. -- Murphy On Aug 23, 2011, at 6:32 PM, Kalapriya Kannan1 wrote: hi Murphy, I take your suggestion that we should install flows to rewrite headers, but the scenario I wanted to handle is somewhat like a proxy scenario that interprets a tcp connection and tries to open a new tcp connection to a new destination. I try to do this .. # Receive the packet from the inport if (inport =1 ) ippacket =packet.find('ipv4') #change the sequence and ack to X and Y, sequence number seems to be correct as i can see the packet in the wireshark. tcppacket.seq =X tcppacket.ack = Y ippacket.set_payload(tcppacket) #change the destination ip ippacket.dstip = convert_to_ipaddr("X.X.X.X") #create a ethernet packet and set this ip as payload replypkt =ethernet() replypkt.set_payload(ippacket) #find the tcp packet in this ethernetpacket and calculate the sum outgoing_tcp = replypkt.find('tcp') outgoing_tcp.csum = outgoing_tcp.checksum() #set the tcp back as payload for ip and then for ethernet ippacket.set_payload(outgoing_tcp) replypkt.set_payload(ippacket) replypkt.type = ethernet.IP_TYPE replypkt.src = octstr_to_array("00:00:00:00:00:0b") replypkt.dst = octstr_to_array("00:00:00:00:00:0d") #Send it to a host on port 3, the orginal packets are actually destined to a machines on port 2, but i am redirecting with header rewritten to port 3 outport=3 inst.send_openflow_packet(dpid,replypkt.tostring(),3) I am again able to see this packet in the wireshark (sequence numbers seems to be correct) and also in the tcp dump of the host machine (on port 3). If i directly send the packets to port 2 (original connection), the connection is established and the application responds with a message that connection is established. But with port 3 it is not happening on the host machine. From:Murphy McCauley To:Kalapriya Kannan1/India/IBM@IBMIN Cc:nox-dev@noxrepo.org Date:08/21/2011 01:04 AM Subject:Re: [nox-dev] IP header rewriting in PySwitch Well for one thing, the checksum in the TCP portion is going to be wrong since you changed the IP address. So you'll need to have something similar to the following in there before you actually send it: tcppkt = replypkt.find('tcp') if tcppkt is not None: tcppkt.csum = tcppkt.checksum() (That's from memory, it might be a bit off.) I'm not sure what other problems you might have with the packet. That one should have actually showed up in Wireshark, though. Please take a close look at the packet that actually gets to the destination and make sure it's all correct. Another problem you may be having is that if you let pyswitch install a flow, you'll stop seeing these packets at the controller and thus stop being able to rewrite them. If all you want to do is rewrite some fields in the IP header, you should consider using OpenFlow to do it (by installing a flow with some rewrite actions) rather than actually doing it within NOX. Hope that helps. -- Murphy On Aug 20, 2011, at 10:51 AM, Kalapriya Kannan1 wrote: hi, I am trying to re-write IP header in pyswitch using the following code below /* obtain ip header and packet for the incoming packet*. if packet.type == ethernet.IP_TYPE: iph = packet.find('ipv4') /* if there is a incoming packet in port 1, rewrite the header to have destination ip address to "X.X.X.X" */ if(inport ==1 ): iph.dstip = convert_to_ipaddr("X.X.X.X") replypkt =ethernet() replypkt.set_payload(iph) replypkt.type = ethernet.IP_TYPE replypkt.src = octstr_to_array("00:00:00:00:00:0b") replypkt.dst = octstr_to_array("0
Re: [nox-dev] IP header rewriting in PySwitch
Remember that you will need to rewrite every packet in the connection in both directions. You will need to install flow rules such that each packet comes to the controller, and you'll need to rewrite addresses in both directions. Remember that the packets from the machine on port 3 will contain that machine's IP address as the source, which isn't the IP address the packets are addressed to as far as the sender is concerned. Is there any reason why you need to rewrite the seq/ack numbers too, as you seem to be doing below? This will make things harder, and you'll need to save some state on the controller and continue rewriting them for every packet in the connection too. This is a difficult approach. Yes, the approach I suggest can be done in mininet. You'll probably have to run the "middlebox" process inside mininet, though. -- Murphy On Aug 24, 2011, at 12:28 AM, Kalapriya Kannan1 wrote: > > hi McCauley, > > By original connection I mean that the connection is to a machine on port 2 > (so no header rewriting to the machine on port 2), but i am trying to > interpret it and send it to a machine on port 3. I am trying to do this in > the mininet, so is it possible to achieve the approach you have mentioned in > mininet? > > regards, > kalapriya. > > > > > From:Murphy McCauley > To:Kalapriya Kannan1/India/IBM@IBMIN > Cc:nox-dev@noxrepo.org > Date:08/24/2011 07:30 AM > Subject:Re: [nox-dev] IP header rewriting in PySwitch > > > > It's difficult to guess from here. > > One thing that strikes me is that you say that it works if you send it to a > machine on port 2, but not to a machine on port 3. I assume you mean if you > change the destination IP address and destination ethernet address AND send > it out port 2. > > I'm not sure what you're trying to accomplish, but one thing to consider > might be to actually create a proxy process. Have it listen on some port. > When you see a connection you want to proxy, install a flow to rewrite the > header and output port so it ends up at the proxy. Then have the proxy > connect to the remote host. This is going to be way more efficient than > having every packet from the flow go through OpenFlow and NOX. > > -- Murphy > > On Aug 23, 2011, at 6:32 PM, Kalapriya Kannan1 wrote: > > > hi Murphy, > > I take your suggestion that we should install flows to rewrite headers, but > the scenario I wanted to handle is somewhat like a proxy scenario that > interprets a tcp connection and tries to open a new tcp connection to a new > destination. I try to do this .. > > # Receive the packet from the inport > if (inport =1 ) > ippacket =packet.find('ipv4') > > #change the sequence and ack to X and Y, sequence number seems to be correct > as i can see the packet in the wireshark. > tcppacket.seq =X > tcppacket.ack = Y > ippacket.set_payload(tcppacket) > > > #change the destination ip > ippacket.dstip = convert_to_ipaddr("X.X.X.X") > > #create a ethernet packet and set this ip as payload > replypkt =ethernet() > replypkt.set_payload(ippacket) > > #find the tcp packet in this ethernetpacket and calculate the sum > outgoing_tcp = replypkt.find('tcp') > outgoing_tcp.csum = outgoing_tcp.checksum() > > #set the tcp back as payload for ip and then for ethernet > ippacket.set_payload(outgoing_tcp) > replypkt.set_payload(ippacket) > > replypkt.type = ethernet.IP_TYPE > replypkt.src = octstr_to_array("00:00:00:00:00:0b") > replypkt.dst = octstr_to_array("00:00:00:00:00:0d") > > #Send it to a host on port 3, the orginal packets are actually destined to a > machines on port 2, but i am redirecting with header rewritten to port 3 > outport=3 > inst.send_openflow_packet(dpid,replypkt.tostring(),3) > > I am again able to see this packet in the wireshark (sequence numbers seems > to be correct) and also in the tcp dump of the host machine (on port 3). If i > directly send the packets to port 2 (original connection), the connection is > established and the application responds with a message that connection is > established. But with port 3 it is not happening on the host machine. > > > > From:Murphy McCauley > To:Kalapriya Kannan1/India/IBM@IBMIN > Cc:nox-dev@noxrepo.org > Date:08/21/2011 01:04 AM > Subject:Re: [nox-dev] IP header rewriting in PySwitch > > > > Well for one thing, the checksum in the TCP portion is going to be wrong > since you changed the IP address. > So you'll need to have something similar to the following in there before you > actually send it: > tcppkt = replypkt.find('tcp') > if tcppkt is not None: tcppkt.csum = tcppkt.checksum() > > (That's from memory, it might be a bit off.) > > I'm not sure what other problems you might have with the packet. That one > should have actually showed up in Wireshark, though. Please take
[nox-dev] FW: Checksum calculation bug?
Hi, I think we have a bug in packet_utils.checksum, please check it: = def checksum(data, start, skip_word = 0): if len(data) % 2 != 0: arr = array.array('H', data[:-1]) else: arr = array.array('H', data) if skip_word: for i in range(0, len(arr)): if i == skip_word: continue start += arr[i] else: for i in range(0,len(arr)): # BUG? start += arr[i]# BUG? # IT should be : # for i in range(0, len(arr)-1,2): # start += arr[i]*0x100 +arr[i+1] if len(data) % 2 != 0: start += struct.unpack('H', data[-1]+'\0')[0] start = (start >> 16) + (start & 0x) start += (start >> 16); return ntohs(~start & 0x) === Thanks, Ibrahim ___ nox-dev mailing list nox-dev@noxrepo.org http://noxrepo.org/mailman/listinfo/nox-dev
Re: [nox-dev] FW: Checksum calculation bug?
Do you have any reason to suspect that it isn't functioning correctly? It seems like you are assuming that arr is an array of bytes. However, if you look at the top of the function, you'll see that it's actually an array.array of "H" values, which are unsigned two-byte values. -- Murphy On Aug 24, 2011, at 4:19 AM, ibrahim mun wrote: > > Hi, > > I think we have a bug in packet_utils.checksum, please check it: > = > def checksum(data, start, skip_word = 0): > > if len(data) % 2 != 0: > arr = array.array('H', data[:-1]) > else: > arr = array.array('H', data) > > if skip_word: > for i in range(0, len(arr)): > if i == skip_word: > continue > start += arr[i] > else: >for i in range(0,len(arr)): # BUG? > start += arr[i]# BUG? ># IT should be : ># for i in range(0, len(arr)-1,2): ># start += arr[i]*0x100 +arr[i+1] > > if len(data) % 2 != 0: > start += struct.unpack('H', data[-1]+'\0')[0] > > start = (start >> 16) + (start & 0x) > start += (start >> 16); > > return ntohs(~start & 0x) > === > > Thanks, > > Ibrahim > > > ___ > nox-dev mailing list > nox-dev@noxrepo.org > http://noxrepo.org/mailman/listinfo/nox-dev ___ nox-dev mailing list nox-dev@noxrepo.org http://noxrepo.org/mailman/listinfo/nox-dev
Re: [nox-dev] Wrong Route update after link down event
In fact, I think the problem is that the routing modules treats the link_down event after the components that depend on it. Karim On 08/20/2011 04:21 AM, Murphy McCauley wrote: Just going to note that I have suspected there was a problem here for several months, but haven't really looked into it. Thanks for the report. Please let us know if you figure anything out! -- Murphy On Aug 15, 2011, at 7:48 AM, karim torkmen wrote: Hi all, I am writing a module for link protection after a link failure. The problem is that when I ask for a new route through the get_route() method, after the link down event occurs, I get the same route, as if the routing module did not detect the link down. Any idea why ? Thanks a lot, Karim ___ nox-dev mailing list nox-dev@noxrepo.org http://noxrepo.org/mailman/listinfo/nox-dev ___ nox-dev mailing list nox-dev@noxrepo.org http://noxrepo.org/mailman/listinfo/nox-dev
Re: [nox-dev] FW: Checksum calculation bug?
The reason is that wireshark shows checksum error in received packets (I've built). in python prompt I tried:data=array.array('B',"example")arr=array.array('H', data)and the result was an array of bytes! modifying the code I don't receive any erroneous packets. Is this my special casa or maybe a python issue?Thanks, Ibrahim Subject: Re: [nox-dev] FW: Checksum calculation bug? From: jam...@nau.edu Date: Wed, 24 Aug 2011 04:35:20 -0700 CC: nox-dev@noxrepo.org To: ibrahim.me...@alumnos.upm.es Do you have any reason to suspect that it isn't functioning correctly? It seems like you are assuming that arr is an array of bytes. However, if you look at the top of the function, you'll see that it's actually an array.array of "H" values, which are unsigned two-byte values. -- Murphy On Aug 24, 2011, at 4:19 AM, ibrahim mun wrote:Hi, I think we have a bug in packet_utils.checksum, please check it: = def checksum(data, start, skip_word = 0): if len(data) % 2 != 0: arr = array.array('H', data[:-1]) else: arr = array.array('H', data) if skip_word: for i in range(0, len(arr)): if i == skip_word: continue start += arr[i] else: for i in range(0,len(arr)): # BUG? start += arr[i]# BUG? # IT should be : # for i in range(0, len(arr)-1,2): # start += arr[i]*0x100 +arr[i+1] if len(data) % 2 != 0: start += struct.unpack('H', data[-1]+'\0')[0] start = (start >> 16) + (start & 0x) start += (start >> 16); return ntohs(~start & 0x) === Thanks, Ibrahim ___ nox-dev mailing list nox-dev@noxrepo.org http://noxrepo.org/mailman/listinfo/nox-dev ___ nox-dev mailing list nox-dev@noxrepo.org http://noxrepo.org/mailman/listinfo/nox-dev
Re: [nox-dev] FW: Checksum calculation bug?
Hi Rob, The code does work as written (maybe is not the optimum code), the only problem is the Byte/word confusion. I did the calculation by hand, adding bytes (not words) and I obtained the same erroneous checksum I had received. However, as you said and in my guess, it's infrequently called so I'm not sure if it's a bug or the modified code only works for my "home made" packets and will result in errors once some other component uses it! Thanks,Ibrahim > Date: Wed, 24 Aug 2011 13:20:17 -0700 > Subject: Re: [nox-dev] FW: Checksum calculation bug? > From: rob.sherw...@bigswitch.com > To: ibrahim.me...@alumnos.upm.es > CC: jam...@nau.edu; nox-dev@noxrepo.org > > Fwiw, just looking (very briefly) at the code, I'm not at all > convinced that it would work as written and my guess is that it's > infrequently called. > > On Wed, Aug 24, 2011 at 10:43 AM, ibrahim mun > wrote: > > The reason is that wireshark shows checksum error in received packets (I've > > built). in python prompt I tried: > > data=array.array('B',"example") > > arr=array.array('H', data) > > and the result was an array of bytes! modifying the code I > > don't receive any erroneous packets. > > Is this my special casa or maybe a python issue? > > Thanks, > > Ibrahim > > > > Subject: Re: [nox-dev] FW: Checksum calculation bug? > > From: jam...@nau.edu > > Date: Wed, 24 Aug 2011 04:35:20 -0700 > > CC: nox-dev@noxrepo.org > > To: ibrahim.me...@alumnos.upm.es > > > > Do you have any reason to suspect that it isn't functioning correctly? > > It seems like you are assuming that arr is an array of bytes. However, if > > you look at the top of the function, you'll see that it's actually an > > array.array of "H" values, which are unsigned two-byte values. > > -- Murphy > > On Aug 24, 2011, at 4:19 AM, ibrahim mun wrote: > > > > Hi, > > > > I think we have a bug in packet_utils.checksum, please check it: > > = > > def checksum(data, start, skip_word = 0): > > > > if len(data) % 2 != 0: > > arr = array.array('H', data[:-1]) > > else: > > arr = array.array('H', data) > > > > if skip_word: > > for i in range(0, len(arr)): > > if i == skip_word: > > continue > > start += arr[i] > > else: > >for i in range(0,len(arr)): # BUG? > > start += arr[i]# BUG? > ># IT should be : > ># for i in range(0, len(arr)-1,2): > ># start += arr[i]*0x100 +arr[i+1] > > > > if len(data) % 2 != 0: > > start += struct.unpack('H', data[-1]+'\0')[0] > > > > start = (start >> 16) + (start & 0x) > > start += (start >> 16); > > > > return ntohs(~start & 0x) > > === > > > > Thanks, > > > > Ibrahim > > > > > > ___ > > nox-dev mailing list > > nox-dev@noxrepo.org > > http://noxrepo.org/mailman/listinfo/nox-dev > > > > > > ___ > > nox-dev mailing list > > nox-dev@noxrepo.org > > http://noxrepo.org/mailman/listinfo/nox-dev > > > > ___ nox-dev mailing list nox-dev@noxrepo.org http://noxrepo.org/mailman/listinfo/nox-dev
Re: [nox-dev] FW: Checksum calculation bug?
checksum() is expecting the payload to be a str, not an array.array('B'). IIRC, the NOX packet library basically always ends up with a str (struct.pack()ing the header fields and concatenating with the payload after possibly calling .tostring() on it). This is the kind of thing that it calls checksum() on, so the assumption that it's passed a str is probably a decent one, so I don't think it's a bug. This raises the question of how you're building the packets and where you are calling checksum() from, but in any event, you can just call .tostring() on your array before passing it to checksum(), or run your own version of checksum(), or modify checksum() to see if it's passed an array.array('B') since apparently creating an array from an array doesn't re-pack the values. -- Murphy On Aug 24, 2011, at 10:43 AM, ibrahim mun wrote: > The reason is that wireshark shows checksum error in received packets (I've > built). in python prompt I tried: > data=array.array('B',"example") > arr=array.array('H', data) > and the result was an array of bytes! modifying the code I don't receive any > erroneous packets. > > Is this my special casa or maybe a python issue? > Thanks, > > Ibrahim > > Subject: Re: [nox-dev] FW: Checksum calculation bug? > From: jam...@nau.edu > Date: Wed, 24 Aug 2011 04:35:20 -0700 > CC: nox-dev@noxrepo.org > To: ibrahim.me...@alumnos.upm.es > > Do you have any reason to suspect that it isn't functioning correctly? > > It seems like you are assuming that arr is an array of bytes. However, if > you look at the top of the function, you'll see that it's actually an > array.array of "H" values, which are unsigned two-byte values. > > -- Murphy > > On Aug 24, 2011, at 4:19 AM, ibrahim mun wrote: > > > Hi, > > I think we have a bug in packet_utils.checksum, please check it: > = > def checksum(data, start, skip_word = 0): > > if len(data) % 2 != 0: > arr = array.array('H', data[:-1]) > else: > arr = array.array('H', data) > > if skip_word: > for i in range(0, len(arr)): > if i == skip_word: > continue > start += arr[i] > else: >for i in range(0,len(arr)): # BUG? > start += arr[i]# BUG? ># IT should be : ># for i in range(0, len(arr)-1,2): ># start += arr[i]*0x100 +arr[i+1] > > if len(data) % 2 != 0: > start += struct.unpack('H', data[-1]+'\0')[0] > > start = (start >> 16) + (start & 0x) > start += (start >> 16); > > return ntohs(~start & 0x) > === > > Thanks, > > Ibrahim > > > ___ > nox-dev mailing list > nox-dev@noxrepo.org > http://noxrepo.org/mailman/listinfo/nox-dev > > ___ nox-dev mailing list nox-dev@noxrepo.org http://noxrepo.org/mailman/listinfo/nox-dev
Re: [nox-dev] [openflow-indigo] I can't make flow-table entry manually
Hi,Can you run "./nox_core -i ptcp:6633 -v pyswitch" ? (in destiny)In destiny,00025|openflow-event|ERR:received Openflow error packet from dpid=002320aa3f26: type=3, code=0, 80 bytes of data00026|openflow-event|ERR:received Openflow error packet from dpid=002320aa3f26: type=3, code=0, 80 bytes of data00027|openflow-event|ERR:received Openflow error packet from dpid=002320aa3f26: type=3, code=0, 80 bytes of data00028|openflow-event|ERR:received Openflow error packet from dpid=002320aa3f26: type=3, code=0, 80 bytes of data00029|openflow-event|ERR:received Openflow error packet from dpid=002320aa3f26: type=3, code=0, 80 bytes of data00030|openflow-event|ERR:received Openflow error packet from dpid=002320aa3f26: type=3, code=0, 80 bytes of data- 원본 메일 -보낸사람: Aaron Rosen 받는사람 : Min-Hyup KANG 참조 : openflow-indigo 날짜: 2011년 8월 25일 목요일, 10시 13분 57초 +0900제목: Re: [openflow-indigo] I can't make flow-table entry manually Are your switches connected to a nonOF control plane to get to the controller? I would just try nox's pyswitch right now. I'm not sure what module you are running. ./nox_core -v -i ptcp:6633 pyswitch Also make sure that both switches are connecting to the controller. 2011/8/24 Min-Hyup KANGHi, Anyway, I am currently conducting an experiment on Pronto 3290 having below test-bed. NOX(destiny)|HOST1(192.168.10.10)(port3)OFSW1(port5)--(port5)OFSW2(port3)-HOST2(192.168.10.11) I run command line "ping" from HOST1 to HOST2 after our test-bed are compeleted.But, as you can see the below message, datapath seems not to be made. so, I believe that I can't ping from HOST1 to HOST2.I don't know exactly why we can't ping from source to destination.I am wondering that there are problem from controller or Switch. 1. It seems like that switch don't have flowtable. can you give some tips about this situation ?2. Have you ever been seen this message ? Message from NOX===00060|spanning_tree|WARN:150867683352 : [84:2b:2b:60:38:03>84:2b:2b:60:26:6e:IP]([v:4hl:5l:84t:64]ICMP cs:a543[192.168.10.10>192.168.10.11]){t:8 c:0 csum: 0xa007}{id:1659seq:15} 00061|openflow-event|ERR:received Openflow error packet from dpid=0023206a2818: type=3, code=0, 80 bytes of data00062|spanning_tree|WARN:150867683352 : [84:2b:2b:60:38:03>84:2b:2b:60:26:6e:IP]([v:4hl:5l:84t:64]ICMP cs:a543[192.168.10.10>192.168.10.11]){t:8 c:0 csum: 0x9f06}{id:1659seq:16} 00063|openflow-event|ERR:received Openflow error packet from dpid=0023206a2818: type=3, code=0, 80 bytes of data=I think type=3 mean OFPST_TABLE and code=0 mean OFPFMFC_ALL_TABLEFULL- 원본 메일 - 보낸사람: Aaron Rosen 받는사람 : Min-Hyup KANG 참조 : openflow-indigo 날짜: 2011년 8월 25일 목요일, 09시 16분 06초 +0900 제목: Re: [openflow-indigo] I can't make flow-table entry manually I'm not sure if you can do it via the web interface but if you install dpctl you can do it from your desktop. That is what I use. I just use whatever the latest version is from noxrepo.org. Aaron2011/8/24 Min-Hyup KANG Thank you for your rely.1.Are you using pronto 3290 switch ?and Can you install the flow entries via web interface ? if so, How can I install flow entries via web interface ? I connect through the "Telnet". 2. Which do you use NOX controller version ? I can't check connectivity between HOST1 and HOST2 using pronto 3290(new release firmware 2011-08-06 ) Also it looks like you are running dpctl against the controller? This should be run against the switch's ip address. -> Thank you for your tips - 원본 메일 - 보낸사람: Aaron Rosen 받는사람 : Min-Hyup KANG 참조 : openflow-indigo 날짜: 2011년 8월 25일 목요일, 00시 24분 37초 +0900제목: Re: [openflow-indigo] I can't make flow-table entry manually Hi Min-Hyup, I usually never login to the 3290 I just configure it via it's web interface to point to my controller. Once you do that the controller can install the flow entries for you. Also it looks like you are running dpctl against the controller? This should be run against the switch's ip address. Aaron2011/8/24 Min-Hyup KANG HI,When I am doing "ping test", among NOX, Pronto 3290, HOST,Should I set "ofdatapath", "ofprotocol" ? Since I can't make flow-table entry manually, so I can't ping HOST to HOST.Any suggestions ?==TEST1===NIMS-Pronto5-CLI# shell /sbin/dpctl add-flow tcp::6633 in_port=1,actions=output:2 Running shell command: /sbin/dpctl add-flow tcp::6633 in_port=1,actions=output:2NIMS-Pronto5-CLI# flowtable brief Flow table showERROR: Status nil, operation did not complete. Error handing command flowtable. No flow table entries returned NIMS-Pronto5-CLI# ==TEST2===NIMS-Pronto2-CLI# shell /sbin