nicmx / jool

SIIT and NAT64 for Linux

Update

jool.mx is no longer maintained. Please use https://nicmx.github.io/Jool instead.

I REPEAT: jool.mx IS (AND WILL PROBABLY FOREVER BE) OUTDATED. DO NOT QUERY IT ANYMORE. PLEASE UPDATE YOUR BOOKMARKS.

Jool

An SIIT and a NAT64 for Linux.

Documentation

See here. You can also generate the docs yourself.

You might also want to see contact info.

Credits

NIC-Mx

• Ing. Jorge Cano Puente
• Ing. Sergio Adrián Casas Fernández - [email protected]
• Ing. Julio Cesar Cossio de Robles
• Ing. Daniel Hernández Félix - [email protected]
• Ing. Alberto Leiva Popper
• Ing. Cristóbal Alfonso de León Benítez - [email protected]
• Ing. Roberto Olivas Alarcón - [email protected]
• Edgar Martín Rodríguez Bernal - [email protected]

ITESM representatives

• Dr. Juan Arturo Nolazco - [email protected]
• Ing. Martha Sordia - [email protected]

ITESM students

• Abraham Baez - [email protected]
• Adrian González - [email protected]
• Alan Villela López - [email protected]
• Angel Cazares - [email protected]
• Armando Cifuentes González - [email protected]
• David Valenzuela - [email protected]
• Ing. Elvia Patricia Barrón Cano - [email protected]
• Gabriel Chavez - [email protected]
• Jose Vicente Ramirez - [email protected]
• Juan Antonio Osorio - [email protected]
• Juan Francisco Barragán Cantú - [email protected]
• Luis Fernando Hinojosa - [email protected]
• Manuel Aude - [email protected]
• Mario Gerardo Trevinho - [email protected]
• Miguel Alejandro González - [email protected]
• Nixa Jayu Gpe Rodríguez Dagnino
• Ramiro Nava - [email protected]
• Roberto Aceves - [email protected]
• Roberto Martínez Beltrán - [email protected]

Special Thanks (contributing users)

• airsnail
• Andreas Urke
• Andreas Rammhold
• Dan Lüdtke
• Eric Gamess
• Hidekazu Tadokoro
• ipclouds
• Jan Pokorny - FIT VUTBR
• Masaya YAMAMOTO
• Michael Richardson
• Molly Miller
• paradon
• Philar Law
• Pier Carlo Chiodi
• Ricardo Salveti - [email protected]
• Sander Steffann - [email protected]
• Stanislav Bogatyrev
• tbe
• techmotive
• Terry Froy
• Tore Anderson
• Washam Fan

License Disclaimer

Jool - SIIT and NAT64 for Linux
Copyright (C) 2024  NIC Mexico <[email protected]>

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
version 2, as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

jool's Issues

The hairpinning test failed.

Test case ID: N/A
Date: 2013/05/17
OS: N/A
Tester: AL, RA
Error module: handling_hairpinning.
Description: Hairpinning doesn't work.
Observations: From the output of the NAT64, one can tell it's failing to identify the packets as hairpin.

Error in TCP communication, wrong TCP state

When trying to talk from IPv4 to IPv6 using static sessions, the following output is observed in dmesg:

[10164.728733] NAT64: ERR4104 (tcp): Invalid state found: 0.

The setup is the next:
*** add static session:
../usr/nat64 --tcp --add --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#6000 --local6=64:ff9b::10.17.112.254#6000 --local4=10.17.113.225#6000 --remote4=10.17.112.254#6000
*** show static session and bib:
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 -b
TCP:
10.17.113.225#6000 - c0ca:db8:2001:1:9474:7b8:5450:60f9#6000
...
(Fetched 9 entries.)
UDP:
10.17.113.225#6000 - c0ca:db8:2001:1:9474:7b8:5450:60f9#6000
(Fetched 1 entries.)
ICMP:
(empty)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 -s

TCP:

STATIC
Remote: 10.17.112.254#6000 c0ca:db8:2001:1:9474:7b8:5450:60f9#6000

Local: 10.17.113.225#6000 64:ff9b::a11:70fe#6000

...
(Fetched 9 entries.)

UDP:

STATIC
Remote: 10.17.112.254#6000 c0ca:db8:2001:1:9474:7b8:5450:60f9#6000

Local: 10.17.113.225#6000 64:ff9b::a11:70fe#6000

(Fetched 1 entries.)

ICMP:

(empty)

*** Client side app (IPv4):
nc -p 6000 10.17.113.225 6000

*** Server side app (IPv6):
nc -l 6000

poolnum is using kmalloc to allocate some large arrays.

Test case ID: N/A
Date: 2013/05/09
OS: N/A
Tester: AL
Error module: poolnum
Description: "If you need more than a few kilobytes (...) there are better ways than kmalloc to obtain memory" (http://lwn.net/images/pdf/LDD3/ch08.pdf).
We're allocating arrays of up to 128kb each.
Observations: -

C. CLASIFICACIÓN DE ERRORES

El nivel de severidad de un error se clasifica en:

• Alto: Es un problema que causa una situación en donde no es posible seguir trabajando, es un error crítico que necesita ser resuelto inmediatamente.
• Medio: Es un problema que restringe la operación de una función importante impactando la lógica del negocio pero es posible seguir probando.
• Bajo: Estos representan problemas menores o errores de imagen y no afectan la operación de la aplicación. El cliente decidirá cuál o cuáles deberán ser atendidos.

B. FORMATO PARA REGISTRO DE BUGS

ID Caso Prueba:

Fecha:

Sistema operativo:

Tester:

Módulo del error:

Descripción:

Observaciones:

The dropTCP parameter is not configurable.

Test case ID: N/A
Date: 2013/05/21
OS: N/A
Tester: AL
Error module: Userspace application
Description: As stated in the milestone description, we don't yet support "simultaneous open of TCP connections" (RFC 6146, p. 28). We used to think this rendered the "--dropTCP" configuration parameter useless, so we disabled it.
Truth is, static BIB entries allow TCP connections to start from outside just fine, so --dropTCP is relevant for this milestone.
Observations: -

Kernel refuses to send some packets.

Test case ID: N/A
Date: 2013/03/14
OS: N/A
Tester: RA, AL
Error module: send packet.
Description: The function from the kernel meant to send IPv4 packets seldom returns error code -90.
Observations: Error code -90 probably stands for "Message too long", as defined in asm-generic/errno.h. Because of the depth of ip_local_out, the several function pointers it handles, and the potential noise generated by dynamically attached netfilter modules, I'm having trouble detecting the offending return statement so I can't tell for sure.

Error compiling in Ubuntu 12 - kernel 3.8.0-19

$ make
make -C /lib/modules/3.8.0-19-generic/build M=$PWD;
make[1]: Entering directory /usr/src/linux-headers-3.8.0-19-generic' LD /home/nat64/nat64/NAT64/mod/built-in.o CC [M] /home/nat64/nat64/NAT64/mod/types.o CC [M] /home/nat64/nat64/NAT64/mod/str_utils.o CC [M] /home/nat64/nat64/NAT64/mod/packet.o CC [M] /home/nat64/nat64/NAT64/mod/ipv6_hdr_iterator.o CC [M] /home/nat64/nat64/NAT64/mod/rfc6052.o CC [M] /home/nat64/nat64/NAT64/mod/out_stream.o CC [M] /home/nat64/nat64/NAT64/mod/random.o CC [M] /home/nat64/nat64/NAT64/mod/poolnum.o CC [M] /home/nat64/nat64/NAT64/mod/pool6.o CC [M] /home/nat64/nat64/NAT64/mod/pool4.o CC [M] /home/nat64/nat64/NAT64/mod/bib.o CC [M] /home/nat64/nat64/NAT64/mod/session.o CC [M] /home/nat64/nat64/NAT64/mod/static_routes.o CC [M] /home/nat64/nat64/NAT64/mod/config.o /home/nat64/nat64/NAT64/mod/config.c: In function ‘config_init’: /home/nat64/nat64/NAT64/mod/config.c:401:4: error: too many arguments to function ‘netlink_kernel_create’ include/linux/netlink.h:48:1: note: declared here make[2]: *** [/home/nat64/nat64/NAT64/mod/config.o] Error 1 make[1]: *** [_module_/home/nat64/nat64/NAT64/mod] Error 2 make[1]: Leaving directory/usr/src/linux-headers-3.8.0-19-generic'
make: *** [all] Error 2

Error en la aceptación de paquete regresado por NAT64 (UDP) por el programa de un cliente

Error de paquetes grandes en ICMP y UDP

Este error es similar al detect ado en TCP issue #6

Error de checksum en TCP

Eliminar uso de alias

Se ocupaba usar alias para enviar paquetes en la red.

Error en las tablas de BIB al retirar NAT64

Bug, Can not create an static session

These are the session & bib tables, and the output of user-space app:

nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --udp --add --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#6000
UDP:
The session entry was added successfully.
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --udp --add --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50364
UDP:
ERR1000: Object exists (System error -6)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --add --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50364
TCP:
The session entry was added successfully.
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --add --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50365
TCP:
ERR1000: Object exists (System error -6)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --remove --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50364
TCP:
The session entry was removed successfully.
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --remove --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50366
TCP:
ERR1000: Object not found (System error -12)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --add --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50367
TCP:
ERR1000: Object exists (System error -6)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --remove --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50364
TCP:
ERR1000: Object not found (System error -12)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --remove --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50365
TCP:
ERR1000: Object not found (System error -12)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --remove --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50366
TCP:
ERR1000: Object not found (System error -12)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --remove --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50367
TCP:
ERR1000: Object not found (System error -12)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --add --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50368
TCP:
ERR1000: Object exists (System error -6)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --remove --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50368
TCP:
ERR1000: Object not found (System error -12)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --add --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50368
TCP:
ERR1000: Object exists (System error -6)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp --add --session --remote6=c0ca:db8:2001:1:9474:7b8:5450:60f9#21 --local6=64:ff9b::10.17.112.254#21 --local4=10.17.113.225#21 --remote4=10.17.112.254#50367
TCP:
ERR1000: Object exists (System error -6)
nat64@nat64:/nat64/NAT64/mod$ ../usr/nat64 --tcp -s

TCP:

DYNAMIC (expires in 699592 milliseconds).
Remote: 168.61.37.189#80 c0ca:db8:2001:1:9474:7b8:5450:60f9#40955

Local: 10.17.113.225#9326 64:ff9b::a83d:25bd#80

DYNAMIC (expires in 699088 milliseconds).
Remote: 168.61.37.189#1935 c0ca:db8:2001:1:9474:7b8:5450:60f9#50890

Local: 10.17.113.225#37101 64:ff9b::a83d:25bd#1935

DYNAMIC (expires in 699612 milliseconds).
Remote: 168.61.37.189#1935 c0ca:db8:2001:1:9474:7b8:5450:60f9#50876

Local: 10.17.113.225#34319 64:ff9b::a83d:25bd#1935

DYNAMIC (expires in 2770316 milliseconds).
Remote: 91.189.89.144#80 c0ca:db8:2001:1:9474:7b8:5450:60f9#34412

Local: 10.17.113.225#23268 64:ff9b::5bbd:5990#80

DYNAMIC (expires in 734264 milliseconds).
Remote: 77.92.89.1#80 c0ca:db8:2001:1:9474:7b8:5450:60f9#58852

Local: 10.17.113.225#4675 64:ff9b::4d5c:5901#80

DYNAMIC (expires in 4610500 milliseconds).
Remote: 65.55.17.76#80 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#58063

Local: 10.17.113.225#12152 64:ff9b::4137:114c#80

DYNAMIC (expires in 2532444 milliseconds).
Remote: 65.55.17.76#80 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#1984

Local: 10.17.113.225#23446 64:ff9b::4137:114c#80

DYNAMIC (expires in 6443620 milliseconds).
Remote: 65.55.87.62#80 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#58152

Local: 10.17.113.225#33032 64:ff9b::4137:573e#80

DYNAMIC (expires in 1077408 milliseconds).
Remote: 148.244.43.5#443 c0ca:db8:2001:1:9474:7b8:5450:60f9#49193

Local: 10.17.113.225#30227 64:ff9b::94f4:2b05#443

DYNAMIC (expires in 1057500 milliseconds).
Remote: 148.244.43.5#80 c0ca:db8:2001:1:9474:7b8:5450:60f9#44117

Local: 10.17.113.225#44135 64:ff9b::94f4:2b05#80

DYNAMIC (expires in 711192 milliseconds).
Remote: 205.210.186.236#80 c0ca:db8:2001:1:9474:7b8:5450:60f9#53265

Local: 10.17.113.225#16362 64:ff9b::cdd2:baec#80

DYNAMIC (expires in 7180208 milliseconds).
Remote: 69.171.248.16#80 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#58106

Local: 10.17.113.225#32552 64:ff9b::45ab:f810#80

DYNAMIC (expires in 1955868 milliseconds).
Remote: 173.194.64.120#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#2999

Local: 10.17.113.225#45187 64:ff9b::adc2:4078#443

DYNAMIC (expires in 1955868 milliseconds).
Remote: 173.194.64.120#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#2998

Local: 10.17.113.225#62876 64:ff9b::adc2:4078#443

DYNAMIC (expires in 7178860 milliseconds).
Remote: 173.252.112.23#80 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#38333

Local: 10.17.113.225#17760 64:ff9b::adfc:7017#80

DYNAMIC (expires in 1882720 milliseconds).
Remote: 157.56.96.208#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#2986

Local: 10.17.113.225#57217 64:ff9b::9d38:60d0#443

DYNAMIC (expires in 2711872 milliseconds).
Remote: 173.194.77.19#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#46305

Local: 10.17.113.225#59264 64:ff9b::adc2:4d13#443

DYNAMIC (expires in 4140780 milliseconds).
Remote: 173.194.77.19#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#46304

Local: 10.17.113.225#43601 64:ff9b::adc2:4d13#443

DYNAMIC (expires in 2535280 milliseconds).
Remote: 173.194.77.19#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#1988

Local: 10.17.113.225#45495 64:ff9b::adc2:4d13#443

DYNAMIC (expires in 4115620 milliseconds).
Remote: 173.194.77.83#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#57980

Local: 10.17.113.225#45425 64:ff9b::adc2:4d53#443

DYNAMIC (expires in 7174880 milliseconds).
Remote: 173.194.77.83#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#57979

Local: 10.17.113.225#48153 64:ff9b::adc2:4d53#443

DYNAMIC (expires in 2119820 milliseconds).
Remote: 173.194.77.132#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#21908

Local: 10.17.113.225#4820 64:ff9b::adc2:4d84#443

DYNAMIC (expires in 77032 milliseconds).
Remote: 173.194.77.189#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#38329

Local: 10.17.113.225#6441 64:ff9b::adc2:4dbd#443

DYNAMIC (expires in 7197288 milliseconds).
Remote: 157.56.100.90#443 c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#2987

Local: 10.17.113.225#64070 64:ff9b::9d38:645a#443

(Fetched 24 entries.)

nat64@nat64:~/nat64/NAT64/mod$ ../usr/nat64 --tcp -b
TCP:
10.17.113.225#4675 - c0ca:db8:2001:1:9474:7b8:5450:60f9#58852
10.17.113.225#4820 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#21908
10.17.113.225#6441 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#38329
10.17.113.225#9326 - c0ca:db8:2001:1:9474:7b8:5450:60f9#40955
10.17.113.225#12152 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#58063
10.17.113.225#16362 - c0ca:db8:2001:1:9474:7b8:5450:60f9#53265
10.17.113.225#17760 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#38333
10.17.113.225#23268 - c0ca:db8:2001:1:9474:7b8:5450:60f9#34412
10.17.113.225#23446 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#1984
10.17.113.225#30227 - c0ca:db8:2001:1:9474:7b8:5450:60f9#49193
10.17.113.225#32552 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#58106
10.17.113.225#33032 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#58152
10.17.113.225#34319 - c0ca:db8:2001:1:9474:7b8:5450:60f9#50876
10.17.113.225#37101 - c0ca:db8:2001:1:9474:7b8:5450:60f9#50890
10.17.113.225#43601 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#46304
10.17.113.225#44135 - c0ca:db8:2001:1:9474:7b8:5450:60f9#44117
10.17.113.225#45187 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#2999
10.17.113.225#45425 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#57980
10.17.113.225#45495 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#1988
10.17.113.225#48153 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#57979
10.17.113.225#57217 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#2986
10.17.113.225#59264 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#46305
10.17.113.225#62876 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#2998
10.17.113.225#64070 - c0ca:db8:2001:1:94c8:20e8:2a8e:4eaf#2987
(Fetched 24 entries.)

Error in UDP communication, wrong port in last mile.

When you add a new UDP static session and try to communicate from IPv4 to IPv6, the NAT64 translates wrong the responses in direction IPv6 -> IPv4, changing the source port instead of use the one defined in the session.

*** Bib entries:
nat64@nat64:~/nat64/NAT64/mod$ ../usr/nat64 -b
TCP:
10.17.113.225#65000 - c0ca:db8:2001:1:21d:9ff:fe08:90a3#65000
...
(Fetched 7 entries.)
UDP:
10.17.113.225#65000 - c0ca:db8:2001:1:21d:9ff:fe08:90a3#65000
(Fetched 1 entries.)
ICMP:
10.17.113.225#65000 - c0ca:db8:2001:1:21d:9ff:fe08:90a3#65000
(Fetched 1 entries.)

*** Session entries:

UDP:

DYNAMIC (expires in 95912 milliseconds).
Remote: 10.17.112.254#65000 c0ca:db8:2001:1:9474:7b8:5450:60f9#65000

Local: 10.17.113.225#11004 64:ff9b::a11:70fe#65000

STATIC
Remote: 10.17.112.254#65000 c0ca:db8:2001:1:21d:9ff:fe08:90a3#65000

Local: 10.17.113.225#65000 64:ff9b::a11:70fe#65000

(Fetched 2 entries.)

*** Setup:

• IPv4 client:
  nc -4 -p 65000 10.17.113.225 65000
• IPv6 server:
  nc -6l 65000

Kernel panic al regresar paquete de vuelta a IPv6

Sucede en ICMP y probablemente en los demas procotolos

Error compiling in OpenSUSE 12.3 - kernel 3.7.10.-1

$ make
make -C /lib/modules/3.7.10-1.1-desktop/build M=$PWD;
make[1]: Entering directory /usr/src/linux-3.7.10-1.1-obj/x86_64/desktop' LD /home/nat64/nat64/NAT64/mod/built-in.o CC [M] /home/nat64/nat64/NAT64/mod/types.o CC [M] /home/nat64/nat64/NAT64/mod/str_utils.o CC [M] /home/nat64/nat64/NAT64/mod/packet.o CC [M] /home/nat64/nat64/NAT64/mod/ipv6_hdr_iterator.o CC [M] /home/nat64/nat64/NAT64/mod/rfc6052.o CC [M] /home/nat64/nat64/NAT64/mod/out_stream.o CC [M] /home/nat64/nat64/NAT64/mod/random.o CC [M] /home/nat64/nat64/NAT64/mod/poolnum.o CC [M] /home/nat64/nat64/NAT64/mod/pool6.o CC [M] /home/nat64/nat64/NAT64/mod/pool4.o CC [M] /home/nat64/nat64/NAT64/mod/bib.o CC [M] /home/nat64/nat64/NAT64/mod/session.o CC [M] /home/nat64/nat64/NAT64/mod/static_routes.o CC [M] /home/nat64/nat64/NAT64/mod/config.o /home/nat64/nat64/NAT64/mod/config.c: In function ‘config_init’: /home/nat64/nat64/NAT64/mod/config.c:401:4: error: too many arguments to function ‘netlink_kernel_create’ In file included from /home/nat64/nat64/NAT64/mod/../include/nat64/mod/out_stream.h:4:0, from /home/nat64/nat64/NAT64/mod/config.c:5: /usr/src/linux-3.7.10-1.1/include/linux/netlink.h:48:1: note: declared here make[4]: *** [/home/nat64/nat64/NAT64/mod/config.o] Error 1 make[3]: *** [_module_/home/nat64/nat64/NAT64/mod] Error 2 make[2]: *** [sub-make] Error 2 make[1]: *** [all] Error 2 make[1]: Leaving directory/usr/src/linux-3.7.10-1.1-obj/x86_64/desktop'
make: *** [all] Error 2

Captura de todas las direcciones IPv4

Alta prioridad:
NAT64 está capturando todas las direcciones de IPv4 en lugar de filtrar apropiadamente.
Es posible que esté fallando o el sistema de userspace que indica en las reglas que direcciones IPv4 capturar o la parte de filtrado en el target de IPv4.
Mascara 0.

Inner ICMP headers are not being translated.

Test case ID: N/A
Date: 2013/05/09
OS: N/A
Tester: AL, RA
Error module: translate_packet

Description:
The incoming packet looks like this (a -> b = a contains b):
IPv4 header -> ICMPv4 error header -> IPv4 header -> ICMPv4 info header.
The outgoing packet should look like this:
IPv6 header -> ICMPv6 error header -> IPv6 header -> ICMPv6 info header.
The outgoing packet actually looks like this:
IPv6 header -> ICMPv6 error header -> IPv6 header -> ICMPv4 info header.
The problem also happens in the IPv6 -> IPv4 direction.

Observations: -

Packets are being linearized on arrival.

Test case ID: N/A
Date: 2013/05/09
OS: N/A
Tester: AL
Error module: core.

Description: Packet linearization: http://vger.kernel.org/~davem/skb_data.html.
This doesn't affect functionality at all; it will simply introduce some performance penalty if people gets paged packets.

Observations: It hasn't been addressed because it appears to me the "two helper routines available which make this pretty easy" don't really buy me anything when packets contain IPv4 options or IPv6 extension headers (Eg. how do I know how many bytes do I need to ask to get the layer 4 header's protocol of a IPv6 packet?).
Am I missing something?

Paginas WEB .org no cargan

ID Caso Prueba:

Fecha: 04/04/2013

Sistema operativo: Ubuntu 12.04, kernel 3.2.0

Tester: AC

Módulo del error: app

Descripción:
Cuando se accede a páginas WEB con terminación .org no carga la página.

Observaciones:
Al parecer es de configuración en el servidor

The module is dropping ICMP infos inside ICMP errors.

Test case ID: N/A
Date: 2013/05/09
OS: N/A
Tester: AL, RA
Error module: determine incoming tuple
Description: The RFC says "If the incoming IP packet contains a complete (un-fragmented) ICMP error message containing an ICMP error message, then the packet is silently discarded". For some reason we thought ICMP infos inside ICMP errors should also be dropped.
Observations: -

Error: L4 offset antes de salir de traducir la tupla y donde se llama a gettuple

Se debe de borrar la línea que manda llamar a GetTuple.

Error al quitar el módulo de NAT64

Cuando se remueve el módulo aparece un error, tal parece que se debe a que las entradas en las tabla de Bib y de sesión no son eliminadas antes de remover el módulo.

Error en el cargado de módulos

Al levantar NAT64 se requiere hacerlo más de una vez para que se cargue el módulo correctamente.
No siempre pasa.

Ports are not returning to the IPv4 pool.

Test case ID: N/A
Date: 2013/05/15
OS: N/A
Tester: AL
Error module: Users of pool4
Description: Whenever BIB entries die, they're supposed to return their IPv4 port to the IPv4 pool so it can be eventually reused. The code used to return them incorrectly, which would lead to unexpected behaviour. I just deleted this, and the code currently simply never returns the ports, which is also wrong, but at least it will simply lead to an empty pool.
Observations: -

Static sessions do not interact with the pools.

Test case ID: N/A
Date: 2013/05/09
OS: N/A
Tester: AL
Error module: static_routes.
Description: The local transport addresses of static sessions need to belong to the pool, just like the ones from dynamic sessions. Also, when static sessions are being created, the local ports are not being actually borrowed from the pools. This means that at some point the NAT64 might override sessions, which would lead to erratic behaviour and memory leaks.
Observations: This was solved in commit a7ce42c. I'm uploading this for tracking purposes.

Naming the NAT64

Test case ID: N/A
Date: 2013/05/10
OS: N/A
Tester: -
Error module: -
Description: There are other NAT64 implementations out there, so it would be arrogant if ours was called "[The] NAT64". Any suggestions?
Observations: -

Add support for static BIB entries, remove support for static session entries.

Test case ID: N/A
Date: 2013/05/17
OS: N/A
Tester: AL
Error module: BIB, session
Description: Users would probably never want to configure static sessions. They're cluttered and require information one would normally not know before the connection is started. What the RFC means by "static bindings" is static BIB entries, which grant a service from the IPv6 network a permanent address from the IPv4 side.
Due to a silly misunderstanding, we coded static sessions instead of static BIB entries. We need to swap that.
Observations: -

The pools lend fairly predictable ports for translation.

Test case ID: N/A
Date: 2013/05/09
OS: N/A
Tester: AL
Error module: pool4

Description:
I suppose you would normally expect source ports >= 1024 to be random.
The algorithm we use is designed to allow constant-time retrieval and return, and memory-wise allows you to pay only for what you've used, but it also means ports are reused as much as possible. This makes them far from random.
It hasn't been fixed because we can't, for the life of us, think of a reason why this would be harmful (it simply looks somewhat/maybe unnatural from outside).

Observations: This was solved in commit a7ce42c. I'm uploading this for tracking purposes.

Need to enable firewall-like features on the NAT64

Test case ID: N/A
Date: 2013/05/13
OS: N/A
Tester: -
Error module: filtering
Description: The user needs a way to define policies to control whether BIB and session entries are created or not. At this point, the module calls an empty function.
Observations: The RFC does not define the policies; they are expected to be user-defined. I imagine the NAT64 is supposed to work like iptables, in the sense that other kernel modules can be attached to it and apply logic.

Jool intercepts and steals packets before iptables filters, so there's no way to firewall translating traffic unless it is done by a separate, adjacent machine.

Error while removing module

ID Caso Prueba:

Fecha: May 22, 2013

Sistema operativo: Ubuntu 12.04 (kernel 2.6.38-16)

Tester: RA, AC

Módulo del error: nat64

Descripción: Can not remove module after some tests on kernel 2.6.38-16. TCP, UDP & ICMP where tested satisfactorily.

Observaciones:

$ make remove
sudo rmmod nat64
ERROR: Removing 'nat64': Device or resource busy
make: *** [remove] Error 1

$ dmesg | tail
[ 23.564660] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 23.630314] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[ 24.216008] init: plymouth-stop pre-start process (2168) terminated with status 1
[ 24.435678] Ebtables v2.0 registered
[ 24.518158] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 24.670015] eth0: no IPv6 routers present
[ 25.835090] type=1400 audit(1369243743.821:39): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/telepathy/mission-control-5" name="/usr/share/gvfs/remote-volume-monitors/" pid=2539 comm="mission-control" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 28.780027] eth2: no IPv6 routers present
[ 29.030044] eth3: no IPv6 routers present
[ 119.378867] NAT64 module inserted.

Kernel Panic TCP fork "magg"

Existe un kernel panic al ejecutar el código de TCP. Esto se relaciona con las estrucutras usadas durante Updating and Filtering más no se tiene más detalles de error.

Se investigará con Gabriel la manera de hacer que el dump del kernel panic sea persistente para poder analizarlo.

Send packet is not deallocating the packets on failure.

Test case ID: N/A
Date: 2013/05/09
OS: N/A
Tester: AL
Error module: send_packet
Description: Because of the way ip_local_out() and friends work, send_packet's functions need to always free the outgoing packets, regardless of success status. I just realized by reading the code that this is not the case.
Observations: -

Error de paquetes grandes en TCP (MTU)

Por ejemplo, se envía paquete de 200 bytes y llegan solo 90.

Error de no envío de paquete al crear la tabla de BIB o Sesión UDP

Chopped off data error

Dicho error sucede al mandar y recibir paquetes con datos de tamaño relativamente grande pero menor a 1500 bytes que es el tamaño maximo del MTU y se puede recrear usando ICMP o UDP facilmente... en TCP se puede apreciar al usar aplicaciones como ssh o apache

Error de no envío de paquete al crear la entrada en la tabla de BIB o de Sesión

Para reproducir este error es necesario realizar estos pasos:

• insertar el módulo de NAT64,
• ejecutar el programa servidor,
• ejecutar el programa cliente,
  ES EN ESTE PUNTO DONDE APARECE EL ERROR, YA QUE LA RESPUESTA DEL SERVIDOR AL CLIENTE NO LLEGA, es decir, el NAT64 no reenvía el paquete con la respuesta del servidor hacia el cliente.
• ejecutar de nuevo el cliente, en esta ocasión si será reenviado hacia el cliente el paquete que lleva la respuesta del servidor.

Se sospecha que el problema radica al rededor de la parte donde ser crean las entradas de BIB o de sesión, tomando en cuenta que estas entradas ya han sido creadas al momento en que se realiza la segunda ejecución del cliente.

Esta condición se ha observado tanto con TCP como con UDP.

User space app shows an error while reporting session or BIB tables.

ID Caso Prueba:

Fecha: 14/03/2013

Sistema operativo: Ubuntu 12.04, kernel 3.2.0

Tester: RA

Módulo del error: User space app

Descripción:
Al consultar la tabla de sesión o de BIB, la aplicación de user space regresa el siguiente error: ERR88: Unknown result code.

Observaciones:
Tal parece que ocurre cuando el número de entradas en la tabla de sesión (o de BIB) supera la cantidad de 140,

Ejemplo de ejecución:
$ ../usr/nat64 -s
TCP:
ERR88: Unknown result code.
UDP:
(empty)

ICMP:
(empty)

$ ../usr/nat64 -b
TCP:
ERR32: Unknown result code.
UDP:
(empty)

ICMP:
(empty)

Need to shield the module from malformed packets further.

Test case ID: N/A
Date: 2013/05/14
OS: N/A
Tester: AL
Error module: core, translate_packet
Description: Considering we'll eventually have to skip the kernel's packet defragmentation module, our validation routines are too weak. In order to avoid wild pointers, we'll have to ensure the next and length fields are consistent both in network and transport headers.
Observations: These validations need to be applied to ICMP inner packets too.

Error de ping

Checado de la red en IPv6

Paquetes son traducidos por NAT64 pero en ocasiones no son transmitidos por la interfaz de IPv6.
Motivo se desconoce.

ICMPv6 - wrong reply packet translation

ID Caso Prueba: Pruebas internas

Fecha: 4-mar-2013

Sistema operativo: Ubuntu 12.04 , kernel 3.2

Tester: RA

Módulo del error: translate_packet_4to6.c

Descripción: En la comunicación ICMP los paquetes fluyen correctamente, pero parece que el paquete ECHO_REPLAY, de NAT64 a la máquina IPv6, está mal formado.

El paquete ECHO_REPLAY llega a la máquina IPv6 pero la aplicación ping6 no toma la respuesta.

Tal parece que hay un problema en el header del paquete.

Observaciones: Captura de paquetes con TCPDUMP:
18:46:38.454459 IP6 (hlim 64, next-header ICMPv6 (58) payload length: 64) c0ca:db8:2001:1:e0d2:82f7:9f7c:1fa0 > 64:ff9b::a11:2e16: [icmp6 sum ok] ICMP6, echo request, seq 225
0x0000: 6000 0000 0040 3a40 c0ca 0db8 2001 0001 ....@:@........ 0x0010: e0d2 82f7 9f7c 1fa0 0064 ff9b 0000 0000 .....|...d...... 0x0020: 0000 0000 0a11 2e16 8000 8fdb 19e2 00e1 ................ 0x0030: 6e40 3551 0000 0000 22ef 0600 0000 0000 n@5Q...."....... 0x0040: 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................ 0x0050: 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./ 0x0060: 3031 3233 3435 3637 01234567 18:46:38.455976 IP6 (hlim 62, next-header Fragment (44) payload length: 72) 64:ff9b::a11:2e16 > c0ca:db8:2001:1:e0d2:82f7:9f7c:1fa0: frag (0x00003316:0|64) ICMP6, echo reply, seq 225 0x0000: 6000 0000 0048 2c3e 0064 ff9b 0000 0000....H,>.d......
0x0010: 0000 0000 0a11 2e16 c0ca 0db8 2001 0001 ................
0x0020: e0d2 82f7 9f7c 1fa0 3a00 0000 0000 3316 .....|..:.....3.
0x0030: 8100 c6a3 e219 00e1 6e40 3551 0000 0000 ........n@5Q....
0x0040: 22ef 0600 0000 0000 1011 1213 1415 1617 "...............
0x0050: 1819 1a1b 1c1d 1e1f 2021 2223 2425 2627 .........!"#$%&'
0x0060: 2829 2a2b 2c2d 2e2f 3031 3233 3435 3637 ()*+,-./01234567

BIB entries do not return their ports to the pools when killed.

Test case ID: N/A
Date: 2013/05/09
OS: N/A
Tester: AL
Error module: bib
Description: BIB entries borrow ports when they're created. If they don't return them when they die, the pools will eventually run out of ports and no further address mapping will be made.
Observations: This was solved in commit a7ce42c. I'm uploading this for tracking purposes.

ICMP hairpin packets are being processed.

Test case ID: N/A
Date: 2013/05/21
OS: N/A
Tester: AL
Error module: Hairpinning
Description: "Hairpin packets can be either TCP or UDP" (RFC 6146, p. 12). This is because 3-tuples don't U-turn very well. Because of this, we should drop ICMP hairpin packets.
Observations: -

A. INSTRUCCIONES DE LLENADO DE ERRORES (ISSUES)

Instrucciones:

• Copiar el formato anexo al issue que se está creando
• Asignar el título del error
• Llenar los campos con la información correspondiente
  ID Caso Prueba: número asignado al caso de prueba (ver documento de pruebas)
  Fecha: Fecha en que se reporta el error (dd/mm/aa)
  Sistema operativo: Sistema operativo en que se está ejecutando la prueba (Ubuntu, MacOsX, iOS, Windows, etc)
  Incluir la versión del sistema operativo.
  Módulo: módulo en donde ocurrió el error
  Tester: Iniciales de la persona que ejecuta la prueba
  Descripción: Descripción del problema indicando claramente las condiciones en las que ocurrió.
  Observaciones: Alguna observación relevante para solucionar el problema, etc.
• Asignar el responsable de la corrección en el encabezado del issue
• Asignar el milestone al cual está asignado el issue en el encabezado del issue
• Asignar la etiqueta con nivel de severidad del error
• En caso necesario, asignar la etiqueta de duplicado si ya existe un issue igual
• En caso necesario, asignar la etiqueta de similar si ya existe un issue similar

DNS Address en configuración DHCP

Configurar de manera automática las direcciones de IP para las máquinas.

Error de memoria time-out session

Kernel Panic en el time-out de sesión

Change in determine_incoming_tuple affects ports & icmp_id

ID Caso Prueba: Pruebas internas

Fecha: 4-mar-2013

Sistema operativo: Ubuntu 12.04 , kernel 3.2

Tester: RA

Módulo del error: determine_incoming_tuple.c

Descripción: Parece que hubo un cambio en los supuestos después de la refactorización del código.

Anteriormente se asumía que los puertos e icmp_id tenían formato BIG ENDIAN, pero parece que eso ya no es así.

Aparecen, con los 3 protocolos, mensajes que indican que no se encuentra la BIB.

Observaciones:

El código de corrección se está trabajando el la branch: fixing_ports

The NAT64 seldom corrupts some packets.

Test case ID: N/A
Date: 2013/04/15
OS: N/A
Tester: RA, AL
Error module: Translate, probably.
Description: The NAT64 is replacing some payloads with garbage.
Observations: Only seen on TCP packets so far. Up till the TCP header, the translation seems normal. The resulting payload appears to be a fragment of a snapshot of memory.