netns.sh stuck at ncat.

netns.sh stuck at ncat.

[René van Dorst]

Hi Jason,

Tested the latest code on my Solidrun Cubox with Marvell Dove 88AP510 SoC.
But is get stuck on ncat. Device did not crash. I can terminate the  
script with ctrl-c.

Probably a weird config ;-)

Crosscompiled kernel 4.13.14 and wireguard on F26 from git source.

Linux cubox-es 4.13.14 #8 Mon Nov 20 17:47:03 CET 2017 armv7l armv7l  
armv7l GNU/Linux

console:

[   15.283929] wireguard: loading out-of-tree module taints kernel.
[   15.339447] wireguard: allowedips self-tests: pass
[   15.341220] wireguard: nonce counter self-tests: pass
[   15.370589] wireguard: curve25519 self-tests: pass
[   15.371282] wireguard: chacha20poly1305 self-tests: pass
[   15.374534] wireguard: blake2s self-tests: pass
[   15.798922] wireguard: ratelimiter self-tests: pass
[   15.799019] wireguard: WireGuard 0.0.20171111-16-gaffc38e loaded.  
See www.wireguard.com for information.
[   15.799023] wireguard: Copyright (C) 2015-2017 Jason A. Donenfeld  
<Jason@zx2c4.com>. All Rights Reserved.

[+] NS2: wg show wg0 endpoints
[+] NS1: wg set wg0 peer wXPE01il/3J9gBYCroPUc7mHgIxXjKW/TPULllHFWmc=  
allowed-ips 192.168.241.0/24
[+] NS1: wait for udp:1111
[+] NS1: ncat -l -u -p 1111
[  318.566899] wireguard: wg0: Sending keepalive packet to peer 6  
([::1]:2/0%0)
[  318.567104] wireguard: wg0: Receiving keepalive packet from peer 7  
([::1]:9998/0%0)
[  325.607881] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  325.607898] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  325.607915] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  325.607925] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  325.607936] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  325.607946] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  330.727519] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  330.727536] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  330.727547] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  335.846999] wireguard: wg0: Sending keepalive packet to peer 6  
([::1]:2/0%0)
[  335.847198] wireguard: wg0: Receiving keepalive packet from peer 7  
([::1]:9998/0%0)
[  346.087013] wireguard: wg0: Sending keepalive packet to peer 6  
([::1]:2/0%0)
[  346.087203] wireguard: wg0: Receiving keepalive packet from peer 7  
([::1]:9998/0%0)
[  356.328019] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  356.328037] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  356.328047] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  356.328057] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  356.328067] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  356.328077] wireguard: wg0: Packet has unallowed src IP (fd00::2)  
from peer 6 ([::1]:2/0%0)
[  366.567072] wireguard: wg0: Sending keepalive packet to peer 6  
([::1]:2/0%0)
[  366.567207] wireguard: wg0: Receiving keepalive packet from peer 7  
([::1]:9998/0%0)
[  376.807090] wireguard: wg0: Sending keepalive packet to peer 6  
([::1]:2/0%0)
[  376.807281] wireguard: wg0: Receiving keepalive packet from peer 7  
([::1]:9998/0%0)

Kernel CONFIG: https://paste.fedoraproject.org/paste/W6aa6vCAmrDMEgSwdAxbYA

root@cubox-es:/usr/src/WireGuard/src/tests# cat /proc/cpuinfo
processor       : 0
model name      : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 333.33
Features        : half thumb fastmult vfp edsp iwmmxt thumbee vfpv3  
vfpv3d16 tls idivt
CPU implementer : 0x56
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0x581
CPU revision    : 5

Hardware        : Marvell Dove
Revision        : 0000
Serial          : 0000000000000000


gcc version 7.0.1 20170309 (Red Hat Cross 7.0.1-0.4)

Greats,

René van Dorst.

Re: netns.sh stuck at ncat.

[Jason A. Donenfeld]

Hey Rene,

Thanks for the report. I'm looking into it. Can you confirm that you
cannot reproduce this on 20171111?

Jason

Re: netns.sh stuck at ncat.

[Jason A. Donenfeld]

This is pretty strange looking, and appears like it's a userland issue
-- like the versions of ncat or ss or whatever weird scripting hacks
in netns.sh aren't working well with the tools installed or some
networking sysctl I forgot to toggle... Maybe one quick way of testing
if it's an ss issue (old RHEL tools, or the like) would be to change
the function body of waitncatudp into just `sleep 2` or something.

Re: netns.sh stuck at ncat.

[René van Dorst]

Quoting "Jason A. Donenfeld" <Jason@zx2c4.com>:

> This is pretty strange looking, and appears like it's a userland issue
> -- like the versions of ncat or ss or whatever weird scripting hacks
> in netns.sh aren't working well with the tools installed or some
> networking sysctl I forgot to toggle... Maybe one quick way of testing
> if it's an ss issue (old RHEL tools, or the like) would be to change
> the function body of waitncatudp into just `sleep 2` or something.

Maybe it did not work before but I didn't noticed because ncat was not  
installed until yesterday.
I tried old wireguard module not the userland tools. But the same  
results stuck at ncat.

This Cubox is running Ubuntu xenial 16.04.3 LTS (GNU/Linux 4.13.14 armv7l)

ncat comes with package nmap

root@cubox-es:~# apt show nmap
Package: nmap
Version: 7.01-2ubuntu2

ss utility, iproute2-ss151103


With sleep 2 it works again.


My script modifications.

root@cubox-es:/usr/src/WireGuard/src/tests# git diff ./netns.sh
diff --git a/src/tests/netns.sh b/src/tests/netns.sh
index 2ad8d88..7718da6 100755
--- a/src/tests/netns.sh
+++ b/src/tests/netns.sh
@@ -38,7 +38,7 @@ ip1() { pretty 1 "ip $*"; ip -n $netns1 "$@"; }
  ip2() { pretty 2 "ip $*"; ip -n $netns2 "$@"; }
  sleep() { read -t "$1" -N 0 || true; }
  waitiperf() { pretty "${1//*-}" "wait for iperf:5201"; while [[ $(ss  
-N "$1" -tlp 'sport = 5201') != *iperf3* ]]; do sleep 0.1; done; }
-waitncatudp() { pretty "${1//*-}" "wait for udp:1111"; while [[ $(ss  
-N "$1" -ulp 'sport = 1111') != *ncat* ]]; do sleep 0.1; done; }
+waitncatudp() { pretty "${1//*-}" "wait for udp:1111"; sleep 2; }
  waitncattcp() { pretty "${1//*-}" "wait for tcp:1111"; while [[ $(ss  
-N "$1" -tlp 'sport = 1111') != *ncat* ]]; do sleep 0.1; done; }
  waitiface() { pretty "${1//*-}" "wait for $2 to come up"; ip netns  
exec "$1" bash -c "while [[ \$(< \"/sys/class/net/$2/operstate\") !=  
up ]]; do read -t .1 -N 0 || true; done;"; }

Greats,

René van Dorst.