May 2020 - SCION - mailman3.inf.ethz.ch

Re: [SCION] [SCIONLab] Package installing is not working properly
by Juan A. García-Pardo 23 Jun '20

23 Jun '20

Hi Hyok, Thanks for your email. It could be that the web application had some kind of error and we cannot trust its diagnostics. Please review our troubleshooting guide here https://docs.scionlab.org/content/faq/troubleshooting.html As a summary, you would check your AS manually within the terminal by connecting to your virtual machine; then check that the scion services are running and then pinging a machine with scmp echo. For an example on how to run scmp echo please see https://docs.scionlab.org/content/config/check.html#ping If you are able to ping with scmp echo other machines in SCIONLab it means your AS is up and running. Thank you very much and best regards, Juan A. On Wed, May 6, 2020 at 8:39 AM Hyok An (안혁) <anhyok(a)korea.ac.kr> wrote: > Dear SCIONLab, > > I have installed SCION AS with the document 'Installing packages' on Ubuntu > 16.04 after the last update. > : https://docs.scionlab.org/content/install/pkg.html > However, it is not working properly. > > The health check of the webapp showed some failed results. > : <image1.png> > > As you can see, it is not working. > The message 'VPN is not configured for this AS' seems a hint in my guess. > Because I already checked the option 'Use VPN' on the User AS page of > SCIONLab as below. > : <image2.png> > > Do you have anything to do with this for me? > (I have checked using vagrant and it is working.) > > Best regards, > > -- > Hyok An > M.S./Ph.D Integrated Course Student > Computer & Communication Security Lab > Korea University > _______________________________________________ > SCION mailing list > SCION(a)lists.inf.ethz.ch > https://lists.inf.ethz.ch/mailman/listinfo/scion >

3 2

Re: [SCION] Some Questions for diploma Thesis (SCIONLab)
by Juan A. García-Pardo 12 May '20

12 May '20

Hi Mauro, Send me a direct email with your Matrix username (@user:server) so I can add you to our Matrix SCION room. By the way, your overview picture shows a peering link between ASes in two different ISDs. I think that will not work, but we can talk about it in Matrix. Best regards, Juan A. On Sat, May 9, 2020 at 6:26 PM mauro.casanova(a)canet.ch < mauro.casanova(a)canet.ch> wrote: > Hi Juan > > > > Thanks for your feedback and please excuse the late reply. Due to the > workload, I didn't get to continue working on my SCION project. > > > > But now I installed my two ASes. The first is running on a Raspberry Pi 4 > connected via WLAN. In the second AS I use a VM for the Control Service and > a Apu Board as a Border Router. For this setup, I already had to work with > the topology files, thanks for your input about this. However, after a few > hours of testing and configuration, I was not able to establish a stable > connection. Sometime I have an connection and sometimes I got the failure: *CRIT: > Failed to retrieve paths from SCIOND: Path lookup had an error > err_code="SCIOND experienced an internal error"* > > > > The scion-apps are working, just the Webapps have some issues. (As already > discussed in the mails with Hyok) > > > > Now my next goal is to configure also the second AS correctly (with > control Service on a VM and Border Router on the Apu Board), and to > configure a peering Link between the two ASes. > > I haven’t really figured out how to build the topology files and configure > it properly. > > > > For an better overview I gave inserted my network map in this LINK > <https://1drv.ms/u/s!AkcX1uSBJ03I2god_o2xMYvJRGaj?e=n6YaWx>. > > > > I would really appreciate it, if I could continue to discuss my project > with you on your Matrix or Slack channel. > > > > Many thanks for your Support and best regards. > > Mauro > > > > > > *Von:* Juan A. García-Pardo <juan.garcia(a)inf.ethz.ch> > *Gesendet:* Donnerstag, 23. April 2020 20:47 > *An:* mauro.casanova(a)canet.ch > *Cc:* SCION(a)lists.inf.ethz.ch > *Betreff:* Re: [SCION] Some Questions for diploma Thesis (SCIONLab) > > > > Hi Mauro, > > I'm glad to hear you are experimenting with our user ASes. I checked the > picture of your network architecture and looks alright. Now, for the > questions (answering online) > > * Is it possible to run the scion control service on a VM an the > border router service on a separated device? So what is necessary to run > just an border router? > > If you refer to what type of hardware, then our experience is a PC can > forward up to some 200Mbps. You can always test your hardware running a > local topology, like "Tiny", and use our bandwidth tester to saturate a > couple of BRs. > > > > * Can I as a SCIONLab User already use the path-awareness and > multipath features, So can I write my own path- and traffic policies? (The > goal is to create some policies like in the presentation on SCION day from > Samuel Hitz) If yes, where can I do this? > > Yes, a SCIONLab user AS is no different in that regard. There are not too > many things right now that are aware of path policies; the SIG might be one > (I don't know for sure); you could even modify your path server to use path > policies right now (it's planned to extend it to do so, but it's not > supported at the moment). > > > > * The same Question I have for the peering link feature. Is this for > an SCIONLab user also available? > > You can peer your user AS with another user AS of your choice. For that > you will have to manually edit the topology files of both ASes. You can > look at how peering links are represented by generating a local topology > and inspecting the generated topology files. > > > > And something else. After the update of SCIONlab my test AS run well (all > necessary service are up, SCMP messages are ok), but also after a new > installation the SCION Apps / Webapps are just running with failure. Is > this > an knowing issue, or have I install the wrong apps? > > I don't know about the webapp, but other applications (bwtest client, > netcat, etc) should have been updated as well. Please try with e.g. netcat > and let us know. Also run dpkg -l scion* and copy the output, to see what > versions you have installed. > > > > I hope this helps. In any case, please send us back your experience, and > we might continue discussing using our Matrix channel, or Slack. > > Thanks and best regards, > > > > Juan A. > > > > > > > > I will be very grateful for some answers. Special to know if this test > deployment is possible. > > > > Thanks for your effort. > > > > Best Regards > > Mauro > > _______________________________________________ > SCION mailing list > SCION(a)lists.inf.ethz.ch > https://lists.inf.ethz.ch/mailman/listinfo/scion >

1 0

Having SIG problem
by YoonJong, Na 12 May '20

12 May '20

Hello, I'm currently working on SIG with newly updated tutorial I'm running two separate PC for environment with vagrant I've checked SCMP is working well between two of them ====================================== PC1: (SIGA) vagrant@scionlab-ffaa-1-c5d:/etc/scion/gen/ISD20/ASffaa_1_c5d/sig20-ffaa_1_c5d-1$ scmp echo -remote 20-ffaa:0:1404,[0.0.0.0] Using path: Hops: [20-ffaa:1:c5d 1>8 20-ffaa:0:1404] MTU: 1472, NextHop: 127.0.0.1:31045 104 bytes from 20-ffaa:0:1404,[0.0.0.0] scmp_seq=0 time=2.215ms ======================================= PC2: (SIGB) vagrant@scionlab-ffaa-1-c42:/etc/scion/gen/ISD18/ASffaa_1_c42/sig18-ffaa_1_c42-1$ scmp echo -remote 20-ffaa:1:c5d,[0.0.0.0] Using path: Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 1>8 18-ffaa:0:1201 3>5 20-ffaa:0:1401 7>1 20-ffaa:0:1403 3>47 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045 168 bytes from 20-ffaa:1:c5d,[0.0.0.0] scmp_seq=0 time=382.11ms ========================================= I've changed log.console to trace level to see what's the problem ========================================= vagrant@scionlab-ffaa-1-c42:/etc/scion/gen/ISD18/ASffaa_1_c42/sig18-ffaa_1_c42-1$ $GOPATH/bin/sig -config=${SC}/gen/ISD${ISD}/AS${AS}/sig${IA}-1/${sigID}.config 2020-05-12 08:07:49.696997+0000 [INFO] =====================> Service started SIG sigB Scion version: In docker: false pid: 21427 euid/egid: 1000 1000 cmd line: ["/home/vagrant/go/bin/sig" "-config=/etc/scion/gen/ISD18/ASffaa_1_c42/sig18-ffaa_1_c42-1/sigB.config"] 2020-05-12 08:07:49.698688+0000 [INFO] Startup capabilities caps="{ effective="net_admin" permitted="net_admin" inheritable="empty" bounding="full" }" 2020-05-12 08:07:49.700057+0000 [INFO] Regular SCION dispatcher addr="" 2020-05-12 08:07:49.710773+0000 [DBUG] Registered with dispatcher addr=18-ffaa:1:c42,172.16.0.11:30256 2020-05-12 08:07:49.711925+0000 [INFO] ReloadConfig: Adding AS... ia=20-ffaa:1:c5d 2020-05-12 08:07:52.456980+0000 [INFO] Starting periodic task debug_id=3ac960aa task=pathmgr_channelwriter 2020-05-12 08:07:52.458021+0000 [DBUG] Registered with dispatcher addr=18-ffaa:1:c42,172.16.0.11:1148 2020-05-12 08:07:52.458882+0000 [INFO] Network setup done ia=20-ffaa:1:c5d 2020-05-12 08:07:52.458961+0000 [INFO] Added network ia=20-ffaa:1:c5d net= 172.16.11.0/24 2020-05-12 08:07:52.459044+0000 [INFO] ReloadConfig: Added AS ia=20-ffaa:1:c5d 2020-05-12 08:07:52.459108+0000 [INFO] Config reloaded 2020-05-12 08:07:52.459219+0000 [INFO] EgressDispatcher: starting ia=20-ffaa:1:c5d 2020-05-12 08:07:52.463310+0000 [INFO] Health monitor starting ia=20-ffaa:1:c5d 2020-05-12 08:07:52.464158+0000 [INFO] PollReqHdlr: starting 2020-05-12 08:07:52.468434+0000 [INFO] EgressWorker: starting ia=20-ffaa:1:c5d sessId=0x00 2020-05-12 08:07:52.484653+0000 [INFO] EgressReader: starting 2020-05-12 08:07:52.485307+0000 [EROR] EgressReader: unable to find dest IA ip=ff02::2 2020-05-12 08:07:52.485839+0000 [DBUG] Registered with dispatcher addr=18-ffaa:1:c42,172.16.0.11:30056 2020-05-12 08:07:52.486012+0000 [INFO] Exporting prometheus metrics addr= 127.0.0.1:1281 2020-05-12 08:07:52.963604+0000 [INFO] sessMonitor: Path not available ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: <nil>" 2020-05-12 08:07:52.963889+0000 [INFO] sessMonitor: New remote ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: a88d6ff3fa53151a Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 1>8 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 7>1 20-ffaa:0:1403 3>47 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" 2020-05-12 08:07:53.466582+0000 [EROR] EgressReader: unable to find dest IA ip=ff02::2 2020-05-12 08:07:53.963361+0000 [INFO] sessMonitor: Remote SIG timeout ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: a88d6ff3fa53151a Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 1>8 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 7>1 20-ffaa:0:1403 3>47 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" duration=1.499208985s 2020-05-12 08:07:53.964553+0000 [INFO] sessMonitor: New remote ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: 6c6a85738b3fbd6b Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 1>8 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 6>1 20-ffaa:0:1402 2>1 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" 2020-05-12 08:07:54.465522+0000 [INFO] sessMonitor: Remote SIG timeout ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: 6c6a85738b3fbd6b Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 1>8 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 6>1 20-ffaa:0:1402 2>1 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" duration=2.001371015s 2020-05-12 08:07:54.466420+0000 [INFO] sessMonitor: New remote ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: d8a28ab0e1798c41 Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 49>3 18-ffaa:0:1203 1>7 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 7>1 20-ffaa:0:1403 3>47 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" 2020-05-12 08:07:54.963183+0000 [INFO] sessMonitor: Remote SIG timeout ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: d8a28ab0e1798c41 Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 49>3 18-ffaa:0:1203 1>7 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 7>1 20-ffaa:0:1403 3>47 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" duration=2.499032058s ========================================= I've added sig entry for both 3 toplogy.json files as follow ========================================== vagrant@scionlab-ffaa-1-c5d:/etc/scion/gen/ISD20/ASffaa_1_c5d/endhost$ cat topology.json | head -n 20 { "Attributes": [], "SIG": { "sig20-ffaa_1_c5d-1": { "Addrs": { "IPv4": { "Public": { "Addr": "127.0.0.1", "L4Port": 31056 } } } } }, "BorderRouters": { ============================ Am I missing something? Thank you, Yoonjong -- *Yoonjong, Na* Korea University Dept. of Computer Science and Engineering Computer & Communication Security Lab. (+82)10-8474-2060

1 0

Re: [SCION] Some Questions for diploma Thesis (SCIONLab)
by Juan A. García-Pardo 09 May '20

09 May '20

Hi Mauro, I'm glad to hear you are experimenting with our user ASes. I checked the picture of your network architecture and looks alright. Now, for the questions (answering online) > * Is it possible to run the scion control service on a VM an the > border router service on a separated device? So what is necessary to run > just an border router? > If you refer to what type of hardware, then our experience is a PC can forward up to some 200Mbps. You can always test your hardware running a local topology, like "Tiny", and use our bandwidth tester to saturate a couple of BRs. * Can I as a SCIONLab User already use the path-awareness and > multipath features, So can I write my own path- and traffic policies? (The > goal is to create some policies like in the presentation on SCION day from > Samuel Hitz) If yes, where can I do this? > Yes, a SCIONLab user AS is no different in that regard. There are not too many things right now that are aware of path policies; the SIG might be one (I don't know for sure); you could even modify your path server to use path policies right now (it's planned to extend it to do so, but it's not supported at the moment). * The same Question I have for the peering link feature. Is this for > an SCIONLab user also available? > You can peer your user AS with another user AS of your choice. For that you will have to manually edit the topology files of both ASes. You can look at how peering links are represented by generating a local topology and inspecting the generated topology files. > And something else. After the update of SCIONlab my test AS run well (all > necessary service are up, SCMP messages are ok), but also after a new > installation the SCION Apps / Webapps are just running with failure. Is > this > an knowing issue, or have I install the wrong apps? > I don't know about the webapp, but other applications (bwtest client, netcat, etc) should have been updated as well. Please try with e.g. netcat and let us know. Also run dpkg -l scion* and copy the output, to see what versions you have installed. I hope this helps. In any case, please send us back your experience, and we might continue discussing using our Matrix channel, or Slack. Thanks and best regards, Juan A. > > I will be very grateful for some answers. Special to know if this test > deployment is possible. > > > > Thanks for your effort. > > > > Best Regards > > Mauro > > _______________________________________________ > SCION mailing list > SCION(a)lists.inf.ethz.ch > https://lists.inf.ethz.ch/mailman/listinfo/scion >

2 1

Re: [SCION] Typo of SCIONLab tutorial
by Juan A. García-Pardo 08 May '20

08 May '20

Hi Hyok, Thanks for telling us. We are fixing it right now. Best regards, Juan A. On Fri, May 8, 2020 at 11:04 AM Hyok An (안혁) <anhyok(a)korea.ac.kr> wrote: > Dear SCIONLab, > > From https://docs.scionlab.org/content/apps/remote_sig.html : > You can find this sentence [*You need to replace the “" AS id of the remote > AS]* on the tutorial page of SCIONLab. > I think you wanted to write this [*You need to replace the > “<remote_sig_AS>" AS id of the remote AS]*. > > It seems that the <remote_sig_AS> is processed as HTML. > How about to change to "*<*remote_sig_AS*>*"? > > Following sentences also have the same problem for "<remote_sig_IPnet>". > > Best regards, > -- > Hyok An > M.S./Ph.D Integrated Course Student > Computer & Communication Security Lab > Korea University > _______________________________________________ > SCION mailing list > SCION(a)lists.inf.ethz.ch > https://lists.inf.ethz.ch/mailman/listinfo/scion >

1 0

Typo of SCIONLab tutorial
by Hyok An (안혁) 08 May '20

08 May '20

Dear SCIONLab, >From https://docs.scionlab.org/content/apps/remote_sig.html : You can find this sentence [*You need to replace the “" AS id of the remote AS]* on the tutorial page of SCIONLab. I think you wanted to write this [*You need to replace the “<remote_sig_AS>" AS id of the remote AS]*. It seems that the <remote_sig_AS> is processed as HTML. How about to change to "*<*remote_sig_AS*>*"? Following sentences also have the same problem for "<remote_sig_IPnet>". Best regards, -- Hyok An M.S./Ph.D Integrated Course Student Computer & Communication Security Lab Korea University

1 0

[SCIONLab] Package installing is not working properly
by Hyok An (안혁) 06 May '20

06 May '20

Dear SCIONLab, I have installed SCION AS with the document 'Installing packages' on Ubuntu 16.04 after the last update. : https://docs.scionlab.org/content/install/pkg.html However, it is not working properly. The health check of the webapp showed some failed results. : <image1.png> As you can see, it is not working. The message 'VPN is not configured for this AS' seems a hint in my guess. Because I already checked the option 'Use VPN' on the User AS page of SCIONLab as below. : <image2.png> Do you have anything to do with this for me? (I have checked using vagrant and it is working.) Best regards, -- Hyok An M.S./Ph.D Integrated Course Student Computer & Communication Security Lab Korea University

1 0