- SCION - mailman3.inf.ethz.ch

New version of SCIONLab
by Juan A. García-Pardo 05 Jan '21

05 Jan '21

Dear SCIONLab user, We just released version 3.0.2 of the control-service package. A bug snuck into version 3.0.1 that we released on January 4th. In case you happened to upgrade your package since yesterday afternoon UTC, make sure you upgrade again: sudo apt-get update; sudo apt-get install --only-upgrade scionlab scion-apps-* Contact us at scion(a)lists.inf.ethz.ch if you have any comments or questions. To reach the SCIONLab administrators directly, send us an email to scionlab-admins(a)sympa.ethz.ch . Thank you and best regards, Your SCIONLab team

1 0

[SCIONLab] SCIONLab update on 9.12.2020
by Matthias Frei 09 Dec '20

09 Dec '20

Dear SCIONLab user, We are updating the SCIONLab infrastructure to be able to build even more exciting applications with it. We are notifying all SCIONLab users ahead of time to prepare for possible outages and to update their applications. The upgrade will happen on Wednesday, 9.12.2020 at 07:00UTC. SCIONLab will be in maintenance mode from 8.12.2020. The most important changes to SCION/SCIONLab include: - Control Plane Public Key Infrastructure now based on x509 certificates instead of the old format based on JSON web signatures. - Control plane messaging now based on gRPC/protobuf instead of capnproto. - Packet header redesigned to be more suitable for high speed software or hardware router implementation. See https://scion.docs.anapaya.net/en/latest/protocols/scion-header.html for details. - Detection of active interfaces now uses the Bidirectional Forwarding Detection protocol (see RFC 5880), instead of custom keep-alive messages between control services. - New border router implementation with support for the new header and BFD. Note that this does not support peering links yet. - New SCION-IP gateway (SIG) implementation - The tools scmp and showpaths are now subcommands of a combined binary with a more polished interface. Usage is e.g. `scion ping <isd-as,ip>`, `scion showpaths <isd-as>`, or `scion traceroute <isd-as,ip>`. - Log output of the SCION services is captured by the systemd journal, there is no file logging anymore. - Easier tinkering with the SCIONLab configuration; the important files are now all directly under `/etc/scion` instead of in deeply nested directories. The scionlab-config utility is more careful to avoid overwriting any changes that a user might have applied. Information about the update process: Please update the SCIONLab debian packages (apt-get update && apt-get upgrade) in your machine or VM connected to SCIONLab after 07:00UTC on Wednesday, 9.12.2020 -- no further action should be required. Please contact us at scion(a)lists.inf.ethz.ch if you have any comments or questions. To reach the SCIONLab administrators directly, send us an email to scionlab-admins(a)sympa.ethz.ch. Thank you and best regards, Your SCIONLab team

1 1

how to add function to the router and test it
by mewtwo 19 Nov '20

19 Nov '20

Hi all I realized a function of path verification.I want to add this function to the router and test how it works via scionlab testbed. How to add function to router on scion?Can I test it via SIG application or other ways? By the way, which programming language scion support? C or Go? Thanks and regard Mewtwo

2 1

SCION SIG
by Chandrashekar Dheeraj 10 Nov '20

10 Nov '20

Hello Use Case - Two IP endhosts under different ASes should be reachable over SCION network using SIG. Currently SIG can be configured between two ASes. Is there a simple way for endhosts to use these SIGs ? Its known that the network could be defined in the SIG configuration, but would it work for globally non routable IP ? Thanks and regard Dheeraj

2 2

SCIONLab package for SIG
by Frei Matthias 27 Jul '20

27 Jul '20

Hi there, we've created a binary package for the SCION IP Gateway (SIG) for SCIONLab. At the same time, we've updated the guide on how to install (which is now trivial) and configure the SIG; please have a look, at https://docs.scionlab.org/content/apps/remote_sig.html. We hope this makes the SIG a bit more approachable. We're looking forward to hear about the experiments that you set up with the SIG on SCIONLab. Cheers, Matthias

1 0

Re: [SCION] [SCIONLab] Package installing is not working properly
by Juan A. García-Pardo 23 Jun '20

23 Jun '20

Hi Hyok, Thanks for your email. It could be that the web application had some kind of error and we cannot trust its diagnostics. Please review our troubleshooting guide here https://docs.scionlab.org/content/faq/troubleshooting.html As a summary, you would check your AS manually within the terminal by connecting to your virtual machine; then check that the scion services are running and then pinging a machine with scmp echo. For an example on how to run scmp echo please see https://docs.scionlab.org/content/config/check.html#ping If you are able to ping with scmp echo other machines in SCIONLab it means your AS is up and running. Thank you very much and best regards, Juan A. On Wed, May 6, 2020 at 8:39 AM Hyok An (안혁) <anhyok(a)korea.ac.kr> wrote: > Dear SCIONLab, > > I have installed SCION AS with the document 'Installing packages' on Ubuntu > 16.04 after the last update. > : https://docs.scionlab.org/content/install/pkg.html > However, it is not working properly. > > The health check of the webapp showed some failed results. > : <image1.png> > > As you can see, it is not working. > The message 'VPN is not configured for this AS' seems a hint in my guess. > Because I already checked the option 'Use VPN' on the User AS page of > SCIONLab as below. > : <image2.png> > > Do you have anything to do with this for me? > (I have checked using vagrant and it is working.) > > Best regards, > > -- > Hyok An > M.S./Ph.D Integrated Course Student > Computer & Communication Security Lab > Korea University > _______________________________________________ > SCION mailing list > SCION(a)lists.inf.ethz.ch > https://lists.inf.ethz.ch/mailman/listinfo/scion >

3 2

Limitations on SCION Lab
by Michael A. Flückiger 22 Jun '20

22 Jun '20

Hi all In the course of my master thesis I would like to perform performance measurements in the SCIONLab network. For this purpose I send data over the network between two AS's created by myself. I'm wondering if there are any limitations implemented (e.g. bandwidth throttling) for "normal" users which could influence my measurements? Thanks for your effort. Best, Michi

2 1

Re: [SCION] Some Questions for diploma Thesis (SCIONLab)
by Juan A. García-Pardo 12 May '20

12 May '20

Hi Mauro, Send me a direct email with your Matrix username (@user:server) so I can add you to our Matrix SCION room. By the way, your overview picture shows a peering link between ASes in two different ISDs. I think that will not work, but we can talk about it in Matrix. Best regards, Juan A. On Sat, May 9, 2020 at 6:26 PM mauro.casanova(a)canet.ch < mauro.casanova(a)canet.ch> wrote: > Hi Juan > > > > Thanks for your feedback and please excuse the late reply. Due to the > workload, I didn't get to continue working on my SCION project. > > > > But now I installed my two ASes. The first is running on a Raspberry Pi 4 > connected via WLAN. In the second AS I use a VM for the Control Service and > a Apu Board as a Border Router. For this setup, I already had to work with > the topology files, thanks for your input about this. However, after a few > hours of testing and configuration, I was not able to establish a stable > connection. Sometime I have an connection and sometimes I got the failure: *CRIT: > Failed to retrieve paths from SCIOND: Path lookup had an error > err_code="SCIOND experienced an internal error"* > > > > The scion-apps are working, just the Webapps have some issues. (As already > discussed in the mails with Hyok) > > > > Now my next goal is to configure also the second AS correctly (with > control Service on a VM and Border Router on the Apu Board), and to > configure a peering Link between the two ASes. > > I haven’t really figured out how to build the topology files and configure > it properly. > > > > For an better overview I gave inserted my network map in this LINK > <https://1drv.ms/u/s!AkcX1uSBJ03I2god_o2xMYvJRGaj?e=n6YaWx>. > > > > I would really appreciate it, if I could continue to discuss my project > with you on your Matrix or Slack channel. > > > > Many thanks for your Support and best regards. > > Mauro > > > > > > *Von:* Juan A. García-Pardo <juan.garcia(a)inf.ethz.ch> > *Gesendet:* Donnerstag, 23. April 2020 20:47 > *An:* mauro.casanova(a)canet.ch > *Cc:* SCION(a)lists.inf.ethz.ch > *Betreff:* Re: [SCION] Some Questions for diploma Thesis (SCIONLab) > > > > Hi Mauro, > > I'm glad to hear you are experimenting with our user ASes. I checked the > picture of your network architecture and looks alright. Now, for the > questions (answering online) > > * Is it possible to run the scion control service on a VM an the > border router service on a separated device? So what is necessary to run > just an border router? > > If you refer to what type of hardware, then our experience is a PC can > forward up to some 200Mbps. You can always test your hardware running a > local topology, like "Tiny", and use our bandwidth tester to saturate a > couple of BRs. > > > > * Can I as a SCIONLab User already use the path-awareness and > multipath features, So can I write my own path- and traffic policies? (The > goal is to create some policies like in the presentation on SCION day from > Samuel Hitz) If yes, where can I do this? > > Yes, a SCIONLab user AS is no different in that regard. There are not too > many things right now that are aware of path policies; the SIG might be one > (I don't know for sure); you could even modify your path server to use path > policies right now (it's planned to extend it to do so, but it's not > supported at the moment). > > > > * The same Question I have for the peering link feature. Is this for > an SCIONLab user also available? > > You can peer your user AS with another user AS of your choice. For that > you will have to manually edit the topology files of both ASes. You can > look at how peering links are represented by generating a local topology > and inspecting the generated topology files. > > > > And something else. After the update of SCIONlab my test AS run well (all > necessary service are up, SCMP messages are ok), but also after a new > installation the SCION Apps / Webapps are just running with failure. Is > this > an knowing issue, or have I install the wrong apps? > > I don't know about the webapp, but other applications (bwtest client, > netcat, etc) should have been updated as well. Please try with e.g. netcat > and let us know. Also run dpkg -l scion* and copy the output, to see what > versions you have installed. > > > > I hope this helps. In any case, please send us back your experience, and > we might continue discussing using our Matrix channel, or Slack. > > Thanks and best regards, > > > > Juan A. > > > > > > > > I will be very grateful for some answers. Special to know if this test > deployment is possible. > > > > Thanks for your effort. > > > > Best Regards > > Mauro > > _______________________________________________ > SCION mailing list > SCION(a)lists.inf.ethz.ch > https://lists.inf.ethz.ch/mailman/listinfo/scion >

1 0

Having SIG problem
by YoonJong, Na 12 May '20

12 May '20

Hello, I'm currently working on SIG with newly updated tutorial I'm running two separate PC for environment with vagrant I've checked SCMP is working well between two of them ====================================== PC1: (SIGA) vagrant@scionlab-ffaa-1-c5d:/etc/scion/gen/ISD20/ASffaa_1_c5d/sig20-ffaa_1_c5d-1$ scmp echo -remote 20-ffaa:0:1404,[0.0.0.0] Using path: Hops: [20-ffaa:1:c5d 1>8 20-ffaa:0:1404] MTU: 1472, NextHop: 127.0.0.1:31045 104 bytes from 20-ffaa:0:1404,[0.0.0.0] scmp_seq=0 time=2.215ms ======================================= PC2: (SIGB) vagrant@scionlab-ffaa-1-c42:/etc/scion/gen/ISD18/ASffaa_1_c42/sig18-ffaa_1_c42-1$ scmp echo -remote 20-ffaa:1:c5d,[0.0.0.0] Using path: Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 1>8 18-ffaa:0:1201 3>5 20-ffaa:0:1401 7>1 20-ffaa:0:1403 3>47 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045 168 bytes from 20-ffaa:1:c5d,[0.0.0.0] scmp_seq=0 time=382.11ms ========================================= I've changed log.console to trace level to see what's the problem ========================================= vagrant@scionlab-ffaa-1-c42:/etc/scion/gen/ISD18/ASffaa_1_c42/sig18-ffaa_1_c42-1$ $GOPATH/bin/sig -config=${SC}/gen/ISD${ISD}/AS${AS}/sig${IA}-1/${sigID}.config 2020-05-12 08:07:49.696997+0000 [INFO] =====================> Service started SIG sigB Scion version: In docker: false pid: 21427 euid/egid: 1000 1000 cmd line: ["/home/vagrant/go/bin/sig" "-config=/etc/scion/gen/ISD18/ASffaa_1_c42/sig18-ffaa_1_c42-1/sigB.config"] 2020-05-12 08:07:49.698688+0000 [INFO] Startup capabilities caps="{ effective="net_admin" permitted="net_admin" inheritable="empty" bounding="full" }" 2020-05-12 08:07:49.700057+0000 [INFO] Regular SCION dispatcher addr="" 2020-05-12 08:07:49.710773+0000 [DBUG] Registered with dispatcher addr=18-ffaa:1:c42,172.16.0.11:30256 2020-05-12 08:07:49.711925+0000 [INFO] ReloadConfig: Adding AS... ia=20-ffaa:1:c5d 2020-05-12 08:07:52.456980+0000 [INFO] Starting periodic task debug_id=3ac960aa task=pathmgr_channelwriter 2020-05-12 08:07:52.458021+0000 [DBUG] Registered with dispatcher addr=18-ffaa:1:c42,172.16.0.11:1148 2020-05-12 08:07:52.458882+0000 [INFO] Network setup done ia=20-ffaa:1:c5d 2020-05-12 08:07:52.458961+0000 [INFO] Added network ia=20-ffaa:1:c5d net= 172.16.11.0/24 2020-05-12 08:07:52.459044+0000 [INFO] ReloadConfig: Added AS ia=20-ffaa:1:c5d 2020-05-12 08:07:52.459108+0000 [INFO] Config reloaded 2020-05-12 08:07:52.459219+0000 [INFO] EgressDispatcher: starting ia=20-ffaa:1:c5d 2020-05-12 08:07:52.463310+0000 [INFO] Health monitor starting ia=20-ffaa:1:c5d 2020-05-12 08:07:52.464158+0000 [INFO] PollReqHdlr: starting 2020-05-12 08:07:52.468434+0000 [INFO] EgressWorker: starting ia=20-ffaa:1:c5d sessId=0x00 2020-05-12 08:07:52.484653+0000 [INFO] EgressReader: starting 2020-05-12 08:07:52.485307+0000 [EROR] EgressReader: unable to find dest IA ip=ff02::2 2020-05-12 08:07:52.485839+0000 [DBUG] Registered with dispatcher addr=18-ffaa:1:c42,172.16.0.11:30056 2020-05-12 08:07:52.486012+0000 [INFO] Exporting prometheus metrics addr= 127.0.0.1:1281 2020-05-12 08:07:52.963604+0000 [INFO] sessMonitor: Path not available ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: <nil>" 2020-05-12 08:07:52.963889+0000 [INFO] sessMonitor: New remote ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: a88d6ff3fa53151a Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 1>8 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 7>1 20-ffaa:0:1403 3>47 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" 2020-05-12 08:07:53.466582+0000 [EROR] EgressReader: unable to find dest IA ip=ff02::2 2020-05-12 08:07:53.963361+0000 [INFO] sessMonitor: Remote SIG timeout ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: a88d6ff3fa53151a Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 1>8 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 7>1 20-ffaa:0:1403 3>47 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" duration=1.499208985s 2020-05-12 08:07:53.964553+0000 [INFO] sessMonitor: New remote ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: 6c6a85738b3fbd6b Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 1>8 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 6>1 20-ffaa:0:1402 2>1 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" 2020-05-12 08:07:54.465522+0000 [INFO] sessMonitor: Remote SIG timeout ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: 6c6a85738b3fbd6b Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 1>8 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 6>1 20-ffaa:0:1402 2>1 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" duration=2.001371015s 2020-05-12 08:07:54.466420+0000 [INFO] sessMonitor: New remote ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: d8a28ab0e1798c41 Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 49>3 18-ffaa:0:1203 1>7 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 7>1 20-ffaa:0:1403 3>47 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" 2020-05-12 08:07:54.963183+0000 [INFO] sessMonitor: Remote SIG timeout ia=20-ffaa:1:c5d sessId=0x00 remote="Sig: 20-ffaa:1:c5d,[SIG A (0x0004)]:0:0 Path: Key: d8a28ab0e1798c41 Hops: [18-ffaa:1:c42 1>36 18-ffaa:0:1206 49>3 18-ffaa:0:1203 1>7 18-ffaa:0:1201 4>5 17-ffaa:0:1101 4>2 23-ffaa:0:1701 4>3 20-ffaa:0:1401 7>1 20-ffaa:0:1403 3>47 20-ffaa:0:1404 8>1 20-ffaa:1:c5d] MTU: 1472, NextHop: 127.0.0.1:31045" duration=2.499032058s ========================================= I've added sig entry for both 3 toplogy.json files as follow ========================================== vagrant@scionlab-ffaa-1-c5d:/etc/scion/gen/ISD20/ASffaa_1_c5d/endhost$ cat topology.json | head -n 20 { "Attributes": [], "SIG": { "sig20-ffaa_1_c5d-1": { "Addrs": { "IPv4": { "Public": { "Addr": "127.0.0.1", "L4Port": 31056 } } } } }, "BorderRouters": { ============================ Am I missing something? Thank you, Yoonjong -- *Yoonjong, Na* Korea University Dept. of Computer Science and Engineering Computer & Communication Security Lab. (+82)10-8474-2060

1 0

Re: [SCION] Some Questions for diploma Thesis (SCIONLab)
by Juan A. García-Pardo 09 May '20

09 May '20

Hi Mauro, I'm glad to hear you are experimenting with our user ASes. I checked the picture of your network architecture and looks alright. Now, for the questions (answering online) > * Is it possible to run the scion control service on a VM an the > border router service on a separated device? So what is necessary to run > just an border router? > If you refer to what type of hardware, then our experience is a PC can forward up to some 200Mbps. You can always test your hardware running a local topology, like "Tiny", and use our bandwidth tester to saturate a couple of BRs. * Can I as a SCIONLab User already use the path-awareness and > multipath features, So can I write my own path- and traffic policies? (The > goal is to create some policies like in the presentation on SCION day from > Samuel Hitz) If yes, where can I do this? > Yes, a SCIONLab user AS is no different in that regard. There are not too many things right now that are aware of path policies; the SIG might be one (I don't know for sure); you could even modify your path server to use path policies right now (it's planned to extend it to do so, but it's not supported at the moment). * The same Question I have for the peering link feature. Is this for > an SCIONLab user also available? > You can peer your user AS with another user AS of your choice. For that you will have to manually edit the topology files of both ASes. You can look at how peering links are represented by generating a local topology and inspecting the generated topology files. > And something else. After the update of SCIONlab my test AS run well (all > necessary service are up, SCMP messages are ok), but also after a new > installation the SCION Apps / Webapps are just running with failure. Is > this > an knowing issue, or have I install the wrong apps? > I don't know about the webapp, but other applications (bwtest client, netcat, etc) should have been updated as well. Please try with e.g. netcat and let us know. Also run dpkg -l scion* and copy the output, to see what versions you have installed. I hope this helps. In any case, please send us back your experience, and we might continue discussing using our Matrix channel, or Slack. Thanks and best regards, Juan A. > > I will be very grateful for some answers. Special to know if this test > deployment is possible. > > > > Thanks for your effort. > > > > Best Regards > > Mauro > > _______________________________________________ > SCION mailing list > SCION(a)lists.inf.ethz.ch > https://lists.inf.ethz.ch/mailman/listinfo/scion >

2 1