Subject: Re: [vserver] tftp server problem
From: Corin Langosch <corinl@gmx.de>
Date: Tue, 19 Feb 2008 16:09:03 +0100
Tue, 19 Feb 2008 16:09:03 +0100
Hi!

I added all caps, but it still does not work :-(

buero:/etc/vservers# cat system/bcapabilities
NET_RAW
NET_BROADCAST
SYS_TIME
SYS_NICE
SYS_RESOURCE

The caps must be set as the dhcp server inside the vserver is running 
fine, which
wont without the caps.

No tftp server is not running inside the host, I unsinatlled it there. 
"netstat -l -p" confirms this.
Otherwise the tftpd inside the host wouldn't be able to bind to the port 
neither..?

This is my tcpdump from the host:

buero:/etc/vservers# tcpdump -n | grep '\.1\.203'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:02:32.108114 IP 192.168.1.203.67 > 255.255.255.255.68: BOOTP/DHCP, 
Reply, length 300
16:02:34.198749 IP 192.168.1.203.67 > 255.255.255.255.68: BOOTP/DHCP, 
Reply, length 300
16:02:34.206389 arp who-has 192.168.1.203 tell 192.168.1.32
16:02:34.206410 arp reply 192.168.1.203 is-at 00:13:8f:56:02:96
16:02:34.206614 IP 192.168.1.32.2070 > 192.168.1.203.69:  27 RRQ 
"pxelinux.0" octet tsize 0
16:02:34.207638 IP 192.168.1.32.2070 > 192.168.1.203.32973: UDP, length 17
16:02:34.207674 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp 
port 32973 unreachable, length 53
16:02:34.214165 IP 192.168.1.32.2071 > 192.168.1.203.69:  32 RRQ 
"pxelinux.0" octet blksize 1456
16:02:34.215175 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:34.215207 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp 
port 32974 unreachable, length 40
16:02:37.968200 IP 192.168.1.32.2071 > 192.168.1.203.32972: UDP, length 4
16:02:37.968234 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp 
port 32972 unreachable, length 40
16:02:39.216366 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:39.216400 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp 
port 32974 unreachable, length 40
16:02:42.972429 IP 192.168.1.32.2071 > 192.168.1.203.32972: UDP, length 4
16:02:42.972464 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp 
port 32972 unreachable, length 40
16:02:44.220570 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:44.220606 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp 
port 32974 unreachable, length 40
16:02:49.224788 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:49.224822 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp 
port 32974 unreachable, length 40
16:02:54.225850 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:54.225885 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp 
port 32974 unreachable, length 40
16:02:59.230023 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:59.230059 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp 
port 32974 unreachable, length 40
16:03:10.223642 IP 192.168.1.32.2072 > 192.168.1.203.69:  32 ACK block 0

For me it seems that the chosen data-port for the transfer by the server 
is somehow not reachable?
What could the reason be, how to solve it?

Corin


Thomas Weber schrieb:
> Am Montag, den 18.02.2008, 19:15 +0100 schrieb Corin Langosch:
>   
>> Hi!
>>
>> I already had NET_RAW in my bcapabilities for dhcp-server. Adding
>> RAW_ICMP to
>> ccapabilities didn't change anything.
>>
>> buero:/etc/vservers/system# cat bcapabilities
>> CAP_NET_RAW
>> CAP_NET_BROADCAST
>> CAP_SYS_TIME
>>     
>
> ehm... try without the CAP_
> /etc/vservers/services# cat bcapabilities
> SYS_NICE
> SYS_RESOURCE
> NET_RAW
>
> not sure if you need all of these for atfpd. But with these bind9, dhcp,
> atftd plus some others work fine.
>
>   
>> buero:/etc/vservers/system# cat ccapabilities
>> RAW_ICMP
>>     
>
> no need for ccapabilities here.
>
>   
>> Any other hints? How to trace the traffic  flow?
>>     
>
> I know its a stupid question: did you make sure to disable the tftpd on
> the root system?
>
> You can capture the traffic with tcpdump on the host.
>
>   Tom
>
>   


Hi!

I added all caps, but it still does not work :-(

buero:/etc/vservers# cat system/bcapabilities
NET_RAW
NET_BROADCAST
SYS_TIME
SYS_NICE
SYS_RESOURCE

The caps must be set as the dhcp server inside the vserver is running fine, which
wont without the caps.

No tftp server is not running inside the host, I unsinatlled it there. "netstat -l -p" confirms this.
Otherwise the tftpd inside the host wouldn't be able to bind to the port neither..?

This is my tcpdump from the host:

buero:/etc/vservers# tcpdump -n | grep '\.1\.203'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:02:32.108114 IP 192.168.1.203.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 300
16:02:34.198749 IP 192.168.1.203.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 300
16:02:34.206389 arp who-has 192.168.1.203 tell 192.168.1.32
16:02:34.206410 arp reply 192.168.1.203 is-at 00:13:8f:56:02:96
16:02:34.206614 IP 192.168.1.32.2070 > 192.168.1.203.69:  27 RRQ "pxelinux.0" octet tsize 0
16:02:34.207638 IP 192.168.1.32.2070 > 192.168.1.203.32973: UDP, length 17
16:02:34.207674 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32973 unreachable, length 53
16:02:34.214165 IP 192.168.1.32.2071 > 192.168.1.203.69:  32 RRQ "pxelinux.0" octet blksize 1456
16:02:34.215175 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:34.215207 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:02:37.968200 IP 192.168.1.32.2071 > 192.168.1.203.32972: UDP, length 4
16:02:37.968234 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32972 unreachable, length 40
16:02:39.216366 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:39.216400 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:02:42.972429 IP 192.168.1.32.2071 > 192.168.1.203.32972: UDP, length 4
16:02:42.972464 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32972 unreachable, length 40
16:02:44.220570 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:44.220606 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:02:49.224788 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:49.224822 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:02:54.225850 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:54.225885 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:02:59.230023 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:59.230059 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:03:10.223642 IP 192.168.1.32.2072 > 192.168.1.203.69:  32 ACK block 0

For me it seems that the chosen data-port for the transfer by the server is somehow not reachable?
What could the reason be, how to solve it?

Corin


Thomas Weber schrieb:
Am Montag, den 18.02.2008, 19:15 +0100 schrieb Corin Langosch:
  
Hi!

I already had NET_RAW in my bcapabilities for dhcp-server. Adding
RAW_ICMP to
ccapabilities didn't change anything.

buero:/etc/vservers/system# cat bcapabilities
CAP_NET_RAW
CAP_NET_BROADCAST
CAP_SYS_TIME
    

ehm... try without the CAP_
/etc/vservers/services# cat bcapabilities
SYS_NICE
SYS_RESOURCE
NET_RAW

not sure if you need all of these for atfpd. But with these bind9, dhcp,
atftd plus some others work fine.

  
buero:/etc/vservers/system# cat ccapabilities
RAW_ICMP
    

no need for ccapabilities here.

  
Any other hints? How to trace the traffic  flow?
    

I know its a stupid question: did you make sure to disable the tftpd on
the root system?

You can capture the traffic with tcpdump on the host.

  Tom