Monthly Archives: August 2014

Summary of the Outreach Program for Women

I’ve just finished my Outreach Program for Women in a Linux kernel project. The last months were amazing. I’ve learnt about development, network, security network, network protocols and more things. I’ve enjoyed it!

I did my OPW into the Netfilter Project. I’m working in Nftable project. Nftables is the project that aims to replace the existing iptables framework.

These are my accomplishments:

* I did the automated regression testing of nftables. This let us check the input of rules of nft-tool from the command-line and the output from nft-tool of this rule. Then, It compares if the rule input matches the rule output automatically. And, the most important thing: It does it automatically. Also, I found a lot of bugs that I reported in the Netfilter project’s bugzilla.

tests: Add Automated regression testing.
tests: Add ip6 folder with test files.
tests: Add inet folder with test files.
tests: Add any folder with test files.
tests: Add arp folder with test files.
tests: Add bridge folder with test files.

* Refactoring and adding some improvements in the libnftnl (libnftnl is a userspace library providing a low-level netlink programming interface (API) to the in-kernel nf_tables subsystem. The library libnftnl has been previously known as libnftables).
[In this blog: XML and JSON in nftables] [All patchs were accepted in libnftnl]

* Add support in nftables tool (and in libnftnl and in kernel) to the following iptables-extension: pkttype, cpu, groupdev and phydev. (Some of these are still finishing)

[and more]

* I made my first talk in English, in The 2014 Netfilter Workshop.

* I was the first girl in a Netfilter workshop.

Plans for the future:
I’d like continue contributing to Open Source (in Netfilter project and other open-source projects) and help other women into free software development.

Thanks a lot Marina Zhurakhinskaya, Karen Sandler and Sarah Sharp for this chance. These days were amazing and I’ve learnt a lot! 🙂 I’m so happy. ….and Thanks Pablo Neira for being my mentor during this intership

Bounding devide

I need a bounding device to test the devgroup support in nft.

Update: I only need add my wlan0 device into a group. It did it with ip link.

ip link set group 100 dev eth0
$ sudo ip link list group 23
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DORMANT qlen 1000
    link/ether e0:06:e6:c6:dc:89 brd ff:ff:ff:ff:ff:ff

It’s necessary this software:

ifenslave-2.6 package to enable bonding

Interface Configuration Files:
/etc/network/interfaces file contains network interface configuration information.
We use this interface configuration file from this link

# Regardless of how our topology looks, we'll need the local interface
auto lo
iface lo inet loopback 
# Configuration basics taken from:
# Define the bonding master, which is ideally our only interface to the outside world
# - define slaves as none initially, this helps with booting faster
# - the primary line makes most sense here, but is not enough
# - set the interface check interval to 100ms
# - we activate 1 interface at a time for now, if one fails, the other takes over
auto bond0
iface bond0 inet dhcp
      bond-slaves none
      bond-mode active-backup
      bond-primary eth0
      bond-miimon 100
# Slave: wired ethernet connection port, typically our office connection
# - critical that the type is set to 'manual'
# - typically wired is the fasted connection, so make this the primary
# - the primary line seems redundant but is needed here
auto eth0
iface eth0 inet manual
       bond-master bond0
       bond-primary eth0
# Slave: the wireless connection interface
# - critical that the type is set to 'manual'
# - interface roams under control of wpa_supplicant
# - the primary line seems redundant but is needed here
# -  
# - tell the interface that packets come in over bond0 instead of wlan0
# - the wpa conf file contains network definitions and other settings.
auto wlan0
allow-hotplug wlan0
iface wlan0 inet manual
      bond-master bond0
      bond-give-a-chance 10
      bond-primary eth0
      wpa-bridge bond0
      wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

The following is a sample file for wpa supplicant


proto=WPA RSN
pairwise=CCMP TKIP

Interruptions of process

cat /proc/interrupts

0: 16 0 0 0 IO-APIC-edge timer
1: 12408 26389 1090 1189 IO-APIC-edge i8042
8: 0 1 0 0 IO-APIC-edge rtc0
9: 6035 4392 738 599 IO-APIC-fasteoi acpi
12: 17385 82984 4436 4409 IO-APIC-edge i8042
16: 4 11 1 0 IO-APIC-fasteoi ehci_hcd:usb3, mmc0
17: 148716 88599 13393 11648 IO-APIC-fasteoi rtl_pci
18: 0 0 0 0 IO-APIC-fasteoi i801_smbus
23: 4 11 1 0 IO-APIC-fasteoi ehci_hcd:usb4
40: 44920 42618 7549 8664 PCI-MSI-edge xhci_hcd
42: 47344 60559 10887 19568 PCI-MSI-edge ahci
43: 112746 1049499 51672 47390 PCI-MSI-edge i915
44: 462 399 83 237 PCI-MSI-edge
45: 1 0 0 0 PCI-MSI-edge
46: 240 3866 169 172 PCI-MSI-edge
47: 245 543 0 0 PCI-MSI-edge snd_hda_intel
49: 1 0 0 0 PCI-MSI-edge
50: 2505 47 0 0 PCI-MSI-edge eth0
NMI: 34 51 54 44 Non-maskable interrupts
LOC: 852531 447119 983786 548548 Local timer interrupts
SPU: 0 0 0 0 Spurious interrupts
PMI: 34 51 54 44 Performance monitoring interrupts
IWI: 1 0 0 0 IRQ work interrupts
RTR: 4 2 0 0 APIC ICR read retries
RES: 81435 60433 162180 136290 Rescheduling interrupts
CAL: 1139 1031 1308 1365 Function call interrupts
TLB: 37253 17301 22612 18712 TLB shootdowns
TRM: 0 0 0 0 Thermal event interrupts
THR: 0 0 0 0 Threshold APIC interrupts
MCE: 0 0 0 0 Machine check exceptions
MCP: 50 50 50 50 Machine check polls
ERR: 0

Iptables: Mostar el numero de paquetes que coinciden con una regla

iptables -t filter -L -v

(master) $ sudo iptables -t filter -L -v
Chain INPUT (policy ACCEPT 441 packets, 146K bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- any any anywhere anywhere PKTTYPE = broadcast

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 468 packets, 160K bytes)
pkts bytes target prot opt in out source destination

`PKG_CHECK_MODULES(LIBMNL, libmnl >= 1.0.0)’ error

If you are installing libnftnl and you have the following error message:

checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... no
checking for mawk... mawk
checking whether make sets $(MAKE)... yes
checking for style of include used by make... GNU
checking how to create a pax tar archive... gnutar
checking dependency style of gcc... gcc3
checking whether make supports nested variables... yes
./configure: line 3960: syntax error near unexpected token `LIBMNL,'
./configure: line 3960: `PKG_CHECK_MODULES(LIBMNL, libmnl >= 1.0.0)'

The first step is to chek the version of libmnl is installed in your system:

$ whereis libmnl
libmnl: /usr/local/lib/ /usr/local/lib/

$ sudo ldd /usr/local/lib/ => (0x00007fffcf5fd000) => /lib/x86_64-linux-gnu/ (0x00007f0c2e14b000)
/lib64/ (0x00007f0c2e6f0000)

I fixed this problem instaling the pkg-config packages. pkg-config is a system for managing library compile and link flags that works with automake and autoconf.

sudo apt-get install pkg-config


Also, It is possible to need the following packages to install nft in your system:

git, make, gcc, bc, libncurses5-dev, autoconf, autotool, libtool, gawk, libjansson-dev, docb, dblatex flex, bison, libgmp-dev, libreadline6-dev

The Netfilter User’s day in the 2014 Netfilter Workshop in Twitter

Amazing days in the 2014 Netfilter Workshop

It finished the 2014 Netfilter Workshop. It was amazing and very interesting for me. I’d been in Lyon before this was my first visit to Montpellier in France. This meeting was co-hosted by 15èmes Rencontres Mondiales du Logiciel Libre, the biggest event of free software in France with more than 300 conferences and workshops.

I arrived on Sunday 6th of July, one day before the workshop, and I visited some stands of Open source projects in the “Esplanade Charles-de-Gaulle” of the 15èmes Rencontres Mondiales du Logiciel Libre. There was a conference of Richard Stallman about the history of Free Software.

On monday, It was the Netfilter’s User day. There were a set of talks about DDoS protection using Netfilter/iptables, nft-sync, Nftables and IPS, Netfilter logging at the nftables age, Suricata IDS/IPS, Zorp and kzorp and Vuurmuur. In my opinion, the most important and interesting talk that day was “nftables: a new packet classification framework for Linux” by Pablo Neira, the maintainer of Netfilter project. Nftables is the new packet classification framework that intends to replace the existing {ip,ip6,arp,eb}_tables infrastructure. It’s the future. 🙂

Tuesday and Wednesday were the first days of the Netfilter’s developers days. They passed with interesting talks, an important debates and decision making about the Netfilter project, their projects and related technologies. Those days, we spoke about netfilter updates with a short summary on the Netfilter kernel changes since the last workshop, achievement unlocked, OVS MPLS, nftables quick hacking HOWTO, the switch-o-pocalypse, NIC’s and external switches, the challenge of 10Gbit/s wirespeed and the lessons learned from DPDK, qdisc updates and lockless FIFO, Open vSwitch with conntrack and Use of nftables from OVS. Moreover, there were time to speak about nftables project: “Nftables kernel” and “Nft from userspace” by Patrick McHardy and Pablo Neira, two of the most relevant developers of nftables project. At that time, They spoke and was a debate about what is done, what needs to be fixed/done and future things coming in nftables (in kernel space) and nft (user-space)

In the OPW, I’m working with nft, libnftln and nftables in the kernel space, so, It was the most interesting moment. I heard a very good explanation about these projects.

On Thursday, It was more talk and debates about ipset and ulogd2. Morever, It was the time for the students of Google Summer of Code and me. Arturo Borrero speak about his project nft-sync, a new userspace tool to distribute a nftables ruleset across the network. Alvaro Neira spoke about XML/JSON support for libnftnl and Giussepe Longo spoke about the compatibility layer in nft. Their talks were very good and very interesting. They were about their work around “Google Summer Of Code” period.

I spoke about one of my tasks during the OPW period: “nftables automated tests” I spoke about the motivation to do it, what is checking, options are available to run this test, the structure of the test file and the test folders. Also, I spoke about the future of the testing in nft and the next tasks to do. I was very nervous: It was my first talk in the Netfilter Workshop and in English language. It was an important challenge to me, I did it the best I could. 🙂

During these days, I talked with the developers and they gave me feedback on the importance of the test system and the expectation of the creation of this task. It hasn’t been any test system in nft tools yet.

They were amazing days. I learned a lot about development, network, linux, the kernel, hardware… and it was a landmark in Netfilter Workshop history: It was the first time that a girl are invited to this meeting and also she gave a talk.

Thanks to The Outreach Program for Women. They sponsored me the travel and the hotel during these days. Without their help, I wouldn’t have been to do it.

Here’s the group picture of the 10th Netfilter workshop which is held from July 7th to July 11th in Montpellier, France. By Eric Leblond
Netfilter workshop group picture 2014