From Fedora Project Wiki

< QA

m (Pavlix moved page QA/IPv6 to QA/Networking: The project is not entirely IPv6 specific.)
No edit summary
Line 14: Line 14:


* [https://bugzilla.redhat.com/showdependencytree.cgi?id=883152 Bugzilla tickets]
* [https://bugzilla.redhat.com/showdependencytree.cgi?id=883152 Bugzilla tickets]
== Name resolution (using libc functions) ==
Name resolution features are provided by the GNU C Library (glibc) which is not yet ready for proper IPv6 and dual-stack operation as you can see when performing your tests. The C library comes with its own testing tool <code>getent</code> that has a special database called <code>ahosts</code> that runs <code>getaddrinfo()</code>, the library function that translates names to objects with addressing information. For your testing it is best used together with tools like <code>strace</code>, <code>ltrace</code> or even <code>gdb</code> so that you know exactly what is happening behind the scenes.
As the <code>getent</code> tool is very primitive, we created a tool called <code>getaddrinfo</code> just as the library function that handles a larger subset of the function's API.
=== Name resolution input ===
When application requests addressing information for a hostname with an optional service name, the library returns a list of addressing information objects. The order of objects in the list is significant and depends on operating system configuration and connectivity.
==== From the application ====
* nodename
* servname
* protocol
* socktype
* flags
** <code>AI_CANONNAME</code>
** ...
==== From local configuration and connectivity checks ====
* Files in <code>/etc/</code> including nsswitch, hosts, services and more
* To what extend is IPv4 and IPv6 available
==== From the outside world ====
* DNS information
* Multicast DNS information
* LDAP information
=== Name resolution processing ===
==== What is requested ====
Not all information is requested at all times. Some information like canonical name must be explicitly requested by the application via <code>AI_CANONNAME</code> flag. It may be desirable to suppress other requests by local configuration or connectivity checks, a notable example being suppression of DNS AAAA queries on hosts without global connectivity.
==== What is passed to the application ====
Not all information that is learnt via requests is presented to the application. It is typically filtered according to input from the application. It is sometimes also filtered according to connectivity checks but that has caused more problems than improvements.
==== How it is sorted ====
There are rules for sorting addressing information returned by <code>getaddrinfo()</code>. One of the basic features is to return global IPv6 destinations before global IPv4 destinations. But when the library detects that IPv6 connectivity is not available, the reverse applies.
=== Example tests ===
==== Dual-stack host, destination with global IPv4 and IPv6 ====
On a host with IPv4 and IPv6 connectivity we request addressing information of another host that is announced as dual-stack in DNS.
<pre>
$ getent ahosts www.nix.cz
2a02:38::1001  STREAM info.nix.cz
2a02:38::1001  DGRAM 
2a02:38::1001  RAW   
195.47.235.3    STREAM
195.47.235.3    DGRAM 
195.47.235.3    RAW
</pre>
You can see that <code>getaddrinfo()</code> returned ''six'' items for ''two'' unique IP addresses with the IPv6 address sorted first. If you only expected only ''two'' items, one for each IP address, see [https://sourceware.org/bugzilla/show_bug.cgi?id=14990 upstream bug 14990].
==== IPv4-only host, destination with global IPv4 and IPv6 ====
We do the same on a host without IPv6 connectivity.
<pre>
$ getent ahosts www.nix.cz
195.47.235.3    STREAM info.nix.cz
195.47.235.3    DGRAM 
195.47.235.3    RAW   
2a02:38::1001  STREAM
2a02:38::1001  DGRAM 
2a02:38::1001  RAW   
</pre>
You can see that the result is the same as before except that IPv4 is sorted first.
== Name resolution (using netresolve) ==
There is an experimental package called netresolve (TODO: not yet in Fedora) that consists of a library somewhat similar to the glibc name resolution API implementation and a set of debugging tools. Any application using libc API and a couple of other APIs can be run using <code>wrapresolve</code> to use the netresolve implementation instead and benefit from some advanced features and more extensive debugging. When using the <code>libc</code> backend, netresolve can be also used to test the glibc implementation. With the <code>nss</code> backend it can be used to test glibc nsswitch backends directly.
<pre>
$ ./netresolve --node www.nix.cz
response netresolve 0.0.1
name info.nix.cz
ip 2a02:38::1001 any any 0 0 0 21599
ip 195.47.235.3 any any 0 0 0 12589
</pre>
You can see that <code>netresolve</code> behaves slightly different than <code>getent ahosts</code> and it by default returns one item per IP address. But you can easily tweak it to behave the same way.
<pre>
$ ./netresolve --node www.nix.cz --service ''
response netresolve 0.0.1
name info.nix.cz
ip 2a02:38::1001 stream tcp 0 0 0 21021
ip 2a02:38::1001 dgram udp 0 0 0 21021
ip 2a02:38::1001 raw any 0 0 0 21021
ip 195.47.235.3 stream tcp 0 0 0 12592
ip 195.47.235.3 dgram udp 0 0 0 12592
ip 195.47.235.3 raw any 0 0 0 12592
</pre>
Note that <code>netresolve</code> is both the name of the command and the name of the library. The above tests are done using the command but the same results would be given to an application using the library. Unless you explicitly request, netresolve uses its internal name resolution modules and not the libc functions.


== Tools ==
== Tools ==

Revision as of 13:53, 6 October 2015

Testing IPv6 support and dualstack networking can be very tricky. The purpose of this document is to provide a live resource on testing situations arising from existance and usage of two network layer protocols.

How to prepare test environment:

How to test different types of packages:

Known issues:

Tools

To be merged into section Packages...

Tools with issues:

Packages

Packages that are expected to play well with IPv6

Following packages play more or less well with IPv6. You can still expect minor issues including delays when configuration of one of the protocols doesn't work as expected. Those packages are still to be tested.

Network configuration:

  • dhcp – Dynamic host configuration protocol software
  • iproute – Advanced IP routing and network device configuration tools
  • NetworkManager – Network connection manager and user applications
  • dnssec-trigger – NetworkManager plugin to update/reconfigure DNSSEC resolving

Server software:

  • bind – The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
  • dnsmasq – A lightweight DHCP/caching DNS server
  • httpd – Apache HTTP Server
  • openssh – An open source implementation of SSH protocol versions 1 and 2

Other:

  • curl – A utility for getting files from remote servers (FTP, HTTP, and others)
  • cyrus-imapd – A high-performance mail server with IMAP, POP3, NNTP and SIEVE support
  • c-ares – A library that performs asynchronous DNS operations
  • firefox – Mozilla Firefox Web browser
  • libssh2 – A library implementing the SSH2 protocol
  • iptables – Tools for managing Linux kernel packet filtering capabilities

Packages with broken or incomplete IPv6 support

Core system:

  • avahi – Local network service discovery
    • IPv6 turned off by default
    • nss-mdns doesn't do IPv6LL due to glibc limitations
  • glibc – The GNU libc libraries

Core tools:

Development:

Packages that are intended for IPv4-only operation

Following packages do not need any IPv6 testing as they contain IPv4 specific tools.

  • arptables
  • arpwatch

Notable packages to be tested for IPv6 support

Following packages weren't categorized yet but are considered important enough to be checked for IPv6 support. Please extend the list with other high visibility packages.

Core system:

  • abrt – Automatic bug detection and reporting tool
  • anaconda – Graphical system installer
  • apr – Apache Portable Runtime library
  • busybox – Statically linked binary providing simplified versions of system commands
  • docker – Automates deployment of containerized applications
    • IPv6 in /etc/resolv.conf
    • IPv6 on bridged networks
  • dracut – Initramfs generator using udev
  • firewalld – A firewall daemon with D-BUS interface providing a dynamic firewall
  • glib2/glib-networking – Networking support for GLib
  • grub2 – Bootloader with support for Linux, Multiboot and more
  • systemd – A System and Service Manager
  • yum – RPM package installer/updater/manager

Services:

  • bird – routing daemon
  • cups – Common Unix Printing System
  • dovecot – Secure imap and pop3 server
  • openswan/libreswan/strongswan – IPSEC implementation with IKEv1 and IKEv2 keying protocols
  • postfix – Postfix Mail Transport Agent
  • quagga – Routing daemon
  • sendmail – A widely used Mail Transport Agent (MTA)

Development:

  • bzr – Friendly distributed version control system
  • cvs – Concurrent Versions System
  • gdb – A GNU source-level debugger for C, C++, Fortran and other languages
  • mercurial – Mercurial – a distributed SCM

Other:

  • apr-util – Apache Portable Runtime Utility library
    • various networking tools including ping
  • gvfs – Backends for the gio framework in GLib
  • ipxe – A network boot loader
  • iptstate – A top-like display of IP Tables state table entries
  • ldns – Low–level DNS(SEC) library with API
  • lftp – A sophisticated file transfer program
  • libevent
  • libvirt – Library providing a simple virtualization API
  • net-tools – Basic networking tools
  • nmap – Network exploration tool and security scanner
  • nss-myhostname – glibc plugin for local system host name resolution
  • nss – Network Security Services
  • postgresql – PostgreSQL client programs
  • rsync – A program for synchronizing files over a network
  • squid – The Squid proxy caching serverb
  • sssd – System Security Services Daemon
  • syslinux – Simple kernel loader which boots from a FAT filesystem
  • tcpdump – A network traffic monitoring tool
  • telnet – The client program for the Telnet remote login protocol
  • traceroute – Traces the route taken by packets over an IPv4/IPv6 network
  • vinagre – VNC client for GNOME
  • vino – A remote desktop system for GNOME
  • virt-manager – Virtual Machine Manager
  • virt-viewer – Virtual Machine Viewer
  • wireshark – Network traffic analyzer
Retrieved from "https://fedoraproject.org/w/index.php?title=QA/Networking&oldid=423653"