Re: [tao-users] Corba server behind firewall/nat and clients using IIOP works with a minor problem
Phil Mesnier
Ariel Brunetto wrote:
> TAO VERSION: *1.6
> * ACE VERSION: *5.6*
>
Thanks for using the PRF! You are using an old version of TAO. The
current release, 1.7.3, may be obtained from
http://download.dre.vanderbilt.edu/ scroll down to the "latest micro
release kit."
> SYNOPSIS: *A client takes a lot of time to perform a _narrow()
> operation when the server is behind a firewall/NAT. The same piece code
> runs fine f the server is on the same network.*
>
> DESCRIPTION: *I traced the application until the method _is_a()
> inside the _narrow() method. It takes a lot of time to return when the
> server is behind a firewall/NAT. Once the object is narrowed, the
> application runs without any problems. I am using IIOP transport
> protocol. I figured that the visual studio debugger reports me a RPC
> server is unavailable exception several times in the process of narrowing. *
>
I suspect your server is creating an IOR which contains multiple
endpoints, such as one for inside the firewall and one for outside, and
that at least the one inside the firewall is expressed as a dotted
decimal address.
What is happening in your client is trying the non-routable endpoint
first, and the underlying TCP connection protocol takes a long time,
minutes, to time out in that case. Then it moves on to the next endpoint
which is the NAT and that succeeds.
There are a few ways to address this. Probably the simplest is to set up
the client to use the parallel connect strategy. On the client side, add
-ORBUseParallelConnects 1. See TAO/docs/Options.html for more info. This
requires the server to use 1 endpoint per profile, which is the default.
On the server side, you could use two ORBs, one for managing NAT
connections, the other for internal network connections. Or you can use
the EndpointPolicy to create separate object references with different
endpoints. The EndpointPolicy requires multiple POAs.
If you don't have the ability to modify the server, you can use the
Lorica firewall traversal tool. This is a separate proxy process that
can provide a single endpoint for exporting outside the firewall. It can
be used with servers that have no awareness of the proxy. Lorica is
currently available under the GPL or a fee-based proprietary license.
Contact me directly or Jules Colding at 42tools.com for more information.
Best regards,
Phil
--
Phil Mesnier
Principal Software Engineer and Partner, http://www.ociweb.com
Object Computing, Inc. +01.314.579.0066 x225
Ariel Brunetto
________________
Ariel Brunetto
www.aquadize.com
Ariel Brunetto
Ariel Brunetto
techabc
TAO VERSION: 1.6
ACE VERSION: 5.6HOST MACHINE and OPERATING SYSTEM: Intel Pentium IV 2.8, 4 GB RAM, Microsoft Windows XP SP3
TARGET MACHINE and OPERATING SYSTEM, if different from HOST: It's same from HOST
COMPILER NAME AND VERSION (AND PATCHLEVEL): Microsoft Visual C++ 2008 Version 9.030729.1 SPTHE $ACE_ROOT/ace/config.h FILE [if you use a link to a platform-
specific file, simply state which one]: I am linking to "ace/config-win32.h"THE $ACE_ROOT/include/makeinclude/platform_macros.GNU FILE [if you
use a link to a platform-specific file, simply state which one
(unless this isn't used in this case, e.g., with Microsoft Visual
C++)]:CONTENTS OF $ACE_ROOT/bin/MakeProjectCreator/config/default.features
(used by MPC when you generate your own makefiles): doesn't matterAREA/CLASS/EXAMPLE AFFECTED: CORBA::Boolean CORBA::Object::_is_a (const char *logical_type_id) method
DOES THE PROBLEM AFFECT: performance.
COMPILATION?
If so, what do your $ACE_ROOT/ace/config.h and
$ACE_ROOT/include/makeinclude/platform_macros.GNU contain?
LINKING?
On Unix systems, did you run make realclean first?
EXECUTION?
OTHER (please specify)?
[Please indicate whether ACE/TAO, your application, or both are affected.]SYNOPSIS: A client takes a lot of time to perform a _narrow() operation when the server is behind a firewall/NAT. The same piece code runs fine f the server is on the same network.DESCRIPTION: I traced the application until the method _is_a() inside the _narrow() method. It takes a lot of time to return when the server is behind a firewall/NAT. Once the object is narrowed, the application runs without any problems. I am using IIOP transport protocol. I figured that the visual studio debugger reports me a RPC server is unavailable exception several times in the process of narrowing.
REPEAT BY: Always.
SAMPLE FIX/WORKAROUND: None.I would appreciate if anybody could point me in the right direction.
Thank you very much!Ariel
_______________________________________________
tao-users mailing list
tao-...@list.isis.vanderbilt.edu
http://list.isis.vanderbilt.edu/mailman/listinfo/tao-users
Johnny Willemsen
Check TAO/docs/ORBEndpoint.html, maybe hostname_in_ior helps in your
situation.
Johnny
On 01/07/2011 08:35 AM, techabc wrote:
> hi Ariel :
> How did you deal with the server behind firewall/NAT without 42tools
> Lorica? I have difficult with it, request for help, thanks a lot.
>
> 2009/9/26 Ariel Brunetto <abru...@gmail.com <mailto:abru...@gmail.com>>
>
> TAO VERSION: *1.6
> * ACE VERSION: *5.6*
>
> HOST MACHINE and OPERATING SYSTEM: *Intel Pentium IV 2.8, 4 GB
> RAM, Microsoft Windows XP SP3*
>
> TARGET MACHINE and OPERATING SYSTEM, if different from HOST:
> It's same from HOST
> COMPILER NAME AND VERSION (AND PATCHLEVEL): *Microsoft Visual
> C++ 2008 Version 9.030729.1 SP*
>
> THE $ACE_ROOT/ace/config.h FILE [if you use a link to a platform-
> specific file, simply state which one]: *I am linking to
> "ace/config-win32.h"*
>
> THE $ACE_ROOT/include/makeinclude/platform_macros.GNU FILE [if you
> use a link to a platform-specific file, simply state which one
> (unless this isn't used in this case, e.g., with Microsoft Visual
> C++)]:
>
> CONTENTS OF $ACE_ROOT/bin/MakeProjectCreator/config/default.features
> (used by MPC when you generate your own makefiles): *doesn't matter*
>
> AREA/CLASS/EXAMPLE AFFECTED: CORBA::Boolean CORBA::Object::_is_a
> (const char *logical_type_id) method
>
> DOES THE PROBLEM AFFECT: *performance.
> * COMPILATION?
> If so, what do your $ACE_ROOT/ace/config.h and
> $ACE_ROOT/include/makeinclude/platform_macros.GNU contain?
> LINKING?
> On Unix systems, did you run make realclean first?
> EXECUTION?
> OTHER (please specify)?
> [Please indicate whether ACE/TAO, your application, or both are
> affected.]
>
> SYNOPSIS: *A client takes a lot of time to perform a _narrow()
> operation when the server is behind a firewall/NAT. The same piece
> code runs fine f the server is on the same network.*
>
> DESCRIPTION: *I traced the application until the method _is_a()
> inside the _narrow() method. It takes a lot of time to return when
> the server is behind a firewall/NAT. Once the object is narrowed,
> the application runs without any problems. I am using IIOP
> transport protocol. I figured that the visual studio debugger
> reports me a RPC server is unavailable exception several times in
> the process of narrowing. *
>
> REPEAT BY: *Always.*
>
> SAMPLE FIX/WORKAROUND: *None.
> *
> I would appreciate if anybody could point me in the right direction.
>
> Thank you very much!
> Ariel
>
> _______________________________________________
> tao-users mailing list
> tao-...@list.isis.vanderbilt.edu
> <mailto:tao-...@list.isis.vanderbilt.edu>
> http://list.isis.vanderbilt.edu/mailman/listinfo/tao-users
Phil Mesnier
> hi Ariel :
> How did you deal with the server behind firewall/NAT without 42tools
> Lorica? I have difficult with it, request for help, thanks a lot.
>
I'm glad to see someone is using Lorica, or trying to, at least.
> 2009/9/26 Ariel Brunetto <abru...@gmail.com <mailto:abru...@gmail.com>>
>
> TAO VERSION: *1.6
> * ACE VERSION: *5.6*
>
Thanks for the PRF.
> SYNOPSIS: *A client takes a lot of time to perform a _narrow()
> operation when the server is behind a firewall/NAT. The same piece
> code runs fine f the server is on the same network.*
>
> DESCRIPTION: *I traced the application until the method _is_a()
> inside the _narrow() method. It takes a lot of time to return when
> the server is behind a firewall/NAT. Once the object is narrowed,
> the application runs without any problems. I am using IIOP
> transport protocol. I figured that the visual studio debugger
> reports me a RPC server is unavailable exception several times in
> the process of narrowing. *
>
It sounds like your server is publishing an IOR that has both internal
(lan-only) and firewall-traversing endpoints. Johnny's suggestion is
important but not sufficient. I suspect you are already using the
hostname_in_IOR technique to get the externally accessible endpoint.
The problem is the server puts all of these endpoints into a single IOR,
and the client has to iterate over the list of endpoints until it finds
one it can use.
TAO does have a feature that will get you better performance in this
situation. On your server, you need to use the command line option:
-ORBUseSharedProfiles 1
This causes the server to create a single profile in the IOR with a
primary and alternate addresses. By default, TAO will use separate
profiles for each endpoint.
Second, on your clients, at least the ones outside the firewall, you
need to add:
-ORBUseParallelConnects 1
This causes the client to try opening a connection to the primary and
all alternate endpoints simultaneously, an use the first one to complete.
Good luck,
techabc
techabc
Phil Mesnier
Is Ariel Brunetto and techabc the same person?
On 01/07/2011 07:20 AM, techabc wrote:
> I do my application just as you said, thank you.
> but, my problem is:
> I start the naming service behind the firewall/NAT with hostname_in_IOR
> technique, in this case, the outside can successfuly access the server,
> but the indise failed.
Ok, you have to use two -ORBListenEndpoint arguments for the server, one
with hostname_in_IOR so that the outside clients can reach, and one
without that, for inside clients.
I assumed you were doing that since you said the outside client
eventually connected, but just after a long time.
With the two endpoints, you also need to add -ORBUseSharedProfiles 1 to
have both endpoints in the same profile. Finally, the
-ORBUseParallelConnects 1 on the clients will make sure they connect as
quickly as possible to the correct endpoint.
Of course for your outside facing endpoint, you need to make sure your
firewall is configured to forward connections correctly. Note there is
no port aliasing available in TAO, so if the firewall has port 12345
opened, your server has to listen to port 12345.
techabc
If I according your suggests, it works well.
Phil Mesnier
techabc wrote:
> Thank you very much to help me.
> I am techabc, NOT Ariel~
>
OK, that's what I thought, but given the similarity of problem
descriptions, I got confused.
> I start the server with iiop://0.0.0.0/port/hostname_in_IOR=natIP,
> so I got the above result.
That you can either connect locally, or connect remotely, but not both?
> If I according your suggests, it works well.
So you've verified the parallel connects feature. Good.
> But, I would like to perform a default way(iiop://0.0.0.0) to fits
> the general sence(without firewall/NAT, but with mutiple IP address
> in a server), and only modify config to the special sence(with
> firewall/NAT).
I don't quite understand. You want the behavior of the parallel connect
feature without using the -ORB options? You can do that by rebuilding
libTAO with the default state for -ORBUseParallelConnects and
-ORBUseSharedProfiles to 1. The OCI distribution of TAO already uses
shared profiles by default, but you can set these by changing the
default values in TAO/tao/ORB_Core.cpp. If you would like to open a
support contract with OCI, we can work with you on this.
Alternatively, you brought up Lorica in your initial email. This is just
the sort of problem that tool was designed to resolve. I have contacted
our original customer for Lorica, 42tools.com. They are no longer in
business, but Lorica is still available under the terms of GPLv3 for
free, or a fee-based commercial license. I can set up a download site on
ociweb.com hosting the source, but I need to get clarification from the
current license holder about its commercial use.
With Lorica, you register your service with the tool using a local-only
IOR, to get an external-access IOR that can be published outside the
firewall.
There is some configuration required to make this all work, but its not
too complicated.
> I start the server with both
> iiop://192.168.10.10/port/hostname_in_IOR=natIP iiop://0.0.0.0:port,
> but the client can NOT connect to the server follow an unknown
> exception.
>
Which client, what exception?
techabc
That you can either connect locally, or connect remotely, but not both?I start the server with iiop://0.0.0.0/port/hostname_in_IOR=natIP, so I got the above result.
So you've verified the parallel connects feature. Good.If I according your suggests, it works well.
I don't quite understand. You want the behavior of the parallel connect feature without using the -ORB options? You can do that by rebuilding libTAO with the default state for -ORBUseParallelConnects and -ORBUseSharedProfiles to 1. The OCI distribution of TAO already uses shared profiles by default, but you can set these by changing the default values in TAO/tao/ORB_Core.cpp. If you would like to open a support contract with OCI, we can work with you on this.
But, I would like to perform a default way(iiop://0.0.0.0) to fits
the general sence(without firewall/NAT, but with mutiple IP address
in a server), and only modify config to the special sence(with
firewall/NAT).
Alternatively, you brought up Lorica in your initial email. This is just the sort of problem that tool was designed to resolve. I have contacted our original customer for Lorica, 42tools.com. They are no longer in business, but Lorica is still available under the terms of GPLv3 for free, or a fee-based commercial license. I can set up a download site on ociweb.com hosting the source, but I need to get clarification from the current license holder about its commercial use.
With Lorica, you register your service with the tool using a local-only IOR, to get an external-access IOR that can be published outside the firewall.
There is some configuration required to make this all work, but its not too complicated.
Which client, what exception?I start the server with both
iiop://192.168.10.10/port/hostname_in_IOR=natIP iiop://0.0.0.0:port,
but the client can NOT connect to the server follow an unknown
exception.
Phil Mesnier
> I means that:
> what is the diffrence when start with
OK, so here's what the various combinations suggest:
> 1) none IP, none Other: "iiop://..."
TAO will use the locally defined hostname, as fully qualified as
possible in the IOR. If you also provide -ORBDottedDecimalAdresses 1 on
the command line, it will enumerate all available interfaces as IP
addresses, excluding localhost. If built with IPv6 support enabled, both
IPv4 and IPv6 addresses will be included.
When you use -ORBDottedDecimalAdresses 1 on a host with multiple
interfaces and your TAO is generating separate profiles for each
address, your IOR will contain multiple profiles, each with a single IP
address. If you are using shared profiles, using the
-ORBUseSharedProfiles 1 option, you will have a single profile with one
primary IP address in the profile, and the rest enumerated as alternate
addresses in a tagged component.
> 2) only IP is 0.0.0.0 : "iiop://0.0.0.0/.. <http://0.0.0.0/..>."
This is similar to 1) except that only IPv4 addresses will be enumerated
even if IPv6 is supported by your TAO.
> 3) 0.0.0.0 and other special IP(special followed the 0.0.0.0) :
> "iiop://0.0.0.0/. <http://0.0.0.0/.>.. iiop://192.168.10.11/.
> <http://192.168.10.11/.>.. "
> 4) 0.0.0.0 and other special IP(0.0.0.0 followed the special) :
> "iiop://192.168.10.11/. <http://192.168.10.11/.>.. iiop://0.0.0.0/.
> <http://0.0.0.0/.>.. "
> 5) none 0.0.0.0, all is special IP : "iiop://192.168.10.11/.
> <http://192.168.10.11/.>.. iiop://192.168.11.11/.
> <http://192.168.11.11/.>.. "
>
In these cases, the multiple endpoint definitions trigger the creation
of multiple listen sockets, each with a distinct port number, but with
an IP address or hostname as given in the endpoint definition.
I suggest you try using each of these various combinations, and observe
the result by writing the generated IOR to a file, then examining the
file using the tao_catior utility.
> Alternatively, you brought up Lorica in your initial email. This is
> just the sort of problem that tool was designed to resolve. I have
> contacted our original customer for Lorica, 42tools.com
> <http://42tools.com>. They are no longer in business, but Lorica is
> still available under the terms of GPLv3 for free, or a fee-based
> commercial license. I can set up a download site on ociweb.com
> <http://ociweb.com> hosting the source, but I need to get
> clarification from the current license holder about its commercial use.
>
> With Lorica, you register your service with the tool using a
> local-only IOR, to get an external-access IOR that can be published
> outside the firewall.
>
> There is some configuration required to make this all work, but its
> not too complicated.
>
> Nice things! I hope this would be as soon as possible.
As I said above, a support contract can make this happen. OCI is a
for-profit company, and while the software is free (gratis, libre) our
effort is not. We don't mind answering questions, as I've been doing,
but unfortunately things that require effort or resources need funding.
I would be happy to speak with you directly about your options and
specific needs.
>
> I start the server with both
> iiop://192.168.10.10/port/hostname_in_IOR=natIP
> <http://192.168.10.10/port/hostname_in_IOR=natIP>
> iiop://0.0.0.0:port,
> but the client can NOT connect to the server follow an unknown
> exception.
>
>
> Which client, what exception?
>
> the exception detail is :
>
> system exception, ID 'IDL:omg.org/CORBA/TRANSIENT:1.0
> <http://omg.org/CORBA/TRANSIENT:1.0>'
> OMG minor code (2), described as '*unknown description*', completed = NO
>
Which client is getting this exception, an internal one, or an external one?
Your example isn't clear, in that you suggest 2 endpoints, but you use
"port" in both. Assuming that you really use 2 port numbers, say 12345
and 23456 like this:
-ORBListenEndpoints iiop://192.168.10.10:12345/hostname_in_IOR=natIP
-ORBListenEndpoints iiop://0.0.0.0:23456
you will end up with at least 2 profiles in your IOR, the first listing
its endpoint address as "natIP:12345" so your natting firewall needs to
be listening to port 12345 and forwarding requests to 192.168.10.10:12345
Note that if you are literally using a slash to separate the IP address
and port number as you show above you ought to be getting a runtime
error in your server.
Again, use tao_catior to decompose the generated IOR to see exactly what
is being generated.
techabc
Ariel Brunetto
I have a little question about the same subject. I am already using hostname_in_ior and I am running my corba server with multiple listening endpoints:
ImR: Successfully activated <DataManager> at
corbaloc:iiop:1...@fuzion.com.ar:5001,iiop:1...@192.168.2.128:5001,iiop:1...@192.168.106.1:5001,iiop:1...@192.168.183.1:5001/
ImR: Forwarding invocation on <DataManager> to <corbaloc:iiop:1...@fuzion.com.ar:5001,iiop:1...@192.168.2.128:5001,iiop:1...@192.168.106.1:5001,iiop:1...@192.168.
183.1:5001/DataManager>
As you can see I am using Implementation Repository. What I am trying to do is to provide internal and external server reachability using multiples profiles. My setup does the work but I have a little problem, the timeout. I mean, when an internal network host tries to reach <DataManager> it tries through the following <corbaloc:iiop:1...@fuzion.com.ar:5001,iiop:1...@192.168.2.128:5001,iiop:1...@192.168.106.1:5001,iiop:1...@192.168.
183.1:5001/DataManager>. It wants to reach through 192.168.2.128, and it must wait fuzion.com.ar timeout.
I am using ORBUseParallelConnects 1 but I receive the same resutls. The invocation iterates through <corbaloc:iiop:1...@fuzion.com.ar:5001,iiop:1...@192.168.2.128:5001,iiop:1...@192.168.106.1:5001,iiop:1...@192.168.
183.1:5001/DataManager> to reach an appropiate IOR. I want to try all at once (parallel connects), but I am using TAO IMR so I supposed that could be the problem.
Thanks in advance!
Ariel
_______________________________________________
tao-users mailing list
tao-...@list.isis.vanderbilt.edu
http://list.isis.vanderbilt.edu/mailman/listinfo/tao-users
Phil Mesnier
> Hi Phill,
>
> First of all thank you for your reply. I am sending a PRF to the TAO
> list right now. I am doing serious debugging over TAO IMR and I reached
> some conclusions that I want to share with you.
> I will continue the discussion over the list.
>
Right. I had intended my response to go to the list too, I didn't
realize I sent just to you.
> Regards,
> Ariel
>
> On Wed, Mar 30, 2011 at 12:41 AM, Phil Mesnier <mesn...@ociweb.com
> <mailto:mesn...@ociweb.com>> wrote:
>
> Ariel Brunetto wrote:
>
> Hi Phill and folks!,
>
> I have a little question about the same subject. I am already
> using hostname_in_ior and I am running my corba server with
> multiple listening endpoints:
>
>
> Hi Ariel,
>
> Can you send a new PRF so I have the context?
>
> 183.1:5001/DataManager>. It wants to reach through
> 192.168.2.128, and it must wait fuzion.com.ar
> <http://fuzion.com.ar> <http://fuzion.com.ar> timeout.
>
>
> OK.
>
> I am using ORBUseParallelConnects 1 but I receive the same
> resutls. The invocation iterates through
> <corbaloc:iiop:1...@fuzion.com.ar:5001
> <http://corbaloc:iiop:1...@fuzion.com.ar:5001>
> <http://corbaloc:iiop:1...@fuzion.com.ar:5001>,iiop:1...@192.168.2.128:5001
> <http://iiop:1...@192.168.2.128:5001>
> <http://iiop:1...@192.168.2.128:5001>,iiop:1...@192.168.106.1:5001
> <http://iiop:1...@192.168.106.1:5001>
> <http://iiop:1...@192.168.106.1:5001>,iiop:1...@192.168.
>
> 183.1:5001/DataManager> to reach an appropiate IOR. I want to
> try all at once (parallel connects), but I am using TAO IMR so I
> supposed that could be the problem.
>
>
> Parallel connects work on all the endpoints within a single profile.
> This constraint was added so that it would work properly in light of
> group IORs used for load balancing.
>
> By default, DOC group TAO servers with multiple endpoints create
> IORs with multiple profiles, one per endpoint. On your server, you
> can pass -ORBUseSharedProfile 1 to the server to create a single
> profile with multiple alternate addresses.
>
> Note that OCI's TAO defaults to multiple endpoints per profile.
>
> -Phil
>
>
> --
> Phil Mesnier
> Principal Software Engineer and Partner, http://www.ociweb.com
> Object Computing, Inc. +01.314.579.0066 x225
>
>
>
>
> --
> ________________
> Ariel Brunetto
> www.aquadize.com <http://www.aquadize.com>
Johnny Willemsen
>> By default, DOC group TAO servers with multiple endpoints create
>> IORs with multiple profiles, one per endpoint. On your server, you
>> can pass -ORBUseSharedProfile 1 to the server to create a single
>> profile with multiple alternate addresses.
>>
>> Note that OCI's TAO defaults to multiple endpoints per profile.
FYI, the DOC group doesn't defaults to multiple endpoints per profile
because that breaks RTCORBA on a multihomed system. RTCORBA needs some
improvements to support this in all cases.
Johnny
Phil Mesnier
Hi Johnny,
That's correct, and that's fine, that's why we have options. In OCI's
case, we had customers deploying on MH systems that wanted the shared
profile feature so that's why we enable it by default. I think this is
one of the only feature differences between default OCI and DOC TAO.
