Subject: appletalk over tcp/ip CRASH my TCP/IP stack on linux redhat 7.2

From: Damien MATTEI <[email-masked]>
Date: Mon, 14 Jan 2002 10:10:29 +0000

i had a problem with transferring big files (>5Mb) from old macs power
pc 8200-9600 with appletalk over tcp/ip (port 548) to a new pentium 4
1.6 Ghz running linux redhat 7.2. Netatalk wasn't shipped with 7.2 and i
download the 7.1 version from redhat, but that's not the problem.
Things were OK with imac,g3,old g4,g4 cube,and when try with power pc it
begin transferring the big file and blocked, all users were
disconnected,and looking on the server show that i had no more internet
connection, i had to restart network services to bring up again the
interfaces. (/etc/rc.d/init.d/network restart)
Finally i find out that the problem was coming from afpovertcp with some
old macs and all the things go better.
My solution was recompiling a kernel with firewalling options (ipchains)
and REJECT afpovertcp coming from old macs, so the macs use simply
appletalk (ddp not afpovertcp) and the transfer of big files is a little
slower but works fine on the both sides), g3 and g4 users can use fast
afp over tcp transfer,and old macs users can transfer
 big files with no problems.
technically speaking,the firewall configuration looks like that:
ipchains -A input -s 134.59.51.56 -p tcp --destination-port 548 -j
REJECT
ipchains -A input -s 134.59.51.53 -p tcp --destination-port 548 -j
REJECT
/sbin/ipchains -L input
Chain input (policy ACCEPT):
target     prot opt     source                destination          
ports
REJECT     tcp  ------  mac5153.unice.fr     anywhere              any
->   afpovertcp
REJECT     tcp  ------  mac5156.unice.fr     anywhere              any
->   afpovertcp
finally i save the firewalling options in a file:
ipchains-save > /etc/my_firewall
and add a few lines in the /etc/rc.d/init.d/network file to be sure that
firewalling is active at each boot:
if [ -f /etc/my_firewall ]; then
        /sbin/ipchains-restore < /etc/my_firewall
    fi
note about difference between REJECTING and DENYING afpovertcp:
if you simply DENY the packets the old macs loop endlessly trying to
connect until the user stop by clicking on a button and then fall back
to appletalk, but when you REJECT packets the server send an ICMP
(Internet control message protocol) message to the mac saying that the
port is unreachable,and the mac use immediately simple appletalk,so
users see nothing at all.

if someone have already meet this problem or have a more simple
solution,i will be happy to know it.
-- 
MATTEI Damien					Phone: +33 (0)4 93 37 76 66
C.N.R.S / U.N.S.A				Fax:   +33 (0)4 93 53 30 71
UMR 6549 Instabilite & Alterations des Genomes	E-mail: [email-masked]
Faculte de Medecine - Avenue de Valombrose - 06107 NICE Cedex 2 - France

---

From: Thomas Kaiser <[email-masked]>
Date: Mon, 14 Jan 2002 10:40:19 +0100

On Mon, 14 Jan 2002 10:10:29 +0000, Damien MATTEI wrote:

> Netatalk wasn't shipped with 7.2 and i download the 7.1 version from redhat,
> but that's not the problem.

Which version is included in 7.1? Have you tried the recent 1.5.0 from
Sourceforge, too? Maybe those problems have been addressed meanwhile?

> Things were OK with imac,g3,old g4,g4 cube,and when try with power pc it begin
> transferring the big file and blocked, all users were disconnected,

Were there any messages in the system's log?

> [...]
> to appletalk, 

The AppleShare client on Macs tries this as long as it is configured for
('TCP Lookup Timeout' value). You can adjust this value with Apple's
'AppleShare Client Setup':

<http://users.phg-online.de/tk/netatalk/AppleShareClientSetup.gif>

> [...] a more simple solution [...]

Hmm... If you just want to force those machines to connect via AppleTalk,
then you could set up the same shares with two different "server" entries in
afpd.conf (one with -notcp option). Or you use the -fqdn switch in afpd.conf
and force the older clients to do a wrong lookup on this address. Combined
with the "Verify TCP Address with Ping" option, this will also cause a
direct fallback to AppleTalk. But the last alternative is only working with
AppleShare clients 3.8.3 or above and is obviously not very smart.

I would prever to give netatalk 1.5 a try :-)

Regards,

Thomas

PS: RPMs for AFAIK RedHat 7.2 are available from here for example:
    <http://kraftwerk.adsl.dk/netatalk/>

---

From: Damien MATTEI <[email-masked]>
Date: Mon, 14 Jan 2002 12:49:14 +0000

> Sourceforge, too? Maybe those problems have been addressed meanwhile?
the version is netatalk-1.5pre2 from official linux redhat web site,i
don't want to make my users beta tester of sourceforge :-)
> Were there any messages in the system's log?
of course they are:
Jan 10 09:55:59 pclgmch1 afpd[1248]: login dmattei (uid 500, gid 500)
Jan 10 09:56:37 pclgmch1 kernel: eth0: Promiscuous mode enabled.
Jan 10 09:56:37 pclgmch1 kernel: eth0: Promiscuous mode enabled.
Jan 10 09:56:59 pclgmch1 atalkd[1064]: as_timer gateway 401.1 down
Jan 10 09:56:59 pclgmch1 atalkd[1064]: rtmp_free: 401-410
Jan 10 09:56:59 pclgmch1 atalkd[1064]: rtmp_replace 411-420
Jan 10 09:56:59 pclgmch1 atalkd[1064]: rtmp_replace 421-430
Jan 10 09:56:59 pclgmch1 atalkd[1064]: rtmp_replace 431-440
Jan 10 09:56:59 pclgmch1 atalkd[1064]: rtmp_replace 441-450
Jan 10 09:56:59 pclgmch1 atalkd[1064]: rtmp_replace 451-460
Jan 10 09:56:59 pclgmch1 atalkd[1064]: rtmp_replace 461-470
Jan 10 09:57:29 pclgmch1 atalkd[1064]: as_timer gateway 401.1 down
Jan 10 09:57:29 pclgmch1 atalkd[1064]: rtmp_free: 411-420
Jan 10 09:57:29 pclgmch1 atalkd[1064]: rtmp_free: 421-430
Jan 10 09:57:29 pclgmch1 atalkd[1064]: rtmp_free: 431-440
Jan 10 09:57:29 pclgmch1 atalkd[1064]: rtmp_free: 441-450
Jan 10 09:57:29 pclgmch1 atalkd[1064]: rtmp_free: 451-460
Jan 10 09:57:29 pclgmch1 atalkd[1064]: rtmp_free: 461-470
Jan 10 09:57:29 pclgmch1 atalkd[1064]: as_timer last gateway down
at this point i have no more TCP/IP services !
401.1 is the Router:
nbplkup
...
PORT_401.1:FORE Router                        401.1:2
...
> <http://users.phg-online.de/tk/netatalk/AppleShareClientSetup.gif>
where is this control panel ? i haven't this control panel on the 'old
macs', anyway, i haven't access to all the mac of the tower we are.
> afpd.conf (one with -notcp option). 
i already use this option but this force all the Mac to not use
appletalk over tcp, even the recent ones.
if i make two server one for old macs , users will see 2 servers ,if
they choose the wrong
my network is down... it's not very smart as you say :-)
>Or you use the -fqdn switch in afpd.conf

---

From: Thomas Kaiser <[email-masked]>
Date: Mon, 14 Jan 2002 13:30:26 +0100

On Mon, 14 Jan 2002 12:49:14 +0000, Damien MATTEI wrote:

> Thomas Kaiser wrote:
>> 
>> [...] Have you tried the recent 1.5.0 from Sourceforge, too? Maybe those
>> problems have been addressed meanwhile?

Good lord! RedHat made you already an early beta tester as they included a
1.5*PRE*2 into their distribution! 1.5.0 is released now (latest PRE-version
was 1.5pre9!), compiles pretty well and many bugs have been fixed (details:
<http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/netatalk/netatalk/ChangeLog?
rev=1.127&content-type=text/vnd.viewcvs-markup>)

Don't trust your distribution in these things! (Same with eg. SuSE: netatalk
in 7.3 is built with enable-cnid!)

BTW: Did you realize that netatalk isn't a commercial tool (and you pay a
company for doing beta-testing and so on)? Who should do testing, if not we
-- the end users, who benefit from this OpenSource project?

> Jan 10 09:56:37 pclgmch1 kernel: eth0: Promiscuous mode enabled.

Why do you put your interface in promisc mode?

> at this point i have no more TCP/IP services !

And no AppleTalk too, it seems. The interface died completely? Which type of
NIC are you using in your server?

> where is this control panel ?

It is a separate unsupported utility from Apple. I believe it has been
removed from the official Apple websites, but you can search the web for:
<http://versiontracker.com/mp/new_search.m?productDB=mac&mode=Quick&OS_Filte
r=MacOS&search=AppleShare+Client+Setup>

Regards,

Thomas

---

From: Magnus Stenman <[email-masked]>
Date: Mon, 14 Jan 2002 18:02:08 +0100

> rev=1.127&content-type=text/vnd.viewcvs-markup>)

good lord?

this was redhat 7.1, released early 2001, so it's not that strange
that 1.5.0 wasn't included...

You can find recent RPMs here:
ftp://ftp.falsehope.net/home/tengel/netatalk/

/magnus

...

---

From: Thomas Kaiser <[email-masked]>
Date: Mon, 14 Jan 2002 18:26:30 +0100

> that 1.5.0 wasn't included...

Of course.

I spoke about the fact, that people trust the 'beta' their linux distro
included with his packages more than the final version.

I always thought only SuSE tends to distribute early pre-releases of
netatalk. Obviously others do the same.

Regards,

Thomas