CentOS 7 firewalld and iptables firewall setup allow multicast traffic

CentOS 7 remove firewalld and enable iptables.service

1. 關閉及停止使用 Firewalld:
systemctl status firewalld
systemctl disable firewalld (Loaded: loaded, Active: active)
systemctl mask firewalld (Loaded: masked, Active: active)
systemctl stop firewalld (Loaded: masked, Active: inactive)
sudo reboot -h now

2. 安裝 iptables
yum install iptables-services

3. 啟動及設定開機執行 iptables
systemctl status iptables.service
systemctl enable iptables
systemctl start iptables

現在已經可以用 iptables, 增加及剛除 rules 的方法跟以前 Centos 5, 6 相同.

如果上述命令沒有 lokkit，可以自己用 yum install lokkit 安裝。事實上 lokkit 也只是設定 iptables 把 http 和 ssh 打開，如果原本就有開了也不用執行或手動自己設定 iptables 也可以。
sudo lokkit -s http -s ssh

Reference
https://www.digitalocean.com/community/tutorials/how-to-migrate-from-firewalld-to-iptables-on-centos-7

New iptables default rules:
[ricky@thrift1 bin]$ sudo iptables -S | tee ~/firewalld_iptables_rules
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Edit the rule file so accept udp packets so that
sudo vi /etc/sysconfig/iptables
      8 -A INPUT -p udp -j ACCEPT
      9 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
     10 -A INPUT -p icmp -j ACCEPT
     11 -A INPUT -i lo -j ACCEPT
     12 -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
     13 -A INPUT -j REJECT --reject-with icmp-host-prohibited
     14 -A FORWARD -j REJECT --reject-with icmp-host-prohibited
     15 COMMIT

Restart to make it effective

sudo sh -c 'iptables-restore -t < /etc/sysconfig/iptables'

systemctl restart iptables.service

Linux CentOS 7 SSH Connection Refused after Reboot

Description

On CentOS 7, I am using SSH fine for a month. After doing some operation with "systemctl status/mask/disable/restart firewalld" followed by "sudo reboot -h now", I cannot use ssh and got "connection refused" after reboot.

Problem

ssh 127.0.0.1

connection refused

Log

journalctl -u sshd | tail -100

Bad configuration option:ForwardX11Trusted

ssh failed

Solution

Comment "ForwardX11Trusted" option in sshd_config file as follows.

sudo vi /etc/ssh/sshd_config

X11Forwarding yes
X11DisplayOffset 10
X11UseLocalhost no
#ForwardX11Trusted yes

Outcome

journalctl -u sshd | tail -100

-- Logs begin at Tue 2016-11-08 17:45:28 HKT, end at Tue 2016-11-08 17:49:45 HKT. --

Nov 08 17:45:47 pc009 systemd[1]: Started OpenSSH server daemon.

Nov 08 17:45:47 pc009 systemd[1]: Starting OpenSSH server daemon...

Nov 08 17:45:47 pc009 sshd[1033]: Server listening on 0.0.0.0 port 22.

Nov 08 17:45:47 pc009 sshd[1033]: Server listening on :: port 22.

Nov 08 17:45:54 pc009 sshd[2296]: Accepted password for user from 10.1.10.111 port 59915 ssh2

SQLite with Java in Eclipse

Download JAR
Download sqlite-jdbc-3.14.2.jar from bit bucket https://bitbucket.org/xerial/sqlite-jdbc/downloads

Create Project
Eclipse > File > New > Java Project > Project Name = SQLiteJDBC

Copy JAR File
Project > Right Click > New > Folder > lib > Right Click > Import > File System > from "Downloads" > select the downloaded JAR file

Add JAR to Build Path Libraries
Project > Right Click > Properties > Libraries > Add JARs

New Class

Project > Right Click > New > Class > Package = "com.sqlite.jdbc", Name = "SQLiteJDBC"

Code

package com.sqlite.jdbc;

import java.sql.Connection;

import java.sql.DriverManager;

public class SQLiteJDBC {

       public static void main(String[] args) {

              Connection c = null;

              try {

                     Class.forName("org.sqlite.JDBC");

                     //c = DriverManager.getConnection("jdbc:sqlite:mdp.db"); // current directory

                     c = DriverManager.getConnection("jdbc:sqlite:data/mdp.db"); // data directory

              }

              catch (Exception e) {

                     System.err.println(e.getClass().getName() + ": " + e.getMessage());

                     System.exit(0);

              }

              System.out.println("Opened database successfully");

       }

}

Run
SQLiteJDBC.java > Right Click > Run As > Java Application

Opened database successfully

Check whether it is a valid binary search tree or not in 1 line in C++

struct Node {

       int data;

       Node* left;

       Node* right;

}

#include <limits.h>

bool checkBST(Node* root, int min = INT_MIN, int max = INT_MAX) {

       return !root || root->data >= min && root->data <= max

              && checkBST(root->left, min, root->data - 1) && checkBST(root->right, root->data + 1, max);

}

Design Pattern and Idiom

C++
NVI Idiom (Non-virtual interface, by creating a public non-virtual function that calls virtual private function that can be overridden by child class)

Java
"Double-Checked Locking" idiom, by checking null once, locking if null, and double checking null again, then initialize. It seems correct but it just works sometimes because by chance it is possible that thread B access the variable while thread A is locking and is partially creating the object. The correct solution is that after Java 5 the field should be declared volatile. The Java volatile field is equivalent to C++ atomic data member, allowing atomic assignment, and hence when thread B sees the variable it must be atomically fully created.

tcpdump and tcpreplay on Linux CentOS 7.2

tcpdump

sudo tcpdump -i em1 -nn port 14316
sudo tcpdump -i em1 -nn 'port 14316'
sudo tcpdump -i em1 -nn port 14316 or port 14311
sudo tcpdump -i em1 -nn 'port 14316 or port 14360 or port 15360 or port 14311 or port 15311'


socat
sudo socat STDIO UDP4-RECV:14316,ip-add-membership=224.0.31.28:em1




All below scripts are tested.


Test

316SA
sudo socat STDIO UDP4-RECV:14316,ip-add-membership=224.0.31.28:em1


GC

360SA
sudo socat STDIO UDP4-RECV:14360,ip-add-membership=224.0.31.202:em1
360SB
sudo socat STDIO UDP4-RECV:15360,ip-add-membership=224.0.32.202:em1

MDP

311SA
sudo socat STDIO UDP4-RECV:14311,ip-add-membership=224.0.31.23:em1
311IA
sudo socat STDIO UDP4-RECV:14311,ip-add-membership=224.0.31.2:em1
311IB
sudo socat STDIO UDP4-RECV:15311,ip-add-membership=224.0.32.2:em1
311NA
sudo socat STDIO UDP4-RECV:14311,ip-add-membership=224.0.31.44:em1






[quantprod@hkoffice083 dev]$ sudo socat STDIO UDP4-RECV:14311,ip-add-membership=224.0.31.23:em1
2016/10/11 05:00:25 socat[20560] E bind(3, {AF=2 0.0.0.0:14311}, 16): Address already in use
[quantprod@hkoffice083 dev]$ sudo socat STDIO UDP4-RECV:14311,ip-add-membership=224.0.31.2:em1
2016/10/11 05:00:33 socat[20562] E bind(3, {AF=2 0.0.0.0:14311}, 16): Address already in use
[quantprod@hkoffice083 dev]$ sudo socat STDIO UDP4-RECV:15311,ip-add-membership=224.0.32.2:em1
2016/10/11 05:00:42 socat[20564] E bind(3, {AF=2 0.0.0.0:15311}, 16): Address already in use
[quantprod@hkoffice083 dev]$ sudo socat STDIO UDP4-RECV:14311,ip-add-membership=224.0.31.44:em1
2016/10/11 05:00:46 socat[20566] E bind(3, {AF=2 0.0.0.0:14311}, 16): Address already in use
[quantprod@hkoffice083 dev]$

pcap

sudo tcpdump -i em1 -nn 'port 14316 or port 14360 or port 15360 or port 14311 or port 15311' -c 1000 -w 311SA.pcap
sudo tcpdump -i em1 -nn 'port 14316 or port 14360 or port 15360 or port 14311 or port 15311' -c 1000 -w 311IA.pcap
sudo tcpdump -i em1 -nn 'port 14316 or port 14360 or port 15360 or port 14311 or port 15311' -c 1000 -w 311IB.pcap
sudo tcpdump -i em1 -nn 'port 14316 or port 14360 or port 15360 or port 14311 or port 15311' -c 1000 -w 311NA.pcap

sudo tcpdump -i em1 -nn 'port 14316 or port 14360 or port 15360 or port 14311 or port 15311' -c 1000 -w 360SA.pcap
sudo tcpdump -i em1 -nn 'port 14316 or port 14360 or port 15360 or port 14311 or port 15311' -c 1000 -w 360SB.pcap

tcpreplay

sudo yum install tcpreplay
http://tcpreplay.synfin.net/wiki/tcpreplay

sudo tcpreplay --loop=0 --intf1=eth0 capture.pcapng

How to compile a Gradle project using command line in Java CME MDP 3.0

Example Project:
https://github.com/epam/java-cme-mdp3-handler


PrintAllSecuritiesTest
1. Copy the directory that contains the required jar files from workspace\AAA\build\b2bits-jmdp3-1.0\lib\ to workspace\AAA\bin\lib\

2. You can use below command to include the classpath of the jar files and start the test
java -cp ".;lib/*" com.epam.cme.mdp3.test.PrintAllSecuritiesTest

3. If the config files are not found, you will see below error messages.
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.
java.lang.NullPointerException
        at com.epam.cme.mdp3.test.PrintAllSecuritiesTest.main(PrintAllSecuritiesTest.java:80)

4. Copy all xml files similar to workspace\AAA\src\test\resources\config.xml to workspace\AAA\bin\config.xml

5. Run the command again
C:\Users\rickypc\workspace\AAA\bin>java -cp ".;lib/*" com.epam.cme.mdp3.test.PrintAllSecuritiesTest
[INFO ] 2016-10-10 15:59:17.940 [Thread-1] PrintAllSecuritiesTest - Channel '311': N feed A is started

6. Notice the below log file will be generated.
Java Market Data Handler for CME Market Data (MDP 3.0).log


Note.
On linux, you need to add the below line to the file /etc/hosts
192.168.10.50 hkoffice083 localhost

SbeParserBenchmark

1. Prepare the file workspace\AAA\bin\dist\pcap\311_AX.bin from workspace\AAA\src\cucumber\sim\data\incr\311_AX_224.0.31.2_17511.zip

2. Run java -cp ".;lib/*" com.epam.cme.mdp3.test.SbeParserBenchmark
or
java -cp ".:lib/*" com.epam.cme.mdp3.test.SbeParserBenchmark

5. Run the command again
5. Run the command again
5. Run the command again
5. Run the command again
5. Run the command again



Eclipse

1. Add jar to Project > Properties > Java Build Path > Libraries > Add JARs

2. Add "Resource" folder as class path folder

3.