xfs runtime link warnings - OBSD 4.2 release + patches

2008-02-29 Thread Mike Williams

Hi,

Looking for clue sticks ...

I get the following warnings when I start xfs:

xfs:/usr/X11R6/lib/libXfont.so.6.0: xfs : WARNING: 
symbol(_FontTransSocketTCPFuncs) size mismatch, relink your program
xfs:/usr/X11R6/lib/libXfont.so.6.0: xfs : WARNING: 
symbol(_FontTransSocketINET6Funcs) size mismatch, relink your program
xfs:/usr/X11R6/lib/libXfont.so.6.0: xfs : WARNING: 
symbol(_FontTransSocketINETFuncs) size mismatch, relink your program
xfs:/usr/X11R6/lib/libXfont.so.6.0: xfs : WARNING: 
symbol(_FontTransSocketLocalFuncs) size mismatch, relink your program
xfs:/usr/X11R6/lib/libXfont.so.6.0: xfs : WARNING: 
symbol(_FontTransSocketUNIXFuncs) size mismatch, relink your program


Yeah, I know relink.  Thing is, this is after a straight install of 
xenocara off the release CD, applying patch 006, and doing a complete 
rebuild and install of X.


I have been through the X readme, tried just rebuilding the apps, 
nothing.  ldd for xfs is:


/usr/X11R6/bin/xfs:
StartEnd  Type Open Ref GrpRef Name
  exe  10   0  /usr/X11R6/bin/xfs
0ddcb000 2ddcf000 rlib 01   0  /usr/X11R6/lib/libFS.so.8.0
0f09b000 2f0b2000 rlib 01   0 
/usr/X11R6/lib/libXfont.so.6.0

0b361000 2b368000 rlib 02   0  /usr/lib/libm.so.2.3
049f6000 249fa000 rlib 02   0 
/usr/X11R6/lib/libfontenc.so.3.0
08cd3000 28cea000 rlib 02   0 
/usr/X11R6/lib/libfreetype.so.14.0

0ff2c000 2ff34000 rlib 03   0  /usr/lib/libz.so.4.1
0446e000 244a2000 rlib 01   0  /usr/lib/libc.so.41.0
04466000 04466000 rtld 01   0  /usr/libexec/ld.so

Oh, and nothing else X related seems to be having similar issues, just xfs.

Many thanks.

em



Re: XForwarding problem: SOLVED

2008-02-29 Thread Denny White
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1


On Thu, Feb 28, 2008 at 11:41:14AM -0700, Predrag Punosevac sez:
 On Thu, Feb 28, 2008 at 02:46:41AM -0700, Predrag Punosevac sez:
   
 Denny White wrote:
 For the last couple of days I've tried everything I can think of to
 make XForwarding work with ssh. As per the FAQ, I have set it like so:
 
 
 In sshd_config
 
 X11Forwarding yes
 
 
 In ssh_config
 
 ForwardAgent yes
 ForwardX11 yes
 
 I can use it passably well in one direction from a box across the
 room to the one I do most of my work on. But, when I try it from
 this box to the one across the room, I get the xauth error message
 along with all typed characters doubled on the screen. I went ahead
 anyway and typed 'display somefile.jpg' just to see what I'd get 
 got this:
 
 Xlib: connection to localhost:10.0 refused by server
 Xlib: Invalid MIT-MAGIC-COOKIE-1 key
 display: unable to open X server `localhost:10.0'.
 
 I've read the man page on xauth(1) and experimented with its
 commands. I've even wiped out the .Xauthority file on both boxes
 and restarted X, to no avail. Possibly I should mention too, that
 I boot on both boxes to a xdm login. I don't know if that would
 have any bearing on the problem or not. Thanks for any help I
 can get on this.
   
 What happens when you try to do the following?
 
 
 Try to do remote login with as follows
 ssh -Y [EMAIL PROTECTED]
 
 
 I get this:
 
 Warning: No xauth data; using fake authentication data for X11
 forwarding.
 
 And, everything I type at the prompt is doubled.
  
   
 you should be now in the shell on the remote host
 
 try to start x client like xdvi or xfig or something like emacs by 
 typing xdvi
 
 If xdvi pops up that means that the client is running on the remote host 
 but it is displayer on the local X server
 
 
 Okay, if after getting in I try to open something like xzgv, I get:
 
 Xlib: connection to localhost:10.0 refused by server
   
 Ok you do have a permission problem
 
 Read carefully man pages for sshd_config  file .  You need to uncomment 
 few lines for X tunneling.
 You can also look at the Secure Architectures with OpenBSD section 
 about OpenSSH.
 
 I do not think that the problem is with X server though.
 Best,
 Predrag
 

Yes, you were right. Operator error, it was the nut holding the
steering wheel as usual. :-)

 
 
 Xlib: Invalid MIT-MAGIC-COOKIE-1 key
 
 Gtk-WARNING **: cannot open display: localhost:10.0
  
 Like I said earlier, I read the man page too on xauth  tried
 sending
 
 xauth extract - $DISPLAY | rsh otherhost xauth merge -
 
 but it doesn't appear to help. I still get the error messages
 and double typed characters.
 
   

4AM, but that's okay. Problem solved. Had previously done some
experimenting around with ~/.profile and ~/.kshrc when I'd been
having history file problems in ksh. As soon as I reverted back
to my old ~/.profile instead of the newer short one that just
exported HISTSIZE, HISTFILE, and ENV=$HOME/.kshrc the XForwarding
problem disappeared. Don't try this at home, kids, especially at
4AM when you're not only old and senile, but tired as hell too. :-) 

-- 

Denny White

All messages scanned by ClamAssassin
http://jameslick.com/clamassassin/
===
GnuPG key  : 0x1644E79A  |  http://wwwkeys.nl.pgp.net
Fingerprint: D0A9 AD44 1F10 E09E 0E67  EC25 CB44 F2E5 1644 E79A
===
iD8DBQFHx9lIy0Ty5RZE55oRAnlYAJ90xDGjlb9tX1csjPP/LQeEksc7BgCfRxZl
+jA3v5SXg6qlmaR/IEC2vIQ=
=efps
-END PGP SIGNATURE-



Re: bgp routing question

2008-02-29 Thread Erich

another routing problem ist that now the ibpg routes get insertet
but also announcend to the ebgp peer since its the same as and
i announce self to the ebgp peers. problems is now that the
network is somewhere else, but announced so i have created a
routing loop. do i have to use static routes or is there a way to configure
stuff like that in bgpd?

thx in advance, erich.

Erich schrieb:

do i have to restart bgpd in order to get ipsec esp ike for a
session / nei working or is a reload and nei up/down enough?

i got

Oct 20 13:21:23 router-mt-1 isakmpd[13070]: dropped message from 
xx.xx.xx.xx port 500 due to notification type NO_PROPOSAL_CHOSEN


and

responder_recv_HASH_SA_NONCE: peer proposed invalid phase 2 IDs: 
initiator id 59caa34e: xxx.xxx.xxx.xxx, responder id 50be811a:  
xx.xx.xxx.xxx


isakmpd is running with -Ka like suggested in man bgpd.conf  and keys 
have been copied to each side.


do i have anything forgotten?

Erich schrieb:

yes thx guys, it worked :)

Claudio Jeker schrieb:

On Thu, Feb 28, 2008 at 08:14:09AM +0100, Erich wrote:
 
i now have a session i turned on update loging ob bpgd but the 
routes do not

get inserted. any ideas?

AS41412: update 123.123.123.0/24 via xxx..xx. ( the router 
where the network is, yes pingable)





Make sure the nexthop is either reachable via a static route or have a
look at nexthop qualify via
  



erich




Re: bgp routing question

2008-02-29 Thread Claudio Jeker
On Fri, Feb 29, 2008 at 02:10:09PM +0100, Erich wrote:
 another routing problem ist that now the ibpg routes get insertet
 but also announcend to the ebgp peer since its the same as and
 i announce self to the ebgp peers. problems is now that the
 network is somewhere else, but announced so i have created a
 routing loop. do i have to use static routes or is there a way to configure
 stuff like that in bgpd?


You need a filter for that. Just deny the prefix on the other router.

-- 
:wq Claudio




Re: bgp routing question

2008-02-29 Thread Erich

Claudio Jeker schrieb:

On Fri, Feb 29, 2008 at 02:10:09PM +0100, Erich wrote:
  

another routing problem ist that now the ibpg routes get insertet
but also announcend to the ebgp peer since its the same as and
i announce self to the ebgp peers. problems is now that the
network is somewhere else, but announced so i have created a
routing loop. do i have to use static routes or is there a way to configure
stuff like that in bgpd?




You need a filter for that. Just deny the prefix on the other router.

  
the other router is not under my control, so i would have to ask them to 
adjust their filters,

isnt there another way?


erich



Re: Intel PRO/1000MT (82546GB) Quad nic with huge packet delay and packet loss

2008-02-29 Thread openbsd firewall
Hello again,

Still having problems with this quad nic. Was doing some performance tests
with iperf for 24h and suddendly it stopped answering/forwarding packets on
quad nic interfaces.
I tried a ifconfig down, ifconfig up and still no packets.
Tried to ping from the switch after clearing the arp cache and the arp entry
is loaded but there is no response. With a tcpdump I can see arp packets
being broadcasted but no answer entering the interface.

I have enabled all debugging flags for 'em' driver and I get this:
em2: watchdog timeout -- resetting
em_init: begin
em_stop: begin
free_transmit_structures: begin
free_receive_structures: begin
em_init: pba=40K
em_hardware_init: begin
em_initialize_transmit_unit: begin
Base = 73f1000, Length = 1

em_set_multi: begin
em_initialize_receive_unit: begin

Shouldn't this reset the nic and fix this ?

I can reproduce the problem much faster after I messed around with if_em.h,
especially this parameter:
#define EM_MAX_TXD  4096

With 4096, the interface becomes unresponsive a few seconds after I start
iperf tests.

I have tried to apply the following patch:
http://article.gmane.org/gmane.os.openbsd.tech/14134

But still the same. It seems those resets aren't being sent to the nic or
something like that. How can I try to debug this ?
Only way to fix it is to reboot the machine... :(

Thanks,
John



console question

2008-02-29 Thread Need Coffee
I feel I should probably know why, but I can't seem to find anything
explaining it... and my curiosity is just too great.

Why does the console behave differently in bsd.rd vs. bsd?

I can almost always get serial console to work on some sun amd64
machines with bsd.rd, regardless of console redirection settings,
and it will even work with their rkvm crap at the same time.

However once the machine's installed the same settings no longer
work and I have to tweak things.

Is there some magic in the ramdisk kernels such that it drives both
glass console and serial console at the same time, or something?

Thanks in advance...



Re: bgp routing question

2008-02-29 Thread Claudio Jeker
On Fri, Feb 29, 2008 at 03:23:27PM +0100, Erich wrote:
 Claudio Jeker schrieb:
 On Fri, Feb 29, 2008 at 02:10:09PM +0100, Erich wrote:
   
 another routing problem ist that now the ibpg routes get insertet
 but also announcend to the ebgp peer since its the same as and
 i announce self to the ebgp peers. problems is now that the
 network is somewhere else, but announced so i have created a
 routing loop. do i have to use static routes or is there a way to 
 configure
 stuff like that in bgpd?

 

 You need a filter for that. Just deny the prefix on the other router.

   
 the other router is not under my control, so i would have to ask them to 
 adjust their filters,
 isnt there another way?


You can also deny incomming prefixes. Read the bgpd.conf man page section
about filtering for more information.

-- 
:wq Claudio



Re: Intel PRO/1000MT (82546GB) Quad nic with huge packet delay and packet loss

2008-02-29 Thread Stuart Henderson
On 2008-02-29, openbsd firewall [EMAIL PROTECTED] wrote:
 Still having problems with this quad nic. Was doing some performance tests
 with iperf for 24h and suddendly it stopped answering/forwarding packets on
 quad nic interfaces.

You mentioned you had one of these machines you've tried Linux on.
Can you try and repeat the same thing there (with the newer bios)?
And if you see a similar problem on Linux, see what SuperMicro
support have to say about it?

(though, linux might not be very helpful with your iperf tests,
I'm not sure but they may switch to polling vs. irq under higher
loads which may mask the problem..)

 I have tried to apply the following patch:
 http://article.gmane.org/gmane.os.openbsd.tech/14134

I believe that is for a different issue, yours looks more like
it's something to do with interrupt routing.



Re: relayd http check connection failures; hoststated operates correctly

2008-02-29 Thread Wijnand Wiersma

Armin Wolfermann wrote:

If you need a quick workaround duplicate your global timeout in every
forward statement.
  

That is indeed a working workaround.

However, it seems that nothing is actually loaded.
pfctl -a relayd -s Tables
returns nothing for example.
So maybe there are more things broken in the parser?

Wijnand



Re: IPSec tunnel problem

2008-02-29 Thread Markus Wernig

Hi

From my point of view the problem is that you use the same network 
range 192.168.0/24  in your home and office. Off the top of my head I'd 
say that this should not work. The routing entries look a bit scary, 
actually. If I had the same setup, I'd try one of the following:

- change the home network to something else than 192.168.0/24
- nat all traffic from the home network on the office gateway to its own 
internal address


And I'd start out with the simplest of configurations and build from that:

Home gateway:
ike dynamic esp from HOME_NET to 192.168.0.0/24 peer OFFICE_EXTERNAL_IP 
psk xxx


Office gateway:
ike passive esp from HOME_NET to 192.168.0.0/24 psk xxx

krgds /markus

Alexey Vatchenko wrote:


flow esp from 192.168.0.0/24 to 192.168.0.0/24 type bypass


Coming to the office this morning i found out that all office's outgoing 
traffic goes through my home gateway. It looks like IPSec created 
default route for hosts in local network.




best way to block flood attacks on pf

2008-02-29 Thread Vinicius Vianna

Hi misc,

I got a firewall with openbsd 4.1 and pf and it's receiving a lot of syn 
floods attacks and even udp floods, since this is common I think someone 
could have developed something on this, so why to reinvent the wheel?


The scenario is this:

block in log
block in quick inet from badip to any
...
pass rules
...

So when I got this attacks, my pflog shows a lot of packets blocked by 
the block in log rule, or sometimes by the scrub in, these packets 
are even from ports i'm not listening.
What I want is someway to set like the max-src-conn-rate in the pass 
rule, something that will put the hosts that send more than 50pkts/s 
blocked to the badip table, I don't know if this can be done in 
pf.conf or some script to work on pflog?


I don't wanna pf having to see all the rules from this attackers, so if 
the packet is comming from badip it will drop it quickly and go to the 
next packet.


Anyone have worked on something like this?

Thanks,
Vinicius



Re: best way to block flood attacks on pf

2008-02-29 Thread Lars Noodén

Vinicius Vianna wrote:

I got a firewall with openbsd 4.1 and pf and it's receiving a lot of syn 
floods attacks and even udp floods,...


I am new at that an have been using pp 68 - 71 of the Book of PF cover 
this as does Firewalling with OpenBSD's PF packet filter, both by 
Peter Hansteen.

http://home.nuug.no/~peter/pf/en/bruteforce.html

I use overloads for the massive number of SSH probes and have chosen 
rather restrictive rules:


block in log quick on $ext_if from ssh-bruteforce \
label BLOCKBRUTES

pass in on $ext_if proto tcp to ($ext_if) port ssh \
flags S/SA keep state \
 (max-src-conn 3, max-src-conn-rate 3/60, overload \
ssh-bruteforce flush global) \
 label BLOCKBRUTES
YMMV

Regards,
-Lars



Re: best way to block flood attacks on pf

2008-02-29 Thread Vinicius Vianna
The problem is that these attacks aren't on any pass rule, they are on 
ports that my firewall doesn't permit, so the packet will go to the 
block rule, and i can't use these overload rules with block can I?


Lars NoodC)n wrote:

Vinicius Vianna wrote:

I got a firewall with openbsd 4.1 and pf and it's receiving a lot of 
syn floods attacks and even udp floods,...

pass in on $ext_if proto tcp to ($ext_if) port ssh \
flags S/SA keep state \
 (max-src-conn 3, max-src-conn-rate 3/60, overload \
ssh-bruteforce flush global) \
 label BLOCKBRUTES

Regards,
-Lars




Intel PRO/1000VT NIC Compatibility

2008-02-29 Thread Alejandro Lozanoff

Hello folks,

Anyone tried one of these network cards and can comment on its 
performance? (Intel PRO/1000VT)


We are going to buy a couple PowerEdge 1435s and we need a quad card, 
they have those as an option. I couldn't find it in em(4) or list 
archives, so i'm not sure if it works and if it works well.


Thanks,
Alejandro.



Re: best way to block flood attacks on pf

2008-02-29 Thread Stefan Schulze Frielinghaus
But what benefit do you expect to get when you block it via a
max-src-conn-rate/overload rule or directly via a (default) block rule?
In either way you will block the packet.

On Fri, 2008-02-29 at 16:49 -0300, Vinicius Vianna wrote:
 The problem is that these attacks aren't on any pass rule, they are on 
 ports that my firewall doesn't permit, so the packet will go to the 
 block rule, and i can't use these overload rules with block can I?
 
 Lars NoodC)n wrote:
  Vinicius Vianna wrote:
 
  I got a firewall with openbsd 4.1 and pf and it's receiving a lot of 
  syn floods attacks and even udp floods,...
  pass in on $ext_if proto tcp to ($ext_if) port ssh \
  flags S/SA keep state \
   (max-src-conn 3, max-src-conn-rate 3/60, overload \
  ssh-bruteforce flush global) \
   label BLOCKBRUTES
 
  Regards,
  -Lars



Re: man dhcpd.interfaces ?

2008-02-29 Thread Chris Cappuccio
Why use dhcpd.interfaces or flags at all?

In current, and maybe even 4.2, dhcpd will detect interfaces automatically.

Rod Whitworth [EMAIL PROTECTED] wrote:
 On Mon, 25 Feb 2008 15:43:55 +0100, Kasper Revsbech wrote:
 
 Hi
 I have some problems with my dhcp server, and is trying to debug the setup.
 I would like to have a subnet on each interface and therefore dhcpd to 
 span both interfaces.
 For that purpose I use /etc/dhcpd.interfaces where i have:
 vr0
 vr1
 But i can't find a man page on this file so I can't see if it make a 
 difference whether I  write:
 vr0 vr1
 
 or
 
 vr0
 vr1
 
 
 So my question is:
 Is there a difference ?
 NO
 
 Is it just me who can't find documentation on this ?
 
 NO but the file is self documenting. The supplied file says:
 #   $OpenBSD: dhcpd.interfaces,v 1.1 1998/08/19 04:25:45 form Exp $
 #
 # List of network interfaces served by dhcpd(8).
 #
 # ep0
 # ed0 le0
 # de1
 
 That should tell you something. It is effectively a combination of your
 alternatives except that it deals with four interfaces.
 
 When I discovered that file I started using it and, because there was
 no man page I started writing one. The reason I stopped was because,
 whilst that file is itself very simple, the process by which it is used
 is complicated and unable to be used in a restart of dhcpd.
 
 For me dhcpd.interfaces is deprecated. It is simpler to use
 dhcpd_flags=if0 if1 which does not require the parsing that
 dhcpd.interfaces requires to allow its free format.
 
 Restarting still means entering the command and the list of interfaces
 e.g.
 #dhcpd if1 if2
 but I don't know of many cases where more than a few ifs are used.
 Those users could script their command if it's too hard to do from
 memory.
 
 OK?
 
 
 
 BTW:
 I use openbsd 4.2 ;)
 
 
 Kind regards:
 Kasper Revsbech
 
 
 Replies to the list (if any) are sufficient, thanks.
 
 Rod/
 /earth: write failed, file system is full
 cp: /earth/creatures: No space left on device

-- 
It is an old observation that the best writers sometimes disregard the rules of
rhetoric. When they do, however, the reader will usually find in the sentence
some compensating merit, attained at the cost of the violation. Unless he is
certain of doing as well, he will probably do best to follow the rules.
--William Strunk



VPN suggestions and advise for clean sheet setup

2008-02-29 Thread Daniel Ouellet

Hi,

I have been looking into this for some time, but there is so many 
different setup possible that unless you have one and are force to 
continue using it, one wouldn't know witch way to go.


I try to keep it as simple and clean as possible, so if you start with a 
clean sheet and no restrictions on use, what would you suggest to go with.


Requirements are to sadly connect Windows users back to a network and I 
want that box to be OpenBSD, or multiples OpenBSD boxes to get full 
network access from these connections. Multiple at once and I try to 
keep the management of the users as simple as possible.


I guess using the pptp client from Windows, or their remote office 
built-in XP. I have to say, last time I use any Microsoft PPTP client 
was about 12 years ago in the NT 4 service pack 6. That's how old it 
was. I only use ssh, putty if needed at time from Windows and that's all 
I need.


I think you could say, it's time to come to sync with todays needs for 
Windows I guess.


What would you suggest to use if any choice is possible? I know OpenBSD 
redesign the ipsec, but is that the best way now? Looks like many users 
still use OpenVPN, and a bunch of others. I am a bit at a lost as if 
that's best, why so many variation in use still today in the archive and 
why one would go that path. I would love the KISS VPN I guess. (; 
Even connecting office together, I see many different choices in the 
archive.


Three needs, providing access to remote Window users, browser, etc.

And if possible in some cases providing specific network access via VPN 
(tunnel, or what not) to remote office.


Last, would be to provide streaming access via a secure gateway like 
proxy or the like to traveling users.


The solutions for each one could be different, but using the same setup, 
or part of it anyway would obviously be better.


The goal is the minimize the impact and most importantly support and 
problem on the remote Windows users, witch I admit, may not be that 
easy. (;


There is so many different choices and ways to do this now, witch one 
would you recommend if today you could start with a clean sheet and not 
have to be stuck with legacy setup?


Many thanks for the suggestions.

Daniel



Re: best way to block flood attacks on pf

2008-02-29 Thread Vinicius Vianna
Since I have a lot of rules, if I get the attackers into a table and use 
a block quick on it, pf won't have to run through all the rules for it.
Now for every packet the attacker sends, pf have to run it through all 
the rules.
The main difference is to be able to use a quick rule, i don't know for 
sure how much resources pf uses to fit a packet on all rules, but maybe 
a 10k pkts/s attack will drain some resources if pf needs to see all 
those rules, if i can get this attack into a table on the first 1k 
packets, a quick rule will apply to it, lowering the load on the 
firewall (maybe?).


Stefan Schulze Frielinghaus wrote:

But what benefit do you expect to get when you block it via a
max-src-conn-rate/overload rule or directly via a (default) block rule?
In either way you will block the packet.

On Fri, 2008-02-29 at 16:49 -0300, Vinicius Vianna wrote:
  
The problem is that these attacks aren't on any pass rule, they are on 
ports that my firewall doesn't permit, so the packet will go to the 
block rule, and i can't use these overload rules with block can I?




pkg_add -u

2008-02-29 Thread fulvio ciriaco
Hallo,
I have some ports updated by me,
e.g. emacs-22.1, sawfish-1.3.3 ...
When trying
pkg_add -ui
Candidates for updating sawfish-1.3.3p0 - sawfish-1.3p9
Candidates for updating auctex-11.14p1 - auctex-11.14p1
...
auctex installed by me, dependent on emacs-22.1 wants to be
replaced by auctex same version dependent on emacs-21.4,
Does pkg_add -u not check version number?
Fulvio



Re: VPN suggestions and advise for clean sheet setup

2008-02-29 Thread Alexey Vatchenko
On 2008-02-29, Daniel Ouellet [EMAIL PROTECTED] wrote:
 Three needs, providing access to remote Window users, browser, etc.

 And if possible in some cases providing specific network access via VPN 
 (tunnel, or what not) to remote office.

 Last, would be to provide streaming access via a secure gateway like 
 proxy or the like to traveling users.

 The solutions for each one could be different, but using the same setup, 
 or part of it anyway would obviously be better.

 There is so many different choices and ways to do this now, witch one 
 would you recommend if today you could start with a clean sheet and not 
 have to be stuck with legacy setup?

For my Windows users i setup OpenVPN in server mode. No problem at all for
roaming users, the same crypto algorithms for Windows and for UNIX. User
just starts .bat file and gets VPN.
I think IPSec is not so good for Windows users because of limitation of crypto:
3des, sha1. It's not so hard to setup, but also i faced problem if office
network is located behind NAT. Also i didn't find thing similar to srcid on
Windows side.

As long as i use OpenBSD at home i'm trying to setup IPSec tunnel for myself.
But still don't resolv a problem :)
(http://marc.info/?l=openbsd-miscm=120378201209896w=2)

-- 
Alexey Vatchenko
http://www.bsdua.org



Re: IPSec tunnel problem

2008-02-29 Thread Alexey Vatchenko

Hi!

Thanks for reply!

Markus Wernig wrote:
 From my point of view the problem is that you use the same network 
range 192.168.0/24  in your home and office. Off the top of my head I'd 
say that this should not work. The routing entries look a bit scary, 
actually. If I had the same setup, I'd try one of the following:

- change the home network to something else than 192.168.0/24


No, i don't use same network address for two networks.

Actually, the problem is here (take a look at flow esp out):

office-gw$ sudo ipsecctl -s all
FLOWS:
flow esp in from 0.0.0.0/0 to 192.168.0.0/24 peer HOME_GATEWAY srcid
OFFICE_GATEWAY/32 dstid [EMAIL PROTECTED] type use
flow esp out from 192.168.0.0/24 to 0.0.0.0/0 peer HOME_GATEWAY srcid
OFFICE_GATEWAY/32 dstid [EMAIL PROTECTED] type require
flow esp in from 192.168.0.0/24 to 192.168.0.0/24 type bypass
flow esp out from 192.168.0.0/24 to 192.168.0.0/24 type bypass

SAD:
esp tunnel from HOME_GATEWAY to OFFICE_GATEWAY spi 0x5d3e6f12 auth
hmac-sha2-256 enc aes
esp tunnel from OFFICE_GATEWAY to HOME_GATEWAY spi 0x7072ca39 auth
hmac-sha2-256 enc aes

It's because of:
ike passive esp from 192.168.0.0/24 to any local egress dstid
[EMAIL PROTECTED] psk xxx

To any! But what should i use if i don't know peer's address?
How ike rule should be specified to create flow with peer's address
instead of 0.0.0.0/0?

--
Alexey Vatchenko
http://www.bsdua.org



Re: xenocara source

2008-02-29 Thread Dongsheng Song
Yes, I'd like use /usr/xenocara, not /usr/src/xenocara.

2008/3/1, J.C. Roberts [EMAIL PROTECTED]:
 According to FAQ-5, the suggested place to put your xenocara source tree
  is under /usr/src/xenocara

  I know it really doesn't matter where you put your xenocara tree but...

  For the sake of new folks it may be wise to put a .cvsignore in
  our /usr/src tree to prevent unintended cosequences of using the (also
  suggested) prune switch on cvs (-P).

  When following anoncvs.html, if a new person goes to update
  their /usr/src tree, they would thwack their /usr/src/xenocara tree.

  Thoughts?


  -JCR



Aircard 595

2008-02-29 Thread HickoryStick
I have a Verizon Aircard 595.  I can't seem to get it working. 
dmesg reports
umsm0 at uhub0 port 1
umsm0: Sierra Wireless, Incorporated Sierra Wireless AC595 Modem, rev
1.10/0.02, addr 2
ucom0 at umsm0 portno 0
I've tried the script in man page umsm, and ppp directly but it doesn't seem
to respond to AT commands.  Any suggestions would be appreciated.  Thanks.

-- 
View this message in context: 
http://www.nabble.com/Aircard-595-tp15769038p15769038.html
Sent from the openbsd user - misc mailing list archive at Nabble.com.



Re: xenocara source

2008-02-29 Thread Marco S Hyman
  For the sake of new folks it may be wise to put a .cvsignore in 
  our /usr/src tree to prevent unintended cosequences of using the (also 
  suggested) prune switch on cvs (-P).

-P will only remove EMPTY directories that cvs knows about.   Putting
xenocara (or in my case zenocara and ports) in /usr/src is pretty much
a no-op when it comes to cvs.   A cd /usr/src; cvs up -Pd displays
? xenocara.  I can live with that.

  When following anoncvs.html, if a new person goes to update 
  their /usr/src tree, they would thwack their /usr/src/xenocara tree.

If the directory isn't empty it isn't thwacked
If the directory isn't known by CVS it isn't thwacked.

// marc



Re: xenocara source

2008-02-29 Thread J.C. Roberts
On Friday 29 February 2008, Dongsheng Song wrote:
 Yes, I'd like use /usr/xenocara, not /usr/src/xenocara.


You can. The addition of a .cvsignore to /usr/src would not remove your 
ability to keep your xenocara where ever you like.

The trouble is the project documentation is misleading. If a new person 
follows the documentation (faq5.html and anoncvs.html), they will 
unintentionally delete their /usr/src/xenocara tree which is the 
suggested location for it according to the documentation.

-jcr



Re: Sun Creator 3D hardware wanted

2008-02-29 Thread Jay Hart
Can you use the following:

Not sure what the model number is, guess it's the number that
looks like the serial number.  But it's revision sticker has

-05REV50

The model number might be this one:

98081 2A3

Got any clue what this might be?

Jay

 It would be great if the devs could get back to the list which card(s) they
 wanted, so that its not a crap-shoot if an available card is what they need.

 I'm looking on my end for anything available, but a more directed search would
 be great.

 Jay

 On Thu, Feb 28, 2008 at 9:14 AM, J.C. Roberts [EMAIL PROTECTED]
 wrote:

 I'll see what I can dig up. My fear is the brand name Creator3D is
 used on multiple products with vastly differing hardware. I might have
 one (or more) of them here collecting dust. Most of my sun hadware is
 SS20 and U2 (with one U60 for kicks), but I have lots of them and
 plenty of spare parts.

 I *think* the Creator3D was also available on the Ultra2 but without a
 part number to reference, it's tough to say it's the same thing as the
 Ultra10 version. I want to think there were both PCI and SBUS versions
 which carried that name...

 --
 (after some digging)

 Sorry for the resend Edd, and I've cc'd oga@ and misc@ on this one.

 Below is what I found on sunsolve and it seems I was right about
 the Creator brand name. Note, there are some dupes in the list below
 and I've forgotten the name of the interface Sun used on the Ultra-2
 for video/graphics but it's a SBUS based system. Also, I've never owned
 a Ultra-30 (and I'm too lazy to look it up) but I'm pretty sure it is a
 PCI based machine.

 Ultra 2 (SBUS)

 http://sunsolve.sun.com/handbook_pub/validateUser.do?target=Systems/U2/components
 3651Ahttp://sunsolve.sun.com/handbook_pub/validateUser.do?target=Systems/U2/components3651A
  501-2634Creator Series 1 (FFB)
 X3652A  501-3129Creator3D Series 1 (FFB) 24-Bit Frame Buffer
 X3653A  501-4127  Buy   Creator Series 1 (FFB) 24-Bit Frame Buffer
 X3657A  501-4173Creator3D Series 2 (FFB2) 24-Bit Frame Buffer
 X3661A  501-4790Creator3D Series 3 (FFB2+) 24-Bit Frame Buffer
 X3671A  501-4790Creator3D Series 3 (FFB2+) 24-Bit Frame Buffer
 X3675A  501-4173Creator3D Series 2 (FFB2) 24-Bit Frame Buffer

 Ultra 10 (PCI)

 http://sunsolve.sun.com/handbook_pub/validateUser.do?target=Systems/U10/components
 X3662Ahttp://sunsolve.sun.com/handbook_pub/validateUser.do?target=Systems/U10/componentsX3662A
 501-4789Creator Series 3 (FFB2+)
 X3663A  501-5690  Buy   Creator3D Series 3 (FFB2+)
 X3670A  501-5690  Buy   Creator3D Series 3 (FFB2+)
 X3672A  501-4789Creator Series 3 (FFB2+)


 So it looks like the Creator3D in the Ultra 2 is different than the one in
 the Ultra 10.  I have an Ultra 2 sitting around with the Creator3D card (not
 sure which model, as it's at home and I'm currently not), and I would be
 willing to ship it, preferably to the continental US.  I'd have to check
 shipping costs before shipping outside the US.



Re: Server room temperature sensors

2008-02-29 Thread HickoryStick
http://www.ibuttonlink.com/link45.aspx 
has rs-232/serial connected 'easy' interface device and sensors
just poll serial port for many sensors...


Joe S-3 wrote:
 
 Can anyone recommend a server room temperature sensor that I can use  
 with openbsd?
 
 I want to monitor temperature and humidity.
 
 I hope to graph the data from the sensor.
 
 The sensor can be connected to my openbsd via usb, serial, or even  
 network.
 
 
 

-- 
View this message in context: 
http://www.nabble.com/Server-room-temperature-sensors-tp15328515p15769058.html
Sent from the openbsd user - misc mailing list archive at Nabble.com.



Re: xenocara source

2008-02-29 Thread Owain Ainsworth
On Fri, Feb 29, 2008 at 05:22:34PM -0800, J.C. Roberts wrote:
 On Friday 29 February 2008, Dongsheng Song wrote:
  Yes, I'd like use /usr/xenocara, not /usr/src/xenocara.
 
 
 You can. The addition of a .cvsignore to /usr/src would not remove your 
 ability to keep your xenocara where ever you like.
 
 The trouble is the project documentation is misleading. If a new person 
 follows the documentation (faq5.html and anoncvs.html), they will 
 unintentionally delete their /usr/src/xenocara tree which is the 
 suggested location for it according to the documentation.

Incorrect. I put xenocara in /usr/src/xenocara. in fact a cvs up updates
both. Since i reckon i do more in the xenocara tree than most people, I
think it's safe to say that it's alright. Prune only removes EMPTY
directories that are in cvs.
 
 -jcr
 

-- 
Don't you feel more like you do now than you did when you came in?



Re: Sun Creator 3D hardware wanted

2008-02-29 Thread pedro la peu
 It would be great if the devs could get back to the list which card(s)

Or you could send whatever you have instead of talking about it.



4.3 Beta: no sound

2008-02-29 Thread Claus Assmann
I've upgraded one machine to 4.3 Beta (2008-02-23, i386, dmesg
below) and there is no audio anymore (it used to work with 3.8). I
tried to cat an audio file directly to the device:

$ file gong.au
gong.au: Sun/NeXT audio data: 8-bit ISDN u-law, mono, 8000 Hz
$ cat gong.au  /dev/audio
$ cat gong.au  /dev/sound


and mpg123 (playing song36.mp3 with various options),
and mplayer, xine, vlc to play some DVDs: video is shown (even though
mplayer is jerky), but no audio.

What can I check next?

$ mixerctl
outputs.master=199,199
outputs.master.mute=off
outputs.mono=255
outputs.mono.mute=off
outputs.mono.source=mixerout
outputs.headphones=255,255
outputs.headphones.mute=off
outputs.surround=255,255
outputs.surround.mute=off
outputs.center=255
outputs.center.mute=off
outputs.lfe=255
outputs.lfe.mute=off
inputs.speaker=255
inputs.speaker.mute=off
inputs.phone=191
inputs.phone.mute=off
inputs.mic=191
inputs.mic.mute=off
inputs.mic.preamp=off
inputs.mic.source=mic0
inputs.line=191,191
inputs.line.mute=off
inputs.cd=191,191
inputs.cd.mute=off
inputs.video=255,255
inputs.video.mute=off
inputs.aux=191,191
inputs.aux.mute=off
inputs.dac=191,191
inputs.dac.mute=off
record.source=mic
record.volume=255,255
record.volume.mute=off
outputs.extamp=off
# I turned off all mute fields as stated in the FAQ.


OpenBSD 4.3-beta (GENERIC) #663: Sat Feb 23 17:30:07 MST 2008
[EMAIL PROTECTED]:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: AMD Athlon(tm) 64 Processor 3000+ (AuthenticAMD 686-class, 512KB L2
cache) 2.01 GHz
cpu0:
FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUS
H,MMX,FXSR,SSE,SSE2
cpu0: AMD errata 89, 97 present, BIOS upgrade may be required
real mem  = 535588864 (510MB)
avail mem = 509964288 (486MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 05/04/04, BIOS32 rev. 0 @ 0xf0010,
SMBIOS rev. 2.3 @ 0xf0520 (65 entries)
bios0: vendor American Megatrends Inc. version 1003.001 date 05/04/2004
bios0: ASUSTeK Computer Inc. K8VB
apm0 at bios0: Power Management spec V1.2
apm0: AC on, battery charge unknown
acpi at bios0 function 0x0 not configured
pcibios0 at bios0: rev 2.1 @ 0xf/0x1
pcibios0: PCI IRQ Routing Table rev 1.0 @ 0xf5cf0/224 (12 entries)
pcibios0: PCI Interrupt Router at 000:17:0 (VIA VT8237 ISA rev 0x00)
pcibios0: PCI bus #1 is the last bus
bios0: ROM list: 0xc/0xc000 0xcc000/0x4000!
cpu0 at mainbus0
cpu0: Cool'n'Quiet K8 2003 MHz: speeds: 2000 1800 800 MHz
pci0 at mainbus0 bus 0: configuration mode 1 (no bios)
pchb0 at pci0 dev 0 function 0 VIA K8HTB Host rev 0x01
agp0 at pchb0: v3, aperture at 0xf800, size 0xf00
ppb0 at pci0 dev 1 function 0 VIA K8HTB AGP rev 0x00
pci1 at ppb0 bus 1
vga1 at pci1 dev 0 function 0 ATI Radeon VE QY rev 0x00
wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
skc0 at pci0 dev 10 function 0 Marvell Yukon 88E8001/8003/8010 rev 0x13,
Yukon Lite rev. A3 (0x7): irq 10
sk0 at skc0 port A: address 00:0e:a6:8e:fc:54
eephy0 at sk0 phy 0: Marvell 88E1011 Gigabit PHY, rev. 5
pciide0 at pci0 dev 15 function 0 VIA VT6420 SATA rev 0x80: DMA
pciide0: using irq 10 for native-PCI interrupt
wd0 at pciide0 channel 0 drive 0: ST3300831AS
wd0: 16-sector PIO, LBA48, 286168MB, 586072368 sectors
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 5
wd1 at pciide0 channel 1 drive 0: ST3300831AS
wd1: 16-sector PIO, LBA48, 286168MB, 586072368 sectors
wd1(pciide0:1:0): using PIO mode 4, Ultra-DMA mode 5
pciide1 at pci0 dev 15 function 1 VIA VT82C571 IDE rev 0x06: ATA133, channel
0 configured to compatibility, channel 1 configured to compatibility
wd2 at pciide1 channel 0 drive 0: ST3650640A
wd2: 16-sector PIO, LBA48, 620018MB, 1269798768 sectors
wd3 at pciide1 channel 0 drive 1: ST3750640A
wd3: 16-sector PIO, LBA48, 715404MB, 1465149168 sectors
wd2(pciide1:0:0): using PIO mode 4, Ultra-DMA mode 5
wd3(pciide1:0:1): using PIO mode 4, Ultra-DMA mode 5
atapiscsi0 at pciide1 channel 1 drive 0
scsibus0 at atapiscsi0: 2 targets
cd0 at scsibus0 targ 0 lun 0: IDE, DVD-ROM 16X, 7.50 SCSI0 5/cdrom
removable
cd0(pciide1:1:0): using PIO mode 4, Ultra-DMA mode 2
uhci0 at pci0 dev 16 function 0 VIA VT83C572 USB rev 0x81: irq 11
uhci1 at pci0 dev 16 function 1 VIA VT83C572 USB rev 0x81: irq 11
uhci2 at pci0 dev 16 function 2 VIA VT83C572 USB rev 0x81: irq 10
uhci3 at pci0 dev 16 function 3 VIA VT83C572 USB rev 0x81: irq 10
ehci0 at pci0 dev 16 function 4 VIA VT6202 USB rev 0x86: irq 5
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 VIA EHCI root hub rev 2.00/1.00 addr 1
viapm0 at pci0 dev 17 function 0 VIA VT8237 ISA rev 0x00
iic0 at viapm0
iic0: addr 0x4a 00=1f 01=03 02=7f 03=07 05=30 06=c0 07=90 08=1f 09=03 0a=7f
0b=07 0d=30 0e=c0 0f=90 10=1f 11=03 12=7f 13=07 15=30 16=c0 17=90 18=1f 19=03
1a=7f 1b=07 1d=30 1e=c0 1f=90 20=1f 21=03 22=7f 23=07 25=30 26=c0 27=90 28=1f
29=03 2a=7f 2b=07 2d=30 2e=c0 2f=90 30=1f 31=03 32=7f 33=07 35=30 36=c0 37=90
38=1f 39=03 3a=7f 3b=07 3d=30 3e=c0 3f=90 40=1f 41=03 42=7f 43=07 

Re: 4.3 Beta: no sound

2008-02-29 Thread Girish Venkatachalam
On 22:15:17 Feb 29, Claus Assmann wrote:
 I've upgraded one machine to 4.3 Beta (2008-02-23, i386, dmesg
 below) and there is no audio anymore (it used to work with 3.8). I
 tried to cat an audio file directly to the device:
 
 $ file gong.au
 gong.au: Sun/NeXT audio data: 8-bit ISDN u-law, mono, 8000 Hz
 $ cat gong.au  /dev/audio
 $ cat gong.au  /dev/sound
 
 
 and mpg123 (playing song36.mp3 with various options),
 and mplayer, xine, vlc to play some DVDs: video is shown (even though
 mplayer is jerky), but no audio.
 
 What can I check next?
 
 $ mixerctl
 outputs.master=199,199
 outputs.master.mute=off
 outputs.mono=255
 outputs.mono.mute=off
 outputs.mono.source=mixerout
 outputs.headphones=255,255
 outputs.headphones.mute=off
 outputs.surround=255,255
 outputs.surround.mute=off
 outputs.center=255
 outputs.center.mute=off
 outputs.lfe=255
 outputs.lfe.mute=off
 inputs.speaker=255
 inputs.speaker.mute=off
 inputs.phone=191
 inputs.phone.mute=off
 inputs.mic=191
 inputs.mic.mute=off
 inputs.mic.preamp=off
 inputs.mic.source=mic0
 inputs.line=191,191
 inputs.line.mute=off
 inputs.cd=191,191
 inputs.cd.mute=off
 inputs.video=255,255
 inputs.video.mute=off
 inputs.aux=191,191
 inputs.aux.mute=off
 inputs.dac=191,191
 inputs.dac.mute=off
 record.source=mic
 record.volume=255,255
 record.volume.mute=off
 outputs.extamp=off
 # I turned off all mute fields as stated in the FAQ.
 

Not sure if it would apply in your case but still...

You can try the UKC stuff.

# config -e -o bsd.new /bsd

And then do a find  auvia and change the PCI device and function
numbers to match the output of scanpci.

But I have most sound cards working even with the above parameters
showing -1.

Your dmesg shows no errors, so this trick might work.

If it doesn't then you can try mplayer with various audio output
drivers.

$ mplayer -ao help

Thanks.

-Girish