Re: cvs.1 contains dead link under SEE ALSO

2008-04-18 Thread Jason McIntyre
On Fri, Apr 18, 2008 at 01:55:49AM +0200, Jona Joachim wrote:
 Hi!
 At the end of the CVS(1) manpage, under the SEE ALSO section, there is a link 
 to
 http://www.loria.fr/~molli/cvs-index.html
 There seems to be no content anymore under this url.
 
 Best regards,
 Jona

there are a few pages that are not directly maintained by developers,
and cvs(1) is such a page. notice how cvs(1) doesn;t have OpenBSD
XX Manual as a header?

generally speaking, if you find fault with such a page, it's more
helpful if you check whether the issue still exists in the latest
version of the software and, if it does, mail the maintainers of the
software a fix, or at least report it.

then, when software gets updated, we get the fix.

jmc



XForwarding + skype

2008-04-18 Thread Pau
Hi,

as you have guessed from the subject, I am ssh -X to another pc in
which there is skype installed. Most of the people I work with use
this thing to send messages around to meet etc (instead of emailing or
using talk, which must be too complicated for them), and I am the only
obsd user. Since I do not want to install skype on this obsd laptop, I
thought I could ssh -X and call skype from there, since I do not need
audio.
There are no other possible softare, since skype uses a close
protocol. It's the philosophy of use me or go away. Ok, I don't want
to discuss on this now.

My question is: I am not an expert. I know how to install obsd, use it
for what I need (I'm using it as my main OS) and full stop. But I
don't have a clue of how insecure it is to do what I am doing.

Your opinion?

Thanks



Power button doesn't work properly

2008-04-18 Thread Zbigniew Baniewski
I would to have a possibility to make a proper shutdown just by pressing
power button. So I've enabled apmd, and created a script /etc/apm/powerdown
with the contents:

  #!/bin/sh
  /sbin/halt -p

Unfortunately, the script doesn't seem to be called by apmd. When I press
the power button, I'm getting the error message:

  apm0: APM set power state: unable to enter requested state (96)

Of course, instead of proper shutdown, power outage follows - resulting in
filesystem was not properly unmounted messages by next boot.

Not sure, how to fix it. Actually, I didn't want from APM to enter any power
state - just to execute /etc/apm/powerdown and nothing more.

APM is enabled in BIOS - it's old BX-based motherboard (Abit BE6-II), so
rather no problem with something unsupported - and apmd's introducing
himself during startup:

  Apr 18 04:58:49 sarge /bsd: apm0 at bios0: Power Management spec V1.2
  Apr 18 04:58:49 sarge /bsd: apm0: AC on, battery charge unknown
  Apr 18 04:58:49 sarge /bsd: apm0: flags 70102 dobusy 1 doidle 1

From that error message (unable to enter requested state) I understand,
that button-press event is recognized by apmd. Perhaps there's a way to
change its action - I mean: instead of trying to enter requested state
(whatever it is), just to execute /etc/apm/powerdown ?

OpenBSD 4.2 i386
-- 
pozdrawiam / regards

Zbigniew Baniewski



Re: Dell RAID controller

2008-04-18 Thread Marco Peereboom
Should work with mpi.  If not it is trivial to add the pci ids.

On Thu, Apr 17, 2008 at 08:43:20AM -0300, John Nietzsche wrote:
 Dear gentleman,
 
 i am setting a dell server to run openbsd 4.3. I am aware dell perc 6i
 and 6e are supported, what about dell perc SAS 6e?
 
 Thank in advance.



Environment variables

2008-04-18 Thread Jurjen Oskam
Hi there,

I'm seeing something I don't quite understand concerning environment
variables. (This is on an OpenBSD 4.2 amd64 system) I hope someone here
can explain.

Given the following C-program:

#include stdio.h
#include errno.h
#include stdlib.h

int main(int argc, char **argv)
{
 char *var1  = FOO=TESTING;
 int  rc;

 sleep(10);

 rc = putenv(var1);
 if (rc  0) {
   printf(Error inserting %s in environ, errno = %d\n,
   var1, errno);
   return 1;
 }

 printf(%s inserted in environ\n, var1);
 sleep(10);

 return 0;
}

In another terminal, I start a while loop:

$ while true ; do ps -eww | grep F[O]O ; sleep 1 ; done

When I run this program using env -i ./a.out, the while loop
in the other terminal doesn't show any output at all. ps doesn't
seem to see FOO being put in the environment.

However, when I start the program using env -i FOO=BAR ./a.out, the
while loop in the other terminal shows this output, beginning right after
the start of the program:

20571 p2  I+  0:00.00 FOO=BAR (a.out)
20571 p2  I+  0:00.00 FOO=BAR (a.out)
20571 p2  I+  0:00.00 FOO=BAR (a.out)
20571 p2  I+  0:00.00 FOO=BAR (a.out)
20571 p2  I+  0:00.00 FOO=BAR (a.out)
20571 p2  I+  0:00.00 FOO=BAR (a.out)
20571 p2  I+  0:00.00 FOO=BAR (a.out)
20571 p2  I+  0:00.00 FOO=BAR (a.out)
20571 p2  I+  0:00.00 FOO=BAR (a.out)
20571 p2  I+  0:00.00 FOO=BAR (a.out)
20571 p2  I+  0:00.00 FOO=TESTING (a.out)
20571 p2  I+  0:00.00 FOO=TESTING (a.out)
20571 p2  I+  0:00.00 FOO=TESTING (a.out)
20571 p2  I+  0:00.00 FOO=TESTING (a.out)
20571 p2  I+  0:00.00 FOO=TESTING (a.out)
20571 p2  I+  0:00.00 FOO=TESTING (a.out)
20571 p2  I+  0:00.00 FOO=TESTING (a.out)
20571 p2  I+  0:00.00 FOO=TESTING (a.out)
20571 p2  I+  0:00.00 FOO=TESTING (a.out)
20571 p2  I+  0:00.00 FOO=TESTING (a.out)


So ps does show FOO, *and* it shows the value of FOO changing after
ten seconds.

I don't understand this behaviour. On another system (AIX), ps does pick
up newly set environment variables. Is this behaviour implementation
dependent? 

Thanks,
-- 
Jurjen Oskam

Savage's Law of Expediency:
You want it bad, you'll get it bad.



Re: Environment variables

2008-04-18 Thread Almir Karic
On Fri, Apr 18, 2008 at 3:20 PM, Jurjen Oskam [EMAIL PROTECTED] wrote:
  So ps does show FOO, *and* it shows the value of FOO changing after
  ten seconds.


what is so weird about it? you set your program an env var via env(1)
for first ten seconds it has that env var, than the putenv(3) call
happens and it changes the value of FOO.


-- 
error: one bad user found in front of screen



Re: Environment variables

2008-04-18 Thread Otto Moerbeek
On Fri, Apr 18, 2008 at 03:20:56PM +0200, Jurjen Oskam wrote:

 Hi there,
 
 I'm seeing something I don't quite understand concerning environment
 variables. (This is on an OpenBSD 4.2 amd64 system) I hope someone here
 can explain.
 
 Given the following C-program:
 
 #include stdio.h
 #include errno.h
 #include stdlib.h
 
 int main(int argc, char **argv)
 {
  char *var1  = FOO=TESTING;
  int  rc;
 
  sleep(10);
 
  rc = putenv(var1);
  if (rc  0) {
printf(Error inserting %s in environ, errno = %d\n,
var1, errno);
return 1;
  }
 
  printf(%s inserted in environ\n, var1);
  sleep(10);
 
  return 0;
 }
 
 In another terminal, I start a while loop:
 
 $ while true ; do ps -eww | grep F[O]O ; sleep 1 ; done
 
 When I run this program using env -i ./a.out, the while loop
 in the other terminal doesn't show any output at all. ps doesn't
 seem to see FOO being put in the environment.
 
 However, when I start the program using env -i FOO=BAR ./a.out, the
 while loop in the other terminal shows this output, beginning right after
 the start of the program:
 
 20571 p2  I+  0:00.00 FOO=BAR (a.out)
 20571 p2  I+  0:00.00 FOO=BAR (a.out)
 20571 p2  I+  0:00.00 FOO=BAR (a.out)
 20571 p2  I+  0:00.00 FOO=BAR (a.out)
 20571 p2  I+  0:00.00 FOO=BAR (a.out)
 20571 p2  I+  0:00.00 FOO=BAR (a.out)
 20571 p2  I+  0:00.00 FOO=BAR (a.out)
 20571 p2  I+  0:00.00 FOO=BAR (a.out)
 20571 p2  I+  0:00.00 FOO=BAR (a.out)
 20571 p2  I+  0:00.00 FOO=BAR (a.out)
 20571 p2  I+  0:00.00 FOO=TESTING (a.out)
 20571 p2  I+  0:00.00 FOO=TESTING (a.out)
 20571 p2  I+  0:00.00 FOO=TESTING (a.out)
 20571 p2  I+  0:00.00 FOO=TESTING (a.out)
 20571 p2  I+  0:00.00 FOO=TESTING (a.out)
 20571 p2  I+  0:00.00 FOO=TESTING (a.out)
 20571 p2  I+  0:00.00 FOO=TESTING (a.out)
 20571 p2  I+  0:00.00 FOO=TESTING (a.out)
 20571 p2  I+  0:00.00 FOO=TESTING (a.out)
 20571 p2  I+  0:00.00 FOO=TESTING (a.out)
 
 
 So ps does show FOO, *and* it shows the value of FOO changing after
 ten seconds.
 
 I don't understand this behaviour. On another system (AIX), ps does pick
 up newly set environment variables. Is this behaviour implementation
 dependent? 

It might be the number of env vars is fixed in the process info, while
the environ array can be modified by the process, I suspect that
ps_nenvstr in struct ps_strings on the kernel side is not updated.

-Otto



Crash with acpi enabled

2008-04-18 Thread Steve Shockley

I'm setting up an HP d530 desktop with 4.3-release.  With acpi enabled,
it crashes during boot (after install), with it disabled it seems to
work okay.  Below is the dmesg/trace/ps when it crashes, below that is a 
successful boot with acpi disabled.


 OpenBSD/i386 BOOT 3.01
boot
booting hd0a:/bsd: 0x72a4d4
entry point at 0x200120
[ using 595232 bytes of bsd ELF symbol table ]
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California.  All rights reserved.
Copyright (c) 1995-2008 OpenBSD. All rights reserved. 
http://www.OpenBSD.org


OpenBSD 4.3 (GENERIC) #698: Wed Mar 12 11:07:05 MDT 2008
[EMAIL PROTECTED]:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: Intel(R) Pentium(R) 4 CPU 2.80GHz (GenuineIntel 686-class) 2.80 GHz
cpu0: 
FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CF

LUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,SBF,CNXT-ID,xTPR
real mem  = 527986688 (503MB)
avail mem = 502472704 (479MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 07/10/03, BIOS32 rev. 0 @ 0xeb4e0, 
SMBIOS

rev. 2.3 @ 0xf8dd4 (61 entries)
bios0: vendor Hewlett-Packard version 786B2 v1.11 date 07/10/2003
bios0: Hewlett-Packard HP d530 CMT(DR533S)
acpi0 at bios0: rev 0
acpi0: tables DSDT FACP SSDT SSDT SSDT SSDT SSDT SSDT SSDT APIC SSDT 
ASF! SSDT SSDT SSDT SSDT SSDT SSDT SSDT SSDT SSDT SSDT SSDT
acpi0: wakeup devices PCI0(S4) HUB_(S4) COM1(S4) COM2(S4) USB1(S3) 
USB2(S3) USB3(S3) USB4(S3) EUSB(S3) PBTN(S4)

acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpiprt0 at acpi0 [\DCHM] 0xd115f684 cnt:02 stk:00 field: bitpos=0da8 
bitlen=0120 ref1:d1152c84 ref2:0 [Field] [\BIOS] 0xd1152c84 cnt:39 
stk:00 opregion: 00,000ea440,fc0

wrong setbufint type 5

c013 Called: \GDBF
  arg0:  0xd1141510 cnt:01 stk:00 objref: 0xd115f684 index:
 [\DCHM] 0xd115f684 cnt:02 stk:00 field: bitpos=0da8 bitlen=0120 
ref1:d1152c84 ref2:0 [Field]

 [\BIOS] 0xd1152c84 cnt:39 stk:00 opregion: 00,000ea440,fc0
  arg1:  0xd114153c cnt:01 stk:00 objref: 0xd115743c index: 
0xd115743c cnt:00 stk:61 integer: 0c175 Called: \_SB_.PCI0._CRS

  local0:  0xd1157410 cnt:00 stk:60 integer: 6c
  local1:  0xd115743c cnt:00 stk:61 integer: 0
panic: aml_die aml_setbufint:988
Stopped at  Debugger+0x4:   leave
Debugger(d078aad0,d1160850,d092c568,8,160) at Debugger+0x4
panic(d077e9b5,d077ea94,3dc,d1157410,d1152c84) at panic+0x63
_aml_die(d077ea94,3dc,d077ea7b,5,d115f684,0,d092c5c8,d0447fcb) at 
_aml_die+0x46


aml_setbufint(d1167b90,0,20,d115f684) at aml_setbufint+0x38
aml_fieldio(d1167844,d11678c4,d1167b90,0,d1167844) at aml_fieldio+0x5f
aml_derefvalue(d1167844,d11678c4,0,d1167b50,d1167a10) at aml_derefvalue+0xcb
aml_evalterm(d1167844,d1167b50,d1167a10,d0673781,38) at aml_evalterm+0x20
aml_parseterm(d1167844,d1167a10,d092c728,d05cedd5,d1167844) at 
aml_parseterm+0x

37
aml_parseref(d1167844,a4,d11679d0,7d) at aml_parseref+0x27e
aml_parseop(d1167844,d11679d0,74) at aml_parseop+0xe6
RUN AT LEAST 'trace' AND 'ps' AND INCLUDE OUTPUT WHEN REPORTING THIS PANIC!
DO NOT EVEN BOTHER REPORTING THIS WITHOUT INCLUDING THAT INFORMATION!
ddb trace
Debugger(d078aad0,d1160850,d092c568,8,160) at Debugger+0x4
panic(d077e9b5,d077ea94,3dc,d1157410,d1152c84) at panic+0x63
_aml_die(d077ea94,3dc,d077ea7b,5,d115f684,0,d092c5c8,d0447fcb) at 
_aml_die+0x46


aml_setbufint(d1167b90,0,20,d115f684) at aml_setbufint+0x38
aml_fieldio(d1167844,d11678c4,d1167b90,0,d1167844) at aml_fieldio+0x5f
aml_derefvalue(d1167844,d11678c4,0,d1167b50,d1167a10) at aml_derefvalue+0xcb
aml_evalterm(d1167844,d1167b50,d1167a10,d0673781,38) at aml_evalterm+0x20
aml_parseterm(d1167844,d1167a10,d092c728,d05cedd5,d1167844) at 
aml_parseterm+0x37

aml_parseref(d1167844,a4,d11679d0,7d) at aml_parseref+0x27e
aml_parseop(d1167844,d11679d0,74) at aml_parseop+0xe6
aml_parseterm(d1167844,d1141568,390,d05cedd5,d1167844) at aml_parseterm+0x2c
aml_callmethod(d1167844,d1141568,d115503f,d1160a44,d1167504) at 
aml_callmethod+0x26
aml_evalmethod(d1167504,d1160a44,2,d1141510,d1141568,d114153c,74,d1141510) 
at aml_evalmethod+0x41

aml_derefvalue(d1167504,d1160a84,1,101) at aml_derefvalue+0x8d
aml_derefvalue(d1167504,d1167810,0,d1167810,d1167790) at aml_derefvalue+0xf6
aml_evalterm(d1167504,d1167810,d1167790,d0673781,38) at aml_evalterm+0x20
aml_parseterm(d1167504,d1167790,d092c8e8) at aml_parseterm+0x37
aml_parseref(d1167504,70,d1167790,a9) at aml_parseref+0xeb
aml_parseop(d1167504,d1167790,74) at aml_parseop+0xe6
aml_parseterm(d1167504,d092ca10,390,30,d1167504) at aml_parseterm+0x2c
aml_callmethod(d1167504,d092ca10,d115521c,d1160844,d077fb42) at 
aml_callmethod+0x26

aml_evalmethod(0,d1160844,0,0,d092ca10) at aml_evalmethod+0x41
aml_evalnode(d1153e00,d1160844,0,0,d092ca10,d092ca10,64,d114cb50) at 
aml_evalnode+0xc7
acpiprt_getpcibus(d1167540,d115b1c4,d092cab8,d114cb60,0) at 
acpiprt_getpcibus+0x30
acpiprt_attach(d1153e00,d1167540,d092cb40,d1153e00,d1153e00) at 
acpiprt_attach+0x22

config_attach(d1153e00,d07852c8,d092cb40,d06713c4) at config_attach+0xfd

Re: Permission problems using NFS on OpenBSD 4.2

2008-04-18 Thread Gregorio Arvilla
Cel,

I think that I should have included the misc@openbsd.org account in
my reply. Sorry for the mistake.

Greg



-Original Message-
From: Gregorio Arvilla
Sent: Friday, April 18, 2008 9:10 AM
To: 'Christopher Linn'
Subject: RE: Permission problems using NFS on OpenBSD 4.2

Cel,

Thank you for your reply.

Your suggestion worked, I modified the -network flag in the exports file
to the correct settings and was able to mount the directory.

Thank you very much.

Greg



-Original Message-
From: Christopher Linn [mailto:[EMAIL PROTECTED]
Sent: Thursday, April 17, 2008 7:06 PM
To: Gregorio Arvilla
Cc: misc@openbsd.org
Subject: Re: Permission problems using NFS on OpenBSD 4.2

hi gregorio,

On Thu, Apr 17, 2008 at 04:00:19PM -0600, Gregorio Arvilla wrote:
 Hi There,

 I'm trying to use NFS on OpenBSD 4.2 but I'm getting permission
errors.
 Here are the contents of the exports file:

 # $OpenBSD: exports,v 1.2 2002/05/31 08:15:44 pjanzen Exp $ # # NFS
 exports Database # See exports(5) for more information.  Be very
 careful: misconfiguration # of this file can result in your
 filesystems being readable by the world.
 /public_nfs -alldirs -ro -network=10.0.0 -mask=255.255.255.0


as mentioned you have an incorrect -network=address, there should be 4
numbers and 3 dots.  do you see any complaints when starting the NFS
server?

also, is 10.0.0 really a typo that should read 10.10.1.0, as the NFS
client information below would suggest?  fix the exports file to reflect
the network it is NFS sharing to.  it looks like you are wanting to do
all this on the 10.10.1.0 255.255.255.0 network, is that correct?

cel


 Here are the contents of the rc.conf.local file:

 ntpd_flags=  # enabled during install
 nfs_server=YES
 portmap=YES


 And here are the contents of hosts file:

 # $OpenBSD: hosts,v 1.11 2002/09/26 23:35:51 krw Exp $ # # Host
 Database # # RFC 1918 specifies that these networks are internal.
 # 10.0.0.0  10.255.255.255
 # 172.16.0.0172.31.255.255
 # 192.168.0.0   192.168.255.255
 #
 ::1 localhost.epvgroup localhost
 127.0.0.1 localhost.epvgroup localhost
 ::1 lappc2.epvgroup lappc2
 127.0.0.1 lappc2.epvgroup lappc2
 10.10.1.232 epv2.epvgroup.com epv2

 From the 10.10.1.232 machine I'm trying to mount the /public_nfs
 directory, here is the command and the output:

 [EMAIL PROTECTED] greg]# mount -t nfs 10.10.1.110:/public_nfs /home/greg/mnt
 mount: 10.10.1.110:/public_nfs failed, reason given by server:
 Permission denied
 [EMAIL PROTECTED] greg]#


 I'm wondering if you can tell me what settings do I have to modify to
 give permissions to mount the directory.

 Thank You

 Greg

--
Christopher Linn celinn at mtu.edu  | By no means shall either the CEC
System Administrator II   | or MTU be held in any way liable
  Center for Experimental Computation | for any opinions or conjecture I
Michigan Technological University | hold to or imply to hold herein.



Re: Permission problems using NFS on OpenBSD 4.2

2008-04-18 Thread Christopher Linn
On Fri, Apr 18, 2008 at 09:16:58AM -0600, Gregorio Arvilla wrote:
[...]
 -Original Message-
 From: Gregorio Arvilla 
 Sent: Friday, April 18, 2008 9:10 AM
 To: 'Christopher Linn'
 Subject: RE: Permission problems using NFS on OpenBSD 4.2
 
 Cel,
 
 Thank you for your reply.
 
 Your suggestion worked, I modified the -network flag in the exports file
 to the correct settings and was able to mount the directory.
 
 Thank you very much.

you are welcome  8*)

cel

-- 
Christopher Linn celinn at mtu.edu  | By no means shall either the CEC
System Administrator II   | or MTU be held in any way liable
  Center for Experimental Computation | for any opinions or conjecture I
Michigan Technological University | hold to or imply to hold herein.



More factoids about OpenBSD folks use in advocacy?

2008-04-18 Thread Protocol Six Consulting

Hi,

I love using OpenBSD in the networks I administer.
It does what I need simply, elegantly and with great power (not to 
mention for free)


When I tell others about OpenBSD I can easily tell them what I like, but 
I was also curious what sort of (verifiable) factoids folks here 
highlight when advocating for OpenBSD.



Some of the ones I've jotted down are:

OpenBSD:

 Only two remote holes in the default install, in more than 10 years! 
- from the project site, obviously


 An OS that has some of the cleanest code around - paraphrased from an 
interview with Theo by a local news channel


Amount of attacks on a webserver can go down by 40% just because the 
bad guys see it is running OpenBSD - would love to know where that 
originally comes from!!


Made by the same people that make OpenSSH, which just about everybody 
uses for secure remote access


The OpenBSD project currently maintains ports for 17 different hardware 
platforms - from Wikipedia, possibly dated.


The project is also noted for the exceptional  documentation and a 
community that expects its users to have read the documentation before 
asking any technical questions  -



I'd love to hear more one-liners like this.  :-)



*

*



Re: hoststated not setting up rules in pf

2008-04-18 Thread Stuart Henderson
On 2008-04-18, The Anarcat [EMAIL PROTECTED] wrote:

  3. pf never gets any rdr rule from hoststated:
  # pfctl -s all | grep rdr
  rdr-anchor hoststated/* all

anchors aren't normally listed by pfctl, you would need to use
pfctl -a 'hoststated/*' -sn, but I have a feeling this may have
been broken in 4.2.



Re: SGI install -current: autoboot failed

2008-04-18 Thread Joel Sing
On Friday 18 April 2008, John N. Brahy wrote:
 Hi,

 I seemed to be successful installing OpenBSD -current for SGI. When I
 reboot the system after the install I get this error:

 Boot file not found on device:
 pci(0)scsi(0)disk(1)rdisk(0)partition(8)/sash
 Autoboot failed
 Unable to continue; press enter to return to the menu:


 I think I'm gun shy from my mac installs but there is a p partition on
 the drive that takes up the first 3515 blocks of the drive and I'm
 thinking I have to leave that there. Please correct me if I'm wrong.
 Otherwise I did the normal install...

Yes, you need to leave it there - the SGI Volume Header takes up the first few 
blocks of the disk.

 Anyone have any suggestions on what do to right?

Assuming your installation has completed correctly, all you need to do is 
change the OSLoader variable in your ARCS firmware from ``/sash'' (or 
``sash'') to ``boot'' - it's still looking for the IRIX boot loader. This is 
easily done by typing ``setenv OSLoader boot at the ARCS console (enter 
Maintenance Mode and select ``Enter Command Monitor).
-- 

 = Joel Sing | [EMAIL PROTECTED] | 0419 577 603 =


 Real stupidity beats artificial intelligence every time.
  - Terry Pratchett, Hogfather



Re: Environment variables

2008-04-18 Thread Jurjen Oskam
On Fri, Apr 18, 2008 at 04:21:08PM +0200, Almir Karic wrote:

 On Fri, Apr 18, 2008 at 3:20 PM, Jurjen Oskam [EMAIL PROTECTED] wrote:
   So ps does show FOO, *and* it shows the value of FOO changing after
   ten seconds.
 
 
 what is so weird about it? you set your program an env var via env(1)
 for first ten seconds it has that env var, than the putenv(3) call
 happens and it changes the value of FOO.

That in itself is not weird. What I meant was that if the variable
isn't set at the start of the program, ps won't see it at all, not even
after the program sets it. 

-- 
Jurjen Oskam

Savage's Law of Expediency:
You want it bad, you'll get it bad.



Re: More factoids about OpenBSD folks use in advocacy?

2008-04-18 Thread Steve Shockley

Protocol Six Consulting wrote:

When I tell others about OpenBSD I can easily tell them what I like, but
I was also curious what sort of (verifiable) factoids folks here
highlight when advocating for OpenBSD.


Personally, I'm a fan of OpenBSD because the dev team is uncompromising. 
 Even though I don't always agree with them, I can understand the 
reasoning.




hoststated/relayd and Linux's tcp_tw_recycle option

2008-04-18 Thread Matthew Dempsky
I setup hoststated earlier this week to provide load balancing and
fail over for a few Linux web servers.  It went fairly smoothly,
except that one of the Linux machines only passed the 'check http /
code 200' test about 50% of the time.  Just using 'check tcp' worked
fine, and I saw the same results from another 4.2 box, and even from a
4.3-beta snapshot using relayd.  I could run 'curl -I http://host/' on
any of the OpenBSD boxes in a loop just fine, but the moment I started
hoststated/relayd, curl would start failing about 50% of the time too.
 The SYN packets were showing up in tcpdump on the Linux machine's
interface, but the kernel would just randomly refuse to respond.

Because curl ran fine right up until hoststated was started, I assumed
it was hoststated's fault for the longest time.  But after giving up
trying to find a bug there, I discovered that on the misbehaving Linux
box, the net.ipv4.tcp_tw_recycle=1 sysctl was enabled.

Apparently, this flag changes how Linux handles sockets in TIME-WAIT
state (and violates the TCP specification, according to the sparse
documentation), which I'm guessing doesn't play nicely with OpenBSD's
sequence number randomization.  It was originally set because one of
the database vendors we spoke with suggested a bunch of sysctl changes
for optimization (some necessary like fixing memory overcommit), but
also bad ones like that.  (Searching google shows a lot of hits for
people mindlessly suggesting to enable tcp_tw_recycle.)

Just thought I'd mention this in case it saves someone else the same
frustrating experience.



Re: continuous message after 4.2 install (dmesg included)

2008-04-18 Thread [EMAIL PROTECTED]
included dmesgthanks for your time.


[EMAIL PROTECTED] wrote:
 
 Hi all,
   I just finished installing 4.2. after I reboot I get the following
 message(s) continously:
 
 ichiico: exec: op 1, addr 0x28, cmdlen 1, len 1, flags 0x00: timeout,
 status 0x0
 ichiico: exec: op 1, addr 0x28, cmdlen 1, len 1, flags 0x00: timeout,
 status 0x0
 ichiico: exec: op 3, addr 0x28, cmdlen 1, len 1, flags 0x00: timeout,
 status 0x0
 ichiico: exec: op 1, addr 0x28, cmdlen 1, len 1, flags 0x00: timeout,
 status 0x0
 ichiico: exec: op 1, addr 0x28, cmdlen 1, len 1, flags 0x00: timeout,
 status 0x0
 ichiico: exec: op 3, addr 0x28, cmdlen 1, len 1, flags 0x00: timeout,
 status 0x0
 
 Any ideas? Do I need to disable/change something?
 
 Thanks in advance. http://www.nabble.com/file/p16755486/dmesg.txt
 dmesg.txt 
 
http://www.nabble.com/file/p16763576/dmesg.txt dmesg.txt 
http://www.nabble.com/file/p16763576/dmesg.txt dmesg.txt 
-- 
View this message in context: 
http://www.nabble.com/continuous-message-after-4.2-install-%28dmesg-included%29-tp16755486p16763576.html
Sent from the openbsd user - misc mailing list archive at Nabble.com.



Re: More factoids about OpenBSD folks use in advocacy?

2008-04-18 Thread Matthew Dempsky
On Fri, Apr 18, 2008 at 8:34 AM, Protocol Six Consulting
[EMAIL PROTECTED] wrote:
  When I tell others about OpenBSD I can easily tell them what I like, but I
 was also curious what sort of (verifiable) factoids folks here highlight
 when advocating for OpenBSD.

You should just take some from http://www.chucknorrisfactoids.com/ and
http://geekz.co.uk/schneierfacts/ and replace Chuck Norris and
Bruce Schneier with Theo and OpenBSD.



Re: Environment variables

2008-04-18 Thread Paul Irofti
On Fri, Apr 18, 2008 at 03:20:56PM +0200, Jurjen Oskam wrote:
 Hi there,
 
 I'm seeing something I don't quite understand concerning environment
 variables. (This is on an OpenBSD 4.2 amd64 system) I hope someone here
 can explain.
 
 Given the following C-program:
 
 #include stdio.h
 #include errno.h
 #include stdlib.h
 
 int main(int argc, char **argv)
 {
  char *var1  = FOO=TESTING;

A bit OT but you should really alloc that or use a static.



Re: hoststated/relayd and Linux's tcp_tw_recycle option

2008-04-18 Thread Denis Doroshenko
google quickly gives a url

http://kbase.redhat.com/faq/FAQ_80_6180.shtm

where it is said It is likely an artifact of having
tcp_tw_recycle and tcp_tw_reuse enabled in the
sysctl settings.

On Fri, Apr 18, 2008 at 8:08 PM, Matthew Dempsky [EMAIL PROTECTED] wrote:
 I setup hoststated earlier this week to provide load balancing and
  fail over for a few Linux web servers.  It went fairly smoothly,
  except that one of the Linux machines only passed the 'check http /
  code 200' test about 50% of the time.  Just using 'check tcp' worked
  fine, and I saw the same results from another 4.2 box, and even from a
  4.3-beta snapshot using relayd.  I could run 'curl -I http://host/' on
  any of the OpenBSD boxes in a loop just fine, but the moment I started
  hoststated/relayd, curl would start failing about 50% of the time too.
   The SYN packets were showing up in tcpdump on the Linux machine's
  interface, but the kernel would just randomly refuse to respond.

  Because curl ran fine right up until hoststated was started, I assumed
  it was hoststated's fault for the longest time.  But after giving up
  trying to find a bug there, I discovered that on the misbehaving Linux
  box, the net.ipv4.tcp_tw_recycle=1 sysctl was enabled.

  Apparently, this flag changes how Linux handles sockets in TIME-WAIT
  state (and violates the TCP specification, according to the sparse
  documentation), which I'm guessing doesn't play nicely with OpenBSD's
  sequence number randomization.  It was originally set because one of
  the database vendors we spoke with suggested a bunch of sysctl changes
  for optimization (some necessary like fixing memory overcommit), but
  also bad ones like that.  (Searching google shows a lot of hits for
  people mindlessly suggesting to enable tcp_tw_recycle.)

  Just thought I'd mention this in case it saves someone else the same
  frustrating experience.



Is there a badblocks-equivalent for OpenBSD?

2008-04-18 Thread ropers
Sometimes I find myself in need of a disk checking utility that can
check both disks with known *and unknown* filesystems, and/or that can
check even currently unpartitioned space on a disk.

There exists such a program for Linux, called badblocks:
http://www.linuxmanpages.com/man8/badblocks.8.php
A command of badblocks -svn /dev/devicename allows me to scan all
kinds of disks, even some of these old Macintosh floppies and other
esoteric stuff. The n is for a non-destructive read and write scan.
Basically it scans the entire disk, and doesn't care what's on it, it
just reads every single bit of data on the device, then does its write
test and write back the original data. Sure, fsck can also scan disks,
but AFAIK it can't do a surface scan, much less of an unknown file
system, because fsck only invokes file-system-specific programs.

Thus far, I've mostly booted Linux Live-CDs and then issued badblocks
-svn /dev/devicename whenever I needed to do such checks.

Is there a way to do the same thing with OpenBSD? I am not a
programmer, and anything exceeding script-kiddie level scripting will
probably be over my head.

Many thanks and kind regards,
--ropers



CARP LAN outgoing IP address

2008-04-18 Thread Gábri Máté
Dear List,

I have two firewalls with ngnix serving a few apache servers. I have to use
CARP on the LAN side so i don't have to change the default gateway on the web
servers when one of the firewalls goes down.
My problem is, that in the apache logs i see the firewalls physical IP address
not the CARP address. Lets say CARP is 192.168.1.100, firewall1 is
192.168.1.1 and firewall2 is 192.168.1.2. If a connection is through
firewall1, then in the apache logs i see 192.168.1.1.
This is normal, but is there a way to make the outgoing package to have the
internal CARP device's address as source IP? I've read through the ngnix docs
but found nothing helpful. I think the key is in PF.
Thank You for your help and advice!

--
Gabri Mate
[EMAIL PROTECTED]
http://www.duosol.hu
Tel: 20/589-5456

[demime 1.01d removed an attachment of type application/pgp-signature which had 
a name of signature.asc ]



Re: hoststated/relayd and Linux's tcp_tw_recycle option

2008-04-18 Thread Matthew Dempsky
On Fri, Apr 18, 2008 at 11:13 AM, Denis Doroshenko
[EMAIL PROTECTED] wrote:
 google quickly gives a url

  http://kbase.redhat.com/faq/FAQ_80_6180.shtm

  where it is said It is likely an artifact of having
  tcp_tw_recycle and tcp_tw_reuse enabled in the
  sysctl settings.

Okay?

The problem I was facing is that I didn't consider I needed to check
for a violate_rfc_793 sysctl on one of the Linux hosts, and that it
only started causing problems while hoststated/relayd was running.  I
wasn't the one who added tcp_tw_recycle=1 to that machine's
sysctl.conf, otherwise I would have checked the Linux kernel
documentation and questioned the database vendor's advice.



Re: Environment variables

2008-04-18 Thread Jurjen Oskam
On Fri, Apr 18, 2008 at 08:47:44PM +0300, Paul Irofti wrote:

  int main(int argc, char **argv)
  {
   char *var1  = FOO=TESTING;
 
 A bit OT but you should really alloc that or use a static.

I'm almost a complete C non-programmer; I've copy-pasted this program
from somewhere on the Web. You'll not be seeing me near any C code with
any significant value anytime soon. :)

But thanks for the tip.

-- 
Jurjen Oskam

Savage's Law of Expediency:
You want it bad, you'll get it bad.



Re: CARP LAN outgoing IP address

2008-04-18 Thread Gábri Máté
Ezzel a datummal: Friday 18 April 2008 21.29.18 ezt mrta:
 On Fri, Apr 18, 2008 at 11:48 AM, Gabri Mati [EMAIL PROTECTED] wrote:
   This is normal, but is there a way to make the outgoing package to have
  the internal CARP device's address as source IP?

 What would this accomplish?  If one of the nginx machines goes down,
 the TCP sessions won't be able to failover to the other carp peer.
 I'd prefer to see in my logs which proxy a request came from so I can
 better diagnose if a particular machine is misbehaving.

You're right, but we need the carp'd IP for statistics on the web servers. If
one of the machines goes down then the user just have to hit the refresh
button and she has access to the content again.

--
Gabri Mate
[EMAIL PROTECTED]
http://www.duosol.hu
Tel: 20/589-5456

[demime 1.01d removed an attachment of type application/pgp-signature which had 
a name of signature.asc ]



Re: Is there a badblocks-equivalent for OpenBSD?

2008-04-18 Thread Calomel
Ropers,

You can find the badblocks utility prepackaged in e2fsprogs.
 

Hope this helps,

  BadBlocks Hard Drive Validation and/or Destructive Wipe
  http://calomel.org/badblocks_wipe.html

--
  Calomel @ http://calomel.org
  Open Source Research and Reference


On Fri, Apr 18, 2008 at 08:44:27PM +0200, ropers wrote:
Sometimes I find myself in need of a disk checking utility that can
check both disks with known *and unknown* filesystems, and/or that can
check even currently unpartitioned space on a disk.

There exists such a program for Linux, called badblocks:
http://www.linuxmanpages.com/man8/badblocks.8.php
A command of badblocks -svn /dev/devicename allows me to scan all
kinds of disks, even some of these old Macintosh floppies and other
esoteric stuff. The n is for a non-destructive read and write scan.
Basically it scans the entire disk, and doesn't care what's on it, it
just reads every single bit of data on the device, then does its write
test and write back the original data. Sure, fsck can also scan disks,
but AFAIK it can't do a surface scan, much less of an unknown file
system, because fsck only invokes file-system-specific programs.

Thus far, I've mostly booted Linux Live-CDs and then issued badblocks
-svn /dev/devicename whenever I needed to do such checks.

Is there a way to do the same thing with OpenBSD? I am not a
programmer, and anything exceeding script-kiddie level scripting will
probably be over my head.

Many thanks and kind regards,
--ropers



Re: Is there a badblocks-equivalent for OpenBSD?

2008-04-18 Thread Jon Simola
On 4/18/08, ropers [EMAIL PROTECTED] wrote:
 Sometimes I find myself in need of a disk checking utility that can
  check both disks with known *and unknown* filesystems, and/or that can
  check even currently unpartitioned space on a disk.

Not claiming to be an optimal solution (dd is faster), but does a read
pass across the
entire partition:
$ sudo md5 /dev/rwd0c
MD5 (/dev/rwd0c) = a85c2c67475f983a98007fd9a47378b7

Run it again and compare the hashes if you're worried.

Works on floppies too, broken ones can't be read:
$ sudo md5 /dev/fd0c
md5: /dev/fd0c: read error: Input/output error
$ tail -n1 /var/log/messages
Apr 18 13:13:29 gamma /bsd: fd0c: hard error reading fsbn 0 of 0-3
(st0 40abnrml st1 20bad_crc st2 20bad_crc cyl 0 head 0 sec 1)

In OpenBSD the 'c' partition covers the entire disk, so you'll
probably want that most of
the time. dd is very useful for this as well, but read the man pages carefully.

-- 
Jon



Re: configure squid on openBSD

2008-04-18 Thread Parvinder Bhasin

Anil Saini wrote:

how can i change the default squid configuration options of squid while
installing it from BSD ports

i make changes in Makefile...is it do the trick

also how we do the same thing when we install it thru pkg_add command



-
Anil Saini
M.E. - Software Systems
B.E. - Electronics and Communication

Project Assistant
CISCO LAB
Information Processing Center Unit
BITS-PILANI
  

In the squid ports directory:   /usr/ports/www/squid (i think)
do :   make show=FLAVORS -- This will give you different config 
options...like build it for transparent proxy or with snmp support.  
Choose what you want and then do:

env FLAVOR=transparent snmp make install.

That should do the trick.



RAIDframe, troubles with root on raid with recent -current

2008-04-18 Thread Josh Grosse
I've been using root on raid for some years, and am using a -current system 
from March 22.

I've been unable to boot recently built kernels unless I use boot -a and
select device raid0a manually.  My older kernel works fine.  

With new kernels, booting -s I get:

   # mount
   root_device on / type ffs (local, readonly)
   # mount -a
   mount_ffs /dev/raid0a on /: Invalid argument

The root directory is mountable, just ... not as the root directory.   

   # mount /dev/raid0a /
   mount_ffs /dev/raid0a on /: Invalid argument
   # mount /dev/raidoa /mnt
   #

My kernel uses swapgeneric, since the config file contains only these three
lines:

   include arch/i386/conf/GENERIC
   pseudo-deviceraid4
   option   RAID_AUTOCONFIG

I know there were a few changes to rf_openbsdkintf.c and subr_disk.c at
the end of March, but I'm not a bright enough bulb to debug this myself.

Any pointers?



Re: RAIDframe, troubles with root on raid with recent -current

2008-04-18 Thread Josh Grosse
On Fri, Apr 18, 2008 at 06:10:48PM -0400, I made a typo:

# mount /dev/raidoa /mnt

D'oh!  Typin' stuff by hand, rather than pasting directly.  



Re: Dell RAID controller

2008-04-18 Thread Mikael Kermorgant
  perc6e/i are sas controllers, you can plug either sata or sas
  disks into them.  They should work fine with 4.3.

Hello,

Is there any way to check raid status without having to reboot and get
into the bios ?

Regards,

-- 
Mikael Kermorgant



Re: RAIDframe, troubles with root on raid with recent -current

2008-04-18 Thread Kenneth R Westerback
On Fri, Apr 18, 2008 at 06:10:48PM -0400, Josh Grosse wrote:
 I've been using root on raid for some years, and am using a -current system 
 from March 22.
 
 I've been unable to boot recently built kernels unless I use boot -a and
 select device raid0a manually.  My older kernel works fine.  
 
 With new kernels, booting -s I get:
 
# mount
root_device on / type ffs (local, readonly)
# mount -a
mount_ffs /dev/raid0a on /: Invalid argument
 
 The root directory is mountable, just ... not as the root directory.   
 
# mount /dev/raid0a /
mount_ffs /dev/raid0a on /: Invalid argument
# mount /dev/raidoa /mnt
#
 
 My kernel uses swapgeneric, since the config file contains only these three
 lines:
 
include arch/i386/conf/GENERIC
pseudo-device  raid4
option RAID_AUTOCONFIG
 
 I know there were a few changes to rf_openbsdkintf.c and subr_disk.c at
 the end of March, but I'm not a bright enough bulb to debug this myself.
 
 Any pointers?
 

This is currently broken (deliberately) as changes are made to the
logic concerning mounting the root disk. There are some more changes
that need to be made before a fix to raidframe can be committed.

 Ken



Re: More factoids about OpenBSD folks use in advocacy?

2008-04-18 Thread Rod Whitworth
On Fri, 18 Apr 2008 11:34:14 -0400, Protocol Six Consulting wrote:

Hi,

I love using OpenBSD in the networks I administer.
It does what I need simply, elegantly and with great power (not to
mention for free)

When I tell others about OpenBSD I can easily tell them what I like, but
I was also curious what sort of (verifiable) factoids folks here
highlight when advocating for OpenBSD.


Some of the ones I've jotted down are:

OpenBSD:

 Only two remote holes in the default install, in more than 10 years!
- from the project site, obviously

 An OS that has some of the cleanest code around - paraphrased from an
interview with Theo by a local news channel

Amount of attacks on a webserver can go down by 40% just because the
bad guys see it is running OpenBSD - would love to know where that
originally comes from!!

Made by the same people that make OpenSSH, which just about everybody
uses for secure remote access

The OpenBSD project currently maintains ports for 17 different hardware
platforms - from Wikipedia, possibly dated.

The project is also noted for the exceptional  documentation and a
community that expects its users to have read the documentation before
asking any technical questions  -


I'd love to hear more one-liners like this.  :-)

Then you would like the first sentence of this:
OpenBSD is quite possibly the most secure operating system on the
planet. Every step of the development process focuses on building a
secure, open, and free platform. UNIX. and Linux. administrators take
note: Without realizing it, you probably use tools ported from OpenBSD
every day. Maybe it's time to give the whole operating system a closer
look.
 Full article is at:
http://www.ibm.com/developerworks/aix/library/au-openbsd.html


Rod/

Write a wise saying and your name will live on forever.  - Anonymous



Re: Is there a badblocks-equivalent for OpenBSD?

2008-04-18 Thread Steve Shockley

Jon Simola wrote:

Not claiming to be an optimal solution (dd is faster), but does a
read pass across the entire partition: $ sudo md5 /dev/rwd0c MD5
(/dev/rwd0c) = a85c2c67475f983a98007fd9a47378b7


I think part of what he wanted about badblocks is that it does a 
non-destructive write test as well as a read test.




Re: Is there a badblocks-equivalent for OpenBSD?

2008-04-18 Thread ropers
On 18/04/2008, Calomel [EMAIL PROTECTED] wrote:
 Ropers,

  You can find the badblocks utility prepackaged in e2fsprogs.

THANK YOU! :) I had wondered why I couldn't find badblocks among
OpenBSD's packages. This explains it. I will say in my defense ;-)
that badblocks is not ext2-specific, so while I have now seen that
it's part of these tools, possibly for historic reasons, that's not
necessarily a logical place for it to be.

Looking at the package contents (
http://www.openbsd.org/4.2_packages/i386/e2fsprogs-1.27p5.tgz-contents.html
), I've also figured out how to search for stuff like this in the
future:

http://www.google.ie/search?q=badblocks+inurl%3Aopenbsd.org+inurl%3Acontents.htmlbtnG=Search

I was surprised though to find that GoogleBot doesn't appear to have
indexed most of these pages -- maybe because
http://www.openbsd.org/x.y_packages/architecture.html loads so
slowly?

   BadBlocks Hard Drive Validation and/or Destructive Wipe
   http://calomel.org/badblocks_wipe.html

Thanks for this info as well. I wonder why googling openbsd and
badblocks didn't turn that up for me.

On 18/04/2008, Jon Simola [EMAIL PROTECTED] wrote:
 On 4/18/08, ropers [EMAIL PROTECTED] wrote:
   Sometimes I find myself in need of a disk checking utility that can
check both disks with known *and unknown* filesystems, and/or that can
check even currently unpartitioned space on a disk.


 Not claiming to be an optimal solution (dd is faster), but does a read
  pass across the
  entire partition:
  $ sudo md5 /dev/rwd0c
  MD5 (/dev/rwd0c) = a85c2c67475f983a98007fd9a47378b7

  Run it again and compare the hashes if you're worried.

  Works on floppies too, broken ones can't be read:
  $ sudo md5 /dev/fd0c
  md5: /dev/fd0c: read error: Input/output error
  $ tail -n1 /var/log/messages
  Apr 18 13:13:29 gamma /bsd: fd0c: hard error reading fsbn 0 of 0-3
  (st0 40abnrml st1 20bad_crc st2 20bad_crc cyl 0 head 0 sec 1)

  In OpenBSD the 'c' partition covers the entire disk, so you'll
  probably want that most of
  the time. dd is very useful for this as well, but read the man pages 
 carefully.

Ah! Those are also very good thoughts! Now Steve rightly observed that
I wanted to do a write-test, but come to think of it, something like
this should allow one to do a badblocks -svn-alike non-destructive
write test:

- Use dd to back up the entire device to /tmp.
- then copy /dev/arandom (or even /dev/srandom) to the device until
it's full and use tee to also duplicate what's being written to the
device to /tmp.
- md5sum the latter, duplicate file in /tmp
- md5sum the device, compare the hashes ( delete the file)
- finally, dd the original backup file back to the device and delete the backup.

This kludge could be used as a poor man's badblocks, if that's not
available, but it does require that twice the size of the device is
available in terms of disk space.
Yes, it's kinda horrible and probably useless in most situations, but
there we go. ;-)

Thanks and regards,
--ropers



Re: RAIDframe, troubles with root on raid with recent -current

2008-04-18 Thread Josh Grosse
On Fri, Apr 18, 2008 at 06:51:10PM -0400, Kenneth R Westerback wrote:
 This is currently broken (deliberately) as changes are made to the
 logic concerning mounting the root disk. There are some more changes
 that need to be made before a fix to raidframe can be committed.

Thanks, Ken!



Re: Environment variables

2008-04-18 Thread Ted Unangst

On Apr 18, 2008, at 1:47 PM, Paul Irofti [EMAIL PROTECTED] wrote:


On Fri, Apr 18, 2008 at 03:20:56PM +0200, Jurjen Oskam wrote:



#include stdio.h
#include errno.h
#include stdlib.h

int main(int argc, char **argv)
{
char *var1  = FOO=TESTING;


A bit OT but you should really alloc that or use a static.


Why?



timeouts on http connects outbound

2008-04-18 Thread Moe Sizlak
Hi all,

 Recently I moved from freebsd 6 to openbsd 4.2 but have had some problems.

I get a lot of timeouts on web pages with a high number of hops and I think
it may be something to do with either pf and/or sysctl.

Any help in diagnosing these timeouts much appreciated.


(box is soekris net5501 with three internal lans nat'd outbound.)


sysctl -w net.inet.ip.forwarding=1
sysctl -w net.inet.tcp.mssdflt=1452
sysctl -w net.inet.tcp.recvspace=131072
sysctl -w net.inet.tcp.sendspace=131072
sysctl -w net.inet.udp.recvspace=139264
sysctl -w net.inet.udp.sendspace=32768



--
#   $OpenBSD: pf.conf,v 1.28 2004/04/29 21:03:09 frantzen Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

ext_if=pppoe0
int_if1=vr1
int_if2=vr2
int_if3=vr3
out_net=192.168.11.0/16

# Private networks, we are going to block incoming traffic from them
priv_nets = { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }

netbios_ports = { 135, 137, 138, 139, 445, 1433 }
#table spamd persist
#table spamd-white persist

set block-policy return

scrub in all

nat on $ext_if from $int_if1:network to any - ($ext_if)
nat on $ext_if from $int_if2:network to any - ($ext_if)
nat on $ext_if from $int_if3:network to any - ($ext_if)


#
block all

# block incoming traffic from private networks on external interface
block drop in quick on $ext_if from $priv_nets to any

# block outgoing traffic to private networks on external interface
block drop out quick on $ext_if from any to $priv_nets

block in quick on $ext_if inet proto tcp from any to any flags FUP/FUP
block in quick on $ext_if inet proto tcp from any to any flags SF/SFRA
block in quick on $ext_if inet proto tcp from any to any flags /SFRA
block in quick on $ext_if inet proto tcp from any to any flags F/SFRA
block in quick on $ext_if inet proto tcp from any to any flags U/SFRAU
block in quick on $ext_if inet proto tcp from any to any flags P/P
pass quick on lo0 all

pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state

#pass in on $ext_if proto udp to any port domain

pass in inet proto icmp all icmp-type echoreq  keep state
pass out inet proto icmp all icmp-type echoreq  keep state

pass in on $int_if1 from $int_if1:network to any keep state
pass in on $int_if2 from $int_if2:network to any keep state
pass in on $int_if3 from $int_if3:network to any keep state
pass out on $int_if1 from any to $int_if1:network keep state
pass out on $int_if2 from any to $int_if2:network keep state
pass out on $int_if3 from any to $int_if3:network keep state

#pass quick on { lo $int_if }
#antispoof quick for { lo $int_if }


--



Re: Is there a badblocks-equivalent for OpenBSD?

2008-04-18 Thread Travers Buda
* ropers [EMAIL PROTECTED] [2008-04-19 02:19:18]:

 On 18/04/2008, Calomel [EMAIL PROTECTED] wrote:
  Ropers,
 
   You can find the badblocks utility prepackaged in e2fsprogs.
 
 THANK YOU! :) I had wondered why I couldn't find badblocks among
 OpenBSD's packages. This explains it. I will say in my defense ;-)
 that badblocks is not ext2-specific, so while I have now seen that
 it's part of these tools, possibly for historic reasons, that's not
 necessarily a logical place for it to be.
 
 Looking at the package contents (
 http://www.openbsd.org/4.2_packages/i386/e2fsprogs-1.27p5.tgz-contents.html
 ), I've also figured out how to search for stuff like this in the
 future:
 
 http://www.google.ie/search?q=badblocks+inurl%3Aopenbsd.org+inurl%3Acontents.htmlbtnG=Search
 
 I was surprised though to find that GoogleBot doesn't appear to have
 indexed most of these pages -- maybe because
 http://www.openbsd.org/x.y_packages/architecture.html loads so
 slowly?
 
BadBlocks Hard Drive Validation and/or Destructive Wipe
http://calomel.org/badblocks_wipe.html
 
 Thanks for this info as well. I wonder why googling openbsd and
 badblocks didn't turn that up for me.
 
 On 18/04/2008, Jon Simola [EMAIL PROTECTED] wrote:
  On 4/18/08, ropers [EMAIL PROTECTED] wrote:
Sometimes I find myself in need of a disk checking utility that can
 check both disks with known *and unknown* filesystems, and/or that can
 check even currently unpartitioned space on a disk.
 
 
  Not claiming to be an optimal solution (dd is faster), but does a read
   pass across the
   entire partition:
   $ sudo md5 /dev/rwd0c
   MD5 (/dev/rwd0c) = a85c2c67475f983a98007fd9a47378b7
 
   Run it again and compare the hashes if you're worried.
 
   Works on floppies too, broken ones can't be read:
   $ sudo md5 /dev/fd0c
   md5: /dev/fd0c: read error: Input/output error
   $ tail -n1 /var/log/messages
   Apr 18 13:13:29 gamma /bsd: fd0c: hard error reading fsbn 0 of 0-3
   (st0 40abnrml st1 20bad_crc st2 20bad_crc cyl 0 head 0 sec 1)
 
   In OpenBSD the 'c' partition covers the entire disk, so you'll
   probably want that most of
   the time. dd is very useful for this as well, but read the man pages 
  carefully.
 
 Ah! Those are also very good thoughts! Now Steve rightly observed that
 I wanted to do a write-test, but come to think of it, something like
 this should allow one to do a badblocks -svn-alike non-destructive
 write test:
 
 - Use dd to back up the entire device to /tmp.
 - then copy /dev/arandom (or even /dev/srandom) to the device until
 it's full and use tee to also duplicate what's being written to the
 device to /tmp.
 - md5sum the latter, duplicate file in /tmp
 - md5sum the device, compare the hashes ( delete the file)
 - finally, dd the original backup file back to the device and delete the 
 backup.
 
 This kludge could be used as a poor man's badblocks, if that's not
 available, but it does require that twice the size of the device is
 available in terms of disk space.
 Yes, it's kinda horrible and probably useless in most situations, but
 there we go. ;-)
 
 Thanks and regards,
 --ropers
 
 

I don't know if anyone brought this up, and I hate to state the
obvious, but if you're getting bad blocks then the hard drive has
exhausted its ability to deal with them on its own and should be
replaced.  Otherwise you'll see data loss/corruption and a higher
probability of a total drive failure.

-- 
Travers Buda



poll(2) vs kqueue(2) performance

2008-04-18 Thread Edwin Eyan Moragas
Hi all,

been reading the select(2) man pages and it mentions poll(2)
being more efficient in most cases. this makes it obvious to
discard the use of select(2) in writing new servers.

i've come across some performance benchmarks which is trying
to use kqueue(2).

the question is, which one is more useful when writing new servers?
kqueue or poll?

-- 
garnet:jasmin:beryllium:gluon
90-12264
90-B



Re: poll(2) vs kqueue(2) performance

2008-04-18 Thread Theo de Raadt
 been reading the select(2) man pages and it mentions poll(2)
 being more efficient in most cases. this makes it obvious to
 discard the use of select(2) in writing new servers.

select requires that you set up a bit array correctly.  but often
people just use a fd_set, and cause a variety of strange buffer
overflow cases as soon as their fd's happen to be greater than the bit
size of the fd_set.

the kernel has to iterate over these bit arrays a few times.

for everyone involved, poll is just plain cheaper.

finally, go look at the latest commit to lib/libc/net/res_send.c to
see how much easier poll() is to use.

 i've come across some performance benchmarks which is trying
 to use kqueue(2).

shrug.  performance is only a small part of the whole.

 the question is, which one is more useful when writing new servers?
 kqueue or poll?

use poll.  it is easier to use -- the behaviours are less surprising.
it is also much more portable.  everyone has select and poll, and
quite honestly poll() is a better select(), even if it came out of
ATT.