Re: pf: bad icmp packet checksums on vlans when natted to own network address

2013-12-08 Thread Walter Haidinger
Am 2013-12-06 20:54, schrieb Lawrence Teo: On Sat, Nov 23, 2013 at 08:31:56PM +0100, Walter Haidinger wrote: Am 2013-11-23 17:41, schrieb mxb: http://marc.info/?l=openbsd-techm=138493672609487w=2 This one might help? Thanks for the reference but no, unfortunately not. Applied the patch

natting vlans broken? (was: pf: bad icmp packet checksums on vlans when natted to own network address)

2013-12-08 Thread Walter Haidinger
Am 2013-11-23 16:32, schrieb Walter Haidinger: Since moving to OpenBSD 5.4/i386, I noticed that I cannot ping some hosts on my vlan2. tcpdump on the receiving machines show icmp echo-requests having a bad checksum. I've managed to trace down the problem to the following pf rule: match out

pf: bad icmp packet checksums on vlans when natted to own network address

2013-11-23 Thread Walter Haidinger
Hi! Since moving to OpenBSD 5.4/i386, I noticed that I cannot ping some hosts on my vlan2. tcpdump on the receiving machines show icmp echo-requests having a bad checksum. I've managed to trace down the problem to the following pf rule: match out quick on vlan2 from (vlan2:network) to any

Re: pf: bad icmp packet checksums on vlans when natted to own network address

2013-11-23 Thread Walter Haidinger
Am 2013-11-23 17:41, schrieb mxb: http://marc.info/?l=openbsd-techm=138493672609487w=2 This one might help? Thanks for the reference but no, unfortunately not. Applied the patch the issue remains. Walter

kernel security level changed from 1 to 0

2012-03-23 Thread Walter Haidinger
Hi! I've recently installed OpenBSD 5.0/i386 on a virtualized root-server (Linux-KVM, dmesg below). Installation was fine. Now I'm dropped from multiuser to the shell, usually a couple of seconds after login with the message: init: kernel security level changed from 1 to 0 No error messages

Re: 5.0 vmt0 kernel panic in Linux KVM

2011-11-10 Thread Walter Haidinger
Hi! Am 09.11.2011 18:05, schrieb Brynet: The previous patch avoids touching the msr at all if ACPI indicates speed scaling is unavailable, this should prevent your panic. Both i386/amd64(..fixed) patches attached below. Your patch works! Thanks a lot! Also installed 5.0/i386 on the machine

Re: 5.0 vmt0 kernel panic in Linux KVM

2011-11-09 Thread Walter Haidinger
Am 08.11.2011 10:32, schrieb Walter Haidinger: I also got informed that is a VM emulator bug and have therefore forwarded the bug to upstream k...@vger.kernel.org. FYI, more evidence. Linux dmesg shows: kvm: cpu0 unhandled rdmsr: 0xc0010063 Walter

Re: 5.0 vmt0 kernel panic in Linux KVM

2011-11-09 Thread Walter Haidinger
Hi! Am 08.11.2011 19:33, schrieb Brynet: On Tue, Nov 08, 2011 at 01:27:37PM -0500, Brynet wrote: @@ -190,7 +190,7 @@ k1x_init(struct cpu_info *ci) #if NACPICPU 0 msr = rdmsr(MSR_K1X_STATUS); - k1x_acpi_init(cstate, msr); + k1x_acpi_init(cstate); Whoops, fixed patch

Re: 5.0 vmt0 kernel panic in Linux KVM

2011-11-09 Thread Walter Haidinger
Am 09.11.2011 16:04, schrieb Theo de Raadt: EDX is zero in a Linux guest (i386 and x86_64). So? What is it on the real hardware? 0x3f9 However, they asked me to test inside a Linux guest. On the host itself, the x86info tool shows for all cores: eax in: 0x8007, eax = ebx =

Re: 5.0 vmt0 kernel panic in Linux KVM

2011-11-09 Thread Walter Haidinger
Am 09.11.2011 18:16, schrieb Brynet: On Wed, Nov 09, 2011 at 08:38:01AM +0100, Walter Haidinger wrote: I did run i386 bsd. /usr/src/sys/arch/i386/i386/k1x-pstate.c also has k1x_acpi_init(cstate, msr); in line 193 of 5.0's k1x_init(). Can you send me the patch below for i386 to test

Re: 5.0 vmt0 kernel panic in Linux KVM

2011-11-08 Thread Walter Haidinger
Am 07.11.2011 16:06, schrieb Alexander Polakov: I don't know of an easy way to disable it but recompiling the kernel with this: Index: sys/arch/i386/i386/machdep.c === RCS file: /cvs/src/sys/arch/i386/i386/machdep.c,v

Re: 5.0 vmt0 kernel panic in Linux KVM

2011-11-08 Thread Walter Haidinger
Am 07.11.2011 16:06, schrieb Alexander Polakov: k1x_init() is not related to vmt, it is from k1x-pstate.c, which is cpu power state driver for K10 processors. Because of this reference, I found a workaround: Rather than running 5.0 under the host cpu (PhenomII), I emulate an older cpu (e.g.

Re: 5.0 vmt0 kernel panic in Linux KVM

2011-11-08 Thread Walter Haidinger
Am 08.11.2011 19:27, schrieb Brynet: On Mon, Nov 07, 2011 at 03:51:50PM +0100, Walter Haidinger wrote: cpu0: AMD Phenom(tm) II X6 1100T Processor (AuthenticAMD 686-class, 512KB L2 cache) 3.31 GHz cpu0: FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR

Re: 5.0 vmt0 kernel panic in Linux KVM

2011-11-08 Thread Walter Haidinger
Am 08.11.2011 19:33, schrieb Brynet: On Tue, Nov 08, 2011 at 01:27:37PM -0500, Brynet wrote: @@ -190,7 +190,7 @@ k1x_init(struct cpu_info *ci) #if NACPICPU 0 msr = rdmsr(MSR_K1X_STATUS); -k1x_acpi_init(cstate, msr); +k1x_acpi_init(cstate); Whoops, fixed patch for

5.0 vmt0 kernel panic in Linux KVM

2011-11-07 Thread Walter Haidinger
Hi! Trying to upgrade to 5.0 fails with a kernel panic (vmt0, see dmesg below). Previous 4.9 worked fine, also 5.0 bsd.rd boots (dmesg below too). The VMware Tools driver seems to miss something - vmt0: failed to open backdoor RPC channel (TCLO protocol) - which is correct, as OpenBSD is _not_

Re: 5.0 vmt0 kernel panic in Linux KVM

2011-11-07 Thread Walter Haidinger
Am 07.11.2011 15:34, schrieb Norman Golisz: I don't know either. But, you could try to disable the vmt(4) driver at boot. At the boot prompt, type boot -c to trigger the UKC. At the UKC prompt, type disable vmt. Then type quit. If your system boots up without errors, you can preserve this

usb ethernet needs promisc after mac change

2009-05-12 Thread Walter Haidinger
Hi! I've got a usb ethernet adapter which basically works but needs to be set into promiscuous mode if the mac address is changed. The adapter is correctly found under OpenBSD 4.4 (GENERIC): axe0 at uhub0 port 2 configuration 1 interface 0 D-Link DUB-E100 rev B1 rev 2.00/0.01 addr 2 axe0:

Re: usb ethernet needs promisc after mac change (fixed with patch)

2009-05-12 Thread Walter Haidinger
I got a patch to try from Jonathan Gray. I've applied the patch to the 4.4 sources (if_axe.c revision 1.85) and compiled a new GENERIC kernel. Problem fixed! :-) I just hope this will go into 4.6. Well, below is Jonathan's patch. Thanks very much for the quick fix! Regards, Walter Jonathan Gray

tcp fast retrans for high packet loss network

2007-04-08 Thread Walter Haidinger
Hi list! Simple(?) question: How do I enable tcp fast retransmissions? I've got a wireless network with a lot of interference which results in about 30% packet loss. Fast retransmission should help here, right? However: * Counter for fast retrans in 'netstat -s' is always zero. * Nothing

clearing ecn flag in outgoing packets?

2006-10-24 Thread Walter Haidinger
Hi! Is it possible to clear the ECN bit in outgoing packings using pf? Something like a no-ecn option, similar to scrub's no-df option. Why? Well, using scrub reassemble tcp and having hosts set the ECN flag seems to cause some troubles. That is, in my post of July 2006, scrub reassemble tcp and

Re: scrub reassemble tcp and nat causes problems with some sitesB

2006-07-22 Thread Walter Haidinger
On Fri, 21 Jul 2006, Daniel E. Hassler wrote: Yes. I called it a Transparent Packet Filter (TPF) - the OpenBSD system is acting as a bridge. It's transparent because neither of the interfaces has an IP configured. WAN---PIX---DMZ---TPF---LAN---OS X Oh yes, I recall that image from one of

Re: scrub reassemble tcp and nat causes problems with some sites

2006-07-21 Thread Walter Haidinger
On Thu, 20 Jul 2006, Steve Welham wrote: Get tcpdumps on both router interfaces with and without the reassemble tcp option. Do this for a similar file on both a working website and broken (ebay) website. I have now. Got a dump of the following request (all on a single line): wget -nd -O

Re: scrub reassemble tcp and nat causes problems with some sitesB

2006-07-21 Thread Walter Haidinger
On Thu, 20 Jul 2006, Daniel E. Hassler wrote: I was hoping he could try 'set debug loud' in his pf.conf and check his /var/log/messages file after testing a problem site. If he sees messages similar to the one's I've seen maybe we both know a little more. Unfortunately not. When I set debug

Re: scrub reassemble tcp and nat causes problems with some sites

2006-07-21 Thread Walter Haidinger
On Fri, 21 Jul 2006, Mike Frantzen wrote: Reassemble TCP does aggressive TCP PAWs checks on the TCP timestamps. It does the usual PAWs check to make sure a timestamp is not older than the last echoed value - which is in theory a wrapped sequence number. It also does its aggressive check to

Re: scrub reassemble tcp and nat causes problems with some sites

2006-07-20 Thread Walter Haidinger
It's a stab in the dark but I would start with the assumption that some sites are using server load balancing and that reassemble tcp is breaking this somehow. Could be. Lets suspect poor load balancing because other big sites, which most likely do load balancing too, work. eBay is just the

scrub reassemble tcp and nat causes problems with some sites

2006-07-19 Thread Walter Haidinger
Hi! I'm running OpenBSD 3.9 GENERIC as a NAT router. If I add the reassemble tcp option to my scrub rule in pf.conf, I have trouble connecting to some sites, particulary ebay (ebay.de, ebay.at and ebay.com as well as e.g. kaufen.ebay.de) and some other few sites, from a machine behind the NAT

Re: scrub reassemble tcp and nat causes problems with some sites

2006-07-19 Thread Walter Haidinger
On Wed, 19 Jul 2006, Sebastian Benoit wrote: This sounds like a MTU problem. Either those sites are blocking Unlikely. I have cable, not a PPTP/PPPoE link. Therefore, no packet encapsulation. I'm aware of the MTU issue with ADSL. ICMP-frag-needed messages or you are. I think I am. _Only_

no raid reconstruction with autoconfigured sets

2006-06-29 Thread Walter Haidinger
Hi! Summary: raid set reconstruction fails with error rewriting parity for sets with non-root autoconfigure enabled, works when disabled. It seems as if there is a bug when reading the the component label. Details: I'm running a OpenBSD 3.9 GENERIC kernel with RAID enabled. That is, no other

Re: no raid reconstruction with autoconfigured sets

2006-06-29 Thread Walter Haidinger
First of all: Thanks for replying to an issue with a non-generic kernel! I really appreciate that! On Thu, 29 Jun 2006, Greg Oster wrote: Adding a spare did work: # raidctl -a /dev/wd1g raid1 Isn't that the spare you used for raid2 ? Sorry, cutpaste error, should have been wd1f.

Re: wi: ifconfig txpower wrong for non 100mW wireless cards?

2006-06-13 Thread Walter Haidinger
On Sat, 10 Jun 2006, Walter Haidinger wrote: Replying to myself giving a short answer: yes, it is. Any references (e.g. to some driver documentation) are appreciated! FYI, I've found the following comments in the Linux Kernel source. linux-2.6.16.17/drivers/net/wireless/hostap/hostap_ioctl.c

Re: wi: ifconfig txpower wrong for non 100mW wireless cards?

2006-06-13 Thread Walter Haidinger
Thanks for the reply! On Tue, 13 Jun 2006, Stuart Henderson wrote: I think CR31 just maps over the whole range of the card, so for a card with a more powerful amp, a particular CR31 setting relates to higher power output than it would on an ordinary card. Yes, that is what I figured too from

wi: ifconfig txpower wrong for non 100mW wireless cards?

2006-06-10 Thread Walter Haidinger
Hi! With the wi(4) driver, is txpower output of ifconfig correct for cards which are capable of more than 100mW (20dBm) power? In the stable OpenBSD 3.9 sources the maximum is _hardcoded_ to 20dBm. There has been only one reference (providing the code below):