- Discuss - lists.centos.org

question on sending mail with 5.2
by Jerry Geis 15 Sep '08

15 Sep '08

I made a little file with a From:, To: and body. I execute the command cat file.txt | sendmail -t -O MinQueueAge=1m thinking that the message would try every minute to send instead of the default 30m. (if the initial attempt failed of course). This doesnt seem to have any effect? In the event I have an important email and I want it try perhaps every minute (1minute) to send the email how do I accomplish this from the sendmail command line? Thanks, jerry

5 7

Directory Server question - enable access by host
by Kwan Lowe 15 Sep '08

15 Sep '08

Hello All: I am in the process of migrating from OpenLDAP to Centos Directory Server. I'm very pleased with the new LDAP and think it's one of those killer apps that will guarantee Linux a place in data centers :D... So far I've gotten the main things working: 1) Host based access via AuthorizedHost 2) Service based access via AuthorizedService 3) AIX/Linux <-> LDAP 4) PosixGroup support The one thing I would like is to have group based host access control. E.g., I would like to define a new LDAP group (say, DBA-Production) that includes a bunch of host entries. When needed, I could add a user to the DBA-Production group and automatically give him/her access to the list of defined hosts. Anyone have suggestions on how to approach this? Thanks, Kwan

1 0

Re: [CentOS] Perhaps slightly OT - Lots of spurious webdav requests.
by Friedrich Clausen 15 Sep '08

15 Sep '08

On Mon, Sep 15, 2008 at 10:58 AM, Kenneth Porter <shiva(a)sewingwitch.com> wrote: > --On Monday, September 15, 2008 10:05 AM +0200 Friedrich Clausen > <fred(a)derf.nl> wrote: > >> I have most assuredly not told windows to try and use a Web folder on >> the CentOS file server called "/share1", just the CIFS share. > > Apparently Windows will search multiple "providers" for the share string you > pass, and the successful results are then sorted by provider priority. Ah yes, I believe you are right. Thanks for the info! Regards, Fred. > >> From <http://support.microsoft.com/kb/832161> > >> When an application tries to open a file that exists on a network, the >> I/O manager passes the request to a system component that is named the >> Multiple UNC Provider (MUP). MUP sits logically above all the >> redirectors. When a network path is passed to MUP, it polls all the >> registered redirectors to determine whether they understand the path. The >> redirectors in turn contact the server to establish if the path is valid >> for the specific protocol. If the server can satisfy the connection, the >> redirector will return success back the MUP. If not, the redirector >> returns a failure. All the future file I/O requests for this file are >> passed to the redirector that accepted the path. If more than one >> redirector accepts the path, MUP picks the one with the highest priority, >> as defined in the registry. > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos >

1 0

Perhaps slightly OT - Lots of spurious webdav requests.
by Friedrich Clausen 15 Sep '08

15 Sep '08

Hello All, I am running a CentOS 4.6 file server for a small office network and I am getting a lot of strange webdav requests from one of the Windows workstations - I have not configured Webdav on the Windows host (hereafter "windows-laptop") in question. Some details - I have configured a Samba share called (say) "share1" on the CentOS server and the windows-laptop connects to this share using CIFS, nothing unusual there. But, for some reason, windows-laptop also tried to access a Webdav folder by the same name ("share1") - lots of log entries such as the following (it seems to try every two minutes): 10.11.1.95 - - [14/Sep/2008:04:10:32 -0400] "OPTIONS / HTTP/1.1" 200 - "-" "Microsoft-WebDAV-MiniRedir/5.1.2600" 10.11.1.95 - - [14/Sep/2008:04:10:32 -0400] "PROPFIND /share1 HTTP/1.1" 405 312 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600" I have most assuredly not told windows to try and use a Web folder on the CentOS file server called "/share1", just the CIFS share. My conclusions - * Windows is trying to be clever and automatically map CIFS shares to a Web folder. * Malware is trying to access a Webfolder by same name as CIFS share. Any hints from the list would be much appreciated! Thanks, Fred.

2 1

Computer and network devices management tool
by Lunix1618 15 Sep '08

15 Sep '08

Hello, I have to deploy a monitoring system that need to keep watch on every device/host on my LAN. Can anyone recommend me a tool that in CentOS packages stock ? I know some tool like GLPI but no available CentOS package so I want to looking for something else that already that tested on CentOS. I am running CentOS 5.2 Thanks in advance. Regards,

2 1

Slackware's 'explodepkg' equivalent for rpm?
by Niki Kovacs 15 Sep '08

15 Sep '08

Hi, Is there any 'explodepkg' equivalent for the rpm command? What I want is simply uncompress an RPM package to get the files directly, but I didn't find anything in rpm's manpage. Cheers, Niki Kovacs

6 6

HP Hardware
by Mag Gam 14 Sep '08

14 Sep '08

At my university we use HP hardware exclusively. When we build CentOS our Unix SA is running several HP utilities. I am wondering what some of these utilities are, such as cmaidad. Is it possible to to use these HP utilities to monitor for disk crashes (similar to smartd)? Is anyone using native HP utilities for this purpose? TIA

3 3

Installing libpng
by Joe Tseng 14 Sep '08

14 Sep '08

I've been trying to install perl-Tk and I learned v804.028 uses libpng > 1.2.20; CentOS 5.2 still uses 1.2.10. Is there an RPM out there I can use that's > 1.2.20? I'm just afraid of compiling from source code and breaking all the apps that depend on what's on the system right now. - Joe

2 1

Local yum repository
by saurabh 14 Sep '08

14 Sep '08

Hi All, i have a local repository configured for 'yum',which have files copied over from the RHEL DVD,It was configured initially,as i was facing some issues with my NIC which was not supported on 2.6.18 so had to upgrade to 2.6.26. Now as all is working fine and i'm on net i want to disable that repository and just use the rpmforge repository configured on my system following directions from http://wiki.centos.org/AdditionalResources/Repositories/RPMForge?action=sho… Please help me out - Disabling the local Repo or by - Any method to keep it up to date ,[syncing it with some online repository]

3 4

Illegal opp code
by Dermot 14 Sep '08

14 Sep '08

Hi, HP DL 385 G2. CentOS 5.1 Kernel 2.6.18-92.1.10.el5 I have a newly installed server that was running x. It told me there were updates to install. I accepted that all, except sysreport as I always seem to have problems installing. I rebooted, having set the default run level to 3. I then got a red screen with an "illegal OpCode" error message. I have used my CD to boot into rescue more. My old system is mounted under /mnt. I would also like to get my system back up and running. I have put a fair bit of time into loading libraries and software. I have tried editing the grub.conf and commenting out the 2.6.18-92.1.10.el5 kernel so it used a previous kernel but I can not get past this error. There is no message from grub. The system comes straight from the BIOS messages into this red screen. Is there any other ways to determine what the problem is? The error messages says nothing more that a few lines of hex which don't look useful to me. Any thoughts would be appreciated. TIA. Dp.

1 1

Installing nVidia driver on remote CentOS 4
by Eon Strife 14 Sep '08

14 Sep '08

Hi, There's a linux cluster somewhere (using Rocks), and I use remote desktop (nxmachine) to do the work on the frontend of the cluster. The desktop is Gnome. And, I intend to install new nVidia driver, but it requires me to stop the X Server. I check around the internet, they say we can use the /etc/init.d/gdm stop, but I can't run it since the gdm file does not exist. Another alternative is by rebooting the Linux (of course, we change the inittab before). But I don't know how to reboot remotely. Moreover, I don't know if it is safe to reboot Linux remotely, because I can't physically access the linux workstation. Oh, the operating system of the Linux is CentOS 4. What should I do ? Thanks. New Email names for you! Get the Email name you've always wanted on the new @ymail and @rocketmail. Hurry before someone else does! http://mail.promotions.yahoo.com/newdomains/aa/

3 2

Re: [CentOS] Problem to run 4 virtual machines at a time.
by Wilson Lee 13 Sep '08

13 Sep '08

nate wrote: >What is vyatta system? From a search the closest I can find is >some sort of software that provides routing functionality > >http://www.vyatta.com/index.php > >Is that it ? Correct. Vyatta is an open source full-featured router/firewall/vpn solution based on Debian. It can be installed on a physical computer or virtualized. Especially in a virtualized environment, Vyatta allows one to easily segregate network segments. Resource requirements can be very low depending on the level of traffic and features enabled. I currently use it as my primary home router for my static PPPoE AT&T DSL. I also use it to provide inter-VLAN routing. At my previous employment, I used it for inter-VLAN routing - segments for VoIP, LAN, and DMZ. It worked very well and never had a hiccup. Best of all, there is no fee for the community edition, with a new version about every 6 months. There's a subscription service if you want technical support and timely updates. BTW, I don't work for Vyatta, just a happy user of their product. Here are the technical specs from their website: HARDWARE SUPPORT » 32-bit x86 processors » PC architecture INTERFACES » 10/100/1000 Ethernet cards » 10 GbE cards » T1/E1 cards – 1 port » T1/E1 cards – 2 port » T1/E1 cards – 4 port » T3 cards IP AND ROUTING PROTOCOLS » IPv4 » OSPFv2 » BGPv4 » RIPv2 » Static routes IP ADDRESS MANAGEMENT » Static » DHCP server » DHCP client » DHCP relay ENCAPSULATIONS » Ethernet » 802.1Q VLANs » PPP » PPPoE » MLPPP » Frame Relay » HDLC » GRE, IP-in-IP LOAD BALANCING » WAN link load balancing » MLPPP » ECMP QoS » Priority Queuing » Classful Queuing » Bandwidth Management SECURITY » Stateful inspection fi rewall » Network address translation » IPSec VPN » Remote VPN (PPTP, L2TP, IPSec) » DES, 3DES, AES Encryption » MD5 and SHA-1 Authentication » RSA, Diffi e Helman Key Management » NAT Traversal » RADIUS authentication » Individual user accounts and passwords HIGH AVAILABILITY » VRRP (Virtual Router Redundancy Protocol) » IPSec VPN Clustering » Protocol fault isolation ADMINISTRATION » Integrated CLI » Web GUI* » Single confi guration fi le » Telnet » SSHv2 » Network upgrades DEBUGGING AND PACKET SNIFFING » tcpdump » Wireshark packet capture LOGGING AND MONITORING » Syslog » SNMPv2c * Web GUI Available Q3 ‘08 Wilson _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

2 1

Startup programs in specific workspaces
by MHR 13 Sep '08

13 Sep '08

I have a specific method of using my five GNOME workspaces to perform certain categories of tasks when I log in on a machine, so I just had a thought. Is there a way to specify, say from a login script, for an application to start up in a particular workspace, preferably with a specific "screen" location? Or is this a gnome question? Thanks. mhr

4 5

Newbies to CentOS List
by Josh Donovan 13 Sep '08

13 Sep '08

Guidelines for CentOS Mailing List posts * Mailing List Etiquette * How To Ask Questions The Smart Way * Quoting Style * Why is Bottom-posting better than Top-posting 1. Please turn off HTML in your e-mail client for these mailing lists. We have several subscribers who read the list with text only readers and they can't easily read html formatted e-mails. There is a place (somewhere) for the flowery stationary and themes that some mail clients offer ... but this is not it. Again, please only post text e-mails to these mailing lists. 2. Please do not top post to the mailing list when replying to a post. (See the Quoting Style link above, and use the Interleaved text method , deleting non-applicable text as required. If you need to reply to a message, and you do not need to post in interleaved mode, please bottom post instead of top posting. 3. Please trim the extra stuff in the email and leave enough to make sense of the thread. Note: There are places to debate the merits of top posting and how it might have some advantages in relation to Interleaved text or bottom posting ... but this is not one of those places. Extracted from http://www.centos.org/modules/tinycontent/index.php?id=16 I added no 3 above. I had not been on this mailing list or others for a while but I thought other newbies would benefit. Thanks, Josh.

2 1

(no subject)
by Bob Hoffman 13 Sep '08

13 Sep '08

Hi all.. I have centos 5.2 There is a cron file that is commented out to auto update the rules of spamassassin Location: /etc/cron.d/sa-update This file is chmod 600, should it not be 755? All the other crons are 755 This line is commented. #10 4 * * * root /usr/share/spamassassin/sa-update.cron 2>&1 | tee -a /var/log/sa-update.log Questions 1- should I re chmod it to 600 or leave it at 755? Is anyone else using this? The cron file says to read a certain wiki page and do this cron at your own peril. Yet I find no warnings on that wiki page that would make me think this was bad. Thanks all

2 1

4.7 update issues?
by RobertH 13 Sep '08

13 Sep '08

Greets, Thank you to all the CentOS team and supporters. :-) Just wondering though... Any 4.7 update issues or horror stories yet? Also, anyone that has upstream support and previously updated, any issues for Internet facing, or other, production machines ? - rh

3 3

Problem to run 4 virtual machines at a time.
by mallikarjun gudisagar 13 Sep '08

13 Sep '08

Hi all I have installed vyatta system, (vyatta-livecd-vc4-alpha2.iso ) on top of Centos5. Our system requirement is, * Centos 5.1 (2.6.18-92.1.10.el5xen ) * 2 Gb RAM, * x86_64 And cpu information is as follow, [root@turtle4 ~]# cat /proc/cpuinfo processor : 0 vendor_id : AuthenticAMD cpu family : 15 model : 107 model name : AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ stepping : 1 cpu MHz : 2100.010 cache size : 512 KB physical id : 0 siblings : 1 core id : 0 cpu cores : 1 fpu : yes fpu_exception : yes cpuid level : 1 wp : yes flags : fpu tsc msr pae mce cx8 apic mtrr mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt lm 3dnowext 3dnow pni cx16 lahf_lm cmp_legacy svm cr8_legacy bogomips : 5252.03 TLB size : 1024 4K pages clflush size : 64 cache_alignment : 64 address sizes : 40 bits physical, 48 bits virtual power management: ts fid vid ttp tm stc [6] processor : 1 vendor_id : AuthenticAMD cpu family : 15 model : 107 model name : AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ stepping : 1 cpu MHz : 2100.010 cache size : 512 KB physical id : 1 siblings : 1 core id : 0 cpu cores : 1 fpu : yes fpu_exception : yes cpuid level : 1 wp : yes flags : fpu tsc msr pae mce cx8 apic mtrr mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt lm 3dnowext 3dnow pni cx16 lahf_lm cmp_legacy svm cr8_legacy bogomips : 5252.03 TLB size : 1024 4K pages clflush size : 64 cache_alignment : 64 address sizes : 40 bits physical, 48 bits virtual power management: ts fid vid ttp tm stc [6] My problem is i have installed '4' virtual machines. each virtual machine have 256Mb RAM. But i am not able to run 4 virtual machines at a time. Please help me, what should i have to do? Thanks mallu

2 1

CentOS-announce Digest, Vol 43, Issue 4
by centos-announce-request＠centos.org 13 Sep '08

13 Sep '08

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2008:0884 Important CentOS 3 ia64 libxml2 - security update (Pasi Pirhonen) 2. CESA-2008:0884 Important CentOS 4 ia64 libxml2 - security update (Pasi Pirhonen) 3. CESA-2008:0884 Important CentOS 3 s390(x) libxml2 - security update (Pasi Pirhonen) 4. CESA-2008:0884 Important CentOS 4 s390(x) libxml2 - security update (Pasi Pirhonen) 5. CentOS 4.7 is released for i386 and x86_64 (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Fri, 12 Sep 2008 19:10:39 +0300 From: Pasi Pirhonen <upi(a)centos.fi> Subject: [CentOS-announce] CESA-2008:0884 Important CentOS 3 ia64 libxml2 - security update To: centos-announce(a)centos.org Message-ID: <20080912161039.GQ9914(a)centos.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2008:0884 https://rhn.redhat.com/errata/RHSA-2008-0884.html The following updated files have been uploaded and are currently syncing to the mirrors: ia64: updates/ia64/RPMS/libxml2-2.5.10-13.ia64.rpm updates/ia64/RPMS/libxml2-devel-2.5.10-13.ia64.rpm updates/ia64/RPMS/libxml2-python-2.5.10-13.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://pasi.pirhonen.eu/ Top-postings silently ignored

1 0

Centos Website
by Dan Carl 13 Sep '08

13 Sep '08

I can't connect, appears to be down. Thought I'd post in case whoevers in charge is listening here. Dan

6 8

Java install
by Ric Moore 13 Sep '08

13 Sep '08

While using Fedora, I always used java straight from Sun. What is recommended for CentOS?? Getting jetty, java and other java apps working correctly has been a real chore. If I used nothing but RPMs for CEntOS, would I have a real working java install? I need some help on this one badly. Ric -- ---------------------------------------------------- My father, Victor Moore (Vic) used to say: "There are two Great Sins in the world... ..the Sin of Ignorance, and the Sin of Stupidity. Only the former may be overcome." R.I.P. Dad. Linux user# 44256 Sign up at: http://counter.li.org/ https://nuoar.dev.java.net/ Verizon Cell # 336-254-1339

6 19

Standby Issue
by Test 13 Sep '08

13 Sep '08

Hi List, I'm running Centos 5.2 on an Pentium III-1000 The box has been running for almost a year without any (hardware) issues. SInce a few weeks the box goes into standby (power led flashes) without any obvious reason (ie. i cannot find anything). This happens randomly (box runs for 1 day and does this, next time it runs for 5 days and it happens). Normally when a box goes into standby, you should be able to start it again pressing the power button, but this does not work. I have to completely unplug it and then it boots up again (after plugging it in again ;-)) I thought it was due to a kernel upgrade from 2.6.18-92.1.6 to 2.6.18-92.1.10, but after a downgrade the same issue occurred I have checked about all settings (loaded modules, logfiles, bios etc.) I have stopped the acpid, still no go... cpuspeed is not running... Bios has got all powermanagement stuff disable.. So basically i am looking for some hints on solving this... Anyone...? -- Test <test(a)remedial-teacher.nl>

7 7

A glimpse into the future for RHEL 6 and CentOS 6
by Scott Silva 13 Sep '08

13 Sep '08

http://searchenterpriselinux.techtarget.com/news/article/0,289142,sid39_gci… -- MailScanner is like deodorant... You hope everybody uses it, and you notice quickly if they don't!!!!

4 3

DNS Logging with Selinux enabled
by Josh Donovan 12 Sep '08

12 Sep '08

I rebuilt my server and setup bind to log queries in a chroot. ################################################################################ # Logging Configuration # logging { # # Define channels for the two log files # channel query_log { severity info; print-time yes; file "/var/log/query.log" versions 3 size 100M; }; channel activity_log { severity info; print-time yes; print-category yes; print-severity yes; file "/var/log/activity.log" versions 3 size 100M; Below is the security context of the files in the chroot. [root@josh log]# ls -alZ /var/named/chroot/var/log/activity.log -rw-r--r-- named named root:object_r:named_conf_t /var/named/chroot/var/log/activity.log [root@josh log]# ls -alZ /var/named/chroot/var/log/query.log -rw-r--r-- named named root:object_r:named_conf_t /var/named/chroot/var/log/query.log I temporarily disabled selinux but there was one simple step I missed (forgot since i did this years ago). I briefly recall creating a symlink and/or using chcon or one of the selinux commands. Thanks, Josh

4 8

CentOS 4.7 status
by Adrian Sevcenco 12 Sep '08

12 Sep '08

Hi, i was wondering what is the status of 4.7 Thank you, Best regards, Adrian

15 23

Custom build kernel patch fails big time.
by Robert Moskowitz 12 Sep '08

12 Sep '08

I am trying to build a custom kernel for the HIPL code (infrahip.hip.fi), using the patch for the Linux 2.6.18 kernel. I followed all the instructions for getting the kernel source and making a custom kernel provided on the wiki. The rpmbuild fails with the following messages: Get an error on this step (figured out my other problem): Patch #40000 (centos-5.2-hipmod-sleep-beet-and-interfamily-all-in-one.patch): 1 out of 4 hunks FAILED -- saving rejects to file net/ipv4/xfrm4_output.c.rej 2 out of 3 hunks FAILED -- saving rejects to file net/ipv4/esp4.c.rej 1 out of 1 hunk FAILED -- saving rejects to file net/ipv6/udp.c.rej 1 out of 1 hunk FAILED -- saving rejects to file net/ipv6/tcp_ipv6.c.rej 1 out of 1 hunk FAILED -- saving rejects to file net/ipv6/esp6.c.rej 2 out of 2 hunks FAILED -- saving rejects to file net/ipv6/icmp.c.rej 2 out of 2 hunks FAILED -- saving rejects to file net/xfrm/xfrm_state.c.rej 1 out of 2 hunks FAILED -- saving rejects to file include/net/xfrm.h.rej Reversed (or previously applied) patch detected! Assume -R? [n] Apply anyway? [n] 1 out of 1 hunk ignored -- saving rejects to file include/linux/net.h.rej I've asked for help on the hipl list, but there is no real experience there with Centos (FC8 and 9), and they are trying to help, put perhaps someone here might know what I am doing wrong? Oh, one question was asked about how the ~/rpmbuild/BUILD/kernel-2.16.18 directory looks like. I think the linux-2.6.18.i386 (or i686) is not what the patch is expecting? Here is the patch file (centos-5.2-hipmod-sleep-beet-and-interfamily-all-in-one.patch): diff -urN a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c --- a/net/ipv4/xfrm4_input.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/xfrm4_input.c 2007-05-25 12:21:11.000000000 +0300 @@ -13,6 +13,7 @@ #include <linux/string.h> #include <linux/netfilter.h> #include <linux/netfilter_ipv4.h> +#include <net/inet_ecn.h> #include <net/ip.h> #include <net/xfrm.h> @@ -23,6 +24,15 @@ EXPORT_SYMBOL(xfrm4_rcv); +static inline void ipip_ecn_decapsulate(struct sk_buff *skb) +{ + struct iphdr *outer_iph = skb->nh.iph; + struct iphdr *inner_iph = skb->h.ipiph; + + if (INET_ECN_is_ce(outer_iph->tos)) + IP_ECN_set_ce(inner_iph); +} + static int xfrm4_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq) { switch (nexthdr) { @@ -103,11 +113,11 @@ xfrm_vec[xfrm_nr++] = x; - if (x->mode->input(x, skb)) + if (x->mode->input(x, skb)) goto drop; - + if (x->props.mode) { - decaps = 1; + decaps = 1; break; } diff -urN a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c --- a/net/ipv4/xfrm4_output.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/xfrm4_output.c 2007-05-25 12:21:11.000000000 +0300 @@ -14,10 +14,12 @@ #include <linux/skbuff.h> #include <linux/spinlock.h> #include <linux/netfilter_ipv4.h> +#include <net/inet_ecn.h> #include <net/ip.h> #include <net/xfrm.h> #include <net/icmp.h> + static int xfrm4_tunnel_check_size(struct sk_buff *skb) { int mtu, ret = 0; @@ -54,7 +56,7 @@ goto error_nolock; } - if (x->props.mode) { + if (x->props.mode == XFRM_MODE_TUNNEL) { err = xfrm4_tunnel_check_size(skb); if (err) goto error_nolock; @@ -66,7 +68,7 @@ if (err) goto error; - err = x->mode->output(skb); + err = x->mode->output(skb); if (err) goto error; @@ -85,6 +87,7 @@ } dst = skb->dst; x = dst->xfrm; + } while (x && !x->props.mode); IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED; diff -urN a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c --- a/net/ipv4/xfrm4_tunnel.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/xfrm4_tunnel.c 2007-05-25 12:21:11.000000000 +0300 @@ -28,13 +28,20 @@ static int ipip_init_state(struct xfrm_state *x) { - if (!x->props.mode) - return -EINVAL; - if (x->encap) return -EINVAL; - x->props.header_len = sizeof(struct iphdr); + switch (x->props.mode) { + case XFRM_MODE_TRANSPORT: + return -EINVAL; + default: + case XFRM_MODE_TUNNEL: + x->props.header_len = sizeof(struct iphdr); + break; + case XFRM_MODE_BEET: + x->props.header_len += IPV4_BEET_PHMAXLEN; + break; + } return 0; } diff -urN a/net/ipv4/route.c b/net/ipv4/route.c --- a/net/ipv4/route.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/route.c 2007-05-25 12:21:11.000000000 +0300 @@ -108,6 +108,7 @@ #ifdef CONFIG_SYSCTL #include <linux/sysctl.h> #endif +#include <linux/xfrm.h> #define RT_FL_TOS(oldflp) \ ((u32)(oldflp->fl4_tos & (IPTOS_RT_MASK | RTO_ONLINK))) @@ -2631,7 +2632,7 @@ int ip_route_output_key(struct rtable **rp, struct flowi *flp) { - return ip_route_output_flow(rp, flp, NULL, 0); + return ip_route_output_flow(rp, flp, NULL, XFRM_LOOKUP_SLEEP); } static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event, diff -urN a/net/ipv4/ah4.c b/net/ipv4/ah4.c --- a/net/ipv4/ah4.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/ah4.c 2007-05-25 12:21:11.000000000 +0300 @@ -253,8 +253,10 @@ goto error; x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len); - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct iphdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; x->data = ahp; return 0; diff -urN a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c --- a/net/ipv4/xfrm4_policy.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/xfrm4_policy.c 2007-05-25 12:21:11.000000000 +0300 @@ -16,6 +16,8 @@ static struct dst_ops xfrm4_dst_ops; static struct xfrm_policy_afinfo xfrm4_policy_afinfo; +static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu); + static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl) { return __ip_route_output_key((struct rtable**)dst, fl); @@ -53,17 +55,20 @@ struct dst_entry *dst, *dst_prev; struct rtable *rt0 = (struct rtable*)(*dst_p); struct rtable *rt = rt0; - u32 remote = fl->fl4_dst; - u32 local = fl->fl4_src; struct flowi fl_tunnel = { .nl_u = { .ip4_u = { - .saddr = local, - .daddr = remote, + .saddr = fl->fl4_dst, + .daddr = fl->fl4_src, .tos = fl->fl4_tos } } }; + union { + struct in6_addr *in6; + struct in_addr *in; + } remote, local; + unsigned short outer_family = 0, beet = 0; int i; int err; int header_len = 0; @@ -75,7 +80,6 @@ for (i = 0; i < nx; i++) { struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops); struct xfrm_dst *xdst; - int tunnel = 0; if (unlikely(dst1 == NULL)) { err = -ENOBUFS; @@ -96,21 +100,45 @@ dst1->next = dst_prev; dst_prev = dst1; - if (xfrm[i]->props.mode) { - remote = xfrm[i]->id.daddr.a4; - local = xfrm[i]->props.saddr.a4; - tunnel = 1; + + if (xfrm[i]->props.mode == XFRM_MODE_TUNNEL || xfrm[i]->props.mode == XFRM_MODE_BEET) { + outer_family = xfrm[i]->props.family; + beet = (xfrm[i]->props.mode == XFRM_MODE_BEET); + + if(outer_family == AF_INET6){ + remote.in6 = (struct in6_addr*)&xfrm[i]->id.daddr; + local.in6 = (struct in6_addr*)&xfrm[i]->props.saddr; + } else if(outer_family == AF_INET){ + remote.in = (struct in_addr*)&xfrm[i]->id.daddr; + local.in = (struct in_addr*)&xfrm[i]->props.saddr; + } else + BUG_ON(1); } header_len += xfrm[i]->props.header_len; trailer_len += xfrm[i]->props.trailer_len; - if (tunnel) { - fl_tunnel.fl4_src = local; - fl_tunnel.fl4_dst = remote; + if (outer_family) { + switch(outer_family) { + case AF_INET: + fl_tunnel.fl4_dst = remote.in->s_addr; + fl_tunnel.fl4_src = local.in->s_addr; + break; + case AF_INET6: + ipv6_addr_copy(&fl_tunnel.fl6_dst, remote.in6); + ipv6_addr_copy(&fl_tunnel.fl6_src, local.in6); + break; + default: + BUG_ON(1); + } err = xfrm_dst_lookup((struct xfrm_dst **)&rt, - &fl_tunnel, AF_INET); + &fl_tunnel, outer_family); if (err) goto error; + /* Without this, the atomic inc below segfaults */ + if (outer_family == AF_INET6) { + rt->peer = NULL; + rt_bind_peer(rt,1); + } } else dst_hold(&rt->u.dst); } @@ -160,6 +188,11 @@ } xfrm_init_pmtu(dst); + if (beet && outer_family == AF_INET6) { + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + u32 mtu = dst_mtu(dst); + xfrm4_update_pmtu(dst, mtu - delta); + } return 0; error: diff -urN a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c --- a/net/ipv4/xfrm4_mode_tunnel.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/xfrm4_mode_tunnel.c 2007-05-25 12:21:11.000000000 +0300 @@ -33,7 +33,7 @@ * On exit, skb->h will be set to the start of the payload to be processed * by x->type->output and skb->nh will be set to the top IP header. */ -static int xfrm4_tunnel_output(struct sk_buff *skb) + static int xfrm4_tunnel_output(struct sk_buff *skb) { struct dst_entry *dst = skb->dst; struct xfrm_state *x = dst->xfrm; @@ -98,6 +98,182 @@ return err; } +/* jk: this should be moved to the beet module! */ +static int xfrm4_beet_output(struct sk_buff *skb) +{ + struct dst_entry *dst = skb->dst; + struct xfrm_state *x = dst->xfrm; + int hdrlen; + struct iphdr *iphv4, *top_iphv4; + struct ipv6hdr *iphv6, *top_iphv6; + + if (skb->nh.iph->version == 4) { + + int optlen; + + /* 4-4 */ + + iphv4 = skb->nh.iph; + skb->h.ipiph = iphv4; + + hdrlen = x->props.header_len; + + optlen = iphv4->ihl * 4 - sizeof(*iphv4); + if (!optlen) { + hdrlen -= IPV4_BEET_PHMAXLEN; + } else { + skb->h.raw -= (IPV4_BEET_PHMAXLEN - (optlen & 4)); + hdrlen -= optlen & 4; + } + + skb->nh.raw = skb_push(skb, hdrlen); + top_iphv4 = skb->nh.iph; + + hdrlen = iphv4->ihl * 4 - optlen; + skb->h.raw += hdrlen; + memmove(top_iphv4, iphv4, hdrlen); + + if (unlikely(optlen)) { + struct ip_beet_phdr *ph; + + BUG_ON(optlen < 0); + + ph = (struct ip_beet_phdr *)skb->h.raw; + ph->padlen = 4 - (optlen & 4); + ph->hdrlen = (optlen + ph->padlen + sizeof(*ph)) / 8; + ph->nexthdr = iphv4->protocol; + top_iphv4->protocol = IPPROTO_BEETPH; + top_iphv4->ihl = sizeof(struct iphdr) / 4; + } + + top_iphv4->saddr = x->props.saddr.a4; + top_iphv4->daddr = x->id.daddr.a4; + + } else if (skb->nh.iph->version == 6) { + + u8 protocol; + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + + /* Inner = 6, Outer = 4 : changing the external IP hdr + * to the outer addresses + */ + + hdrlen = x->props.header_len - IPV4_BEET_PHMAXLEN; + skb_push(skb, hdrlen); + iphv6 = skb->nh.ipv6h; + + skb->nh.raw = skb->data; + top_iphv6 = skb->nh.ipv6h; + + protocol = iphv6->nexthdr; + skb->nh.raw = skb_pull(skb, delta); + top_iphv4 = skb->nh.iph; + skb->h.raw = skb->data + hdrlen; + top_iphv4->ihl = (sizeof(struct iphdr) >> 2); + top_iphv4->version = 4; + top_iphv4->id = 0; + top_iphv4->frag_off = htons(IP_DF); + top_iphv4->ttl = dst_metric(dst->child, RTAX_HOPLIMIT); + top_iphv4->saddr = x->props.saddr.a4; + top_iphv4->daddr = x->id.daddr.a4; + skb->h.raw += top_iphv4->ihl*4; + top_iphv4->protocol = protocol; + + } else + BUG_ON(1); + + return 0; +} + + +/* jk: this should be moved to the beet module! */ +static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb) +{ + int err = -EINVAL; + int phlen = 0; + int optlen = 0; + __u8 ph_nexthdr = 0; + int size = (x->sel.family == AF_INET) ? sizeof(struct iphdr) : sizeof(struct ipv6hdr); + int proto = skb->nh.iph->protocol; + int hops = skb->nh.iph->ttl; + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + + if (x->sel.family == AF_INET6) { + /* Here, the inner family is 6, therefore I have to + * substitute the IPhdr by enlarging it */ + if (skb_tailroom(skb) < delta){ + if (pskb_expand_head(skb, 0, delta, GFP_ATOMIC)) + goto out; //Just returning from here. + } + + skb->nh.raw -= delta; + } else if (x->sel.family == AF_INET) { + // We need to extract the PH + struct ip_beet_phdr *ph = (struct ip_beet_phdr*)(skb->nh.iph + 1); + + if (proto == IPPROTO_BEETPH) { + if (!pskb_may_pull(skb, sizeof(*ph))) + goto out; + phlen = ph->hdrlen * 8; + optlen = phlen - ph->padlen - sizeof(*ph); + + if (optlen < 0 || optlen & 3 || optlen > 250) + goto out; + if (!pskb_may_pull(skb, phlen)) + goto out; + + ph_nexthdr = ph->nexthdr; + } + } else + BUG_ON(1); + + if (skb_cloned(skb) && + pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) + goto out; + + skb_push(skb, size); + memmove(skb->data, skb->nh.raw, size); + skb->nh.raw = skb->data; + + if (x->sel.family == AF_INET) { + struct iphdr *iph = skb->nh.iph; + + if (unlikely(phlen)) { + skb_pull(skb, phlen - optlen); + memmove(skb->data, skb->nh.raw, sizeof(*iph)); + skb->nh.raw = skb->data; + iph = skb->nh.iph; + } + + iph->ihl = (sizeof(*iph) + optlen) / 4; + iph->tot_len = htons(skb->len); + iph->daddr = x->sel.daddr.a4; + iph->saddr = x->sel.saddr.a4; + if (ph_nexthdr) + iph->protocol = ph_nexthdr; + else + iph->protocol = proto; + ip_send_check(iph); + } else if (x->sel.family == AF_INET6) { + struct ipv6hdr *ip6h = skb->nh.ipv6h; + + memset(ip6h->flow_lbl, 0, sizeof(ip6h->flow_lbl)); + ip6h->version = 6; + ip6h->priority = 0; + ip6h->nexthdr = proto; + ip6h->hop_limit = hops; + ip6h->payload_len = htons(skb->len - size); + ipv6_addr_copy(&ip6h->daddr, (struct in6_addr *)&x->sel.daddr.a6); + ipv6_addr_copy(&ip6h->saddr, (struct in6_addr *)&x->sel.saddr.a6); + skb->protocol = htons(ETH_P_IPV6); + } + + err = 0; + out: + + return err; +} + static struct xfrm_mode xfrm4_tunnel_mode = { .input = xfrm4_tunnel_input, .output = xfrm4_tunnel_output, @@ -105,8 +281,19 @@ .encap = XFRM_MODE_TUNNEL, }; +/* jk: this should be moved to the beet module! */ +static struct xfrm_mode xfrm4_beet_mode = { + .input = xfrm4_beet_input, + .output = xfrm4_beet_output, + .owner = THIS_MODULE, + .encap = XFRM_MODE_BEET, +}; + static int __init xfrm4_tunnel_init(void) { + int err; + /* jk: this should be moved to the beet module! */ + err = xfrm_register_mode(&xfrm4_beet_mode, AF_INET); return xfrm_register_mode(&xfrm4_tunnel_mode, AF_INET); } @@ -114,6 +301,9 @@ { int err; + /* jk: this should be moved to the beet module! */ + err = xfrm_unregister_mode(&xfrm4_beet_mode, AF_INET); + BUG_ON(err); err = xfrm_unregister_mode(&xfrm4_tunnel_mode, AF_INET); BUG_ON(err); } diff -urN a/net/ipv4/esp4.c b/net/ipv4/esp4.c --- a/net/ipv4/esp4.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/esp4.c 2007-05-25 12:21:11.000000000 +0300 @@ -237,7 +237,8 @@ * as per draft-ietf-ipsec-udp-encaps-06, * section 3.1.2 */ - if (!x->props.mode) + if (x->props.mode == XFRM_MODE_TRANSPORT || + x->props.mode == XFRM_MODE_BEET) skb->ip_summed = CHECKSUM_UNNECESSARY; } @@ -255,17 +256,27 @@ { struct esp_data *esp = x->data; u32 blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4); + int enclen = 0; - if (x->props.mode) { - mtu = ALIGN(mtu + 2, blksize); - } else { - /* The worst case. */ + switch (x->props.mode) { + default: + case XFRM_MODE_TUNNEL: + mtu = ALIGN(mtu +2, blksize); + break; + case XFRM_MODE_TRANSPORT: + /* The worst case */ mtu = ALIGN(mtu + 2, 4) + blksize - 4; + break; + case XFRM_MODE_BEET: + /* The worst case. */ + enclen = IPV4_BEET_PHMAXLEN; + mtu = ALIGN(mtu + enclen + 2, blksize); + break; } if (esp->conf.padlen) mtu = ALIGN(mtu, esp->conf.padlen); - return mtu + x->props.header_len + esp->auth.icv_trunc_len; + return mtu + x->props.header_len + esp->auth.icv_trunc_len - enclen; } static void esp4_err(struct sk_buff *skb, u32 info) @@ -368,8 +379,10 @@ if (crypto_cipher_setkey(esp->conf.tfm, esp->conf.key, esp->conf.key_len)) goto error; x->props.header_len = sizeof(struct ip_esp_hdr) + esp->conf.ivlen; - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct iphdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; if (x->encap) { struct xfrm_encap_tmpl *encap = x->encap; diff -urN a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c --- a/net/ipv4/ipcomp.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/ipcomp.c 2007-05-25 12:21:11.000000000 +0300 @@ -176,7 +176,7 @@ return 0; out_ok: - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) ip_send_check(iph); return 0; } @@ -216,7 +216,7 @@ t->id.daddr.a4 = x->id.daddr.a4; memcpy(&t->sel, &x->sel, sizeof(t->sel)); t->props.family = AF_INET; - t->props.mode = 1; + t->props.mode = x->props.mode; t->props.saddr.a4 = x->props.saddr.a4; t->props.flags = x->props.flags; @@ -415,8 +415,10 @@ goto out; x->props.header_len = 0; - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct iphdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; mutex_lock(&ipcomp_resource_mutex); if (!ipcomp_alloc_scratches()) @@ -427,7 +429,7 @@ goto error; mutex_unlock(&ipcomp_resource_mutex); - if (x->props.mode) { + if (x->props.mode == XFRM_MODE_TUNNEL) { err = ipcomp_tunnel_attach(x); if (err) goto error_tunnel; diff -urN a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c --- a/net/ipv6/xfrm6_input.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/xfrm6_input.c 2007-05-25 12:21:11.000000000 +0300 @@ -13,9 +13,21 @@ #include <linux/string.h> #include <linux/netfilter.h> #include <linux/netfilter_ipv6.h> +#include <net/dsfield.h> +#include <net/inet_ecn.h> +#include <net/ip.h> #include <net/ipv6.h> #include <net/xfrm.h> +static inline void ipip6_ecn_decapsulate(struct sk_buff *skb) +{ + struct ipv6hdr *outer_iph = skb->nh.ipv6h; + struct ipv6hdr *inner_iph = skb->h.ipv6h; + + if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph))) + IP6_ECN_set_ce(inner_iph); +} + int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi) { int err; @@ -33,7 +45,6 @@ seq = 0; if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0) goto drop; - do { struct ipv6hdr *iph = skb->nh.ipv6h; @@ -44,6 +55,7 @@ if (x == NULL) goto drop; spin_lock(&x->lock); + if (unlikely(x->km.state != XFRM_STATE_VALID)) goto drop_unlock; @@ -69,16 +81,17 @@ xfrm_vec[xfrm_nr++] = x; - if (x->mode->input(x, skb)) + if (x->mode->input(x, skb)) goto drop; - - if (x->props.mode) { /* XXX */ - decaps = 1; - break; + + if (x->props.mode) { + decaps = 1; + break; } if ((err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) < 0) goto drop; + } while (!err); /* Allocate new secpath or COW existing one. */ @@ -110,6 +123,7 @@ netif_rx(skb); return -1; } else { + #ifdef CONFIG_NETFILTER skb->nh.ipv6h->payload_len = htons(skb->len); __skb_push(skb, skb->data - skb->nh.raw); diff -urN a/net/ipv6/ah6.c b/net/ipv6/ah6.c --- a/net/ipv6/ah6.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/ah6.c 2007-05-25 12:21:11.000000000 +0300 @@ -387,8 +387,10 @@ goto error; x->props.header_len = XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len); - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct ipv6hdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; x->data = ahp; return 0; diff -urN a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c --- a/net/ipv6/xfrm6_policy.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/xfrm6_policy.c 2007-05-25 12:21:11.000000000 +0300 @@ -22,6 +22,8 @@ static struct dst_ops xfrm6_dst_ops; static struct xfrm_policy_afinfo xfrm6_policy_afinfo; +static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu); + static int xfrm6_dst_lookup(struct xfrm_dst **dst, struct flowi *fl) { int err = 0; @@ -70,16 +72,19 @@ struct dst_entry *dst, *dst_prev; struct rt6_info *rt0 = (struct rt6_info*)(*dst_p); struct rt6_info *rt = rt0; - struct in6_addr *remote = &fl->fl6_dst; - struct in6_addr *local = &fl->fl6_src; struct flowi fl_tunnel = { .nl_u = { .ip6_u = { - .saddr = *local, - .daddr = *remote + .saddr = fl->fl6_src, + .daddr = fl->fl6_dst } } }; + union { + struct in6_addr *in6; + struct in_addr *in; + } remote, local; + unsigned short outer_family = 0, beet = 0; int i; int err = 0; int header_len = 0; @@ -91,7 +96,6 @@ for (i = 0; i < nx; i++) { struct dst_entry *dst1 = dst_alloc(&xfrm6_dst_ops); struct xfrm_dst *xdst; - int tunnel = 0; if (unlikely(dst1 == NULL)) { err = -ENOBUFS; @@ -114,19 +118,39 @@ dst1->next = dst_prev; dst_prev = dst1; - if (xfrm[i]->props.mode) { - remote = (struct in6_addr*)&xfrm[i]->id.daddr; - local = (struct in6_addr*)&xfrm[i]->props.saddr; - tunnel = 1; + if (xfrm[i]->props.mode == XFRM_MODE_TUNNEL || xfrm[i]->props.mode == XFRM_MODE_BEET) { + outer_family = xfrm[i]->props.family; + beet = (xfrm[i]->props.mode == XFRM_MODE_BEET); + if (outer_family == AF_INET6) { + remote.in6 = (struct in6_addr*)&xfrm[i]->id.daddr; + local.in6 = (struct in6_addr*)&xfrm[i]->props.saddr; + } else if(outer_family == AF_INET){ + remote.in = (struct in_addr*)&xfrm[i]->id.daddr; + local.in = (struct in_addr*)&xfrm[i]->props.saddr; + } } header_len += xfrm[i]->props.header_len; trailer_len += xfrm[i]->props.trailer_len; - if (tunnel) { - ipv6_addr_copy(&fl_tunnel.fl6_dst, remote); - ipv6_addr_copy(&fl_tunnel.fl6_src, local); + if (outer_family) { + switch(outer_family) { + case AF_INET: + fl_tunnel.fl4_dst = remote.in->s_addr; + fl_tunnel.fl4_src = local.in->s_addr; + + fl_tunnel.fl4_tos = 0; + fl_tunnel.fl4_fwmark = 0; + fl_tunnel.fl4_scope = 0; + break; + case AF_INET6: + ipv6_addr_copy(&fl_tunnel.fl6_dst, remote.in6); + ipv6_addr_copy(&fl_tunnel.fl6_src, local.in6); + break; + default: + BUG_ON(1); + } err = xfrm_dst_lookup((struct xfrm_dst **) &rt, - &fl_tunnel, AF_INET6); + &fl_tunnel, outer_family); if (err) goto error; } else @@ -177,6 +201,11 @@ } xfrm_init_pmtu(dst); + if (beet && outer_family == AF_INET) { + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + u32 mtu = dst_mtu(dst); + xfrm6_update_pmtu(dst, mtu + delta); + } return 0; error: diff -urN a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c --- a/net/ipv6/xfrm6_output.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/xfrm6_output.c 2007-05-25 12:21:11.000000000 +0300 @@ -14,8 +14,11 @@ #include <linux/spinlock.h> #include <linux/icmpv6.h> #include <linux/netfilter_ipv6.h> +#include <net/dsfield.h> +#include <net/inet_ecn.h> #include <net/ipv6.h> #include <net/xfrm.h> +#include <net/ip.h> static int xfrm6_tunnel_check_size(struct sk_buff *skb) { @@ -47,7 +50,7 @@ goto error_nolock; } - if (x->props.mode) { + if (x->props.mode == XFRM_MODE_TUNNEL) { err = xfrm6_tunnel_check_size(skb); if (err) goto error_nolock; @@ -59,7 +62,7 @@ if (err) goto error; - err = x->mode->output(skb); + err = x->mode->output(skb); if (err) goto error; diff -urN a/net/ipv6/udp.c b/net/ipv6/udp.c --- a/net/ipv6/udp.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/udp.c 2007-05-25 12:21:11.000000000 +0300 @@ -788,7 +788,7 @@ if (final_p) ipv6_addr_copy(&fl->fl6_dst, final_p); - if ((err = xfrm_lookup(&dst, fl, sk, 0)) < 0) + if ((err = xfrm_lookup(&dst, fl, sk, XFRM_LOOKUP_SLEEP)) < 0) goto out; if (hlimit < 0) { diff -urN a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c --- a/net/ipv6/tcp_ipv6.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/tcp_ipv6.c 2007-05-25 12:21:11.000000000 +0300 @@ -257,7 +257,7 @@ if (final_p) ipv6_addr_copy(&fl.fl6_dst, final_p); - if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) + if ((err = xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_SLEEP)) < 0) goto failure; if (saddr == NULL) { diff -urN a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c --- a/net/ipv6/af_inet6.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/af_inet6.c 2007-05-25 12:21:11.000000000 +0300 @@ -939,4 +939,8 @@ } module_exit(inet6_exit); +EXPORT_SYMBOL(inet6_create); +EXPORT_SYMBOL(inet6_stream_ops); +EXPORT_SYMBOL(inet6_dgram_ops); + MODULE_ALIAS_NETPROTO(PF_INET6); diff -urN a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c --- a/net/ipv6/xfrm6_mode_tunnel.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/xfrm6_mode_tunnel.c 2007-05-25 12:21:11.000000000 +0300 @@ -15,6 +15,7 @@ #include <net/inet_ecn.h> #include <net/ipv6.h> #include <net/xfrm.h> +#include <net/ip.h> static inline void ipip6_ecn_decapsulate(struct sk_buff *skb) { @@ -95,6 +96,209 @@ return err; } + +/* jk: move this to beet module! */ +static int xfrm6_beet_output(struct sk_buff *skb) +{ + struct dst_entry *dst = skb->dst; + struct xfrm_state *x = dst->xfrm; + int hdrlen; + struct iphdr *iphv4, *top_iphv4; + struct ipv6hdr *iphv6, *top_iphv6; + + if (skb->nh.iph->version == 6) { + + u8 *prevhdr; + int hdr_len; + + /* 6-6 */ + + hdrlen = x->props.header_len - IPV4_BEET_PHMAXLEN; + skb_push(skb, hdrlen); + iphv6 = skb->nh.ipv6h; + + hdr_len = ip6_find_1stfragopt(skb, &prevhdr); + skb->nh.raw = prevhdr - hdrlen; + skb->h.raw = skb->data + hdr_len; + memmove(skb->data, iphv6, hdr_len); + + skb->nh.raw = skb->data; + top_iphv6 = skb->nh.ipv6h; + skb->nh.raw = &top_iphv6->nexthdr; + skb->h.ipv6h = top_iphv6 + 1; + ipv6_addr_copy(&top_iphv6->saddr, (struct in6_addr *)&x->props.saddr); + ipv6_addr_copy(&top_iphv6->daddr, (struct in6_addr *)&x->id.daddr); + + } else if (skb->nh.iph->version == 4) { + + int flags; + int optlen; + int dsfield; + u8 protocol; + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + + /* Inner = 4, Outer = 6*/ + + iphv4 = skb->nh.iph; + skb->h.ipiph = iphv4; + + hdrlen = x->props.header_len; + + optlen = iphv4->ihl * 4 - sizeof(*iphv4); + if (!optlen) { + hdrlen -= IPV4_BEET_PHMAXLEN; + } else { + skb->h.raw -= (IPV4_BEET_PHMAXLEN - (optlen & 4)); + hdrlen -= optlen & 4; + } + + skb->nh.raw = skb_push(skb, hdrlen); + top_iphv4 = skb->nh.iph; + + hdrlen = iphv4->ihl * 4 - optlen; + skb->h.raw += hdrlen; + + if (unlikely(optlen)) { + struct ip_beet_phdr *ph; + + BUG_ON(optlen < 0); + + ph = (struct ip_beet_phdr *)skb->h.raw; + ph->padlen = 4 - (optlen & 4); + ph->hdrlen = (optlen + ph->padlen + sizeof(*ph)) / 8; + ph->nexthdr = iphv4->protocol; + top_iphv4->protocol = IPPROTO_BEETPH; + top_iphv4->ihl = sizeof(struct iphdr) / 4; + } + + protocol = top_iphv4->protocol; + + if (unlikely(optlen)) + protocol = top_iphv4->protocol; + else + protocol = iphv4->protocol; + + if (skb_headroom(skb) <= 2*delta){ + if (pskb_expand_head(skb, delta,0, GFP_ATOMIC)) + return 0; + } + + skb->nh.raw = skb_push(skb, delta); + + top_iphv6 = skb->nh.ipv6h; + skb->h.ipv6h = top_iphv6 + 1; + /* DS disclosed */ + top_iphv6->version = 6; + top_iphv6->priority = 0; + top_iphv6->flow_lbl[0] = 0; + top_iphv6->flow_lbl[1] = 0; + top_iphv6->flow_lbl[2] = 0; + dsfield = ipv6_get_dsfield(top_iphv6); + dsfield = INET_ECN_encapsulate(dsfield, dsfield); + flags = x->props.flags; + if (flags & XFRM_STATE_NOECN) + dsfield &= ~INET_ECN_MASK; + ipv6_change_dsfield(top_iphv6, 0, dsfield); + + top_iphv6->nexthdr = protocol; + top_iphv6->hop_limit = dst_metric(dst->child, RTAX_HOPLIMIT); + top_iphv6->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + ipv6_addr_copy(&top_iphv6->saddr,(struct in6_addr *)&x->props.saddr); + ipv6_addr_copy(&top_iphv6->daddr, (struct in6_addr *)&x->id.daddr); + skb->nh.raw = &top_iphv6->nexthdr; + + } else + BUG_ON(1); + + return 0; +} + + + +/* jk: move this to beet module! */ +static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb) +{ + struct ip_beet_phdr *ph = (struct ip_beet_phdr*)(skb->h.raw); + int size = (x->sel.family == AF_INET) ? sizeof(struct iphdr) : sizeof(struct ipv6hdr); + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + __u8 proto = skb->nh.ipv6h->nexthdr, hops = skb->nh.ipv6h->hop_limit; + __u8 ph_nexthdr = 0; + int phlen = 0; + int optlen = 0; + int err = -EINVAL; + + if (x->sel.family == AF_INET) { + /* Inner = IPv4, therefore the IPhdr must be shrunk */ + /* Inner = 4, Outer = 6 */ + if (unlikely(proto == IPPROTO_BEETPH)) { + if (!pskb_may_pull(skb, sizeof(*ph))) + goto out; + phlen = ph->hdrlen * 8; + optlen = phlen - ph->padlen - sizeof(*ph); + + if (optlen < 0 || optlen & 3 || optlen > 250) + goto out; + if (!pskb_may_pull(skb, phlen)) + goto out; + + proto = ph_nexthdr = ph->nexthdr; + } + skb->nh.raw += delta; + } + + if (skb_cloned(skb) && + pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) + goto out; + + skb_push(skb, size); + memmove(skb->data, skb->nh.raw, size); + skb->nh.raw = skb->data; + + skb->mac.raw = memmove(skb->data - skb->mac_len, + skb->mac.raw, skb->mac_len); + if (unlikely(phlen)) { + skb_pull(skb, phlen - optlen); + skb->nh.raw = skb->data; + } + + if (x->sel.family == AF_INET6) { + struct ipv6hdr *ip6h = skb->nh.ipv6h; + + ip6h->payload_len = htons(skb->len - size); + ipv6_addr_copy(&ip6h->daddr, (struct in6_addr *) &x->sel.daddr.a6); + ipv6_addr_copy(&ip6h->saddr, (struct in6_addr *) &x->sel.saddr.a6); + + } else if (x->sel.family == AF_INET) { + + struct iphdr *iph = skb->nh.iph; + + iph->ihl = (sizeof(*iph) + optlen) / 4; + iph->version = 4; + iph->tos = 0; + iph->id = 0; + iph->frag_off = 0; + iph->ttl = hops; + iph->protocol = proto; + iph->daddr = x->sel.daddr.a4; + iph->saddr = x->sel.saddr.a4; + iph->tot_len = htons(skb->len); + ip_send_check(iph); + skb->protocol = htons(ETH_P_IP); + if (unlikely(!optlen)) { + skb->h.raw = skb->nh.raw; + } + dst_release(skb->dst); + skb->dst = NULL; + } else + BUG_ON(1); + + err = 0; + + out: + return err; +} + + static struct xfrm_mode xfrm6_tunnel_mode = { .input = xfrm6_tunnel_input, .output = xfrm6_tunnel_output, @@ -102,8 +306,20 @@ .encap = XFRM_MODE_TUNNEL, }; +/* jk: move this to beet module! */ +static struct xfrm_mode xfrm6_beet_mode = { + .input = xfrm6_beet_input, + .output = xfrm6_beet_output, + .owner = THIS_MODULE, + .encap = XFRM_MODE_BEET, +}; + static int __init xfrm6_tunnel_init(void) { + + /* jk: move this to beet module! */ + xfrm_register_mode(&xfrm6_beet_mode, AF_INET6); + return xfrm_register_mode(&xfrm6_tunnel_mode, AF_INET6); } @@ -111,6 +327,9 @@ { int err; + /* jk: move this to beet module! */ + err = xfrm_unregister_mode(&xfrm6_beet_mode, AF_INET6); + err = xfrm_unregister_mode(&xfrm6_tunnel_mode, AF_INET6); BUG_ON(err); } diff -urN a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c --- a/net/ipv6/ipcomp6.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/ipcomp6.c 2007-05-25 12:21:11.000000000 +0300 @@ -416,8 +416,10 @@ goto out; x->props.header_len = 0; - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct ipv6hdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; mutex_lock(&ipcomp6_resource_mutex); if (!ipcomp6_alloc_scratches()) @@ -428,7 +430,7 @@ goto error; mutex_unlock(&ipcomp6_resource_mutex); - if (x->props.mode) { + if (x->props.mode == XFRM_MODE_TUNNEL) { err = ipcomp6_tunnel_attach(x); if (err) goto error_tunnel; diff -urN a/net/ipv6/esp6.c b/net/ipv6/esp6.c --- a/net/ipv6/esp6.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/esp6.c 2007-05-25 12:21:11.000000000 +0300 @@ -344,8 +344,10 @@ if (crypto_cipher_setkey(esp->conf.tfm, esp->conf.key, esp->conf.key_len)) goto error; x->props.header_len = sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen; - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct ipv6hdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; x->data = esp; return 0; diff -urN a/net/ipv6/icmp.c b/net/ipv6/icmp.c --- a/net/ipv6/icmp.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/icmp.c 2007-05-25 12:21:11.000000000 +0300 @@ -64,6 +64,7 @@ #include <net/ip6_route.h> #include <net/addrconf.h> #include <net/icmp.h> +#include <linux/xfrm.h> #include <asm/uaccess.h> #include <asm/system.h> @@ -389,7 +390,7 @@ goto out_dst_release; } - if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) + if ((err = xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_SLEEP)) < 0) goto out; if (ipv6_addr_is_multicast(&fl.fl6_dst)) diff -urN a/net/key/af_key.c b/net/key/af_key.c --- a/net/key/af_key.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/key/af_key.c 2007-05-25 12:21:11.000000000 +0300 @@ -1166,7 +1166,8 @@ /* Nobody uses this, but we try. */ x->sel.family = pfkey_sadb_addr2xfrm_addr(addr, &x->sel.saddr); x->sel.prefixlen_s = addr->sadb_address_prefixlen; - } + } else + x->sel.family = x->props.family; /* Conservative */ if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) { struct sadb_x_nat_t_type* n_type; @@ -1763,14 +1764,13 @@ if (!t->reqid && !(t->reqid = gen_reqid())) return -ENOBUFS; } - - /* addresses present only in tunnel mode */ - if (t->mode) { - switch (xp->family) { +/* addresses present in any mode */ + { + struct sockaddr *sa; + sa = (struct sockaddr *)(rq+1); + switch(sa->sa_family) { case AF_INET: - sin = (void*)(rq+1); - if (sin->sin_family != AF_INET) - return -EINVAL; + sin = (struct sockaddr_in *)sa; t->saddr.a4 = sin->sin_addr.s_addr; sin++; if (sin->sin_family != AF_INET) @@ -1779,9 +1779,7 @@ break; #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) case AF_INET6: - sin6 = (void *)(rq+1); - if (sin6->sin6_family != AF_INET6) - return -EINVAL; + sin6 = (struct sockaddr_in6 *)sa; memcpy(t->saddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr)); sin6++; if (sin6->sin6_family != AF_INET6) @@ -1792,6 +1790,7 @@ default: return -EINVAL; } + t->outer_family = sa->sa_family; } /* No way to set this via kame pfkey */ t->aalgos = t->ealgos = t->calgos = ~0; diff -urN a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c --- a/net/xfrm/xfrm_user.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/xfrm/xfrm_user.c 2007-05-25 12:21:11.000000000 +0300 @@ -173,8 +173,9 @@ err = -EINVAL; switch (p->mode) { - case 0: - case 1: + case XFRM_MODE_TRANSPORT: + case XFRM_MODE_TUNNEL: + case XFRM_MODE_BEET: break; default: @@ -763,6 +764,7 @@ t->aalgos = ut->aalgos; t->ealgos = ut->ealgos; t->calgos = ut->calgos; + t->outer_family = ut->family; } } diff -urN a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c --- a/net/xfrm/xfrm_policy.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/xfrm/xfrm_policy.c 2007-05-25 12:21:11.000000000 +0300 @@ -782,6 +782,7 @@ if (tmpl->mode) { remote = &tmpl->id.daddr; local = &tmpl->saddr; + family = tmpl->outer_family; } x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family); diff -urN a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c --- a/net/xfrm/xfrm_state.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/xfrm/xfrm_state.c 2007-05-25 12:21:11.000000000 +0300 @@ -366,7 +366,7 @@ selector. */ if (x->km.state == XFRM_STATE_VALID) { - if (!xfrm_selector_match(&x->sel, fl, family) || + if (!xfrm_selector_match(&x->sel, fl, x->sel.family) || !xfrm_sec_ctx_match(pol->security, x->security)) continue; if (!best || @@ -378,7 +378,7 @@ acquire_in_progress = 1; } else if (x->km.state == XFRM_STATE_ERROR || x->km.state == XFRM_STATE_EXPIRED) { - if (xfrm_selector_match(&x->sel, fl, family) && + if (xfrm_selector_match(&x->sel, fl, x->sel.family) && xfrm_sec_ctx_match(pol->security, x->security)) error = -ESRCH; } diff -urN a/include/net/xfrm.h b/include/net/xfrm.h --- a/include/net/xfrm.h 2007-05-25 12:21:11.000000000 +0300 +++ b/include/net/xfrm.h 2007-05-25 12:21:11.000000000 +0300 @@ -226,7 +226,7 @@ extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo); extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c); extern void km_state_notify(struct xfrm_state *x, struct km_event *c); -#define XFRM_ACQ_EXPIRES 30 +#define XFRM_ACQ_EXPIRES 3 struct xfrm_tmpl; extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol); @@ -297,6 +297,10 @@ /* Source address of tunnel. Ignored, if it is not a tunnel. */ xfrm_address_t saddr; +/* family of the outer addresses. The family may differ from + the one in selector */ + unsigned short outer_family; + __u32 reqid; /* Mode: transport/tunnel */ diff -urN a/include/linux/xfrm.h b/include/linux/xfrm.h --- a/include/linux/xfrm.h 2007-05-25 12:21:11.000000000 +0300 +++ b/include/linux/xfrm.h 2007-05-25 12:21:11.000000000 +0300 @@ -43,6 +43,12 @@ #define XFRM_SC_ALG_RESERVED 0 #define XFRM_SC_ALG_SELINUX 1 +/* Transport layer flag passed to xfrm_lookup. If set, the userspace + process sleeps in a waitqueue until key management daemon has + finished setting up security associations. This workaround exists + until we have queues for outgoing IPsec packets. */ +#define XFRM_LOOKUP_SLEEP (!in_atomic() && !in_softirq()) + /* Selector, used as selector both on policy rules (SPD) and SAs. */ struct xfrm_selector @@ -118,9 +124,13 @@ XFRM_SHARE_UNIQUE /* Use once */ }; -#define XFRM_MODE_TRANSPORT 0 -#define XFRM_MODE_TUNNEL 1 -#define XFRM_MODE_MAX 2 +enum +{ + XFRM_MODE_TRANSPORT = 0, + XFRM_MODE_TUNNEL, + XFRM_MODE_BEET, + XFRM_MODE_MAX +}; /* Netlink configuration messages. */ enum { diff -urN a/include/linux/ipsec.h b/include/linux/ipsec.h --- a/include/linux/ipsec.h 2007-05-25 12:21:12.000000000 +0300 +++ b/include/linux/ipsec.h 2007-05-25 12:21:12.000000000 +0300 @@ -12,7 +12,8 @@ enum { IPSEC_MODE_ANY = 0, /* We do not support this for SA */ IPSEC_MODE_TRANSPORT = 1, - IPSEC_MODE_TUNNEL = 2 + IPSEC_MODE_TUNNEL = 2, + IPSEC_MODE_BEET = 3 }; enum { diff -urN a/include/linux/net.h b/include/linux/net.h --- a/include/linux/net.h 2007-05-25 12:21:12.000000000 +0300 +++ b/include/linux/net.h 2007-05-25 12:21:12.000000000 +0300 @@ -24,7 +24,7 @@ struct poll_table_struct; struct inode; -#define NPROTO 32 /* should be enough for now.. */ +#define NPROTO 33 /* should be enough for now.. */ #define SYS_SOCKET 1 /* sys_socket(2) */ #define SYS_BIND 2 /* sys_bind(2) */ diff -urN a/include/linux/in.h b/include/linux/in.h --- a/include/linux/in.h 2007-05-25 12:21:12.000000000 +0300 +++ b/include/linux/in.h 2007-05-25 12:21:12.000000000 +0300 @@ -40,6 +40,7 @@ IPPROTO_ESP = 50, /* Encapsulation Security Payload protocol */ IPPROTO_AH = 51, /* Authentication Header protocol */ + IPPROTO_BEETPH = 94, /* IP option pseudo header for BEET */ IPPROTO_PIM = 103, /* Protocol Independent Multicast */ IPPROTO_COMP = 108, /* Compression Header protocol */ diff -urN a/include/linux/ip.h b/include/linux/ip.h --- a/include/linux/ip.h 2007-05-25 12:21:12.000000000 +0300 +++ b/include/linux/ip.h 2007-05-25 12:21:12.000000000 +0300 @@ -79,6 +79,8 @@ #define IPOPT_TS_TSANDADDR 1 /* timestamps and addresses */ #define IPOPT_TS_PRESPEC 3 /* specified modules only */ +#define IPV4_BEET_PHMAXLEN 8 + struct iphdr { #if defined(__LITTLE_ENDIAN_BITFIELD) __u8 ihl:4, @@ -122,4 +124,11 @@ __u16 cpi; }; +struct ip_beet_phdr { + __u8 nexthdr; + __u8 hdrlen; + __u8 padlen; + __u8 reserved; +}; + #endif /* _LINUX_IP_H */

3 4

shutdown and boot on Xen
by Sergio Belkin 12 Sep '08

12 Sep '08

Hi, I am using xen-3.0.3-41.el5 on Centos 5 with 2.6.18-53.1.21.el5xen kernel. I'd like to: 1) When Dom0 shutdown, DomU's do the same. 2) When Dom0 boots. DomU's do the same. Is that possible? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 1

gv
by Terry Polzin 12 Sep '08

12 Sep '08

Where can I find gv for centos 5.x

2 1

yum erase fails
by Robert Moskowitz 12 Sep '08

12 Sep '08

I am trying to erase an rpm with yum erase. It fails: service hipfw does not support chkconfig Removed: hipl-firewall.i386 0:1.0.4.1 Complete! And it is not removed.... If I try with rpm -e, I get the same error message. So how do I remove this rpm?

4 5

CentOS-announce Digest, Vol 43, Issue 3
by centos-announce-request＠centos.org 12 Sep '08

12 Sep '08

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2008:0884 Important CentOS 3 i386 libxml2 - security update (Tru Huynh) 2. CESA-2008:0884 Important CentOS 3 x86_64 libxml2 - security update (Tru Huynh) 3. CESA-2008:0886-01: Important CentOS 2 i386 libxml2 security update (John Newbigin) ---------------------------------------------------------------------- Message: 1 Date: Thu, 11 Sep 2008 22:48:40 +0200 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2008:0884 Important CentOS 3 i386 libxml2 - security update To: centos-announce(a)centos.org Message-ID: <20080911204840.GA30448(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2008:0884 libxml2 security update for CentOS 3 i386: https://rhn.redhat.com/errata/RHSA-2008-0884.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/libxml2-2.5.10-13.i386.rpm updates/i386/RPMS/libxml2-devel-2.5.10-13.i386.rpm updates/i386/RPMS/libxml2-python-2.5.10-13.i386.rpm source: updates/SRPMS/libxml2-2.5.10-13.src.rpm You may update your CentOS-3 i386 installations by running the command: yum update libxml2 Tru -- Tru Huynh (mirrors, CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

CentOS 5 on an MSI Wind U100 Netbook && RTL8187 wireless card configuration
by Niki Kovacs 12 Sep '08

12 Sep '08

Hi, I recently purchased an MSI Wind Netbook, just slightly bigger than an EeePC, and IMHO just one step above the mere toy category. It's got a 10" monitor, 80 GB SATA HD, and the keyboard is just big enough so I can type with ten fingers (with a little exercise). The thing came preinstalled with Windows XP, and I've spent the last two days figuring out how I could possibly install my favourite OS on it. Among the many hairy details: 1) there's no CDROM nor floppy, only USB, and 2) the NIC is an RTL8101, not handled by the install kernel (nor the normal CentOS kernel). There were several Catch22's, but here's how I went about it. I published my detailed install notes (in French, but the Linux bits are universal :oD), since it seems to be a quite popular bit of hardware: http://www.microlinux.fr/article.php3?id_article=47 There's one exception though: the wireless card is a Realtek RTL8187 (which lspci lists as RTL8199 Unknown device). I must have tried about ten different drivers out there, none of them worked (MSI only published precompiled kernel modules for SuSE Linux Enterprise 10, go figure). The ndiswrapper solution didn't work either: the Windows driver loaded OK, but no signal. I tried the dkms-rtl818x driver from RPMForge, but to no avail. Any suggestions on this piece of hardware? Cheers, Niki

1 0

cfengine and crontab
by Ric Moore 12 Sep '08

12 Sep '08

The docs to installing cfengine refers to /var/spool/cron/crontabs/root That doesn't exist. Nor does /etc/crontab. Heck I remember that from the "old days", now there are lots of cron entries, in /etc but no crontab. Not installed by default. So, I'm hunting that one down. Nate, what did you wind up doing?? Ric -- ---------------------------------------------------- My father, Victor Moore (Vic) used to say: "There are two Great Sins in the world... ..the Sin of Ignorance, and the Sin of Stupidity. Only the former may be overcome." R.I.P. Dad. Linux user# 44256 Sign up at: http://counter.li.org/ https://nuoar.dev.java.net/ Verizon Cell # 336-254-1339

5 10

My turn at building a custom kernel for IPsec BEET mode
by Robert Moskowitz 12 Sep '08

12 Sep '08

Well I am working on building a kernel that will have the IPsec BEET mode patch available from infrahip.hiit.fi. I have some decent help, but really no one there is a seasoned Centos kernel builder (though they work with different FC kernels), and now they are mostly done for the day. I have been following the wiki on building a custom kernel, got my patch in ~/rpmbuild/SOURCES and away with the rpmbuild. That failed on line 69: Unknown tag: % define buildid .hipl0809111 But the comments say to set the define to something like ".local" or ".bz123456" So why the failure? Too long our are the quotes required? If this works, I would like to see this patch 'mainstreamed' as it is in the 2.6.27 kernel....

4 5

Alarming (?) smartd reports
by MHR 11 Sep '08

11 Sep '08

I decided, after the last discussion of smartd and S.M.A.R.T. disks, to take a look in my /var/log/messages, and I'm seeing fair bit of this: Sep 10 20:11:23 mhrichter smartd[3361]: Device: /dev/sda, 4294967295 Offline uncorrectable sectors Sep 10 20:41:23 mhrichter smartd[3361]: Device: /dev/hdb, 21 Currently unreadable (pending) sectors Sep 10 20:41:24 mhrichter smartd[3361]: Device: /dev/sda, 4294967295 Currently unreadable (pending) sectors Sep 10 20:41:24 mhrichter smartd[3361]: Device: /dev/sda, 4294967295 Offline uncorrectable sectors Sep 10 21:11:23 mhrichter smartd[3361]: Device: /dev/hdb, 21 Currently unreadable (pending) sectors Sep 10 21:11:23 mhrichter smartd[3361]: Device: /dev/sda, 4294967295 Currently unreadable (pending) sectors Sep 10 21:11:23 mhrichter smartd[3361]: Device: /dev/sda, 4294967295 Offline uncorrectable sectors Clearly there is a minor problem on /dev/hdb, which doesn't really surprise me, nor is it particularly worrisome (because I don't use that drive much). However, the other one I find more than a little curious. /dev/sda is a Seagate 300GB SATA drive that's coming up on two years old next month, but the number of "Currently unreadable (pending) sectors" or "Offline uncorrectable sectors," depending on which one you believe, is interesting - 4294967295 is FFFFFFFF in hex, and I'm running a 64-bit machine. Google is not particularly informative on this subject - anyone know more than general suggestions about dd, badblocks, etc.? This is my boot and primary system disk (has been for some time), but the error message is essentially meaningless (to me, right now). Thanks. mhr PS: In the last couple of months there was a discussion of how to make the disk less active, starting with someone reporting that their disk drive activity light blinked every 30 seconds or something like that. I tried to find it again, but I couldn't pin down what to search for - what was the solution?

10 16

Thin client
by lingu 11 Sep '08

11 Sep '08

Dear all, I am very much new to Linux Thin Client Concept. But know i am very much interested to create Centos 5 based thin client of 512MB on flash rom. Can any one guide me to how to start and if you provide any suitable links that will be very much great full. Regards. Lingu

4 3

Logwatch / spamassassin
by Bob Hoffman 11 Sep '08

11 Sep '08

Hi all, Well it took a while for me to figure it out, but apparently my logwatch no longer can be mailed locally on my computer as I believe spamassassin is eating it. I can send it out to an email address outside my server though. So spamassassin is only checking incoming I guess. My question is....how do I...or should I.... Make all local mail go straight to the boxes and skip spamasassin entirely.. Or.. Whitelist logwatch. Apparently, I am guessing, all those nifty log reports are so full of blacklisted urls and ips...well, you get the picure. Best ways to make this work so I can get it delivered to root again? Thanks

4 4

RE: Logwatch / spamassassin
by Bob Hoffman 11 Sep '08

11 Sep '08

So.. To answer my own question... so I edited the file /etc/mail/spamassassin/local.cf whitelist_from logwatch(a)localhost.localdomain Where localhost.localdomain is your hostname.servername And it worked. However, I am concerned about spoofing. I would think that mail agent and spamassassin would have an 'okay, it's a local user' thing going on. They do not. On the internet there are 1000s of posts like mine, asking questions about this and getting no answers. I hope this helps. Centos 5.2... -----Original Message----- From: Bob Hoffman [mailto:bob@bobhoffman.com] Sent: Thursday, September 11, 2008 4:54 AM To: 'centos(a)centos.org' Subject: Logwatch / spamassassin Hi all, Well it took a while for me to figure it out, but apparently my logwatch no longer can be mailed locally on my computer as I believe spamassassin is eating it. I can send it out to an email address outside my server though. So spamassassin is only checking incoming I guess. My question is....how do I...or should I.... Make all local mail go straight to the boxes and skip spamasassin entirely.. Or.. Whitelist logwatch. Apparently, I am guessing, all those nifty log reports are so full of blacklisted urls and ips...well, you get the picure. Best ways to make this work so I can get it delivered to root again? Thanks

3 2

RE: Logwatch / spamassassin
by Bob Hoffman 11 Sep '08

11 Sep '08

Ned, Thanks for the letters. Yes, I added the whitelist, but think that is not right either. No matter what I add in there, it will allow someone to use it and come in. The postmaster not getting tagged is just as scary actually. The weird part is the mail will go to another server via smtp and not be tagged as SPAM. How strange is that. I can only assume I should be changing something in the logwatch file to make it not be from 'logwatch' but to instead be 'root' or some other local user. Since logwatch has no local user in my mail setups...maybe that is the problem. So it might be that matter that makes it get killed by procmail or by spamassassin. Strange. But a very obvious problem across the net. I will work on this more tonight and see if I can get it to run better without whitelisting.

1 0

RE: [CentOS] /etc/rc5.d
by Bowie Bailey 11 Sep '08

11 Sep '08

tony.chamberlain(a)lemko.com wrote: > > start() { > date >> /root/joe.log > /usr/bin/joevpn start & > RES=$? > return $RES > } > > This all works and everything. I am just curious as to why when I do > a ps I get this: > /bin/bash /etc/rc5.d/S99runjoevpn > > Shouldn't that init script terminate since I have an "&" when I do the > start() function above? No other rc5 stuff (i.e. tomcat for instance) > shows up in the ps, though tomcat is running, it started up and > returned. Is this OK or am I missing something? The "&" doesn't terminate anything. It simply moves the process to the background and leaves it attached to the parent process. The parent process cannot exit until all of its child processes exit. What you are looking for is this: start() { date >> /root/joe.log nohup /usr/bin/joevpn start & RES=$? return $RES } The "nohup" command will detach the joevpn process from the parent and allow the parent process to exit. -- Bowie

1 0

RE: [CentOS] RE: Logwatch / spamassassin
by Bowie Bailey 11 Sep '08

11 Sep '08

Bob Hoffman wrote: > So.. > > To answer my own question... > > so I edited the file /etc/mail/spamassassin/local.cf > > whitelist_from logwatch(a)localhost.localdomain > > Where localhost.localdomain is your hostname.servername > > And it worked. > > However, I am concerned about spoofing. I would think that mail agent > and spamassassin would have an 'okay, it's a local user' thing going > on. Generally, using 'whitelist_from' is a bad idea due to spoofing. The address you are using will probably not cause too many problems, but you should still fix it if possible. Use 'whitelist_from_rcvd' instead. This will whitelist the address only if the mail comes from a specified domain. Try this (untested): whitelist_from_rcvd logwatch(a)localhost.localdomain localhost.localdomain Note that this will require your DNS server to resolve localhost.localdomain (forward and reverse). Another option is to configure your mail server to bypass SA entirely for local mail. -- Bowie

1 0

/etc/rc5.d
by tony.chamberlain＠lemko.com 11 Sep '08

11 Sep '08

I have a shell script, /usr/bin/joevpn, which does a quick VPN connect. Basically (HOST and DOFIL are defined above and are correct. I just did not list them here) case "$1" in start) date > $DOFIL while [ -f $DOFIL ] do echo y | /usr/local/bin/vpnclient connect $HOST sleep 10 done ;; # Reconnects in case of disconnect (in while loop) This works. And in /etc/init.d I have a runjoevpn (which linked to /etc/rc5.d/S99runjoevpn). It works like the others. Below, $1 is checked (not shown here for brevity) and if it is "start" then start below is called: start() { date >> /root/joe.log /usr/bin/joevpn start & RES=$? return $RES } This all works and everything. I am just curious as to why when I do a ps I get this: /bin/bash /etc/rc5.d/S99runjoevpn Shouldn't that init script terminate since I have an "&" when I do the start() function above? No other rc5 stuff (i.e. tomcat for instance) shows up in the ps, though tomcat is running, it started up and returned. Is this OK or am I missing something?

2 1

Job Scheduling suggestions
by Mag Gam 11 Sep '08

11 Sep '08

At my university we have 50 computers in the lab. We would like to use a scheduler to schedule our fluid models, and I was wondering what is a good suggestion? TIA

4 4

Centos 4.7 delay more than mirror issue?
by Josh Donovan 11 Sep '08

11 Sep '08

Hi folks, Normally people ask "when is CentOS 4.7 coming" and they are told "when it is ready". Dag posted on his blog about it going to testing in July while it was supposed to be syncing to the mirrors on Sept 5/6th according to Karanbir. Is there something going on behind the scenes? I have not seen Johnny Hughes or even Dag posting on this list for some time. CentOS has gone for some time while other rebuilds folded so I wouldn't like it to follow the same way. Thanks, Josh

5 4

PCI SATA Controller Recommendations?
by Tim Nelson 10 Sep '08

10 Sep '08

Hello fellow listers... I'd like to get some recommendations on a good SATA controller for use with CentOS 5.x. It should be PCI, bootable, have 4 SATA ports, have native support (no crap proprietary or manually compiled drivers), and possibly hot swap support. Any ideas? There are plenty of PCI-X and PCIe controllers that I think would work but the use for this card is in a smaller 1U server that is quite cramped, hence the query for a standard PCI card. All suggestions and comments welcome. Thank you! Tim Nelson Systems/Network Engineer Rockbochs Inc. (218)727-4332 x105

4 3

Centos 5 Virtualization
by lingu 10 Sep '08

10 Sep '08

Hello list, I am very much new to Virtualization.But i want to study and test Virtualization.Can any one suggest me the web links from where i can start. I want to learn from basic to advanced concepts of VT. Thanks in advance for your reply

6 7

open(/dev/pts/0): No such file or directory
by Ric Moore 10 Sep '08

10 Sep '08

I'm getting this error just recently. Is this something to be concerned with?? Running CentOS 5.2. Kernel 2.6.18-53.el5 Thanks for any considerations, Ric -- ---------------------------------------------------- My father, Victor Moore (Vic) used to say: "There are two Great Sins in the world... ..the Sin of Ignorance, and the Sin of Stupidity. Only the former may be overcome." R.I.P. Dad. Linux user# 44256 Sign up at: http://counter.li.org/ https://nuoar.dev.java.net/ Verizon Cell # 336-254-1339

3 4

DB stop&start
by Mad Unix 10 Sep '08

10 Sep '08

Hi I need a script to automatically Starting/Stopping an Oracle 10g DB on CentOS5.2 64bit i.e lsnrctl start/stop db start/stop emctl start/stop dbconsole" Any help? -- Madunix_at_Gmail Sysadmin "Computers are useless. They can only give you answers" - Pablo Picasso "Never trust a computer you can't throw out a window." - Steve Wozniak

2 2

centos5 - logwatch - verisign
by RobertH 10 Sep '08

10 Sep '08

Re: centos 5 logwatch Has anyone ever looked into why verisign does this from these ips fairly frequently? It appears that it is some type of SSL probing the HTTP port, correct? Are they just gathering stats or something ? --------------------- httpd Begin ------------------------ A total of 2 sites probed the server 216.168.253.197 216.168.253.198 ..... The first ip is a3-pip6.verisign.net The second ip is a3-pip7.verisign.net Here is grep from logs 216.168.253.197 - - [01/Sep/2008:13:30:19 -0700] "\x80@\x01\x03" 501 304 216.168.253.197 - - [01/Sep/2008:14:02:08 -0700] "\x80@\x01\x03" 501 304 216.168.253.197 - - [05/Sep/2008:22:16:20 -0700] "\x80@\x01\x03" 501 304 216.168.253.197 - - [05/Sep/2008:22:16:29 -0700] "\x80@\x01\x03" 501 297 216.168.253.197 - - [09/Sep/2008:15:26:54 -0700] "\x80@\x01\x03" 501 304 216.168.253.197 - - [09/Sep/2008:15:27:04 -0700] "\x80@\x01\x03" 501 304 216.168.253.197 - - [09/Sep/2008:15:27:13 -0700] "\x80@\x01\x03" 501 297 216.168.253.198 - - [02/Sep/2008:07:00:39 -0700] "\x80@\x01\x03" 501 304 216.168.253.198 - - [02/Sep/2008:07:48:42 -0700] "\x80@\x01\x03" 501 297 216.168.253.198 - - [03/Sep/2008:15:04:50 -0700] "\x80@\x01\x03" 501 297 216.168.253.198 - - [05/Sep/2008:22:19:52 -0700] "\x80@\x01\x03" 501 297 216.168.253.198 - - [09/Sep/2008:15:26:52 -0700] "\x80@\x01\x03" 501 297 - rh

2 1

Compromised
by Miark 10 Sep '08

10 Sep '08

My wife's office server was compromised today. It appears they ssh'ed in through account pcguest which was set up for Samba. (I don't remember setting up that account, but maybe I did.) At any rate, I found a bazillion "ftp_scanner" processes running. A killall finished them off quickly, I nuked the pcguest account, and switched ssh to a different port (which I normally do anyway). I used 'find' to locate ftp_scanner, which was running in a folder under /var/tmp. It seems that before I could nuke the directory, it nuked itself! Because it was running from /var/tmp, and because 'find' and 'ps' were not compromised (in that they did not hide the ftp_scanner processes or files), I'm thinking the attacker really didn't get any further than eating some bandwidth. I suppose I have no choice but to re-install, but I thought I'd run I'd get some feedback first. (Something other than, "Way to go, moron.") In the meantime, I'm pulling the plug. Miark

4 3

Network card help please
by Gary 10 Sep '08

10 Sep '08

Hi ya'll, Running v5 .. I have 2 Linksys PCI cards running already without any problems. These were recognized by the system as ADMTek NC100 cards, per usual... they run on eth0 and eth2 ... have for months.... no problems. I added a third Linksys PCI card to the mobo, fired the computer up, and it is not recognized at all. It has been many years since I had this problem of a network card not being automatically recognized, so I am a little rusty. Can someone give me input on the steps needed to get this third NIC recognized please. Thanks for your help. -- Regards, Gary

3 12

buildinstall cannot find modules
by treed＠ultraviolet.org 09 Sep '08

09 Sep '08

When using buildinstall and CentOS 5.2 to create my own CD minus a bunch of unneeded RPM's and plus a few of my custom RPM's I find that the install CD that gets build does not install an initrd which renders the system unbootable. I also notice that when I run buildinstall with the -debug option it says: unpacking /var/www/html/centos/5.2/os/x86_64/CentOS/kernel-2.6.18-92.el5.x86_64.rpm.x86_64 Building initrd.img Module 3c501 not found in kernel rpm Module 3c503 not found in kernel rpm Module 3c505 not found in kernel rpm and so on for many kernel modules. I notice that the filename it says it is unpacking ends with .x86_64.rpm.x86_64. Is that normal? I google'd and found someone else saying theirs did the same thing. Could this be related to why I'm not ending up with an initrd being installed? -- Tracy Reed http://tracyreed.org

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss