- Discuss - lists.centos.org

Newbies to CentOS List
by Josh Donovan 13 Sep '08

13 Sep '08

Guidelines for CentOS Mailing List posts * Mailing List Etiquette * How To Ask Questions The Smart Way * Quoting Style * Why is Bottom-posting better than Top-posting 1. Please turn off HTML in your e-mail client for these mailing lists. We have several subscribers who read the list with text only readers and they can't easily read html formatted e-mails. There is a place (somewhere) for the flowery stationary and themes that some mail clients offer ... but this is not it. Again, please only post text e-mails to these mailing lists. 2. Please do not top post to the mailing list when replying to a post. (See the Quoting Style link above, and use the Interleaved text method , deleting non-applicable text as required. If you need to reply to a message, and you do not need to post in interleaved mode, please bottom post instead of top posting. 3. Please trim the extra stuff in the email and leave enough to make sense of the thread. Note: There are places to debate the merits of top posting and how it might have some advantages in relation to Interleaved text or bottom posting ... but this is not one of those places. Extracted from http://www.centos.org/modules/tinycontent/index.php?id=16 I added no 3 above. I had not been on this mailing list or others for a while but I thought other newbies would benefit. Thanks, Josh.

2 1

(no subject)
by Bob Hoffman 13 Sep '08

13 Sep '08

Hi all.. I have centos 5.2 There is a cron file that is commented out to auto update the rules of spamassassin Location: /etc/cron.d/sa-update This file is chmod 600, should it not be 755? All the other crons are 755 This line is commented. #10 4 * * * root /usr/share/spamassassin/sa-update.cron 2>&1 | tee -a /var/log/sa-update.log Questions 1- should I re chmod it to 600 or leave it at 755? Is anyone else using this? The cron file says to read a certain wiki page and do this cron at your own peril. Yet I find no warnings on that wiki page that would make me think this was bad. Thanks all

2 1

4.7 update issues?
by RobertH 13 Sep '08

13 Sep '08

Greets, Thank you to all the CentOS team and supporters. :-) Just wondering though... Any 4.7 update issues or horror stories yet? Also, anyone that has upstream support and previously updated, any issues for Internet facing, or other, production machines ? - rh

3 3

Problem to run 4 virtual machines at a time.
by mallikarjun gudisagar 13 Sep '08

13 Sep '08

Hi all I have installed vyatta system, (vyatta-livecd-vc4-alpha2.iso ) on top of Centos5. Our system requirement is, * Centos 5.1 (2.6.18-92.1.10.el5xen ) * 2 Gb RAM, * x86_64 And cpu information is as follow, [root@turtle4 ~]# cat /proc/cpuinfo processor : 0 vendor_id : AuthenticAMD cpu family : 15 model : 107 model name : AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ stepping : 1 cpu MHz : 2100.010 cache size : 512 KB physical id : 0 siblings : 1 core id : 0 cpu cores : 1 fpu : yes fpu_exception : yes cpuid level : 1 wp : yes flags : fpu tsc msr pae mce cx8 apic mtrr mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt lm 3dnowext 3dnow pni cx16 lahf_lm cmp_legacy svm cr8_legacy bogomips : 5252.03 TLB size : 1024 4K pages clflush size : 64 cache_alignment : 64 address sizes : 40 bits physical, 48 bits virtual power management: ts fid vid ttp tm stc [6] processor : 1 vendor_id : AuthenticAMD cpu family : 15 model : 107 model name : AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ stepping : 1 cpu MHz : 2100.010 cache size : 512 KB physical id : 1 siblings : 1 core id : 0 cpu cores : 1 fpu : yes fpu_exception : yes cpuid level : 1 wp : yes flags : fpu tsc msr pae mce cx8 apic mtrr mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt lm 3dnowext 3dnow pni cx16 lahf_lm cmp_legacy svm cr8_legacy bogomips : 5252.03 TLB size : 1024 4K pages clflush size : 64 cache_alignment : 64 address sizes : 40 bits physical, 48 bits virtual power management: ts fid vid ttp tm stc [6] My problem is i have installed '4' virtual machines. each virtual machine have 256Mb RAM. But i am not able to run 4 virtual machines at a time. Please help me, what should i have to do? Thanks mallu

2 1

CentOS-announce Digest, Vol 43, Issue 4
by centos-announce-request＠centos.org 13 Sep '08

13 Sep '08

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2008:0884 Important CentOS 3 ia64 libxml2 - security update (Pasi Pirhonen) 2. CESA-2008:0884 Important CentOS 4 ia64 libxml2 - security update (Pasi Pirhonen) 3. CESA-2008:0884 Important CentOS 3 s390(x) libxml2 - security update (Pasi Pirhonen) 4. CESA-2008:0884 Important CentOS 4 s390(x) libxml2 - security update (Pasi Pirhonen) 5. CentOS 4.7 is released for i386 and x86_64 (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Fri, 12 Sep 2008 19:10:39 +0300 From: Pasi Pirhonen <upi(a)centos.fi> Subject: [CentOS-announce] CESA-2008:0884 Important CentOS 3 ia64 libxml2 - security update To: centos-announce(a)centos.org Message-ID: <20080912161039.GQ9914(a)centos.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2008:0884 https://rhn.redhat.com/errata/RHSA-2008-0884.html The following updated files have been uploaded and are currently syncing to the mirrors: ia64: updates/ia64/RPMS/libxml2-2.5.10-13.ia64.rpm updates/ia64/RPMS/libxml2-devel-2.5.10-13.ia64.rpm updates/ia64/RPMS/libxml2-python-2.5.10-13.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://pasi.pirhonen.eu/ Top-postings silently ignored

1 0

Centos Website
by Dan Carl 13 Sep '08

13 Sep '08

I can't connect, appears to be down. Thought I'd post in case whoevers in charge is listening here. Dan

6 8

Java install
by Ric Moore 13 Sep '08

13 Sep '08

While using Fedora, I always used java straight from Sun. What is recommended for CentOS?? Getting jetty, java and other java apps working correctly has been a real chore. If I used nothing but RPMs for CEntOS, would I have a real working java install? I need some help on this one badly. Ric -- ---------------------------------------------------- My father, Victor Moore (Vic) used to say: "There are two Great Sins in the world... ..the Sin of Ignorance, and the Sin of Stupidity. Only the former may be overcome." R.I.P. Dad. Linux user# 44256 Sign up at: http://counter.li.org/ https://nuoar.dev.java.net/ Verizon Cell # 336-254-1339

6 19

Standby Issue
by Test 13 Sep '08

13 Sep '08

Hi List, I'm running Centos 5.2 on an Pentium III-1000 The box has been running for almost a year without any (hardware) issues. SInce a few weeks the box goes into standby (power led flashes) without any obvious reason (ie. i cannot find anything). This happens randomly (box runs for 1 day and does this, next time it runs for 5 days and it happens). Normally when a box goes into standby, you should be able to start it again pressing the power button, but this does not work. I have to completely unplug it and then it boots up again (after plugging it in again ;-)) I thought it was due to a kernel upgrade from 2.6.18-92.1.6 to 2.6.18-92.1.10, but after a downgrade the same issue occurred I have checked about all settings (loaded modules, logfiles, bios etc.) I have stopped the acpid, still no go... cpuspeed is not running... Bios has got all powermanagement stuff disable.. So basically i am looking for some hints on solving this... Anyone...? -- Test <test(a)remedial-teacher.nl>

7 7

A glimpse into the future for RHEL 6 and CentOS 6
by Scott Silva 13 Sep '08

13 Sep '08

http://searchenterpriselinux.techtarget.com/news/article/0,289142,sid39_gci… -- MailScanner is like deodorant... You hope everybody uses it, and you notice quickly if they don't!!!!

4 3

DNS Logging with Selinux enabled
by Josh Donovan 12 Sep '08

12 Sep '08

I rebuilt my server and setup bind to log queries in a chroot. ################################################################################ # Logging Configuration # logging { # # Define channels for the two log files # channel query_log { severity info; print-time yes; file "/var/log/query.log" versions 3 size 100M; }; channel activity_log { severity info; print-time yes; print-category yes; print-severity yes; file "/var/log/activity.log" versions 3 size 100M; Below is the security context of the files in the chroot. [root@josh log]# ls -alZ /var/named/chroot/var/log/activity.log -rw-r--r-- named named root:object_r:named_conf_t /var/named/chroot/var/log/activity.log [root@josh log]# ls -alZ /var/named/chroot/var/log/query.log -rw-r--r-- named named root:object_r:named_conf_t /var/named/chroot/var/log/query.log I temporarily disabled selinux but there was one simple step I missed (forgot since i did this years ago). I briefly recall creating a symlink and/or using chcon or one of the selinux commands. Thanks, Josh

4 8

CentOS 4.7 status
by Adrian Sevcenco 12 Sep '08

12 Sep '08

Hi, i was wondering what is the status of 4.7 Thank you, Best regards, Adrian

15 23

Custom build kernel patch fails big time.
by Robert Moskowitz 12 Sep '08

12 Sep '08

I am trying to build a custom kernel for the HIPL code (infrahip.hip.fi), using the patch for the Linux 2.6.18 kernel. I followed all the instructions for getting the kernel source and making a custom kernel provided on the wiki. The rpmbuild fails with the following messages: Get an error on this step (figured out my other problem): Patch #40000 (centos-5.2-hipmod-sleep-beet-and-interfamily-all-in-one.patch): 1 out of 4 hunks FAILED -- saving rejects to file net/ipv4/xfrm4_output.c.rej 2 out of 3 hunks FAILED -- saving rejects to file net/ipv4/esp4.c.rej 1 out of 1 hunk FAILED -- saving rejects to file net/ipv6/udp.c.rej 1 out of 1 hunk FAILED -- saving rejects to file net/ipv6/tcp_ipv6.c.rej 1 out of 1 hunk FAILED -- saving rejects to file net/ipv6/esp6.c.rej 2 out of 2 hunks FAILED -- saving rejects to file net/ipv6/icmp.c.rej 2 out of 2 hunks FAILED -- saving rejects to file net/xfrm/xfrm_state.c.rej 1 out of 2 hunks FAILED -- saving rejects to file include/net/xfrm.h.rej Reversed (or previously applied) patch detected! Assume -R? [n] Apply anyway? [n] 1 out of 1 hunk ignored -- saving rejects to file include/linux/net.h.rej I've asked for help on the hipl list, but there is no real experience there with Centos (FC8 and 9), and they are trying to help, put perhaps someone here might know what I am doing wrong? Oh, one question was asked about how the ~/rpmbuild/BUILD/kernel-2.16.18 directory looks like. I think the linux-2.6.18.i386 (or i686) is not what the patch is expecting? Here is the patch file (centos-5.2-hipmod-sleep-beet-and-interfamily-all-in-one.patch): diff -urN a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c --- a/net/ipv4/xfrm4_input.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/xfrm4_input.c 2007-05-25 12:21:11.000000000 +0300 @@ -13,6 +13,7 @@ #include <linux/string.h> #include <linux/netfilter.h> #include <linux/netfilter_ipv4.h> +#include <net/inet_ecn.h> #include <net/ip.h> #include <net/xfrm.h> @@ -23,6 +24,15 @@ EXPORT_SYMBOL(xfrm4_rcv); +static inline void ipip_ecn_decapsulate(struct sk_buff *skb) +{ + struct iphdr *outer_iph = skb->nh.iph; + struct iphdr *inner_iph = skb->h.ipiph; + + if (INET_ECN_is_ce(outer_iph->tos)) + IP_ECN_set_ce(inner_iph); +} + static int xfrm4_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq) { switch (nexthdr) { @@ -103,11 +113,11 @@ xfrm_vec[xfrm_nr++] = x; - if (x->mode->input(x, skb)) + if (x->mode->input(x, skb)) goto drop; - + if (x->props.mode) { - decaps = 1; + decaps = 1; break; } diff -urN a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c --- a/net/ipv4/xfrm4_output.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/xfrm4_output.c 2007-05-25 12:21:11.000000000 +0300 @@ -14,10 +14,12 @@ #include <linux/skbuff.h> #include <linux/spinlock.h> #include <linux/netfilter_ipv4.h> +#include <net/inet_ecn.h> #include <net/ip.h> #include <net/xfrm.h> #include <net/icmp.h> + static int xfrm4_tunnel_check_size(struct sk_buff *skb) { int mtu, ret = 0; @@ -54,7 +56,7 @@ goto error_nolock; } - if (x->props.mode) { + if (x->props.mode == XFRM_MODE_TUNNEL) { err = xfrm4_tunnel_check_size(skb); if (err) goto error_nolock; @@ -66,7 +68,7 @@ if (err) goto error; - err = x->mode->output(skb); + err = x->mode->output(skb); if (err) goto error; @@ -85,6 +87,7 @@ } dst = skb->dst; x = dst->xfrm; + } while (x && !x->props.mode); IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED; diff -urN a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c --- a/net/ipv4/xfrm4_tunnel.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/xfrm4_tunnel.c 2007-05-25 12:21:11.000000000 +0300 @@ -28,13 +28,20 @@ static int ipip_init_state(struct xfrm_state *x) { - if (!x->props.mode) - return -EINVAL; - if (x->encap) return -EINVAL; - x->props.header_len = sizeof(struct iphdr); + switch (x->props.mode) { + case XFRM_MODE_TRANSPORT: + return -EINVAL; + default: + case XFRM_MODE_TUNNEL: + x->props.header_len = sizeof(struct iphdr); + break; + case XFRM_MODE_BEET: + x->props.header_len += IPV4_BEET_PHMAXLEN; + break; + } return 0; } diff -urN a/net/ipv4/route.c b/net/ipv4/route.c --- a/net/ipv4/route.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/route.c 2007-05-25 12:21:11.000000000 +0300 @@ -108,6 +108,7 @@ #ifdef CONFIG_SYSCTL #include <linux/sysctl.h> #endif +#include <linux/xfrm.h> #define RT_FL_TOS(oldflp) \ ((u32)(oldflp->fl4_tos & (IPTOS_RT_MASK | RTO_ONLINK))) @@ -2631,7 +2632,7 @@ int ip_route_output_key(struct rtable **rp, struct flowi *flp) { - return ip_route_output_flow(rp, flp, NULL, 0); + return ip_route_output_flow(rp, flp, NULL, XFRM_LOOKUP_SLEEP); } static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event, diff -urN a/net/ipv4/ah4.c b/net/ipv4/ah4.c --- a/net/ipv4/ah4.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/ah4.c 2007-05-25 12:21:11.000000000 +0300 @@ -253,8 +253,10 @@ goto error; x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len); - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct iphdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; x->data = ahp; return 0; diff -urN a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c --- a/net/ipv4/xfrm4_policy.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/xfrm4_policy.c 2007-05-25 12:21:11.000000000 +0300 @@ -16,6 +16,8 @@ static struct dst_ops xfrm4_dst_ops; static struct xfrm_policy_afinfo xfrm4_policy_afinfo; +static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu); + static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl) { return __ip_route_output_key((struct rtable**)dst, fl); @@ -53,17 +55,20 @@ struct dst_entry *dst, *dst_prev; struct rtable *rt0 = (struct rtable*)(*dst_p); struct rtable *rt = rt0; - u32 remote = fl->fl4_dst; - u32 local = fl->fl4_src; struct flowi fl_tunnel = { .nl_u = { .ip4_u = { - .saddr = local, - .daddr = remote, + .saddr = fl->fl4_dst, + .daddr = fl->fl4_src, .tos = fl->fl4_tos } } }; + union { + struct in6_addr *in6; + struct in_addr *in; + } remote, local; + unsigned short outer_family = 0, beet = 0; int i; int err; int header_len = 0; @@ -75,7 +80,6 @@ for (i = 0; i < nx; i++) { struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops); struct xfrm_dst *xdst; - int tunnel = 0; if (unlikely(dst1 == NULL)) { err = -ENOBUFS; @@ -96,21 +100,45 @@ dst1->next = dst_prev; dst_prev = dst1; - if (xfrm[i]->props.mode) { - remote = xfrm[i]->id.daddr.a4; - local = xfrm[i]->props.saddr.a4; - tunnel = 1; + + if (xfrm[i]->props.mode == XFRM_MODE_TUNNEL || xfrm[i]->props.mode == XFRM_MODE_BEET) { + outer_family = xfrm[i]->props.family; + beet = (xfrm[i]->props.mode == XFRM_MODE_BEET); + + if(outer_family == AF_INET6){ + remote.in6 = (struct in6_addr*)&xfrm[i]->id.daddr; + local.in6 = (struct in6_addr*)&xfrm[i]->props.saddr; + } else if(outer_family == AF_INET){ + remote.in = (struct in_addr*)&xfrm[i]->id.daddr; + local.in = (struct in_addr*)&xfrm[i]->props.saddr; + } else + BUG_ON(1); } header_len += xfrm[i]->props.header_len; trailer_len += xfrm[i]->props.trailer_len; - if (tunnel) { - fl_tunnel.fl4_src = local; - fl_tunnel.fl4_dst = remote; + if (outer_family) { + switch(outer_family) { + case AF_INET: + fl_tunnel.fl4_dst = remote.in->s_addr; + fl_tunnel.fl4_src = local.in->s_addr; + break; + case AF_INET6: + ipv6_addr_copy(&fl_tunnel.fl6_dst, remote.in6); + ipv6_addr_copy(&fl_tunnel.fl6_src, local.in6); + break; + default: + BUG_ON(1); + } err = xfrm_dst_lookup((struct xfrm_dst **)&rt, - &fl_tunnel, AF_INET); + &fl_tunnel, outer_family); if (err) goto error; + /* Without this, the atomic inc below segfaults */ + if (outer_family == AF_INET6) { + rt->peer = NULL; + rt_bind_peer(rt,1); + } } else dst_hold(&rt->u.dst); } @@ -160,6 +188,11 @@ } xfrm_init_pmtu(dst); + if (beet && outer_family == AF_INET6) { + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + u32 mtu = dst_mtu(dst); + xfrm4_update_pmtu(dst, mtu - delta); + } return 0; error: diff -urN a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c --- a/net/ipv4/xfrm4_mode_tunnel.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/xfrm4_mode_tunnel.c 2007-05-25 12:21:11.000000000 +0300 @@ -33,7 +33,7 @@ * On exit, skb->h will be set to the start of the payload to be processed * by x->type->output and skb->nh will be set to the top IP header. */ -static int xfrm4_tunnel_output(struct sk_buff *skb) + static int xfrm4_tunnel_output(struct sk_buff *skb) { struct dst_entry *dst = skb->dst; struct xfrm_state *x = dst->xfrm; @@ -98,6 +98,182 @@ return err; } +/* jk: this should be moved to the beet module! */ +static int xfrm4_beet_output(struct sk_buff *skb) +{ + struct dst_entry *dst = skb->dst; + struct xfrm_state *x = dst->xfrm; + int hdrlen; + struct iphdr *iphv4, *top_iphv4; + struct ipv6hdr *iphv6, *top_iphv6; + + if (skb->nh.iph->version == 4) { + + int optlen; + + /* 4-4 */ + + iphv4 = skb->nh.iph; + skb->h.ipiph = iphv4; + + hdrlen = x->props.header_len; + + optlen = iphv4->ihl * 4 - sizeof(*iphv4); + if (!optlen) { + hdrlen -= IPV4_BEET_PHMAXLEN; + } else { + skb->h.raw -= (IPV4_BEET_PHMAXLEN - (optlen & 4)); + hdrlen -= optlen & 4; + } + + skb->nh.raw = skb_push(skb, hdrlen); + top_iphv4 = skb->nh.iph; + + hdrlen = iphv4->ihl * 4 - optlen; + skb->h.raw += hdrlen; + memmove(top_iphv4, iphv4, hdrlen); + + if (unlikely(optlen)) { + struct ip_beet_phdr *ph; + + BUG_ON(optlen < 0); + + ph = (struct ip_beet_phdr *)skb->h.raw; + ph->padlen = 4 - (optlen & 4); + ph->hdrlen = (optlen + ph->padlen + sizeof(*ph)) / 8; + ph->nexthdr = iphv4->protocol; + top_iphv4->protocol = IPPROTO_BEETPH; + top_iphv4->ihl = sizeof(struct iphdr) / 4; + } + + top_iphv4->saddr = x->props.saddr.a4; + top_iphv4->daddr = x->id.daddr.a4; + + } else if (skb->nh.iph->version == 6) { + + u8 protocol; + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + + /* Inner = 6, Outer = 4 : changing the external IP hdr + * to the outer addresses + */ + + hdrlen = x->props.header_len - IPV4_BEET_PHMAXLEN; + skb_push(skb, hdrlen); + iphv6 = skb->nh.ipv6h; + + skb->nh.raw = skb->data; + top_iphv6 = skb->nh.ipv6h; + + protocol = iphv6->nexthdr; + skb->nh.raw = skb_pull(skb, delta); + top_iphv4 = skb->nh.iph; + skb->h.raw = skb->data + hdrlen; + top_iphv4->ihl = (sizeof(struct iphdr) >> 2); + top_iphv4->version = 4; + top_iphv4->id = 0; + top_iphv4->frag_off = htons(IP_DF); + top_iphv4->ttl = dst_metric(dst->child, RTAX_HOPLIMIT); + top_iphv4->saddr = x->props.saddr.a4; + top_iphv4->daddr = x->id.daddr.a4; + skb->h.raw += top_iphv4->ihl*4; + top_iphv4->protocol = protocol; + + } else + BUG_ON(1); + + return 0; +} + + +/* jk: this should be moved to the beet module! */ +static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb) +{ + int err = -EINVAL; + int phlen = 0; + int optlen = 0; + __u8 ph_nexthdr = 0; + int size = (x->sel.family == AF_INET) ? sizeof(struct iphdr) : sizeof(struct ipv6hdr); + int proto = skb->nh.iph->protocol; + int hops = skb->nh.iph->ttl; + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + + if (x->sel.family == AF_INET6) { + /* Here, the inner family is 6, therefore I have to + * substitute the IPhdr by enlarging it */ + if (skb_tailroom(skb) < delta){ + if (pskb_expand_head(skb, 0, delta, GFP_ATOMIC)) + goto out; //Just returning from here. + } + + skb->nh.raw -= delta; + } else if (x->sel.family == AF_INET) { + // We need to extract the PH + struct ip_beet_phdr *ph = (struct ip_beet_phdr*)(skb->nh.iph + 1); + + if (proto == IPPROTO_BEETPH) { + if (!pskb_may_pull(skb, sizeof(*ph))) + goto out; + phlen = ph->hdrlen * 8; + optlen = phlen - ph->padlen - sizeof(*ph); + + if (optlen < 0 || optlen & 3 || optlen > 250) + goto out; + if (!pskb_may_pull(skb, phlen)) + goto out; + + ph_nexthdr = ph->nexthdr; + } + } else + BUG_ON(1); + + if (skb_cloned(skb) && + pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) + goto out; + + skb_push(skb, size); + memmove(skb->data, skb->nh.raw, size); + skb->nh.raw = skb->data; + + if (x->sel.family == AF_INET) { + struct iphdr *iph = skb->nh.iph; + + if (unlikely(phlen)) { + skb_pull(skb, phlen - optlen); + memmove(skb->data, skb->nh.raw, sizeof(*iph)); + skb->nh.raw = skb->data; + iph = skb->nh.iph; + } + + iph->ihl = (sizeof(*iph) + optlen) / 4; + iph->tot_len = htons(skb->len); + iph->daddr = x->sel.daddr.a4; + iph->saddr = x->sel.saddr.a4; + if (ph_nexthdr) + iph->protocol = ph_nexthdr; + else + iph->protocol = proto; + ip_send_check(iph); + } else if (x->sel.family == AF_INET6) { + struct ipv6hdr *ip6h = skb->nh.ipv6h; + + memset(ip6h->flow_lbl, 0, sizeof(ip6h->flow_lbl)); + ip6h->version = 6; + ip6h->priority = 0; + ip6h->nexthdr = proto; + ip6h->hop_limit = hops; + ip6h->payload_len = htons(skb->len - size); + ipv6_addr_copy(&ip6h->daddr, (struct in6_addr *)&x->sel.daddr.a6); + ipv6_addr_copy(&ip6h->saddr, (struct in6_addr *)&x->sel.saddr.a6); + skb->protocol = htons(ETH_P_IPV6); + } + + err = 0; + out: + + return err; +} + static struct xfrm_mode xfrm4_tunnel_mode = { .input = xfrm4_tunnel_input, .output = xfrm4_tunnel_output, @@ -105,8 +281,19 @@ .encap = XFRM_MODE_TUNNEL, }; +/* jk: this should be moved to the beet module! */ +static struct xfrm_mode xfrm4_beet_mode = { + .input = xfrm4_beet_input, + .output = xfrm4_beet_output, + .owner = THIS_MODULE, + .encap = XFRM_MODE_BEET, +}; + static int __init xfrm4_tunnel_init(void) { + int err; + /* jk: this should be moved to the beet module! */ + err = xfrm_register_mode(&xfrm4_beet_mode, AF_INET); return xfrm_register_mode(&xfrm4_tunnel_mode, AF_INET); } @@ -114,6 +301,9 @@ { int err; + /* jk: this should be moved to the beet module! */ + err = xfrm_unregister_mode(&xfrm4_beet_mode, AF_INET); + BUG_ON(err); err = xfrm_unregister_mode(&xfrm4_tunnel_mode, AF_INET); BUG_ON(err); } diff -urN a/net/ipv4/esp4.c b/net/ipv4/esp4.c --- a/net/ipv4/esp4.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/esp4.c 2007-05-25 12:21:11.000000000 +0300 @@ -237,7 +237,8 @@ * as per draft-ietf-ipsec-udp-encaps-06, * section 3.1.2 */ - if (!x->props.mode) + if (x->props.mode == XFRM_MODE_TRANSPORT || + x->props.mode == XFRM_MODE_BEET) skb->ip_summed = CHECKSUM_UNNECESSARY; } @@ -255,17 +256,27 @@ { struct esp_data *esp = x->data; u32 blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4); + int enclen = 0; - if (x->props.mode) { - mtu = ALIGN(mtu + 2, blksize); - } else { - /* The worst case. */ + switch (x->props.mode) { + default: + case XFRM_MODE_TUNNEL: + mtu = ALIGN(mtu +2, blksize); + break; + case XFRM_MODE_TRANSPORT: + /* The worst case */ mtu = ALIGN(mtu + 2, 4) + blksize - 4; + break; + case XFRM_MODE_BEET: + /* The worst case. */ + enclen = IPV4_BEET_PHMAXLEN; + mtu = ALIGN(mtu + enclen + 2, blksize); + break; } if (esp->conf.padlen) mtu = ALIGN(mtu, esp->conf.padlen); - return mtu + x->props.header_len + esp->auth.icv_trunc_len; + return mtu + x->props.header_len + esp->auth.icv_trunc_len - enclen; } static void esp4_err(struct sk_buff *skb, u32 info) @@ -368,8 +379,10 @@ if (crypto_cipher_setkey(esp->conf.tfm, esp->conf.key, esp->conf.key_len)) goto error; x->props.header_len = sizeof(struct ip_esp_hdr) + esp->conf.ivlen; - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct iphdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; if (x->encap) { struct xfrm_encap_tmpl *encap = x->encap; diff -urN a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c --- a/net/ipv4/ipcomp.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv4/ipcomp.c 2007-05-25 12:21:11.000000000 +0300 @@ -176,7 +176,7 @@ return 0; out_ok: - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) ip_send_check(iph); return 0; } @@ -216,7 +216,7 @@ t->id.daddr.a4 = x->id.daddr.a4; memcpy(&t->sel, &x->sel, sizeof(t->sel)); t->props.family = AF_INET; - t->props.mode = 1; + t->props.mode = x->props.mode; t->props.saddr.a4 = x->props.saddr.a4; t->props.flags = x->props.flags; @@ -415,8 +415,10 @@ goto out; x->props.header_len = 0; - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct iphdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; mutex_lock(&ipcomp_resource_mutex); if (!ipcomp_alloc_scratches()) @@ -427,7 +429,7 @@ goto error; mutex_unlock(&ipcomp_resource_mutex); - if (x->props.mode) { + if (x->props.mode == XFRM_MODE_TUNNEL) { err = ipcomp_tunnel_attach(x); if (err) goto error_tunnel; diff -urN a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c --- a/net/ipv6/xfrm6_input.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/xfrm6_input.c 2007-05-25 12:21:11.000000000 +0300 @@ -13,9 +13,21 @@ #include <linux/string.h> #include <linux/netfilter.h> #include <linux/netfilter_ipv6.h> +#include <net/dsfield.h> +#include <net/inet_ecn.h> +#include <net/ip.h> #include <net/ipv6.h> #include <net/xfrm.h> +static inline void ipip6_ecn_decapsulate(struct sk_buff *skb) +{ + struct ipv6hdr *outer_iph = skb->nh.ipv6h; + struct ipv6hdr *inner_iph = skb->h.ipv6h; + + if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph))) + IP6_ECN_set_ce(inner_iph); +} + int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi) { int err; @@ -33,7 +45,6 @@ seq = 0; if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0) goto drop; - do { struct ipv6hdr *iph = skb->nh.ipv6h; @@ -44,6 +55,7 @@ if (x == NULL) goto drop; spin_lock(&x->lock); + if (unlikely(x->km.state != XFRM_STATE_VALID)) goto drop_unlock; @@ -69,16 +81,17 @@ xfrm_vec[xfrm_nr++] = x; - if (x->mode->input(x, skb)) + if (x->mode->input(x, skb)) goto drop; - - if (x->props.mode) { /* XXX */ - decaps = 1; - break; + + if (x->props.mode) { + decaps = 1; + break; } if ((err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) < 0) goto drop; + } while (!err); /* Allocate new secpath or COW existing one. */ @@ -110,6 +123,7 @@ netif_rx(skb); return -1; } else { + #ifdef CONFIG_NETFILTER skb->nh.ipv6h->payload_len = htons(skb->len); __skb_push(skb, skb->data - skb->nh.raw); diff -urN a/net/ipv6/ah6.c b/net/ipv6/ah6.c --- a/net/ipv6/ah6.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/ah6.c 2007-05-25 12:21:11.000000000 +0300 @@ -387,8 +387,10 @@ goto error; x->props.header_len = XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len); - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct ipv6hdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; x->data = ahp; return 0; diff -urN a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c --- a/net/ipv6/xfrm6_policy.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/xfrm6_policy.c 2007-05-25 12:21:11.000000000 +0300 @@ -22,6 +22,8 @@ static struct dst_ops xfrm6_dst_ops; static struct xfrm_policy_afinfo xfrm6_policy_afinfo; +static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu); + static int xfrm6_dst_lookup(struct xfrm_dst **dst, struct flowi *fl) { int err = 0; @@ -70,16 +72,19 @@ struct dst_entry *dst, *dst_prev; struct rt6_info *rt0 = (struct rt6_info*)(*dst_p); struct rt6_info *rt = rt0; - struct in6_addr *remote = &fl->fl6_dst; - struct in6_addr *local = &fl->fl6_src; struct flowi fl_tunnel = { .nl_u = { .ip6_u = { - .saddr = *local, - .daddr = *remote + .saddr = fl->fl6_src, + .daddr = fl->fl6_dst } } }; + union { + struct in6_addr *in6; + struct in_addr *in; + } remote, local; + unsigned short outer_family = 0, beet = 0; int i; int err = 0; int header_len = 0; @@ -91,7 +96,6 @@ for (i = 0; i < nx; i++) { struct dst_entry *dst1 = dst_alloc(&xfrm6_dst_ops); struct xfrm_dst *xdst; - int tunnel = 0; if (unlikely(dst1 == NULL)) { err = -ENOBUFS; @@ -114,19 +118,39 @@ dst1->next = dst_prev; dst_prev = dst1; - if (xfrm[i]->props.mode) { - remote = (struct in6_addr*)&xfrm[i]->id.daddr; - local = (struct in6_addr*)&xfrm[i]->props.saddr; - tunnel = 1; + if (xfrm[i]->props.mode == XFRM_MODE_TUNNEL || xfrm[i]->props.mode == XFRM_MODE_BEET) { + outer_family = xfrm[i]->props.family; + beet = (xfrm[i]->props.mode == XFRM_MODE_BEET); + if (outer_family == AF_INET6) { + remote.in6 = (struct in6_addr*)&xfrm[i]->id.daddr; + local.in6 = (struct in6_addr*)&xfrm[i]->props.saddr; + } else if(outer_family == AF_INET){ + remote.in = (struct in_addr*)&xfrm[i]->id.daddr; + local.in = (struct in_addr*)&xfrm[i]->props.saddr; + } } header_len += xfrm[i]->props.header_len; trailer_len += xfrm[i]->props.trailer_len; - if (tunnel) { - ipv6_addr_copy(&fl_tunnel.fl6_dst, remote); - ipv6_addr_copy(&fl_tunnel.fl6_src, local); + if (outer_family) { + switch(outer_family) { + case AF_INET: + fl_tunnel.fl4_dst = remote.in->s_addr; + fl_tunnel.fl4_src = local.in->s_addr; + + fl_tunnel.fl4_tos = 0; + fl_tunnel.fl4_fwmark = 0; + fl_tunnel.fl4_scope = 0; + break; + case AF_INET6: + ipv6_addr_copy(&fl_tunnel.fl6_dst, remote.in6); + ipv6_addr_copy(&fl_tunnel.fl6_src, local.in6); + break; + default: + BUG_ON(1); + } err = xfrm_dst_lookup((struct xfrm_dst **) &rt, - &fl_tunnel, AF_INET6); + &fl_tunnel, outer_family); if (err) goto error; } else @@ -177,6 +201,11 @@ } xfrm_init_pmtu(dst); + if (beet && outer_family == AF_INET) { + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + u32 mtu = dst_mtu(dst); + xfrm6_update_pmtu(dst, mtu + delta); + } return 0; error: diff -urN a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c --- a/net/ipv6/xfrm6_output.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/xfrm6_output.c 2007-05-25 12:21:11.000000000 +0300 @@ -14,8 +14,11 @@ #include <linux/spinlock.h> #include <linux/icmpv6.h> #include <linux/netfilter_ipv6.h> +#include <net/dsfield.h> +#include <net/inet_ecn.h> #include <net/ipv6.h> #include <net/xfrm.h> +#include <net/ip.h> static int xfrm6_tunnel_check_size(struct sk_buff *skb) { @@ -47,7 +50,7 @@ goto error_nolock; } - if (x->props.mode) { + if (x->props.mode == XFRM_MODE_TUNNEL) { err = xfrm6_tunnel_check_size(skb); if (err) goto error_nolock; @@ -59,7 +62,7 @@ if (err) goto error; - err = x->mode->output(skb); + err = x->mode->output(skb); if (err) goto error; diff -urN a/net/ipv6/udp.c b/net/ipv6/udp.c --- a/net/ipv6/udp.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/udp.c 2007-05-25 12:21:11.000000000 +0300 @@ -788,7 +788,7 @@ if (final_p) ipv6_addr_copy(&fl->fl6_dst, final_p); - if ((err = xfrm_lookup(&dst, fl, sk, 0)) < 0) + if ((err = xfrm_lookup(&dst, fl, sk, XFRM_LOOKUP_SLEEP)) < 0) goto out; if (hlimit < 0) { diff -urN a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c --- a/net/ipv6/tcp_ipv6.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/tcp_ipv6.c 2007-05-25 12:21:11.000000000 +0300 @@ -257,7 +257,7 @@ if (final_p) ipv6_addr_copy(&fl.fl6_dst, final_p); - if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) + if ((err = xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_SLEEP)) < 0) goto failure; if (saddr == NULL) { diff -urN a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c --- a/net/ipv6/af_inet6.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/af_inet6.c 2007-05-25 12:21:11.000000000 +0300 @@ -939,4 +939,8 @@ } module_exit(inet6_exit); +EXPORT_SYMBOL(inet6_create); +EXPORT_SYMBOL(inet6_stream_ops); +EXPORT_SYMBOL(inet6_dgram_ops); + MODULE_ALIAS_NETPROTO(PF_INET6); diff -urN a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c --- a/net/ipv6/xfrm6_mode_tunnel.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/xfrm6_mode_tunnel.c 2007-05-25 12:21:11.000000000 +0300 @@ -15,6 +15,7 @@ #include <net/inet_ecn.h> #include <net/ipv6.h> #include <net/xfrm.h> +#include <net/ip.h> static inline void ipip6_ecn_decapsulate(struct sk_buff *skb) { @@ -95,6 +96,209 @@ return err; } + +/* jk: move this to beet module! */ +static int xfrm6_beet_output(struct sk_buff *skb) +{ + struct dst_entry *dst = skb->dst; + struct xfrm_state *x = dst->xfrm; + int hdrlen; + struct iphdr *iphv4, *top_iphv4; + struct ipv6hdr *iphv6, *top_iphv6; + + if (skb->nh.iph->version == 6) { + + u8 *prevhdr; + int hdr_len; + + /* 6-6 */ + + hdrlen = x->props.header_len - IPV4_BEET_PHMAXLEN; + skb_push(skb, hdrlen); + iphv6 = skb->nh.ipv6h; + + hdr_len = ip6_find_1stfragopt(skb, &prevhdr); + skb->nh.raw = prevhdr - hdrlen; + skb->h.raw = skb->data + hdr_len; + memmove(skb->data, iphv6, hdr_len); + + skb->nh.raw = skb->data; + top_iphv6 = skb->nh.ipv6h; + skb->nh.raw = &top_iphv6->nexthdr; + skb->h.ipv6h = top_iphv6 + 1; + ipv6_addr_copy(&top_iphv6->saddr, (struct in6_addr *)&x->props.saddr); + ipv6_addr_copy(&top_iphv6->daddr, (struct in6_addr *)&x->id.daddr); + + } else if (skb->nh.iph->version == 4) { + + int flags; + int optlen; + int dsfield; + u8 protocol; + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + + /* Inner = 4, Outer = 6*/ + + iphv4 = skb->nh.iph; + skb->h.ipiph = iphv4; + + hdrlen = x->props.header_len; + + optlen = iphv4->ihl * 4 - sizeof(*iphv4); + if (!optlen) { + hdrlen -= IPV4_BEET_PHMAXLEN; + } else { + skb->h.raw -= (IPV4_BEET_PHMAXLEN - (optlen & 4)); + hdrlen -= optlen & 4; + } + + skb->nh.raw = skb_push(skb, hdrlen); + top_iphv4 = skb->nh.iph; + + hdrlen = iphv4->ihl * 4 - optlen; + skb->h.raw += hdrlen; + + if (unlikely(optlen)) { + struct ip_beet_phdr *ph; + + BUG_ON(optlen < 0); + + ph = (struct ip_beet_phdr *)skb->h.raw; + ph->padlen = 4 - (optlen & 4); + ph->hdrlen = (optlen + ph->padlen + sizeof(*ph)) / 8; + ph->nexthdr = iphv4->protocol; + top_iphv4->protocol = IPPROTO_BEETPH; + top_iphv4->ihl = sizeof(struct iphdr) / 4; + } + + protocol = top_iphv4->protocol; + + if (unlikely(optlen)) + protocol = top_iphv4->protocol; + else + protocol = iphv4->protocol; + + if (skb_headroom(skb) <= 2*delta){ + if (pskb_expand_head(skb, delta,0, GFP_ATOMIC)) + return 0; + } + + skb->nh.raw = skb_push(skb, delta); + + top_iphv6 = skb->nh.ipv6h; + skb->h.ipv6h = top_iphv6 + 1; + /* DS disclosed */ + top_iphv6->version = 6; + top_iphv6->priority = 0; + top_iphv6->flow_lbl[0] = 0; + top_iphv6->flow_lbl[1] = 0; + top_iphv6->flow_lbl[2] = 0; + dsfield = ipv6_get_dsfield(top_iphv6); + dsfield = INET_ECN_encapsulate(dsfield, dsfield); + flags = x->props.flags; + if (flags & XFRM_STATE_NOECN) + dsfield &= ~INET_ECN_MASK; + ipv6_change_dsfield(top_iphv6, 0, dsfield); + + top_iphv6->nexthdr = protocol; + top_iphv6->hop_limit = dst_metric(dst->child, RTAX_HOPLIMIT); + top_iphv6->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + ipv6_addr_copy(&top_iphv6->saddr,(struct in6_addr *)&x->props.saddr); + ipv6_addr_copy(&top_iphv6->daddr, (struct in6_addr *)&x->id.daddr); + skb->nh.raw = &top_iphv6->nexthdr; + + } else + BUG_ON(1); + + return 0; +} + + + +/* jk: move this to beet module! */ +static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb) +{ + struct ip_beet_phdr *ph = (struct ip_beet_phdr*)(skb->h.raw); + int size = (x->sel.family == AF_INET) ? sizeof(struct iphdr) : sizeof(struct ipv6hdr); + int delta = sizeof(struct ipv6hdr) - sizeof(struct iphdr); + __u8 proto = skb->nh.ipv6h->nexthdr, hops = skb->nh.ipv6h->hop_limit; + __u8 ph_nexthdr = 0; + int phlen = 0; + int optlen = 0; + int err = -EINVAL; + + if (x->sel.family == AF_INET) { + /* Inner = IPv4, therefore the IPhdr must be shrunk */ + /* Inner = 4, Outer = 6 */ + if (unlikely(proto == IPPROTO_BEETPH)) { + if (!pskb_may_pull(skb, sizeof(*ph))) + goto out; + phlen = ph->hdrlen * 8; + optlen = phlen - ph->padlen - sizeof(*ph); + + if (optlen < 0 || optlen & 3 || optlen > 250) + goto out; + if (!pskb_may_pull(skb, phlen)) + goto out; + + proto = ph_nexthdr = ph->nexthdr; + } + skb->nh.raw += delta; + } + + if (skb_cloned(skb) && + pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) + goto out; + + skb_push(skb, size); + memmove(skb->data, skb->nh.raw, size); + skb->nh.raw = skb->data; + + skb->mac.raw = memmove(skb->data - skb->mac_len, + skb->mac.raw, skb->mac_len); + if (unlikely(phlen)) { + skb_pull(skb, phlen - optlen); + skb->nh.raw = skb->data; + } + + if (x->sel.family == AF_INET6) { + struct ipv6hdr *ip6h = skb->nh.ipv6h; + + ip6h->payload_len = htons(skb->len - size); + ipv6_addr_copy(&ip6h->daddr, (struct in6_addr *) &x->sel.daddr.a6); + ipv6_addr_copy(&ip6h->saddr, (struct in6_addr *) &x->sel.saddr.a6); + + } else if (x->sel.family == AF_INET) { + + struct iphdr *iph = skb->nh.iph; + + iph->ihl = (sizeof(*iph) + optlen) / 4; + iph->version = 4; + iph->tos = 0; + iph->id = 0; + iph->frag_off = 0; + iph->ttl = hops; + iph->protocol = proto; + iph->daddr = x->sel.daddr.a4; + iph->saddr = x->sel.saddr.a4; + iph->tot_len = htons(skb->len); + ip_send_check(iph); + skb->protocol = htons(ETH_P_IP); + if (unlikely(!optlen)) { + skb->h.raw = skb->nh.raw; + } + dst_release(skb->dst); + skb->dst = NULL; + } else + BUG_ON(1); + + err = 0; + + out: + return err; +} + + static struct xfrm_mode xfrm6_tunnel_mode = { .input = xfrm6_tunnel_input, .output = xfrm6_tunnel_output, @@ -102,8 +306,20 @@ .encap = XFRM_MODE_TUNNEL, }; +/* jk: move this to beet module! */ +static struct xfrm_mode xfrm6_beet_mode = { + .input = xfrm6_beet_input, + .output = xfrm6_beet_output, + .owner = THIS_MODULE, + .encap = XFRM_MODE_BEET, +}; + static int __init xfrm6_tunnel_init(void) { + + /* jk: move this to beet module! */ + xfrm_register_mode(&xfrm6_beet_mode, AF_INET6); + return xfrm_register_mode(&xfrm6_tunnel_mode, AF_INET6); } @@ -111,6 +327,9 @@ { int err; + /* jk: move this to beet module! */ + err = xfrm_unregister_mode(&xfrm6_beet_mode, AF_INET6); + err = xfrm_unregister_mode(&xfrm6_tunnel_mode, AF_INET6); BUG_ON(err); } diff -urN a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c --- a/net/ipv6/ipcomp6.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/ipcomp6.c 2007-05-25 12:21:11.000000000 +0300 @@ -416,8 +416,10 @@ goto out; x->props.header_len = 0; - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct ipv6hdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; mutex_lock(&ipcomp6_resource_mutex); if (!ipcomp6_alloc_scratches()) @@ -428,7 +430,7 @@ goto error; mutex_unlock(&ipcomp6_resource_mutex); - if (x->props.mode) { + if (x->props.mode == XFRM_MODE_TUNNEL) { err = ipcomp6_tunnel_attach(x); if (err) goto error_tunnel; diff -urN a/net/ipv6/esp6.c b/net/ipv6/esp6.c --- a/net/ipv6/esp6.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/esp6.c 2007-05-25 12:21:11.000000000 +0300 @@ -344,8 +344,10 @@ if (crypto_cipher_setkey(esp->conf.tfm, esp->conf.key, esp->conf.key_len)) goto error; x->props.header_len = sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen; - if (x->props.mode) + if (x->props.mode == XFRM_MODE_TUNNEL) x->props.header_len += sizeof(struct ipv6hdr); + else if (x->props.mode == XFRM_MODE_BEET) + x->props.header_len += IPV4_BEET_PHMAXLEN; x->data = esp; return 0; diff -urN a/net/ipv6/icmp.c b/net/ipv6/icmp.c --- a/net/ipv6/icmp.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/ipv6/icmp.c 2007-05-25 12:21:11.000000000 +0300 @@ -64,6 +64,7 @@ #include <net/ip6_route.h> #include <net/addrconf.h> #include <net/icmp.h> +#include <linux/xfrm.h> #include <asm/uaccess.h> #include <asm/system.h> @@ -389,7 +390,7 @@ goto out_dst_release; } - if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) + if ((err = xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_SLEEP)) < 0) goto out; if (ipv6_addr_is_multicast(&fl.fl6_dst)) diff -urN a/net/key/af_key.c b/net/key/af_key.c --- a/net/key/af_key.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/key/af_key.c 2007-05-25 12:21:11.000000000 +0300 @@ -1166,7 +1166,8 @@ /* Nobody uses this, but we try. */ x->sel.family = pfkey_sadb_addr2xfrm_addr(addr, &x->sel.saddr); x->sel.prefixlen_s = addr->sadb_address_prefixlen; - } + } else + x->sel.family = x->props.family; /* Conservative */ if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) { struct sadb_x_nat_t_type* n_type; @@ -1763,14 +1764,13 @@ if (!t->reqid && !(t->reqid = gen_reqid())) return -ENOBUFS; } - - /* addresses present only in tunnel mode */ - if (t->mode) { - switch (xp->family) { +/* addresses present in any mode */ + { + struct sockaddr *sa; + sa = (struct sockaddr *)(rq+1); + switch(sa->sa_family) { case AF_INET: - sin = (void*)(rq+1); - if (sin->sin_family != AF_INET) - return -EINVAL; + sin = (struct sockaddr_in *)sa; t->saddr.a4 = sin->sin_addr.s_addr; sin++; if (sin->sin_family != AF_INET) @@ -1779,9 +1779,7 @@ break; #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) case AF_INET6: - sin6 = (void *)(rq+1); - if (sin6->sin6_family != AF_INET6) - return -EINVAL; + sin6 = (struct sockaddr_in6 *)sa; memcpy(t->saddr.a6, &sin6->sin6_addr, sizeof(struct in6_addr)); sin6++; if (sin6->sin6_family != AF_INET6) @@ -1792,6 +1790,7 @@ default: return -EINVAL; } + t->outer_family = sa->sa_family; } /* No way to set this via kame pfkey */ t->aalgos = t->ealgos = t->calgos = ~0; diff -urN a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c --- a/net/xfrm/xfrm_user.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/xfrm/xfrm_user.c 2007-05-25 12:21:11.000000000 +0300 @@ -173,8 +173,9 @@ err = -EINVAL; switch (p->mode) { - case 0: - case 1: + case XFRM_MODE_TRANSPORT: + case XFRM_MODE_TUNNEL: + case XFRM_MODE_BEET: break; default: @@ -763,6 +764,7 @@ t->aalgos = ut->aalgos; t->ealgos = ut->ealgos; t->calgos = ut->calgos; + t->outer_family = ut->family; } } diff -urN a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c --- a/net/xfrm/xfrm_policy.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/xfrm/xfrm_policy.c 2007-05-25 12:21:11.000000000 +0300 @@ -782,6 +782,7 @@ if (tmpl->mode) { remote = &tmpl->id.daddr; local = &tmpl->saddr; + family = tmpl->outer_family; } x = xfrm_state_find(remote, local, fl, tmpl, policy, &error, family); diff -urN a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c --- a/net/xfrm/xfrm_state.c 2007-05-25 12:21:11.000000000 +0300 +++ b/net/xfrm/xfrm_state.c 2007-05-25 12:21:11.000000000 +0300 @@ -366,7 +366,7 @@ selector. */ if (x->km.state == XFRM_STATE_VALID) { - if (!xfrm_selector_match(&x->sel, fl, family) || + if (!xfrm_selector_match(&x->sel, fl, x->sel.family) || !xfrm_sec_ctx_match(pol->security, x->security)) continue; if (!best || @@ -378,7 +378,7 @@ acquire_in_progress = 1; } else if (x->km.state == XFRM_STATE_ERROR || x->km.state == XFRM_STATE_EXPIRED) { - if (xfrm_selector_match(&x->sel, fl, family) && + if (xfrm_selector_match(&x->sel, fl, x->sel.family) && xfrm_sec_ctx_match(pol->security, x->security)) error = -ESRCH; } diff -urN a/include/net/xfrm.h b/include/net/xfrm.h --- a/include/net/xfrm.h 2007-05-25 12:21:11.000000000 +0300 +++ b/include/net/xfrm.h 2007-05-25 12:21:11.000000000 +0300 @@ -226,7 +226,7 @@ extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo); extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c); extern void km_state_notify(struct xfrm_state *x, struct km_event *c); -#define XFRM_ACQ_EXPIRES 30 +#define XFRM_ACQ_EXPIRES 3 struct xfrm_tmpl; extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol); @@ -297,6 +297,10 @@ /* Source address of tunnel. Ignored, if it is not a tunnel. */ xfrm_address_t saddr; +/* family of the outer addresses. The family may differ from + the one in selector */ + unsigned short outer_family; + __u32 reqid; /* Mode: transport/tunnel */ diff -urN a/include/linux/xfrm.h b/include/linux/xfrm.h --- a/include/linux/xfrm.h 2007-05-25 12:21:11.000000000 +0300 +++ b/include/linux/xfrm.h 2007-05-25 12:21:11.000000000 +0300 @@ -43,6 +43,12 @@ #define XFRM_SC_ALG_RESERVED 0 #define XFRM_SC_ALG_SELINUX 1 +/* Transport layer flag passed to xfrm_lookup. If set, the userspace + process sleeps in a waitqueue until key management daemon has + finished setting up security associations. This workaround exists + until we have queues for outgoing IPsec packets. */ +#define XFRM_LOOKUP_SLEEP (!in_atomic() && !in_softirq()) + /* Selector, used as selector both on policy rules (SPD) and SAs. */ struct xfrm_selector @@ -118,9 +124,13 @@ XFRM_SHARE_UNIQUE /* Use once */ }; -#define XFRM_MODE_TRANSPORT 0 -#define XFRM_MODE_TUNNEL 1 -#define XFRM_MODE_MAX 2 +enum +{ + XFRM_MODE_TRANSPORT = 0, + XFRM_MODE_TUNNEL, + XFRM_MODE_BEET, + XFRM_MODE_MAX +}; /* Netlink configuration messages. */ enum { diff -urN a/include/linux/ipsec.h b/include/linux/ipsec.h --- a/include/linux/ipsec.h 2007-05-25 12:21:12.000000000 +0300 +++ b/include/linux/ipsec.h 2007-05-25 12:21:12.000000000 +0300 @@ -12,7 +12,8 @@ enum { IPSEC_MODE_ANY = 0, /* We do not support this for SA */ IPSEC_MODE_TRANSPORT = 1, - IPSEC_MODE_TUNNEL = 2 + IPSEC_MODE_TUNNEL = 2, + IPSEC_MODE_BEET = 3 }; enum { diff -urN a/include/linux/net.h b/include/linux/net.h --- a/include/linux/net.h 2007-05-25 12:21:12.000000000 +0300 +++ b/include/linux/net.h 2007-05-25 12:21:12.000000000 +0300 @@ -24,7 +24,7 @@ struct poll_table_struct; struct inode; -#define NPROTO 32 /* should be enough for now.. */ +#define NPROTO 33 /* should be enough for now.. */ #define SYS_SOCKET 1 /* sys_socket(2) */ #define SYS_BIND 2 /* sys_bind(2) */ diff -urN a/include/linux/in.h b/include/linux/in.h --- a/include/linux/in.h 2007-05-25 12:21:12.000000000 +0300 +++ b/include/linux/in.h 2007-05-25 12:21:12.000000000 +0300 @@ -40,6 +40,7 @@ IPPROTO_ESP = 50, /* Encapsulation Security Payload protocol */ IPPROTO_AH = 51, /* Authentication Header protocol */ + IPPROTO_BEETPH = 94, /* IP option pseudo header for BEET */ IPPROTO_PIM = 103, /* Protocol Independent Multicast */ IPPROTO_COMP = 108, /* Compression Header protocol */ diff -urN a/include/linux/ip.h b/include/linux/ip.h --- a/include/linux/ip.h 2007-05-25 12:21:12.000000000 +0300 +++ b/include/linux/ip.h 2007-05-25 12:21:12.000000000 +0300 @@ -79,6 +79,8 @@ #define IPOPT_TS_TSANDADDR 1 /* timestamps and addresses */ #define IPOPT_TS_PRESPEC 3 /* specified modules only */ +#define IPV4_BEET_PHMAXLEN 8 + struct iphdr { #if defined(__LITTLE_ENDIAN_BITFIELD) __u8 ihl:4, @@ -122,4 +124,11 @@ __u16 cpi; }; +struct ip_beet_phdr { + __u8 nexthdr; + __u8 hdrlen; + __u8 padlen; + __u8 reserved; +}; + #endif /* _LINUX_IP_H */

3 4

shutdown and boot on Xen
by Sergio Belkin 12 Sep '08

12 Sep '08

Hi, I am using xen-3.0.3-41.el5 on Centos 5 with 2.6.18-53.1.21.el5xen kernel. I'd like to: 1) When Dom0 shutdown, DomU's do the same. 2) When Dom0 boots. DomU's do the same. Is that possible? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 1

gv
by Terry Polzin 12 Sep '08

12 Sep '08

Where can I find gv for centos 5.x

2 1

yum erase fails
by Robert Moskowitz 12 Sep '08

12 Sep '08

I am trying to erase an rpm with yum erase. It fails: service hipfw does not support chkconfig Removed: hipl-firewall.i386 0:1.0.4.1 Complete! And it is not removed.... If I try with rpm -e, I get the same error message. So how do I remove this rpm?

4 5

CentOS-announce Digest, Vol 43, Issue 3
by centos-announce-request＠centos.org 12 Sep '08

12 Sep '08

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2008:0884 Important CentOS 3 i386 libxml2 - security update (Tru Huynh) 2. CESA-2008:0884 Important CentOS 3 x86_64 libxml2 - security update (Tru Huynh) 3. CESA-2008:0886-01: Important CentOS 2 i386 libxml2 security update (John Newbigin) ---------------------------------------------------------------------- Message: 1 Date: Thu, 11 Sep 2008 22:48:40 +0200 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2008:0884 Important CentOS 3 i386 libxml2 - security update To: centos-announce(a)centos.org Message-ID: <20080911204840.GA30448(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2008:0884 libxml2 security update for CentOS 3 i386: https://rhn.redhat.com/errata/RHSA-2008-0884.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/libxml2-2.5.10-13.i386.rpm updates/i386/RPMS/libxml2-devel-2.5.10-13.i386.rpm updates/i386/RPMS/libxml2-python-2.5.10-13.i386.rpm source: updates/SRPMS/libxml2-2.5.10-13.src.rpm You may update your CentOS-3 i386 installations by running the command: yum update libxml2 Tru -- Tru Huynh (mirrors, CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

CentOS 5 on an MSI Wind U100 Netbook && RTL8187 wireless card configuration
by Niki Kovacs 12 Sep '08

12 Sep '08

Hi, I recently purchased an MSI Wind Netbook, just slightly bigger than an EeePC, and IMHO just one step above the mere toy category. It's got a 10" monitor, 80 GB SATA HD, and the keyboard is just big enough so I can type with ten fingers (with a little exercise). The thing came preinstalled with Windows XP, and I've spent the last two days figuring out how I could possibly install my favourite OS on it. Among the many hairy details: 1) there's no CDROM nor floppy, only USB, and 2) the NIC is an RTL8101, not handled by the install kernel (nor the normal CentOS kernel). There were several Catch22's, but here's how I went about it. I published my detailed install notes (in French, but the Linux bits are universal :oD), since it seems to be a quite popular bit of hardware: http://www.microlinux.fr/article.php3?id_article=47 There's one exception though: the wireless card is a Realtek RTL8187 (which lspci lists as RTL8199 Unknown device). I must have tried about ten different drivers out there, none of them worked (MSI only published precompiled kernel modules for SuSE Linux Enterprise 10, go figure). The ndiswrapper solution didn't work either: the Windows driver loaded OK, but no signal. I tried the dkms-rtl818x driver from RPMForge, but to no avail. Any suggestions on this piece of hardware? Cheers, Niki

1 0

cfengine and crontab
by Ric Moore 12 Sep '08

12 Sep '08

The docs to installing cfengine refers to /var/spool/cron/crontabs/root That doesn't exist. Nor does /etc/crontab. Heck I remember that from the "old days", now there are lots of cron entries, in /etc but no crontab. Not installed by default. So, I'm hunting that one down. Nate, what did you wind up doing?? Ric -- ---------------------------------------------------- My father, Victor Moore (Vic) used to say: "There are two Great Sins in the world... ..the Sin of Ignorance, and the Sin of Stupidity. Only the former may be overcome." R.I.P. Dad. Linux user# 44256 Sign up at: http://counter.li.org/ https://nuoar.dev.java.net/ Verizon Cell # 336-254-1339

5 10

My turn at building a custom kernel for IPsec BEET mode
by Robert Moskowitz 12 Sep '08

12 Sep '08

Well I am working on building a kernel that will have the IPsec BEET mode patch available from infrahip.hiit.fi. I have some decent help, but really no one there is a seasoned Centos kernel builder (though they work with different FC kernels), and now they are mostly done for the day. I have been following the wiki on building a custom kernel, got my patch in ~/rpmbuild/SOURCES and away with the rpmbuild. That failed on line 69: Unknown tag: % define buildid .hipl0809111 But the comments say to set the define to something like ".local" or ".bz123456" So why the failure? Too long our are the quotes required? If this works, I would like to see this patch 'mainstreamed' as it is in the 2.6.27 kernel....

4 5

Alarming (?) smartd reports
by MHR 11 Sep '08

11 Sep '08

I decided, after the last discussion of smartd and S.M.A.R.T. disks, to take a look in my /var/log/messages, and I'm seeing fair bit of this: Sep 10 20:11:23 mhrichter smartd[3361]: Device: /dev/sda, 4294967295 Offline uncorrectable sectors Sep 10 20:41:23 mhrichter smartd[3361]: Device: /dev/hdb, 21 Currently unreadable (pending) sectors Sep 10 20:41:24 mhrichter smartd[3361]: Device: /dev/sda, 4294967295 Currently unreadable (pending) sectors Sep 10 20:41:24 mhrichter smartd[3361]: Device: /dev/sda, 4294967295 Offline uncorrectable sectors Sep 10 21:11:23 mhrichter smartd[3361]: Device: /dev/hdb, 21 Currently unreadable (pending) sectors Sep 10 21:11:23 mhrichter smartd[3361]: Device: /dev/sda, 4294967295 Currently unreadable (pending) sectors Sep 10 21:11:23 mhrichter smartd[3361]: Device: /dev/sda, 4294967295 Offline uncorrectable sectors Clearly there is a minor problem on /dev/hdb, which doesn't really surprise me, nor is it particularly worrisome (because I don't use that drive much). However, the other one I find more than a little curious. /dev/sda is a Seagate 300GB SATA drive that's coming up on two years old next month, but the number of "Currently unreadable (pending) sectors" or "Offline uncorrectable sectors," depending on which one you believe, is interesting - 4294967295 is FFFFFFFF in hex, and I'm running a 64-bit machine. Google is not particularly informative on this subject - anyone know more than general suggestions about dd, badblocks, etc.? This is my boot and primary system disk (has been for some time), but the error message is essentially meaningless (to me, right now). Thanks. mhr PS: In the last couple of months there was a discussion of how to make the disk less active, starting with someone reporting that their disk drive activity light blinked every 30 seconds or something like that. I tried to find it again, but I couldn't pin down what to search for - what was the solution?

10 16

Thin client
by lingu 11 Sep '08

11 Sep '08

Dear all, I am very much new to Linux Thin Client Concept. But know i am very much interested to create Centos 5 based thin client of 512MB on flash rom. Can any one guide me to how to start and if you provide any suitable links that will be very much great full. Regards. Lingu

4 3

Logwatch / spamassassin
by Bob Hoffman 11 Sep '08

11 Sep '08

Hi all, Well it took a while for me to figure it out, but apparently my logwatch no longer can be mailed locally on my computer as I believe spamassassin is eating it. I can send it out to an email address outside my server though. So spamassassin is only checking incoming I guess. My question is....how do I...or should I.... Make all local mail go straight to the boxes and skip spamasassin entirely.. Or.. Whitelist logwatch. Apparently, I am guessing, all those nifty log reports are so full of blacklisted urls and ips...well, you get the picure. Best ways to make this work so I can get it delivered to root again? Thanks

4 4

RE: Logwatch / spamassassin
by Bob Hoffman 11 Sep '08

11 Sep '08

So.. To answer my own question... so I edited the file /etc/mail/spamassassin/local.cf whitelist_from logwatch(a)localhost.localdomain Where localhost.localdomain is your hostname.servername And it worked. However, I am concerned about spoofing. I would think that mail agent and spamassassin would have an 'okay, it's a local user' thing going on. They do not. On the internet there are 1000s of posts like mine, asking questions about this and getting no answers. I hope this helps. Centos 5.2... -----Original Message----- From: Bob Hoffman [mailto:bob@bobhoffman.com] Sent: Thursday, September 11, 2008 4:54 AM To: 'centos(a)centos.org' Subject: Logwatch / spamassassin Hi all, Well it took a while for me to figure it out, but apparently my logwatch no longer can be mailed locally on my computer as I believe spamassassin is eating it. I can send it out to an email address outside my server though. So spamassassin is only checking incoming I guess. My question is....how do I...or should I.... Make all local mail go straight to the boxes and skip spamasassin entirely.. Or.. Whitelist logwatch. Apparently, I am guessing, all those nifty log reports are so full of blacklisted urls and ips...well, you get the picure. Best ways to make this work so I can get it delivered to root again? Thanks

3 2

RE: Logwatch / spamassassin
by Bob Hoffman 11 Sep '08

11 Sep '08

Ned, Thanks for the letters. Yes, I added the whitelist, but think that is not right either. No matter what I add in there, it will allow someone to use it and come in. The postmaster not getting tagged is just as scary actually. The weird part is the mail will go to another server via smtp and not be tagged as SPAM. How strange is that. I can only assume I should be changing something in the logwatch file to make it not be from 'logwatch' but to instead be 'root' or some other local user. Since logwatch has no local user in my mail setups...maybe that is the problem. So it might be that matter that makes it get killed by procmail or by spamassassin. Strange. But a very obvious problem across the net. I will work on this more tonight and see if I can get it to run better without whitelisting.

1 0

RE: [CentOS] /etc/rc5.d
by Bowie Bailey 11 Sep '08

11 Sep '08

tony.chamberlain(a)lemko.com wrote: > > start() { > date >> /root/joe.log > /usr/bin/joevpn start & > RES=$? > return $RES > } > > This all works and everything. I am just curious as to why when I do > a ps I get this: > /bin/bash /etc/rc5.d/S99runjoevpn > > Shouldn't that init script terminate since I have an "&" when I do the > start() function above? No other rc5 stuff (i.e. tomcat for instance) > shows up in the ps, though tomcat is running, it started up and > returned. Is this OK or am I missing something? The "&" doesn't terminate anything. It simply moves the process to the background and leaves it attached to the parent process. The parent process cannot exit until all of its child processes exit. What you are looking for is this: start() { date >> /root/joe.log nohup /usr/bin/joevpn start & RES=$? return $RES } The "nohup" command will detach the joevpn process from the parent and allow the parent process to exit. -- Bowie

1 0

RE: [CentOS] RE: Logwatch / spamassassin
by Bowie Bailey 11 Sep '08

11 Sep '08

Bob Hoffman wrote: > So.. > > To answer my own question... > > so I edited the file /etc/mail/spamassassin/local.cf > > whitelist_from logwatch(a)localhost.localdomain > > Where localhost.localdomain is your hostname.servername > > And it worked. > > However, I am concerned about spoofing. I would think that mail agent > and spamassassin would have an 'okay, it's a local user' thing going > on. Generally, using 'whitelist_from' is a bad idea due to spoofing. The address you are using will probably not cause too many problems, but you should still fix it if possible. Use 'whitelist_from_rcvd' instead. This will whitelist the address only if the mail comes from a specified domain. Try this (untested): whitelist_from_rcvd logwatch(a)localhost.localdomain localhost.localdomain Note that this will require your DNS server to resolve localhost.localdomain (forward and reverse). Another option is to configure your mail server to bypass SA entirely for local mail. -- Bowie

1 0

/etc/rc5.d
by tony.chamberlain＠lemko.com 11 Sep '08

11 Sep '08

I have a shell script, /usr/bin/joevpn, which does a quick VPN connect. Basically (HOST and DOFIL are defined above and are correct. I just did not list them here) case "$1" in start) date > $DOFIL while [ -f $DOFIL ] do echo y | /usr/local/bin/vpnclient connect $HOST sleep 10 done ;; # Reconnects in case of disconnect (in while loop) This works. And in /etc/init.d I have a runjoevpn (which linked to /etc/rc5.d/S99runjoevpn). It works like the others. Below, $1 is checked (not shown here for brevity) and if it is "start" then start below is called: start() { date >> /root/joe.log /usr/bin/joevpn start & RES=$? return $RES } This all works and everything. I am just curious as to why when I do a ps I get this: /bin/bash /etc/rc5.d/S99runjoevpn Shouldn't that init script terminate since I have an "&" when I do the start() function above? No other rc5 stuff (i.e. tomcat for instance) shows up in the ps, though tomcat is running, it started up and returned. Is this OK or am I missing something?

2 1

Job Scheduling suggestions
by Mag Gam 11 Sep '08

11 Sep '08

At my university we have 50 computers in the lab. We would like to use a scheduler to schedule our fluid models, and I was wondering what is a good suggestion? TIA

4 4

Centos 4.7 delay more than mirror issue?
by Josh Donovan 11 Sep '08

11 Sep '08

Hi folks, Normally people ask "when is CentOS 4.7 coming" and they are told "when it is ready". Dag posted on his blog about it going to testing in July while it was supposed to be syncing to the mirrors on Sept 5/6th according to Karanbir. Is there something going on behind the scenes? I have not seen Johnny Hughes or even Dag posting on this list for some time. CentOS has gone for some time while other rebuilds folded so I wouldn't like it to follow the same way. Thanks, Josh

5 4

PCI SATA Controller Recommendations?
by Tim Nelson 10 Sep '08

10 Sep '08

Hello fellow listers... I'd like to get some recommendations on a good SATA controller for use with CentOS 5.x. It should be PCI, bootable, have 4 SATA ports, have native support (no crap proprietary or manually compiled drivers), and possibly hot swap support. Any ideas? There are plenty of PCI-X and PCIe controllers that I think would work but the use for this card is in a smaller 1U server that is quite cramped, hence the query for a standard PCI card. All suggestions and comments welcome. Thank you! Tim Nelson Systems/Network Engineer Rockbochs Inc. (218)727-4332 x105

4 3

Centos 5 Virtualization
by lingu 10 Sep '08

10 Sep '08

Hello list, I am very much new to Virtualization.But i want to study and test Virtualization.Can any one suggest me the web links from where i can start. I want to learn from basic to advanced concepts of VT. Thanks in advance for your reply

6 7

open(/dev/pts/0): No such file or directory
by Ric Moore 10 Sep '08

10 Sep '08

I'm getting this error just recently. Is this something to be concerned with?? Running CentOS 5.2. Kernel 2.6.18-53.el5 Thanks for any considerations, Ric -- ---------------------------------------------------- My father, Victor Moore (Vic) used to say: "There are two Great Sins in the world... ..the Sin of Ignorance, and the Sin of Stupidity. Only the former may be overcome." R.I.P. Dad. Linux user# 44256 Sign up at: http://counter.li.org/ https://nuoar.dev.java.net/ Verizon Cell # 336-254-1339

3 4

DB stop&start
by Mad Unix 10 Sep '08

10 Sep '08

Hi I need a script to automatically Starting/Stopping an Oracle 10g DB on CentOS5.2 64bit i.e lsnrctl start/stop db start/stop emctl start/stop dbconsole" Any help? -- Madunix_at_Gmail Sysadmin "Computers are useless. They can only give you answers" - Pablo Picasso "Never trust a computer you can't throw out a window." - Steve Wozniak

2 2

centos5 - logwatch - verisign
by RobertH 10 Sep '08

10 Sep '08

Re: centos 5 logwatch Has anyone ever looked into why verisign does this from these ips fairly frequently? It appears that it is some type of SSL probing the HTTP port, correct? Are they just gathering stats or something ? --------------------- httpd Begin ------------------------ A total of 2 sites probed the server 216.168.253.197 216.168.253.198 ..... The first ip is a3-pip6.verisign.net The second ip is a3-pip7.verisign.net Here is grep from logs 216.168.253.197 - - [01/Sep/2008:13:30:19 -0700] "\x80@\x01\x03" 501 304 216.168.253.197 - - [01/Sep/2008:14:02:08 -0700] "\x80@\x01\x03" 501 304 216.168.253.197 - - [05/Sep/2008:22:16:20 -0700] "\x80@\x01\x03" 501 304 216.168.253.197 - - [05/Sep/2008:22:16:29 -0700] "\x80@\x01\x03" 501 297 216.168.253.197 - - [09/Sep/2008:15:26:54 -0700] "\x80@\x01\x03" 501 304 216.168.253.197 - - [09/Sep/2008:15:27:04 -0700] "\x80@\x01\x03" 501 304 216.168.253.197 - - [09/Sep/2008:15:27:13 -0700] "\x80@\x01\x03" 501 297 216.168.253.198 - - [02/Sep/2008:07:00:39 -0700] "\x80@\x01\x03" 501 304 216.168.253.198 - - [02/Sep/2008:07:48:42 -0700] "\x80@\x01\x03" 501 297 216.168.253.198 - - [03/Sep/2008:15:04:50 -0700] "\x80@\x01\x03" 501 297 216.168.253.198 - - [05/Sep/2008:22:19:52 -0700] "\x80@\x01\x03" 501 297 216.168.253.198 - - [09/Sep/2008:15:26:52 -0700] "\x80@\x01\x03" 501 297 - rh

2 1

Compromised
by Miark 10 Sep '08

10 Sep '08

My wife's office server was compromised today. It appears they ssh'ed in through account pcguest which was set up for Samba. (I don't remember setting up that account, but maybe I did.) At any rate, I found a bazillion "ftp_scanner" processes running. A killall finished them off quickly, I nuked the pcguest account, and switched ssh to a different port (which I normally do anyway). I used 'find' to locate ftp_scanner, which was running in a folder under /var/tmp. It seems that before I could nuke the directory, it nuked itself! Because it was running from /var/tmp, and because 'find' and 'ps' were not compromised (in that they did not hide the ftp_scanner processes or files), I'm thinking the attacker really didn't get any further than eating some bandwidth. I suppose I have no choice but to re-install, but I thought I'd run I'd get some feedback first. (Something other than, "Way to go, moron.") In the meantime, I'm pulling the plug. Miark

4 3

Network card help please
by Gary 10 Sep '08

10 Sep '08

Hi ya'll, Running v5 .. I have 2 Linksys PCI cards running already without any problems. These were recognized by the system as ADMTek NC100 cards, per usual... they run on eth0 and eth2 ... have for months.... no problems. I added a third Linksys PCI card to the mobo, fired the computer up, and it is not recognized at all. It has been many years since I had this problem of a network card not being automatically recognized, so I am a little rusty. Can someone give me input on the steps needed to get this third NIC recognized please. Thanks for your help. -- Regards, Gary

3 12

buildinstall cannot find modules
by treed＠ultraviolet.org 09 Sep '08

09 Sep '08

When using buildinstall and CentOS 5.2 to create my own CD minus a bunch of unneeded RPM's and plus a few of my custom RPM's I find that the install CD that gets build does not install an initrd which renders the system unbootable. I also notice that when I run buildinstall with the -debug option it says: unpacking /var/www/html/centos/5.2/os/x86_64/CentOS/kernel-2.6.18-92.el5.x86_64.rpm.x86_64 Building initrd.img Module 3c501 not found in kernel rpm Module 3c503 not found in kernel rpm Module 3c505 not found in kernel rpm and so on for many kernel modules. I notice that the filename it says it is unpacking ends with .x86_64.rpm.x86_64. Is that normal? I google'd and found someone else saying theirs did the same thing. Could this be related to why I'm not ending up with an initrd being installed? -- Tracy Reed http://tracyreed.org

1 1

ADD locale ISO-8859-1 - CENTOS 4
by Adriano Frare 09 Sep '08

09 Sep '08

Dear Friends. The CENTOS 4 is install with locale utf-8, but I would like add locale iso-8859-1. How do you it ? Thanks Adriano Frare

2 3

Re: [CentOS] Re: Need help with an odd issue I am experiencing
by David Petruzzella 09 Sep '08

09 Sep '08

---------- Original Message ---------------------------------- From: Scott Silva <ssilva(a)sgvwater.com> Reply-To: CentOS mailing list <centos(a)centos.org> Date: Tue, 09 Sep 2008 14:07:24 -0700 >This is an OpenPGP/MIME signed message (RFC 2440 and 3156) > who knows its been a long time since I talked with anyone at my old isp haven't had them for years. ________________________________________________________________ Sent via the WebMail system at mail.dsli.com

1 0

RE: [CentOS] Need help with an odd issue I am experiencing
by David Petruzzella 09 Sep '08

09 Sep '08

---------- Original Message ---------------------------------- From: "RobertH" <roberth(a)abbacomm.net> Reply-To: CentOS mailing list <centos(a)centos.org> Date: Tue, 9 Sep 2008 12:36:11 -0700 >> >> I got my information about the MTU setting from doing google searches and >> the message boards on broadband reports as well as doing the tweak test on >> broad band reports. >> > >David > >I also noticed that if you > >dig dlsi.com > >it appears to come up as 0.0.0.0 > >huh? > >Good for you. > >maybe you should change that depending on how you have things setup > >could be that your packets get a lil confused eh? > > - rh > >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos > dsli.com is just for e-mail has nothing to do with my current internet service, dsli used to be a national isp I had service with before all the clecs went poof and as a sign of gratitude they let me and my wife keep our e-mail accounts. ________________________________________________________________ Sent via the WebMail system at mail.dsli.com

1 0

Re: [CentOS] Re: Need help with an odd issue I am experiencing
by David Petruzzella 09 Sep '08

09 Sep '08

---------- Original Message ---------------------------------- From: Scott Silva <ssilva(a)sgvwater.com> Reply-To: CentOS mailing list <centos(a)centos.org> Date: Tue, 09 Sep 2008 14:00:01 -0700 >This is an OpenPGP/MIME signed message (RFC 2440 and 3156) > I tried that and I don't think I got ethtool to respond properly, I will have to try again later. ________________________________________________________________ Sent via the WebMail system at mail.dsli.com

1 0

RE: [CentOS] Need help with an odd issue I am experiencing
by David Petruzzella 09 Sep '08

09 Sep '08

---------- Original Message ---------------------------------- From: "RobertH" <roberth(a)abbacomm.net> Reply-To: CentOS mailing list <centos(a)centos.org> Date: Tue, 9 Sep 2008 12:32:33 -0700 >> >> I got my information about the MTU setting from doing google searches and >> the message boards on broadband reports as well as doing the tweak test on >> broad band reports. >> >> > >It appears you are on Comtrash where everything is CoMtRaSHtIc. > >Good for you. Dance a jig. > >Stop beating the MTU horse to death and get busy finding out how to best >connect to the CPE devices. > >Google that stuff. > >First, when testing, disable (admin down) the internal network on the second >nic > >Also, check to see what specific nics you have an if any recent issues with >kernels and such and any updates. > >Google that too. > >Then Focus on the internet transit/transport infrastructure. > >Find out best way to interface with the cable modem CPE infrastructure. > >Meaning what speed and duplex. > >Trial and error. > >You will get there... > >Some nics need to be played with and dealt with in terms of kernel and other >things like disable ipv6 in modprobe.conf and dhcp... > >You might be better off having an intermediate device between you and the >cable modem if your nics don't wanna play nice with the cable modem. > >Last but not least, you can always check stats and see if collisions and >errors on interfaces and more. > >Enjoy > > - rh > >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos > 1. Comcrap is not available in my area I am on road runner biz through bright house with 15m down and 2 up and static ip. 2. Already tested without the internal nic running 3. Tried with a router in between and the result is the same. 4. I do agree about the negotiation aspect, which I'm looking into as well. 5. Don't notice any collisions or errors on ifconfig. ________________________________________________________________ Sent via the WebMail system at mail.dsli.com

3 2

Re: [CentOS] Need help with an odd issue I am experiencing
by David Petruzzella 09 Sep '08

09 Sep '08

---------- Original Message ---------------------------------- From: Les Mikesell <lesmikesell(a)gmail.com> Reply-To: CentOS mailing list <centos(a)centos.org> Date: Tue, 09 Sep 2008 15:46:53 -0500 >David Petruzzella wrote: >> >> I got my information about the MTU setting from doing google searches and the message boards on broadband reports as well as doing the tweak test on broad band reports. > >MTU's need to match the lowest value in the path between endpoints not >just your adjacent connection. If there are tunnels/PPOE that add >encapsulating headers involved you'll have a performance hit when the >routers need to fragement and reassemble large packets. > >-- > Les Mikesell > lesmikesell(a)gmail.com > > >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos > No tunnels. ________________________________________________________________ Sent via the WebMail system at mail.dsli.com

1 0

RE: [CentOS] Need help with an odd issue I am experiencing
by David Petruzzella 09 Sep '08

09 Sep '08

---------- Original Message ---------------------------------- From: Ric Moore <wayward4now(a)gmail.com> Reply-To: CentOS mailing list <centos(a)centos.org> Date: Tue, 09 Sep 2008 14:56:58 -0400 > >On Mon, 2008-09-08 at 23:46 -0600, Joseph L. Casale wrote: >> >I have a server with dual nic's running centos 5.2 1 nic connects to the >> >cable modem, which has 15m d and 2m up, but speed tests barely come back at >> >5mb down including road runner's internal speed test. I hook up my laptop to >> >the same modem, same port, using the same cable and I get 17mb down. I have >> >ruled out iptables, nics (because same result on both nics), cables, cable >> >modem(with a brighthouse rep) any suggestions would be greatly appreciated. >> >Thanks. >> >> So I gather the nics aren't teamed from your wording, maybe MTU is set sub >> optimal for your particular ISP? What OS on your laptop? Wrong MTU can have >> a significant effect such as this. > >"Back in the day..." there used to be a utility that would test your >connection for the optimal MTU setting. Is there something like that for >Linux?? Ric > >-- >---------------------------------------------------- >My father, Victor Moore (Vic) used to say: >"There are two Great Sins in the world... >..the Sin of Ignorance, and the Sin of Stupidity. >Only the former may be overcome." R.I.P. Dad. >Linux user# 44256 Sign up at: http://counter.li.org/ >https://nuoar.dev.java.net/ >Verizon Cell # 336-254-1339 > >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos > I got my information about the MTU setting from doing google searches and the message boards on broadband reports as well as doing the tweak test on broad band reports. ________________________________________________________________ Sent via the WebMail system at mail.dsli.com

3 3

RE: [CentOS] Need help with an odd issue I am experiencing
by David Petruzzella 09 Sep '08

09 Sep '08

---------- Original Message ---------------------------------- From: "RobertH" <roberth(a)abbacomm.net> Reply-To: CentOS mailing list <centos(a)centos.org> Date: Tue, 9 Sep 2008 13:19:41 -0700 >> >> 1. Comcrap is not available in my area I am on road runner biz through >> bright house with 15m down and 2 up and static ip. >> >> 2. Already tested without the internal nic running >> >> 3. Tried with a router in between and the result is the same. >> >> 4. I do agree about the negotiation aspect, which I'm looking into as >> well. >> >> 5. Don't notice any collisions or errors on ifconfig. >> >> > >I see, when I trace the domain you are sending email from I assumed it was >you on a comcast link. > >Or maybe roadrunner resells comcast in your area or comcast bought >roadrunner in your area? > >The dlsi.com dig pointing at 0.0.0.0 was interesting. > >Never ever seen dns point to 0.0.0.0 > >Shouldn't there be a error catch in dns server software for that situation? > >It's like using dns to route? Har har he. > >Or did you buy the internet? > >;-) > >Man, if so, I wanna be your best bud cause I need a piece of the action to >sell at a good deal > >;-> > > - rh > > >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos > LOL I wish I bought the internet, no this dsli.com e-mail address is because I used to have dsl service with them when they were a national provider back when there were clec's, but when all the clec's went poof they could not keep the dsl side of it, but as a sign of gratitude they let me and my wife keep the e-mail account. My domain is actually pbfamily.net ________________________________________________________________ Sent via the WebMail system at mail.dsli.com

1 0

grub permission denied
by Jay 09 Sep '08

09 Sep '08

I have one server that I can not edit the /etc/grub/grub.conf file. I get permission denied as root. I can change other files just not grub.conf. after unmounting /dev/hda from /boot and mounting under /g for a test the same things occurs. Even in single mode I can not modify / delete / move the file. When umounted I did a fsck on it and all is fine. also can not edit menu.lst which links to grub.conf. what am I missing? Thanks -Jay

3 4

DJB's daemontools package
by Robert Moskowitz 09 Sep '08

09 Sep '08

Is this available for Centos? If so where?

8 10

CentOS 4 & autofs 4.1.3
by John Kordash 09 Sep '08

09 Sep '08

For those of you using CentOS 4, is anyone having trouble with autofs 4.1.3? I'm seeing (with 60second unmount timeout) what appears to be an apparent race condition where a script touches an automount directory at about (the same second according to logs) the same time the unmount is triggered, and the script then gets a read error. Sure, increasing the unmount timeout will reduce the occurrence rate, but if this really is a race, then it won't eliminate it. In looking at the CHANGELOG between autofs 4.1.3 and 5.0.1rc2, there have been tons of changes including some references to timing issues. However nothing is jumping out, and there are many changes. Is it conventional wisdom that the 4.1.3 autofs has 'issues' and folks routinely move up to autofs 5 on CentOS 4.x? Thanks, -John

2 1

RE: [CentOS] Need help with an odd issue I am experiencing
by David Petruzzella 09 Sep '08

09 Sep '08

Not a laptop it is a server with dual nics mtu set at 1500, 1 nic directly to the cable modem the other to my lan. ---------- Original Message ---------------------------------- From: "Joseph L. Casale" <JCasale(a)activenetwerx.com> Reply-To: CentOS mailing list <centos(a)centos.org> Date: Mon, 8 Sep 2008 23:46:40 -0600 >>I have a server with dual nic's running centos 5.2 1 nic connects to the >>cable modem, which has 15m d and 2m up, but speed tests barely come back at >>5mb down including road runner's internal speed test. I hook up my laptop to >>the same modem, same port, using the same cable and I get 17mb down. I have >>ruled out iptables, nics (because same result on both nics), cables, cable >>modem(with a brighthouse rep) any suggestions would be greatly appreciated. >>Thanks. > >So I gather the nics aren't teamed from your wording, maybe MTU is set sub >optimal for your particular ISP? What OS on your laptop? Wrong MTU can have >a significant effect such as this. > >jlc >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos > ________________________________________________________________ Sent via the WebMail system at mail.dsli.com

3 2

RE: [CentOS] Need help with an odd issue I am experiencing
by David Petruzzella 09 Sep '08

09 Sep '08

---------- Original Message ---------------------------------- From: "Joseph L. Casale" <JCasale(a)activenetwerx.com> Reply-To: CentOS mailing list <centos(a)centos.org> Date: Tue, 9 Sep 2008 12:40:48 -0600 >>Not a laptop it is a server with dual nics mtu set at 1500, 1 nic directly to the cable modem the other to my lan. > >MTU has nothing to do with laptops, it has to do with TCP/IP. >Aside from a previous posters duplex setting (good catch on his part) its >possible that MTU is an issue. Some ISP's do some silly stuff. You >*are* going into a cable modem (which I read as accessing the internet >through some means other than a high-end fiber/etc connection where oddities >wouldn't likely exist:>) > >jlc >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos > The MTU setting of 1500 is optimal for that connection from what I read and according to tweak tests and I was just clarifying that the pc in question was not a laptop I am aware that MTU is TCP related and I agree sometimes there are funny things that happen with that, based on other tests I have done with other devices kind of rules out MTU it seems to be more a duplexing issue or driver issue I think. Both myself and the cable guy have hooked a laptop to the cable modem all beit they are windows laptops with the same settings and speed tests were normal. ________________________________________________________________ Sent via the WebMail system at mail.dsli.com

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss