Re: [gentoo-user] iproute2 reference

2018-06-11 Thread Peter Humphrey
On Sunday, 10 June 2018 17:58:35 BST Grant Taylor wrote:

--->8  much detail that makes me feel a bit faint...

> IMHO the biggest issue is that you have to understand what you want to do
> and then translate it to the proper ip commands to do it.  You need that
> high level blueprint (if you will) so that you can then implement it with
> the "ip" command.  This is why you need at least a basic understanding of
> networking to fully take advantage of the "ip" command.

Quite so. Understanding is dawning, but slowly these days, and starting from 
deep darkness.

The lartc website has been down for a few days now, but I'd already got hold 
of the howto. I've just sent a subscription request to the mailing list.

Many thanks for your help, Grant.

-- 
Regards,
Peter.






Re: [gentoo-user] NFS and user IDs

2018-06-11 Thread Joerg Schilling
Wol's lists  wrote:

> On 09/06/18 18:09, Rich Freeman wrote:
...
> > downsides as well, in particular it is certainly more complex and at
> > work we practically forbid any kind of windows ACLs at anything other
> > than the top mount level because it is so hard to control.
>
> Windows is better than POSIX?! That doesn't say much for POSIX then, 
> seeing as I feel Windows ACLs are overly complex and difficult!

Well, "Windows ACLs" is the only ACL system that is standardized (as part of 
the NFSv4 standard). The old proposal in POSIX.1e from 1993 from Sun has been 
withdrawn in 1997 since the customers did not like it.

Jörg

-- 
 EMail:jo...@schily.net(home) Jörg Schilling D-13353 Berlin
joerg.schill...@fokus.fraunhofer.de (work) Blog: http://schily.blogspot.com/
 URL: http://cdrecord.org/private/ http://sf.net/projects/schilytools/files/'



[gentoo-user] Do I need to do anything if a package masked by my profile?

2018-06-11 Thread James Stevenson
Hi all,

I was running `emerge --update --newuse --deep @world` this morning and
I received a notification that one of my packages had been masked by my
profile. Am I correct in thinking that this issue will resolve itself in
30 days?

!!! The following installed packages are masked:
- x11-proto/xextproto-7.3.0-r1::gentoo (masked by: package.mask)
/usr/portage/profiles/package.mask:
# Matt Turner  (10 Jun 2018)
# Packages combined into x11-base/xorg-proto.
#All reverse deps transitioned.
# Removal in 30 days. Bug #656250

- x11-proto/dri2proto-2.8-r2::gentoo (masked by: package.mask)
- x11-proto/xf86driproto-2.1.1-r2::gentoo (masked by: package.mask)
- x11-proto/dri3proto-1.0-r1::gentoo (masked by: package.mask)
- x11-proto/presentproto-1.1-r1::gentoo (masked by: package.mask)
- x11-proto/xf86vidmodeproto-2.3.1-r2::gentoo (masked by: package.mask)
- x11-proto/glproto-1.4.17-r2::gentoo (masked by: package.mask)
For more information, see the MASKED PACKAGES section in the emerge
man page or refer to the Gentoo Handbook.

All the best,
James



Re: [gentoo-user] Do I need to do anything if a package masked by my profile?

2018-06-11 Thread Dale
James Stevenson wrote:
> Hi all,
>
> I was running `emerge --update --newuse --deep @world` this morning and
> I received a notification that one of my packages had been masked by my
> profile. Am I correct in thinking that this issue will resolve itself in
> 30 days?
>
> !!! The following installed packages are masked:
> - x11-proto/xextproto-7.3.0-r1::gentoo (masked by: package.mask)
> /usr/portage/profiles/package.mask:
> # Matt Turner  (10 Jun 2018)
> # Packages combined into x11-base/xorg-proto.
> #All reverse deps transitioned.
> # Removal in 30 days. Bug #656250
>
> - x11-proto/dri2proto-2.8-r2::gentoo (masked by: package.mask)
> - x11-proto/xf86driproto-2.1.1-r2::gentoo (masked by: package.mask)
> - x11-proto/dri3proto-1.0-r1::gentoo (masked by: package.mask)
> - x11-proto/presentproto-1.1-r1::gentoo (masked by: package.mask)
> - x11-proto/xf86vidmodeproto-2.3.1-r2::gentoo (masked by: package.mask)
> - x11-proto/glproto-1.4.17-r2::gentoo (masked by: package.mask)
> For more information, see the MASKED PACKAGES section in the emerge
> man page or refer to the Gentoo Handbook.
>
> All the best,
> James
>
>


If my memory serves me correctly, the package you have installed now is
being included/transitioned in another package.  In other words, you
should be able to uninstall xextproto and the files that were in it are
now in xorg-proto.  It may be that you have to emerge xextproto again or
it may even require a USE flag change to insure it creates the new files
from the old package. 

If my memory has failed me, I'm sure someone will come along and correct
me.  ;-)

Dale

:-)  :-) 



Re: [gentoo-user] Do I need to do anything if a package masked by my profile?

2018-06-11 Thread Neil Bothwick
On Mon, 11 Jun 2018 10:06:36 +0100, James Stevenson wrote:

> I received a notification that one of my packages had been masked by my
> profile. Am I correct in thinking that this issue will resolve itself in
> 30 days?
> 
> !!! The following installed packages are masked:
> - x11-proto/xextproto-7.3.0-r1::gentoo (masked by: package.mask)
> /usr/portage/profiles/package.mask:
> # Matt Turner  (10 Jun 2018)
> # Packages combined into x11-base/xorg-proto.
> #All reverse deps transitioned.
> # Removal in 30 days. Bug #656250

You shouldn't have any of these packages installed now, they should have
been depcleaned after xorg-proto was installed. If depclean doesn't
remove them, they still be required by a package in an overlay, that
happened to me.

emerge -cpv packagename

should tell you why each package is still there.


-- 
Neil Bothwick

WinErr 014: Keyboard locked - Try anything you can think of.


pgp8VmOPeDq2J.pgp
Description: OpenPGP digital signature


Re: [gentoo-user] Do I need to do anything if a package masked by my profile?

2018-06-11 Thread James Stevenson
Thank you for the advice, you've both been very helpful! I'll take a look
at it this evening.

James

On Mon, Jun 11, 2018, 10:37 AM Neil Bothwick  wrote:

> On Mon, 11 Jun 2018 10:06:36 +0100, James Stevenson wrote:
>
> > I received a notification that one of my packages had been masked by my
> > profile. Am I correct in thinking that this issue will resolve itself in
> > 30 days?
> >
> > !!! The following installed packages are masked:
> > - x11-proto/xextproto-7.3.0-r1::gentoo (masked by: package.mask)
> > /usr/portage/profiles/package.mask:
> > # Matt Turner  (10 Jun 2018)
> > # Packages combined into x11-base/xorg-proto.
> > #All reverse deps transitioned.
> > # Removal in 30 days. Bug #656250
>
> You shouldn't have any of these packages installed now, they should have
> been depcleaned after xorg-proto was installed. If depclean doesn't
> remove them, they still be required by a package in an overlay, that
> happened to me.
>
> emerge -cpv packagename
>
> should tell you why each package is still there.
>
>
> --
> Neil Bothwick
>
> WinErr 014: Keyboard locked - Try anything you can think of.
>


Re: [gentoo-user] Enable "regular" network traffic when using VPN

2018-06-11 Thread Mick
On Sunday, 10 June 2018 23:51:42 BST Grant Taylor wrote:
> On 06/10/2018 12:30 PM, Mick wrote:
> > If NAT'ed between guest and host and then NAT'ed again at the home
> > router, you are double NAT'ed.
> 
> Or possibly triple NATed if your ISP is using Carrier Grade NAT.
> 
> At least that's one definition of "double NAT".  I tend to use a
> different definition, one where you're NATing source and destination in
> a single device.  As opposed to doing a single NAT operation on multiple
> devices.
> 
> > As far as I know VPNs will not work through a double NAT situation,
> > unless you use your gateway or host as the VPN end point and then
> > setup port forwarding to the host from there.
> 
> I see no reason why SSL or SSH based VPNs wouldn't work perfectly fine
> through many layers of NAT.

You'll need a trusted gateway to do the unwrapping and then forwarding to the 
next hop (SSH forwarding).  If you attempt TCP-tunneling (TCP-over-TCP) you'll 
soon experience 'TCP meltdown' with upper and lower TCP layers' retransmission 
timeouts. 


> I also think that it should be possible to get IPSec VPNs to work
> through multiple layers of NAT.  You'd need to account for the AH issues
> or ESP without AH.

How will you be able to account for such a multi-NAT routing arrangement if 
(in tunnel rather than transport mode) the original entire IP datagram is 
encrypted and encapsulated?  You'll need to decrypt it, take the payload and 
read its IP header before you know where to forward it to.  On single NAT you 
encapsulate the IPSec into UDP (NAT-Traversal), but on a double NAT what will 
you do?  I've never heard of double/triple NAT-T without port forwarding ...


> Each layer of NAT makes VPNs more difficult, but not impossible.
> 
> Depending on the type of VPN, each layer of NAT may mean that you must
> be the only person using that type of VPN to avoid confusing the NAT /
> breaking all of that type of VPN.

Do you mean VPN within UDP within VPN?  You'll need intermediate VPN gateways 
for this.


> > Bridge the host to guest adaptors and you should be good to go (once
> > any other conventionla VPN configuration problem is solved).  :-)
> 
> Hilco's issue was what is routed through the VPN, not a problem with
> establishing said VPN.

Quite, we've gone off-piste here.

-- 
Regards,
Mick

signature.asc
Description: This is a digitally signed message part.


[gentoo-user] Re: Latest 4.9 kernels broken?

2018-06-11 Thread Ian Zimmerman
On 2018-06-09 18:51, Alexander Kapshuk wrote:

> readelf -h /path/to/module.ko

ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class: ELF64
  Data:  2's complement, little endian
  Version:   1 (current)
  OS/ABI:UNIX - System V
  ABI Version:   0
  Type:  REL (Relocatable file)
  Machine:   Advanced Micro Devices X86-64
  Version:   0x1
  Entry point address:   0x0
  Start of program headers:  0 (bytes into file)
  Start of section headers:  52808 (bytes into file)
  Flags: 0x0
  Size of this header:   64 (bytes)
  Size of program headers:   0 (bytes)
  Number of program headers: 0
  Size of section headers:   64 (bytes)
  Number of section headers: 23
  Section header string table index: 22

This was less frustrating than the other times as I didn't have to
reboot back and forth, so you need not feel guilty about it.

-- 
Please don't Cc: me privately on mailing lists and Usenet,
if you also post the followup to the list or newsgroup.
To reply privately _only_ on Usenet and on broken lists
which rewrite From, fetch the TXT record for no-use.mooo.com.



Re: [gentoo-user] [Maybe OT]: Instability of system

2018-06-11 Thread R0b0t1
On Sun, Jun 10, 2018 at 8:48 AM, Mick  wrote:
> On Sunday, 10 June 2018 14:06:22 BST Alan Mackenzie wrote:
>
>> The shop I bouught everything from seems to have gone out of business,
>> with both its telephone number and its website having been down for a
>> sustained period.  So I'm unlikely to be able to get the processor
>> exchanged for an unbuggy one.  Shelling out for a new processor out of my
>> own pocket seems too much of a long shot to justify the money (~400
>> Euros) and the time.
>>
>> So it's looking like I'm not going to be getting the problem fixed any
>> time soon.  :-(
>
> All may not be lost, yet.
>
> Since this is arguably a manufacturing fault of the CPU, you should have some
> consumer rights over it.  Try contacting AMD directly for RMA, as long as it
> is still under the *manufacturer's* warranty and you have your receipt.
>

If at all possible avoid doing the RMA. It seems to take over a month,
time which you are not compensated for.

Federal law implies a warranty of fitness for a particular purpose*
from the seller, not the manufacturer. You can take it up with them.
The statute of limitations is 4 years. Make them deal with AMD.

Cheers,
 R0b0t1


* You generally can't waive this during a transaction, so those
disclaimers in open source licenses are not valid. What is more
important is there was no transfer of money.



Re: [gentoo-user] Enable "regular" network traffic when using VPN

2018-06-11 Thread Grant Taylor

On 06/11/2018 04:55 AM, Mick wrote:
You'll need a trusted gateway to do the unwrapping and then forwarding 
to the next hop (SSH forwarding).  If you attempt TCP-tunneling 
(TCP-over-TCP) you'll soon experience 'TCP meltdown' with upper and 
lower TCP layers' retransmission timeouts.


I disagree.

If I can establish an HTTPS (or other TCP connection to carry TLS 
traffic) out through multiple layers of NAT (SOHO router + CGN + ???) to 
a server with a globally routed IP address, I should be golden.


NAT will do what it needs to with the internal IPs to establish the 
connection from the deeply buried client out to the TLS VPN server.


The connection will (extremely likely) be kept alive with various 
different methods (TCP keep alive or VPN keep alive or pings through the 
VPN) such that the upstream gateway can send data back to the client 
through the established VPN.


Arguably this is no different than a long lived HTTP(S) connection from 
the same client deep behind multiple NATs.


There is no need for something in the middle to unwrap things.

It almost sounds like you're talking about trying to do something from 
one computer behind one or more NATs to another computer behind one or 
more NATs on the far end.  —  That is a far more complex and 
significantly different problem.


Most corporate VPN users are road warriors and connect from random IPs 
to a static globally routed IP that is open to the world.


How will you be able to account for such a multi-NAT routing arrangement 
if (in tunnel rather than transport mode) the original entire IP datagram 
is encrypted and encapsulated?  You'll need to decrypt it, take the 
payload and read its IP header before you know where to forward it to.


Let me know if my comments above don't answer your question.

On single NAT you encapsulate the IPSec into UDP (NAT-Traversal), but 
on a double NAT what will you do?


On the second NAT, you pass the UDP traffic from the first NAT.


I've never heard of double/triple NAT-T without port forwarding ...


There is no specific need for port forwarding in any of the NATs when 
the traffic is originated outbound from the innermost client going out 
to a static globally routed IP.  —  Just like there's no need for it 
when making an HTTPS request from the same client system.


Do you mean VPN within UDP within VPN?  You'll need intermediate VPN 
gateways for this.


No.  L2TP and / or PPTP are notoriously flaky with NATs.  But it's 
usually possible to get a single L2TP / PPTP VPN to function behind a 
NAT.  This is because the NAT sees the L2TP or PPTP traffic and 
associates it with a single VPN client behind the NAT.  If (when) there 
is a second VPN client of the same type, it breaks the association of 
which internal client the traffic goes to.  Thus it usually breaks / 
prevents all such clients from working at the same time.




--
Grant. . . .
unix || die



Re: [gentoo-user] NFS and user IDs

2018-06-11 Thread Wols Lists
On 11/06/18 09:54, Joerg Schilling wrote:
> Wol's lists  wrote:
> 
>> On 09/06/18 18:09, Rich Freeman wrote:
> ...
>>> downsides as well, in particular it is certainly more complex and at
>>> work we practically forbid any kind of windows ACLs at anything other
>>> than the top mount level because it is so hard to control.
>>
>> Windows is better than POSIX?! That doesn't say much for POSIX then, 
>> seeing as I feel Windows ACLs are overly complex and difficult!
> 
> Well, "Windows ACLs" is the only ACL system that is standardized (as part of 
> the NFSv4 standard). The old proposal in POSIX.1e from 1993 from Sun has been 
> withdrawn in 1997 since the customers did not like it.
> 
Ummm - just because it's standard doesn't mean it's any good :-)

This version I'm talking about dates from about 1983. The company making
it went bust in 1991.

I've just had a quick look at the NFS v4 RFC, and almost the first thing
I see is DENY entries. These ACLs don't have deny, because it's
pointless. And DENY is exactly why I think Posix/Windows ACLs are
confusing and hard to use.

Cheers,
Wol




Re: [gentoo-user] Do I need to do anything if a package masked by my profile?

2018-06-11 Thread John Blinka
>
>> You shouldn't have any of these packages installed now, they should have
>> been depcleaned after xorg-proto was installed. If depclean doesn't
>> remove them, they still be required by a package in an overlay, that
>> happened to me.
>>
>> emerge -cpv packagename
>>
>> should tell you why each package is still there.
>
>
In my case, depclean didn’t remove them after xorg-proto was installed, no
other package depended on them, and there were no portage anomalies like
being accidentally included in my world file.  I had to remove them
explicitly by hand.  Don’t know what that’s all about, but everything still
works.

John Blinka

>
>>


Re: [gentoo-user] [Maybe OT]: Instability of system

2018-06-11 Thread Wol's lists




On 11/06/18 16:30, R0b0t1 wrote:

Federal law implies a warranty of fitness for a particular purpose*
from the seller, not the manufacturer. You can take it up with them.
The statute of limitations is 4 years. Make them deal with AMD.


Please read the parent post !!!

The seller no longer exists, so that is not an option.

Federal law is irrelevant, as the OP is about 4000 miles outside their 
jurisdiction.


I believe the OP and AMD are the same nationality, and that is nowhere 
near the American continent, let alone the US.


Cheers,
Wol



Re: [gentoo-user] [Maybe OT]: Instability of system

2018-06-11 Thread R0b0t1
On Mon, Jun 11, 2018 at 1:16 PM, Wol's lists  wrote:
>
>
> On 11/06/18 16:30, R0b0t1 wrote:
>>
>> Federal law implies a warranty of fitness for a particular purpose*
>> from the seller, not the manufacturer. You can take it up with them.
>> The statute of limitations is 4 years. Make them deal with AMD.
>
>
> Please read the parent post !!!
>
> The seller no longer exists, so that is not an option.
>
> Federal law is irrelevant, as the OP is about 4000 miles outside their
> jurisdiction.
>
> I believe the OP and AMD are the same nationality, and that is nowhere near
> the American continent, let alone the US.
>

My apologies, sir. Sometimes I forget that the United States is not
the only country.

AMD is an American company based out of California. However rereading
the post I notice he is using Euros, in which case there are likely
even stronger guarantees of fitness for a particular purpose. I
suppose it doesn't help that the seller seems to have gone bankrupt.

Cheers,
 R0b0t1



Re: [gentoo-user] [Maybe OT]: Instability of system

2018-06-11 Thread Wols Lists
On 11/06/18 20:11, R0b0t1 wrote:
> AMD is an American company based out of California. However rereading
> the post I notice he is using Euros, in which case there are likely
> even stronger guarantees of fitness for a particular purpose. I
> suppose it doesn't help that the seller seems to have gone bankrupt.

Apologies, but I am lucky to have an excellent memory, and I do get a
bit grumpy sometimes when another poster has either not read or
forgotten information that was mentioned earlier.

As for AMD being American, reading Wikipedia I see they are, but I was
under the impression they were German. (The OP is in Germany despite
their anglo-saxon sounding name.) However, I note that they were in a
joint venture with Siemens, which I guess is where I got that
impression. Maybe (having gone fabless) a lot of their chips are
produced by Siemens in Germany - I don't know.

(And I'm sitting on a system - which I haven't yet managed to boot
successfully - where my supplier too has gone bust :-(

Cheers,
Wol



Re: [gentoo-user] Enable "regular" network traffic when using VPN

2018-06-11 Thread Mick
On Monday, 11 June 2018 17:47:16 BST Grant Taylor wrote:
> On 06/11/2018 04:55 AM, Mick wrote:
> > You'll need a trusted gateway to do the unwrapping and then forwarding
> > to the next hop (SSH forwarding).  If you attempt TCP-tunneling
> > (TCP-over-TCP) you'll soon experience 'TCP meltdown' with upper and
> > lower TCP layers' retransmission timeouts.
> 
> I disagree.
> 
> If I can establish an HTTPS (or other TCP connection to carry TLS
> traffic) out through multiple layers of NAT (SOHO router + CGN + ???) to
> a server with a globally routed IP address, I should be golden.
> 
> NAT will do what it needs to with the internal IPs to establish the
> connection from the deeply buried client out to the TLS VPN server.

As I understand it, the CGN router will rewrite the IP headers and ports from/
to the SOHO router using PCP.  This is not a TCP-over-TCP tunnel.


> The connection will (extremely likely) be kept alive with various
> different methods (TCP keep alive or VPN keep alive or pings through the
> VPN) such that the upstream gateway can send data back to the client
> through the established VPN.

Outgoing connections will be OK, but to run a local server I believe you'll 
need to set up an external 'rendezvous server' to facilitate incoming 
connections, since the double NAT'ed local server will not have a public 
facing IP address.


> Arguably this is no different than a long lived HTTP(S) connection from
> the same client deep behind multiple NATs.
> 
> There is no need for something in the middle to unwrap things.

I'm trying to recall what I was thinking when I wrote this ... SSH reverse 
tunneling?  Not sure.  Outgoing VPN connections *should* work fine, incoming 
won't.


> It almost sounds like you're talking about trying to do something from
> one computer behind one or more NATs to another computer behind one or
> more NATs on the far end.  —  That is a far more complex and
> significantly different problem.

I've tried that and couldn't get it to work - for reasons I explained below.


> Most corporate VPN users are road warriors and connect from random IPs
> to a static globally routed IP that is open to the world.
> 
> > How will you be able to account for such a multi-NAT routing arrangement
> > if (in tunnel rather than transport mode) the original entire IP datagram
> > is encrypted and encapsulated?  You'll need to decrypt it, take the
> > payload and read its IP header before you know where to forward it to.
> 
> Let me know if my comments above don't answer your question.
> 
> > On single NAT you encapsulate the IPSec into UDP (NAT-Traversal), but
> > on a double NAT what will you do?
> 
> On the second NAT, you pass the UDP traffic from the first NAT.
> 
> > I've never heard of double/triple NAT-T without port forwarding ...
> 
> There is no specific need for port forwarding in any of the NATs when
> the traffic is originated outbound from the innermost client going out
> to a static globally routed IP.  —  Just like there's no need for it
> when making an HTTPS request from the same client system.
> 
> > Do you mean VPN within UDP within VPN?  You'll need intermediate VPN
> > gateways for this.
> 
> No.  L2TP and / or PPTP are notoriously flaky with NATs.  But it's
> usually possible to get a single L2TP / PPTP VPN to function behind a
> NAT.  This is because the NAT sees the L2TP or PPTP traffic and
> associates it with a single VPN client behind the NAT.  If (when) there
> is a second VPN client of the same type, it breaks the association of
> which internal client the traffic goes to.  Thus it usually breaks /
> prevents all such clients from working at the same time.

Yes, in these cases you have to use different ports and set port forwarding 
per client.

-- 
Regards,
Mick

signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-user] Enable "regular" network traffic when using VPN

2018-06-11 Thread Grant Taylor

On 06/11/2018 02:51 PM, Mick wrote:
As I understand it, the CGN router will rewrite the IP headers and ports from/ 
to the SOHO router using PCP.  This is not a TCP-over-TCP tunnel.


The VPN could be TCP based and it could be sending TCP through it.  Yes, 
the potential pitfalls of TCP-in-TCP may apply.


Just because it's sub-optimal doesn't mean that it won't work.

Outgoing connections will be OK, but to run a local server I believe you'll 
need to set up an external 'rendezvous server' to facilitate incoming 
connections, since the double NAT'ed local server will not have a public 
facing IP address.


The NATed server doesn't need a globally routed IP if there is port 
forwarding in place.  Such is possible, all be it unlikely, with 
multiple layers of NAT.


I still think the OP was talking about (multiple layers of) NAT at his 
end and connecting to a VPN server at his office that had a globally 
routed IP address.


Besides, the OP did state that he was able to connect and that traffic 
did flow bidirectionally through the VPN.


I'm trying to recall what I was thinking when I wrote this ... SSH reverse 
tunneling?  Not sure.  Outgoing VPN connections *should* work fine, incoming 
won't.


Incoming VPN connections can be made to work.  They will require 
significantly more effort and cooperation of the NAT administrators.


Besides, this is outside of the OP's use case.


I've tried that and couldn't get it to work - for reasons I explained below.


I've lost what your referring to there.

Yes, in these cases you have to use different ports and set port forwarding 
per client.


Not all VPN protocols have the concept of ports and as such can't use 
different ports.




--
Grant. . . .
unix || die



Re: [gentoo-user] Enable "regular" network traffic when using VPN

2018-06-11 Thread Alarig Le Lay
Hi,

On ven.  8 juin 18:34:14 2018, Grant Taylor wrote:
> I'd then reconfigure the VPN with "Use only for resources on this
> connection." and then do something like this:
> 
> I'm not completely sure about the "dev" syntax as it's been a while since
> I've done routes via devices.  Check IP's man page.

The “dev” syntax is correct. As tun0 is a L3 tunnel, you don’t have to
bother about ARP next-hop resolution.

-- 
alarig


signature.asc
Description: PGP signature


Re: [gentoo-user] Enable "regular" network traffic when using VPN

2018-06-11 Thread Alarig Le Lay
So, from what I’m reading in the thread you need three things:
1. Look at what are the internal ranges used at work
2. Disable the default route to the VPN
3. For each range, add a route like 'ip route add $range dev
   tun0'

For the last part, it should be a good idea to create a up script to
avoid adding routes at each connexion.

4. bonus part, tell you IT department to push internal routes
   and not the default one

-- 
alarig


signature.asc
Description: PGP signature


Re: [gentoo-user] Enable "regular" network traffic when using VPN

2018-06-11 Thread Grant Taylor

On 06/11/2018 06:50 PM, Alarig Le Lay wrote:
The “dev” syntax is correct. As tun0 is a L3 tunnel, you don’t 
have to bother about ARP next-hop resolution.


Thank you for the confirmation Alarig.



--
Grant. . . .
unix || die



Re: [gentoo-user] Re: Latest 4.9 kernels broken?

2018-06-11 Thread Alexander Kapshuk
On Mon, Jun 11, 2018 at 6:09 PM Ian Zimmerman  wrote:
>
> On 2018-06-09 18:51, Alexander Kapshuk wrote:
>
> > readelf -h /path/to/module.ko
>
> ELF Header:
>   Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
>   Class: ELF64
>   Data:  2's complement, little endian
>   Version:   1 (current)
>   OS/ABI:UNIX - System V
>   ABI Version:   0
>   Type:  REL (Relocatable file)
>   Machine:   Advanced Micro Devices X86-64
>   Version:   0x1
>   Entry point address:   0x0
>   Start of program headers:  0 (bytes into file)
>   Start of section headers:  52808 (bytes into file)
>   Flags: 0x0
>   Size of this header:   64 (bytes)
>   Size of program headers:   0 (bytes)
>   Number of program headers: 0
>   Size of section headers:   64 (bytes)
>   Number of section headers: 23
>   Section header string table index: 22
>
> This was less frustrating than the other times as I didn't have to
> reboot back and forth, so you need not feel guilty about it.
>
> --
> Please don't Cc: me privately on mailing lists and Usenet,
> if you also post the followup to the list or newsgroup.
> To reply privately _only_ on Usenet and on broken lists
> which rewrite From, fetch the TXT record for no-use.mooo.com.
>

Hmm...

Looks like I'd have to build kernel 4.9.107 in an environment
resembling yours to try and reproduce the behavior in question.
What is the version of kmods you have installed on your system?
What's the output of 'emerge --info'?

In the meantime, see this email exchange [1] that  might be relevant
to the problem you're having.
[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857354#10



[gentoo-user] Re: Latest 4.9 kernels broken?

2018-06-11 Thread Ian Zimmerman
On 2018-06-12 08:23, Alexander Kapshuk wrote:

> Looks like I'd have to build kernel 4.9.107 in an environment
> resembling yours to try and reproduce the behavior in question.
> What is the version of kmods you have installed on your system?
> What's the output of 'emerge --info'?

https://gist.github.com/nobrowser/314da0f994ce134e3d554cc4cfed266e

BTW, why are you so interested in this?  It seems to me to be purely a
kernel/kernel tools problem.  What is the gentoo angle?

Of course I'm not complaining that you're trying to help - thanks a lot.

-- 
Please don't Cc: me privately on mailing lists and Usenet,
if you also post the followup to the list or newsgroup.
To reply privately _only_ on Usenet and on broken lists
which rewrite From, fetch the TXT record for no-use.mooo.com.



[gentoo-user] Different resolutions in startup

2018-06-11 Thread Klaus Ethgen
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Hi Folks,

I have something that annoys me somehow when starting the system.

Usually I set the fb resolution in grub with a proper vga command line.
The problem begins afterwards that the resolution gets changed
afterwards to a very poor resolution before asked to type the password
for disk encryption.

After that the resolution changes again to a different (but higher)
resolution. (I think, that is the final resolution set by conf.d.)

I did not find a way to change the intermediate resolution to a better
value or even find a way to prevent the resolution switch at all...

Anybody an idea how to set the resolution in grub command line and not
changing it afterwards?

Regards
   Klaus
- -- 
Klaus Ethgen   http://www.ethgen.ch/
pub  4096R/4E20AF1C 2011-05-16Klaus Ethgen 
Fingerprint: 85D4 CA42 952C 949B 1753  62B3 79D0 B06F 4E20 AF1C
-BEGIN PGP SIGNATURE-
Comment: Charset: ISO-8859-1

iQGzBAEBCgAdFiEEMWF28vh4/UMJJLQEpnwKsYAZ9qwFAlsfaTMACgkQpnwKsYAZ
9qx1aAv/SrGrXBZbvDd0S31FgA4Qbmru9oUTWWQkkgZZO2/l33nG0kLg4Cri7WgR
Hu929gJIT7NXBM3UPBlvZBNkPvLM6n/tfcANpazWLW5aQyjNkOgKwNRSrHiRUllU
0KU5BhhbAl+qlywSSmCwh5rnpmGB6dwrIxEDt/xhF2ZrzLk2bGxzuZ4cp4hDyTZy
NV3DReipOxFKD4NUTy8xL6yfVKx669ucnzwJW9pO+mGBeFR6QD8Q+rr+uKqOreew
4g8BboJIbdOQ+zyOBZZ2b1S7GjfVlRL2910OHVw6Q82kuKFPYkWtydHsyc5w2aj2
zLIDJzXJBKLIRX8Y9ydmr2uFVPKUG8LQhjNehaxlsFruY+TcbrhuawBkUcZ8RlKt
2aL+d/3KbP+Vtr4+wTS9Dy0uzRgo6WKtLc9oMhRYhryd4ySriGjz1eFGtSL+T6Qe
x1vuJUeYh7cvZp2xuOl2tvhyGYfyk1DAb/Z0Q7ugP188jPYgJ9fas4+FZSFJkC8b
PUsy66qI
=jZMq
-END PGP SIGNATURE-



Re: [gentoo-user] Re: Latest 4.9 kernels broken?

2018-06-11 Thread Alexander Kapshuk
On Tue, Jun 12, 2018 at 8:54 AM Ian Zimmerman  wrote:
>
> On 2018-06-12 08:23, Alexander Kapshuk wrote:
>
> > Looks like I'd have to build kernel 4.9.107 in an environment
> > resembling yours to try and reproduce the behavior in question.
> > What is the version of kmods you have installed on your system?
> > What's the output of 'emerge --info'?
>
> https://gist.github.com/nobrowser/314da0f994ce134e3d554cc4cfed266e
>
> BTW, why are you so interested in this?  It seems to me to be purely a
> kernel/kernel tools problem.  What is the gentoo angle?
>
> Of course I'm not complaining that you're trying to help - thanks a lot.
>
> --
> Please don't Cc: me privately on mailing lists and Usenet,
> if you also post the followup to the list or newsgroup.
> To reply privately _only_ on Usenet and on broken lists
> which rewrite From, fetch the TXT record for no-use.mooo.com.
>

I do programming for a living with an interest in kernel programming.
I'm not a Gentoo developer and I'm not doing this on behalf of the
Gentoo Foundation.
I was just l curious to find out what could have caused the issue
you're having and if possible to try and come up with a fix.

I can't promise I will be able to fix this for you. Chances are, the
next kmods and/or kernel upgrade will  have fixed this for you.

Any reason you're trying to load those modules by hand rather then
have them loaded for you automatically?
Did dmesg have any more info on the failing modules?