Divert sockets no longer behave like connected (SS_ISCONNECTED is removed from so->so_state)

2004-12-15 Thread Äìèòðèé Äâîéíèêîâ
Hello, I'm having this application (VPN daemon) which uses divert sockets for sending stuff http://www.targeted.org/nest/ It worked fine under 5.3-RELEASE but broke after recent upgrade to FreeBSD 5.3-STABLE. An attempt to send() via divert socket now returns EDESTADDRREQ "Destination address req

Re: per-interface packet filters [summary]

2004-12-15 Thread Kelly Yancey
On Thu, 16 Dec 2004, Andre Oppermann wrote: > Kelly Yancey wrote: > > > > How about a generic per-interface pfil demultiplexer? That is, a module > > that uses the existing pfil hooks to in turn call per-interface hooks. > > As Luigi suggested earlier, it would be possible to use the interface

Re: per-interface packet filters [summary]

2004-12-15 Thread Andre Oppermann
Kelly Yancey wrote: > > On Tue, 14 Dec 2004, Gleb Smirnoff wrote: > > > On Tue, Dec 14, 2004 at 01:47:35PM +0100, Andre Oppermann wrote: > > A> > Implementationwise, the kernel side is evidently trivial as the > > A> > original code already supports the idea of multiple chains. All > > A> > you

Re: per-interface packet filters [summary]

2004-12-15 Thread Kelly Yancey
On Tue, 14 Dec 2004, Gleb Smirnoff wrote: > On Tue, Dec 14, 2004 at 01:47:35PM +0100, Andre Oppermann wrote: > A> > Implementationwise, the kernel side is evidently trivial as the > A> > original code already supports the idea of multiple chains. All > A> > you need is to extend the struct ifnet

Re: Load Balancing

2004-12-15 Thread Elton Machado
NiY wrote: Greetings! I have yet to find a definitive answer on this subject, so I was hoping someone would let me know the official way to go about this, or if it's even possible. We have two ADSL services coming into out building. We would like to use them both on one network, using a multi-home

bge (BCM5751) maxes out at 620Mb/s TX?

2004-12-15 Thread Aleksandr Milewski
Having pulled in some updates from HEAD to get the BCM5751 working, I am now stuck at a maximum transmit rate of about 620Mb/s. Receive works fine, I can receive at about 950Mb/s, but transmit seems limited. Same hardware (same box) under Linux does 950Mb/s each way, no problem. This is with i

OpenNMS and RELENG_5_3

2004-12-15 Thread Ryan Sommers
Has anyone been able to get OpenNMS/java/et al. to work together on 5.3? The last mention of it I see on the lists is almost 2 years old, has anyone been able to get it working (or not) since then? Just wondering if it's worth my time to attempt it. -- Ryan Sommers [EMAIL PROTECTED] ___

NAT works but port redirection does not work on IPNAT and PF

2004-12-15 Thread Zeno Lee
It seems I've somehow didn't set up my freebsd gateway properly. I am trying to use my FreeBSD server as a NAT with port redirection. NAT works fine, but when I use port redirection to redirect requests from my external interface em0 160.79.174.98:80 the request makes it to my internal web se

Re: Trouble making NFS work with Mac OS X

2004-12-15 Thread Jon Noack
Michael Hopkins, Hopkins Research wrote: > I keep reading that Mac OS X is very easy to get working other machines > using open standards. This is not my current experience after two > fruitless days messing about with NFS, but I am no network expert so maybe > I am missing something really obviou

Re: NAT works but port redirection does not work on IPNAT and PF

2004-12-15 Thread Nickolay A. Kritsky
Hello Zeno, Check your default gateway on 192.168.1.54. It seems to be 192.168.1.1 instead of 192.168.168.55: 12:51:57.118967 arp who-has 192.168.1.1 tell 192.168.1.54 Wednesday, December 15, 2004, 9:10:21 PM, Zeno Lee wrote: ZL> It seems I've somehow didn't set up my freebsd gateway properly.

Trouble making NFS work with Mac OS X

2004-12-15 Thread Michael Hopkins, Hopkins Research
Hi all I keep reading that Mac OS X is very easy to get working other machines using open standards. This is not my current experience after two fruitless days messing about with NFS, but I am no network expert so maybe I am missing something really obvious - or maybe it's the FreeBSD box that i

Re: per-interface packet filters, design approach

2004-12-15 Thread Andre Oppermann
Gleb Smirnoff wrote: > > On Wed, Dec 15, 2004 at 12:04:12PM +0100, Andre Oppermann wrote: > A> > On Tue, Dec 14, 2004 at 03:03:27PM +0100, Andre Oppermann wrote: > A> > A> d1. The PFIL_HOOKS API has one hook per direction per protocol and > A> > A> passes the interface information to the fir

Re: per-interface packet filters

2004-12-15 Thread Andre Oppermann
Gleb Smirnoff wrote: > > On Wed, Dec 15, 2004 at 11:50:55AM +0100, Andre Oppermann wrote: > A> First you change the way pfil_hooks is used in a multiprotocol incompatible > A> way. Lets have a look at ip_input(): > A> > A> pfil_run_hooks(&inet_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN, NULL); >

Re: per-interface packet filters, design approach

2004-12-15 Thread Gleb Smirnoff
On Wed, Dec 15, 2004 at 12:04:12PM +0100, Andre Oppermann wrote: A> > On Tue, Dec 14, 2004 at 03:03:27PM +0100, Andre Oppermann wrote: A> > A> d1. The PFIL_HOOKS API has one hook per direction per protocol and A> > A> passes the interface information to the firewall package. A> > A> d2. Shou

Quick question about the tired ipf/ipnat/"dmz"/bridge scenario

2004-12-15 Thread Andrew Heyn
Hi, Quoting http://www.moatware.com/support/docbook/faq-bridge.html, 10.8. Why can't hosts on a NATed interface talk to hosts on a bridged interface? This frequently happens when someone wants to bridge an interface to their WAN to use it as a DMZ, and wants to put all of the hosts on their LAN

Re: per-interface packet filters

2004-12-15 Thread Luigi Rizzo
On Wed, Dec 15, 2004 at 02:57:09PM +0300, Gleb Smirnoff wrote: > On Wed, Dec 15, 2004 at 11:50:55AM +0100, Andre Oppermann wrote: ... > A> Secondly the stuct ifnet would have to be extended with a pfil_head pointer > A> for every protocol family in the system. This would be non-dynamic and > A> wo

Re: per-interface packet filters

2004-12-15 Thread Gleb Smirnoff
On Wed, Dec 15, 2004 at 11:50:55AM +0100, Andre Oppermann wrote: A> First you change the way pfil_hooks is used in a multiprotocol incompatible A> way. Lets have a look at ip_input(): A> A> pfil_run_hooks(&inet_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN, NULL); A> ^^

Re: per-interface packet filters, design approach

2004-12-15 Thread Andre Oppermann
Gleb Smirnoff wrote: > > On Tue, Dec 14, 2004 at 03:03:27PM +0100, Andre Oppermann wrote: > A> d1. The PFIL_HOOKS API has one hook per direction per protocol and > A> passes the interface information to the firewall package. > A> d2. Should the PFIL_HOOKS API be changed and be per interface

Re: per-interface packet filters [summary]

2004-12-15 Thread Andre Oppermann
Gleb Smirnoff wrote: > > On Tue, Dec 14, 2004 at 01:12:31PM -0500, James wrote: > J> The way we have approached this in the past is to install /32 host routes > J> for each interface addr's and respective subnet and broadcast /32 addresses > J> into the kernel RIB, destined to lo0 interface. Place

Re: per-interface packet filters

2004-12-15 Thread Andre Oppermann
Gleb Smirnoff wrote: > > On Tue, Dec 14, 2004 at 04:02:37PM +0100, Andre Oppermann wrote: > A> > Ÿ ??, 14/12/2004 ? 13:54 +0100, Andre Oppermann ?: > A> > > It's about HOW to implement it. I think the ways proposed so far are > A> > > hackish, too complex and outside of our framework which wa

Re: Marvell 88E8001 on sk0 and RELENG_5_3 - big problems

2004-12-15 Thread Michal Belczyk
On Tue, Dec 14, 2004 at 11:00:40PM +0100, Heinz Knocke wrote: > b) according to the vendor's info, NIC should be able to do jumboframes. > (http://www.marvell.com/products/pcconn/yukon/Yukon_88E8001_10_073103_final.pdf) > > ifconfig mtu 9000 works, but packets seems to come truncated (in both >

Re: per-interface packet filters [summary]

2004-12-15 Thread James
On Wed, Dec 15, 2004 at 12:13:29PM +0300, Gleb Smirnoff wrote: > On Wed, Dec 15, 2004 at 03:49:09AM -0500, James wrote: > J> On Wed, Dec 15, 2004 at 11:45:40AM +0300, Gleb Smirnoff wrote: > J> > On Tue, Dec 14, 2004 at 01:12:31PM -0500, James wrote: > J> > J> The way we have approached this in the

Re: per-interface packet filters [summary]

2004-12-15 Thread Gleb Smirnoff
On Tue, Dec 14, 2004 at 01:12:31PM -0500, James wrote: J> The way we have approached this in the past is to install /32 host routes J> for each interface addr's and respective subnet and broadcast /32 addresses J> into the kernel RIB, destined to lo0 interface. Place your per-interface J> filter on

Re: TCP/IP over USB

2004-12-15 Thread Sangwoo Shim
FYI, I've talked to YOPY PDA(also StrongArm-based linux PDA) using udbp + ng_eiface (with minor hack, namely, add DEVICE/VENDOR ID.) This combination seems to be compatible with linux's usbnet implementation. But I've told Zaurus doesn't use standard arm linux kernel.. I think you should hack ng_ei

Re: per-interface packet filters [summary]

2004-12-15 Thread Gleb Smirnoff
On Wed, Dec 15, 2004 at 03:49:09AM -0500, James wrote: J> On Wed, Dec 15, 2004 at 11:45:40AM +0300, Gleb Smirnoff wrote: J> > On Tue, Dec 14, 2004 at 01:12:31PM -0500, James wrote: J> > J> The way we have approached this in the past is to install /32 host routes J> > J> for each interface addr's a

Re: per-interface packet filters, design approach

2004-12-15 Thread Gleb Smirnoff
On Tue, Dec 14, 2004 at 03:03:27PM +0100, Andre Oppermann wrote: A> d1. The PFIL_HOOKS API has one hook per direction per protocol and A> passes the interface information to the firewall package. A> d2. Should the PFIL_HOOKS API be changed and be per interface instead A> of per protocol

Re: per-interface packet filters

2004-12-15 Thread James
On Wed, Dec 15, 2004 at 11:18:10AM +0300, Gleb Smirnoff wrote: [ snip ] > > Sorry, but the short answer is "same was as in Cisco|Juniper world". The > longer > description is: > > The cloner will. If this was sysadmin with ifconfig in his hands, then he > will attach chains to interface. The sa

Re: per-interface packet filters [summary]

2004-12-15 Thread James
On Wed, Dec 15, 2004 at 11:45:40AM +0300, Gleb Smirnoff wrote: > On Tue, Dec 14, 2004 at 01:12:31PM -0500, James wrote: > J> The way we have approached this in the past is to install /32 host routes > J> for each interface addr's and respective subnet and broadcast /32 addresses > J> into the kerne

Re: per-interface packet filters

2004-12-15 Thread Gleb Smirnoff
On Tue, Dec 14, 2004 at 04:02:37PM +0100, Andre Oppermann wrote: A> > ÷ ??, 14/12/2004 ? 13:54 +0100, Andre Oppermann ?: A> > > It's about HOW to implement it. I think the ways proposed so far are A> > > hackish, too complex and outside of our framework which was very well A> > > designed and