Alexander Nasonov's shared items

Tuesday, June 19, 2007

Redundant firewalls with OpenBSD, CARP and pfsync

I finally found a good description of redundant network configuration here. Too bad I can't apply it in practice.

Wednesday, May 30, 2007

Smashing The Kernel Stack For Fun And Profit

After reading the great Firewall Spotting with broken CRC I continued reading Phrack #60.
Surprisenly, there is another OpenBSD article Smashing The Kernel Stack For Fun And Profit.
I enjoyed it even more.

Interesting OpenBSD commits

http://www.undeadly.org/cgi?action=article&sid=20070528213858 Especially this comment:
> Check protocol (TCP/UDP/ICMP/ICMP6) checksums of all incoming packets,
> and drop packets with invalid checksums. Without such a check, pf would
> return RST/ICMP errors even for packets with invalid checksums, which
> could be used to detect the presence of the firewall, reported by
> "Ed White" in http://www.phrack.org/phrack/60/p60-0x0c.txt.
The link above is broken, please go to http://www.phrack.org/issues.html?issue=60&id=12#article, very intersting reading.

Wednesday, May 02, 2007

Switching to modular-xorg and xfce4

I changed X11_TYPE to "modular" and added the following packages to my pkgchk.conf file:

x11/modular-xorg-server
x11/xf86-input-keyboard
x11/xf86-input-mouse
x11/xf86-video-ati
x11/xinit
x11/xterm
x11/xauth
x11/iceauth
meta-pkgs/modular-xorg-fonts
wm/ratpoison

All packages builds fine under FreeBSD, OpenBSD and Linux with a simple command:

pkg_chk -u -a

meta-pkgs/xfce4 builds without problems on Linux and FreeBSD too.

OpenBSD is a bit tricky. You should apply pkg/36346 OpenBSD patches for sysutills/fam.

Please add LOCALPATCHES pointing to an empty directory to your mk.conf, create $LOCALPATCHES/sysutils/fam/ directory and add copy patches to $LOCALPATCHES/sysutils/fam/mntent_compat.c++.patch and $LOCALPATCHES/sysutils/fam/IMonKQueue.c++.patch files respectively.

Update:

also add the patch below to $LOCALPATCHES/devel/glib2/localcharset.c.patch file
--- glib/libcharset/localcharset.c.pkgsrc       Sat May 12 21:37:52 2007
+++ glib/libcharset/localcharset.c      Sat May 12 21:41:30 2007
@@ -256,6 +256,10 @@
 
   /* Most systems support nl_langinfo (CODESET) nowadays.  */
   codeset = nl_langinfo (CODESET);
+#if defined(__OpenBSD__)
+  if(strcmp(codeset, "646") == 0)
+      codeset = "ASCII";
+#endif
 
 # else
 

Friday, April 20, 2007

[boost] Announce: scope_exit version 0.03

Version 0.03 is available for download at http://tinyurl.com/yps8zs

You can read documentation online: http://194.6.223.221/~nasonov/scope_exit-0.03/libs/scope_exit/doc/html/

What's new in this version:

- Based on simpler 0.01 interface but with a better implementation - Found a problem on MSVC. It doesn't link when a block in a header file is included by more than one cpp file. I tried __declspec(selectany) and __forceinline. - Added experimental BOOST_SCOPE_EXIT_FASTER_IMPL. See documentation for details.

I'd like to remind you that nobody volunteered to be a review manager yet.

Thursday, March 15, 2007

I thought I found a bug in OpenBSD ...

... but someone else found that bug a bit earlier. I spent a funny evening tracking it down to the same lines as in the fix.

Sunday, February 25, 2007

How to run print/acroread7 on FreeBSD 6.2

This instruction explains how to install and run print/acroread7 on FreeBSD 6.2 using pkgsrc. Before you start, please check that it's still broken. I hope it'll be fixed soon after my post and you would only need to follow configuration of /compat/linux.

  1. Go to emulators/suse100_base and suppress an execution of /dev/MAKEDEV - this file doesn't exist (/dev is devfs mount point on FreeBSD 6.2)
  2. % cvs diff -u Makefile
    Index: Makefile
    ===================================================================
    RCS file: /cvsroot/pkgsrc/emulators/suse100_base/Makefile,v
    retrieving revision 1.7
    diff -u -r1.7 Makefile
    --- Makefile    22 Feb 2007 19:26:27 -0000      1.7
    +++ Makefile    25 Feb 2007 18:38:10 -0000
    @@ -53,8 +53,8 @@
              ${INSTALL_SCRIPT} $$FILE ${PREFIX}/sbin/`basename $$FILE .sh`; \
            done
            ${INSTALL_DATA_DIR} ${EMULDIR}/dev
    -       ${INSTALL_DATA} /dev/MAKEDEV ${EMULDIR}/dev
    -       cd ${EMULDIR}/dev && ${SH} ./MAKEDEV  std audio
    +#      ${INSTALL_DATA} /dev/MAKEDEV ${EMULDIR}/dev
    +#      cd ${EMULDIR}/dev && ${SH} ./MAKEDEV  std audio
            cd ${EMULDIR}/dev && ${LN} -fs sound dsp
            @${CP} ${PKGDIR}/PLIST ${PLIST_SRC}
            ${RPM2PKG} ${RPM2PKGARGS}
  3. Go to print/acroread7 and patch Makefile.
  4. % cvs diff -u Makefile
    Index: Makefile
    ===================================================================
    RCS file: /cvsroot/pkgsrc/print/acroread7/Makefile,v
    retrieving revision 1.17
    diff -u -r1.17 Makefile
    --- Makefile    11 Jan 2007 11:52:17 -0000      1.17
    +++ Makefile    25 Feb 2007 19:29:36 -0000
    @@ -32,7 +32,7 @@
     # Default (overridden below)
     PLATFORM=      unknown
     
    -.if ${OPSYS} == "NetBSD" || ${OPSYS} == "DragonFly"
    +.if ${OPSYS} == "NetBSD" || ${OPSYS} == "DragonFly" || ${OPSYS} == "FreeBSD"
     . if (${MACHINE_ARCH} == "i386")
     DEPENDS+=      suse_gtk2>=10.0:../../emulators/${SUSE_DIR_PREFIX}_gtk2
     DEPENDS+=      suse_libcups>=10.0:../../emulators/${SUSE_DIR_PREFIX}_libcups
  5. Run bmake with properly set $BRANDELF. For some reason, this variable is not set when building suse100_base and it would break an installation of that package.
  6. % env BRANDELF=brandelf bmake
  7. Run
  8. % sed -i '' -e 's/\(NetBSD | DragonFly\)/\1 | FreeBSD/' work/AdobeReader/INSTALL
  9. Install acroread7
  10. % bmake install
  11. Run as root
  12. # sed -i '' -e 's/\(NetBSD | DragonFly\)/\1 | FreeBSD/' /usr/pkg/bin/acroread7
  13. Set LD_LIBRARY_PATH to
  14. LD_LIBRARY_PATH=/usr/pkg/emul/linux/usr/lib/:/usr/pkg/emul/linux/opt/gnome/lib:/usr/pkg/Acrobat7/Reader/intellinux/lib

When I completed these steps, I was able to run /usr/pkg/bin/acroread7 but later I removed packages installed from ports and I couldn't run the program anymore. To fix this, I replaced FreeBSD linux compatibility directory with pkgsrc linux emulator and regenerated gdk-pixbuf.loaders:

# mv /compat/linux /compat/linux.freebsd
# ln -s /usr/pkg/emul/linux /compat/linux
# /usr/pkg/emul/linux/opt/gnome/bin/gdk-pixbuf-query-loaders > /usr/pkg/emul/linux/etc/opt/gnome/gtk-2.0/gdk-pixbuf.loaders

This method proves that suse100 linux emulator works on FreeBSD but since it could "interfere" in a bad way with FreeBSD update procedure I went another route:

# ln -s /usr/pkg/emul/linux/opt/gnome /compat/linux/opt/gnome
# ln -s /usr/pkg/emul/linux/etc/opt/gnome /compat/linux/etc/opt/gnome
# ln -s /usr/pkg/emul/linux/opt/gnome/lib/pango /compat/linux/usr/lib/pango

You can always find these three foreign links with the find command:

% find /compat/linux -type l | xargs file | grep pkg
/compat/linux/etc/opt/gnome:                               symbolic link to `/usr/pkg/emul/linux/etc/opt/gnome'
/compat/linux/usr/lib/pango:                               symbolic link to `/usr/pkg/emul/linux/opt/gnome/lib/pango'
/compat/linux/opt/gnome:                                   symbolic link to `/usr/pkg/emul/linux/opt/gnome'

UPDATE: I thought that /compat/linux belongs to FreeBSD base system but it has been installed from linux_base port. So I can easily remove it and use suse100_base from pkgsrc. Another cool idea is to mount a real Linux to /compat/linux as described here.