November 2003 - Darwin-kernel

Re: status (plans?) of latest *BDS's ipfw2 for OSX/Darwin kernel?
by Jeff Nathan 23 Nov '03

23 Nov '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenBSD's (Danielt Hartmeier's) pf is really quite neat. Loadable kernel modules aside (yeah yeah, I know the old argument that securelevel is a one-way spinlock, and we've seen the exploits that disprove that), it's well-implemented piece of software. Some of the finer points that really make it nice are the scrubbing features (dealing with duplicate IP fragments with overlapping data), the ability to compensate for weak TCP ISNs when acting as a NATting system, queueing, anchor points for externally generated rules, useful counters.... Rather than go on with glittering generalities, I think I'd like to familiarize myself better with ipfw2 (I haven't looked at it at all, to be honest). Hartmeier's pf has some support for sharing nat and filter states among systems (though I'm not sure how advanced this is at the moment. I think it uses a pseudo device). It can operate in a routing fashion or in a bridging fashion too which is quite handy. Just like Darren Reid's ipf, Hartmeier's pf uses a configuration file (using a yacc parser), as opposed to the ipfw/iptables/ipchains method of using the binary for all configuration -- yes, I've seen the iptables restore format and it's a lot closer to making it maintainable. - -Jeff P.S. I sent in a kernel patch to this list a few days ago and never saw it make the list, is anyone else having problems sending messages to the list? P.P.S. I submitted the same patch to Apple's patch form and actually received a bounce! (The submission page is a web form). On Nov 22, 2003, at 9:06 PM, OpenMacNews wrote: then again, its seems that i spoke (somewhat) too soon ... looks like OpenBSD's "pf" has been ported to FreeBSD 5.x (<http://pf4freebsd.love2party.net/>) as a lodable kernel module. what implications that has for Darwin, i honestly don't know ... comments/thoughts anyone? richard On a related note, is there any interest in exploring the potential benefits of Daniel Hartmeier's pf or Darren Reid's ipf? - -Jeff On Nov 22, 2003, at 5:53 PM, OpenMacNews wrote: hi all, what plans/progress exist for updating Darwin's "ipfw" to "ipfw2"? having moved from a FreeBSD box to a Mac, there are several features missing from ipfw that i'm having to work around ... in particular, the assignment/use of rule sets and the ability to assign boolean concatenations of IP ranges to a variable, then use the variable in a rule. or, there's always the possibility that i'm missing an already existing feature set in current Darwin .... if it exists, a friendly pointer to it would be much appreciated! thanks, richard _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. - -- The most technical single-track security conference in the West. Vancouver B.C., Canada April, 2004 http://cansecwest.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (Darwin) iD8DBQE/wBj7Eqr8+Gkj0/0RArxzAKCxqSjOebVuU5sEZL+xODuHELnwHwCeKleI QZ3F7vZet0+VfirJ9ajG3Jc= =Cg3p -----END PGP SIGNATURE----- _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: status (plans?) of latest *BDS's ipfw2 for OSX/Darwin kernel?
by OpenMacNews 23 Nov '03

23 Nov '03

then again, its seems that i spoke (somewhat) too soon ... looks like OpenBSD's "pf" has been ported to FreeBSD 5.x (<http://pf4freebsd.love2party.net/>) as a lodable kernel module. what implications that has for Darwin, i honestly don't know ... comments/thoughts anyone? richard On a related note, is there any interest in exploring the potential benefits of Daniel Hartmeier's pf or Darren Reid's ipf? - -Jeff On Nov 22, 2003, at 5:53 PM, OpenMacNews wrote: hi all, what plans/progress exist for updating Darwin's "ipfw" to "ipfw2"? having moved from a FreeBSD box to a Mac, there are several features missing from ipfw that i'm having to work around ... in particular, the assignment/use of rule sets and the ability to assign boolean concatenations of IP ranges to a variable, then use the variable in a rule. or, there's always the possibility that i'm missing an already existing feature set in current Darwin .... if it exists, a friendly pointer to it would be much appreciated! thanks, richard _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: kernel related MPI problem?
by Paul Ripke 23 Nov '03

23 Nov '03

On Sunday, Nov 23, 2003, at 06:38 Australia/Sydney, Jonas Maebe wrote: On 22 nov 2003, at 09:14, Paul Ripke wrote: Well, they (ipcs, ipcrm) do exist, because I needed them a while back :) Google for: darwin ipcs ipcrm and you should find them on my site. The 10.2 ones seem to work fine on 10.3. Thanks, worked fine indeed (although my mother always told me never to run binaries from strangers with root privileges!) Yah, my bad. I actually subscribe to that philosophy myself. Have had great fun with auditors at work refusing to run their shell scripts as root... I'll put the source up as soon as I can find out where I've archived it... Cheers, -- Paul Ripke Unix/OpenVMS/TSM/DBA I love deadlines. I like the whooshing sound they make as they fly by. -- Douglas Adams _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: status (plans?) of latest *BDS's ipfw2 for OSX/Darwin kernel?
by Jeff Nathan 22 Nov '03

22 Nov '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On a related note, is there any interest in exploring the potential benefits of Daniel Hartmeier's pf or Darren Reid's ipf? - -Jeff On Nov 22, 2003, at 5:53 PM, OpenMacNews wrote: hi all, what plans/progress exist for updating Darwin's "ipfw" to "ipfw2"? having moved from a FreeBSD box to a Mac, there are several features missing from ipfw that i'm having to work around ... in particular, the assignment/use of rule sets and the ability to assign boolean concatenations of IP ranges to a variable, then use the variable in a rule. or, there's always the possibility that i'm missing an already existing feature set in current Darwin .... if it exists, a friendly pointer to it would be much appreciated! thanks, richard _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. - -- http://cerberus.sourcefire.com/~jeff (gpg/pgp key id 6923D3FD) "Common sense is the collection of prejudices acquired by age eighteen." - Albert Einstein -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (Darwin) iD8DBQE/v+rLEqr8+Gkj0/0RAnteAKCxKffLkHuA3m1+xZ7gg3wPTgOQHACfVFMv LHsiTqgzRkTX87k8r+PlcYM= =YajN -----END PGP SIGNATURE----- _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

status (plans?) of latest *BDS's ipfw2 for OSX/Darwin kernel?
by OpenMacNews 22 Nov '03

22 Nov '03

hi all, what plans/progress exist for updating Darwin's "ipfw" to "ipfw2"? having moved from a FreeBSD box to a Mac, there are several features missing from ipfw that i'm having to work around ... in particular, the assignment/use of rule sets and the ability to assign boolean concatenations of IP ranges to a variable, then use the variable in a rule. or, there's always the possibility that i'm missing an already existing feature set in current Darwin .... if it exists, a friendly pointer to it would be much appreciated! thanks, richard _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: kernel related MPI problem?
by Jonas Maebe 22 Nov '03

22 Nov '03

On 22 nov 2003, at 09:14, Paul Ripke wrote: Well, they (ipcs, ipcrm) do exist, because I needed them a while back :) Google for: darwin ipcs ipcrm and you should find them on my site. The 10.2 ones seem to work fine on 10.3. Thanks, worked fine indeed (although my mother always told me never to run binaries from strangers with root privileges!) Jonas _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: getsockname(.....) not working
by Matt Jaffa 22 Nov '03

22 Nov '03

Ok, I have looked at socket.h and i think I saw sys_socket.h, But I still don't know what I am looking for to be able to decipher the socket identifier, So a little more help would be great. Thanks On Nov 21, 2003, at 4:56 PM, Justin Walker wrote: On Friday, November 21, 2003, at 03:26 PM, Matt Jaffa wrote: Hi, I am developing a kernel Extension and right now I have the socket.h file included in my KEXT but it wont let me use getsockname function found in socket.h any reasons for this? It says it can't find the identifier. What is the 'it' that says it can't find the identifier? It's easier to help if know what actually went wrong, and what the error messages are. The identifier 'getsockname' is currently exported by the kernel (but, as discussed on this list earlier, you can't bank on that being true for long). in that call it gives you the integer socket identifier and I am trying to get who sent the sendto command and also what protocol and any ports it wants to use, etc. This call won't give you that information. All the call gets you is the local address of the socket. You need the 'socket' structure, which you get from the file descriptor (see bsd/kern/sys_socket.h to see how to do this). Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | Some people have a mental | horizon of radius zero, and | call it their point of view. | -- David Hilbert *-------------------------------------- *-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: kernel related MPI problem?
by Jonas Maebe 22 Nov '03

22 Nov '03

On 22-nov-03, at 01:09, Paul Ripke wrote: Worked fine for me on 10.2.7 and 10.3. Remember: - those shm segments are persistent. They'll have to be manually deleted. Worked fine for me under 10.3 as well, but how do you delete them manually under Darwin/Mac OS X? Under Linux, you use ipcs, but that tool doesn't exist under Mac OS X. Jonas _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: kernel related MPI problem?
by Paul Ripke 22 Nov '03

22 Nov '03

On Friday, Nov 21, 2003, at 20:56 Australia/Sydney, Peter Klaver wrote: Hi everyone, A collegue in my lab, knowledgeable in unix but not specifically in Darwin, wants to run MPI code on a dual G5, but there some problems when using the smp-compiled libraries (-comm=share). He suspects it's a kernel-related matter, see below. From his description, can anyone see if this is indeed the case? If anyone on this list happens to have smp-MPI running ok, then any other relevant info is of course also much welcomed. kind greets, Peter Shared memory problem. During testing the smp-MPICH software the following error occurs: P4xxxxx shmget error -1 This looks like a shmget error. Testing the operating system with: sysctl -a |grep sysv kern.sysv.shmmax: 4194304 kern.sysv.shmmin: 1 kern.sysv.shmmni: 32 kern.sysv.shmseg: 8 kern.sysv.shmall: 1024 Looks allright to me. I have tested the shmget call by the following C-program. #include <sys/types.h> #include <sys/ipc.h> #include <sys/shm.h> int main() { key_t key; int size; int shmflg; int shmid; size = 100; key = IPC_PRIVATE; shmflg = IPC_CREAT & IPC_EXCL & (7+7*8+7*64); shmflg = shmflg&IPC_CREAT; Don't you really mean: shmflg = IPC_CREAT | IPC_EXCL | 0777; Do you? shmid=shmget(key, size, shmflg); printf("result %d/ \n",shmid); return 1; } It always returns -1. Runnig the C-program on other (non G5) platforms returns a normal shmid. my hardware platform is dual-G5 my OS version is 10.3 or 10.2.8, similar problems on both. Worked fine for me on 10.2.7 and 10.3. Remember: - those shm segments are persistent. They'll have to be manually deleted. - there's only 4 MB available. - you might have run out of space! - you're really better off using mmap(2) under Darwin. Cheers, -- Paul Ripke Unix/OpenVMS/TSM/DBA I love deadlines. I like the whooshing sound they make as they fly by. -- Douglas Adams _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: getsockname(.....) not working
by Justin Walker 21 Nov '03

21 Nov '03

On Friday, November 21, 2003, at 03:26 PM, Matt Jaffa wrote: Hi, I am developing a kernel Extension and right now I have the socket.h file included in my KEXT but it wont let me use getsockname function found in socket.h any reasons for this? It says it can't find the identifier. What is the 'it' that says it can't find the identifier? It's easier to help if know what actually went wrong, and what the error messages are. The identifier 'getsockname' is currently exported by the kernel (but, as discussed on this list earlier, you can't bank on that being true for long). in that call it gives you the integer socket identifier and I am trying to get who sent the sendto command and also what protocol and any ports it wants to use, etc. This call won't give you that information. All the call gets you is the local address of the socket. You need the 'socket' structure, which you get from the file descriptor (see bsd/kern/sys_socket.h to see how to do this). Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | Some people have a mental | horizon of radius zero, and | call it their point of view. | -- David Hilbert *--------------------------------------*-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0