C unit tests seen by OpenBSD developpers

2006-10-14 Thread Bruno Carnazzi

  Hi misc,

I'm currently learning C. In many languages, you hear lots of stuff
likes 'unit testing', 'refactoring', 'agile  programming' and
others... It seems that these techniques are not very present in C
programming (whereas check framework is in packages, it seems too
complex) Looking quickly at the OpenBSD's CVS, I found no unit test. I
won't debate on the merit or cost of this approach, and I'm not really
fond of it (add not-so-usefull complexity) but I'm just curious to
know why OpenBSD developpers choose to not use this technique for
userland tools (for kernel, it's obvious :).

Best regards,

Bruno.



Re: C unit tests seen by OpenBSD developpers

2006-10-14 Thread Otto Moerbeek
On Sat, 14 Oct 2006, Bruno Carnazzi wrote:

   Hi misc,
 
 I'm currently learning C. In many languages, you hear lots of stuff
 likes 'unit testing', 'refactoring', 'agile  programming' and
 others... It seems that these techniques are not very present in C

These techniques (minus the hype factor) are feasable in any language.

 programming (whereas check framework is in packages, it seems too
 complex) Looking quickly at the OpenBSD's CVS, I found no unit test. I
 won't debate on the merit or cost of this approach, and I'm not really
 fond of it (add not-so-usefull complexity) but I'm just curious to
 know why OpenBSD developpers choose to not use this technique for
 userland tools (for kernel, it's obvious :).

You did not look hard enough. We have a lot of tests in src/regress.
Both to test userland stuff as well as system calls.

-Otto



Soekris network problems - 48 hour deadline

2006-10-14 Thread Richard P. Koett
I'm having throughput problems using a Soekris net4801 as a firewall
running OpenBSD 3.9. This is replacing a SonicWALL device that was
working fine from the user's perspective. (I want to replace it because,
among other things, I abhor SonicWALL's licensing). I won't post a
dmesg unless requested because I think this platform is pretty well
known. Hosts on the internal network are able to access the Internet
but report that access seems slow. Some operations fail consistently.
For example, users can send and receive e-mail e-mails but can't send
e-mail with attachments larger than about 20K. I ran a browser-based
ADSL speed test from an internal host and found download speeds to
be quite good but upload tests fail to complete.

I found a few similar problems in the archives but the posted solutions
haven't worked for me. I can't see that pf is blocking anything I want
passed. At the moment I am running a stripped down pf.conf as follows:

# DECLARATIONS:
Ext_If=sis0
Int_If=sis1
DMZ_If=sis2
Int_Net=192.168.5.0/24

# OPTIONS:
set loginterface $Ext_If

# NAT / REDIRECTION:
nat on $Ext_If from $Int_Net to any - ($Ext_If)
rdr on $Ext_If inet proto tcp from any to ($Ext_If) port 3391 \
- 192.168.5.1 port 3391
rdr on $Ext_If inet proto tcp from any to ($Ext_If) port 3392 \
- 192.168.5.2 port 3392

I think I can rule out things like speed and duplex problems between the
Soekris and the local switch because the problem only affects outbound
traffic. I tried a few scrub options to no avail but may not have been doing
the right thing. I would really appreciate any suggestions on how to
troubleshoot this. If I can't get this resolved by Monday morning I'm going
to take some heat.

Thanks,
RPK.



Re: Soekris network problems - 48 hour deadline

2006-10-14 Thread Matthew Closson

On Sat, 14 Oct 2006, Richard P. Koett wrote:


I'm having throughput problems using a Soekris net4801 as a firewall
running OpenBSD 3.9. This is replacing a SonicWALL device that was
working fine from the user's perspective. (I want to replace it because,
among other things, I abhor SonicWALL's licensing). I won't post a
dmesg unless requested because I think this platform is pretty well
known. Hosts on the internal network are able to access the Internet
but report that access seems slow. Some operations fail consistently.
For example, users can send and receive e-mail e-mails but can't send
e-mail with attachments larger than about 20K. I ran a browser-based
ADSL speed test from an internal host and found download speeds to
be quite good but upload tests fail to complete.

I found a few similar problems in the archives but the posted solutions
haven't worked for me. I can't see that pf is blocking anything I want
passed. At the moment I am running a stripped down pf.conf as follows:

# DECLARATIONS:
Ext_If=sis0
Int_If=sis1
DMZ_If=sis2
Int_Net=192.168.5.0/24

# OPTIONS:
set loginterface $Ext_If

# NAT / REDIRECTION:
nat on $Ext_If from $Int_Net to any - ($Ext_If)
rdr on $Ext_If inet proto tcp from any to ($Ext_If) port 3391 \
   - 192.168.5.1 port 3391
rdr on $Ext_If inet proto tcp from any to ($Ext_If) port 3392 \
   - 192.168.5.2 port 3392

I think I can rule out things like speed and duplex problems between the
Soekris and the local switch because the problem only affects outbound
traffic. I tried a few scrub options to no avail but may not have been doing
the right thing. I would really appreciate any suggestions on how to
troubleshoot this. If I can't get this resolved by Monday morning I'm going
to take some heat.

Thanks,
RPK.


What kind of link is sis0 on?  Do you know what your interface MTU was set 
to on the SonicWall?


-Matt-



Undeadly not responding

2006-10-14 Thread Daniel Ouellet

What's up with undeadly.org.

It's dying at:

cat6509-vlan300.edm.tera-byte.com (66.244.192.42)
* * *



Re: Undeadly not responding

2006-10-14 Thread Marc Balmer
* Daniel Ouellet wrote:

 What's up with undeadly.org.

It's down for maintenance, that's up.



Re: Soekris network problems - 48 hour deadline

2006-10-14 Thread Adriaan

On 10/14/06, Richard P. Koett [EMAIL PROTECTED] wrote:

I'm having throughput problems using a Soekris net4801 as a firewall
running OpenBSD 3.9. This is replacing a SonicWALL device that was
working fine from the user's perspective. (I want to replace it because,
among other things, I abhor SonicWALL's licensing). I won't post a
dmesg unless requested because I think this platform is pretty well
known. Hosts on the internal network are able to access the Internet
but report that access seems slow. Some operations fail consistently.
For example, users can send and receive e-mail e-mails but can't send
e-mail with attachments larger than about 20K. I ran a browser-based
ADSL speed test from an internal host and found download speeds to
be quite good but upload tests fail to complete.

I found a few similar problems in the archives but the posted solutions
haven't worked for me. I can't see that pf is blocking anything I want
passed. At the moment I am running a stripped down pf.conf as follows:

# DECLARATIONS:
Ext_If=sis0
Int_If=sis1
DMZ_If=sis2
Int_Net=192.168.5.0/24

# OPTIONS:
set loginterface $Ext_If

# NAT / REDIRECTION:
nat on $Ext_If from $Int_Net to any - ($Ext_If)
rdr on $Ext_If inet proto tcp from any to ($Ext_If) port 3391 \
- 192.168.5.1 port 3391
rdr on $Ext_If inet proto tcp from any to ($Ext_If) port 3392 \
- 192.168.5.2 port 3392

I think I can rule out things like speed and duplex problems between the
Soekris and the local switch because the problem only affects outbound
traffic. I tried a few scrub options to no avail but may not have been doing
the right thing. I would really appreciate any suggestions on how to
troubleshoot this. If I can't get this resolved by Monday morning I'm going
to take some heat.



Do netstat -in,  netstat -s or netstat -ss give any clues?



Re: armish fdisk/disklabel free sectors

2006-10-14 Thread Stuart Henderson
On 2006/10/13 19:37, Theo de Raadt wrote:
  Speaking of zaurus -- any way to get a com0 on this thing?
 
 You have to buy the special Zaurus adapter for this.  It is a little
 bit hard to find.  If you do so, you can even use it as a serial
 console.

Sharp ce-170ts (try amazon), there is another one (serialio zslimcable)
which fits the socket but is not suitable for use with sl-c3xxx.



Re: Soekris network problems - 48 hour deadline

2006-10-14 Thread Stuart Henderson
On 2006/10/14 00:56, Richard P. Koett wrote:
 known. Hosts on the internal network are able to access the Internet
 but report that access seems slow. Some operations fail consistently.
 For example, users can send and receive e-mail e-mails but can't send
 e-mail with attachments larger than about 20K. I ran a browser-based
 ADSL speed test from an internal host and found download speeds to
 be quite good but upload tests fail to complete.

 I tried a few scrub options to no avail

which ones, did you try the max-mss I suggested? if 1440 is no good try
a bit lower. it sounds very likely that you have MTU problems and max-mss
will workaround that (at least for TCP).



Re: Soekris network problems - 48 hour deadline

2006-10-14 Thread Richard P. Koett
Matthew Closson wrote:
 On Sat, 14 Oct 2006, Richard P. Koett wrote:
 
 I'm having throughput problems using a Soekris net4801 as a firewall
 running OpenBSD 3.9. This is replacing a SonicWALL device that was
 working fine from the user's perspective. (I want to replace it
 because, among other things, I abhor SonicWALL's licensing). I won't
 post a 
 dmesg unless requested because I think this platform is pretty well
 known. Hosts on the internal network are able to access the Internet
 but report that access seems slow. Some operations fail consistently.
 For example, users can send and receive e-mail e-mails but can't send
 e-mail with attachments larger than about 20K. I ran a browser-based
 ADSL speed test from an internal host and found download speeds to
 be quite good but upload tests fail to complete.
 
 I found a few similar problems in the archives but the posted
 solutions haven't worked for me. I can't see that pf is blocking
 anything I want passed. At the moment I am running a stripped down
 pf.conf as follows: 
 
 # DECLARATIONS:
 Ext_If=sis0
 Int_If=sis1
 DMZ_If=sis2
 Int_Net=192.168.5.0/24
 
 # OPTIONS:
 set loginterface $Ext_If
 
 # NAT / REDIRECTION:
 nat on $Ext_If from $Int_Net to any - ($Ext_If)
 rdr on $Ext_If inet proto tcp from any to ($Ext_If) port 3391 \
- 192.168.5.1 port 3391
 rdr on $Ext_If inet proto tcp from any to ($Ext_If) port 3392 \
- 192.168.5.2 port 3392
 
 I think I can rule out things like speed and duplex problems between
 the Soekris and the local switch because the problem only affects
 outbound traffic. I tried a few scrub options to no avail but may
 not have been doing the right thing. I would really appreciate any
 suggestions on how to troubleshoot this. If I can't get this
 resolved by Monday morning I'm going to take some heat. 
 
 Thanks,
 RPK.
 
 What kind of link is sis0 on?  Do you know what your interface MTU
 was set to on the SonicWall?
 
   -Matt-

sis0 is connected to a D-Link ADSL modem - not sure of the exact model.
ifconfig shows the following details:

# ifconfig
lo0: flags=8049UP,LOOPBACK,RUNNING,MULTICAST mtu 33224
groups: lo
inet 127.0.0.1 netmask 0xff00
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x7
sis0: flags=8843UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST mtu 1500
lladdr 00:00:24:c6:df:34
groups: egress
media: Ethernet autoselect (100baseTX full-duplex)
status: active
inet6 fe80::200:24ff:fec6:df34%sis0 prefixlen 64 scopeid 0x1
inet xxx.xxx.xxx.xxx netmask 0xfe00 broadcast
xxx.xxx.xxx.xxx
sis1: flags=8843UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST mtu 1500
lladdr 00:00:24:c6:df:35
media: Ethernet autoselect (100baseTX full-duplex)
status: active
inet 192.168.5.254 netmask 0xff00 broadcast 192.168.5.255
inet6 fe80::200:24ff:fec6:df35%sis1 prefixlen 64 scopeid 0x2
sis2: flags=8802BROADCAST,SIMPLEX,MULTICAST mtu 1500
lladdr 00:00:24:c6:df:36
media: Ethernet autoselect (none)
status: no carrier
pflog0: flags=141UP,RUNNING,PROMISC mtu 33224
pfsync0: flags=0 mtu 1460
enc0: flags=0 mtu 1536

I don't know what MTU the SonicWALL was using but I'm sure it would
have been whatever the default setting is on a SonicWALL SOHO3.



Re: Soekris network problems - 48 hour deadline

2006-10-14 Thread Richard P. Koett
Adriaan wrote:
 On 10/14/06, Richard P. Koett [EMAIL PROTECTED] wrote:
 I'm having throughput problems using a Soekris net4801 as a firewall
 running OpenBSD 3.9. This is replacing a SonicWALL device that was
 working fine from the user's perspective. (I want to replace it
 because, among other things, I abhor SonicWALL's licensing). I won't
 post a 
 dmesg unless requested because I think this platform is pretty well
 known. Hosts on the internal network are able to access the Internet
 but report that access seems slow. Some operations fail consistently.
 For example, users can send and receive e-mail e-mails but can't send
 e-mail with attachments larger than about 20K. I ran a browser-based
 ADSL speed test from an internal host and found download speeds to
 be quite good but upload tests fail to complete.
 
 I found a few similar problems in the archives but the posted
 solutions haven't worked for me. I can't see that pf is blocking
 anything I want passed. At the moment I am running a stripped down
 pf.conf as follows: 
 
 # DECLARATIONS:
 Ext_If=sis0
 Int_If=sis1
 DMZ_If=sis2
 Int_Net=192.168.5.0/24
 
 # OPTIONS:
 set loginterface $Ext_If
 
 # NAT / REDIRECTION:
 nat on $Ext_If from $Int_Net to any - ($Ext_If)
 rdr on $Ext_If inet proto tcp from any to ($Ext_If) port 3391 \
 - 192.168.5.1 port 3391
 rdr on $Ext_If inet proto tcp from any to ($Ext_If) port 3392 \
 - 192.168.5.2 port 3392
 
 I think I can rule out things like speed and duplex problems between
 the Soekris and the local switch because the problem only affects
 outbound traffic. I tried a few scrub options to no avail but may
 not have been doing the right thing. I would really appreciate any
 suggestions on how to troubleshoot this. If I can't get this
 resolved by Monday morning I'm going to take some heat. 
 
 
 Do netstat -in,  netstat -s or netstat -ss give any clues?

netstat -in lists no errors or collisions. Below is the output from
netstat -ss and netstat -s. I'm not sure what to make of it:

# netstat -ss
ip:
241379 total packets received
3302 packets for this host
1 packet for unknown/unsupported protocol
236784 packets forwarded
3 packets not forwardable
3048 packets sent from this host
icmp:
495 calls to icmp_error
Output packet histogram:
echo reply: 180
destination unreachable: 495
Input packet histogram:
destination unreachable: 1
echo: 180
180 message responses generated
igmp:
ipencap:
tcp:
1234 packets sent
1017 data packets (161279 bytes)
27 data packets (17252 bytes) retransmitted
153 ack-only packets (775 delayed)
37 control packets
1737 packets received
762 acks (for 151461 bytes)
222 duplicate acks
808 packets (28599 bytes) received in-sequence
9 completely duplicate packets (252 bytes)
10 out-of-order packets (80 bytes)
4 window update packets
1737 packets hardware-checksummed
6 connection requests
26 connection accepts
32 connections established (including accepts)
57 connections closed (including 0 drops)
717 segments updated rtt (of 729 attempts)
26 retransmit timeouts
3 correct ACK header predictions
457 correct data packet header predictions
308 PCB cache misses
cwr by fastrecovery: 26
cwr by timeout: 26
26 SYN cache entries added
26 completed
26 SACK recovery episodes
34 segment rexmits in SACK recovery episodes
8552 byte rexmits in SACK recovery episodes
202 SACK options received
1 SACK option sent
udp:
1385 datagrams received
5 with no checksum
1380 input packets hardware-checksummed
99 dropped due to no socket
1260 broadcast/multicast datagrams dropped due to no socket
26 delivered
27 datagrams output
100 missed PCB cache
esp:
ah:
etherip:
ipcomp:
carp:
pfsync:
ip6:
12 packets sent from this host
Mbuf statistics:
icmp6:
Output packet histogram:
multicast listener report: 10
neighbor solicitation: 2
Histogram of error messages to be generated:
pim6:
rip6:

--
# netstat -s

(Note: Some parts omitted for brevity where all entries were zeros)

ip:
241674 total packets received
0 bad header checksums
0 with size smaller than minimum
0 with data size  data length
0 with header length  data size
0 with data length  header length
0 with bad options
0 with incorrect version number
0 fragments received
0 

Re: Soekris network problems - 48 hour deadline

2006-10-14 Thread Richard P. Koett
Stuart Henderson wrote:
 On 2006/10/14 00:56, Richard P. Koett wrote:
 known. Hosts on the internal network are able to access the Internet
 but report that access seems slow. Some operations fail consistently.
 For example, users can send and receive e-mail e-mails but can't send
 e-mail with attachments larger than about 20K. I ran a browser-based
 ADSL speed test from an internal host and found download speeds to
 be quite good but upload tests fail to complete.
 
 I tried a few scrub options to no avail
 
 which ones, did you try the max-mss I suggested? if 1440 is no good
 try a bit lower. it sounds very likely that you have MTU problems and
 max-mss will workaround that (at least for TCP).

I tried the following variations:

scrub out on sis0 max-mss 1440
scrub out max-mss 1440
scrub max-mss 1440
scrub max-mss 1400

Should I keep going lower, or try some other variation?



Thanks once more

2006-10-14 Thread Stephan A. Rickauer
Guys, I just browsed over 40.html#new and I'm once more deeply astounded
what you guys achieve for each new release. Given the hostile vendor
environment you have to deal with one can just be impressed how you guys
just did it again - somehow ... even my fully-closed-and-no-docs 88E8053
is now supported.

Respect.

--

 Stephan A. Rickauer

 ---
 Institut f|r Neuroinformatik  Tel: +41 44 635 30 50
 Universitdt / ETH Z|rich  Sek: +41 44 635 30 52
 Winterthurerstrasse 190   Fax: +41 44 635 30 53
 CH-8057 Z|richWeb:  www.ini.ethz.ch

 RSA public key: https://www.ini.ethz.ch/~stephan/pubkey.asc
 ---

[demime 1.01d removed an attachment of type application/pgp-signature which had 
a name of signature.asc]



Re: UPS just delivered the 4.0 release CD-set

2006-10-14 Thread Nico Meijer
Hey Ingo,

 Please refrain from Vandeputte-bashing...   =;-)  =;-)

Wow, hold your horses. Wim is Belgian, I am Dutch. The Dutch diss the
Belgians. This is a fundamental (f)law of the Universe.

But nevertheless. My three favorite Belgians are:

1) Urbanus
2) Wim
3) God

Be well and keep on smiling... Nico :-)



eagle DSL driver which card to try to ngrep :)

2006-10-14 Thread dreamwvr
Helo,
Anyone using eagle driver for Telus High speed ADSL.
If so which card would you recommend. Are they still
flakey for plunking a server out there? It has been
a while.

TIA
[EMAIL PROTECTED]



Re: Soekris network problems - 48 hour deadline

2006-10-14 Thread Matt Radtke
Good morning

 I tried the following variations:
 
 scrub out on sis0 max-mss 1440
 scrub out max-mss 1440
 scrub max-mss 1440
 scrub max-mss 1400

You should be able to figure out the problem,
actually.  Good ole tcpdump should show you something.
 I'd specifically look for icmp that you might be
blocking.

-Matt
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 



Re: c.93.3 not found when installing packages

2006-10-14 Thread patrick keshishian

Christian Weisgerber [EMAIL PROTECTED] wrote:


I expect a new snapshot to be available by Monday.

(Building a full package snapshot now takes ~68 hours on the Xeon
2.66 GHz dedicated to the job.  If somebody wants to donate a new
high-end machine for the task, talk to Theo what his rack can
accommodate.)



Hmm.. can you use a few such machines and employ distcc?
I couldn't help notice that a port for it was recently submitted
to [EMAIL PROTECTED]

distcc significantly reduces compile time.  At work we used
to run it on our individual boxes and our compiles would take
a fraction of the normal time.





--
Christian naddy Weisgerber  [EMAIL PROTECTED]




Re: Soekris network problems - 48 hour deadline - SOLVED!!

2006-10-14 Thread Richard P. Koett
A huge thank you to all who offered advice on my network problem. It
appears that the problem has been fixed by changing hostname.sis0
from dhcp NONE NONE NONE to dhcp media 10baseT.

Previous output from ifconfig showed:

sis0: flags=8843UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST mtu 1500
  media: Ethernet autoselect (100baseTX full-duplex)

It now shows:

sis0: flags=8843UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST mtu 1500
  media: Ethernet 10baseT

I guess it was a stupid autonegotiation problem after all. I didn't
know that could affect traffic in only 1 direction. Live and learn :)

At this point I have reloaded my full pf rule set. Unless doing so
introduces a new problem I believe things are fine.

The advice I received from the list has been educational and much
appreciated as always.

RPK.



Re: Firefox/Iceweasel in OpenBSD

2006-10-14 Thread Henrik Enberg
 Date: Thu, 12 Oct 2006 11:11:52 -0400
 From: Kurt Miller [EMAIL PROTECTED]
 
 On Thursday 12 October 2006 10:13 am, Tobias Ulmer wrote:
  We are modifying the source code, which is ok with the porting
  software paragraph in the document above, but contradicts with a
  private mail from Mike Connor where he writes about patching of
  app source violates their trademark. Oh well...
 
 Yes they are trying to exert a ridiculous level of control with
 their trademark but only when using the official branding.
 If they have given a project permission to use the official
 branding then any patch to firefox must first be approved
 by them.
 
 That's what all the fus is about. I'm not happy about it but
 it doesn't affect our ability to distribute it under the
 community edition rules.

Actually, what the Mozilla people objected to in the whole Debian
debacle seems to be that the package was called ;firefox+.  Debian
already used the community edition version just like OpenBSD does.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=354622



Re: best hardware plattform for openbsd

2006-10-14 Thread Rogier Krieger

On 10/13/06, Toni Mueller [EMAIL PROTECTED] wrote:

Thanks for pointing me to bioctl - I was unaware about that - but I
don't offhand see how I could eg. collect SMART status on the drives
hanging off such a card.


IIRC, you cannot collect the SMART status on individual drives.
Personally, I don't really mind as I'm not a big fan of SMART. Having
seen drives that showed no issues in SMART, right up to the point of
dying, is bound to change one's perspective.



Since the machines may very well be not in reach, I don't fancy
beeping or blinking drive enclosures. I need log entries instead.


The logical disk status on ami(4) devices can also be polled through
sensorsd(8). Perhaps I should also have mentioned that bit.

If you want individual drive statistics, I suppose you would want to
parse bioctl(8) output. I also recommend you take a quick look at
sensorsd.conf(5).

The above works for me, but of course your requirements may be different.

Cheers,

Rogier

--
If you don't know where you're going, any road will get you there.



Re: Soekris network problems - 48 hour deadline

2006-10-14 Thread Stuart Henderson
On 2006/10/14 02:42, Richard P. Koett wrote:
  I won't post a dmesg unless requested because I think this platform
  is pretty well known.

it probably won't make a difference here, but in general, the dmesg
doesn't just tell about the platform, it tells about the OS you're using
on it too.

  I think I can rule out things like speed and duplex problems between
  the Soekris and the local switch because the problem only affects
  outbound traffic.

Not entirely, it could only be affecting things in one direction.
Better to verify.

On 2006/10/14 03:10, Richard P. Koett wrote:
  I tried a few scrub options to no avail
  
  which ones, did you try the max-mss I suggested? if 1440 is no good
  try a bit lower. it sounds very likely that you have MTU problems and
  max-mss will workaround that (at least for TCP).
 
 I tried the following variations:
 
 scrub out on sis0 max-mss 1440
 scrub out max-mss 1440
 scrub max-mss 1440
 scrub max-mss 1400
 
 Should I keep going lower, or try some other variation?

I'd have thought that would have taken care of it, perhaps it's
some other problem I haven't thought of...

Any blocked packets when you see problems? (tcpdump -neipflog0)



Re: Soekris network problems - 48 hour deadline

2006-10-14 Thread Bob DeBolt
On Saturday 14 October 2006 4:10 am, you wrote:

Hi Richard

I dealt with an ISP on behalf of a client that required a MSS of 1100 during 
one particular phase of troubleshooting. Funny thing (not) they forgot to 
notify everyone when said problem was corrected and the client ran with that 
MSS for 5 months.Thankfully the actual packets they used are consistently 
small.

Anyway, have you done the ruleset adjustment to to pass out quick on your 
$ext_if to rule out a rule issue. I have used this many times and has been 
helpful and takes just a couple of minutes. Do a one to one NAT from your 
testing machine through the OBSD box and put pass in quick keep state on 
the $int_if and pass out quick keep state on the $ext_if at the top of your 
ruleset and see what happens. If things work correctly you add back you 
ruleset one at a time.

 Should I keep going lower, or try some other variation?

Certainly try lower, you may find the magic bullet 
Sonicwall defaults to 1500

If your comfortable with sending your complete ruleset to the list or to me 
privately please do so. It is more often than not considerably more helpful.

Thanks Richard

-- 
Sincerely

Bob DeBolt



Static code analysis tools?

2006-10-14 Thread John Richard Moser
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

I've been looking for static code analysis tools for a while, and the
only real free tools I've found are rats and flawfinder.  The other
stuff is... not very useful.  Either incomplete, reliant on non-free
parts, reliant on Java (not GNU classpath, but
pain-in-the-ass-to-get-working Java), or otherwise just not worth my time.

The kinds of things I'm looking for are code coverage and memory safety
(buffer overflows, double free()s, memory leaks), not sure on anything
else.  There are a lot of would be nice things that aren't likely to
happen, like finding long loops and code paths (isn't this akin to the
halting problem) so as to pretend static profiling can be done.

The only thing I can think of at this point is somewhere in process
someone working on OpenBSD has got to have found a good set of tools.
Manual audits take time; static analysis tools get potential issues to
the front of your attention so you can check those areas first before
continuing with a deep analysis.

Anything out there that's really good that I should know about?

- --
We will enslave their women, eat their children and rape their
cattle!
  -- Bosc, Evil alien overlord from the fifth dimension
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQIVAwUBRTEXQgs1xW0HCTEFAQK3IA/8Dj9EMWLX0d8/+hXEpruVb+iOJaTSpC34
8/6psFkko/wzrpL1J+Jtsl9VOaKfhnwSCVgYiYBAStyd9pMUNv7yEgjowqen/ZZ2
esTiWUJMfgwbLncVoARqhOiycQRntD9ktBPv2r3yh0xdqluB2X7Uz3zcwBtGeFV5
b2lPkmsj6swZ/3DJ7L258Q+dvu+AQ4iXkqRsB54TqGgJT1DkT56f1bX3sh3GNduf
FcijBYNAfwMchhGmOw820EctNMZ6KEVnk4vhvw9wWIvnJiw79vPEYgOAbm0RFW8m
6BuY5IzvJfi87Gq0e9uFeGCSAi9bvrpzAO/si0lyW7U5dXWQf/Tyy7hEkNSmjcgj
cHn4n6Ms+ByNOx7rNMjrfqvH5ZqNozEmGVGBAL1eiXmT87R8dkKPGflFoQ9JL4AK
CWZgffIKSJXvturDhm2Lh/OChEpJZL63jFo6gDbsb65rGKUuS0I68RmztttGmXFn
C16nBlwv0Sf4aiolrAA/yH8ga8mljtz7k4iOznwXRu0bjen+Qg3H7wgpH6B0B1DL
91St6ECOk0E6Bmqxyog91p9H5T+x1H45/yOM++25XkwKYx4m6Anm9PEj2cvEvz6G
M4b4R6ZhlpBiAa38ilZYwVyLKRuhMAl+xDmhOyzI3buL+6MXMwZwJHi7+4fNmru6
lGvvUuS2sK8=
=CHxa
-END PGP SIGNATURE-



Re: C unit tests seen by OpenBSD developpers

2006-10-14 Thread Steve Fairhead
Bruno said:
 I'm currently learning C. In many languages, you hear lots of stuff likes
'unit testing', 'refactoring', 'agile  programming' and others... It seems
that these techniques are not very present in C programming (whereas check
framework is in packages, it seems too
complex) Looking quickly at the OpenBSD's CVS, I found no unit test. I won't
debate on the merit or cost of this approach, and I'm not really fond of it
(add not-so-usefull complexity) but I'm just curious to know why OpenBSD
developpers choose to not use this technique for userland tools (for kernel,
it's obvious :). 

First, I'm not (perhaps yet) an OpenBSD developer, so I can't speak for
them.

I write a lot of C (and assembler), but my speciality is embedded work (e.g.
instrumentation, controllers, the design of which uses embedded micros). In
that field, the methodologies you cite are indeed used, albeit not
necessarily fully and individually, and perhaps not as widely as they should
be. With embedded devices, bugs are less forgiving. I've now spent nearly
three decades acquiring techniques and methodologies that allow me to
provide bug-free software (actually, usually firmware) by design, rather
than by debugging (something I actively try to avoid) [1].

The methodologies you cite each contain valuable lessons and techniques, but
I rarely come across full-blooded devotees of any one or more or them.
Regression testing has its uses, and in some cases is absolutely necessary,
but in others impractical. There are many other appropriate techniques; it's
a large area which pretty much amounts to the entire craft of software
engineering. There are many good books (perhaps starting with The Mythical
Man-Month). Mostly, IMO, it's an attitude: developing an approach (to both
design and coding) which results in clear, maintainable, and above all
robust code.

Back at OpenBSD, the developers are proactive on these things, and are
actively encouraging the use of certain idioms and alternatives to classic
library functions to avoid common bugs (e.g. buffer overflows). I've yet to
read much source, but I'm confident you'd find it enlightening.

[1] A typical response to this claim is get real! or must be really
trivial software, then. I can understand that; the software industry at
large is fixated on the myth that complex software must be buggy. I don't
buy that; it's a question of managing complexity. Reducing the complex to a
collection of inter-communicating trivial things is one of the most
important skills there is.

Steve
http://www.fivetrees.com



OpenBSD and the Blind

2006-10-14 Thread Zachary Kline
Hello,
 Let me start things out here by saying I'm not a Unix programmer.  
I've no overwhelming need, commercial or otherwise, to use the operating system 
at all.  
I'm a hobbiest, which I suppose is a bit of a rarer breed for BSD than for 
something like Linux.
 However,, to add interest to the title of hobbiest, I also happen to be a 
blind computer user.
Linux provides programs and kernel patches to enable me to use the system 
completely, even so far as to listen to the innumerable bootup messages--always 
interesting.
However, I've recently discovered OpenBSD by the only way I currently can, 
emulation.  I'm running it on a VAX provided to me by the work of Bob Supnick 
and the SIMH team.
The reason the I386 version of BSD is generally more difficult for me to use 
involves the fact that the normal installation program doesn't provide a screen 
reader, which is something Linux got right, at least some distributions of it.
What I am interested in here are ways that an OpenBSD system might be made 
accessible.  Does anyone here have any thoughts on this issue?  I'm more than 
willing to discuss possible approaches.
Yours,
Zack.



Re: best hardware plattform for openbsd

2006-10-14 Thread STeve Andre'
On Saturday 14 October 2006 08:28, Rogier Krieger wrote:
 On 10/13/06, Toni Mueller [EMAIL PROTECTED] wrote:
  Thanks for pointing me to bioctl - I was unaware about that - but I
  don't offhand see how I could eg. collect SMART status on the drives
  hanging off such a card.

 IIRC, you cannot collect the SMART status on individual drives.
 Personally, I don't really mind as I'm not a big fan of SMART. Having
 seen drives that showed no issues in SMART, right up to the point of
 dying, is bound to change one's perspective.
[snip]

SMART isn't pefect.  I've had a disk go which SMART reported as being
fine the day before, so that happens.  But I've also seen SMART
accurately fortell of problems a couple of time now. While it isn't
perfect, it is useful.

--STeve Andre'



Re: Soekris network problems - 48 hour deadline - SOLVED!!

2006-10-14 Thread Melameth, Daniel D.
Richard P. Koett wrote:
 I guess it was a stupid autonegotiation problem after all. I didn't
 know that could affect traffic in only 1 direction. Live and learn :)

FWIW, if you're not autonegotiating, you should make certain both sides
(NIC and switch) are hard coded/not set to negotiate.



Re: OpenBSD and the Blind

2006-10-14 Thread Han Boetes
Zachary Kline wrote:
 What I am interested in here are ways that an OpenBSD system
 might be made accessible.  Does anyone here have any thoughts on
 this issue?  I'm more than willing to discuss possible
 approaches.

Don't get overexited when reading the header, but do read the
whole thread, it contains a lot of useful information.

http://undeadly.org/cgi?action=articlesid=20061011142519mode=expanded



# Han