patchwork rulez!

Some time ago, Jeremy Kerr wrote the patchwork program as a means to track patches sent to mailing-lists (specifically netfilter-devel in our case).

I'm now using it more-or-less frequently and it has already uncovered a number of patches that got lost otherwise. Therefore I consider it a very helpful tool. Hopefully reports of netfilter-devel being "a write-only mailing-list" will cease now..

Donating 7000 EUR from GPL enforcement to FoeBud e.V.

Sometimes as part of my GPL enforcement work, vendors will make donations in order to settle things like a grace period, i.e. a time where they can still sell their stock of already-produced gpl incompliant devices.

Recently, as part of such a settlement, I was able to get EUR7000 which have been donated to FoeBud e.V., a registered German charity fighting against privacy-invading technology use such as RFID, and video surveillance. They hold the annual "Big Brother Awards" which give a "prize" to those individuals and organizations that hurt privacy and data protection most in that year.

Chaosradio 105: Embedded Systems

This month's Chaosradio show (held today) will be looking into the plethora of embedded devices that are present in todays world.

CCC "residents" will be Tim Pritlove and myself.

The main focus will be on consumer embedded systems, especially those running free operating systems and those with good "hack value".

Linus has merged the net-2.6.14 tree from DaveM

This means that all the code from my netfilter-2.6.14 tree (master branch) are now in the mainline kernel. The code in question mainly includes

• conntrack event notifiers
• nfnetlink layer
• ctnetlink interface
• nf_log API extension
• nf_queue and nf_log /proc files
• nfnetlink_log as successor of ipt_ULOG and ebt_ulog
• nfnetlink_queue as successor of ip_queue and ip6_queue

We'll see whether nf_conntrack will also go into 2.6.14, at the moment I have my doubts...

CLUSTERIP fixes/cleanup

Apparently we now have at least one corporate user of the ipt_CLUSTERIP target (allowing load balancing without a load balancer). Krisztian Kovacs has re-worked some of it's weak parts (like refcounting and procfs). I'll review the patches soon.

GPL licensed 100% free software Atheros driver to be hosted on gnumonks.org

I've always intended to write a 100% free software driver for Atheros cards, based on the new IEEE80211 subsystem in the mainline kernel. I've even stated at OLS earlier this year that I'd start one. As with many of my projects, there was a significant lack of time.

Meanwhile, Mateusz Berezecki has written a beta-state driver for the ar5212 chipset based wireless cards. He has contacted me for hosting the driver on gnumonks.org. So this way I'll at least be able to provide some help with the driver this way ;).

I still intend to contribute to the driver (as time permits), as well as the core IEEE80211 stack in the Linux kernel. One of my must-have features is virtual access points, i.e. running as AP of multiple ESSID's with one card on one channel.

Back from holidays - catching up

So I'm back from holidays and are half way through reading the incredible backlog of emails.

It seems like netdev has been a bit more quiet than it was before, and surprisingly there were no more bug reports on the recently introduced netfilter code (nfnetlink, nfnetlink_log, nfnetlink_queue, nf_log, ...). So things seem to have settled down a bit.

Organization of the netfilter developer workshop seems to proceed quite fine, too. Travel sponsorships are taken care of, however we're still lacking some EUR 1600 for the cost of accommodation. If anyone (any company/organization) is interested in contributing to the netfilter project by funding accommodation for the workshop, please let me know.

Most of the 'interesting' new email seems to come in on the GPL violations front. I haven't yet analyzed any of the new alleged violations, but there seems to be plenty. It's a pity since it will again keep me from interesting real work. Also, there's still some minor cleanup to do in order to fully close the last 11 cases that I've dealt with...

Offline until Aug 25

I'm off for holidays in Scotland, so please don't expect any email to be answered before Aug 25.

Don't send any important netfilter issues to me personally, but rather to the core-team or the respective lists.

iRiver hands over source code CD-ROM

Some time ago, I ran into GPL issues with the iRiver PMP-1xx series. For some reason, the Korean company chose to cease distributing their products in Germany, rather than making them GPL compliant.

Despite that, they've now sent me a CD-R with the source code. I've made it available to interested parties at ftp.gpl-devices.org. I did not yet have the time to do a full-scale analysis whether it is complete (as per gpl definition of "complete corresponding source code"). However, at least from a first quick look it seems fine (and even documented!).

Gentoo is so broken

The next episode in my Gentoo rant.

Every time I do an "emerge -b -n world" to get the latest security fixes, I have several hours, if not days of cleanup.

A number of times glibc was somehow fucked up, so all dynamically linked applications would refuse to work.

This time, let me only pick the interesting examples:

• I don't have a "vi" anymore. It tells me "unresolved symbol: pthread_create".
• Proftpd doesn't start anymore ("unresolved symbol: setproctitle").
• spamd starts, but fails to do DNS lookups (missing dependency to Net::DNS)
• clamav regularly crashes (reason unknown)
• The linker/gcc (3.4.4) fails to detect unresolved symbols at runtime. This leads to the vi and proftpd issues described above

This is a _production server_. *sigh*.

I sincerely consider switching Debian-ppc (in 32bit mode) on that Dual G5 XServe now. If that wasn't such a terrible amount of work...

One day of systems maintainance

Today I really felt like a systems administrator (which I've never been, at least never as daytime job).

On the software side, there were still a cuple of woody -> sarge upgrades to be made. Also, I finally have a running sparc64 setup at home again (all my other sparc's are hosted, and I recently crashed one during development).

On the hardware side, various pending repairs (broken fan's, bad memory, hard disk replacement0) lead to some shuffling of hardware pieces between my various machines.

As a result, I now have more storage capacity on my main NFS server, as well as on the main backup server. While planning the new backup strategy, I found out that all in all I own more than 4.6TB of hard disks. Sounds an awful lot, but most of it is lost due to various raid levels, and some 1.6TB of drives are only used for backups.

I wish tape drives with decent capacities were not all that expensive...

Tomorrow will be one day of accounting and taxes. So don't expect any further new netfilter stuff before I'm leaving for holidays in Scotland next week.

Netfilter workshop dates

Pablo is working on workshop.netfilter.org. But at least the dates are fixed now:

• Oct 4th: some unofficial user-related event with the local lug
• Oct 5th-6th: The workshop itself. discussions, presentations.
• Oct 7th-9th: Hacking on code.

Expect more news soon...

Update on the netfilter work

Ok, we've seen a terrible amount of bug-fixes going into the net-2.6.14 tree after my new nfnetlink/nfnetlink_log/nfnetlink_queue/... stuff was merged. It is my belief that we've now covered most of it.

As of now, I'm not planning to make any other big netfilter-related patch submissions. So nf_conntrack will probably have to wait for 2.6.15, especially since there are still a number of ip_conntrack/nf_conntrack compatibility issues to be resolved.

Lately I've been working on the userspace side. At least libnfnetlink_log and the libipulog compat API are finished now. libnfnetlink_queue is getting there, and the 'big' missing part is the libipq compat API.

So now I'm heading for some work on ulogd2, libnfnetlink_conntrack and the virtual Ethernet device (vdev) code. And if I still have some time left, there's exciting non-netfilter stuff like my RFID stack.

I'll be in Bangalore again :)

Well, according to the organizers it's just a formality, but "just for the record", I've now officially been invited to the-conference-formerly-known-as-Linux-Bangalore. It will happen Nov 29 to Dec 02, but due to timing overlap, I'll probably only be there from the 30th onwards.

I've already tried to raise awareness for this fabulous event with almost everybody I met during my vivid conference travel. Let's hope I have managed to convince a number of high-quality Linux hackers to consider submitting a paper (and let's hope the CfP will be published really soon now).

Vodafone reacts to my notice about some broken WLAN

It's amazing! A person who claimed to be the Chief Designer of Vodafone's Global WLAN services has read my blog and stumbled accross my previous blog entry about the network problems at Linuxtag and sent a quite thorough email in response. And no, this was not in response to my proclaimed cancellation of credit card charge (which I obviously forgot, so it never happened).

Anyway, I'm amazed.

Bug-fixing nfnetlink_log, nfnetlink_queue and nfnetlink_conntrack

Almost as expected, as soon as that code hits a somewhat more used tree (such as Dave m's net-2.6.14 and the -mm tree), there are numerous bug-fixes piling up.

That's a bit embarrassing, though I'd rather fix it now than later when it is already in the mainline tree :)

nf_conntrack now merged into local branch of netfilter-2.6.14.git

I've committed the last version of nf_conntrack, the layer-3-independent connection tracking code to my netfilter-2.6.14.git tree. It's a local branch called "nf_conntrack".

Yasuyuki and me have been working to port the latest mainline ip_conntrack changes to nf_conntrack. Now the tree should now be fully in sync with ip_conntrack of the same net-2.6.14 tree (this means that it supports CONNTRACK_ACCT and has it's own conntrack-event-api).

Major pieces that are missing from nf_conntrack are:

• IPv4 NAT for nf_conntrack
• nf_conntrack_netlink (aka ctnetlink for nf_conntrack)
• support for ip(6)tables 'state', 'conntrack' and other matches
• Finally, ct_sync