Weblog

Sunday September 30, 2007

Which free un*x for a database today?

The quest to be the fastest webserver or database server or whatever is no different to any other part of the IT market, with the leader constantly changing, depending on who's where with their current development cycle.

Over at one of the other open source projects that I'm involved with, NetBSD, some of the project members have been doing some testing with MySQL on some "older" SMP machines they have at their disposal.

The first graph shows NetBSD-current (the equivalent of "nevada" or OpenSolaris) against an earlier release of NetBSD, OpenBSD, FreeBSD and Linux.

After seeing the above graph, a few people (including myself) were curious about how NetBSD's performance stacked up against OpenSolaris - afterall, Solaris is *the* platform for people running production databases in many environments today. The results are quite surprising but very pleasing to the NetBSD project. (For details of the test and hardware used in the test below, see http://www.netbsd.org/~ober/

Friday September 28, 2007

USD freefall - where does it end?

Today on the currency exchange markets, the Canadian dollar became worth more than the US dollar, crossing the $1 mark in the afternoon. Is it headed for the heights of the 1970s when 1 Canadian dollar bought $1.07 US dollars? Or will it go even further? The important point to note here is that it's not that the Canadian dollar has become better, rather that the US dollar has become worth less as investors seek to move money elsewhere due to signs of a struggling US economy (weak housing market, low consumer confidence, exports of durable goods trending down.)

The nail in the coffin for crossing this benchmark, this time, was the drop in interest rates by the US Federal Reserve by .5%. Not only was this more than what the market expected (.25%) but it is not expected to be the last drop in interest rates by the US fed.

The casual observer might wander why the dollar has dropped now, rather than in the years earlier as interest rates were low then too. The answer here is because the US economy is struggling to get back on its feet. After the dot-com-bomb and 9-11 related recession, most of the other western economies seem to have recovered and are now moderately prosperous...except in the USA. Of course it doesn't take a genius to notice that this period of depressed US dollar value also coincides with the US government needing to fund its invasion of Iraq, spending billions of dollars that it otherwise wouldn't need to. One can but hope that a change in President will also bring a change in the fortunes of the strength of the US dollar.

Monday September 24, 2007

IPFilter 4.1.26

It's been a while since I blogged about IPFilter. I've been attending to problems over the past few months in a fairly responsive manner. The one consistent message I get out of this is I need to do more testing. Sigh. Just developing code is much more fun :) Testing is for users ;) Of course if there are fewer features then there is also less to test and go wrong. A lot to be said for simplicity!

http://coombs.anu.edu.au/~avalon/ip_fil4.1.26.tar.gz

Changelog

4.1.26 - Released 24 September 2007

• Fix build problem for Solaris prior to S10U4

4.1.25 - Released 20 September 2007

• stepping through structures with ioctls can lead to the wrong things being free'd and panics
• if a NAT entry (such as an rdr) is created but the packet ends up being blocked, tear down the NAT entry.
• fix fragment cache preventing keep state from functioning
• fix handling of \ to indicate a continued line in .conf files
• include port ranges in the allowed input for ipf when using "port = ()"
• only advance TCP state for packets on the leading edgeof the window.
• using ipnat -l can lead to memory corruption in high stress situations
• track TCP sequence numbers with NAT so that it can do timeout advances correctly inline with state
• ICMP checksums for some redirect'd packets are not adjusted correctly.
• IPv6 address components need to be explicitly cast to a 32bit pointer boundary so that compilers don't try to access them as two 64bit pieces (no guarantee is made that an Ipv6 address is on a 64bit aligned address)
• filling up the ipauth packet queue can lead to no more packets being processed.
• locking used to deref a nat entry causes a significant performance hit
• m_pulldown isn't properly handled, leading to possible panics with ICMPv6 packets
• IPv6 fragment handling doesn't allow for "keep frag" to work
• build on Solaris10 Update4 with pfhooks in the kernel
• logging of Ipv6 packets with extension headers fix - Miroslaw Luc

4.1.24 - Released 8 July 2007

• patch from Stuart Remphrey to address recursive mutex lock with TCP state
• add hash table bucket stats display to ipnat -s
• give ASSERT some teeth for user compiles
• initialising ipf_global, ipf_frcache, ipf_mutex should all be done very early on
• do some caddr_t cleanup, where possible
• fr_ref no longer tracks the number of children rules in a group for head rules
• make sure all BCOPY* have a value assigned to something
• fix possible use of icmp pointer after pullup makes it invalid
• resolve compile problems related to FreeBSD tree

4.1.23 - Released 31 May 2007

Sunday September 23, 2007

DNS Proxy

Today I imported a DNS proxy, that I've been hacking around on for a while, into CVS on sourceforge. As a proxy it currently does no caching of DNS queries and answers, it merely redirects them to another DNS server. What benefits does it bring then?

The primary reason for the proxy is access control of DNS queries. The proxy's main purpose is allow me to block DNS requests for, say, microsoft.com. Or perhaps more appropriately, it allows me to block DNS requests for doubleclick.net, etc - ie. advertising web sites and other sources of web page spam.

Because it has been written to work with IPFilter, it can correctly work with packets that are sent to the proxy through the use of rdr rules - i.e. it can function as a transparent proxy when in the path of DNS.

The source code is part of the IPFilter project on sourceforge.net and can be seen at http://ipfilter.cvs.sourceforge.net/ipfilter/dns-proxy/.

Limitations? It currently only works with DNS over UDP and requires IPFilter to compile. Well, there are probably lots of other limitations too, at present, as the feature set is just starting to be fleshed out.

Related to this, I'm also working on putting a simpler proxy into IPFilter 5.0 itself that allows for filtering DNS packets based on the names in the queries.

The proxy can be downloaded from sourceforge at:

http://downloads.sourceforge.net/ipfilter/dns-proxy-1.1.1.tar.gz

Saturday September 15, 2007

Iraq war was about oil: Greenspan

So all the rhetoric about freedom and democracy seems to be just window dressing according to Greenspan's book...where does the W go now? Greenspan on Oil and Iraq.