5 ms·

It's not quite that simple. People actually tried to update net-tools ifconfig (one of the two ifconfigs back in 2018). In 2019, I simply wrote an ifconfig th

by JdeBP 7y ago

It's not quite that simple. People actually tried to update net-tools ifconfig (one of the two ifconfigs back in 2018). In 2019, I simply wrote an ifconfig that uses the netlink API, because for portability I needed a Linux ifconfig that had a FreeBSD-like command-line syntax. It doesn't have the old interface aliasing mentioned in the headlined article, and has no problems setting up and reporting IPv6 addresses or additional IPv4 addresses. * https://unix.stackexchange.com./a/504084/5132 https://unix.stackexchange.com./a/504084/5132 * http://jdebp.uk./Softwares/nosh/guide/commands/ifconfig.xml http://jdebp.uk./Softwares/nosh/guide/commands/ifconfig.xml I have a system to convert Debian /etc/network/interfaces into a BSD-style rc.conf, which then in turn gets converted into a suite of native service bundles. One of the service bundles is ifconfig@interface , which invokes ifconfig with a uniform command-line syntax across Linux and FreeBSD, hence the need for a more FreeBSD-alike ifconfig on Linux. * http://jdebp.uk./Softwares/nosh/guide/rcconf-amalgamation.html http://jdebp.uk./Softwares/nosh/guide/rcconf-amalgamation.ht... * http://jdebp.uk./Softwares/nosh/guide/rcconf.html http://jdebp.uk./Softwares/nosh/guide/rcconf.html * http://jdebp.uk./Softwares/nosh/guide/networking.html http://jdebp.uk./Softwares/nosh/guide/networking.html

dooglius 7y ago
> People actually tried to update net-tools ifconfig (one of the two ifconfigs back in 2018). What happened?
- JdeBP 7y ago
  See the StackExchange answer.
  - blaser-waffle 7y ago
    It's a comprehensive reply -- good stuff, and worth a read. The short version: > "As you can see, the GNU inetutils and NET-3 net-tools ifconfigs have some marked deficiencies, with respect to IPv6, with respect to interfaces that have multiple addresses, and with respect to functionality like -l. > The IPv6 problem is in part some missing code in the tools themselves. But in the main it is caused by the fact that Linux does not (as other operating systems do) provide IPv6 functionality through the ioctl() interface. It only lets programs see and manipulate IPv4 addresses through the networking ioctl()s. > Linux instead provides this functionality through a different interface, send() and recv() on a special, and somewhat odd, address family of sockets, AF_NETLINK. > The GNU and NET-3 ifconfigs could have been adjusted to use this new API. The argument against doing so was that it was not portable to other operating systems, but these programs were in practice already not portable anyway so that was not much of an argument. > But they weren't adjusted, and remain as aforeshown to this day."
    - tyingq 7y ago
      That split where ioctl() is used for ipv4, and the send()/recv()/AF_NETLINK setup for ipv6 is interesting. I'm curious why the Linux folks chose that route. I'd get it as a temporary thing, but shouldn't they have migrated everything onto AF_NETLINK?
      - yencabulator 7y ago
        That's exactly what happened. Nobody bothered rewriting ifconfig to use the new APIs, because `ip` was the new hotness (and much more flexible and if not saner, at least differently insane).
dependenttypes 7y ago
Why are you using the dot for your site but not for stackexchange?
- JdeBP 7y ago
  Lazy copy and paste on my part. (-:
- kccqzy 7y ago
  This might be the first time in quite a few years that I've seen people using a dot like that. Any reasons to do so? I figured most people do not have weird DNS search domains or some such to warrant that dot.
  - kbr2000 7y ago
    It would be good practice to do so, when you are referring to a FQDN. Apart from that, to circumvent badly configured paywall filters?
    - JdeBP 7y ago
      You both need to read http://jdebp.uk./FGA/web-fully-qualified-domain-name.html http://jdebp.uk./FGA/web-fully-qualified-domain-name.html , including the Hacker News person's reminiscences. (-:
halyconWays 7y ago
If you'd read the article you'd see that it talks about how people tried to update ifconfig.
Phemist 7y ago
Off-topic: I can't help but be nosy and check the https version of your page. You seem to be serving a cert with CN=albertstreetantiquescentre.co.uk. Might want to get this looked at :) Edit: Interesting, https://jdebp.uk https://jdebp.uk has the correct cert configured, whereas https://jdebp.uk https://jdebp.uk. serves the cert as mentioned above.
- JdeBP 7y ago
  That's the page on a shared hosting service, not served by me. See the site history page (still in the same place that it was a couple of years ago when it came up on Hacker News).
  - internalthief 7y ago
    It's due to Apache not correctly matching the SNI when it is sent a FQDN ending in a period (.) More information: https://news.ycombinator.com/item?id=22632959 https://news.ycombinator.com/item?id=22632959
- internalthief 7y ago
  It seems that the server running on the other end doesn't properly match the certificate from the SNI if the domain sent by the browser is a FQDN (i.e. ends in a .) For example, try the following: openssl s_client -connect jdebp.uk:443 -servername "jdebp.uk." vs openssl s_client -connect jdebp.uk:443 -servername "jdebp.uk" You'll notice that in the first case the default certificate is sent back, in the second case the certificate is correctly matched against the SNI. According to the Server header returned: Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 Phusion_Passenger/5.3.7 Testing against an NGINX based server, I am not seeing the same results, in fact I am seeing the correct certificate being returned.
  - tialaramex 7y ago
    The relevant RFC says not to send a trailing dot in SNI. Browsers should probably trim the dot out if present. Maybe they aren't doing so because it causes some unexpected compatibility mishap, maybe in reality it rarely causes any trouble so nobody got around to it.
beagle3 7y ago
Thanks for nosh. Another off-topic question (using this forum as your author page is quite discouraging about sending you emails ....) What's the reason for naming cyclog files with the time they were closed? (other than that's how djb did it?), since this information is available easily with 'ls -l'? I use a logger that opens a $CREATE_TIMESTAMP.u file, and makes "current" a symbolic link to it; and on close renames it to ".s", which I find more intuitive and informative (also provides time between log creation and first message, which is unavailable with cyclog). I was considering changing the ".u"/".s" marking to be an attribute (-w or +i or +t to signify "safely closed") to help repeated rsyncs of log directories, but haven't done that yet. I'm sure there's some useful aspect of existing cyclog/multilog behaviour that I'm missing, but I haven't been able to figure what it is for the last 10 years ...
- JdeBP 7y ago
  If you want more than just my perspective, look to Laurent Bercot's Supervision Mailing list. M. Bercot is of course there, as well as a few other people. * http://www.skarnet.org/lists.html http://www.skarnet.org/lists.html As for the filenames, yes the original reason was for compatibility with multilog, and of course all of the other tools that can process these log directories. I did set out, after all, to produce a cyclog workalike, with lessons from multilog incorporated. Note that said tools might not deal well with log directories where the same log file is available via two names, both "current" and something else. Moreover, if you go and look at follow-log-directories you can see an additional benefit that it very efficiently skips its cursors over old files without having to look at their i-nodes because it knows that the filename is guaranteed to be a timestamp at or after the last log entry in the file. Furthermore, if you go and read the cyclog manual, you'll find out why using the w permission bit had problems. (-: 1.41 is building up changes, by the way.
  - beagle3 7y ago
    > Moreover, if you go and look at follow-log-directories you can see an additional benefit that it very efficiently skips its cursors over old files without having to look at their i-nodes because it knows that the filename is guaranteed to be a timestamp at or after the last log entry in the file. Thanks, that's two thing I've missed (because I never used it, I guess ..): This optimization and follow-log-directories+export-to-rsyslog which was introduced at a time I wasn't looking :) > Furthermore, if you go and read the cyclog manual, you'll find out why using the w permission bit had problems. (-: :) Indeed, thanks. > 1.41 is building up changes, by the way. Thanks! And since I've missed follow-log-directories (and export-to-rsyslog) before, maybe there's another tool I've missed that would make shipping log directories more efficient? I'm concerned with very-low-bandwidth, very-intermittently-connected servers in which rsync is a godsend and e.g. rsyslog and friends proved much less reliable and efficient; And the renaming of "current" makes it miss the fact that it already has an (almost complete) copy of said file under a different name. Thanks again!

by JdeBP 7y ago

dooglius 7y ago

> People actually tried to update net-tools ifconfig (one of the two ifconfigs back in 2018). What happened?

JdeBP 7y ago
See the StackExchange answer.
- blaser-waffle 7y ago
  It's a comprehensive reply -- good stuff, and worth a read. The short version: > "As you can see, the GNU inetutils and NET-3 net-tools ifconfigs have some marked deficiencies, with respect to IPv6, with respect to interfaces that have multiple addresses, and with respect to functionality like -l. > The IPv6 problem is in part some missing code in the tools themselves. But in the main it is caused by the fact that Linux does not (as other operating systems do) provide IPv6 functionality through the ioctl() interface. It only lets programs see and manipulate IPv4 addresses through the networking ioctl()s. > Linux instead provides this functionality through a different interface, send() and recv() on a special, and somewhat odd, address family of sockets, AF_NETLINK. > The GNU and NET-3 ifconfigs could have been adjusted to use this new API. The argument against doing so was that it was not portable to other operating systems, but these programs were in practice already not portable anyway so that was not much of an argument. > But they weren't adjusted, and remain as aforeshown to this day."
  - tyingq 7y ago
    That split where ioctl() is used for ipv4, and the send()/recv()/AF_NETLINK setup for ipv6 is interesting. I'm curious why the Linux folks chose that route. I'd get it as a temporary thing, but shouldn't they have migrated everything onto AF_NETLINK?
    - yencabulator 7y ago
      That's exactly what happened. Nobody bothered rewriting ifconfig to use the new APIs, because `ip` was the new hotness (and much more flexible and if not saner, at least differently insane).

dependenttypes 7y ago

Why are you using the dot for your site but not for stackexchange?

JdeBP 7y ago
Lazy copy and paste on my part. (-:
kccqzy 7y ago
This might be the first time in quite a few years that I've seen people using a dot like that. Any reasons to do so? I figured most people do not have weird DNS search domains or some such to warrant that dot.
- kbr2000 7y ago
  It would be good practice to do so, when you are referring to a FQDN. Apart from that, to circumvent badly configured paywall filters?
  - JdeBP 7y ago
    You both need to read http://jdebp.uk./FGA/web-fully-qualified-domain-name.html http://jdebp.uk./FGA/web-fully-qualified-domain-name.html , including the Hacker News person's reminiscences. (-:

halyconWays 7y ago

If you'd read the article you'd see that it talks about how people tried to update ifconfig.

Phemist 7y ago

Off-topic: I can't help but be nosy and check the https version of your page. You seem to be serving a cert with CN=albertstreetantiquescentre.co.uk. Might want to get this looked at :) Edit: Interesting, https://jdebp.uk https://jdebp.uk has the correct cert configured, whereas https://jdebp.uk https://jdebp.uk. serves the cert as mentioned above.

JdeBP 7y ago
That's the page on a shared hosting service, not served by me. See the site history page (still in the same place that it was a couple of years ago when it came up on Hacker News).
- internalthief 7y ago
  It's due to Apache not correctly matching the SNI when it is sent a FQDN ending in a period (.) More information: https://news.ycombinator.com/item?id=22632959 https://news.ycombinator.com/item?id=22632959
internalthief 7y ago
It seems that the server running on the other end doesn't properly match the certificate from the SNI if the domain sent by the browser is a FQDN (i.e. ends in a .) For example, try the following: openssl s_client -connect jdebp.uk:443 -servername "jdebp.uk." vs openssl s_client -connect jdebp.uk:443 -servername "jdebp.uk" You'll notice that in the first case the default certificate is sent back, in the second case the certificate is correctly matched against the SNI. According to the Server header returned: Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 Phusion_Passenger/5.3.7 Testing against an NGINX based server, I am not seeing the same results, in fact I am seeing the correct certificate being returned.
- tialaramex 7y ago
  The relevant RFC says not to send a trailing dot in SNI. Browsers should probably trim the dot out if present. Maybe they aren't doing so because it causes some unexpected compatibility mishap, maybe in reality it rarely causes any trouble so nobody got around to it.

beagle3 7y ago

Thanks for nosh. Another off-topic question (using this forum as your author page is quite discouraging about sending you emails ....) What's the reason for naming cyclog files with the time they were closed? (other than that's how djb did it?), since this information is available easily with 'ls -l'? I use a logger that opens a $CREATE_TIMESTAMP.u file, and makes "current" a symbolic link to it; and on close renames it to ".s", which I find more intuitive and informative (also provides time between log creation and first message, which is unavailable with cyclog). I was considering changing the ".u"/".s" marking to be an attribute (-w or +i or +t to signify "safely closed") to help repeated rsyncs of log directories, but haven't done that yet. I'm sure there's some useful aspect of existing cyclog/multilog behaviour that I'm missing, but I haven't been able to figure what it is for the last 10 years ...

JdeBP 7y ago
If you want more than just my perspective, look to Laurent Bercot's Supervision Mailing list. M. Bercot is of course there, as well as a few other people. * http://www.skarnet.org/lists.html http://www.skarnet.org/lists.html As for the filenames, yes the original reason was for compatibility with multilog, and of course all of the other tools that can process these log directories. I did set out, after all, to produce a cyclog workalike, with lessons from multilog incorporated. Note that said tools might not deal well with log directories where the same log file is available via two names, both "current" and something else. Moreover, if you go and look at follow-log-directories you can see an additional benefit that it very efficiently skips its cursors over old files without having to look at their i-nodes because it knows that the filename is guaranteed to be a timestamp at or after the last log entry in the file. Furthermore, if you go and read the cyclog manual, you'll find out why using the w permission bit had problems. (-: 1.41 is building up changes, by the way.
- beagle3 7y ago
  > Moreover, if you go and look at follow-log-directories you can see an additional benefit that it very efficiently skips its cursors over old files without having to look at their i-nodes because it knows that the filename is guaranteed to be a timestamp at or after the last log entry in the file. Thanks, that's two thing I've missed (because I never used it, I guess ..): This optimization and follow-log-directories+export-to-rsyslog which was introduced at a time I wasn't looking :) > Furthermore, if you go and read the cyclog manual, you'll find out why using the w permission bit had problems. (-: :) Indeed, thanks. > 1.41 is building up changes, by the way. Thanks! And since I've missed follow-log-directories (and export-to-rsyslog) before, maybe there's another tool I've missed that would make shipping log directories more efficient? I'm concerned with very-low-bandwidth, very-intermittently-connected servers in which rsync is a godsend and e.g. rsyslog and friends proved much less reliable and efficient; And the renaming of "current" makes it miss the fact that it already has an (almost complete) copy of said file under a different name. Thanks again!