virtual runabout

To move a vm (on vmare 5.5.5) from

kernel 2.6.18-gentoo-r6 (old tools from the iso image)

to

kernel 2.6.24-gentoo-r3 and open-vm-tools (keyworded in portage)

1. the kernel LSI scsi driver is borked - resulting in the kernel panicing when it can't find the root device. Fix that by hand applying this patch.
2. the pcnet32 driver loads, but its interrupt is immediately disabled and no interface is created- so switch to the e1000 driver and be happy.
   

The vmx incantation to get an e1000 is:

ethernet0.virtualDev = "e1000"

And an updated patch:

--- mptbase.c_orig 2008-03-20 21:15:32.000000000 +0000
+++ mptbase.c 2008-03-20 21:17:46.000000000 +0000
@@ -2844,6 +2844,18 @@
pfacts->IOCStatus = le16_to_cpu(pfacts->IOCStatus);
pfacts->IOCLogInfo = le32_to_cpu(pfacts->IOCLogInfo);
pfacts->MaxDevices = le16_to_cpu(pfacts->MaxDevices);
+
+ /*
+ * VMware emulation is broken, its PortFact's MaxDevices reports value
+ * programmed by IOC Init, so if you program IOC Init to 256 (which is 0,
+ * as that field is only 8 bit), it reports back 0 in port facts, instead
+ * of 256... And unfortunately using 256 triggers another bug in the
+ * code (parallel SCSI can have only 16 devices).
+ */
+ if (pfacts->MaxDevices == 0) {
+ pfacts->MaxDevices = 16;
+ }
+
pfacts->PortSCSIID = le16_to_cpu(pfacts->PortSCSIID);
pfacts->ProtocolFlags = le16_to_cpu(pfacts->ProtocolFlags);
pfacts->MaxPostedCmdBuffers = le16_to_cpu(pfacts->MaxPostedCmdBuffers);

Switching to the buslogic driver (especially for new systems) would seem to be a better medium term solution.

The e1000 needs to be blacklisted to allow vmxnet grab the virtual ethernet dev - but a job for another day.

Network Slight of Hand

The mysql proxy cookbook has this recipe:

iptables -t nat -I PREROUTING \
-s ! 127.0.0.1 -p tcp \
--dport 3306 -j \
REDIRECT --to-ports 4040

It redirects remote clients attempting to connect to the default mysqld listen port to the mysql proxy daemon instead.

I had a legacy application with no support for port selection:

iptables -t nat -I PREROUTING \
-p tcp --destination dummyhostname --dport 3306 \
-j REDIRECT --to-ports 4040

This directs any connection to the dummy host port 3306 to instead go to the proxy - neat.

From this HP-UX security summary we see that HP-UX has ipfilter (new enough versions seem to have nat - older ones don't) and puts filter rules in /etc/opt/ipf/ipf.conf :

rdr lan0 20.20.20.5/32 port 80 -> 192.168.0.5 port 8000

redirects traffic from port 80 to port 8000, or how about some load balancing:

rdr lan0 20.20.20.5/32 port 80 -> 192.168.0.5,192.168.0.6 port 8000

A useful trick where the legacy application doesn't know about off host destinations and you would like to punt some of the load to another box.

ipf won't act as a reflector, which appears to mean that something like this doesn't work, even when I think that it should:

/etc/opt/ipf/ipnat.conf:
rdr lo0 127.0.0.1/32 port 7777 -> 192.168.0.42 port 23

# ipnat -CF -f /etc/opt/ipf/ipnat.conf
# ipnat -l
# ipnat -sv

Curious, as the interfaces are different.

Its also not clear if you have to enable ip forwarding on HP-UX with:

# ndd -set /dev/ip ip_forwarding 1
# ndd -get /dev/ip ip_forwarding