Saturday, October 7, 2017

FreeBSD 11 Kernel file for VirtualBox

A kernel configuration file for FreeBSD 11 as a VirtualBox guest


#
# VIRTUALBOX Virtualbox kernel configuration for FreeBSD 11.1/x64
#

cpu HAMMER
ident VIRTUALBOX


makeoptions WITH_CTF=1 # Run ctfconvert(1) for DTrace support
options SCHED_ULE # ULE scheduler
options PREEMPTION # Enable kernel thread preemption
options INET # InterNETworking
options INET6 # IPv6 communications protocols
options IPSEC # IP (v4/v6) security
options TCP_OFFLOAD # TCP offload
options SCTP # Stream Control Transmission Protocol
options FFS # Berkeley Fast Filesystem
options SOFTUPDATES # Enable FFS soft updates support
options UFS_ACL # Support for access control lists
options UFS_DIRHASH # Improve performance on big directories
options UFS_GJOURNAL # Enable gjournal-based UFS journaling
options QUOTA # Enable disk quotas for UFS
options MD_ROOT # MD is a potential root device
options NFSCL # Network Filesystem Client
options NFSD # Network Filesystem Server
options NFSLOCKD # Network Lock Manager
options NFS_ROOT # NFS usable as /, requires NFSCL
options MSDOSFS # MSDOS Filesystem
options CD9660 # ISO 9660 Filesystem
options PROCFS # Process filesystem (requires PSEUDOFS)
options PSEUDOFS # Pseudo-filesystem framework
options GEOM_PART_GPT # GUID Partition Tables.
options GEOM_RAID # Soft RAID functionality.
options GEOM_LABEL # Provides labelization
options COMPAT_FREEBSD32 # Compatible with i386 binaries
options COMPAT_FREEBSD10 # Compatible with FreeBSD10
options SCSI_DELAY=5000 # Delay (in ms) before probing SCSI
options KTRACE # ktrace(1) support
options STACK # stack(9) support
options SYSVSHM # SYSV-style shared memory
options SYSVMSG # SYSV-style message queues
options SYSVSEM # SYSV-style semaphores
options _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options PRINTF_BUFR_SIZE=128 # Prevent printf output being interspersed.
options KBD_INSTALL_CDEV # install a CDEV entry in /dev
options HWPMC_HOOKS # Necessary kernel hooks for hwpmc(4)
options AUDIT # Security event auditing
options CAPABILITY_MODE # Capsicum capability mode
options CAPABILITIES # Capsicum capabilities
options MAC # TrustedBSD MAC Framework
options KDTRACE_FRAME # Ensure frames are compiled in
options KDTRACE_HOOKS # Kernel DTrace hooks
options DDB_CTF # Kernel ELF linker loads CTF data
options INCLUDE_CONFIG_FILE # Include this file in kernel
options RACCT # Resource accounting framework
options RACCT_DEFAULT_TO_DISABLED # Set kern.racct.enable=0 by default
options RCTL # Resource limits

# Debugging support.  Always need this:
options KDB # Enable kernel debugger support.
options KDB_TRACE # Print a stack trace for a panic.

# Make an SMP-capable kernel by default
options SMP # Symmetric MultiProcessor Kernel
options DEVICE_NUMA # I/O Device Affinity
options EARLY_AP_STARTUP

# CPU frequency control
device cpufreq

# Bus support.
device acpi
options ACPI_DMAR
device pci

# Floppy drives
device fdc

# ATA controllers
device ahci # AHCI-compatible SATA controllers
device ata # Legacy ATA/SATA controllers

# SCSI Controllers
device ahc # AHA2940 and onboard AIC7xxx devices
device ahd # AHA39320/29320 and onboard AIC79xx devices

# ATA/SCSI peripherals
device scbus # SCSI bus (required for ATA/SCSI)
device ch # SCSI media changers
device da # Direct Access (disks)
device sa # Sequential Access (tape etc)
device cd # CD
device pass # Passthrough device (direct ATA/SCSI access)
device ctl # CAM Target Layer

# atkbdc0 controls both the keyboard and the PS/2 mouse
device atkbdc # AT keyboard controller
device atkbd # AT keyboard
device psm # PS/2 mouse

device kbdmux # keyboard multiplexer

device vga # VGA video card driver
options VESA # Add support for VESA BIOS Extensions (VBE)

device splash # Splash screen and screen saver support

# syscons is the default console driver, resembling an SCO console
device sc
options SC_PIXEL_MODE # add support for the raster text mode

# vt is the new video console driver
device vt
device vt_vga
device vt_efifb

# Serial (COM) ports
device uart # Generic UART driver

# PCI Ethernet NICs.
device em # Intel PRO/1000 Gigabit Ethernet Family
device igb # Intel PRO/1000 PCIE Server Gigabit Family

# Pseudo devices.
device loop # Network loopback
device random # Entropy device
device rdrand_rng # Intel Bull Mountain RNG
device ether # Ethernet support
device vlan # 802.1Q VLAN support
device tun # Packet tunnel.
device md # Memory "disks"
device gif # IPv6 and IPv4 tunneling
device firmware # firmware assist module

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
# Note that 'bpf' is required for DHCP.
device bpf # Berkeley packet filter

# USB support
options USB_DEBUG # enable debug msgs
device uhci # UHCI PCI->USB interface
device ohci # OHCI PCI->USB interface
device ehci # EHCI PCI->USB interface (USB 2.0)
device xhci # XHCI PCI->USB interface (USB 3.0)
device usb # USB Bus (required)
device ukbd # Keyboard
device umass # Disks/Mass storage - Requires scbus and da

# Sound support
device sound # Generic sound driver (required)
device snd_hda # Intel High Definition Audio
device snd_ich # Intel, NVidia and other ICH AC'97 Audio


# VirtIO support
device virtio # Generic VirtIO bus (required)
device virtio_pci # VirtIO PCI device
device vtnet # VirtIO Ethernet device
device virtio_blk # VirtIO Block device
device virtio_scsi # VirtIO SCSI device
device virtio_balloon # VirtIO Memory Balloon device

# VMware support
device vmx # VMware VMXNET3 Ethernet

# Netmap provides direct access to TX/RX rings on supported NICs
device netmap # netmap(4) support

# The crypto framework is required by IPSEC
device crypto # Required by IPSEC

### EFLI Additions
options P1003_1B_SEMAPHORES # POSIX style demaphores
device cryptodev # For the aesni hw crypto extensions
device aesni # Ditto
device pf # pf packet filtering
device atapicam # Access ATAPI devices through the 
# CAM subsystem

Monday, October 26, 2015

On eHealth Solutions

Yesterday I had day surgery at the Mater hostpital in Pimlico (Townsville).

It was great to see how orderly and calm the staff were and how smooth the workflow went.

I can't comment on the operation itself because I was under anaesthesia, but every other part of it went like clockwork. On admission I noticed a typo in my address - this was corrected in under than two minutes.

But here's the thing: All the filing, record keeping, box ticking - at least what I could see - was done the traditional way. i.e. in a paper based file. I never saw a nurse or doctor go near a computer terminal.

If anything, the nurses were under worked. They certainly had plenty of time to attend to patients.

Coincidence?

Monday, September 28, 2015

Per Connection Queues on a Mikrotik Home Router

Per Connection Based Queues


Set up the address lists


/ip firewall address-list
add address=10.0.0.0/8 list="RFC 1918 Private"
add address=172.16.0.0/12 list="RFC 1918 Private"
add address=192.168.0.0/16 list="RFC 1918 Private"
add address=255.255.255.0 list="RFC 1918 Private"
add address=255.255.255.255 list="RFC 1918 Private"

/ipv6 firewall address-list
add address=2001:44b8:2143:8c00::/56 list=Local
add address=fe80::/16 list=Local

Now set up the packet tagging.


/ip firewall mangle
add action=mark-packet chain=forward dst-address-list="RFC 1918 Private" \
    new-packet-mark=MARK_LOCAL_TO_LOCAL passthrough=no src-address-list=\
    "RFC 1918 Private"
add action=mark-packet chain=forward in-interface=pppoe-out1 new-packet-mark=\
    MARK_INCOMING_HIGH_PRIORITY packet-size=0-123 passthrough=no protocol=tcp tcp-flags=\
    ack
add action=mark-packet chain=forward in-interface=pppoe-out1 new-packet-mark=\
    MARK_INCOMING_HIGH_PRIORITY passthrough=no protocol=udp src-port=53
add action=mark-packet chain=forward in-interface=pppoe-out1 new-packet-mark=\
    MARK_INCOMING_HIGH_PRIORITY passthrough=no protocol=tcp src-port=53
add action=mark-packet chain=forward in-interface=pppoe-out1 new-packet-mark=\
    MARK_INCOMING_NORMAL_PRIORITY passthrough=no
add action=mark-packet chain=forward in-interface=bridge-local new-packet-mark=\
    MARK_OUTGOING_HIGH_PRIORITY packet-size=0-123 passthrough=no protocol=tcp tcp-flags=\
    ack
add action=mark-packet chain=forward dst-port=53 in-interface=bridge-local \
    new-packet-mark=MARK_OUTGOING_HIGH_PRIORITY passthrough=no protocol=udp
add action=mark-packet chain=forward dst-port=53 in-interface=bridge-local \
    new-packet-mark=MARK_OUTGOING_HIGH_PRIORITY passthrough=no protocol=tcp
add action=mark-packet chain=forward in-interface=bridge-local new-packet-mark=\
    MARK_OUTGOING_NORMAL_PRIORITY passthrough=no
add action=mark-packet chain=forward log=yes log-prefix="Mark: should not get here" \
    new-packet-mark=error passthrough=no


/ipv6 firewall mangle
add action=mark-packet chain=forward dst-address-list=Local new-packet-mark=\
    MARK_LOCAL_TO_LOCAL passthrough=no src-address-list=Local
add action=mark-packet chain=forward in-interface=pppoe-out1 new-packet-mark=\
    MARK_INCOMING_HIGH_PRIORITY packet-size=0-123 passthrough=no protocol=tcp tcp-flags=\
    ack
add action=mark-packet chain=forward in-interface=pppoe-out1 new-packet-mark=\
    MARK_INCOMING_HIGH_PRIORITY passthrough=no protocol=udp src-port=53
add action=mark-packet chain=forward in-interface=pppoe-out1 new-packet-mark=\
    MARK_INCOMING_HIGH_PRIORITY passthrough=no protocol=tcp src-port=53
add action=mark-packet chain=forward in-interface=pppoe-out1 new-packet-mark=\
    MARK_INCOMING_NORMAL_PRIORITY passthrough=no
add action=mark-packet chain=forward in-interface=bridge-local new-packet-mark=\
    MARK_OUTGOING_HIGH_PRIORITY packet-size=0-123 passthrough=no protocol=tcp tcp-flags=\
    ack
add action=mark-packet chain=forward dst-port=53 in-interface=bridge-local \
    new-packet-mark=MARK_OUTGOING_HIGH_PRIORITY passthrough=no protocol=udp
add action=mark-packet chain=forward dst-port=53 in-interface=bridge-local \
    new-packet-mark=MARK_OUTGOING_HIGH_PRIORITY passthrough=no protocol=tcp
add action=mark-packet chain=forward in-interface=bridge-local new-packet-mark=\
    MARK_OUTGOING_NORMAL_PRIORITY passthrough=no
add action=mark-packet chain=forward new-packet-mark=error passthrough=no

Add the queue types


/queue type
add kind=pcq name=pcq-download pcq-classifier=dst-address pcq-limit=128k \
    pcq-src-address-mask=0 pcq-src-address6-mask=0
add kind=pcq name=pcq-upload pcq-classifier=src-address pcq-dst-address-mask=0 \
    pcq-dst-address6-mask=0 pcq-limit=128k

And now add the queue tree


/queue tree
add burst-limit=20M burst-time=2s limit-at=10M max-limit=18M name=Total_Upload parent=\
    global priority=1 queue=default
add burst-limit=50M burst-time=10s limit-at=25M max-limit=48M name=Total_Download \
    parent=global priority=1 queue=default
add burst-limit=2M burst-threshold=2M burst-time=2s limit-at=256k max-limit=2M name=\
    incoming_high_priority packet-mark=MARK_INCOMING_HIGH_PRIORITY parent=Total_Download \
    priority=1 queue=pcq-download
add burst-limit=50M burst-threshold=50M burst-time=2s limit-at=256k max-limit=50M name=\
    incoming_normal_priority packet-mark=MARK_INCOMING_NORMAL_PRIORITY parent=\
    Total_Download priority=2 queue=pcq-download
add burst-limit=1M burst-threshold=1M burst-time=2s limit-at=256k max-limit=1M name=\
    outgoing_high_priority packet-mark=MARK_OUTGOING_HIGH_PRIORITY parent=Total_Upload \
    priority=1 queue=pcq-upload
add burst-limit=20M burst-threshold=20M burst-time=2s limit-at=256k max-limit=20M name=\
    outgoing_normal_priority packet-mark=MARK_OUTGOING_NORMAL_PRIORITY parent=\
    Total_Upload priority=2 queue=pcq-upload