Linux system time and time zone

Linux上設定time zone的方式有
1.設定環境變數TZ
  TZ=GMT-8

2.編輯/etc/TZ
  echo GMT-8 > /etc/TZ

http://www.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap08.html

以台灣為例,GMT或UTC時區為+8:00(超前8小時)
但TZ環境變數中的超前為負號,故要設為GMT-8, UTC-8 or GMT-8:00也可以
(其實任意XXX-8都可以)

http://linux.vbird.org/linux_server/0440ntp.php

GMT : Greenwich Mean Time (格林威治時間)
UTC : Coordinated Universal Time (協和標準時間)
CST : China Standard Time
epoch : The Unix epoch is the time 00:00:00 UTC on January 1 1970

系統時間可以透過NTP來校正.
而所得到的時間為再透過time zone設定就是local time了

Process handle tips

一些處理行程的技巧

1.防止zombie process產生

http://home.educities.edu.tw/shirock/comp/Anti_zombie_process.htm

linux上的正解

int child_stat;

void reapchild() { 
  while( wait(&child_stat) <= 0 ) 
    /*NOTHING or your code*/; 
} 

. . . 
struct sigaction act; 
act.sa_handler = reapchild; 
act.sa_flags = SA_NOCLDSTOP; /* Do not signal while process paused */
sigaction( SIGCHLD, &act, NULL); 

這個方式不適合在寫library時用
只要用library的人去重設signal就完了

2.system(const char *string)的傳回值

system這個function的return value傳回的是fork process的return value
並不是所執行的程式傳回值.

要拿到執行的程式傳回值要用以下方式

  #include 

  int r;
  r = system("ifconfig eth0");
  if(WEXITSTATUS(r) == 1) /*Fail*/
    return;


2.Fork

  pid_t pid;
  if((pid = vfork()) == 0)  { /*Child*/
    execl("/bin/ping", "ping", "-c", "3", ip, (char *)0);
    _exit(127);
  } else if(pid < 0)
    perror("fork");
  else  /*Parent*/
    dev->ping->pid = pid;

  .......
  .......

  int status;
  pid_t pid = waitpid(dev->ping->pid, &status, WNOHANG);
  if(pid > 0)
  if(WIFEXITED(status)) {
   dev->ping->pid = 0;
   if(WEXITSTATUS(status) != 0)  {  /*ping without response*/
    SxNetDev_Fail(dev, "Ping fail");
    return;
  } else  {
    SxNetDev_Connect(dev);
    SxNetDev_Ping(dev, config->pppoe.ping);
  }
  }

F3F 大同山 45.06

0373_0802 from Flying Apple on Vimeo.

F3F 鐵鉆山 41.24

Linux Networking Security

網路攻擊簡介
http://www.iii.org.tw/adc/papers/thesis/00B02.htm

鳥哥的私房菜
 Linux 防火牆與 NAT 主機

Linux CLDP文件,說明各種受到攻擊時的對策
http://www.linux.org.tw/CLDP/OLD/Adv-Routing-HOWTO-16.html

目前linux kernel對大部分的攻擊應該都已經有防禦能力.
以下是linux的一些防禦對策.

1.TCP Sync Attack

Enable kernel feature - TCP Syncookies
echo "1" > /proc/sys/net/ipv4/tcp_syncookies

2.Smurf

不回應broadcast ICMP封包
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

3.防止惡意竄改的封包

echo "1" > /proc/sys/net/ipv4/rp_filter

4.用iptables建立一些基礎防禦

阻擋異樣ICMP封包

iptables -A INPUT -p icmp --icmp-type echo-request -j REJECT

或是

iptables -I INPUT -p icmp --icmp-type echo-request -m limit --limit 6/min --limit-burst 4 -j ACCEPT

阻擋port scan

iptables -A INPUT -i eth0 -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A INPUT -i eth0 -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -i eth0 -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
iptables -A INPUT -i eth0 -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -i eth0 -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -i eth0 -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

Patch for dillo cross compile friendly

--- VT300/dillo2/configure.in    2009-07-03 21:08:27.000000000 +0800
+++ S3C2440/dillo2/configure.in    2009-07-03 20:53:30.000000000 +0800
@@ -95,10 +95,10 @@
 dnl (this is somewhat a religious problem)
 dnl --------------------------------------
 dnl
-if test "`$CPP -v < /dev/null 2>&1 | grep '/usr/local/include' 2>&1`" = ""; then
-  CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-  LDFLAGS="$LDFLAGS -L/usr/local/lib"
-fi
+dnl if test "`$CPP -v < /dev/null 2>&1 | grep '/usr/local/include' 2>&1`" = ""; then
+dnl   CPPFLAGS="$CPPFLAGS -I/usr/local/include"
+dnl   LDFLAGS="$LDFLAGS -L/usr/local/lib"
+dnl fi
 
 dnl ------------------------------------
 dnl Check for socket libs (AIX, Solaris)
@@ -145,12 +145,18 @@
 dnl ----------------------
 dnl
 dnl For debugging and to be user friendly
+
+dnl Check if the user hasn't set the variable $FLTK2_CONFIG
+  if test -z "$FLTK2_CONFIG"; then
+    PNG_CONFIG=`which fltk2-config`
+  fi
+
 AC_MSG_CHECKING([FLTK2])
 if sh -c "fltk2-config --version" >/dev/null 2>&1
 then AC_MSG_RESULT(yes)
-     LIBFLTK_CXXFLAGS=`fltk2-config --cxxflags`
-     LIBFLTK_CFLAGS=`fltk2-config --cflags`
-     LIBFLTK_LIBS=`fltk2-config --use-images --ldflags`
+     LIBFLTK_CXXFLAGS=`$FLTK2_CONFIG --cxxflags`
+     LIBFLTK_CFLAGS=`$FLTK2_CONFIG --cflags`
+     LIBFLTK_LIBS=`$FLTK2_CONFIG --use-images --ldflags`
 else AC_MSG_RESULT(no)
      AC_ERROR(FLTK2 must be installed!)
 fi

20090628鐵鉆山 Ascot F3F