[pfSense Support] OpenBGPD
After seeing the flurry of commits to this package, I was curious, and tried it out with a half dozen VMs in a basic 'core and border' setup. I'd like to play with it a bit more and see what it's really capable of. Are there any good guides out there on using openBGPD, maybe even specific to pfSense? One thing I couldn't figure out how to do is restricting announcements. For example, my upstream carriers restrict my BGP announces so that I can't announce networks that don't belong to me, like 74.125.0.0/16, and steal Google's traffic. :-) Thank You, Nathan Eisenberg Sr. Systems Administrator Atlas Networks, LLC - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPD
Hi Nathan, On Fri, Aug 21, 2009 at 10:18, Nathan Eisenberg wrote: > After seeing the flurry of commits to this package, I was curious, and tried > it out with a half dozen VMs in a basic 'core and border' setup. > > I'd like to play with it a bit more and see what it's really capable of. Are > there any good guides out there on using openBGPD, maybe even specific to > pfSense? One thing I couldn't figure out how to do is restricting > announcements. > > For example, my upstream carriers restrict my BGP announces so that I can't > announce networks that don't belong to me, like 74.125.0.0/16, and steal > Google's traffic. :-) I'll suggest: http://www.openbsd.org/cgi-bin/man.cgi?query=bgpd.conf (the definitions of filters is about 2/3 down) http://www.openbsd.org/papers/linuxtag06-network.pdf ("real-life" examples) Regards, Aarno -- Aarno Aukia Atrila GmbH Switzerland - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPD
Nathan Eisenberg wrote: After seeing the flurry of commits to this package, I was curious, and tried it out with a half dozen VMs in a basic 'core and border' setup. I'd like to play with it a bit more and see what it's really capable of. Are there any good guides out there on using openBGPD, maybe even specific to pfSense? One thing I couldn't figure out how to do is restricting announcements. For example, my upstream carriers restrict my BGP announces so that I can't announce networks that don't belong to me, like 74.125.0.0/16, and steal Google's traffic. :-) Thank You, Nathan Eisenberg Sr. Systems Administrator Atlas Networks, LLC - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org If you understand BGP without any relation to whatever platform it is used on then its configuration is pretty straightforward. I found pretty nice document explaining OpenBGPD implementation http://www.openbsd.org/papers/linuxtag06-network.pdf plus numerious howtos. You can play with restrictions by using deny from/allow from in RawConfig tab, for now this feature is not supported via gui. Eugene. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
RE: [pfSense Support] OpenBGPD
> -Original Message- > From: Evgeny Yurchenko [mailto:evg.yu...@rogers.com] > Sent: Friday, August 21, 2009 5:46 AM > To: support@pfsense.com > Subject: Re: [pfSense Support] OpenBGPD > > If you understand BGP without any relation to whatever platform it is > used on then its configuration is pretty straightforward. > I found pretty nice document explaining OpenBGPD implementation > http://www.openbsd.org/papers/linuxtag06-network.pdf plus numerious > howtos. > You can play with restrictions by using deny from/allow from in > RawConfig tab, for now this feature is not supported via gui. > > Eugene. > > > - I have a moderate understanding of how BGP works, but have much to learn. I would love to see the ability to restrict announcements to specific networks added to the GUI. I'd bet that more polish on this package could let PFSense enter the 'core router' arena. Ah, were I a programmer... Best Regards, Nathan Eisenberg - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPD
Nathan Eisenberg wrote: I have a moderate understanding of how BGP works, but have much to learn. I would love to see the ability to restrict announcements to specific networks added to the GUI. I'd bet that more polish on this package could let PFSense enter the 'core router' arena. Ah, were I a programmer... Best Regards, Nathan Eisenberg There was a bounty http://forum.pfsense.org/index.php/topic,8480.0.html requesting many improvements for OpenBGPD package but it showed lack of interest from public. Eugene. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
RE: [pfSense Support] OpenBGPD
> -Original Message- > From: Evgeny Yurchenko [mailto:evg.yu...@rogers.com] > Sent: Saturday, August 22, 2009 7:24 AM > To: support@pfsense.com > Subject: Re: [pfSense Support] OpenBGPD > > There was a bounty http://forum.pfsense.org/index.php/topic,8480.0.html > requesting many improvements for OpenBGPD package but it showed lack of > interest from public. > > Eugene. > > - Looks like someone else is offering to reopen it. If the original posters come back, that's an $800 bounty. Not bad! :) http://forum.pfsense.org/index.php/topic,15785.0.html Best Regards, Nathan Eisenberg - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPD
Nathan Eisenberg wrote: Looks like someone else is offering to reopen it. If the original posters come back, that's an $800 bounty. Not bad! :) http://forum.pfsense.org/index.php/topic,15785.0.html Best Regards, Nathan Eisenberg hmm, indeed... I did not see this post. But it seems previous posters do not confirm their interest in these improvements, though I do not know how these bounties work. And... Scott was going to pick up this bounty ;-) - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
[pfSense Support] OpenBGPD missing breaket
When you do not specify groups and more then one neighbor bgpd.conf is missing right closing breaket and 'descr' does not look: neighbor 2.2.2.252 { descr "left" set localpref 50 remote-as 65444 neighbor 2.2.3.253 { descr "right" remote-as 65444 } Could you please fix this? --- openbgpd.inc.20091211.bak2009-12-10 11:26:10.0 -0500 +++ openbgpd.inc2009-12-11 17:15:09.76300 -0500 @@ -110,7 +110,7 @@ $used_this_item = false; if($neighbor['groupname'] == "") { $conffile .= "neighbor {$neighbor['neighbor']} {\n"; - $conffile .= "descr \"{$neighbor['descr']}\"\n"; + $conffile .= "descr \"{$neighbor['descr']}\"\n"; $setkeycf .= "delete {$openbgpd_conf['listenip']} {$neighbor['neighbor']} tcp 0x1000;\n"; if ($neighbor['md5sigpass']) { $setkeycf .= "add {$openbgpd_conf['listenip']} {$neighbor['neighbor']} tcp 0x1000 -A tcp-md5 \"{$neighbor['md5sigpass']}\";\n"; @@ -125,9 +125,9 @@ $conffile .= "{$row['paramaters']} {$row['parmvalue']} \n"; } } +if($used_this_item) + $conffile .= "}\n"; } - if($used_this_item) -$conffile .= "}\n"; } // OpenBGPD filters Thanks, Evgeny. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
[pfSense Support] OpenBGPD status page
I know it is cosmetic but it is easy to fix, please do it. 1) Status has two "OpenBGPD Routing" sections, one of them should be renamed to "Forwarding" as it shows fib not rib. 2) "OpenBGPD IP" section returns error missing argument: valid commands/args: bgp it happens because not there is not "bgpctl show ip" command, we have to use "bgpctl show ip bgp" Fix for both issues: --- openbgpd_status.php.20091211.bak2009-12-10 11:26:10.0 -0500 +++ openbgpd_status.php 2009-12-11 19:20:28.83700 -0500 @@ -140,10 +140,10 @@ defCmdT("OpenBGPD Summary","bgpctl show summary"); defCmdT("OpenBGPD Interfaces","bgpctl show interfaces"); defCmdT("OpenBGPD Routing","bgpctl show rib"); -defCmdT("OpenBGPD Routing","bgpctl show fib"); +defCmdT("OpenBGPD Forwarding","bgpctl show fib"); defCmdT("OpenBGPD Network","bgpctl show network"); defCmdT("OpenBGPD Nexthops","bgpctl show nexthop"); -defCmdT("OpenBGPD IP","bgpctl show ip"); +defCmdT("OpenBGPD IP","bgpctl show ip bgp"); defCmdT("OpenBGPD Neighbors","bgpctl show neighbor"); ?> Thanks, Evgeny. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
[pfSense Support] OpenBGPd raw config edit
Hello, Attached is a patch to allow the more experienced BGP admin to edit the raw bgpd.conf in the WebConfigurator. This is against https://rcs.pfsense.org/projects/pfsense-packages/repos/mainline/trees/master/config/openbgpd/. Regards, Aarno -- Aarno Aukia Atrila GmbH Switzerland pfsense-openbgpd-rawconfig.diff Description: Binary data - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPD status page
On Fri, Dec 11, 2009 at 7:26 PM, Evgeny Yurchenko wrote: > I know it is cosmetic but it is easy to fix, please do it. > > 1) Status has two "OpenBGPD Routing" sections, one of them should be renamed > to "Forwarding" as it shows fib not rib. > 2) "OpenBGPD IP" section returns error > > missing argument: > valid commands/args: > bgp > > it happens because not there is not "bgpctl show ip" command, we have to use > "bgpctl show ip bgp" > > Fix for both issues: > --- openbgpd_status.php.20091211.bak 2009-12-10 11:26:10.0 -0500 > +++ openbgpd_status.php 2009-12-11 19:20:28.83700 -0500 > @@ -140,10 +140,10 @@ > defCmdT("OpenBGPD Summary","bgpctl show summary"); defCmdT("OpenBGPD > Interfaces","bgpctl show interfaces"); defCmdT("OpenBGPD Routing","bgpctl > show rib"); -defCmdT("OpenBGPD Routing","bgpctl show fib"); > +defCmdT("OpenBGPD Forwarding","bgpctl show fib"); defCmdT("OpenBGPD > Network","bgpctl show network"); defCmdT("OpenBGPD Nexthops","bgpctl show > nexthop"); -defCmdT("OpenBGPD IP","bgpctl show ip"); +defCmdT("OpenBGPD > IP","bgpctl show ip bgp"); defCmdT("OpenBGPD Neighbors","bgpctl show > neighbor"); > ?> Thanks, all of the submissions have been committed. Scott - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd raw config edit
On Tue, Jun 30, 2009 at 11:58 AM, Aarno Aukia wrote: > Hello, > > Attached is a patch to allow the more experienced BGP admin to edit > the raw bgpd.conf in the WebConfigurator. > > This is against > https://rcs.pfsense.org/projects/pfsense-packages/repos/mainline/trees/master/config/openbgpd/. Hi, Thanks for this! One question: how would you prevent the raw edited configuration from automatically be overwritten by the GUI? Scott - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd raw config edit
Hi Scott, On Tue, Jun 30, 2009 at 18:21, Scott Ullrich wrote: > On Tue, Jun 30, 2009 at 11:58 AM, Aarno Aukia wrote: >> Hello, >> >> Attached is a patch to allow the more experienced BGP admin to edit >> the raw bgpd.conf in the WebConfigurator. >> >> This is against >> https://rcs.pfsense.org/projects/pfsense-packages/repos/mainline/trees/master/config/openbgpd/. > > Hi, > > Thanks for this! One question: how would you prevent the raw edited > configuration from automatically be overwritten by the GUI? As noted on the "Raw config" site itself, the GUI-configuration is ignored as long as there is raw config present. One can empty out the raw config and then start using the gui again. -Aarno -- Aarno Aukia Atrila GmbH Switzerland - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd raw config edit
On Tue, Jun 30, 2009 at 3:12 PM, Aarno Aukia wrote: > As noted on the "Raw config" site itself, the GUI-configuration is > ignored as long as there is raw config present. One can empty out the > raw config and then start using the gui again. Thanks, that is perfect. I have to admit that I did not read the "Raw config" as of yet as I have about 2 pages of TODO's left. I will commit this patch shortly. Thanks for the submission! Scott - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd raw config edit
On Tue, Jun 30, 2009 at 21:30, Scott Ullrich wrote: > On Tue, Jun 30, 2009 at 3:12 PM, Aarno Aukia wrote: >> As noted on the "Raw config" site itself, the GUI-configuration is >> ignored as long as there is raw config present. One can empty out the >> raw config and then start using the gui again. > > Thanks, that is perfect. I have to admit that I did not read the > "Raw config" as of yet as I have about 2 pages of TODO's left. np. Corrected patch (with correct highlighting of the selected tab) attached. -Aarno -- Aarno Aukia Atrila GmbH Switzerland pfsense-openbgpd-rawconfig.diff Description: Binary data - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd raw config edit
On Wed, Jul 1, 2009 at 6:41 AM, Aarno Aukia wrote: > Corrected patch (with correct highlighting of the selected tab) attached. Patch was already applied. You need to submit a change on top of what is commited: sullrich$ patch < ~/Downloads/pfsense-openbgpd-rawconfig.diff patching file openbgpd.inc Reversed (or previously applied) patch detected! Assume -R? [n] ^C Thanks - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd raw config edit
On Wed, Jul 1, 2009 at 19:07, Scott Ullrich wrote: > On Wed, Jul 1, 2009 at 6:41 AM, Aarno Aukia wrote: >> Corrected patch (with correct highlighting of the selected tab) attached. > > Patch was already applied. You need to submit a change on top of what > is commited: > > sullrich$ patch < ~/Downloads/pfsense-openbgpd-rawconfig.diff > patching file openbgpd.inc > Reversed (or previously applied) patch detected! Assume -R? [n] ^C That would be the following two-liner. -Aarno diff -urN openbgpd.med/openbgpd_raw.php openbgpd/openbgpd_raw.php --- openbgpd.med/openbgpd_raw.php 2009-07-02 13:43:30.0 +0200 +++ openbgpd/openbgpd_raw.php 2009-07-01 10:03:26.0 +0200 @@ -56,7 +56,7 @@ $tab_array[] = array(gettext("Neighbors"), false, "/pkg.php?xml=openbgpd_neighbors.xml"); $tab_array[] = array(gettext("Groups"), false, "/pkg.php?xml=openbgpd_groups.xml"); $tab_array[] = array(gettext("Raw config"), true, "/openbgpd_raw.php"); - $tab_array[] = array(gettext("Status"), true, "/openbgpd_status.php"); + $tab_array[] = array(gettext("Status"), false, "/openbgpd_status.php"); display_top_tabs($tab_array); ?> diff -urN openbgpd.med/openbgpd_status.php openbgpd/openbgpd_status.php --- openbgpd.med/openbgpd_status.php2009-07-02 13:43:30.0 +0200 +++ openbgpd/openbgpd_status.php2009-07-01 10:03:46.0 +0200 @@ -120,7 +120,7 @@ $tab_array[] = array(gettext("Settings"), false, "/pkg_edit.php?xml=openbgpd.xml&id=0"); $tab_array[] = array(gettext("Neighbors"), false, "/pkg.php?xml=openbgpd_neighbors.xml"); $tab_array[] = array(gettext("Groups"), false, "/pkg.php?xml=openbgpd_groups.xml"); - $tab_array[] = array(gettext("Raw config"), true, "/openbgpd_raw.php"); + $tab_array[] = array(gettext("Raw config"), false, "/openbgpd_raw.php"); $tab_array[] = array(gettext("Status"), true, "/openbgpd_status.php"); display_top_tabs($tab_array); ?> -- Aarno Aukia Atrila GmbH Switzerland - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd raw config edit
On Thu, Jul 2, 2009 at 7:44 AM, Aarno Aukia wrote: > $tab_array[] = array(gettext("Status"), false, "/openbgpd_status.php"); Thanks, commited! Scott - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
[pfSense Support] OpenBGPd package on 1.2.3-release
Hello, bgpd is started twice when booting on 1.2.3-release with the newest package. I suspect once from /usr/local/pkg/openbgpd.inc and once from /usr/local/etc/rc.d/bgpd.sh ? When commenting out the exec("bgpd") in /usr/local/pkg/openbgpd.inc it is only started once. Should the check is_openbgpd_running() also be added to /usr/local/etc/rc.d/bgpd.sh or is there a more favorable way ? In addition I discovered support for tcp-md5sig, which only works for openbgpd-configurations made with the assisstant. I'll try to hack something up for parsing the "raw config" and generating a bgpdsetkey.conf. Any suggestions there ? Regards, Aarno -- Aarno Aukia Atrila GmbH Switzerland - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd package on 1.2.3-release
On Thu, Jan 28, 2010 at 10:57 AM, Aarno Aukia wrote: > Hello, > > bgpd is started twice when booting on 1.2.3-release with the newest > package. I suspect once from /usr/local/pkg/openbgpd.inc and once from > /usr/local/etc/rc.d/bgpd.sh ? When commenting out the exec("bgpd") in > /usr/local/pkg/openbgpd.inc it is only started once. Should the check > is_openbgpd_running() also be added to /usr/local/etc/rc.d/bgpd.sh or > is there a more favorable way ? Sounds reasonable. > In addition I discovered support for tcp-md5sig, which only works for > openbgpd-configurations made with the assisstant. I'll try to hack > something up for parsing the "raw config" and generating a > bgpdsetkey.conf. Any suggestions there ? No suggestions at the moment but I would appreciate anything you can send over in form of patches. Have been super busy lately and not enough time to go around unfortunately. Scott - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd package on 1.2.3-release
Hello, On Fri, Jan 29, 2010 at 00:06, Scott Ullrich wrote: > On Thu, Jan 28, 2010 at 10:57 AM, Aarno Aukia wrote: >> bgpd is started twice when booting on 1.2.3-release with the newest >> package. I suspect once from /usr/local/pkg/openbgpd.inc and once from >> /usr/local/etc/rc.d/bgpd.sh ? When commenting out the exec("bgpd") in >> /usr/local/pkg/openbgpd.inc it is only started once. Should the check >> is_openbgpd_running() also be added to /usr/local/etc/rc.d/bgpd.sh or >> is there a more favorable way ? > > Sounds reasonable. That would be: $ diff -urNp openbgpd.inc.old openbgpd.inc --- openbgpd.inc.old2010-01-29 16:53:08.0 +0100 +++ openbgpd.inc2010-01-29 17:00:55.0 +0100 @@ -153,7 +153,11 @@ function openbgpd_install_conf() { $fd = fopen("/usr/local/etc/rc.d/bgpd.sh","w"); fwrite($fd, "#!/bin/sh\n\n"); fwrite($fd, "# This file was created by the pfSense package manager. Do not edit!\n\n"); - fwrite($fd, "/usr/local/sbin/bgpd -f /usr/local/etc/bgpd.conf\n"); + fwrite($fd, "NUMBGPD=`ps auxw | grep bgpd | grep parent | grep -v grep | wc -l | awk '{print \$1}'`\n"); + fwrite($fd, "#echo \$NUMBGPD\n"); + fwrite($fd, "if [ \$NUMBGPD -lt 0 ] ; then\n"); + fwrite($fd, " /usr/local/sbin/bgpd -f /usr/local/etc/bgpd.conf\n"); + fwrite($fd, "fi\n"); fclose($fd); exec("chmod a+rx /usr/local/etc/rc.d/bgpd.sh"); exec("chmod a-rw /usr/local/etc/bgpd.conf"); Thanks for committing, Aarno -- Aarno Aukia Atrila GmbH Switzerland - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd package on 1.2.3-release
On Fri, Jan 29, 2010 at 11:03 AM, Aarno Aukia wrote: > Thanks for committing, Committed. Thanks for submitting. Scott - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd package on 1.2.3-release
On Fri, Jan 29, 2010 at 5:03 PM, Aarno Aukia wrote: > Hello, > > On Fri, Jan 29, 2010 at 00:06, Scott Ullrich wrote: > > On Thu, Jan 28, 2010 at 10:57 AM, Aarno Aukia > wrote: > >> bgpd is started twice when booting on 1.2.3-release with the newest > >> package. I suspect once from /usr/local/pkg/openbgpd.inc and once from > >> /usr/local/etc/rc.d/bgpd.sh ? When commenting out the exec("bgpd") in > >> /usr/local/pkg/openbgpd.inc it is only started once. Should the check > >> is_openbgpd_running() also be added to /usr/local/etc/rc.d/bgpd.sh or > >> is there a more favorable way ? > > > > Sounds reasonable. > > That would be: > $ diff -urNp openbgpd.inc.old openbgpd.inc > --- openbgpd.inc.old2010-01-29 16:53:08.0 +0100 > +++ openbgpd.inc2010-01-29 17:00:55.0 +0100 > @@ -153,7 +153,11 @@ function openbgpd_install_conf() { >$fd = fopen("/usr/local/etc/rc.d/bgpd.sh","w"); >fwrite($fd, "#!/bin/sh\n\n"); >fwrite($fd, "# This file was created by the pfSense package manager. > Do not edit!\n\n"); > - fwrite($fd, "/usr/local/sbin/bgpd -f /usr/local/etc/bgpd.conf\n"); > + fwrite($fd, "NUMBGPD=`ps auxw | grep bgpd | grep parent | grep -v > grep | wc -l | awk '{print \$1}'`\n"); > + fwrite($fd, "#echo \$NUMBGPD\n"); > + fwrite($fd, "if [ \$NUMBGPD -lt 0 ] ; then\n"); > + fwrite($fd, " /usr/local/sbin/bgpd -f > /usr/local/etc/bgpd.conf\n"); > + fwrite($fd, "fi\n"); >fclose($fd); >exec("chmod a+rx /usr/local/etc/rc.d/bgpd.sh"); >exec("chmod a-rw /usr/local/etc/bgpd.conf"); > > This is missing a bgpctl reload in an else?! > Thanks for committing, > Aarno > -- > Aarno Aukia > Atrila GmbH > Switzerland > > - > To unsubscribe, e-mail: support-unsubscr...@pfsense.com > For additional commands, e-mail: support-h...@pfsense.com > > Commercial support available - https://portal.pfsense.org > > -- Ermal
Re: [pfSense Support] OpenBGPd package on 1.2.3-release
Hello Ermal, On Mon, Feb 1, 2010 at 09:35, Ermal Luçi wrote: > On Fri, Jan 29, 2010 at 5:03 PM, Aarno Aukia wrote: >> On Fri, Jan 29, 2010 at 00:06, Scott Ullrich wrote: >> > On Thu, Jan 28, 2010 at 10:57 AM, Aarno Aukia >> > wrote: >> >> bgpd is started twice when booting on 1.2.3-release with the newest >> >> package. I suspect once from /usr/local/pkg/openbgpd.inc and once from >> >> /usr/local/etc/rc.d/bgpd.sh ? When commenting out the exec("bgpd") in >> >> /usr/local/pkg/openbgpd.inc it is only started once. Should the check >> >> is_openbgpd_running() also be added to /usr/local/etc/rc.d/bgpd.sh or >> >> is there a more favorable way ? >> > >> > Sounds reasonable. >> >> That would be: >> $ diff -urNp openbgpd.inc.old openbgpd.inc >> --- openbgpd.inc.old 2010-01-29 16:53:08.0 +0100 >> +++ openbgpd.inc 2010-01-29 17:00:55.0 +0100 >> @@ -153,7 +153,11 @@ function openbgpd_install_conf() { >> $fd = fopen("/usr/local/etc/rc.d/bgpd.sh","w"); >> fwrite($fd, "#!/bin/sh\n\n"); >> fwrite($fd, "# This file was created by the pfSense package >> manager. >> Do not edit!\n\n"); >> - fwrite($fd, "/usr/local/sbin/bgpd -f /usr/local/etc/bgpd.conf\n"); >> + fwrite($fd, "NUMBGPD=`ps auxw | grep bgpd | grep parent | grep -v >> grep | wc -l | awk '{print \$1}'`\n"); >> + fwrite($fd, "#echo \$NUMBGPD\n"); >> + fwrite($fd, "if [ \$NUMBGPD -lt 0 ] ; then\n"); >> + fwrite($fd, " /usr/local/sbin/bgpd -f >> /usr/local/etc/bgpd.conf\n"); >> + fwrite($fd, "fi\n"); >> fclose($fd); >> exec("chmod a+rx /usr/local/etc/rc.d/bgpd.sh"); >> exec("chmod a-rw /usr/local/etc/bgpd.conf"); > > This is missing a bgpctl reload in an else?! Do you think executing /usr/local/etc/rc.d/bgpd.sh should issue a "bgpctl reload" if bgpd is already running ? Although issuing an error message (and maybe suggesting using bgpctl reload instead) if bgpd was found already running would be the nice thing to do, I agree: $ diff -urNp openbgpd.inc.old openbgpd.inc --- openbgpd.inc.old2010-01-29 16:53:08.0 +0100 +++ openbgpd.inc2010-02-01 11:29:46.0 +0100 @@ -153,7 +153,13 @@ function openbgpd_install_conf() { $fd = fopen("/usr/local/etc/rc.d/bgpd.sh","w"); fwrite($fd, "#!/bin/sh\n\n"); fwrite($fd, "# This file was created by the pfSense package manager. Do not edit!\n\n"); - fwrite($fd, "/usr/local/sbin/bgpd -f /usr/local/etc/bgpd.conf\n"); + fwrite($fd, "NUMBGPD=`ps auxw | grep bgpd | grep parent | grep -v grep | wc -l | awk '{print \$1}'`\n"); + fwrite($fd, "#echo \$NUMBGPD\n"); + fwrite($fd, "if [ \$NUMBGPD -lt 0 ] ; then\n"); + fwrite($fd, " /usr/local/sbin/bgpd -f /usr/local/etc/bgpd.conf\n"); + fwrite($fd, "else\n"); + fwrite($fd, " echo 'bgpd was not started because there is already a process \"bgpd parent\" running. To reload the configuration please issue \"bgpctl reload\".\n"); + fwrite($fd, "fi\n"); fclose($fd); exec("chmod a+rx /usr/local/etc/rc.d/bgpd.sh"); exec("chmod a-rw /usr/local/etc/bgpd.conf"); Regards, Aarno -- Aarno Aukia Atrila GmbH Switzerland - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPd package on 1.2.3-release
Hello, On Sun, Jan 31, 2010 at 19:10, Scott Ullrich wrote: > On Fri, Jan 29, 2010 at 11:03 AM, Aarno Aukia wrote: >> Thanks for committing, > > Committed. Thanks for submitting. Please also bump the packages version number, although this was not in my patch ;) Thanks, Aarno -- Aarno Aukia Atrila GmbH Switzerland - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
[pfSense Support] OpenBGPD package: excessive } if if neighbor does not belong to a group
Again me -((( found one more bug in OpenBGPD. When you add/modify neighbor which does not belong to any group you get excessive } in bgpd.conf after neighbor{} block. # diff -rub openbgpd.inc.20090816.bak openbgpd.inc --- openbgpd.inc.20090816.bak 2009-08-16 05:09:38.0 + +++ openbgpd.inc2009-08-16 05:10:33.0 + @@ -113,8 +113,6 @@ $conffile .= " }\n"; } } - if($used_this_item) -$conffile .= "}\n"; } // OpenBGPD filters Eugene. - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPD package: excessive } if if neighbor does not belong to a group
On Sun, Aug 16, 2009 at 1:18 AM, Evgeny Yurchenko wrote: > Again me -((( > found one more bug in OpenBGPD. When you add/modify neighbor which does not > belong to any group you get excessive } in bgpd.conf after neighbor{} block. > > # diff -rub openbgpd.inc.20090816.bak openbgpd.inc > --- openbgpd.inc.20090816.bak 2009-08-16 05:09:38.0 + > +++ openbgpd.inc 2009-08-16 05:10:33.0 + > @@ -113,8 +113,6 @@ > $conffile .= " }\n"; > } > } > - if($used_this_item) > - $conffile .= "}\n"; > } > > // OpenBGPD filters Thanks, this one is commited. Scott - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
[pfSense Support] OpenBGPD package: impossible to edit group in use but it can easily be deleted
1) When a BGP group is in use it is impossible to modify group's parameters. Click 'Save' gives you "Sorry this group is in use... and can not be deleted" Probably it is intended behavior but then we have to change the error message to "... can not be edited" which is not very logical as the idea behind using groups is to have some parameters common for all peers belonging to this group. If you agree with me please delete this check: # diff -rub openbgpd_groups.xml.20090815.bak openbgpd_groups.xml --- openbgpd_groups.xml.20090815.bak2009-08-15 22:07:13.0 + +++ openbgpd_groups.xml 2009-08-15 22:41:28.0 + @@ -111,9 +111,4 @@ openbgpd_install_conf(); - - $status = check_group_usage($_POST['groupname']); - if($status != "") - $input_errors[] = "Sorry this group is in use by {$status} and cannot be deleted."; - 2) The group can be easily deleted even if it is in use without any impact on /usr/local/etc/bgpd.conf which leads to little mess. After that if you will edit your neighbor then this neighbor will be excluded from this group and thus probably will loose AS number. I could not find a way how to prevent this. Probably we could create some tag in openbgpd_groups.xml like: $status = check_group_usage($_POST['groupname']); if($status != "") $input_errors[] = "Sorry this group is in use by {$status} and cannot be deleted."; ... and use it in /usr/local/www/pkg.php before it actually deletes parameter: line 66if ($a_pkg[$_GET['id']]) { + if($pkg['custom_php_del_validation'] <> "") { + $status = eval($pkg['custom_php_del_validation'] ); + if ($status != ""){ + header("Location: pkg.php?xml=" . $xml); + exit; + } +} unset($a_pkg[$_GET['id']]); write_config(); ... and it works (it's not deleted) but I can't find a way to tell user about the error. Thanks, Eugene - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org
Re: [pfSense Support] OpenBGPD package: impossible to edit group in use but it can easily be deleted
On Sat, Aug 15, 2009 at 7:32 PM, Evgeny Yurchenko wrote: > 1) When a BGP group is in use it is impossible to modify group's parameters. > Click 'Save' gives you "Sorry this group is in use... and can not be > deleted" > Probably it is intended behavior but then we have to change the error > message to "... can not be edited" which is not very logical as the idea > behind using groups is to have some parameters common for all peers > belonging to this group. If you agree with me please delete this check: > > # diff -rub openbgpd_groups.xml.20090815.bak openbgpd_groups.xml > --- openbgpd_groups.xml.20090815.bak 2009-08-15 22:07:13.0 + > +++ openbgpd_groups.xml 2009-08-15 22:41:28.0 + > @@ -111,9 +111,4 @@ > > openbgpd_install_conf(); > > - > - $status = check_group_usage($_POST['groupname']); > - if($status != "") > - $input_errors[] = "Sorry this group is in use by > {$status} and cannot be deleted."; > - > > > 2) The group can be easily deleted even if it is in use without any impact > on /usr/local/etc/bgpd.conf which leads to little mess. After that if you > will edit your neighbor then this neighbor will be excluded from this group > and thus probably will loose AS number. I could not find a way how to > prevent this. > Probably we could create some tag in openbgpd_groups.xml like: > > $status = check_group_usage($_POST['groupname']); > if($status != "") > $input_errors[] = "Sorry this group is in use by > {$status} and cannot be deleted."; > > > ... and use it in /usr/local/www/pkg.php before it actually deletes > parameter: > > line 66 if ($a_pkg[$_GET['id']]) { > + if($pkg['custom_php_del_validation'] <> "") { > + $status = > eval($pkg['custom_php_del_validation'] ); > + if ($status != ""){ > + header("Location: pkg.php?xml=" . > $xml); > + exit; > + } > + } > unset($a_pkg[$_GET['id']]); > write_config(); > > ... and it works (it's not deleted) but I can't find a way to tell user > about the error. > > Thanks, > Eugene > > > > - > To unsubscribe, e-mail: support-unsubscr...@pfsense.com > For additional commands, e-mail: support-h...@pfsense.com > > Commercial support available - https://portal.pfsense.org > > Please sign up for a rcs.pfsense.org account and email me the info off-list. It is time for you to have a commit bit to be able to push these changes since you are showing an interest in the BGPD package. Scott - To unsubscribe, e-mail: support-unsubscr...@pfsense.com For additional commands, e-mail: support-h...@pfsense.com Commercial support available - https://portal.pfsense.org