Re: Upgrading from 7.0 to 7.1

[latincom]

Hello Tbias

You were totally correct, the host network was wrongly configured! host
and ifconfig gave different ip

Thanks so much

> Heho,
> I would still assume that there is _something_ wrong with your network
> setup. The information that the system failing to upgrade runs on VMM is
> somewhat important. Please also not that seemingly both, http and https
> for retrieving the sets failed in your initial message.
>
> Can you please provide the output of the following commands, ideally
> prefixed with the command, as a paste (not dumped into an email). You can
> redact the first three octets of IPv4 addresses and the first 48 bits of
> IPv6 addresses, if you prefer, as well as the top and second level part of
> domains, if you prefer.
>
> On host.,:
>
> cat /etc/mygate
> cat /etc/resolv.conf
> sysctl net.inet.ip.forwarding
> sysctl net.inet6.ip6.forwarding
> cat /etc/pf.conf
> ls /etc/hostname.*
> cat /etc/honstname.*
> ifconfig
> cat /etc/vm.conf
>
> On the vm with the upgrade issue to 7.1, prior to the upgrade when booted
> into 7.0:
>
> cat /etc/mygate
> cat /etc/resolv.conf
> cat /etc/pf.conf
> ls /etc/hostname.*
> cat /etc/honstname.*
> ifconfig
>
> With best regards,
> Tobias
>
> P.S.: Please keep replies on list. There is nothing more frustrating than
> having the same issue as you, digging through promising mailing list
> archives, and then figuring out that the solution went off-list.

Yes. i know that thanks

>
> -Original Message-
> From: latin...@vcn.bc.ca 
> Sent: Sunday, 7 August 2022 20:58
> To: Tobias Fiebig 
> Subject: Re: Upgrading from 7.0 to 7.1
>
> Hello Tobias
>
> It ia a vm at host.
> I am testing again with 7.0 installation to upgrade to 7.1, the reason is
> because it failed with something related to https. Please look the
> download stoped repently again; i think that dns resolution is not a
> problem; but you know better:
>
> host$ vmctl console agrox
> Connected to /dev/ttypf (speed 115200)
>
> Server directory? [pub/OpenBSD/7.0/amd64]
>
> Select sets by entering a set name, a file name pattern or 'all'.
> De-select sets by prepending a '-', e.g.: '-game*'. Selected sets are
> labelled '[X]'.
> [X] bsd   [X] comp70.tgz[X] xbase70.tgz   [X] xserv70.tgz
> [X] bsd.rd[X] man70.tgz [X] xshare70.tgz
> [X] base70.tgz[X] game70.tgz[X] xfont70.tgz
> Set name(s)? (or 'abort' or 'done') [done]
> Get/Verify SHA256.sig   100% |**|  2144
> 00:00
> Signature Verified
> Get/Verify bsd  100% |**| 21090 KB
> 01:17
> Get/Verify bsd.rd   100% |**|  4109 KB
> 00:12
> Get/Verify base70.tgz37% |* |   113 MB
> 12:10 ETA
>
> PS:
> $ host agrox.host.
> agrox.host. has address .96 agrox.host. has IPv6
> address ::
>
> But ifconfig says .224
>
>
>

Re: dump(8) is slow

[Theo de Raadt]

Tomasz Rola  wrote:

> Ok. But what is a theoretic speed limit for this device?
> 
> If I do something like this on my laptop w/ssd:
> 
>  #  date +'%s'; dd if=/dev/sda2 of=/dev/null bs=1024 count=$((512*1024)); 
> date +'%s'
> 1660089697
> 521565184 bytes (522 MB, 497 MiB) copied, 2 s, 261 MB/s
> 524288+0 records in
> 524288+0 records out
> 536870912 bytes (537 MB, 512 MiB) copied, 2,06702 s, 260 MB/s
> 1660089699
> 
> I tried it with reading first 512 megs, for you, since you want to
> deal with terabytes, count= would need to be adjusted, say, 100 gigs?
> 
> Reasoning: the specification for sata says one thing, but it says
> theoretical upper speed, if I am correct. So you want to know about
> real speed limit of _this_ device.

Bravo, you tested the speed at 1024 bytes of data per system call.

Re: dump(8) is slow

[Tomasz Rola]

On Tue, Aug 09, 2022 at 02:21:21PM +0200, Christian Weisgerber wrote:
> Moving 9TB with dump|restore from an old hard disk to a bigger one
> reminded me again that dump(8) is, well, slow:
> 
>   DUMP: 9104433830 tape blocks
>   DUMP: Date of this level 0 dump: Sat Aug  6 16:36:52 2022
>   ...
>   DUMP: Date this dump completed:  Tue Aug  9 13:51:01 2022
>   DUMP: Average transfer rate: 36530 KB/s
> 
> That is far below the read-write speed of a modern SATA drive.
> systat(1) clearly showed that the source disk and dump(8) was the
> bottleneck, not the target disk and restore(8).  Too much seeking?

Ok. But what is a theoretic speed limit for this device?

If I do something like this on my laptop w/ssd:

 #  date +'%s'; dd if=/dev/sda2 of=/dev/null bs=1024 count=$((512*1024)); date 
+'%s'
1660089697
521565184 bytes (522 MB, 497 MiB) copied, 2 s, 261 MB/s
524288+0 records in
524288+0 records out
536870912 bytes (537 MB, 512 MiB) copied, 2,06702 s, 260 MB/s
1660089699

I tried it with reading first 512 megs, for you, since you want to
deal with terabytes, count= would need to be adjusted, say, 100 gigs?

Reasoning: the specification for sata says one thing, but it says
theoretical upper speed, if I am correct. So you want to know about
real speed limit of _this_ device.

-- 
Regards,
Tomasz Rola

--
** A C programmer asked whether computer had Buddha's nature.  **
** As the answer, master did "rm -rif" on the programmer's home**
** directory. And then the C programmer became enlightened...  **
** **
** Tomasz Rola  mailto:tomasz_r...@bigfoot.com **

Re: dump(8) is slow

[gwes]

On 8/9/22 18:28, gwes wrote:



On 8/9/22 13:14, Christian Weisgerber wrote:

Kenneth Gober:

Are you certain that dump(8) is the big bottleneck here?  My 
recollection
is that restore(8) is significantly slower, so of course if 
restore(8) is

systat's default vmstat display shows you the time spend in disk
accesses.  Typical figures during the dump-restore run were 1.0 for
the dump disk and 0.0 for the restore disk, i.e., the dump disk was
saturated and the restore disk was practically idle.  Also the
number of transfers was a magnitude higher for the dump disk, i.e.,
a larger number of smaller reads compared to a smaller number of
larger writes.

So, yeah, the dump(8) side is the bottleneck.


dump(8) reads the raw device unbuffered and caches relatively little
restore(8) writes the cooked device which tries very hard to minimize
disk accesses and buffers a great deal.

It looks like most of dump(8)'s reads are small(er) than file system 
buffers.
The input files may consist of blocks scattered all over which would 
cause

seek and rotational delays.

iostat(1) transfer size etc and vmstat syscall count would tell a lot

geoff steckel


Apologies for not reading fully.

Re: dump(8) is slow

[gwes]

On 8/9/22 13:14, Christian Weisgerber wrote:

Kenneth Gober:


Are you certain that dump(8) is the big bottleneck here?  My recollection
is that restore(8) is significantly slower, so of course if restore(8) is

systat's default vmstat display shows you the time spend in disk
accesses.  Typical figures during the dump-restore run were 1.0 for
the dump disk and 0.0 for the restore disk, i.e., the dump disk was
saturated and the restore disk was practically idle.  Also the
number of transfers was a magnitude higher for the dump disk, i.e.,
a larger number of smaller reads compared to a smaller number of
larger writes.

So, yeah, the dump(8) side is the bottleneck.


dump(8) reads the raw device unbuffered and caches relatively little
restore(8) writes the cooked device which tries very hard to minimize
disk accesses and buffers a great deal.

It looks like most of dump(8)'s reads are small(er) than file system 
buffers.

The input files may consist of blocks scattered all over which would cause
seek and rotational delays.

iostat(1) transfer size etc and vmstat syscall count would tell a lot

geoff steckel

Re: Relayd Questions

[Stuart Henderson]

I don't think you can do this using SPI directly.

If you use IKE then you might be able to do something in iked or isakmpd
config to set PF tags, and then use PF rules to rewrite the dest port
to point at something else to select a different relay in relayd..



On 2022/08/09 12:53, Todd Carpenter wrote:
> I just wanted to clarify, for relayd..
> 
> Is it possible to filter / loadbalance based on the SPI information of the 4 
> byte
> headers within ipsec?
> https://en.wikipedia.org/wiki/IPsec#Encapsulating_Security_Payload
> 
> Security Parameters Index (32 bits)
> Arbitrary value used (together with the destination IP address) to 
> identify the security
> association of the receiving party
> 
> I could not find any information that relates specifically to ipsec 
> traffic
> 
> Thanks Again.
> 
> On Sun, Aug 7, 2022 at 3:59 AM Stuart Henderson  
> wrote:
> 
> On 2022-08-06, Todd Carpenter  wrote:
> > Hi all,
> >
> > I've been trying to get relayd up and running on my configuration and 
> had a
> > couple of questions I could not find answers for.
> >
> > As I understand it, relayd is capable of making a "protocol" where you
> > could essentially take connection details and call it whatever you like,
> > then create rules in pf via that protocol.
> >
> > for example, in mwl's relayd book he creates a "dns fix protocol"
> > relay dns {
> >      listen on 203.0.113.213 port 53
> >      forward to check tcp
> >      protocol dnsfix
> > }
> >
> > questions:
> > how can I pass this to pf.conf and apply stickines to it to ensure that 
> if
> > the protocol dnsfix was routed to server 52 on the back end.. that all
> > future requests are sent to server 52 and not server 17 (ie is this a
> > relayd.conf thing.. or a pf.conf thing)?
> 
> Relays are userland TCP proxies done inside relayd. Configuring them
> is done in relayd.conf. See
> 
> man relayd.conf | less "+/set the scheduling algorithm"
> 
> > is it possible to have multiple ports and protocols wrapped into a new
> > protocol?
> > for example I need port 443 tcp, 10443 tcp, 8000 udp and 8001 tcp  .. 
> to be
> > treated as a single connection.  Is a protocol even the right tool for 
> the
> > job? If so, how do you add multiple ports? or does each rule need to be
> > seperate?  (an example would be awesome)
> 
> As a single protocol definition? You can't, you need separate ones.
> 
> > Next question, in regards to the previous question. How would you apply 
> a
> > stickiness state to ensure that all 4 ports from the same client are 
> sent
> > to the same server?
> 
> "mode source-hash" is probably the only option.
> 
> > last question..
> > how do you decide what configuration should be placed in pf.conf vs
> > relayd.conf?  and if your using an anchor like relayd .. in terms of 
> pf, is
> > there 1 config or are they seperate?
> >
> > IE: if i have a  in relayd.conf that defines {server1,2,3,4}  do 
> I
> > need the same table in my pf.conf file? or should I make the exact same
> > table with a unique name? or are the relayd.conf tables used as both an
> > anchor and expanded into the default pf.conf?
> 
> For the main part relayd loads what it needs into PF under the anchor.
> 
> If you're using _redirections_ with sticky-address and want that to 
> persist
> across multiple connections then see "src.track" in pf.conf(5).
> 
> 
> --
> Please keep replies on the mailing list.
> 
> 

Re: cdio(1): cdplay with next and prev

[Lucian Popescu]

On 2022-08-09 14:40:08, Christian Weisgerber  wrote:

> cdio(1) is cobbled together, mostly designed for a world that no
> longer exists, and would have to be redesigned from scratch for a
> consistent user experience.  Nobody has stepped forward to do this,
> even when CD drives were still common, so I don't expect it to ever
> happen.

I'm planning to write cdnext, cdpause, cdprevious, cdreplay and
cdresume with a non-blocking cdplay. I'm sure that there are still folks
who use CDs for playing music.

Re: Relayd Questions

[Todd Carpenter]

I just wanted to clarify, for relayd..

Is it possible to filter / loadbalance based on the SPI information of the
4 byte headers within ipsec?
https://en.wikipedia.org/wiki/IPsec#Encapsulating_Security_Payload

*Security Parameters Index* (32 bits)Arbitrary value used (together with
the destination IP address) to identify the security association
 of the receiving party
I could not find any information that relates specifically to ipsec traffic
Thanks Again.

On Sun, Aug 7, 2022 at 3:59 AM Stuart Henderson 
wrote:

> On 2022-08-06, Todd Carpenter  wrote:
> > Hi all,
> >
> > I've been trying to get relayd up and running on my configuration and
> had a
> > couple of questions I could not find answers for.
> >
> > As I understand it, relayd is capable of making a "protocol" where you
> > could essentially take connection details and call it whatever you like,
> > then create rules in pf via that protocol.
> >
> > for example, in mwl's relayd book he creates a "dns fix protocol"
> > relay dns {
> >  listen on 203.0.113.213 port 53
> >  forward to check tcp
> >  protocol dnsfix
> > }
> >
> > questions:
> > how can I pass this to pf.conf and apply stickines to it to ensure that
> if
> > the protocol dnsfix was routed to server 52 on the back end.. that all
> > future requests are sent to server 52 and not server 17 (ie is this a
> > relayd.conf thing.. or a pf.conf thing)?
>
> Relays are userland TCP proxies done inside relayd. Configuring them
> is done in relayd.conf. See
>
> man relayd.conf | less "+/set the scheduling algorithm"
>
> > is it possible to have multiple ports and protocols wrapped into a new
> > protocol?
> > for example I need port 443 tcp, 10443 tcp, 8000 udp and 8001 tcp  .. to
> be
> > treated as a single connection.  Is a protocol even the right tool for
> the
> > job? If so, how do you add multiple ports? or does each rule need to be
> > seperate?  (an example would be awesome)
>
> As a single protocol definition? You can't, you need separate ones.
>
> > Next question, in regards to the previous question. How would you apply a
> > stickiness state to ensure that all 4 ports from the same client are sent
> > to the same server?
>
> "mode source-hash" is probably the only option.
>
> > last question..
> > how do you decide what configuration should be placed in pf.conf vs
> > relayd.conf?  and if your using an anchor like relayd .. in terms of pf,
> is
> > there 1 config or are they seperate?
> >
> > IE: if i have a  in relayd.conf that defines {server1,2,3,4}  do I
> > need the same table in my pf.conf file? or should I make the exact same
> > table with a unique name? or are the relayd.conf tables used as both an
> > anchor and expanded into the default pf.conf?
>
> For the main part relayd loads what it needs into PF under the anchor.
>
> If you're using _redirections_ with sticky-address and want that to persist
> across multiple connections then see "src.track" in pf.conf(5).
>
>
> --
> Please keep replies on the mailing list.
>
>

Re: dump(8) is slow

[Christian Weisgerber]

Kenneth Gober:

> Are you certain that dump(8) is the big bottleneck here?  My recollection
> is that restore(8) is significantly slower, so of course if restore(8) is

systat's default vmstat display shows you the time spend in disk
accesses.  Typical figures during the dump-restore run were 1.0 for
the dump disk and 0.0 for the restore disk, i.e., the dump disk was
saturated and the restore disk was practically idle.  Also the
number of transfers was a magnitude higher for the dump disk, i.e.,
a larger number of smaller reads compared to a smaller number of
larger writes.

So, yeah, the dump(8) side is the bottleneck.

-- 
Christian "naddy" Weisgerber  na...@mips.inka.de

Multiuser security on OpenBSD

[Dave Levine]

Hello all,

I'm new to the mailing list so feel free to yell at me if I messed
something up here.

I currently use OpenBSD on my laptop for a number of reasons, mainly
performance and hardware support. However, I have been considering
setting up a multiuser POWER9 box for some Discord friends and I to
work on in a hobbyist setting (these things are expensive and I'm the
one who currently has the machine we want to work on), but need to
know if OpenBSD is a good option for that. As it apparently lacks
mitigations for multiple medium-risk hardware side channel attacks, I
think it is important to ask: What does OpenBSD do to stop an
unprivileged user with access to a compiler or shell from copy-pasting
a proof-of-concept exploit to siphon e.g. SSH private keys, root
passwords and the like, or are these more difficult to exploit than I
give them credit for with things like (K)ASLR enabled?

Thanks,
- Dave

Re: Firefox and stuttering USB audio

[Courtney]

THANK YOU!! This seems to have solved the issue. Thankfully I had 
already set

/tmp to be an in-memory filesystem so this will do wonders. I'm assuming
you haven't had any issues with the firefox cache being blown away every
reboot? Doesn't really matter anyway, I prefer good audio over firefox 
having

a clean cache every time. Now I can listen to my music while I work and not
have to cringe ;)

On 8/7/22 14:44, Mihai Popescu wrote:

Courtney, I will try to suggest something.

First, I was having problems in the past with Firefox. I use to let
mpv play in the background ( a stream of internet radio) and the sound
has stuttering and pauses whenever Firefox loaded some pages. I was
told to use sndio for mpv as an option with ao=sndio in the mpv.conf.
I did this and the problem was gone.

Next, you could try something just to check. It is a shoot in the
dark, but I use it for something else.
I have an old computer, and the browsing was very slow. The disk (
mechanical) was spinning like hell whenever a page was loaded, both
Firefox and Chromium. Looking on internet, I found that browsers are
using caching on the disk a lot. I see you are using SSD, but here it
is anyway;

Do a backup:
# cp /etc/fstab /etc/fstab.install

Change the entry for the /tmp partition to look like this:
swap /tmp mfs rw,nodev,nosuid,-s=1g 0 0

Reboot in single user mode, using -s at boot prompt and do this on the shell:
# mount -uw /
#chmod 1777 /tmp
# reboot

Let it boot normally and issue this inside a terminal:
$ XDG_CACHE_HOME=/tmp firefox

Then do your job with sound and check for stuttering. If it is fine
now, use it like this. If not, just reverse the fstab backup and try
something else. Please report here, too :).

Re: cdio(1): cdplay with next and prev

[Christian Weisgerber]

On 2022-08-08, Lucian Popescu  wrote:

> lucian-pc# cdio cdplay 
> track 1 'a' 0200/00018053   1%
>
> From another terminal I issue the following command to play the next
> song:
>
> lucian-pc# cdio next #exit code is 0
>
> However this does not work. Can I use next and prev with cdplay? The man
> page does not make this clear.

No, "next" and "previous" work with "play".

The fact that it is impossible to issue other commands as long as
"cdplay" is running should be sufficiently clear, your very determined
effort to circumvent this nonwithstanding.

> What I observed is that when using 'cdio play' with 'cdio next' the
> track reported by 'cdio status' is indeed changed. The problem with this
> approach is that 'cdio play' does not output any sound.

Oh, it does--to the (probably nonexistent) analog output of your
CD drive, which needs to be hooked up to a corresponding input on
your soundcard.  You have now traveled back in time to the 1990s.

cdio(1) was designed for the way CD drives were connected into the
system back then.  This has been long obsolete.  At some point, the
"cdplay" and "cdrip" commands were bolted onto cdio to accommodate
the then current model where the audio data was digitally read off
the CD over the SCSI/SATA/USB/etc. bus.  However, contrary to "play",
the "cdplay" command is blocking.  "Play" would return you to the
cdio prompt right away, and you could fire off other command such
as "next", "previous", "pause", "stop", etc.  With "cdplay" you are
stuck while it is running.

cdio(1) is cobbled together, mostly designed for a world that no
longer exists, and would have to be redesigned from scratch for a
consistent user experience.  Nobody has stepped forward to do this,
even when CD drives were still common, so I don't expect it to ever
happen.

-- 
Christian "naddy" Weisgerber  na...@mips.inka.de

Re: dump(8) is slow

[Kenneth Gober]

On Tue, Aug 9, 2022 at 8:25 AM Christian Weisgerber 
wrote:

> Moving 9TB with dump|restore from an old hard disk to a bigger one
> reminded me again that dump(8) is, well, slow:
>
>   DUMP: 9104433830 tape blocks
>   DUMP: Date of this level 0 dump: Sat Aug  6 16:36:52 2022
>   ...
>   DUMP: Date this dump completed:  Tue Aug  9 13:51:01 2022
>   DUMP: Average transfer rate: 36530 KB/s
>

In my experience, dump(8) runs up to twice as fast if you use the "-b 64"
option, unless you hit a hardware bottleneck first.  I haven't tested
lately,
but two years ago I was getting these results dumping a 1TB volume from
a 4-drive hardware RAID10 array to various destinations:

096724 KB/s/dev/null
199562 KB/s/dev/null (-b 64)
046365 KB/sLTO4 SAS
056925 KB/sLTO4 SAS (-b 64)
088129 KB/sLTO4 SAS external (-b 64)
050710 KB/sLTO5 FC 8Gbps
101542 KB/sLTO5 FC 8Gbps (-b 64)

Are you certain that dump(8) is the big bottleneck here?  My recollection
is that restore(8) is significantly slower, so of course if restore(8) is
slow
reading from the pipe then whatever is writing to the pipe at the other
end will stall.

-ken

Re: Fanless amd64 sytem recommendations

[Hrvoje Popovski]

On 8.8.2022. 14:16, Rachel Roch wrote:
> My personal preference are Deciso boxes 
> (https://www.deciso.com/product-catalog/dec600/)
> 
> They come with OpenSense but  you can plug in a USB serial cable and install 
> OpenBSD with zero issues.
> 

Hi,

I would recommend to go with at least 4 cores and em(4) interfaces, i350
or i210. 4 cores because forwarding is parallel with 4 threads and maybe
in near future em(4) will be multiqueue ..

https://marc.info/?l=openbsd-tech=165642186010149=2

System freezes after execution of large script

[Miethe, Martin]

Hello everyone,

we are running 4 * Dell R430 for firewalling, NAT, accounting etc. for a 
student network (approx. 5.200 users). We use pf and authpf. Server 1 and 2 
form a carp-cluster as well as server 2 und 3. All boxes come with identical 
hardware and software configuration. The only difference is, that cluster A 
runs 6.7 and cluster B openbsd 7.0.

Every user (-> student) on the network has it's own individual login (directly 
doing ssh to one of the boxes) to open up a connection to the internet. The 
user database on server 1 und 2 carries approx 2.600 users, the user database 
on cluster B the other half. 

The creation and updating of user information is scripted. Most of the time we 
just need to update authpf.message to show traffic consumption to the students 
on login:

echo "* UPD (183883)"
echo "---\n\nWelcome to studNET!\n\nYou have a maximum of 600 GB traffic 
available per month.\nYou have already used 9.231 GB in the current month 
(calculated at 2022-08-08 21:02:07) [.] .\n\n---" 
>/etc/authpf/users/183883/authpf.message || error_handler
echo "... authpf-file /etc/authpf/users/183883/authpf.message generated"
if [ $USER_ERROR -eq 0 ]
then
  echo "* UPD (183883|dummyuser, dummyuser) ... success"
else
  echo "* UPD (183883| dummyuser, dummyuser) ... failed"
fi

This chunk of code is repeated maybe 2.000 times,  generated twice a day to a 
script file and run by cron.

*Problem*
Maybe once a month server 3 or 4 crash - they just freeze. Sometimes a reboot 
helps but often it additionaly comes along with a corrupt user database (system 
wont start, user root not found).  If this happens we manually have to recover  
a working master.passwd and apply pwd_mkdb. As the systems freeze there are no 
helping log entries or something similar. The only thing for sure is, that 
*when* it happens its always *after* the script ran and until now it never 
happend on server 1 or 2 (6.7).

*Question*
As the problem surely seems to be caused by the exectution of the script the 
question is why this happens? Heaavy IO or some bug with the hard disk driver? 
Does someone of you have a clue why the system crashes and even the user 
database gets corrupted in our setup?!  

Best regards,
Martin Miethe

dump(8) is slow

[Christian Weisgerber]

Moving 9TB with dump|restore from an old hard disk to a bigger one
reminded me again that dump(8) is, well, slow:

  DUMP: 9104433830 tape blocks
  DUMP: Date of this level 0 dump: Sat Aug  6 16:36:52 2022
  ...
  DUMP: Date this dump completed:  Tue Aug  9 13:51:01 2022
  DUMP: Average transfer rate: 36530 KB/s

That is far below the read-write speed of a modern SATA drive.
systat(1) clearly showed that the source disk and dump(8) was the
bottleneck, not the target disk and restore(8).  Too much seeking?

And we are not talking about a filesystem full of small files.
Average size 3.9 GB, median 2.1 GB.

Both NetBSD and FreeBSD have in different ways added some kind of
caching to dump.  Has anybody looked into this?

-- 
Christian "naddy" Weisgerber  na...@mips.inka.de