route an IPv4 /32 to a different interface

2019-12-15 Thread Denis Fondras
Hi,

I have this setup :

em3: flags=8843 mtu 1500
lladdr 
index 4 priority 0 llprio 3
media: Ethernet autoselect (1000baseSX full-duplex)
status: active
inet6 fe80::aa9:b803:8a7a:ca72%em3 prefixlen 64 scopeid 0x4
inet 172.16.0.254 netmask 0xff00 broadcast 172.16.0.255
em4: flags=8843 mtu 1500
lladdr
index 5 priority 0 llprio 3
media: Ethernet autoselect (1000baseSX full-duplex)
status: active
inet 172.16.0.249 netmask 0xfffc broadcast 172.16.0.251
inet6 fe80::29ae:98d:f238:fd68%em4 prefixlen 64 scopeid 0x5

I have a computer with IPv4 address 172.16.0.248 connected to em3.
When I try to ping it, obviously it goes to em4.

How can I route 172.16.0.248 through em3 ?

I tried with :
* route add 172.16.0.248/32 172.16.0.254 -iface em3
* route add 172.16.0.248/32 -llinfo -link -static -iface em3
but without luck.

Thank you in advance,
Denis



Re: route an IPv4 /32 to a different interface

2019-12-16 Thread Denis Fondras
On Sun, Dec 15, 2019 at 08:29:42PM +, Tom Smyth wrote:
> Hi Denis,
> 
> ok ..I hadnt read your email fully sorry about that...
> 
> what are you trying to achieve here?
> 
> you have a  172.16.0.249/30 address on em3  which includes
> 172.16.0.248-127.16.0.251
> 
> and then you have a 172.16.0.254/24 which includes the entire range of
>  172.16.0.0-172.16.0.255
> 
> I think you are making life tougher on your self and who ever has to
> diagnose the system after you...
> it is private IP space co can you not put them on different networks
> and do meat and Potatoes Routing ?
> 
> the other thing you need to consider is that you need to turn on proxy
> arp (which can be very counter productive and cause other issues  ) so
> that your host responds to arp requests for
> 
> 172.16.0.249 and 172.16.0.250  on em3 (assuming you want hosts on the
> network attached to em3 to be able to talk the ips connected to em4)
> 
> the other concern I would have is that you are trying to route traffic
> to an ip that is a reserved ip  172.16.0.248 is the network address of
> em4 according to your configuration...
> 
> I hope this helps...
> 

Thank you, I will try to renumber, this sounds like the best idea :)



Re: ifconfig behavior

2020-01-08 Thread Denis Fondras
On Tue, Jan 07, 2020 at 10:19:36PM +, Pedro Caetano wrote:
> Hi misc@ happy new year!
> 
> While running snapshot #584 on amd64 I noticed setting addresses using
> ifconfig is not consistent for ipv4 and ipv6.
> 
> Is this expected behavior? I wasn't able to find anything in the FAQ.
> 

It has been like that for ages and, for me, it is expected.



Re: Contributing to spamd

2020-04-03 Thread Denis Fondras
On Fri, Apr 03, 2020 at 08:54:22AM -0400, Aisha Tammy wrote:
> Hi devs and all,
>   I have been using spamd for quite a while and have been loving it.
> I've seen that spamd currently only supports ipv4 and have been
> wondering if it was possible to extend it to ipv6. I know that workforce
> is always limited so I wanted to know if there is anyway to contribute
> help towards this :)
> I admit I'm not the most knowledgeable about ipv6 so I was wondering if
> there is any small place to start to contribute to spamd and build up
> from there.
> Hoping for some positive response.
> 
> Thanks a lot for your work and hope you are safe,
> Aisha
> 

phessler@ did almost all the work. There are still one issue so it did not get
in.



Re: VLAN syntax in hostname.vlanxxx

2020-04-29 Thread Denis Fondras
On Wed, Apr 29, 2020 at 09:58:27PM +0200, Lars Bonnesen wrote:
> On an obsd 6.6, I use the vmx device, but the syntax:
> inet 172.18.11.9 255.255.255.252 NONE vlandev vmx2 description VLAN703
>

vlandev is not supported any more.
You have to use parent and vnetid, check man ifconfig.



Re: OSPF lsa_check issue

2020-05-05 Thread Denis Fondras
On Tue, May 05, 2020 at 09:07:34AM +0100, Richard Chivers wrote:
> Another 5 or so seconds later the same LS-Update comes in with the same seq
> number. This appears to continue indefinitely. Our only fix appears to be
> restarting ospfd on the routers.
> 
> Does anyone have an idea what is going wrong here?
> 
> Something we have considered being a problem is that we do have many
> interfaces, we have 90 or so, so the LS-Update packets are quite large and
> do get fragmented, as we are using a 1500mtu.
> 

Can you give more details about your network ?
(config, number of speakers, number of routes ?)

I could not reproduce it.

Yet, I have a similar problem with ospf6d. I don't understand the details but
changing prepare_ls_update() has an impact.



Re: net.inet.ip6.forwarding=1 ?

2020-05-19 Thread Denis Fondras
On Tue, May 19, 2020 at 08:36:56PM +0200, Harald Dunkel wrote:
> Hi folks,
> 
> congrats to the new release.
> 
> Question about https://www.openbsd.org/faq/upgrade67.html:
> Shouldn't it be
> 
>   net.inet.ip.forwarding=1
>   net.inet6.ip6.forwarding=1
> 
> Thats what I found in my sysctl.conf (before upgrade).
> 

Fixed, thank you.



Re: Source address selection algorithm w/ bgp

2020-05-28 Thread Denis Fondras
On Thu, May 28, 2020 at 08:09:25AM -0600, Theo de Raadt wrote:
> A few tools have options like -s, but it is a problem.
> 
> I'm also frustrated by this solution, and working on a better method.
> 
> Pierre Emeriaud  wrote:
> 
> > What is the current canonical way to tweak source address selection?
> > 
> > I have a bgp multi-homed router, and while answers do use the correct
> > source address, host-generated traffic uses the outgoing interface IP
> > address:
> > 
> > $ route -n get 194.2.0.20
> >route to: 194.2.0.20
> > destination: 194.2.0.0
> >mask: 255.255.192.0
> > gateway: 44.151.211.1
> >   interface: em1
> >  if address: 44.151.211.2  Not reachable from outside my network.
> >priority: 48 (bgp)
> >   flags: 
> >  use   mtuexpire
> >3 0 0
> > 
> > This can cause issues when the /30 peering subnet is not announced, as
> > return traffic (or even forward w/ urpf enabled in adjacent networks)
> > will be dropped.
> > 

I have a pf.conf with :
pass out on $if_ix from $ip_ix to !$subnet_ix nat-to $ip_router

Not a definitve solution but does the work on a low-traffic bgp router :/



Re: OpenBSD Foundation on HTTPS

2018-02-06 Thread Denis Fondras
> If you actually donate and click on any links there you would see it
> bring you to a secure page.
> 

But is this the right link ? Can I update the value of "hosted_button_id" and
send you to my Paypal account ?

Denis



Re: spamd and IPv6

2018-02-14 Thread Denis Fondras
> does anyone can tell me what the state of spamd and IPv6 is? I would
> have expected it to work but I can't set for exampe ::1 or [::1] as a
> listening address (neither alone or together with 127.0.0.1).
> 

Unsupported yet. phessler@ has a diff for it.



Re: Confusing IPv6 route(8) results

2018-05-24 Thread Denis Fondras
Hi,

On Wed, May 23, 2018 at 10:34:19PM -0400, David Higgs wrote:
> I am using route(8) in a script but found some odd behavior when
> querying routes for some IPv6 addresses - lookups seem to fail if the
> trailing address bytes are zero (implicit or explicitly) as shown
> below.  However, the routing table still seems to be forwarding
> traffic correctly, as shown in my final example.
> 
> Can anyone shed light on this, perhaps explain how I'm misusing route(8)?
> 

route is getting confused between host address and network address.
Try with route -n get 2607:f8b0:4004:805::/128


> This is on amd64 running 6.3-stable.
> 
> Thanks.
> 
> --david
> 
> 
> $ route -n get 2607:f8b0:4004:805::2004
>route to: 2607:f8b0:4004:805::2004
> destination: ::
>mask: ::
> gateway: fe80:1::201:5cff:fe86:7046%em0
>   interface: em0
>  if address: fe80::5e8c:75d:e349:26fd%em0
>priority: 56 (default)
>   flags: 
>   label: slaacd
>  use   mtuexpire
>   220369 0 0
> sockaddrs: 
> 
> $ route -n get 2607:f8b0:4004:805::
> get net 2607:f8b0:4004:805::: not in table
> 
> $ route -n get 2600:1901:0:94b6::
> get net 2600:1901:0:94b6::: not in table
> 
> $ ping6 2600:1901:0:94b6::
> PING 2600:1901:0:94b6:: (2600:1901:0:94b6::): 56 data bytes
> 64 bytes from 2600:1901:0:94b6::: icmp_seq=0 hlim=54 time=10.302 ms
> 64 bytes from 2600:1901:0:94b6::: icmp_seq=1 hlim=54 time=11.270 ms
> 



Re: Confusing IPv6 route(8) results

2018-05-24 Thread Denis Fondras
On Thu, May 24, 2018 at 07:04:04AM -0400, David Higgs wrote:
> But shouldn’t the answer be the same, since I have a valid default route?
> 

It should but that's not how route(8) works for now :)

Barely tested diff, assumes that no netmask means /128 (similar to IPv4 handling
where no netmask means /32)

Index: route.c
===
RCS file: /cvs/src/sbin/route/route.c,v
retrieving revision 1.214
diff -u -p -r1.214 route.c
--- route.c 1 May 2018 18:14:10 -   1.214
+++ route.c 24 May 2018 15:54:37 -
@@ -800,13 +800,8 @@ inet6_makenetandmask(struct sockaddr_in6
if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) &&
sin6->sin6_scope_id == 0) {
plen = "0";
-   } else if ((sin6->sin6_addr.s6_addr[0] & 0xe0) == 0x20) {
-   /* aggregatable global unicast - RFC2374 */
-   memset(&in6, 0, sizeof(in6));
-   if (!memcmp(&sin6->sin6_addr.s6_addr[8],
-   &in6.s6_addr[8], 8))
-   plen = "64";
-   }
+   } else
+   plen = "128";
}
 
if (!plen || strcmp(plen, "128") == 0)



Re: Confusing IPv6 route(8) results

2018-05-24 Thread Denis Fondras
On Thu, May 24, 2018 at 08:43:30PM +0200, Sebastian Benoit wrote:
> Denis Fondras(de...@openbsd.org) on 2018.05.24 17:57:19 +0200:
> > On Thu, May 24, 2018 at 07:04:04AM -0400, David Higgs wrote:
> > > But shouldn???t the answer be the same, since I have a valid default 
> > > route?
> > > 
> > 
> > It should but that's not how route(8) works for now :)
> > 
> > Barely tested diff, assumes that no netmask means /128 (similar to IPv4 
> > handling
> > where no netmask means /32)
> 
> But it doesn't:
> 

Well, my words didn't translate my thought.

$ route -n get 192.168.5.33
is equivalent to
$ route -n get 192.168.5.33/32

So :
$ route -n get 2001:db8::
should be equivalent to
$ route -n get 2001:db8::/128

By what rule should it stick to /64 ?

Though I agree we should always specify the mask length.



vxlan(4) in endpoint mode

2022-04-03 Thread Denis Fondras
Hi,

In vxlan(4) manual, we have :

endpoint mode
When configured without a tunnel destination address, vxlan operates as
a bridge, but with learning disabled.


The question is : is it possible to set tunnel source address without a
destination ?



Re: vxlan(4) in endpoint mode

2022-04-04 Thread Denis Fondras
Le Mon, Apr 04, 2022 at 08:23:35PM +1000, David Gwynne a écrit :
> 
> 
> > On 3 Apr 2022, at 21:46, Denis Fondras  wrote:
> > 
> > Hi,
> > 
> > In vxlan(4) manual, we have :
> > 
> > endpoint mode
> > When configured without a tunnel destination address, vxlan operates as
> > a bridge, but with learning disabled.
> > 
> > 
> > The question is : is it possible to set tunnel source address without a
> > destination ?
> 
> ifconfig vxlan0 tunneladdr 10.20.30.1
> 
> that should work.

Thank you David. I will prepare a patch to the manual :)



Re: Fanless amd64 sytem recommendations

2022-07-11 Thread Denis Fondras
Le Sun, Jul 10, 2022 at 10:45:40PM -0600, Steve Williams a écrit :
> Hi,
> 
> My pcengines APU system died on me catastrophically.  It's my  primary
> router / email / web server.
> 
> First, I built a Raspberry Pi 4b system with a USB wired NIC and went to
> restore my backup from Google using rclone only to find that rclone isn't
> supported on arm64. :(
> 
> I have built an old Dell desktop into a replacement, but I would really
> like a silent system (fanless) and rclone is instrumental to my backup
> system so I need to stick to (likely) an amd64 compatible system.
> 
> What recommendations do people have for a fanless AMD64 compatible system
> that (ideally) has wired NIC's on it.
> 

I use Protectli devices : https://eu.protectli.com/



Re: Fanless amd64 sytem recommendations

2022-07-21 Thread Denis Fondras
Le Thu, Jul 21, 2022 at 10:20:25AM +0300, Lars Noodén a écrit :
> On 7/11/22 12:25, Denis Fondras wrote:
> [snip]
> > I use Protectli devices : https://eu.protectli.com/
> 
> Are all the network interfaces available?
> 

I cannot speak for all the models. Yet, FW6C is fully supported network-wise
(see dmesg below).

> What was the installation process like and where there any special
> obstacles to be aware of?

Not once, it was a flawless process, one of the easier I had to deal with a
headless device :
- boot amd64/image71.img from USB
- install
- reboot
- enjoy


OpenBSD 7.1-current (GENERIC.MP) #2: Wed Jun 29 19:37:39 CEST 2022
de...@carcass.ledeuns.net:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 4191444992 (3997MB)
avail mem = 4047044608 (3859MB)
random: good seed from bootblocks
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 3.0 @ 0x8d317000 (85 entries)
bios0: vendor American Megatrends Inc. version "5.12" date 07/08/2019
bios0: Protectli FW6
acpi0 at bios0: ACPI 6.1
acpi0: sleep states S0 S5
acpi0: tables DSDT FACP APIC FPDT MCFG SSDT FIDT SSDT HPET SSDT SSDT UEFI SSDT 
LPIT WSMT SSDT SSDT SSDT SSDT DBGP DBG2 DMAR ASF!
acpi0: wakeup devices PS2K(S0) PS2M(S0) RP09(S0) PXSX(S0) RP10(S0) PXSX(S0) 
RP11(S0) PXSX(S0) RP12(S0) PXSX(S0) RP13(S0) PXSX(S0) RP01(S0) PXSX(S0) 
RP02(S0) PXSX(S0) [...]
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpimadt0 at acpi0 addr 0xfee0: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Celeron(R) CPU 3865U @ 1.80GHz, 1696.05 MHz, 06-8e-09
cpu0: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,TSC_ADJUST,SGX,SMEP,ERMS,INVPCID,MPX,RDSEED,SMAP,CLFLUSHOPT,PT,SRBDS_CTRL,MD_CLEAR,TSXFA,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,XSAVEC,XGETBV1,XSAVES,MELTDOWN
cpu0: 32KB 64b/line 8-way D-cache, 32KB 64b/line 8-way I-cache, 256KB 64b/line 
4-way L2 cache, 2MB 64b/line 8-way L3 cache
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges
cpu0: apic clock running at 24MHz
cpu0: mwait min=64, max=64, C-substates=0.2.1.2.4.1.1.1, IBE
cpu1 at mainbus0: apid 2 (application processor)
cpu1: Intel(R) Celeron(R) CPU 3865U @ 1.80GHz, 1696.05 MHz, 06-8e-09
cpu1: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,TSC_ADJUST,SGX,SMEP,ERMS,INVPCID,MPX,RDSEED,SMAP,CLFLUSHOPT,PT,SRBDS_CTRL,MD_CLEAR,TSXFA,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,XSAVEC,XGETBV1,XSAVES,MELTDOWN
cpu1: 32KB 64b/line 8-way D-cache, 32KB 64b/line 8-way I-cache, 256KB 64b/line 
4-way L2 cache, 2MB 64b/line 8-way L3 cache
cpu1: smt 0, core 1, package 0
ioapic0 at mainbus0: apid 2 pa 0xfec0, version 20, 120 pins
acpimcfg0 at acpi0
acpimcfg0: addr 0xe000, bus 0-255
acpihpet0 at acpi0: 2399 Hz
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus -1 (PEG0)
acpiprt2 at acpi0: bus -1 (PEG1)
acpiprt3 at acpi0: bus -1 (PEG2)
acpiprt4 at acpi0: bus -1 (RP09)
acpiprt5 at acpi0: bus -1 (RP10)
acpiprt6 at acpi0: bus -1 (RP11)
acpiprt7 at acpi0: bus -1 (RP12)
acpiprt8 at acpi0: bus -1 (RP13)
acpiprt9 at acpi0: bus 1 (RP01)
acpiprt10 at acpi0: bus 2 (RP02)
acpiprt11 at acpi0: bus 3 (RP03)
acpiprt12 at acpi0: bus 4 (RP04)
acpiprt13 at acpi0: bus 5 (RP05)
acpiprt14 at acpi0: bus 6 (RP06)
acpiprt15 at acpi0: bus -1 (RP07)
acpiprt16 at acpi0: bus -1 (RP08)
acpiprt17 at acpi0: bus -1 (RP17)
acpiprt18 at acpi0: bus -1 (RP18)
acpiprt19 at acpi0: bus -1 (RP19)
acpiprt20 at acpi0: bus -1 (RP20)
acpiprt21 at acpi0: bus -1 (RP21)
acpiprt22 at acpi0: bus -1 (RP22)
acpiprt23 at acpi0: bus -1 (RP23)
acpiprt24 at acpi0: bus -1 (RP24)
acpiprt25 at acpi0: bus -1 (RP14)
acpiprt26 at acpi0: bus -1 (RP15)
acpiprt27 at acpi0: bus -1 (RP16)
acpiec0 at acpi0: not present
acpipci0 at acpi0 PCI0: 0x 0x0011 0x0001
com0 at acpi0 UAR1 addr 0x3f8/0x8 irq 4: ns16550a, 16 byte fifo
acpicmos0 at acpi0
acpibtn0 at acpi0: SLPB
"INT33A1" at acpi0 not configured
acpibtn1 at acpi0: PWRB
"PNP0C0B" at acpi0 not configured
"PNP0C0B" at acpi0 not configured
"PNP0C0B" at acpi0 not configured
"PNP0C0B" at acpi0 not configured
"PNP0C0B" at acpi0 not configured
acpicpu0 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), 
C1(1000@1 mwait.1), PSS
acpicpu1 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), 
C1(1000@1 mwait.1), PSS
acpipwrres0 at acpi0: WRST
acpipwrres1 at acpi0: WRS

Re: PC Engines APU alternative for OpenBSD - 2022h2

2022-09-28 Thread Denis Fondras
Le Wed, Sep 28, 2022 at 04:55:51PM +0200, Erik van Westen a écrit :
> 
> Have a look at shop.opnsense.com, they might have something.
> 

The DEC6xx/7xx/8xx are not fully supported by OpenBSD.
I don't know about the bigger boxes but being based on the same SoC they are
probably not supported.



Re: PC Engines APU alternative for OpenBSD - 2022h2

2022-09-29 Thread Denis Fondras
Le Thu, Sep 29, 2022 at 09:18:44AM -0700, Chris Cappuccio a écrit :
> Denis Fondras [open...@ledeuns.net] wrote:
> > Le Wed, Sep 28, 2022 at 04:55:51PM +0200, Erik van Westen a ?crit :
> > > 
> > > Have a look at shop.opnsense.com, they might have something.
> > > 
> > 
> > The DEC6xx/7xx/8xx are not fully supported by OpenBSD.
> > I don't know about the bigger boxes but being based on the same SoC they are
> > probably not supported.
> 
> What's unsupported? These seem like garden variety AMD Epyc.
>

Console port (well, the getty(8) part of it) and SFP+ ports.
Also multiple PCI devices are not recognized.

(don't get fooled by the axgb0/1 devices, this is WIP and not ready yet).

OpenBSD 7.1-current (GENERIC.MP) #38: Mon Sep  5 18:25:36 CEST 2022
r...@carcass.lab.ledeuns.net:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 8519172096 (8124MB)
avail mem = 8243609600 (7861MB)
random: good seed from bootblocks
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 3.1 @ 0xce156000 (22 entries)
bios0: vendor INSYDE Corp. version "05.32.50.0014-A10.22E" date 02/18/2022
bios0: Deciso B.V. NetBoard-A10
acpi0 at bios0: ACPI 5.0
acpi0: sleep states S0 S3 S5
acpi0: tables DSDT FACP UEFI SSDT ASF! BOOT HPET APIC MCFG SLIC WDAT WDRT WSMT 
SSDT SSDT CRAT CDIT SSDT SSDT FPDT BGRT SSDT SSDT
acpi0: wakeup devices GPP0(S4) GPP1(S4) GPP2(S4) GPP3(S4) GPP4(S4) GPP5(S4) 
GPP6(S4) GP17(S4) XHC0(S4) XHC1(S4) GP18(S4)
acpitimer0 at acpi0: 3579545 Hz, 32 bits
acpihpet0 at acpi0: 14318180 Hz
acpimadt0 at acpi0 addr 0xfee0: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: AMD Ryzen Embedded V1500B, 2196.19 MHz, 17-11-00
cpu0: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu0: 32KB 64b/line 8-way D-cache, 64KB 64b/line 4-way I-cache, 512KB 64b/line 
8-way L2 cache, 4MB 64b/line 16-way L3 cache
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 8 var ranges, 88 fixed ranges
cpu0: apic clock running at 24MHz
cpu0: mwait min=64, max=64, C-substates=1.1, IBE
cpu1 at mainbus0: apid 1 (application processor)
cpu1: AMD Ryzen Embedded V1500B, 2195.85 MHz, 17-11-00
cpu1: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu1: 32KB 64b/line 8-way D-cache, 64KB 64b/line 4-way I-cache, 512KB 64b/line 
8-way L2 cache, 4MB 64b/line 16-way L3 cache
cpu1: smt 1, core 0, package 0
cpu2 at mainbus0: apid 2 (application processor)
cpu2: AMD Ryzen Embedded V1500B, 2195.85 MHz, 17-11-00
cpu2: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu2: 32KB 64b/line 8-way D-cache, 64KB 64b/line 4-way I-cache, 512KB 64b/line 
8-way L2 cache, 4MB 64b/line 16-way L3 cache
cpu2: smt 0, core 1, package 0
cpu3 at mainbus0: apid 3 (application processor)
cpu3: AMD Ryzen Embedded V1500B, 2195.85 MHz, 17-11-00
cpu3: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu3: 32KB 64b/line 8-way D-cache, 64KB 64b/line 4-way I-cache, 512KB 64b/line 
8-way L2 cache, 4MB 64b/line 16-way L3 cache
cpu3: smt 1, core 1, package 0
cpu4 at mainbus0: apid 4 (application processor)
cpu4: AMD Ryzen Embedded V1500B, 2195.85 MHz, 17-11-00
cpu4: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TO

Re: PC Engines APU alternative for OpenBSD - 2022h2

2022-09-29 Thread Denis Fondras
Le Thu, Sep 29, 2022 at 06:37:16PM +0200, Denis Fondras a écrit :
> Le Thu, Sep 29, 2022 at 09:18:44AM -0700, Chris Cappuccio a écrit :
> > Denis Fondras [open...@ledeuns.net] wrote:
> > > Le Wed, Sep 28, 2022 at 04:55:51PM +0200, Erik van Westen a ?crit :
> > > > 
> > > > Have a look at shop.opnsense.com, they might have something.
> > > > 
> > > 
> > > The DEC6xx/7xx/8xx are not fully supported by OpenBSD.
> > > I don't know about the bigger boxes but being based on the same SoC they 
> > > are
> > > probably not supported.
> > 
> > What's unsupported? These seem like garden variety AMD Epyc.
> >
> 
> Console port (well, the getty(8) part of it)
> 

And BTW kettenis@ should be thanked for making it display kernel logs on the
console :)



Re: OpenBSD and AMD EPYC/RYZEN 10gb

2023-04-12 Thread Denis Fondras
Le Wed, Apr 12, 2023 at 10:01:01AM +, Laura Smith a écrit :
> Has anyone had the opportunity to experiment using OpenBSD in conjunction 
> with AMD EPYC/RYZEN native 10gb ports ?
> 
> As far as I can see there are no drivers for it in stable ?  But maybe 
> someone's been playing with it on the bleeding-edge ?
> 

I started to write something that looks like a driver but haven't gone far yet.
There is no freely available doc about this chipset. The only source is the
FreeBSD driver and it is meh...


> Thanks !
> 
> Laura
> 



Re: rtadvd bug ?

2018-06-09 Thread Denis Fondras
On Thu, Jun 07, 2018 at 04:02:34PM +0200, Bastien Durel wrote:
> shouldn't it check the rtm_priority to be RTP_LOCAL or RTP_CONNECTED ??
> it make no sense to start advertising prefix on an interface if the
> prefix is over a gateway.
> 

Why RTP_LOCAL ?



Re: Interest in new network protocols

2018-06-14 Thread Denis Fondras
Hi,

> I've been doing some light reading on the topic of new(er) networking 
> protocols, and I've come across Locator/Identifier Seperation Protocol (LISP)
> (RFC6830 and onwards) and Identifier/Locator Network Protocol (ILNP) (RFC6740 
> and onwards).
> 
> There appear to be implementations of LISP already, and there is a public beta
> network already in operation. A cursory search doesn't yield any information 
> on implementations of ILNP, but the (somewhat sparse) Wikipedia article makes
> reference of RFC6115, in which ILNP is recommended by the IETF Routing 
> Research Group as "the preferred evolutionary direction for IPv6".
> 
> Is there any interest among the OpenBSD developers in implementing either of
> these two (or other similar) protocols?
> 

I have a moderated interest in LISP as it seems to get less and less traction.
Among the (new) shiny toys, SRv6 seems like a good bet.

Denis



Re: rtadvd bug ?

2018-06-17 Thread Denis Fondras
On Mon, Jun 11, 2018 at 10:13:36AM +0200, Bastien Durel wrote:
> Because it's lower than RTP_CONNECTED and I don't know what it is. The
> /* local address routes (must be the highest) */ comment makes me think
> it MAY be 127.0.0.0/8 or ::1/128 (useless for rtadvd then), but it may
> be related to interface addresses; I did not check in the kernel code
> how this flag is set. (hence the question marks)
> 

RTP_LOCAL are local addresses, they won't pass the test at L367 of rtadvd.c
anyway.

Here is a diff if you want to try :

Index: if.c
===
RCS file: /cvs/src/usr.sbin/rtadvd/if.c,v
retrieving revision 1.46
diff -u -p -r1.46 if.c
--- if.c12 Aug 2017 07:38:26 -  1.46
+++ if.c17 Jun 2018 19:37:55 -
@@ -285,6 +285,14 @@ get_ifm_flags(char *buf)
return (ifm->ifm_flags);
 }
 
+u_char
+get_priority(char *buf)
+{
+   struct rt_msghdr *rtm = (struct rt_msghdr *)buf;
+
+   return (rtm->rtm_priority);
+}
+
 int
 get_prefixlen(char *buf)
 {
Index: if.h
===
RCS file: /cvs/src/usr.sbin/rtadvd/if.h,v
retrieving revision 1.14
diff -u -p -r1.14 if.h
--- if.h10 Aug 2017 19:07:14 -  1.14
+++ if.h17 Jun 2018 19:37:55 -
@@ -45,6 +45,7 @@ struct in6_addr *get_addr(char *);
 int get_rtm_ifindex(char *);
 int get_ifm_ifindex(char *);
 int get_ifam_ifindex(char *);
+u_char get_priority(char *);
 int get_ifm_flags(char *);
 int get_prefixlen(char *);
 int prefixlen(u_char *, u_char *);
Index: rtadvd.c
===
RCS file: /cvs/src/usr.sbin/rtadvd/rtadvd.c,v
retrieving revision 1.91
diff -u -p -r1.91 rtadvd.c
--- rtadvd.c22 Aug 2017 01:44:09 -  1.91
+++ rtadvd.c17 Jun 2018 19:37:55 -
@@ -309,7 +309,7 @@ rtsock_cb(int fd, short event, void *arg
 {
int n, type, ifindex = 0, oldifflags, plen;
char *rtm;
-   u_char ifname[IF_NAMESIZE];
+   u_char ifname[IF_NAMESIZE], prio;
struct prefix *prefix;
struct rainfo *rai;
struct in6_addr *addr;
@@ -362,6 +362,11 @@ rtsock_cb(int fd, short event, void *arg
 
addr = get_addr(rtm);
plen = get_prefixlen(rtm);
+   prio = get_priority(rtm);
+
+   if (!(prio & RTP_CONNECTED))
+   break;
+
/* sanity check for plen */
/* as RFC2373, prefixlen is at least 4 */
if (plen < 4 || plen > 127) {



Re: Adding New Commands to BGP Looking Glass?

2018-07-20 Thread Denis Fondras
> If you need specifics I can certainly supply screenshots or code snippets.
> It's probably something obvious that I'm just not seeing, but any help would
> be greatly appreciated.
> 

Can you show some diff and detailed steps please ?



Re: Adding New Commands to BGP Looking Glass?

2018-07-23 Thread Denis Fondras
> Do you see where I might've gone wrong? I know that my definition in the .h
> file is wrong, but I'm trying to get this working in baby steps, and perhaps
> I was mistaken but I thought that having a duplicated function would still
> make it appear in the bgplg menu. Is there anything obvious that leaps out
> at you that I'm not seeing?
> 

It is not clear whether you rebuilt ebuilt bgplg or not.
Also mtrace binary needs to be built statically.



Re: OpenBSD on EdgeRouter 4

2018-08-20 Thread Denis Fondras
On Mon, Aug 20, 2018 at 10:22:58PM +, r303 wrote:
> Has anyone installed OpenBSD on an EdgeRouter 4?
> If so, can you share a quick rundown of the installation steps?
> The tutorial for the EdgeRouter Lite doesn't seem to match up with the ER-4.
> 

https://ftp.openbsd.org/pub/OpenBSD/6.3/octeon/INSTALL.octeon worked for me. I
only had to update "numcores".



Re: OpenBGPD as route server - correct filter syntax ?

2018-08-30 Thread Denis Fondras
On Thu, Aug 30, 2018 at 03:29:50PM +, Bob Smith wrote:
> Hi,
> 
> I'm trying to figure out the most suitable config params transform OpenBGPD 
> into a route server.
> 
> So far I have :
> route-collector yes

If you are configuring a route server, you don't want "route-collector yes".
Or if you want a route collector, it won't advertise any route so your concerns
are null.

> transparent-as yes
> 
> But my concern is more in the area of suitable filters to prevent loops.
> 
> I'm thinking I need something along the lines of :
> 
> allow to any peer-as != neighbor-as
> 
> But any variation of the above that I try always ends up with a "bgpd -n -f" 
> throwing a syntax error.
> 
> Ideas most welcome !
> 

This is not needed. Code says (rde_update.c L292) :

if (peer == prefp)
/* Do not send routes back to sender */
return (0);

> Thanks
> 
> Bob
> 



Re: Error output from ndp -an

2018-12-28 Thread Denis Fondras
On Thu, Dec 27, 2018 at 01:39:33PM -0600, Aaron Riekenberg wrote:
> I'm using OpenBSD 6.4 on a pcengines apu2 box as a router/firewall for a
> CenturyLink DSL (pppoe) connection.
> 
> Today I set up rd6 for ipv6 for the first time, similar to what is
> described here:
> https://gist.github.com/afresh1/791343380b4410687d51fdd94f20bd42
> 
> Things are working well but one minor issue I notice is when I run "ndp
> -an" to see ipv6 neighbor info I get an error printed to stderr from ndp:
> 
> [aaron@apu2] ~$ ndp -an
> Neighbor Linklayer Address   Netif ExpireS
> Flags
> ndp: ioctl(SIOCGNBRINFO_IN6): Invalid argument
> ndp: failed to get neighbor information
> 

Are you sure ndp and the kernel are in sync ?


> This is followed by normal ndp output lines so this seems like a very minor
> bug, but is slightly noisy.
> 
> Below I am pasting:
> 1. ktrace output for the "ndp -an" command.  Looks like
> ioctl(SIOCGNBRINFO_IN6) is being called on a SOCK_DGRAM socket.  ioctl
> returns -1 with errno 22 Invalid Argument.
> 2. ifconfig output
> 
> 
> 1. ktrace output from "ndp -an" command:
>   9697 ndp  CALL  socket(AF_INET6,0x2,0)
>   9697 ndp  RET   socket 3
>   9697 ndp  CALL
>  sysctl(4.17.0.0.6.0,0,0x7f7ee808,0,0)
>   9697 ndp  RET   sysctl 0
>   9697 ndp  CALL
>  sysctl(4.17.0.0.6.0,0x133e91ee1a00,0x7f7ee808,0,0)
>   9697 ndp  RET   sysctl 0
>   9697 ndp  CALL  kbind(0x7f7ee7c8,24,0xd76384b171042686)
>   9697 ndp  RET   kbind 0
>   9697 ndp  CALL  ioctl(3,SIOCGNBRINFO_IN6,0x133c63e05100)
>   9697 ndp  RET   ioctl -1 errno 22 Invalid argument
>   9697 ndp  CALL  kbind(0x7f7ee7c8,24,0xd76384b171042686)
>   9697 ndp  RET   kbind 0
>   9697 ndp  CALL  write(2,0x7f7ee050,0x5)
>   9697 ndp  GIO   fd 2 wrote 5 bytes
>"ndp: "
>   9697 ndp  RET   write 5
>   9697 ndp  CALL  write(2,0x7f7ee140,0x17)
>   9697 ndp  GIO   fd 2 wrote 23 bytes
>"ioctl(SIOCGNBRINFO_IN6)"
> 
> 2. ifconfig:
> [aaron@apu2] ~$ ifconfig
> lo0: flags=8049 mtu 32768
> index 5 priority 0 llprio 3
> groups: lo
> inet6 ::1 prefixlen 128
> inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
> inet 127.0.0.1 netmask 0xff00
> em0: flags=8843 mtu 1500
> lladdr 00:0d:b9:4b:17:10
> index 1 priority 0 llprio 3
> media: Ethernet autoselect (1000baseT full-duplex)
> status: active
> em1: flags=8843 mtu 1500
> lladdr 00:0d:b9:4b:17:11
> index 2 priority 0 llprio 3
> media: Ethernet autoselect (1000baseT full-duplex,rxpause,txpause)
> status: active
> inet 192.168.1.1 netmask 0xff00 broadcast 192.168.1.255
> inet6 fe80::813b:5c49:d64b:f9fc%em1 prefixlen 64 scopeid 0x2
> inet6 2602:d8:a032:2200::1 prefixlen 64
> em2: flags=8802 mtu 1500
> lladdr 00:0d:b9:4b:17:12
> index 3 priority 0 llprio 3
> media: Ethernet autoselect (none)
> status: no carrier
> enc0: flags=0<>
> index 4 priority 0 llprio 3
> groups: enc
> status: active
> pppoe0: flags=8851 mtu 1492
> index 6 priority 0 llprio 3
> dev: vlan201 state: session
> sid: 0x25d PADI retries: 4 PADR retries: 0 time: 04:57:57
> sppp: phase network authproto chap
> groups: pppoe egress
> status: active
> inet 216.160.50.34 --> 207.109.2.20 netmask 0x
> vlan201: flags=8843 mtu 1500
> lladdr 00:0d:b9:4b:17:10
> index 7 priority 0 llprio 3
> encap: vnetid 201 parent em0
> groups: vlan
> media: Ethernet autoselect (1000baseT full-duplex)
> status: active
> pflog0: flags=141 mtu 33136
> index 8 priority 0 llprio 3
> groups: pflog
> gif0: flags=8051 mtu 1472
> index 9 priority 0 llprio 3
> groups: gif egress
> tunnel: inet 216.160.50.34 -> 205.171.2.64 ttl 64 nodf
> inet6 fe80::e39e:d302:d26:902f%gif0 ->  prefixlen 64 scopeid 0x9
> inet6 2602:d8:a032:2200::1 ->  prefixlen 24



Re: bgplg doesn't work with wildcard httpd servers

2019-01-11 Thread Denis Fondras
On Fri, Jan 11, 2019 at 10:50:21AM -0600, Adam Thompson wrote:
> Running 6.4 (-stable, via openup/mtier).
> I have bgpd(8) talking to my border router, acting as a route collector.
> That part seems fine.
> I now have httpd(8) configured trivially to run bgplg(8) (per the bgplg(8)
> manpage) but it's not working, and I can't tell why.  **EDIT: yes, I can,
> see below**
> 
> httpd.conf:
> ===start===
> server "*" {
> listen on * port 80
> location "/cgi-bin/*" {
> fastcgi
> root ""
> }
> }
> ===end===
> 
> On the client end, I get:
> 
>   bgpmirror# wget -v http://localhost/cgi-bin/bgplg
>   --2019-01-11 10:12:05--  http://localhost/cgi-bin/bgplg
>   Resolving localhost (localhost)... 127.0.0.1, ::1
>   Connecting to localhost (localhost)|127.0.0.1|:80... connected.
>   HTTP request sent, awaiting response... 200 No headers, assuming HTTP/0.9
>   Length: unspecified
>   Saving to: 'bgplg'
> (it never completes until I kill it)
> 
> Ktrace'ing slowcgi and httpd in -d mode reveals that bgplg execve's
> properly, loads, spits out "invalid character in input" and dies.  Slowcgi
> and/or httpd do not handle this... well, at all, really.  That error message
> also does not get logged anywhere nor is visible anywhere except ktrace
> logs.
> 
> Looking at the bgplg source code, this means there's something funky in its
> environment that it doesn't like.  Ah.  It looks like it's the "*" in
> server_name, as passed in by slowcgi:
>   slowcgi: env[18], SERVER_NAME=*
> 
> Yup.  That's the problem, all right: /usr/src/usr.bin/bgplg/bgplg.c:115
> excludes '*'.  But I want my looking glass to be accessible from at least
> two different hostnames, and I really would prefer to not have to define
> them all manually in httpd.conf(5).
> 
> The naive local fix is trivial (adding '*' to the strchr call in line 115),
> but what else might I be breaking or letting in?  Clearly this is supposed
> to ensure the environment is sanitized before continuing, but is "*"
> forbidden because it's unsafe, or simply because it never occurred to
> anyone?
> 
> Thoughts / suggestions ?
> 

You can use 'server match "."' to match any hostname.
The page title will be "." though.



Re: DHCPd - option capwap (code 138)

2021-05-06 Thread Denis Fondras
Le Thu, May 06, 2021 at 10:48:55AM +0200, Radek a écrit :
> Hello,
> I want to use dhcpd server to push Wireless Controller's IP address to the 
> APs.
> 
> According to this:
> http://systemnetworksecurity.blogspot.com/2013/02/adding-custom-options-in-isc-dhcpds.html
> https://www.secuvera.de/blog/capwap-dhcp-option-138-auf-isc-dhcpd-server-einrichten/
> I need to add *option capwap* to /etc/dhcpd.conf
> 
> option capwap code 138 = ip-address; #Custom Option capwap
> option capwap 192.168.1.110; #WLAN-Controller-IP
> 

Have you tried something like :

option option-138 C0:A8:01:6E;

?



pflow on PE router

2021-05-14 Thread Denis Fondras
Hello,

I used OpenBSD as a PE router on my network. The router is connected to an IX, a
transit and multiple peers with OpenBGPd.

Earlier this week, I enabled pflow(4) to track traffic usage.
Unfortunately enabling pf(4) on a edge router does not seems like a good idea.
Some peers called in to tell they notice multiple problems (ranging from what
seems MTU problem to cut in lengthy TCP sessions), deactivating pf(4)
instantaneously fixed the problem on their side, reactivating pf($) and the
problems are back.

I tried to push up the state table (I reached 300k states), to no avail.

Do you know what are the "right settings" to have pflow(4) enabled on PE router
?

Thank you in advance,
Denis



Re: pflow on PE router

2021-05-16 Thread Denis Fondras
Here are some more infos :

>- does running pf(4) without pflow(4) cause issue? 

Yes, the issue is linked to pf(4) being enabled.

>- can you confirm you were running with pf(4) disabled prior to enabling 
> pflow(4)?

I do confirm. I never enable pf(4) on edge routers, it bit in the past with
assymetric routing :)

>- are you able to provide or indicate your pf.conf? 

--- /etc/pf.conf ---
set state-defaults pflow
set limit states 100

pass
--- /etc/pf.conf ---

>- how many pf(4) states are you seeing in # pfctl -s info ? what is the 
> removal rate?

depending on the period of the day, it ranges from 300 to 30.
The removal rate was 112761228.5/s when I disabled pf(4) again.

>- was traffic to the pflow sink machine transiting MPLS?  

No, there is no MPLS involved at all. (I guess PE was not the right word, but
edge router might have triggered Ubiquiti fans...)

>- can you provide a dmesg

I upgraded this morning, problem is still the same :

OpenBSD 6.9-current (GENERIC.MP) #20: Sun May 16 00:32:45 MDT 2021
dera...@amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 34228760576 (32643MB)
avail mem = 33175949312 (31639MB)
random: good seed from bootblocks
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.8 @ 0xdab19000 (51 entries)
bios0: vendor American Megatrends Inc. version "1.0c" date 06/30/2020
bios0: Supermicro AS -5019D-FTN4
acpi0 at bios0: ACPI 6.1
acpi0: sleep states S0 S5
acpi0: tables DSDT FACP APIC FPDT FIDT SSDT SPMI SSDT MCFG SSDT CRAT CDIT BERT 
EINJ HEST HPET SSDT UEFI SSDT WSMT
acpi0: wakeup devices S0D0(S3) S0D1(S3) S0D2(S3) S0D3(S3) S1D0(S3) S1D1(S3) 
S1D2(S3) S1D3(S3)
acpitimer0 at acpi0: 3579545 Hz, 32 bits
acpimadt0 at acpi0 addr 0xfee0: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: AMD EPYC 3251 8-Core Processor, 2500.55 MHz, 17-01-02
cpu0: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu0: 64KB 64b/line 4-way I-cache, 32KB 64b/line 8-way D-cache, 512KB 64b/line 
8-way L2 cache
cpu0: ITLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu0: DTLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 8 var ranges, 88 fixed ranges
cpu0: apic clock running at 99MHz
cpu0: mwait min=64, max=64, C-substates=1.1, IBE
cpu1 at mainbus0: apid 2 (application processor)
cpu1: AMD EPYC 3251 8-Core Processor, 2500.01 MHz, 17-01-02
cpu1: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu1: 64KB 64b/line 4-way I-cache, 32KB 64b/line 8-way D-cache, 512KB 64b/line 
8-way L2 cache
cpu1: ITLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu1: DTLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu1: smt 0, core 1, package 0
cpu2 at mainbus0: apid 4 (application processor)
cpu2: AMD EPYC 3251 8-Core Processor, 2500.01 MHz, 17-01-02
cpu2: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu2: 64KB 64b/line 4-way I-cache, 32KB 64b/line 8-way D-cache, 512KB 64b/line 
8-way L2 cache
cpu2: ITLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu2: DTLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu2: smt 0, core 2, package 0
cpu3 at mainbus0: apid 6 (application processor)
cpu3: AMD EPYC 3251 8-Core Processor, 2500.01 MHz, 17-01-02
cpu3: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu3: 64KB 64b/line 4-way I-cache, 32KB

Re: pflow on PE router

2021-05-30 Thread Denis Fondras
Le Fri, May 28, 2021 at 03:30:58PM -0700, Chris Cappuccio a écrit :
> You might try "set state-defaults pflow, sloppy", also in some scenarios you 
> might need "set state-policy floating"
> 
> If "sloppy" fixes it, there may be some bugs to hunt.
>

"sloppy" seems to fix the issue. I will do more tests this week before declaring
victory :)

Thank you Chris.



Re: supermicro 5019D-FTN4 server with AMD EPYC 3251 SoC Processor

2021-06-30 Thread Denis Fondras
Le Tue, Jun 29, 2021 at 07:46:55PM +0200, EdaSky a écrit :
> Good day everyone
> 
> Does anyone use supermicro 5019D-FTN4 server with AMD EPYC 3251 SoC
> Processor?
> 
> https://www.supermicro.com/Aplus/system/Embedded/AS-5019D-FTN4.cfm
> 
> Experience and dmesg would be perfect.
> 

Experience is perfect so far. I am really happy with it as BGP edge.


OpenBSD 6.9-current (GENERIC.MP) #20: Sun May 16 00:32:45 MDT 2021
dera...@amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 34228760576 (32643MB)
avail mem = 33175949312 (31639MB)
random: good seed from bootblocks
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.8 @ 0xdab19000 (51 entries)
bios0: vendor American Megatrends Inc. version "1.0c" date 06/30/2020
bios0: Supermicro AS -5019D-FTN4
acpi0 at bios0: ACPI 6.1
acpi0: sleep states S0 S5
acpi0: tables DSDT FACP APIC FPDT FIDT SSDT SPMI SSDT MCFG SSDT CRAT CDIT BERT 
EINJ HEST HPET SSDT UEFI SSDT WSMT
acpi0: wakeup devices S0D0(S3) S0D1(S3) S0D2(S3) S0D3(S3) S1D0(S3) S1D1(S3) 
S1D2(S3) S1D3(S3)
acpitimer0 at acpi0: 3579545 Hz, 32 bits
acpimadt0 at acpi0 addr 0xfee0: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: AMD EPYC 3251 8-Core Processor, 2500.55 MHz, 17-01-02
cpu0: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu0: 64KB 64b/line 4-way I-cache, 32KB 64b/line 8-way D-cache, 512KB 64b/line 
8-way L2 cache
cpu0: ITLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu0: DTLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 8 var ranges, 88 fixed ranges
cpu0: apic clock running at 99MHz
cpu0: mwait min=64, max=64, C-substates=1.1, IBE
cpu1 at mainbus0: apid 2 (application processor)
cpu1: AMD EPYC 3251 8-Core Processor, 2500.01 MHz, 17-01-02
cpu1: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu1: 64KB 64b/line 4-way I-cache, 32KB 64b/line 8-way D-cache, 512KB 64b/line 
8-way L2 cache
cpu1: ITLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu1: DTLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu1: smt 0, core 1, package 0
cpu2 at mainbus0: apid 4 (application processor)
cpu2: AMD EPYC 3251 8-Core Processor, 2500.01 MHz, 17-01-02
cpu2: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu2: 64KB 64b/line 4-way I-cache, 32KB 64b/line 8-way D-cache, 512KB 64b/line 
8-way L2 cache
cpu2: ITLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu2: DTLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu2: smt 0, core 2, package 0
cpu3 at mainbus0: apid 6 (application processor)
cpu3: AMD EPYC 3251 8-Core Processor, 2500.01 MHz, 17-01-02
cpu3: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,OSVW,SKINIT,TCE,TOPEXT,CPCTR,DBKP,PCTRL3,MWAITX,ITSC,FSGSBASE,BMI1,AVX2,SMEP,BMI2,RDSEED,ADX,SMAP,CLFLUSHOPT,SHA,IBPB,XSAVEOPT,XSAVEC,XGETBV1,XSAVES
cpu3: 64KB 64b/line 4-way I-cache, 32KB 64b/line 8-way D-cache, 512KB 64b/line 
8-way L2 cache
cpu3: ITLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu3: DTLB 64 4KB entries fully associative, 64 4MB entries fully associative
cpu3: smt 0, core 3, package 0
cpu4 at mainbus0: apid 8 (application processor)
cpu4: AMD EPYC 3251 8-Core Processor, 2500.01 MHz, 17-01-02
cpu4: 
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,HTT,SSE3,PCLMUL,MWAIT,SSSE3,FMA3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AES,XSAVE,AVX,F16C,RDRAND,NXE,MMXX,FFXSR,PAGE1GB,RDTSCP,LONG,LAHF,CMPLEG,SVM,EAPICSP,AMCR8,ABM,SSE4A,MASSE,3DNOWP,O

Dynamic routing and REJECT,LLINFO,CLONED routes

2021-11-07 Thread Denis Fondras
Hi,

I am using BGP to connect 2 OpenBSD-current routers :

[static default GW]---RT1---[bgp]---RT2

I announce an IPv4 /32 from RT2.
After I start both RT1 and RT2, traffic flows to RT2 /32 without any issue.
However if I reboot RT2 (let's say for sysupgrade), RT1 loses the /32 (which is
expected) but as traffic is still directed to the /32 (because of a constant
ping towards the /32 for example), RT1 installs a route for the /32 with these
flags :

flags: 
(The REJECT flag is dropped after a timeout but comes back a few second later)

>From there I cannot get the back /32 from BGP until I manually delete the
automatically installed HOST route. Is there any way to deal with it without
manual intervention ?

Denis



Re: Dynamic routing and REJECT,LLINFO,CLONED routes

2021-11-07 Thread Denis Fondras
I came up with this diff to overcome my problem.

Index: rtable.c
===
RCS file: /cvs/src/sys/net/rtable.c,v
retrieving revision 1.75
diff -u -p -r1.75 rtable.c
--- rtable.c25 May 2021 22:45:09 -  1.75
+++ rtable.c7 Nov 2021 11:21:33 -
@@ -834,6 +834,10 @@ rtable_mpath_insert(struct art_node *an,
return;
}
 
+   /* Unreachable on-link route will not preferred */
+   if (ISSET(mrt->rt_flags, RTF_LLINFO|RTF_REJECT))
+   prio = 0;
+
/* Iterate until we find the route to be placed after ``rt''. */
while (mrt->rt_priority <= prio && SRPL_NEXT_LOCKED(mrt, rt_next)) {
prt = mrt;

Le Sun, Nov 07, 2021 at 10:11:54AM +0100, Denis Fondras a écrit :
> Hi,
> 
> I am using BGP to connect 2 OpenBSD-current routers :
> 
> [static default GW]---RT1---[bgp]---RT2
> 
> I announce an IPv4 /32 from RT2.
> After I start both RT1 and RT2, traffic flows to RT2 /32 without any issue.
> However if I reboot RT2 (let's say for sysupgrade), RT1 loses the /32 (which 
> is
> expected) but as traffic is still directed to the /32 (because of a constant
> ping towards the /32 for example), RT1 installs a route for the /32 with these
> flags :
> 
> flags: 
> (The REJECT flag is dropped after a timeout but comes back a few second later)
> 
> From there I cannot get the back /32 from BGP until I manually delete the
> automatically installed HOST route. Is there any way to deal with it without
> manual intervention ?
> 
> Denis



Re: Dynamic routing and REJECT,LLINFO,CLONED routes

2021-11-07 Thread Denis Fondras
Le Sun, Nov 07, 2021 at 12:58:13PM +0100, Claudio Jeker a écrit :
> To be honest, you have arp or ND running on that prefix and then overload
> it with a /32 route. You really need to explain why you do that. This is
> in my opinion a broken setup.
> 

It seemed like a smart idea back then, but you are right, I'd better rework my
setup :)



Re: How to restore vendor-specified MAC address

2021-11-17 Thread Denis Fondras
Le Wed, Nov 17, 2021 at 05:03:42AM +0100, Radek a écrit :
> 
> How can I restore the vendor's MAC address?
> It is 6.8/amd64.
> 

Check dmesg, it will give you the original MAC address, then ifconfig lladdr...



any BFD user ?

2021-12-06 Thread Denis Fondras
The subject says it all.

Is there any active BFD (Bidirectionnal Forwarding Detection) user ?

Denis



Re: Impact of 002_icmp6.patch

2020-10-30 Thread Denis Fondras
On Fri, Oct 30, 2020 at 11:36:33AM +0100, js-openbsd-m...@webkeks.org wrote:
> To close this thread, I found this: 
> https://twitter.com/m00nbsd/status/1321524807473782784
> 

Please, fix your tweet. The default install answer for IPv6 is 'none'.



Re: Impact of 002_icmp6.patch

2020-10-30 Thread Denis Fondras
On Fri, Oct 30, 2020 at 11:58:41AM +0100, Martin Schröder wrote:
> Am Fr., 30. Okt. 2020 um 11:54 Uhr schrieb Denis Fondras 
> :
> > Please, fix your tweet. The default install answer for IPv6 is 'none'.
> 
> This borders on "switch off v6 for security reasons", which would be just 
> wrong.
> 
> I'd much prefer that the project adopted a" v6 first, vintage ip
> second" approach.
> But I'm not a dev.
> 

The question is 'Is IPv6 enabled by default ?'. Fact tells NO.
The rest is a matter of opinion.



Re: Making MS teams work on openbsd

2023-04-18 Thread Denis Fondras
Le Fri, Mar 31, 2023 at 03:42:48PM +0200, Divan Santana a écrit :
> 
> - if no audio, mute and unmute the tab
> 

Thank you for the tip, it solved my audio issue.
Unfortunately, I lost the mic in the battle :D

So back to Firefox for Teams despite the screen sharing problem.



Failure to boot post 04/18 kernel on Deciso DEC750

2023-05-13 Thread Denis Fondras
Hello,

Just for your information, when applying this diff :
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/dev/ic/com.c.diff?r1=1.175&r2=1.176&f=h
Deciso DEC750 (based on Ryzen Embedded) cannot boot anymore (reboot or
hang when loading kernel).

Regards,
Denis



Re: Checking OpenBSD host type

2023-09-19 Thread Denis Fondras
Le Tue, Sep 19, 2023 at 03:13:21PM +0200, Alessandro Baggi a écrit :
> Hi list,
> there is a way to check if  OpenBSD runs on VM or physical hardware?
> 
> Something like in sysctl or similar.
> 
> Thank you in advance.
> 

You may want to check the `hw` variable :

$ sysctl hw
[...]
hw.model=Common KVM processor
hw.vendor=QEMU
[...]



Programmatically add default IPv6 route

2024-02-23 Thread Denis Fondras
Hello,

I am trying to add IPv6 support for pppd(8) (IPv6CP) and I encounter a blocker
when adding a default IPv6 route to PPP peer.

Feb 23 17:26:45 rt-01 pppd[64071]: Couldn't add IPv6 default route: Network is 
unreachable

Adding the default route from route(8) works when the connection is established.

>From what I see with route(8), it sends the same route message as pppd(8).

>From `route -v add -inet6 default fe80::ca4c:75ff:fe16:9f00%ppp0` :

```
RTM_ADD: Add Route: len 168, priority 0, table 0, if# 0, pid: 0, seq 1, errno 0
flags:
fmask:
use:0   mtu:0expire:0 
locks:  inits: 
sockaddrs: 
 :: fe80::ca4c:75ff:fe16:9f00%ppp0 default
```

>From pppd(8) :
```
got message of size 168 on Fri Feb 23 17:26:45 2024
RTM_ADD: Add Route: len 168, priority 0, table 0, if# 0, pid: 64071, seq 1, 
errno 51
flags:
fmask:
use:0   mtu:0expire:0 
locks:  inits: 
sockaddrs: 
 :: fe80::ca4c:75ff:fe16:9f00%ppp0 default
```

However `route monitor -inet6` shows that the message is different when using
route(8) :
```
got message of size 288 on Fri Feb 23 17:26:22 2024
RTM_ADD: Add Route: len 288, priority 56, table 0, if# 7, name ppp0, pid: 
53003, seq 1, errno 0
flags:
fmask:
use:0   mtu:0expire:0 
locks:  inits: 
sockaddrs: 
 :: fe80::ca4c:75ff:fe16:9f00%ppp0 :: ppp0 fe80::d925:b01f:db25:b020%ppp0 
fe80::ca4c:75ff:fe16:9f00%ppp0
```

Should I also send the IFP, IFA and BRD sockaddrs from pppd(8) ?
How comes message sent from route(8) have more attributes when received by
monitor ?

Denis



Re: Programmatically add default IPv6 route

2024-02-23 Thread Denis Fondras
One more information, ENETUNREACH is issued on line 521 of net/route.c.
Could this be some kind of race condition ?

>From route monitor, I get this after my RTM_ADD :
```
RTM_CHGADDRATTR: address attributes being changed: len 224, if# 7, name ppp0, 
metric 0, flags:
sockaddrs: 
 ::::::: ppp0 fe80::d97e:e77f:db7e:e780%ppp0 
fe80::ca4c:75ff:fe16:9f00%ppp0

```


Le Fri, Feb 23, 2024 at 06:25:18PM +0100, Denis Fondras a écrit :
> Hello,
> 
> I am trying to add IPv6 support for pppd(8) (IPv6CP) and I encounter a blocker
> when adding a default IPv6 route to PPP peer.
> 
> Feb 23 17:26:45 rt-01 pppd[64071]: Couldn't add IPv6 default route: Network 
> is unreachable
> 
> Adding the default route from route(8) works when the connection is 
> established.
> 
> From what I see with route(8), it sends the same route message as pppd(8).
> 
> From `route -v add -inet6 default fe80::ca4c:75ff:fe16:9f00%ppp0` :
> 
> ```
> RTM_ADD: Add Route: len 168, priority 0, table 0, if# 0, pid: 0, seq 1, errno > 0
> flags:
> fmask:
> use:0   mtu:0expire:0 
> locks:  inits: 
> sockaddrs: 
>  :: fe80::ca4c:75ff:fe16:9f00%ppp0 default
> ```
> 
> From pppd(8) :
> ```
> got message of size 168 on Fri Feb 23 17:26:45 2024
> RTM_ADD: Add Route: len 168, priority 0, table 0, if# 0, pid: 64071, seq 1, 
> errno 51
> flags:
> fmask:
> use:0   mtu:0expire:0 
> locks:  inits: 
> sockaddrs: 
>  :: fe80::ca4c:75ff:fe16:9f00%ppp0 default
> ```
> 
> However `route monitor -inet6` shows that the message is different when using
> route(8) :
> ```
> got message of size 288 on Fri Feb 23 17:26:22 2024
> RTM_ADD: Add Route: len 288, priority 56, table 0, if# 7, name ppp0, pid: 
> 53003, seq 1, errno 0
> flags:
> fmask:
> use:0   mtu:0expire:0 
> locks:  inits: 
> sockaddrs: 
>  :: fe80::ca4c:75ff:fe16:9f00%ppp0 :: ppp0 fe80::d925:b01f:db25:b020%ppp0 
> fe80::ca4c:75ff:fe16:9f00%ppp0
> ```
> 
> Should I also send the IFP, IFA and BRD sockaddrs from pppd(8) ?
> How comes message sent from route(8) have more attributes when received by
> monitor ?
> 
> Denis
> 



Re: ssh IPV6 link local through jumphost

2024-02-23 Thread Denis Fondras
Le Fri, Feb 23, 2024 at 12:33:42PM -0500, Tom a écrit :
> Hi list!
> 
> Could you please guide me how to use link-local addresses with jumphost?
> 
> I have a server 'X' with a link local IPv6 address of
> fe80::262:bff:: 
> that IP is reachable from the server 'jumpserver' via interface em0,
> command `ssh user@fe80::262:bff::@em0` works just fine.
> 
> However if I issue the command:
> `ssh -J  user9001@jumpserver user@fe80::262:bff::%em0`
> that doesn't work:
> Error: channel 0: open failed: connect failed: hostname
> nor servname provided, or not known stdio forwarding failed
> 
> The command above works fine for IPv6 GUA 2006::XYZ.
> 
> Tried versions OpenSSH_7.5, OpenSSH_9.6.
> 

I can confirm it works with OpenSSH_9.6 on OpenBSD-current.
Any change to ssh_config or sshd_config ?



Re: Programmatically add default IPv6 route

2024-02-23 Thread Denis Fondras
Le Fri, Feb 23, 2024 at 08:58:59PM +0100, Claudio Jeker a écrit :
> > 
> > Should I also send the IFP, IFA and BRD sockaddrs from pppd(8) ?
> 
> Don't think so.
> 
> > How comes message sent from route(8) have more attributes when received by
> > monitor ?
> 
> The kernel fills those in.
> 
> Make sure you encode the IPv6 link local address correctly. The stupid
> kame hack will hunt you.
>

You are right Claudio, I messed that part...

It is much better when you fill the right byte with the correct value :p

rt-01# tcpdump  -i ppp0   
tcpdump: listening on ppp0, link-type PPP
22:25:22.420092 liopen.xco6.lioptic.net > par10s42-in-x04.1e100.net: icmp6: 
echo request
22:25:22.519524 par10s42-in-x04.1e100.net > liopen.xco6.lioptic.net: icmp6: 
echo reply

Thank you very much Claudio :)

Denis



Re: Keeping track of MAC addresses

2019-02-20 Thread Denis Fondras
On Wed, Feb 20, 2019 at 01:05:59PM -0700, j...@bitminer.ca wrote:
> > 
> > did you take a look at net/arpwatch?
> 
> Too many emails; email to root is not a useful mechanism for me.
> 

And net/arpwatch does not handle IPv6.
I'll use the route message ABI if I had to do what you are looking for.



Re: Block/allow outgoing traffic by user or application?

2019-02-24 Thread Denis Fondras
On Sun, Feb 24, 2019 at 01:43:08PM +0700, Frank Beuth wrote:
> Is it possible to restrict network access on a per-user or per-application
> (rather than per-port) basis?
> 
> pf does not seem to have any capability to do this, maybe I missed something.
> 

Don't know what you are aiming to do but pf rules have a "user" keyword.



Re: openbgpd; strip private ASNs from bgp updates

2019-03-26 Thread Denis Fondras
On Tue, Mar 26, 2019 at 02:54:38PM +0100, open...@kene.nu wrote:
> Hello,
> 
> Is there a way to make openbgpd strip private ASNs from updates it
> sends to certain neighbors?
> I am using openbgpd on my edge routers and distribute routes generated
> internally to the rest of the world. However, the internal routers use
> private ASNs and this is obviously frowned upon by my peering
> partners.
> 
> I can of course have network statements on my edge routers but that
> assumes the prefixes will always be reachable via said edge router,
> something I can never be certain of. I would rather the updates rely
> on the prefix actually being announced from the source.
> 

Perhaps with transparent-as ?



Re: packet loss when > 1000 clients connect

2019-04-16 Thread Denis Fondras
On Tue, Apr 16, 2019 at 11:07:47AM +0200, Torsten wrote:
> Hi!
> 
> Problem description:
> In a customers network more than 2k clients connect to a server and
> perform https requests. When in the morning more and more clients become
> active, the number of connections rises until more and more clients fail
> to connect to the server. The reason appears to be packet losses.
> 
> 
> Question:
> Are we hitting system limits or resource exhaustion that we should have
> configured higher? Any other idea what to look for?
> 

Check with pfctl -si if you reach a limit



Re: eBGP routes are not reannounced

2019-04-22 Thread Denis Fondras
On Mon, Apr 22, 2019 at 10:07:52AM +, Mik J wrote:
> Hello,
> 
> I'm trying to set up openbgpd.
> 
> On site 2, I'm peering with us.bgp-spamd.net and eu.bgp-spamd.net sucessfully.
> The problem is that these routes are not in the bgp table on site 3. The BGP 
> peerings are up.
> From site 3 I can ping 192.0.2.2/site 2. I sucessfully receive prefixes 
> announced on site 2. 
> I used next hop self on the ibgp session.Does anyone has an idea ?
> 

allow from group "spam-bgp" ?


> log updates
> network 192.0.2.2/32network 10.1.1.0/24
> myAS="65001"
> site2="192.0.2.2"
> site3="192.0.2.3"
> spam_rs1="64.142.121.62"    # us.bgp-spamd.net
> spam_rs2="217.31.80.170"    # eu.bgp-spamd.net
> spamASN="65066"
> 
> AS $myAS
> fib-update no
> 
> group "spam-bgp" {
>     remote-as   $spamASN
>     multihop 64
>     announce none   # Do not send any route updates
>     neighbor $spam_rs1
>     neighbor $spam_rs2
> }
> 
> group "internalnet" {
>     remote-as   $myAS
>     multihop    64
>     neighbor    $site3
>     local-address   $site2
>     set    nexthop self
>     tcp md5sig password password1234
> }
> 
> 



Re: eBGP routes are not reannounced

2019-04-22 Thread Denis Fondras
> I don't understand how to use "allow from group"
> 

Sorry, I responded too fast. You already receive the prefixes from $spamASN and
you want to redistribute them.

There is no filtering in the (old) versions you use IIRC.

> Yes I use 6.0, 6.1 and 5.8 on these machines. I'm waiting for 6.5 to be 
> released and try to migrate them all.
> 
> I'm used to configure Cisco devices and there's no filtering. Routes received 
> by an eBGP session are reannounced to iBGP peers and next hop self should be 
> used in that case.
> If that option is not used, the routes are installed in the BGP table but 
> since the next hop is unreachable, they are not installed in the routing 
> table.
> 
> I expected my iBGP peers (site 3...) to receive the routes (spam) coming from 
> the eBGP peer on site 2.
> 
> It seemed to me that group was like a peer-group.
> Le lundi 22 avril 2019 à 18:32:26 UTC+2, Tom Smyth 
>  a écrit :  
>  
>  Hi Mik,
> 
> 1) what version of OpenBSD / OpenBGPD are you running...
> 2) if it is >6.4 OpenBSD / OpenBGPD  then Claudio et all have
> implemented a new RFC  for eBGP (cant remember the number)
> 
> TLDR version of the new  eBGP RFC is that unfiltered bgp will by
> default, deny any announcements and only announce what is explicitly
> allowed by filters added by the administrator of the BGP router...
> 
> Check out Job@  & Claudio@
>  *NOG  videos on BGPD / OpenBGPD for more details
> (they are on youtube)
> 
> I hope this helps
> 
> Bon Chance :)
> 
> 
> 
> On Mon, 22 Apr 2019 at 11:17, Mik J  wrote:
> >
> > Hello,
> >
> > I'm trying to set up openbgpd.
> >
> > On site 2, I'm peering with us.bgp-spamd.net and eu.bgp-spamd.net 
> > sucessfully.
> > The problem is that these routes are not in the bgp table on site 3. The 
> > BGP peerings are up.
> > From site 3 I can ping 192.0.2.2/site 2. I sucessfully receive prefixes 
> > announced on site 2.
> > I used next hop self on the ibgp session.Does anyone has an idea ?
> >
> > log updates
> > network 192.0.2.2/32network 10.1.1.0/24
> > myAS="65001"
> > site2="192.0.2.2"
> > site3="192.0.2.3"
> > spam_rs1="64.142.121.62"    # us.bgp-spamd.net
> > spam_rs2="217.31.80.170"    # eu.bgp-spamd.net
> > spamASN="65066"
> >
> > AS $myAS
> > fib-update no
> >
> > group "spam-bgp" {
> >    remote-as          $spamASN
> >    multihop 64
> >    announce none          # Do not send any route updates
> >    neighbor $spam_rs1
> >    neighbor $spam_rs2
> > }
> >
> > group "internalnet" {
> >    remote-as          $myAS
> >    multihop            64
> >    neighbor            $site3
> >    local-address      $site2
> >    set                        nexthop self
> >    tcp md5sig password password1234
> > }
> >
> >
> 
> 
> -- 
> Kindest regards,
> Tom Smyth.
> 
>   



Re: When will be created a great desktop experience for OpenBSD?

2019-05-06 Thread Denis Fondras
> user-friendly and easy-to-use
>

Sounds like the exact description of current OpenBSD...



bgpd : route in FIB, not in kernel route table

2019-05-10 Thread Denis Fondras
Hi,

I had a weird problem today that I can't explain when I tried to add a peer
(185.22.129.11) to bgpd.
The prefix was accepted, shows up in RIB as valid, installed in FIB according to
bgpctl but kernel could not find a route. Group "liopen" provides a fullview.

OpenBSD-current from May 8th.

I had to restart bgpd for the route to show up.

Any idea what happened ?

rt-grav-02# bgpctl sh fib 193.169.46.0/23
flags: * = valid, B = BGP, C = Connected, S = Static, D = Dynamic
   N = BGP Nexthop reachable via this route
   r = reject route, b = blackhole route

flags prio destination  gateway
*B 48 193.169.46.0/23  185.22.129.11

rt-grav-02# route get 193.169.46.0/23
get net 193.169.46.0/23: not in table

My config file :

AS 60983
router-id 185.22.128.253

neighbor 185.22.129.11 {
remote-as 49623
multihop 5
enforce neighbor-as yes
enforce local-as yes
announce IPv4 unicast
}
group "liopen" {
neighbor 2a00:6060::1 {
descr "rt-grav-01 v6"
remote-as 60983
enforce neighbor-as no
enforce local-as yes
announce IPv6 unicast
}
neighbor 185.22.129.254 {
descr "rt-grav-01 v4"
remote-as 60983
enforce neighbor-as no
enforce local-as yes
announce IPv4 unicast
}
}

match to 185.22.129.254 set { nexthop self }
allow from 185.22.129.11 
allow to 185.22.129.11 
allow from ibgp 
allow to ibgp 
allow from any prefix 0.0.0.0/0 prefixlen 8 - 24 
allow from any prefix ::/0 prefixlen 16 - 48 
match from any community 65535:0 set { localpref 0 }
deny quick from any AS 23456 
deny quick from any AS 64496 - 131071 
deny quick from any AS 42 - 4294967295 
deny from any max-as-len 100 



Re: Static IPv6, router tries to reach system with unknown fe80 address

2019-07-13 Thread Denis Fondras
On Sat, Jul 13, 2019 at 12:15:30PM +0200, Stefan Hagen wrote:
> Hello,
> 
> I have a question regarding the IPv6 behavior of OpenBSD compared to
> Linux/FreeBSD. I tried to configure a static IPv6 address on my VPS.
> 
> From my provider, I got the following data:
> 
> IP Address: 2a01:4f8:c2c:76ef::/64
> Gateway: fe80::1
> 
> So I configured my interface:
> 
> $ cat /etc/hostname.vio0
> inet6 2a01:4f8:c2c:76ef::1 128
> 
> $ cat /etc/mygate
> fe80::1%vio0
> 
> Which results in:
> vio0: flags=8843 mtu 1500
>lladdr 96:00:00:2a:a9:8b
>index 1 priority 0 llprio 3
>groups: egress
>media: Ethernet autoselect
>status: active
>inet6 fe80::72f2:b265:b89c:b4ec%vio0 prefixlen 64 scopeid 0x1
>inet6 2a01:4f8:c2c:76ef::1 prefixlen 128
> 
> $ route -n show
> Internet6:
> Destination Gateway  Flags Refs Use Mtu Prio Iface
> default fe80::1%vio0 UGS  0  26   -8 vio0
> [...]
> 
> $ ndp -an
> Neighbor   Linklayer Address Netif ExpireS Flags
> 2a01:4f8:c2c:76ef::1   96:00:00:2a:a9:8b  vio0 permanent R l
> fe80::1%vio0   d2:74:7f:6e:37:e3  vio0 8h32m58s  S R
> fe80::3452:7ff:fe83:fa7b%vio0  d2:74:7f:6e:37:e3  vio0 10h9m34s  S R
> fe80::72f2:b265:b89c:b4ec%vio0 96:00:00:2a:a9:8b  vio0 permanent R l
> 
> While this configuration (just setting IP and gateway) leads to a
> working IPv6 connectivity on Linux and FreeBSD, it does not on OpenBSD
> and it took me while to figure out why.
> 
> While pinging an IPv6 only address, tcpdump revealed the following line
> repeating over and over again:
> 
> $ tcpdump -i vio0 ip6
> [...]
> 21:50:58.688256 fe80::3896:ecff:fe78:2702 > ff02::1:ff2a:a98b: \
>icmp6: neighbor sol: who has fe80::9400:ff:fe2a:a98b
> [...]
> 
> I then added the address fe80::9400:ff:fe2a:a98b as alias to my
> interface.
> 
> Now IPv6 works like a charm:
> 
> $ ifconfig vio0
> vio0: flags=8843 mtu 1500
>lladdr 96:00:00:2a:a9:8b
>index 1 priority 0 llprio 3
>groups: egress
>media: Ethernet autoselect
>status: active
>inet 116.203.83.222 netmask 0x
>inet6 fe80::72f2:b265:b89c:b4ec%vio0 prefixlen 64 scopeid 0x1
>inet6 2a01:4f8:c2c:76ef::1 prefixlen 128
>inet6 fe80::9400:ff:fe2a:a98b%vio0 prefixlen 64 scopeid 0x1
> 
> $ ndp -an
> Neighbor   Linklayer Address Netif ExpireS Flags
> 2a01:4f8:c2c:76ef::1   96:00:00:2a:a9:8b  vio0 permanent R l
> fe80::1%vio0   d2:74:7f:6e:37:e3  vio0 8h20m39s  S R
> fe80::3452:7ff:fe83:fa7b%vio0  d2:74:7f:6e:37:e3  vio0 9h57m15s  S R
> fe80::72f2:b265:b89c:b4ec%vio0 96:00:00:2a:a9:8b  vio0 permanent R l
> fe80::9400:ff:fe2a:a98b%vio0   96:00:00:2a:a9:8b  vio0 permanent R l
> 
> My assumption is, that the gateway definition of fe80::1 instructs the OS to
> "look around for a router". The router then offers(?) a new fe80 Address to
> communicate with my interface. But my interface doesn't know
> about it and ignores the request.
> 
> My assumption is probably wrong. Can someone help me to understand this
> scenario and how to make it work in OpenBSD without having to play with
> tcpdump?
> 
> Wasn't the router supposed to talk to me via fe80::72f2:b265:b89c:b4ec?
> Or should OpenBSD have assigned fe80::9400:ff:fe2a:a98b automatically as
> alias?
> 
> Compared with FreeBSD on a VM next to the OpenBSD one:
> 
> $ ifconfig vtnet0
> vtnet0: flags=8843 metric 0 mtu 1500
>options=[...line too long...]
>ether 96:00:00:2a:c9:de
>inet6 2a01:4f8:c2c:70f1::1 prefixlen 64
>inet6 fe80::9400:ff:fe2a:c9de%vtnet0 prefixlen 64 scopeid 0x1
>inet 116.203.86.85 netmask 0x broadcast 116.203.86.85
>media: Ethernet 10Gbase-T 
>status: active
>nd6 options=21
> 
> Here I see fe80::9400:ff:fe2a:c9de%vtnet0 set as local alias
> automatically. I'm not sure how this address is being generated and/or
> communicated between the OS and the router. But apparently there is a
> mismatch between router and OpenBSD, but not on Linux and FreeBSD.
> 
> Am I missing something?
> 

OpenBSD has RFC7217 enabled by default. This means your LL address does not
embed your MAC address. Use "ifconfig vio0 -soii" to disable that behavior (see
ifconfig(8) for details).



Re: Moving from Bird to OpenBGPD

2019-07-14 Thread Denis Fondras
On Sat, Jul 13, 2019 at 09:44:28PM -0700, BSD user wrote:
> Hello,
> 
> My apologies for sending this email multiple times.
> 
> I was so mortified by Tutanota's awful text formatting that I created a
> new mail account that supported IMAP so that I could load it up in
> Thunderbird with text only mode enabled.
> 
> Once again, my apologies for my rookie mistake choosing Tutanota for use
> on an international mailing list such as this one. I hope you guys will
> give me one more chance.
> 
> My (hopefully) unmangled message is below.
> 

You did not include which version you are running, I'll assume this is 6.5.
It seems you do not have any filter, OpenBGPD denies everything by default.

> 
> --
> 
> 
> Hello,
> 
> 
> I’m having some trouble configuring OpenBGPD to replace my Bird deployment.
> 
> I’m trying to set up redundant web infrastructure for a few websites I
> host with Vultr. To do so, I followed this guide:
> 
> https://www.vultr.com/docs/high-availability-on-vultr-with-floating-ip-and-bgp
> 
> It works flawlessly with Bird running on OpenBSD, but I obviously prefer
> to run utilities from the base system wherever possible. I’ve spent more
> time than I’d like to admit trying to get this setup working on OpenBGPD.
> 
> The only thing I did different from the above guide was use lo1 rather
> than a dummy interface, as dummy interfaces appear to be a linuxism as
> per this mailing list thread I found:
> 
> http://openbsd-archive.7691.n7.nabble.com/Dummy-Interface-In-OpenBGPd-td34009.html
> 
> Basically, all I’m trying to do is port my Bird config over to OpenBGPD.
> At this point I’m just banging my head against a wall. I’ve spent
> several days googling, reading man pages and trying different configs. I
> must be missing something basic, and it’s likely something obvious I’m
> missing, as I am by no means a BGP expert.
> 
> My bird config looks like this:
> 
> 
> log "/var/log/bird" all;
> 
> router id xxx.xxx.224.9;
> 
> protocol device
> {
> scan time 60;
> }
> 
> protocol direct
> {
> interface "lo1";
> }
> 
> protocol bgp vultr
> {
> local as 65xxx;
> source address xxx.xxx.224.9;
> import none;
> export all;
> graceful restart on;
> next hop self;
> multihop 2;
> neighbor 169.254.169.254 as 64515;
> password "xx";
> }
> 
> 
> My attempt at a bgpd.conf looks like this:
> 
> 
> # Global Configuration
> 
> AS 65xxx
> router-id xxx.xxx.224.9
> 
> # Our Address Space
> network xxx.xxx.0.141/32
> network inet connected
> 
> # IPv4 Peers
> 
> neighbor 169.254.169.254 {
> remote-as   64515
> tcp md5sig password xx
> set nexthop self
> multihop2
> descr   Vultr
> local-address   xxx.xxx.224.9
> announceIPv4 unicast
> }
> 
> 
> 
> Any assistance you fine folks could provide to help me get this working
> would be hugely appreciated.
> 
> I've also attached my config files to eliminate any chance of them being
> mangled.
> 
> Thanks so much for your time.
> 

> # Global Configuration
> 
> AS 65xxx
> router-id xxx.xxx.224.9
> 
> # Our Address Space
> network xxx.xxx.0.141/32
> network inet connected
> 
> # IPv4 Peers
> 
> neighbor 169.254.169.254 {
> remote-as   64515
> tcp md5sig password xx
> set nexthop self
> multihop2
> descr   Vultr
> local-address   xxx.xxx.224.9
> announceIPv4 unicast
> }

> log "/var/log/bird" all;
> 
> router id xxx.xxx.224.9;
> 
> protocol device
> {
> scan time 60;
> }
> 
> protocol direct
> {
> interface "lo1";
> }
> 
> protocol bgp vultr
> {
> local as 65xxx;
> source address xxx.xxx.224.9;
> import none;
> export all;
> graceful restart on;
> next hop self;
> multihop 2;
> neighbor 169.254.169.254 as 64515;
> password "xx";
> }
> 



Re: IPv6 problems

2019-08-13 Thread Denis Fondras
On Tue, Aug 13, 2019 at 05:25:43PM +0200, list wrote:
> Hi,
> 
> I have been trying to set up IPv6 on my OpenBSD machine.
> 
> It is running on stable branch. 
> 
> The interface I am trying to configure IPv6 on is "vio".
> 
> My hostname.vio0 looks like this:
> 
> 
> dhcp
> 
> inet6 alias  provider> 64
> 
> 
> But I just can't get it to work. It is not reachable at all. I may not
> be reached and I can't reach anybody else via IPv6.
> 
> 
> I'd appreciate any help.
> 

Perhaps you are missing a route ?

> 
> Thank you for your time.
> 
> 
> With kind regards,
> 
> Stephan
> 



Re: IPv6 problems

2019-08-14 Thread Denis Fondras
On Wed, Aug 14, 2019 at 08:36:45PM +0200, list wrote:
> Hello,
> 
> thanks alot for your suggestions! I really appreciate it.
> 
> Unluckily that didn't work out.
> 
> My hostname.vio0 now looks like this:
> 
>         inet6 alias /64
> 
>         !route add -inet6 default fe80::2de:361a:24aa:d7a6%vio0
>

Why this LL IP as the gateway ?
I guess this would work better if it was an IP not on your own machine.

> 
> So with this gateway added I now don't get the "no route to host" when
> trying to ping someone else on their IPv6. But I am not getting any
> replies.
> 
> I somehow don't get any replies. Even with pf turned off. (pfctl -d)
> 
> I still cannot ping the issued server. Getting "no route to host" when
> trying to ping it.
> 
> Which seems logical when i just added a route. Shouldn't change anything
> when trying to ping from the outside.
> 
> Do you have any futher ideas ?
> 
> When doing a "ifconfig vio0" I get:
> 
>     vio0: flags=8843 mtu 1500
> 
>     lladdr 
> 
>     index 1 priority 0 llprio 3
> 
>     groups: egress
> 
>     media: Ethernet autoselect
> 
>     status: active
> 
>     inet  netmask 0xfc00 broadcast 
> 
>     inet6 fe80::2de:361a:24aa:d7a6%vio0 prefixlen 64 scopeid 0x1
> 
>     inet6  prefixlen 64
> 
> .. Hmmm it feels like I am forgetting something.
> 
> 
> I'd appreciate any suggestions !
> 
> 
> Kind regards,
> 
> 
> Stephan
> 
> On 8/13/19 10:21 PM, Jordan Geoghegan wrote:
> >
> > On 8/13/19 10:11 AM, Thomas Bohl wrote:
> >> Hello,
> >>
> >>> My hostname.vio0 looks like this:
> >>>
> >>>
> >>> dhcp
> >>>
> >>> inet6 alias  >>> provider> 64
> >>>
> >>
> >> You most likely need to add a route. Add something like this to your
> >> hostname file:
> >> !route add -inet6 default fe80::1%vio0
> >>
> >>
> >> Just in case you have the same problem. For whatever reason, after a
> >> reboot, I have to do this in order to get IPv6 traffic flowing:
> >> ping6 -c 10 fe80::1%vio0
> >>
> > or just add your gateway to your /etc/mygate file.
> >
> >
> >
> 



Re: IPv6 problems

2019-08-15 Thread Denis Fondras
On Thu, Aug 15, 2019 at 06:50:09PM +0200, list wrote:
> Hi,
> 
> EDIT:
> 
> I have taken a look at the website of my hosting provider.
> 
> My IPv6 gateway would be fe80::1.
> 
> When trying to add the route manually i get "network unreachable".
> 

Did you specify the output interface ? With LL addresses, you need to specify 
it.

route add -inet6 default fe80::1%vio0



Re: bgpctl sho ri nei terse output vs man page discrepancy

2019-09-22 Thread Denis Fondras
On Sun, Sep 22, 2019 at 02:08:50PM +0200, Rachel Roch wrote:
> Hi,
> 
> Hopefully I'm not missing something silly here but I've read the paragraph in 
> the man page and it only lists 15 variables:
> 
> "The printed numbers are the sent and received open,
> sent and received notifications, sent and received
> updates, sent and received keepalives, and sent and
> received route refresh messages plus the current and
> maximum prefix count, the number of sent and received
> updates, and withdraws."
> 
> But bgpctl sho ri nei outputs 16 numbers, not 15 ?
> 

You should read "sent & received withdraws".
> 



Re: IPv6 routing

2008-11-07 Thread Denis Fondras

BTW: Don't forget to route the prefix to lo at the last hop so that any
unassigned subnets don't cause the packet to be bounced back up to the
default route.



Could you explain how to do that on OpenBSD please ?
Perhaps my box is misconfigured... :p

TIA,
Denis



Re: IPv6 routing

2008-11-11 Thread Denis Fondras

A bit late perhaps, but this is how I do it :

route add -inet6 -net $PREFIX:: -prefixlen 48 -interface ::1 -reject

Of course, you have to set PREFIX to the prefix you want to reject.
After this, all routes you add should be more specific (smaller
prefix) so should work anyway.

I add this line in the /etc/hostname.IF file of the interface where
the prefix is routed to (with a ! at the start, of course).

Cheers,

Paul 'WEiRD' de Weerd



Thank you very much for the tip :)

Denis



Re: [obsdfr-misc] besoin de comprendre l'install de ma soekris

2008-11-14 Thread Denis Fondras

Salut,



voila mon histoire, je viens d'installer openbsd4.4 ( au moin dix fois en 2 jours 
<;oD )
sur ma soekris en pxe  avec l'interface minicom pour girer l'install . 
Apris de multiples echec de connexion suite ` mon installation 
( essais avec 2 postes  sous deux distributions Linux diffirentes) 
je me suis apergu qu'il fallait quand mime ` la racine de mes 2 postes,

 le repertoire TFTP avec le fichier pxeboot(dans le doute il y a aussi les 
fichiers bsd et bsd.rd).
Enfin, je pense qu'il n'y a que le fichier "pxeboot"qui permet le dimarrage 
car je disactive le  serveur DHCP afin de dimarrer sur OpenBSD maintenant et non sur l'installation.


es ce vrai ou ai je loupi une itape ?



pxeboot permet de lancer le chargeur de dimarrage.
bsd.rd permet de lancer l'installation.
/etc/boot.conf permet de configurer le chargeur de dimarrage


un autre petit point qui me fait transpirer !
 Dans la mesure ou mon install c'est faite sur une CF, je n'ai pas mis de swap. 
Au partitionnement je crier d'abord la partition "a" puis arrivant sur la "b" , par defaut 
le systhme de fichier proposi et "swap" . 
Donc je repropose le format 4.2bsd ( il me semble..) avec le nom de la 
partition adiquat etc.. A la fin du partitionnement quand je termine avec l'option "q" ,
la partition "b" n'apparait pas sur la liste des partitions qui vont etre formatis. 
Pour que toutes les partitions qui seront formatis ` la fin apparaissent, 
 apris la criation de "a" je passe directement ` la criation de "d" et tout rentre dans l'ordre.


La aussi es ce normal ou ai je loupi quelques choses ?



La lecture de la FAQ :D
"b" est toujours le swap sous OpenBSD ;)

Denis



Re: Apache problems

2011-09-18 Thread Denis Fondras

Le 18/09/2011 15:54, L. V. Lammert a icrit :
>
> Something is borking Apache and causing it to use UP all resources in an
> 'unauthorized' manner, or *think* they have all bee used.
>

Could this be linked to some "Apache Killer" ?



Re: Multiple ISP-connections/Routing/Packet filtering

2012-01-14 Thread Denis Fondras

Hello,



Unfortunately, the pf.conf syntax has changed since v4.6 and while I do
plan to upgrade my
own firewall to v5.0 (I've bought the CD already) I haven't yet had time to
perform the upgrade.
As a result, I haven't worked out what the equivalent 'modern' syntax would
be, but you might
be able to get some hints from what I'm using in v4.6.



I'm really looking forward the result of your upgrade.

I have a plain "pass in on $if_bnt inet proto tcp to any port 25 
reply-to $if_bnt", I can see traffic comming through $if_bnt but never 
see any response going out (on any interface). I can see a state is 
created in the state-table.


SMTP port is answering on another internet-facing interface without any 
problem.


If I change the rule to "pass in on $if_bnt inet proto icmp reply-to 
$if_bnt", I can see a state is created, I can see the icmp-request comes 
through $if_bnt but icmp-reply goes out through another 
internet-connected interface.


I read on some website that (FreeBSD pf's) "reply-to" only works with 
traffic passing through the router but not with traffic terminating on 
the router.


Denis



undeadly.org IPv6 reachability

2009-08-16 Thread Denis Fondras

Hello Misc,

Since a few day, I can't connect to Undeadly.org over IPv6 (works well 
over v4).

Is there any issue going on these days ?

Thanks,
Denis



Re: smtpd: feature like the transport table in postfix

2009-10-25 Thread Denis Fondras

Hi Rene,

Perhaps I didn't understand correctly your problem but can't you just use :
"accept from $mynetwork for domain example.net relay" ?

and let smtpd resolve example.net MX ?

Denis



Re: Why anyone in their right mind would like to use NAT64

2012-10-24 Thread Denis Fondras

Hello,

Le 24/10/2012 18:43, Daniel Ouellet a écrit :

Hi,

Just saw a few questions and patch for NAT64 on misc and tech@ and I am
really questioning the reason to be fore NAT64 and why anyone in their
right mind would actually want to use this?



What is your proposal to allow a v6-only network to reach a v4-only server ?

Denis



Problem with uplcom(4) - hangs

2010-08-29 Thread Denis Fondras

Hello misc@,

I have a problem with uplcom(4). Whenever I connect to a remote terminal 
with "cu -l /dev/ttyU0", it hangs after a few seconds (usually under 2 
minutes).


I tried various settings and still have the same issue :
- using /dev/cuaU0
- setting speed 9600 or 19200
- connecting to a Soekris Net5501 or a Cisco router
- using OpenBSD 4.6, 4.7 and -current

However the adapter works like a charm from a MS Windows workstation.

Here is what a typical session looks like :

# cu -l /dev/ttyU0 -s 19200
Connected

OpenBSD/i386 (soekris.my.domain) (tty00)

login:
[] <= when it hangs the cursor stands here (looks like a \n\t)


I can't stop cu without killing its process.

/var/log/aculog tells :

root (Sun Aug 29 21:01:37 2010)  call completed
root (Sun Aug 29 21:14:41 2010)  call completed


And ps looks like :

[...]
22347 p0  Is  0:00.01 -ksh (ksh)
27473 p0  I+  0:00.01 cu -l /dev/ttyU0 -s 19200
 5241 p0  I+  0:00.00 cu -l /dev/ttyU0 -s 19200
[...]


I tried to enable debugging in /usr/src/sys/dev/usb/uplcom.c but it is 
not really helping.


Is there anything I can try to track that bug ?

Thank you in advance,
Denis


P.S. : Here is my dmesg :

OpenBSD 4.8-current (GENERIC) #3: Sun Aug 29 20:49:25 CEST 2010
r...@kreator.my.domain:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: Intel(R) Celeron(R) CPU 2.50GHz ("GenuineIntel" 686-class) 2.50 GHz
cpu0: 
FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH, 



DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,SBF,CNXT-ID,xTPR
real mem  = 786919424 (750MB)
avail mem = 764088320 (728MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 01/29/04, BIOS32 rev. 0 @ 0xfd4a0, 
SMBIOS 
  rev. 2.31 
@ 0xd8010 (40 entries)

bios0: vendor Phoenix Technologies LTD version "V1.15" date 01/29/04
bios0: Acer TravelMate 240
acpi0 at bios0: rev 0
acpi0: sleep states S0 S3 S4 S5
acpi0: tables DSDT FACP BOOT
acpi0: wakeup devices LID_(S3) LANC(S5) MODM(S4)
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus 2 (PCIB)
acpiec0 at acpi0
acpicpu0 at acpi0: C2, C1
acpitz0 at acpi0: critical temperature 85 degC
acpitz1 at acpi0: critical temperature 80 degC
acpibat0 at acpi0: BAT0 model "Bat 8Cell" serial 236 type Lion oem "Acer"
acpiac0 at acpi0: AC unit online
acpibtn0 at acpi0: LID_
acpibtn1 at acpi0: SLP2
acpivideo0 at acpi0: VGA_
acpivout0 at acpivideo0: CRT_
acpivout1 at acpivideo0: LCD_
acpivout2 at acpivideo0: TVO_
bios0: MP signature mismatch (504d4350 vs 0)
bios0: ROM list: 0xc/0xc800 0xcc800/0x1000 0xd8000/0x4000! 
0xdc000/0x4000!

cpu0 at mainbus0: (uniprocessor)
pci0 at mainbus0 bus 0: configuration mode 1 (bios)
pchb0 at pci0 dev 0 function 0 "Intel 82855GM Host" rev 0x02
"Intel 82855GM Memory" rev 0x02 at pci0 dev 0 function 1 not configured
"Intel 82855GM Config" rev 0x02 at pci0 dev 0 function 3 not configured
vga1 at pci0 dev 2 function 0 "Intel 82855GM Video" rev 0x02
wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
intagp0 at vga1
agp0 at intagp0: aperture at 0xe800, size 0x800
inteldrm0 at vga1: irq 5
drm0 at inteldrm0
"Intel 82855GM Video" rev 0x02 at pci0 dev 2 function 1 not configured
uhci0 at pci0 dev 29 function 0 "Intel 82801DB USB" rev 0x03: irq 5
uhci1 at pci0 dev 29 function 1 "Intel 82801DB USB" rev 0x03: irq 11
uhci2 at pci0 dev 29 function 2 "Intel 82801DB USB" rev 0x03: irq 3
ehci0 at pci0 dev 29 function 7 "Intel 82801DB USB" rev 0x03: irq 4
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
ppb0 at pci0 dev 30 function 0 "Intel 82801BAM Hub-to-PCI" rev 0x83
pci1 at ppb0 bus 2
cbb0 at pci1 dev 4 function 0 "TI PCI1520 CardBus" rev 0x01: irq 10
cbb1 at pci1 dev 4 function 1 "TI PCI1520 CardBus" rev 0x01: irq 10
rl0 at pci1 dev 10 function 0 "Realtek 8139" rev 0x10: irq 11, address 
00:0a:e4: 
03:87:b4

rlphy0 at rl0 phy 0: RTL internal PHY
cardslot0 at cbb0 slot 0 flags 0
cardbus0 at cardslot0: bus 3 device 0 cacheline 0x10, lattimer 0x40
pcmcia0 at cardslot0
cardslot1 at cbb1 slot 1 flags 0
cardbus1 at cardslot1: bus 4 device 0 cacheline 0x10, lattimer 0x40
pcmcia1 at cardslot1
ichpcib0 at pci0 dev 31 function 0 "Intel 82801DBM LPC" rev 0x03
pciide0 at pci0 dev 31 function 1 "Intel 82801DBM IDE" rev 0x03: DMA, 
channel 0 


configured to 

Re: Problem with uplcom(4) - hangs

2010-08-29 Thread Denis Fondras

Le 29/08/2010 23:38, Martin PelikC!n a C)crit :


I've seen way too many faulty/misbehaving uplcom's. Have you tried
different piece of hardware?



I haven't. The only other piece of serial port I have is an integrated 
stuff on another computer and that one works great :)




Re: Problem with uplcom(4) - hangs

2010-09-01 Thread Denis Fondras

Hello,


Le 29/08/2010 23:38, Martin PelikC!n a C)crit :


I've seen way too many faulty/misbehaving uplcom's. Have you tried
different piece of hardware?



I justed tested with Prolific 2303 (not X) and I could work for 2 hours 
without disconnection.


So it might be a buggy adapter or a buggy 2303X driver :)

Denis



Re: exFAT & NTFS

2024-07-28 Thread Denis Fondras
Le Sun, Jul 28, 2024 at 09:40:29AM -0400, openbsd_fr...@mail2tor.com a écrit :
> Can OpenBSD write to exFAT and NTFS partitions?
> 

OpenBSD has a ntfs-3g port to manage NTFS partitions.



Re: OpenBSD equivalent to FreeBSD hw.uart.console boot setting

2024-08-16 Thread Denis Fondras
Le Fri, Aug 16, 2024 at 09:02:50AM +, Laura Smith a écrit :
> On Friday, 16 August 2024 at 09:52, Peter N. M. Hansteen  
> wrote:
> 
> > On Fri, Aug 16, 2024 at 08:31:50AM +, Laura Smith wrote:
> > 
> > > Is there an OpenBSD equivalent to the below flag which is set in 
> > > /boot/loader.conf.local on FreeBSD ?
> > > 
> > > hw.uart.console="mm:0xfedc9000,rs:2"
> > 
> > 
> > In order to get useful responses it is always a good idea to give some 
> > context on
> > what it is you are trying to do.
> > 
> 
> I am trying to get console output during boot.
> 
> This is on Deciso hardware, specifically the newer models.
> 

Oh, they changed it again ?



<    1   2