Re: bgpd ROA validation

2018-09-27 Thread Claudio Jeker
On Wed, Sep 26, 2018 at 06:24:36PM +0200, Claudio Jeker wrote: > On Tue, Sep 25, 2018 at 12:23:48PM +0200, Claudio Jeker wrote: > > On Sat, Sep 22, 2018 at 09:48:24PM +, Job Snijders wrote: > > > Hi claudio, > > > > > > Seems we are getting very close. Some suggestions to simplify the > > > ex

Re: bgpd ROA validation

2018-09-27 Thread Claudio Jeker
On Thu, Sep 27, 2018 at 09:39:36AM +0200, Claudio Jeker wrote: > On Wed, Sep 26, 2018 at 06:24:36PM +0200, Claudio Jeker wrote: > > On Tue, Sep 25, 2018 at 12:23:48PM +0200, Claudio Jeker wrote: > > > On Sat, Sep 22, 2018 at 09:48:24PM +, Job Snijders wrote: > > > > Hi claudio, > > > > > > > >

pfctl(8) and securelevel(7)

2018-09-27 Thread Zbyszek Żółkiewski
Hi list, At securelevel(7) set to 2, NAT rules and filter cannot be altered, however as stated in pfctl.conf(5) manual - it is possible to modify tables by adding/deleting entries (https://man.openbsd.org/pf.conf.5#TABLES) and this works fine. Question: why it is not possible to list content of

Re: pfctl(8) and securelevel(7)

2018-09-27 Thread Klemens Nanni
What version are you running? On Thu, Sep 27, 2018 at 02:06:44PM +0200, Zbyszek Żółkiewski wrote: > At securelevel(7) set to 2, NAT rules and filter cannot be altered, however > as stated in pfctl.conf(5) manual - it is possible to modify tables by > adding/deleting entries > (https://man.openbs

Re: pfctl(8) and securelevel(7)

2018-09-27 Thread Zbyszek Żółkiewski
Here: > Wiadomość napisana przez Klemens Nanni w dniu 27.09.2018, > o godz. 15:19: > > What version are you running? sorry, forgot mention: 6.3 -stable > > On Thu, Sep 27, 2018 at 02:06:44PM +0200, Zbyszek Żółkiewski wrote: >> At securelevel(7) set to 2, NAT rules and filter cannot be altered

bgpd, withdraws and stuck routes

2018-09-27 Thread Claudio Jeker
Some people noticed that routes get stuck or to be more precise that withdraws are not sent to peers in some cases. Until now bgpd did not really track what was announced and what not (there is no real Adj-RIB-Out) and instead tried to figure out if it should or should not send the withdraw. With t

ftp -w is not dying

2018-09-27 Thread sven falempin
I m not sure how this is possible but here s the data : i used the ENV to push -w 5 in my pkg_add process : # date Thu Sep 27 10:40:28 EDT 2018 # ps auxww | grep pkgfet _pkgfetc 60348 0.0 0.1 1728 5456 ?? INp Wed05PM 0:00.09 /usr/bin/ftp -w 5 -S session -o - https:// myportal.com/tar/6.3/packages/

Re: ftp -w is not dying

2018-09-27 Thread sven falempin
On Thu, Sep 27, 2018 at 10:47 AM sven falempin wrote: > I m not sure how this is possible but here s the data : > > i used the ENV to push -w 5 in my pkg_add process : > # date > Thu Sep 27 10:40:28 EDT 2018 > # ps auxww | grep pkgfet > _pkgfetc 60348 0.0 0.1 1728 5456 ?? INp Wed05PM 0:00.09 /usr

Re: bgpd, withdraws and stuck routes

2018-09-27 Thread Claudio Jeker
On Thu, Sep 27, 2018 at 04:41:22PM +0200, Claudio Jeker wrote: > Some people noticed that routes get stuck or to be more precise that > withdraws are not sent to peers in some cases. Until now bgpd did not > really track what was announced and what not (there is no real > Adj-RIB-Out) and instead t

pfsync: avoid a recursion on PF_LOCK

2018-09-27 Thread Alexandr Nedvedicky
Hello, patch below is missing piece to stuff, which I commit on n2k18 [1]. Fairly quickly people, who have PF deployed with pfsync (and are willing to experiment), discovered a panic on PF_LOCK recursion. The recursion is identified by stack as follows: login: panic: rw_enter: pf_lock locking

nsd 4.1.25

2018-09-27 Thread Florian Obser
unexciting update to 4.1.25, running in production in front of a powerdns signer without issues. OK? diff --git config.h.in config.h.in index eded09dd6b3..4d47f603062 100644 --- config.h.in +++ config.h.in @@ -1,5 +1,8 @@ /* config.h.in. Generated from configure.ac by autoheader. */ +/* apply

vmd.c copy-pasto

2018-09-27 Thread Greg Steuck
diff --git a/usr.sbin/vmd/vmd.c b/usr.sbin/vmd/vmd.c index 25d19dc7a7f..2694c3111ac 100644 --- a/usr.sbin/vmd/vmd.c +++ b/usr.sbin/vmd/vmd.c @@ -1861,7 +1861,7 @@ user_checklimit(struct vmd_user *usr, struct vm_create_params *vcp) limit = "cpu "; goto fail; }

Re: pfctl(8) and securelevel(7)

2018-09-27 Thread Klemens Nanni
On Thu, Sep 27, 2018 at 03:35:30PM +0200, Zbyszek Żółkiewski wrote: > sorry, forgot mention: 6.3 -stable Same on -CURRENT and probably older releases as well. > to reproduce: > - at securelevel=1 > - load pf.conf - file whitelist is populated with IP addresses > - try to list table: pfctl -t white

Re: ftp -w is not dying

2018-09-27 Thread sven falempin
On Thu, Sep 27, 2018 at 11:59 AM sven falempin wrote: > > > On Thu, Sep 27, 2018 at 10:47 AM sven falempin > wrote: > >> I m not sure how this is possible but here s the data : >> >> i used the ENV to push -w 5 in my pkg_add process : >> # date >> Thu Sep 27 10:40:28 EDT 2018 >> # ps auxww | gre

Re: pfsync: avoid a recursion on PF_LOCK

2018-09-27 Thread Alexandr Nedvedicky
On Thu, Sep 27, 2018 at 11:30:09PM +0200, Hrvoje Popovski wrote: > On 27.9.2018. 18:34, Alexandr Nedvedicky wrote: > > Mentioning parallelism: there is yet another change you need to perform > > in order to get more pf_test() instances running. Currently there > > is only single input task, which p

add vlan and trunk to arm64 RAMDISK

2018-09-27 Thread Carlos Cardenas
Howdy. Attached is a patch to add vlan and trunk to arm64's RAMDISK (parity with amd64). make release'ed and tested, size increase as follows: -rw--- 1 los los12940598 Sep 27 21:01 bsd.rd-patch -rw--- 1 los los12864682 Sep 27 05:41 bsd.rd-snap

Re: add vlan and trunk to arm64 RAMDISK

2018-09-27 Thread Theo de Raadt
That is exactly how I like to see this displayed, all the details are there. i find it odd the rd0a didn't change that much in size. Compression is really helping it. ok deraadt > Howdy. > > Attached is a patch to add vlan and trunk to arm64's RAMDISK (parity > with amd64). > > make release'

Re: unveil(2) tcpdump(8)

2018-09-27 Thread Ricardo Mestre
Hi tech@ I've commited this, please test it as much as possible by applying the diff right now or just wait for the next snapshot. Let it run for a long time and let me know of any problems as soon as you get any. For this your ktrace, pcap and coredump files will be VERY important for further an