Re: IPSec heavy traffic slows down all network traffic

2020-07-21 Thread jean-yves boisiaud
ok, i'll try with the bsd.sp kernel. thank you for your help. :-( Le dim. 19 juil. 2020 à 07:41, Chris Cappuccio a écrit : > jean-yves boisiaud [jean-yves.boisi...@alcor-consulting.fr] wrote: > > Last week, I upgraded a couple of firewalls using carp/pfsync and sasyncd > > from 6.0 to 6.7 (ye

monitoring-plugins-2.2p8: check_dhcp broadcast requests not working

2020-07-21 Thread Marcos Madeira | Secure Networks
Hello ports@, I am unable to get broadcast DHCP requests to be generated on openbsd 6.6 and 6.7 using the packaged versions of monitoring-plugins, which are monitoring-plugins-2.2p8 and monitoring-plugins-2.2p9, respectively. I have tested the package on a few different environments and it boils

Re: perl hex possible bug

2020-07-21 Thread Philip Guenther
On Tue, Jul 21, 2020 at 3:12 PM Edgar Pettijohn wrote: > I was playing around with the hex function in perl. So naturally I > started with: > > perldoc -f hex > > Which showed me a few examples namely the following: > > print hex '0xAf'; # prints '175' > print hex 'aF'; # same >

Re: perl hex possible bug

2020-07-21 Thread Andrew Hewus Fresh
I realized after the fact, that looking at some of the different ways you can write numbers in perl. $n = 1234; # decimal integer $n = 0b1110011; # binary integer $n = 01234; # octal integer $n = 0x1234;# hexadecimal integer $n = 12.

Re: perl hex possible bug

2020-07-21 Thread Andrew Hewus Fresh
On Tue, Jul 21, 2020 at 07:10:34PM -0500, Edgar Pettijohn wrote: > I was playing around with the hex function in perl. So naturally I > started with: > > perldoc -f hex > > Which showed me a few examples namely the following: > > print hex '0xAf'; # prints '175' > print hex 'aF'; #

perl hex possible bug

2020-07-21 Thread Edgar Pettijohn
I was playing around with the hex function in perl. So naturally I started with: perldoc -f hex Which showed me a few examples namely the following: print hex '0xAf'; # prints '175' print hex 'aF'; # same $valid_input =~ /\A(?:0?[xX])?(?:_?[0-9a-fA-F])*\z/ However, I g

Re: Shell account service providers

2020-07-21 Thread Andinus
Adrian Grigore @ 2020-07-19 13:33 IST: > https://tilde.institute/ There's also tilde.black, both are part of [tildeverse]. But it doesn't meet the poster's requirements. >> > Minimally, SSH login, 100GB disk space, and build tools I think the admins would be okay with installing build tools if

pf.conf set state-defaults pflow seemingly not exporting traffic

2020-07-21 Thread marfabastewart
pf.conf set state-defaults pflow seemingly not exporting traffic My money is on state-defaults working and I just am doing something wrong, but I can't figure out what it is. The sensor's information: OpenBSD 6.7 (GENERIC.MP) #4: Wed Jul 15 11:16:20 MDT 2020 r...@syspatch-67-amd64.openbsd.org:/us

Re: gdb in uninterruptible wait

2020-07-21 Thread Julian Smith
On Mon, 20 Jul 2020 17:18:19 +0100 Julian Smith wrote: > On Mon, 20 Jul 2020 15:26:11 + > Visa Hankala wrote: > > > On Mon, Jul 20, 2020 at 04:35:12AM +, Visa Hankala wrote: > > > On Sun, Jul 19, 2020 at 09:47:54PM +0100, Julian Smith wrote: > > > > I've been finding egdb and gdb

ksh very slow compared to bash when running ghostscript's ./configure script

2020-07-21 Thread Julian Smith
It looks like ksh runs much slower than bash with current Ghostscript's ./configure script - for me it takes 20m, compared with 45s under bash. This is on OpenBSD 6.7 GENERIC.MP#1 amd64. [This kernel has visa@'s wait4() patch (see recent 'gdb in uninterruptible wait' thread), but the same problem

Re: pf.conf set state-defaults pflow seemingly not exporting traffic

2020-07-21 Thread Daniel Jakots
On Tue, 21 Jul 2020 19:35:17 +0200, Peter Nicolai Mathias Hansteen wrote: > pfctl -vnf pf.conf oh indeed it says pass out log on vlan10 proto tcp all flags S/SA modulate state (if-bound) but I understood why my pflow setup still works: it takes the flow from the internal interfaces :)

Re: pf.conf set state-defaults pflow seemingly not exporting traffic

2020-07-21 Thread Peter Nicolai Mathias Hansteen
> 21. jul. 2020 kl. 19:06 skrev Daniel Jakots : >> Your ‘modulate state’ overrides the default. As you have seen, on >> non-default rules you need to add any options explicitly. > > Are you sure? > I have a working (AFAIK) pflow setup and I also have > pass out log on $ext_if proto { tcp, udp }

Re: pf.conf set state-defaults pflow seemingly not exporting traffic

2020-07-21 Thread Daniel Jakots
On Tue, 21 Jul 2020 18:52:40 +0200, Peter Nicolai Mathias Hansteen wrote: > > 21. jul. 2020 kl. 17:42 skrev marfabastewart > > : > > > > pf.conf set state-defaults pflow seemingly not exporting traffic > > > > My money is on state-defaults working and I just am doing something > > wrong, but I

Re: pf.conf set state-defaults pflow seemingly not exporting traffic

2020-07-21 Thread Peter Nicolai Mathias Hansteen
> 21. jul. 2020 kl. 17:42 skrev marfabastewart : > > pf.conf set state-defaults pflow seemingly not exporting traffic > > My money is on state-defaults working and I just am doing something > wrong, but I can't figure out what it is. > > The sensor's information: > OpenBSD 6.7 (GENERIC.MP) #4:

Re: how to pledge(2) for Yubikey

2020-07-21 Thread Demi M. Obenour
On 2020-07-14 12:58, Stuart Henderson wrote: > Known problem, there's no nice way around it though. The standard model > used on most OS of controlling many simpler USB devices from a low > privileged userland process does not work too well with the approach > in https://cvsweb.openbsd.org/src/etc/

Re: Installation in a Xen guest (pvgrub)

2020-07-21 Thread Pierre-Philipp Braun
Hey, > For boot I can only rely on a bunch of provided Linux kernels or the > pvgrub stuff to boot from the disks. There is no possibility to run HVM / PVHVM guests over there? PVGRUB will only boot PV guests, not even PVH. To run a PVH guest, the only method available today is Direct Kernel

ipcomp does not work with IPv6 trafic

2020-07-21 Thread Антон Касимов
Adding ipcomp to earlier mentioned policy blocks IPv6 packets on the receiving side. tcpdump shows that packet is received on enc0 interface but not forwarded to the endpoint. Adding ipv4 traffic selector allows to send IPv4 packets over ipcomp but not IPv6. ipcomp is enabled on both sides. $ sy

Re: l2ip + ipsec question

2020-07-21 Thread kasak
21.07.2020 11:43, Stuart Henderson пишет: most endpoints cope wigh slightly less terrible crypto, you can try something like ike passive esp transport \ proto udp from my.external.ip to any port 1701 \ main auth "hmac-sha1" enc "aes-256" group modp2048 \ quick auth

Re: iked wrongly processes traffic selectors

2020-07-21 Thread Антон Касимов
Hi Tobias, the patch works for me. Thanks. пн, 20 июл. 2020 г. в 23:51, Tobias Heider : > On Mon, Jul 20, 2020 at 12:03:57PM +0300, Антон Касимов wrote: > > I am using OpenBSD 6.7 > > iked does not respect mixing ports in the source and the destination of > > traffic selectors. > > > > Such poli

Re: l2ip + ipsec question

2020-07-21 Thread Stuart Henderson
On 2020-07-20, kasak wrote: > Hello misc. > Recently, i needed to setup l2tp-ipsec for some ip phones to reach my > network. > > so, the l2tp part is not trouble at all with npppd, but, the ipsec part > is harder to understand. > > after reading ipsec and ipsec.conf man, > > i tryed to add just

Re: non-checksummed UDP packets

2020-07-21 Thread Stuart Henderson
On 2020-07-21, David Gwynne wrote: > > >> On 20 Jul 2020, at 05:30, Stuart Henderson wrote: >> >> On 2020-07-19, obs...@loopw.com wrote: >>> Is this normal? >>> >>> Checksum is OPTIONAL in UDP, not required. This is covered in RFC 768. >> >> For IPv4, anyway. It's required for v6. >