tag:blogger.com,1999:blog-128484032024-03-05T08:45:44.103+01:00Olivier's Blogc'est un simple blog... d'une simple personne.Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.comBlogger50125tag:blogger.com,1999:blog-12848403.post-89182820617493823782019-02-22T09:54:00.003+01:002019-02-22T09:54:32.607+01:00PXE booting of a FreeBSD disk image<h2>
Introduction</h2>
I had to set up a regression and network performance lab. This lab will be managed by a Jenkins, but the first step is to understand how to boot a FreeBSD disk by PXE. This article explains a simple way of doing it.<br />
For information, all these steps were done using 2 <a href="https://pcengines.ch/apu2.htm">PC Engines APU2</a> (upgraded with <a href="https://pcengines.ch/file/apu2_v4.0.7.rom.zip">latest BIOS</a> for <a href="http://ipxe.org/">iPXE</a> support), so it's a headless (serial port only, this can be IPMI SoL with different hardware) .<br />
<br />
<h2>
The big picture</h2>
<div>
Before explaining all steps and command line, here is the full big picture of the final process (<a href="https://people.freebsd.org/~olivier/pictures/PXE_and_FreeBSD_MFS.svg">more readable SVG version of this file</a>):</div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3qvVC4EwlIzxQtdqGkZwo-vkgKWoYvm3Lxqnu2k59w38XcLusNvKuzbz2ik7c8s8zwAAejAZhSdzupEeYaVVbRsBj20Re6HVvFQmm8bRodJxIheLxxdNarQqiudJzSWG3qTujkg/s1600/PXE+and+FreeBSD+mfs+image.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="947" data-original-width="1393" height="434" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3qvVC4EwlIzxQtdqGkZwo-vkgKWoYvm3Lxqnu2k59w38XcLusNvKuzbz2ik7c8s8zwAAejAZhSdzupEeYaVVbRsBj20Re6HVvFQmm8bRodJxIheLxxdNarQqiudJzSWG3qTujkg/s640/PXE+and+FreeBSD+mfs+image.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">FreeBSD PXE boot steps</td></tr>
</tbody></table>
<br />
And the tasks we will do:<br />
<br />
<ol>
<li>Creating image-miniroot and image.txz, with the help of poudriere</li>
<li>Setting up a DHCP (dnsmasq), TFTP (FreeBSD) and FTP (FreeBSD) server</li>
<li>Populating the TFTP and FTP server</li>
<li>Configuring the DHCP server</li>
<li>Test the result</li>
</ol>
<div>
Notice in my lab, the server is configured with IP 1.1.1.254 and the DHCP range will be between .1 and .10.</div>
<h2>
Instructions</h2>
<h3>
Creating images</h3>
<div>
To create images we had to do:</div>
<div>
<ol>
<li>Install poudriere</li>
<li>Configure it (I don't have ZFS on my small APU2, so disable it)</li>
<li>Create a poudriere jail of a FreeBSD 12.0-RELEASE</li>
<li>Configure custom configuration file we want on the image</li>
<li>Generate the poudriere images (main and miniroot)</li>
</ol>
<div>
These commands will do it:</div>
</div>
<div>
<br /></div>
<br />
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">pkg install -y poudriere-devel</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">echo "NO_ZFS=yes" >> /usr/local/etc/poudriere.conf</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">echo "FREEBSD_HOST=https://download.FreeBSD.org" >> /usr/local/etc/poudriere.conf</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">poudriere jail -c -j 120amd64 -v 12.0-RELEASE -K GENERIC</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mkdir -p ~/miniroot-overlay/boot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">echo 'console="comconsole"' >> ~/miniroot-overlay/boot/loader.conf</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mkdir -p ~/miniroot-overlay/etc</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">cat >~/miniroot-overlay/etc/rc <<EOF</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">#!/bin/sh</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">PATH=/bin:/sbin:/usr/bin</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># Reusing data from the pxeboot loader to configure network</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">ifconfig \$(kenv boot.netif.name) inet \$(kenv boot.netif.ip) netmask \$(kenv boot.netif.netmask) up</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">route add default \$(kenv boot.netif.gateway)</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># Need to remount in read-write: Can't use uzip compressed image (read-only)</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mount -uw /</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mkdir /newroot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># An empty 12.0 base installation (no ports) consumme 1.2G</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">md=\$(mdconfig -s 2g)</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">newfs \$md</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mount /dev/\$md /newroot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">fetch -o - ftp://\$(kenv boot.tftproot.server)/image.txz | bsdtar -xpf - -C /newroot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">umount /newroot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">kenv vfs.root.mountfrom=ufs:/dev/\$md</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># reboot -r needs tmpfs.ko loaded</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">reboot -r</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">EOF</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mkdir -p ~/image-overlay/boot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">echo 'console="comconsole"' >> ~/image-overlay/boot/loader.conf</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mkdir -p ~/image-overlay/etc</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">cat >~/image-overlay/etc/rc.conf <<EOF</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># IP configuration and routes will be preserved from the miniroot state</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># But configure it as DHCP in case of an 'service netif restart'</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">ifconfig_igb0="DHCP"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># You need to install your SSH keys</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">sshd_enable="YES"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># Avoid "My unqualified host name (poudriere-image) unknown; sleeping for retry"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">sendmail_enable="NONE"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># Hostname will be added by poudriere image here:</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">EOF</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">poudriere image -j 120amd64 -t tar -n image -m ~/miniroot-overlay -c ~/image-overlay/</span></div>
<div>
<br /></div>
<div>
The last 2 lines from poudriere should be:</div>
<div>
<br /></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">Image `/usr/local/poudriere/data/images//image-miniroot' complete</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">Image available at: /usr/local/poudriere/data/images/image.txz</span></div>
</div>
<div>
<br /></div>
<div>
We will move these files later.</div>
<div>
<br /></div>
<h3>
TFTP server</h3>
<div>
Now let's:</div>
<div>
<ol>
<li>Enable TFTPD and inetd</li>
<li>Populate the directory with pxeboot, lua scripts, kernel, custom boot/loader.conf and unziped image-miniroot</li>
</ol>
<div>
These commands will do it:</div>
</div>
<div>
<br /></div>
<div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">sed -i "" -e 's/^#tftp/tftp/g' /etc/inetd.conf</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">sysrc inetd_enable="YES"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mkdir -p /tftpboot/boot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mkdir -p /tftpboot/kernel</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">cp /usr/local/poudriere/jails/120amd64/boot/pxeboot /tftpboot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">cp -r /usr/local/poudriere/jails/120amd64/boot/lua /tftpboot/boot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">cp -r /usr/local/poudriere/jails/120amd64/boot/defaults /tftpboot/boot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">cp /usr/local/poudriere/jails/120amd64/kernel/kernel /tftpboot/kernel</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">cp /usr/local/poudriere/jails/120amd64/kernel/tmpfs.ko /tftpboot/kernel</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">cat > /tftpboot/boot/loader.conf <<EOF</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># Disable menu</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">autoboot_delay="-1"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># Enable serial console only</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">console="comconsole"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">comconsole_speed="115200"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># tmpfs is needed by reboot -r</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">tmpfs_load="YES"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;"># Download an md_image and use it as root fs</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">vfs.root.mountfrom="ufs:/dev/md0"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mfs_load="YES"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mfs_type="md_image"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mfs_name="/image-miniroot"</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">EOF</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">mv /usr/local/poudriere/data/images/image-miniroot.gz /tftpboot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">cd /tftpboot</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">gunzip image-miniroot.gz</span></div>
<div>
<span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">service inetd start</span></div>
</div>
<div>
<br /></div>
<div>
Check your TFTP server is correctly able to serve our files:</div>
<br /><span style="font-family: Courier New, Courier, monospace; font-size: x-small;">cd</span><div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">tftp localhost <br />tftp> get pxeboot <br /><i>Received 436224 bytes during 0.1 seconds in 853 blocks</i> <br />tftp> quit</span><div>
<br /></div>
<div>
<h3>
FTP server</h3>
</div>
<div>
Now let's:</div>
<div>
<ol>
<li>Enable anonymous FTP server (by creating 'ftp' account)</li>
<li>Move image.txz into /home/ftp</li>
</ol>
<div>
These commands will do it:</div>
</div>
<div>
<br /></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">sysrc ftpd_enable=YES</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">echo "ftp::::::FTP anonymous::/usr/sbin/nologin" | adduser -f -</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">mv /usr/local/poudriere/data/images/image.txz /home/ftp/</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">service ftpd start</span></div>
</div>
<div>
<br /></div>
<div>
Check your FTP server is correctly able to serve this file:</div>
<div>
<br /><span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><b>ftp ftp://anonymous:nobody@localhost</b> <br />Trying ::1:21 ... <br />Connected to localhost. <br />220 apu2.cochard.me FTP server (Version 6.00LS) ready. <br />331 Guest login ok, send your email address as password. <br />230 Guest login ok, access restrictions apply. <br />Remote system type is UNIX. <br />Using binary mode to transfer files. <br />200 Type set to I. <br />ftp> <b>get image.txz</b><br />local: image.txz remote: image.txz<br />229 Entering Extended Passive Mode (|||61982|)<br />150 Opening BINARY mode data connection for 'image.txz' (257213124 bytes).<br />100% |***********************************************************************************************| 245 MiB 26.63 MiB/s 00:00 ETA<br />226 Transfer complete.<br /><i>257213124 bytes received in 00:09 (26.63 MiB/s)</i><br />ftp> <b>quit</b><br />221 Goodbye.</span><br /><br /><h3>
DHCP server</h3>
</div>
<div>
The last configuration step:</div>
<div>
<ol>
<li>Install dnsmasq</li>
<li>Configure (with the trick of generating a different answer if the request came from iPXE or from FreeBSD's pxeboot loader) and enable it</li>
</ol>
</div>
<div>
These commands will do it:</div>
<div>
<br /></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">pkg install -y dnsmasq</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">cat >/usr/local/etc/dnsmasq.conf <<EOF</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"># Range of IP to distribute (mandatory to enable DHCP server)</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">dhcp-range=1.1.1.1,1.1.1.10,3h</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"># TFTP server name</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">dhcp-option=66,"1.1.1.254"</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"># Filename to download</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">dhcp-boot=pxeboot</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"># Magic trick to detect FreeBSD's pxeboot and avoid iPXE conflict</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"># Add tag 'fbsd' to clients using userclass 'FreeBSD':</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">dhcp-userclass=set:fbsd,FreeBSD</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"># Reply with root-path only to 'fbsd' tagged clients:</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">dhcp-option=tag:fbsd,option:root-path,tftp://1.1.1.254</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">EOF</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">sysrc dnsmasq_enable=YES</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">service dnsmasq start</span></div>
</div>
<div>
<br /></div>
<h2>
Final test</h2>
<div>
<br /></div>
<div>
Now time to power up a PXE client (still a PC Engine APU2):</div>
<br /><span style="color: #666666; font-family: Courier New, Courier, monospace; font-size: x-small;">Booting from ROM... <br />iPXE (PCI 00:00.0) starting execution...ok <br />iPXE initialising devices...ok <br /><br />iPXE 1.0.0+ (f8e167) -- Open Source Network Boot Firmware -- http://ipxe.org <br />Features: DNS HTTP iSCSI TFTP AoE ELF MBOOT PXE bzImage Menu PXEXT <br /><br /><br />---------------- iPXE boot menu ---------------- <br /><br />ipxe shell <br />autoboot<br /><br />net0: 00:0d:b9:45:7a:d4 using i210-2 on PCI01:00.0 (open)<br />[Link:up, TX:0 TXE:0 RX:0 RXE:0]<br />Configuring (net0 00:0d:b9:45:7a:d4)...... ok<br /><span style="background-color: yellow;">net0: 1.1.1.1/255.255.255.0 gw 1.1.1.254</span><br />Next server: 1.1.1.254<br /><span style="background-color: yellow;">Filename: pxeboot<br />tftp://1.1.1.254/pxeboot... ok</span><br />pxeboot : 436224 bytes [PXE-NBP]<br />PXE Loader 1.00<br /><br />Building the boot loader arguments<br />Relocating the loader and the BTX<br /><br />Starting the BTX loader<br />(...)<br /><br />\Loading /boot/loader.conf.local<br />Loading kernel...<br />/boot/kernel/kernel text=0x1678aa8 data=0x1cd288+0x768b40 syms=[0x8+0x174cd8+0x8+0x19224a]<br />Loading configured modules...<br /><span style="background-color: yellow;">/image-miniroot size=0xb00000<br />/boot/kernel/tmpfs.ko size 0x10c70 at 0x313d000</span><br />can't find '/boot/entropy'<br />---<<BOOT>>---<br />Copyright (c) 1992-2018 The FreeBSD Project.<br />Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994<br />The Regents of the University of California. All rights reserved.<br />(...)<br />nfs_diskless: no server<br />Trying to mount root from ufs:/dev/md0 []...<br />2019-02-22T09:44arc4random: no preloaded entropy cache<br />:02.524970+00:00 init 26 - - login_getclass: unknown class 'daemon'<br />arc4random: no preloaded entropy cache<br /><span style="background-color: yellow;">add net default: gateway 1.1.1.254</span><br />fstab: /etc/fstab:0: No such file or directory<br />uhub1: 4 ports with 4 removable, self powered<br />random: unblocking device.<br /><span style="background-color: yellow;">/dev/md1: 2048.0MB (4194304 sectors) block size 32768, fragment size 4096<br />using 4 cylinder groups of 512.03MB, 16385 blks, 65664 inodes.<br />super-block backups (for fsck_ffs -b #) at:<br />192, 1048832, 2097472, 3146112<br />newfs: Cannot retrieve operator gid, using gid 0.</span><br />uhub0: 2 ports with 2 removable, self powered<br /><br />ugen1.2: <vendor 0x0438 product 0x7900> at usbus1<br />igb0: link state changed to UP<br />- 245 MB 2074 kBps 02m01s<br /><span style="background-color: yellow;">vfs.root.mountfrom="ufs:/dev/md1"<br />Trying to mount root from ufs:/dev/md1 []...</span><br />/etc/rc: WARNING: hostid: unable to figure out a UUID from DMI data, generating a new one<br />Setting hostuuid: b1161b13-3686-11e9-acda-000db9457ad4.<br />Setting hostid: 0x123814de.<br /><br />eval: cannot open /etc/fstab: No such file or directory<br /><br />(...)<br /><br />Fri Feb 22 09:46<br />FreeBSD/amd64 (poudriere-image) (ttyu0)<br /><br />login: root<br />Feb 22 09:46:53 poudriere-image login[1023]: ROOT LOGIN (root) ON ttyu0<br />FreeBSD 12.0-RELEASE-p3 GENERIC<br /><br />Welcome to FreeBSD!<br />(...)<br /><br />Edit /etc/motd to change this login announcement.<br />root@poudriere-image:~ # df -h<br />Filesystem Size Used Avail Capacity Mounted on<br />/dev/md1 1.9G 1.2G 611M 67% /<br />devfs 1.0K 1.0K 0B 100% /dev<br />root@poudriere-image:~ #</span></div>
<style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #536870; background-color: #fcf4dc} </style><style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #536870; background-color: #fcf4dc} </style><style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #536870; background-color: #fcf4dc} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #536870; background-color: #fcf4dc; min-height: 19.0px} </style><style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #536870; background-color: #fcf4dc} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #eae3cb; background-color: #0a2933} span.s1 {color: #536870} </style><style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #eae3cb; background-color: #0a2933} span.s1 {color: #536870} </style><style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #eae3cb; background-color: #0a2933} </style><style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #eae3cb; background-color: #0a2933} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #536870; background-color: #fcf4dc; min-height: 19.0px} </style><style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #eae3cb; background-color: #0a2933} </style><style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 14.0px Monaco; color: #eae3cb; background-color: #0a2933} </style>Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-70341877163059038762018-01-07T07:35:00.002+01:002018-01-07T07:35:57.055+01:00Replacing a Raspberry Pi by an Odroid C2 for HEVC supportMy mediacenter was, since some years now, a <a href="https://www.raspberrypi.org/">Raspberry Pi</a> with <a href="http://openelec.tv/">OpenElec</a>.<br />
But more and more of available contents are using HEVC (H.265) video codecs, then not supported on this platform. I was looking for a same size factor replacement with HEVC support, then I've started to test the <a href="https://www.pine64.org/">Pine64</a> but was very disappointed by the poor support of its graphic drivers under Linux (only a very slow Android image was able to decode HEVC on this board).<br />
Hopefully I've found a good candidate into <a href="https://libreelec.tv/">LibreElec</a> (an OpenElec fork)'s list of supported hardware: <a href="http://www.hardkernel.com/main/products/prdt_info.php?g_code=G145457216438">HardKernel Odroid C2</a>.<br />
<br />
The migration step I've followed was this one:<br />
<ol>
<li>Upgrading my old OpenElec (7.0.1) to the latest one (8.0.4) on the Raspberry Pi</li>
<li>Switching (upgrading) OpenElec to LibreElec on the Raspberry Pi</li>
<li>Backuping LibreElec configuration into an USB key</li>
<li>Installing LibreElec on the Odroid C2</li>
<li>Restoring LibreElec configurations from the USB key: all my network shares, database, settings were restored. </li>
</ol>
And now I can enjoy to play HEVC movies downloaded from YGGTorrent.<br />
<br />Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com1tag:blogger.com,1999:blog-12848403.post-73325847357163743212016-05-14T14:57:00.002+02:002016-05-14T14:57:44.459+02:00Playing with FreeBSD packet filter state table limits<h3>
Objective</h3>
I've got a very specific needs: Selecting a firewalls to be installed between large number of monitoring servers and a big network (about one million of equipment).<br />
This mean lot's of short SNMP (UDP based) flows: I need a firewall able to manage 4 millions state table entries but don't need important throughput (few gigabit per second is enough).<br />
Short look on the datasheet marked:<br />
<ul>
<li>Juniper SRX 3600: 6 millions concurrent sessions maximum and up to 65Gbps (marketing bullshit: Giving a value in Gbps is useless)</li>
<li>Cisco ASA 5585-X: 4 millions concurrent sessions maximum and up to 15Gbps (same marketing bullshit unit as Juniper, marketing department seems stronger than engineering)</li>
</ul>
I'm not looking for such big throughput, then how about performance vs maximum number of firewall states on a simple x86 servers ?<br />
<br />
I will do my benches on a small <a href="http://store.netgate.com/ADI/RCC-VE-4860.aspx">Netgate RCC-VE 4860</a> (4 cores ATOM C2558, 8GB RAM) under FreeBSD 10.3: I'm rebooting it between each bench, and do a lot's of bench, then I need an equipment with a short POST BIOS time.<br />
My performance unit will be the packet-per-second with smallest-size packet (64 bytes Ethernet frame size) generated at maximum line-rate (1.48Mpps if Gigabit interface, 14.8Mpps if 10 Gigabit interface).<br />
<h3>
Performance with default pf parameters</h3>
By default pf uses these maximum number of state values:<br />
<span style="font-family: "courier new" , "courier" , monospace;">[root@DUT]~# pfctl -sm</span><br />
<span style="font-family: "courier new" , "courier" , monospace;">states hard limit 10000</span><br />
<span style="font-family: "courier new" , "courier" , monospace;">src-nodes hard limit 10000</span><br />
<span style="font-family: "courier new" , "courier" , monospace;">frags hard limit 5000</span><br />
<span style="font-family: "courier new" , "courier" , monospace;">table-entries hard limit 200000</span><br />
<span style="font-family: "courier new" , "courier" , monospace;">[root@DUT]~# sysctl net.pf</span><br />
<span style="font-family: "courier new" , "courier" , monospace;">net.pf.source_nodes_hashsize: 8192</span><br />
<span style="font-family: 'courier new', courier, monospace;">net.pf.states_hashsize: 32768</span><span style="font-family: "courier new" , "courier" , monospace;"></span><br />
<div>
<br /></div>
This mean it manages 10K session maximum with a size of pf states hashsize of 32768 (no idea of the unit).<br />
<br />
A very simple pf.conf will be used:<br />
<span style="font-family: Courier New, Courier, monospace;">[root@DUT]~# cat /etc/pf.conf</span><br />
<span style="font-family: Courier New, Courier, monospace;">set skip on lo0</span><br />
<span style="font-family: Courier New, Courier, monospace;">pass</span><br />
<br />
I will start by benching pf performance impact regarding number of states: between 128 to 9800.<br />
For one unidirectional UDP flow pf will create 2 session entries (one for each direction).<br />
As example, with a a packet generator like netmap's pkg-gen, we can ask for generating a range of 70 sources IP addresses and 70 destinations addresses: This will give total of 70*70=4900 unidirectional UDP flows (for 9800 pf states).<br />
<br />
From theory to practice with pkt-gen:<br />
<span style="font-family: 'courier new', courier, monospace;">pkt-gen -i ncxl0 -f tx -l 60 -d 198.19.10.1:2000-198.19.10.70 -D 00:07:43:2e:e5:90 -s 198.18.10.1:2000-198.18.10.70 -w 4</span><br />
<br />
And during this load, we check number of current states:<br />
<br />
<span style="font-family: "courier new" , "courier" , monospace;">[root@DUT]~# pfctl -si</span><br />
<span style="font-family: "courier new" , "courier" , monospace;">Status: Enabled for 0 days 00:00:19 Debug: Urgent</span><br />
<span style="font-family: "courier new" , "courier" , monospace;"><br /></span><span style="font-family: "courier new" , "courier" , monospace;">State Table Total Rate</span><br />
<span style="font-family: "courier new" , "courier" , monospace;"> current entries 9800</span><br />
<span style="font-family: "courier new" , "courier" , monospace;"> searches 13777196 725115.6/s</span><br />
<span style="font-family: "courier new" , "courier" , monospace;"> inserts 9800 515.8/s</span><br />
<span style="font-family: "courier new" , "courier" , monospace;"> removals 0 0.0/s</span><br />
<br />
Great: theory match practice, now I can start to generate multiple pktgen configuration (128, 512, 2048, 9800 states) <a href="https://github.com/ocochard/netbenches">on my bench script </a>and run a first session:<br />
<br />
<span style="font-family: Courier New, Courier, monospace;">olivier@manager:~/netbenches/Atom_C2558_4Cores-Intel_i350 % ~/netbenches/scripts/bench-lab.sh -f bench-lab-2nodes.config -n 10 -p ../pktgen.configs/FW-states-10k/ -d pf-sessions/results/fbsd10.3/</span><br />
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;">BSDRP automatized upgrade/configuration-sets/benchs script</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"><br /></span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">This script will start 40 bench tests using:</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> - Multiples images to test: no</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> - Multiples configuration-sets to test: no</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> - Multiples pkt-gen configuration to test: yes</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> - Number of iteration for each set: 10</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> - Results dir: pf-sessions/results/fbsd10.3/</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"><br /></span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Do you want to continue ? (y/n): y</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Testing ICMP connectivity to each devices:</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> 192.168.1.3...OK</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> 192.168.1.3...OK</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> 192.168.1.9...OK</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Testing SSH connectivity with key to each devices:</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> 192.168.1.3...OK</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> 192.168.1.3...OK</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> 192.168.1.9...OK</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Starting the benchs</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Start configuration set: pf-statefull</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Uploading cfg pf-session/config//pf-statefull</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Rebooting DUT and waiting device return online...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Start pkt-gen set: ../pktgen.configs/FW-states-10k//128</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Start bench serie bench.pf-statefull.128.1</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Waiting for end of bench 1/40...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Rebooting DUT and waiting device return online...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Start bench serie bench.pf-statefull.128.2</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Waiting for end of bench 2/40...done</span></div>
</div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Rebooting DUT and waiting device return online...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Start bench serie bench.pf-statefull.128.3</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Waiting for end of bench 3/40...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Rebooting DUT and waiting device return online...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Start bench serie bench.pf-statefull.128.4</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Waiting for end of bench 4/40...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Rebooting DUT and waiting device return online...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Start bench serie bench.pf-statefull.128.5</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Waiting for end of bench 5/40...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Rebooting DUT and waiting device return online...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Start bench serie bench.pf-statefull.128.6</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Waiting for end of bench 6/40...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Rebooting DUT and waiting device return online...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Start bench serie bench.pf-statefull.128.7</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Waiting for end of bench 7/40...done</span></div>
</div>
<div>
<span style="font-family: Courier New, Courier, monospace;">(etc.)</span></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Waiting for end of bench 40/40...done</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">All bench tests were done, results in results/fbsd10.3/</span></div>
</div>
<div>
<br /></div>
<div>
Once done (3 hours after) we ask to generate a gnuplot.data file:</div>
<div>
<br /></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;">olivier@manager:% ~/netbenches/scripts/bench-lab-ministat.sh Atom_C2558_4Cores-Intel_i350/pf-session/results/fbsd10.3/</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Ministating results...</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Done</span></div>
</div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;">olivier@lame4: % cat Atom_C2558_4Cores-Intel_i350/pf-session/results/fbsd10.3/gnuplot.data</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">#index median minimum maximum</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">128 413891.5 409959 418019</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">512 411258 406566 413515</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">2048 392497.5 388039 401090</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">9800 372441.5 369681.5 377640</span></div>
</div>
<div>
<br /></div>
<div>
We obtains this result:</div>
<div>
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgj3ZxN4XUmptg8Thpm8zBUQqcYpPNtaolOjI5cNd4yZzwLWV1GeWYRsk2fOo4sEhrZXfN-HwCxp-qGP_rmJneclona2Q0hyphenhyphen4cjtY_bj034ryvAtPu3z6rZIV27-YBG3_Hjbfr0eA/s1600/graph.png" imageanchor="1"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgj3ZxN4XUmptg8Thpm8zBUQqcYpPNtaolOjI5cNd4yZzwLWV1GeWYRsk2fOo4sEhrZXfN-HwCxp-qGP_rmJneclona2Q0hyphenhyphen4cjtY_bj034ryvAtPu3z6rZIV27-YBG3_Hjbfr0eA/s640/graph.png" width="640" /></a></div>
<div>
<br /></div>
<div>
<br /></div>
<div>
We notice a little performance impact when we reach the default 10K state table: From 413Kpps with 128 states in-used, it lower to 372Kpps.<br />
Can we prevent this by tuning the pf.state_hashsize value ?</div>
<br />
<h3>
Tuning pf.state_hashsize (for default 10K pf max states)</h3>
This value configure the table size used to store state hash and <a href="https://www.freebsd.org/cgi/man.cgi?query=pf&apropos=0&sektion=0&manpath=FreeBSD+10.3-RELEASE+and+Ports&arch=default&format=html">this value should be a power of 2</a>.<br />
I didn't found how to check the efficient usage of this table, but I've found the relationship of this table size and the RAM consumed.<br />
First test: On a system with unloaded pf.ko, configure a big states_hashsize:<br />
<span style="font-family: Courier New, Courier, monospace;">echo 'net.pf.states_hashsize="8388608"' >> /boot/loader.conf</span><br />
<br />
And start pf, then check the RAM reserved by pf_hash:<br />
<span style="font-family: Courier New, Courier, monospace;">[root@DUT]~# service pf onestart</span><br />
<br />
<span style="font-family: Courier New, Courier, monospace;">Enabling pf.</span><br />
<span style="font-family: 'Courier New', Courier, monospace;">[root@DUT]~# vmstat -m | grep pf_hash</span><br />
<span style="font-family: 'Courier New', Courier, monospace;"> pf_hash 3 655680K - 3</span><br />
<div>
<br /></div>
pf_hash consume 655680KiB of RAM: It's about 80 times the state_hashsize.<br />
<br />
We will try again with <a href="https://en.wikipedia.org/wiki/Power_of_two#The_first_96_powers_of_two">the next power-of-2 value</a>: 16777216.<br />
Theoretically, the RAM consumed with this value should be:<br />
16777216 * 80 = 1342177280 (about 1,310,720KiB or 1.25GiB RAM).<br />
<br />
From theory to practice, reboot the server and:<br />
<span style="font-family: Courier New, Courier, monospace;">echo 'net.pf.states_hashsize="16777216"' >> /boot/loader.conf</span><br />
<br />
<span style="font-family: Courier New, Courier, monospace;">[root@DUT]~# service pf onestart</span><br />
<span style="font-family: Courier New, Courier, monospace;"></span><br />
<span style="font-family: Courier New, Courier, monospace;">Enabling pf.</span><br />
<span style="font-family: Courier New, Courier, monospace;">[root@DUT]~# vmstat -m | grep pf_hash</span><br />
<span style="font-family: Courier New, Courier, monospace;"></span><br />
<span style="font-family: Courier New, Courier, monospace;"> pf_hash 3 1311040K - 3</span><br />
<div>
<br /></div>
<span style="font-family: inherit;">Great: We've got the relationship between pf.states_hashsize and RAM consumed.</span><br />
<span style="font-family: inherit;"><b>But take care</b>: On this 8GB RAM server, the maximum hashsize is 33,554,432 (2.5GB of RAM).</span><br />
<span style="font-family: inherit;">If configured to 67,108,864, this mean using 5GB of RAM on my 8GB server: <a href="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209475">this hang kldoal pf.ko (PR: </a></span><a href="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209475">209475)</a><span style="font-family: inherit;">.</span><br />
<br />
For the next bench, the number of flow will be fixed for generating 9800 pf state entries, but I will try different value of pf.states_hashsize until the maximum allowed on my 8GB RAM server (still with the default max states of 10k):<br />
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiht-LzgVoqD2SyGLk4DGADzsHAvX0APQ3CId5s6yLe9NH4VkO8xxp4V9rHH7-4n5CB33UpamgMxXwk6mk59Ja5z7qwEWkjFSiowjx_PGcK9C-fr3L1PbmVv6nVhcmqi7MCFB8aOA/s1600/graph.png" imageanchor="1"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiht-LzgVoqD2SyGLk4DGADzsHAvX0APQ3CId5s6yLe9NH4VkO8xxp4V9rHH7-4n5CB33UpamgMxXwk6mk59Ja5z7qwEWkjFSiowjx_PGcK9C-fr3L1PbmVv6nVhcmqi7MCFB8aOA/s640/graph.png" width="640" /></a><br />
There is no need to increase pf.states_hashsize with 10k state entries, the default size is enough.<br />
We just have to write down that with a 10K state table full, this equipment is still able to keept 372Kpps.<br />
What about the performance drop if we increase a lot's more the pf state table ?<br />
<h3>
Increasing pf max states to 4 millions</h3>
<div>
Now increasing the number of max states by updating the simple pf configuration file allowing a maximum 4M states :</div>
<span style="font-family: Courier New, Courier, monospace;"><br /></span>
<span style="font-family: Courier New, Courier, monospace;">root@DUT:~ # cat /etc/pf.conf</span><br />
<span style="font-family: Courier New, Courier, monospace;">set limit { states 4000000 }</span><br />
<span style="font-family: Courier New, Courier, monospace;">set skip on lo0</span><br />
<span style="font-family: Courier New, Courier, monospace;">pass</span><br />
<br />
For filling 4M states, we just need to generate 2 millions of UDP flows in one direction, pf will create 2 entries in its table (one for each direction) using netmap pkt-gen:<br />
<br />
( 5 * 256 + 134 ) source addresses * (5 * 256 + 134 ) destination addresses = 1,996,569 one-direction flows (about 4M pf state).<br />
<br />
From theory to practice with pkt-gen:<br />
<span style="font-family: 'courier new', courier, monospace;">pkt-gen -i ncxl0 -f tx -l 60 -d 198.19.10.0:2000-198.19.15.133 -D 00:07:43:2e:e5:90 -s 198.18.10.1:2000-198.18.15.133 -w 4</span><br />
<br />
And current state entries:<br />
<span style="font-family: Courier New, Courier, monospace;">[root@DUT]~# pfctl -si</span><br />
<span style="font-family: Courier New, Courier, monospace;">Status: Enabled for 0 days 00:01:22 Debug: Urgent</span><br />
<span style="font-family: Courier New, Courier, monospace;"><br /></span>
<span style="font-family: Courier New, Courier, monospace;">State Table Total Rate</span><br />
<span style="font-family: Courier New, Courier, monospace;"> current entries 3998792</span><br />
<span style="font-family: Courier New, Courier, monospace;"> searches 7302196 89051.2/s</span><br />
<span style="font-family: Courier New, Courier, monospace;"> inserts 3998792 48765.8/s</span><br />
<span style="font-family: Courier New, Courier, monospace;"> removals 0 0.0/s</span><br />
<br />
<div>
<br /></div>
It should be logic to increase pf.states_hashsize too after increasing the maximum states: But what value to be set ?<br />
Does the relation ship between this 2 values linear ?<br />
This mean because the increase factor was 400 between the default maximum number of state (10K) and this new value (4M), should the pf.states_hashsize need to be multiplied by 400 too ?<br />
<br />
If the relationship between need to be linear, the best performance will be reacheable at 32768 * 400 = 13,107,200. But because we are using power of 2, this mean we need to reach between 8 or 16M pf.states_hashsize.<br />
<br />
I didn't find answer in the man page neither in code comments, then I will restart the same previous bench regarding different value of pf.states_hashsize, until I reach the maximum value allowed on this 8GB RAM server.<br />
<span style="font-family: Courier New, Courier, monospace;"><br /></span>
<span style="font-family: 'Courier New', Courier, monospace;">#index median minimum maximum</span><br />
<span style="font-family: Courier New, Courier, monospace;">32Ki 100809 99866 101388</span><br />
<span style="font-family: Courier New, Courier, monospace;">65Ki 168147 165946 168726.5</span><br />
<span style="font-family: Courier New, Courier, monospace;">128Ki 230205 222452 231987</span><br />
<span style="font-family: Courier New, Courier, monospace;">256Ki 280163 278519 282029</span><br />
<span style="font-family: Courier New, Courier, monospace;">512Ki 316142 313727 317546</span><br />
<span style="font-family: Courier New, Courier, monospace;">1Mi 339614.5 336799 342808.5</span><br />
<span style="font-family: Courier New, Courier, monospace;">2Mi 353461 349322 355908</span><br />
<span style="font-family: Courier New, Courier, monospace;">4Mi 360044 357546 361448</span><br />
<span style="font-family: Courier New, Courier, monospace;">8Mi 364828 361667 367729</span><br />
<span style="font-family: Courier New, Courier, monospace;">16Mi 366323 363514 368747</span><br />
<span style="font-family: Courier New, Courier, monospace;">32Mi 364977 363073 366800.5</span><br />
<div>
<br /></div>
<div>
And the graphic:</div>
<div>
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8ZGQz52F_-IF-dcIj_F42oVPpDkjS9E0AIv5vQm9LECqWjZZL1hNoSACXiCxxDD1G0SV2e0SfVoU9dcN8TibOGqZzshw6vRmobhmUSa7UuOckzvLmrIbcvKSQL5mQ3gtLJbVJmA/s1600/graph.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8ZGQz52F_-IF-dcIj_F42oVPpDkjS9E0AIv5vQm9LECqWjZZL1hNoSACXiCxxDD1G0SV2e0SfVoU9dcN8TibOGqZzshw6vRmobhmUSa7UuOckzvLmrIbcvKSQL5mQ3gtLJbVJmA/s640/graph.png" width="640" /></a></div>
<br />
<br />
Theory seem confirmed: Best performance are when pf.states_hashsize reach 16M.<br />
<br />
And notice that with 4M pf states in place of 10K, and correctly tuning pf.states_hashsize, there is no big performance drop:<br />
<b>There is only 12% performance penalty between pf 128 pf states and 4 million pf states.</b><br />
<br />
<h3>
Pushing the limit to maximum: 10 millions sates on a 8GB RAM server</h3>
My 8GB RAM system can be configured for 32M of pf.states_hashsize, wich is about 1024 bigger than the default pf.states_hashsize.<br />
Then, can I configure pf for managing 1024 more state than default , this mean (10,000 * 1024) = 10M state entries ?<br />
<br />
Let's try!<br />
<br />
<span style="font-family: Courier New, Courier, monospace;">[root@DUT]~# cat /etc/pf.conf</span><br />
<span style="font-family: Courier New, Courier, monospace;">set limit { states 10000000 }</span><br />
<span style="font-family: Courier New, Courier, monospace;">set skip on lo0</span><br />
<span style="font-family: Courier New, Courier, monospace;">pass</span><br />
<span style="font-family: Courier New, Courier, monospace;"></span><br />
<span style="font-family: 'Courier New', Courier, monospace;">[root@DUT]~# cat /boot/loader.conf</span><br />
<span style="font-family: Courier New, Courier, monospace;">net.pf.states_hashsize="33554432"</span><br />
<span style="font-family: Courier New, Courier, monospace;"><br /></span>
<span style="font-family: inherit;">A rapid check after the reboot:</span><br />
<span style="font-family: inherit;"><br /></span>
<span style="font-family: Courier New, Courier, monospace;">[root@DUT]~# pfctl -sm</span><br />
<span style="font-family: Courier New, Courier, monospace;">states hard limit 10000000</span><br />
<span style="font-family: Courier New, Courier, monospace;">src-nodes hard limit 10000</span><br />
<span style="font-family: Courier New, Courier, monospace;">frags hard limit 5000</span><br />
<span style="font-family: Courier New, Courier, monospace;"></span><br />
<span style="font-family: Courier New, Courier, monospace;">table-entries hard limit 200000</span><br />
<span style="font-family: Courier New, Courier, monospace;">[root@DUT]~# sysctl net.pf.states_hashsize</span><br />
<span style="font-family: Courier New, Courier, monospace;"></span><br />
<span style="font-family: Courier New, Courier, monospace;">net.pf.states_hashsize: 33554432</span><br />
<div>
<br /></div>
<div>
And now a pkt-gen generating 5M unidirectional UDP flows:</div>
<div>
<br /></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">[root@pkt]~# pkt-gen -U -f tx -i igb2 -l 60 -w 4 -d 198.19.10.0:2001-198.19.18.187 -D 00:08:a2:09:33:da -s 198.18.10.0:2001-198.18.18.187</span></div>
<div>
<br /></div>
<div>
And check number of pf states:</div>
<div>
<br /></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;">[root@netgate]~# pfctl -si</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Status: Enabled for 0 days 00:03:52 Debug: Urgent</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"><br /></span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">State Table Total Rate</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> current entries 9999392</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> searches 136730570 589355.9/s</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> inserts 9999392 43100.8/s</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> removals 0 0.0/s</span></div>
</div>
<div>
<br /></div>
<div>
Re-using the bench script for another number-of-states/performance graph, but pushing the maximum limit to 10M:</div>
<div>
<br /></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;">% cat gnuplot.data</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">#index median minimum maximum</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">128 406365 371415 411379</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">1K 368245.5 367299 370606</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">1M 367210 365505 370600</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">2M 367252 365939 369866</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">4M 365722 362921.5 369635.5</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">6M 365899 365213 368887</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">10M 362200 351420 365515</span></div>
</div>
<div>
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyqJrQbYp7xVcfr4wXXWdSO563_7B-o3kGpfvUXQvAM4mRDmudBv_RHpTwZS9txBP_KsXg193UvJmDAyRIkdwu8UQqhjXCDI6-OqM4scRKOI6mV6JhtERcCDy_Om11WJ5aWYQjZg/s1600/graph.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyqJrQbYp7xVcfr4wXXWdSO563_7B-o3kGpfvUXQvAM4mRDmudBv_RHpTwZS9txBP_KsXg193UvJmDAyRIkdwu8UQqhjXCDI6-OqM4scRKOI6mV6JhtERcCDy_Om11WJ5aWYQjZg/s640/graph.png" width="640" /></a></div>
<div>
<br /></div>
<div>
With 10M state, pf performance lower to 362Kpps: Still only 12% lower performance than with only 128 states.</div>
<div>
<br /></div>
<h3>
pfsync impact</h3>
<div>
After testing the behavior with only one firewalll, how about the behavior of pfsync with 10M states table to synchronize with another firewall ?</div>
<div>
During previous benches, the traffic was sent at gigabit line-rate traffic (1.48Mpps) and this heavy load prevent to entering command to this small firewall console. How will it share resources with pfsync ?</div>
<div>
Configuring pfsync (same on another "backup" firewall) on a unused interface (using syncpeer because I don't want to send my switch in the sky with potentially large number of multicast):</div>
<div>
<br /></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;">sysrc pfsync_enable="YES"</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">sysrc pfsync_syncdev="igb5"</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">sysrc pfsync_syncpeer="192.168.1.8"</span></div>
</div>
<div>
<br /></div>
<div>
And we try by generating unidirectionnal 5million UDP flows a line-rate:</div>
<div>
<br /></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">[root@pkt]~#pkt-gen -U -f tx -i igb2 -n 300000000 -l 60 -d 198.19.10.0:2001-198.19.18.187 -D 00:08:a2:09:33:da -s 198.18.10.0:2001-198.18.18.187 -w 4</span></div>
<div>
<br /></div>
<div>
But no pfsync traffic received on backup firewall, the DUT didn't have enough resources (all are spend to drop lot's of received 1.48Mpps rate) for managing correctly pfsync.</div>
<div>
<br /></div>
<div>
We need to lower packet rate to 200Kpps:</div>
<div>
<br /></div>
<div>
<span style="font-family: 'Courier New', Courier, monospace;">[root@pkt]~#</span><span style="font-family: 'Courier New', Courier, monospace;">pkt-gen -U -f tx -i igb2 -n 300000000 -l 60 -d 198.19.10.0:2001-198.19.18.187 -D 00:08:a2:09:33:da -s 198.18.10.0:2001-198.18.18.187 -w 4 -R 20000</span></div>
<div>
<br /></div>
<div>
At this lower rate, the DUT have enough resource for updating pfsync, the backup firewall start to receive see some states:</div>
<div>
<br /></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;">[root@backup]~# pfctl -si</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Status: Enabled for 0 days 00:25:23 Debug: Urgent</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"><br /></span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">State Table Total Rate</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> current entries 1007751</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> searches 99696386 65460.5/s</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> inserts 25494221 16739.5/s</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> removals 24486050 16077.5/s</span></div>
</div>
<div>
<br /></div>
<div>
And pfsync traffic can reach 100Mb/s:</div>
<div>
<br /></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> /0 /1 /2 /3 /4 /5 /6 /7 /8 /9 /10</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Load Average |</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"><br /></span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">Interface Traffic Peak Total</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> pfsync0 in 12.763 MB/s 105.422 MB/s 11.073 GB</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> out 371.891 KB/s 7.476 MB/s 876.564 MB</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"><br /></span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> igb0 in 12.896 MB/s 106.495 MB/s 11.184 GB</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;"> out 375.360 KB/s 7.546 MB/s 885.000 MB</span></div>
</div>
<div>
<br /></div>
<div>
<br /></div>
<h3>
Conclusion</h3>
<br />
<ul>
<li>There need to be a linear relationship between the pf hard-limit of states and the pf.states_hashsize;</li>
<li>RAM needed for pf.states_hashsize = pf.states_hashsize * 80 Byte and pf.states_hashsize should be a power of 2 (from the manual page);</li>
<li>Even small hardware can manage large number of sessions (it's a matter of RAM), but under too lot's of pressure pfsync will suffer.</li>
</ul>
Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-81707002641652353742016-01-15T01:20:00.001+01:002016-01-16T10:54:21.645+01:00Example of a FreeBSD bug hunting session by a simple user<br />
<h2>
Problem description</h2>
<br />
I've meet a problem with one of my FreeBSD-wireless-router, and a FreeBSD network developer (Alexander V. Chernikov, alias melifaro) helps me to identify the culprit kernel function. I've write-down all tips I've learn by this teacher during this session here.<br />
<br />
<h2>
Day 1: Facing a bug</h2>
<br />
You need a bug for starting your day. In my case, after updating the configuration of previously working wireless-router, my setup stop working correctly.<br />
<br />
<h2>
Day 2: Reducing my setup complexity</h2>
<br />
My wireless-router configuration was complex: it involves routing, wireless in hostap mode, ipfw, snort, bridge, openvpn, etc.<br />
The first step was to reproduce my problem:<br />
<br />
<ol>
<li>In the minimum steps (this mean with the simplest configuration)</li>
<li>On the latest FreeBSD -current (because developers works on -current)</li>
</ol>
<br />
Rules for getting help: Your call-for-help message needs to be short, because developers don't have lot's of free time. It's very important that you clearly demonstrate a non-attended behavior and the steps for reproduce it easily.<br />
I had to to it twice: I've post a first call-for-help message with a still too complex configuration:<br />
<a href="https://lists.freebsd.org/pipermail/freebsd-current/2015-December/059045.html">https://lists.freebsd.org/pipermail/freebsd-current/2015-December/059045.html</a><br />
<br />
Then I had to work again for simplify my problem and post a new message few days later:<br />
<a href="https://lists.freebsd.org/pipermail/freebsd-current/2016-January/059250.html">https://lists.freebsd.org/pipermail/freebsd-current/2016-January/059250.html</a><br />
<br />
This second message was a good one: It catch some developer eyes :-)<br />
<br />
A resume of my bug with this setup:<br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">LAN 0 <--> (re0) fbsd router (bridge0 = re1 + wlan0) <--> LAN 1 and Wireless LAN</span><br />
<br />
This FreeBSD (11-head r293631) is configured like that:<br />
<br />
<ul>
<li>One IP address on re0, we will call this LAN 0</li>
<li>One IP address on bridge0 (that includes interfaces re1 and wlan0)</li>
<li>re1 enabled (put in UP state)</li>
<li>wlan0 configured in hostap mode</li>
<li>forwarding enabled</li>
</ul>
<br />
But this setup can forward between wireless clients and hosts on LAN 0 ONLY if interface re1 (that belong to bridge0) is in "connected" status !?!<br />
If the Ethernet NIC is in "not connected" status, the FreeBSD router will consider all clients behind bridge0 "unreacheable"… Even if it can ping all wireless clients!<br />
Here is a tcpdump output from the router dumping a ping generated by a wireless clients (1.1.1.2, connected to wlan0 and forwarded by cbridge0) toward an host on LAN 0 (1.0.0.2):<br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">root@fbsd-router:~ # tcpdump -pni re0</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">listening on re0, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:04.466866 ARP, Request who-has 1.0.0.2 tell 1.0.0.1, length 28</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:04.467052 ARP, Reply 1.0.0.2 is-at 00:08:a2:09:c4:a2, length 46</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:04.467090 IP 1.1.1.2 > 1.0.0.2: ICMP echo request, id 72, seq 1,</span><span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">length 64</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:04.467226 IP 1.0.0.2 > 1.1.1.2: ICMP echo reply, id 72, seq 1, length </span><span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">64</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:04.467300 IP 1.0.0.1 > 1.0.0.2: ICMP host 1.1.1.2 unreachable, length </span><span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">36</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:05.483053 IP 1.1.1.2 > 1.0.0.2: ICMP echo request, id 72, seq 2,</span><span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">length 64</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:05.483259 IP 1.0.0.2 > 1.1.1.2: ICMP echo reply, id 72, seq 2, length </span><span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">64</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:05.483318 IP 1.0.0.1 > 1.0.0.2: ICMP host 1.1.1.2 unreachable, length </span><span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">36</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:06.387304 IP 1.1.1.2 > 1.0.0.2: ICMP echo request, id 72, seq 3,</span><span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">length 64</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:06.387466 IP 1.0.0.2 > 1.1.1.2: ICMP echo reply, id 72, seq 3, length </span><span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">64</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">23:38:06.387514 IP 1.0.0.1 > 1.0.0.2: ICMP host 1.1.1.2 unreachable, length </span><span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">36</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">^C</span><br />
For solving this problem, I just need to plug the Ethernet interface for changing its status to "active".<br />
<h2>
<br />
Checking interface status: a simple user's way</h2>
<br />
The only check I can do was to check the "status" of my interfaces:<br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">root@fbsd-router# ifconfig re0</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> ether 00:0d:b9:3c:ae:24</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> inet 1.0.0.1 netmask 0xffffff00 broadcast 1.0.0.255</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> media: Ethernet autoselect (1000baseT <full-duplex,master>)</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> status: active</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><br />
</span> <span style="font-family: Courier New, Courier, monospace; font-size: x-small;">root@fbsd-router# ifconfig wlan0</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">wlan0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> ether 04:f0:21:17:3b:d7</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> media: IEEE 802.11 Wireless Ethernet autoselect mode 11ng <hostap></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> status: running</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> ssid tutu channel 6 (2437 MHz 11g ht/40+) bssid 04:f0:21:17:3b:d7</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> country US ecm authmode OPEN privacy OFF txpower 27 scanvalid 60</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> protmode CTS ampdulimit 64k ampdudensity 8 shortgi wme burst</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> dtimperiod 1 -dfs</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> groups: wlan</span><br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">root@fbsd-router# ifconfig re1</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">re1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> options=82099<RXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> ether 00:0d:b9:3c:ae:25</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> media: Ethernet autoselect (none)</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> status: no carrier</span><br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">root@fbsd-router# ifconfig bridge0</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> ether 02:6b:c0:de:b8:00</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> inet 1.1.1.1 netmask 0xffffff00 broadcast 1.1.1.255</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> nd6 options=9<PERFORMNUD,IFDISABLED></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> groups: bridge</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> member: re1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> ifmaxaddr 0 port 2 priority 128 path cost 55</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> member: wlan0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> ifmaxaddr 0 port 5 priority 128 path cost 33333</span><br />
<br />
Nothing seems wrong here:<br />
<br />
<ul>
<li>re0 has flag UP and status "active"</li>
<li>wlan0 has flag UP and status "running" (I will suppose it's okay because wireless clients paquets correctly enter this interface and even ping bridge0 IP address)</li>
<li>re1 has flag UP and status "no carrier" (no cable connected)</li>
<li>bridge0 has flag UP but did not display its status (I will suppose it's UP because wireless client can ping it)</li>
</ul>
<br />
<br />
But a developer will never "suppose" the status of these interfaces and will speak in their strange language directly to the kernel for asking the real status.<br />
<h2>
<br />
Checking kernel interface status: a developer's way</h2>
<br />
How FreeBSD kernel manage network interface ? As a simple user, let's read the (huge) "man ifconfig". I didn't found my answer, but the "see also" section mention a "man netintro".<br />
An introduction to "network" should be comprehensive for me.<br />
Inside netintro man page, I've skipped addressing and routing sections for the interfaces section, but nothing here about "interface status". But the "see also" section mention a "man ifnet": Let's try!<br />
Trying to resume this man page:<br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(...)</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> The kernel mechanisms for handling network interfaces reside primarily in</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> the ifnet, if_data, ifaddr, and ifmultiaddr structures in <net/if.h> and</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> <net/if_var.h> and the functions named above and defined in</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> /sys/net/if.c.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(...)</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span>The system keeps a linked list of interfaces using the TAILQ macros</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> defined in queue(3); this list is headed by a struct ifnethead called</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> ifnet. The elements of this list are of type struct ifnet...</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(...)</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> The structure additionally contains generic statistics applicable to a</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> variety of different interface types (except as noted, all members are of</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> type u_long):</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><br />
</span> <span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> ifi_link_state (u_char) The current link state of Ethernet</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> interfaces. See the Interface Link States</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> section for possible values.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(...)</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> Interface Link States</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> The following link states are currently defined:</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><br />
</span> <span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> LINK_STATE_UNKNOWN The link is in an invalid or unknown state.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> LINK_STATE_DOWN The link is down.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> LINK_STATE_UP The link is up.</span><br />
<br />
<br />
Wow, I reach my limits ;-) But here is my understanding:<br />
<br />
<ol>
<li>Each network interface have an index number assigned</li>
<li>once known this index number we can read its state by variable ifi_link_state</li>
</ol>
<br />
<br />
I've got 3 new questions now :-(<br />
<br />
<h3>
How to know the "index" number of my interfaces ?</h3>
<br />
User used to uses "netstat -i" should know the "Link#" displayed:<br />
<br />
<span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">root@fbsd-router:~ # netstat -iWW | grep Link# | tr -s ' ' | cut -d ' ' -f 1-3</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">re0 1500 <Link#1></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">re1 1500 <Link#2></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">re2* 1500 <Link#3></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">lo0 16384 <Link#4></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">wlan0 1500 <Link#5></span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">bridge0 1500 <Link#6></span><br />
<br />
This link number is the interface index number :-)<br />
<br />
<h3>
How to display this variable (ifi_link_state) ?</h3>
<br />
This answer came from melifaro@ : "use kernel debugger (kgdb) for printing value of variable called ifindex_table[INDEX].if_link_state".<br />
<br />
<h4>
How did this wizzard of code find variable ifindex_table[] ?</h4>
I had to use "<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">grep ifindex_table /usr/src/sys/net/*</span>" and found that ifindex_table is defined in if.c as "Table of ifnet by index."<br />
Reading the source code is mandatory here for discovering this variable name.<br />
<h4>
Why variable is if_link_state and not ifi_link_state like written in ifnet(9) ?</h4>
It seems that ifnet(9) (the manual page) is not up-to-date.<span class="Apple-tab-span" style="white-space: pre;"> </span><br />
<br />
<h3>
Time to play with live kernel debugging</h3>
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">root@fbsd-router:~ # kgdb /boot/kernel/kernel /dev/mem</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">GNU gdb 6.1.1 [FreeBSD]</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">Copyright 2004 Free Software Foundation, Inc.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(...)</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><br /></span>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(kgdb) print ifindex_table[1].if_link_state</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">$1 = 2 '\002'</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(kgdb) p ifindex_table[2].if_link_state</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">$2 = 1 '\001'</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(kgdb) p ifindex_table[5].if_link_state</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">$3 = 0 '\0'</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(kgdb) p ifindex_table[6].if_link_state</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">$4 = 1 '\001'</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><br /></span>
Great: I've got some values!<br />
<div>
We can even print the full structure with command "ptype":<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><br /></span>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(kgdb) ptype ifindex_table[1]</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">type = struct ifnet {</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> struct {</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> struct ifnet *tqe_next;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> struct ifnet **tqe_prev;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> } if_link;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> struct {</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> struct ifnet *le_next;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> struct ifnet **le_prev;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> } if_clones;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> struct {</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> struct ifg_list *tqh_first;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> struct ifg_list **tqh_last;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> } if_groups;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> u_char if_alloctype;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> void *if_softc;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> void *if_llsoftc;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> void *if_l2com;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> const char *if_dname;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> int if_dunit;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> u_short if_index;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> short if_index_reserved;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> char if_xname[0];</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> char *if_description;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> int if_flags;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> int if_drv_flags;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> int if_capabilities;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> int if_capenable;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> void *if_linkmib;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> size_t if_linkmiblen;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> u_int if_refcount;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> uint8_t if_type;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> uint8_t if_addrlen;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> uint8_t if_hdrlen;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> uint8_t if_link_state;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> uint32_t if_mtu;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> uint32_t if_metric;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> uint64_t if_baudrate;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> uint64_t if_hwassist;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(...)</span><br />
Funny but useless for my current task.<br />
<br />
<h3>
How to convert link_state values in Human language ?</h3>
<br />
Another "<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">grep LINK_STATE /usr/src/sys/net/*</span>" for the answer: they are described in if.h:<br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">/*</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> * Values for if_link_state.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> */</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">#define LINK_STATE_UNKNOWN 0 /* link invalid/unknown */</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">#define LINK_STATE_DOWN 1 /* link is down */</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">#define LINK_STATE_UP 2 /* link is up */</span><br />
<br />
<br />
Now I can translate the "kernel view" of my interfaces:<br />
<br />
<ul>
<li>re0 (index 1) is in state 2 (UP)</li>
<li>re1 (index 2) is in state 1 (DOWN)</li>
<li>wlan0 (index 5) is in state 0 (UNKNOWN)</li>
<li>bridge0 (index 6) is in state 1 (DOWN)</li>
</ul>
<br />
<br />
What?!! Wait a minute: bridge0 is in state DOWN ?!? This can't be correct because my wlan0 interface is working!<br />
The bridge logic seems to be wrong: If the first interface is in DOWN state, and the second in UNKNOW state, then bridge is in DOWN state.<br />
<br />
Let's check by plugging re1 and testing the "kernel view" again:<br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(kgdb) p ifindex_table[2].if_link_state</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">$6 = 2 '\002'</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(kgdb) p ifindex_table[6].if_link_state</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">$7 = 2 '\002'</span><br />
<br />
Confirmed: once re1 switch to "LINK UP" state, the bridge switch to "LINK UP" too!!<br />
There is definitively a bug in the bridge logic here, full detailed explanation here:<br />
<a href="https://lists.freebsd.org/pipermail/freebsd-current/2016-January/059274.html">https://lists.freebsd.org/pipermail/freebsd-current/2016-January/059274.html</a><br />
<br />
But I was not able, as simple user, to found by myself the exact index table name and variable name to debug :-(<br />
<br />
Could I did it with D-trace ?<br />
<br />
<h2>
Checking kernel interface status: modern's way</h2>
<br />
Dtrace guide (<a href="http://dtrace.org/guide/preface.html">http://dtrace.org/guide/preface.html</a>) mention:<br />
"DTrace is a comprehensive dynamic tracing framework for the illumos™ Operating System. DTrace provides a powerful infrastructure to permit administrators, developers, and service personnel to concisely answer arbitrary questions about the behavior of the operating system and user programs"<br />
<br />
=> As a "service personnel" I should be able to use it ;-)<br />
<br />
First "freebsd dtrace" google answer is: <a href="https://wiki.freebsd.org/DTrace/Tutorial">https://wiki.freebsd.org/DTrace/Tutorial</a><br />
This tutorial explains how to display all available dtrace probes… but what is a probe?<br />
"A probe is a location or activity to which DTrace can bind a request to perform a set of actions, like recording a stack trace, a timestamp, or the argument to a function. Probes are like programmable sensors scattered all over your illumos system in interesting places." (for official guide).<br />
<br />
For my "link state" problem, I will start by searching probes named "link_state" or "linkstate":<br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">root@fbsd-router# dtrace -l | grep 'link.*state'</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> ID PROVIDER MODULE FUNCTION NAME</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">16563 fbt kernel do_link_state_change entry</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">16564 fbt kernel do_link_state_change return</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">16740 fbt kernel vlan_link_state entry</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">43390 fbt kernel if_link_state_change entry</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">43391 fbt kernel if_link_state_change return</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">53619 fbt kernel usbd_req_set_port_link_state entry</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">53620 fbt kernel usbd_req_set_port_link_state return</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">55751 fbt if_bridge bridge_linkstate entry</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">55825 fbt bridgestp bstp_linkstate entry</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">55826 fbt bridgestp bstp_linkstate return</span><br />
<br />
There are some interesting results. But before to use them I had to read the dtrace guide:<br />
"dtrace use D programming language for scripting action when probe are triggered."<br />
<br />
As example, if I want to display "dtrace probe triggered" each time the dtrace proble "bridge_linkstate" is triggered, I can use this command:<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">dtrace -f 'bridge_linkstate {trace("dtrace probe triggered")}'</span><br />
<br />
Here is an example:<br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">root@fbsd-router:~ # dtrace -f 'bridge_linkstate {trace("dtrace probe triggered")}'</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">dtrace: description 'bridge_linkstate ' matched 1 probe</span><br />
=> now I plug re1 interface to a switch</div>
<div>
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">CPU ID FUNCTION:NAME</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> 1 55751 bridge_linkstate:entry dtrace probe triggered</span><br />
=> now I unplug re1 interface</div>
<div>
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> 1 55751 bridge_linkstate:entry dtrace probe triggered</span><br />
=> now I plug-back re1</div>
<div>
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> 1 55751 bridge_linkstate:entry dtrace probe triggered</span><br />
=> now I unplug re1 interface</div>
<div>
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> 1 55751 bridge_linkstate:entry drace probe triggered</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">(...)</span><br />
<br />
I've remove the other lines, because I've play with this cable during about 1 hour :-)<br />
<br />
I can see when this probe was triggered…but I have no idea of the variable values changed (or not) before and after this call, then this information is almost useless.<br />
<br />
Here came melifaro@ again that brings me a full dtrace script (I've added the comments):<br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">/* The BEGIN is a special probe triggered at the begining of the script</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> The purpose here is to define a table giving link_state value=>description</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">*/</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">BEGIN {</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> a[0] = "UNKNOWN";</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> a[1] = "DOWN";</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> a[2] = "UP";</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">}</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><br /></span>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">/* Defining an action when probe if_bridge:bridge_linkstate:entry is triggered</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> Notice that each probe had an :entry and :return</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> and entry or return variable are called "arg0"</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> If you need the return code of the function, :return is used</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">*/</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">fbt:if_bridge:bridge_linkstate:entry</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">{</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span>/* Need to read sys/net/if_bridge.c for understanding this dtrace function</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span> bridge_linkstate() is called with an ifnet structure pointer as argument (arg0).</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> First step is to cast arg0 into ifnet struct for using it: this->m_ifp</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span> But we can't directly use this->m_ifp->if_link_state, because as a bridge interface,</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span> this ifnet struct includes a specific "software state for each bridge"</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span> (bridge_softc struct) as if_bridge.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span> Second step is to cast this->m_ifp->if_bridge into a bridge_softc struct: this->sc</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span> The first member of a bridge_softc struc is a standard ifnet structure nammed ifp.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> Then, at last, we cast ifnet struct on it: self->ifp</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span> Now we can get the if_link_state with self->ifp->if_link_state</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span>*/</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> this->m_ifp = (struct ifnet *)arg0;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> this->sc = (struct bridge_softc *)this->m_ifp->if_bridge;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> self->ifp = (struct ifnet *)this->sc->sc_ifp;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">}</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><br /></span>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">/* Defining an action when probe kernel:do_link_state_change is triggered</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> Notice the /self->ifp/</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> This is specific to D language that didn't include control flow (like if, while,).</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> Then here, each time this probe is triggered, the condition between / is checked.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> If false (=0), code is not exectuted.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> Here the condition is self->ifp, this mean this condition is triggered only if</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> this variable was set (non NULL) by the previous probe.</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">*/</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><br /></span>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">fbt:kernel:do_link_state_change:entry</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">/self->ifp/</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">{</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> /* originaly a stack trace was displayed but I've commented it</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span>stack();</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span>*/</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span>/* Need to read sys/net/if.c for understanding this dtrace function</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span> static void do_link_state_change(void *arg, int pending)</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> the first argument (arg0) is an ifnet structure, the second argument is the "new" state to apply</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span>*/</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> printf("linkstate changed for %s to %s", stringof(self->ifp->if_xname),</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> a[self->ifp->if_link_state]);</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><span class="Apple-tab-span" style="white-space: pre;"> </span>/* Then reset the triggering variable to NULL */</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> self->ifp = NULL;</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">}</span><br />
<br />
Let's try it:<br />
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">root@fbsd-router:~ # dtrace -s bridge.d</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">dtrace: script 'bridge.d' matched 3 probes</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"><br /></span>
=> now I plug re1:</div>
<div>
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">CPU ID FUNCTION:NAME</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> 0 16563 do_link_state_change:entry linkstate changed for bridge0 to UP</span><br />
=> now I unplug re1:</div>
<div>
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> 1 16563 do_link_state_change:entry linkstate changed for bridge0 to DOWN</span><br />
=> now I plug re1 again:</div>
<div>
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;"> 1 16563 do_link_state_change:entry linkstate changed for bridge0 to UP</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">^C</span><br />
<br />
Great, this tool give "live" view of my REAL current interface status from the kernel point of view.<br />
For using Dtrace, like with kgbd, I had to read FreeBSD sources (man page is outdated here).<br />
For this small "easy" troubleshooting, kgbd is a lot's more easy and faster choice.<br />
But it's too late: I've started to read FreeBSD source code and learned how to use Dtrace now :-)<br />
<br />
Small bugs, beware I'm coming!</div>
Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-87033588749985921772015-09-16T10:55:00.001+02:002022-01-07T19:15:20.280+01:00Recipe for building a 10Mpps FreeBSD based routerFirst you need a server, with a minimum of 8 cores and a good NIC.<br />
My setup is this one:<br />
<br />
<ul>
<li>HP ProLiant DL360p Gen8: 8 cores Intel Xeon E5-2650 @ 2.60GHz</li>
<li>Quad port 10 Gigabit Chelsio TS540-CR</li>
</ul>
<br />
<br />
<div>
The first step is to entering the UEFI and disabling Hyper-Threading.</div>
<div>
<i>(note to myself: Need to generate benchmark comparing HT impact for a router use)</i></div>
<div>
<br /></div>
<div>
Once done, you can install a FreeBSD on it… but not a classical 10.2!</div>
<div>
<br /></div>
<div>
Default behavior of FreeBSD multi-queue NIC drivers is to create a number of queue equal to number of core (with a maximum number of 16 for Chelsio).</div>
<div>
This mean for a 8 cores server, it will create 8 queues:</div>
<div>
<ul>
<li>Each queue will obtain its own IRQ</li>
<li>The NIC will load-balance in/out frames between these queues</li>
</ul>
</div>
<div>
The NIC load-balance algorithm kepts same flow on the same queue by default: Then you need lot's of differents flow (different src/dst IP addresss or TCP/UDP ports) for a correct distribution among all theses queues: <i>Don't bench your setup with only one FTP flow as example</i>.</div>
<div>
<br /></div>
<div>
And FreeBSD meet a problem here because the number of queue/core didn't scale well after 4 cores:</div><div class="separator" style="clear: both; text-align: center;"><a href="https://raw.githubusercontent.com/ocochard/netbenches/master/Xeon_E5-2650_8Cores-Chelsio_T540-CR/hw.cxgbe.nXxq10g/results/fbsd10.2/graph.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="600" data-original-width="800" height="300" src="https://raw.githubusercontent.com/ocochard/netbenches/master/Xeon_E5-2650_8Cores-Chelsio_T540-CR/hw.cxgbe.nXxq10g/results/fbsd10.2/graph.png" width="400" /></a></div><br /><div><br /></div>
<div class="separator" style="clear: both; text-align: center;"><br /></div>
<div>
=> On this 8 cores setup, you need to reduce your NIC queue number to 4 for the best performance.</div>
<div>
<br /></div>
<div>
But recently this problem was resolved by Alexander V. Chernikov (melifaro) on its experimental <a href="https://svnweb.freebsd.org/base/projects/routing/">projects/routing</a> branchs (lot's of cleaning regarding fine locking and testing new ideas):</div><div class="separator" style="clear: both; text-align: center;"><a href="https://raw.githubusercontent.com/ocochard/netbenches/master/Xeon_E5-2650_8Cores-Chelsio_T540-CR/hw.cxgbe.nXxq10g/results/fbsd11-routing.r287531/graph.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="600" data-original-width="800" height="300" src="https://raw.githubusercontent.com/ocochard/netbenches/master/Xeon_E5-2650_8Cores-Chelsio_T540-CR/hw.cxgbe.nXxq10g/results/fbsd11-routing.r287531/graph.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><br /><br /></div>
<div>
<br /></div>
<div>
Well… almost resolved: We see a big improvement and perfect linear scale up to 4 cores but still not linear to 8 cores. </div>
<div>
And surprisingly this non-linear problem isn't related to the improvement in forwarding code, but to <a href="https://svnweb.freebsd.org/base?view=revision&revision=287023">the new random entropy harvester brings recently in head</a> that is collecting first 2 bytes of each frame under single mutex.</div>
<div>
Disabling INTERRUPT and NET_ETHER entropy sources (by adding <span style="font-family: "courier new" , "courier" , monospace;">harvest_mask="351"</span> in /etc/rc.conf) solve the problem:</div><div class="separator" style="clear: both; text-align: center;"><a href="https://raw.githubusercontent.com/ocochard/netbenches/master/Xeon_E5-2650_8Cores-Chelsio_T540-CR/hw.cxgbe.nXxq10g.harvest.mask.351/results/fbsd11-routing.r287531/graph.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="600" data-original-width="800" height="300" src="https://raw.githubusercontent.com/ocochard/netbenches/master/Xeon_E5-2650_8Cores-Chelsio_T540-CR/hw.cxgbe.nXxq10g.harvest.mask.351/results/fbsd11-routing.r287531/graph.png" width="400" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>
<div>
<br /></div>
<div>
=> 9.5Mpps on this setup !</div>
<div>
<br /></div>
<div>
And for non-network people who didn't understand value in "paquet-per-second", here is a different graph regarding impact on forwarding performance with ipfw or pf enabled. With the equivalent IMIX on the right side:</div>
<div>
<br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://raw.githubusercontent.com/ocochard/netbenches/master/Xeon_E5-2650_8Cores-Chelsio_T540-CR/forwarding-pf-ipfw/results/fbsd11-routing.r287531/graph.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="600" data-original-width="800" height="300" src="https://raw.githubusercontent.com/ocochard/netbenches/master/Xeon_E5-2650_8Cores-Chelsio_T540-CR/forwarding-pf-ipfw/results/fbsd11-routing.r287531/graph.png" width="400" /></a></div><br /><div class="separator" style="clear: both; text-align: center;"><br /></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div>
<br /></div>
<div>
Now how to reach 10Mpps? Just use a little more powerful CPU ;-)<br />
<br />
And if you want to test these new performance on your hardware you just need one USB flash disk and installing on it <a href="http://dev.bsdrp.net/benchs/nanobsd/fbsd11-routing.r287531/">these BSD Router Project (nanobsd) EXPERIMENTAL images used for theses bench</a>s. It's just a dd to the USB flash disk, and more <a href="http://bsdrp.net/documentation/end-users_docs">installation instructions are on BSDRP web site</a>.</div>
<div>
<br /></div>
Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-24277794196493108392015-06-24T00:45:00.002+02:002015-06-25T09:35:50.317+02:00Serial-PXE-TFTP install of FreeBSD(BSDRP,Xsense,NAS4Free)/OpenBSD/Centos<h3>
Objectives</h3>
Remote installation of multiples Operating systems using only:<br />
<ul>
<li>FreeBSD server with a PXE and TFTP services</li>
<li>Serial console: IPMI Serial-over-LAN (sol) </li>
</ul>
<h3>
</h3>
I didn't found an easy way for PXE+TFTP (only!) serial remote installation for NetBSD or DragonFly.<br />
FreeBSD was very complex too (need to recompile bootloader for TFTP and serial usage), but hopefully <a href="http://mfsbsd.vx.sk/">mfsBSD</a> hides this problem.<br />
OpenBSD and CentOS, by providing ramdisk natively and easy way of configuring their bootloader, were the most admin-friendly.<br />
<h3>
dnsmasq</h3>
This step will install an all-in-once DHCP/TFTP server:<br />
<span style="font-family: "Courier New",Courier,monospace;">pkg install dnsmasq</span><br />
Then, create a small configuration file (example with "bce1" as NIC and local subnet in 192.168.1.0/24)<span style="font-family: "Courier New",Courier,monospace;"><br />cat > /usr/local/etc/dnsmasq.conf <<EOF<br />interface=bce1<br />dhcp-range=192.168.1.80,192.168.1.85<br />pxe-service=x86PC, "pxelinux", pxelinux<br />enable-tftp<br />tftp-root=/tftpboot<br />EOF</span><br />
<br />
And start it:<br />
<span style="font-family: "Courier New",Courier,monospace;">sysrc dnsmasq_enable=yes</span><br />
<span style="font-family: "Courier New",Courier,monospace;">service dnsmasq start</span><br />
<br />
<h3>
pxelinux</h3>
<pre class="screen"><kbd class="userinput"></kbd></pre>
<div class="screen">
This step will install pxelinux binaries and configure PXE menu<kbd class="userinput">:</kbd><kbd class="userinput"></kbd><kbd class="userinput">
</kbd></div>
<pre class="screen"><kbd class="userinput"></kbd></pre>
<pre class="screen"><code></code></pre>
<pre class="screen"><code></code></pre>
<pre class="screen"><code></code></pre>
<pre class="screen"><code></code></pre>
<span style="font-family: "Courier New",Courier,monospace;">mkdir /tftpboot<br />cd /tftpboot<br />fetch https://www.kernel.org/pub/linux/utils/boot/syslinux/syslinux-6.03.zip<br />unzip -d syslinux syslinux-6.03.zip<br />cp syslinux/bios/memdisk/memdisk /tftpboot<br />cp syslinux/bios/core/pxelinux.0 /tftpboot<br />cp syslinux/bios/com32/elflink/ldlinux/ldlinux.c32 /tftpboot<br />cp syslinux/bios/com32/menu/menu.c32 /tftpboot<br />cp syslinux/bios/com32/libutil/libutil.c32 /tftpboot<br />cp syslinux/bios/com32/modules/pxechn.c32 /tftpboot<br />cp syslinux/bios/com32/lib/libcom32.c32 /tftpboot</span><br />
<span style="font-family: "Courier New",Courier,monospace;">cp syslinux/bios/com32/chain/chain.c32 /tftpboot</span><br />
<span style="font-family: "Courier New",Courier,monospace;">cp syslinux/bios/com32/modules/reboot.c32 /tftpboot/<br />rm syslinux-6.03.zip<br />rm -rf syslinux<br />mkdir /tftpboot/pxelinux.cfg<br />cat > /tftpboot/pxelinux.cfg/default <<EOF</span><br />
<span style="font-family: "Courier New",Courier,monospace;">SERIAL 0 115200<br />CONSOLE 0<br />UI menu.c32<br />TIMEOUT 300<br />MENU TITLE PXE BOOT MENU<br />LABEL freebsd<br /> MENU DEFAULT<br /> MENU LABEL mfsbsd (FreeBSD, pfSense, BSDRP, NAS4Free, etc...)<br /> KERNEL memdisk<br /> APPEND initrd=/mfsbsd-10.1-RELEASE-amd64.img harddisk raw<br />LABEL openbsd<br /> MENU LABEL OpenBSD<br /> KERNEL pxechn.c32<br /> APPEND ::/openbsd/pxeboot<br />LABEL netbsd<br /> MENU LABEL NetBSD<br /> KERNEL pxechn.c32<br /> APPEND ::/netbsd/pxeboot_ia32_com0.bin<br />LABEL centos<br /> MENU LABEL Centos 7<br /> kernel centos/vmlinuz<br /> append initrd=centos/initrd.img method=http://mirror.centos.org/centos/7/os/x86_64/ devfs=nomount ip=dhcp console=ttyS0,115200 earlyprint=serial,ttyS0,115200<br />LABEL local<br /> MENU LABEL local disk<br /> KERNEL chain.c32<br /> APPEND hd0</span><br />
<span style="font-family: "Courier New",Courier,monospace;">LABEL reboot<br /> MENU LABEL reboot<br /> KERNEL reboot.c32<br />EOF</span><code></code><br />
<pre class="screen"><code></code></pre>
<h3>
FreeBSD</h3>
<div class="screen">
Download mfsBSD image and enable serial port:<code> </code></div>
<span style="font-family: "Courier New",Courier,monospace;">fetch -o /tftpboot/mfsbsd-10.1-RELEASE-amd64.img http://mfsbsd.vx.sk/files/images/10/amd64/mfsbsd-10.1-RELEASE-amd64.img <br />mdconfig -a -t vnode -f mfsbsd-10.1-RELEASE-amd64.img<br />mount /dev/md0a /mnt/<br />echo "-S115200 -h" > /mnt/boot.config</span><br />
<span style="font-family: "Courier New",Courier,monospace;">umount /mnt<br />mdconfig -d -u 0 </span><br />
<h3 class="screen">
OpenBSD</h3>
<h3 class="screen">
</h3>
Download OpenBSD's pxeboot and RamDisk image, then enable serial port:<span style="font-family: "Courier New",Courier,monospace;"> </span><br />
<span style="font-family: "Courier New",Courier,monospace;">mkdir /tftpboot/openbsd/<br />fetch -o /tftpboot/openbsd/pxeboot http://ftp.openbsd.org/pub/OpenBSD/5.7/amd64/pxeboot<br />fetch -o /tftpboot/openbsd/bsd.rd http://ftp.openbsd.org/pub/OpenBSD/5.7/amd64/bsd.rd<br />mkdir /tftpboot/etc<br />cat > /tftpboot/etc/boot.conf <<EOF<br />stty com0 115200<br />set tty com0<br />boot tftp:/openbsd/bsd.rd<br />EOF</span><br />
<h3>
CentOS</h3>
Download CentOS kernel and RamDisk:<span style="font-family: "Courier New",Courier,monospace;"><br />mkdir /tftpboot/centos<br />fetch -o /tftpboot/centos/initrd.img ftp://ftp.free.fr/mirrors/ftp.centos.org/7.1.1503/os/x86_64/images/pxeboot/initrd.img<br />fetch -o /tftpboot/centos/vmlinuz ftp://ftp.free.fr/mirrors/ftp.centos.org/7.1.1503/os/x86_64/images/pxeboot/vmlinuz</span><br />
<h3>
Installing BSDRP, pfSense, OPNsense, NAS4Free, or any nanoBSD</h3>
<h3>
</h3>
From mfsbsd, just dd their serial nanobsd/embedded image to the local hard drive.<br />
For installing FreeBSD: just uses <span style="font-family: "Courier New",Courier,monospace;">bsdinstall</span><br />
<h3>
Debugging PXE/TFTP process</h3>
From the server, start a tcpdump accepting only bootps and tftp packets:<br />
<pre class="screen"><kbd class="userinput">tcpdump -ni bce1 -vv port bootps or port tftp</kbd></pre>
<pre class="screen"><kbd class="userinput">
</kbd></pre>
Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com1tag:blogger.com,1999:blog-12848403.post-44881053982249785692014-10-13T19:04:00.000+02:002014-10-13T19:04:18.455+02:00ipfw improvement on FreeBSD -currentFew days ago <span class="st">Alexander V. Chernikov </span>posted on the FreeBSD -net mailing list an "<a href="http://lists.freebsd.org/pipermail/freebsd-net/2014-October/039995.html">HEADS UP: Merging projects/ipfw to HEAD</a>" with lot's of promises:<br />
<ul>
<li>Tables are now identified by names, not numbers. There can be up to
65k tables with up to 63-byte long names.</li>
<li>Tables are now set-aware (default off), so you can switch/move them
atomically with rules.</li>
<li>More functionality is supported (swap, lock, limits, user-level
lookup, batched add/del) by generic table code.</li>
<li>New table types are added (flow) so you can match multiple packet
fields at once.</li>
<li>Ability to add different type of lookup algorithms for particular
table type has been added.</li>
<li>New table algorithms are added (cidr:hash, iface:array, number:array
and flow:hash) to make certain types of lookup more effective.</li>
<li>Table value are now capable of holding multiple data fields for
different tablearg users</li>
</ul>
I'm not an expert of <a href="https://www.freebsd.org/cgi/man.cgi?ipfw%288%29">ipfw(8)</a>, but I would check the impact of this improved-ipfw on forwarding performance. By "performance" I mean how this code impact the throughput (in term of packet-per-second) of my FreeBSD firewall (I didn't bench all the parameters requiered by <a href="https://www.ietf.org/rfc/rfc3511.txt">RFC3511</a>).<br />
Once the code was committed as <a href="http://lists.freebsd.org/pipermail/freebsd-net/2014-October/039995.html">r272840</a> on -head, I've generated a new <a href="https://www.freebsd.org/cgi/man.cgi?nanobsd%288%29">nanobsd(8)</a> image on my <a href="http://bsdrp.net/documentation/examples/forwarding_performance_lab_of_an_ibm_system_x3550_m3_with_10-gigabit_intel_x540-at2">10gigabit bench lab</a>… and here are the results:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi23ANQZxkGIdv3842oLuTb3I2WjAGxPWq-ai9zCgD2Xtz1o8YX0al4GvJS6Y-UTU446e2Il21pMEAATJrvJNq6jlLKrgNAQeaseTYp3Mf2Eev88YNgPBSuaywxJyjNDelOC9Qo1w/s1600/new-ipfw.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi23ANQZxkGIdv3842oLuTb3I2WjAGxPWq-ai9zCgD2Xtz1o8YX0al4GvJS6Y-UTU446e2Il21pMEAATJrvJNq6jlLKrgNAQeaseTYp3Mf2Eev88YNgPBSuaywxJyjNDelOC9Qo1w/s1600/new-ipfw.png" height="403" width="640" /></a></div>
<br />
More than 100K pps of differences! Now I dream of an ipfw_sync equivalent to <a href="https://www.freebsd.org/cgi/man.cgi?pfsync%284%29">pf_sync(4)</a>.<br />
And here are the ministat output for statistician extremists.<br />
Regarding ipfw in stateless mode: <br />
<br /> <br />
<span style="font-family: "Courier New", Courier, monospace;">x 272685.ipfw-stateless<br />+ 273009.ipfw-stateless<br />+----------------------------------------------------------------------+<br />|x x x x + + + + +|<br />| |______A__M___| |<br />| |___M__A_____| |<br />+----------------------------------------------------------------------+<br /> N Min Max Median Avg Stddev<br />x 5 1585928 1619817 1608891 1604564.2 12728.878<br />+ 5 1683246 1712607 1690405 1695508.6 12250.89<br />Difference at 95.0% confidence<br /> 90944.4 +/- 18219.1<br /> 5.66786% +/- 1.13546%<br /> (Student's t, pooled s = 12492.2)<br /></span><br />
And regarding ipfw in statefull mode:<br />
<br /> <br />
<span style="font-family: "Courier New", Courier, monospace;">x 272685.ipfw-statefull<br />+ 273009.ipfw-statefull<br />+----------------------------------------------------------------------+<br />|xx x x x ++ + + +|<br />||_____A______| |<br />| |_______M___A____________| |<br />+----------------------------------------------------------------------+<br /> N Min Max Median Avg Stddev<br />x 5 1390415 1433678 1407058 1408663.4 18451.472<br />+ 5 1502719 1589778 1517320 1529871.8 35404.181<br />Difference at 95.0% confidence<br /> 121208 +/- 41172.4<br /> 8.6045% +/- 2.9228%<br /> (Student's t, pooled s = 28230.4)</span><br /> Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com1tag:blogger.com,1999:blog-12848403.post-59321255295742570632014-09-17T12:03:00.002+02:002014-09-17T12:03:53.313+02:00PuTTY and Solarized colorsI'm using the <a href="http://ethanschoonover.com/solarized">Solarized</a> color palette on all my FreeBSD desktops, but at work I had to works from a MS Windows desktop :-(<br />
Here are my PuTTY settings for a correct rendering of Solarized colors.<br />
<h3>
Softwares used</h3>
<ul>
<li><a href="http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html">PuTTY</a> and it's authentication agent (There is <a href="http://www.9bis.net/kitty/">KiTTY</a>, an improved version of PuTTY too)</li>
<li><a href="http://www.ttyplus.com/">MTPuTTY (Multi-Tabbed Putty)</a> for adding tabbed feature to PuTTY/KiTTY</li>
<li><a href="https://github.com/brantb/solarized/tree/master/putty-colors-solarized">Solarized PuTTY settings</a></li>
</ul>
<h3>
Installation steps</h3>
Installing PuTTY or MTPuTTY didn't need specials instruction.<br />
If you're using KiTTY, the Solarized PuTTY.reg files need to be adapted by opening them into a text editor and replacing the line:<br />
<span style="font-family: "Courier New",Courier,monospace;">[HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\Solarized%20Dark]</span><br />
By this one:<br />
<span style="font-family: "Courier New",Courier,monospace;">[HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions\Solarized%20Dark]</span><br />
Then import the .reg files.<br />
<h3>
KiTTY/PuTTY configuration</h3>
Now start KiTTY or PuTTY, load the Dark or Light Solarized session and modify this session with: <br />
<ul>
<li>Window - Colours : Enable "Allow terminal to use xterm 256-colour mode"</li>
<li>Connection - Data - Terminal details : Terminal-type string : "xterm-256color"</li>
</ul>
You can then add more customization, for example:<br />
<ul>
<li>Terminal - Bell : Visual Bell</li>
<li>Window - Appearance - Font Settings - Font: "Consolas" - 12point</li>
<li>Window - Appearance - Font Settings - Font quality: ClearType</li>
<li>Window - Translation - Remote character set: UTF-8</li>
<li>Window - Lines of scrollback: 10000</li>
<li>Window - Selection - Control use of mouse: xterm (Right extends, Middle Past)</li>
<li>Connection : Second between keepalives: 25</li>
<li>Connection : Enable TCP keepalives</li>
<li>Connection - SSH - X11: Enable X11 forwarding</li>
</ul>
Once all your customization done, save the session as "Default Settings".<br />
<br />
<h3>
Checking parameters</h3>
Start a KiTTY/PuTTY, check that your preferences are loaded by default and open a SSH session to an *nix machine.<br />
Once logged, the command "<span style="font-family: "Courier New",Courier,monospace;">echo $TERM</span>" should answer "<span style="font-family: "Courier New",Courier,monospace;">xterm-256color</span>".<br />
And, if you've <a href="http://ethanschoonover.com/solarized/vim-colors-solarized">solarized your VIM</a> (you don't need to use <code>let g:solarized_termcolors=256<span style="font-family: inherit;">!), </span></code>you should correctly see the column after entering a "<span style="font-family: "Courier New",Courier,monospace;">set colorcolumn=80</span>". <br />
<br />
<h3>
tmux </h3>
tmux need to be configured for advertise a 256color term by adding in ~/.tmux.conf the line:<br />
<span style="font-family: "Courier New",Courier,monospace;">set -g default-terminal "screen-256color"</span><br />
<br />Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-43868940200357065322014-02-19T15:48:00.000+01:002014-02-19T15:48:23.364+01:00Configuration IPv6 propre d'une Kimsufi sous FreeBSDPour configurer une passerelle par défaut IPv6 sur un Kimsufi,<a href="http://guides.ovh.com/Ipv4Ipv6#link5"> le guide officiel</a> se résume à:<br />
<ol>
<li>Paramétrer l'IPv6 de votre interface avec votre préfixe /64 (2001:41D0:1:46e::/64 par exemple)</li>
<li>Suivre la règle IP:v:6:FF:FF:FF:FF:FF pour déduire votre passerelle par défaut (dans notre exemple elle est donc 2001:41D0:1:4FF:FF:FF:FF:FF).</li>
</ol>
Sauf qu'avec cette règle l'IP de la passerelle est en dehors de votre réseau (/64)… donc injoignable !<br />
«À ce qu'il paraît» cela ne pose pas de problème aux GNU/Linux…no comment.<br />
<a href="http://guides.ovh.com/Ipv4Ipv6#link10">Une autre section du guide propose de récupérer les RA pour trouver la route par défaut "link-local" annoncée par le routeur</a>, mais cela ne fonctionne plus car <a href="http://travaux.ovh.net/?do=details&id=8047">ils ont été désactivés</a>.<br />
La solution la plus commune à ce problème est de paramétrer un préfixe /56 à la place du /64 sur votre interface: du coup la passerelle par défaut se trouve dans votre réseau et le problème est résolus.<br />
Mais OVH m'a donné un /64, je ne vois pas pourquoi je lui déclarerai un /56!<br />
<br />
Une jolie solution (soufflée par <a href="https://wiki.freebsd.org/IrcNicks">flo@</a>) permettant de paramétrer un /64 tout en utilisant cette route par défaut est la suivante:<br />
<br />
<span style="font-family: "Courier New",Courier,monospace;">ifconfig_re0_ipv6="inet6 2001:41D0:1:46e::1 prefixlen 64"</span><br />
<span style="font-family: "Courier New",Courier,monospace;">ipv6_static_routes="mac"<br />ipv6_route_mac="-host 2001:41D0:1:4FF:FF:FF:FF:FF -iface re0"<br />ipv6_defaultrouter="2001:41D0:1:4FF:FF:FF:FF:FF"</span>Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-74908488313854663762014-01-25T22:37:00.001+01:002021-10-08T15:48:36.398+02:00Ethernet-Wifi failover on FreeBSDI want a simple behaviour with my laptop:<br />
<ol>
<li>If Ethernet cable connected use this connectivity, otherwise use the wireless;</li>
<li>I want to kept the same IP addresses, event if I'm using DHCP client.</li>
</ol>
The solution is quiet simple:<br />
<ol>
<li>set-up an aggregate interface in failover mode with Ethernet as primary and wireless as backup;</li>
<li>Clone the Wireless MAC NIC to the Ethernet (opposite is not always possible with wireless chipset restriction).</li>
</ol>
Here are how to do it:<br />
<br />
<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;"># <b>ifconfig -l</b><br />iwn0 bge0 lo0 </span></span><br />
<span style="font-family: "Courier New",Courier,monospace;"><span style="font-size: small;">=> My Ethernet NIC is "bge0" and wireless is "iwn0" here</span></span><br />
<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;"></span></span><br />
<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;"># <b>set MAC=`ifconfig wlan0 | grep ether | cut -d ' ' -f 2`</b></span></span><br />
<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;"># <b>sysrc ifconfig_bge0=</b><b>"ether $MAC"</b><br />ifconfig_bge0: -> ether 00:1c:23:25:ab:45<br /># <b>sysrc wlans_iwn0=wlan0</b><br />wlans_iwn0: -> wlan0</span></span><br />
<span style="font-family: "Courier New",Courier,monospace;"><span style="font-size: small;"># <b>sysrc ifconfig_wlan0="WPA up"</b><br />ifconfig_wlan0: WPA DHCP -> WPA up<br /># <b>sysrc cloned_interfaces=lagg0</b><br />cloned_interfaces: -> lagg0<br /># <b>sysrc ifconfig_lagg0="laggproto failover laggport bge0 laggport wlan0 DHCP"</b><br />ifconfig_lagg0: -> laggproto failover laggport bge0 laggport wlan0 DHCP<br /># <b>sysrc ifconfig_lagg0_ipv6="inet6 accept_rtadv"</b><br />ifconfig_lagg0_ipv6: -> inet6 accept_rtadv</span></span><br />
<span style="font-family: "Courier New",Courier,monospace;"><span style="font-size: small;"># <b>service netif restart</b></span></span><br />
<span style="font-family: "Courier New",Courier,monospace;"><br /></span>
<span style="font-family: "Courier New",Courier,monospace;">And now with Ethernet cable unplugged:</span><br />
<span style="font-family: "Courier New",Courier,monospace;"><br /></span>
<span style="font-family: "Courier New",Courier,monospace;"># <b>ifconfig lagg0</b><br />lagg0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500<br /> ether 00:1c:23:25:ab:45<br /> inet6 fe80::41d:23ff:fe25:ab78%lagg0 prefixlen 64 scopeid 0x4 <br /> inet6 2a01:e35:9b9d:a1a0:41d:23ff:fe25:ab45 prefixlen 64 autoconf <br /> inet 192.168.100.7 netmask 0xffffff00 broadcast 192.168.100.255 <br /> nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL><br /> media: Ethernet autoselect<br /> status: active<br /> laggproto failover lagghash l2,l3,l4<br /> <span style="background-color: yellow;">laggport: wlan0 flags=4<ACTIVE></span><br /> laggport: bge0 flags=1<MASTER></span><br />
<span style="font-family: "Courier New",Courier,monospace;"><br /></span>
<br />
<span style="font-size: small;">Then If I plug the Ethernet cable:</span><br />
<br />
<span style="font-size: small;"></span><br />
<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;"># ifconfig lagg0<br />lagg0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500<br /> ether 00:1c:23:25:ab:45<br /> inet6 fe80::41d:23ff:fe25:ab45%lagg0 prefixlen 64 scopeid 0x4 <br /> inet6 2a01:e35:9b9d:a1a0:41d:23ff:fe25:ab45 prefixlen 64 autoconf <br /> inet 192.168.100.7 netmask 0xffffff00 broadcast 192.168.100.255 <br /> nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL><br /> media: Ethernet autoselect<br /> status: active<br /> laggproto failover lagghash l2,l3,l4<br /> laggport: wlan0 flags=0<><br /> <span style="background-color: yellow;">laggport: bge0 flags=5<MASTER,ACTIVE></span></span></span><br />
<span style="font-size: small;"><br /></span>Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-19753347817282966322013-06-05T20:46:00.000+02:002014-12-12T10:11:24.685+01:00Generating custom FreeBSD installation media<br />
<h2>
Objective</h2>
Generating a custom -current memstick image without all the debug feature enabled.<br />
<h2>
Prerequisite</h2>
Have the head source installed (I will use /usr/src as example).<br />
If not, here is an example for synchronizing up-to-date head (-current) sources on /usr/src <br />
<span style="font-family: "Courier New",Courier,monospace;">svnlite co svn://svn.freebsd.org/base/head /usr/src</span><br />
<h2>
Customizing build compilation options</h2>
A little debug feature to disable on -current: <br />
<span style="font-family: "Courier New",Courier,monospace;">echo "</span><span style="font-family: "Courier New",Courier,monospace;"><span style="font-family: "Courier New",Courier,monospace;">MALLOC_PRODUCTION=yes" </span>> /etc/src.conf </span><br />
<h2>
Building world and kernel</h2>
New we start the classical building of world and our customized kernel.<br />
For information this step takes about 4 hours on my PC.<br />
<span style="font-family: "Courier New",Courier,monospace;">cd /usr/src<br />make buildworld; make buildkernel KERNCONF=GENERIC-NODEBUG</span><br />
<h2>
Generating install media image</h2>
Last step: Generating the install media.<br />
Here is an example for generating memstick install media without port tree (long live to pkgng! neither doc):<br />
<span style="font-family: "Courier New",Courier,monospace;">cd /usr/src/release<br />make -DNOPORTS -DNODOC memstick</span><br />
<br />
Replace "memstick" by "cdrom" (bootonly.iso and release.iso) or "ftp" for other media.<br />
You can add a -DNOSRC option for avoiding to include sources too on the media.<br />
<br />
Then copy the image to your usb key:<br />
<span style="font-family: "Courier New",Courier,monospace;">dd if=memstick of=/dev/da0 bs=64k</span><br />
<h2>
<span style="font-family: inherit;">Cleaning your mess</span></h2>
<span style="font-family: inherit;">Your system has lot's of file that you don't need anymore, here is how to clean it: </span><br />
<span style="font-family: "Courier New",Courier,monospace;">cd /usr/src/release</span><br />
<span style="font-family: "Courier New",Courier,monospace;">make clean</span><br />
<span style="font-family: "Courier New",Courier,monospace;">cd /usr/src</span><br />
<span style="font-family: "Courier New",Courier,monospace;">make clean</span><br />
<br />
<br />
<br />Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-31825112708960205322013-03-06T22:26:00.001+01:002013-03-07T12:44:56.221+01:00Xorg for FreeBSD on Raspberry Pi<span style="font-family: inherit;">Thanks to <a href="http://raybsd.blogspot.fr/">Ray</a><a href="http://www.blogger.com/blogger.g?blogID=12848403"></a>, we have a working X11 drivers that works on Raspberry pi too.</span><br />
Here is how to install it:<br />
Download the latest <a href="http://www.peach.ne.jp/archives/rpi">Daisuke's Raspberry pi FreeBSD image</a> (login/password: pi/ raspberry and root password: raspberry).<br />
Unzip, dd it on your 8GB SD card, boot your rspie and configure your network (Internet access mandatory for downloading pkg). <br />
Install USB mouse drivers:<br />
<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;">cd /usr/src/sys/modules/usb/ums <br />make clean all install</span></span><br />
Install pkg and declare the repository:<br />
<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;">fetch http://dev.bsdrp.net/pkg/freebsd:10:arm:32:el:oabi:softfp/Latest/pkg.txz<br />tar xf ./pkg.txz -s ",/.*/,,g" "*/pkg-static"<br />./pkg-static add ./pkg.txz</span></span><br />
<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;">echo 'packagesite: http://dev.bsdrp.net/pkg/${ABI}' > /usr/local/etc/pkg.conf</span></span><br />
Install Xorg, scfb drivers and some X apps:<br />
<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;">pkg inst xorg-minimal xf86-video-scfb xorg-apps</span> </span><br />
Configure /etc/X11/xorg.conf<span style="font-family: 'Courier New';">:</span><br />
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">Section "Files"</span><br />
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">EndSection</span><span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> </span><br />
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">Section "Module"</span><br />
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Load "dbe"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Disable "dri"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Disable "dri2"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Disable "glx"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> SubSection "extmod"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Option "omit xfree86-dga"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> EndSubSection</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">EndSection</span></div>
<span style="font-size: small;"><br />
</span><br />
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">Section "ServerFlags"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Option "AIGLX" "false"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Option "NoAccel" "True"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Option "NoDRI" "True"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Option "DRI" "False"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Option "DRI2" "False"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">EndSection</span></div>
<span style="font-size: small;"><br />
</span><br />
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">Section "InputDevice"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Identifier "Keyboard1"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Driver "kbd"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">EndSection</span></div>
<span style="font-size: small;"><br />
</span><br />
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">Section "InputDevice"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Identifier "Mouse1"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Driver "mouse"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Option "Protocol" "auto"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Option "Device" "/dev/sysmouse"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">EndSection</span></div>
<span style="font-size: small;"><br />
</span><br />
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">Section "Monitor"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Identifier "Monitor"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">EndSection</span></div>
<span style="font-size: small;"><br />
</span><br />
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">Section "Device"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Identifier "Generic FB"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Driver "scfb"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Option "NoAccel" "True"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">EndSection</span></div>
<span style="font-size: small;"><br />
</span><br />
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">Section "Screen"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Identifier "Screen"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Device "Generic FB"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Monitor "Monitor"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> DefaultDepth 16</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> SubSection "Display"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Depth 16</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> EndSubsection</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">EndSection</span></div>
<span style="font-size: small;"><br />
</span><br />
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">Section "ServerLayout"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Identifier "layout"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> Screen 0 "Screen" 0 0</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> InputDevice "Mouse1" "CorePointer"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;"> InputDevice "Keyboard1" "CoreKeyboard"</span></div>
<div dir="ltr" style="margin-bottom: 0pt; margin-right: 4.5pt; margin-top: 0pt;">
<span style="background-color: white; color: black; font-family: 'Courier New'; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; text-decoration: none; vertical-align: baseline;">EndSection</span></div>
<ol>
</ol>
Then a dummy ~/.xinitrc:<br />
<span style="font-family: "Courier New",Courier,monospace;">xterm &<br />xclock &<br />xcalc &<br />exec twm</span><br />
<br />
And enjoy:<br />
<span style="font-family: "Courier New",Courier,monospace;">startx</span><br />
<br />
A first ugly screenshoot:<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwCaL3-IZaP3V9YnCAO6xtvHwdsXA2vRff0E6LcBtsxMhAytdQU6hPxE9gLaYWslxPRRoHazFKpxYLQuAW5rxQC49ByWMwDz4ra_TBY573nHYP5jD-kh-U8wAJY4847Uv8jOWsQg/s1600/screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwCaL3-IZaP3V9YnCAO6xtvHwdsXA2vRff0E6LcBtsxMhAytdQU6hPxE9gLaYWslxPRRoHazFKpxYLQuAW5rxQC49ByWMwDz4ra_TBY573nHYP5jD-kh-U8wAJY4847Uv8jOWsQg/s320/screenshot.png" width="320" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<br />Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com5tag:blogger.com,1999:blog-12848403.post-38159924053003074552012-12-06T02:30:00.000+01:002014-09-13T19:36:34.176+02:00Installation de FreeBSD sur partition chiffrée<h3>
Le conce<span style="font-family: inherit;">pt</span> </h3>
Cet article présente l'usage de <a href="http://www.freebsd.org/cgi/man.cgi?query=geli">geli </a>pour l'installation d'un FreeBSD (9.1) sur un disque chiffré.<br />
Le module geli permet:<br />
<ol>
<li>D'utiliser l'assistance matériel si elle est disponible (comme l'<a href="http://www.freebsd.org/cgi/man.cgi?query=aesni">aesni</a> des processeurs Intel).</li>
<li>De gérer des clés «maitres» (cas typique d'usage en entreprise: Une clé «maitre» stockée dans le coffre du bureau sécurité, permettant l'accès d'un disque en cas de perte d'une clé «salarié»).</li>
<li>De générer des clés aléatoires: Utile pour avoir une clé différente pour la partition swap à chaque re-démarrage.</li>
</ol>
L'intégralité des partitions du disque ne sont pas chiffrées:<br />
<ol>
<li>La partition contenant le boot-loader (utilisant GPT, on réserve une partition pour lui) est en clair</li>
<li>La partition contenant la configuration des boot-loader, le noyau et ses modules est en clair</li>
<li>Tout le reste est chiffré (le /)</li>
</ol>
Cet exemple présente un usage simple sur un PC portable personnel, c'est à dire avec cette configuration: <br />
<ol>
<li>Utilisation d'un mot de passe uniquement (pas de clé)</li>
<li>Pas de partition swap </li>
</ol>
<u>À noter:</u><br />
Le mot de passe étant demandé pendant le chargement du noyau, le clavier sera obligatoirement en QWERTY (à moins de reconfigurer/recompiler un noyau)… Donc pensez-y lorsque vous rentrez votre mot de passe ;-)<br />
<br />
<h3>
Un dessin vaut mieux qu'un long discours</h3>
Voici l'organisation des partitions sur votre disque à la fin de cette installation: <br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXRii35mG7n4RNUtVUZCLClD2RdbS_8CQoUQngFwR9RxocoVhTNocCzepb0evmOQo8VjyjLUFNvHm4O-9P60SRmlwOKFU0nrJW4y3R5ZipiyM28eZTZHG9AwN_MbiUJaKwj8VE-Q/s1600/encrypt+FBSD+disk.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXRii35mG7n4RNUtVUZCLClD2RdbS_8CQoUQngFwR9RxocoVhTNocCzepb0evmOQo8VjyjLUFNvHm4O-9P60SRmlwOKFU0nrJW4y3R5ZipiyM28eZTZHG9AwN_MbiUJaKwj8VE-Q/s400/encrypt+FBSD+disk.png" height="225" width="400" /></a></div>
<br />
<br />
<h3>
La procédure d'installation détaillée</h3>
<h4>
Démarrage de l'installateur</h4>
On commence par lancer l'installateur et<span style="font-family: "Courier New", Courier, monospace;"> </span>sélectionner les options suivantes:<br />
<ol>
<li>Install</li>
<li>Distribution Select: Vous pouvez décocher le «port tree», le <a href="http://ivoras.net/blog/tree/2012-07-26.pkgng---best-thing-since-sliced-bread!.html">fabuleux pkgng</a> boostrapable depuis la 9.1 rend caduque l'ancienne méthode de compilation des ports (et fini les portmaster/portupgrade)</li>
<li>Partitioning: Attention ! C'est là qu'il faut choisir «Shell»</li>
</ol>
<h4>
Partitionnement et chiffrage «en ligne de commande» du disque</h4>
Une fois dans le shell, afficher la liste des disques détecté<span style="font-family: inherit;">s</span> par le système:<br />
<br />
<span style="font-family: "Courier New", Courier, monospace;"># <b>sysctl kern.disks</b><br />kern.disks: ada0 cd0</span><span style="font-family: inherit;"> </span><br />
<br />
<span style="font-family: inherit;">Facile</span> ici, il n'y a que ada0 (cd0 étant le lecteur CD), on commence par le ré-initialiser et lui créer une table GPT (la MBR c'est pour les vieux):<br />
<br />
<span style="font-family: "Courier New", Courier, monospace;"># <b>gpart destroy -F ada0</b><br />gpart: arg0 'ada0': Invalid argument (si disque vide)<br />ou</span><br />
<span style="font-family: "Courier New", Courier, monospace;">ada0 destroyed (si table MBR/GPT déja présente) </span><br />
<span style="font-family: "Courier New", Courier, monospace;"># <b>gpart create -s gpt ada0</b><br />ada0 created</span><br />
<br />
<span style="font-family: inherit;">Créer la première partition (p1) contenant le boot-loader:</span><br />
<br />
<span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"># <b>gpart add -t freebsd-boot -s 64k -a 4k ada0</b><br />ada0p1 added<br /># <b>gpart bootcode -b /boot/pmbr -p /boot/gptboot -i 1 ada0</b><br />bootcode written to ada0</span> </span><br />
<br />
<span style="font-family: inherit;">Puis créer la deuxième (p2) de 1G qui va contenir le noyau:</span><br />
<br />
<span style="font-family: "Courier New",Courier,monospace;"># <b>gpart add -t freebsd-ufs -s 1G -l bootpart -a 4k ada0</b><br />ada0p2 added<br /># <b>newfs -j gpt/bootpart</b><br />gpt/bootpart: 1024.0MB (2097152 sectors) block size 32768, fragment size 4096<br /> using 4 cylinder groups of 256.03MB, 8193 blks, 32896 inodes.<br /> with soft updates<br />super-block backups (for fsck_ffs -b #) at:<br /> 192, 524544, 1048896, 1573248<br />newfs: Can't stat gpt/bootpart: No such file or directory<br />Using inode 4 in cg 0 for 8388608 byte journal<br />newfs: soft updates journaling set</span><br />
<span style="font-family: "Courier New", Courier, monospace;"><br /></span>
<span style="font-family: inherit;">Puis créer, initialiser le chiffrement (clé a 256bits, taille de secteur a 4k), attacher et formatter la troisième partition (p3) qui va contenir tout le reste.</span><br />
<span style="font-family: inherit;">En profiter pour charger votre drivers crypto (ici aesni car processeur Intel). </span><br />
<br />
<span style="font-family: "Courier New", Courier, monospace;"># <b>gpart add -t freebsd-ufs -l rootfs -a 4k ada0</b><br />ada0p3 added<br /># <b>kldload aesni</b><br />cryptosoft0: <software crypto> on motherboard</span><br />
<span style="font-family: "Courier New", Courier, monospace;">aesni0: <AES-CBC,AES-XTS> on motherboard</span><br />
<span style="font-family: "Courier New", Courier, monospace;"># <b>geli init -s 4096 -bl 256 gpt/rootfs</b><br />Enter new passphrase: <i>jemmerdeleBEFTI</i></span><span style="font-family: "Courier New", Courier, monospace;"><i>etOCLTIC</i> <br />Reenter new passphrase: <i>jemmerdeleBEFTIet</i></span><span style="font-family: "Courier New", Courier, monospace;"><i>OCLTIC</i><br /><br />Metadata backup can be found in /var/backups/gpt_rootfs.eli and<br />can be restored with the following command:<br /><br /> # geli restore /var/backups/gpt_rootfs.eli gpt/rootfs<br /># <b>geli attach gpt/rootfs</b><br />Enter passphrase:</span><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: "Courier New", Courier, monospace;"> <i>jemmerdeleBEFTIet</i></span></span><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: "Courier New", Courier, monospace;"><i>OCLTIC</i></span> <br />GEOM_ELI: Device gpt/rootfs.eli created.<br />GEOM_ELI: Encryption: AES-XTS 256<br />GEOM_ELI: Crypto: hardware<br /># <b>newfs -j gpt/rootfs.eli</b><br />gpt/rootfs.eli: 9215.9MB (18874168 sectors) block size 32768, fragment size 4096<br /> using 15 cylinder groups of 626.09MB, 20035 blks, 80256 inodes.<br /> with soft updates<br />super-block backups (for fsck_ffs -b #) at:<br /> 192, 1282432, 2564672, 3846912, 5129152, 6411392, 7693632, 8975872, 10258112,<br /> 11540352, 12822592, 14104832, 15387072, 16669312, 17951552<br />newfs: Can't stat gpt/rootfs.eli: No such file or directory<br />Using inode 4 in cg 0 for 33554432 byte journal<br />newfs: soft updates journaling set</span><br />
<br />
<span style="font-family: inherit;">Reste le montage de ces partitions au bon endroit avant de retourner à l'installateur:</span><br />
<br />
<span style="font-family: "Courier New", Courier, monospace;"># <b>mount /dev/gpt/rootfs.eli /mnt/</b><br /># <b>mkdir /mnt/bootpart</b><br /># <b>cd /mnt</b><br /># <b>ln -s bootpart/boot boot</b><br /># <b>mount /dev/gpt/bootpart /mnt/bootpart</b></span><br />
<span style="font-family: "Courier New", Courier, monospace;"># <b>mkdir bootpart/boot</b></span><br />
<span style="font-family: "Courier New", Courier, monospace;"><br /></span>
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;">Et quitter le shell pour revenir à l'installateur:</span></span><br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"># <b>exit</b></span></span></span><br />
<h4>
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><b>Retour à l'installateur</b></span></span></span></span><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><b> </b></span></span></span></span></h4>
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;">Terminer l'installation et la configuration réseau, timezone, services à activer<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><b>, </b>puis</span>:</span></span></span></span></span><br />
<ol>
<li><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;">Dumpdev Configuration: No, car il n'existe pas de partiton swap</span> <span style="font-family: inherit;">pour la récupérer</span></span></span></span></span></li>
<li><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;">Final Configuration: Exit</span></span></span></span></span></li>
<li><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;">Manual Configuration: Yes, pour lancer une dernière fois le shell avant de redémarrer la machine</span></span></span></span></span></li>
</ol>
<h4>
<span style="font-family: inherit;">Finalisation de la configuration par le shell</span></h4>
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;">On commence par vérifier que l'installation s'est correctement déroulée puis à configurer correctement le fichier boot/loader.conf:</span></span></span></span></span><br />
<br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"># <b>test -L boot </b></span></span></span></span><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><b>&& echo "ok" || echo "NOK !"</b><br />ok</span></span></span></span><br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"># <b>test -f bootpart/boot/loader && echo "ok" || echo "NOK !"</b><br />ok</span></span></span></span><br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"># <b>cat > boot/loader.conf <<EOF</b><br />> <b>geom_eli_load="YES"</b><br />> <b>aesni_load="YES"</b><br />> <b>vfs.root.mountfrom="ufs:/dev/ada0p3.eli"</b><br />> <b>EOF</b></span></span></span></span><br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><br /></span></span></span></span></span></span>
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;">Note: Ne pas essayer d'utiliser les label gpt pour le vfs.root.mountfrom car ça ne fonctionne pas.</span></span></span></span></span></span></span><br />
<br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;">Puis la génération du etc/fstab:</span></span></span></span></span></span></span><br />
<br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"># <b>cat > etc/fstab <<EOF</b><br />> <b>/dev/gpt/bootpart /bootpart ufs rw,noatime 1 1</b><br />> <b>/dev/gpt/rootfs.eli / ufs rw,noatime 1 1</b><br />> <b>EOF</b><span style="font-family: inherit;"> </span></span></span></span></span><br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><br /></span></span></span></span>
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;">On en profite aussi pour générer le mtree qui récupére l'emprunte sha256 de l'ensemble des fichiers de la partition /bootpart que vous stockerez sur votre partition chiffrée.</span></span></span></span></span><br />
<br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"># <b>cd /bootpart</b> </span></span></span></span></span></span><br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"># <b>mtree -x -ic -k sha256digest > /root/boot.mtree</b></span></span></span></span></span></span><br />
<br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"></span></span></span></span><br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"></span></span></span></span><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;">Et enfin quitter le shell et rebooter:</span></span></span></span></span><br />
<br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"># <b>quit</b> </span> </span></span></span></span></span><br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"></span> </span></span></span><br />
<h3>
Le démarrage</h3>
Désormais, au démarrage, pendant le chargement du noyau, s'affichera le message suivant puis il attendra votre mot de passe:<br />
<span style="font-family: "Courier New",Courier,monospace;">Enter passphrase for ada0p3: </span><br />
<br />
Note: Il arrive que cette phrase soit mélangée dans le dmesg et pas très visible. Il suffit alors de taper votre mot de passe quand le démarrage semble en pause.<br />
<br />
<h3>
<span style="font-family: inherit;">Pour les paranos</span></h3>
<span style="font-family: inherit;">Lors de l'étape de finalisation, juste avant le reboot, nous avons créé un fichier mtree.</span><br />
<span style="font-family: inherit;">Cette étape sert à vous protéger d'un vecteur d'attaque assez vicieux:</span><br />
<span style="font-family: inherit;"> Pour
obtenir votre mot de passe il est possible d'aller remplacer le noyau
(car stocké sur partition en clair) par un noyau modifié (qui
enregistrer votre mot de passe à votre insu).</span><br />
<span style="font-family: inherit;">Le
fait d'avoir stocké l'emprunte sha256 des fichiers en clair sur la partition chiffrée, et de vérifier leur cohérence après chaque démarrage
(un petit script fait très bien l'affaire) permet de limiter cette attaque.</span><br />
<span style="font-family: inherit;">Pour vérifier la cohérence des fichiers avec le mtree, c'est cette commande:</span><br />
<span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;"><span style="font-family: inherit;"><span style="font-family: inherit;"><span style="font-family: "Courier New", Courier, monospace;">mtree -f /root/boot.mtree -p /bootpart</span></span></span></span></span></span><br />
<span style="font-family: inherit;">S'il n'affiche rien: C'est bon signe :-)</span><br />
<br />
<h3>
<span style="font-family: inherit;">Sources</span></h3>
<span style="font-family: inherit;">Je me suis appuyé sur les deux articles suivants:</span><br />
<ul>
<li><a href="https://www.dan.me.uk/blog/2012/05/05/full-disk-encryption-in-freebsd-9-x-well-almost/"><span style="font-family: inherit;">Full disk encryption in FreeBSD 9.x (well, almost!)</span></a></li>
<li><a href="http://namor.userpage.fu-berlin.de/howto_fbsd9_encrypted_ufs.html"><span style="font-family: inherit;">Installing FreeBSD 9.0 with encrypted root fs (all ufs) </span></a></li>
</ul>
Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com2Notre-Dame-des-Landes, France47.381523 -1.71126947.338516500000004 -1.790233 47.4245295 -1.632305tag:blogger.com,1999:blog-12848403.post-29325590724590399882012-10-18T16:11:00.001+02:002012-10-19T15:57:46.606+02:00Using BCM4313 wireless chip under FreeBSDI've got a new laptop at $DAY-JOB, and this laptop have a BCM4313 chip:<br />
<br />
<span style="font-family: Courier New, Courier, monospace;"># pciconf -lv | grep Wireless</span><br />
<span style="font-family: Courier New, Courier, monospace;"> device = 'BCM4313 802.11b/g/n Wireless LAN Controller'</span><br />
<br />
I've first try with net/bwn-firmware-kmod and if_bwn without success, but NDIS works great (on 9.1-RC2 at last).<br />
Here here to proced for converting the Windows XP drivers to a kernel module:<br />
<span style="font-family: Courier New, Courier, monospace;"># cd /tmp</span><br />
<span style="font-family: Courier New, Courier, monospace;"># fetch http://gugus69.free.fr/freebsd/Broadcom_BCM43xx_5.100.235.19_win5x.tgz</span><br />
<span style="font-family: Courier New, Courier, monospace;"># tar xzvf Broadcom_BCM43xx_5.100.235.19_win5x.tgz</span><br />
<span style="font-family: Courier New, Courier, monospace;"># cd Broadcom_BCM43xx_5.100.235.19_win5x/</span><br />
<span style="font-family: Courier New, Courier, monospace;"># ndisgen</span><br />
<br />
Inside ndisgen, here is to proceed:<br />
<br />
<ol>
<li>Type 3 for "Convert driver"</li>
<li>INF Filename: bcmwl5.inf</li>
<li>SYS Filename: bcmwl564.sys (or bcmwl5.sys for FreeBSD-i386)</li>
<li>Firmware Files: kept empty</li>
</ol>
<br />
At the end, it should generated the bcmwl564_sys.ko module, now enable it:<br />
<span style="font-family: Courier New, Courier, monospace;"># cp bcmwl564_sys.ko /boot/modules/</span><br />
<span style="font-family: Courier New, Courier, monospace;"># kldload bcmwl564_sys</span><br />
<br />
<span style="font-family: Courier New, Courier, monospace;">ndis0: <broadcom 802.11n="802.11n" adapter="adapter" network="network"> mem 0xd4500000-0xd4503fff irq 19 at device 0.0 on pci36</broadcom></span><br />
<span style="font-family: Courier New, Courier, monospace;">ndis0: NDIS API version: 5.</span><br />
<br />
<br />
And check that you have a new ndis0 interface:<br />
<br />
<span style="font-family: Courier New, Courier, monospace;"># ifconfig | grep ndis</span><br />
<span style="font-family: Courier New, Courier, monospace;">ndis0: flags=8843<up> metric 0 mtu 2290</up></span><br />
<div>
<br /></div>
<div>
You can now configure your rc.conf like that</div>
<div>
<span style="font-family: Courier New, Courier, monospace;">kld_list='bcmwl564_sys'</span></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace;">wlans_ndis0="wlan0"</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace;">ifconfig_wlan0="WPA SYNCDHCP"</span></div>
</div>
<div>
<br /></div>
<br />
And enjoy !<br />
<br />Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-71793630918273566692012-09-09T01:03:00.001+02:002012-10-29T08:07:20.631+01:00FreeBSD kernel for Nintendo WiiFew months ago I've subsrcibed to the FreeBSD "<a href="http://lists.freebsd.org/mailman/listinfo/svn-src-head">svn-src-head</a>" mailing-list for being notified of <span style="background-color: white;">every change to the -current source tree.</span><br />
<span style="background-color: white;">And some weeks ago I've seen this message: </span><a href="http://lists.freebsd.org/pipermail/svn-src-head/2012-August/039685.html">Initial support for running FreeBSD on the Nintendo Wii</a>.<br />
<br />
<b>What ??? FreeBSD is going running on Wii ???</b><br />
<b><br /></b>
I've looked for more information and found a small page that explain how to build it on the wiki: <a href="http://wiki.freebsd.org/FreeBSD/Wii">FreeBSD/Wii</a>.<br />
The commit message includes an important detail: "There are still some MMU problems and to get a working system you need to patch locore32.S. Since we haven't found the best way yet to address that problem, we're not committing those changes yet."<br />
<br />
<div>
<ol>
<li>The -current code is incomplete, but meanwhile we can apply this <a href="http://gugus69.free.fr/freebsd/wii/locore32.diff">locore32.S</a> unofficial patch.</li>
<li>The result is not usable: You will not obtain a shell prompt, it will hang before.</li>
</ol>
</div>
<div>
Here is the video of the boot process:</div>
<div>
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen='allowfullscreen' webkitallowfullscreen='webkitallowfullscreen' mozallowfullscreen='mozallowfullscreen' width='320' height='266' src='https://www.youtube.com/embed/Tsh46zv3ckY?feature=player_embedded' frameborder='0'></iframe></div>
<div>
<br /></div>
<div>
<br /></div>
<div>
For building the kernel you need -current source tree, then the steps for building this kernel are pretty simple:</div>
<div>
<br /></div>
<div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">cd /usr/src</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">fetch http://gugus69.free.fr/freebsd/wii/locore32.diff</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">patch < locore32.diff</span></div>
<div>
<span style="font-family: 'Courier New', Courier, monospace; font-size: x-small;">mkdir /tmp/WII</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">setenv MAKEOBJDIRPREFIX /tmp/WII ; make TARGET=powerpc TARGET_ARCH=powerpc buildworld</span></div>
<div>
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">setenv MAKEOBJDIRPREFIX /tmp/WII ; make TARGET=powerpc TARGET_ARCH=powerpc KERNCONF=WII buildkernel</span></div>
<div>
<br /></div>
<div>
It will generate a kernel for WII here:</div>
<div>
/tmp/WII/powerpc.powerpc/usr/src/sys/WII/kernel</div>
<div>
<br /></div>
<div>
Then follow instructions from <a href="http://wiki.freebsd.org/FreeBSD/Wii">FreeBSD/wii wiki page</a> for setup the SD card.</div>
<div>
<br /></div>
<div>
You can download <a href="http://gugus69.free.fr/freebsd/wii/freebsd-wii.tar.xz">my own FreeBSD/Wii archive</a> (to be extracted on the root of your SD card).</div>
</div>
Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-25692703801194389852012-08-22T11:41:00.001+02:002012-08-22T11:41:44.635+02:00My home NAS: HP ProLiant MicroServerMy old NAS system was dying, I need to found a new one…<br />
Here is my new setup:<br />
<ul>
<li><a href="http://h10010.www1.hp.com/wwpc/us/en/sm/WF05a/15351-15351-4237916-4237918-4237917-4248009.html">HP ProLiant MicroServer</a> (using a <a href="http://hpmicroserver2011.tessimarketingservices.fr/">special 100€ french user cash back offer</a>, valid until the 31/10/2012)</li>
<ul>
<li>8 GB of ECC RAM</li>
<li>One 3.5 hard drive mounting bracket adapter for 5.25 inch bay (for the CD/DVD bay)</li>
<li>One SATA cable with right angle connector</li>
<li>5 SATA hard drives, 2TB each</li>
<li>A <a href="http://www.avforums.com/forums/networking-nas/1521657-hp-n36l-microserver-updated-ahci-bios-support.html">customized BIOS that unlock the SATA mode of the CD/DVD bay</a> (locked in PATA mode in the official BIOS)</li>
<li>A 2GB usb key (there is an USB connector inside the box)</li>
<li>A <a href="http://www.amazon.com/Micro-Server-Remote-Access-Car/dp/B0042AL4R2/ref=sr_1_1?ie=UTF8&qid=1345627815&sr=8-1">HP MicroServer remote access card</a> (not mandatory)</li>
</ul>
<li><a href="http://www.lian-li.com/v2/en/product/product06.php?pr_index=331&cl_index=2&sc_index=5&ss_index=13&g=f">Lian Li EX-50 Expension box</a></li>
<ul>
<li>5 SATA hard drives, 1TB each. They came from my old NAS.</li>
</ul>
</ul>
<div>
I've found lot's of advices regarding the setup of the HP MicroServer on <a href="http://www.tekforums.net/guides-projects/hp-proliant-microserver-purchase-upgrade-setup-guide/">TechForum</a>.<br />
Before installing <a href="http://www.freenas.org/">FreeNAS</a> on it, I'm playing with a small <a href="http://www.freebsd.org/">FreeBSD 9.0</a> installation on the USB key.<br />
FreeBSD was installed without any package neither the port-tree: I'm using <a href="http://wiki.freebsd.org/pkgng/">pkgng</a> with <a href="http://gugus69.free.fr/packages/9.0/amd64/server/">my own package repository</a> (thanks to <a href="http://blog.etoilebsd.net/post/Home_made_pkgng_repo">poudriere</a>).<br />
The only problem that I found, was to correctly disable moused: A simple <span style="font-family: Courier New, Courier, monospace;">moused_enable="NO"</span> in the <span style="font-family: Courier New, Courier, monospace;">/etc/rc.conf</span> is not enough, I need to add <span style="font-family: Courier New, Courier, monospace;">moused_ums0_enable="NO"</span> for disable it.<br />
I've create 2 raid-z pools: A first with the internal hard-drives, a second with the external drives.<br />
<br />
Now I've got lot's of disk space for my files:<br />
<div>
<br /></div>
<br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">[root@nas]/#zpool list</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">NAME SIZE ALLOC FREE CAP DEDUP HEALTH ALTROOT</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">estorage 4,53T 912K 4,53T 0% 1.00x ONLINE -</span><br />
<span style="font-family: Courier New, Courier, monospace; font-size: x-small;">storage 9,06T 6,56T 2,50T 72% 1.00x ONLINE -</span><br />
<div>
<br /></div>
<br />
<br /></div>
<div>
<br /></div>
<div>
<br /></div>
<br />
<br />Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-79647301640075731822012-03-19T13:39:00.000+01:002012-03-19T13:40:45.237+01:00OpenBSD 5.1 installation on softraid(4)OpenBSD 5.1 brings <a href="http://openbsd.org/plus51.html">new cool features</a> like this one:<br />
<br />
"<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=boot&manpath=OpenBSD%20Current&sektion=8&arch=amd64&format=html">boot(8/amd64)</a> is teached how to access <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=softraid&manpath=OpenBSD%20Current&sektion=4&format=html">softraid(4)</a>
volumes, which allows a kernel to be loaded from a softraid RAID 1
volume. Furthermore it is sufficient to only boot from a disk that is a
member of a bootable softraid volume, as this case will be detected and
the boot will automatically be redirected to <kbd>sr[0-9]a:/bsd</kbd>."<br />
<br />
This mean that the bootloader can boot directly from a softraid(4) partition: No more "standard" partitions needed with kernel copied on them on both hard drive!<br />
<br />
<br />
Here is how to proceed:<br />
During your CD-ROM boot, check that you have a minimum of 2 hard drives detected:<br />
<div style="border: 1pt solid windowtext; font-family: "Courier New",Courier,monospace; padding: 1pt 4pt;">
<div class="console">
CD-ROM: E0</div>
<div class="console">
Loading /5.1/AMD64/CDBOOT</div>
<div class="console">
probing: pc0 com0 mem[639K 126M a20=on]</div>
<div class="console">
disk: <span style="background: none repeat scroll 0% 0% yellow;">hd0+*
hd1+*</span> cd0</div>
<div class="console">
>> OpenBSD/amd64 CDBOOT 3.16</div>
<div class="console">
boot></div>
</div>
<br />
Continue the boot process and select to launch a shell:<br />
<br />
<br />
<div style="border: 1pt solid windowtext; font-family: "Courier New",Courier,monospace; padding: 1pt 4pt;">
<div class="console">
Welcome to the OpenBSD/amd64 5.1 installation program.</div>
<div class="console">
(I)nstall, (U)pgrade or (S)hell? <b style="mso-bidi-font-weight: normal;">s</b></div>
</div>
<br />
Display the names of the disks detected by OpenBSD:<br />
<br />
<br />
<div style="border: 1pt solid windowtext; font-family: "Courier New",Courier,monospace; padding: 1pt 4pt;">
<div class="console">
# <b style="mso-bidi-font-weight: normal;">sysctl hw.disknames</b></div>
<div class="console">
hw.disknames=wd0:7922594e8158ee03,wd1:49129150e28daf19,cd0:,rd0:7c8ac10ea613493f <b><br /></b></div>
</div>
<br />
On this example (Virtualbox VM), we've got 2 SATA hard-drives: wd0 and wd1 (cd0 is the CD-ROM and rd0 is the RAM drive created by the kernel). <br />
By default OpenBSD create only one /dev for the first hard drive, we need to create a second and initialize a MBR to them:<br />
<br />
<div style="border: 1pt solid windowtext; font-family: "Courier New",Courier,monospace; padding: 1pt 4pt;">
<div class="console">
# <b style="mso-bidi-font-weight: normal;">cd /dev/</b></div>
<div class="console">
# <b style="mso-bidi-font-weight: normal;">sh MAKEDEV wd1</b></div>
<div class="console">
# <b style="mso-bidi-font-weight: normal;">fdisk -iy wd0</b></div>
<div class="console">
Writing MBR at offset 0.</div>
<div class="console">
# <b style="mso-bidi-font-weight: normal;">fdisk -iy wd1</b></div>
<div class="console">
Writing MBR at offset 0.</div>
</div>
<br />
Now, we need to create a BSD label named "raid" to both disks.<br />
We will create a BSD label for the first drive, and dump/restore the label table to the second drive:<br />
<br />
<div style="border: solid windowtext 1.0pt; mso-border-alt: solid windowtext .5pt; mso-element: para-border-div; padding: 1.0pt 4.0pt 1.0pt 4.0pt;">
<div class="console" style="font-family: "Courier New",Courier,monospace;">
# <b style="mso-bidi-font-weight: normal;">disklabel -E wd0</b></div>
<div class="console" style="font-family: "Courier New",Courier,monospace;">
Label editor (enter '?' for help at any prompt)</div>
<div class="console">
<span style="font-family: "Courier New",Courier,monospace;">> </span><b style="font-family: "Courier New",Courier,monospace;">a a</b><br />
<span style="font-family: "Courier New",Courier,monospace;">offset: [64] </span><b style="font-family: "Courier New",Courier,monospace;"><enter></enter></b><br />
<span style="font-family: "Courier New",Courier,monospace;">size: [20964761] </span><b style="font-family: "Courier New",Courier,monospace;"><enter></enter></b><br />
<span style="font-family: "Courier New",Courier,monospace;">FS type: [4.2BSD] </span><b style="font-family: "Courier New",Courier,monospace;">raid</b><br />
<span style="font-family: "Courier New",Courier,monospace;">> </span><b style="font-family: "Courier New",Courier,monospace;">q</b><br />
<span style="font-family: "Courier New",Courier,monospace;">Write new label?: [y] </span><b style="font-family: "Courier New",Courier,monospace;"><enter></enter></b></div>
<div class="console" style="font-family: "Courier New",Courier,monospace;">
# <b>disklabel wd0 > protofile</b></div>
<div class="console">
<span style="font-family: "Courier New",Courier,monospace;"># <b>disklabel -R wd1 protofile</b></span></div>
</div>
<br />
<br />
Now we can create a softraid(4) volume using the two "a" partitions :<br />
<br />
<div style="border: solid windowtext 1.0pt; mso-border-alt: solid windowtext .5pt; mso-element: para-border-div; padding: 1.0pt 4.0pt 1.0pt 4.0pt;">
<div class="console">
</div>
<div class="console">
<b><span style="font-family: "Courier New",Courier,monospace;"># bioctl -c 1 -l wd0a,wd1a softraid0</span></b><span style="font-family: "Courier New",Courier,monospace;"> </span></div>
<div class="console">
<span style="font-family: "Courier New",Courier,monospace;">sd0 at scsibus1 targ 1 lun 0: <openbsd, 005="" 1,="" raid="" sr=""> SCSI2 0/direct fixed</openbsd,></span><br />
<span style="font-family: "Courier New",Courier,monospace;">sd0: 10236MB, 512 bytes/sector, 20964233 sectors</span><br />
<span style="font-family: "Courier New",Courier,monospace;">softraid0: SR RAID 1 volume attached as sd0 </span><b><br /></b></div>
</div>
<br />
This will create a new drive: sd0 in this example.<br />
Return back to the OpenBSD installer (Ctrl+D), and select this new softraid disk for the destination root disk:<br />
<br />
<div style="border: solid windowtext 1.0pt; mso-border-alt: solid windowtext .5pt; mso-element: para-border-div; padding: 1.0pt 4.0pt 1.0pt 4.0pt;">
<div class="console" style="font-family: "Courier New",Courier,monospace;">
# <b style="mso-bidi-font-weight: normal;">^D</b></div>
<div class="console" style="font-family: "Courier New",Courier,monospace;">
erase ^?, werase ^W, kill ^U, intr ^C, status ^T</div>
<div class="console" style="font-family: "Courier New",Courier,monospace;">
<br />
Welcome to the OpenBSD/amd64 5.1 installation program.<br />
(I)nstall, (U)pgrade or (S)hell? <b>i</b></div>
<div class="console" style="font-family: "Courier New",Courier,monospace;">
<br /></div>
<div class="console" style="font-family: "Courier New",Courier,monospace;">
(etc...)</div>
<div class="console" style="font-family: "Courier New",Courier,monospace;">
<br /></div>
<div class="console">
<span style="font-family: "Courier New",Courier,monospace;">Available disks are: wd0 wd1 sd0.</span><br />
<span style="font-family: "Courier New",Courier,monospace;">Which one is the root disk? (or 'done') [wd0] <b>sd0</b></span></div>
</div>
<br />
Once installed, simply reboot and enjoy: <br />
<br />
<br />
<div style="border: solid windowtext 1.0pt; mso-border-alt: solid windowtext .5pt; mso-element: para-border-div; padding: 1.0pt 4.0pt 1.0pt 4.0pt;">
<div style="font-family: "Courier New",Courier,monospace;">
>> OpenBSD/amd64 BOOT 3.18<br />
boot><br />
<span style="background-color: yellow;">booting sr0a:/bsd</span>: 5648376+1600524+932384+0+616448 [89+497880+322605]=0xd2d0a8<br />
entry point at 0x1001e0 [7205c766, 34000004, 24448b12, ccb8a304]</div>
<div style="font-family: "Courier New",Courier,monospace;">
(etc...)</div>
<span style="font-family: "Courier New",Courier,monospace;">sd0 at scsibus2 targ 1 lun 0: <openbsd, 005="" 1,="" raid="" sr=""> SCSI2 0/direct fixed</openbsd,></span><br />
<span style="font-family: "Courier New",Courier,monospace;">sd0: 10236MB, 512 bytes/sector, 20964233 sectors</span><br />
<span style="font-family: "Courier New",Courier,monospace;">root on sd0a (f7748118e1f577a4.a) swap on sd0b dump on sd0b</span><br />
<span style="font-family: "Courier New",Courier,monospace;">Automatic boot in progress: starting file system checks.</span><br />
<span style="font-family: "Courier New",Courier,monospace;">(etc...)</span></div>
<br />
<br />
<br />
<br />Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-12350180793108627512012-01-28T11:48:00.001+01:002013-11-03T13:49:58.001+01:00Installing Samsung ML-2950 series printer drivers on FreeBSDI've just replaced my inkjet printer with a laser one (Samsung ML-2955ND: Netword and Duplex).<br />
Samsung <a href="http://www.samsung.com/us/support/downloads/black-and-white-laser-printers/ML-2955ND/XAA">provide drivers for lot's of OS</a> (HP-UX, IBM AIX, GNU/Linux, MacOSX, etc…) but nothing for FreeBSD :-(<br />
<br />
Hopefully the GNU/Linux drivers is CUPS based and use standard PPD file… But with a binary only cups-filter.<br />
I didn't know if it was possible to use the Linux emulation layer of FreeBSD for using this cups-filter, but a <a href="http://www.opennet.ru/tips/info/1869.shtml">previous experience was successful</a>, then I try it too.<br />
<br />
<br />
The major idea is to:<br />
<br />
<ol>
<li>Install print/cups</li>
<li>Enable and install the <a href="http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/linuxemu.html">FreeBSD Linux binary compatibility</a></li>
<li>Getting the <a href="http://www.samsung.com/us/support/owners/product/ML-2955ND/XAA">Samsung Unified drivers for the ML-2950 series</a></li>
<li>Extracting the PPD file and the i386 binary cups-filter used by the PPD</li>
<li>Fixing the missing dependency needed by the samsung cups-filter</li>
</ol>
<br />
I will not explain the steps 1,2 and 3.<br />
<br />
Extract the Unified Linux Drivers:<br />
<span style="font-family: 'Courier New',Courier,monospace;">$ <b>tar zxvf ULD_Linux_V1.00.06.tar.gz</b></span><br />
<br />
Then check the filter used by the PPD file:<br />
<br />
<span style="font-family: 'Courier New',Courier,monospace;">$ </span><b><span style="font-family: 'Courier New',Courier,monospace;">grep cupsFilter uld/noarch/share/ppd/Samsung_ML-2950_Series.ppd</span></b><br />
<span style="font-family: 'Courier New',Courier,monospace;">*cupsFilter: "application/vnd.cups-raster 0 rastertospl"</span><br />
<div>
<br /></div>
<div>
=> This PPD file use the "rastertospl" filter.</div>
<div>
<br /></div>
<br />
Now copy the PPD and the Samsung cups-filter to the local cups directories:<br />
<span style="font-family: 'Courier New',Courier,monospace;">$ <b>mkdir /usr/local/share/cups/model/samsung</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;">$ </span><b style="font-family: 'Courier New', Courier, monospace;">cp uld/noarch/share/ppd/Samsung_ML-2950_Series.ppd/usr/local/share/cups/model/samsung/</b><br />
<span style="font-family: 'Courier New',Courier,monospace;">$ </span><b style="font-family: 'Courier New', Courier, monospace;">cp uld/i386/rastertospl /usr/local/libexec/cups/filter/</b><br />
<br />
Once copied, you can execute rastertosamsungspl from a CLI for displaying the missing Linux libs:<br />
<br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>/usr/local/libexec/cups/filter/rastertospl</b> </span><br />
<span style="font-family: 'Courier New',Courier,monospace;">/usr/local/libexec/cups/filter/rastertosamsungspl: error while loading shared libraries: libcups.so.2: cannot open shared object file: No such file or directory</span><br />
<br />
There are two method here:<br />
<br />
The first and easiest is simply to install <span style="font-family: Courier New, Courier, monospace;">print/linux-f10-cups-libs</span>. It should install all dependency needed by the crappy Samsung binary filter (Thanks Patrick for this tips!)<br />
<br />
The second, a lot's more complex, and that add lot's of file not managed by the FreeBSD package manager is to check for missing libs one by one: You need to install the missing libs, running a ldconfig and re-execute rastertosamsungspl for discovering that another libs is missing.<br />
Here is the list of all libs that I've installed:<br />
<span style="font-family: 'Courier New', Courier, monospace;"># </span><b style="font-family: 'Courier New', Courier, monospace;">cd /tmp</b><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>fetch http://archives.fedoraproject.org/pub/archive/fedora/linux/releases/10/Everything/i386/os/Packages/cups-libs-1.3.9-2.fc10.i386.rpm</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>fetch http://archives.fedoraproject.org/pub/archive/fedora/linux/releases/10/Everything/i386/os/Packages/gnutls-2.4.2-2.fc10.i386.rpm</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>fetch http://archives.fedoraproject.org/pub/archive/fedora/linux/releases/10/Everything/i386/os/Packages/libtasn1-1.5-1.fc10.i386.rpm</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>fetch http://archives.fedoraproject.org/pub/archive/fedora/linux/releases/10/Everything/i386/os/Packages/libgcrypt-1.4.3-2.fc10.i386.rpm</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>fetch http://archives.fedoraproject.org/pub/archive/fedora/linux/releases/10/Everything/i386/os/Packages/libgpg-error-1.6-2.i386.rpm</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>cd /compat/linux</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>rpm2cpio /tmp/cups-libs-1.3.9-2.fc10.i386.rpm | tar -zxf -</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>rpm2cpio /tmp/gnutls-2.4.2-2.fc10.i386.rpm | tar -zxf -</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>rpm2cpio /tmp/libtasn1-1.5-1.fc10.i386.rpm | tar -zxf -</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>rpm2cpio /tmp/libgcrypt-1.4.3-2.fc10.i386.rpm | tar -zxf -</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>rpm2cpio /tmp/libgpg-error-1.6-2.i386.rpm | tar -zxf -</b></span><br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>/compat/linux/sbin/ldconfig</b></span><br />
<br />
<br />
Once all dependencies are installed, you should have this message when executing rastertosamsungspl:<br />
<br />
<span style="font-family: 'Courier New',Courier,monospace;"># <b>/usr/local/libexec/cups/filter/rastertosamsungspl</b> </span><br />
<span style="font-family: 'Courier New',Courier,monospace;">INFO: Usage: rastertosamsungspl job-id user title copies options [file]</span><br />
<span style="font-family: 'Courier New',Courier,monospace;">ERROR: Wrong number of arguments</span><br />
<br />
Now you can add your printer from the CUPS admin panel and use it :-)<br />
<br />Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com2tag:blogger.com,1999:blog-12848403.post-30522072364049577522011-10-05T16:19:00.000+02:002011-10-06T16:09:24.852+02:00BSD Router Project: Version 1.0 disponibleCela faisait plusieurs mois qu'il n'y avait pas eu de nouvelle version de ce <a href="http://bsdrp.net/fr/bsdrp">routeur libre</a>: <a href="http://bsdrp.net/fr/downloads">C'est corrigé depuis cette nuit</a>.<br />
Et comme j'ai passé pas mal de temps à <a href="http://bsdrp.net/documentation/examples/maximum_bsdrp_features_lab">le tester dans tous les sens</a>, je me suis dit que cette version méritait finallement de passer directement en 1.0.<br />
J'ai par contre découvert une grosse limitation concernant la protection des protocoles de routages IPv6 sous FreeBSD (RIPng et OSPFv3): Ces protocoles n'incluent plus leur propre mécanismes de sécurité mais les délèguent à la couche IPSec d'IPv6. Cela veux dire que nous devons passer par <a href="http://www.freebsd.org/cgi/man.cgi?query=setkey&apropos=0&sektion=0&manpath=FreeBSD+8.2-RELEASE&arch=default&format=html">setkey(8)</a> pour configurer des SAD/SPD manuels les protégeant.… <a href="http://lists.freebsd.org/pipermail/freebsd-net/2011-September/029899.html">Or la couche IPSec de FreeBSD ne sait pas gérer les adresses multicast</a> et l'usage du multicast est très courant en IPv6 (RIPng et OSPFv3 l'utilisent). Cette limitation est assez bloquante car elle ne permet pas d'avoir le même niveau de protection des réseaux RIP/OSPF en IPv6 qu'en IPv4 sous FreeBSD.<br />
<br />
J'ai aussi amélioré <a href="http://bsdrp.net/fr/documentation/examples/how_to_build_a_bsdrp_router_lab">les scripts VirtualBox (PowerShell et Shell) permettant de lancer les labs virtuels facilement</a> pour qu'ils prennent en charge les fonctionnalités de linked-type-clone et Page Fusion: Le gain en ressource pour la machine hôte est impressionnant!<br />
Par exemple sur le <a href="http://bsdrp.net/documentation/examples/bgp_route_reflector_and_confederation_using_quagga_and_bird">lab BGP route reflector/confederation</a> qui nécessite le lancement de 7 routeurs, donc 7 VMs (avec 128Mo de RAM et 256Mo de disque alloué à chacune):<br />
<ul>
<li>La fonctionnalité «linked-type-clone» permet de ne consommer que 153Mo d'espace disque pour l'ensemble des VMs: Le template de référence utilise 80Mo et chacun des clones 10Mo.</li>
<li>La fonctionnalité «Page Fusion», elle, permet de ne consommer que 112Mo de RAM pour l'ensemble des VMs (environ 16Mo par VM).</li>
</ul>
Pour la suite, va falloir que je travaille un système de centralisation/gestion des configurations et pourquoi pas permettre le pre-provisionning des configurations pour du déploiement grande échelle.Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-52230525930117849922011-08-29T08:37:00.000+02:002011-08-29T08:37:19.046+02:00Pourquoi ne jamais utiliser iperf sur FreeBSDJ'ai enfin eu le temps de remonter mon petit lab pour faire <a href="http://bsdrp.net/documentation/examples/network_performance_tuning_on_low-end_hardware">quelques tests de performance réseaux avec BSDRP:</a><br />
<ul><li>Un <a href="http://pcengines.ch/wrap1e203.htm">PC Engines wrap1e203</a>, qui va me servir de routeur (Geode à 233Mhz)</li>
<li>Deux clients léger HP Compaq T5000 (Transmeta Crusoe à 800Mhz)</li>
<li>Un switch gigabit</li>
</ul>L'avantage d'utiliser des vieilles machines FastEthernet est qu'elles sont plus faciles à saturer que des nouvelles supportant le gigabit. <br />
Avant de tester les perfs de routage du WRAP, j'ai commencé par noter ma valeur de référence, en mesurant les perfs réseaux maximum des HP Compaq T5000.<br />
Pour cela il existe plusieurs logiciels, le plus connus étant iperf. Mais sur les différentes mailing-list FreeBSD, j'ai souvent lus que iperf «ça pue car codé par des linuxiens et donc incapable d'utiliser le pleins potentiel de FreeBSD».<br />
Dans le doute, j'ai donc aussi utilisé netblast (les sources sont cachées dans /usr/src/tools/tools/netrate/netblast, et il n'est pas installé par défaut).<br />
D'ailleur <a href="http://lists.freebsd.org/pipermail/freebsd-sparc64/2011-August/008019.html">concernant netblast sur sparc64: Il faut le patcher</a> pour corriger un problème d'alignement.<br />
Bref, lancons nos tests (en UDP et avec les tailles de paquet au max), et voici les résultats:<br />
<ul><li>iperf: 60Mbit/s</li>
<li>netblast : 80Mbit/s</li>
</ul>Le verdict est sans appel en faveur de netblast! <br />
Et après avoir activé le polling, j'ai pus monter jusqu’à 92Mbit/s: On arrive presque au 100Mbit/s de leur carte réseaux… Pas mal du tout pour ces petites bêtes. Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-3000473985912862122011-08-28T00:45:00.000+02:002011-08-28T00:45:49.354+02:00Backporting Intel PRO/Wireless 6205a FreeBSD 9.0 modules to 8.2My old professionnal Dell Latitude D630 laptop was replaced by a new Dell Latitude E5420… and this new one have a wireless chipset not supported on FreeBSD 8.2:<br />
<br />
<div style="font-family: "Courier New",Courier,monospace;">[root@laptop]~#dmesg | grep iwn<br />
iwn0: <Intel(R) PRO/Wireless 6205a> mem 0xe5300000-0xe5301fff irq 17 at device 0.0 on pci2 <br />
0xe5300000-0xe5301fff irq 17 at device 0.0 on pci2<br />
iwn0: MIMO 2T2R, MoW, address a0:88:b4:7d:40:9c<br />
iwn0: [ITHREAD]<br />
iwn0: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps<br />
iwn0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps<br />
iwn0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps<br />
iwn6005fw: could not load firmware image, error 2<br />
iwn0: iwn_read_firmware: could not load firmare image "iwn6005fw"<br />
iwn0: iwn_init_locked: could not read firmware, error 22<br />
<br />
</div><br />
<br />
But, this new chipset is supported on FreeBSD-current, then I've <a href="http://gugus69.free.fr/tools/FreeBSD-8.2-iwn-current.tgz">backported it to 8.2</a>.<br />
I had to do 3 small changes in if_iwn.c file : One function name to revert (pci_find_cap to pci_find_extcap), and remove 2 lines (use of ic_rxstream and ic_txstream).<br />
You can install this drivers like this:<br />
<br />
<div style="font-family: "Courier New",Courier,monospace;">cd /tmp</div><div style="font-family: "Courier New",Courier,monospace;">fetch http://gugus69.free.fr/tools/FreeBSD-8.2-iwn-current.tgz</div><div style="font-family: "Courier New",Courier,monospace;">cd /</div><div style="font-family: "Courier New",Courier,monospace;">tar zxvf /tmp/FreeBSD-8.2-iwn-current.tgz</div><div style="font-family: "Courier New",Courier,monospace;">cd /usr/src</div><div style="font-family: "Courier New",Courier,monospace;">make buildkernel</div><div style="font-family: "Courier New",Courier,monospace;">make installkernel</div><div style="font-family: "Courier New",Courier,monospace;">reboot</div><br />
I've tested Internet browsing and small files transfert with this drivers without problem.Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-56218538145402718562011-08-14T03:09:00.003+02:002011-08-25T11:06:56.092+02:00Creating and starting VirtualBox machine with PowerShell<a href="http://bsdrp.net/">BSD Router Project</a> provided a <a href="http://bsdrp.net/documentation/examples/how_to_build_a_bsdrp_router_lab">VBScript for starting MS Windows based virtualbox lab</a>. But because this vbs script works only on XP, I had to found a more powerful solution: Why not discovering PowerShell and using the <a href="http://www.virtualbox.org/sdkref/index.html">VirtualBox COM API</a> ?<br />
I didn't found very detailed examples, then here is a PowerShell script that explains how to create, configure and start a VirtualBox Machine.<br />
The goal is:<br />
<ol><li>Create a VM (OS type: FreeBSD_64)</li>
<li>Configure it (with a serial port that redirect to a pipe)</li>
<li>Convert a unzipped<a href="http://bsdrp.net/downloads"> BSDRP-full-amd64-vga disk image file</a> to a VDI file, and attach this VDI to the VM</li>
<li>Start the VM</li>
</ol>And here are the big steps of this script:<br />
<ol><li>Initialize the COM API</li>
<li>Create the VM</li>
<li>Configure the VM (excluding attaching medium to it)</li>
<li>Save and register the VM</li>
<li>Convert a RAW file to VDI (using VBoxManage.exe) and registering it</li>
<li>Lock the VM in write mode for attaching the medium</li>
<li>Launch the VM </li>
</ol>Now the PowerShell code sample:<br />
<br />
<a name='more'></a><br />
<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;">#<br />
# VirtualBox COM API PowerShell sample script<br />
# Example for BSD Router Project (http://bsdrp.net)<br />
<br />
$erroractionpreference = "Stop"<br />
<br />
#### Declaring enumeration types ######<br />
# PowerShell can't import type library from a COM Object<br />
# http://msdn.microsoft.com/en-us/library/hh228154.aspx<br />
# Need to copy/write all enums type used in this script<br />
# You can use the official API doc:<br />
# http://www.virtualbox.org/sdkref/index.html<br />
# Or extracting values with oleview.exe<br />
<br />
#StorageBus<br />
$StorageBus_IDE = 1<br />
$StorageBus_SATA = 2<br />
$StorageBus_SCSI = 3<br />
$StorageBus_Floppy = 4<br />
$StorageBus_SAS = 5<br />
<br />
#StorageControllerType<br />
$StorageControllerType_LsiLogic = 1<br />
$StorageControllerType_BusLogic = 2<br />
$StorageControllerType_IntelAhci = 3<br />
$StorageControllerType_PIIX3 = 4<br />
$StorageControllerType_PIIX4 = 5<br />
$StorageControllerType_ICH6 = 6<br />
$StorageControllerType_I82078 = 7<br />
$StorageControllerType_LsiLogicSas = 8<br />
<br />
#DeviceType<br />
$DeviceType_Null = 0<br />
$DeviceType_Floppy = 1<br />
$DeviceType_DVD = 2<br />
$DeviceType_HardDisk = 3<br />
$DeviceType_Network = 4<br />
$DeviceType_USB = 5<br />
$DeviceType_SharedFolder = 6<br />
<br />
#AccessMode<br />
$AccessMode_ReadOnly = 1<br />
$AccessMode_ReadWrite = 2<br />
<br />
#LockType<br />
$LockType_Write = 2<br />
$LockType_Shared = 1<br />
<br />
#PortMode (serial)<br />
$PortMode_Disconnected = 0<br />
$PortMode_HostPipe = 1<br />
$PortMode_HostDevice = 2<br />
$PortMode_RawFile = 3<br />
<br />
#### Scripts Variables #####<br />
<br />
#Machine name<br />
$MACHINE_NAME="BSDRP_template"<br />
<br />
#OS type<br />
$MACHINE_ARCH="FreeBSD_64"<br />
<br />
#Raw image disk filename<br />
$RAW_FILE="C:\BSDRP_0.35_full_amd64_vga.img"<br />
<br />
### Here we go<br />
<br />
write-host "First step: initialize the COM API"<br />
<br />
# Initialize the main VirtualBox COM Object<br />
$VIRTUALBOX = New-Object -ComObject VirtualBox.VirtualBox<br />
<br />
write-host "Second step: Create the VM"<br />
<br />
# Create VM<br />
$MACHINE=$VIRTUALBOX.createMachine("",$MACHINE_NAME,$MACHINE_ARCH,"",$false)<br />
#As the new machine will not be registered, it's in mutable (modifiable) status<br />
<br />
Write-Host "Third step: Configuring the VM (excluding attaching medium to it)"<br />
<br />
# Configure the VM<br />
$MACHINE.MemorySize=128<br />
$MACHINE.VRAMSize=6<br />
$MACHINE.Description="BSD Router Project - Template VM"<br />
$MACHINE.setBootOrder(1,$DeviceType_HardDisk)<br />
$MACHINE.setBootOrder(2,$DeviceType_Null)<br />
$MACHINE.setBootOrder(3,$DeviceType_Null)<br />
$MACHINE.setBootOrder(4,$DeviceType_Null)<br />
<br />
# Serial port<br />
# Link the VM serial port to a pipe into the host<br />
# You can connect, from the host, to the serial port of the VM <br />
$MACHINE_SERIAL=$MACHINE.getSerialPort(0)<br />
$MACHINE_SERIAL.path="\\.\pipe\$MACHINE_NAME"<br />
$MACHINE_SERIAL.hostMode=$PortMode_HostPipe<br />
$MACHINE_SERIAL.server=$true<br />
$MACHINE_SERIAL.enabled=$true<br />
<br />
# Adding a disk controller<br />
$MACHINE_CTRL=$MACHINE.addStorageController("SATA Controller",$StorageBus_SATA)<br />
<br />
write-host "Forth step: Saving and registering the VM"<br />
<br />
# Configure the disk controller<br />
$MACHINE_CTRL.portCount=1<br />
<br />
# Save settings<br />
$MACHINE.saveSettings()<br />
<br />
# Need to register the VM (mandatory before attaching a disk to it)<br />
# But registering the VM will change it's state to un-mutable !<br />
$VIRTUALBOX.registerMachine($MACHINE)<br />
<br />
write-host "Fifth step: Registering a VDI"<br />
<br />
# Convert a raw image disk to VDI using VBoxManage.exe<br />
$VDI_FILE=$VIRTUALBOX.SystemProperties.DefaultMachineFolder + "\$MACHINE_NAME\$MACHINE_NAME.vdi"<br />
<br />
# Call external command VBoxManage.exe for converting the given RAW .img to VDI<br />
# Need to add quote to the command string<br />
$VB_MANAGE ='"' + $env:VBOX_INSTALL_PATH + "VBoxManage.exe" + '"'<br />
$CMD="convertfromraw " + '"' + $RAW_FILE +'" "' + $VDI_FILE + '"'<br />
<br />
$erroractionpreference = "silentlycontinue"<br />
invoke-expression "& $VB_MANAGE $CMD"<br />
$erroractionpreference = "Stop"<br />
<br />
# Register the VDI (Mandatory before attaching it to a VM)<br />
$MEDIUM=$VIRTUALBOX.openMedium($VDI_FILE,$DeviceType_HardDisk,$AccessMode_ReadWrite,$true)<br />
<br />
# (optional) Compact the VDI (and create a process object for following the process)<br />
$PROGRESS=$MEDIUM.compact()<br />
<br />
# Wait for end of compacting the VDI...<br />
$PROGRESS.waitForCompletion(-1)<br />
<br />
Write-Host "Sixth step: Unlock the VM in write mode for attaching the medium"<br />
<br />
# Need to unclock the VM (put it in "mutable" state) before modifying it<br />
# (More I'm discovering the complexity of VirtualBox, more I love qemu !)<br />
# We need to lock the MACHINE in Write mode, and use a SESSION for that<br />
<br />
# Initialize VirtualBox Session object<br />
$SESSION = New-Object -ComObject VirtualBox.Session <br />
<br />
# Now lock the machine using the SESSION object<br />
# This will create a new SESSION.machine object <br />
$MACHINE.lockMachine($SESSION,$LockType_Write)<br />
<br />
# Waring: MACHINE is still in un-mutable state,<br />
# but there is a copy of MACHINE, called SESSION.MACHINE that is in mutable state.<br />
<br />
# Attach the disk to the mutable state machine (SESSION.machine)<br />
$SESSION.machine.attachDevice("SATA Controller",0,0,$DeviceType_HardDisk,$MEDIUM)<br />
<br />
# Save new settings... but still on SESSION.machine<br />
$SESSION.machine.saveSettings()<br />
<br />
# Unlock the machine<br />
$SESSION.unlockMachine()<br />
<br />
write-host "seventh step: Launch the VM"<br />
# Launch VM in GUI mode<br />
$PROGRESS=$MACHINE.launchVMProcess($SESSION,"gui","")<br />
<br />
# Wait for launching process of the VM<br />
$PROGRESS.waitForCompletion(-1)<br />
<br />
Write-Host "Machine started:"<br />
Write-Host " - Graphical console: On the VirtualBox Window"<br />
write-host " - Serial port: Configure your putty/kitty to connect to:"<br />
write-host " serial serial line: \\.\pipe\</span></span><span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;">$MACHINE_NAME</span></span><span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;">"<br />
write-host " baud : 115200"<br />
Write-Host "Press a key to continue"<br />
$x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")</span></span><br />
<br />
You can found a more complex examples (using VboxHeadless, linked clones, etc…) by looking at the <a href="http://bsdrp.svn.sourceforge.net/viewvc/bsdrp/trunk/tools/BSDRP-lab-vbox.ps1">BSDRP VirtualBox Lab PowerShell srcipt</a>.<span style="font-size: small;"><span style="font-family: "Courier New",Courier,monospace;"> </span></span>Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-46443738397672799592011-03-21T17:42:00.001+01:002011-03-22T11:49:05.540+01:00Serveur NFS v4 avec FreeBSDNFS v4 possède quelques avantages bien sympa: En plus de la possibilité de s'appuyer sur kerberos, il utilise un seul port TCP (très pratique lorsqu'il se trouve derrière un firewall).<br />
Cet exemple montre sa mise en place, et les problèmes rencontrés pour un fonctionnement sans l'authentification kerberos avec FreeBSD (8.1 et 8.2).<br />
On commence par lire <a href="http://www.freebsd.org/cgi/man.cgi?query=nfsv4&apropos=0&sektion=0&manpath=FreeBSD+8.2-RELEASE&format=html">nfsv4(4)</a>, qui nous indique que pour activer le serveur NFS v4 il faut:<br />
<br />
1. Ajouter 3 lignes dans le /etc/rc.conf:<br />
<div style="margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px;"><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">nfs_server_enable="YES"</span></div><div style="margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px;"><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">nfsv4_server_enable="YES"</span></div><div style="margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px;"><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">nfsuserd_enable="YES"</span></div><div style="margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px;"><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><br />
</span></div>2. Créer un fichier nfs-stablerestart (en root):<br />
<br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">install -o root -g wheel -m 600 /dev/null /var/db/nfs-stablerestart</b></span><br />
<br />
Maintenant on passe à la lecture du <a href="http://www.freebsd.org/cgi/man.cgi?query=exports&apropos=0&sektion=0&manpath=FreeBSD+8.2-RELEASE&format=html">exports(5)</a> qui, pour NFS v4 est un peu plus complexe.<br />
Mon but est de partager le dossier /home/olivier en lecture seule, le fichier exports se résume donc à 2 lignes:<br />
<span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">V4: /</span><br />
<span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">/home/olivier -ro 127.0.0.1</span><br />
<br />
Puis je lance les services:<br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">/etc/rc.d/nfsd start</b></span><br />
<span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">Starting mountd.</span><br />
<span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">Starting nfsd.</span><br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"></span><br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><span class="Apple-style-span" style="background-color: #eeeeee;"><b>/etc/rc.d/nfsuserd start</b></span></span><br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><span class="Apple-style-span" style="background-color: #eeeeee;">Starting nfsuserd.</span></span><br />
<br />
<div><br />
Aucun message d'erreur, ça semble bon, maintenant affichons la liste des exports:</div><div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">showmount -e</b></span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">Exports list on localhost:</span></div></div><div><br />
</div><div>Rien :-(<br />
Et aucun message dans les logs indiquant une erreur dans le fichier exports.</div><div><br />
</div><div>On va quand même essayer:</div><div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">mount -o nfsv4 localhost:/home/olivier /mnt/</b></span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">nfsv4 err=10029</span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">mount_nfs: /mnt, : Input/output error</span></div></div><div><br />
</div><div>Le message d'erreur le plus intéressant ici est le «nfsv4 err=10029», je n'ai pas trouvé grand chose sur le net concernant ce message, sauf une petite note dans le <a href="http://tools.ietf.org/html/draft-ietf-nfsv4-minorversion1-26#section-15.1.2.8">draft nfsv4</a>:<br />
<br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">NFS4ERR_SYMLINK (Error Code 10029)</b></span><br />
<span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">The current filehandle designates a symbolic link when the current operation does not allow a symbolic link as the target.</span><br />
<br />
Je n'avais pas fait attention à un détail du exports(5):</div><div>«<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;">The pathnames must not have any symbolic links in them</span>»</div><div><br />
Et sur FreeBSD le dossier /home est un lien symbolique qui pointe sur /usr/home.</div><div>On corrige donc le fichier /etc/exports:</div><div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">V4: /</span></div><div><span class="Apple-style-span" style="background-color: #eeeeee;"><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;">/usr/home/olivier -ro 127.0.0.</span></span><span class="Apple-style-span" style="background-color: #eeeeee;">1</span></div></div><div><br />
</div><div>Et on demande à mountd de charger ce nouveau fichier:</div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">/etc/rc.d/mountd reload</b></span></div><div><br />
</div><div>Vérifions si c'est mieux </div><div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">showmount -e</b></span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">Exports list on localhost:</span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">/usr/home/olivier 127.0.0.1</span></div></div><div><br />
</div><div>Cool, maintenant je vais pouvoir le monter (en localhost pour débuter):<br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">mount -o nfsv4 localhost:/usr/home/olivier /mnt/</b></span><br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;"></b></span><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">mount | grep olivier</b></span><br />
<span class="Apple-style-span" style="background-color: #eeeeee;"><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b></b></span><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;">localhost:/usr/home/olivier on /mnt (newnfs)</span></span><br />
<br />
<div><br />
</div><div>Parfait, maintenant on liste les fichiers sur du dossier /mnt</div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">ls /mnt/</b></span></div><div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">ls: /mnt/: Input/output error</span></div></div><div><br />
</div><div>Bon, ça ne fonctionne toujours pas :-(</div><div>Qu'est que ce bordel ?</div><div>Voici la commande qui donne un indice sur ce problème:</div><div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace; font-size: x-small;"><b style="background-color: #eeeeee;">netstat -a | grep nfsd</b></span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace; font-size: x-small;">tcp6 0 0 localhost.nfsd localhost.18082 ESTABLISHED</span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace; font-size: x-small;">tcp6 0 0 localhost.18082 localhost.nfsd ESTABLISHED</span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace; font-size: x-small;">tcp6 0 0 localhost.621 localhost.nfsd TIME_WAIT</span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace; font-size: x-small;">tcp6 0 0 *.nfsd *.* LISTEN</span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace; font-size: x-small;">tcp4 0 0 *.nfsd *.* LISTEN</span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace; font-size: x-small;">udp6 0 0 *.nfsd *.*</span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace; font-size: x-small;">udp4 0 0 *.nfsd *.*</span></div></div><div><br />
</div><div>Et oui, je n'ai autorisé que l'IP 127.0.0.1 à accéder à mon partage dans mon /etc/exports, et la commande mount localhost a utilisé l'IPv6 localhost (::1) pour s'y connecter.</div><div>On va donc forcer un montage en utilisant la pile IPv4:</div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">umount /mnt/</b></span></div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">mount -t nfs -o nfsv4 127.0.0.1:/usr/home/olivier /mnt/</b></span></div><div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b style="background-color: #eeeeee;">ls /mnt</b></span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">.complete .mailrc </span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">.cshrc .profile </span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">.history .rhosts </span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">.lesshst .shrc </span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">.lftp .ssh </span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">.login .viminfo </span></div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><span class="Apple-style-span" style="background-color: #eeeeee;">.login_conf .vimrc </span> </span> </div></div><div><br />
</div><div>Enfin, cela fonctionne en local :-)</div><div>Comme je veux le monter aussi en IPv6, j'ajoute donc ::1 à ma liste d'IP autorisées:</div><div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">V4: /</span></div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">/usr/home/olivier -ro 127.0.0.1 ::1</span></div></div><div><br />
</div><div>Maintenant que le montage local IPv4/IPv6 fonctionne, on édite le /etc/exports pour y autoriser les subnets du LAN:</div><div><div><span class="Apple-style-span" style="background-color: #eeeeee; font-family: 'Courier New',Courier,monospace;">V4: /</span></div><div><span class="Apple-style-span"></span><br />
<div style="font-family: 'Courier New', Courier, monospace;"><span class="Apple-style-span"><span class="Apple-style-span" style="background-color: #eeeeee;">/usr/home/olivier -ro -network 2a01:e35:aaaa:aaaa::/64</span></span></div><div style="font-family: 'Courier New', Courier, monospace;"><span class="Apple-style-span"><span class="Apple-style-span" style="background-color: #eeeeee;">/usr/home/olivier -ro -network 192.168.100.0</span></span></div><div><div style="font-family: 'Courier New', Courier, monospace;"><span class="Apple-style-span"><span class="Apple-style-span" style="background-color: white;"><br />
</span></span></div><div><span class="Apple-style-span"><span class="Apple-style-span" style="background-color: white; font-family: inherit;">Puis on recharge mountd et vérifie que le fichier exports a été correctement interprété:</span></span></div><div style="font-family: 'Courier New', Courier, monospace;"><span class="Apple-style-span"><b style="background-color: #eeeeee;">/etc/rc.d/mountd reload</b></span></div><div style="font-family: 'Courier New', Courier, monospace;"><span class="Apple-style-span"><b style="background-color: #eeeeee;">showmount -e</b></span></div><div style="font-family: 'Courier New', Courier, monospace;"><span class="Apple-style-span"><span class="Apple-style-span" style="background-color: #eeeeee;">Exports list on localhost:</span></span></div><div style="font-family: 'Courier New', Courier, monospace;"><span class="Apple-style-span"><span class="Apple-style-span" style="background-color: #eeeeee;">/usr/home/olivier 2a01:e35:aaaa:aaaa:: 192.168.100.0</span></span></div></div></div></div><div><br />
</div><div><i>Note concernant un client sous Linux, l</i><i>a syntaxe de la commande mount est la suivante:</i></div><div><span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;">mount -t nfs4 server-name:/usr/home/olivier/ /mnt</span></div><div><br />
</div><div>Donc, à noter pour la configuration NFS v4:</div><div><ol><li>Ne pas oublier de créer le fichier /var/db/nfs-stablerestart</li>
<li>Ne pas déclarer de chemin utilisant des liens symboliques dans le fichier exports</li>
<li>Si <span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><b>showmount -e</b></span> n'indique rien suite au rechargement de mountd, ce n'est pas la peine de continuer</li>
<li>Attention aux doubles piles IPv4/IPv6, n'oubliez pas de déclarer aussi les IPv6 dans votre exports</li>
<li>Ce n'est pas parce que le montage s'effectue que vous êtes autorisé</li>
</ol></div></div>Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-5019269877976080222011-03-13T21:26:00.009+01:002011-09-02T07:37:24.176+02:00FreeBSD packages generator <i> </i><br />
<i><b>Update (8 april 2011): There is a best method detailled <a href="http://blog.etoilebsd.net/post/En_attendant_pkgng">here</a> (in french)</b></i><br />
<br />
Using up-to-date ports on my old workstations became more and more painful (more than 8 hours for compiling the latest LibreOffice).<br />
Then I've decided to use my brand new server (used for generating <a href="http://bsdrp.net/">BSD Router Project images</a> and running <a href="http://bsdrp.net/documentation/examples">BSDRP routing labs</a> using virtualbox) as a FreeBSD packages generator.<br />
But I've faced to a problem with the "make package-recursive" command on FreeBSD:<br />
The port needs to be installed before generating the package! And I didn't want to install useless programs (xorg, hal, etc…) on my server.<br />
Then I've wrote small ugly script that:<br />
<br />
<ol>
<li>Generate a full new freebsd in a working dir (downloading FreeBSD base, src and lib32 sets).</li>
<li>Update the local port tree</li>
<li>Launch a chrooted portmaster into the working dir for generating the packages.</li>
</ol>
<br />
This script, <a href="http://gugus69.free.fr/packages/package_gen.sh">package_gen.sh</a>, is to be use like that:<br />
<br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><span class="Apple-style-span" style="font-size: x-small;">Package generator usage:<br />
./package_gen.sh COMMAND [familly/port-name] [build-option]<br />
Where COMMAND can be:<br />
generate [familly/port-name] [build-option]<br />
upgrade [port-name] [build-option]<br />
replace familly/port-name familly/port-name<br />
delete [familly/port-name]<br />
examples:<br />
./package_gen.sh generate sysutils/tmux : Generate tmux package<br />
./package_gen.sh generate editors/vim-lite -DWITHOUT_X11 : Generate vim-lite package without X11 stuffs<br />
./package_gen.sh generate editors/libreoffice LOCALIZED_LANG=fr : Generate french libreoffice<br />
./package_gen.sh upgrade : Upgrade all packages previously generated<br />
./package_gen.sh delete editors/vim-lite : Delete vim-lite<br />
</span></span><br />
<div>
<br /></div>
<div>
All generated packages are in /usr/ports/packages.</div>
<br />
Once generated or upgraded, I upload them onto a web server using a small <a href="http://lftp.yar.ru/">lftp</a> script (-f option):<br />
<br />
<br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;"><span class="Apple-style-span" style="font-size: x-small;"> set ftp:list-options -a<br />
set cmd:fail-exit true<br />
debug -o /home/USER/lftp_debug.log 3<br />
open -p 21 LOGIN:PASS@ftpperso.free.fr<br />
cd /packages/8.2/amd64/Latest<br />
lcd /usr/ports/packages/Latest<br />
mirror -eRL --only-newer --parallel=2 --verbose=4<br />
cd /packages/8.2/amd64/All<br />
lcd /usr/ports/packages/All<br />
mirror -eRL --only-newer --parallel=2 --verbose=4<br />
quit<br />
</span></span><br />
<div>
<br /></div>
<div>
This lftp script replaces symbolic links found in /usr/ports/packages by the real file.</div>
Now, from my workstations, I can install up-to-date ported software with this command:<br />
<br />
<span class="Apple-style-span" style="font-family: 'Courier New',Courier,monospace;">env PACKAGESITE=http://gugus69.free.fr/packages/8.2/amd64/Latest/ pkg_add -r openjdk6</span><br />
<br />
<span class="Apple-style-span" style="font-family: inherit;">You can use <a href="http://gugus69.free.fr/packages/8.2/amd64/">this package repository</a> freely. I will try to kept it online (if my ISP accept this uses) and up-to-date.</span><br />
<span class="Apple-style-span" style="font-family: inherit;">But here are some information about theses packages:</span><br />
<ul>
<li>FreeBSD amd64 8.2 only</li>
<li>www/firefox-i8n include only french language pack</li>
<li>emulators/qemu with kqemu support and GNS3 patch</li>
<li>java/jdk16 is compiled with IPv6 enabled</li>
</ul>
<br />
<span class="Apple-style-span" style="font-family: inherit;"><br />
</span>Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0tag:blogger.com,1999:blog-12848403.post-27444447765904575212011-02-11T18:27:00.000+01:002011-02-11T18:27:14.046+01:00How to enable receiving UDP syslog message on UbuntuAfter loosing lot's of my precious time, here is how to enable receiving remote syslog message on a Ubuntu server 10.04 LTS:<br />
<br />
<ol><li>Create a new file in /etc/rsyslog.d/ and call it udp_server as example:</li>
<ul><li><span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;"><b>vim /etc/rsyslog.d/udp_server</b></span></li>
</ul><li>Add these 2 lines:</li>
<ul><li><span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">$ModLoad imudp</span></li>
<li><span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">$UDPServerRun 514</span></li>
</ul><li>Restart rsyslog: <span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;"><b>sudo service rsyslog restart</b></span></li>
<li>Check that it's working:</li>
<ul><li><span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">echo "FreeBSD rocks!" | nc -w0 -u 127.0.0.1 514</span></li>
<li><span class="Apple-style-span" style="font-family: 'Courier New', Courier, monospace;">sudo tail /var/log/messages</span></li>
</ul></ol><br />
Don't modify the file /etc/rsyslog.conf, it's not used at all !<br />
<div><br />
</div>Olivier Cochard-Labbéhttp://www.blogger.com/profile/08901361095735842069noreply@blogger.com0