Topics

Hi,
what's the recommended way to stop services using configd? Keeping in mind, that rc script refuse to work if the corresponding service is not enabled, simply executing /usr/local/etc/rc.d/<service> stop is not sufficient.

In the Proxy plugin is was done by calling killall squid after trying to execute the rc.d/squid stop, but why did you actually use killall to "stop" squid instead of executing /usr/local/etc/rc.d/squid onestop? Is there a side-effect in using the "onestop" action? I'd say a completely clean mechanism should not kill all instances, but should only kill the instance stored in the service's pid-file...

Also for querying the service status, maybe using "onestatus" instead of "status" would allow recognizing e.g. a hanging or still running process, even the service has already been disabled. Right now if the service is not enabled, OPNsense always assumes that the process behind the service is not running, which is fact is not always the case.

Thanks,
Manuel

Are there any coding guidelines for OPNsense? The forked pfsense code does not seem to have any guidelines (e.g. indents vary in tabs and spaces, single if statements used with and without curly braces, etc.)... Currently the code is a mix between different coding styles, it seems.

If one adds code to existing files, should the style of the file being adopted, or is there a OPNsense recommendation to apply? Shall existing files be adopted to a consistent style in future?

I really like the new menu structure, which e.g. unifies the DHCP Relay and the DHCP Server. But is there a specific reason, why the different DNS services were not put together into one sub-menu? I guess the DNS Filter, DNS Forwarder, DNS Resolver, and maybe even the Dynamic DNS services might go into one DNS menu, which then has sub items for Filter, Forwarder, Resolver, and Dynamic DNS.

The IPsec tunnel settings (see attachment) has six columns for each P1 entry: IKE, Remote Gateway, Mode, P1 Protocol, P1 Transforms, and P1 Description. I don't understand the columns P1 Protocol and P1 Transforms:
The P1 Protocol column shows the P1 encryption algorithm, why the name P1 Protocol? The column P1 Transforms should show the P1 authenticity algorithm (but currently it does not show it, I guess due to a bug?), but typically I know the term proposal as a combination of all cryptographic algorithms and settings, so I personally would expect e.g. "AES (128 bits), SHA-256" in the P1 Proposal column.

Maybe the P1 Protocol column should show something regarding the chose key material, like PSK or RSA? But then, still a better name should be chosen... ;)

The nano image (OPNsense-15.7.18-OpenSSL-nano-i386.img) is actullay 3999997952 bytes in size, while my 4GB Kingston CF card holds 3997163520 bytes. Interestingly I've a second 4GB CF from Transcend, which holds 4009549824 bytes.

I have no idea if there is a well defined definition for "4GB", but actually I guess I'm not the only one with a CF smaller than the nano image. What does the third slice of the image actually hold? Is there any important data in the last 50MB?

Is there any difference between the nano images and the other images manually configured to use a ramdisk for /var and /tmp? Does the nano image use redundant partitions on the storage media, or so?

I've a IPsec phase 1 entry with three phase 2 entries. Only the first in the list is being established. At the other endpoint I cannot even see OPNsense trying to establish the other P2's. If I swap the P2 entries (just order, no config), the new first P2 entry is being established.

The /usr/local/etc/ipsec.conf file contains all endpoints as configured via the GUI, namely con1-000 up to con1-002. In the IPsec logs i found:

Nov 29 10:30:22    ipsec_starter[87595]: 'con1-001' routed
Nov 29 10:30:22    ipsec_starter[87595]: 'con1-000' routed
Nov 29 10:30:21    ipsec_starter[87595]: configuration 'con1-001' not found
Nov 29 10:30:21    ipsec_starter[87595]: configuration 'con1-000' unrouted

I'm not so deep into charon, which log levels should I raise to get more info on that issue?

I use OPNsense 15.7.18_1-i386 (willing to upgrade to unstable if this would help investigations).