Call for testing: netmap on 20.7

[binaryanomaly]

By design 20.7-BETA does not include anything but development packages.

Ok so this means that testing sensei with 20.7 will only be possible once sunnyvalley provides the respective working development package for sensei?

[mb]

Can you try once more?

Code Select Expand

pkg install os-sensei

[binaryanomaly]

Not working but no surprise because according to Franco:

By design 20.7-BETA does not include anything but development packages.

Code Select Expand


root@OPNsense-DEV:~ # pkg install os-sensei
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
pkg: No packages available to install matching 'os-sensei' have been found in the repositories
root@OPNsense-DEV:~ # pkg install os-sensei-devel
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
pkg: No packages available to install matching 'os-sensei-devel' have been found in the repositories
root@OPNsense-DEV:~ #
root@OPNsense-DEV:~ # pkg install os-sunnyvalley
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
pkg: No packages available to install matching 'os-sunnyvalley' have been found in the repositories


That explains why the production release can't be installed.

Further installing the Development packages fails:

Code Select Expand


root@OPNsense-DEV:~ # pkg install os-sunnyvalley-devel
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking integrity... done (0 conflicting)
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
os-sunnyvalley-devel: 1.2

Number of packages to be installed: 1

Proceed with this action? [y/N]: y
[1/1] Installing os-sunnyvalley-devel-1.2...
[1/1] Extracting os-sunnyvalley-devel-1.2: 100%
root@OPNsense-DEV:~ # pkg update
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating SunnyValley repository catalogue...
Fetching meta.txz: 100%    948 B   1.0kB/s    00:01
Fetching packagesite.txz: 100%   12 KiB  12.0kB/s    00:01
Processing entries:   0%
pkg: wrong architecture: FreeBSD:11:* instead of FreeBSD:12:amd64
pkg: repository SunnyValley contains packages with wrong ABI: FreeBSD:11:*
Processing entries: 100%
Unable to update repository SunnyValley
Error updating repositories!


Guess you need to fix this first

pkg: wrong architecture: FreeBSD:11:* instead of FreeBSD:12:amd64
pkg: repository SunnyValley contains packages with wrong ABI: FreeBSD:11:*

[mb]

Got it, sorry about that. It looks like out team tried the 20.7 through upgrading via UI.

Give us a few days and we'll ship 12.x packages.

In the meantime, you can also test Suricata if you like.

[binaryanomaly]

No problem. Keep us posted.

I'll start re-routing some client traffic once I can replicate the prod setup and achieve the same level of control and protection - so I'll wait for the update.

[ruggerio]

The development branch doesnt upgrade OS yet. You have to install via ISO or IMG

Did i get this correct? 20.7 in devel branch via GUI is not yet the same as the downloadable iso?

As i have a pc-engines apu4, i disabled suricata, i just got on 75mbps. Just tried it now (on 20.7 devel branch, not the iso) and got up to 140 mbps. CPU-Load is about 50% whilst 2 gb download

btw. using aho-corasick "Ken Steele variant"

Thx!
Ruggerio

[franco]

20.7 development exists on HBSD 11.2 via 20.1 and also on HBSD 12.1 via 20.7-BETA.

The difference is the underlying operating system depending on what image you installed indeed. It gives us the extra opportunity to test core changes independently from the OS update. :)


Cheers,
Franco

[ruggerio]

20.7 development exists on HBSD 11.2 via 20.1 and also on HBSD 12.1 via 20.7-BETA.

The difference is the underlying operating system depending on what image you installed indeed. It gives us the extra opportunity to test core changes independently from the OS update. :)


Cheers,
Franco

Ahaaaaa  :) this means, i just profited from suricata 5 and not from the mentionned netmap-bufixing, isn't it? the new netmap-thingy is just in the iso, not in the devel-branch from 20.1.

Thx!

[franco]

Yep. :)

[ruggerio]

Hi,

OK, changing firewall back zu ISO, updating to Beta .108 - but not finding "Ken Steele variant" in Suricata, as it is in 1.7 Devel-Branch.

[franco]

Please, slow down. We have not published a new 20.7-BETA snapshot yet with the latest packages...

[ruggerio]

 ;) thx for information.

[mb]

Sensei packages for OPNsense 20.7 (amd64/OpenSSL) is out and available for testing.

If you test OPNsense 20.7, as a bonus, you get to access to the latest Sensei (1.5.1.rc1) which is yet to be released ;)

PS: Make sure you update to the latest 20.7 beta after the ISO installation, since latest 20.7 includes some important patches with regard to interface drivers. Kernel should read 12.1-RELEASE-p5 or later:

12.1-RELEASE-p5-HBSD FreeBSD 12.1-RELEASE-p5-HBSD #0  d8b850736ba(master)-dirty

[binaryanomaly]

Works now 👍🏻

[mb]

Perfect.

This is the first one we'll be fixing:

1. If you have VLANs on em(4), you cannot have em(4) parent interface for Suricata/Sensei. https://github.com/luigirizzo/netmap/issues/703.

Anyone out there experiencing the  same problem with other drivers (igb, ix, ixl, and.... vtnet?)