Issues w/ .13 so far

Issues w/ .13 so far

[Stefan G. Weichinger]

[-- Attachment #1: Type: text/plain, Size: 1219 bytes --]


greets, I am new to this list, afai see my issues weren't mentioned
before, so I think they aren't FAQ ;-)

Both seem to be WebGUI-issues. I installed from scratch onto CF-card,
running on an older ALIX board. Restored my backup pulled from the
former 2.11 core 62 installation.

My DHCP-setup seemed to be there, but didn't work ... fixed leases were
visible but didn't get pulled by the devices (laptop, tablet, phone).

Maybe I should have rebooted once more (I think I did anyway ...), will
retest after writing this mail.

Additional: tried to re-add a fixed lease via GUI. I usually want to say
"add fixed lease for this MAC currently using a dynamic lease" ... then
MAC and IP are "copied" into the field "Neue Zuordnung", I normally edit
the IP (and description), then ADD.

Now the dynamic lease gets added to the fixed lease before, so the MAC
is already there and ADDing fails.

(minor issue aside: typo in german dhcp.gi: "Globaler Bereich oder
begenze Bereich" ... should be "begrenze")

-

With IPSEC I had the case of mismatching display: connected tunnels
seemed disactivated and vice versa, see attachment. Right now it looks
ok. Will retest w/ other tunnels soon.

Greets, Stefan (rebooting now)

Re: Issues w/ .13 so far

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1276 bytes --]

Hey Stefan,

On Wed, 2012-09-12 at 19:07 +0200, Stefan G. Weichinger wrote:
> My DHCP-setup seemed to be there, but didn't work ... fixed leases were
> visible but didn't get pulled by the devices (laptop, tablet, phone).

Please hit the save button on the DHCP page one more time, sometimes the
settings are not completely restored after a backup. That's because we
need to regenerate the configuration files.

> Additional: tried to re-add a fixed lease via GUI. I usually want to say
> "add fixed lease for this MAC currently using a dynamic lease" ... then
> MAC and IP are "copied" into the field "Neue Zuordnung", I normally edit
> the IP (and description), then ADD.
> 
> Now the dynamic lease gets added to the fixed lease before, so the MAC
> is already there and ADDing fails.

This should also be the same in IPFire 2.11 because dhcp.cgi has not
been touched in ages.

> With IPSEC I had the case of mismatching display: connected tunnels
> seemed disactivated and vice versa, see attachment. Right now it looks
> ok. Will retest w/ other tunnels soon.

Couldn't find the attachment, but I guess I know what you mean. Could
you please provide the output of "ipsec status" when the display error
is happening?

Also, does anything change when you refresh?

Michael

Re: Issues w/ .13 so far

[Stefan G. Weichinger]

[-- Attachment #1: Type: text/plain, Size: 988 bytes --]

Am 12.09.2012 19:58, schrieb Michael Tremer:

> Couldn't find the attachment, but I guess I know what you mean. Could
> you please provide the output of "ipsec status" when the display error
> is happening?
> 
> Also, does anything change when you refresh?

I have it right now.

One tunnel active, but shown as "GETRENNT" (should we write in german?
;-) ).

# ipsec status
Security Associations (0 up, 0 connecting):
  none

This was after stopping another tunnel via GUI.

Refresh or clicking "IPSEC" in the GUI doesn't change things.


When I check off "Aktiviert" (-> not set, disabled) and "Speichern" ...
it comes back with "Aktiviert" set -> enabled.

And now magically after another Refresh that one tunnel is GREEN again.


# ipsec status
Security Associations (1 up, 0 connecting):
       tunnel[1]: ESTABLISHED 92 seconds ago, 213.xxx[...... *SECRET
       tunnel{1}:  INSTALLED, TUNNEL, ESP SPIs: c68b5716_i 2c8fbcf4_o
       tunnel{1}:   172.31.98.0/24 === 10.1.1.0/20

S

Re: Issues w/ .13 so far

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1335 bytes --]

On Wed, 2012-09-12 at 20:29 +0200, Stefan G. Weichinger wrote:
> Am 12.09.2012 19:58, schrieb Michael Tremer:
> 
> > Couldn't find the attachment, but I guess I know what you mean. Could
> > you please provide the output of "ipsec status" when the display error
> > is happening?
> > 
> > Also, does anything change when you refresh?
> 
> I have it right now.
> 
> One tunnel active, but shown as "GETRENNT" (should we write in german?
> ;-) ).
> 
> # ipsec status
> Security Associations (0 up, 0 connecting):
>   none
> 
> This was after stopping another tunnel via GUI.
> 
> Refresh or clicking "IPSEC" in the GUI doesn't change things.
> 
> 
> When I check off "Aktiviert" (-> not set, disabled) and "Speichern" ...
> it comes back with "Aktiviert" set -> enabled.
> 
> And now magically after another Refresh that one tunnel is GREEN again.
> 
> 
> # ipsec status
> Security Associations (1 up, 0 connecting):
>        tunnel[1]: ESTABLISHED 92 seconds ago, 213.xxx[...... *SECRET
>        tunnel{1}:  INSTALLED, TUNNEL, ESP SPIs: c68b5716_i 2c8fbcf4_o
>        tunnel{1}:   172.31.98.0/24 === 10.1.1.0/20

It's hard to keep track of what you are doing.

So, when the connection should be disabled, it is still functioning? Or
is it not functioning (as it is supposed), but the WUI is showing a
wrong connection status?

Michael

Re: Issues w/ .13 so far

[Stefan G. Weichinger]

[-- Attachment #1: Type: text/plain, Size: 1524 bytes --]

Am 12.09.2012 19:58, schrieb Michael Tremer:

> Please hit the save button on the DHCP page one more time, sometimes
> the settings are not completely restored after a backup. That's
> because we need to regenerate the configuration files.

I assumed something like that, yes ... seems to work now ... will
monitor ...

>> Now the dynamic lease gets added to the fixed lease before, so the
>> MAC is already there and ADDing fails.
> 
> This should also be the same in IPFire 2.11 because dhcp.cgi has not 
> been touched in ages.

It was the first time I saw this issue. And I had to change my usual
procedure (not a real problem).

Maybe some mismatch because of the not yet so regenerated config-files?
(see above)

>> With IPSEC I had the case of mismatching display: connected
>> tunnels seemed disactivated and vice versa, see attachment. Right
>> now it looks ok. Will retest w/ other tunnels soon.
> 
> Couldn't find the attachment, but I guess I know what you mean.

Yep, forgot the pic. You saw it on twitter today.

> Could you please provide the output of "ipsec status" when the
> display error is happening?

Will do as soon as I hit it again?

> Also, does anything change when you refresh?

In the situation back then it didn't change. I will see if it happens
again or if I can reproduce by starting and stopping tunnels.

Stefan

ps: regarding this mailing list:

Why do the headers of the mailing-list-mails not contain a "List-Id" ? I
use that for server-based filtering with other lists. Very handy ...

Re: Issues w/ .13 so far

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 385 bytes --]

Sorry for the delay.

On Wed, 2012-09-12 at 20:21 +0200, Stefan G. Weichinger wrote:
> ps: regarding this mailing list:
> 
> Why do the headers of the mailing-list-mails not contain a "List-Id" ? I
> use that for server-based filtering with other lists. Very handy ...

I don't know. Does mailman support "List-Id"? RFC-2369 headers are
enabled, so I guess that will include List-Id.

Re: Issues w/ .13 so far

[Stefan G. Weichinger]

[-- Attachment #1: Type: text/plain, Size: 579 bytes --]

Am 17.09.2012 21:58, schrieb Michael Tremer:
> Sorry for the delay.
> 
> On Wed, 2012-09-12 at 20:21 +0200, Stefan G. Weichinger wrote:
>> ps: regarding this mailing list:
>>
>> Why do the headers of the mailing-list-mails not contain a "List-Id" ? I
>> use that for server-based filtering with other lists. Very handy ...
> 
> I don't know. Does mailman support "List-Id"? RFC-2369 headers are
> enabled, so I guess that will include List-Id.

I don't see/find it (even in your latest mail now).
But I can also filter for "Organization: IPFire.org", no problem.

Thanks, Stefan

Re: Issues w/ .13 so far

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 813 bytes --]

I had a look at an older email, which had these headers...

Restarted mailman and disabled -> enabled the RFC 2369 option.

Let's see...

On Mon, 2012-09-17 at 22:00 +0200, Stefan G. Weichinger wrote:
> Am 17.09.2012 21:58, schrieb Michael Tremer:
> > Sorry for the delay.
> > 
> > On Wed, 2012-09-12 at 20:21 +0200, Stefan G. Weichinger wrote:
> >> ps: regarding this mailing list:
> >>
> >> Why do the headers of the mailing-list-mails not contain a "List-Id" ? I
> >> use that for server-based filtering with other lists. Very handy ...
> > 
> > I don't know. Does mailman support "List-Id"? RFC-2369 headers are
> > enabled, so I guess that will include List-Id.
> 
> I don't see/find it (even in your latest mail now).
> But I can also filter for "Organization: IPFire.org", no problem.
> 
> Thanks, Stefan

Re: Issues w/ .13 so far

[Stefan G. Weichinger]

[-- Attachment #1: Type: text/plain, Size: 358 bytes --]

Am 17.09.2012 22:09, schrieb Michael Tremer:
> I had a look at an older email, which had these headers...
> 
> Restarted mailman and disabled -> enabled the RFC 2369 option.
> 
> Let's see...

I don't see it :-)

As mentioned: I can filter for other header-info.

AFAI know mailman is capable to provide that info, as I use it for many
other lists.

Stefan

Re: Issues w/ .13 so far

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 516 bytes --]

The email I just wrote came with the correct set of headers.

On Mon, 2012-09-17 at 22:13 +0200, Stefan G. Weichinger wrote:
> Am 17.09.2012 22:09, schrieb Michael Tremer:
> > I had a look at an older email, which had these headers...
> > 
> > Restarted mailman and disabled -> enabled the RFC 2369 option.
> > 
> > Let's see...
> 
> I don't see it :-)
> 
> As mentioned: I can filter for other header-info.
> 
> AFAI know mailman is capable to provide that info, as I use it for many
> other lists.
> 
> Stefan
> 

Re: Issues w/ .13 so far

[Stefan G. Weichinger]

[-- Attachment #1: Type: text/plain, Size: 552 bytes --]

Am 17.09.2012 22:15, schrieb Michael Tremer:
> The email I just wrote came with the correct set of headers.

THIS one? --^

I still don't see it here ... (thunderbird, showing "Quelltext" .. using
"find").

Ah, you CC: me, maybe I always look at those "direct" mails.

YES

checked your mail "openvpn broken in 13" .. contains List-Id.

Solved.

I just wonder why I only get the CC-mails and not the other copy to the
list.

Pls only reply to the list now, and remove the CC: ("best practise"
anyway for ml, I follow this now as well).

Thanks, Stefan

Re: Issues w/ .13 so far

[Stefan G. Weichinger]

[-- Attachment #1: Type: text/plain, Size: 388 bytes --]


DHCP:

I still see this behavior:

Even when there are fixed leases stored (my tablet should always get the
same IP) the device pulls an IP out of the range for dynamic leases.

I have repeatedly stored stuff via WebGUI ...

How to make the dhcpd-server forget about the currently assigned dynamic
leases?

It would be nice to add a button for this ... "forget dynamic lease(s)"

Stefan

Re: Issues w/ .13 so far

[Stefan G. Weichinger]

[-- Attachment #1: Type: text/plain, Size: 211 bytes --]

Am 19.09.2012 12:44, schrieb Stefan G. Weichinger:

> How to make the dhcpd-server forget about the currently assigned dynamic
> leases?

removed and recreated /var/state/dhcp/dhcpd.leases ... looks OK for now.