openvpn icon indicating copy to clipboard operation
openvpn copied to clipboard

support freebsd's fib feature

Open cnbatch opened this issue 1 year ago • 7 comments

This patch is to support FreeBSD's FIB feature.

When using FreeBSD's setfib command to launch OpenVPN in other FIB (routing table), the interface's IP address was not added to correct routing table, and then the routing entries couldn't be added successfully: https://forums.freebsd.org/threads/freebsd-14-and-route-in-non-zero-fib.91099/ https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=278295

This is duo to ifconfig command does not retrieve FIB number of current envirnment which is set by setfib. It only accepts fib N parameter. route command can retrieve FIB number of current envirnment, the following routing entries will be added to correct routing table. But if the interface's IP address was not added correct routing table, route command will fail.

cnbatch avatar May 07 '24 18:05 cnbatch

I am wondewring if the ifconfig behaviour is intended behaviour or if we working around a bug in ifconfig here in OpenVPN.

schwabe avatar May 08 '24 10:05 schwabe

There are also build failures related to macOS.

schwabe avatar May 08 '24 11:05 schwabe

There are also build failures related to macOS.

Yeah, these are related to the code that was not moved correctly.

flichtenheld avatar May 08 '24 11:05 flichtenheld

Sorry, it seems I misunderstood earlier. This doesn't appear to be a FreeBSD bug but rather a requirement of ifconfig. According to FreeBSD's documentation, if a FIB number needs to be specified, it must be explicitly stated it in ifconfig; otherwise, the default FIB (main route table) will be used: https://man.freebsd.org/cgi/man.cgi?ifconfig

fib	fib_number
	       Specify interface FIB.  A FIB fib_number	 is  assigned  to  all
	       frames  or  packets received on that interface.	The FIB	is not
	       inherited, e.g.,	vlans or other sub-interfaces will use the de-
	       fault FIB (0) irrespective of the parent	interface's FIB.   The
	       kernel  needs  to be tuned to support more than the default FIB
	       using the  ROUTETABLES  kernel  configuration  option,  or  the
	       net.fibs	tunable.

cnbatch avatar Sep 01 '24 07:09 cnbatch