From: openbsd@systemfailure.net Subject: Re: [UPDATE] net/i2pd: update to 2.61.0 To: David Uhden Collado ,ports@openbsd.org Cc: lucas@sexy.is,stu@spacehopper.org,andrew@kloet.net,sonya@i2pmail.org Date: Fri, 24 Jul 2026 18:06:01 +0000 Hi, As far as I understand, the recent pledge/unveil commits in i2pd are mostly pointless (doing almost nothing), but also mostly harmless (introducing only very minor regressions). Andrew has submitted a pull request [1] and opened a discussion [2] on i2pd's Github repo. I hope this will solve the problem. But we don't know if Andrew's patches will be accepted upstream and how long it will take. In the meantime, I would be in favor of updating the i2pd port anyway, as is. On the one hand, this new version introduced 2 small regressions : - MTU discovery for SSU2 packets doesn't work anymore - i2pd doesn't run as a non-standard user or using non-standard file paths Honestly, I don't know how serious the first issue is, but in all my tests, i2pd continued to work fine with the default MTU. The second issue is unlikely to affect most users. i2pd still runs fine when launched with the provided rc script (ie. with 'rcctl start i2pd'). On the other hand, there are benefits to not delaying the update even more: - versions 2.60.0 and 2.61.0 provide bug fixes and new features - we would at last be able to move the port from using /var/lib/i2pd to /var/i2pd ("at last" because we're discussing this for months) - and also to resolve other issues raised by David and Stuart At least, provided we clearly inform users about the changes and known regressions. Re: the user intervention required by the move from /var/lib to /var, I agree with Stuart that it's risky to try to automate that entirely. David, I appreciate your efforts, but unfortunately your script is not enough to ensure a complete migration. As you know, the _i2pd user has a new home directory, and in my tests, if this user is not recreated, i2pd will somehow "insist" on writing files to the old directory (/var/lib/i2pd), even with and updated configuration, and crash. Moreover, you're right that .dat files must be moved to the new directory, but it's better if all other files are moved along them (long story short, i2pd will run if other files are missing, but it'll lose information about the network). Please find attached a patch that updates i2pd to the latest release, with a README explaining how to update the package and warning them about the small regressions. Most of this patch is based on David's latest proposal. It applies cleanly, with that the port builds and runs fine, with all tests passing. My idea is that we'll be in a better position to incorporate or just even test pledge/unveil changes after the port is updated. Best regards. -- [1] https://github.com/PurpleI2P/i2pd/pull/2436 [2] https://github.com/PurpleI2P/i2pd/issues/2435 On Wednesday, July 22nd, 2026 at 6:16 PM, David Uhden Collado wrote: > Stuart Henderson wrote: > > When I say "user review" I mean "actual review of the changes that it > > intends to make", not "is it ok if I do some stuff as root from a shell > > script that I'm not going to show you first" > > Hello Stuart, > > You are right. My previous use of @ask-update only described the > migration and asked for permission to proceed; it did not allow the user > to review each planned operation. > > I have revised the migration helper to provide separate --review and > --apply modes. The --review mode prints the proposed operations without > changing any files, directories, permissions, ownership, or account > information. It shows the source and destination of each .dat file, > destination files that would be left unchanged, directories that would > be prepared, the metadata and ownership that would be applied, and > whether the _i2pd home directory would be changed. > > The --apply mode performs the migration. It preserves the source file > modes and timestamps, assigns the copied files and directories to > _i2pd:_i2pd, leaves existing destination files unchanged, and does not > remove the original files. > > I have also updated the @ask-update message to describe these operations > more clearly, and @exec-update now invokes the helper with the explicit > --apply argument. The script also reports each directory that it > prepares while applying the migration. > > I have attached the updated patch. > > Best regards, > David. Index: Makefile =================================================================== RCS file: /cvs/ports/net/i2pd/Makefile,v diff -u -p -r1.33 Makefile --- Makefile 21 Feb 2026 14:20:20 -0000 1.33 +++ Makefile 24 Jul 2026 17:33:42 -0000 @@ -2,7 +2,7 @@ COMMENT = client for the I2P anonymous n GH_ACCOUNT = PurpleI2P GH_PROJECT = i2pd -GH_TAGNAME = 2.59.0 +GH_TAGNAME = 2.61.0 CATEGORIES = net HOMEPAGE = https://i2pd.website @@ -12,9 +12,10 @@ MAINTAINER = SystemFailure > /etc/sysctl.conf If you intend to run a floodfill, you should raise this limit even more: - + # sysctl kern.maxfiles=16000 # echo "kern.maxfiles=16000" >> /etc/sysctl.conf @@ -24,3 +66,73 @@ and also edit /etc/login.conf.d/i2pd: :openfiles-cur=8192:\ :openfiles-max=8192:\ :tc=daemon: + + +The HTTP interface +================== + +On OpenBSD, i2pd's HTTP interface is disabled by default, because it +allows any user on the system to perform actions on the daemon, such +as shutting it down, or access private data, such as the router +identity and the tunnels' B32 addresses. + +If you want to use this interface anyway, you can reenable it in +${SYSCONFDIR}/i2pd/i2pd.conf under the [http] section. + + +Graceful shutdown +================= + +It is good practice to shutdown the i2pd daemon gracefully, to avoid +immediately severing all connections, which would disconnect all +your peers and affect the overall operation of the I2P network. + +You can initiate a graceful shutdown without the HTTP interface by +sending a signal to the i2pd daemon like this: + + kill -INT $(cat /var/i2pd/i2pd.pid) + +When it shuts down gracefully, the i2pd daemon waits for all transit +tunnels to expire, which usually takes 10 minutes. + + +Logging +======= + +By default, this package sends its log messages to syslogd(8), which +writes them to the /var/log/daemon file. + +The default log level of i2pd ("warn") can be very verbose. You may +want to reduce this log verbosity by changing the "loglevel" +parameter in ${SYSCONFDIR}/i2pd/i2pd.conf. + +If you want log messages to be written to another file, e.g. +${LOCALSTATEDIR}/i2pd/i2pd.log, you can change the "log" and "logfile" + +parameters in ${SYSCONFDIR}/i2pd/i2pd.conf. To have this log file +rotated automatically, you can add an entry to /etc/newsyslog.conf +using the i2pd pid file so that newsyslog(8) can send SIGHUP to the +daemon after rotation. + +For example: + + ${LOCALSTATEDIR}/i2pd/i2pd.log _i2pd:_i2pd 644 6 * $D13 Z ${LOCALSTATEDIR}/i2pd/i2pd.pid + +Sending SIGHUP is enough for log rotation, and also makes i2pd reload +its tunnel configuration and rotate transient keys. + + +Known bugs +========== + +Version 2.61.0 of i2pd introduced two small regressions on OpenBSD: + +- i2pd is currently unable to autodetect the proper MTU for SSU2 + packets and falls back to the default value of 1280. If you want to + set another value, you can do so by tuning the ssu2.mtu4 and + ssu2.mtu6 parameters. + +- i2pd runs fine when launched as the default _i2pd user and with the + default file paths (ie. when run with the default rc script). + However, it doesn't run as another user or with non-standard file + paths. Index: pkg/i2pd.rc =================================================================== RCS file: /cvs/ports/net/i2pd/pkg/i2pd.rc,v diff -u -p -r1.4 i2pd.rc --- pkg/i2pd.rc 11 Mar 2022 19:46:04 -0000 1.4 +++ pkg/i2pd.rc 24 Jul 2026 17:33:42 -0000 @@ -2,7 +2,12 @@ daemon="${TRUEPREFIX}/bin/i2pd --daemon" daemon_user="_i2pd" -daemon_flags="--service --datadir=${LOCALSTATEDIR}/lib/i2pd --conf=${SYSCONFDIR}/i2pd/i2pd.conf --tunconf=${SYSCONFDIR}/i2pd/tunnels.conf --tunnelsdir=${SYSCONFDIR}/i2pd/tunnels.d" +daemon_flags="--service \ + --datadir=${LOCALSTATEDIR}/i2pd \ + --conf=${SYSCONFDIR}/i2pd/i2pd.conf \ + --tunconf=${SYSCONFDIR}/i2pd/tunnels.conf \ + --tunnelsdir=${SYSCONFDIR}/i2pd/tunnels.d \ + --certsdir=${LOCALSTATEDIR}/i2pd/certificates" . /etc/rc.d/rc.subr