summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-12-12Remove NULL-checks before free().mmcc
2015-12-12remove CA from pki and no longer allow specifying a CA with 'pki' keyword.Gilles Chehade
introduce 'ca' keyword to allow specifying a custom CA. making CA part of pki was a bad idea and several people hit use-cases that plain couldn't work. instead of: pki foobar.org ca "/etc/mail/CA.pem" use now: ca foobar.org certificate "/etc/mail/CA.pem" ok sunil@, jung@
2015-12-12Remove a needless inclusion of sys/cdefs.h. Inspired by reyk's recentmmcc
commit doing the same.
2015-12-12comment typommcc
2015-12-12whitespacesGilles Chehade
2015-12-12when using senders map to restrict email address a user may use in SMTPGilles Chehade
dialogue, if `masquerade' is used as a parameter then rewrite the email address of the DATA From header to the email address in the map.
2015-12-12add the plumbing for masqueradingGilles Chehade
ok sunil@, jung@
2015-12-12Add key-table option to set the default key table for a session, allowsNicholas Marriott
different key bindings for different sessions and a few other things.
2015-12-12do not prevent group from reading key, it prevents a certificate fromGilles Chehade
being shared between smtpd and another daemon
2015-12-12Return after changing key table.Nicholas Marriott
2015-12-12Allow prefix and prefix2 to be set to None to disable (useful if youNicholas Marriott
would rather bind the prefix in the root table).
2015-12-12correct commentTed Unangst
2015-12-12allow overriding the default cipher-suiteGilles Chehade
ok jung@, sunil@, millert@
2015-12-12bump DH params to 2048, it's been part of smtpd releases for a long timeGilles Chehade
and I've been running with it since June with no side-effect ok sunil@, jung@, millert@
2015-12-12Adjust IPI numbers to get the interrupts working. Bits 5 and 6 do notVisa Hankala
seem to trigger an IPI. According to IP27 headers in Linux, those have a special meaning in hardware.
2015-12-12zap surplus blank lineStuart Henderson
2015-12-12Send DECLINE messages in response to ACK messages that turn out toKenneth R Westerback
have inadequate or invalid leases. In particular leases for addresses that are already configured on a different interface. After the DECLINE, return to INIT state and start looking for a valid lease. This conforms much closer to the relevant RFC's. Avoids 'hanging' dhclient(8) during boot when the attempt to configure the address fails without dhclient(8) realizing it. Issue found and various fixes tested by mpi@. Feedback from beck@ and reyk@. ok mpi@
2015-12-12check in parse.y that pki param is a valid hostnameGilles Chehade
2015-12-12pki name is a hostname not a pathGilles Chehade
2015-12-12rename enum valueGilles Chehade
2015-12-12remove whitespacesGilles Chehade
2015-12-12do not limit smtp session username to LOGIN_NAME_MAX it could be a virtualGilles Chehade
username
2015-12-12if no certificate matches name AND fallback hint was given, search for aGilles Chehade
global certificate
2015-12-12remove redundant checkGilles Chehade
2015-12-12remove empty lineGilles Chehade
2015-12-12In the A-MSDU receive code path, add an upper bounds check on A-MSDUStefan Sperling
subframe length and a clean exit at the bottom of the subframe loop. ok mpi@
2015-12-12move the cert verify code to its own function outside the imsg handlingGilles Chehade
code, no functional change but this makes code easier to read, and will ease implementing DANE later on.
2015-12-12smtp / mta have been factored in the same process months ago, factor theGilles Chehade
code that handles the same imsg's too ok sunil@, ok jung@
2015-12-12x2APIC is currently enabled on HV guests only, not on bare metal, toReyk Floeter
speedup interrupt handling on virtual machines. Unfortunately it is broken on Xen 4.2 or older, so use the early pvbus detection to drop the advertised x2APIC CPU feature. Xen has fixed this in late 2013, but the problem still shows up in "the Cloud" (it doesn't seem to affect others as they either use legacy APIC or Xen IPIs). OK mlarkin@ mikeb@ Cvs: ----------------------------------------------------------------------
2015-12-12document the keyboard backlight supportJoerg Jung
2015-12-12prepare bits to enable masquerade in parse.yGilles Chehade
2015-12-12add missing check for failed allocationGilles Chehade
2015-12-12enable keyboard backlight support via wskbd(4) hooksJoerg Jung
tested by Bryan Vyhmeister, krw, tb, and myself ok krw tb
2015-12-12Identify hypervisors before configuring other children of the mainbusReyk Floeter
(bios, CPU, interrupt handlers, pvbus). This splits the pvbus attach function into two parts: pvbus_identify() to scan the CPUID registers for supported hypervisors and pvbus_attach() to attach the bus, print information, and configure the children. This will be needed for Xen and KVM, as discussed with mikeb@ and sf@ OK mlarkin@
2015-12-12add keyboard backlight variableJoerg Jung
tested by Bryan Vyhmeister, krw, tb, and myself ok jcs krw tb
2015-12-12add new ioctls to control keyboard backlightsJoerg Jung
tested by Bryan Vyhmeister, krw, tb, and myself ok jcs krw tb
2015-12-12spacesGilles Chehade
2015-12-12add bits so local enqueuer can run filters when they are enabledGilles Chehade
2015-12-12Flag AP as QoS capable when EDCA or WME information elements occur in beaconsStefan Sperling
or probe responses. Makes 11n negotiation with Linux iwlwifi AP succeed. ok mpi@
2015-12-12tweak previous;Jason McIntyre
2015-12-12tweak; ok mpiJason McIntyre
2015-12-1211n/HT negotiation fixes:Stefan Sperling
Some APs will not negotiate HT if the vendor-specific WME info element is missing in probe and association requests, so add one. Fix the wrong flag (NODE_HT) being checked to determine whether 11n related elements should be included in management frames. If 11n mode is enabled (F_HTON flag) we can always include 11n related elements in management frames. ok mpi@
2015-12-12Implement senders map.Sunil Nimmagadda
senders table allows to restrict the addresses that an authenticated user can use in the SMTP dialogue. Ok gilles@
2015-12-12Kill domountroothooks(9) and mountroothook_establish(9) references,Martin Pieuchot
reminded by jmc@
2015-12-12Finish support for receiving 11n A-MPDUs.Stefan Sperling
The initial implementation was added by damien@ years ago. Summary of the changes made in this commit: - In ieee80211_input(), process A-MPDUs before duplicate detection. - Don't forget to set ba->ba_ni in ieee80211_recv_addba_req() so we don't crash in ieee80211_rx_ba_timeout(). - In ieee80211_recv_addba_req(), tweak the logic to deny BlockAck requests if the driver has no callback for doing so. - Implement ieee80211_ba_del() which cleans up BlockAck state. - Increase the minimum and maximum lifetime for BlockAck agrements. ok mpi@
2015-12-12whitespacesGilles Chehade
2015-12-12prepare for asynchronous certificate verify, needed for a mechanicalGilles Chehade
cleanup and later on for DANE support
2015-12-12expose foreground_log in smtpd.h so filters can inherit itGilles Chehade
2015-12-12prepare load_pki_tree() for pki/ca splitGilles Chehade
2015-12-12add a log_trace() for debugging purposesGilles Chehade