summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-08-12On broadcast and point-to-point interfaces only accept hello packets whenremi
the destination is 224.0.0.5 (AllSPFRouters). RFC 2328 sys in "9.5. Sending Hello packets" that hello packets are sent to the multicast address AllSPFRouters on broadcast and physical point-to-point networks. With this new check the test for AllDRouters is not needed anymore. ok benno@
2019-08-12Warn when a neighbor changes its source IP address. Either it is becauseremi
of a planned change or something bad is happening in the network. ok benno@
2019-08-12Fix typo; spotted by Krystian Lewandowski.Mark Kettenis
2019-08-12Remove spurious newline. Spotted by patrick@Mark Kettenis
2019-08-12In isnow(), always validate the value of the month variable beforeTodd C. Miller
using it as an index into the cumdays[] array. Found with American Fuzzy Lop. Original diff by and OK fcambus@
2019-08-12instructions for replacing cert.pem are probably more harmful than helpful.Ted Unangst
noticed by freda_bundchen. ok gilles millert
2019-08-12Make it possible to switch to framebuffer "glass" console in case itMark Kettenis
isn't the default already. ok patrick@
2019-08-12Provide a local version of X509_get0_subject_key_id()Joel Sing
It seems that the CMS code is currently the only code in existence that uses this function.
2019-08-12Inline the equivalent of ASN1_TYPE_unpack_sequence().Joel Sing
2019-08-12Stop pulling libssl into rpki-client.Joel Sing
None of this code actually does TLS, hence libssl is not needed. Instead, pull in the correct headers and call the appropriate libcrypto initialisation functions (even this is only necessary to support OpenSSL prior to 1.1). While here also remove libssl/libcrypto initialisation/uninitialisation from main() - it should only be necessary in proc_parser(). ok deraadt@ job@
2019-08-12Do not exit with error if the challenge file already exists, instead ↵Sebastian Benoit
truncate it and write the challenge again. We can get asked to supply the same challenge multiple times. bug found and patch tested by jmc@ patch discussed with, mangled and okayed by florian@
2019-08-12correct a misspelled page name in an .Xr;Ingo Schwarze
it looks like this was the last bad .Xr in *CMS*(3)
2019-08-12correct misspelled page name in an .XrIngo Schwarze
2019-08-12Fix .Xrs to non-existant pages by correcting the misspelled functionIngo Schwarze
names and documenting these two functions, CMS_decrypt_set1_pkey(3) and CMS_decrypt_set1_key(3) right here in this same page. While here, simplify and improve some wording.
2019-08-12Reset the IdleHoldTime and the session error count when doing a adminClaudio Jeker
command that clears or starts a neighbor. This way an admin reset does what people expect since it makes the session behave like a brand new one. OK job@ deraadt@ sthen@
2019-08-12These public functions are listed in the OpenSSL manuals but notIngo Schwarze
actually documented, so write the documentation from scratch.
2019-08-12Change the way IdleHoldTime is reset once the session is up and stable.Claudio Jeker
The implemented reverse exponential backoff results in very long times until a session gets back to the initial hold values. Instead just wait for the timer to fire once and reset the settings then. In most cases the timer is double the IdleHold time (because of the way the backoff is implemented) which is enough to ensure that fast flapping sessions are punished. OK benno@
2019-08-12Add the rpki TAL files to the changelist including arin.tal (which is notClaudio Jeker
shipeed by default). OK job@ sthen@ deraadt@
2019-08-12Add the CP_SPIN time to the sum of system time reported.Claudio Jeker
OK kettenis@
2019-08-12merge a few minor improvements from the OpenSSL 1.1.1 branch,Ingo Schwarze
which is still under a free license: * mention pem_password_cb in NAME and SYNOPSIS * recommend -1 as pem_password_cb error return for OpenSSL compat * minor improvements to the pass_cb() example code * mention that the pass phrase is just a byte sequence * and minor wording and markup improvements
2019-08-12Remlve command mutex. It is unnecessary since commands are alreadyMark Kettenis
serialized by the use of a taskq and it prevents sendmsg/endmsg from being able to sleep. This hurts when implementing SSIF since some i2c controllers sleep while waiting for transactions on the i2c bus to complete. ok jmatthew@, deraadt@
2019-08-12There is no reason why the TAL files are installed only readable by rootClaudio Jeker
these are public files. Agreed by deraadt@ (and florian@)
2019-08-12regenanton
2019-08-12Unlock lseek(2) since the file offset is MP-safe by now. Callinganton
VOP_GETATTR() must still be serialized using the kernel lock since the underlying file system implementation is not MP-safe. no objection from deraadt@ and ok mpi@ visa@
2019-08-12Prepend SPI to send and recv log messages to see which line belongs totobhe
which SA. Use IKE specific terms peer and local instead of to and from. ok reyk@ patrick@
2019-08-11Change all error exits to EX_TEMPFAIL so that mail rejected by the LMTPTim van der Molen
server stays queued instead of being bounced. Also improve getline(3) error handling and remove unreachable code. OK sunil@ a while ago, "please get it in" gilles@
2019-08-11In let's encrypt v1 we had to track a challenge for every domain inFlorian Obser
the certificate we were requesting. This is no longer true in v2 and we have to free the amount of challenges the server told us to fullfill. OK benno
2019-08-11Replace some err(1, NULL) with err(1, "malloc").Martijn van Duren
Requested by deraadt@
2019-08-11Various fixes to make this compile with clang on powerpc.Mark Kettenis
ok visa@
2019-08-11the filtering protocol in OpenBSD 6.6 will be version 0, it has worked fineGilles Chehade
for about a year now but until we have had a release with filters and until we bring back the feedback from that release into the protocol, we will not be version 1 of the protocol.
2019-08-11add 'from rdns' to ruleset match criterias making it possible to matchGilles Chehade
envelopes created by sessions that had or did not have an rDNS: match from rdns [...] action "local" match !from rdns [...] reject
2019-08-11Cleanup usage.Martijn van Duren
Prodded by and OK deraadt@
2019-08-11delete the bufcachepercent command (since this can be done at runtime),Theo de Raadt
and leftovers from past commands shmseg/shmmaxpg/nmbclusters ok kettenis
2019-08-11syncTheo de Raadt
2019-08-11teach builtin filter rdns how to match a session that has or lacks rdnsGilles Chehade
2011-04-24Here comes the easter bunnytils 2.17 (the last version released against aMiod Vallat
licence mere mortals can understand the terms of); will be connected to the build on an arch-by-arch basis. Testsuites and generated files have been intentionnaly omitted from this import. Peer pressure and ok from at least drahn@ pirofti@ deraadt@
2019-08-11fix rewrite action on filtering of MAIL FROM phaseGilles Chehade
basically the transaction must be created in the proceed function for the mail from phase, not in the checking function, otherwise the second pass in the check function will fail due to the tx already existing. reported by Niklas Hallqvist <niklas@appli.se>
2019-08-11Document ip.arpq and remove ip, ip6 and mpls ifq.denis
ok deraadt@
2019-08-11whitespace issues like a knife in my eyesTheo de Raadt
2019-08-11syncTheo de Raadt
2019-08-11No specific called "exec(3)", so move primary manpage to a name whichTheo de Raadt
does exist -- execv(3). Still call this a family but without "Nm". Adjust Xr in various pages to refer to the precise function used rather than the family, in most cases the semantics of execve(2) are being referenced, so change the Xr. ok jmc
2019-08-11Use ERR_asprintf_error_data() instead of ERR_add_error_data().Joel Sing
2019-08-11Add clock support to sxirtc(4); needed by newer Linux DTs.Mark Kettenis
ok patrick@
2019-08-11document proc and proc-based filtersGilles Chehade
2019-08-11error if malloc fails; ok martijnTheo de Raadt
2019-08-11ugly whitespacesTheo de Raadt
2019-08-11Add battery sensors for the AXP803. A somewhat recent Linux DT is neededMark Kettenis
to expose these sensors. Heavily based on a diff from Krystian Lewandowski.
2019-08-11Remove unsupported GOST 2012 NIDs.Joel Sing
2019-08-11Disable DES3 since we do not currently provide DES3 keywrap.Joel Sing
2019-08-11Remove label that is now unused (due to arc4random_buf() returning void).Joel Sing
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 00:49:33 +0000