summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2010-09-23add KexAlgorithms to the -o list;Jason McIntyre
2010-09-23add [-l limit] to usage();Jason McIntyre
2010-09-23Teach the installer how to process the new hw.disknames output.Joel Sing
ok krw@
2010-09-23Include the disklabel UID in hw.disknames.Joel Sing
ok deraadt@ krw@
2010-09-23When a disk is attached create a workq task to read the disklabel,Joel Sing
providing the DKF_NOLABELREAD flag is not set. This provides the kernel with the actual disklabel which includes the disklabel UID. ok deraadt@ miod@ krw@
2010-09-23Introduce a DKF_NOLABELREAD flag, which is used by a device to preventJoel Sing
automatic reading of disklabel on attach. ok deraadt@ miod@ krw@
2010-09-23translate WRITE SAME 16 into DSM TRIM.David Gwynne
2010-09-23change description for AES-GMAC a bit.Mike Belopuhov
prompted by reyk
2010-09-23support for aes-gcmMike Belopuhov
OK reyk
2010-09-23commands and bits for data set management.David Gwynne
2010-09-23fix indentation to not confusingly align with an unassociated while() statementBret Lambert
ok claudio@
2010-09-23descripe a few bits of the write same commands.David Gwynne
2010-09-23tweak the mclgeti algorithm to behave better under load.David Gwynne
instead of letting hardware rings grow on every interrupt, restrict it so it can only grow once per softclock tick. we can only punish the rings on softclock ticks, so it make sense to only grow on softclock tick boundaries too. the rings are now punished after >1 lost softclock tick rather than >2. mclgeti is now more aggressive at detecting livelock. the rings get punished by an 8th, rather than by half. we now allow the rings to be punished again even if the system is already considered in livelock. without this diff a livelocked system will have its rx ring sizes scale up and down very rapidly, while holding the rings low for too long. this affected throughput significantly. discussed and tested heavily at j2k10. there are still some games with softnet we can play, but this is a good first step. "put it in" and ok deraadt@ ok claudio@ krw@ henning@ mcbride@ if we find out that it sucks we can pull it out again later. till then we'll run with it and see how it goes.
2010-09-23Do not declare the domain and protosw structures in at.h fixes build withClaudio Jeker
netatalk enabled.
2010-09-23returning here can cause the usb task thread to go to sleep forever,Jacob Meuser
becaue it skips a wakeup() later on. this is the only error condition that returns before the wakeup. not sure why this particular case is handled differently, and not certain what the error code should be, but this is better than breaking all of usb because of a problem on one port. dicussed with deraadt
2010-09-23add two members to struct usb_taskJacob Meuser
* usbd_device_handle dev - the device responsible for the task. use this to not run the task if the device's hub is dying. * int running - a flag to be set when the task is running. add usb_rem_wait_task(), a wrapper for usb_rem_task() that waits for the task to complete if the task is already running. s/usb_rem_task/usb_rem_wait_task/ in usb_detach(). probably most drivers using usb_tasks should do this as well. although device attach/detach is serialized in normal cases, in the special case where the usb bus is hotpluggable (like cardbus/pcmcia), devices are not detached in the task thread.
2010-09-23add a 'dying' flag to struct usbd_bus. use this to signify the busJacob Meuser
is dying, instead of setting a flag in struct usb_softc. as usbd_device_handle has a pointer to the usbd_bus it's attached to, usb devices, and functions they run or functions run on their behalf, can now easily check if their bus is dying. use this to stop usbd_do_request* from running and the usb task thread from adding new tasks when a device's bus is dying.
2010-09-23instead of waiting the full power-up-to-power-steady time for rootJacob Meuser
hubs before their first port explore, check how long it's actually been since power up and only wait as necessary. saves a little time on boot, especially now that explore tasks are serialized. ok yuo@
2010-09-23Add pppx(4) to the cdevs of the remaining archs.Claudio Jeker
OK dlg@
2010-09-23instead of running usb_explore() from individual kthreads for eachJacob Meuser
USB bus, make usb_explore() a usb_task. reduces races during normal USB device detach, since now usb_tasks and detach happen in the same process. ok yuo@, matthew@ helped with the task thread loop
2010-09-23remove reference to msgs(1)Theo de Raadt
2010-09-23syncTheo de Raadt
2010-09-23Add the same license text to these files as the rest of npppd.Jonathan Gray
ok yasuoka@
2010-09-23If tunread() fails, we should increment if_oerrors, not if_ierrors.Matthew Dempsky
"yup" deraadt@
2010-09-23add a new IP level socket option IP_PIPEX. This option is used for L2TPYASUOKA Masahiko
support by pipex. OK henning@, "Carry on" blambert@
2010-09-23remove support for talking to the zebra routing socket whichJonathan Gray
was not enabled, we use a kernel routing socket for such things. ok yasuoka@ claudio@
2010-09-23Eliminate mention of EPERM error condition from tun(4) man page. WeMatthew Dempsky
just use the filesystem permissions now. Pointed out by stsp@.
2010-09-23rename usb_discover to usb_explore for consistency.Jacob Meuser
OK krw
2010-09-22add an option per-read/write callback to atomicioDamien Miller
factor out bandwidth limiting code from scp(1) into a generic bandwidth limiter that can be attached using the atomicio callback mechanism add a bandwidth limit option to sftp(1) using the above "very nice" markus@
2010-09-22use audio(4)'s quiesce/resume for data i/o, and ac97_resume() for mixerJacob Meuser
suspend/resume support
2010-09-22- fix a ghc variableJasper Lievisse Adriaanse
2010-09-22autoconf activate, suspend/resume supportJacob Meuser
2010-09-22We are still far away from supporting the roff macro definition macro .deIngo Schwarze
in mandoc, if we ever get to that point. Even less so with variable arguments and using a single non-alphabetic character (here, '`') as the macro identifier. In the meantime, refrain from using .de in cvs(1). Patch generated by running #!/usr/bin/perl while(<>){s/^\.\` "(.*)"(.*)/.RB \` "\\|$1\\|" \'$2/;print;} followed by some hand-polishing. Repeatedly prodded by many (e.g. halex@, weerd@) and repeatedly forgotten. "yes. at least people will be able to read the page." jmc@
2010-09-22as dying flag didn't set in aue_detach(), set it.Yojiro Uo
ok jsg@
2010-09-22Support AES-GCM-16 (as aes-gcm) and ENCR_NULL_AUTH_AES_GMACMike Belopuhov
(as aes-gmac) encryption transformations in the ipsec.conf(5). Available "enc" arguments denoting use of 1) AES-GCM-16: aes-128-gcm for 160 bit key (128+nonce) aes-192-gcm for 224 bit key (192+nonce) aes-256-gcm for 288 bit key (256+nonce) 2) ENCR_NULL_AUTH_AES_GMAC: aes-128-gmac for 160 bit key (128+nonce) aes-192-gmac for 224 bit key (192+nonce) aes-256-gmac for 288 bit key (256+nonce) Please note that aes-gmac family performs no encryption and provides no confidentiality and is intended for cases in which confidentiality is not desired (it can be thought of as AH with NAT-T support). Also, although this implementation supports manual keying, it's use is strictly discouraged as AES-GCM security depends on frequent re-keying. So it can be thought of as a debug facility only. Example configuration: ike esp from 172.23.61.36 to 172.23.61.156 \ quick enc aes-256-gcm \ psk humppa Thoroughly tested by me and naddy. Works fine with Linux. Requires updated pfkeyv2.h include file. OK naddy
2010-09-22Support for use of AES-GCM-16 (as AESGCM) and ENCR_NULL_AUTH_AES_GMACMike Belopuhov
(as AESGMAC) ciphers in the ISAKMP Phase 2 (aka Quick Mode). Thoroughly tested by me and naddy. Works fine with Linux. Requires updated pfkeyv2.h include file. ok naddy
2010-09-22Support for AES-GCM-16 and ENCR_NULL_AUTH_AES_GMAC in ESP as perMike Belopuhov
RFC 4106 and 4543. Authentication hash key is set to be the same as an encryption key. The length that is specified for the authentication hash descriptor denotes the the length of Additional Authentication Data (AAD). The encryption transformation descriptor length denotes the length of the payload (to be encrypted and authenticated). ENCR_NULL_AUTH_AES_GMAC treats all input as AAD, thus the encryption length is set to zero. This also fixes padding for stream ciphers, so that payload will be 4-byte aligned.
2010-09-22no more msgs(1);Jason McIntyre
2010-09-22Add a new interface pppx(4) -- the ppp multiplexer to be used with npppdClaudio Jeker
and pipex. pppx(4) creates an interface whenever a session is created so that altq and pf can work on these. Started by dlg@ debugged and made usable by myself OK dlg@ yasuoka@ deraadt@
2010-09-22Kill msgs. Noone uses it, and it has a longjmp in it.Theo de Raadt
Lots of agreement.
2010-09-22Add AES-GCM Transform Identifiers as specified by IANA inMike Belopuhov
RFC 4106 and 4543. Please note that although IKEv1 and IKEv2 identifiers are different for ESP_NULL_AUTH_AES-GMAC (SADB_X_EALG_AESGMAC), we use the IKEv2 one only (which is 21). ipsecctl(8) will be taught to handle exported SA correctly.
2010-09-22Revert previous and let drivers register counterless interrupts;Miod Vallat
tc_intr_disestablish() prototype is changed to carry information whether the counter needs to be detached or not. This does not matter much since no driver ever calls tc_intr_disestablish().
2010-09-22regress test for each of the key exchange algorithms that we supportDamien Miller
2010-09-22Test vectors for GMAC as published in the original GCM proposalMike Belopuhov
to NIST (gcm-spec.pdf) and draft-mcgrew-gcm-test-01.txt.
2010-09-22OCF support for the Galois/Counter Mode (GCM) for AES asMike Belopuhov
described in FIPS SP 800-38D. This implementation supports 16 byte authentication tag only, splitting transformation into two parts: encryption and authentication. Encryption is handled by the existing AES-CTR implementation, while authentication requires new AES_GMAC hash function. Additional routine is added to the software crypto driver to deal with peculiarities of a combined authentication- encryption transformation. With suggestions from reyk, naddy and toby.
2010-09-22unify MS-CHAP implementation to sbin/iked/chap_ms.[ch].YASUOKA Masahiko
copy sbin/iked/chap_ms.[ch] and fixed chap.c and eap.c to compile with it.
2010-09-22Switch to unconditionally attaching evcounts on TurboChannelMatthew Dempsky
interrupts, since inspecting the code, they seem to always attach anyway. This fixes compiler fallout from my evcount simplification. build error reported by naddy@; "seems sensible" deraadt@
2010-09-22nextmsg could be used uninitialized as well.Paul Irofti
``Go ahead, its free'' deraadt@.
2010-09-22Initialise firstmsg so we do not have random number whenlum
bounds file is empty. ok deraadt@ henning@
2010-09-22support INVALID_KE_PAYLOAD notification sent by the responder in caseMike Belopuhov
the initiator chose wrong D-H group. in this case we throw away our SA and start over with a proper group. makes iked work as an initiator with strongswan/charon without any specific "ikesa" (phase 1) configuration. ok reyk
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-12 03:25:35 +0000