summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-05-04Check v6 availablilty mask instead of v4.Gerhard Roth
go for it deraadt@
2020-05-04Partially reverse a commit from 2019/12/28denis
A large number of redistributed routes make ospf6d crash. OK remi@, sthen@
2020-05-04Fix out-of-bounds access in tables[][] that was exposed in bluhm'sTheo Buehler
regress on i386 after inoguchi moved some symbols to const. ok inoguchi jsing deraadt
2020-05-04tcpbench: display stats on SIGINFO, not just at exit. ok tb@ procter@ deraadt@Stuart Henderson
2020-05-03Use strftime() rather than ctime() to generate timestamps nicer.Theo de Raadt
ok job, input claudio benno
2020-05-03Make it clear the date is in UTC.Theo de Raadt
ok job
2020-05-03Correctly name max_out_prefix and don't clobber the max_prefix value.Claudio Jeker
Also include the group name in the general neighbor description. Both issues reported by Patrick Velder OK deraadt@
2020-05-03repair headers, as noted by tbTheo de Raadt
2020-05-03correct dateTheo de Raadt
2020-05-03Accept two ChangeCipherSpec messages during a TLSv1.3 handshake.Joel Sing
In compatibility mode, a TLSv1.3 server MUST send a dummy CCS message immediately after its first handshake message. This is normally after the ServerHello message, but it can be after the HelloRetryRequest message. As such we accept one CCS message from the server during the handshake. However, it turns out that in the HelloRetryRequest case, Facebook's fizz TLSv1.3 stack sends CCS messages after both the HelloRetryRequest message and the ServerHello message. This is unexpected and as far as I'm aware, no other TLSv1.3 implementation does this. Unfortunately the RFC is rather ambiguous here, which probably means it is not strictly an RFC violation. Relax the CCS message handling to allow two dummy CCS messages during a TLSv1.3. This makes our TLSv1.3 client work with Facebook Fizz when HRR is triggered. Issue discovered by inoguchi@ and investigated by tb@. ok deraadt@ tb@
2020-05-02Add ping(1)-like summary statistics.Richard Procter
Makefile omitted by mistake from commit tJPIjljmTjZW ok djm@ deraadt@
2020-05-02Add ping(1)-like summary statistics.Richard Procter
ok djm@ deraadt@
2020-05-02Repair the description of "edh [params (none|auto|legacy)]" toSebastian Benoit
configure EDH-based cipher suites with Perfect Forward Secrecy (PFS) for older clients that do not support ECDHE. Problem noticed and initial diff by Jesper Wallin, thanks! ok kn@
2020-05-02Minimal documentation of JSON output.Claudio Jeker
2020-05-02Add support to output data in JSON. This is still work in progress andClaudio Jeker
the output structures may still change but it should be a good starting point for poeple to start playing with it. OK benno@, job@, deraadt@
2020-05-02Adjust fmt_attr() to pass in -1 for flags to tell it you don't careClaudio Jeker
about the flags of the attribute. Part of the JSON output diff. OK job@, benno@, deraadt@
2020-05-02Indirect the output functions through function pointers so that theyClaudio Jeker
can be changed easily. This will be used later on to add JSON output. OK benno@, job@, deraadt@
2020-05-02If read-write is set to disabled, also disable reading with the privateMartijn van Duren
community. Issue reported by Steven Surdock ssurdock <at> engineered-net <dot> com OK deraadt@ claudio@ sthen@
2020-05-02Cleanup the output functions a bit. show_neighbor_full() should print someClaudio Jeker
values only if the session is established or show it unconditonally (for shutdown message and last notficiation error codes. Adjust show_attr() a bit, print ORIGIN as string and add support for AID_VPN_IPv6. General add some warning if length checks fail. OK job@, benno@, deraadt@ as part of a bigger diff
2020-05-02The warning "bad AGGREGATOR, AS 0 not allowed ..." is not very helpful.Claudio Jeker
Make it a log_debug() instead to reduce the noise seen on most full feeds. The DFZ is currently not clean enough to properly drop AS 0 in that case. OK job@ deraadt@
2020-05-02Get bus number from _CRS.Mark Kettenis
ok sthen@, deraadt@
2020-05-02Use gettimeofday() instead of CLOCK_MONOTONIC in gettime(). The return valuetobhe
is compared to one received via PFKEY which results in garbage. Found by Rene Ammerlaan <rj (dot) ammerlaan (at) sungai (dot) nl> ok patrick@
2020-05-02Fix buglet in previous commit; use time from the struct timeval that wasMark Kettenis
passed in when setting the RTC time instead of the global time_second. ok mpi@
2020-05-02we have a sshkey_save_public() function to save public keys; use itDamien Miller
and save a bunch of redundant code. Patch from loic AT venez.fr; ok markus@ djm@
2020-05-02Don't make an illegal adde. Avoids fatal error on PowerPC.gkoehler
When the DAG truncates an ISD::ADDE node, DAGCombiner may optimize it by making an adde with smaller operands. PowerPC has i1 registers, and may truncate an i32 adde to i1, but an i1 adde is not legal for PowerPC, and the legalize-ops phase can't fix it. This was causing "fatal error: error in backend: Cannot select..." cwen@ reported the error ok mortimer@ kettenis@ deraadt@
2020-05-02Add const to TLS1.3 internal vectorsKinichiro Inoguchi
ok tb@
2016-09-03Use the space freed up by sparc and zaurus to import LLVM.Pascal Stumpf
ok hackroom@
2020-05-01When initiating IKE SA rekeying, make sure to send a key from a mutualtobhe
DH group (as negotiated by IKE_SA_INIT) instead of one from the configured policy. Not doing so may result in INVALID_KE errors. ok patrick@
2020-05-01Use the same inittodr()/resettodr() implementation as onMark Kettenis
amd64/arm64/armv7/i386/hppa/sparc64 and move it to the end of machdep.c. Wrap the existing time_read and time_write hooks into something that can be used as a todr_handle. ok mpi@
2020-05-01Use the same inittodr()/resettodr() implementation as onMark Kettenis
amd64/arm64/armv7/i386/sparc64 and move it to the end of machdep.c. Rework the actual implementation for the MC14818 compatible RTC into something that can be used as a todr_handle just like on amd64. ok mpi@
2020-05-01Clarify global 'set active' and 'set passive' options and how theytobhe
interact with the per-policy active/passive options. ok kn@
2020-05-01Prevent divide-by-zero in MiRA which I managed to trigger with iwn(4).Stefan Sperling
ok deraadt@
2020-05-01update currency exchange rates;Jason McIntyre
2020-05-01when receving a file in sink(), be careful to send at most a singleDamien Miller
error response after the file has been opened. Otherwise the source() and sink() can become desyncronised. Reported by Daniel Goujot, Georges-Axel Jaloyan, Ryan Lahfa, and David Naccache. ok deraadt@ markus@
2020-05-01expose vasnmprintf(); ok (as part of other commit) markus deraadtDamien Miller
2020-05-01avoid NULL dereference when attempting to convert invalid ssh.comDamien Miller
private keys using "ssh-keygen -i"; spotted by Michael Forney
2020-05-01sure enough, some of the test data that we though were in new formatDamien Miller
were actually in the old format; fix from Michael Forney
2020-05-01make mktestdata.sh generate old/new format keys that we expect.Damien Miller
This script was written before OpenSSH switched to new-format private keys by default and was never updated to the change (until now) From Michael Forney
2020-05-01portability fix for sed that always emil a newline even if theDamien Miller
input does not contain one; from Michael Forney
2020-05-01remove obsolete RSA1 test keys; spotted by Michael ForneyDamien Miller
2020-04-30Add ECDH groups and higher order MODP DH groups to default proposal.tobhe
ok sthen@, patrick@
2020-04-30Disallow setting the AES-GCM IV length to 0Theo Buehler
It is possible to do this by abusing the EVP_CTRL_INIT API. Pointed out by jsing. ok inoguchi jsing (as part of a larger diff)
2020-04-30drop duplicate word;Ingo Schwarze
reported by Gordon Bergling <gbergling at gmail dot com>
2020-04-30tweak previous; ok markusJason McIntyre
2020-04-30bring back debug() removed in rev 1.74; noted by pradeep kumarMarkus Friedl
2020-04-30run the 2nd ssh with BatchMode for scp -3Markus Friedl
2020-04-30Reword verbose log messages to clarify what's happeningjob
OK deraadt@
2020-04-30Place elapsed, user, and system time for processing in the comment headers.Theo de Raadt
ok job benno claudio
2020-04-30Do not remove the automatic-rename option from the global set, only fromNicholas Marriott
the window (it must stay in the global set or tmux will crash). GitHub issue 2188.
2020-04-30If there's only one input (output) name it simply "input" ("output")Alexandre Ratchov
Besides making things simpler, this allows libsndio to figure out that this is a control affecting all inputs (outputs) that needs to be exposed.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-04 14:42:53 +0000