summaryrefslogtreecommitdiff
path: root/sbin/slaacd
AgeCommit message (Collapse)Author
2021-07-12Change the error reporting pattern throughout the tree when unveilBob Beck
fails to report the path that the failure occured on. Suggested by deraadt@ after some tech discussion. Work done and verified by Ashton Fagg <ashton@fagg.id.au> ok deraadt@ semarie@ claudio@
2021-05-01In singel user mode / is mounted ro. Just warn if we can't createFlorian Obser
the control socket instead of fatal(). OK deraadt
2021-05-01Allow running in single user mode where /var/empty doesn't exist byFlorian Obser
switching from chroot("/var/empty") to unveil("/", ""). This is just an extra pair of suspenders since these processes pledge(2) to not access the filesystem. OK deraadt
2021-03-21Use new terminology of RFC 8981 and (mechanically) replace "privacy"Florian Obser
with "temporary".
2021-03-21Don't warn that we can't form a temporary address when a routerFlorian Obser
deprecates a prefix by sending a pltime of 0, this is normal. Continue warning when the pltime is smaller than 5 as this is almost certainly a configuration error. Found the hard way by & OK otto.
2021-03-20RFC 8981 allows the configuration of only temporary IPv6 addresses.Florian Obser
Track autoconf and temporary flag individually to be able to support this. OK kn
2021-03-20Fix SMALL build when done from sbin/slaacdkn
distrib/special/slaccd is the actual SMALL user but having it build from here is useful, too; in fact, it showed some more unused variables under SMALL. OK florian
2021-03-11When RFC 8981 obsoleted RFC 4941 the terminology changed fromFlorian Obser
"privacy extensions" to "temporary address extensions" Change ifconfig(8) to output temporary after temporary addresses and add "temporary" option which is an alias for autoconfprivacy for now. Also make AUTOCONF6TEMP a positiv flag that is set by default. Previously the negative flag "INET6_NOPRIVACY" was set when privacy addresses were disabled. This makes the flags output less ugly and will allow us to disable autoconf addresses while having temporary addresses enabled in the future. More work is needed in slaacd. input benno, jmc, deraadt previous verison OK benno OK jmc, kn
2021-03-07Withdraw nameservers when the interface goes down.Florian Obser
Problem reported by deraadt some time ago.
2021-03-07Fold get_lladdr into update_iface, now the only caller.Florian Obser
This allows us to pass the link state over to engine here instead of in update_addr which is not available in small. This gets us more in line dhcpleased.
2021-03-07No need to pass the link local and hw address around, we have itFlorian Obser
already in the interface on the engine side.
2021-03-07reshuffle to bring more in line with dhcpleasedFlorian Obser
2021-03-07Introduce engine_update_if().Florian Obser
This was too much code in the imsg handler.
2021-03-06Implement last remaining bits to update from RFC 4941 to RFC 8981.Florian Obser
The desync factor is now tracked per temporary IP and the max value has been increased to about 9 hours. While here fix a bug where the minimum acceptable pltime in a router advertisement should be bigger than PRIV_REGEN_ADVANCE not the desync factor (which didn't make any sense at all). From Fernando Gont, thanks! OK sthen
2021-03-02Fix indentation of switch / case. No binary change.Florian Obser
2021-03-02remove uneeded md5.h includeJonathan Gray
ok florian@
2021-02-27Path #defines are traditionally prefixed with _PATH.Florian Obser
pointed out by deraadt
2021-02-26remove some unused functions in slaacdJonathan Gray
ok florian@
2021-01-19Make imsg event structs static to fix -fno-common.Florian Obser
Follows claudio's lead in ospfd et al. Problem reported by mortimer.
2021-01-19Move control_state and ctl_conns to control.c, it's not neededFlorian Obser
elsewhere and unbreaks -fno-common. Inspired by claudio Problem reported by mortimer
2021-01-19No need for a global slaacd_process; unbreaks -fno-common.Florian Obser
Problem reported by mortimer
2021-01-17Mark up locations of KAME hack with #ifdef __KAME__ so that we canFlorian Obser
find it again if and when we no longer need it. No object change.
2021-01-16Oops, fix previous.Florian Obser
We only want to recover the scope id if it hasn't already been recovered. But we want to always copy the link-local address.
2021-01-16Only recover the KAME embedded scope if the sin6_scope_id is notFlorian Obser
initialized. If it is set assume the scope was already recovered. OK bluhm, claudio
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. florian@ mentioned this might be a problem in slaacd(8) and rad(8) after claudio@ fixed it in bgpd, so i went looking...
2020-12-01Sync get_ifrdomain() to rad(8) version by removing a useles (void)Florian Obser
cast in front of a strlcpy(3). tb@ had pointed out that the use in rad(8) was not consistent. I consider the void cast a useless annotation, either the strl* functions must have the canonical trucation check or it must be obvious that truncation cannot happen or is not a problem. While at it remove a bunch more casts that snuck in over time.
2020-11-29Fix previous; we need to set the icmp6ev in the interface to NULLFlorian Obser
otherwise we are referencing the wrong one when the rdomain changes. Sorry for not spotting it earlier.
2020-11-28improve legibility of the newly introduced unref_icmp6ev() before thisChristian Weisgerber
code gets copied around; ok florian@
2020-11-28An interface might have disappeared or switched rdomains while weFlorian Obser
waited for a FD. It's not a fatal condition if it arrives late. OK tb
2020-11-28Reduce code duplication by introducing unref_icmp6ev().Florian Obser
OK tb
2020-11-28Handle the case of an autoconf interface changing its rdomain.Florian Obser
To avoide code duplication have get_icmp6ev_by_rdomain() either return an existing icmp6ev in the correct rdomain or allocate one. OK tb
2020-10-30Track creation time of address proposals to be able to establish totalFlorian Obser
lifetime. Use this information to renew pltime / vltime of privacy addresses for up to 1 day / 2 days as RFC 4941. This is important when announced pltime / vltime is lower than 1 day / 2 days, privacy addresses would have expired too fast. Spotted after a remark by Fernando Gont on misc@
2020-10-30If Duplicate Address Detection (DAD) fails only generate a new addressFlorian Obser
if we are using Semantically Opaque Interface Identifiers (soii) otherwise we would just create the same address again and DAD will fail again.
2020-10-30Follow RFC 4941 and calculate the desync_factor at startup.Florian Obser
There is probably nothing wrong with calculating a new random value everytime we create an address, but we are also not gaining anything. Makes math in upcomming diffs easier.
2020-10-30Since the RFC 4941 constants are no longer in a public headerFlorian Obser
(netinet6/nd6.h) we can remove the ND6 prefix. While here use a MAX_DESYNC_FACTOR of 10 minutes as the RFC specifies. We are using arc4random_uniform which avoids modulo bias.
2020-10-30Pull check for duplicate address up to skip them early, we are notFlorian Obser
going to renew them. Avoids redundant check for privacy addresses.
2020-10-30update_iface_ra does too much, move prefix handling into function.Florian Obser
2020-10-30update_iface_ra does too much, move dfr handling into function.Florian Obser
2020-10-30update_iface_ra does too much, move rdns handling into function.Florian Obser
2020-09-17With the multi rdomain support, slaacd now sees all icmpv6 packets andSebastien Marie
filters in userland. But the packet type check was placed at the wrong place so the hoplimit check was done against every icmpv6 packet but no all of them have a hoplimit constraint. tested and ok by me, committed on behalf of florian@
2020-09-14We might race against removal of an rdomain we just want to handle.Florian Obser
Make setsockopt non-fatal in this case and just ignore the request. Spotted in a diff by reyk for rad(8); discussed with claudio
2020-09-14Let slaacd handle all rdomains in a single daemon.Florian Obser
Suggested by claudio and matthieu Testing matthieu Putting it in now to get enough testing before release so that there is enough time to back it out, suggested by deraadt
2020-08-19When sending a router solicitation use the link-layer (mac) address ofFlorian Obser
the outgoing interface in the source link-layer address ICMPv6 option instead of the address of the last configured autoconf interface. It is not the most efficient way to first transform an if_index into and interface name and then iterate over all addresses but this is also not in the hot path. Under normal operations slaacd will send one solicitation when an interface is set to autoconf and then never again because it will see unsolicitated router advertisements before addresses expire. OK kn
2020-07-03Rename IN6_IFF_PRIVACY to IN6_IFF_TEMPORARY.Florian Obser
This is the name the other BSDs use for this, there is no reason to be different, the IPv6 RFCs call these addresses temporary, and some software in ports wants to use this as well. Most recently pointed out for firefox by landry. OK claudio, sthen
2020-05-25Do not log "startup" to syslog.Florian Obser
slaacd and unwind start very early in the boot process and syslog is not fully available yet so these messages tend to get lost. But they are also not particularly useful. Prompted by a report by Jason Mader on bugs@ OK deraadt, claudio, bluhm Note that this code has been copied around to all our privsep daemons and also lives in usr.sbin. Leave it alone there because multiple people said they find it useful for those daemons.
2020-04-17Only pay attention to interfaces in our routing domainFlorian Obser
OK tohe
2020-04-16Make the control socket name depend on the routing domain we are in.Florian Obser
That way, when slaacd gets started in a different rdomain with route exec things just work, no need to provide an alternative control socket. Pointed out by claudio Original diff by benno, but I like my bikeshed purple. OK benno, claudio
2020-04-14When slaacd is run in a routing domain (rdomain) other than the default (0) itFlorian Obser
sends router solicitations and receives router advertisements only from interfaces that are in its own rdomain. It also only sees interfaces arriving, or departing in its own rdomain. However, for the default route there is rdomain cross-talk because slaacd configures the default route in the default rdomain (and fails). Make slaacd honour the rdomain it's running in as well. OK denis, phessler, benno
2020-03-28Move ND6_PRIV_* constants from nd6.h to slaacd the only place whereFlorian Obser
they are used. Nobody in the wider eco system uses these. While here reduce temporary address valid lifetime to 2 days as per draft-ietf-6man-rfc4941bis. This should considerably reduce the amount of addresses configured on an interface - a common complaint. Original diff from Fernando Gont (fernando AT gont.com.ar), thanks! Ports tree scanning by sthen@
2019-12-15semarie diagnosed a what appeared to be a 'large backwards memcpy' of anTheo de Raadt
ipv6 address, but was actually oversize (a large union). correct access to the right subfield. ok florian semarie
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 06:44:05 +0000