summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2020-08-06Delete commented out code.tobhe
2020-08-06Avoid reading one byte before the path buffer.Christian Weisgerber
This happens when there's only one component (e.g. "/foo"). This bug has been present since June 1990 when it was commited to mountd.c SCCS version 5.9. Note: the bug is on the second changed line, the first line is changed for visual consistency. From CheriBSD via FreeBSD ok millert@ deraadt@
2020-08-05Move TPMR section above TRUNK to sort alphabeticallykn
Reminded by jmc
2020-08-05Document tpmr ioctls and synopsiskn
Add missing TPMR section to ifconfig(8) by moving the commands from the driver's manual to it (copy/paste) and document the ioctl(2) interface in tpmr(4). Indenting tpmr's first EXAMPLE while here; from jmc. OK jmc
2020-08-05Print tpmr(4) memberskn
tpmr is a trivial bridge and has no specific ioctls, so to distinguish it from the rest we must rely on the interface name; assuming that it is tpmr because neither is_bridge() nor is_switch() return success is not possible due to the way ifconfig is designed: it runs all *_status() commands for all interface types. OK dlg
2020-08-05Merge switch_status() into bridge_status()kn
This is to reduce duplicate code and prepare for bridge_status() to cover all bridge like interfaces: bridge(4), switch(4) and tpmr(4). OK dlg
2020-07-31Ensure DECLINE messages always contain the address from the OFFER.Kenneth R Westerback
DECLINE messages emitted when required options were missing did not contain the address. Reported via tech@ and fix tested by Dominik Schreilechner.
2020-07-29Remove redundant bridge checkskn
bridge_status() and switch_status() do the regular sanity check with SIOCGIFFLAGS, but both functions also call is_switch() and bridge_status() also calls is_bridge(). is_bridge() checks SIOCGIFFLAGS again, then both is_*() helpers finally do driver specific ioctl(2) calls to test whether the given interface is indeed a bridge(4) or a switch(4). SIOCGIFFLAGS serves no purpose here and is taken care of in ifconfig.c's getinfo(), so remove its calls from brconfig.c entirely. OK dlg
2020-07-27Fix return value check for openssl API used during pubkey validation.tobhe
Found thanks to bug report by Michael Scheibel <m.Scheibel (at) tuvit (dot) de> ok patrick@, markus@, tb@
2020-07-26Document aggr(4) in the TRUNK sectionkn
Complete the synopsis while here. Feedback OK jmc
2020-07-23Fix ibuf leak in sa_localauth when SA is freed.tobhe
ok patrick@
2020-07-21rename PF_OPT_TABLE_PREFIX to PF_OPTIMIZER_TABLE_PFX and move it to pfvar.hHenning Brauer
OPT is misleading and usually refers to command line arguments to pfctl ok sashan kn
2020-07-21unify and cleanup -DSEEALSO chunks in both disklabel MakefilesTheo de Raadt
2020-07-21Provide GRE over transport mode examplekn
First transport mode for child SAs was implemented, then a few interoperability issues have been identified with peers other than iked, now tobhe fixed pubkey (`rsa' ikeauth, default) usage based on this so this "just works". Feedback tobhe deraadt sthen OK tobhe
2020-07-21Handle TEMPORARY_FAILURE notification on IKESA rekeying.tobhe
If we rekey both the IKESA and an CHILDSA in a small time window a strongswan peer might reposend with a TEMPORARY_FAILURE notification. In this case we retry the rekey of the IKESA after a short timeout and queue PFKEY expire messages (by returning -1 in ikev2_rekey_sa()), so the CHILDSA rekeying gets delayed. ok markus@
2020-07-21extra garbage line found during archeologyTheo de Raadt
2020-07-20Fix dst/src port configuration bug with multiple flows.tobhe
ok patrick@
2020-07-20Mention hostid and checksumkn
Complete the description of "-s info -v" such that grepping for them in the manual pager yields something. Feedback jmc OK sashan
2020-07-20iked: fix typo in fatalxStuart Henderson
2020-07-19Try to deal with no reply from PF_KEY on pfkey_sa_add.tobhe
ok markus@
2020-07-17'seonds' -> 'seconds'.Kenneth R Westerback
From Larry Hynes via tech@.
2020-07-16Remove unused assignment.tobhe
2020-07-16Make sure to update policy dependant SA fields after policy_lookup().tobhe
ok kn@ patrick@
2020-07-15Make CERT and CERTREQ payloads optional for public key authentication.tobhe
When using certificate authentication the CERT payload is mandatory and as the name suggests is used to send a certificate containing a public key used for the authentication signature. For pubkey authentication the key is preshared and stored locally, but only the 'ca' process can read the local keys. The 'ikev2' process had to get the key from the received CERT payload to verify the authentication signature. The peer ID + raw key was then forwarded to the 'ca' process which compared the key against the contents of /etc/iked/pubkey and returned either CERTVALID or CERTINVALID. With this change a message containing only the ID may be sent from 'ikev2' to the 'ca' process if CERT was not included. In this case the CA process will try to find a local key matching the ID and return it to the 'ikev2' process. The auth verification happens after the 'ca' process has verified or found a key and returned it to the 'ikev2' process, eliminating the need for the CERT payload. Making CERTREQ optional is easier because we already have a fallback case if the CERTREQ can not be fulfilled. If no CERTREQ was received we now use this same fallback. This should fix public key authentication interoperability with *swan and other IKEv2 implementations. ok and tested by kn@ ok patrick@
2020-07-15POWE9 CPUs provide an energy sensor that accumulates the emount of energyMark Kettenis
used by the processor chip. Although we have a SENSOR_WATTHOUR sensor type its units are not really suitable for this sensor. So add a SENSOR_ENERGY type that uses micro Joules as its unit. ok deraadt@
2020-07-14Properly clean up and dereference 'old' policy after failed lookup.tobhe
ok patrick@
2020-07-13Both phase 1 and phase 5 need the cylinder group meta data, so save thoseOtto Moerbeek
in phase one to be used in phase 5, unless we're tight on memory. From FreeBSD; ok bket@
2020-07-10table fix;Jason McIntyre
2020-07-10Document which crypto transforms are enabled by default.tobhe
2020-07-08Always try to retransmit on sendtofrom() errors to ensure the SAtobhe
is properly cleaned up in ikev2_msg_retransmit_timeout(). ok patrick@
2020-07-07Revert r1.121 and rewrite merge_option_data() to achieve same effectKenneth R Westerback
w/o using string functions on data that *MIGHT NOT* be NUL terminated. Fiddle parse_domain_name_list() to avoid string functions for the same reason. Problem encountered by Jesper Wallin when running with vm.malloc_conf=CFGJUR, although he later proved 'J' (more junking) was the actual trouble maker.
2020-07-07Fix shared DH secret length in log message.tobhe
ok patrick@
2020-07-07Stop using make_addr() which trims trailing zeros of the netmask, setYASUOKA Masahiko
family and length field. This fixes route(8) to handle "::/0" properly. Also fix "route add -inet 0.0.0.0 -prefixlen 0 (gateway)" to work properly. ok kn
2020-07-03Rename IN6_IFF_PRIVACY to IN6_IFF_TEMPORARY.Florian Obser
This is the name the other BSDs use for this, there is no reason to be different, the IPv6 RFCs call these addresses temporary, and some software in ports wants to use this as well. Most recently pointed out for firefox by landry. OK claudio, sthen
2020-06-27remove the spacing around "arp | rarp", as prompted by schwarze;Jason McIntyre
2020-06-27macro fixes; from matthew martinJason McIntyre
2020-06-26Replace SIMPLEQ concatenation loop with SIMPLEQ_CONCATbket
OK florian@, kn@, millert@
2020-06-25Silence ca_validate_pubkey() error message for cert typetobhe
IKEV2_CERT_X509_CERT.
2020-06-25Rework 'ikeauth' configuration option. The key and cert checks in the configtobhe
parser aren't needed as they are checked at runtime during the handshake. Moreover, these checks during startup of the daemon never worked properly when dstid was not explicitly configured. The dstid depends on the ID message payload which is only known after the initial handshake. ok patrick@
2020-06-24spelling fix; from matthias schmidtJason McIntyre
2020-06-24Fix botched format string in previous commit as spotted by robert@Otto Moerbeek
2020-06-22use (undocumented) base64 code in libc instead of libcrypto.David Gwynne
naddy gave me a pointer in the right direction ok millert@ deraadt@ looks good to matt dunwoodie
2020-06-21various minor tweaks;Jason McIntyre
2020-06-21wgpip -> wgendpoint. ok dlg@Matthieu Herrb
2020-06-21teach ifconfig about wireguard.David Gwynne
note that this links ifconfig with libcrypto to get at base64 encoding and decoding routines. im looking at an alternative way to do that, so hopefully this is temporary. secondly, note that all the wireguard stuff is under ifndef SMALL, so the special build of ifconfig for install media does include wireguard support, and also does not need libcrypto. from Matt Dunwoodie and Jason A. Donenfeld ok deraadt@
2020-06-20With filesystem having many cylinder groups and many inodes per cg theOtto Moerbeek
ncg * ipg calcualtion can overflow if signed types are used. Move to uint32_t for the relevant values. Aligned with FreeBSD changes. Also make sure newfs refuses to create an fs with more that 2^32-1 inodes. ok millert@
2020-06-18Fix handling of short EAP-MSCHAP messages.tobhe
ok patrick@
2020-06-17Fix length check in ca_getreq().tobhe
ok patrick@
2020-06-15Log errors with log_info and SPI prepended.tobhe
2020-06-09Move AUTH_REQUEST SA state change from parser to IKE_AUTH exchange handler.tobhe
ok patrick@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-01 10:45:06 +0000