summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2019-02-13(unsigned) means (unsigned int) which on ptrdiff_t or size_t or otherTheo de Raadt
larger types really is a range reduction... Almost any cast to (unsigned) is a bug. ok millert tb benno
2019-02-13Nuke unused variable.Kenneth R Westerback
2019-02-13Try harder to start a new line when link is obtained and a newKenneth R Westerback
message is about to be displayed on the console.
2019-02-12Restructure code to simplifiy imsg communications, further separatingKenneth R Westerback
DHCP knowledge and interface manipulation. Unprivileged process now sends proposal derived from the accepted lease to the privileged process rather than individual interface manipulation requests. The only intended functional change is that /etc/resolv.conf.tail is not re-read each time a new proposal is implemented, rather than once at dhclient startup.
2019-02-11With the rewrite of the trust anchor handling code we no longer need aFlorian Obser
directory writable by group _unwind. Move the on-disk trustanchor to /var/db/unwind.key. OK sthen
2019-02-10Delete BUGS: dubious style and not relevant/accurateJeremie Courreges-Anglas
Noticed by deraadt@
2019-02-10Add a warning that scan_ffs doesn't support FFS2 filesystemsJeremie Courreges-Anglas
Hints and wording from jmc@
2019-02-10Drop useless .TH line; ok jmc@Jeremie Courreges-Anglas
2019-02-10Anchor names must not be emptykn
The parser would allow bogus input and sometimes even produce invalid rules on empty anchor names, so error out immediately. OK sashan
2019-02-10Unify anchor name sanity checkskn
For anchor names, make `load anchor' use the same grammar as `anchor' and merge unique checks from both places so that anchor names are validated regardless of the specific rule at hand. OK sashan
2019-02-10Simplify trust anchor handling.Florian Obser
Open trust anchor file for reading and writing on startup and pass it to the frontend process. The frontend process seeks and truncates the file apropriately when writing out new trust anchors learned via DNS but never closes the file. On error the file is truncated to zero length. This is in turn handled on startup by switching to the built in trust anchor when no trustanchor can be read from disk. This side steps the need for an unveil'ed directory with "c" permission and also removes the wpath and cpath pledges from the parent process. deraadt@ pointed out that my previous design didn't make sense and I had confused myself along the way. (It did work, but was too complicated for no good reason). While here validate that we actually read a trust anchor from disk by trying to parse it and checking that it is a DNSKEY. Unfortunately ub_ctx_add_ta() accepts just any string as a trust anchor without any validation.
2019-02-08Backport r5108 from unbound upstream, pointed out by florian@.Stuart Henderson
Shouldn't affect unwind but keeping in sync. r5108 | wouter | 2019-02-08 15:05:24 +0000 (Fri, 08 Feb 2019) | 3 lines - Fix #4225: clients seem to erroneously receive no answer with DNS-over-TLS and qname-minimisation.
2019-02-08update unwind's copy of libunbound to match the new 1.9.0 update inStuart Henderson
/usr/src/usr.sbin/unbound, diff from florian@
2019-02-08Oops, unbreak captive portal detection.Florian Obser
The captive portal process needs to receive sockets from the main process to speak http to.
2019-02-07Rewrite trust anchor handling.Florian Obser
Do not use the libunbound's auto trust anchor file feature since it then the resolver process needs rpath, wpath, and cpath pledges and permission on the trust anchor file. Instead configure the trust anchor as resource record strings. The parent process opens the file, passes a filedescriptor to the frontend process to parse the file and then passes trust anchors to the resolver process to (re-) configure the resolver contexts. The resolver process periodically probes for new trust anchors (DNSKEY records of the root zone) and passes those to the frontend process. This in turn requests a file descripter for writing from the parent process. Once the trust anchors have been written the parent process renames the tmp file to the final location. Also provide a built in trust anchor for boot strapping purposes if no file is found on disk. That way we can get rid of unbound-anchor in unwind's rc.d script.
2019-02-06Replace overlapping memcpy() with memmove() in getpathname().Todd C. Miller
Same fix as in fsck_ffs. OK deraadt@ tb@
2019-02-06Replace overlapping memcpy() with memmove() in getpathname().Todd C. Miller
Found the hard way and OK tb@
2019-02-05Cm yes | Cm no -> Cm yes | noJason McIntyre
2019-02-05unref resolver in error branchFlorian Obser
2019-02-05missing full stop;Jason McIntyre
2019-02-05dev_t is signed to permit passing -1 as an invalid condition, but theTheo de Raadt
decomposition into major and minor is unsigned, so we should print them with %u instead of %d. ok guenther
2019-02-04various minor tweaks, plus an adjustment from florian;Jason McIntyre
ok florian
2019-02-03Stop lying about slaacd(8).Florian Obser
This requires quite a bit of yak shaving until we can pick up nameservers from router advertisements. Pointed out by sthen & kn
2019-02-03Captive portal detection for unwind(8).Florian Obser
2019-02-02Show the routing address selected by "route-to" in "pfctl -s states".YASUOKA Masahiko
ok sthen
2019-02-01Don't send udp sockets that we failed to open to the frontend,Florian Obser
it will crash when it sees a -1 FD. Found the hard way by solene on a box without ::1
2019-02-01port is in network byte orderFlorian Obser
2019-01-31Make divert-packet port accept any port specificationkn
Contrary to other rules accepting a single port, this one only works with numerical values. Fix it by simply using the proper grammar. Port ranges are not accepted, but an error message on a range without start was missing in general, so add it while here. OK bluhm
2019-01-31Remove a log statement used for debugsolene
ok florian@
2019-01-31restrict commands reload and log to root onlysolene
tweaks and ok florian@
2019-01-30fix parsing of imcomplete dhclient.lease files, initialize epoch to 0.Sebastian Benoit
ok florian@
2019-01-30check that ips in the forwarder {} sections are indeed ips.Sebastian Benoit
ok florian@
2019-01-30remove not needed includes in uw_parse.ySebastian Benoit
add some to unwind.h clean up some whitespace. ok florian@
2019-01-29replace err() with yyerror/YYERROR, only leave err() where we run outSebastian Benoit
of memory and can't do anything else. This way we don't terminate on config reload with a bad config. ok florian@
2019-01-29Get rid of ugly access(2) and still be able to run without a configFlorian Obser
file. Prodded by deraadt
2019-01-29notyetFlorian Obser
2019-01-29Bring macro section in line with other config file man pages.Florian Obser
otto@ pointed out that we lost a description on HOW to use macros.
2019-01-29Make imsg processing much more paranoid.Florian Obser
If it comes from one of our processes and the size does not match what we expect call fatalx to crash and burn. We either hit a logic bug or something is fishy on the other end and we can't trust that process any longer. Not that we trust those processes to begin with. This also applies to receiving resources that we don't expect. For example if we have an open UDP listen socket and get a new one passed from the main process something is wrong and we should crash and burn. The only place where we are more lenient is on the control socket. We just ignore wrong sized messages so that users can't bring down unwind.
2019-01-29nl in forwarder line is optional, makes the grammar conform more to manualOtto Moerbeek
ok florian@
2019-01-29We don't need IMSG_SHUTDOWN, we can just close the sockets.Florian Obser
pointed out by deraadt
2019-01-29Add a dedicated sysctl(2) node for witness(4).Visa Hankala
The new node contains the subsystem's main control variable, kern.witness.watch. It is aliased by the old name, kern.witnesswatch. The alias will be removed in the future. OK anton@ mpi@
2019-01-29Reuse copy_satopfaddr() when killing entrieskn
Recently introduced in pfctl_parser.c r1.333, this helper nicely simplifies code when copying IPs based on their address family, so use it in five other places when killing state or source node entries. All addresses copied in these code paths result from either pfctl_parse_host() or pfctl_addrprefix() which guarantee the address family set to AF_INET or AF_INET6. Therefore, effectively relaxing the case of unhandled families from errx(3) in callers to warnx(3) in copy_satopfaddr() is safe since it's never reached. OK sashan
2019-01-29Make -N and -r mutually exclusivekn
Either disable DNS or enable additional reverse lookups, but not both. OK benno
2019-01-28Simplify lookups when killing entrieskn
Killing source tracking or state entries by hostname or CIDR would pass given keys twice to getaddrinfo(3): once to resolve/parse and again to parse the numerical address in case a prefix was specified. Avoid this overhead by making pfctl_addrprefix() resolve, pass and mask in one go and return the list of IPs to the callers. This notably simplifies both logic and sanity checks around prefix length and address family. While here, also pass -N along such that -k and -K can be restricted to not use DNS. Discussed with procter sashan, OK sashan
2019-01-27Implement DNS over TLS (DoT).Florian Obser
2019-01-27Add ub_ctx_set_tls() to libunbound to enable DNS over TLS on a context.Florian Obser
2019-01-27unwind(8) traces its ancestry to rad(8) and inherited all of its includeFlorian Obser
directives, some of them no longer necessary. Cleanup by Caspar Schutijser, thank you very much!
2019-01-26Rename ACTION_NONE to ACTION_USELEASE. TOK_NOACTION to TOK_USELEASE.Kenneth R Westerback
More consistent, clearer.
2019-01-26Zap trailing space that stuck its head up.Kenneth R Westerback
2019-01-26Mention that -r does reverse DNS lookups for tables as wellkn
OK benno
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-01 11:49:24 +0000