summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2019-11-03 When we are talking to an upstream nameserver we should not refuse toFlorian Obser
forward queries for certain reverse zones (e.g. RFC1918 space). The local network might use them and it's the policy of the upstream nameserver what should be done with these. Of course if we are recursively resolving ourselves these should not leak to the global internet so we continue to synthesize NXDOMAIN ourselves. For now we also always synthesize NXDOMAIN for special use domains like test and onion. Pointed out by henning. Input & OK sthen
2019-11-03*** empty log message ***Otto Moerbeek
2019-11-02unused globalFlorian Obser
2019-11-02When we are behind a captive portal we very likely need to use the asrFlorian Obser
strategy to get past it. This is also true when we don't know yet if we are behind a captive portal. However, when the nameserver dhcp hands us are unreachable (e.g. because they are down) asr is dead, we are still using it and we are now stuck. Only force to asr if we know that it is working. If we are behind a captive portal and the dhcp nameserver are dead we probably won't get past it. But if we are in a network with unreachable dhcp nameservers we will make progress. Stumbled upon by remi while blocking port 53 in pf. OK remi
2019-10-31Constrain and correct the routes being deleted when applying a newKenneth R Westerback
lease. Constrain by only looking at static routes, which are the only kind dhclient will add. Correct by realizing direct /32 routes in the lease look different when returned from the routing table. Further correct route comparison by applying appropriate netmask to both destination addresses before comparing them. Fixes "arpresolve: ... route contains no arp information" issue reported on bugs@. Much problem analysis and fix testing by Lauri Tirkkonen. Thanks!
2019-10-31 With the asr fallback we can skip the service port up & down dance,Florian Obser
unwind should now be able to work in networks with crappy middle boxes. We also need to switch to the ASR resolver, not DHCP when we are behind a captive portal. Some captive portals let through DNS queries with edns0 options but the "click here to accept the terms of service page" is not resolvable with edns0.
2019-10-31Add asr resolver type which completely bypasses libunbound and uses theFlorian Obser
libc asynchronous resolver directly with DHCP provided nameservers. This is a last-ditch effort when we find ourself behind a completely broken middle-box. Input & OK otto OK benno
2019-10-29mobileip is going to the atticDavid Gwynne
2019-10-27Print interface index and name for RTM_NEWADDR, RTM_DELADDR andKenneth R Westerback
RTM_CHGADDRATTR messages. Be consistant and eliminate ':' after all 'name's. ok bluhm@
2019-10-25Forgot to add '\30AUTOONF4" to ifnetflags[].Kenneth R Westerback
route will now show "AUTOCONF4" in flags.
2019-10-24Fix ifconfig(8) compiler warnings regarding variable "name" reuse.Alexander Bluhm
Call the global variable with the name of the interface "ifname". Do not pass it around, just use it globally. Do not use "ifname" for anything else. OK deraadt@
2019-10-21Optionally log blocked queries when using the block list.Florian Obser
OK benno
2019-10-19Plug mem leak when the list of dhcp resolvers didn't change. ok florian@Otto Moerbeek
2019-10-18Plug mem leak in error path; ok florian@ who also spotted the rad caseOtto Moerbeek
2019-10-18Another case of using yacc effectively to avoid repeating code; ok florian@Otto Moerbeek
2019-10-18Reafctor forwarder clause to avoid having to write out the same codeOtto Moerbeek
a couple of times by declaring optional stuff the proper way. ok @florian
2019-10-17Use -1 to indicate an invalid uid/gid, not UID_MAX and GID_MAX.Todd C. Miller
This is the userland portion. OK deraadt@ sashan@
2019-10-17Fix some compiler warings in ifconfig(8). Move all prototypes andAlexander Bluhm
variables used in multiple .c files into common ifconfig.h. Basically this renames brconfig.h to ifconfig.h and also uses it for sff.c. Fix missing prototypes. Global variable name s is bad as it shadows local variables. Call it sock and use it everywhere. OK deraadt@
2019-10-12handle version.bind / version.serverFlorian Obser
2019-10-12Carry the answer in the pending_query struct. Makes it clearer who isFlorian Obser
responsible for freeing allocated memory.
2019-10-12Be more strict with which queries to accept. Modeled afterFlorian Obser
worker_handle_request() in unbound(8).
2019-10-12Don't hand parse the query, libunbound has query_info_parse() for that.Florian Obser
This requires a switch to sldns_buffer to satisfy the API. But it will be benefitial later on for even stricter input validation.
2019-10-08 Make sure struct pending_query is fully initialized by using calloc.Florian Obser
Doesn't matter currently but lead to some head scratching while working on new things.
2019-10-06Eek, check overflow with destination size, not sourceFlorian Obser
2019-10-03Fix CVE-2019-16866Florian Obser
--- Recent versions of Unbound contain a problem that may cause Unbound to crash after receiving a specially crafted query. This issue can only be triggered by queries received from addresses allowed by Unbound's ACL. --- tested by benno, tb
2019-09-30 Introduce defines for DNSSEC validation states.Florian Obser
This also fixes a brain fart in trust_anchor_resolve_done() which was arguably created by "sec" carrying 3 values and "true" does not mean secure. Why this does not use enum sec_status is beyond me.
2019-09-29Fix histogram code to do an inclusive check for the upper bound toOtto Moerbeek
avoid an out-of-bound write for specific values and also check for oob writes in general; with input from kettenis; ok florian@ kn@
2019-09-29annoying trailing whitespacesFlorian Obser
2019-09-26Use SPI_SA() instead of __func__ in all logging calls. Use log_infotobhe
instead of log_debug in error cases. ok bluhm@ sthen@
2019-09-26Fix leaks by cleaning up after configuration parser.tobhe
ok bluhm@
2019-09-25 Do not leak cur_ns in case of malformed lease file.Florian Obser
Found by llvm's scan-build. OK deraadt, benno
2019-09-25Be more robust when dealing with malformed lease files.Florian Obser
Do not assume that required tokens have been generated by strsep. (toks[0] cannot be NULL but it doesn't hurt to be explicit about it.) Found by llvm's scan-build. OK deraadt, kn
2019-09-22Let sysctl(1) work in single-user mode. Same diff applied by florian@Kenneth R Westerback
to ps(1). Noted by kettenis@. florian@'s fix pointed out by maestre@. ok maestre@
2019-09-20Document the output of 'ifconfig scan' in client mode.Stefan Sperling
ok mlarkin
2019-09-12 Update to libunbound 1.9.3Florian Obser
Heavy lifting by sthen with updating in-tree unbound(8)
2019-09-06More Version 1 AT&T UNIX history.Ingo Schwarze
This became possible because copies of the original v1 manuals have shown up on the Internet some time ago. Reminded by Sevan Janiyan <venture37 at geeklan dot co dot uk>.
2019-09-03It's perfectly normal for the SIOCGIFFLAGS and SIOCGIFXFLAGS to failFlorian Obser
when an interface is gone. Bubble the error up and let the callers deal with it instead of exiting. OK deraadt, benno
2019-09-02More correction of section 3 layout. directory->opendir, fts->fts_open,Theo de Raadt
getcap->cgetent. pwcache->user_from_uid. And then repair references. ok jmc
2019-09-02Make net80211 expose reasons for association failures to userland and haveStefan Sperling
ifconfig display them in 'scan' output and on the ieee80211 status line if the failure is applicable to an already selected AP (e.g. wrong WPA key). This will hopefully reduce the amount of help requests for what often turn out to be trivial misconfiguration issues that were previously hard to diagnose without debug mode. ifconfig must be recompiled with the new ieee80211_ioctl.h to stay in sync with the kernel. A full 'make build' will do the right thing! Very helpful input by mpi@ and deraadt@
2019-08-31The algorithm creating the routing addresses in route(8) and arp(6)Alexander Bluhm
were still not correct. While the values written to the kernel are fine, the bytes for padding were taken from memory after the sockaddr structs. In route(8) the union of sockaddrs can be made larger, so that the padding is taken from there. In arp(8) the size of the struct is known. Copy only the struct and advance over the padding. The memory has been zeroed before. Merge all address size fixes from arp(8) into ndp(8). OK claudio@
2019-08-30mop up for the pcap.3 rename;Jason McIntyre
help/ok deraadt
2019-08-30Remove configured IPv6 addresses remaining when slaacd(8) detects apamela
link-state change and no new router advertisement is obtained (in accordance with RFC 6059). This should improve IPv6 -> legacy-IP-only transitions, preventing applications from believing IPv6 connectivity is available when it is not, potentially resulting in long timeouts. suggestion, input and OK florian@ phessler@
2019-08-30whitespace, found while pondering improvements to sffdumpTheo de Raadt
2019-08-29The kernel uses rtm_addrs as a bit field for addresses that areAlexander Bluhm
included in the routing message. The significance of the bits has to be consistent with the order of the addresss. In route(8) store addresses in ascending order of RTA values. This allows to use MPLS routes together with route labels. OK mpi@ claudio@
2019-08-29Remove redundant ikev2_msg_valid_ike_sa() call.tobhe
ok patrick@
2019-08-29route(8) used inet/inet6 autodetection also for the link addressAlexander Bluhm
type. Provide the address family AF_LINK and storage size of struct sockaddr_dl to the kernel when creating an IFP routing address. OK mpi@
2019-08-29fix a comparison which generated a warning on sparc64.David Gwynne
found by deraadt@
2019-08-29make the list of OM fibre distances go OM1, OM2, OM3, not OM2, OM1, OM3David Gwynne
2019-08-28At startup, unveil entire filesystem to read-only. If after privdrop, someTheo de Raadt
implausible bug existed in the socket setup (mostly dns-related and setsockopt) it would be largely neutered. of course, a very restrictive pledge is installed soon after that... ok mestre brynet florian
2019-08-28s/No separable connector/No connector/David Gwynne
shrinks some QSFP+ DAC output a bit.
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-13 05:25:26 +0000