summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2021-01-21Rearrange variables in dump / restore to handle -fno-common.mortimer
Largely following the commit by mckusick in FreeBSD. ok naddy@
2021-01-20Make sure to enforce matching dstid as initiator. Use policy lookuptobhe
to make sure the negotiated SA matches the selected policy. ok patrick@
2021-01-19Make imsg event structs static to fix -fno-common.Florian Obser
Follows claudio's lead in ospfd et al. Problem reported by mortimer.
2021-01-19Move control_state and ctl_conns to control.c, it's not neededFlorian Obser
elsewhere and unbreaks -fno-common. Inspired by claudio Problem reported by mortimer
2021-01-19Prevent more yacc clashes; fixes -fno-common.Florian Obser
Problem reported by mortimer.
2021-01-19Reduce scope of routesock unbreaking -fno-common.Florian Obser
Problem reported by mortimer.
2021-01-19No need for a global uw_process; unbreaks -fno-common.Florian Obser
Problem reported by mortimer
2021-01-19Make imsg event structs static to fix -fno-common.Florian Obser
Follows claudio's lead in ospfd et al. Problem reported by mortimer.
2021-01-19Move control_state and ctl_conns to control.c, it's not neededFlorian Obser
elsewhere and unbreaks -fno-common. Inspired by claudio Problem reported by mortimer
2021-01-19No need for a global slaacd_process; unbreaks -fno-common.Florian Obser
Problem reported by mortimer
2021-01-18Remove c++ comment that snuck in and remove useless debug output.Florian Obser
2021-01-18Sync SA configuration payload to new SA after IKE SA rekeying.tobhe
2021-01-17umb(4) sets a default interface priority too; mention it hereStuart Henderson
ok deraadt
2021-01-17Mark up locations of KAME hack with #ifdef __KAME__ so that we canFlorian Obser
find it again if and when we no longer need it. No object change.
2021-01-16Oops, fix previous.Florian Obser
We only want to recover the scope id if it hasn't already been recovered. But we want to always copy the link-local address.
2021-01-16Only recover the KAME embedded scope if the sin6_scope_id is notFlorian Obser
initialized. If it is set assume the scope was already recovered. OK bluhm, claudio
2021-01-16Only recover the scope_id if it was not set. This way this code worksClaudio Jeker
both with and without embedded scope. OK bluhm@ florian@
2021-01-16Only recover the KAME embedded scope if the sin6_scope_id filed isClaudio Jeker
not initalized. If it is set assume that the scope was already recovered. This is required to get rid of all this scope madness in the long run. OK bluhm@ florian@
2021-01-13kernel, sysctl(8): remove dead variable: tickadjcheloha
The global "tickadj" variable is a remnant of the old NTP adjustment code we used in the kernel before the current timecounter subsystem was imported from FreeBSD circa 2004 or 2005. Fifteen years hence it is completely vestigial and we can remove it. We probably should have removed it long ago but I guess it slipped through the cracks. FreeBSD removed it in 2002: https://cgit.freebsd.org/src/commit/?id=e1d970f1811e5e1e9c912c032acdcec6521b2a6d NetBSD and DragonflyBSD can probably remove it, too. We export tickadj via the kern.clockrate sysctl(2), so update sysctl.2 and sysctl(8) accordingly. Hypothetically this change could break someone's sysctl(8) parsing script. I don't think that's very likely. ok mvs@
2021-01-13Temporary addresses are preferred for 1 day and valid for 2.Florian Obser
Lifetimes are extended from router advertisements within these limits. From weerd@
2021-01-12Implement listening on 53/TCPFlorian Obser
Since we are only serving localhost we could get away with doing serving over UDP only because we have a huge MTU on lo0, it's still not correct behavior. This also enables sending truncated answers with TC set if the answer does not fit into the edns announced udp size. Testing at least by matthieu, jca, otto, phessler OK phessler
2021-01-12Rewrite query parsing and answer formatting using libunbound providedFlorian Obser
functions. With this we can filter out DNSSEC RRsets if the client did not ask for them. We will also be able to send truncated answers to indicate to the client to switch to tcp. This will be enabled in the next commit. Testing at least by matthieu, jca, otto, phessler OK phessler
2021-01-12Sometimes a user ID was logged in pflog(4) although the logopt ofAlexander Bluhm
the rule did not specify it. Check the option again for the log rule in case another rule has triggered a socket lookup. Remove logopt group, it is not documented and cannot work as struct pfloghdr does not contain a gid. Rename PF_LOG_SOCKET_LOOKUP to PF_LOG_USER to express what it does. The lookup involved is only an implemntation detail. OK kn@ sashan@ mvs@
2021-01-06do not call log_addr() when the address is NULLanton
ok florian@
2021-01-02add three missing .Dv macros,Ingo Schwarze
and move punctuation out of two that are already there
2020-12-30getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. florian@ mentioned this might be a problem in slaacd(8) and rad(8) after claudio@ fixed it in bgpd, so i went looking...
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-12-29If we manage to send all "count" flood pings before receiving allFlorian Obser
answers we would exit after receiving the first answer and claiming a (huge) packet loss. OK benno
2020-12-28Add back keyword "any" to match any IP address, which actually workstobhe
after recent fixes.
2020-12-28Add support for kern.video.record.Marcus Glocker
ok mpi@
2020-12-27Fix "any" and "dynamic" keywords for flows and add proper IPv6 support.tobhe
For traffic selectors with a keyword on either 'from' or 'to' side, install flow with address family of the opposite side. If both source and destination address are keywords, install flows for both address families. The 'dynamic' keyword is special as it will only install flows for the address family of the dynamically assigned address (specified with the 'config address' option). ok patrick@
2020-12-26Update default preference listkn
OK florian
2020-12-26Otto hit an impossible situation: an answer bigger than 64k.Florian Obser
Log the query and answer SERVFAIL instead of exiting fataly. That way we can at least figure out where libunbound goes off the rail. OK otto
2020-12-22Log SPI with SPI_SH() wherever possible.tobhe
2020-12-21Use policy_test() to reassign existing SAs to updated policies aftertobhe
'ikectl reload'. This prevents initiation of new additional SAs for each policy every time the config is reloaded. ok patrick@
2020-12-20Don't leak ipsec_hosts when building hosts_list.tobhe
ok patrick@
2020-12-17Use strtonum() instead of atoi() to parse port option.tobhe
2020-12-17Sort command line options.tobhe
ok bluhm@
2020-12-16Fail to parse rules with invalid rangeskn
This makes pfctl(8) detect bogus ranges (with and without `-n') before loading the ruleset and completes the previous commit. OK sashan sthen
2020-12-16Reject rules with invalid port rangeskn
Ranges where the left boundary is bigger than the right one are always bogus as they work like `port any' (`port 34<>12' means "all ports") or in way that inverts the rule's action (`pass ... port 34:12' means "pass no port at all"). Add checks for all ranges and invalidate those that yield no or all ports. For this to work on redirections, make pfctl(8) pass the range's type, otherwise boundary including ranges are not detected as such; that is to say, `struct pf_pool's `port_op' member was unused in the kernel so far. `rdr-to' rules with invalid ranges could panic the kernel when hit. Reported-by: syzbot+9c309db201f06e39a8ba@syzkaller.appspotmail.com OK sashan
2020-12-15Fix leak of REQUEST string.tobhe
2020-12-13Make sure flow src and dst addresses have the same address family.tobhe
ok patrick@
2020-12-11The keyword "any" does not actually work properly for traffic selectors.tobhe
To match all traffic use 0.0.0.0/0 or ::/0. ok patrick@
2020-12-11Introduce query_imsg2str() to simplify printing "qname class type".Florian Obser
OK kn some time ago
2020-12-11The recent fix to handle large answers in unwind (errata #5 for 6.8)Florian Obser
has the downside to always copy the maximum IMSG size (about 16k) between the resolver and frontend process for DNS answers because we had to keep it as simple as possible. We can now rearange things in -current to be less wasteful. This copies only the usually small DNS answer. In the unusual case that a DNS answer is larger than the maximum IMSG size fragment the message and send multiple IMSGs.
2020-12-11Warning: arithmetic on a pointer to void is a GNU extension; mergedFlorian Obser
upstream.
2020-12-11Sprinkle in some static to prevent missing prototype warnings; mergedFlorian Obser
upstream.
2020-12-11sync to libunbound 1.13.0Florian Obser
Support for channel reuse of TCP and TLS (DoT) streams should improve latency when the DoT strategy is used in unwind.
2020-12-11pass down the `skip' flag to the mountfs() function in the case ofRobert Nagy
manually mounting a device which is not present in fstab(5) so that the `-s' flag can be used in this case as well. ok millert@, deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-28 02:58:27 +0000