summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2020-01-26Don't validate '-c' with S_ISREG(). The install script uses /dev/stdin.Kenneth R Westerback
Noticed by sebastia@
2020-01-24simplify, no need to make a copy of the filename, pointer is fineMarc Espie
okay millert@ schwarze@
2020-01-24Fix isakmpd monitor process to use the exit status of main processYASUOKA Masahiko
when exiting. "make sense" deraadt
2020-01-24Allow carp(4) interfaces to be configured via dhcp.Kenneth R Westerback
Original diff & testing from dtucker@ ok beck@ dtucker@
2020-01-23Separate command line syntax parsing from semantic validation ofKenneth R Westerback
command line contents. Display usage() when syntax is incorrect and relevant error messages when semantic checks fail. More akin to the way other commands handle the syntax/semantic split. Idea taken from a larger diff by kn@. ok kn@
2020-01-22delete wasteful ;;Theo de Raadt
ok tedu
2020-01-22remove semicolons not needed after } statements. ok deraadtTed Unangst
2020-01-21use an underscore for -p's argument, rather than hyphen: matches SYNOPSISJason McIntyre
and usage();
2020-01-20Move warning about DHO_STATIC_ROUTES (option 33) to debug.Kenneth R Westerback
Continued emittance noticed by mlarkin@ ok florian@
2020-01-20We can not share a cache between validating and resolving strategies.Florian Obser
The resolving only strategies mess up the negative cache by claiming DNSSEC related records do not exist which confuses the validating strategies. Found the hard way by kn@ and analysed by otto@ OK kn@
2020-01-19add some explicit tagging macros; OK kn@ on a previous versionIngo Schwarze
2020-01-16Add '-p' command line option which allows to configuretobhe
the UDP encapsulation port, similar to isakmpd's '-N' flag. Being able to change the UDP encapsulation port is useful in cases where ESP and UDP ports 500 and 4500 are blocked or rate limited. ok sthen@
2020-01-16Usually, -width Fl (which is 10n) is too wide and hence ugly.Ingo Schwarze
Change several instances, most of them to the usual -width Ds.
2020-01-16Fail on missing anchorkn
There is no reason to continue on anchor specific paths if the given anchor does not exist. OK sashan
2020-01-15Do the actual pfr_strerror() to pf_strerror() renamekn
Missed in previous
2020-01-15Unify error message for nonexisting anchorskn
pf(4) returns EINVAL for DIOCGETRULE, DIOCGETRULES and DIOCGETRULESET if the specified anchor does not exist. Extend and rename {pfr -> pf}_strerror() to make error message more consistent. There are other occasions as well but those need additional tweaks; that's stuff for another diff. OK and rename from sashan
2020-01-15Support multiple x509 extensions and extensions with multipletobhe
subjectAltName fields. The new parser code is inspired by tls_check_subject_altname() from libssl. ok markus@
2020-01-15s/deprecated/ignored/ in the warning message if -6 is used; the optionStuart Henderson
is ignored (the behaviour previously behind -6 is now the default so if this flag was used, it can happily be removed.
2020-01-15If we don't find a certificate signed by a trusted CAtobhe
with subjectAltName matching srcid, try certificate with only matching subjectAltName. ok patrick@
2020-01-15Refine error messagekn
While code in pf/pfctl confusingly uses either anchor or ruleset depending on the context, pfctl(8) (both manual and user interface) should be consistent. For users there are basically anchors only, so do not imply any difference between the two terminologies. OK sashan
2020-01-15Merge radix_perror() into simpler warnx()/errx() usagekn
Less nesting for clearer code. OK sashan
2020-01-15Further document recursive flush behaviourkn
OK sashan
2020-01-15Print the main ruleset/anchor as "/" not "<root>" for consistencykn
OK sashan
2020-01-15Recent change to pfctl(8) prompts for a minor update of manpage.Alexandr Nedvedicky
OK kn@
2020-01-15Enable pfctl(8) to recursively flush rules and tables from PF driver. TheAlexandr Nedvedicky
recursive operation ("pfctl -a '*' ...") works for '-s' option already. This change enables the same thing for '-F' option, so "pfctl -a '*' -Fa" will flush everything from PF driver. The idea was discussed with many on tech@ in spring 2019. OK kn@
2020-01-15Replace duplicate error message with gai_strerror(3)kn
getaddrinfo(3) may fail for multiple reasons, but error message should be unique in general. OK bluhm
2020-01-14Remove IPsec flow blocking unencrypted IPv6 traffic which wastobhe
meant to prevent VPN leakage but repeatedly broke people's setups. The -6 flag which used to disable the blocking flow is now ignored and prints a deprecation warning. ok kn@ bluhm@ phessler@
2020-01-08Unify duplicate NOTIFY payload construction code in ikev2_add_notify andtobhe
remove unused arguments from ikev2_add_* functions. ok bluhm@
2020-01-07Link ESP-SA and IPcomp-SA using GRPSPIS instead of using a self-builttobhe
solution for multi-SA flows. As a result we only need a single outgoing IPCOMP flow and can get rid of the two extra transport mode flows for ESP. ok bluhm@
2020-01-04ping(8): improve "-i wait" parsing and error-checking codecheloha
- Never accept negative values. - Cap the interval at UINT_MAX seconds to avoid strange rounding behavior at the end of the input range. - Use error messages that resemble other parts of the tree where we are able to use strtonum(3). - Leverage modf(3) for cleaner code. - Call it "-i interval" to avoid accidental visual similarity to "-w maxwait". With input from cjeker@, kettenis@, kn@. ok kn@
2019-12-28Refactor child SA cleanup.tobhe
ok bluhm@
2019-12-27Fix ifconfig WPA key installation with max allowed length SSIDs.Stefan Sperling
ok claudio phessler deraadt sthen
2019-12-25timeout(9): new flag: TIMEOUT_SCHEDULED, new statistic: tos_scheduledcheloha
This flag is set whenever a timeout is put on the wheel and cleared upon (a) running, (b) deletion, and (c) readdition. It serves two purposes: 1. Facilitate distinguishing scheduled and rescheduled timeouts. When a timeout is put on the wheel it is "scheduled" for a later softclock(). If this happens two or more times it is also said to be "rescheduled". The tos_rescheduled value thus indicates how many distant timeouts have been cascaded into a lower wheel level. 2. Eliminate false late timeouts. A timeout is not late if it is due before softclock() has had a chance to schedule it. To track this we need additional state, hence a new flag. rprocter@ raises some interesting questions. Some answers: - This interface is not stable and name changes are possible at a later date. - Although rescheduling timeouts is a side effect of the underlying implementation, I don't forsee us using anything but a timeout wheel in the future. Other data structures are too slow in practice, so I doubt that the concept of a rescheduled timeout will be irrelevant any time soon. - I think the development utility of gathering these sorts of statistics is high. Watching the distribution of timeouts under a given workflow is informative. ok visa@
2019-12-24dmesg(8) allocated a bit too much memory due to padding of structAlexander Bluhm
msgbuf. Use the same size algorithm in kernel and userland. OK cheloha@ guenther@ deraadt@
2019-12-23Ralph Dolmans from nlnetlabs points out that libunbound usesFlorian Obser
ub_event_pluggable.c instead of ub_event.c. ( https://github.com/NLnetLabs/unbound/issues/99 ) We have been the odd one out, so switch to ub_event_pluggable, too.
2019-12-20Try to bind to port 53 before opening the control socket.Florian Obser
The bind might fail if another daemon is running while the control socket opening will succeed. Then we end up with an overwritten control socket, unwind exiting and no control socket to the already running unwind. Found the hard way by deraadt OK deraadt, mestre, kn, pamela
2019-12-19The previous fix for creating isakmpd(8) IKE pcap file, weakenedAlexander Bluhm
the path sanitizer in the privsep parent. Bring back the checks in a way that works with new realpath(3). tested and OK hshoexer@
2019-12-19Spell "mount point" as other man pages do, with a space.Anthony J. Bentley
ok jmc@
2019-12-18Workaround unbound github issue #99.Florian Obser
https://github.com/NLnetLabs/unbound/issues/99 ub_ctx_delete would free the passed in event_base leading to use-after-free since libunbound never allocated the memory and unwind expects to continue using the event_base.
2019-12-18Update to libunbound 1.9.6Florian Obser
Heavy lifting by sthen with updating in-tree unbound(8).
2019-12-18Implement unwindctl status memory to show chache memory usage.Florian Obser
testing by otto & pamela as part of a larger diff
2019-12-18Rework unified cache handling to be able to unify key and neg caches.Florian Obser
testing by otto & pamela as part of a larger diff
2019-12-18Use neg and key cache from the passed in environment if initialized so thatFlorian Obser
unwind can share caches between strategies. testing by otto & pamela as part of a larger diff
2019-12-17Use correct size when zeroing out dinode.Todd C. Miller
Fixes a bug on file systems using the rev1 inode structure where the size of the in-memory and on-disk dinode differ. From Chris Waddey; OK deraadt@
2019-12-17Reject leases that do not provide a subnet mask for the address beingKenneth R Westerback
provided. Restores behaviour previously provided by the default dhclient.conf.
2019-12-15Make this fit in 80 cols.Florian Obser
2019-12-15semarie diagnosed a what appeared to be a 'large backwards memcpy' of anTheo de Raadt
ipv6 address, but was actually oversize (a large union). correct access to the right subfield. ok florian semarie
2019-12-15Allow more outgoing ports, the default 16 is pretty tight for theOtto Moerbeek
recursor. Also change strategy to not fetch addresses of nameservers pro-actively, it does not help a lot in typical unwind setups and consumes resources we would like to spend on actual resolving user queries. ok florian@
2019-12-14Be less aggressive pre-allocating memory; ok florian@Otto Moerbeek
2019-12-14Simplify resolve_done.Florian Obser
- check if this is an answer to a still running query up front, if not there is nothing more to do - get rid of the retry case, we can now just inline it - reduce indent by always calculating elapsed time for DOUBT_NXDOMAIN_SEC Triggered by, input and OK otto
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 13:31:51 +0000