summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2017-06-01Expand $eapid in iked tags, allowing PF rules to be written based on EAPStuart Henderson
identity (username). OK mikeb@
2017-06-01Return time_uptime as value for when pf was enabled instead ofPatrick Wildt
time_second. Since time_second changes depending on the wall- clock time, time_second is not a reliable source for the status. We can even end up with a negative time delta. Thus, use the monotonically growing time_uptime and export it to userland. ok bluhm@ mikeb@
2017-05-31fold the vnetid and parent lines into a single encap line.David Gwynne
this is a modest attempt to shorten the ifconfig output. encap wont show up if neither vnetid or parent are supplied by an interface. whitespace tweaks from benno@ output tweaks from reyk@ ok deraadt@ henning@
2017-05-30Fix escaping: .Nm Op Fl "Dx" turning into "pflogd [-DragonFly]"Ingo Schwarze
is funny, but not useful, so say .Nm Op Fl \&Dx as required.
2017-05-30fix a commentHenning Brauer
2017-05-28Don't check np->port for NULL - it's an array, it's never NULL.Michal Mazurek
OK bluhm@
2017-05-28Elegant and reliable link status checking courtesy of mpi@.Kenneth R Westerback
Less of unreliable ioctl(SIOCGIFMEDIA), more getifaddrs(). ok mpi@
2017-05-28print_ioctl() is unused if not debugging. Found with clang, afterMichal Mazurek
marking the function "static". Use OSFP_DEBUG, in a similar fashion to OPT_DEBUG (pfctl_optimize.c). OK bluhm@
2017-05-27Move includes.Michal Mazurek
This reduces the diff with usr.sbin/tcpdump/pfctl_osfp.c. The change from tcpdump is newer, so change pfctl. No binary change. OK deraadt@
2017-05-27Mention the display.font variable in EXAMPLES.Frederic Cambus
As mentioned by miod@ here [1], wsconsctl(8) has a currently undocumented 'display.font' variable allowing to change the current font on framebuffer consoles. [1] http://undeadly.org/cgi?action=article&sid=20131023125815 OK deraadt@
2017-05-26Move logic to set default client-identifier into aKenneth R Westerback
separate function so it can be used in multiple places.
2017-05-26Whitespace rectification of a couple of mis-indentations.Kenneth R Westerback
2017-05-26Move the two loops through the leases fileKenneth R Westerback
looking for a valid recorded lease into a separate function and thus make them consistent. No intentional functional change.
2017-05-21A few more freezero() usesTheo de Raadt
ok yasuoka mikeb
2017-05-19tweak partition sizes for auto-alloction to better suit 8G disksOtto Moerbeek
ok kr@ aja@
2017-05-15Fixup printing of queue bandwidth specificationsMike Belopuhov
Reported by Carl Mascott, thanks! OK sthen
2017-05-15Put the closing parenthesis in the right spot and fix std-dev calculationMike Belopuhov
2017-05-15Hook up FQ-CoDel to the tree and enable configuration in the pfctl(8)Mike Belopuhov
OK sthen, visa
2017-05-12Make the markup of negative parameters consistently use .Cm;Ingo Schwarze
those are command modifiers, not flags. Inconsistency noticed and patch sent in by Anton dot Lindqvist at gmail dot com.
2017-05-04Merge headers defining identifiers from sysctl.8 into sysctl.3. Shorten andTheo Buehler
update their descriptions. In sysctl.8 refer to /etc/sysctl.conf in FILES. discussed with and ok jmc
2017-05-03Use the safe idiom of cleaning sensitive data from memory with explicit_bzero,Ricardo Mestre
instead of relying on other methods, after readpassphrase. Some programs on this diff won't benefit that much since it happens near the terminal path, but someone might copy the unsafe idiom to another program and place it where it may leak sensitive data. Discussed aeons ago with tb@, OK deraadt@ and beck@
2017-04-28Remove double assignmentsMike Belopuhov
2017-04-26Perform H-FSC root queue allocation in the kernelMike Belopuhov
Since only leaf queues can have packets assigned to them, H-FSC requires the user specified root queue to have a parent. To simplify userland tools and the configuration interface, the kernel can be leveraged to set it up. ok henning
2017-04-26cope with IP address changes. before, we were trying to resend the msgHenning Brauer
with the no-longer-available address over and over and over, requiring iked to be restarted eventually. instead, on EADDRNOTAVAIL, schedule SA deletion so a new one is set up shortly thereafter. ok reyk mikeb
2017-04-25Use strtonum instead of strto{,u}ll for simpler and better overflowTheo Buehler
checking, make somaxconn and sominconn unsigned. Issue reported by orge on freenode, thanks! Input, patient explanations and ok deraadt, millert.
2017-04-24Fix configuration of ASN1_DN IDs.Reyk Floeter
Public key authentication uses public key files that are stored in the /etc/iked/pubkeys/ directory where the IKE IDs are encoded as filenames. This does not simply work with ASN1_DNs where the IDs include slashes and other special characters. Instead of breaking and failing when an ASN1_DN is configured, simply skip the public key lookup but allow to use it with certificates or PSKs. Reported and fix tested by Igor V. Gubenko - Thanks.
2017-04-23oops, this was meant to be committed with the pfctl.8 change:Jason McIntyre
sync usage() with SYNOPSIS;
2017-04-23trim the documentation for -k: make it more consistent,Jason McIntyre
and do not try to do all the documenting in SYNOPSIS/usage(); ok deraadt
2017-04-21Add "key" modifier for -k to make pfctl can kill a state by specifyingYASUOKA Masahiko
the key of the state. ok sasha
2017-04-19Rename all SA groups to bundles consistently. The first kernelAlexander Bluhm
commit in 2000 that introduced the features already called them SA bundles. The word group is taken by Diffie-Hellman, reusing it causes confusion. OK hshoexer@
2017-04-19Switch base tools from /dev/bpf0 to /dev/bpf. Now that /dev/bpf has beenMartin Natano
around for two releases, it should be safe to do so. ok bluhm deraadt sthen tb yasuoka
2017-04-19Bump numbers for /usr/obj allocation with *big* compilers.Theo Buehler
ok otto
2017-04-19enlarge obj to satisfy new world order that has *big* compilers andOtto Moerbeek
remove condition for static linking; ok tb@
2017-04-18Tweak parameters to decode_*, add a check or two, and thus gain most of theKenneth R Westerback
sanity improvements reyk@ recently put into dhcrelay to ensure no more than the captured packet is processed.
2017-04-18After 11 years of pondering about it I think that brookdavis@freebsd.orgKenneth R Westerback
had it correct. Don't BPF_WORDALIGN() the value for the number of bytes read() into the buffer. This could theoretically cause the processing of 1 - 3 more bytes than were read.
2017-04-18use freezero()Theo de Raadt
2017-04-16Different compilers and versions of compilers have different warnings.Jonathan Gray
Remove -Werror to give code a greater chance of building. ok deraadt@ florian@
2017-04-14Up to now ipsecctl(8) grouped SAs with identical src and dst to theAlexander Bluhm
flow which the first SA matched by the flow type. This behaviour was mostly undocumented and unexpected. Make SA bundles explicit in ipsec.conf(5). Only group SAs that have the same src and dst and also the same bundle identifier. OK hshoexer@
2017-04-13fix wrongly indented linesJonathan Gray
2017-04-13Add a NAT-T keepalive timer in case we are behind a NAT gateway.Patrick Wildt
See RFC 5996, section 2.23, NAT Traversal: In the case of a mismatching NAT_DETECTION_DESTINATION_IP hash, it means that the system receiving the NAT_DETECTION_DESTINATION_IP payload is behind a NAT and that system SHOULD start sending keepalive packets as defined in [UDPENCAPS]. With markus@, ok reyk@
2017-04-12Prevent inosused from wrapping when soft updates is enabled whileTodd C. Miller
scanning the used inode map. The code as written assumes inosused is signed but this is no longer the case. OK deraadt@
2017-04-12RTM_PROTO3 messages should not trigger a resolv.conf check.Kenneth R Westerback
2017-04-12Shuffle another function.Kenneth R Westerback
2017-04-11Shuffle route/interface changing functions together into kroute.c. Try toKenneth R Westerback
group related functions in kroute.c together and comment them a bit. No intentional functional change.
2017-04-11Fold priv_write_file() into its only remaining userKenneth R Westerback
priv_write_resolv_conf() and move the latter into kroute.c with all its priv_ friends. No intentional functional change.
2017-04-10Rework -L logic to use the idiom used in handling the leases file.Kenneth R Westerback
i.e. open FILE during program set up and use the FILE created for the rest of the program lifetime after dropping privilege and pledge()'ing. No need for passing messages to the priv process. Tweak lease file handling a bit in passing. Monitoring the -L file with external programs like sysutils/entr still works. Looks good to sthen@.
2017-04-10Found another len += snprintf...Theo de Raadt
ok mikeb
2017-04-10Remove always false comparison: inosused type is ino_t, which isFrederic Cambus
unsigned. While there, fix a whitespace issue. OK deraadt@
2017-04-09Seven casts, a couple of tweaks and CFLAGS+=-Wsign-compare for theKenneth R Westerback
win. No intentional functional change.
2017-04-08Reduce the overburden of signed vs unsigned comparisons by sprinklingKenneth R Westerback
'int' -> 'unsigned int' (and visa versa) where obvious. Steal a couple of 'unsigned' -> u_int32_t from reyk@'s dhcrelay tweaks. No intentional functional change.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-11 23:14:11 +0000