summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2012-08-08fix type (part from NetBSD)Alexandr Shadchin
ok miod@
2012-08-08remove mac68k leftoversJonathan Gray
ok miod@ mpi@ deraadt@ martin@
2012-07-26Make interface_status() assume that a link is up when IFM_AVALIDKenneth R Westerback
is not set. This is what the late interface_link_status() did. Allows drivers who cannot tell what the link state is to get dhcp leases. Prodding by henning@. ok deraadt@ miod@
2012-07-26load os passive fingerprints when testing the ruleset; ok henningMike Belopuhov
2012-07-25do not check ns here, we're supposed to compute it; ok krw@ deraadt@Otto Moerbeek
2012-07-14replace (somewhat) magic numbers with constantsAlexander Hall
ok krw@
2012-07-14ansifyAlexandr Shadchin
ok deraadt@
2012-07-14fix typo in commentAlexandr Shadchin
ok deraadt@
2012-07-14zap whitespaceAlexandr Shadchin
ok deraadt@
2012-07-13small tweak;Jason McIntyre
2012-07-13Change the configuration format fed to the isakmpd FIFO to be ableMike Belopuhov
to specify extended options like SA Lifetime. All the hard work was done by lteo@, while naddy@ and me have made sure that defaults and AH still work; sthen and jmc have looked over the diffs as well.
2012-07-13Replace a '512' with DEV_BSIZE. Calculate physmem size in blocks andKenneth R Westerback
not sectors, since the values being tested/manipulated in the auto_alloc tables are blocks at that point. Use MEG(256) instead of hand expanding it when testing physmem.
2012-07-13Support additional MODP DH groups in the Phase 1 and Phase 2.Mike Belopuhov
lteo@ noticed that ipsecctl allowed them within the ike rules while isakmpd failed to load the generated configuration. The fix was verified by hshoexer, ok naddy
2012-07-13allow destination/prefixlen syntax for ipv6 routes.Sebastian Benoit
from Florian Obser, florian -AT- narrans -DOT- de ok sthen@
2012-07-13Use NULL instead of 0 for pointersAlexandr Shadchin
ok gilles@, guenther@
2012-07-11MBR can't handle the truth.Kenneth R Westerback
When reading disk size/geometry from disklabel, clamp disk size to the maximum number of cylinders that fit into UINT32_MAX sectors. Don't just use the bottom 32 bits of the DL_GETDSIZE(). Warn that truncation has been done.
2012-07-11Simplify guts and calling of getuint(). Eliminate a useless 'help'Kenneth R Westerback
capablity by using help text as regular prompt for 'size' and 'offset'. Try to detect and handle more overflow/underflow conditions in getuint() and ensure returned value is always within requested bounds. Handle zero-length partitions by treating them as UNUSED. tested & ok halex@
2012-07-10Rename "life" to "lifetime" to match iked.Lawrence Teo
ok mikeb naddy sthen; procedures ok henning
2012-07-10disable lidsuspend on shutdownAlexander Hall
ok phessler@ mpf@ pirofti@ mpi@
2012-07-10use PFSTATE_SCRUBMASKHenning Brauer
whenever you see (flags >= ONE_OF_THE_FLAGS), run. that must break sooner or later.
2012-07-10Allow an implicit address family for af-to rules. If the addressAlexander Bluhm
family can be determined by the "from" or "to" parameter in the matching part, it is no longer necessary to specify "inet" or "inet6" there. OK henning@ mikeb@
2012-07-10intermediate hack^Wugly "fix" to prevent spurious "scrub ()" printsHenning Brauer
+ XXX comment as reminder to clean this up for good
2012-07-10set { ... } -> set ( ... )Henning Brauer
brought up by ryan, discussed with him and theo and they convinced me
2012-07-09Fix typo in warning message.Lawrence Teo
ok mikeb sthen haesbaert henning
2012-07-09We always want to do unit conversions. So flags parameter of getuint()Kenneth R Westerback
is now superflous. With rounding gone the offset parameter is similarly superfluous. Simply getuint() accordingly.
2012-07-09I want some of what kjell was smoking 10 years ago when he addedKenneth R Westerback
units handling by copying getuint() from disklabel. MBR partition id and disklabel partition type are different beasts. So deciding to round off a MBR partition with id FS_BSDFFS meant rounding off NTFS partitions. And FS_SWAP partitions meant DOS FAT 12. So just nuke rounding off for now to simplify getuint(). ok beck@
2012-07-09Make 'swap' command work like fdisk(8) says -- you must supply two validKenneth R Westerback
partition numbers.
2012-07-09Terminate with extreme prejudice the multiple timeout queuingKenneth R Westerback
mechanism that was a holdover from when dhclient handled multiple interfaces at once. There is only one timeout possible at a time. Also move calculation of current time to just before check to see if the timeout has expired. ok beck@ guenther@
2012-07-09fix some of the confusion we have in pf regarding filter criteria vsHenning Brauer
options that "write" to the packet by putting the latter in a set { } block. for now prio and tos, maintain set-tos backwards compat for the moment. "match set { prio 6, tos lowdelay }" "match set prio 6" from a discussion with ryan in tokyo a while ago, ok ryan phessler
2012-07-09Revert previous.Kenneth R Westerback
The standards gpds are jealous gods. kettenis@ and beck@ have shown EROFS is the wrong thing to return. So revert to EACCES until a better error code is decided on.
2012-07-09Use strtonum() instead of strtol() inside ask_num(). Many overflowsKenneth R Westerback
are thus avoided. Since bounds are now reliable don't check the returned value for being in-bounds. Since default value is forced inside bounds, don't bother being tricky and passing a default that is outside the bounds being specified. ok beck@
2012-07-08set_pid() does not need prompt string, low or high parameters. TheseKenneth R Westerback
are all constants. Independantly suggested by guenther@.
2012-07-08Disallow manual security associations that use AES-CTR, AES-GCM,Christian Weisgerber
or AES-GMAC. These algorithms cannot be used safely with static keys and RFCs 3686, 4106, and 4543 expressly forbid such configurations. Also include a tweak (with jmc@) to the key size explanation, for completeness sake. ok mikeb@
2012-07-08New attempt to make the -P flag work with -ss, so that states can beLawrence Teo
printed with port names if desired. tcpdump's pf_print_state.c has diverged significantly from pfctl's, so the change to tcpdump's pf_print_state.c is not exactly the same as pfctl's. ok henning sthen
2012-07-08Split out an ask_pid() function rather than over-parameterizing theKenneth R Westerback
ask_num() function. Remove now unneeded 'flags' and 'help' parameters from both. Display out of range values in hex in ask_pid(), since we are seeking hex input. ok guenther@
2012-07-08Return EROFS when a read-write mount of a read-only sd(4) deviceKenneth R Westerback
is attempted. This is instead of the current EACCES and is intended to result in better error messages from mount(8). Tweak default EROFS error text to mention fsck'ing in mount_ext2fs and mount_msdos since they both have fsck's like ffs. ok deraadt@ aja@ ian@ phessler@
2012-07-08Call Xsetpid() to edit the partition type from Xedit() rather thanKenneth R Westerback
duplicating the code. Allows simplification of the EDIT() #define in Xedit() since we always ASK_DEC and use a NULL help parameter when invoking ask_num().
2012-07-08if you use nitems() in userland, you must define it yourselfTheo de Raadt
discussed with guenther
2012-07-08Nuke useless EDIT() #define in Xsetpid.Kenneth R Westerback
A #define to simplify a function calling snippet does not simply or help when it is used only once.
2012-07-08Replace tricker atoi() and hand rolled parsing with strsep() andKenneth R Westerback
strtonum(). Make related error messages consistant. ok haesbaert@
2012-07-07copy&paste mistake in error messageChristian Weisgerber
2012-07-07remove incorrect check in pfctl preventing set-tos for ipvshit.Henning Brauer
the kernel has code to deal with set-tos and that crap. don't ask for details. stuart ok
2012-07-07rename prio in struct pf_rule and related structs to set_prio so it isHenning Brauer
utterly clear this is not a filter criteria but a packet modification thing. also preparation for upcoming changes, including one to unscrew this mess (I should not have to touch half the tree for this - ifixitlater) not user visible, ok gcc
2012-07-07Replace atoi() with strtonum() where it's easy. Make related errorKenneth R Westerback
messages consistant. Check for valid partition when 'select'ing a partition. ok haesbaert@
2012-07-05don't output "esn" string in the rule section as we can't use theMike Belopuhov
keyword in the grammar to create a esn-enabled rule (no reason to do so for manual sa configuration). instead decode sa flags so that we can also watch changes happening in the realtime with the monitor mode. prompted and ok by naddy
2012-07-05when rekeying ike sa copy more info from the old one;Mike Belopuhov
fixes the last known iked inter-op problem with windows 7.
2012-07-03Improve the key derivation function to produce correct keying materialMike Belopuhov
when rekeying IKE SA as specified in the section 2.18 of RFC5996. Makes Windows 7 clients a bit happier.
2012-07-02checking state flags make sense only when processing a responseMike Belopuhov
2012-07-02augment every sa_free call with a debugging log messageMike Belopuhov
2012-07-02Don't close IKE SA immediately after creating a new one when rekeying.Mike Belopuhov
Instead set a timeout that will shut it down in case we don't get an SA delete notification.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 06:18:01 +0000