summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2010-11-09when setting the rdomain, use the same define as the kernelJonathan Gray
for the maximum route-id instead of a currently incorrect number ok claudio@
2010-11-08fixup number rounding; ok reykMike Belopuhov
2010-11-02expose the kernels network livelock counterDavid Gwynne
2010-11-01bye bye wpa-psk. instead of using ifconfig wpapsk `wpa-psk password` youTheo de Raadt
can now simply use ifconfig wpakey password ok damien
2010-11-01add support for (full length only) hex keys to the wpakey code. for theTheo de Raadt
remainder of the 4.8->4.9 transition, alias wpapsk to wpakey (since it swings both ways) ok damien halex tedu
2010-10-25range check rtm_type more carefully against the known RTM_ values.Theo de Raadt
this is not the real solution to PR 6500; claudio is going to fix that properly in the kernel ok claudio
2010-10-23make sure an interface is registered before we start using itPeter Hessler
found by clang OK claudio@, krw@
2010-10-19convert to fuse cast from the libcrypto. with a simplification nit fromMike Belopuhov
blambert, ok jsg, "seems ok" todd
2010-10-18document the new wpakey optionAlexander Hall
prodded by deraadt@ "tweak previous" expected... ;-)
2010-10-18as determined 4 years ago, FortiGate needs DOI of 0 responses to DPDTodd T. Fries
so, copy a small bit of logic to make DPD interop with FortiGate function tested by me, ok mikeb@, silence from 'the usual suspects'
2010-10-18Revert non-compatible and undocumented bullshit commited by 3 developersTheo de Raadt
who decided to just do it on their own. henning, mcbride, jsing -- shame on you -- if you had shown this diff to just 1 other network developer, the astounding mistake in it would have been noticed. Start practicing inclusionary development instead of going alone. ok claudio
2010-10-18smm bits removal; whilst here, fix up aliases.5;Jason McIntyre
2010-10-18Add wpakey/-wpakey options. This was originally written by halex andTheo de Raadt
has gone many times around now (it is smaller now). man page diff coming soon. Fits onto the media that need it. ok halex
2010-10-17Add quirks support to operating system fingerprinting. tcpdump partJoel Sing
by mcbride@. ok mcbride@ henning@
2010-10-15fixup generation of suites string for isakmpd wrt "group none"Mike Belopuhov
bug noticed and fix tested by robert
2010-10-15Switch the remaining users of libdes in src to libcrypto,Jonathan Gray
telnet portion partially from the latest heimdal. ok mikeb@
2010-10-15Add and ignore DHCP option 66/0x42 TFTP server name.Jonathan Gray
ok krw@ phessler@
2010-10-15tweak previous;Jason McIntyre
2010-10-15freebsd uses SIGINT to request a reboot, we may as well be consistent.David Gwynne
pointed out by kettenis@ and deraadt@
2010-10-14add a SIGQUIT handler that does the same as USR1 and USR2, except itDavid Gwynne
reboots the machine instead just halting or powering down. diff from Jonathan Matthew manpage tweaks from jmc@ ok deraadt@
2010-10-14plug a tiny leak.David Hill
ok mikeb@
2010-10-14looks like i jumped the gun with the duid stuff; back it outJason McIntyre
2010-10-13paste in the description of "special"; ok krwJason McIntyre
2010-10-12pfctl -sr did not show divert-reply rules without address familyAlexander Bluhm
correctly. A zero address field is used to identify divert-reply rules. If the rule's address family is unspecified, PF_AZERO() always returns false. So use AF_INET6 as address family, to check all bits of the address. ok markus@
2010-10-11Make route(8) use the ROUTE_TABLEFILTER and change the code so thatClaudio Jeker
route(8) will default to the process rtableid. route -T 1 exec route add default 192.168.1.1 route -T 1 exec route -n show These commands will now operate outmatically on rtable 1 and not on rtable 0 as it was done before. OK henning@
2010-10-11Remove net.inet.tcp.recvspace and net.inet.tcp.sendspace here as well.Claudio Jeker
Reminded by jmc@
2010-10-08use the right capitalization in the Nd strings.Igor Sobrado
ok jmc@
2010-10-06Retire SkipjackMike Belopuhov
There's not much use for the declassified cipher from the 80's with a questionable license these days. According to the FIPS drafts, Skipjack reaches its EOL in December 2010. The libc portion will be removed after the ports hackathon. djm and thib agree, no objections from deraadt Thanks to jsg for digging up FIPS drafts.
2010-10-03tweak previous;Jason McIntyre
2010-10-01the grammar of my last commit worked with mandoc, but didn't work with nroff;Reyk Floeter
convert a long .Op line into a few lines of .Xo ... .Xc. no "binary" change with mandoc.
2010-10-01Add the -R id option to pfctl that allows to show only a specified ruleReyk Floeter
by numeric ID in combination with the "-s rules" or "-s labels" options. For example, this allows you to dump the statistics of a specified rule only (pfctl -sr -v -R 0). ok henning@
2010-09-30promote openssl errors to the warning level; ok reykMike Belopuhov
2010-09-30check that there are transforms in the proposal before tryingMike Belopuhov
to actually parse it. ok reyk
2010-09-30disable padding correctly. therefore we no longer need to supplyMike Belopuhov
additional space in the buffer and just pad input length up to the block size. finalization is not needed for properly padded data. kills a bunch of XXX's and an annoying error from openssl. also, check a result from CipherUpdate while here. ok reyk
2010-09-30More information about creating and maintaining the PKI with a link toReyk Floeter
ikectl(8).
2010-09-29Add missing err.h includeDavid Coppa
OK deraadt@
2010-09-28document disklabel uids and move a little text to improve readability; theJason McIntyre
duid text was supplied by krw ...after much discussion with jsing and krw ok krw
2010-09-24Make it possible to use "dhclient egress" to refetch a lease withoutClaudio Jeker
rememberingwhich interface dhclient was actually active on. Requested by deraadt, OK deraadt@, krw@
2010-09-24remove the check that enforced rdr-to only inbound and nat-to only outbound.Henning Brauer
both now can be used in both directions. the kernel allowed that ever since we did the great NAT rewrite. still enforce that a direction is given, a rule with rdr-to and/or nat-to and no direction is pretty certainly an error (which it would work, technically) ok ryan claudio dlg
2010-09-24Now that HW_DISKNAMES returns xx0: or xx0:uid entries, we must truncateTheo de Raadt
the : and uid components out -- otherwise these two programs will work poorly.
2010-09-23tweak the disklabel uid stuff; ok jsingJason McIntyre
2010-09-23Correctly identify mount points when they are specified in /etc/fstab usingJoel Sing
a disklabel UID. Based on a diff from josh@elsasser.org. Resolves PR6471. ok krw@
2010-09-23Print disklabel UIDs using printf/fprintf instead of using the hand rolledJoel Sing
uid_print() function. ok krw@
2010-09-23change description for AES-GMAC a bit.Mike Belopuhov
prompted by reyk
2010-09-23support for aes-gcmMike Belopuhov
OK reyk
2010-09-22Support AES-GCM-16 (as aes-gcm) and ENCR_NULL_AUTH_AES_GMACMike Belopuhov
(as aes-gmac) encryption transformations in the ipsec.conf(5). Available "enc" arguments denoting use of 1) AES-GCM-16: aes-128-gcm for 160 bit key (128+nonce) aes-192-gcm for 224 bit key (192+nonce) aes-256-gcm for 288 bit key (256+nonce) 2) ENCR_NULL_AUTH_AES_GMAC: aes-128-gmac for 160 bit key (128+nonce) aes-192-gmac for 224 bit key (192+nonce) aes-256-gmac for 288 bit key (256+nonce) Please note that aes-gmac family performs no encryption and provides no confidentiality and is intended for cases in which confidentiality is not desired (it can be thought of as AH with NAT-T support). Also, although this implementation supports manual keying, it's use is strictly discouraged as AES-GCM security depends on frequent re-keying. So it can be thought of as a debug facility only. Example configuration: ike esp from 172.23.61.36 to 172.23.61.156 \ quick enc aes-256-gcm \ psk humppa Thoroughly tested by me and naddy. Works fine with Linux. Requires updated pfkeyv2.h include file. OK naddy
2010-09-22Support for use of AES-GCM-16 (as AESGCM) and ENCR_NULL_AUTH_AES_GMACMike Belopuhov
(as AESGMAC) ciphers in the ISAKMP Phase 2 (aka Quick Mode). Thoroughly tested by me and naddy. Works fine with Linux. Requires updated pfkeyv2.h include file. ok naddy
2010-09-22support INVALID_KE_PAYLOAD notification sent by the responder in caseMike Belopuhov
the initiator chose wrong D-H group. in this case we throw away our SA and start over with a proper group. makes iked work as an initiator with strongswan/charon without any specific "ikesa" (phase 1) configuration. ok reyk
2010-09-22new log opt "matches"Henning Brauer
awesome for debugging, a rule like match log(matches) from $testbox will show you exactly which subsequent rules match on that packet real ok theo assumed oks ryan & dlg bikeshedding many implementation time ~1 min bikeshedding about the keyword longish. i voted for "matches" since i like to play with matches idea was theo's, actually
2010-09-2115 months later, there is still no mpls(4) man page: .Xr mpls 4 -> MPLSJason McIntyre
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 08:32:11 +0000