summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2021-03-21The tag comes after iface in iked.conf(5).tobhe
2021-03-21Use new terminology of RFC 8981 and (mechanically) replace "privacy"Florian Obser
with "temporary".
2021-03-21Don't warn that we can't form a temporary address when a routerFlorian Obser
deprecates a prefix by sending a pltime of 0, this is normal. Continue warning when the pltime is smaller than 5 as this is almost certainly a configuration error. Found the hard way by & OK otto.
2021-03-20RFC 8981 allows the configuration of only temporary IPv6 addresses.Florian Obser
Keep "temporary" the default when setting inet6 autoconf but make it possible to disable the "autoconf" flag but keep "temporary" enabled. The normal usecase to only have temporary autoconf addresses would be "inet6 temporary" in hostname.if OK kn
2021-03-20RFC 8981 allows the configuration of only temporary IPv6 addresses.Florian Obser
Track autoconf and temporary flag individually to be able to support this. OK kn
2021-03-20Fix SMALL build when done from sbin/slaacdkn
distrib/special/slaccd is the actual SMALL user but having it build from here is useful, too; in fact, it showed some more unused variables under SMALL. OK florian
2021-03-19Edit wireguard for concision. Remove some background covered by wg(4).Richard Procter
Swap -wgpeerall and wgpeer in synopsis to ease parsing. "I'm good" - Matt Dunwoodie. "just commit" - jmc suggestions and ok sthen@
2021-03-19Fix function name in warningkn
2021-03-19RTM_IFINFO is providing the mac address now, no need to go throughFlorian Obser
getifaddrs on every route message. This also allows us to drop the route pledge since we only need to fetch the interface state with getifaddrs on startup.
2021-03-18Document "-tunneldomain" and "-mplslabel", complete MPLS synopsiskn
OK claudio
2021-03-17Split off init_ifaces from update_iface. init_ifaces discovers theFlorian Obser
state of the machine on startup using ioctl(2) and getifaddrs(3). We can then update this state with information provided by route messages. We still need getifaddrs(3) to check if the layer 2 address has changed. This simplifies error handling (what should we do if ioctl(2) fails?), reduces kernel round trips (no need to ask the kernel again for information RTM_IFINFO provided already) and prevents a theoretical race between RTM_IFINFO and getaddrinfo(3). In a fast link state UP -> DOWN -> UP transition RTM_IFINFO informs us that the link went down but we were not using this information but rather looked at getifaddrs(3) information which might see the link as already up again. We would then do nothing while we should try to get a new lease. By storing all interface information in the frontend process we can skip imsgs to the engine process if we get an RTM_IFINFO without relevant changes for us.
2021-03-16Add 'grp31' alias for curve25519 as documented in iked.conf(5).tobhe
2021-03-16Nuke unused time_t variable.Kenneth R Westerback
2021-03-16Move setifrtlabel() and *keepalive() prototypes out of SMALLkn
Those commands are not supported under SMALL; unless I overlooked others, this should be the last bit to declare all prototypes correctly wrt. SMALL (the overall unsorted order of both prototypes and commands makes this hard to spot). No object change, with and without SMALL.
2021-03-16sync to unbound 1.13.1; heavy lifting by sthenFlorian Obser
2021-03-16Don't (try to) deconfigure an interface that was never configured.Florian Obser
2021-03-16We can't learn anything interesting from RTM_NEWADDR, stop handlingFlorian Obser
it.
2021-03-15We makes sure that a dh group is required if the local proposaltobhe
contains an explicit group transform. Override requiredh if one of the local options is 'none' so that a proposal with no DH group and on with explicit group 'none' result in a match. ok patrick@
2021-03-15Ignore msg_ke in CREATE_CHILD_SA if DH negotiation results in grouptobhe
'none' (disabling PFS). Fixes a bug when the initiator sends a KE payload but the negotiation results in DH group "none". For other DH group mismatches we send an INVALID_KE notify, for 'none' we can just ignore the KE payload. ok patrick@
2021-03-14Log errors with log level info and SPI.tobhe
2021-03-14Since we are doing getifaddrs() anyway we can get the rdomain out ofFlorian Obser
AF_LINK and skip one ioctl. OK benno
2021-03-13Remove "deletetunnel" (deprecated with 6.4)kn
OK deraadt
2021-03-13Move all rdomain bits under SMALLkn
"[-]rdomain" commands are ignored under SMALL but their prototypes, the global and therefore dead print logic are still in. OK deraadt
2021-03-13Move MPLS related function prototypes under SMALLkn
OK deraadt
2021-03-12INET6_NOPRIVACY is called AUTOCONF6TEMP now, missed during rename.Florian Obser
2021-03-12Add deprecation warning for autoconfprivacy.Florian Obser
While here check address family for 'temporary' option, only inet6 is allowed. OK kn
2021-03-11fix a double space and a macro error;Jason McIntyre
2021-03-11When RFC 8981 obsoleted RFC 4941 the terminology changed fromFlorian Obser
"privacy extensions" to "temporary address extensions" Change ifconfig(8) to output temporary after temporary addresses and add "temporary" option which is an alias for autoconfprivacy for now. Also make AUTOCONF6TEMP a positiv flag that is set by default. Previously the negative flag "INET6_NOPRIVACY" was set when privacy addresses were disabled. This makes the flags output less ugly and will allow us to disable autoconf addresses while having temporary addresses enabled in the future. More work is needed in slaacd. input benno, jmc, deraadt previous verison OK benno OK jmc, kn
2021-03-11Use timespec timers to determine when select-timeout and timeout intervalsKenneth R Westerback
are exceeded. Feedback from otto@, cheloha@
2021-03-11Remove unhelpful sentence from TPMRkn
with dlg
2021-03-11Document veb(4)kn
All text is copied from other already existing sections, i.e. link flag handling from TPMR and the rest from BIDGE. Contrary to BRIDGE, add a synopsis for VEB such that there's a simple overwiew, especially since veb(4) currently does not explain *how* to use the described features. NB: While TPMR and VEB use the same wording for link flags, their semantics are different, i.e. both different flags and swapped polarity for those flags. Feedback jmc dlg OK dlg
2021-03-09Also log transforms on IKE SA rekey.tobhe
2021-03-09Zap stray Xrkn
2021-03-09Fix TRUNK synopsis alignmentkn
2021-03-09Replace time_t startup_time with struct timespec link_timeout.Kenneth R Westerback
Feedback from otto@
2021-03-09Do not adjust (uhm.. zero) the swap 'b' partition size if physmem isTheo de Raadt
zero (should not happen, but did), because the auto-allocate code will put a filesystem on that partition. ok otto kurt
2021-03-08dhclient relationship with "inet autoconf" is incorrect, it activatedTheo de Raadt
dhcpleased.
2021-03-08Add some references, most of these were removed when we stopped buildingJonathan Gray
and installing USD/SMM/PSD docs. jmc@ agrees with the direction, ok millert@ on an earlier diff
2021-03-07Reduce debug logging by moving protocol level debug logFlorian Obser
behind -vv or by deleting unneeded output. While here reword some debug output to make it more useful. (There is more to be done here.)
2021-03-07No need to cap the exponential backoff here, iface_timeout() alreadyFlorian Obser
handles this for us by doing a state transition if we have been stuck in "rebooting" or "requesting" for too long. Makes the code a bit simpler and we only have one place were we need to special case the timeout cap.
2021-03-07Log ESN for child SAs if enabled.tobhe
2021-03-07Withdraw nameservers when the interface goes down.Florian Obser
Problem reported by deraadt some time ago.
2021-03-07Fold get_lladdr into update_iface, now the only caller.Florian Obser
This allows us to pass the link state over to engine here instead of in update_addr which is not available in small. This gets us more in line dhcpleased.
2021-03-07No need to pass the link local and hw address around, we have itFlorian Obser
already in the interface on the engine side.
2021-03-07reshuffle to bring more in line with dhcpleasedFlorian Obser
2021-03-07Introduce engine_update_if().Florian Obser
This was too much code in the imsg handler.
2021-03-06whitespacetobhe
2021-03-06Implement last remaining bits to update from RFC 4941 to RFC 8981.Florian Obser
The desync factor is now tracked per temporary IP and the max value has been increased to about 9 hours. While here fix a bug where the minimum acceptable pltime in a router advertisement should be bigger than PRIV_REGEN_ADVANCE not the desync factor (which didn't make any sense at all). From Fernando Gont, thanks! OK sthen
2021-03-06Turns out there are dhcp servers that ignore DHCPREQUEST messages whenFlorian Obser
they don't like them instead of sending a DHCPNAK. Found the hard way by benno who didn't want to wait 127 seconds. Due to another bug dhcpleased would have exit through a fatal() in the frontend process if he had waited long enough for a Rebooting -> Init transition because we didn't deconfigure our IP address and thus didn't close our UDP socket. Upon configuring a new IP address we would open a new UDP socket send it to the frontend which would then fatal() due to an unexpected fd passed in. Aproporiate timings are rather underspecified in RFC 2131. Instead of doing an exponential backoff up to 64 in the "Rebooting" and "Requesting" state only go up to 2 for a total of 3 packets and total timeout of 3 seconds before going into "Init" state and sending a DHCPDISCOVER. To prevent the fatal() in the frontend process we reshuffle the state transition into the "Init" state and deconfigure the IP when appropriate.
2021-03-05Print PFS group for rekeyed Child SAs.tobhe
ok patrick@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-20 05:32:05 +0000