summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2019-04-01Reduce code duplication and ensure that a type of resolver and it'sFlorian Obser
checking counterpart are created the same way.
2019-04-01Implement "Authentication Domain Names" configuration as per RFC 8310Florian Obser
section 7.1 for DoT servers. We are setting the CA cert bundle path (/etc/ssl/cert.pem) directly in libunbound so we need to losen pledge(2) a bit and allow rpath. At the same time we unveil only /etc/ssl/cert.pem. We can drop the chroot(2) since pledge(2) and unveil(2) give us more fine grained isolation. prodding by tb@. p.s. for portable it might be necessary to pass in a file descriptor from the parent, slurp in the file and then use X509_STORE_load_mem() (pointed out by sthen) in the guts of libunbound.
2019-04-01Bring documentation into better correspondanceKenneth R Westerback
with latest command line prompt change. ok kn@ jmc@, with more improvements inevitable.
2019-04-01No need to save/restore fields across the invocation ofKenneth R Westerback
getasciilabel() when getasciilabel() explicitly avoids changing those fields. ok otto@
2019-03-31simpler display;Jason McIntyre
2019-03-31update the default partition sizes in the man page as wellPeter Hessler
pointed out by otto@
2019-03-31when using the auto partitioner, grow minimum size for /usr to 1300M.Peter Hessler
bare minimum /usr for all sets on amd64 is 920M used space, and we need some more for upgrades, as well as relinking libs and kernels. OK deraadt@
2019-03-31Restore -t behaviourkn
revision 1.178 from 23.10.2015 accidentially removed the tflag bits, turning `-t' into a NOOP. Found out the hard way during debug. OK deraadt
2019-03-31Avoid calling dup2(oldd, newd) when oldd == newd. In that case theYASUOKA Masahiko
descriptor keeps CLOEXEC flag then it will be closed unexpectedly by exec(). ok tedu florian
2019-03-31Enhance prompt shown during -E label editing. AlwaysKenneth R Westerback
display the disk device whose label is being edited. Change '>' to '#' when in expert mode.
2019-03-31we don't need to set openssl lock callbacks. this code is not threaded.Ted Unangst
ok florian
2019-03-31use AI_NUMERICHOST for ip conversion. ok florianTed Unangst
2019-03-30Shuffle captive portal detection around.Florian Obser
While we are behind a captive portal we have to ask the dhcp provided resolvers. However it is possible that those resolvers do not like to talk to unwind because of EDNS0. Unwind handles this case by closing its listening socket and hands over to asr. Except for the resolving of the captive portal host which it still tries to resolve via libunbound. Turns out there is no need for this we can just use getaddrinfo_async from asr which then either hits unwind which does the right thing or unwind closed its listening socket and asr moves on to talk directly to the dhcp resolvers.
2019-03-30Fail on invalid netmasks when filling tableskn
Fix a regression of revision 1.326 "Zap v4mask and v6mask in host()" which allowed CIDR networks with more than one "/" to be loaded into tables. I took care of this code path with regard to rules coming the ruleset parser, which aborts earlier on such invalid specifications, but missed `-T add 1/2/3' and the like. Analyzed and fixed by Petr Hoffmann <petr dot hoffmann at oracle dot com>, thanks! OK deraadt
2019-03-30Do not try to print NULL with %s.Florian Obser
Brainfart pointed out by tb
2019-03-30update to libunbound 1.9.1; heavy lifting by sthen in unbound(8)Florian Obser
2019-03-29point readers to individual driver pages for notes on powersave; ok stspJason McIntyre
2019-03-27Add support for displaying fontwidth and fontheight values, this allowsFrederic Cambus
users to know the size of the currently used font. Based on a diff from Artturi Alm, thanks! OK sthen@, kettenis@, tedu@, jcs@
2019-03-27comment out the optional "duration" argument to powersave:Jason McIntyre
only two older cards currently attempt to set this, and it should not be neccessary anyway; i've added in a some (commented) info to explain this; discussed with and ok stsp
2019-03-26note that powersave is disabled by default (i.e. no need to explicitlyJason McIntyre
disable this), and provide a little more info on "duration"; some driver-specific notes hopefully to follow... help/ok stsp
2019-03-24Reduce debug logging in best_resolver() to two lines, helps a bit withFlorian Obser
seeing what is going on. There is still a lot to do wrt logging but it's not a priority yet.
2019-03-24recheck all resolvers when we are no longer behind a captive portalFlorian Obser
2019-03-24Do not check every resolver every 30 seconds as that is wasteful andFlorian Obser
pointless. Trigger a check - on startup - when forwarders change on config reload - when dhcp provided forwarders change - on network interface state change When a check finishes and the checked resolver cannot resolve anything configure a timer to run another check in the future using an exponential backoff for the timeout.
2019-03-24If we can't check the resolver its state is UNKNOWN.Florian Obser
2019-03-24remove useless debug outputFlorian Obser
2019-03-22Revert parts of recent changes to pretty_print_domain_search(). PartsKenneth R Westerback
of WIP escaped into the wild and broke parsing of domain-search. Reported by Greg Steuck and Raf Czlonka. Fix tested by Greg.
2019-03-22No need to log that the DHCP lease file doesn't exist.Jeremie Courreges-Anglas
We still want to log other causes when failing to open the lease file, but then do so with a more helpful error message. ok florian@
2019-03-21punctuation needs to be preceeded by a space, in Scots;Jason McIntyre
2019-03-21Clarify verbiage. If we could just write it in Scots thenKenneth R Westerback
it would be so much easier.
2019-03-21Simplify merge_option_data() with strpbrk().Kenneth R Westerback
Zap insidious trailing space.
2019-03-20Do not accept dhclient.conf(5) "prepend" or "append" statements whenKenneth R Westerback
the option data cannot be prepended or appended to. Instead, treat "prepend" as "supersede" and "append" as "default". This preserves the safe aspects of current behaviour. Issue a parsing warning when appropriate to encourage people to fix their configuration files. Eliminate egregious repeated code by abstracting merge_option_data().
2019-03-19Parsing error messages display only the first 80 characters of theKenneth R Westerback
offending line. It is fruitless to try to position the "^" at a character more than 80 characters from the start of the line.
2019-03-19delay dropping privs a bit when root so that setrtable works.Ted Unangst
traceroute bits from benno. ok benno claudio
2019-03-19Nuke a couple of XXX comments.Kenneth R Westerback
2019-03-18Use same idiom for pretty_print_domain_search() andKenneth R Westerback
pretty_print_classless_routes(), making both of them local to options.c. Avoids a double pretty print of DHO_DOMAIN_SEARCH, eliminates an unneeded 1024 byte static array. Shrinks size of upcoming diff to implement parsing of domain search option in leases and dhclient.conf.
2019-03-18Add a couple of checks to ensure option data fits into the proposalKenneth R Westerback
field being memcpy()'d into. Tweak DHO_ROUTERS handling to be similar to the other cases populating proposal->rtstatic, including a warning when things go wrong.
2019-03-18explicitly use BPF_FILDROP_CAPTURE when configuring BIOCSFILDROPDavid Gwynne
BIOCSFILDROP used to just be a flag, ie, any non-zero value was treated the same, but i'm changing it so different values do different things. this way the programs should keep working even if i decide to change the values for these macros.
2019-03-15Correctly interlock config reloads imsgs.Florian Obser
Only accept a new config reload if it's not currently running and on accept a config reload end if one is currently running. OK pamela
2019-03-15Do not accept a control socket if we already have one.Florian Obser
OK pamela
2019-03-11Make slaacd(8) imsg processing more paranoid. Unexpected size mismatchespamela
mean we should no longer trust processes, so we call fatal(x). The control socket is the exception, where we ignore rather than allow crashes due to data from the outside. suggestion/input and OK florian@
2019-03-11sort the mpls options; ok dlgJason McIntyre
2019-03-11tweak previous;Jason McIntyre
2019-03-11Change fatal() to fatalx() where errno is not set.pamela
input and OK florian@
2019-03-11While strtonum(3) does set errno, we already use errstr to show what'sFlorian Obser
going on so use log_warnx to not print a useless 2nd error message. OK pamela
2019-03-11fix the documentation for mpls interfacesDavid Gwynne
instead of an mpe and mpw section, have an MPLS section that talks about mpe, mpw, and mpip.
2019-03-11remove an extra ; on a lineDavid Gwynne
no functional change
2019-03-10delete whitespace before a full stop on a text line;Ingo Schwarze
patch from Alessandro dot Gallo at syssegv dot org
2019-03-07update the error message for the interactive 'n' command to show thatJason McIntyre
-F or -f is required; ok krw
2019-03-07use colons before showing examples; while here, replace the \*( char sequences;Jason McIntyre
2019-03-07Remove pfctl_*_pool() remnantskn
Left behind in pfctl_parser.h revision 1.91 "First pass at removing the 'pf_pool' mechanism [...]" These functions don't exist anymore, no object change. OK procter
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 23:21:57 +0000