summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2017-05-21A few more freezero() usesTheo de Raadt
ok yasuoka mikeb
2017-05-19tweak partition sizes for auto-alloction to better suit 8G disksOtto Moerbeek
ok kr@ aja@
2017-05-15Fixup printing of queue bandwidth specificationsMike Belopuhov
Reported by Carl Mascott, thanks! OK sthen
2017-05-15Put the closing parenthesis in the right spot and fix std-dev calculationMike Belopuhov
2017-05-15Hook up FQ-CoDel to the tree and enable configuration in the pfctl(8)Mike Belopuhov
OK sthen, visa
2017-05-12Make the markup of negative parameters consistently use .Cm;Ingo Schwarze
those are command modifiers, not flags. Inconsistency noticed and patch sent in by Anton dot Lindqvist at gmail dot com.
2017-05-04Merge headers defining identifiers from sysctl.8 into sysctl.3. Shorten andTheo Buehler
update their descriptions. In sysctl.8 refer to /etc/sysctl.conf in FILES. discussed with and ok jmc
2017-05-03Use the safe idiom of cleaning sensitive data from memory with explicit_bzero,Ricardo Mestre
instead of relying on other methods, after readpassphrase. Some programs on this diff won't benefit that much since it happens near the terminal path, but someone might copy the unsafe idiom to another program and place it where it may leak sensitive data. Discussed aeons ago with tb@, OK deraadt@ and beck@
2017-04-28Remove double assignmentsMike Belopuhov
2017-04-26Perform H-FSC root queue allocation in the kernelMike Belopuhov
Since only leaf queues can have packets assigned to them, H-FSC requires the user specified root queue to have a parent. To simplify userland tools and the configuration interface, the kernel can be leveraged to set it up. ok henning
2017-04-26cope with IP address changes. before, we were trying to resend the msgHenning Brauer
with the no-longer-available address over and over and over, requiring iked to be restarted eventually. instead, on EADDRNOTAVAIL, schedule SA deletion so a new one is set up shortly thereafter. ok reyk mikeb
2017-04-25Use strtonum instead of strto{,u}ll for simpler and better overflowTheo Buehler
checking, make somaxconn and sominconn unsigned. Issue reported by orge on freenode, thanks! Input, patient explanations and ok deraadt, millert.
2017-04-24Fix configuration of ASN1_DN IDs.Reyk Floeter
Public key authentication uses public key files that are stored in the /etc/iked/pubkeys/ directory where the IKE IDs are encoded as filenames. This does not simply work with ASN1_DNs where the IDs include slashes and other special characters. Instead of breaking and failing when an ASN1_DN is configured, simply skip the public key lookup but allow to use it with certificates or PSKs. Reported and fix tested by Igor V. Gubenko - Thanks.
2017-04-23oops, this was meant to be committed with the pfctl.8 change:Jason McIntyre
sync usage() with SYNOPSIS;
2017-04-23trim the documentation for -k: make it more consistent,Jason McIntyre
and do not try to do all the documenting in SYNOPSIS/usage(); ok deraadt
2017-04-21Add "key" modifier for -k to make pfctl can kill a state by specifyingYASUOKA Masahiko
the key of the state. ok sasha
2017-04-19Rename all SA groups to bundles consistently. The first kernelAlexander Bluhm
commit in 2000 that introduced the features already called them SA bundles. The word group is taken by Diffie-Hellman, reusing it causes confusion. OK hshoexer@
2017-04-19Switch base tools from /dev/bpf0 to /dev/bpf. Now that /dev/bpf has beenMartin Natano
around for two releases, it should be safe to do so. ok bluhm deraadt sthen tb yasuoka
2017-04-19Bump numbers for /usr/obj allocation with *big* compilers.Theo Buehler
ok otto
2017-04-19enlarge obj to satisfy new world order that has *big* compilers andOtto Moerbeek
remove condition for static linking; ok tb@
2017-04-18Tweak parameters to decode_*, add a check or two, and thus gain most of theKenneth R Westerback
sanity improvements reyk@ recently put into dhcrelay to ensure no more than the captured packet is processed.
2017-04-18After 11 years of pondering about it I think that brookdavis@freebsd.orgKenneth R Westerback
had it correct. Don't BPF_WORDALIGN() the value for the number of bytes read() into the buffer. This could theoretically cause the processing of 1 - 3 more bytes than were read.
2017-04-18use freezero()Theo de Raadt
2017-04-16Different compilers and versions of compilers have different warnings.Jonathan Gray
Remove -Werror to give code a greater chance of building. ok deraadt@ florian@
2017-04-14Up to now ipsecctl(8) grouped SAs with identical src and dst to theAlexander Bluhm
flow which the first SA matched by the flow type. This behaviour was mostly undocumented and unexpected. Make SA bundles explicit in ipsec.conf(5). Only group SAs that have the same src and dst and also the same bundle identifier. OK hshoexer@
2017-04-13fix wrongly indented linesJonathan Gray
2017-04-13Add a NAT-T keepalive timer in case we are behind a NAT gateway.Patrick Wildt
See RFC 5996, section 2.23, NAT Traversal: In the case of a mismatching NAT_DETECTION_DESTINATION_IP hash, it means that the system receiving the NAT_DETECTION_DESTINATION_IP payload is behind a NAT and that system SHOULD start sending keepalive packets as defined in [UDPENCAPS]. With markus@, ok reyk@
2017-04-12Prevent inosused from wrapping when soft updates is enabled whileTodd C. Miller
scanning the used inode map. The code as written assumes inosused is signed but this is no longer the case. OK deraadt@
2017-04-12RTM_PROTO3 messages should not trigger a resolv.conf check.Kenneth R Westerback
2017-04-12Shuffle another function.Kenneth R Westerback
2017-04-11Shuffle route/interface changing functions together into kroute.c. Try toKenneth R Westerback
group related functions in kroute.c together and comment them a bit. No intentional functional change.
2017-04-11Fold priv_write_file() into its only remaining userKenneth R Westerback
priv_write_resolv_conf() and move the latter into kroute.c with all its priv_ friends. No intentional functional change.
2017-04-10Rework -L logic to use the idiom used in handling the leases file.Kenneth R Westerback
i.e. open FILE during program set up and use the FILE created for the rest of the program lifetime after dropping privilege and pledge()'ing. No need for passing messages to the priv process. Tweak lease file handling a bit in passing. Monitoring the -L file with external programs like sysutils/entr still works. Looks good to sthen@.
2017-04-10Found another len += snprintf...Theo de Raadt
ok mikeb
2017-04-10Remove always false comparison: inosused type is ino_t, which isFrederic Cambus
unsigned. While there, fix a whitespace issue. OK deraadt@
2017-04-09Seven casts, a couple of tweaks and CFLAGS+=-Wsign-compare for theKenneth R Westerback
win. No intentional functional change.
2017-04-08Reduce the overburden of signed vs unsigned comparisons by sprinklingKenneth R Westerback
'int' -> 'unsigned int' (and visa versa) where obvious. Steal a couple of 'unsigned' -> u_int32_t from reyk@'s dhcrelay tweaks. No intentional functional change.
2017-04-08Replace another snprintf() dance with easier to read code usingKenneth R Westerback
strlcat(). Shorter, clearer, fewer signed vs unsigned questions. Use an 8K static buffer for pretty_print_classless() and use it rather scribbling intermediate values into the final destination. No intentional functional change.
2017-04-08Replace a mess of snprintf() dances with easier to read code usingKenneth R Westerback
strlcat(). Shorter, clearer, fewer signed vs unsigned questions. Shrink static buffer for the string version of an option value from 32K to 8K. Since the string version of the entire lease is constructed in a 8K buffer, bigger option values are pointless. Use 8K of the saved space for a static buffer for pretty_print_string() and use it rather scribbling intermediate values into the final destination. No intentional functional change.
2017-04-07Simply decoding of domain search option. No intentional functionalKenneth R Westerback
change.
2017-04-06Inspired by recent dhcrelay(8) changes add some stricter CFLAGS. No codeKenneth R Westerback
changes needed (yet).
2017-04-06less chatty EXAMPLES; from anton lindqvistJason McIntyre
2017-04-06document -=; while here, simplify things so that we don;t add a separateJason McIntyre
usage every time we think of a new way to use this; -= bits from anton lindqvist ok tb tom
2017-04-05Shuffle sendhup() into dispatch.c, the only place it is used.Kenneth R Westerback
2017-04-05various improvements, from klemens nanni;Jason McIntyre
i've omitted hunk 3 of his diff, as what's there now is correct; ok mikeb
2017-04-04Send a RTM_PROPOSAL to clear out other dhclient instances on startup.Kenneth R Westerback
Replaces forcing interface link state down and up to generate RTM_IFINFO messages.
2017-04-04Treat SSID's like the 0 to 32 bytes of uint8_t data that they reallyKenneth R Westerback
are. Track and use the actual lengths and use memcpy()/memcmp() instead of strcmp()/strdup().
2017-04-03warn format string should be literal.Frederic Cambus
OK deraadt@, millert@
2017-04-03Change parse_string() to take an optional integer pointer that canKenneth R Westerback
be used to return the final size of the parsed (i.e. un-vis'ed) string. Use same, plus memcpy() to ensure entire final string is copied to intended destination even if there are embedded NULs.
2017-04-03Simplify read_string() to just read the characters between the '"'s.Kenneth R Westerback
Push the un-vising up to parse_string(). This allows both the actual string and the un-vised version to be available as desired. Use memcpy() instead of strdup() to copy un-vised string since it may legitimately contain NUL.