summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2021-01-06do not call log_addr() when the address is NULLanton
ok florian@
2021-01-02add three missing .Dv macros,Ingo Schwarze
and move punctuation out of two that are already there
2020-12-30getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. florian@ mentioned this might be a problem in slaacd(8) and rad(8) after claudio@ fixed it in bgpd, so i went looking...
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-12-29If we manage to send all "count" flood pings before receiving allFlorian Obser
answers we would exit after receiving the first answer and claiming a (huge) packet loss. OK benno
2020-12-28Add back keyword "any" to match any IP address, which actually workstobhe
after recent fixes.
2020-12-28Add support for kern.video.record.Marcus Glocker
ok mpi@
2020-12-27Fix "any" and "dynamic" keywords for flows and add proper IPv6 support.tobhe
For traffic selectors with a keyword on either 'from' or 'to' side, install flow with address family of the opposite side. If both source and destination address are keywords, install flows for both address families. The 'dynamic' keyword is special as it will only install flows for the address family of the dynamically assigned address (specified with the 'config address' option). ok patrick@
2020-12-26Update default preference listkn
OK florian
2020-12-26Otto hit an impossible situation: an answer bigger than 64k.Florian Obser
Log the query and answer SERVFAIL instead of exiting fataly. That way we can at least figure out where libunbound goes off the rail. OK otto
2020-12-22Log SPI with SPI_SH() wherever possible.tobhe
2020-12-21Use policy_test() to reassign existing SAs to updated policies aftertobhe
'ikectl reload'. This prevents initiation of new additional SAs for each policy every time the config is reloaded. ok patrick@
2020-12-20Don't leak ipsec_hosts when building hosts_list.tobhe
ok patrick@
2020-12-17Use strtonum() instead of atoi() to parse port option.tobhe
2020-12-17Sort command line options.tobhe
ok bluhm@
2020-12-16Fail to parse rules with invalid rangeskn
This makes pfctl(8) detect bogus ranges (with and without `-n') before loading the ruleset and completes the previous commit. OK sashan sthen
2020-12-16Reject rules with invalid port rangeskn
Ranges where the left boundary is bigger than the right one are always bogus as they work like `port any' (`port 34<>12' means "all ports") or in way that inverts the rule's action (`pass ... port 34:12' means "pass no port at all"). Add checks for all ranges and invalidate those that yield no or all ports. For this to work on redirections, make pfctl(8) pass the range's type, otherwise boundary including ranges are not detected as such; that is to say, `struct pf_pool's `port_op' member was unused in the kernel so far. `rdr-to' rules with invalid ranges could panic the kernel when hit. Reported-by: syzbot+9c309db201f06e39a8ba@syzkaller.appspotmail.com OK sashan
2020-12-15Fix leak of REQUEST string.tobhe
2020-12-13Make sure flow src and dst addresses have the same address family.tobhe
ok patrick@
2020-12-11The keyword "any" does not actually work properly for traffic selectors.tobhe
To match all traffic use 0.0.0.0/0 or ::/0. ok patrick@
2020-12-11Introduce query_imsg2str() to simplify printing "qname class type".Florian Obser
OK kn some time ago
2020-12-11The recent fix to handle large answers in unwind (errata #5 for 6.8)Florian Obser
has the downside to always copy the maximum IMSG size (about 16k) between the resolver and frontend process for DNS answers because we had to keep it as simple as possible. We can now rearange things in -current to be less wasteful. This copies only the usually small DNS answer. In the unusual case that a DNS answer is larger than the maximum IMSG size fragment the message and send multiple IMSGs.
2020-12-11Warning: arithmetic on a pointer to void is a GNU extension; mergedFlorian Obser
upstream.
2020-12-11Sprinkle in some static to prevent missing prototype warnings; mergedFlorian Obser
upstream.
2020-12-11sync to libunbound 1.13.0Florian Obser
Support for channel reuse of TCP and TLS (DoT) streams should improve latency when the DoT strategy is used in unwind.
2020-12-11pass down the `skip' flag to the mountfs() function in the case ofRobert Nagy
manually mounting a device which is not present in fstab(5) so that the `-s' flag can be used in this case as well. ok millert@, deraadt@
2020-12-10Simplify '-i' handling, failing immediately during command line parsingKenneth R Westerback
when an invalid option name is encountered.
2020-12-10Print valid ikesa/childsa configuration at startup. Comma seperatedtobhe
transforms are not supported. ok patrick@
2020-12-07synproxy should be processing incoming SYN packets only.Alexandr Nedvedicky
issue noticed by sthen@. fix discussed with bluhm@ and procter@ OK bluhm@, kn@, procter@
2020-12-06Oops. Missed chunk in previous.Kenneth R Westerback
fatal() immediately whem parsing command line option '-c' reveals a non-existant file. Original diff, tweaks & ok kn@
2020-12-06Add support for RSASSA-PSS signature verification (RFC 7427).tobhe
ok patrick@
2020-12-06fatal() immediately whem parsing command line option '-c' reveals a non-existantKenneth R Westerback
file. Original diff, tweaks & ok kn@
2020-12-05Make len unsigned.tobhe
ok patrick@
2020-12-04Log pfkey type and message length on write failure.tobhe
2020-12-03Fix type mismatch. auth_method should be uint8_t.tobhe
ok markus@
2020-12-02The skip steps must be set up for each attribute independentlytobhe
otherwise the wrong rules might me skipped, e.g. if you have policies with different listen addresses that are not sorted by address family. ok patrick@
2020-12-01Don't log ESRCH as warning.tobhe
2020-12-01Sync get_ifrdomain() to rad(8) version by removing a useles (void)Florian Obser
cast in front of a strlcpy(3). tb@ had pointed out that the use in rad(8) was not consistent. I consider the void cast a useless annotation, either the strl* functions must have the canonical trucation check or it must be obvious that truncation cannot happen or is not a problem. While at it remove a bunch more casts that snuck in over time.
2020-12-01Extract another couple of chunks from main() into helper functions,Kenneth R Westerback
get_routefd() and set_user().
2020-11-30We need to rekey every child SA (even if acquired): Otherwise we cantobhe
get out of sync with the peer and the peer would keep on using the expired SA because the lifetime is not negotiated. ok patrick@
2020-11-29Add 'set stickyaddress' option. If this option is enabled, iked will trytobhe
to assign the same 'config address' when an IKESA is negotiated with the DSTID of an existing IKESA. The original IKESA will be closed and the address will be transferred to the new IKESA. ok patrick@
2020-11-29Fix previous; we need to set the icmp6ev in the interface to NULLFlorian Obser
otherwise we are referencing the wrong one when the rdomain changes. Sorry for not spotting it earlier.
2020-11-28improve legibility of the newly introduced unref_icmp6ev() before thisChristian Weisgerber
code gets copied around; ok florian@
2020-11-28Add support for multiple address pools. The parser already allowstobhe
specifying multiple pools, make ikev2_cp_setaddr() iterate over the pools to find a matching address. ok patrick@
2020-11-28An interface might have disappeared or switched rdomains while weFlorian Obser
waited for a FD. It's not a fatal condition if it arrives late. OK tb
2020-11-28Reduce code duplication by introducing unref_icmp6ev().Florian Obser
OK tb
2020-11-28Handle the case of an autoconf interface changing its rdomain.Florian Obser
To avoide code duplication have get_icmp6ev_by_rdomain() either return an existing icmp6ev in the correct rdomain or allocate one. OK tb
2020-11-27Remove redundant state change. ikev2_ikesa_delete() sets the correct state.tobhe
2020-11-27Shuffle code relating to initializing the physical interface and theKenneth R Westerback
internal structure reflecting the interface into a function that in turn calls simple helper functions to do the different actions involved. Simplifies the overly lengthy main(), correctly starts the state machine with the state of the interface link as DOWN when IFF_UP is 0, tests more initialization actions when '-n' is used.
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-22 12:40:38 +0000