summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2021-05-02Try harder to ensure there are no GPT revenants afterKenneth R Westerback
choosing MBR partitioning.
2021-05-02Shuffle some code to eliminate get_address(), bring interface_state() andKenneth R Westerback
initialize_interface() logic into closer alignment, and try harder to initialize link_state at start up.
2021-05-02Improve documentation. Try to explain the various inputs that result inTheo de Raadt
a rewritten resolv.conf, and without being too precise, the order they will be in the file discussed with florian and jmc
2021-05-01In singel user mode / is mounted ro. Just warn if we can't createFlorian Obser
the control socket instead of fatal(). OK deraadt
2021-05-01Allow running in single user mode where /var/empty doesn't exist byFlorian Obser
switching from chroot("/var/empty") to unveil("/", ""). This is just an extra pair of suspenders since these processes pledge(2) to not access the filesystem. OK deraadt
2021-05-01Allow running in single user mode where /var/empty doesn't exist byFlorian Obser
switching from chroot("/var/empty") to unveil("/", ""). This is just an extra pair of suspenders since these processes pledge(2) to not access the filesystem. OK deraadt
2021-04-20Move TAILQ initialization to files where they are used.dv
These priv-sep daemons all follow a similar design and use TAILQs for tracking control process connections. In most cases, the TAILQs are initialized separate from where they are used. Since the scope of use is generally confined to a specific control process file, this commit also removes any extern definitions and exposing the TAILQ structures to other compilation units. ok bluhm@, tb@
2021-04-17rewrite the text describing the "address" parameter into somethingJason McIntyre
easier to read;
2021-04-14my fingers cannot avoid KNF'ing as I review codeTheo de Raadt
2021-04-12Document bpe(4)kn
Diff from Marcus MERIGHI <mcmer-openbsd at tor dot at>, thanks. Feedback OK jmc OK dlg
2021-04-11Document 'request' option to request additional configuration payloads.tobhe
ok patrick@
2021-04-10Make sure the ip header lands on a 4 byte alignment by adding 2 bytesFlorian Obser
padding because the ethernet header in front is only 14 bytes. Found the hard way by me while testing on sparc64. Solution suggested by & OK deraadt
2021-04-09When a DHCP server sends an invalid T1 or T2 default back to the defaultMartijn van Duren
values as specified in RFC2131 section 4.4.5. Allows my Comtrend VI-3223u to work. OK florian@
2021-04-09Only modify routes if SA has a valid address lease. On IKE SA rekeytobhe
sa_cp_addr and sa_cp_addr6 are moved to the new SA before the old SA is deleted. Fixes a bug where host routes were deleted on IKE SA rekey. ok patrick@
2021-04-08Do not request unused "classless-static-routes" dhcp-options(5)kn
Doing so implies support for it, but dhcpleased(8) currently ingores it entirely and does not configure any route from it. As per RFC 3442 servers SHOULD NOT respond with a "routers" option when "classless-static-routes" is set. dhcpd(8)/dhcpd.conf(5) follows that, hence requesting but not using static routes results in not installing any routes at all. Stop signaling support for this option and only request "routers" such that dhcpleased continues to install a default route and properly ignores the unsupported option if used by the server. Report from Uwe Werler <uwe @ werler dot is> about a default route not being set when requesting the "classless-static-routes" dhcp-options(5) from dhcpd(8), thanks! OK florian
2021-04-07"oldlladddr" -> "oldlladdr" in fatal() verbiage.Kenneth R Westerback
2021-04-03Add size check for sockaddr mask.tobhe
2021-04-01Tweak log_debug() verbiage to reduce repetitive infoKenneth R Westerback
(ACK/NAK), add details (DISCOVER/REQUEST) and provide before/after info for SSID/LLADDR/MTU changes.
2021-04-01Also immediately accept the *first* OFFER if it matches the requested address,Kenneth R Westerback
rather than waiting for select_timeout to expire before accepting the same OFFER.
2021-03-31Set 'select_timeout' to 'now' when an OFFER is received for the IP addressKenneth R Westerback
requested in the DISCOVER. i.e. immediately accept the OFFER rather than waiting for select_timeout to expire before accepting the same OFFER. A corner case since select-timeout is 0 by default.
2021-03-31Add two missing checks for strdup() returning NULL.Kenneth R Westerback
2021-03-31Fix some debug output when running in foreground.Kenneth R Westerback
Call tick_msg() at startup so it knows if the link is up. Don't emit 'link timeout expired' messages after the link has been up.
2021-03-28Now that the real time and monotonic time streams don'tKenneth R Westerback
cross flip CLOCK_REALTIME to CLOCK_MONOTONIC. Suggested by cheloha@, millert@, otto@ at various stages in the time_t -> timespec conversion.
2021-03-28Convert remaining timers (lease renew, rebind, expiry) toKenneth R Westerback
timespec values. Translate from the epoch values in leases to timespec values in one place. Final step to allow CLOCK_REALTIME -> CLOCK_MONOTONIC time accounting for the active lease.
2021-03-27If we want to configure default routes over multiple interfaces weFlorian Obser
need to provide the address of the interface behind which the default router is in case they are on the same subnet otherwise the kernel can't figure out which route we are talking about This happens for example when your wifi and wired networks are bridged. Pointed out by claudio some time ago.
2021-03-25Sync correct ROUNDUP() from net/route.ctobhe
2021-03-24More timespec conversions. Less 'seconds' arithmetic.Kenneth R Westerback
2021-03-23Don't send DELETE notify if IKE SA is replaced because oftobhe
'enforcesingleikesa'. Fixes an interop problem with strongswan if make-before-break is enabled. ok patrick@
2021-03-22BOOTP has a minimum packet length of 300 bytes. Since DHCP isFlorian Obser
interoperable with BOOTP we should also send packets that have a minimum size of 300. I haven't seen a DHCP server that actually enforces this except the one in vmd(8), but it doesn't cost us much and prevents hair pulling later on when we find one in the wild. OK deraadt
2021-03-22Avoid overflow by writing x = (y * 7) / 8 as x = y - (y / 8); ok florianOtto Moerbeek
2021-03-21The tag comes after iface in iked.conf(5).tobhe
2021-03-21Use new terminology of RFC 8981 and (mechanically) replace "privacy"Florian Obser
with "temporary".
2021-03-21Don't warn that we can't form a temporary address when a routerFlorian Obser
deprecates a prefix by sending a pltime of 0, this is normal. Continue warning when the pltime is smaller than 5 as this is almost certainly a configuration error. Found the hard way by & OK otto.
2021-03-20RFC 8981 allows the configuration of only temporary IPv6 addresses.Florian Obser
Keep "temporary" the default when setting inet6 autoconf but make it possible to disable the "autoconf" flag but keep "temporary" enabled. The normal usecase to only have temporary autoconf addresses would be "inet6 temporary" in hostname.if OK kn
2021-03-20RFC 8981 allows the configuration of only temporary IPv6 addresses.Florian Obser
Track autoconf and temporary flag individually to be able to support this. OK kn
2021-03-20Fix SMALL build when done from sbin/slaacdkn
distrib/special/slaccd is the actual SMALL user but having it build from here is useful, too; in fact, it showed some more unused variables under SMALL. OK florian
2021-03-19Edit wireguard for concision. Remove some background covered by wg(4).Richard Procter
Swap -wgpeerall and wgpeer in synopsis to ease parsing. "I'm good" - Matt Dunwoodie. "just commit" - jmc suggestions and ok sthen@
2021-03-19Fix function name in warningkn
2021-03-19RTM_IFINFO is providing the mac address now, no need to go throughFlorian Obser
getifaddrs on every route message. This also allows us to drop the route pledge since we only need to fetch the interface state with getifaddrs on startup.
2021-03-18Document "-tunneldomain" and "-mplslabel", complete MPLS synopsiskn
OK claudio
2021-03-17Split off init_ifaces from update_iface. init_ifaces discovers theFlorian Obser
state of the machine on startup using ioctl(2) and getifaddrs(3). We can then update this state with information provided by route messages. We still need getifaddrs(3) to check if the layer 2 address has changed. This simplifies error handling (what should we do if ioctl(2) fails?), reduces kernel round trips (no need to ask the kernel again for information RTM_IFINFO provided already) and prevents a theoretical race between RTM_IFINFO and getaddrinfo(3). In a fast link state UP -> DOWN -> UP transition RTM_IFINFO informs us that the link went down but we were not using this information but rather looked at getifaddrs(3) information which might see the link as already up again. We would then do nothing while we should try to get a new lease. By storing all interface information in the frontend process we can skip imsgs to the engine process if we get an RTM_IFINFO without relevant changes for us.
2021-03-16Add 'grp31' alias for curve25519 as documented in iked.conf(5).tobhe
2021-03-16Nuke unused time_t variable.Kenneth R Westerback
2021-03-16Move setifrtlabel() and *keepalive() prototypes out of SMALLkn
Those commands are not supported under SMALL; unless I overlooked others, this should be the last bit to declare all prototypes correctly wrt. SMALL (the overall unsorted order of both prototypes and commands makes this hard to spot). No object change, with and without SMALL.
2021-03-16sync to unbound 1.13.1; heavy lifting by sthenFlorian Obser
2021-03-16Don't (try to) deconfigure an interface that was never configured.Florian Obser
2021-03-16We can't learn anything interesting from RTM_NEWADDR, stop handlingFlorian Obser
it.
2021-03-15We makes sure that a dh group is required if the local proposaltobhe
contains an explicit group transform. Override requiredh if one of the local options is 'none' so that a proposal with no DH group and on with explicit group 'none' result in a match. ok patrick@
2021-03-15Ignore msg_ke in CREATE_CHILD_SA if DH negotiation results in grouptobhe
'none' (disabling PFS). Fixes a bug when the initiator sends a KE payload but the negotiation results in DH group "none". For other DH group mismatches we send an INVALID_KE notify, for 'none' we can just ignore the KE payload. ok patrick@
2021-03-14Log errors with log level info and SPI.tobhe
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-19 00:22:30 +0000