summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2022-01-02Stop writing big-endian checksums into the little-endian GPTKenneth R Westerback
header fields gh_csum and gh_part_csum. Constrain kernel to accepting only correct little-endian checksums. Temporarily allow fdisk(8) to read either endian GPTs so that big-endian GPTs can be made correct by a simple 'fdisk -e' && 'w'. Fixes inter-architecture, inter-OS GPT portability and GPT fdisk(8) on big-endian architectures. Broken since initial GPT implementation. Suggestions and ok kettenis@
2021-12-29make the argument name for veb's "child-iface" consistent;Jason McIntyre
from caspar schutijser
2021-12-29Tweak some DEBUG output.Kenneth R Westerback
Always put '0x' prefix in front of displayed hex values, i.e. the checksums. Add missing letoh32() so bad endian checksum is clear. Be consistent when displaying 'expected' and 'got' checksums, i.e. 'expected' == calculated checksum and 'got' == checksum found in GPT.
2021-12-28Tweak some DEBUG output.Kenneth R Westerback
'EFI PART' reads better than "TRAP IFE" and checksums are easier to read/compare when shown in hex rather than decimal. Prompted by recent GPT vs disklabel misc@ thread concerning Rob Whitlock's problematic GPT.
2021-12-27knfFlorian Obser
2021-12-23fix off by one in bounds testJonathan Gray
ok tobhe@
2021-12-19Simplify error message emitted when requested partition sizeKenneth R Westerback
cannot be accommodated. "not enough space" should be enough for anyone. Requested by deraadt@
2021-12-18Make sure we receive what we expect over imsg.Florian Obser
Instead of repairing potential garbage ensure that we receive proper C strings. Inspired by a similar diff by deraadt@ for ldapd.
2021-12-14Move raw pubkey bytes to EVP_PKEY conversion to common function.Tobias Heider
ok markus@
2021-12-13Fix asprintf() error check. Portable code should check the returnTheo Buehler
value for -1, not buf == NULL. ok tobhe
2021-12-13Fix a few leaks due to X509_NAME_oneline(name, NULL, 0) dynamicallyTheo Buehler
allocating a buffer. ok tobhe
2021-12-13including sys/cdefs.h manually started as a result of netbsd trying toTheo de Raadt
macro-build a replacement for sccsid, and was done without any concern for namespace damage. Unfortunately this practice started infecting other code as others were unaware they didn't need the file. ok millert guenther
2021-12-13Avoid a potential double free in group_free()Theo Buehler
In the unlikely event that EC_KEY_check_key() in ec_init() fails, the group would be freed twice: once in ec_init(), and later in group_free(). ok tobhe
2021-12-13Cleanup libcrypto memory management. Remove redundant NULL checksTobias Heider
before calling *_free() functions. Use 'get0' functions where it makes sense to avoid some frees. Feedback and ok tb@
2021-12-13Only generate a new xid on state change.Florian Obser
When we first request a lease (INIT or REBOOTING state) we run with very short timeouts. If the dhcp server is slow to respond we already have a new xid and ignore the server's response. This goes on until we increase the timeout high enough. If we just stick to an xid this will not happen and we accept "late" responses. RFC 2131 has: Selecting a new 'xid' for each retransmission is an implementation decision. A client may choose to reuse the same 'xid' or select a new 'xid' for each retransmitted message. Problem seen by phessler on german train wifi. OK phessler
2021-12-13Treat xid as a uint32_t in network byte order on the wire.Florian Obser
Internally this doesn't matter since we only care about equality. This makes logging output comparable to tcpdump(8). Pointed out by joel@ OK claudio
2021-12-13Replace struct member assignment with struct assignment to make theFlorian Obser
code more compact. No binary change. OK claudio
2021-12-11Start the default OpenBSD partition either immediately followingKenneth R Westerback
any boot partition specified via '-b' or /usr/mdec/mbr; at the power of 2 block after the first track; or immediately following the MBR if there is only one track. Mark any non-EFISYS boot partition created by -b as DOSACTIVE. Suggested by kettenis@, better than a separate new option. Brings -b behaviour into line with many uses of -e to create boot partitions, allowing for the eventual elimination of said -e uses in the creation of the various boot media and in the install scripts.
2021-12-09Rework in which state to add and not add the server-ip andFlorian Obser
requested-ip option as well as setting ciaddr. This started with joel@ pointing out that their CPE is ignoring RENEWING and REBINDING requests when ciaddr was not set. RFC 2131 4.3.6, Table 4 has a good overview, we got a bunch of it wrong. Previously the logic for this was all over the place which made it difficult to reason about, it is now contained in the engine process in request_dhcp_request() and request_dhcp_discover(). Problem pointed out by, lots of testing and review as well as OK joel@ Additional testing and 50% review benno@
2021-12-09Properly enable NAT-T without udpencap if mobike was negotiated without NAT.Tobias Heider
Fixes a bug where iked sent zero-prefixed NAT-T messages on port 500 causing parsing errors. ok markus@ patrick@
2021-12-09Move switch to NAT-T port and udpencap activation to ikev2_enable_natt().Tobias Heider
ok patrick@
2021-12-08The /etc/iked/certs/ directory is used for both local and peerTobias Heider
certificates. Check if we have a matching key before using a certificate as local to prevent cryptic error messages later when the signature is checked. ok markus@ patrick@
2021-12-07Fix locally stored peer certificates in /etc/iked/certs as documented inTobias Heider
iked(8). Local certificates are always trusted and preferred over certs received over the wire. ok patrick@ markus@
2021-12-07Don't truncate the default OpenBSD partition at the end of theKenneth R Westerback
last full cylinder. Let it extend to the end of the disk.
2021-12-06Logging received addresses and DNS configuration only makes sense forTobias Heider
the initiator. ok patrick@
2021-12-04Send out dstid as initiator if configured. This makes it easier forTobias Heider
the responder to match the correct policy if multiple are available. ok patrick@
2021-12-01Remove the MBR_init() "#ifdef defined(__macppc__) ||Kenneth R Westerback
defined(__mips__)" chunk that rounded the start of the default OpenBSD partition to a cylinder boundary. The value has been immediately re-rounded to a power of 2 block since r1.25 in 2009. Eliminates wasted space when no /usr/mdec/mbr partition 0 information is available. '-b' becomes available to architectures other than amd64 and i386, taking precedence over /usr/mdec/mbr partition 0 information. The latter being present only in macppc and loongson /usr/mdec/mbr files.
2021-12-01whitespace cleanup during review readTheo de Raadt
2021-11-30isakmpd: convert modp_init() for opaque DH.Theo Buehler
ok jsing
2021-11-30whitespaceTobias Heider
2021-11-29add -V to usage(), and list it before -v in both SYNOPSIS and theJason McIntyre
options list;
2021-11-29Add command line option to show the versionTobias Heider
ok patrick@
2021-11-29sys/param.h was included for MAX(), MIN() and roundup(). make localTheo de Raadt
copies of MAXIMUM() and MINIMUM() like we have done in 50+ other places, and also include a roundup() ok jsg
2021-11-29the code in this file has reason to include any sys/*.h header files,Theo de Raadt
let alone sys/param.h, which it uses to get roundup(). make a local copy of the macro, and call it a day.
2021-11-28Make sure the interface still exists before updating it.Florian Obser
When we get a route message, for example an address being added (RTM_NEWADDR, but the problem exists with most of the route messages) and the interface gets unplugged at just the right moment if_nametoindex(3) will return NULL. We will pass NULL through update_iface() to get_xflags() which will then crash because we dereference the NULL pointer there. OK kn
2021-11-28Make sure if_index is set in all case statements and use itFlorian Obser
consistently. This makes the next diff easier, also consistency is good. OK kn
2021-11-27Rename msg_id to msg_peerid now that we also have msg_localid.Tobias Heider
ok patrick@
2021-11-26A peer sends both his local id and remote id he expects us to be. So far wePatrick Wildt
have only looked at the peer's local id, so that we can find a policy with the matching dstid set. Hence dstid is involved in the decision making. While we do send out our local id, which the peer will use to verify his policies, we do not yet make a decision based on the id the peer expects us to have. If you have two policies configured with only srcid set, we will always pick the same. To be able to choose a policy that matches the peer's expectations, save the local id the peer expects us to have and use it during policy lookup. ok tobhe@
2021-11-26Fix ikev2_child_sa_rekey() warnings. The SPI can't be printed without aTobias Heider
parent SA.
2021-11-26remaing -> remainingJonathan Gray
2021-11-25Remove unused variable fd.Tobias Heider
2021-11-25Silence unitialized variable warnings.Tobias Heider
2021-11-25Honour /usr/mdec/mbr or -f partition 0 information even outsideKenneth R Westerback
of _powerpc__ and __mips__, preventing the possible creation of MBRs with overlapping partitions 0 and 3. Don't set bootprt DOSACTIVE flag if no partition 0 information was provided via /usr/mdec/mbr or -f. Lets octeon fdisk(8) set DOSACTIVE on the OpenBSD partition in the default MBR like every other fdisk(8) does.
2021-11-24Unregister event on pfkey socket during pfkey_reply(). Using eventsTobias Heider
and poll() at the same time may lead to a race that locks up the process in recv(). ok bluhm@
2021-11-24Pass env to pfkey API. Consistently call pfkey file descriptor fd.Tobias Heider
ok bluhm@
2021-11-23Use system uptime not UTC time to calculate PPPoE session durationKlemens Nanni
Systems without RTC are likely to boot with wrong time, but pppoe(4) used microtime(9) anyway to remember when a new session began. (In)adequately, ifconfig(8) used gettimeofday(2) and calculated the difference between two absoloute dates to infer the PPPoE session duration. This goes off the rails if the wall clock jumps in between, e.g. due to NTP kicking in. Use getmicrouptime(9) and clock_gettime(2)/CLOCK_BOOTTIME instead to rely on the monotonically increasing system uptime instead to fix this. Reported and tested by Peter J. Philipp <pjp AT delphinusdns DOT org> on some octeon box without RTC. I've seen this on a Edgerouter 4 as well (2m uptime, 19d session). OK claudio
2021-11-23Add logging for rekey failures.Tobias Heider
ok patrick@
2021-11-22MOBIKE is RFC 4555.Tobias Heider
2021-11-21Add 'ikectl show certinfo' to show trusted CAs and certificates.Tobias Heider
This helps debug authentication issues with x509 certificates. ok markus@
2021-11-20Gather the setup of the initial OpenBSD MBR partition into oneKenneth R Westerback
location within MBR_init(), ensuring that MBR_init() creates an OpenBSD MBR partition only when there is space for it. No functional change.