summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2017-11-29Print_host is used mainly in printf style functions. So do not return NULLClaudio Jeker
instead return "unknown". OK beck@
2017-11-28The divert structure was using the port number to indicate thatAlexander Bluhm
divert-to or divert-reply was active. If the address was also set, it meant divert-to. Divert packet used a separate structure. This is confusing and makes it hard to add new features. It is better to have a divert type that explicitly says what is configured. Adapt the pf rule struct in kernel and pfctl, no functional change. Note that kernel and pfctl have to be updated together. OK sashan@
2017-11-28in auto-allocation, increase size of /usr/src to 1.3G.Sebastian Benoit
Our tree is now 1.1G big. ok florian@, sure deraadt@
2017-11-27The divert structure was using the port number to indicate thatAlexander Bluhm
divert-to or divert-reply was active. If the address was also set, it meant divert-to. Divert packet used a separate structure. This is confusing and makes it hard to add new features. It is better to have a divert type that explicitly says what is configured. Convert the pfctl(8) rule parser to divert types, kernel cleanup will be the next step. OK sashan@
2017-11-27Implement MOBIKE (RFC 4555) support in iked(8), with us acting asPatrick Wildt
responder. In practice this support means that clients like iPhones can roam in different networks (LTE, WiFi) and change their external addresses without having to re-do the whole handshake. It allows the client to choose how and when to change the external tunnel endpoint addresses on demand, depending on which network is better or even is connected at all. ok sthen@ tweaks from jmc@ tested by a handful
2017-11-27Simplify lease_as_string() logic to use a single time_t variableKenneth R Westerback
and lease_[expiry|rebind|renewal]() functions.
2017-11-27Fix pasto so lease_rebind() returns rebind value and notKenneth R Westerback
renewal value.
2017-11-26Move rebind time calculation to a function lease_rebind(), just likeKenneth R Westerback
lease_expiry() and lease_renewal(). Simplifies logic and upcoming changes.
2017-11-25- pfctl fails to handle nested 'load anchor' properlyAlexandr Nedvedicky
[ + yet another 'anchor name vs. path mix up in load anchor (parse.y) ] OK bluhm@
2017-11-25- patching use-after-free and innocent memory leak in pfctl_optimzie.cAlexandr Nedvedicky
OK bluhm@
2017-11-25- pfctl rule optimizer: anchor name vs. anchor path mix upAlexandr Nedvedicky
OK bluhm@
2017-11-24Remove 'renewal' field from struct client_lease. Add lease_renewal() toKenneth R Westerback
calculate the value when required for a particular lease.
2017-11-23in isakmpd(8), provide a hint: from scott chelohaJason McIntyre
also some minor tweaks while here...
2017-11-23Fix use of lease_expiry() in set_lease_times(). lease_expiry() returnsKenneth R Westerback
wall clock time, not length of lease time.
2017-11-20Wnen purging dhclient.leases and when looking for unexpired offers toKenneth R Westerback
use, always recalculate offer expiry time based on the information in the original offer.
2017-11-20Support collapsing flow outputs.Martin Pieuchot
Makes it easier to check live status of complex setups. ok hshoexer@
2017-11-18Generate correct time comments (renewal/rebind/expiry) inKenneth R Westerback
dhclient.leases and the 'offered' lease generated by -L. i.e. the times contained in the actual offer, and not the 'effective' times that reflect changes imposed by dhclient.conf or -i.
2017-11-17replace the deletetunnel option with -tunnelSebastian Benoit
ok bluhm@
2017-11-16Range check default values so that a range likeKenneth R Westerback
'[1 - 0] [1]' can no longer return '1'. Issue reported by Alexi Malinin via bugs@. Thanks!
2017-11-15Reset the OCSP URL on config reload. Otherwise we end up not beingPatrick Wildt
able to disable OCSP without restarting iked. ok beck@ sthen@
2017-11-14- nested anchors vs. pfctl/parse.yAlexandr Nedvedicky
bug reported and fix tested by Leonardo Guardati OK bluhm@
2017-11-14Treat invalid server name as empty instead of declining the lease offeredMartin Pieuchot
by such misconfigured DHCP servers. Original diff from and ok krw@, ok sthen@
2017-11-13Constrain MBR partition offsets to 0 .. disk.size - 1.Kenneth R Westerback
Issue reported by Alexi Malinin via bugs@. Thanks!
2017-11-13add a generic packet rate matching filter. allows things likeHenning Brauer
pass in proto icmp max-pkt-rate 100/10 all packets matching the rule in the direction the state was created are taken into consideration (typically: requests, but not replies). Just like with the other max-*, the rule stops matching if the maximum is reached, so in typical scenarios the default block rule would kick in then. with input from Holger Mikolon ok mikeb
2017-11-12Clone epoch value in clone_lease(), not manually.Kenneth R Westerback
2017-11-09tweak previous;Jason McIntyre
2017-11-09Use lease 'epoch' (time lease was acquired) to calculate timers forKenneth R Westerback
renew/rebind/expiry. Treat renew/rebind/expiry statements in leases as comments for human consumption.
2017-11-08Add a type cast to force signed comparison. This fixes a loopVisa Hankala
termination issue that can arise when parsing IP options. The bug was found by Hrvoje Popovski with ping -R. Fix tested by Hrvoje, OK millert@
2017-11-08Do not accept superfluous arguments.Patrick Wildt
From Klemens Nanni. ok markus@
2017-11-08In the final RFC 5903 the computation for the DH shared secret changed.Patrick Wildt
Instead of the full point, only the X point is included. The member g_xy is always the shared secret but so far its buffer has been allocated using the size of the public points. Since this is a different size now, as the shared secret for EC Groups should only store the x point, we need another member to specify the length of g_xy. Since this is a backwards incompatible change older isakmpds won't be able to negotiate if you use EC groups. Bump the version of our own vendor tag so peers can try to keep compatibility based on the presen- ted tag. This could be used to implement backwards compatibility to older isakmpds. Prompted by and ok mpi@
2017-11-08For IPcomp we need to load explicit ESP-flows for the IPIP or IPCOMPPatrick Wildt
tunneled packets, otherwise every packet between the gateways will be sent into the tunnel (e.g. ICMP, too). ok markus@
2017-11-06Add lease declaration 'epoch' to hold the time() when a lease isKenneth R Westerback
received. Set it in packet_to_lease() and preserve it in apply_defaults(). Otherwise not used, documented or printed in lease database yet.
2017-11-06Add format 't' to parse_decimal() for signed 64-bitKenneth R Westerback
integers.
2017-11-05ifconfig <if> giftunnel was deprecated in 2001, it's never too late toSebastian Benoit
remove it ok phessler@ beck@
2017-11-04Don't keep blindly chugging along when receiving an unexpected imsg,Florian Obser
something is seriously wrong.
2017-11-04Decline duplicate offers for the requested address, as areKenneth R Westerback
duplicate offers for other addresses, so that the fastest responding and presumably 'closest' DHCP server is used.
2017-11-03There can be multiple default routers sending router advertisements.Florian Obser
Install the default route with mpath flag. OK mpi
2017-10-30Fix '-L' file handling. Mixing idioms in previous cleanups ended upKenneth R Westerback
fopen()'ing the the file with a mode of "a" (so watchers don't detect changes until the file is re-written as part of interface configuration) but using rewind() to start writing from the beginning of the file. Use ftruncate() and overwrite the date as intended, rather than appending new data. Problem reported and diffs tested by Mike via tech@. Thanks!
2017-10-30Exit printing an error message if SIOCSIFMEDIA fails.Martin Pieuchot
from Jesper Wallin.
2017-10-30In the subjectAltName comparison, the bzero before the while-loop wasPatrick Wildt
lost while applying the diff. This is means sanid could be passed uninitialized to ca_x509_subjectaltname_cmp(), where ibuf_release() could try to release a pointer which is essentially stack garbage. While there I realized that the bzero() in the loop is essentially fatal, since every mismatch leads to a silent leak of ibufs. Since ca_x509_subjectaltname_cmp() releases and initializes the passed iked_id, we can safely call it multiple times after initializing sanid once before the loop. ok markus@
2017-10-27zap a bad space in usage(): sorry ken for not spotting!Jason McIntyre
2017-10-27Add '-n' option to just parse dhclient.conf for errors.Kenneth R Westerback
ok jmc@ tb@
2017-10-27Support multiple subjectAltNames by trying each existing until therePatrick Wildt
is none or until we find one that matches. ok markus@
2017-10-27In the final RFC 5903 the computation for the DH shared secret changed.Patrick Wildt
Instead of the full point, only the X point is included. Unfortunately this is a backwards incompatible change, so older ikeds won't be com- patible with this change. Of course only if you use ECP. Anyway, this change makes us follow the RFC correctly. ok markus@
2017-10-27Support DH groups 19 to 21 and 25 to 30, just like iked(8) does.Martin Pieuchot
ok visa@, markus@
2017-10-24remove defines for ioctls the kernel doesn't recogniseJonathan Gray
ok mpi@
2017-10-23Use 'for (;;)' instead of a mix of "while (1) {}" andKenneth R Westerback
"do {} while (1)".
2017-10-23Use same parse_warn() verbiage in parse_lease_time() as thatKenneth R Westerback
emitted when other unsigned 32-bit values are parsed. i.e. "expecting integer between 0 and 4294967295". No need to make people google what "unsigned 32-bit decimal value" means.
2017-10-23Enforce dhclient.conf prohibitions on nesting 'interface'Kenneth R Westerback
declarations and placing 'lease' declarations inside 'interface' declarations. Document and enforce requirement that all 'lease' declarations must specify the interface to which they apply. Ignore static leases that apply to other interfaces rather than complaining the interface name is wrong and using the lease anyway.
2017-10-21Last but not least, bring parse_interface_declaration()Kenneth R Westerback
into the 0/1 for success world.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-04 02:02:11 +0000