summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2020-05-21Rename various parameters and variables to eliminate misleadingKenneth R Westerback
allusions to 'rtstatic'.
2020-05-21extract_classless_route() -> extract_route() as there is only the one routeKenneth R Westerback
extraction function.
2020-05-21Rename route_in_rtstatic() to route_pos() to more clearly reflect itsKenneth R Westerback
current usage.
2020-05-20Remove no longer necessary RTLEN.Kenneth R Westerback
2020-05-20Fix typo in comment.Kenneth R Westerback
2020-05-20Rename proposal{} fields rtstatic_len, rtsearch_len and rtdns_len toKenneth R Westerback
routes_len, domains_len, ns_len. Removes obsolete alignment with names of RTM_PROPOSAL fields and makes code easier to read. No intentional functional change.
2020-05-20Replace fixed 128-byte fields for search domains, static routes andKenneth R Westerback
domain name servers with variable sized uint8_t chunks. Allows larger lists of search domains and static routes while making common situations use much less memory. Original report of breaching the 128-byte limit for static routes from James Cook via misc@. Testing of various versions by Andreas Kusalananda.
2020-05-19Eliminate imsg_propose{}, imsg_revoke{} and imsg_tell_unwind{} asKenneth R Westerback
unnecessary wrappers, since they all contained a single field that could be used as is. Suggested by claudio@
2020-05-19sync libunbound fixes from unbound, ok florian@Stuart Henderson
2020-05-19Move back to FFS1 by default for MFS as suggested by millert@. OK otto@Stuart Henderson
2020-05-19Copy ownership/permissions from the mountpoint to FFS2 MFS, as already doneStuart Henderson
for FFS1 MFS. Problem reported by Mark Patruck and Andreas Kusalananda Kahari. ok otto@
2020-05-18Make ffs2 the default for newfs; change all calls to create e.g. floppyOtto Moerbeek
filesystems or ramdisks to use explicit -O 1; installer already does that. ok sthen@
2020-05-16list example files in FILES with a short description: generally, "ExampleJason McIntyre
configuration file.", but occasionally something else fit better; at the same time, try to make the format for FILES more consistent; original diff from clematis
2020-05-15Shuffle and tweak code in lease_as_proposal() to allocate the proposalKenneth R Westerback
after the variable length data (static routes, search path, dns servers) sizes are deteremined. No intentional functional change. Allows potential change to variable length proposals.
2020-05-15Fix domain-search option processing. Testing one value and then usingKenneth R Westerback
a different value to limit memcpy() is a bad thing. Discovered & fix tested by Andreas Kahari. Thanks!
2020-05-15Be more careful in extracting the uint16_t value of interface-mtu, andKenneth R Westerback
in printing the int field we store it in. i.e. '%d' not '%u. Discovered while tracking down breakage reported by Andreas Kahari on bugs@.
2020-05-15pf(4): use CLOCK_BOOTTIME to get time_uptime(9) in userspacecheloha
In pf(4), the pf_status.since timestamp is set with time_uptime(9). This is a low-res snapshot of nanouptime(9). nanouptime(9) is used to implement CLOCK_BOOTTIME for clock_gettime(2). It is not used to implement CLOCK_UPTIME, though. The names are misleading. Switch to CLOCK_BOOTTIME in places in userspace where we use pf_status.since so we are working with the right clock. Technically CLOCK_MONOTONIC is equivalent, but we shouldn't use that here. CLOCK_MONOTONIC is not necessarily the "time since boot": the standard says its absolute value is meaningless. ok patrick@ bluhm@
2020-05-14Stricter return value checking for EVP_Cipher* calls.tobhe
ok patrick@
2020-05-14Massage merge_option_data() to be more careful when dealing with 'D'Kenneth R Westerback
(domain search) and 't' (text) options. Enables append/prepend for the domain-search option by inserting blanks between the domains and ensures the presence of a terminating NUL when merging text.
2020-05-13Remove unnecessary logging messages.tobhe
2020-05-13Repair 'domain-search' parsing broken in r1.191.Kenneth R Westerback
2020-05-13We don't count a terminating NUL in the length of option data.Kenneth R Westerback
2020-05-13Nuke a variable that is always set to 0.Kenneth R Westerback
2020-05-13No need to memcpy() into a string created by strdup().Kenneth R Westerback
2020-05-13Remove dead 'iked_flow' member 'flow_type'.tobhe
2020-05-11Fix policy lookup edge case for simultaneous transport and tunnel mode SAs.tobhe
Only the initiator can use 'msg_policy' to determine if the policy is supposed to be transport mode, the responder has to check for a received USE_TRANSPORT notify to find a matching policy during the lookup. ok markus@
2020-05-10sockaddr_rtdns does not guarantee alignment of the buffer. So firstOtto Moerbeek
memcpy the address into a local var before comparing it with code that reads ints using int *. at least sparc64 and landisk suffer from this. with and ok jca@
2020-05-09Log error notifications other than NO_PROPOSAL_CHOSENtobhe
ok markus@
2020-05-09Shuffle and clarify logic creating the contents of resolv.conf.Kenneth R Westerback
No intentional functional change.
2020-05-08Use a union to ensure cmsg buffer is properly alignedJeremie Courreges-Anglas
Fixes a crash on landisk (strict alignement arch) reported by otto@ ok deraadt@ otto@
2020-05-08Remove unneccessary X509_NAME_oneline wrapper. Passing NULL as buftobhe
does the same thing. ok patrick@
2020-05-08Nuke unneeded 'inits' field in struct proposal. 'mtu' being 0 is enough of a ↵Kenneth R Westerback
clue to avoid setting interface mtu.
2020-05-08Nuke 'set but never used' addrs field in struct proposal.Kenneth R Westerback
2020-05-02Use gettimeofday() instead of CLOCK_MONOTONIC in gettime(). The return valuetobhe
is compared to one received via PFKEY which results in garbage. Found by Rene Ammerlaan <rj (dot) ammerlaan (at) sungai (dot) nl> ok patrick@
2020-05-01When initiating IKE SA rekeying, make sure to send a key from a mutualtobhe
DH group (as negotiated by IKE_SA_INIT) instead of one from the configured policy. Not doing so may result in INVALID_KE errors. ok patrick@
2020-05-01Clarify global 'set active' and 'set passive' options and how theytobhe
interact with the per-policy active/passive options. ok kn@
2020-04-30Add ECDH groups and higher order MODP DH groups to default proposal.tobhe
ok sthen@, patrick@
2020-04-29Remove trailing tabtobhe
2020-04-29Missing whitespace.tobhe
2020-04-29Add the 'nomimo' nwflag which disables MIMO in 11n mode.Stefan Sperling
This flag restricts a wireless driver to MCS0 - MCS7 for both transmission and reception. It can be set to work around packet loss in 11n mode caused by unused antenna connectors on a MIMO-capable wireless network device. man page tweak from tracey@ ok deraadt@
2020-04-28The order of arguments to proposals_negotiate makes a difference.tobhe
'key->pol_proposals' should be the peer proposal as it is derived from a received SA payload, 'p->p_proposal' comes from a locally configured policy. ok patrick@
2020-04-28Remove support for insecure EC2N groups. Clarify which Diffie-Hellmantobhe
groups are not recommended to use and are only supported for backwards compatibility. Feedback from sthen@ ok kn@
2020-04-27Add curve25519 IANA group number.tobhe
2020-04-27Log with SPI_SA().tobhe
2020-04-27If the DHCP server disappears between OFFER'ing and ACK'ing a lease,Kenneth R Westerback
stop trying to get an ACK from that server after 'timeout' seconds. Give up and try to get another lease. Possible infinite loop pointed out by Alexander Markert on tech@.
2020-04-26Fix leak of temporary ID ibufs on IKE SA rekey.tobhe
ok markus@
2020-04-26Only print valid rdomains. '-1' is used as default value and shouldtobhe
not be printed.
2020-04-26Tighten up NAK handling. Inform unwind when the active lease isKenneth R Westerback
discarded. Update leases file when active lease is discarded. Discard NAK'ed offers even if there is no active lease. Always transition to INIT. Issues discovered after inappropriate behaviour resported by Alexander Markert and Pierre Emeriaud.
2020-04-25Reduce minimum allowed number of chunks in a CONCAT volume from 2 toKenneth R Westerback
1. This increases the number of volumes that can be created on a single disk from 7 to 15. i.e. a disk can be sliced into a maximum of 225 (15 * 15) filesystems instead of a mere 105 (7 * 15). ok deraadt@
2020-04-24Add some useful log messages for the IKE handshake.tobhe
ok patrick@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 09:35:53 +0000