summaryrefslogtreecommitdiff
path: root/sbin
AgeCommit message (Collapse)Author
2020-01-19add some explicit tagging macros; OK kn@ on a previous versionIngo Schwarze
2020-01-16Add '-p' command line option which allows to configuretobhe
the UDP encapsulation port, similar to isakmpd's '-N' flag. Being able to change the UDP encapsulation port is useful in cases where ESP and UDP ports 500 and 4500 are blocked or rate limited. ok sthen@
2020-01-16Usually, -width Fl (which is 10n) is too wide and hence ugly.Ingo Schwarze
Change several instances, most of them to the usual -width Ds.
2020-01-16Fail on missing anchorkn
There is no reason to continue on anchor specific paths if the given anchor does not exist. OK sashan
2020-01-15Do the actual pfr_strerror() to pf_strerror() renamekn
Missed in previous
2020-01-15Unify error message for nonexisting anchorskn
pf(4) returns EINVAL for DIOCGETRULE, DIOCGETRULES and DIOCGETRULESET if the specified anchor does not exist. Extend and rename {pfr -> pf}_strerror() to make error message more consistent. There are other occasions as well but those need additional tweaks; that's stuff for another diff. OK and rename from sashan
2020-01-15Support multiple x509 extensions and extensions with multipletobhe
subjectAltName fields. The new parser code is inspired by tls_check_subject_altname() from libssl. ok markus@
2020-01-15s/deprecated/ignored/ in the warning message if -6 is used; the optionStuart Henderson
is ignored (the behaviour previously behind -6 is now the default so if this flag was used, it can happily be removed.
2020-01-15If we don't find a certificate signed by a trusted CAtobhe
with subjectAltName matching srcid, try certificate with only matching subjectAltName. ok patrick@
2020-01-15Refine error messagekn
While code in pf/pfctl confusingly uses either anchor or ruleset depending on the context, pfctl(8) (both manual and user interface) should be consistent. For users there are basically anchors only, so do not imply any difference between the two terminologies. OK sashan
2020-01-15Merge radix_perror() into simpler warnx()/errx() usagekn
Less nesting for clearer code. OK sashan
2020-01-15Further document recursive flush behaviourkn
OK sashan
2020-01-15Print the main ruleset/anchor as "/" not "<root>" for consistencykn
OK sashan
2020-01-15Recent change to pfctl(8) prompts for a minor update of manpage.Alexandr Nedvedicky
OK kn@
2020-01-15Enable pfctl(8) to recursively flush rules and tables from PF driver. TheAlexandr Nedvedicky
recursive operation ("pfctl -a '*' ...") works for '-s' option already. This change enables the same thing for '-F' option, so "pfctl -a '*' -Fa" will flush everything from PF driver. The idea was discussed with many on tech@ in spring 2019. OK kn@
2020-01-15Replace duplicate error message with gai_strerror(3)kn
getaddrinfo(3) may fail for multiple reasons, but error message should be unique in general. OK bluhm
2020-01-14Remove IPsec flow blocking unencrypted IPv6 traffic which wastobhe
meant to prevent VPN leakage but repeatedly broke people's setups. The -6 flag which used to disable the blocking flow is now ignored and prints a deprecation warning. ok kn@ bluhm@ phessler@
2020-01-08Unify duplicate NOTIFY payload construction code in ikev2_add_notify andtobhe
remove unused arguments from ikev2_add_* functions. ok bluhm@
2020-01-07Link ESP-SA and IPcomp-SA using GRPSPIS instead of using a self-builttobhe
solution for multi-SA flows. As a result we only need a single outgoing IPCOMP flow and can get rid of the two extra transport mode flows for ESP. ok bluhm@
2020-01-04ping(8): improve "-i wait" parsing and error-checking codecheloha
- Never accept negative values. - Cap the interval at UINT_MAX seconds to avoid strange rounding behavior at the end of the input range. - Use error messages that resemble other parts of the tree where we are able to use strtonum(3). - Leverage modf(3) for cleaner code. - Call it "-i interval" to avoid accidental visual similarity to "-w maxwait". With input from cjeker@, kettenis@, kn@. ok kn@
2019-12-28Refactor child SA cleanup.tobhe
ok bluhm@
2019-12-27Fix ifconfig WPA key installation with max allowed length SSIDs.Stefan Sperling
ok claudio phessler deraadt sthen
2019-12-25timeout(9): new flag: TIMEOUT_SCHEDULED, new statistic: tos_scheduledcheloha
This flag is set whenever a timeout is put on the wheel and cleared upon (a) running, (b) deletion, and (c) readdition. It serves two purposes: 1. Facilitate distinguishing scheduled and rescheduled timeouts. When a timeout is put on the wheel it is "scheduled" for a later softclock(). If this happens two or more times it is also said to be "rescheduled". The tos_rescheduled value thus indicates how many distant timeouts have been cascaded into a lower wheel level. 2. Eliminate false late timeouts. A timeout is not late if it is due before softclock() has had a chance to schedule it. To track this we need additional state, hence a new flag. rprocter@ raises some interesting questions. Some answers: - This interface is not stable and name changes are possible at a later date. - Although rescheduling timeouts is a side effect of the underlying implementation, I don't forsee us using anything but a timeout wheel in the future. Other data structures are too slow in practice, so I doubt that the concept of a rescheduled timeout will be irrelevant any time soon. - I think the development utility of gathering these sorts of statistics is high. Watching the distribution of timeouts under a given workflow is informative. ok visa@
2019-12-24dmesg(8) allocated a bit too much memory due to padding of structAlexander Bluhm
msgbuf. Use the same size algorithm in kernel and userland. OK cheloha@ guenther@ deraadt@
2019-12-23Ralph Dolmans from nlnetlabs points out that libunbound usesFlorian Obser
ub_event_pluggable.c instead of ub_event.c. ( https://github.com/NLnetLabs/unbound/issues/99 ) We have been the odd one out, so switch to ub_event_pluggable, too.
2019-12-20Try to bind to port 53 before opening the control socket.Florian Obser
The bind might fail if another daemon is running while the control socket opening will succeed. Then we end up with an overwritten control socket, unwind exiting and no control socket to the already running unwind. Found the hard way by deraadt OK deraadt, mestre, kn, pamela
2019-12-19The previous fix for creating isakmpd(8) IKE pcap file, weakenedAlexander Bluhm
the path sanitizer in the privsep parent. Bring back the checks in a way that works with new realpath(3). tested and OK hshoexer@
2019-12-19Spell "mount point" as other man pages do, with a space.Anthony J. Bentley
ok jmc@
2019-12-18Workaround unbound github issue #99.Florian Obser
https://github.com/NLnetLabs/unbound/issues/99 ub_ctx_delete would free the passed in event_base leading to use-after-free since libunbound never allocated the memory and unwind expects to continue using the event_base.
2019-12-18Update to libunbound 1.9.6Florian Obser
Heavy lifting by sthen with updating in-tree unbound(8).
2019-12-18Implement unwindctl status memory to show chache memory usage.Florian Obser
testing by otto & pamela as part of a larger diff
2019-12-18Rework unified cache handling to be able to unify key and neg caches.Florian Obser
testing by otto & pamela as part of a larger diff
2019-12-18Use neg and key cache from the passed in environment if initialized so thatFlorian Obser
unwind can share caches between strategies. testing by otto & pamela as part of a larger diff
2019-12-17Use correct size when zeroing out dinode.Todd C. Miller
Fixes a bug on file systems using the rev1 inode structure where the size of the in-memory and on-disk dinode differ. From Chris Waddey; OK deraadt@
2019-12-17Reject leases that do not provide a subnet mask for the address beingKenneth R Westerback
provided. Restores behaviour previously provided by the default dhclient.conf.
2019-12-15Make this fit in 80 cols.Florian Obser
2019-12-15semarie diagnosed a what appeared to be a 'large backwards memcpy' of anTheo de Raadt
ipv6 address, but was actually oversize (a large union). correct access to the right subfield. ok florian semarie
2019-12-15Allow more outgoing ports, the default 16 is pretty tight for theOtto Moerbeek
recursor. Also change strategy to not fetch addresses of nameservers pro-actively, it does not help a lot in typical unwind setups and consumes resources we would like to spend on actual resolving user queries. ok florian@
2019-12-14Be less aggressive pre-allocating memory; ok florian@Otto Moerbeek
2019-12-14Simplify resolve_done.Florian Obser
- check if this is an answer to a still running query up front, if not there is nothing more to do - get rid of the retry case, we can now just inline it - reduce indent by always calculating elapsed time for DOUBT_NXDOMAIN_SEC Triggered by, input and OK otto
2019-12-14No use to create resolvers we know are going to be dead; ok florian@Otto Moerbeek
2019-12-13Don't try dead resolvers; ok florian@Otto Moerbeek
2019-12-13print type as type and not as rcodeOtto Moerbeek
2019-12-13Revert two files committed by accidentOtto Moerbeek
2019-12-13Avoid leaks by using the _buf versions of sldns_wire2str_* functions.Otto Moerbeek
Also add some consistentcy checking to detect logic errors. ok @florian
2019-12-12Avoid optimizing empty rulesetskn
All optimizations work on actual rules; if there are none, return early. While here, tell which ruleset/anchor is being optimized to make the debug message actually useful. OK mikeb
2019-12-12Only create (and check) resolvers listed in preferences.Florian Obser
Unfortunately this required a fair amount of deck chair shuffling. Input & OK otto
2019-12-11Plug leaks related to running queue maintenance. ok florian@Otto Moerbeek
2019-12-10If a file or directory component does not exists, realpath(3) returnsAlexander Bluhm
ENOENT. In this case, try to open(2) the path. Then a non-existing file will be created, but a missing directory component still causes an error. This fixes isakmpd(8) IKE pcap file creation. from hshoexer@
2019-12-10We can receive a delete and free an SA that is referenced in sa_nextr.tobhe
Remove references when deleting the SA, otherwise we trigger a use-after-free. ok markus@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-12 07:42:34 +0000