summaryrefslogtreecommitdiff
path: root/usr.sbin/relayd/parse.y
AgeCommit message (Collapse)Author
2019-05-10Add support for from/to in relay filter rules.Reyk Floeter
For example, pass from 10.0.0.0/8 path "/hello/*" forward to <b> Ok benno@
2019-03-13remove unused keyword "virtual".Sebastian Benoit
ok gcc, claudio@ agrees
2019-03-04Support for rfc 6455 Websockets connection upgrade. Add a new protocolSebastian Benoit
option 'http { [no] websockets }' to allow such connections (default is no). Original diff from Daniel Lamando (dan AT danopia DOT net), option and header checks by me. suggestions and ok bluhm@ and earlier diff claudio@
2019-02-13(unsigned) means (unsigned int) which on ptrdiff_t or size_t or otherTheo de Raadt
larger types really is a range reduction... Almost any cast to (unsigned) is a bug. ok millert tb benno
2018-11-01- odd condition/test in PF lexerAlexandr Nedvedicky
(and other lexers too) This commit rectifies earlier change: in the lex... even inside quotes, a \ followed by space or tab should expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). OK deraadt@, OK millert@
2018-10-22Make host_*() AF-agnosticdenis
Merge host_v{4,6}() into much simpler host_ip() using just getaddrinfo(). With input & test by kn@ and benno@ OK benno@ kn@
2018-09-07replace malloc()+strlcpy() with strndup() in cmdline_symset().miko
"looks good" gilles@ halex@
2018-08-06replace the current log optionsSebastian Benoit
log updates|all with log state changes log host checks log connection [errors] The first two control the logging of host check results: either changes in host state only or all checks. The third option controls logging of connections in relay mode: Either log all connections, or only errors. Additionaly, errors will be logged with LOG_WARN and good connections will be logged with LOG_INFO, so they can be differentiated in syslog. ok and feedback from claudio@
2018-07-11Do for most running out of memory err() what was done for most runningKenneth R Westerback
out of memory log_warn(). i.e. ("%s", __func__) instead of manual function names and redundant verbiage about which wrapper detected the out of memory condition. ok henning@
2018-07-09No need to mention which memory allocation entry point failed (malloc,Kenneth R Westerback
calloc or strdup), we just need to log that we ran out of memory in a particular function. Recommended by florian@ and deraadt@ ok benno@ henning@ tb@
2018-06-11Fix an off-by-one line count when using include statements.denis
Thanks to otto@ for the initial diff. OK benno@
2018-04-26Plug leak in error case of the common 'varset' implementations.Kenneth R Westerback
ok benno@
2018-04-18Remove RELAY_MAX_SESSIONS from relayd, there is no reason to limit relaysClaudio Jeker
to 1024 session per process (esp. with keep-alive). Now the fd limit is the new maximum and relayd will make sure to not accept too many sessions. The tcp backlog config maximum is now 512, adjust manpage accordingly. OK benno@ deraadt@
2017-11-29add options to specify the control socket in relayd and relayctl.Sebastian Benoit
From Kapetanakis Giannis, thanks. ok claudio@
2017-11-27Change the ecdhe curve configuration to the same way httpd is doing it.Claudio Jeker
This removes 'no ecdh' and renames 'ecdh curve auto' to ecdhe default. The code uses now tls_config_set_ecdhecurves(3) so it is possible to specify multiple curves now. If people specified curves in their config they need to adjust their config now. OK beck@
2017-11-27Use file descriptor passing to load certificates into the relays. EspeciallyClaudio Jeker
the ca file (having all the trusted certs in them) can be so big that loading via imsg fails. OK beck@
2017-11-16Check that http options are only configured in http protocols.Alexander Bluhm
OK benno@
2017-11-15make the maximum size of http headers configurable in the protocol.Sebastian Benoit
ok bluhm@, >8k makes sense claudio@
2017-08-2865535 is a valid port to listen on.Florian Obser
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT gmail, thanks! chris@ pointed out that more than httpd(8) is effected. OK gilles@
2017-05-27Migrate relayd to use libtls for TLS. Still does the TLS privsep via theClaudio Jeker
engine but at least we can use a sane API for new features. Going in now so it is possible to work with this in tree. General agreement at d2k17.
2017-01-05Replace hand-rolled for(;;) emptying of 'symhead' TAILQ with moreKenneth R Westerback
modern TAILQ_FOREACH_SAFE(). No intentional functional change. ok millert@ bluhm@ gilles@
2017-01-05Replace symset()'s hand-rolled for(;;) traversal of 'symhead' TAILQKenneth R Westerback
with more modern TAILQ_FOREACH(). This what symget() was already doing. Add paranoia '{}' around body of symget()'s TAILQ_FOREACH(). No intentional functional change. ok bluhm@ otto@
2016-09-26spacingReyk Floeter
2016-09-03Replace [RELAY|SERVER]_MAXPROC with the new PROC_MAX_INSTANCESReyk Floeter
variable and limit it from 128 to 32 instances (the old value). While here, move a few PROC_ defines around. OK rzalamena@
2016-09-02Move snmp options into struct relayd_config and delay start of theReyk Floeter
snmp subsystem until the configuration is done. OK benno@ claudio@
2016-09-02Split "struct relayd" into two structs: "struct relayd" and "structReyk Floeter
relayd_config". This way we can send all the relevant global configuration to the children, not just the flags and the opts. With input from and OK claudio@ benno@
2016-09-01Switch from the not really working session cache (because of the multiprocessClaudio Jeker
nature of relayd) to tls session tickets to do TLS session resumption. TLS session tickets do not need to store SSL session data in the server but instead send an encrypted ticket to the clients that allows to resume the session. This is mostly stateless (apart from the encryption keys). relayd now ensures that all relay processes use the same key to encrypt the tickets. Keys are rotated every 2h and there is a primary and backup key. The tls session timeout is set to 2h to hint to the clients how long the session tickets is supposed to be alive. Input and OK benno@, reyk@
2016-06-21do not allow whitespace in macro names, i.e. "this is" = "a variable".Sebastian Benoit
change this in all config parsers in our tree that support macros. problem reported by sven falempin. feedback from henning@, stsp@, deraadt@ ok florian@ mikeb@
2015-11-22Update log.c: change fatal() and fatalx() into variadic functions,Reyk Floeter
include the process name, and replace all calls of fatal*(NULL) with fatal(__func__) for better debugging. OK benno@
2015-08-20stdlib.h is in scope; do not cast malloc/calloc/realloc*Theo de Raadt
ok millert krw
2015-05-02Fix obvious problems with relayd config reload.Claudio Jeker
- fix a TAILQ corruption because of a use after free - do not reinit the SSL engine since that fails OK sthen, benno
2015-02-08Use AI_ADDRCONFIG when resolv hosts on startup.Reyk Floeter
OK henning@
2015-01-22Clean up the relayd headers with help of include-what-you-use and someReyk Floeter
manual review. Based on common practice, relayd.h now includes the necessary headers for itself. OK benno@
2015-01-21Include <netinet/in.h> before <net/pfvar.h>. In a future change whenTheo de Raadt
ports is ready, <net/pfvar.h> will stop including a pile of balony.
2015-01-16Adapt to <limits.h> universe.Theo de Raadt
ok millert
2014-12-23pf now supports source-hash and random with tables so we can allow itReyk Floeter
in redirections. Thanks for help and input from jsg and yasuoka who reminded me to dig out and update these old diffs for pf and relayd. ok jsg@
2014-12-21Stop pulling in <arpa/inet.h> or <arpa/nameser.h> when unnecessary.Philip Guenther
*Do* pull it in when in_{port,addr}_h is needed and <netinet/in.h> isn't. ok reyk@
2014-12-18Update relayd to use siphash instead of sys/hash. The source-hash,Reyk Floeter
loadbalance and hash modes use a random key by default that can be forced to be a static key with a new configuration argument. With input from Max Fillinger. ok tedu@
2014-12-12Change the keyword "ssl" to "tls" to reflect reality since weReyk Floeter
effectively disabled support for the SSL protocols. SSL remains a common term describing SSL/TLS, there is some controvery about this change, and the name really doesn't matter, but I feel confident about it now. (btw., sthen@ pointed out some historical context: http://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html) OK benno@, with input from tedu@
2014-11-20Don't allow embedded nul characters in strings.Jonathan Gray
Fixes a pfctl crash with an anchor name containing an embedded nul found with the afl fuzzer. pfctl parse.y patch from and ok deraadt@
2014-11-19Support exporting relayd statistics via AgentX/snmpdBret Lambert
This should be equivalent to the statistics available via the various relaydctl show commands okay benno@ reyk@
2014-11-07Remove the sslv2 option since LibreSSL has no SSLv2 support (however retainJoel Sing
SSL_OP_NO_SSLv2 in case you happen to be running relayd on another platform with another SSL library). Also fix the SSLv3 handling so that 'no sslv3' actually works as intended. ok reyk@
2014-11-02Convert the logic in yyerror(). Instead of creating a temporaryAlexander Bluhm
format string, create a temporary message. OK deraadt@
2014-10-20Remove the "interface" option from the "transparent forward" directive.Reyk Floeter
It was mandatory in the grammar but never used in the code. A fully transparent relay can now be specified with the following directive in a relay block: "transparent forward to destination". OK sthen@
2014-10-15Disable SSLv3 by default.Reyk Floeter
OK sthen@ jsing@
2014-09-05revert previous; was based on a work-in-progress, as wellBret Lambert
as being an incomplete and therefore incorrect adaptation apologies to anybody who got bitten by this mistake ok reyk@
2014-08-29Implement consistent host hashing for relayd, based onBret Lambert
work done by andre@ Re-add a randomized hash seed (which had apparently gotten inadvertently removed in the past). Allows for multiple relayd instances to be configured to forward traffic to the same host, falling back to the random seed when not explicitly configured to do so. ok reyk@
2014-07-11Sometimes I just sort the tokens in parse.yReyk Floeter
2014-07-11Add support for EDH to provide perfect forward secrecy for older SSLReyk Floeter
clients. Additionally, add options for disallowing client-initiated renegotiations and to prefer the server's cipher list over the client's preferences. This work is based on a diff by Markus Gebert at hostpoint.ch, and was discussed with jsing@ resulting in a few different defaults. ok benno@
2014-07-11Simplify the code that handles the HTTP headers by using an RB treeReyk Floeter
with associated lists instead of the complicated lookup table and "others" list. This might add a little malloc overhead for common headers but also fixes some issues like the handling of repeated headers - for example, handling of multiple "Set-Cookie" headers. ok bluhm@ (regress part) ok benno@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-01 02:27:52 +0000