summaryrefslogtreecommitdiff
path: root/usr.sbin/relayd/relay.c
AgeCommit message (Collapse)Author
2021-03-24Responses to HEAD requests must not have a message body (even though they haveSebastian Benoit
a Content-Length header). HTTP RFC 7231 section 4.3.2. found by niklas@, claudio@ agrees.
2021-01-27remove bogus key hack now that it's handled by libtlsEric Faurot
no objection claudio@ ok tb@ jsing@
2021-01-09Add 'strip' directivedenis
Feedback by Olivier Cherrier, Hiltjo Posthuma, Mischa OK benno@
2020-05-14Enable TLSv1.3 support in relayd(8)pvk
with the help from tb@ jsing@; ok tb@
2019-07-13Don't "forward to <table>" when a "forward to destination" address is set.Christopher Zimmermann
This matches the documented behaviour. On matching "forward to <table>" filter rules the "forward to destination" address is unset, so that in that case the "forward to <table>" rule is still used. OK benno@, regression tests still passing.
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-06-26Add support for OCSP staplingReyk Floeter
Many thanks to Bruno Flueckiger who independently sent a very similar patch. He also tested the one I'm committing that it works as expected. OK tb@
2019-05-31Move the relay keys/certs into a separate global list and look them up by id.Reyk Floeter
Moving the certs out of the relay struct will help to add multiple SNI certs. Tested by many users (thanks!) Feedback & OK rob@
2019-05-29Move relay_load_*() functions into relayd.cReyk Floeter
Pass the *env as an explicit argument instead of using the global pointer: The relay_load_certfiles() function is called early before the *env is set up. This does not change anything in the current code as *env is not used by anything in the function (not even ssl_load_key() that is taking it as an argument) but it will be needed by upcoming changes for SNI. Ok rob@
2019-05-13Fix filter rules with "forward to" statement in persistent connections.Reyk Floeter
OK bentley@ mikeb@
2019-05-10Add support for from/to in relay filter rules.Reyk Floeter
For example, pass from 10.0.0.0/8 path "/hello/*" forward to <b> Ok benno@
2019-05-08Fix and tweak websocket upgrade handling.Reyk Floeter
- Don't expect the Connection header to equal Upgrade, it may include Upgrade - Reshuffle the code to check the Upgrade/Connection headers in one place Reported and tested by Rivo Nurges OK and input from benno@ Cvs: ----------------------------------------------------------------------
2019-03-04Support for rfc 6455 Websockets connection upgrade. Add a new protocolSebastian Benoit
option 'http { [no] websockets }' to allow such connections (default is no). Original diff from Daniel Lamando (dan AT danopia DOT net), option and header checks by me. suggestions and ok bluhm@ and earlier diff claudio@
2018-09-19Do not abort when the ca privenc runs into a timeout.Reyk Floeter
OK claudio@
2018-08-06replace the current log optionsSebastian Benoit
log updates|all with log state changes log host checks log connection [errors] The first two control the logging of host check results: either changes in host state only or all checks. The third option controls logging of connections in relay mode: Either log all connections, or only errors. Additionaly, errors will be logged with LOG_WARN and good connections will be logged with LOG_INFO, so they can be differentiated in syslog. ok and feedback from claudio@
2018-06-10When a TLS error occurs, print the tls_error() message as part of theSebastian Benoit
connection closed log message, not just as debug message. ok claudio@ reyk@
2018-04-18Remove RELAY_MAX_SESSIONS from relayd, there is no reason to limit relaysClaudio Jeker
to 1024 session per process (esp. with keep-alive). Now the fd limit is the new maximum and relayd will make sure to not accept too many sessions. The tcp backlog config maximum is now 512, adjust manpage accordingly. OK benno@ deraadt@
2017-12-27log specific error when connect() fails.Sebastian Benoit
ok claudio@, feedback bluhm@
2017-11-28Introduce relay_reset_event() which closes and resets a relay connection.Claudio Jeker
Currently this is only used by relay_close() but will be needed in near future. OK benno@
2017-11-28In TLS inspection mode we also need to keep the server tls object around.Claudio Jeker
For this we need to add an additional pointer to the ctl_relay_event. Diff from Petri Mikkila (pmikkila at gmail) OK benno@
2017-11-28Add space between to and read like in other DPRINTFs.Claudio Jeker
2017-11-27Change the ecdhe curve configuration to the same way httpd is doing it.Claudio Jeker
This removes 'no ecdh' and renames 'ecdh curve auto' to ecdhe default. The code uses now tls_config_set_ecdhecurves(3) so it is possible to specify multiple curves now. If people specified curves in their config they need to adjust their config now. OK beck@
2017-11-27lseek/read is racy when there is multiple consumers. Use pread instead.Claudio Jeker
Solves the startup issues seen by bluhm@. pread idea from guenther@. While there save the errno in the error case. OK bluhm@
2017-11-27Add a DPRINTF() in relay_error() that helped me out way too many times.Claudio Jeker
2017-11-27Use file descriptor passing to load certificates into the relays. EspeciallyClaudio Jeker
the ca file (having all the trusted certs in them) can be so big that loading via imsg fails. OK beck@
2017-11-27Do not rip out the output buffer of the bufferevent. Instead just use anClaudio Jeker
initial bufferevent_write_buffer() to write out the queued up HTTP request. OK benno@
2017-11-27relay_tls_connected() is playing with the inner bowels of bufferevents.Claudio Jeker
Be more careful and remove the events before resetting them to the new backends. This is also what some of the bufferevent functions are doing. OK benno@
2017-09-23The relayd regression tests for chunked HTTP traffic were failingAlexander Bluhm
sporadically. If the \r and \n were read in separate chunks, relayd got out of sync with the protocol as they were interpreted as two lines. Use evbuffer_readln() with EVBUFFER_EOL_CRLF instead of evbuffer_readline(). OK benno@
2017-08-28Do not close the relay if data is still in the output buffer.Alexander Bluhm
Otherwise data not written could get lost. Also try to drain the buffers when socket splicing should be enabled. The latter was lost when the expicit bufferevent_enable() was added in relay_write(). bug report, analysis, initial fix, testing Rivo Nurges; OK beck@
2017-08-09Call tls_config_skip_private_key_check() to disable the key checking inClaudio Jeker
the inspect case (same is done in the regular server mode). OK bluhm@ and jsing@
2017-07-30Fix a double free of the TLS config in the error path.Alexander Bluhm
OK claudio@
2017-07-28Always calculate the hash value of the x509 cert in ssl_load_pkey().Alexander Bluhm
Check whether TLS server object is available before using it. With these fixes the ssl inspect regress test just fails and does not crash relayd. OK claudio@
2017-07-04make relayd not crash in relay_udp_server() when using a dns relay.Sebastian Benoit
needs revisiting. From Rivo Nurges, thanks. ok florian@
2017-05-28use __func__ in log messages. fix some whitespace while here.Sebastian Benoit
From Hiltjo Posthuma hiltjo -AT codemadness -DOT- org, thanks! ok florian, claudio
2017-05-27Migrate relayd to use libtls for TLS. Still does the TLS privsep via theClaudio Jeker
engine but at least we can use a sane API for new features. Going in now so it is possible to work with this in tree. General agreement at d2k17.
2017-02-02Disable client-initiated TLS renegotiation by default.Reyk Floeter
It is rarely needed and imposes a light DoS risk. LibreSSL's libssl allows to turn it off with a simple SSL_OP_NO_CLIENT_RENEGOTIATION option instead of the complicated implementation that was used before. It now turns it off completely instead of allowing one initial client-initiated renegotiation. It can still be enabled with "tls client-renegotiation". ok benno@ beck@ jsing@
2017-01-09Stop accessing verbose and debug variables from log.c directly.Reyk Floeter
This replaces log_verbose() and "extern int verbose" with the two functions log_setverbose() and log_getverbose(). Pointed out by benno@ OK krw@ eric@ gilles@ (OK gilles@ for the snmpd bits as well)
2016-11-10Fix tcp ip ttl / minttl on IPv6 sockets.Jeremie Courreges-Anglas
ok florian@
2016-09-29fix DEBUG build after ps->ps_instance changeSebastian Benoit
ok reyk@ bluhm@
2016-09-26spacingReyk Floeter
2016-09-23use sizeof instead of constant 16 in function callsJonathan Gray
suggested by and ok reyk@
2016-09-22Change function arguments from "unsigned char keyname[16]" toJonathan Gray
"unsigned char *keyname" to make it clear that an array size can not be inferred. Suggested by millert@
2016-09-22correct invalid use of sizeofJonathan Gray
ok krw@ millert@ claudio@
2016-09-02Split "struct relayd" into two structs: "struct relayd" and "structReyk Floeter
relayd_config". This way we can send all the relevant global configuration to the children, not just the flags and the opts. With input from and OK claudio@ benno@
2016-09-02proc_id has been replaced by ps->ps_instance.Reyk Floeter
OK claudio@
2016-09-02As done in httpd, remove ps_ninstances and p_instance.Reyk Floeter
OK benno@ rzalamena@
2016-09-02Terminate relayd using the socket status instead of watching SIGCHLDReyk Floeter
or killing child processes. - Based on rzalamena@'s diff for httpd. OK deraadt@ rzalamena@
2016-09-01Switch from the not really working session cache (because of the multiprocessClaudio Jeker
nature of relayd) to tls session tickets to do TLS session resumption. TLS session tickets do not need to store SSL session data in the server but instead send an encrypted ticket to the clients that allows to resume the session. This is mostly stateless (apart from the encryption keys). relayd now ensures that all relay processes use the same key to encrypt the tickets. Keys are rotated every 2h and there is a primary and backup key. The tls session timeout is set to 2h to hint to the clients how long the session tickets is supposed to be alive. Input and OK benno@, reyk@
2015-12-30SSL_CTX_free() and SSL_free() check for null so dont do it in relaydSebastian Benoit
ok jung@ tedu@ deraadt@
2015-12-24completly -> completelymmcc
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-24 03:10:14 +0000