summaryrefslogtreecommitdiff
path: root/usr.sbin/relayd
AgeCommit message (Collapse)Author
2015-01-02PFS stands for Perfect Forward Secrecy.Igor Sobrado
ok reyk@
2015-01-01Merge error page changes from httpd: send Content-Length:, changeReyk Floeter
Date: from asctime to the preferred HTTP/1.1 format, and use the popular "Comic Sans" style (can be changed in the configuration).
2015-01-01Use the recommended HTML5 doctype in error pages.Reyk Floeter
OK validator.w3.org (This document was successfully checked as HTML5!)
2014-12-27zap trailing whitespace;Jason McIntyre
2014-12-26Document forward to in protocols.Sebastian Benoit
2014-12-23pf now supports source-hash and random with tables so we can allow itReyk Floeter
in redirections. Thanks for help and input from jsg and yasuoka who reminded me to dig out and update these old diffs for pf and relayd. ok jsg@
2014-12-21Stop pulling in <arpa/inet.h> or <arpa/nameser.h> when unnecessary.Philip Guenther
*Do* pull it in when in_{port,addr}_h is needed and <netinet/in.h> isn't. ok reyk@
2014-12-18an hex -> a hex;Jason McIntyre
2014-12-18Update relayd to use siphash instead of sys/hash. The source-hash,Reyk Floeter
loadbalance and hash modes use a random key by default that can be forced to be a static key with a new configuration argument. With input from Max Fillinger. ok tedu@
2014-12-17Add missing flag in the description field.Reyk Floeter
2014-12-16Replace setpgrp(0, getpid()) with setpgid(0, 0). OK deraadt@ tedu@Todd C. Miller
2014-12-12Change the keyword "ssl" to "tls" to reflect reality since weReyk Floeter
effectively disabled support for the SSL protocols. SSL remains a common term describing SSL/TLS, there is some controvery about this change, and the name really doesn't matter, but I feel confident about it now. (btw., sthen@ pointed out some historical context: http://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html) OK benno@, with input from tedu@
2014-11-25use correct divisor when converting microseconds to 100ths of a secondBret Lambert
found by yasuoka@
2014-11-24remove a surplus break statementJonathan Gray
2014-11-22use size_t where appropriate. ok deraadt reykTed Unangst
2014-11-20Don't allow embedded nul characters in strings.Jonathan Gray
Fixes a pfctl crash with an anchor name containing an embedded nul found with the afl fuzzer. pfctl parse.y patch from and ok deraadt@
2014-11-19Support exporting relayd statistics via AgentX/snmpdBret Lambert
This should be equivalent to the statistics available via the various relaydctl show commands okay benno@ reyk@
2014-11-14Shorten the AgentX header debug messages (only compiled with -DDEBUG)Reyk Floeter
to a single line and print to stderr instead of stdout. This makes it easier to follow the debug output again. Also, as a rule of thumb, it is OK to exceed 80 chars for these kinds of developer debug messages. OK blambert@
2014-11-07Remove the sslv2 option since LibreSSL has no SSLv2 support (however retainJoel Sing
SSL_OP_NO_SSLv2 in case you happen to be running relayd on another platform with another SSL library). Also fix the SSLv3 handling so that 'no sslv3' actually works as intended. ok reyk@
2014-11-02Convert the logic in yyerror(). Instead of creating a temporaryAlexander Bluhm
format string, create a temporary message. OK deraadt@
2014-10-25Remove unnecessary netinet/in_systm.h include.Lawrence Teo
ok millert@
2014-10-21Remove SSLv2 and SSLv3 references from the example relayd.conf and theLawrence Teo
relevant example snippet in the relayd.conf(5) man page. Change the default SSL protocols in the example file/man page to "no tlsv1.0" (suggested by sthen@), which will enable the TLSv1.1 and TLSv1.2 protocols only. feedback/ok jsing@ reyk@ sthen@
2014-10-20Remove the "interface" option from the "transparent forward" directive.Reyk Floeter
It was mandatory in the grammar but never used in the code. A fully transparent relay can now be specified with the following directive in a relay block: "transparent forward to destination". OK sthen@
2014-10-15Disable SSLv3 by default.Reyk Floeter
OK sthen@ jsing@
2014-10-12Remove possibility of mutiplicative integer overflow by not multiplying.Bret Lambert
Instead of the widespread-but-overflow-prone while (newlen < wanted) { newlen *= 2; } idiom, just realloc() for the space requested by the caller and check for additive overflow. Also change type of 'newlen' variable from int to size_t to avoid overflows there. Pointed out by deraadt@ ok reyk@
2014-10-02no need to set the same field NULL twice ;-)Gilles Chehade
ok reyk@
2014-09-15Make the HTTP version mandatory and abort if it is missing in the request.Reyk Floeter
2014-09-05revert previous; was based on a work-in-progress, as wellBret Lambert
as being an incomplete and therefore incorrect adaptation apologies to anybody who got bitten by this mistake ok reyk@
2014-08-29Implement consistent host hashing for relayd, based onBret Lambert
work done by andre@ Re-add a randomized hash seed (which had apparently gotten inadvertently removed in the past). Allows for multiple relayd instances to be configured to forward traffic to the same host, falling back to the random seed when not explicitly configured to do so. ok reyk@
2014-08-18Sync proc.c with httpd. httpd needs SIGUSR1 but relayd will ignore itReyk Floeter
now instead of terminating the process. ok florian@
2014-08-14Sync with httpd, including the following change from doug@:Reyk Floeter
"Sync with RFC 7230-7235 phrases and IANA registered status codes. ok reyk@"
2014-08-10There was a race in relayd that caused connections to hang. ItAlexander Bluhm
happend with non-persistent PUT connections that had a very short body. If the whole body was read from the client before the connection to the server was set up, the event callback was not called. Do the regular checks after relay_connect() succeeded. OK reyk@
2014-08-08No events were added for DNS UDP so it stopped working after the firstReyk Floeter
request. Additionally, the DNS code tried to use an invalid timeout. Fix from mm@freebsd.org Reported by Johan Schuijt
2014-07-17Move comment about strcasecmp() to a more suitable spot.Stefan Sperling
ok reyk benno
2014-07-14When a connection was spliced in one direction and in copy mode inAlexander Bluhm
the other direction, the timeouts did not work. They were longer than specified. Link the splicing and non-splicing timeouts. Found by make run-regress-args-timeout-http.pl OK reyk@
2014-07-13Remove a debug messageReyk Floeter
2014-07-13Sync file to be identical in relayd(8) and httpd(8).Reyk Floeter
2014-07-13improve log output for relays. adjust regress testsSebastian Benoit
ok reyk
2014-07-13repair matching of headers, add regress test for this errorSebastian Benoit
ok reyk
2014-07-12fix relay "append header" action, add regression test for appendSebastian Benoit
ok reyk
2014-07-12Move HTTP error codes into http.h.Reyk Floeter
ok benno@
2014-07-11optimize a FALLTHROUGHSebastian Benoit
implicit ok reyk
2014-07-11Limit HTTP header length to about 8K (based on the default of 4-8K inReyk Floeter
common web servers). Add a related regress test. OK benno@
2014-07-118 bits is enough for sslflagsReyk Floeter
2014-07-11Sometimes I just sort the tokens in parse.yReyk Floeter
2014-07-11Add support for EDH to provide perfect forward secrecy for older SSLReyk Floeter
clients. Additionally, add options for disallowing client-initiated renegotiations and to prefer the server's cipher list over the client's preferences. This work is based on a diff by Markus Gebert at hostpoint.ch, and was discussed with jsing@ resulting in a few different defaults. ok benno@
2014-07-11Tweak error checking for msgbuf_write() as recommended by the imsgKenneth R Westerback
gurus. ok reyk@ benno@
2014-07-11Simplify the code that handles the HTTP headers by using an RB treeReyk Floeter
with associated lists instead of the complicated lookup table and "others" list. This might add a little malloc overhead for common headers but also fixes some issues like the handling of repeated headers - for example, handling of multiple "Set-Cookie" headers. ok bluhm@ (regress part) ok benno@
2014-07-10Print "%s (removed)" into relayd log and test for that string.Alexander Bluhm
suggested by reyk@
2014-07-10add additional includes required to build with -DOPENSSL_NO_DEPRECATEDJonathan Gray
ok reyk@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-18 04:14:53 +0000