summaryrefslogtreecommitdiff
path: root/usr.sbin/relayd
AgeCommit message (Collapse)Author
2018-04-26Plug leak in error case of the common 'varset' implementations.Kenneth R Westerback
ok benno@
2018-04-20adjust the example to make it work;Jason McIntyre
from matt schwartz ok claudio
2018-04-18Remove RELAY_MAX_SESSIONS from relayd, there is no reason to limit relaysClaudio Jeker
to 1024 session per process (esp. with keep-alive). Now the fd limit is the new maximum and relayd will make sure to not accept too many sessions. The tcp backlog config maximum is now 512, adjust manpage accordingly. OK benno@ deraadt@
2018-04-14In case of a tcp read timeout, the destination host state needs to beSebastian Benoit
set to HOST_DOWN. Noticed and fixed by Rivo Nurges <Rivo DOT Nurges AT smit DOT ee> ok and reminder florian@
2018-01-24Log some more errors in the ca code, since there seems to be still a bugClaudio Jeker
hidden somewhere. Also return after a poll timeout, there is no reason to wait longer than a second for the answer of the ca process. OK jsing@
2018-01-01RSA_private_{en,de}crypt() can fail and will return -1 in that case.Claudio Jeker
Check for this in the ca process and return a valid answer to the relay process. This fixes rsae_send_imsg poll timeouts blocking relay processes as seen by Mischa Peters and myself. OK benno@
2017-12-27log specific error when connect() fails.Sebastian Benoit
ok claudio@, feedback bluhm@
2017-12-18always initialize the hce_launch_checks event timer.Sebastian Benoit
Fixes a crash when poll is run without any checks. Found and fixed by Hiltjo Posthuma (hiltjo -AT- codemadness -DOT- org). ok claudio@
2017-11-29fix double dot;Jason McIntyre
2017-11-29add options to specify the control socket in relayd and relayctl.Sebastian Benoit
From Kapetanakis Giannis, thanks. ok claudio@
2017-11-28One less lie in commentsClaudio Jeker
2017-11-28Introduce relay_reset_event() which closes and resets a relay connection.Claudio Jeker
Currently this is only used by relay_close() but will be needed in near future. OK benno@
2017-11-28In TLS inspection mode we also need to keep the server tls object around.Claudio Jeker
For this we need to add an additional pointer to the ctl_relay_event. Diff from Petri Mikkila (pmikkila at gmail) OK benno@
2017-11-28relay_load_fd() is no longer clobering errno in the error case so useClaudio Jeker
fatal() instead of fatalx()
2017-11-28Add space between to and read like in other DPRINTFs.Claudio Jeker
2017-11-27Change the ecdhe curve configuration to the same way httpd is doing it.Claudio Jeker
This removes 'no ecdh' and renames 'ecdh curve auto' to ecdhe default. The code uses now tls_config_set_ecdhecurves(3) so it is possible to specify multiple curves now. If people specified curves in their config they need to adjust their config now. OK beck@
2017-11-27Make ca_launch error messages unique.Alexander Bluhm
OK claudio@
2017-11-27lseek/read is racy when there is multiple consumers. Use pread instead.Claudio Jeker
Solves the startup issues seen by bluhm@. pread idea from guenther@. While there save the errno in the error case. OK bluhm@
2017-11-27Add a DPRINTF() in relay_error() that helped me out way too many times.Claudio Jeker
2017-11-27Use file descriptor passing to load certificates into the relays. EspeciallyClaudio Jeker
the ca file (having all the trusted certs in them) can be so big that loading via imsg fails. OK beck@
2017-11-27Do not rip out the output buffer of the bufferevent. Instead just use anClaudio Jeker
initial bufferevent_write_buffer() to write out the queued up HTTP request. OK benno@
2017-11-27rfc 7230 mandates that a "204 No Content" http status must not come with aSebastian Benoit
Content-Lenght Header. Of course some servers still so it and send Content-Lenght: 0. Adjust accordingly. ok claudio@
2017-11-27relay_tls_connected() is playing with the inner bowels of bufferevents.Claudio Jeker
Be more careful and remove the events before resetting them to the new backends. This is also what some of the bufferevent functions are doing. OK benno@
2017-11-27Simplify relay_close_http(), make relay_httpdesc_free() accept and ignoreClaudio Jeker
a NULL pointer argument (like free()). Also switch a !size to size == 0. OK benno@
2017-11-16Check that http options are only configured in http protocols.Alexander Bluhm
OK benno@
2017-11-15make the maximum size of http headers configurable in the protocol.Sebastian Benoit
ok bluhm@, >8k makes sense claudio@
2017-09-23The relayd regression tests for chunked HTTP traffic were failingAlexander Bluhm
sporadically. If the \r and \n were read in separate chunks, relayd got out of sync with the protocol as they were interpreted as two lines. Use evbuffer_readln() with EVBUFFER_EOL_CRLF instead of evbuffer_readline(). OK benno@
2017-09-14Differentiate between a style string not being specified and an emptyJonathan Gray
style string by including NUL in imsg and set the pointer in the struct passed over imsg to NULL in the receiving process to be sure nothing tries to use it. Avoids a crash when specifying an empty style string reported by Karl-Andre' Skevik. ok bluhm@
2017-08-28Do not close the relay if data is still in the output buffer.Alexander Bluhm
Otherwise data not written could get lost. Also try to drain the buffers when socket splicing should be enabled. The latter was lost when the expicit bufferevent_enable() was added in relay_write(). bug report, analysis, initial fix, testing Rivo Nurges; OK beck@
2017-08-2865535 is a valid port to listen on.Florian Obser
Off-by-one pointed out by and diff from Kris Katterjohn katterjohn AT gmail, thanks! chris@ pointed out that more than httpd(8) is effected. OK gilles@
2017-08-09Use X509_pubkey_digest() like libtls to hash the keys for the TLS privsepClaudio Jeker
code. This fixes interception mode (since there we rewrite the CERT which would alter the hash of the cert but the keys still remain the same). OK bluhm@ and jsing@
2017-08-09Call tls_config_skip_private_key_check() to disable the key checking inClaudio Jeker
the inspect case (same is done in the regular server mode). OK bluhm@ and jsing@
2017-07-30Fix a double free of the TLS config in the error path.Alexander Bluhm
OK claudio@
2017-07-28Always calculate the hash value of the x509 cert in ssl_load_pkey().Alexander Bluhm
Check whether TLS server object is available before using it. With these fixes the ssl inspect regress test just fails and does not crash relayd. OK claudio@
2017-07-12Consistently use the variable "ttl" for get/setsockoptJeremie Courreges-Anglas
ok benno@ on an earlier version, input from Kapetanakis Giannis
2017-07-11Correctly set ttl for IPv4 and IPv6.Florian Obser
Problem noted and fix from Kapetanakis Giannis, thanks! Input & OK jca.
2017-07-11The config option is called "no splice", the parser rejects "nosplice".Alexander Bluhm
2017-07-04if configured, set the ttl (IPV6_UNICAST_HOPS) for ipv6 tcp checks.Sebastian Benoit
From Kapetanakis Giannis, thanks. ok florian@
2017-07-04make relayd not crash in relay_udp_server() when using a dns relay.Sebastian Benoit
needs revisiting. From Rivo Nurges, thanks. ok florian@
2017-07-03no need to generate y.tab.h if nothing uses it, set YFLAGS to nothingMarc Espie
instead of CLEANFILES += y.tab.h okay millert@
2017-05-31Fix a memory leak in pkey_add() error path. All current callers fatalJonathan Gray
if pkey_add() fails.
2017-05-28use __func__ in log messages. fix some whitespace while here.Sebastian Benoit
From Hiltjo Posthuma hiltjo -AT codemadness -DOT- org, thanks! ok florian, claudio
2017-05-27Migrate relayd to use libtls for TLS. Still does the TLS privsep via theClaudio Jeker
engine but at least we can use a sane API for new features. Going in now so it is possible to work with this in tree. General agreement at d2k17.
2017-05-06Convert explicit_bzero() + free() to freezero().Frederic Cambus
OK reyk@, deraadt@ (previous version)
2017-04-19better example; from hiltjo posthumaJason McIntyre
ok sthen
2017-04-06fix format string found by clang -Wformat-securityGleydson Soares
OK deraadt millert
2017-03-25X-Forwarded-By should be the server $SERVER_ADDR instead of the clientClaudio Jeker
$REMOTE_ADDR. Noticed and diff provided by Hiltjo Posthuma (hiltjo at codemadness dot org)
2017-03-21From a syslog perspective it does not make sense to log fatal andAlexander Bluhm
warn with the same severity. Switch log_warn() to LOG_ERR and keep fatal() at LOG_CRIT. OK reyk@ florian@
2017-03-10DELETE can have a body.Reyk Floeter
Fix by Rivo Nurges, fixes a problem with Atlassian JIRA OK benno@
2017-02-27update an example in the relayd.conf manpage, that was not convertedSebastian Benoit
to the new syntax 2 years ago. Found by Michael W. Lucas, thanks! ok tb@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-24 10:07:04 +0000