summaryrefslogtreecommitdiff
path: root/usr.sbin/relayd
AgeCommit message (Collapse)Author
2014-12-16Replace setpgrp(0, getpid()) with setpgid(0, 0). OK deraadt@ tedu@Todd C. Miller
2014-12-12Change the keyword "ssl" to "tls" to reflect reality since weReyk Floeter
effectively disabled support for the SSL protocols. SSL remains a common term describing SSL/TLS, there is some controvery about this change, and the name really doesn't matter, but I feel confident about it now. (btw., sthen@ pointed out some historical context: http://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html) OK benno@, with input from tedu@
2014-11-25use correct divisor when converting microseconds to 100ths of a secondBret Lambert
found by yasuoka@
2014-11-24remove a surplus break statementJonathan Gray
2014-11-22use size_t where appropriate. ok deraadt reykTed Unangst
2014-11-20Don't allow embedded nul characters in strings.Jonathan Gray
Fixes a pfctl crash with an anchor name containing an embedded nul found with the afl fuzzer. pfctl parse.y patch from and ok deraadt@
2014-11-19Support exporting relayd statistics via AgentX/snmpdBret Lambert
This should be equivalent to the statistics available via the various relaydctl show commands okay benno@ reyk@
2014-11-14Shorten the AgentX header debug messages (only compiled with -DDEBUG)Reyk Floeter
to a single line and print to stderr instead of stdout. This makes it easier to follow the debug output again. Also, as a rule of thumb, it is OK to exceed 80 chars for these kinds of developer debug messages. OK blambert@
2014-11-07Remove the sslv2 option since LibreSSL has no SSLv2 support (however retainJoel Sing
SSL_OP_NO_SSLv2 in case you happen to be running relayd on another platform with another SSL library). Also fix the SSLv3 handling so that 'no sslv3' actually works as intended. ok reyk@
2014-11-02Convert the logic in yyerror(). Instead of creating a temporaryAlexander Bluhm
format string, create a temporary message. OK deraadt@
2014-10-25Remove unnecessary netinet/in_systm.h include.Lawrence Teo
ok millert@
2014-10-21Remove SSLv2 and SSLv3 references from the example relayd.conf and theLawrence Teo
relevant example snippet in the relayd.conf(5) man page. Change the default SSL protocols in the example file/man page to "no tlsv1.0" (suggested by sthen@), which will enable the TLSv1.1 and TLSv1.2 protocols only. feedback/ok jsing@ reyk@ sthen@
2014-10-20Remove the "interface" option from the "transparent forward" directive.Reyk Floeter
It was mandatory in the grammar but never used in the code. A fully transparent relay can now be specified with the following directive in a relay block: "transparent forward to destination". OK sthen@
2014-10-15Disable SSLv3 by default.Reyk Floeter
OK sthen@ jsing@
2014-10-12Remove possibility of mutiplicative integer overflow by not multiplying.Bret Lambert
Instead of the widespread-but-overflow-prone while (newlen < wanted) { newlen *= 2; } idiom, just realloc() for the space requested by the caller and check for additive overflow. Also change type of 'newlen' variable from int to size_t to avoid overflows there. Pointed out by deraadt@ ok reyk@
2014-10-02no need to set the same field NULL twice ;-)Gilles Chehade
ok reyk@
2014-09-15Make the HTTP version mandatory and abort if it is missing in the request.Reyk Floeter
2014-09-05revert previous; was based on a work-in-progress, as wellBret Lambert
as being an incomplete and therefore incorrect adaptation apologies to anybody who got bitten by this mistake ok reyk@
2014-08-29Implement consistent host hashing for relayd, based onBret Lambert
work done by andre@ Re-add a randomized hash seed (which had apparently gotten inadvertently removed in the past). Allows for multiple relayd instances to be configured to forward traffic to the same host, falling back to the random seed when not explicitly configured to do so. ok reyk@
2014-08-18Sync proc.c with httpd. httpd needs SIGUSR1 but relayd will ignore itReyk Floeter
now instead of terminating the process. ok florian@
2014-08-14Sync with httpd, including the following change from doug@:Reyk Floeter
"Sync with RFC 7230-7235 phrases and IANA registered status codes. ok reyk@"
2014-08-10There was a race in relayd that caused connections to hang. ItAlexander Bluhm
happend with non-persistent PUT connections that had a very short body. If the whole body was read from the client before the connection to the server was set up, the event callback was not called. Do the regular checks after relay_connect() succeeded. OK reyk@
2014-08-08No events were added for DNS UDP so it stopped working after the firstReyk Floeter
request. Additionally, the DNS code tried to use an invalid timeout. Fix from mm@freebsd.org Reported by Johan Schuijt
2014-07-17Move comment about strcasecmp() to a more suitable spot.Stefan Sperling
ok reyk benno
2014-07-14When a connection was spliced in one direction and in copy mode inAlexander Bluhm
the other direction, the timeouts did not work. They were longer than specified. Link the splicing and non-splicing timeouts. Found by make run-regress-args-timeout-http.pl OK reyk@
2014-07-13Remove a debug messageReyk Floeter
2014-07-13Sync file to be identical in relayd(8) and httpd(8).Reyk Floeter
2014-07-13improve log output for relays. adjust regress testsSebastian Benoit
ok reyk
2014-07-13repair matching of headers, add regress test for this errorSebastian Benoit
ok reyk
2014-07-12fix relay "append header" action, add regression test for appendSebastian Benoit
ok reyk
2014-07-12Move HTTP error codes into http.h.Reyk Floeter
ok benno@
2014-07-11optimize a FALLTHROUGHSebastian Benoit
implicit ok reyk
2014-07-11Limit HTTP header length to about 8K (based on the default of 4-8K inReyk Floeter
common web servers). Add a related regress test. OK benno@
2014-07-118 bits is enough for sslflagsReyk Floeter
2014-07-11Sometimes I just sort the tokens in parse.yReyk Floeter
2014-07-11Add support for EDH to provide perfect forward secrecy for older SSLReyk Floeter
clients. Additionally, add options for disallowing client-initiated renegotiations and to prefer the server's cipher list over the client's preferences. This work is based on a diff by Markus Gebert at hostpoint.ch, and was discussed with jsing@ resulting in a few different defaults. ok benno@
2014-07-11Tweak error checking for msgbuf_write() as recommended by the imsgKenneth R Westerback
gurus. ok reyk@ benno@
2014-07-11Simplify the code that handles the HTTP headers by using an RB treeReyk Floeter
with associated lists instead of the complicated lookup table and "others" list. This might add a little malloc overhead for common headers but also fixes some issues like the handling of repeated headers - for example, handling of multiple "Set-Cookie" headers. ok bluhm@ (regress part) ok benno@
2014-07-10Print "%s (removed)" into relayd log and test for that string.Alexander Bluhm
suggested by reyk@
2014-07-10add additional includes required to build with -DOPENSSL_NO_DEPRECATEDJonathan Gray
ok reyk@
2014-07-10Fix another free error.Reyk Floeter
ok benno@
2014-07-09When copying structures via imsg, the contents should not containReyk Floeter
bogus pointer values - make sure to zero the first rule_kv element. awesome benno@
2014-07-09Don't assign garbage in kv_extend().Reyk Floeter
Found by clang.
2014-07-09tweak previous;Jason McIntyre
2014-07-09The "tag" keyword in redirections has been renamed to "pftag".Reyk Floeter
2014-07-09Replace the protocol directives for HTTP with a new generic filteringReyk Floeter
language. The grammar is inspired by pf and allows to write versatile last-matching filter rules in protocol sections starting with the "pass", "block" or "match" keywords. This work was started almost two years ago and replaces large parts of relayd(8)'s HTTP and filtering code. The initial version reimplements and extends HTTP filtering, but will be improved to support generic TCP and other protocols later. With some testing, feedback, and help from benno@ and andre@. OK benno@
2014-06-27knf, no functional change.Andre de Oliveira
ok reyk
2014-06-25sync copyright to reality according to my last changesReyk Floeter
2014-05-20Unify the SSL privsep key loading functions.Reyk Floeter
ok eric@
2014-05-15Use log_warn() to include errno if write() fails.Reyk Floeter
From thib
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-18 07:05:33 +0000