summaryrefslogtreecommitdiff
path: root/usr.sbin
AgeCommit message (Collapse)Author
2019-06-01Make sure that the IMSG_CTL_RESET message is sent immediately.Reyk Floeter
This fixes an issue that might better be solved in imsg itself. The problem is that IMSG_CTL_RESET does not include an fd while the following messages (IMSG_CFG_RELAY and IMSG_CFG_RELAY_FD) do contain fds. If the receiver gets them in one buffer (via recvmsg), the first fd might be wrongly associated to the IMSG_CTL_RESET message. This is theoretically taken care of by the imsg API, so it is either a bug in relayd's API usage or in imsg itself. "sure" claudio@ as a temporary fix.
2019-05-31zap trailing whitespace;Jason McIntyre
2019-05-31Fix previous: create() got inadvertently moved after parse_config(),Ingo Schwarze
which effectively caused the config file to be ignored. So move parse_config() back after create(). OK deraadt@
2019-05-31Add support for SNI with new "tls keypair" option to load additional certs.Reyk Floeter
Tested by many (thanks!) Feedback & OK rob@
2019-05-31Move the relay keys/certs into a separate global list and look them up by id.Reyk Floeter
Moving the certs out of the relay struct will help to add multiple SNI certs. Tested by many users (thanks!) Feedback & OK rob@
2019-05-31similar to note recently added to bgpd.conf(5), mention in docs forStuart Henderson
"bgpctl reload" that ipsec/md5sig and "export none/default-route" only take effect when the session is reset. sounds good to claudio
2019-05-31Exit the attribute loop early if there are no unknown attributes leftClaudio Jeker
and the loop passed all attributes known by bgpd. Saves about 80% of time in up_generate_attr(). OK phessler@
2019-05-31Also check the type of a network statement when looking for duplicates.Claudio Jeker
Fixes adding network 0.0.0.0/0 after network inet static. OK phessler@ benno@
2019-05-30Use proper algorithm for median computation; use fabs() for computingOtto Moerbeek
an absolute value and fix poll loop to first generate messages and then compute poll flags the write cases. This makes the timeout workaround for constraints unneeded. ok reyk@ tb@
2019-05-29Change vmctl(8) syntax: command options before the disk/name/id argument.Reyk Floeter
vmctl had a CLI-style syntax (bgpctl-style) for a short time but I changed it back to a more suitable getopt syntax. I replaced the CLI tokens to getopts flags but didn't consider swapping the order of command options and arguments to be more UNIX-like again ("vmctl create disk.img size 10G" simply became "vmctl create disk.img -s 10G"). This changes "create", "start", and "stop" commands to the commonly expected syntax like "vmctl create -s 10G disk.img". Requested by many OK mlarkin@ kn@ solene@
2019-05-29If a DBS resolve was done with the Checking Disabled flag, re-resolveOtto Moerbeek
with once the clock is synced. ok deraadt@ florian@
2019-05-29Fix the check if a relay has been specified twiceReyk Floeter
Relays cannot have the same name or listen address. If a listen address is specified multiple times, the parser expands the configuration into multiple relays automatically. OK rob@
2019-05-29Move relay_load_*() functions into relayd.cReyk Floeter
Pass the *env as an explicit argument instead of using the global pointer: The relay_load_certfiles() function is called early before the *env is set up. This does not change anything in the current code as *env is not used by anything in the function (not even ssl_load_key() that is taking it as an argument) but it will be needed by upcoming changes for SNI. Ok rob@
2019-05-29Document the few neighbor options that need a reset (bgpctl nei X clear)Claudio Jeker
to be picked up after a reload. With and OK jmc@, sthen@
2019-05-29Rework pfkey handling a bit. The old remove then add way of inserting md5sigClaudio Jeker
hit a race frequently where a session ended up with no key/SPI in the kernel. Since there is no way to do atomic updates of SADB_X_SATYPE_TCPSIGNATURE the code is adding a new one then removing the old one. Also make sure keys are correctly cleared when peers are deconfigured. May not be perfect but a lot better than what was there before. Tested by and OK sthen@
2019-05-28oops, let cdrom normalize if it's there.Marc Espie
Noticed by sthen@
2019-05-28make PERMIT_CDROM info optionalMarc Espie
as discussed with sthen@, code slightly adjusted
2019-05-28Make vmd(8)'s ns8250 emulation more correctMike Larkin
Remove the scratch register (8250s don't have this), and reorganize some constants to be able to more easily support more than one serial port in the future. ok deraadt Diff from Katherine Rohl, thanks!
2019-05-28A step in solving the bootstrap problem in a dnssec environement.Otto Moerbeek
If the time is wrong, we cannot validate dnssec, leading to failed DNS lookups, so we cannot adjust or set the time. Work around this by repeating a failed DNS lookup with a lookup with the DC (check disabled) bit set. ok florian@
2019-05-28vmd: unset CR0_CD and CR0_NW in default flat64 register valuespd
These never got unset on AMD/SVM guests when booted via vmctl start -b causing them to run very slow ok mlarkin@
2019-05-27only reschedule the periodic interrupt after updating register AJasper Lievisse Adriaanse
if something changed in register A. when updating register A we were checking in register B if the PIE bit was set in order to decide if rtc_reschedule_per needed to be called. if that bit was changed then the timer rate would already have been adjusted by rtc_update_regb so the call from rtc_update_rega is not needed. this now matches what qemu and other emulators are doing too. ok mlarkin@
2019-05-27Switch the peer TAILQ to a RB tree indexed by the peer id. This wayClaudio Jeker
getpeerbyid() gets a lot quicker at finding the peer when many peers are configured. In my test case the difference is around 20% runtime. OK denis@
2019-05-26support -T erspan so arbitrary gre protocols can be seen as erspanDavid Gwynne
this lets me configure a custom gre protocol on a dell s4810 or s5048 and see what's inside it when it lands on an openbsd box. ok lteo@
2019-05-26reflect current realityMarc Espie
it's much simpler now that md5 is entirely gone
2019-05-26document somewhat oldish improvementsMarc Espie
2019-05-26adjust comment. ArcCheck hasn't dealt with long names ever sinceMarc Espie
OpenBSD::Ustar gained support for xhdr.
2019-05-26perl makewhatis has been dead a few yearsMarc Espie
2019-05-26Allow specifying area by number as well as id. No changes to outputs.remi
reads OK to kn@ OK denis@
2019-05-24switch from having automatic EVP_CIPHER_CTX variables to allocating themGilles Chehade
with EVP_CIPHER_CTX_new() and releasing them with EVP_CIPHER_CTX_free(). ok sunil@ and millert@
2019-05-24ERR_R_SSL_LIB is defined to ERR_LIB_SSL which works for both LibreSSL andGilles Chehade
OpenSSL, so use that one instead to reduce delta in portable branch
2019-05-24assume X509_STORE_CTX is opaque, don't access ->error but use theGilles Chehade
X509_STORE_CTX_get_error() function instead
2019-05-24mechanical change to dynamically allocate rsae_methodGilles Chehade
2019-05-24fix typo in fatal message to -> tooGilles Chehade
2019-05-24remove useless check, it's never been and will never be hitGilles Chehade
2019-05-24Change timer_nextisdue() and timer_nextduein() to take the current timeClaudio Jeker
as an argument. This way getmonotime() can be called once at the start of looping over all peers instead of twice during the loop. Makes a big difference with many peers. OK florian@ sthen@
2019-05-23look for tag in self first, solves a fringe case whereMarc Espie
we could find the dependency in another version of the the same package first, and error out (see special case found_in_self).
2019-05-23Implement bgpctl show mrt neighbors, a command to print the neighbor tableClaudio Jeker
of MRT TABLE_DUMP_V2 dumps. It only works with TABLE_DUMP_V2 dumps on other table dumps the neighbor of the first entry is printed since those table dumps don't have a neighbor table. OK sthen@ benno@
2019-05-23Add F_CTL_NEIGHBORS a flag only used in bgpctl's mrt parsing code.Claudio Jeker
OK sthen@ benno@
2019-05-23unbound-checkconf pledges "stdio rpath getpw", later narrowing to "stdio rpath".Stuart Henderson
(File access is needed through the course of a run depending on which options are configured - e.g. for DNSSEC root keys, hints and zone files). Based on a diff from, and ok with, mestre@
2019-05-22re-order to reported states based on order of significance:Jasper Lievisse Adriaanse
paused takes priority over running; running takes priority over disabled ok mlarkin@ pd@
2019-05-21Use malloc_ and calloc_conceal() to allocate memory for sensitive,Otto Moerbeek
private key data. We leave the corresponding freezero() calls since the code might be ported to a system not having the conceal functions. This also makes sure the stdio bufer is concealed. And zap a redundant free(buf); ok gilles@
2019-05-20drop fatalx calls when claiming a new vm id; otherwise it's possibleJasper Lievisse Adriaanse
to crash vmd and take all other vms with it. this required a little shuffling to get the error value reported back to the caller to handle the error properly. ok mlarkin@
2019-05-20rev 1.219 of the file was a fix to an LMTP issue that was misunderstood. weGilles Chehade
fixed the root cause in mda_variables.c months ago independantely but we're still carrying this diff which is not only unnecessary now, but is also the cause of a bug with mailer-daemons going through an LMTP mda. issue reported by otto@
2019-05-18Fix LDAP RFC reference in comment. Also noticed by martijn.rob
ok guenther@, claudio@
2019-05-17handle ERSPAN type IDavid Gwynne
type I and II share their GRE protocol, but you tell them apart by checking if a sequence number is used. type I does not use a sequence number and contains a bare ethernet frame. type II contains a sequence number and a shim header that is already handled by the code. tested with a Dell S5048F-ON and an encapsulated remote port mirror setup.
2019-05-16Unbreak vmctl start foo -b /bsd -d disk.img -cLClaudio Jeker
Define a local definition of LOADADDR() instead of pulling in machine/loadfile_machdep.h. vmd -b requires the addresses to be masked and the new bootloader no longer does that. OK pd@ kettenis@
2019-05-16Accept address and number format for "ospfctl show database area XXX".remi
OK denis@ benno@
2019-05-16unveil code was unaware of -f option.Theo de Raadt
From Anton Borowka. ok sthen
2019-05-16treat vms that are disabled in vm.conf the same as any other vm that's stoppedJasper Lievisse Adriaanse
"disabled" in this context might imply it being broken or otherwise unusable prompted by and ok mlarkin@
2019-05-16Do not change router-id on reload if unspecified.denis
OK remi@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-07 04:18:06 +0000