summaryrefslogtreecommitdiff
path: root/usr.sbin
AgeCommit message (Collapse)Author
2019-08-16Send snmpctl(8) to the great bitbucket in the sky. You've served us well.Martijn van Duren
People are now expected to use snmp(1) for all their snmp client needs. "Go ahead" deraadt@
2019-08-14revert the inet6 format diff, regression observed by florian@Gilles Chehade
2019-08-14Rework the way ribs are stored in the RDE. Instead of a flat array thatClaudio Jeker
gets enlarged use an array of pointers, so pointers to struct rib entries remain valid after adding new RIBs. Also remove the global ribs pointer and rib_valid() since they are no longer used since all the code uses now rib_byid() instead. OK benno@
2019-08-14There is no longer a reason to use two structs for RIBs where one is partClaudio Jeker
of the other. Just merge struct rib_desc into struct rib. Makes code simpler. OK benno@
2019-08-14Improve the error message when supplying an invalid template to vmctlanton
start. Favoring 'invalid template' over 'permission denied' should give the user a better hint on what went wrong. ok kn@ mlarkin@
2019-08-14Fix ber_scanf_elements for traphandler:Martijn van Duren
- pdu header has 3 elements, not 4 - additional varbinds are optional. This is needed to make ber_scanf_elements stricter. Note that people using "trap handle" in their snmpd.conf and expect a trap without additional varbinds to show the trapoid to appear twice will have to adjust their "command". OK rob@
2019-08-13config -eu uses a second copy of the nlist array[], which should neverTheo de Raadt
become different or the #define's for the slots could diverge. To avoid this, make one a copy of the other at runtime.
2019-08-13use proper format to display inet6 addresses in logs as well as to store inGilles Chehade
disk envelopes. smtpd used the Received and helo response format that isn't valid in a relay url and looks wrong in logs. spotted and tested ok@ by semarie
2019-08-13Do not abuse a for-loop to do an addition.Claudio Jeker
2019-08-13Silence warnings about short reads. They happen, we deal with it, it'sFlorian Obser
just noise. OK claudio
2019-08-13Show the most common warnings only if verbose is set. Most of these warningsClaudio Jeker
were shown because of an inconsistent rpki database and is no real problem. OK florian@
2019-08-13snmpd was using ifq_len for ifOutQLen, apart from being the wrong variableStuart Henderson
for this MIB in the first place, this has now been removed in ifq changes. Since the MIB is marked as deprecated anyway, simply return 0. ok claudio@
2019-08-13Report if_iqdrops (input queue drops) as ifInDiscards. This is prettyClaudio Jeker
much what this counter is for. For sure better than net.inet.ip.ifq.drops which no longer exists. Found by and OK martijn@ and OK sthen@
2019-08-13Instead of passing a struct prefix pointer to rde_filter() pass the 4 valuesClaudio Jeker
prefix_peer, prefix_vstate and prefix/prefixlen to the function. This removes some ugly hacks in cases where the prefix was not available. Also adjust the order of arguments of rde_attr_set() to match rde_filter(). OK benno@
2019-08-13Do not use the SE global conf struct for the bgpd_config but actuallyClaudio Jeker
the bgpd_config pointer passed to these functions. Luckily the affected functions were not used outside of the SE. While there also use getpeerbyid() to check if an peer id is in use instead of the rather dumb linear loop. OK benno@
2019-08-13When allocating a new peer set the reconf_action to RECONF_REINIT.Claudio Jeker
Also in merge_config() it is no longer needed to reset the reconf_action of the new peers to RECONF_REINIT. merge_config() is not called on startup and so some of the initialisation of new peers did not happen correctly. This fixes the md5 integration test since the md5 initialisation did not happen early enough.
2019-08-12Mark up no-verify with Cm; OK jmc@ gilles@Tim van der Molen
2019-08-12Prepend a dot to every line that starts with a dot -- not merely theTim van der Molen
ones that consist of a single dot. OK gilles@
2019-08-12On broadcast and point-to-point interfaces only accept hello packets whenremi
the destination is 224.0.0.5 (AllSPFRouters). RFC 2328 sys in "9.5. Sending Hello packets" that hello packets are sent to the multicast address AllSPFRouters on broadcast and physical point-to-point networks. With this new check the test for AllDRouters is not needed anymore. ok benno@
2019-08-12Warn when a neighbor changes its source IP address. Either it is becauseremi
of a planned change or something bad is happening in the network. ok benno@
2019-08-12Stop pulling libssl into rpki-client.Joel Sing
None of this code actually does TLS, hence libssl is not needed. Instead, pull in the correct headers and call the appropriate libcrypto initialisation functions (even this is only necessary to support OpenSSL prior to 1.1). While here also remove libssl/libcrypto initialisation/uninitialisation from main() - it should only be necessary in proc_parser(). ok deraadt@ job@
2019-08-12Do not exit with error if the challenge file already exists, instead ↵Sebastian Benoit
truncate it and write the challenge again. We can get asked to supply the same challenge multiple times. bug found and patch tested by jmc@ patch discussed with, mangled and okayed by florian@
2019-08-12Reset the IdleHoldTime and the session error count when doing a adminClaudio Jeker
command that clears or starts a neighbor. This way an admin reset does what people expect since it makes the session behave like a brand new one. OK job@ deraadt@ sthen@
2019-08-12Change the way IdleHoldTime is reset once the session is up and stable.Claudio Jeker
The implemented reverse exponential backoff results in very long times until a session gets back to the initial hold values. Instead just wait for the timer to fire once and reset the settings then. In most cases the timer is double the IdleHold time (because of the way the backoff is implemented) which is enough to ensure that fast flapping sessions are punished. OK benno@
2019-08-11Change all error exits to EX_TEMPFAIL so that mail rejected by the LMTPTim van der Molen
server stays queued instead of being bounced. Also improve getline(3) error handling and remove unreachable code. OK sunil@ a while ago, "please get it in" gilles@
2019-08-11In let's encrypt v1 we had to track a challenge for every domain inFlorian Obser
the certificate we were requesting. This is no longer true in v2 and we have to free the amount of challenges the server told us to fullfill. OK benno
2019-08-11the filtering protocol in OpenBSD 6.6 will be version 0, it has worked fineGilles Chehade
for about a year now but until we have had a release with filters and until we bring back the feedback from that release into the protocol, we will not be version 1 of the protocol.
2019-08-11add 'from rdns' to ruleset match criterias making it possible to matchGilles Chehade
envelopes created by sessions that had or did not have an rDNS: match from rdns [...] action "local" match !from rdns [...] reject
2019-08-11delete the bufcachepercent command (since this can be done at runtime),Theo de Raadt
and leftovers from past commands shmseg/shmmaxpg/nmbclusters ok kettenis
2019-08-11teach builtin filter rdns how to match a session that has or lacks rdnsGilles Chehade
2019-08-11fix rewrite action on filtering of MAIL FROM phaseGilles Chehade
basically the transaction must be created in the proceed function for the mail from phase, not in the checking function, otherwise the second pass in the check function will fail due to the tx already existing. reported by Niklas Hallqvist <niklas@appli.se>
2019-08-11document proc and proc-based filtersGilles Chehade
2019-08-11document filter chains, which is essentially a way to declare a set ofGilles Chehade
related filters to be applied one after another
2019-08-11start documenting the builtin filtersGilles Chehade
2019-08-11no longer document that username may be omitted if equal to label, this isGilles Chehade
not true anymore.
2019-08-11rework grammar for builtin filters so i can start documenting itGilles Chehade
2019-08-11the mta "certificate check" log line was not in the same format as otherGilles Chehade
log lines, fix
2019-08-11properly implement the "from socket" match criteria, so it is now possibleGilles Chehade
to specifically match a connection that happened through the local enqueuer
2019-08-10improve level of details when logging mda errors that happen while we're inGilles Chehade
the creation of the mda process. in some situations, we can provide details far more precise than just the strerror()
2019-08-10start documenting filters for next releaseGilles Chehade
2019-08-10document proxy-v2 option to listenerGilles Chehade
2019-08-10this introduces experimental proxy v2 support which is fairly isolated to aGilles Chehade
single proxy.c file, importing it to work in tree initial work from Antoine Kaufmann <toni@famkaufmann.info>
2019-08-10enforce domain length check in valid_domainpart(), checking it in caller isGilles Chehade
not the proper place, also since helo uses valid_domainpart(), such a check would have indirectly prevented last weeks errata.
2019-08-10let smtpd tell filters about configuration keys before they register hooks.Gilles Chehade
the set of configuration keys is not yet finalized but the mechanism is all we need for now to be able to release 6.6 with a stable api. discussed with eric months ago
2019-08-10bump versionGilles Chehade
2019-08-10documentation was missing 'smtp limit' bits, document them.Gilles Chehade
spotted by "mabi"
2019-08-10valid_domainpart() uses res_hnok() internally which considers the hostnamesGilles Chehade
ending with a dot to be valid. add a check to make sure that if domain part ends with a dot, it is rejected as it should. issue reported by Hans Freitag <hans.freitag@conesphere.com>
2019-08-10Like we did on other daemons that cannot be pledged due to forbidden ioctls theRicardo Mestre
main process can be unveiled to restrict filesystem access. In this case we can restrict it to only read, although it must be the entire / since the daemon is able to include config files from anywhere. Additionally the ldpe process currently has cpath promise to unlink the socket, nevertheless the socket is actually unlinked from the main proc so this permission can be removed. As we discussed before, leaving the socket behind doesn't do any harm that's why I didn't unveil it in the main proc. OK deraadt@
2019-08-09Move prefix_update to the right spot and also move some prototypes down.Claudio Jeker
2019-08-09Rename some of the prefix functions to make it clearer. Also renameClaudio Jeker
path_update to prefix_update since this is now more working on a prefix. OK clang
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-22 22:05:06 +0000