summaryrefslogtreecommitdiff
path: root/usr.sbin
AgeCommit message (Collapse)Author
2020-10-16Refactor a bunch of oscpcheck for single return to clean it up,Bob Beck
and add the ability to parse a port in the specified ocsp url. Since this will now pass them, enable regress tests previously committed for ocspcheck. mostly by me with some cleanup by tb after an obvious yak was found to shave in the OCSP routines in libcrypto ok tb@
2020-10-15Accommodate POSIX basename(3) that takes a non-const parameter andChristian Weisgerber
may modify the string buffer. ok florian@
2020-10-13More useless stuff snuck in.Florian Obser
OK sthen
2020-10-13remove dir useless for cvsStuart Henderson
2020-10-13merge NSD 4.3.3Stuart Henderson
2020-10-13import NSD 4.3.3, ok florian@Stuart Henderson
2020-10-13annoying whitespace gliches spotted during re-readTheo de Raadt
2020-10-11Implement more of RFC 8630 and support more than one URI in the TAL file.Claudio Jeker
The URI are sorted which results in preferrence of https URI. To make rpki-client's handling easier enforce that all URI use the same filename. OK benno@
2020-10-11Introduce repo_filename() a function that converts a URI into the localClaudio Jeker
path to that resource. This will be needed for future RRDP support. Additionally support more then one TAL URI and select the rsync URI in that list. Finally queue_add_from_cert() got modified to include both the rsync URI and the RRDP notify URI (which is still unused). OK benno@
2020-10-11Handle absence of TLS certs while parsing the configTheo Buehler
There is a soft fail mechanism to handle missing certs for seamless interaction with acme-client. Move this to the config parser. This is simpler than server.c r1.117 and avoids a crash due to listening on port 443 without having set up the TLS context first. More precisely, the crash happens if a server with missing certificate is visited via https in a configuration where there is a second server with valid certificate and key. From Joshua Sing (joshua at hypera dot dev) ok benno
2020-10-08Fail on invalid installurlkn
Validate the URL's protocol identifier to avoid passing bogus arguments to ftp(1) which otherwise might drop into the "ftp> " prompt instead of causing sysupgrade(8) to exit non-zero. Code taken from syspatch(8) as advised by ajacoutot. Feedback jca Feedback OK naddy
2020-10-08Print usage to stderr, print error messages in errx(3) fashionkn
While here, rename sg_err()/ug_err() to just err() and sync code between syspatch(8) and sysupgrade(8). Feedback OK naddy
2020-10-08Remove -y from usage too; noticed by jmc@Todd C. Miller
2020-10-07Remove support for zic's long-obsolete '-y YEARISTYPE' option.Todd C. Miller
2020-10-05Remove redundant code and lets code looks similarjan
to the ospf6d counterpart. OK remi@
2020-10-04Fix indentdenis
2020-10-03The new intra area db entry has to be saved into the tree beforejan
orig_intra_area_prefix_lsas() is called. If not, the ospf6d will not announce the new intra area db for a newly learned link from another ospf router of the broadcast domain. OK denis@
2020-10-01In OpenSSL 1.1.x EVP_ENCODE_CTX is an opaque struct and has to beClaudio Jeker
allocated with EVP_ENCODE_CTX_new(). Do this once on the first call and keep the context around for all subsequent calls. OK tb@ and benno@
2020-10-01Rewrite the signal handler to just toggle a flag and then exit asapClaudio Jeker
in the main loop. This removes a few portability issues. OK benno@
2020-10-01Make the repotab (rt) a global instead of passing the value around asClaudio Jeker
an argument. Will help with further changes. OK benno@
2020-10-01Use correct way to report error when strtonum fails.Claudio Jeker
Use errx(), remove the extra \n and use the correct argument (-s not -t).
2020-09-30Sync with libagentxMartijn van Duren
2020-09-30Instead of using the kind of hidden b64_pton() from libc resolv.h switchClaudio Jeker
to the -lcrypto base64 decoder using EVP_Decode* this is more portable. With and OK tb@, OK benno@ (on a less polished version)
2020-09-29Sync with libagentxMartijn van Duren
2020-09-28Set hw.perfpolicy to "manual" and hw.setperf to max when handling -HJeremie Courreges-Anglas
This is better than using hw.perfpolicy="high" for a number of reasons: - matches the manpage - apm(8) reporting becomes accurate - more symmetry with -L ("low") - lets the user tweak hw.setperf with sysctl(8) later ok tedu@
2020-09-28Fix segfault in pstat -vTheo Buehler
Broken in r1.122 when the vnode list at the mount point was converted to a TAILQ to make softdeps happy. There was a for loop that looked a lot like a LIST_FOREACH that was converted to a TAILQ_FOREACH. Unfortunately, the loop is a bit more intricate. Revert to the original loop logic, but now with TAILQ. "looks correct" millert, "looks good" deraadt
2020-09-24Always ask the kernel about current hw.perfpolicyJeremie Courreges-Anglas
apmd(8) doesn't need to maintain state about the current hw.perfpolicy. Dropping this weak caching fixes several issues: - setting hw.perfpolicy can fail, don't report a bogus hw.perfpolicy if that happens (reported by Miod) - don't assume that hw.perfpolicy is set to "manual" at apmd(8) startup - don't assume that hw.perfpolicy can't change behind apmd(8)'s back "Seems fine" tedu@
2020-09-23Revert agentx support for now, we're too close to release.Martijn van Duren
requested by deraadt@
2020-09-23Revert agentx support for now, we're too close to release.Martijn van Duren
requested by deraadt@
2020-09-23Add support for agentx to smtpd.Martijn van Duren
This is based around NETWORK-SERVICES-MIB from RFC2788 and MTA-MIB from RFC2789, but does not export the full spec. Hopefully this will expand in the future. People who want to use this against net-snmp (currently the only option known to me at the time of writing) may want to add -I -mta_sendmail to the flags, so net-snmp doesn't throw garbage into the mib-2.28 subtree.
2020-09-23Add support for agentx to vmd.Martijn van Duren
This is based around VM-MIB from RFC7666,but does not export the full spec. People more knowledgeable of vmd are encouraged to expand on this.
2020-09-23Zap code remnants of the "cool running mode" (removed in 2014)Jeremie Courreges-Anglas
Nowadays "auto" mode is used instead. ok deraadt@
2020-09-22Allow handling long lines in an aliases table.Martijn van Duren
Pointed out by AIsha Tammy (openbsd <dot> bugs <at> aisha <dot> cc) Original diff by Edgar Pettijohn (edgar <at> pettijohn-web <dot> com) OK tb@
2020-09-21Fix memory leak in "iov".tobhe
ok jca@
2020-09-19Add a bsd.schema including a shadowPassword and an sshPublicKeyTheo Buehler
attribute that can be used to extend existing LDAP users with the additional bsdAccount objectclass. The former is useful for ypldap+ldapd setups without login_ldap and the latter makes it easier to use sshd's AuthorizedKeysCommand. Originally from reyk, revived by Aisha Tammy, with input from many, especially Robert Klein.
2020-09-18fix typo in comment and trailing whitespaceJasper Lievisse Adriaanse
2020-09-18various fixes; ok mpiJason McIntyre
2020-09-17document min/max/sum functionJasper Lievisse Adriaanse
ok mpi@
2020-09-16Stop removing the control socket on exit and tighten the unveil evenremi
further. This is in line with what other networking daemons do. ok mestre@
2020-09-16Add the admd keyword. This can be used by filters interested in theMartijn van Duren
Authentication-Results header. OK giovanni@
2020-09-16close all fds > STDERR_FILENO before executing the pipe program.Martijn van Duren
OK bluhm@
2020-09-15Align man page with realityjob
sure benno@
2020-09-15Experienced a situation where (older code) rpki-client+openrsyncd got "stuck"Theo de Raadt
(for an amusing long time), so that the partnership with cron "~ -ns" could not make progress ingesting new ROAs. Add a "-s timeout" feature (default 1H, 0 to disable) after which rpki-client gives up the ghost, allowing cron to perform a fresh try. Log loudly when this occurs. ok job claudio beck
2020-09-15consistently format/word the function documentationJasper Lievisse Adriaanse
2020-09-15s/sizeof(ipaddress)/sizeof(*ipaddress)/gMartijn van Duren
This is no issue, since a pointer is always >= 4 bytes, but incorrect is incorrect. Found by tb's static analyzer. OK beck@
2020-09-15Fix a dead store and a wrong-level NULL-check.Martijn van Duren
Found the static analyzer from tb@ OK beck@
2020-09-14Established TCP and TLS sockets of syslogd did stay open foreverAlexander Bluhm
if a client aborted the connection silently. As syslogd does not write anything into incoming connections, it will not recognize failure. Setting TCP keep alive on the listen socket does prevent that for accecpted sockets. Note that outgoing connections do not need it as syslogd will write data into them. noticed by dhill@; OK millert@ beck@ deraadt@
2020-09-14Briefly document default boot disk behaviourkn
2020-09-14add support for '&' and '|' operators in btrace scriptsJasper Lievisse Adriaanse
feedback from otto@ ok mpi@ kn@ semarie@
2020-09-14Fix handling of user names containing '@' symbols.Todd C. Miller
It is possible to have a user name of the form foo@bar in the URL. When splitting user name from host name, split at the last '@', not the first one. From Josh Rickmar
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-14 07:43:37 +0000