summaryrefslogtreecommitdiff
path: root/usr.sbin
AgeCommit message (Collapse)Author
2019-08-08added /* no filesystem visibility */ above unveil("/", "") since "" is too easyRicardo Mestre
to misread. as per suggestion by and OK deraadt@
2019-08-08Fix typos in OpenBSD::Intro.3p and OpenBSD::PackingElement.3p.Frederic Cambus
2019-08-08Parse the config file early on startup before bgpd is daemonized.Claudio Jeker
This way config errors will be directly user visible on startup. To do this split out send_config() out of reconfigure() which is sending the config to the SE and RDE. OK sthen@
2019-08-08Set the reconf state of listening addrs to RECONF_REINIT. This is whatClaudio Jeker
the session engine expects and will allow to send out the config without calling merge_config first. OK sthen@
2019-08-08Describe what "disabling the decision process" entails for the "no evaluate" ↵Richard Procter
flag ok claudio@
2019-08-08One missing piece when I added pledge(2) to dhcpd(8) was in the code path whenRicardo Mestre
it's invoked with either -A/-C/-L, which at the time I left alone due to some forbidden ioctls by pledge(2). Now we have unveil(2) and this path can be further restricted by using it instead of chroot(2) since this "sandbox" (not sure why people call sandbox to about everything these days) can be escaped with *at(2) calls. Since no filesystem access is needed here then we can disable its access by calling unveil("/", "") unveil(NULL, NULL). added /* no filesystem visibility */ as per suggestion by and OK deraadt@
2019-08-07Improve RIB reload behaviour. Especially when the rtable changes or theClaudio Jeker
route evaluation is modified. In both cases the softreconfig code will now walk the RIB and ensure that everything is in proper sync. Additionally remove 'route-collector yes|no' from the bgpd config, instead use 'rde rib Loc-RIB no evaluate' with the benefit that you can alter the setting now during runtime. Tested and OK benno@
2019-08-07Implement the last few missing bits of RFC7607 and ensure that the AS inClaudio Jeker
AGGREGATOR and AS4_AGGREGATOR are non zero. All other cases have already been covered. OK benno@
2019-08-07Only templates can have a remote-as of 0 (as in uninitalised, trust the ASClaudio Jeker
from the OPEN message) any other use of AS 0 is forbidden. This makes templates work again without any extra unwanted config. OK benno@
2019-08-07Order RFC by number.Claudio Jeker
OK benno@
2019-08-06Use pw->pw_dir when chroot'ing, not _PATH_VAREMPTY.Kenneth R Westerback
Brings various dhcp related daemons into line with the common idiom. ok florian@
2019-08-05Allow an optional stride in the vcpu specification. This makes it possibleMark Kettenis
to allocate virtual CPUs but not assign them to domains. This way you can give domains exclusive access to a core without assigning all threads of that core to the domain.
2019-08-05Add a comment why network_bulk() is not using send_filterset(). UsingClaudio Jeker
send_filterset() would result in a use after free because send_filterset() frees the set after sending but network_bulk() runs in a loop.
2019-08-05Cleanup config reload in the RDE. Use the bgpd_conf struct to store setsClaudio Jeker
and l3vpns instead of temporary globals. Also rework rde_reload_done to free filters and sets earlier. The soft-reconfiguration process no longer needs the previous filters / sets to do its work since there is a full Adj-RIB-Out. OK benno@
2019-08-05Change the order how filtersets are passed during config reloads. InsteadClaudio Jeker
of sending them after e.g. the filter rule send them before. The benefit is that the filterset is present when a rule is added and so the filter rule is complete at that moment. OK benno@
2019-08-01smtpd can crash on excessively large input, causing a denial of service.Gilles Chehade
the crash is caused by a logic error leading to a fatal() ok deraadt@ bluhm@ benno@
2019-07-31When walking a leaf return the value itself instead of returning theMartijn van Duren
getnext value. Based on an older diff. Reminded and tested by deraadt@
2019-07-28minor markup polishing and typo fixes; OK kn@Ingo Schwarze
2019-07-28Document the iodevice keyword.Mark Kettenis
2019-07-28Add missing article, use Dq not literal "kn
2019-07-28Use imperative present tense consistentlykn
2019-07-28Move ldom.conf.5 to ldomctlkn
ldomctl(8)/ldomd(8) differs from the usual control/daemon setup since ldom.conf(5) is never read by the daemon itself but the control program only, so put it where it belongs. While here, mention eeprom(8) for a list of OpenPROM variables. Move prompted by kettenis Positive feedback deraadt, "go ahead" kettenis
2019-07-28Delete all CPUs from the primary and add back the number that we want toMark Kettenis
keep.
2019-07-28Add support for configuring static direct I/O.Mark Kettenis
2019-07-27tweak previous;Jason McIntyre
2019-07-27Move configuration format into ldom.conf(5)kn
ldomctl(8) contains the entire format describing logical domain configurations loaded with that tool. Entangle control commands and config options by putting the latter into its own page. The config options' descriptions stayed the same, only the EXAMPLE section gained a bit wording. Convert mdoc(7) macros `Ic =' to `Ns = Ns' and `Ic \&{ ... Ic \&}' to `Brq ...' while here. More improvements will follow in-tree. OK deraadt
2019-07-26add IMSG_REPORT_SMTP_TX_RESET to imsg_to_strGilles Chehade
2019-07-26even though RSET can be issued outside a tx, RFC states it's noop outside aGilles Chehade
transaction so rename link-reset to tx-reset and only issue the smtp report when a reset _actually_ has a side-effect. note that rset is implicit on a message commit or rollback, so tx-reset get issued even though there was no explicit RSET. the filters are MUCH simpler to write when you don't need to track every event that can reset a tx :-)
2019-07-25Fix another %m occurencekn
Found by bluhm, thanks.
2019-07-24rib_dump_terminate() and rib_dump_abort() need to free any possiblyClaudio Jeker
locked entry (rib or prefix) before removing the context else elements may remain locked for the rest of the run time (which is equal to a memory leak). OK benno@
2019-07-24Make SMTPS default to port 465 in relay-hostkn
While the other protocols either require an explicit port (LTMP) or correctly default to 25 for plaintext as well as STARTTLS, SMTP with forced TLS never happens on 25, so default to the well defined standard instead. Input and OK gilles
2019-07-24mrt.h only needs to be included by mrt.cSebastian Benoit
ok claudio@
2019-07-24Two problems:Gilles Chehade
- RFC 2034 Section 3 (item 4) requires that the status code is always followed by one or more spaces. However, OpenSMTPD has a colon right after the status code in many of the replies it sends. - RFC 2034 Section 4 states: "When responses are continued across multiple lines the same status code must appear at the beginning of the text in each line of the response." However, OpenSMTPD only has the enhanced status code for the last reply line it sends. Still, there is only one case in which it sends such a multi-line reply: the HELP command. diff from Stephan Bosch
2019-07-24Fix format specifier in execl(3) error messagekn
Typo from r1.84 introducing the logmsg() wrapper. OK deraadt
2019-07-24GC old catchallMarc Espie
add a better framework for signal handling (not used yet)
2019-07-24Stop using reserved words in the smtpd.conf configuration exampleskmos
in the default smtpd.conf and smtpd.conf(5) manual page. This eliminates ambiguity in our documentation examples that can cause confusion. Input and OK deraadt@ schwarze@ kn@
2019-07-24explain some detailsMarc Espie
2019-07-24Refactor the way RIBs are parsed a bit. No functional change but shouldClaudio Jeker
make it easier to extend the rib definitions later on. OK benno@
2019-07-24Cleanup and fix some obvious shortcomings in the mrt dump code. AlsoClaudio Jeker
implement the missing bits to dump MPLS VPN prefixes in the table-mp case. Missing support noticed by benno@ because of King Bula warning. OK benno@
2019-07-23Use the correct prefix size when writing out AID_VPN_IPv4 and AID_VPN_IPv6Claudio Jeker
prefixes.
2019-07-23Make sure that pfd is not overflown, can not happen unless the mrt countClaudio Jeker
is off.
2019-07-23include grp.h for setgroups()Gilles Chehade
2019-07-23errstr may be uninitialized in error code pathGilles Chehade
2019-07-23Clean up RIB related kroute code. Introduce a way to flush a FIB tableClaudio Jeker
from the RDE. Make sure that all nexthops don't get removed in the FIB when a FIB table is removed. This should only happen for the main FIB. Remove F_RIB_HASNOFIB which is just confusing since there is already F_RIB_NOFIB and F_RIB_NOFIBSYNC. OK benno@
2019-07-23delete a stray blank from the usage() message; reported by Jesper WallinIngo Schwarze
2019-07-22Use mnemonic IPPORT_HILASTAUTOkn
More readable, no binary change. OK kmos
2019-07-22switchd(8)'s main proc needs to open the following paths, and which can beRicardo Mestre
unveiled: / -> read, it will open config files from anywhere in the system /dev -> read/write, in order to open /dev/tap* and /dev/switch* hint and OK akoshibe@
2019-07-22Zap useless globalskn
Initialize stack variables directly instead of using global state in between. OK tedu deraadt
2019-07-22No need to check first if something is not NULL to assign NULL to it.Claudio Jeker
Just do it all the time.
2019-07-22GC three prototypes whose function have gone long ago.Claudio Jeker
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-12 22:24:29 +0000