| Age | Commit message (Collapse) | Author |
|---|
|
The original virtio device implementation relied on allocating a
buffer on heap, copying the virtqueue from the guest, mutating the
copy, and then overwriting the virtqueue in the guest.
While the approach worked, it was both complex and added extra
overhead. On older hardware, switching to the zero-copy approach
can show a noticeable performance improvement for vionet devices.
An added benefit is this diff also reduces the amount of code in
vmd, which is always a welcome change.
In addition, change to talking about the queue pfn and not "address"
as the virtio-pci spec has drivers provide a 32-bit value representing
the physical page number of the location in guest memory, not the
linear address.
Original idea from dlg@ while working on re-adding async task queues.
ok dlg@, tested by many
|
|
remove some redundant info regarding netstat -r from ipcomp/ipsec
feedback claudio sthen
ok claudio kn sthen
|
|
A few programs used the plural in their synopsis which doesn't read as
clear as the obvious triple-dot notation.
mdoc(7) .Ar defaults to "file ..." if no arguments are given and consistent
use of 'arg ...' matches that behaviour.
Cleanup a few markups of the same argument so the text keeps reading
naturally; omit unhelpful parts like 'if optional arguments are given,
they are passed along' for tools like time(1) and timeout(1) that obviously
execute commands with whatever arguments where given -- just like doas(1)
which doesn't mention arguments in its DESCRIPTION in the first place.
For expr(1) the difference between 'expressions' and 'expression ...' is
crucial, as arguments must be passed as individual words.
Feedback millert jmc schwarze deraadt
OK jmc
|
|
OK sthen@, kn@
|
|
snmp uses signed 32 bits integers and agentx uses unsigned 16 bits
integers. I somehow ended up somewhere in between.
OK sthen@, kn@
|
|
we overflow the encbuf. Allocate encbuf on the fly so that we always have
enough room.
Give decryption the same treatment, although this one is not at risk, since
the input is limited to READ_BUF_SIZE.
OK sthen@, kn@
|
|
write(2), make sure that we don't restart the message on the next write
out, but continue where we left of.
OK sthen@, kn@
|
|
ok marlkin@
|
|
|
|
requested by jsing
|
|
We don't do PEM or random in here, but we use BN, EC, ECDSA, so include
the relevant headers. errno.h was also missing.
|
|
Make sure the size_t containing EC signature length is not truncated
when passing it to d2i_ECDSA_SIG() as a long. This won't happen, but
documents API quirks...
requested by jsing
|
|
We can get the correct size of the signature using EVP_PKEY_bits() which
uses the order instead of the (strictly speaking incorrect) degree. Grab
the (r, s) out of the ECDSA signature with ECDSA_SIG_get0_{r,s}(), which
is a saner interface than EVP_SIG_get0(). Finally, do the zero padding
using BN_bn2binpad() which is simpler than the currently rather fiddly
solution.
ok jsing
|
|
EVP_DigestSign() is a bit more ergonomic than the old EVP_Sign* family,
it takes size_t instead of int and and it also allows allocating the
memory needed instead of relying on some weird estimate. This again gets
rid of a few stupid else if.
ok jsing
|
|
We can EVP_Digest() into an array on the stack rather than doing a long
dance and song with lots of ugly else if.
ok jsing
|
|
|
|
If a SAN isn't configured, it could be anything, so make printing it safe
using strvisx(). If it is configured but duplicate, printing it should be
fine, so don't bother. This removes two XXX added in the previous commit.
ok florian
|
|
The revoke process, which does a lot more than revoking a cert, wants to
know the SANs in the cert to be revoked or renewed and check them against
the ones configured in the config file.
To find out which ones are, it prints the SAN extension to a BIO using
X509V3_EXT_print(), slurps that into a buffer, tokenizes the undocumented
output string and plucks out the "DNS:" names. This is reminiscent of
node's hilarious CVE-2021-44532 and on about the same level of crazy, but
fortunately not security relevant.
Get the SAN extension as a GENERAL_NAMES from libcrypto, then we have an
actual data structure to work with, which allows us to access the DNS names
without problems. This simplifies things quite a bit, but the actual logic
in this file remains unmodified. Be careful about ASN1_IA5STRINGs and do
not assume they are C strings.
Tested by florian, millert, Renaud Allard, thanks!
ok florian jsing
|
|
Store the length locally instead of computing it multiple times.
OK dv@, previous version OK deraadt@
|
|
Times in certificates are all expressed in Zulu time, so calling the time
zone dependent mktime() on such a time and comparing it to time(NULL) is
wrong.
This means that the check of at least 30 days validity and deciding on
whether to renew or not might have been off by by half a day depending on
where you are. That should not matter since you (or cron) are supposed to
run acme-client way more often than once a month.
ok claudio millert
|
|
There is a hand-rolled, only minimally checked implementation converting
an ASN1_TIME into a struc tm. beck has invested a lot of time improving
the time parsing inside libcrypto, so make use of that. That code is safer,
better vetted and more correct.
ok florian
|
|
OK millert@
|
|
Many statistic values are now accounted by repository via repo_stat_inc()
At end of the run sum_stats() accumulates these stats per TAL and globally.
The new output file metrics is written when the -m output flag is specified.
The metrics file is written in OpenMetrics format (with a few tweaks to
allow node_exporter to parse the file as well). The ometric code is a copy
from bgpctl(8) and should be kept in sync.
OK tb@
|
|
unsigned char.
Casting to int is particularly useless because that's what the
compiler already does. We need to prevent sign extension, not write
down that we want sign extension.
OK deraadt, kn, miod, op
|
|
unsigned char.
Casting to int is particularly useless because that's what the
compiler already does. We need to prevent sign extension, not write
down that we want sign extension.
OK deraadt, kn, miod
|
|
unsigned char.
Casting to int is particularly useless because that's what the
compiler already does. We need to prevent sign extension, not write
down that we want sign extension.
OK deraadt, millert, kn
|
|
|
|
header of the buf was read. This often saves a round-trip to the main
event loop and poll(2).
OK job@ tb@
|
|
ok sthen
|
|
instead of per prefix.
OK sthen@
|
|
OK tb@
|
|
Changes output like this:
# HELP bgpd bgpd information
-# TYPE bgpd unknown
+# TYPE bgpd info
bgpd_info{nodename="xxx",domainname="xxx",release="7.7"} 1
|
|
OK tb@
|
|
clock_gettime(CLOCK_MONOTONIC) for runtime calculation.
OK tb@
|
|
across all object types
OK claudio@ tb@
|
|
OK tb@
|
|
|
|
over to handle struct timespec instead of struct timeval. This way no
extra conversion is needed.
OK tb@
|
|
From Rob Whitlock <rwhitlock22 () gmail ! com>
|
|
Prefer CLOCK_MONOTONIC to gettimeofday(2) when measuring elapsed time,
as the UTC clock can jump around.
ok claudio@
|
|
Add a function that a) verifies that none of the special suffixes is used
and b) that the name itself is not yet used already.
Also when printing a counter _total has to be added to the metric name and
for info metrics _info is added.
With and OK tb@
|
|
ok phessler@ sthen@ tobhe@
|
|
Timestamps are special since they can require more significant bits
than a double provides. Instead print them as pseudo float as suggested
by the OpenMetrics draft.
OK cheloha@
|
|
|
|
Calling ometric_set_int_with_labels() for a state metric fails because
there is a check in ometric_set_int comparing the type.
Use olabels_add_extras() and ometric_set_int_value() instead.
|
|
getopt(3) returns '?' when it encounters a flag not present in the in
the optstring or if a flag is missing its option argument. We can
handle this case with the "default" failure case with no loss of
legibility. Hence, remove all the redundant "case '?':" lines.
Prompted by dlg@. With help from dlg@ and millert@.
Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2
ok naddy@ millert@ dlg@
|
|
ok patrick@
|
|
|
|
Both are initalised with compile-time constants and never written to.
They are part of the Neighbour Discovery machinery and only surface
through the single-user SIOCGIFINFO_IN6:
$ ndp -i lo0
basereachable=30s0ms, reachable=39s, retrans=1s0ms
These values are read-only since 2017
sys/netinet6/nd6.c r1.217
usr.sbin/ndp/ndp.c r1.85
Remove knob and always do neighbor unreachable detection
Inline the macros (to keep meaningful names), shrink the per-interface
allocated struct nd_ifinfo to what is actually needed and inline
nd6_dad_starttimer()'s constant `msec' argument.
Nothing else in base, incl. regress, uses SIOCGIFINFO_IN6 or `ndp -i'.
OK bluhm
|
|
|
