summaryrefslogtreecommitdiff
path: root/usr.sbin
AgeCommit message (Collapse)Author
2021-01-09Remove locally imposed limit on sockets.rob
Suggested by martijn@, ok claudio@
2021-01-09Add 'strip' directivedenis
Feedback by Olivier Cherrier, Hiltjo Posthuma, Mischa OK benno@
2021-01-08accept_reserve() counter function argument doesn't need to be volatile.Todd C. Miller
Revision 1.21 removed the volatile from the cgi_inflight global but accept_reserve() was not updated to match. OK florian@
2021-01-08avoid extra warnings if undefined values are encounteredMarc Espie
2021-01-08Simplify the entity queue processing. There is no need to keep the entityClaudio Jeker
queue element around once it is sent to the parser process. Instead just keep a count of pending entities and make the parser send back the entity type instead of the id (since this is the only field needed to figure out what to do). OK job@
2021-01-08Start using the ibuf API (ibuf_dynamic, ibuf_add, ibuf_close) for writingClaudio Jeker
data between processes. This completely decouples the write side. rpki-client can't really use the imsg framework but it can use the ibuf bits wich imsg is built on. OK benno@ job@
2021-01-07bump VM shutdown event timeout ok mlarkin@ stsp@ florian@tracey
VMs with addition package daemons were not given enough time to shutdown gracefully.
2021-01-07Fix multiple shift/reduce conflicts in the parser because of the dependonClaudio Jeker
synatx element with its optional / empty element. While this is needed for redistribute statements it causes the conflicts in the interface sections since there the statement can not be empty (this conflicts with empty new lines handled in optnl). Add a dependonopt for redistribute statements and make depend on no longer optional. Also sync the curly bracket blocks (interface, area, ...) to be like set blocks and the blocks in bgpd. This should result in more flexible newline handling. Tested by sthen@, benno@, Kapetanakis Giannis OK benno@
2021-01-06if getting the vpd data fails, don't try and parse the vpd data.David Gwynne
pointed out by jsg@
2021-01-06double word fix; from sean daviesJason McIntyre
2021-01-06do not call log_addr() when the address is NULLanton
ok florian@
2021-01-05unwrap a lineTheo Buehler
2021-01-05Refactor how traphandler verifies the code.Martijn van Duren
Two things of note: 1) traphandler_v1translate now translates v1 traps to v2 traps in line with RFC3584 section 3.1 before handing them over to the "command". This can cause compatibility issues if you still receive v1 traps. 2) sysUpTime and snmpTrapOID are now always taken from the varbindlist, which means that if you run snmpd with -N the names will now show up numerical in the script, instead of by their full symbolic name. lots of feedback and OK rob@
2021-01-05It is safe to call addr2sa with a bgpd_addr NULL pointerClaudio Jeker
2021-01-05Revert part of the last addr2sa change. When addr is NULL or AID_UNSPECClaudio Jeker
addr2sa needs to return NULL. Without this connection establishment fails because bind is called with a bad sockaddr.
2021-01-05Add AID_VPN_IPv[46] support to addr2sa. It only converts the address partClaudio Jeker
of the VPN address into a sockaddr but it allows to use log_sockaddr for all cases of log_addr now. OK florian@
2021-01-04Rename PFD_PIPE_ROUTE to PFD_PIPE_RDE which is a more obvious name.Claudio Jeker
Also change the startup code to use enum bgpd_process to select which process needs to be run. Makes the code in my opinion easier to understand. OK denis@
2021-01-04Rework roa_cmp() so that the result does not depend on the endianess ofClaudio Jeker
the system. While at use memcmp in prefixset_cmp() as well for address checks. OK florian@
2021-01-04Use log_sockaddr() in log_addr() to print a struct bgpd_addr. This wayClaudio Jeker
IPv6 scoped addresses will print correctly. OK tb@ florian@
2021-01-04Remove BER_TYPE_BOOLEAN, it's not part of the spec and I haven't seen itMartijn van Duren
used anywhere. OK jan@
2021-01-03Create .1 backup files when acme-client is going to overwrite aFlorian Obser
certificate file. These files are not terribly big and they might become helpful if one re-creates a certificate with additional or removed domains and whishes to revoke the old cert (this part needs a bit of work to make it convenient to do). OK sthen
2021-01-02If acme-client detects an added or removed SAN in the config fileStuart Henderson
compared to the existing certificate on disk, automatically request a new certificate without requiring -F. (Previously the code using -F only coped with added SANs; if one was removed in config then the certificate needed manual removal vefore acme-client would work). Name checks for -r (revocation) are kept as-is for now.
2021-01-02Pull tls_close() and tls_free() further up, so tls_free() will alreadyTheo Buehler
be in the right spot once tls_close() is handled by libevent. suggested by jsing
2021-01-02Call tls_close() before closing the underlying socketTheo Buehler
In order to end a TLS connection regularly, an implementation MUST send a close_notify alert. libtls does this in tls_close() via SSL_shutdown(), so the socket had better still be open. The incorrect order in server_close() caused a leak on each tls connection due to a bug in libssl (fixed in tls_record_layer.c r1.56). As pointed out by claudio, tls_close() should really be handled from the main event loop. This will be addressed in a later commit. ok claudio florian jsing
2021-01-02replace obsolete .Li macros with .Dv and .Er as appropriateIngo Schwarze
2021-01-02Remove PIPEX{S,G}MODE ioctl(2) commands. This time they are pretty dummymvs
and were kept only for backward compatibility reasons. ok mpi@ yasuoka@
2020-12-31Don't leak the log message in server_sendlogTheo Buehler
While there, use the length calculated by vasprintf() instead of using strlen needlessly. ok claudio florian
2020-12-31Don't leak access.log and error.log on reload.Theo Buehler
ok florian
2020-12-31Rename the pony process to dispatcher and klondike to crypto.Martijn van Duren
From gilles@ OK millert@ giovanni@
2020-12-30The result of getifaddrs() not used in pppoed_reload(). Remove it.Sebastian Benoit
ok mvs@ kn@
2020-12-30getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-12-30getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-12-30getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-12-30Add 'bgpctl show sets' to display information about the roa-set, as-sets,Claudio Jeker
and prefix-sets loaded into bgpd. OK benno@
2020-12-30Implement IMSG_CTL_SHOW_SET to get information about roa-set, as-sets andClaudio Jeker
prefix-sets loaded into the RDE. For now only the number of prefixes or asnumbers are shown plus the time since the last change was done to the table. OK benno@
2020-12-30Use correct IMSG type in fatal message. Also reformat some not so long lines.Claudio Jeker
Bad IMSg name noticed by proctor@
2020-12-30RB_REMOVE from the correct tree. Dumb copy paste bug introduced by last commit.Claudio Jeker
Noticed by procter@
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. florian@ mentioned this might be a problem in slaacd(8) and rad(8) after claudio@ fixed it in bgpd, so i went looking... ok claudio@
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisSebastian Benoit
before accessing anything in ifa_addr. ok claudio@
2020-12-29In preparation for RTR support change the representation of the roa-setClaudio Jeker
in the parent to a simple RB tree based on struct roa. With this overlapping ROAs (same prefix & source-as but different maxlen) are now merged in the RDE when the lookup trie is constructed. OK benno@
2020-12-29Fix calloc in GBRjob
OK claudio@
2020-12-29sync usage() with SYNOPSIS; the -S option remainsJason McIntyre
undocumented, at least for now;
2020-12-29getifaddrs() can return entries where ifa_addr is NULL. Check for thisClaudio Jeker
before accessing anything in ifa_addr. OK florian@
2020-12-29Only skip routes with a loopback gateway for network static and connected.Claudio Jeker
For network rtlabel and priority skip this check since there the operator may actually want to distribute this network explicitly (even though it is probably a reject or blackhole route). Requested by dlg@ OK benno@
2020-12-24First fulfil all challenges then tell the CA that it should check.Florian Obser
For http-01 this doesn't matter but I think this will be nicer for dns-01 because there are propagation delays to consider and it will be better to just put everything in DNS and then wait then wait after each challenge. Testing & OK sthen
2020-12-23smtpd's filter state machine can prematurely release resourcesTodd C. Miller
leading to a crash. From gilles@
2020-12-23Fix a memory leak: use a single memory allocation for struct addrinfo andEric Faurot
the sockaddr it contains, as expected by freeaddrinfo(). Move the allocation to a helper function for clarity. comments from martijn@ millert@ ok millert@
2020-12-23BGP uses KEEPALIVE packets and the HOLD timer to detect stalled sessions.Claudio Jeker
The problem is that this timer only looks at the receive side of the TCP session. If for some reason the send side stalls the system fully depends on the remote BGP peer to reset the session. As seen in an ever growing OutQ and as a result important changes can get stalled and cause routing troubles. This change introduces a SEND HOLD timer. The timer is reset whenever the session engine was able to write data to the TCP socket. If the send hold timer expires bgpd was not able to send any data to that neighbor for at least 90 seconds and therefor the session is forcefully closed with a hold timer expired notification. The send hold timer acts as a last resort to detect faulty peers. On an idle session it can take a long time until this timer triggers but the main goal here is to reset a stuck session at some point which did not happen before. With and OK job@
2020-12-23Use regfree after we're done with preg.Martijn van Duren
From gilles@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 03:38:23 +0000