summaryrefslogtreecommitdiff
path: root/usr.sbin
AgeCommit message (Collapse)Author
2023-10-24According to RFC2741 section 6.1.1 an agentx-response-pdu shouldn't haveMartijn van Duren
the NON_DEFAULT_CONTEXT set. Remove the argument from ax_response(). OK tb@
2023-10-24Make sure that unpacking of an AgentX OID doesn't contain more than 128Martijn van Duren
elements. OK tb@
2023-10-24Remove filter-pf-addresses. This feature has been deprecated since 7.2 inMartijn van Duren
favour of 'blocklist pfTblAddrTable'. OK tb@
2023-10-23sorry, somehow I did redo this line badly and didn't retestMarc Espie
2023-10-23Revert Subst.pm r1.22. It broke ordinary pkg_add usageTheo Buehler
2023-10-23Use xoff instead of *olen in the shift_right() call. xoff is the rightClaudio Jeker
value here since *olen is (conditionally) set a few lines later to the same value as xoff. Should fix the CodeQL warnings because *olen is dereferenced without proper NULL check. OK tb@
2023-10-23split on spaces as well, to take advantage of +=Marc Espie
2023-10-23add some limited capability to -DVAR+=valueMarc Espie
to be used with REGRESSION_TESTING, where it's somewhat inconvenient to know the full list in advance.
2023-10-23Fix radiusd(8) to fixup MPPE-{Send,Recv}-Key and Tunnel-PasswordYASUOKA Masahiko
attributes of the response properly.
2023-10-22bt(5), btrace(8): execute END probe and print non-empty maps upon exit()Scott Soule Cheloha
BPFTrace's exit() statement executes the END probe (if any) and prints the contents of all non-empty maps before terminating the interpreter. Implement this in btrace(8) with a halting check after each statement. If a statement causes the program to halt, the condition bubbles up to the top-level evaluation loop and causes rules_teardown() to run immediately. btrace(8) still performs a full rules_setup() if exit() is called during the BEGIN probe, though the top-level evaluation loop is never run. One edge-like case: an exit() from the END probe is treated as an early return; END is not executed multiple times. Thread: https://marc.info/?l=openbsd-tech&m=169765169420751&w=2 ok mpi@
2023-10-19syslogd(8) counts dropped UDP packets.Alexander Bluhm
Now that syslogd handles delayed DNS lookups, also count dropped packets to UDP loghosts. Although not every outgoing UDP packet dropped along the path can be detected, the message makes the admin aware that there is a local blind spot during startup. Improve debug and log messages, especially if UDP logging is shut down permanently. Also do not print 'last message repeated' if the message was dropped. OK deraadt@
2023-10-19Add experimental support for secp256r1 aka P-256 aka prime256v1Job Snijders
ECDSA signatures are much smaller than RSA signatures while offering similar security. Adding support for P-256 now allows CA developers to test their implementations, and paving the way for signers in the production environment in the future to take advantage of ECDSA. OK tb@
2023-10-19While the ibuf_add calls should not fail the way they are used itClaudio Jeker
is still better to check for error. OK tb@
2023-10-19Convert rtr_proto.c to use new ibuf API.Claudio Jeker
More yak shaving required which will follow. OK tb@
2023-10-19Convert the session engine to use the new ibuf API.Claudio Jeker
OK tb@
2023-10-18only strip actual file/line part from the eval errorMarc Espie
2023-10-18rpki-client: move inherit in {ip,as}_warn()Theo Buehler
While alphabetic order makes sense, having inherit between individual AS and IP entries and ranges makes little sense. Use the order that we have elsewhere. ok claudio job
2023-10-18rpki-client: rework ip_addr_check_overlap()Theo Buehler
Avoid conditional early returns and significantly simplify the printing of ip addresses/ranges by using the new ip_warn(). This also eliminates an extremely weird usage of the comma operator and reduces noise levels quite a bit. ok claudio job
2023-10-18rpki-client: rework as_check_overlap()Theo Buehler
Avoid early returns and use a single copy of the warning by reworking the control flow through two nested switches. ok claudio job
2023-10-18rfc3779: no need for err.h, but we do need asn1.hTheo Buehler
2023-10-17Neither sin_len nor sin6_len can be 0 so these checks are not needed.Claudio Jeker
Also reorder the RTF_HOST vs netmask check. RTF_HOST wins if both are set. Makes the code a bit neater. OK tb@
2023-10-17Remove bogus plen != 0xff checkClaudio Jeker
OK tb@
2023-10-16Improve IPv6 link-local address handlingClaudio Jeker
When a session is established determine the possible interface scope of that session. The scope is only set when the remote address is directly connected. This interface scope is passed to the RDE that uses this information when link-local nexthops are received. Again checking that a link-local nexthop is actually acceptable. OK tb@
2023-10-14Verify but don't overwrite SHA256.sig in fw_update(8)Andrew Fresh
Signify is happy to overwite the file with the signature stripped off. However, if we do that, when downloading firmware we lose the ability to check the signature before verifying checksums on the downloaded files. Noticed by Thomas <exnihilo () fastmail ! org> Right deraadt@
2023-10-14Rewrite log_peer_info() and log_peer_warn[x]()Claudio Jeker
Passing the peer description as part of the format string was a bad idea since the peer description may include some % signs (e.g. for link local IPv6 addresses). So instead of asprintf a new fmt string use vasprintf to get the message and then use logit("%s: %s", peer_info, msg). OK tb@
2023-10-13Allow imposing constraints on RPKI trust anchorsJob Snijders
The ability to constrain a RPKI Trust Anchor's effective signing authority to a limited set of Internet Number Resources allows Relying Parties to enjoy the potential benefits of assuming trust, within a bounded scope. Some examples: ARIN does not support inter-RIR IPv6 transfers, so it wouldn't make any sense to see a ROA subordinate to ARIN's trust anchor covering RIPE-managed IPv6 space. Conversely, it wouldn't make sense to observe a ROA covering ARIN-managed IPv6 space under APNIC's, LACNIC's, or RIPE's trust anchor - even if a derived trust arc (a cryptographically valid certificate path) existed. Along these same lines, AFRINIC doesn't support inter-RIR transfers of any kind, and none of the RIRs have authority over private resources like 10.0.0.0/8 and 2001:db8::/32. For more background see: https://datatracker.ietf.org/doc/draft-snijders-constraining-rpki-trust-anchors/ https://mailman.nanog.org/pipermail/nanog/2023-September/223354.html With and OK tb@, OK claudio@
2023-10-13Add missing Ns in argument list of announce (IPv4|IPv6) ...Claudio Jeker
2023-10-12Retry DNS lookup for remote loghost.Alexander Bluhm
If DNS lookup for a remote loghost configured in syslog.conf did not work at startup, the entry was ignored. Better retry the lookup in intervals until it succeeds. Improve debug output to print IP address after resolution. Unify retry code that resolves DNS for UDP and connects to TCP server. testing and feedback from Paul de Weerd; OK deraadt@
2023-10-12bt(5), btrace(8): add support for binary modulo operator ('%')Scott Soule Cheloha
Link: https://marc.info/?l=openbsd-tech&m=169695435209410&w=2 ok mpi@
2023-10-12Before calling rde_generate_updates() with EVAL_ALL ensure that the newClaudio Jeker
path is actually eligible. If this is not the case pass NULL instead. This is an optimisation to bypass extra work if both old and new path were ineligible. OK tb@
2023-10-12In up_generate_addpath_all() ensure that the new prefix is valid.Claudio Jeker
This should fix a fatal error reported by Arend Brouwer (arend at eritap com) when "announce add-path send all" is used. As a workaround "announce add-path send best plus 500" can used. OK tb@
2023-10-12Remove default sets answerKlemens Nanni
The autoinstall(8) response file contains only non-defaults, except for Set name(s)? (or 'abort' or 'done') [done] done which is the hardcoded default since 2009. Added in 2019 r1.23 "Let sysupgrade(8) create auto_upgrade.conf file [...]" with all others, remove the exception. OK florian
2023-10-11put "stub" within grasp of -DREGRESSION_TESTING.Marc Espie
Extend it slightly: do not stub quirks, so that caching mechanisms work as usual even when using stubs.
2023-10-11missing state in locator call, surprised nobody else ran into thatMarc Espie
2023-10-11Bump version for -portable releaseClaudio Jeker
2023-10-10When rewriting community_writebuf() the handling of non-transitiveClaudio Jeker
ext-communities was put into the wrong place in the loop finding start, end and number of communities to dump. As a result the end pointer for regular communities can point at an ext-community and with that the COMMUNITY attribute written includes unexpected extra bytes. This in turn causes the peer to send a NOTIFICATION error and to terminate the session. Fix for -portable issue #64 reported by Pier Carlo Chiodi (pierky) OK tb@
2023-10-09Add Message-Id as needed for messages received on the submission port.Todd C. Miller
Since listener->port is in network byte order we need to compare against htons(587). The fix for this got dropped in the rewrite in revision 1.335.
2023-10-09placeholder for later featureMarc Espie
2023-10-09Fix return value confusion of sa_cmp() by renaming the function sa_equal().Claudio Jeker
The code in get_alternate_addr() checked for sa_cmp() == 0 but actually sa_cmp() returned 1 for equal addrs. So rename the function to sa_equal() to make it clear that a true return value means equality. Found by Asa Yeamans (enigma2e at rivin net) OK tb@
2023-10-09simplify: all 3 mock-ups are strings that get eval'd, so do this properly.Marc Espie
2023-10-08subclass system libraries so we can give better diagnostic eventuallyMarc Espie
2023-10-08oops, those eval need to be STRINGS, otherwise the whole definition stuffMarc Espie
happens regardless. Add a third one to only disregard base libraries
2023-10-08add another two regression testing parts. Use a simple framework thatMarc Espie
allows me to redefine methods to not do a thing (maybe this will migrate to its own file if it grows enough)
2023-10-08wrong prototype, it's called as an OO methodMarc Espie
2023-10-08plain forgot to save the values for regression testingMarc Espie
2023-10-07with firmware known, recognize that we couldn't find any update at allMarc Espie
and just say that instead of a dauntingly long list of packages
2023-10-07track firmware separately, since those will appear as uptodate for usMarc Espie
2023-10-07use more specific regression testing knobMarc Espie
2023-10-06add -v to usage();Jason McIntyre
2023-10-05Do log output to stderr while running dhcpd(8) in foreground to makeVitaliy Makkoveev
behaviour in accordance with man page. Introduce '-v' option to make output more verbose. Do a little refactoring to make code more consistent with other daemons like ospfd(8), httpd(8), relayd(8), etc. Feedback from bluhm benno ok bluhm
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 21:47:01 +0000