| Age | Commit message (Collapse) | Author |
|---|
|
The resources delegated in the RFC 3779 extensions of the EE cert for
ROAs or RSCs can be a subset of the resources in the auth chain. So far
we compared that the resources of ROAs and RSCs are covered by the auth
chain, which is not entirely correct. Extract the necessary data from
the EE cert into rpki-client's own data structures, then verify that
the EE cert's resources cover the ones claimed in the ROA or RSC.
Do this as part or ROA and RSC parsing, that the EE cert's resources are
covered by the auth chain is checked in valid_x509() later on.
All this is a bit more annoying and intrusive than it should be...
ok claudio job
|
|
In knexthop_true_nexthop() connected routes need to be handled specially.
If a nexthop is directly reachable the gateway needs to remain the same.
There is no nexthop set for F_CONNECTED kroutes. A very similar trick
is used in rde_rib.c::nexthop_update() but was forgotten here.
Regression noticed by Daniel Jakots (danj at chown.me).
OK tb@
|
|
Platform-dependent preparation of the filesystem required by the boot loader
only ever creates a new fileystem without instaling using any bootstrap files.
To reflect reality, turn
# installboot -nvp vnd0
Using / as root
would install bootstrap on /dev/rvnd0c
using first-stage /usr/mdec/biosboot, second-stage /usr/mdec/boot
would newfs 545c9bdf92aa18f9.i
into
# ./obj/installboot -nvp vnd0
would newfs 4db2c0e89e0d3268.i
and error out if -p is combined with -r or stages:
$ man -hl./installboot.8
installboot [-nv] [-r root] disk [stage1 [stage2]]
installboot [-nv] -p disk
Feedback OK millert
|
|
|
|
rather than relying on ypbind to do it, which also means you don't need
portmap running. In this mode, ypldap binds its rpc sockets to loopback,
so YP services are only available to the host it's running on. The
previous behaviour, now called portmap bind mode, is still the default.
encouragement from deraadt@ and dlg@
|
|
since krm is only set for IPv4 routes but not for IPv6 ones.
OK tb@
|
|
OK tb@
|
|
one from kr_state and removing this argument helps portability.
OK tb@
|
|
OK tb@ deraadt@
|
|
The memory regions passed to memcpy() can not overlap so no need for memmove().
OK tb@ deraadt@
|
|
OK tb@
|
|
struct.
OK tb@
|
|
|
|
|
|
instead use exit_nexthop (the nexthop from BGP). The FIB code can then
do the lookup and replace the nexthop in the FIB.
This solves an issue when multiple nexthops change concurrently. In the
RDE the decision process handles these changes ansynchronously which
resulted in bad true_nexthops to be sent to the FIB. The exit_nethop
is stable so the data sent to the FIB is always correct.
Fix a bug in netxhop tracking introduced in 1.280. On RTM_CHANGE when the
nexthop of a kroute changes a knexthop_send_update() must be sent but
knexthop_track() does not do that because the kroute did not change.
Introduce a knexthop_update() function for this case instead.
OK tb@
|
|
arm64 is the only currently supported OpenBSD platform which both
a) supports booting off root on softraid(4) (kernel and bootloader) and
b) is an EFI platform (as far as installboot(8) is concerned).
Currently, installboot treats softraid root volumes as regular devices,
ignoring ignores chunk devices completely.
Teach installboot the first bits of softraid support for EFI:
installing the single-stage boot loader on chunks rather than the volume.
Copy over sparc64's softraid stage-1 code as-is and make its stage-2 a NOOP:
# ./obj/installboot -v sd4
Using / as root
installing bootstrap on /dev/rsd4c
using first-stage /usr/mdec/BOOTAA64.EFI
sd4: softraid volume with 1 disk(s)
sd0a: installing boot blocks on /dev/rsd0c
copying /usr/mdec/BOOTAA64.EFI to /tmp/installboot.KuBD4zkfpM/efi/boot/bootaa64.efi
writing /tmp/installboot.KuBD4zkfpM/efi/boot/startup.nsh
arm64 miniroot fits and boots with this.
OK stsp
As of now, EFI partitions must still be created manually as installboot's
'-p' does not support softraid at all (next missing piece for root on
softraid on arm64 installations to work out-of-the-box).
|
|
They both are only used as struct http_descriptor.
OK tb@
|
|
file and other cases. Especially when the session uses keep-alive it is
important to set TOREAD_HTTP_HEADER so that the state machine knows what's
next.
OK op@
|
|
namelist and its entries are not freed if escape_html fails or if we
fail in the inner loop. Move scandir later so it's closer to the for
loop and handle escape_html and url_encode failures.
With lots of help from tb, thanks!
ok tb@
|
|
tweak/ok tb@
|
|
If that succeeds the fcgi session will be terminated the regular way.
If it fails close all fds and finish the request.
Sending a SIGTERM to a read only bgpctl process should be fine at any point.
Also reduce the timeout to 30sec. This is not long enough to dump a full
rib but nobody should do that.
OK tb@
|
|
The EE Cert has just been allocated as part of deserializing the cms.
There is no need for an expensive copy, we can just keep a reference.
ok job
|
|
from Frederic Nowak, thanks !
|
|
OK op@
|
|
body so server_fcgi_error shouldn't print the end marker.
OK claudio@
|
|
disconnection from the fastcgi application via server_file_error which
assumes that the reply was completey done. However, if the fastcgi
reply wasn't complete (e.g. because slowcgi hit the timeout) the HTTP
client are left "hanging" and waiting for a reply until they give up.
This adds a server_fcgi_error callback to handle the "no headers" and
"incomplete data" cases and properly close the reply before falling back
to server_file_error.
OK claudio@
|
|
|
|
The ROA specification (RFC 6482 section 4) is a bit underspecified, however
in the wild the RFC 3779 AS Resources extension never ever appears on ROA EE
certificates, as it serves no purpose in the validation process.
OK tb@
|
|
This matches the VPN4 code and avoids a NULL deref in the else branch.
ok claudio
|
|
memcpy(). Additionally replace a bzero() with memset() and remove to
superfluous bzero calls.
OK tb@
|
|
The nexthop can be valid but still a NULL pointer. In that case just set
the aid like it is done for invalid nexthops. If the nexthop is set by
explicitly specifying one then include the exit_nexthop, that is the
nexthop that is relevant for BGP. Further cleanup the function as usual.
OK tb@
|
|
If a repository is uncommunicative, rpki-client will try other transports,
or come back later (because of a next crontab invocation).
OK claudio@
|
|
OK tb@
|
|
hit this timeout. This is in line with the rsync code.
OK tb@ job@
|
|
OK claudio@
|
|
OK sthen@
|
|
|
|
original diff from Alfred Morgan (alfred [at] 54 dot org)
ok florian@ and manpage tweaks by me.
|
|
Intel CPUs mostly used to have processor name strings of the form
cpu0: Intel(R) Pentium(R) M processor 1.60GHz ("GenuineIntel" 686-class) 1.60 GHz, 06-0d-06
cpu0: Intel(R) Core(TM) i7-5600U CPU @ 2.60GHz, 2494.61 MHz, 06-3d-04
recent CPUs use
cpu0: 11th Gen Intel(R) Core(TM) i5-1130G7 @ 1.10GHz, 30009.37 MHz, 06-8c-01
cpu0: 12th Gen Intel(R) Core(TM) i5-12400, 4390.71 MHz, 06-97-02
cpu0: 12th Gen Intel(R) Core(TM) i7-1260P, 1995.55 MHz, 06-9a-03
change pattern used to handle this
also covers oddities such as
cpu0: Genuine Intel(R) CPU @ 600MHz, 600.10 MHz
cpu0: Genuine Intel(R) CPU @ 1.00GHz, 1000.13 MHz, 06-26-01
cpu0: Genuine Intel(R) CPU L2400 @ 1.66GHz ("GenuineIntel" 686-class) 1.67 GHz, 06-0e-08
test chips use "Genuine Intel(R) CPU 0000"
|
|
Up to two wildcards, since we have to work around the way ksh does things.
Tweaks and suggestions from kn@ and halex@
|
|
the cachedir and if output files are written to outputdir. In -f mode
the unveil can be read-only in normal operation rwc is required because
the main process writes the RRDP files and also does the cleanup at the
end of the run.
Input from tb@ and mestre@, OK tb@
|
|
|
|
Use .Vt instead of .Tn for mode_t and dev_t.
While here, also use .Fa rather than .Va for st_rdev (as usual
for struct fields), and correctly mark up st_mode and S_IFMT.
|
|
ok schwarze@
|
|
|
|
knexthop_validate() will modify the kroute the nexthop points to.
Because of this knexthop_validate() needs to be called before the
to be removed kroute is freed. Move the code into kroute_remove[46]
so the order is correct.
Problem found and fix tested by sthen@.
OK sthen@ tb@
|
|
kroute_match() may return NULL so setting kn->ifindex should only
be done if the kroute is valid. Also set the ifindex to 0 in
kroute_detach_nexthop().
Based on a bigger diff which is OK tb@ and sthen@
|
|
Make "vmctl create -s3G 1.img 2.img" fail instead of just creating 1.img
and ignoring 2.img.
OK dv cheloha
|
|
ok jmc@ schwarze@
|
|
show a "processing" message when we're actually grabbing data
(often from the net). This should be really quick in most cases,
but sometimes, it might take minutes (like for texlive), so that
we know what's going on.
|
