summaryrefslogtreecommitdiff
path: root/usr.sbin
AgeCommit message (Collapse)Author
2023-02-23When parsing MFT the CRL referenced by the MFT is loaded and verified atClaudio Jeker
the same time. So in case of a valid crl pass the CRL filename as entity message to the parent process together with the MFT. This way the MFT and CRL end up both in the valid cache even if some files in the MFT are missing. On severe errors (like X.509 verify errors) the CRL is not moved since it is not considered valid. With and OK job@, tb@
2023-02-22Explicitly initialize vmd_vm pointer with NULL before calling vm_register.Moritz Buhl
Found by codechecker. ok dv@
2023-02-21rpki-client: refactor manifest/crl parsing a bitTheo Buehler
Now that we always try to load the CRL from both locations, we can deal with loading the DER directly in proc_parser_mft_pre(), so shuffle the code around to accomplish that. This should make an upcoming diff by claudio a bit simpler. ok claudio
2023-02-21spelling.Moritz Buhl
ok jmc
2023-02-21Check all possible storage areas for a matching CRLJob Snijders
This change makes proc_parser_mft_pre() -> parse_load_crl_from_mft() search in both DIR_TEMP and DIR_VALID for a CRL with a matching SHA256 hash, increasing our chances of constructing a full publication point. With and OK tb@ claudio@
2023-02-21rpki-client: ensure there is no trailing garbage in signed objectsTheo Buehler
The d2i functions are designed in such a way that the caller is responsible to check if the entire buffer was consumed. Add checks on deserializing a signed object to ensure the entire file has been consumed. Reject the file if it has trailing garbage. found by & ok job, ok claudio
2023-02-19describe what qcow2 is, in sufficient simple termsTheo de Raadt
2023-02-17Update AUTHORS sectionJob Snijders
2023-02-17Use %R technical report macro for RFCsJob Snijders
2023-02-16- remove a leftover .ElJason McIntyre
- escape "An" as this is also a macro
2023-02-16Update references in STANDARDS section to use Rs blocksJob Snijders
Also drop largely irrelevant references like IPv6 and CIDR (as we didn't reference IPv4 either), remove obsoleted RFCs and add their successors.
2023-02-16Revert r1.63.Theo Buehler
GEN_OTHERNAME is the type of a GENERAL_NAMES, not of a DIST_POINT_NAME, which needs naked numbers as there is no enum nor defines describing it. claudio agrees
2023-02-16Add missing RFC 6487 section 4.8.6 CRLDP compliance checksJob Snijders
OK tb@ claudio@
2023-02-16explain why ARIN TAL is not included.Theo de Raadt
ok job
2023-02-16remove the '(R)' from the intel cpu match patternJonathan Gray
Intel(R) does not appear in cpu0: Intel Atom(R) x6425RE Processor @ 1.90GHz, 1895.90 MHz, 06-96-01 reported by patrick@ ok deraadt@
2023-02-15proc_ispeer() is not used anywhere anymore so remove it everywhere.Tobias Heider
ok florian@ bluhm@ ok for vmd mlarkin@
2023-02-14When initalizing a new peer, wait an extra 5 seconds before connectingClaudio Jeker
eo the remote end. With this the RDE has a chance to finish config reload before the session to a new peer is established. OK tb@
2023-02-14No longer wait for the RTR process to finish the config reload beforeClaudio Jeker
sending the IMSG_RECONF_DONE message to the RDE. The RDE does not depend on the RTR config reload (in contrast to the SE). The ROA / ASPA reload is async from the RDE config reload. OK tb@
2023-02-13Pass struct rib_entry to rde_generate_updates() instead of struct rib.Claudio Jeker
With this the newbest and oldbest arguments can go since the infromation is part of the rib_entry. Especially the prefix in the rib_entry is always valid so simplify some code in various functions below to use this information. OK tb@
2023-02-11Refactor common code of the 3 up_generate functions into up_process_prefix()Claudio Jeker
Simplifies up_generate_updates(), up_generate_addpath() and up_generate_addpath_all() a fair bit. OK tb@
2023-02-09Use GEN_OTHERNAME instead of hardcoding 0Theo Buehler
discussed with job
2023-02-09Instead of relaying struct peer from the SE to the RDE to fill out 10Claudio Jeker
stat numbers, just send the peerid and have the RDE response with the stats. The control code will then merge these counters into the real peer struct and send that to bgpctl. This reduces the number of bytes sent around a fair bit. OK tb@
2023-02-08usr.sbin: missing void to appease clang 15's -Wstrict-prototype.Theo Buehler
2023-02-06vmd(8): scan pci bus to determine bootorder strings.Dave Voutila
vmd's SeaBIOS bootorder strings had hardcoded pci device ids, so if a user added a network interface the bootorder strings didn't line up with reality. Using vmctl(8) to boot from a cdrom (-B cdrom) would fail, for instance, if attaching both a nic and a disk as well. This change scans the pci devices and finds the first of each type to construct viable bootorder strings. ok jan@
2023-02-06smtpd(8) could abort due to a connection from a local, scoped ipv6 address.Sebastien Marie
avoid using inet_pton(3) which doesn't support scoped ipv6 address, and use getaddrinfo(3) instead of. ok millert@ florian@ kn@
2023-02-06Accept netstat-style address.port syntax too.Todd C. Miller
OK bluhm@ deraadt@ jmc@
2023-02-03Add void to conn_close_any()Theo Buehler
This makes the function definition match the prototype and silences a clang-15 warning.
2023-02-03add missing ".It Xo" in previous;Jason McIntyre
2023-02-03Add ASPA support to bgpctl FastCGI serverJob Snijders
OK tb@ claudio@
2023-02-02Emit log messages in consistent formatJob Snijders
2023-02-02Fix typoJob Snijders
2023-02-02Deny "pipex no" tunnel setting for pppx(4) interfaces. They are uselessVitaliy Makkoveev
with disabled pipex(4), because in such case npppd(8) successfully establishes connection, but doesn't create corresponding interface, so the traffic doesn't flow. This is not applicable for pppac(4) interfaces, they work with disabled pipex(4). ok yasuoka@
2023-02-01Fix spellingJob Snijders
2023-01-31Not only reset the connection when a fatal error is received (or sent)Claudio Jeker
but also reset the cache and start totally fresh. The RFC is exceptionally vague about error handling but in most cases the cache state is enough off after an error that a fresh restart makes most sense. With and OK job@
2023-01-31Fix RTR error reporting: length fields in Error Reports are 32 bitsJob Snijders
OK claudio@
2023-01-31Improve whitespace alignment of RTR error reportsJob Snijders
OK claudio@
2023-01-30vmd(8): fix an interrupt storm in ns8250.Dave Voutila
On slower hosts, such as those in a nested virtualization scenario of OpenBSD guest inside OpenBSD atop Linux KVM, ns8250 can cause a race between the kevent firing and the vcpu being kicked by an assert/deassert of the irq. The end user experiences a "stuck" serial console and the host will see a vmd process peg the cpu. This change only toggles the irq if we were in a position of being ready to receive data on the device so while the kevent might continuously fire, the vcpu will not be kicked repeatedly. OK mlarkin@
2023-01-30Same parseextvalue() change as in parse.y rev 1.441Claudio Jeker
Use 2-byte ASnum encoding as a default when local-as/neighbor-as is used.
2023-01-30Alter the way extended communities are matched when part of the valueClaudio Jeker
is auto-expanded or masked off. Try to match against both 2- and 4-byte AS encoding and on insertion check if expansion is actually possible and deny communities where both community values are > USHRT_MAX. OK tb@
2023-01-28Move some header definitions from vmm(4) to vmd(8).Dave Voutila
Part of an ongoing effort to move userland-specific information out of a kernel header and directly into vmd(8). No functional change. ok mlarkin@
2023-01-25change naming convention for the lru "save history" cache, so thatMarc Espie
ports like "lang/chicken/core" do generate files like lang.chicken.core.lru instead of lang.chicken.core (which can create confusion in people's mind) do so transparently by reading the old file if need be, and removing it afterwards. Funny thing noticed by tb@ ok tb@, sthen@
2023-01-24Add ASPA to STANDARDS sectionJob Snijders
2023-01-24Fix typoJob Snijders
2023-01-24Implmement `bgpctl show rib avs invalid` and firends.Claudio Jeker
This will show all invalid ASPA paths. OK tb@
2023-01-24Implement filter and control message matching for ASAP.Claudio Jeker
This adds avs (ASPA validation state) which can be 'unknown', 'valid' or 'invalid'. It behaves similar to ovs but the ASPA validation state of paths from iBGP sessions is 'unknown' and the role of the ebgp session is important to get the right validation state. OK tb@
2023-01-24Print the ASPA validation state (avs) in various show rib outputs.Claudio Jeker
OK tb@
2023-01-24Implement ASPA validation and reload logic on ASPA set changes.Claudio Jeker
For this use the validation state (vstate) in struct prefix and struct filterstate to store both the ASPA and ROA validity. Introduce helper functions to set and get the various states for struct prefix and make sure struct filterstate is also setup properly. Change the ASPA state in rde_aspath to be AFI/AID and role independent by storing all 4 possible outcomes. Also add a ASPA generation count which is used to update the rde_aspath ASPA state cache on reloads. Rework the rde_aspa.c code to be AFI/AID and role independent. Doing this for roles is trivial but AFI switch goes deep and is so unnecessary. The reload is combined with the ROA reload logic and renamed to RPKI softreload. OK tb@
2023-01-24match unknown ATI display devices as amdgpu in fw_updateJonathan Gray
For recent devices amdgpu matches via the hardware ip discovery table, not with a table of pci vendor and product ids. So amdgpu_devlist.h and pcidevs do not cover all devices that amdgpu may match. in dmesg amdgpu with an unknown product takes the form: ramdisk kernel, bios/mbr: vga1 at pci12 dev 0 function 0 vendor "ATI", unknown product 0x687f rev 0xc3 ramdisk kernel, efi or non-x86 arch: vendor "ATI", unknown product 0x687f (class display subclass VGA, rev 0x03) at pci12 dev 0 function 0 not configured non-ramdisk kernel: amdgpu0 at pci12 dev 0 function 0 vendor "ATI", unknown product 0x687f rev 0xc3 ok deraadt@ on an earlier version
2023-01-22vmd(8): don't remove known vm's from the config on error.Dave Voutila
Multiple error paths, specifically the one related to if a guest cannot allocate memory at start, resulted in a known vm (via vm.conf(5)) being removed from the vm list. Adjust the error paths to check if the failing vm is defined in the config before tearing it down. Tested with help from beck@ and Mischa Peters. ok beck@
2023-01-20Sync usage with SYNOPSIS, mention that -x may use stdoutKlemens Nanni
Feedback from jmc and Crystal Kolipe OK jmc
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-29 08:38:36 +0000