summaryrefslogtreecommitdiff
path: root/usr.sbin
AgeCommit message (Collapse)Author
2021-09-01A couple commands don't need sys/param.h, but they do need sys/signal.hTheo de Raadt
2021-09-01Let rpki-client(8) inform bgpd(8) when RPKI VRPs will expire.Job Snijders
This will help prevent machines loading outdated roa-sets. OK claudio@
2021-09-01remove sys/param.h use (few small repairs)Theo de Raadt
2021-09-01Clarify maxlen is optional in roa-setJob Snijders
OK claudio@
2021-09-01Handle the case where map/hist can be read after calling clear().Martin Pieuchot
Fix a NULL-derference found by jasper@ with AFL++ (port coming soon!). ok jasper@
2021-09-01Implement roa-set data expiry. Every prefix in a roa-set can specify anClaudio Jeker
optional expires timestamp. The rtr process is walking the roa-set every 5min and removes every prefix that is expired. With this stale RPKI data will slowly disapear and not linger around. OK job@
2021-09-01RPKI only cares about *.{cer,crl,gbr,mft,roa} files. Use rsync --includeClaudio Jeker
and --exclude to only fetch those files from the CA repositories. OK job@
2021-09-01remove unused functions and cleanup vmd.hDave Voutila
Discussed with mlarkin@. These functions were implemented but never used. While in vmd.h, fix the order to match current vmd(8) reality.
2021-09-01Fix bad logic I introduced before commit.Claudio Jeker
Found by job@
2021-09-01Document the http_proxy environment variableClaudio Jeker
2021-09-01Add http_proxy support to rpki-client's http handler.Claudio Jeker
OK tb@
2021-09-01Imitate how free(3) behaves and make map_clear() works on NULL map.Martin Pieuchot
2021-09-01Always print non-empty map & hist on exit even if there's an END rule.Martin Pieuchot
Match bpftrace behavior.
2021-09-01Support for insert pid/tid/cpu builtins in map/hist.Martin Pieuchot
2021-08-31Make includes follow style(9).Florian Obser
2021-08-31memset the pfds array in the poll loop and not only at the start.Claudio Jeker
2021-08-31Make "relayctl reload" when agentx enabling is toggled in relayd.conf workMartijn van Duren
consistently. OK benno@
2021-08-31Basic test, if (no else atm), support with a single statement.Martin Pieuchot
2021-08-31Support storing syscall arguments in a map/hist.Martin Pieuchot
2021-08-31Rewrite grammar to implement operator precedence without using %right or %prec.Martin Pieuchot
Arithmetic operator should now behave as expeted and tests can now be written without superfluous parenthesis, for example: syscall:select:entry /($1 == 0) || (pid == $1)/ { } Can now be written: syscall:select:entry /$1 == 0 || pid == $1/ { } While here improve filter debugging support.
2021-08-30Properly account entity_queue when the file has already been seenJob Snijders
Thanks to Ben Maddison for helping create a test case OK claudio@
2021-08-30Remove unused filesJob Snijders
OK deraadt@
2021-08-30Implement '<' and '>' operators in filters.Martin Pieuchot
Based on a diff from and ok dv@
2021-08-29Mask viornd descriptor value to prevent out of bound reads.Dave Voutila
viornd did not mask the descriptor value in the avialable ring allowing guest values to read past the end of the descriptor table. While here, change fatal to fatalx because errno is not set. Reported by Ilja van Sprundel ok mlarkin@
2021-08-29mask next descriptor value and fix chunk_size calculationDave Voutila
Guest can cause out of bounds read with a malformed descriptor. In same loop, also fix a chunk size calculation. Reported by Ilja van Sprundel. ok mlarkin@
2021-08-29check for null vioblk infoDave Voutila
If {c,m}alloc fail, info could be NULL and result in NULL deref. Reported by Ilja van Sprundel. ok mlarkin@
2021-08-29correct device status write sizeDave Voutila
Reported by Ilja van Sprundel. ok mlarkin@
2021-08-29remove old descriptor dump functionDave Voutila
Used originally to aid dev. Unneeded. ok mlarkin@
2021-08-29-w default is now 3;Jason McIntyre
2021-08-28whitespace nitStuart Henderson
2021-08-28Allow traceroute -w values down to 1 second, from John CarmackStuart Henderson
Change the default -w from 5 to 3 seconds, reducing the time it waits for a response. John proposed using 1 second for this, but several of us are familiar with networks where that would be likely to remove hops, 3 seems reasonable and still saves 6 seconds on a non-responding hop (there's always mtr if you need faster output). Feedback from various, ok phessler@ kn@ florian@
2021-08-24fix outdated comments, from Emil Engler, thanks.Sebastian Benoit
2021-08-23Since we have a config file now we should Xr its manpage.Florian Obser
From Scott Bennett, thanks!
2021-08-16add missing breakJonathan Gray
ok claudio@
2021-08-13merge unbound-1.13.2 / regen configure, ok florianStuart Henderson
2021-08-13import unbound 1.13.2, ok florian@Stuart Henderson
2021-08-12Rework the logic for fetching TA files a bit. Move the logic that checksClaudio Jeker
if all possible sources have been used to ta_fetch() this simplifies the logic in the rsync and http done cases. Additionally when -R is used, skip https URI and only connect via rsync. If the TAL file has no rsync URI then the system will fall back to the cache and not try https instead. This makes -R a only use rsync flag. With and OK job@
2021-08-12The RRDP specification is very vage what to do if a notification fileClaudio Jeker
has a serial lower than what the client synced to last time. This could happen if the CDN has a bad server that distributes old data. Instead of falling back to a snapshot just ignore this case and consider the repo synced. Hopefully the next run will bring everything back to normal. OK job@ benno@
2021-08-11For the snmpv2c example, use a community which is something more likeStuart Henderson
the sort of thing which should actually be used (a proper random string rather than a common word, and especially not a common word that is the default for much SNMP software). The example here is restricted to 127.0.0.1 but it's easy to adapt to something where it's more unsafe so better not to give the example. ok martijn@
2021-08-10Overlooked a listen_tcp that needed removal in previous commit.Martijn van Duren
This caused listen on tcp lines to fail to parse. OK sthen@
2021-08-10add file missed in previousStuart Henderson
2021-08-10Update to nsd 4.3.7Florian Obser
OK sthen
2021-08-10Simplify and be more concise with the listen on flags description.Martijn van Duren
Suggested by schwarze@
2021-08-10Set the SO_REUSEADDR flag on listening sockets.Martijn van Duren
This way we can have a global listen statement, but add an additional listener on with different flags on specific interfaces (e.g. allow snmpv2c on localhost for easier testing) OK sthen@
2021-08-10Allow "any" to be used as a listen on address.Martijn van Duren
This is a convenient shorthand for listen on 0.0.0.0 listen on :: and was already the default behaviour if no listen on statement is present. This way it's easier to add additional listeners to the default (like trap receivers). Manpage feedback sthen@ schwarze@ Manpage OK jmc@ OK sthen@
2021-08-09Type-O in previous.Martijn van Duren
Diff by jmc@, who can't commit right now. Thanks.
2021-08-09Allow setting the engineid.Martijn van Duren
The previous engineid was based aronud the engine boottime and a random value, which gives problems when sending/receiving unacknowledged PDUs (trapv2) over SNMPv3 with authentication enabled, which need a consistent engineid across restarts to determine the correct user from the sender. The new default engineid takes a sha256 hash (chosen for its longer output) of gethostname(3) and places the first 27 bytes after the new format number 129. This should give us a very low probability of collisions, assuming all machines have a unique name. The other formats as specified in SNMP-FRAMEWORK-MIB (RFC3411) are also supported as well as arbitrary formats in the range 128-255 for other private enterprise numbers in hex format. OK jmatthew@
2021-08-09for extraction, deal with created temp file directly:Marc Espie
- don't adjust the file object, just extract_to_fh - for may_check_digest, explicitly pass the path instead of a file object
2021-08-09add $self->fullname to simplify the cumbersome usual nameMarc Espie
add $self->extract_to_fh, only for IsFile objects, so that they can be written to a temporary file without needing to adjust the file object's name
2021-08-09minor tweaks to make things clearerMarc Espie
- in both extract and tie, $self has the right file names - move the possible creation of the directory into find_safe_dir (passing state as the only parameter, since we have everything else in self), thus getting rid of an XXX should have zero effect on anything
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 00:19:24 +0000