summaryrefslogtreecommitdiff
path: root/usr.sbin
AgeCommit message (Collapse)Author
2021-03-10do not request client certificate unless requiredEric Faurot
issue hit by florian@ diff by jsing@ ok tb@
2021-03-10Expand the maximum length for CHAP challenge to 96 octets. npppdYASUOKA Masahiko
couldn't handle ICCN message which has a ProxyAuthenChallenge AVP longer than 24 octets. Juniper actually send such challenges. Reported and tested by Ryan Freeman.
2021-03-10Fix "phone number" spelling.Patrick Wildt
ok yasuoka@
2021-03-10When adding files from the manifest only the .crl need to be first, afterClaudio Jeker
that the order does not matter so simplify the code and just walk the list twice. Add the .crl first and then in the second round all other files. OK job@
2021-03-09Fix some old phrasing on how to set up a trap handler which aren't correctMartijn van Duren
anymore after moving it from its own subprocess to snmpe. feedback and OK jan@
2021-03-09Early daemons like dhcpleased(8), slaacd(8), unwind(8), resolvd(8)Alexander Bluhm
are started before syslogd(8). This resulted in ugly sendsyslog(2) dropped logs and the real message was lost. Create a temporary stash for log messages within the kernel. It has a limited size of 100 messages, and each message is truncated to 8192 bytes. When the stash is exhausted, the well-known dropped message is generated with a counter. After syslogd(8) has setup everything, it sends a debug line through libc to flush the kernel stash. Then syslogd receives all messages from the kernel before the usual logs. OK deraadt@ visa@
2021-03-08When introducing prefix_eligible() I botched up one if statement.Claudio Jeker
For nexthops it is fine if they point to NULL. This is used in local announcements. Only if they point to a real struct the state must be NEXTHOP_REACH. Bug reported by and OK florian@
2021-03-08Add some references, most of these were removed when we stopped buildingJonathan Gray
and installing USD/SMM/PSD docs. jmc@ agrees with the direction, ok millert@ on an earlier diff
2021-03-07use the mx hostname for sni on outgoing connection, not the reverseEric Faurot
dns for the peer address. spotted by krw@ ok krw@ tb@
2021-03-05Avoid print for NULL pointerjan
The subclass arrays have to be empty. OK deraadt@
2021-03-05Factor out the URI check we do in various places into valid_uri().Claudio Jeker
RRDP will add a bunch more checks so this makes even more sense. With and OK tb@
2021-03-05Factor out the SHA256 hash checks into valid_filehash() so that it canClaudio Jeker
be used by the RRDP code as well. OK tb@
2021-03-05add missing PCI classesjan
OK dlg@
2021-03-05Start porting smtpd to libtls.Eric Faurot
Note that it changes the way SNI works: The certificate to use is now selected by looking at the names found in the certificates themselves, rather than the names of the pki entries in the configuration file. The set of certificates for a tls listener must be defined explicitly by using the pki listener option multiple times. ok tb@
2021-03-05Remove space at end of lineClaudio Jeker
2021-03-05Fix some heap over-read in logging in PPTP protocol handler.YASUOKA Masahiko
2021-03-04Add two error checks for strdup for consistency.Theo Buehler
ok claudio
2021-03-04typo in commentTheo Buehler
2021-03-04Last commit was done from a non-clean tree. Revert one line that brokeClaudio Jeker
everything. Oups.
2021-03-04Unify the out of memory errors here as well.Claudio Jeker
2021-03-04Use the same way to error out in out of memory situation.Claudio Jeker
Just use 'err(1, NULL);' there is no need to include the type of function that failed since it is still impossible to locate the right call. Just use a debugger in that case. OK tb@ deraadt@
2021-03-04an -> andTheo Buehler
2021-03-04zap whitespace on three linesTheo Buehler
2021-03-04Replace NOTREACHED with actuall errx() calls. I managed to return fromClaudio Jeker
the proc_xyz() function at least in two occastions and it is not that trivial to realize what goes wrong.
2021-03-04Remove NOTREACHED marker, it should be obvious when the code is:Claudio Jeker
exit(rc); /* NOTREACHED */
2021-03-04Simply ignore errors from tls_close(). ftp(1) does the same and it seemsClaudio Jeker
too many servers out there fail to properly close the TLS session which results in unneccessary warnings like TLS close: EOF without close notify Result of a discussion with job@ and tb@
2021-03-04Implement a https client as a sub-process for rpki-client. This code willClaudio Jeker
be used to fetch TA certs and later on for RRDP. Kind of unreached for now since the default TAL files don't include https URI. The http client is fully asynchronous and can handle multiple downloads at the same time. This code was based on the http client in ftp(1). OK tb@, job@
2021-03-03off by one in array bounds testsJonathan Gray
ok mlarkin@
2021-03-02finish GC old unintuitive interfaceMarc Espie
now handle_continue and find_window_size are fully separated.
2021-03-02Introduce 'rde evaluate all' a mode to work around path hiding in IXPClaudio Jeker
route-server environments. By default only the best path is sent to peers and if that path is filtered then the path is hidden for that peer. On route-servers this is sometimes not desried. For this 'rde evaluate all' will cause the evaluation process to fall back to alternate routes and will redistribute the first non-filtered path to the peer. This is very similar to per-peer RIBs but accomplishes the same effect without the massive increase in memory usage. Compared to the default mode this requires more CPU resources but it is probably less than what per-peer RIBs would require. 'rde evaluate all' can be set and reset globally, on groups and on idividual neighbors. It is not limited to route-server configs but route loops are possible if not properly used. OK benno@
2021-03-02There is no longer the need to mkpathat(), the main process runs now fromClaudio Jeker
the cachedir.
2021-03-02Open both the cachedir and outputdir early and use fchdir(2) toClaudio Jeker
switch between the two. OK deraadt@ job@
2021-03-02When building the chain of the intermediate certificates do not include theClaudio Jeker
root node (which should be a trust anchor). Trust anchors where added to the X509_store and having them in the chain is kind of wrong and confuse the new libressl X509 validator. OK tb@
2021-03-02remove ts_print() prototype function was removed in rev 1.100Jonathan Gray
2021-03-02remove uneeded md5.h includeJonathan Gray
ok florian@
2021-03-02don't read past the end of an arrayJonathan Gray
ok mvs@ mlarkin@
2021-03-02off by one in bounds testJonathan Gray
ok sthen@ millert@
2021-03-01Document veb(4) supportkn
Feedback jmc OK dlg
2021-03-01allocate enough space in start_child() argv for all possible flagsJonathan Gray
ok claudio@
2021-03-01off by one in bounds testJonathan Gray
ok florian@
2021-03-01off by one in bounds testJonathan Gray
ok claudio@
2021-02-28add veb(4) to the list of supported bridges/switches you can configure.David Gwynne
tested by josh rickmar ok kn@
2021-02-27Path #defines are traditionally prefixed with _PATH.Florian Obser
Pointed out by deraadt
2021-02-27Path #defines are traditionally prefixed with _PATH.Florian Obser
Pointed out by deraadt
2021-02-27Path #defines are traditionally prefixed with _PATH.Florian Obser
pointed out by deraadt
2021-02-27Path #defines are traditionally prefixed with _PATH.Florian Obser
pointed out by deraadt
2021-02-27Add logger(1) support for daemons that are logging to stdout/stderr (mostly fromAntoine Jacoutot
the go ecosystem). Properly handle failing daemon startup now that we have pipefail. To take advantage of this new feature, just add foo_logger=facility to the daemon rc.d(8) script or in rc.conf.local(8) or use rcctl: rcctl set foo logger daemon.info tweak for checking flags in rcctl(8) from martijn@ "this looks pretty good" deraadt@ ok sthen@
2021-02-27It is perfectly fine to POLLIN and POLLOUT at the same time. It mayClaudio Jeker
actually make things a bit faster. OK deraadt@
2021-02-26Hook up dhcpleased to the build.Florian Obser
OK deraadt
2021-02-26Import dhcpleased(8) - a dhcp daemon to acquire IPv4 address leasesFlorian Obser
from servers. dhcpleased(8) follows the well known three process design of all our privsep daemons. It uses pledge(2) and unveil(2) to restrict access further. In particular the "engine" process, responsible for parsing of untrusted data, is pledge'd "stdio". It cannot access the outside world nor the filesystem at all. Like slaacd(8) for IPv6 it will be always running and acquire addresses for all interface with the autoconf4 flag set. The flag can be set by "ifconfig $if inet autoconf" or by adding "inet autoconf" to /etc/hostname.if. An existing "dhcp" line should be removed. Various iterations tested by deraadt@ The hardest part, finding a name, was handled by jmatthew@ & otto@ "get to it :)" deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-29 07:32:56 +0000