IABSD.fr/src/usr.sbin
Branch :
Log
| Author | Commit | Date | CI | Message |
|---|---|---|---|---|
 |
b331eacb | 2023-03-04 12:02:07 | expand Nd (missed in previous); ok claudio | |
 |
bb47adf3 | 2023-03-03 16:19:05 | In filemode, print the certification path towards the Trust Anchor with and OK tb@ | |
 |
9183674a | 2023-03-03 13:03:29 | Use EXTRACT_16BITS() in default_print() instead of handrolling it. OK bluhm@ | |
|
328c3f4b | 2023-03-02 17:09:52 | improve the Nd lines such that the format is consistent for the various *d, *conf, *ctl files (where relevant) and simple; also makes "man -k routing" more useful; help from claudio and florian ok claudio florian millert | |
 |
b1668e29 | 2023-03-01 17:27:45 | Bogus full stop. | |
|
12bf74e7 | 2023-03-01 08:17:53 | Change fatal() to fatalx() since the errno has no meaning here. OK tb@ | |
|
93343522 | 2023-03-01 08:15:58 | KNF, no functional change. | |
|
2b7cc9f7 | 2023-02-28 10:04:50 | Adjust default_print() to not run over snapend. Kill default_print_unaligned() and adjust default_print() to also work with unaligned buffers. There is no need for two functions doing the same thing. Pass the right length in nsh_print to default_print(). Fixes on place that makes tcpdump crash. Reported by Peter J. Philipp (pjp at delphinusdns dot org) OK mbuhl@ | |
 |
6fd959f8 | 2023-02-23 13:06:42 | rpki-client: simplify parse_load_crl_from_mft() Now that we always inspect both locations if necessary, we can do away with the loop and simply have the only caller call twice. Removes a bunch of clever complexity and streamlines the code quite a bit. ok claudio job | |
|
e038f1a1 | 2023-02-23 09:50:40 | When parsing MFT the CRL referenced by the MFT is loaded and verified at the same time. So in case of a valid crl pass the CRL filename as entity message to the parent process together with the MFT. This way the MFT and CRL end up both in the valid cache even if some files in the MFT are missing. On severe errors (like X.509 verify errors) the CRL is not moved since it is not considered valid. With and OK job@, tb@ | |
 |
501909c0 | 2023-02-22 10:04:45 | Explicitly initialize vmd_vm pointer with NULL before calling vm_register. Found by codechecker. ok dv@ | |
|
a4968bd9 | 2023-02-21 17:06:52 | rpki-client: refactor manifest/crl parsing a bit Now that we always try to load the CRL from both locations, we can deal with loading the DER directly in proc_parser_mft_pre(), so shuffle the code around to accomplish that. This should make an upcoming diff by claudio a bit simpler. ok claudio | |
|
fcd50198 | 2023-02-21 15:45:40 | spelling. ok jmc | |
|
061a04ee | 2023-02-21 11:13:05 | Check all possible storage areas for a matching CRL This change makes proc_parser_mft_pre() -> parse_load_crl_from_mft() search in both DIR_TEMP and DIR_VALID for a CRL with a matching SHA256 hash, increasing our chances of constructing a full publication point. With and OK tb@ claudio@ | |
|
797cceee | 2023-02-21 10:18:47 | rpki-client: ensure there is no trailing garbage in signed objects The d2i functions are designed in such a way that the caller is responsible to check if the entire buffer was consumed. Add checks on deserializing a signed object to ensure the entire file has been consumed. Reject the file if it has trailing garbage. found by & ok job, ok claudio | |
 |
9588f088 | 2023-02-19 17:10:38 | describe what qcow2 is, in sufficient simple terms | |
|
22e084e1 | 2023-02-17 14:52:06 | Update AUTHORS section | |
|
22998c80 | 2023-02-17 13:26:18 | Use %R technical report macro for RFCs | |
|
19a20c11 | 2023-02-16 20:33:07 | - remove a leftover .El - escape "An" as this is also a macro | |
|
5e8a8b88 | 2023-02-16 20:06:15 | Update references in STANDARDS section to use Rs blocks Also drop largely irrelevant references like IPv6 and CIDR (as we didn't reference IPv4 either), remove obsoleted RFCs and add their successors. | |
|
bcf2dfa5 | 2023-02-16 14:34:34 | Revert r1.63. GEN_OTHERNAME is the type of a GENERAL_NAMES, not of a DIST_POINT_NAME, which needs naked numbers as there is no enum nor defines describing it. claudio agrees | |
|
c1d2420b | 2023-02-16 14:25:27 | Add missing RFC 6487 section 4.8.6 CRLDP compliance checks OK tb@ claudio@ | |
|
cc072802 | 2023-02-16 04:07:33 | explain why ARIN TAL is not included. ok job | |
 |
75837956 | 2023-02-16 03:09:33 | remove the '(R)' from the intel cpu match pattern Intel(R) does not appear in cpu0: Intel Atom(R) x6425RE Processor @ 1.90GHz, 1895.90 MHz, 06-96-01 reported by patrick@ ok deraadt@ | |
 |
c1868907 | 2023-02-15 20:44:01 | proc_ispeer() is not used anywhere anymore so remove it everywhere. ok florian@ bluhm@ ok for vmd mlarkin@ | |
|
69592b47 | 2023-02-14 15:37:45 | When initalizing a new peer, wait an extra 5 seconds before connecting eo the remote end. With this the RDE has a chance to finish config reload before the session to a new peer is established. OK tb@ | |
|
fd932e23 | 2023-02-14 15:33:46 | No longer wait for the RTR process to finish the config reload before sending the IMSG_RECONF_DONE message to the RDE. The RDE does not depend on the RTR config reload (in contrast to the SE). The ROA / ASPA reload is async from the RDE config reload. OK tb@ | |
|
988ba0ba | 2023-02-13 18:07:53 | Pass struct rib_entry to rde_generate_updates() instead of struct rib. With this the newbest and oldbest arguments can go since the infromation is part of the rib_entry. Especially the prefix in the rib_entry is always valid so simplify some code in various functions below to use this information. OK tb@ | |
|
a2b6ec13 | 2023-02-11 08:50:43 | Refactor common code of the 3 up_generate functions into up_process_prefix() Simplifies up_generate_updates(), up_generate_addpath() and up_generate_addpath_all() a fair bit. OK tb@ | |
|
c6749b32 | 2023-02-09 22:50:07 | Use GEN_OTHERNAME instead of hardcoding 0 discussed with job | |
|
82625ff8 | 2023-02-09 13:43:23 | Instead of relaying struct peer from the SE to the RDE to fill out 10 stat numbers, just send the peerid and have the RDE response with the stats. The control code will then merge these counters into the real peer struct and send that to bgpctl. This reduces the number of bytes sent around a fair bit. OK tb@ | |
|
04fee684 | 2023-02-08 08:20:53 | usr.sbin: missing void to appease clang 15's -Wstrict-prototype. | |
 |
1e8eabf2 | 2023-02-06 20:33:34 | vmd(8): scan pci bus to determine bootorder strings. vmd's SeaBIOS bootorder strings had hardcoded pci device ids, so if a user added a network interface the bootorder strings didn't line up with reality. Using vmctl(8) to boot from a cdrom (-B cdrom) would fail, for instance, if attaching both a nic and a disk as well. This change scans the pci devices and finds the first of each type to construct viable bootorder strings. ok jan@ | |
 |
f748277e | 2023-02-06 18:35:52 | smtpd(8) could abort due to a connection from a local, scoped ipv6 address. avoid using inet_pton(3) which doesn't support scoped ipv6 address, and use getaddrinfo(3) instead of. ok millert@ florian@ kn@ | |
 |
8aa0c375 | 2023-02-06 18:14:10 | Accept netstat-style address.port syntax too. OK bluhm@ deraadt@ jmc@ | |
|
3fe2f2e6 | 2023-02-03 17:43:25 | Add void to conn_close_any() This makes the function definition match the prototype and silences a clang-15 warning. | |
|
a35a1b73 | 2023-02-03 15:51:09 | add missing ".It Xo" in previous; | |
|
600dedbf | 2023-02-03 10:10:36 | Add ASPA support to bgpctl FastCGI server OK tb@ claudio@ | |
|
d62638d7 | 2023-02-02 20:31:37 | Emit log messages in consistent format | |
|
9a717891 | 2023-02-02 19:23:01 | Fix typo | |
 |
b74ab850 | 2023-02-02 09:34:17 | Deny "pipex no" tunnel setting for pppx(4) interfaces. They are useless with disabled pipex(4), because in such case npppd(8) successfully establishes connection, but doesn't create corresponding interface, so the traffic doesn't flow. This is not applicable for pppac(4) interfaces, they work with disabled pipex(4). ok yasuoka@ | |
|
2b195b86 | 2023-02-01 15:37:34 | Fix spelling | |
|
2ced3cdb | 2023-01-31 17:14:27 | Not only reset the connection when a fatal error is received (or sent) but also reset the cache and start totally fresh. The RFC is exceptionally vague about error handling but in most cases the cache state is enough off after an error that a fresh restart makes most sense. With and OK job@ | |
|
81be598d | 2023-01-31 14:38:43 | Fix RTR error reporting: length fields in Error Reports are 32 bits OK claudio@ | |
|
e2760038 | 2023-01-31 14:32:43 | Improve whitespace alignment of RTR error reports OK claudio@ | |
|
2a7454b2 | 2023-01-30 21:43:12 | vmd(8): fix an interrupt storm in ns8250. On slower hosts, such as those in a nested virtualization scenario of OpenBSD guest inside OpenBSD atop Linux KVM, ns8250 can cause a race between the kevent firing and the vcpu being kicked by an assert/deassert of the irq. The end user experiences a "stuck" serial console and the host will see a vmd process peg the cpu. This change only toggles the irq if we were in a position of being ready to receive data on the device so while the kevent might continuously fire, the vcpu will not be kicked repeatedly. OK mlarkin@ | |
|
5aca612e | 2023-01-30 16:53:24 | Same parseextvalue() change as in parse.y rev 1.441 Use 2-byte ASnum encoding as a default when local-as/neighbor-as is used. | |
|
b2402ebb | 2023-01-30 16:51:34 | Alter the way extended communities are matched when part of the value is auto-expanded or masked off. Try to match against both 2- and 4-byte AS encoding and on insertion check if expansion is actually possible and deny communities where both community values are > USHRT_MAX. OK tb@ | |
|
d489aa7e | 2023-01-28 14:40:53 | Move some header definitions from vmm(4) to vmd(8). Part of an ongoing effort to move userland-specific information out of a kernel header and directly into vmd(8). No functional change. ok mlarkin@ | |
 |
9356e752 | 2023-01-25 13:25:07 | change naming convention for the lru "save history" cache, so that ports like "lang/chicken/core" do generate files like lang.chicken.core.lru instead of lang.chicken.core (which can create confusion in people's mind) do so transparently by reading the old file if need be, and removing it afterwards. Funny thing noticed by tb@ ok tb@, sthen@ | |
|
6ac17ef2 | 2023-01-24 15:52:46 | Add ASPA to STANDARDS section | |
|
29100734 | 2023-01-24 15:50:10 | Fix typo | |
|
bfee927a | 2023-01-24 14:14:15 | Implmement `bgpctl show rib avs invalid` and firends. This will show all invalid ASPA paths. OK tb@ | |
|
060f4cb2 | 2023-01-24 14:13:11 | Implement filter and control message matching for ASAP. This adds avs (ASPA validation state) which can be 'unknown', 'valid' or 'invalid'. It behaves similar to ovs but the ASPA validation state of paths from iBGP sessions is 'unknown' and the role of the ebgp session is important to get the right validation state. OK tb@ | |
|
50d35cac | 2023-01-24 11:29:34 | Print the ASPA validation state (avs) in various show rib outputs. OK tb@ | |
|
f8fade75 | 2023-01-24 11:28:41 | Implement ASPA validation and reload logic on ASPA set changes. For this use the validation state (vstate) in struct prefix and struct filterstate to store both the ASPA and ROA validity. Introduce helper functions to set and get the various states for struct prefix and make sure struct filterstate is also setup properly. Change the ASPA state in rde_aspath to be AFI/AID and role independent by storing all 4 possible outcomes. Also add a ASPA generation count which is used to update the rde_aspath ASPA state cache on reloads. Rework the rde_aspa.c code to be AFI/AID and role independent. Doing this for roles is trivial but AFI switch goes deep and is so unnecessary. The reload is combined with the ROA reload logic and renamed to RPKI softreload. OK tb@ | |
|
9843e5d8 | 2023-01-24 01:40:22 | match unknown ATI display devices as amdgpu in fw_update For recent devices amdgpu matches via the hardware ip discovery table, not with a table of pci vendor and product ids. So amdgpu_devlist.h and pcidevs do not cover all devices that amdgpu may match. in dmesg amdgpu with an unknown product takes the form: ramdisk kernel, bios/mbr: vga1 at pci12 dev 0 function 0 vendor "ATI", unknown product 0x687f rev 0xc3 ramdisk kernel, efi or non-x86 arch: vendor "ATI", unknown product 0x687f (class display subclass VGA, rev 0x03) at pci12 dev 0 function 0 not configured non-ramdisk kernel: amdgpu0 at pci12 dev 0 function 0 vendor "ATI", unknown product 0x687f rev 0xc3 ok deraadt@ on an earlier version | |
|
10ccde23 | 2023-01-22 22:18:40 | vmd(8): don't remove known vm's from the config on error. Multiple error paths, specifically the one related to if a guest cannot allocate memory at start, resulted in a known vm (via vm.conf(5)) being removed from the vm list. Adjust the error paths to check if the failing vm is defined in the config before tearing it down. Tested with help from beck@ and Mischa Peters. ok beck@ | |
 |
4493dc29 | 2023-01-20 17:15:22 | Sync usage with SYNOPSIS, mention that -x may use stdout Feedback from jmc and Crystal Kolipe OK jmc | |
|
83abafdc | 2023-01-20 15:42:34 | Remove 'allow' from aspa-set provider-set lists. That keyword is no longer needed. OK tb@ | |
|
f611db80 | 2023-01-20 15:41:33 | Document the aspa-set table. While there remove the superfluous 'allow' keyword. OK tb@ | |
|
81f73015 | 2023-01-20 10:30:41 | comma space not space comma | |
|
8fb62f1c | 2023-01-20 10:28:22 | Bad indent | |
|
7b77ed1e | 2023-01-20 09:54:43 | remove extra tab | |
|
bebffd5a | 2023-01-18 18:12:20 | Require version 4 UUIDs as RRDP session IDs OK tb@ | |
|
c85bce7b | 2023-01-18 17:40:17 | Use the vstate of the filterstate struct instead of passing an extra copy to the various prefix update functions. While there fix a filterstate leak in up_generate_updates(). With and OK tb@ | |
|
86c75b53 | 2023-01-18 13:20:00 | Improve pending checks in poll loop by ordering them by trigger frequency and by making peer_imsg_pending() a true O(1) function. OK tb@ | |
|
7b8866bb | 2023-01-18 10:13:46 | The default output format is -o (openbgpd) but it now includes both roa-set and aspa-set by default. So make the man page less specific. OK tb@ job@ kn@ | |
|
bc7ae01a | 2023-01-18 00:27:10 | rpki-client: explicitly enable policy checks In x509_verify.c r1.62, beck disabled policy checks by default in the new X.509 verifier to match the behavior of the legacy validator and OpenSSL. In order to keep policy checks as mandated by RFC 7318, we need to opt into them explicitly. ok beck | |
|
c4f772fd | 2023-01-17 16:09:34 | Teach bgpctl about ASPA tables. OK tb@ | |
|
d7e93531 | 2023-01-17 16:09:01 | Add the needed logic to load the ASPA table from the rtr process into the RDE. The actual reload logic is missing to keep the diff small. OK tb@ | |
|
7a579a5a | 2023-01-16 22:59:41 | Enable softraid(4) support in installboot(8) riscv64 efiboot already supports booting from softraid volumes. These installboot bits make sure that the boot loader will be installed on chunk devices rather than the volume for root on softraid installations, i.e. full boot support for riscv64, just like amd64, arm64 and sparc64. regress is happy. OK kettenis | |
|
d7214ab1 | 2023-01-16 10:37:08 | Fix bad MP logic in the route refresh handling. Found by and fix provided by Zenon Mousmoulas (@zmousm) | |
|
2748f5e2 | 2023-01-14 20:55:55 | Only open /dev/vmm once in vmd(8). Have the parent process open /dev/vmm and send the fd to the vmm child process. Only the vmm process and its resulting children (guest vms) need it for ioctl calls. ok kn@ | |
|
acb55ac2 | 2023-01-13 08:58:36 | Add aspa-set to openbgpd config output. Change the way the validated ASPA tree is built since OpenBGPD config follows more the ASPA profile and puts the optional AFI to each provider ASnum instead of duplicated everything into an IPv4 and IPv6 tree. The JSON output of ASPA is still the same. The inclusion of the aspa-set can currently be disabled by the -A flag. OK tb@ | |
|
977f29ed | 2023-01-12 17:35:51 | Split rde_filterstate_prep() into three functions. - rde_filterstate_init(): initialize a filterstate to default values - rde_filterstate_copy(): copy from a filterstate into a new state object - rde_filterstate_prep(): set filtersate based on prefix passed as argument. This makes the code a bit easier to read. OK tb@ | |
|
245e5d07 | 2023-01-11 17:10:25 | Add the validation state to the filterstate struct. Removes vstate argument from rde_filter(). Rename prefix_vstate() to prefix_roa_vstate(). OK tb@ | |
|
28d66047 | 2023-01-11 13:53:17 | Add ASPA validation functions to the RDE. This implements ASPA validation based on the current draft. Implementing this showed various weaknesses in the current ASPA draft which I hope to fix in the near future. Unlike the algorithm specified in the draft our version validates the AS_PATH attribute in a single path doing one or two lookups depending on the sessions BGP role. The code is not yet hooked up into the RDE (see the NOTYET blocks). Missing are reload logic, bgpctl integration and the loading of the merged ASPA set from the rtr process. OK tb@ | |
|
cc6f004e | 2023-01-10 13:26:34 | Improve timestamp printing in filemode OK claudio@ | |
|
ad00e8c1 | 2023-01-08 19:57:17 | vmd(8): add thread names to vm process. ok guenther@. | |
 |
98dbb30e | 2023-01-07 06:40:21 | The maximum length of the value is extended to 64k bytes. ok yasuoka | |
|
39c0924a | 2023-01-06 16:06:43 | Rework the main <-> parser/filemode communication protocol a bit. Swap repo_id and filename to simplify the code in parser.c. In filemode both repo_id and filename are ignored. Additionally do not errx() in case of unknown file types. Instead send back enough info that the code can move on. OK tb@ | |
|
81b1a5f5 | 2023-01-06 13:26:57 | sync with rpki-client 'more dastardly white spaces' commit | |
|
796ad6a2 | 2023-01-06 13:22:00 | more dastardly white spaces | |
|
9903d06f | 2023-01-06 13:19:43 | Zap trailing tabs | |
|
f49178b1 | 2023-01-04 16:51:34 | Print RRDP serial + ID if nothing changed OK tb@ | |
|
e4453397 | 2023-01-04 14:42:46 | Christos Zoulas removed his name from advertising clauses and copyrights of some files in NetBSD. Make the same changes here. https://mail-index.netbsd.org/source-changes/2017/06/03/msg084953.html https://mail-index.netbsd.org/source-changes/2017/06/03/msg084955.html https://mail-index.netbsd.org/source-changes/2019/12/02/msg111431.html https://mail-index.netbsd.org/source-changes/2019/12/02/msg111432.html | |
|
c0c94bcc | 2023-01-04 14:33:30 | Add a per eBGP session role to the config. This somewhat replaces the RFC 9234 open policy role. This is done because ASPA requires the same role to be present to properly validate paths. For iBGP sessions the role is forced to ROLE_NONE. If no role is set on an ebgp session then 'announce policy' is forced to 'no'. Also make sure the the role capability is only added if the role is set. OK tb@ | |
|
45735add | 2023-01-04 14:22:43 | Validate the session_id to be a real UUID. RFC 8182 requires the session_id to be a version 4 random UUID (using variant 1). Now checking the version and variant is currently disabled because there is at least one CA with a session_id that is all random and therefor the version check triggers there. Joint work with job@. OK job@, tb@ | |
|
893695ce | 2023-01-04 13:00:11 | Christos Zoulas agreed to rescind clause 3 and 4 in NetBSD fsck.8 rev 1.35 fsutil.h rev 1.14 pathnames.h rev 1.2 netgroup_mkdb.8 rev 1.9 netgroup_mkdb.c rev 1.18 str.c rev 1.7 str.h rev 1.4 rdate.8 rev 1.11 rdate.c rev 1.19 extern.h rev 1.14 getnetgrent.c rev 1.41 netgroup.h rev 1.10 fparseln.3 rev 1.4 fparseln.c rev 1.10 our stringlist.c/stringlist.h are derived from getnetgrent.c rfc868time.c from rdate.c newfs/pathnames.h from fsck/pathnames.h https://mail-index.netbsd.org/source-changes/2009/10/21/msg002182.html Not all files are covered as some had copyright assigned to TNF in 1998. | |
|
f2b1f729 | 2023-01-04 02:19:19 | Typos in vmd error message. No functional change. | |
|
7a023eeb | 2023-01-03 20:58:05 | do not mention dhclient as a dhcp route message sender | |
|
f5209848 | 2023-01-03 18:19:12 | Print the RRDP Session ID and Serial in verbose mode OK tb@ claudio@ | |
 |
a2316026 | 2022-12-30 18:47:45 | accton.c: add missing $OpenBSD$ tag | |
|
b2767518 | 2022-12-28 21:38:29 | {en,de}queing -> {en,de}queuing; from paul tagliamonte | |
|
3a50f0a9 | 2022-12-28 21:30:15 | spelling fixes; from paul tagliamonte any parts of his diff not taken are noted on tech | |
|
20ec15d6 | 2022-12-28 20:56:37 | iostat(8): implement periodic display with setitimer(2) Prefer setitimer(2)+sigsuspend(2) to nanosleep(2) when performing periodic work. The latter drifts. Link: https://marc.info/?l=openbsd-tech&m=167068674625838&w=2 ok millert@ | |
|
31947c16 | 2022-12-28 13:21:11 | style(9) for includes | |
|
d313d8cd | 2022-12-28 12:16:35 | Properly ignore comments in geofeed files Do not consider comments and whitespace leading up to a comment as part of the line. ok claudio job | |
|
f96c94aa | 2022-12-27 17:05:38 | Adjust handling of the RFC 9234 role capability for ibgp sessions: - Exclude the role capability on ibgp sessions when sending an OPEN - Warn when a role capability is received on an iBGP session - Make sure the capability negotiation is skipped for ibgp sessions, this in turn disables the role capability on the session. OK tb@ |