IABSD.fr/src/etc
Branch :
Log
| Author | Commit | Date | CI | Message |
|---|---|---|---|---|
 |
a03fa7cf | 2024-01-04 09:51:49 | Import regenerated moduli. | |
 |
e006e8e6 | 2023-12-31 16:05:50 | Increase datasize to 1536 MB for running llvm-tblgen on i386. Fixes build in src/gnu/usr.bin/clang/include/llvm/AMDGPU. OK semarie@ | |
 |
49a7a16f | 2023-12-26 13:36:18 | Align the other RIRs with the recent clarifications from AFRINIC Following https://lists.afrinic.net/pipermail/dbwg/2023-December/000496.html Simply apply the inverse of 'afrinic.constraints' r1.2 to the other RIR files (since no resources can be transferred from AFRINIC to any other RIRs). OK tb@ | |
|
5568aeed | 2023-12-19 08:10:19 | Add markers OK tb@ | |
 |
654e8744 | 2023-12-15 16:59:48 | Run non-daemons services in a different process group to avoid SIGHUP at boot 12 factors apps and similar don't daemonize and are thus vulnerable to receiving a SIGHUP signal at the end of /etc/rc. Shield them by running them in a different process group. Do this only for services that need rc_bg=Yes, as suggested by ajacoutot@ There have been several reports about this issue in the past years, the last one being from edd@ who successfully tested this fix. Input from several folks, ok sthen@ ajacoutot@ | |
 |
592bd543 | 2023-12-15 10:17:40 | Sync limits with octeon. | |
|
0b77ea89 | 2023-12-14 12:26:03 | Constrain the AFRINIC TA further Today AFRINIC clarified its actual current resource holdings by issuing a new CA certificate in response to a report on overclaiming: https://lists.afrinic.net/pipermail/dbwg/2023-December/000496.html OK tb@ | |
|
b44517b3 | 2023-12-14 09:13:00 | For historical reasons, APNIC ended up with a v6 block for IX assignments carved out of a larger block assigned to RIPE NCC OK tb@ | |
|
668419e1 | 2023-12-13 11:34:56 | Impose constraints on RPKI Trust Anchors See https://datatracker.ietf.org/doc/html/draft-snijders-constraining-rpki-trust-anchors for more information. Tested for a few months. OK tb@ claudio@ | |
 |
615efeaf | 2023-12-11 19:52:40 | Synchronize datasize-cur limit for staff with the default class. ok deraadt@, millert@, phessler@ | |
 |
9e8ee861 | 2023-12-07 14:53:31 | add services entries for Matter, a protocol for discovery and comms with "smart home"/IoT devices, which runs over TCP or UDP over v6 over various physical/network layers (Ethernet, Wifi, or low power lossy radio-based networks like Thread). req by Jordan Williams ok deraadt https://csa-iot.org/wp-content/uploads/2022/11/22-27349-001_Matter-1.0-Core-Specification.pdf | |
 |
7217bca9 | 2023-11-16 16:05:13 | Use tset -I for all terminals, not just xterm. Terminal initialization is usually only needed for hardware terminals, which are rare these days, and the initialization strings result in a bunch of extra newlines on pseudo-terminals. OK nicm@ | |
|
8a9450e5 | 2023-11-16 16:03:51 | Use tset -I for all terminals, not just xterm. Terminal initialization is usually only needed for hardware terminals, which are rare these days, and the initialization strings result in a bunch of extra newlines on pseudo-terminals. OK nicm@ | |
 |
66fa2bb9 | 2023-11-16 13:47:42 | crank some limits because clang is a piggy | |
 |
0a0902a1 | 2023-11-14 21:31:01 | Bump powerpc64 default datasize to 1536M This is for llvm 16; powerpc64 (like some other platforms) needs a higher datasize limit to build base-clang 16. ok jca@ | |
 |
60955c03 | 2023-11-14 12:48:46 | increase datasize to 1536M for the default login class needed to build llvm-16 gnu/usr.bin/clang/include/llvm/AMDGPU ok jca@ | |
|
609421e2 | 2023-11-13 20:19:45 | raise i386's datasize for 'daemon' class so that relinking libc at boot doesn't fail - new clang is even greedier than the old one. I picked the value 1500M out of the air, it works for me but could perhaps be finessed downwards a bit. (I'm also using 1500M for make build / mkr+mkrx on i386; make -j8 build is no longer a good idea on i386 ;) | |
|
62af4917 | 2023-11-13 11:33:52 | Bump datasize for staff to match amd64 Suggested by jsing@, ok tb@ | |
|
0f9e8641 | 2023-11-12 23:50:57 | Bump datasize for the default login class, needed to build clang-16 | |
|
2585fc0d | 2023-11-12 23:15:56 | Also bump the default limit on riscv64 Reported by jsing@ | |
 |
ed371cb1 | 2023-11-12 14:41:41 | bump datasize to 1536M for the default login class to allow the build user to generate the AMDGPU includes in llvm-16 discussed with deraadt@ | |
|
a535e1e0 | 2023-11-05 16:27:18 | Add cdXX.iso to MDEXT, for it to be included in SHA256; reported by `petcat30' on bugs@. | |
 |
f71e4cb7 | 2023-10-29 11:27:11 | Unmention/don't explain SSL, drop 9y old "ssl" keyword/deprecation warning Switch "ssl" to "tls" in relayd.conf(5) if you haven't done so in the last ten years, "ssl" is now an error. Say "TLS" not "SSL/TLS" and drop the primer in the TLS RELAYS section. OK benno | |
 |
5fa8c77c | 2023-10-26 19:28:30 | do not create /usr/local/share/nls and subdirectories by default The share/nls/<locale> paths are unused. ok miod@ deraadt@ | |
|
86ed9ec7 | 2023-10-25 05:38:08 | Import regenerated moduli. | |
|
649efdcf | 2023-10-08 14:05:10 | move release a earlier. when we wait for security fixes from one piece of software, another one will announce that we should wait for a security fix. the only winning move is not to play. | |
|
38371caa | 2023-10-02 13:26:04 | maybe a bit earlier | |
|
b6013e36 | 2023-10-01 20:15:23 | show fingerprint of freshly generated ssh host key on first boot Print to the console the fingerprint of a newly generated ssh host key of the preferred type (currently ED25519), typically when booting for the first time. This simplifies a secure first ssh connection to a freshly installed machine. ok deraadt@ kn@, and various for earlier iterations | |
 |
63d1ec24 | 2023-09-27 10:49:21 | Match GRACEFUL_SHUTDOWN only from ebgp sessions as specified by RFC8326 Section 4.1. OK sthen@ phessler@ job@ | |
 |
2e635c6e | 2023-09-24 06:09:35 | Strip realm part for bsdauth. This is required and an exmaple usage of new radius_standard module. | |
|
fdd80b35 | 2023-09-19 15:02:54 | etc: drop vestiges of obsolete DSA ssh host keys It has been 8 years since DSA keys were disabled by default for ssh/sshd, and 15 months since ssh-keygen -A belatedly stopped generating DSA host keys. ok semarie@ deraadt@ | |
 |
13e62e96 | 2023-09-18 14:44:21 | match style used in revision 1.16 of src/etc/examples/radiusd.conf ok yasuoka@ | |
|
4a0a51f8 | 2023-09-18 13:16:13 | crank to 7.4-beta | |
|
d9148028 | 2023-09-16 18:06:26 | add 7.5 syspatch key | |
|
096789ee | 2023-09-16 13:28:39 | 7.5 packages key | |
|
781f2a15 | 2023-09-16 11:45:03 | add 7.5 firmware key | |
|
4a276a0d | 2023-08-18 06:45:15 | Tweak radiusd.conf example. input from an anonymous user. | |
 |
b669b6ec | 2023-06-22 15:20:16 | Add machdep.lidaction example. We support this on arm64 laptops now. From Jan Stary Ok patrick@ | |
|
1105dba7 | 2023-06-19 13:05:25 | The group "operator" gatekeeps a few superuser abilities (dumping disks, manipulating tape drives -> means gid operator on device nodes). This group is also used with group-access bit on the setuid-root shutdown command (mode ug+x,u+s). Some people use this to shutdown/reboot their machines, but use of that group is giving them disk read access also, which is wrong. It would be a pain to re-gid all the device nodes, so instead let's renumber the operator execution gid into group "_shutdown". Users using this shutdown/reboot functionality will notice it no longer works, and move themselves to the correct group. Various choices discussed at large, this seems our best choice. ok sthen | |
|
d1aec814 | 2023-06-09 15:31:44 | we always create keys 2 releases into the future | |
|
d0dc268b | 2023-05-25 09:41:46 | After RFC 9110, the IANA services registry now lists both udp and tcp for https (HTTP/3 over QUIC). Add it to /etc/services so that it's included when /etc/rc populates sysctl net.inet.udp.baddynamic. suggested by Renauld Allard, ok tb@ | |
 |
34982bd4 | 2023-05-10 07:34:57 | Add a hint on using letsencrypt-staging for testing While florian rightly points out that this is likely to be overlooked, it may help someone. Also doesn't affect the adjust-config-with-sed-ability of the example file after input by a few. no objection florian ok espie millert | |
|
01f22c7e | 2023-05-01 08:57:29 | Import regenerated moduli. | |
 |
6fcd0d88 | 2023-04-26 14:28:09 | During boot we have a protective and restrictive pf ruleset during the time we are running netstart, and then load the pf.conf ruleset after all of the interfaces are loaded. Allow in and out IPv6 neighbor advertisement traffic without state during that time. suggestions/OK from saschan@ OK sthen@ kn@ florian@ deraadt@ | |
|
53e6d92c | 2023-04-24 16:36:54 | add default tmux config; ok sthen | |
 |
8214c829 | 2023-04-21 14:09:52 | Delete incomplete and unreferenced 'miniroot' entries from arm64 and macppc disktab. | |
|
cec6811b | 2023-04-19 11:20:03 | Remove obsolete/unused disktab entries for install media that are no longer built. ok miod@ | |
 |
9cc4dd68 | 2023-04-18 08:50:37 | changelist: remove dhclient(8) files as currently dhclient(8) is a (sort of) alias to "ifconfig inet autoconf", these files aren't used anymore. ok tb@ | |
|
34c8bf7e | 2023-04-18 08:48:17 | changelist: add unbound-control files ok tb@ | |
 |
9b501007 | 2023-04-16 07:16:58 | Add /etc/mixerctl.conf to changelist(5). ok deraadt@ kn@ semarie@ | |
|
73812c34 | 2023-03-25 15:07:19 | things will be ready a bit earlier | |
|
db2c8214 | 2023-03-25 00:09:51 | correct day of week | |
|
106086b7 | 2023-03-15 19:54:32 | slightly earlier, and tweak some dates | |
|
aac8e53e | 2023-03-07 16:41:08 | Nuke pointless 'pb#N:ob#0:' lines from floppy types. ok miod@ | |
|
067bd747 | 2023-03-06 21:16:50 | Delete extraneous trailing blank line. | |
|
8e30ef80 | 2023-03-06 18:12:47 | Remove pointless ":ob#0:pb#0:[tb=swap:]" disktab lines. ok miod@ | |
|
2e4eb7f8 | 2023-03-06 13:57:45 | tweak examples/iked.conf bits a little further following comments by aisha@ and Crystal Kolipe, ok aisha@ tobhe@ | |
|
194a64d3 | 2023-03-04 14:49:36 | move to 7.3-beta | |
|
693dc5e1 | 2023-03-03 16:22:57 | Process accounting and lastcomm(1) can detect execve(2) violations of pinsyscall(2) policy. Report such findings in daily mail like other security violations. User has to turn on accounting=YES in rc.conf.local to utilize this feature. OK deraadt@ | |
|
dae58e70 | 2023-03-01 22:45:25 | /etc/examples/iked.conf tweaks: - show a demo of a strong random string for psk, for some types of configuration psk makes sense. the previous example hinted at.not using it. - change the EAP MSCHAPv2 example so that more than one client can connect (previous used address config but with only a single address not a pool), and use the newer keywords to show how to route all traffic from dynamic-ip clients over the tunnel ok tobhe@ | |
|
ffc3cc9d | 2023-02-28 16:12:13 | add 7.4 fw key | |
|
3179f043 | 2023-02-19 17:28:46 | add 7.4 syspatch public key | |
|
06b46744 | 2023-02-19 15:19:38 | 7.4 packages key | |
|
d9d92150 | 2023-02-18 18:50:15 | 7.4 base key | |
|
b7211c5d | 2023-01-28 11:47:25 | sync | |
|
2aa24a8c | 2023-01-28 11:04:47 | Update the number of default wskbd entries OK deraadt@ | |
 |
e0c25898 | 2023-01-25 10:53:15 | Delete TAB only line. | |
|
f50e68cc | 2023-01-24 13:31:47 | sync | |
|
b7167f60 | 2023-01-24 13:30:44 | Provide /dev/ujoy/[0-3] ok deraadt@ miod@ | |
|
036e2a92 | 2023-01-18 20:44:40 | process the sshd random-relink kit if it is found. sshd's text segment is now garbled, and in the future xonly univirse you'll have poor success downloading it or libc to know where gadgets are. ok djm | |
|
796f3615 | 2023-01-14 12:19:11 | regen | |
|
b48a47a7 | 2023-01-14 12:15:12 | Create /dev/efi on amd64 and arm64. ok yasuoka@ | |
|
0b442041 | 2022-12-28 09:53:33 | Make wait_reorder_libs() honour library_aslr=NO Otherwise it will unconditionally print an empty line in case relinking is disabled. Reported by kettenis Feedback OK tb OK florian | |
|
ee5ad0ad | 2022-12-26 20:24:43 | add newline missed in previous | |
 |
5ea7b462 | 2022-12-26 18:57:50 | Re-order libraries in parallel to netstart. While netstart is busy setting up the network and waiting for a default route we can already start with reordering libraries since this does not depend on running network, speeding things up. Idea & input deraadt Input & OK kn | |
|
8f27d2fe | 2022-12-18 15:52:52 | Revert previous as it doesn't create additional lo(4) anymore Reported by Andreas Bartelt on bugs@ | |
|
46f96729 | 2022-12-18 05:51:14 | Do not try to create physical interfaces vifscreate() always creates all virtual interfaces up-front. To check whether a given interface exists, ifstart() uses ifcreate() which tries to create nonexistent ones. Virtual ones are guaranteed to be present and physical ones cannot be created, so replace the ifcreate() call with a simpler ifconfig test and clarify the comment. OK martijn afresh1 | |
|
5e544b4e | 2022-12-16 17:57:39 | zap double space and needless line break | |
 |
51e3b6ac | 2022-12-16 04:04:25 | Prioritize lladdr over name/unit in hostname.if processing When needed, lladdr is more precise and enduring. Suggested by deraadt@ Many improvments and OK kn@ | |
|
af42e33e | 2022-12-05 20:12:00 | Add support configuring hostname.if(5) by lladdr Original implementation by martijn@ Feedback and suggestions from kn@, sthen@, claudio@, florian@, and deraadt@. ok deraadt | |
|
1fae1118 | 2022-11-30 02:54:15 | add configtest; OK martijn | |
 |
76a9e5e6 | 2022-11-28 14:56:31 | rc(8): reorder_libs: print names of relinked libraries When booting from slow media, the boot can appear to stall at the "reordering libs" line for quite some time. For my example, my G4 PowerMac booting from USB 1.1 takes a full minute to reorder the libraries. Let's print the name of each library before it is relinked. This gives the operator a better sense of what the machine is doing. In particular, it signals to the operator that the machine did not hang. With input from kn@, deraadt@. Positive feedback from sthen@. Link: https://marc.info/?l=openbsd-tech&m=165914104421476&w=2 ok kn@ | |
|
27ea7898 | 2022-11-10 11:02:26 | Regen | |
|
fd2ae1c6 | 2022-11-10 09:50:00 | Nuke Vax (ra,rx) and HP-300 (hd) devices. Noticed by kn@ ok millert@ | |
|
98abb01d | 2022-11-09 22:18:53 | Regen | |
|
86ac43f9 | 2022-11-09 19:35:23 | Remove xy/xd. SMD left with sparc. ok kn@ deraadt@ | |
|
fabf5c24 | 2022-11-09 18:46:04 | Remove xy/xd. SMD left with sparc. ok kn@ deraadt@ | |
|
5c6e5728 | 2022-11-07 02:21:21 | Import regenerated moduli. | |
|
b91554c6 | 2022-11-06 18:32:51 | regen after /dev/pf? cleanup (only /dev/pf exists) | |
|
eb0d8c28 | 2022-11-06 18:30:22 | There is only one pf(4); OK sashan | |
|
8a356058 | 2022-11-05 12:06:05 | "need root privileges" is an error, print it on stderr" | |
|
ac570418 | 2022-11-05 12:03:58 | Print full path in usage; OK jmc | |
|
577f3075 | 2022-11-01 11:18:06 | Only load the SOII key if IPv6 is available Possible now that IP6KERNERL is hoisted. This also improves readability and zaps double negation logic. | |
|
7c2e177a | 2022-11-01 10:45:53 | Do not wait for DAD completion in dry-run mode 1. only do so when running without -n 2. move code to own wait_dad() helper like wait_autoconf_default() has it 3. use local _count as usual in both functions rather than the global count Feedback OK claudio | |
|
1943041a | 2022-10-31 20:14:45 | Hoist only the feature check Keep adding IPv6 routes after lo0 got an addres like before, meant to be committed together with r1.223. | |
|
ab2ae2f8 | 2022-10-31 19:48:50 | Fix comment: IPv6 link local addresses do not use SOII anymore sys/netinet6/in6_ifattach.c r1.114 limited it to SLAAC addresses in 2019. | |
|
751bfb17 | 2022-10-31 19:25:16 | Improve shell style wrt. variable naming/boolean convention The mixed use of upper and lower case variables is neither obvious nor consistent. PRINT_ONLY is local to netstart. ip6kernel is local to netstart. multicast gets sourced from rc.subr(8). 1. uppercase ip6kernel as is common for global variables in base scripts 2. use the simpler true/false idiom and default with the rest of netstart-only variables, making it clearer that only `multicast=YES/NO' comes from the rc environment 3. hoist kernel feature detection such that a later diff can load the SOII key conditionally 4. zap obvious comment OK aja | |
|
91d26677 | 2022-10-24 20:51:07 | do not wait for autoconf in dry-run If there is no default route but some interface has AUTOCONF, printing what would be done still waits for... nothing to happen. OK tb | |
|
f2bb6261 | 2022-10-24 17:58:43 | Add required sh(1) to synopsis Contrary to other scripts in base like rc.d(8) or MAKEDEV(8), netstart(8) itself is not executable and must be passed as file to sh(1): $ man -h netstart /etc/netstart [-n] [interface ...] $ /etc/netstart ksh: /etc/netstart: cannot execute - Permission denied Fix usage and synopsis to provide required usage: $ man -h netsart sh /etc/netstart [-n] [interface ...] OK jmc | |
|
eb43ab97 | 2022-10-23 09:29:48 | powerpc64 and riscv64: sync pbuild class with amd64 and arm64 From Brad |