IABSD.fr/src/usr.sbin
Branch :
Log
| Author | Commit | Date | CI | Message |
|---|---|---|---|---|
 |
b5d1cb3f | 2024-12-04 16:17:31 | Update references for recent RPKI specifications | |
 |
ffce2a54 | 2024-12-04 09:33:41 | Disallows registering multiple probes of the same type. If a bt(5) script uses the same probe multiple times (like interval:hz), btrace(8) has currently no knowledge of which rule to execute when it parses events read from the kernel. Disable the funcitonnality until someone in need of such feature comes up with a nice implementation. From Christian Ludwig. | |
 |
ddff58c9 | 2024-12-04 07:58:51 | Fix debug output for http headers from Kenjiro Nakayama | |
|
dab7a176 | 2024-12-03 14:51:09 | Add more checks for router keys OK tb@ | |
 |
3a99c822 | 2024-12-03 13:46:53 | Only set the SO_RCVBUF and SO_SNDBUF on the socketpair to what we want. Do not retry if that fails hoping for a different result. OK tb@ kn@ | |
|
5ffbcedb | 2024-12-03 10:38:06 | Add /rib/in and /rib/out as endpoints to query the Adj-RIB-In and Adj-RIB-Out respectively. Also fix the rib query parameter to properly work. bgpctl calls this table. OK sthen@ | |
 |
d11b04b2 | 2024-12-02 22:32:57 | Have pkg_add run ldconfig after each updateset if the list of shared libraries was changed. Before @tag we used to execute programs directly as part of many updates (rebuilding desktop databases, icon cache, etc) but those are now usually deferred until the end of the run, leaving some executables not able to be run until pkg_add finishes. From espie. | |
|
ba04a0e7 | 2024-12-02 16:31:51 | Check in bgpctl show rib commands if the table / rib passed is Adj-RIB-Out and in that case set F_CTL_ADJ_OUT on the request. With this 'bgpctl show rib out' and 'bgpctl show rib table Adj-RIB-Out' return the same results. OK tb@ | |
|
aaaf7e1f | 2024-12-02 15:13:57 | Remove the ASPA imsg size workaround now that imsg are large enough to handle MAX_ASPA_SPAS_COUNT (10k) entries. OK tb@ | |
|
5bf6f543 | 2024-12-02 15:03:46 | Bump imsg size like bgpd just did. OK tb@ | |
|
04e12482 | 2024-12-02 15:03:17 | Bump imsg size up to MAX_BGPD_IMSGSIZE (128k) to support extended messages and more. OK tb@ | |
|
bf5a499b | 2024-12-02 14:55:02 | If AS0 TALs are provided, by default omit VRPs derived from such AS0 TALs AS0 TALs represent unmitigated operational risks: what if the RIR by accident marks some IP space as 'unassigned'? APNIC notes in their limitation of liability statement: """ Depending on router configuration, errors in the AS0 ROA could cause unintended interruption to routing with other networks. For this reason, it is strongly recommended that the AS0 ROA is used for advisory and/ or alerting purposes only, and not for automatic filtering of BGP routes. """ https://www.apnic.net/community/security/resource-certification/apnic-limitations-of-liability-for-rpki-2/ Guard usage of AS0 TALs behind new '-0' option OK deraadt@ tb@ | |
|
3417aeae | 2024-12-02 13:46:11 | Remove global queue_buf which is no longer used. OK compiler | |
 |
347b7373 | 2024-12-01 09:58:15 | -o[arg] must not have spaces between option and argument; OK jmc getopt(3) says so and, e.g. 'mrouted -d 1' must be 'mrouted -d1' to work. dhcpd(8) and sed(1) got this right, our multicast programs did not. | |
 |
266241f9 | 2024-11-28 11:51:45 | Fix radiusd_ipcp module to check whether the type of the ipcp_address is for pool when selecting a random address from the pools, and tweak the code for easier understanding. Also, check whether the left value of an address range configuration is smaller than the right value. | |
|
1669612d | 2024-11-28 10:42:16 | Fix warnings from gcc. found by deraadt | |
 |
8fbe85f5 | 2024-11-27 22:32:14 | vmd/vioblk: add missed break There's no value in that log message in that specific condition. OK dv@ kn@ | |
|
a0b97782 | 2024-11-27 15:19:26 | zap trailing whitespace from previous | |
|
9509a1e6 | 2024-11-26 13:59:54 | Adjust the msgbuf parser callbacks in bgpd to the new API. OK tb@ | |
|
929d2bb2 | 2024-11-26 13:59:09 | Adapt the rpki-client message reader to the new msgbuf_new_reader callback. This is mostly stolen from the imsg handler and should probably be cleaned up further. OK tb@ | |
|
475ff837 | 2024-11-26 13:35:48 | Workaround for compatibility issue with some libcrypto implementations Historically, CMS_get1_crls() returned NULL if the CMS is an unsupported content type or contained zero CRLs. Nowadays, if the CMS contains zero CRLs, some implementations will return a pointer to a STACK of CRLs with zero objects. OK tb@ | |
|
bb6b0345 | 2024-11-26 10:28:27 | Generate a single event when timers advance for more than one tick. Also report the number of events missed due to recursions or skipped ticks to btrace(8). From Christian Ludwig. | |
 |
78b9b1e6 | 2024-11-24 21:27:04 | Make fw_update -d behave like the manual says The manual says without -a or any drivers specified, fw_update -d will delete all firmware not required by a driver, and now it does. While here, slightly improve function name. | |
|
4e55220c | 2024-11-24 10:44:59 | simpler ifaliasreq sockaddr filling Rather than setting the destination struct member's size in an AF-specific way only to read from and then overwrite it with memcpy, use the destination size directly. OK mlarkin | |
|
882428cd | 2024-11-21 13:43:10 | Handle radiusd and npppd, they are different but nothing stands out. OK tb@ | |
|
545b6e31 | 2024-11-21 13:42:49 | sasyncd is another unexpected imsg user that is in the end not that special OK tb@ | |
|
bf921b2a | 2024-11-21 13:42:22 | In smtpd enable fdpassing on all imsgbufs apart from the one in mproc.c that was specially handled before. On the control socket fdpassing needs to be enabled when a IMSG_CTL_SMTP_SESSION message is received. OK tb@ | |
|
0a9d031f | 2024-11-21 13:39:34 | Convert vmd over to check for imsgbuf_init failure and sprinkle a lot of imsgbuf_allow_fdpass() since vmd and vmctl pass fds left and right. OK tb@ | |
|
81e98199 | 2024-11-21 13:39:07 | ldapd is also different to other imsg daemons. OK tb@ | |
|
6676295f | 2024-11-21 13:38:45 | Convert various reyk proc.c daemons over to new imsgbuf_init and imsgbuf_allow_fdpass. OK tb@ | |
|
f1b790a5 | 2024-11-21 13:38:14 | Convert simple stuff in usr.sbin over to new imsgbuf_init behaviour OK tb@ | |
|
af27b3cc | 2024-11-21 13:34:51 | At least make this rotting version of lpd compile again. OK tb@ | |
|
6a3db2ba | 2024-11-21 13:34:30 | Convert session.c to use the new msgbuf reader API. OK tb@ | |
|
eaff30a2 | 2024-11-21 13:34:01 | Teach mrt_dump_bgp_msg() to use ibufs OK tb@ | |
|
c9c4d4e4 | 2024-11-21 13:33:41 | Pass the message to bgp_fsm as argument instead of stashing it in rptr. This fixes many XXX in the parser functions since we now pass ibufs around. OK tb@ | |
|
9e5228dd | 2024-11-21 13:33:14 | Kill the bgp_msg struct and instead pass the type to session_sendmsg() OK tb@ | |
|
22b46a1f | 2024-11-21 13:32:50 | Convert rtr_proto to use new msgbuf reader API. OK tb@ | |
|
b5fa5d51 | 2024-11-21 13:32:27 | Rewrite the rpki-client io read handling using the new ibuf_read API. OK tb@ | |
|
c7d6dea4 | 2024-11-21 13:32:02 | Remove the imsgbuf_read_nofd() hack since the imsgbuf API rquires the caller to enable fdpassing. OK tb@ | |
|
98435822 | 2024-11-21 13:31:37 | Replace imsgbuf_read_nofd() hack with the new imsgbuf API. OK tb@ | |
|
25d36c5c | 2024-11-21 13:30:17 | Adjust rpki-client to new msgbuf API OK tb@ | |
|
05453d67 | 2024-11-21 13:29:52 | Adjust bgpd to the new msgbuf API The tricky bit here is the fact that the peer wbuf needs to be allocated and freed in the right places (when a peer is setup and when it is freed). During lifetime we just flush the msgbuf with msgbuf_clear(). mrt has a similar issue. I think that freeing the msgbuf in mrt_clean is right. OK tb@ | |
|
3bba10cf | 2024-11-21 13:29:28 | Adjust ldpd to the msgbuf change that turns the struct opaque OK tb@ | |
|
a6a6bc2c | 2024-11-21 13:28:54 | Adjust rpki-client to the new msgbuf_write api OK tb@ | |
|
bb561412 | 2024-11-21 13:28:34 | Adjust bgpd to the new msgbuf_write / ibuf_write API OK tb@ | |
|
a66ca8da | 2024-11-21 13:28:03 | Adjust to new msgbuf_write/ibuf_write API and use ibuf_write since there is no need to support fd passing. OK tb@ | |
|
cfaf7410 | 2024-11-21 13:27:40 | Do not abuse struct ibuf_read instead define local struct with the same fields. All of this will die in the end. This is just a step towards that. OK tb@ | |
|
26889e1d | 2024-11-21 13:27:13 | Do not abuse struct ibuf_read for internal bits. Just define an own struct. OK tb@ | |
|
fa353a8f | 2024-11-21 13:26:49 | s/ibuf_add_buf/ibuf_add_ibuf/ OK tb@ | |
|
ef2e27a1 | 2024-11-21 13:26:25 | Unify error reporting in various control programs. Just use "read error" since the code also uses "write error" for the imsg_flush case. OK tb@ | |
|
4dca706e | 2024-11-21 13:25:56 | Only ldapd tried to handle fd exhaustion during imsg fd passing. Move the getdtablecount check back into ldapd. OK tb@ | |
|
d12ef5f3 | 2024-11-21 13:25:30 | Convert vmd over to new imsgbuf_read behaviour and fix some lurking issues by introducing imsg_read_one(). This code is still a bit strange since it uses imsg_flush() on non-blocking sockets. A possible fix would be to replace imsg_flush() with a new imsg_write_one() that uses poll like atomicio. This is what imsg_read_one() does here. OK tb@ | |
|
f3f62f4d | 2024-11-21 13:25:01 | Try to handle the dumpster fire called constraint.c a bit better. The imsg handling in here is not quite right. It works but more by luck. - use imsgbuf_read_one (similar code as found in a few other places) to read the one message we expect. - do not call imsgbuf_flush() without a child running to read the data. With large enough requests imsgbuf_flush() may be locked forever since there is no reader on the other side of the pipe. OK tb@ | |
|
f6bd242e | 2024-11-21 13:24:39 | Simple bits of converting ntpd over to the new imsgbuf_read behaviour. OK tb@ | |
|
4f3fb1ff | 2024-11-21 13:23:37 | Convert radiusd to new imsgbuf_read behaviour. OK tb@ | |
|
ba4450f4 | 2024-11-21 13:23:13 | Convert npppd and npppctl over to new imsgbuf_read behaviour. OK tb@ | |
|
035f9310 | 2024-11-21 13:22:48 | No need to handle EAGAIN anymore. OK tb@ | |
|
16b0c81b | 2024-11-21 13:22:21 | bgpd and smtpd include their own imsgbuf_read_nofd() implementation. Adjust that one as well apart from that the conversion to the new imsgbuf_read read behaviour is trivial. OK tb@ | |
|
668e5ba9 | 2024-11-21 13:21:33 | Convert the common imsgbuf_read calls to the post EAGAIN world. OK tb@ | |
|
b82d3e10 | 2024-11-21 13:20:00 | Use msgbuf_queuelen() where approriate OK tb@ | |
|
31be28ca | 2024-11-21 13:18:37 | Use imsgbuf_queuelen() instead of accessing the w.queue member. OK tb@ | |
|
9cbf9e90 | 2024-11-21 13:17:56 | Use imsgbuf_clear() where appropriate instead of msgbuf_clear(). OK tb@ | |
|
dd7efffe | 2024-11-21 13:17:01 | Rename imsg_init, imsg_clear, imsg_read, imsg_write and imsg_flush to imsgbuf_init, imsgbuf_clear, imsgbuf_read, imsgbuf_write and imsgbuf_flush. This separates the imsgbuf API from the per-imsg API. OK tb@ | |
|
c1aa9554 | 2024-11-21 13:16:06 | Convert imsg_write() callers to the new simplified return logic. OK tb@ | |
|
4fb43511 | 2024-11-21 13:13:37 | Convert ibuf_write() callers to new simplified return logic. OK tb@ | |
|
9aadc625 | 2024-11-21 13:12:19 | Convert msgbuf_write() callers to the new return logic. OK tb@ | |
|
baf86509 | 2024-11-21 13:12:11 | Convert msgbuf_write() callers to the new return logic. OK tb@ | |
|
e4dbe30d | 2024-11-21 13:11:33 | Use ibuf_write() to send BGP messages to peers instead of msgbuf_write(). This code does not need to pass fds so there is no need to call msgbuf_write. OK tb@ | |
|
ce33693d | 2024-11-21 13:10:18 | Introduce imsg_write() and use it instead of msgbuf_write(). imsg_write() is just a thin wrapper around msgbuf_write(). So this is mostly search and replace. OK tb@ | |
|
22e91112 | 2024-11-21 13:08:32 | Use imsg_flush() instead of implementing the same by hand. OK tb@ | |
|
f978fa48 | 2024-11-21 13:06:19 | imsg_flush no longer returns EAGAIN. Simplify proc_flush_imsg() accordingly. Issue spotted by op@ | |
|
674395a0 | 2024-11-21 13:05:23 | ibuf_get_string() was added to the ibuf API, remove local version OK tb@ | |
|
b4964d69 | 2024-11-14 10:28:59 | rpki-client: use macros for skipping rather than hardcoded numbers ok claudio | |
 |
be5c6ada | 2024-11-13 15:51:50 | Take into account how long the dns probe takes before decding to punt. A single res_query() call can return immediately (e.g. success or the nameservers are unreachable), or take quite some time, depending on how many nameservers are configured. So measure the actual time it takes and decide wat to do based on that. Early version from beck@; ok claudio@ deraadt@ | |
|
30a08502 | 2024-11-13 12:51:03 | Second sweep of foosz -> num_foos and friends Binary change in main.o and tal.o due to an assertion change and in spl.o due to line number changes looks good to claudio, ok clang + sha256 | |
|
381ee599 | 2024-11-12 09:23:07 | Rename ips/as and ipsz/asz to ips/ases, num_ips/num_ases Having a single letter to distinguish a length from a pointer is error prone. This results in binary change only in validate.c and cert.c due to a line wrap resulting in line number changes and in cert.c there's in addition two asserts that change. checked with/ok job | |
|
6b1aed72 | 2024-11-09 12:40:10 | sync curly braces markup, fix indent Replace literal braces with .Brq, use lists, replace literal 'foo options' with .Ar option ... and indent options where they belong. This highlights config parser differences between daemons: - dhcpleased: requires empty blocks, e.g. 'interface em0 {}' (Brq Op Ar option ...) - rad: lets you omit them, e.g. 'interface em0' (Op Brq Ar option ...) Feedback OK jmc | |
|
3df64845 | 2024-11-09 02:40:57 | Remove unnecessary variable It turns out that DOWNLOAD_ONLY was just used as the inverse of INSTALL, so use the one variable instead of two. This also uncovered some small cleanups. | |
|
14dcac1e | 2024-11-09 02:19:48 | Add a -l flag to list drivers or files This provides a more easily machine readable list than the normal output. | |
 |
db15c72a | 2024-11-08 10:43:07 | Only install a second copy of the bootloader if the EFI System Partition is at least 1MB. This should prevent us from filling up the tiny ESPs that we used to create a few releases ago. ok deraadt@ | |
|
3a9fd06c | 2024-11-07 16:00:11 | The comparator of the RBtree for the IP addresses was broken. Also, log verbosely when ignoring accounting request. | |
 |
18e6fc66 | 2024-11-07 10:12:18 | Move syslogd(8) TLS handshake callback from read to write handler. syslogd should immediately detect that the incoming TLS handshake is complete. The old logic detected it when the first log message over TLS was arriving. For now only a debug message is logged, but the callback will be used to print the common name of the client certificate in the future. OK tb@ | |
|
53407cb0 | 2024-11-07 09:20:09 | Add multi-line strings support to the bt(5) script parser. From Christian Ludwig | |
|
7af3c895 | 2024-11-07 06:37:18 | Log the username when rejecting by ipcp. | |
|
7f22b52a | 2024-11-06 23:04:45 | Fix vmd(8) logging to syslog(3) from child process. Log messages from vmd(8) child processes went to /dev/null. Re-exec set the -n option, which in turn sets vmd_noaction and vmd_debug. Debugging means no more syslog(3), but stderr, which is /dev/null for a daemon. Remove -n from child re-exec, it does not have any effect except looging. Pass on the -d flag when debugging. The VMD_VERBOSE defines are more confusing than useful, just write -v like all the other options. Rework creation of execvp arguments. Do not use tab in syslog messages, space is sufficient. OK mlarkin@ hshoexer@ dv@ | |
|
06d0d098 | 2024-11-06 22:06:16 | vmd(8) logs psp(4) firmware version. On vmd startup, log the AMD SEV PSP API and build number. from hshoexer@; OK mlarkin@ | |
 |
c18ef1e4 | 2024-11-06 17:14:03 | Add -g option to get the index of the current virtual terminal. This can help scripts using wsconsctl display.focus to perform vt switches. From NetBSD via Sergiy Kopchalyuk. | |
|
e7a1ead9 | 2024-11-06 14:26:20 | Fix broken vmd(8) build on arm64 due to missing psp_setup(). The psp.c source is restricted in makefile with .if ${MACHINE} == "amd64" so use #ifdef __amd64__ around the call to psp_setup(). On arm64 set vmd_psp_fd to an invalid value. OK hshoexer@ mlarkin@ | |
|
64468f86 | 2024-11-06 12:01:39 | Reference SendHoldTimer RFC in bgpd(8) OK claudio@ | |
|
5db0dbc5 | 2024-11-05 23:16:46 | vmd(8) resets psp(4) Use shutdown and init to reset psp(4) on vmd(8) startup. This helps when hacking on vmd(8) and crashing it. The psp(4) reset cleans up all remnants of dead VMs from psp(4). Otherwise one would have to reboot the machine. from hshoexer@; OK mlarkin@ | |
 |
605f2cbb | 2024-11-05 19:36:53 | mark up fix; from jesper wallin | |
 |
496b8bf9 | 2024-11-05 18:58:35 | Check for pfxsz, not the pointer ok tb | |
|
f814cda1 | 2024-11-05 18:09:16 | Avoid zero-sized allocations ok claudio | |
|
45a3ee5e | 2024-11-05 09:18:35 | ncomplete is set but never used. Noticed by cc OK tb@ | |
|
490bf478 | 2024-11-05 06:05:35 | rpki-client: check validity time in filemode Currently the validation indicator only takes the certificate's status into account. In case everything check out, check the product's life time and the signature path's expiration moment before printing OK. should fix an issue encountered by job looks good to claudio | |
 |
2119819d | 2024-11-04 21:59:15 | Ignore extra groups that don't fit in the buffer passed to getgrouplist(3) Our kernel supports 16 groups (NGROUPS_MAX), but nothing prevents an admin from adding a user to more groups. With that tweak we'll keep on ignoring them instead of potentially reading past the buffer passed to getgrouplist(3). That behavior is explicitely described in initgroups(3). ok millert@ gilles@ | |
|
c4e27ad9 | 2024-11-04 11:39:12 | Update reference | |
 |
6b5bf2e8 | 2024-11-04 11:12:52 | Some atoi -> strtonum conversions; ok denis | |
|
8eda69bd | 2024-11-04 01:24:00 | Allow downloading firmware without root If we are downloading as non-root, we can't drop privileges using ftp, but sometimes that is OK. While here, improve the DOWNLOAD_ONLY variable name. | |
|
fcfe10d6 | 2024-11-04 00:34:47 | Make fw_update -p consistent Previously, if using fw_update -Fp ..., the argument to -p was treated as a destination path, unless it looked like a URL. This is too complex, if we want to be able to change the download destination, that wll need to be a new option. |