wireguard-openbsd/libexec/spamd/spamd.8, branch jd/simplify-queueingWireGuard implementation for the OpenBSD kernelhttps://git.zx2c4.com/wireguard-openbsd/atom/libexec/spamd/spamd.8?h=jd%2Fsimplify-queueing2019-07-24T18:41:05ZEver since I introduced pledge(2) on spamd(8) the chroot'ed process, if running2019-07-24T18:41:05Zmestremestre@openbsd.org2019-07-24T18:41:05Zurn:sha1:fd9fa3ac1b409c700bd4b6768bfcd3ad46ac29e6
in default, cannot get anywhere near the filesystem since its only promises are
"stdio inet". Furthermore, in blacklist mode this same codepath is not
chroot'ed but once again it gets the same pledge(2).
Therefore we can remove the BUGS section from spamd(8)'s manpage.
OK millert@ deraadt@
note that some hosts never generate tuples and are ignored;2017-04-02T18:14:34Zjmcjmc@openbsd.org2017-04-02T18:14:34Zurn:sha1:c57e657f8f02eb3d1248e2aed512a8bac1c2cd97
ok beck
define the role of spamd-setup a little better;2017-03-16T15:16:21Zjmcjmc@openbsd.org2017-03-16T15:16:21Zurn:sha1:18b3c5b8f73c693c8171ed87f6ba36e40e19b634use one way to show filter rules, not two. the bits and pieces of the2017-03-16T15:07:45Zjmcjmc@openbsd.org2017-03-16T15:07:45Zurn:sha1:53028453fb9a9a3bf2c9514e3ab1fd10fcf36372
spamd setup are complex enough without freestyling the pf rules;
while here, Bk/Ek no longer required
start replacing some \*([GL]t;2015-08-12T14:41:37Zjmcjmc@openbsd.org2015-08-12T14:41:37Zurn:sha1:f77456993a08f35cb48736e083e72dd08b81ad64divert-to a table needs an address family;2015-08-12T14:36:47Zjmcjmc@openbsd.org2015-08-12T14:36:47Zurn:sha1:46ddce193739833ca1ae95072b501b4832753f41
from steve shockley
ok sthen
use file system path (.Pa) semantic markup macros where appropriate.2015-07-27T17:28:38Zsobradosobrado@openbsd.org2015-07-27T17:28:38Zurn:sha1:b9170857bcc7a01a0c7526d7965c4c9339fbceb9
ok jmc@
Change spamd to use divert-to instead of rdr-to.2015-05-18T16:04:21Zreykreyk@openbsd.org2015-05-18T16:04:21Zurn:sha1:0f849a0c7750c78fae43b22e6fdc50f4867c3474
divert-to has many advantages over rdr-to for proxies. For example,
it is much easier to use, requires less code, does not depend on
/dev/pf, works in-band without the asynchronous lookup (DIOCNATLOOK
ioctl), saves us from additional port allocations by the rdr/NAT code,
and even avoids potential collisions and race conditions that could
theoretically happen with the lookup.
Heads up: users will have to update their spamd PF rules from rdr-to
to divert-to. spamd now also listens to 127.0.0.1 instead of "any"
(0.0.0.0) by default which should be fine with most setups but has to
be considered for some special configurations.
Based on a diff is almost two years old but got delayed several times
... beck@: "now is the time to get it in" :)
Tested by many
With help from okan@
OK okan@ beck@ millert@
wrap a long line2015-04-14T17:29:06Zderaadtderaadt@openbsd.org2015-04-14T17:29:06Zurn:sha1:f90b2e2aa0aa43edffc8b80488c3137ade0f4749Don't use Aq macros when <> is intended; they are not the same thing.2015-02-15T22:27:51Zbentleybentley@openbsd.org2015-02-15T22:27:51Zurn:sha1:18891bf9726ee2885a1670934c9d38f6c689007e
ok schwarze@