wireguard-openbsd/sbin/iked/proc.c, branch jd/queueboosts WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sbin/iked/proc.c?h=jd%2Fqueueboosts 2020-04-08T20:04:19Z Prevent multiple ibuf leaks. Clean up on proccess shutdown. 2020-04-08T20:04:19Z tobhe tobhe@openbsd.org 2020-04-08T20:04:19Z urn:sha1:44afdd6cea1e9b9bbb6e00e7bb16af023452dc7e ok markus@ Remove cpath pledge(2) promise. We decided that not deleting the unix control 2018-08-06T06:30:06Z mestre mestre@openbsd.org 2018-08-06T06:30:06Z urn:sha1:eb073997ed712c65eb5d1d1ce4c43fbc10c97913 sockets cause no harm and this way we close another attack surface by not allowing the daemon to create/delete any more files. OK kn@ Stop accessing verbose and debug variables from log.c directly. 2017-01-09T14:49:21Z reyk reyk@openbsd.org 2017-01-09T14:49:21Z urn:sha1:871fc12c557cf094bf5ca1277faefd10ad038938 This replaces log_verbose() and "extern int verbose" with the two functions log_setverbose() and log_getverbose(). Pointed out by benno@ OK krw@ eric@ gilles@ (OK gilles@ for the snmpd bits as well) Add imsg "peerid" to debug messages (only within -DDEBUG). 2015-12-07T16:05:56Z reyk reyk@openbsd.org 2015-12-07T16:05:56Z urn:sha1:66094308c50bdd3f984e2f533449249ea32c98da Sync proc.c, use shorter proc_compose[v]() 2015-12-07T12:46:37Z reyk reyk@openbsd.org 2015-12-07T12:46:37Z urn:sha1:c205e9721f579350493d48d3e7fb8edc3c0b9a5e EAGAIN handling for imsg_read. OK henning@ benno@ 2015-12-05T13:09:46Z claudio claudio@openbsd.org 2015-12-05T13:09:46Z urn:sha1:18c579c625351e46981a7ca7fd8fa8b792f5e79d Replace socket_set_blockmode() and fcntl(fd, F_SETFL, O_NONBLOCK) calls 2015-11-23T19:28:33Z reyk reyk@openbsd.org 2015-11-23T19:28:33Z urn:sha1:52ab28df8cada3e7b1975bb0ceb97c1793a51d5b with the SOCK_NONBLOCK flag to socket() and accept4(). OK claudio@ jung@ Update log.c: change fatal() and fatalx() into variadic functions, 2015-11-22T13:27:13Z reyk reyk@openbsd.org 2015-11-22T13:27:13Z urn:sha1:0f12961a04ac3682ec8aa1b881b1d1932b3d3ca5 include the process name, and replace all calls of fatal*(NULL) with fatal(__func__) for better debugging. OK benno@ iked hereby pledges that it will run with restricted system 2015-10-22T15:55:18Z reyk reyk@openbsd.org 2015-10-22T15:55:18Z urn:sha1:ebfc369325d2c22f833acf029b45694846aba023 operations. This adds pledge(2) too all processes, including the iked parent process; the existing privsep design has been improved for better pledgeability. There haven't been any serious problems as it was already sane (eg. by receiving the PFKEYv2 and UDP sockets via fd passing). The control socket moved to an independent process to remove some abilities from the cert process. Committed in agreement with many but nobody was brave enough to OK it. Better testing will happen with having it in the tree. "It's the truth" deraadt@ "Let's see what happens" benno@ Switch iked to C99-style fixed-width integer types. 2015-08-21T11:59:27Z reyk reyk@openbsd.org 2015-08-21T11:59:27Z urn:sha1:d09d3a7dbad47058079f27fcacf4b5f502f520e8 OK mikeb@