summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add a -f filter argument to the list commands like choose-tree.nicm2020-04-125-42/+100
|
* Clarify a couple of style options.nicm2020-04-121-2/+6
|
* Mention tail queue in comments.visa2020-04-121-3/+11
|
* make ifpromisc assert that the caller is holding the NET_LOCK.dlg2020-04-121-1/+3
| | | | | | it needs NET_LOCK because it modifies if_flags and if_pcount. ok visa@
* say if_pcount needs NET_LOCK instead of the kernel lock.dlg2020-04-121-2/+2
| | | | | | | | if_pcount is only touched in ifpromisc(), and ifpromisc() needs NET_LOCK anyway because it also modifies if_flags. suggested by mpi@ ok visa@
* take NET_LOCK in aggr_clone_destroy() before calling aggr_p_dtor()dlg2020-04-121-1/+3
| | | | | | | | | | | aggr_p_dtor() calls ifpromisc(), and ifpromisc() callers need to be holding NET_LOCK to make changes to if_flags and if_pcount, and before calling the interfaces ioctl to apply the flag change. i found this while reading code with my eyes, and was able to trigger the NET_ASSERT_LOCKED in the vlan_ioctl path. ok visa@
* take NET_LOCK in tpmr_clone_destroy() before calling tpmr_p_dtor()dlg2020-04-121-1/+3
| | | | | | | | | | | | tpmr_p_dtor() calls ifpromisc(), and ifpromisc() callers need to be holding NET_LOCK to make changes to if_flags and if_pcount, and before calling the interfaces ioctl to apply the flag change. found by hrvoje popovski who was testing tpmr with vlan interfaces. vlan(4) asserts that the net lock is held in it's ioctl path, which started this whole bug hunt. ok visa@ (who came up with a similar diff, which hrvoje tested)
* ifpromisc() requires NET_LOCK(), so acquire the lock when changingvisa2020-04-121-1/+5
| | | | | | | | | promiscuous mode from bridge(4). This fixes a regression of r1.332 of sys/net/if_bridge.c. splassert with bridge(4) and vlan(4) reported by David Hill OK mpi@, dlg@
* DELETE payloads are common. Log with log_info instead of log_warnx.tobhe2020-04-111-2/+2
|
* add space between macro arg and punctuation;jmc2020-04-111-3/+3
|
* If we haven't received any IKE message from our partner for sometobhe2020-04-112-7/+34
| | | | | | | time, make sure to send a DPD packet to him so that we break up the connection faster if it's dead. ok patrick@
* Avoid using libc SHA256File(), just perform the operation inline toderaadt2020-04-111-30/+17
| | | | | make things easier for -portable ok claudio
* To help -portable, use a strrchr instead of basename, since we know whatderaadt2020-04-111-4/+6
| | | | | kinds of paths are coming in here. ok benno claudio
* remove a __unused attribute, it's obvious and complicates things.benno2020-04-111-2/+2
| | | | ok claudio@
* Add soassertlocked() checks to sbappend() and sbappendaddr(). This bringsclaudio2020-04-111-1/+4
| | | | | them in line with sbappendstream() and sbappendrecord(). Agreed by mpi@
* Document the TLSv1.3 control word, update the description of theschwarze2020-04-111-4/+30
| | | | | | | TLSv1 control word, and explain how TLSv1.3 cipher suites can be configured in LibreSSL and in OpenSSL. While here, also mention how users can inspect the DEFAULT list of cipher suites. Stimulus, feedback and OK from jsing@.
* Eliminate an unnecessary intermediate variable in ieee80211_mira_choose().stsp2020-04-111-4/+2
| | | | suggested by jmatthew
* Skip MiRA's event-based probing if we're already at the minimum orstsp2020-04-111-5/+7
| | | | | | maximum rate of our current rateset. ok tb@
* Update MiRA probing interval of probed rates which are worse than thestsp2020-04-111-24/+18
| | | | | | | | | | | | | | | | current best rate, not worse than the rate currently being probed. This seems to be a more accurate interpretation of the MiRA paper. The paper says the interval for a rate needs to be updated if the rate's goodput is worse than that of the "current transmission rate" (see the "Adaptive probing interval" section). Our implementation interpreted "current transmission rate" as "rate being probed right now" and adjusted the interval of the previously probed rate. However, the context of this section of the paper suggests that "current transmissions rate" intends to refer to the currently selected best rate for our non-probing transmissions. testing and ok tb@ jmatthew@
* Use acpi_getsta(); avoids printing "no _STA method" messages and assumeskettenis2020-04-111-10/+3
| | | | | | the device is present instead. ok deraadt@
* log() lines need \n too.dlg2020-04-111-2/+2
|
* Avoid triggering KASSERT for bogus reason in pfsync_sendout with PFSYNC_DEBUG.stsp2020-04-111-2/+2
| | | | ok mpi@
* Grab the exclusive NET_LOCK() in the softnet thread.mpi2020-04-111-7/+7
| | | | | | | | | Prevent a data corruption on a UDP receive socket buffer reported by procter@ who triggered it with wireguard-go. The symptoms are underflow of sb_cc/sb_datacc/sb_mcnt. ok visa@
* fix build with PFSYNC_DEBUG by switching a format string from %d to %zdstsp2020-04-111-2/+2
|
* Refactor private key parsing. Eliminates a fair bit of duplicateddjm2020-04-111-147/+40
| | | | | | | code and fixes oss-fuzz#20074 (NULL deref) caused by a missing key type check in the ECDSA_CERT parsing path. feedback and ok markus@
* Zap double definition of conf and make ibuf_dns static to avoid doubleotto2020-04-113-6/+5
| | | | definition; from Michael Forney
* syncderaadt2020-04-111-0/+3
|
* omcm(4), omclock(4) and omsysc(4)kettenis2020-04-104-3/+131
|
* Add omcm(4), omclock(4) and omsysc(4) drivers that support the new buskettenis2020-04-109-15/+335
| | | | | | structure that is used in current mainline Linux device trees. ok jsg@
* The Raspberry Pi4 (suing UEFI firmware in ACPI mode) uses QWord()kettenis2020-04-101-1/+8
| | | | | | resource descriptors. Add support for this. ok deraadt@
* Only make the type part of the idstring lowercase when looking for certs intobhe2020-04-104-9/+9
| | | | | | | '/etc/iked', otherwise certs with SubjAltNames containing uppercase letters are not found. ok markus@
* Remove unused define, also a man fix from jmc.nicm2020-04-102-4/+3
|
* When failing to validate a peer TLS certificate in the MTA due to thebeck2020-04-101-2/+6
| | | | | | | | desired name of the MX not being present in the certificate, log that this is he reason for the failure and the name we couldn't find in the cert. ok millert@ martijn@
* sync cert.pem with Mozilla's root ca list, ok beck@sthen2020-04-101-276/+343
|
* Typo in comment.mpi2020-04-101-2/+2
|
* Now that copy mode copies the pane content rather than keeping anicm2020-04-1010-48/+70
| | | | | | | | | | reference to it, it isn't necessary that the pane in copy mode is the same as the one copying from. Add a -s flag to copy-mode to specify a different pane for the source content. This means it is possible to view two places in a pane's history at the same time in different panes, or copy from a pane's history into an editor or shell in the same pane. From Anindya Mukherjee.
* Place the 64bit key on the stack instead of malloc(9)in' it in pppx_if_find().mpi2020-04-101-10/+10
| | | | | | | Removing a malloc(9) with M_WAITOK reduces possible context switches which helps when dealing with parallelism issues. From Vitaliy Makkoveev.
* Update ARG_MAX bytes countjca2020-04-101-3/+3
| | | | ok deraadt@
* Implement stacktrace_save_at() required for upcoming WITNESS.mpi2020-04-101-1/+38
| | | | ok gkoehler@
* When printing the serialNumber, fall back to the colon separated hextb2020-04-101-2/+4
| | | | | | | | | bytes in case ASN1_INTEGER_get() failed. This happens more often since asn1/a_int.c -r1.34. Matches OpenSSL behavior. Issue in openssl x509 -text output reported by sthen ok jsing sthen
* Add tests for TOKEN expansion of LocalForward and RemoteForward.dtucker2020-04-101-2/+9
|
* Add TOKEN percent expansion to LocalFoward and RemoteForward when useddtucker2020-04-102-59/+109
| | | | | | for Unix domain socket forwarding. Factor out the code for the config keywords that use the most common subset of TOKENS into its own function. bz#3014, ok jmc@ (man page bits) djm@
* When I removed CCK fallback from iwm(4) I accidentally left an else-if blockstsp2020-04-091-8/+1
| | | | | | | in place which should have been deleted entirely. As a result firmware-based retries weren't being used in 11n mode anymore. Fix this. I really shouldn't be committing non-trivial changes without OK...
* The -6 option is ignored and will be removed in the future.tobhe2020-04-091-3/+3
|
* Simplify socket creation logic. Normally iked needs two sockets, onetobhe2020-04-096-36/+52
| | | | | | | | | | | for normal operation (UDP port 500) and one for NAT traversal (UDP 4500). There are several command line options resulting in only one of the sockets being created (-T, -t and -p). Add a new 'enum natt_mode' to make the logic for those somewhat less complicated as well as some comments where it makes sense. From Wataru Ashihara <wataash (at) wataash (dot) com> ok patrick@
* Revise test to handle the fact that TLSv1.3 cipher suites are now beingjsing2020-04-091-2/+4
| | | | included in the output from `openssl ciphers`.
* Include TLSv1.3 cipher suites unless cipher string references TLSv1.3.jsing2020-04-091-6/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL has always taken the approach of enabling almost everything by default. As a result, if you wanted to run a secure TLS client/server you had to specify your own "secure" cipher string, rather than being able to trust the defaults as being sensible and secure. The problem is that with the introduction of TLSv1.3, most of these "secure" cipher strings result in the new TLSv1.3 cipher suites being excluded. The "work around" for this issue in OpenSSL was to add a new TLSv1.3 API (SSL_CTX_set_ciphersuites(), SSL_set_ciphersuites()) and have separate knobs for the pre-TLSv1.3 and TLSv1.3 cipher suites. This of course means that every application now needs to call two APIs, but it does mean that applications that only call SSL_CTX_set_cipher_list()/SSL_set_cipher_list() cannot remove TLSv1.3 cipher suites and prevent TLSv1.3 from working. We've taken a different approach and have allowed TLSv1.3 cipher suites to be manipulated via the existing SSL_set_cipher_list() API. However, in order to avoid problems with hardcoded cipher strings, change this behaviour so that we always include TLSv1.3 cipher suites unless the cipher string has a specific reference to the TLSv1.3 protocol or a TLSv1.3 cipher suite. This means that: $ openssl ciphers -v TLSv1.2:!TLSv1.3 still gives TLSv1.2 only cipher suites and: $ openssl ciphers -v AEAD-CHACHA20-POLY1305-SHA256 only lists a single TLSv1.3 cipher, however: $ openssl ciphers -v ECDHE-RSA-AES256-GCM-SHA384 now includes both TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 and all TLSv1.3 cipher suites (which also matches OpenSSL's openssl(1) behaviour). Issue encountered by kn@ with mumble. ok tb@
* Test both SSLv3 (aka pre-TLSv1.2) and TLSv1.2 cipher suites with TLS.jsing2020-04-091-1/+1
|
* Tidy line wrapping and remove an extra blank line.jsing2020-04-091-4/+3
|
* ssl_aes_is_accelerated() returns a boolean - treat it as such, rather thanjsing2020-04-091-2/+2
| | | | explicitly comparing against a value.
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.