summaryrefslogtreecommitdiffstats
path: root/usr.sbin (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Adjust HTTP client code a bit. Add support for 304 Not Modified responses,claudio2021-03-253-30/+39
| | | | | | | remove handling of 206 Partial Content (the client does not use range headers). Report the Last-Modified timestamp back to the requestor and switch OK to a enum value for (FAIL, OK and NOT MODIFIED). OK tb@
* Adjust base64_decode() to just take a base64 string as input instead ofclaudio2021-03-251-11/+8
| | | | | a string plus length. Preparation work for RRDP. OK tb@
* Responses to HEAD requests must not have a message body (even though they havebenno2021-03-243-14/+99
| | | | | a Content-Length header). HTTP RFC 7231 section 4.3.2. found by niklas@, claudio@ agrees.
* Use time_t for intermediate lease time values when calculating humanflorian2021-03-231-7/+17
| | | | | | | | | | readable output for very long timeouts to prevent overflow. While here add years and days. Days might actually show up in normal leases. Years is to catch "infinity" which is encoded as UINT32_MAX and used by vmd(8). Previously we would overflow, wrap to negative which then got transformed to 0s. Pointed out by Dave Voutila while working on the vmd(8) dhcp code.
* Timed out RSA key ops, may leave uncalled for responses in the imsg returnclaudio2021-03-232-6/+24
| | | | | | path. These have to be dropped or every subsequent call will cause decrypt errors. Use a sequence number cookie to keep the systems in sync. Diff from niklas@ with some minor adjustments by myself.
* Properly reflect stopping statekn2021-03-221-4/+4
| | | | | | | | | | | | | Diff from Preben Guldberg < preben at guldberg dot org>, thanks! In "vmctl status", VMs that are being stopped but are still running will simply show up as "running". Give preference to showing the "stopping" state akin to how a paused VM is handled. Tested by Dave Voutila OK tb
* Use new terminology of RFC 8981 and (mechanically) replace "privacy"florian2021-03-211-4/+5
| | | | with "temporary".
* add -n to SYNOPSIS;jmc2021-03-211-2/+2
|
* Add -n (no action) mode, which just parses the program and exits.jmatthew2021-03-212-6/+15
| | | | ok mpi@ kn@
* Add an -V option to show the version of rpki-client. For the base versionclaudio2021-03-193-7/+12
| | | | | it will show just OpenBSD while -portable will show the portable version. OK sthen@, tb@, kn@
* Delay chdir to the cache directory to after parsing the tal files.claudio2021-03-191-5/+13
| | | | | | Using the -t option relative locations can be passed as tal locations and so the process can not chdir until these files were read. OK job@
* Remove booting from kernels in raw/qcow2 imageskn2021-03-1910-1435/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Diff and (slightly tweaked) text below from Dave Voutila < dave at sisu dot io >, thanks! -- Since 6.7 switched to FFS2 as the default filesystem for new installs, the ability for vmd(8) to load a kernel and boot.conf from a disk image directly (without SeaBIOS) has been broken. A diff from tb to add FFS2 support never mdae it into the tree. On 5th Jan 2021, new ramdisks for amd64 have started shipping gzipped, breaking the ability to load the bsd.rd directly as a kernel image for a vmd guest without first uncompressing the image. Using BIOS works, the FFS2 change happend ten months ago and few if any have complained about the breakage. vmctl(8) is still vague about supporting it per its man page and one still has to pass the disk image twice as a "-b" and "-d" argument to boot an OpenBSD guest *without* BIOS. Josh Rickmar reported the gzip issue on bugs@ and provided patches to add support for compressed ramdisks and kernel images. The easiest way to do so is to drop support for FFS images since they require a call to fmemopen(3) while all the other logic uses fopen(3)/fdopen(3) calls and a file descriptor. It is much easier to get thsoe patches merged if they don't have to account for extracting files from disk images. -- No objections anyone "Removing it makes sense" reyk (who wrote the FFS module) OK mlarkin
* Do not include ':' in the port number.tb2021-03-181-2/+2
| | | | ok claudio
* Fail in rsync_base_uri() if the strdup calls fail. Do not bubble thisclaudio2021-03-181-3/+8
| | | | | error upwards since a NULL return represents a bad-URI. Diff originally from tb@
* Avoid NULL access in http_parse_uri()tb2021-03-181-3/+6
| | | | | | | A malformed URI such as "https://[::1/index.html" causes a NULL access in the hosttail[1] == ":" check. ok claudio
* Do not assign the return value from asprintf (int) to a size_t and thenclaudio2021-03-181-3/+6
| | | | | | | compare it to -1. Instead use a temp variable and assign to bufsz after the -1 check. Also add errx() calls after the switch statements in the FSM functions. OK job@ tb@
* Initialize rsyncpid and httppid in the noop case. It seem gcc is not ableclaudio2021-03-181-3/+7
| | | | | to realize that the pids are initialized if !noop and not accessed if noop. OK job@ tb@
* Since the entity queues are per repo there is no need to store the repo idclaudio2021-03-181-2/+1
| | | | | anymore. OK job@ tb@
* Remove duplicate prototype.bluhm2021-03-181-2/+1
|
* The ntpd client code corrects both T1 and T4 with the current offsetbluhm2021-03-181-5/+6
| | | | | | | | | | | | | | returned by adjtime(2) from the kernel. T1 is local time when the NTP packet is sent and T4 when the response is received. If between these events a NTP reply from another server is received, it may change the kernel offset with adjtime(2). Then the calulation of the client offset was done with different bases, the result was wrong and the system time started moving around. So instead of correcting T1 and T4 individually at different events, correct their sum once. Error handling was missing if there is no timestamp in the response. As this should not happen in our kernel, fatal() is appropriate. tested by weerd@; OK claudio@
* Do not delete control socket upon exitkn2021-03-161-14/+1
| | | | | | | | | | | | | The control socket is not unveiled, therefore accounting would report unveil violations whenever apmd(8) stopped (normally). As discussed and done with other daemons such as relayd which also employ no pledge (due to inherent limitations) but unveil effecting all of /, simply stop removing the socket upon exit and leave it to the next apmd which completely sets up its control socket anew at startup. Violations reported by anton Feedback OK semarie mestre
* A socket buffer is not the best size to read from a disk.otto2021-03-161-6/+9
| | | | Use st_blksize to set high water mark; florian@
* tweaks to system version handling:espie2021-03-151-5/+6
| | | | | | | | | - create an element that accumulates version values for when we have several - actually use compare on version values instead of hardcoding the difference no functional change
* Allocate the repo structs individually linked by a SLIST instead of usingclaudio2021-03-151-85/+90
| | | | | | an array that is reallocated during runtime. With this the entityq can move back into struct repo. OK tb@
* merge unbound-1.13.1sthen2021-03-1257-5380/+8023
|
* update to unbound-1.13.1, tested by gnezdo@sthen2021-03-1213-28/+99
|
* Use unveil(2)kn2021-03-111-1/+6
| | | | | | | | | | | | | Pledge is not possible due to the ioctls, but as apmd hoists both the control socket and apm device early at startup and only ever possibly executes scripts under /etc/apm/, hiding the rest of the filesystem becomes easy. Technically, only "x" is required to traverse the directory and run scripts, but apmd carefully access(2) each script, which requires the read bit regardless of the permission bits being tested. OK mestre
* Revert rev 1.116claudio2021-03-111-37/+43
| | | | | | The repo structs are reallocated during runtime and so the back pointers to the head element of the TAILQ get corrupted. Noticed by tb@
* There is no need to revisit a file in the repo, so if the RB_INSERT failsclaudio2021-03-111-4/+10
| | | | | just drop the entity queue element. OK benno@ tb@
* There is no need for a global enity queue, instead use per repo queues.claudio2021-03-111-43/+37
| | | | | Simplifies the code a fair bit. OK tb@
* Build install media with -fno-asynchronous-unwind-tables to furtherjsg2021-03-101-1/+2
| | | | | | | reduce size. Allows a clang 11 amd64 release to complete without overflowing the floppy image. ok kettenis@ deraadt@
* do not request client certificate unless requirederic2021-03-101-3/+1
| | | | | | | issue hit by florian@ diff by jsing@ ok tb@
* Expand the maximum length for CHAP challenge to 96 octets. npppdyasuoka2021-03-101-2/+2
| | | | | | couldn't handle ICCN message which has a ProxyAuthenChallenge AVP longer than 24 octets. Juniper actually send such challenges. Reported and tested by Ryan Freeman.
* Fix "phone number" spelling.patrick2021-03-101-3/+3
| | | | ok yasuoka@
* When adding files from the manifest only the .crl need to be first, afterclaudio2021-03-101-34/+12
| | | | | | that the order does not matter so simplify the code and just walk the list twice. Add the .crl first and then in the second round all other files. OK job@
* Fix some old phrasing on how to set up a trap handler which aren't correctmartijn2021-03-091-7/+18
| | | | | | anymore after moving it from its own subprocess to snmpe. feedback and OK jan@
* Early daemons like dhcpleased(8), slaacd(8), unwind(8), resolvd(8)bluhm2021-03-091-1/+5
| | | | | | | | | | | | | are started before syslogd(8). This resulted in ugly sendsyslog(2) dropped logs and the real message was lost. Create a temporary stash for log messages within the kernel. It has a limited size of 100 messages, and each message is truncated to 8192 bytes. When the stash is exhausted, the well-known dropped message is generated with a counter. After syslogd(8) has setup everything, it sends a debug line through libc to flush the kernel stash. Then syslogd receives all messages from the kernel before the usual logs. OK deraadt@ visa@
* When introducing prefix_eligible() I botched up one if statement.claudio2021-03-081-3/+6
| | | | | | | For nexthops it is fine if they point to NULL. This is used in local announcements. Only if they point to a real struct the state must be NEXTHOP_REACH. Bug reported by and OK florian@
* Add some references, most of these were removed when we stopped buildingjsg2021-03-083-10/+19
| | | | | | and installing USD/SMM/PSD docs. jmc@ agrees with the direction, ok millert@ on an earlier diff
* use the mx hostname for sni on outgoing connection, not the reverseeric2021-03-071-2/+2
| | | | | | | dns for the peer address. spotted by krw@ ok krw@ tb@
* Avoid print for NULL pointerjan2021-03-051-5/+4
| | | | | | The subclass arrays have to be empty. OK deraadt@
* Factor out the URI check we do in various places into valid_uri().claudio2021-03-054-58/+50
| | | | | RRDP will add a bunch more checks so this makes even more sense. With and OK tb@
* Factor out the SHA256 hash checks into valid_filehash() so that it canclaudio2021-03-053-46/+50
| | | | | be used by the RRDP code as well. OK tb@
* add missing PCI classesjan2021-03-051-1/+8
| | | | OK dlg@
* Start porting smtpd to libtls.eric2021-03-0523-577/+549
| | | | | | | | | | Note that it changes the way SNI works: The certificate to use is now selected by looking at the names found in the certificates themselves, rather than the names of the pki entries in the configuration file. The set of certificates for a tls listener must be defined explicitly by using the pki listener option multiple times. ok tb@
* Remove space at end of lineclaudio2021-03-051-2/+2
|
* Fix some heap over-read in logging in PPTP protocol handler.yasuoka2021-03-052-18/+17
|
* Add two error checks for strdup for consistency.tb2021-03-042-6/+8
| | | | ok claudio
* typo in commenttb2021-03-041-2/+2
|
* Last commit was done from a non-clean tree. Revert one line that brokeclaudio2021-03-041-2/+2
| | | | everything. Oups.
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.