claudio [Tue, 2 Feb 2021 18:35:38 +0000 (18:35 +0000)]
Adjust the repository handling a bit. Instead of storing host/module pairs
store repo (rsync URI) and local (the local path to the repository).
Simplifies the the rsync handling a fair bit.
OK deraadt@
claudio [Tue, 2 Feb 2021 18:33:11 +0000 (18:33 +0000)]
Add a mkpath() helper function to rpki-client to recursively create
directories.
OK deraadt@
claudio [Tue, 2 Feb 2021 17:55:12 +0000 (17:55 +0000)]
As done for the AF_INET multicast case, ensure that passed interface
via index is actually in the right rdomain for the socket.
OK bluhm@ mvs@
claudio [Tue, 2 Feb 2021 17:53:02 +0000 (17:53 +0000)]
KNF, move { up to if () statement
claudio [Tue, 2 Feb 2021 17:47:42 +0000 (17:47 +0000)]
If IP_MULTICAST_IF or IP_ADD_MEMBERSHIP pass a interface index to the
kernel make sure that the rdomain of that interface is the same as
the rdomain of the inpcb.
Problem spotted and fix tested by semarie@
OK bluhm@ mvs@
cheloha [Tue, 2 Feb 2021 15:46:16 +0000 (15:46 +0000)]
dhclient(8): fork_privchld, take_charge, propose_release: poll(2) -> ppoll(2)
Switch from poll(2) to ppoll(2) in a few more functions.
Because we're working with ppoll(2) and clock_gettime(2) it is easier
to encode the various timeouts as static const timespecs instead of
preprocessor macros. This way we aren't packing timespecs in the
middle of the code, which distracts from the (more important) logic of
what the code is doing.
Part of a larger campaign improve "time stuff" in dhclient(8).
Prompted by and discussed with krw@. Based on a diff by krw@.
ok krw@
naddy [Tue, 2 Feb 2021 15:42:00 +0000 (15:42 +0000)]
replace fgetln(3) with getline(3) in disklabel
Since getline() returns a C string, we don't need to carry around
the length separately.
ok millert@
claudio [Tue, 2 Feb 2021 15:24:43 +0000 (15:24 +0000)]
Properly implement 'rde med compare strict' and make sure that the order
of prefixes is always correct. The strict RFC4271 way of checking MED is
requires to check the neighbor AS and only do the check if the AS are equal.
Because of this it is possible that inserting or removing a route reshuffles
the total order.
prefix_cmp() was extended to return the location where the decision happened:
- 0 if the decision was before the MED comparison or med compare always is set
- 1 if the decision happened after the MED comparison
- 2 if the MED made caused the decision
With this the new functions prefix_insert() and prefix_remove() are able
to decide if more prefixes need to be evaluated (testall was not 0.) and
if prefixes need to be re-evaluated after this one was put (testall = 2).
There is a local redo list where prefixes where the MED resulted in a
reshuffle are put on. After the new prefix is inserted all prefixes on
the redo list are reinserted. Because now all affected MED routes get
reevaluated the order is always correct.
job [Tue, 2 Feb 2021 13:58:26 +0000 (13:58 +0000)]
Add a bunch of RPKI OIDs
RFC6482 - A Profile for Route Origin Authorizations (ROAs)
RFC6484 - Certificate Policy (CP) for the RPKI
RFC6493 - The RPKI Ghostbusters Record
RFC8182 - The RPKI Repository Delta Protocol (RRDP)
RFC8360 - RPKI Validation Reconsidered
draft-ietf-sidrops-rpki-rta - A profile for RTAs
Also in OpenSSL: https://github.com/openssl/openssl/commit/
d3372c2f35495d0c61ab09daf7fba3ecbbb595aa
OK sthen@ tb@ jsing@
nicm [Tue, 2 Feb 2021 13:03:03 +0000 (13:03 +0000)]
Fix popup mouse position.
robert [Tue, 2 Feb 2021 12:58:42 +0000 (12:58 +0000)]
introduce support for sending the If-Modified-Since header while
fetching over http(s) and use the timestamps from the remote server's
Last-Modified header if available when saving local files
this makes it possible to mirror files better with ftp(1)
the new timestamp behaviour can be disabled with the new '-u' flag
ok sthen@, input from sthen@ and gnezdo@
ratchov [Tue, 2 Feb 2021 11:18:57 +0000 (11:18 +0000)]
Fix use-after-free in dev_abort()
Fixes crash that can occur when an usb device is unplugged, found by edd@
jmc [Tue, 2 Feb 2021 07:37:18 +0000 (07:37 +0000)]
article fix; from eddie youseph
jmc [Tue, 2 Feb 2021 07:33:29 +0000 (07:33 +0000)]
article fixes; from eddie youseph
danj [Tue, 2 Feb 2021 00:34:03 +0000 (00:34 +0000)]
Improve the last comment
Remove a trailing white space, don't misspell misconfiguration and
use https.
ok jmc, claudio
jca [Mon, 1 Feb 2021 21:48:36 +0000 (21:48 +0000)]
Document MODOCAML_RUNDEP
ok bket@ sthen@ (who initially suggested the if-not-native value under
a similar name)
espie [Mon, 1 Feb 2021 20:15:01 +0000 (20:15 +0000)]
in case we're not a tty, don't do anything else
this does fix the grep case
bluhm [Mon, 1 Feb 2021 18:11:46 +0000 (18:11 +0000)]
ESP path MTU discovery over IPv6 tunnel has been fixed. Add test.
sthen [Mon, 1 Feb 2021 16:39:50 +0000 (16:39 +0000)]
change "demote counter" / "demote count" to "demotion counter", ok deraadt
sthen [Mon, 1 Feb 2021 16:39:19 +0000 (16:39 +0000)]
describe pfsync(4)'s use of carpdemote, ok/tweak kn deraadt
tobhe [Mon, 1 Feb 2021 16:37:48 +0000 (16:37 +0000)]
Take flows into consideration for policy lookup as initiator.
Fixes a bug where policies that only differ in their flow
configuration lead to a handshake error.
Found by claudio@
ok patrick@
cheloha [Mon, 1 Feb 2021 16:29:22 +0000 (16:29 +0000)]
dhclient(8): default_route_index(): poll(2) -> ppoll(2)
Use ppoll(2) instead of poll(2) in default_route_index(). Using
ppoll(2) here forces us to use clock_gettime(2) to measure the
timeout, which is less error-prone than using time(3).
Part of a larger campaign in dhclient(8) to make "time stuff" more
accurate and robust.
Prompted by krw@. Based on a diff from krw@.
ok krw@
kettenis [Mon, 1 Feb 2021 16:27:06 +0000 (16:27 +0000)]
The code in mdstore.c should stand on its own, so rename the global
variables used here instead of using the ones from config.c.
ok deraadt@, kn@
visa [Mon, 1 Feb 2021 15:55:07 +0000 (15:55 +0000)]
Remove obsolete vnode operation vector declarations.
OK bluhm@, claudio@, mpi@, semarie@
tb [Mon, 1 Feb 2021 15:35:41 +0000 (15:35 +0000)]
Use "EC/RSA key setup failure" to align error with others
ok eric jsing
tobhe [Mon, 1 Feb 2021 15:13:15 +0000 (15:13 +0000)]
Whitespace
jsg [Mon, 1 Feb 2021 14:30:01 +0000 (14:30 +0000)]
handle #pinctrl-cells 2
needed for >= linux 5.9 dtbs on bbb
ok kettenis@
bluhm [Mon, 1 Feb 2021 13:25:04 +0000 (13:25 +0000)]
Fix path MTU discovery for ESP tunneled in IPv6. We always want
short TCP segments or fragments encapsulated in ESP instead of
fragmented ESP packets. Pass the don't fragment flag down along
the stack so that dynamic routes with MTU are created eventually.
with and OK markus@; OK tobhe@
bluhm [Mon, 1 Feb 2021 12:52:07 +0000 (12:52 +0000)]
Syntax of pf(4) route-to has changed. Adapt tests.
bluhm [Mon, 1 Feb 2021 12:08:50 +0000 (12:08 +0000)]
Fix white spaces and wrap long lines.
mpi [Mon, 1 Feb 2021 11:26:28 +0000 (11:26 +0000)]
Start implementing conditionals for filters.
Allows to check the existence of a variable in predicates, making it
possible to trace syscall latency, as follow:
syscall:select:entry
{
@start[pid] = nsecs;
}
syscall:select:return
/@start[pid]/
{
@usecs = hist((nsecs - @start[pid]) / 1000);
delete(@start[pid]);
}
mglocker [Mon, 1 Feb 2021 09:21:51 +0000 (09:21 +0000)]
Align the mixed naming for the variables used to reference to
bInterfaceNumber and bAlternateSetting as following:
ifaceidx -> ifaceno
altidx -> altno
Suggested and ok mpi@
nicm [Mon, 1 Feb 2021 08:01:14 +0000 (08:01 +0000)]
Add a no-detached choice to detach-on-destroy which detaches only if
there are no other detached sessions to switch to, from Sencer Selcuk in
GitHub issue 2553.
mvs [Mon, 1 Feb 2021 07:46:55 +0000 (07:46 +0000)]
Netlock should be grabbed before pppx_if_find() call in pppxwrite().
Otherwise this `pxi' can be killed by concurrent thread after context
switch caused by following netlock.
ok yasuoka@
mvs [Mon, 1 Feb 2021 07:44:58 +0000 (07:44 +0000)]
Remove dummy TUNSIFMODE ioctl(2) call from pppac(4) and npppd(8). Since
OpenBSD 6.7 npppd(8) can't work over tun(4).
ok yasuoka@
mvs [Mon, 1 Feb 2021 07:43:33 +0000 (07:43 +0000)]
ifunit() was fully replaced by if_unit(9) and should go away.
ok bluhm@ dlg@
jmc [Mon, 1 Feb 2021 07:39:59 +0000 (07:39 +0000)]
update the pathname for the control socket path; from daniel jakots
clean up FILES while here
ok claudio for the former
jmc [Mon, 1 Feb 2021 07:33:19 +0000 (07:33 +0000)]
update currency exchange rates;
jmc [Mon, 1 Feb 2021 07:09:37 +0000 (07:09 +0000)]
some article fixes; from eddie youseph and grep
deraadt [Mon, 1 Feb 2021 05:49:48 +0000 (05:49 +0000)]
a regular function decl collides with an inline, due to C99 inline rules.
We are never updating this sub-tree. Knock out the collision in the simplest
way. diff from mortimer.
This is the last change required for -fno-common on all architectures,
thanks to mortimer for starting the effort and encouraging others.
deraadt [Mon, 1 Feb 2021 05:45:02 +0000 (05:45 +0000)]
sync
krw [Mon, 1 Feb 2021 01:42:20 +0000 (01:42 +0000)]
Switch dispatch loop to ppoll() and protocol timeouts to struct timespec.
Reduces spurious packet transmissions in situations with short timings.
Suggestions millert@, further suggestions & ok cheloha@
dlg [Mon, 1 Feb 2021 00:31:04 +0000 (00:31 +0000)]
change route-to so it sends packets to IPs instead of interfaces.
this is a significant (and breaking) reworking of the policy based
routing that pf can do. the intention is to make it as easy as
nat/rdr to use, and more robust when it's operating.
the main reasons for this change are:
- route-to, reply-to, and dup-to do not work with pfsync
this is because the information about where to route-to is stored in
rules, and it is hard to have a ruleset synced between firewalls,
and impossible to have them synced 100% of the time.
- i can make my boxes panic in certain situations using route-to
yeah...
- the configuration and syntax for route-to rules are confusing.
the argument to route-to and co is an interace name with an optional
ip address. there are several problems with this. one is that people
tend to think about routing as sending packets to peers by their
address, not by the interface they're reachable on. another is that
we currently have no way to synchronise interface topology information
between firewalls, so using an interface to say where packets go
means we can't do failover of these states with pfsync. another
is that a change in routing topology means a host may become
reachable over a different interface. tying routing policy to
interfaces gets in the way of failover and load balancing.
this change does the following:
- stores the route info in the state instead of the pf rule
this allows route-to to keep working when the ruleset changes, and
allows route-to info to be sent over pfsync. there's enough spare bits
in pfsync messages that the protocol doesnt break.
the caveat is that route-to becomes tied to pass rules that create
state, like rdr-to and nat-to.
- the argument to route-to etc is a destination ip address
it's not limited to a next-hop address (thought a next-hop can be a
destination address). this allows for the failover and load balancing
referred to above.
- deprecates the address@interface host syntax in pfctl
because routing is done entirely by IPs, the interface is derived from
the route lookup, not pf. any attempt to use the @interface syntax
will fail now in all contexts.
there's enthusiasm from proctor@ jmatthew@ and others
ok sashan@ bluhm@
djm [Sun, 31 Jan 2021 22:55:29 +0000 (22:55 +0000)]
more strictly enforce KEX state-machine by banning packet types
once they are received. Fixes memleak caused by duplicate
SSH2_MSG_KEX_DH_GEX_REQUEST (spotted by portable OpenSSH kex_fuzz
via oss-fuzz #30078).
ok markus@
mglocker [Sun, 31 Jan 2021 19:32:01 +0000 (19:32 +0000)]
Spacing.
tobhe [Sun, 31 Jan 2021 17:23:45 +0000 (17:23 +0000)]
Ignore addresses that are not 0/32 (dynamic) in ikev2_cp_fixaddr()
instead of throwing an error. Fixes a bug where flows without
'dynamic' were skipped when 'config/request address' is used.
ok patrick@
tobhe [Sun, 31 Jan 2021 17:15:38 +0000 (17:15 +0000)]
Don't leak flows if ikev2_cp_fixflow() fails.
ok patrick@
florian [Sun, 31 Jan 2021 16:07:27 +0000 (16:07 +0000)]
Make progress when stepping through rdns proposals even when skipping
localhost.
espie [Sun, 31 Jan 2021 15:22:55 +0000 (15:22 +0000)]
turns out STDOUT may have been redirected, in which case tcgetpgrp will
return -1, in which case we never need to suppress output.
noticed by Mark Patruck
naddy [Sun, 31 Jan 2021 14:24:47 +0000 (14:24 +0000)]
replace fgetln(3) with getline(3) in fdisk
ok millert@
naddy [Sun, 31 Jan 2021 14:23:05 +0000 (14:23 +0000)]
replace fgetln(3) with getline(3) in sed
Partly from Johann Oskarsson for Illumos/FreeBSD.
ok millert@
naddy [Sun, 31 Jan 2021 14:18:44 +0000 (14:18 +0000)]
fix mistaken operator precedence in a pointer dereference in disklabel
ok millert@
patrick [Sun, 31 Jan 2021 11:07:51 +0000 (11:07 +0000)]
Add basic support for BCM4378 as found on the Apple M1 SoCs. There's a
little bit more to do though before it can be enabled.
patrick [Sun, 31 Jan 2021 10:52:36 +0000 (10:52 +0000)]
regen
patrick [Sun, 31 Jan 2021 10:51:53 +0000 (10:51 +0000)]
Add Broadcom BCM4378.
dtucker [Sun, 31 Jan 2021 10:50:10 +0000 (10:50 +0000)]
Set linesize returned by getline to zero when freeing and NULLing the
returned string. OpenBSD's getline handles this just fine, but some
implementations used by -portable do not. ok djm@
deraadt [Sun, 31 Jan 2021 05:14:24 +0000 (05:14 +0000)]
last pieces of satisfying -fno-common
danj [Sat, 30 Jan 2021 22:00:06 +0000 (22:00 +0000)]
Don't print an empty line at the end of `route sourceaddr`
ok denis
deraadt [Sat, 30 Jan 2021 21:06:45 +0000 (21:06 +0000)]
satisfy -fno-common
kn [Sat, 30 Jan 2021 19:34:13 +0000 (19:34 +0000)]
Remove duplicate hvmd decleration
Already declared "extern" in ldomctl.h; required for "-fno-common".
OK kettenis
kn [Sat, 30 Jan 2021 19:32:44 +0000 (19:32 +0000)]
Move global domain declaration to parse.y
This is the only object that uses it; required for "-fno-common".
OK kettenis
krw [Sat, 30 Jan 2021 18:21:06 +0000 (18:21 +0000)]
Add dhclient.conf back to list of "installed network configuration
files during upgrade".
Mistakenly removed during dhclient.conf cleanup of r1.1050.
krw [Sat, 30 Jan 2021 18:16:36 +0000 (18:16 +0000)]
Make editing GPT easier/safer by defaulting offet to beginning of largest
free space and preventing the creation of overlapping partitions.
Prompted & tested by landry@
rob [Sat, 30 Jan 2021 16:48:31 +0000 (16:48 +0000)]
Add AMAP flag description.
OK deraadt@
rob [Sat, 30 Jan 2021 16:43:22 +0000 (16:43 +0000)]
Remove ACOMPAT.
OK deraadt@
naddy [Sat, 30 Jan 2021 15:15:20 +0000 (15:15 +0000)]
document that sizes in fdisk can be input and printed in terabytes
visa [Sat, 30 Jan 2021 14:59:13 +0000 (14:59 +0000)]
Abstract octeon board handling a little
Detect octeon board model in one place, and replace firmware-supplied
board_type with an abstract model identifier in driver code. This makes
it easier to manage with different products, and board flavours, that
happen to use the same model information, such as board_type.
deraadt [Sat, 30 Jan 2021 14:37:01 +0000 (14:37 +0000)]
satisfy -fno-common
espie [Sat, 30 Jan 2021 11:19:01 +0000 (11:19 +0000)]
do not print to STDOUT if we're in background, as requested by Theo
who pointed at ssh code for process group handling. Thanks
espie [Sat, 30 Jan 2021 11:16:58 +0000 (11:16 +0000)]
I'm such a doofus, of course I have to call base method as well
tb [Sat, 30 Jan 2021 10:48:15 +0000 (10:48 +0000)]
missing word in comment
espie [Sat, 30 Jan 2021 10:43:43 +0000 (10:43 +0000)]
switch ProgressMeter to clearer API
espie [Sat, 30 Jan 2021 10:37:22 +0000 (10:37 +0000)]
rework API slightly, so that handle_continue is an explicit method
(to be overrideen by subclasses when needed)
florian [Sat, 30 Jan 2021 10:31:51 +0000 (10:31 +0000)]
Re-try to open DNSSEC trust anchor file if /var is not mounted yet.
This is a step towards starting unwind earlier, before the network is
up and partitions are mounted.
OK kn
espie [Sat, 30 Jan 2021 10:24:19 +0000 (10:24 +0000)]
for now, do not try to install quirks in case we're running "not"
the better thing to do would be to pseudo-install it under /tmp so we
can run it, but it requires way more changes
martijn [Sat, 30 Jan 2021 08:44:42 +0000 (08:44 +0000)]
Fix delay parsing by stealing from strtonum and returning a proper error to
the user when an invalid value is entered instead of silently falling back
to the default 5s.
While here I also capped the upper limit to UINT32_MAX /
1000000 to prevent
useconds_t overflow. This hard limits us to 4294s, instead of the current
soft limit which just make systat go berserk if you go over it.
Reported and original diff by Nick Gasson nick <at> nickg <dot> me <dot> uk
OK cheloha@
Tweaks and OK bluhm@
djm [Sat, 30 Jan 2021 00:56:38 +0000 (00:56 +0000)]
add a SK_DUMMY_INTEGRATE define that allows the dummy security key
middleware to be directly linked; useful for writing fuzzers, etc.
tobhe [Fri, 29 Jan 2021 21:26:06 +0000 (21:26 +0000)]
Add proper padding for pfkey messages. Use ROUNDUP() for auth and
enc keys.
ok patrick@
florian [Fri, 29 Jan 2021 17:48:58 +0000 (17:48 +0000)]
Some libunbound configuration changes can change the quality of a
resolver so we have to schedule a re-check.
OK kn
florian [Fri, 29 Jan 2021 17:46:04 +0000 (17:46 +0000)]
Don't filter by address family on the route socket.
While here also set SOCK_NONBLOCK on the frontend routesock.
sthen [Fri, 29 Jan 2021 17:12:19 +0000 (17:12 +0000)]
update remaining usb.org URLs
sthen [Fri, 29 Jan 2021 17:06:19 +0000 (17:06 +0000)]
update usb.org URLs
sthen [Fri, 29 Jan 2021 16:59:41 +0000 (16:59 +0000)]
update some usb.org URLs following reorganisation, add a new one for upd
partly from Alessandro Ricci
kettenis [Fri, 29 Jan 2021 16:40:07 +0000 (16:40 +0000)]
Adjust for disabling gcc on macppc.
kettenis [Fri, 29 Jan 2021 16:38:20 +0000 (16:38 +0000)]
Stop building gcc on macppc.
ok cwen@, deraadt@
deraadt [Fri, 29 Jan 2021 16:22:34 +0000 (16:22 +0000)]
repair declerations to satisfy -fno-common
ok kettenis
espie [Fri, 29 Jan 2021 15:58:56 +0000 (15:58 +0000)]
be more forceful about FULLPKGPATH
edd [Fri, 29 Jan 2021 11:44:06 +0000 (11:44 +0000)]
Don't rely on USB interfaces being at compliant indices.
When obtaining an interface handle, we currently rely on the device being
properly USB compliant, and thus the interface being at the correct index in
the interfaces array.
However, some devices present their indices incorrectly. For example, the
following audio device exposes interfaces 0, 1 and 3, in that order (skipping
interface 2 entirely):
uaudio2 at uhub4 port 4 configuration 1 interface 3 "E+ Corp. DAC Audio" rev 1.10/0.01 addr 2
uaudio2: class v1, full-speed, async, channels: 2 play, 0 rec, 3 ctls
This means that that the audio stream interface (number 3) is not found at the
expected index of 2, and this causes looking up the handle to fail.
This change makes usbd_device2interface_handle() search for the right
interface, instead of assuming it will be at the right index. Although this is
a little slower, note that this routine not very frequently called and there
are typically not hundreds of interfaces on a typical USB device.
This fixes the above E+ Corp device, and one other uaudio device reported
broken by a user.
With input from, tested by, and OK ratchov@, mglocker@ and kettenis@.
Many thanks!
ratchov [Fri, 29 Jan 2021 11:38:23 +0000 (11:38 +0000)]
Make audio clients use struct opt to reach the device
No behavior change. This decreases the number of explicit references
to the dev structure
ratchov [Fri, 29 Jan 2021 11:36:44 +0000 (11:36 +0000)]
Make control clients use struct opt to reach the device
No behavior change. This decreases the number of explicit references
to the dev structure.
ratchov [Fri, 29 Jan 2021 11:31:28 +0000 (11:31 +0000)]
Rename ctlslot->mask to ctlslot->self to match the rest of the code
No binary change.
ratchov [Fri, 29 Jan 2021 11:25:05 +0000 (11:25 +0000)]
Order opt_list in opt_new() call order, limit items to OPT_NMAX
No behavior change, except for improved debug printfs.
ratchov [Fri, 29 Jan 2021 11:21:00 +0000 (11:21 +0000)]
Move the options list out of the device structure
No behavior change. Later this will ease applying the configuration of
one device to another by "just" swapping pointers.
ratchov [Fri, 29 Jan 2021 10:55:19 +0000 (10:55 +0000)]
Move the control client state out of the device structure
No behavior change. Later this will ease changing the controlled
device by "just" swapping pointers.
ratchov [Fri, 29 Jan 2021 10:51:24 +0000 (10:51 +0000)]
Move the audio clients state out of the device structure
No behavior change. Later this will ease moving clients from one
device to another by "just" swapping pointers.
claudio [Fri, 29 Jan 2021 10:47:24 +0000 (10:47 +0000)]
Use NULL instead of 0 to clear v_socket pointer (which actually clears all
of the v_un pointers).
OK jsg@ mvs@
claudio [Fri, 29 Jan 2021 10:15:42 +0000 (10:15 +0000)]
Adjust regress test, the hash argument to the parse functions was removed.
claudio [Fri, 29 Jan 2021 10:13:16 +0000 (10:13 +0000)]
A while ago rpki-client was changed to validate the sha256 hashes of
files referenced in MFT files during the validation of the MFT file.
An MFT is only valid if all files are present and their hashes are valid.
Because of this there is no longer the need to check the hash when
these files are parsed later on. Remove these checks for CRT, ROA and CRL
files. Use the presence of the pkey when parsing cert files to decide
if it is a root cert or not.
OK tb@
nicm [Fri, 29 Jan 2021 09:48:43 +0000 (09:48 +0000)]
Trim output overwritten by later text or clears completely rather than
only in a few cases. This means we can better track when a line should
wrap. GitHub issue 2537.
jsg [Fri, 29 Jan 2021 08:48:19 +0000 (08:48 +0000)]
recognise Cortex-A78C