Re: ASLR bypass on OpenBSD-5.6
On Wed, Jan 14, 2015 at 5:52 PM, Theo de Raadt dera...@cvs.openbsd.org wrote: And what breaks? Did you do an assessment? Hypothetically, if we do this and it improves security but breaks mplayer or firefox and people are forced to run some other system instead, is it then a security improvement? Indeed. On a Linux machine of mine, I've tried booting a grsecurity patched kernel (v3.18.2). First, enabling Grsecurity/PaX options automatically disables HIBERNATE support, thus hibernation is no more possible. Second, I've tried booting with it and the KDE desktop blew up with a lot of segfaults :( I have no polemic intentions, I just wanted to report some facts... Ciao! David
Re: libpcap use after free
On 15 January 2015 at 03:53, Lawrence Teo l...@openbsd.org wrote:
libpcap has a use after free (found via LLVM).
pcap_close() currently looks like this:
void
pcap_close(pcap_t *p)
{
if (p-opt.source != NULL)
free(p-opt.source);
pcap_cleanup_bpf(p);
free(p);
}
The bug affects libpcap programs that enable monitor mode on 802.11
devices (i.e. if they call pcap_set_rfmon() followed by
pcap_activate()). If pcap_close() is called after that,
pcap_cleanup_bpf() will attempt to use p-opt.source while trying to
disable monitor mode, resulting in a use after free.
The fix is simple (diff below). I tested this with a small program
that calls pcap_create(), pcap_set_rfmon(), pcap_activate(), and
pcap_close() on an iwn(4) device with MALLOC_OPTIONS=AFGJPRX.
With the diff applied, the test program no longer segfaults.
ok?
Looks good to me. OK mikeb
PATCH: NAT on IPSec
Hello folks,
This patch brings nat capabilites into iked, the same way that mpf@ did
with isakmpd about 6 years ago.
Comments ?
Tested with the following setup, with icmp, udp and tcp:
Local pf.conf:
table homev4 { 172.23.0.0/23 }
set skip on lo
match out on enc0 from ! homev4 to homev4 nat-to 172.23.50.1
block return
pass
block return in on ! lo0 proto tcp to port 6000:6010
Local iked.conf:
ikev2 active esp \
from 172.23.50.1 (0.0.0.0/0) to 172.23.0.0/23 peer 79.143.250.153 \
srcid 'spinoza.kilob.yt' dstid 'brouwer.kilob.yt'
Local ip address:
ppp0: flags=8051UP,POINTOPOINT,RUNNING,MULTICAST mtu 1500
priority: 0
groups: ppp egress
inet 100.97.217.112 -- 10.64.64.64 netmask 0xff00
Remote pf.conf:
[...]
pass on enc0
[...]
Remote iked.conf:
ikev2 esp \
from 172.23.0.0/23 to 172.23.50.1 peer any \
srcid 'brouwer.kilob.yt' dstid 'spinoza.kilob.yt'
Index: iked.h
===
RCS file: /cvs/src/sbin/iked/iked.h,v
retrieving revision 1.82
diff -u -p -r1.82 iked.h
--- iked.h 18 Aug 2014 09:43:02 - 1.82
+++ iked.h 15 Jan 2015 13:54:46 -
@@ -139,6 +139,8 @@ struct iked_flow {
struct iked_addr flow_src;
struct iked_addr flow_dst;
u_intflow_dir; /* in/out */
+ struct iked_addr flow_prenat; /* pre-nat source */
+ u_intflow_usenat;
u_intflow_loaded; /* pfkey done */
Index: parse.y
===
RCS file: /cvs/src/sbin/iked/parse.y,v
retrieving revision 1.43
diff -u -p -r1.43 parse.y
--- parse.y 12 Jan 2015 11:24:58 - 1.43
+++ parse.y 15 Jan 2015 13:54:47 -
@@ -2401,7 +2401,7 @@ create_ike(char *name, int af, u_int8_t
{
char idstr[IKED_ID_SIZE];
u_intidtype = IKEV2_ID_NONE;
- struct ipsec_addr_wrap *ipa, *ipb;
+ struct ipsec_addr_wrap *ipa, *ipb, *ipn;
struct iked_policy pol;
struct iked_proposal prop[2];
u_intj;
@@ -2622,6 +2622,16 @@ create_ike(char *name, int af, u_int8_t
flows[j].flow_dst.addr_mask = ipb-mask;
flows[j].flow_dst.addr_net = ipb-netaddress;
flows[j].flow_dst.addr_port = hosts-dport;
+
+ ipn = ipa-srcnat;
+ if (ipn) {
+ memcpy(flows[j].flow_prenat.addr, ipn-address,
+ sizeof(ipn-address));
+ flows[j].flow_prenat.addr_af = ipn-af;
+ flows[j].flow_prenat.addr_mask = ipn-mask;
+ flows[j].flow_prenat.addr_net = ipn-netaddress;
+ flows[j].flow_usenat = 1;
+ }
flows[j].flow_ipproto = ipproto;
Index: pfkey.c
===
RCS file: /cvs/src/sbin/iked/pfkey.c,v
retrieving revision 1.40
diff -u -p -r1.40 pfkey.c
--- pfkey.c 29 Oct 2014 06:26:39 - 1.40
+++ pfkey.c 15 Jan 2015 13:54:47 -
@@ -180,6 +180,7 @@ int
pfkey_flow(int sd, u_int8_t satype, u_int8_t action, struct iked_flow *flow)
{
struct sadb_msg smsg;
+ struct iked_addr*flow_src, *flow_dst;
struct sadb_address sa_src, sa_dst, sa_local, sa_peer, sa_smask,
sa_dmask;
struct sadb_protocol sa_flowtype, sa_protocol;
@@ -192,58 +193,76 @@ pfkey_flow(int sd, u_int8_t satype, u_in
sport = dport = 0;
sa_srcid = sa_dstid = NULL;
+ flow_src = flow-flow_src;
+ flow_dst = flow-flow_dst;
+
+ if (flow-flow_usenat)
+ switch (flow-flow_type) {
+ case SADB_X_FLOW_TYPE_USE:
+ flow_dst = flow-flow_prenat;
+ break;
+ case SADB_X_FLOW_TYPE_REQUIRE:
+ flow_src = flow-flow_prenat;
+ break;
+ case 0:
+ if (flow-flow_dir == IPSP_DIRECTION_IN)
+ flow_dst = flow-flow_prenat;
+ else
+ flow_src = flow-flow_prenat;
+ }
+
bzero(ssrc, sizeof(ssrc));
bzero(smask, sizeof(smask));
- memcpy(ssrc, flow-flow_src.addr, sizeof(ssrc));
- memcpy(smask, flow-flow_src.addr, sizeof(smask));
- if ((sport = flow-flow_src.addr_port) != 0)
+ memcpy(ssrc, flow_src-addr, sizeof(ssrc));
+ memcpy(smask, flow_src-addr, sizeof(smask));
+ if ((sport = flow_src-addr_port) != 0)
dport = 0x;
socket_af((struct sockaddr *)ssrc, sport);
socket_af((struct sockaddr *)smask, dport);
- switch
Re: Remove more .Tn markup from manpages
Hi Jan, Jan Stary wrote on Thu, Jan 15, 2015 at 10:31:54AM +0100: The following diff removes .Tn from bin, games, libm, libexec, and a few assorted places; replaces some .Tn with .Dv if they are. Committed, thanks. Ingo
remove disabled chapms from pppd
This code doesn't build (CHAPMS not defined), and it contains
unspeakable DES horrors, so I'd like to remove it entirely.
Index: chap.c
===
RCS file: /cvs/src/usr.sbin/pppd/chap.c,v
retrieving revision 1.17
diff -u -p -r1.17 chap.c
--- chap.c 17 May 2014 20:31:07 - 1.17
+++ chap.c 15 Jan 2015 19:42:23 -
@@ -66,10 +66,6 @@
#include pppd.h
#include chap.h
-#ifdef CHAPMS
-#include chap_ms.h
-#endif
-
/*
* Protocol entry points.
*/
@@ -468,12 +464,6 @@ ChapReceiveChallenge(cstate, inp, id, le
BCOPY(hash, cstate-response, MD5_SIGNATURE_SIZE);
cstate-resp_length = MD5_SIGNATURE_SIZE;
break;
-
-#ifdef CHAPMS
-case CHAP_MICROSOFT:
- ChapMS(cstate, rchallenge, rchallenge_len, secret, secret_len);
- break;
-#endif
default:
CHAPDEBUG((LOG_INFO, unknown digest type %d, cstate-resp_type));
Index: chap_ms.c
===
RCS file: chap_ms.c
diff -N chap_ms.c
--- chap_ms.c 27 Oct 2009 23:59:53 - 1.10
+++ /dev/null 1 Jan 1970 00:00:00 -
@@ -1,344 +0,0 @@
-/* $OpenBSD: chap_ms.c,v 1.10 2009/10/27 23:59:53 deraadt Exp $*/
-
-/*
- * chap_ms.c - Microsoft MS-CHAP compatible implementation.
- *
- * Copyright (c) 1995 Eric Rosenquist. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *notice, this list of conditions and the following disclaimer in
- *the documentation and/or other materials provided with the
- *distribution.
- *
- * 3. The name(s) of the authors of this software must not be used to
- *endorse or promote products derived from this software without
- *prior written permission.
- *
- * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
- * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
- * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
- * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
- * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Modifications by Lauri Pesonen / lpeso...@clinet.fi, april 1997
- *
- * Implemented LANManager type password response to MS-CHAP challenges.
- * Now pppd provides both NT style and LANMan style blocks, and the
- * prefered is set by option ms-lanman. Default is to use NT.
- * The hash text (StdText) was taken from Win95 RASAPI32.DLL.
- *
- * You should also use DOMAIN\\USERNAME as described in README.MSCHAP80
- */
-
-#ifdef CHAPMS
-
-#include stdio.h
-#include string.h
-#include ctype.h
-#include sys/types.h
-#include sys/time.h
-#include syslog.h
-#include unistd.h
-#include md4.h
-#ifdef HAVE_CRYPT_H
-#include crypt.h
-#endif
-
-#include pppd.h
-#include chap.h
-#include chap_ms.h
-
-#ifndef USE_CRYPT
-#include des.h
-#endif
-
-typedef struct {
-u_char LANManResp[24];
-u_char NTResp[24];
-u_char UseNT; /* If 1, ignore the LANMan response field */
-} MS_ChapResponse;
-/* We use MS_CHAP_RESPONSE_LEN, rather than sizeof(MS_ChapResponse),
- in case this struct gets padded. */
-
-
-static voidChallengeResponse(u_char *, u_char *, u_char *);
-static voidDesEncrypt(u_char *, u_char *, u_char *);
-static voidMakeKey(u_char *, u_char *);
-static u_char Get7Bits(u_char *, int);
-static voidChapMS_NT(char *, int, char *, int, MS_ChapResponse *);
-#ifdef MSLANMAN
-static voidChapMS_LANMan(char *, int, char *, int, MS_ChapResponse *);
-#endif
-
-#ifdef USE_CRYPT
-static voidExpand(u_char *, u_char *);
-static voidCollapse(u_char *, u_char *);
-#endif
-
-static void
-ChallengeResponse(challenge, pwHash, response)
-u_char *challenge; /* IN 8 octets */
-u_char *pwHash;/* IN 16 octets */
-u_char *response; /* OUT 24 octets */
-{
-charZPasswordHash[21];
-
-BZERO(ZPasswordHash, sizeof(ZPasswordHash));
-BCOPY(pwHash, ZPasswordHash, MD4_SIGNATURE_SIZE);
-
-#if 0
-log_packet(ZPasswordHash, sizeof(ZPasswordHash), ChallengeResponse -
ZPasswordHash, LOG_DEBUG);
-#endif
-
-DesEncrypt(challenge, ZPasswordHash + 0, response + 0);
-DesEncrypt(challenge, ZPasswordHash + 7, response + 8);
-DesEncrypt(challenge, ZPasswordHash + 14, response + 16);
-
-#if 0
-log_packet(response, 24, ChallengeResponse - response, LOG_DEBUG);
-#endif
-}
-
-
-#ifdef USE_CRYPT
-static void
-DesEncrypt(clear, key, cipher)
-u_char *clear; /* IN 8 octets */
-u_char
cleanup sys/crypto/des.h
Almost of the entirety of des.h is useless userland prototypes (some for
perl5!). There's also some junk that can be excised from des_locl.h.
Then the two or three things that matter can simply be put in
des_locl.h and we're one header lighter.
Index: des.h
===
RCS file: des.h
diff -N des.h
--- des.h 13 Jun 2005 10:56:44 - 1.3
+++ /dev/null 1 Jan 1970 00:00:00 -
@@ -1,254 +0,0 @@
-/* $OpenBSD: des.h,v 1.3 2005/06/13 10:56:44 hshoexer Exp $*/
-
-/* lib/des/des.h */
-/* Copyright (C) 1995 Eric Young (e...@mincom.oz.au)
- * All rights reserved.
- *
- * This file is part of an SSL implementation written
- * by Eric Young (e...@mincom.oz.au).
- * The implementation was written so as to conform with Netscapes SSL
- * specification. This library and applications are
- * FREE FOR COMMERCIAL AND NON-COMMERCIAL USE
- * as long as the following conditions are aheared to.
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed. If this code is used in a product,
- * Eric Young should be given attribution as the author of the parts used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *notice, this list of conditions and the following disclaimer in the
- *documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *must display the following acknowledgement:
- *This product includes software developed by Eric Young
(e...@mincom.oz.au)
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed. i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#ifndef HEADER_DES_H
-#define HEADER_DES_H
-
-#include sys/types.h
-#ifndef _KERNEL
-#include stdio.h
-#endif
-
-typedef unsigned char des_cblock[8];
-typedef struct des_ks_struct
- {
- union {
- des_cblock _;
- /* make sure things are correct size on machines with
-* 8 byte longs */
- int32_t pad[2];
- } ks;
-#undef _
-#define _ ks._
- } des_key_schedule[16];
-
-#define DES_KEY_SZ (sizeof(des_cblock))
-#define DES_SCHEDULE_SZ (sizeof(des_key_schedule))
-
-#define DES_ENCRYPT1
-#define DES_DECRYPT0
-
-#define DES_CBC_MODE 0
-#define DES_PCBC_MODE 1
-
-#define des_ecb2_encrypt(i,o,k1,k2,e) \
- des_ecb3_encrypt((i),(o),(k1),(k2),(k1),(e))
-
-#define des_ede2_cbc_encrypt(i,o,l,k1,k2,iv,e) \
- des_ede3_cbc_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(e))
-
-#define des_ede2_cfb64_encrypt(i,o,l,k1,k2,iv,n,e) \
- des_ede3_cfb64_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(n),(e))
-
-#define des_ede2_ofb64_encrypt(i,o,l,k1,k2,iv,n) \
- des_ede3_ofb64_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(n))
-
-#define C_Block des_cblock
-#define Key_schedule des_key_schedule
-#define ENCRYPT DES_ENCRYPT
-#define DECRYPT DES_DECRYPT
-#define KEY_SZ DES_KEY_SZ
-#define string_to_key des_string_to_key
-#define read_pw_string des_read_pw_string
-#define random_key des_random_key
-#define pcbc_encrypt des_pcbc_encrypt
-#define set_key des_set_key
-#define key_sched des_key_sched
-#define ecb_encrypt des_ecb_encrypt
-#define cbc_encrypt des_cbc_encrypt
-#define ncbc_encrypt des_ncbc_encrypt
-#define cbc_cksum des_cbc_cksum
-#define quad_cksum des_quad_cksum
-
-/* For compatibility with the MIT lib - eay 20/05/92 */
-typedef struct des_key_schedule bit_64;
-#define des_fixup_key_parity des_set_odd_parity
-#define des_check_key_parity check_parity
-
-extern int
no errata for 2015-01-08 openssl advisory
After some review of the issues fixed in the latest OpenSSL release, we will not be publishing errata for them. Referring to: https://www.openssl.org/news/secadv_20150108.txt Several of the reported issues are in code removed from 5.6, and the remainder appear to be low impact. They will of course be fixed in cvs going forward, but at this time, the impact is low enough that it doesn't outweight the stress of patching.
Clarification on bgpd behaviour
Hi I have setup openbsd routers running dual homed with another pair of upstream routers announcing a default route. Each router has two interfaces, egress and ingress. r1 - openbsd1 r2 - openbsd2 r3 - upstream1 r4 - upstream2 vio0 is the external interface uses a /28 network to talk ibgp with two upstream routers. vio1 is the internal interface that also uses a /28 network to interconnect both openbsd routers. Each router has its own private AS, talking with both isp peers via the vio0 (there is only one remote AS) to get a default-route. The two openbsd routers are also connected via ibgp via the vio1 interface. BGP works as expected, yet there is a behaviour i find strange. By setting vio0 down on r1, shouldn't the local route be removed? Although r2 announces a valid default-route, the local route in fib is preferred rendering that network unreachable. Both openbsd routers are vms on top of kvm amd6 -current snapshot 14 Jan Cheers, Pedro Caetano r1 dmesg below: OpenBSD 5.7-beta (GENERIC) #719: Wed Jan 14 18:59:03 MST 2015 dera...@amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC real mem = 117428224 (111MB) avail mem = 110616576 (105MB) mpath0 at root scsibus0 at mpath0: 256 targets mainbus0 at root bios0 at mainbus0: SMBIOS rev. 2.4 @ 0x7fffec0 (10 entries) bios0: vendor Seabios version 0.5.1 date 01/01/2007 bios0: Red Hat KVM acpi0 at bios0: rev 0 acpi0: sleep states S5 acpi0: tables DSDT FACP SSDT APIC SSDT acpi0: wakeup devices acpitimer0 at acpi0: 3579545 Hz, 24 bits acpimadt0 at acpi0 addr 0xfee0: PC-AT compat cpu0 at mainbus0: apid 0 (boot processor) cpu0: AMD Opteron 240 (Gen 1 Class Opteron), 1867.13 MHz cpu0: FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,SSE3,x2APIC,HV cpu0: 64KB 64b/line 2-way I-cache, 64KB 64b/line 2-way D-cache, 512KB 64b/line 16-way L2 cache cpu0: ITLB 255 4KB entries direct-mapped, 255 4MB entries direct-mapped cpu0: DTLB 255 4KB entries direct-mapped, 255 4MB entries direct-mapped cpu0: smt 0, core 0, package 0 mtrr: Pentium Pro MTRR support, 8 var ranges, 88 fixed ranges cpu0: apic clock running at 1000MHz ioapic0 at mainbus0: apid 0 pa 0xfec0, version 11, 24 pins acpiprt0 at acpi0: bus 0 (PCI0) acpicpu0 at acpi0 pci0 at mainbus0 bus 0 pchb0 at pci0 dev 0 function 0 Intel 82441FX rev 0x02 pcib0 at pci0 dev 1 function 0 Intel 82371SB ISA rev 0x00 pciide0 at pci0 dev 1 function 1 Intel 82371SB IDE rev 0x00: DMA, channel 0 wired to compatibility, channel 1 wired to compatibility atapiscsi0 at pciide0 channel 0 drive 0 scsibus1 at atapiscsi0: 2 targets cd0 at scsibus1 targ 0 lun 0: QEMU, QEMU DVD-ROM, 0.12 ATAPI 5/cdrom removable cd0(pciide0:0:0): using PIO mode 0 pciide0: channel 1 disabled (no drives) uhci0 at pci0 dev 1 function 2 Intel 82371SB USB rev 0x01: apic 0 int 11 piixpm0 at pci0 dev 1 function 3 Intel 82371AB Power rev 0x03: apic 0 int 9 iic0 at piixpm0 iic0: addr 0x18 00=00 01=00 02=00 03=00 04=00 05=00 06=00 07=00 08=00 words 00= 01= 02= 03= 04= 05= 06= 07= iic0: addr 0x1a 00=00 01=00 02=00 03=00 04=00 05=00 06=00 07=00 08=00 words 00= 01= 02= 03= 04= 05= 06= 07= iic0: addr 0x29 00=00 01=00 02=00 03=00 04=00 05=00 06=00 07=00 08=00 words 00= 01= 02= 03= 04= 05= 06= 07= iic0: addr 0x2b 00=00 01=00 02=00 03=00 04=00 05=00 06=00 07=00 08=00 words 00= 01= 02= 03= 04= 05= 06= 07= iic0: addr 0x4c 00=00 01=00 02=00 03=00 04=00 05=00 06=00 07=00 08=00 words 00= 01= 02= 03= 04= 05= 06= 07= iic0: addr 0x4e 00=00 01=00 02=00 03=00 04=00 05=00 06=00 07=00 08=00 words 00= 01= 02= 03= 04= 05= 06= 07= vga1 at pci0 dev 2 function 0 Cirrus Logic CL-GD5446 rev 0x00 wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation) wsdisplay0: screen 1-5 added (80x25, vt100 emulation) virtio0 at pci0 dev 3 function 0 Qumranet Virtio Network rev 0x00: Virtio Network Device vio0 at virtio0: address 52:54:00:8f:e4:7f virtio0: apic 0 int 11 virtio1 at pci0 dev 4 function 0 Qumranet Virtio Network rev 0x00: Virtio Network Device vio1 at virtio1: address 52:54:00:8c:ba:45 virtio1: apic 0 int 11 virtio2 at pci0 dev 5 function 0 Qumranet Virtio Storage rev 0x00: Virtio Block Device vioblk0 at virtio2 scsibus2 at vioblk0: 2 targets sd0 at scsibus2 targ 0 lun 0: VirtIO, Block Device, SCSI3 0/direct fixed sd0: 1024MB, 512 bytes/sector, 2097152 sectors virtio2: apic 0 int 10 virtio3 at pci0 dev 6 function 0 Qumranet Virtio Memory rev 0x00: Virtio Memory Balloon Device viomb0 at virtio3 virtio3: apic 0 int 10 virtio4 at pci0 dev 7 function 0 Qumranet Virtio Network rev 0x00: Virtio Network Device vio2 at virtio4: address 52:54:00:70:e5:fc virtio4: apic 0 int 11 isa0 at pcib0 isadma0 at isa0 fdc0 at isa0 port 0x3f0/6 irq 6 drq 2 fd0 at fdc0 drive 0: density unknown fd1 at fdc0 drive 1: density unknown com0 at isa0 port 0x3f8/8 irq 4:
Re: Clarification on bgpd behaviour
That is correct, all routers share a /28 segment, r1 talks with upstream1 and upstream2, r2 talks with upstream1 and upstream2 each with its own private AS. Tomorrow i'll try your suggestions and report back. Thank you, Pedro Caetano On Thu, Jan 15, 2015 at 11:12 PM, Claudio Jeker cje...@diehard.n-r-g.com wrote: On Thu, Jan 15, 2015 at 10:38:50PM +, Pedro Caetano wrote: Hi I have setup openbsd routers running dual homed with another pair of upstream routers announcing a default route. Each router has two interfaces, egress and ingress. r1 - openbsd1 r2 - openbsd2 r3 - upstream1 r4 - upstream2 vio0 is the external interface uses a /28 network to talk ibgp with two upstream routers. vio1 is the internal interface that also uses a /28 network to interconnect both openbsd routers. Each router has its own private AS, talking with both isp peers via the vio0 (there is only one remote AS) to get a default-route. The two openbsd routers are also connected via ibgp via the vio1 interface. If both routers have own private AS numbers they will not have an ibgp session but a ebgp one. Only if they share a common AS number then it is an ibgp session. BGP works as expected, yet there is a behaviour i find strange. By setting vio0 down on r1, shouldn't the local route be removed? No, this is (currently) not happening. The local route (which is staticly declared on the interface) is always valid no matter what. There is currently a lot of work going on in the routing code and maybe we get feature but no promises. Although r2 announces a valid default-route, the local route in fib is preferred rendering that network unreachable. Are r1 - r4 sharing on common network? A few things you can do to make the situation better: - set nexthop self (on the session between r1 and r2 over vio1) - use carp on vio1 and demote carp in the neighbor section for r3 r4 -- :wq Claudio
Re: Clarification on bgpd behaviour
On Thu, Jan 15, 2015 at 10:38:50PM +, Pedro Caetano wrote: Hi I have setup openbsd routers running dual homed with another pair of upstream routers announcing a default route. Each router has two interfaces, egress and ingress. r1 - openbsd1 r2 - openbsd2 r3 - upstream1 r4 - upstream2 vio0 is the external interface uses a /28 network to talk ibgp with two upstream routers. vio1 is the internal interface that also uses a /28 network to interconnect both openbsd routers. Each router has its own private AS, talking with both isp peers via the vio0 (there is only one remote AS) to get a default-route. The two openbsd routers are also connected via ibgp via the vio1 interface. If both routers have own private AS numbers they will not have an ibgp session but a ebgp one. Only if they share a common AS number then it is an ibgp session. BGP works as expected, yet there is a behaviour i find strange. By setting vio0 down on r1, shouldn't the local route be removed? No, this is (currently) not happening. The local route (which is staticly declared on the interface) is always valid no matter what. There is currently a lot of work going on in the routing code and maybe we get feature but no promises. Although r2 announces a valid default-route, the local route in fib is preferred rendering that network unreachable. Are r1 - r4 sharing on common network? A few things you can do to make the situation better: - set nexthop self (on the session between r1 and r2 over vio1) - use carp on vio1 and demote carp in the neighbor section for r3 r4 -- :wq Claudio
Re: cleanup sys/crypto/des.h
On Thu, Jan 15, 2015 at 15:11, Ted Unangst wrote:
Almost of the entirety of des.h is useless userland prototypes (some for
perl5!). There's also some junk that can be excised from des_locl.h.
Then the two or three things that matter can simply be put in
des_locl.h and we're one header lighter.
Even less, even better. No longer need to worry about what mysterious
things will happen when machines have 8 byte longs.
Index: des_locl.h
===
RCS file: /cvs/src/sys/crypto/des_locl.h,v
retrieving revision 1.5
diff -u -p -r1.5 des_locl.h
--- des_locl.h 15 Jan 2015 23:20:33 - 1.5
+++ des_locl.h 15 Jan 2015 23:23:22 -
@@ -57,13 +57,11 @@ typedef unsigned char des_cblock[8];
typedef struct des_ks_struct
{
union {
- des_cblock _;
+ des_cblock cblock;
/* make sure things are correct size on machines with
* 8 byte longs */
int32_t pad[2];
} ks;
-#undef _
-#define _ ks._
} des_key_schedule[16];
#define DES_KEY_SZ (sizeof(des_cblock))
@@ -77,64 +75,16 @@ void des_encrypt2(u_int32_t *data,des_ke
#define ITERATIONS 16
#define HALF_ITERATIONS 8
-/* used in des_read and des_write */
-#define MAXWRITE (1024*16)
-#define BSIZE (MAXWRITE+4)
#define c2l(c,l) (l =((u_int32_t)(*((c)++))), \
l|=((u_int32_t)(*((c)++))) 8L, \
l|=((u_int32_t)(*((c)++)))16L, \
l|=((u_int32_t)(*((c)++)))24L)
-/* NOTE - c is not incremented as per c2l */
-#define c2ln(c,l1,l2,n){ \
- c+=n; \
- l1=l2=0; \
- switch (n) { \
- case 8: l2 =((u_int32_t)(*(--(c24L; \
- case 7: l2|=((u_int32_t)(*(--(c16L; \
- case 6: l2|=((u_int32_t)(*(--(c 8L; \
- case 5: l2|=((u_int32_t)(*(--(c; \
- case 4: l1 =((u_int32_t)(*(--(c24L; \
- case 3: l1|=((u_int32_t)(*(--(c16L; \
- case 2: l1|=((u_int32_t)(*(--(c 8L; \
- case 1: l1|=((u_int32_t)(*(--(c; \
- } \
- }
-
#define l2c(l,c) (*((c)++)=(unsigned char)(((l) )0xff), \
*((c)++)=(unsigned char)(((l) 8L)0xff), \
*((c)++)=(unsigned char)(((l)16L)0xff), \
*((c)++)=(unsigned char)(((l)24L)0xff))
-
-/* replacements for htonl and ntohl since I have no idea what to do
- * when faced with machines with 8 byte longs. */
-#define HDRSIZE 4
-
-#define n2l(c,l) (l =((u_int32_t)(*((c)++)))24L, \
-l|=((u_int32_t)(*((c)++)))16L, \
-l|=((u_int32_t)(*((c)++))) 8L, \
-l|=((u_int32_t)(*((c)++
-
-#define l2n(l,c) (*((c)++)=(unsigned char)(((l)24L)0xff), \
-*((c)++)=(unsigned char)(((l)16L)0xff), \
-*((c)++)=(unsigned char)(((l) 8L)0xff), \
-*((c)++)=(unsigned char)(((l) )0xff))
-
-/* NOTE - c is not incremented as per l2c */
-#define l2cn(l1,l2,c,n){ \
- c+=n; \
- switch (n) { \
- case 8: *(--(c))=(unsigned char)(((l2)24L)0xff); \
- case 7: *(--(c))=(unsigned char)(((l2)16L)0xff); \
- case 6: *(--(c))=(unsigned char)(((l2) 8L)0xff); \
- case 5: *(--(c))=(unsigned char)(((l2) )0xff); \
- case 4: *(--(c))=(unsigned char)(((l1)24L)0xff); \
- case 3: *(--(c))=(unsigned char)(((l1)16L)0xff); \
- case 2: *(--(c))=(unsigned char)(((l1) 8L)0xff); \
- case 1: *(--(c))=(unsigned char)(((l1) )0xff); \
- } \
- }
#define D_ENCRYPT(Q,R,S) {\
u=(R^s[S ]); \
Re: syslog over TLS
On Fri, Jan 16, 2015 at 01:46, Alexander Bluhm wrote: Hi, This diff enables sending syslog messages over TLS. To implement the buffer layer, I have copied evbuffer.c from libevent and changed TCP to TLS where necessary. This way I made a buffertls wrapper around bufferevent. This might be integrated into libevent later. I like the direction this is going, and I think it's in the right place for now. We can learn from this, then decide how to incorporate libtls and libevent later.
validating the syntax of base system manual pages
Hi, this mail is a heads-up regarding some changes to the syntax validation of base system manual pages. It is relevant to people who sometimes edit manuals or often run builds. Yesterday, i fixed the last handful of cases where mandoc(1) used to throw FATAL errors. That is, since today, if mandoc(1) can open a file, it will now always produce some output - at worst, that may be almost empty, but it will never fail outright (except when there is a bug in mandoc, as opposed to a bug in the manual). In other words, mandoc -Tlint -Wfatal can no longer fail on readable files, and consequently, since today, this command is no longer run during make build. In principle, this shortens the build log and speeds up the build - on a modern machine, it's probably not very noticeable, but it might save a bit of time on older architectures. Theo suggested adding a new target to validate the syntax of base system manual pages, and that was easy to do. You are welcome to use it in two situations: 1. You are editing manual pages. In the small subtree you are working on, run make manlint That runs mandoc -Tlint on all manuals in that subtree and errors out if there is a warning or an error. If you consider the complaint reasonable, fix it and rerun. If you suspect a false positive, feel free to talk to me, i might be able to improve mandoc -Tlint. 2. You wonder whether manuals are good in general. Feel free to run something like make -k manlint 21 | grep ^mandoc: over the whole tree (that takes about 16 seconds on my notebook, checking 2248 files) or over large subtrees. If you spot something that you consider a real issue, and unless it's in files maintained by some upstream, sending patches might make sense. Before sinking a lot of time into such work, feel free to ask me whether the work you plan to do makes sense. Here is a snapshot of the current status: bin: 5 warnings games: clean gnu: 737 warnings, 2000 errors lib: 318 warnings, 2 errors libexec: clean sbin: 7 warnings share: 42 warnings sys: 2 warnings usr.bin: 28 warnings usr.sbin: 449 warnings (207 nsd, 179 unbound, 63 elsewhere) Yours, Ingo P.S. One thing i'm planning to do in the future is to split the mandoc ERROR level into two. After the split, ERROR will be for syntax errors in the respective manual page, i.e. for things that must be fixed by removing markup bugs from the manual page. Typically, if there is an ERROR, it won't work well with groff(1), either. A new level (maybe UNSUPP or UNIMPL) will be used for low-level roff(7) constructions that work with groff(1), but are not supported by mandoc(1). This distinction is intended to make life easier for porters. When it's done, checking a port gets simpler: If there is UNSUPP, USE_GROFF - if there are only WARNINGs and ERRORs, no need to. But that's not available yet. Right now, you still need to watch out for ERRORs and then figure out manually of which kind they are, and whether or not they require USE_GROFF.
Remove more .Tn markup from manpages
Ingo, recently you removed .Tn from stdio: On Jan 13 07:02:30, schwa...@cvs.openbsd.org wrote: Modified files: lib/libc/stdio : fgetln.3 fgetwln.3 fopen.3 fputs.3 funopen.3 printf.3 tmpnam.3 Log message: remove .Tn from stdio manuals; Kaspars Bankovskis found one of these The following diff removes .Tn from bin, games, libm, libexec, and a few assorted places; replaces some .Tn with .Dv if they are. Please see also previous diff to tech@ removing .Tn from sys. Jan Index: bin/cat/cat.1 === RCS file: /cvs/src/bin/cat/cat.1,v retrieving revision 1.33 diff -u -p -r1.33 cat.1 --- bin/cat/cat.1 16 Jul 2013 06:52:05 - 1.33 +++ bin/cat/cat.1 14 Jan 2015 20:08:01 - @@ -92,12 +92,9 @@ which are displayed normally. The tab character, control-I, can be made visible via the .Fl t option. -The -.Tn DEL -character (octal 0177) prints as +The DEL character (octal 0177) prints as .Ql ^? . -.Pf Non- Ns Tn ASCII -characters (with the high bit set) are printed as +Non-ASCII characters (with the high bit set) are printed as .Ql M- (for meta) followed by the character for the low 7 bits. .El Index: bin/chio/chio.1 === RCS file: /cvs/src/bin/chio/chio.1,v retrieving revision 1.32 diff -u -p -r1.32 chio.1 --- bin/chio/chio.1 15 Jul 2013 23:43:58 - 1.32 +++ bin/chio/chio.1 14 Jan 2015 20:08:01 - @@ -243,9 +243,7 @@ Configure the changer to use picker 2 (t .Sh AUTHORS The .Nm -program and -.Tn SCSI -changer driver were written by +program and SCSI changer driver were written by .An Jason R. Thorpe Aq Mt thor...@and.com for And Communications .Pq Lk http://www.and.com/ . Index: bin/csh/csh.1 === RCS file: /cvs/src/bin/csh/csh.1,v retrieving revision 1.73 diff -u -p -r1.73 csh.1 --- bin/csh/csh.1 9 Dec 2014 15:37:13 - 1.73 +++ bin/csh/csh.1 14 Jan 2015 20:08:01 - @@ -179,9 +179,7 @@ in the home directory of the invoker, and, if this is a login shell, the file .Pa .login in the same location. -It is typical for users on -.Tn CRT Ns s -to put the command +It is typical for users on CRTs to put the command .Ic stty crt in their .Pa .login @@ -1677,9 +1675,7 @@ Like but no .Ql \e escapes are recognized and words are delimited -by -.Tn NUL -characters in the output. +by NUL characters in the output. Useful for programs that wish to use the shell to filename expand a list of words. .Pp @@ -1936,9 +1932,7 @@ to the given The final two forms run command at priority 4 and .Ar number respectively. -The greater the number, the less -.Tn CPU -the process will get. +The greater the number, the less CPU the process will get. The superuser may specify negative priority by using .Dq nice \-number ... . .Ar command @@ -2570,9 +2564,7 @@ Built-in commands that fail return exit all other built-in commands set status to 0. .It Ic time Controls automatic timing of commands. -If set, then any command that takes more than this many -.Tn CPU -seconds +If set, then any command that takes more than this many CPU seconds will cause a line giving user, system, and real times, and a utilization percentage which is the ratio of user plus system times to real time to be printed when it terminates. Index: bin/date/date.1 === RCS file: /cvs/src/bin/date/date.1,v retrieving revision 1.64 diff -u -p -r1.64 date.1 --- bin/date/date.1 14 Feb 2014 19:12:27 - 1.64 +++ bin/date/date.1 14 Jan 2015 20:08:01 - @@ -93,8 +93,7 @@ Print out (in specified format) the date .Ar seconds from the Epoch. .It Fl t Ar minutes_west -Set the system's value for minutes west of -.Tn GMT . +Set the system's value for minutes west of GMT. .Ar minutes_west specifies the number of minutes returned in .Fa tz_minuteswest Index: bin/dd/dd.1 === RCS file: /cvs/src/bin/dd/dd.1,v retrieving revision 1.31 diff -u -p -r1.31 dd.1 --- bin/dd/dd.1 27 Mar 2014 15:32:13 - 1.31 +++ bin/dd/dd.1 14 Jan 2015 20:08:01 - @@ -123,9 +123,7 @@ using the tape .Xr ioctl 2 function calls. If the seek operation is past the end of file, space from the current -end of file to the specified offset is filled with blocks of -.Tn NUL -bytes. +end of file to the specified offset is filled with blocks of NUL bytes. .It Cm skip= Ns Ar n Skip .Ar n @@ -165,12 +163,8 @@ is one of the symbols from the following .It Cm ascii The same as the .Cm unblock -value except that characters are translated from -.Tn EBCDIC -to -.Tn ASCII -before the -records are converted. +value except that characters are translated from EBCDIC to ASCII +before the records are converted. (These values imply .Cm unblock if the operand
remove include/des.h
Nothing uses it, apart from a false positive in pppd.
I can imagine some ports still include this header, although I'm not
sure what good it does. None of the symbols declared exists anywhere.
I suspect they were all fixed to use libcrypto EVP interfaces, but
maybe a straggler include des.h was left behind?
Index: Makefile
===
RCS file: /cvs/src/include/Makefile,v
retrieving revision 1.197
diff -u -p -r1.197 Makefile
--- Makefile8 Dec 2014 20:39:56 - 1.197
+++ Makefile15 Jan 2015 19:53:18 -
@@ -10,7 +10,7 @@
.include bsd.own.mk
FILES= a.out.h ar.h asr.h assert.h bitstring.h blf.h bsd_auth.h \
- complex.h cpio.h ctype.h curses.h db.h dbm.h des.h dirent.h disktab.h \
+ complex.h cpio.h ctype.h curses.h db.h dbm.h dirent.h disktab.h \
dlfcn.h elf_abi.h err.h errno.h fenv.h float.h fnmatch.h fstab.h fts.h \
ftw.h getopt.h glob.h grp.h ifaddrs.h inttypes.h iso646.h kvm.h \
langinfo.h libgen.h limits.h locale.h login_cap.h malloc.h math.h \
Index: des.h
===
RCS file: des.h
diff -N des.h
--- des.h 4 Mar 2002 22:00:13 - 1.4
+++ /dev/null 1 Jan 1970 00:00:00 -
@@ -1,284 +0,0 @@
-/* $OpenBSD: des.h,v 1.4 2002/03/04 22:00:13 deraadt Exp $ */
-
-/* crypto/des/des.h */
-/* Copyright (C) 1995-1997 Eric Young (e...@mincom.oz.au)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (e...@mincom.oz.au).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to. The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code. The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (t...@mincom.oz.au).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *notice, this list of conditions and the following disclaimer in the
- *documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *must display the following acknowledgement:
- *This product includes cryptographic software written by
- * Eric Young (e...@mincom.oz.au)
- *The word 'cryptographic' can be left out if the rouines from the library
- *being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *the apps directory (application code) you must include an
acknowledgement:
- *This product includes software written by Tim Hudson
(t...@mincom.oz.au)
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed. i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#ifndef HEADER_DES_H
-#define HEADER_DES_H
-
-#ifdef __cplusplus
-extern C {
-#endif
-
-#include stdio.h
-
-#define DES_LONG unsigned int
-
-typedef unsigned char des_cblock[8];
-typedef struct des_ks_struct
- {
- union {
- des_cblock _;
- /* make sure things are correct size on machines with
-* 8 byte longs */
-
axen(4): two small changes
Hi,
1) axen_cmd() returns int instead of usbd_status.
2) the ifp variable in axen_tick_task() is not used so delete it.
Cheers,
Fabian
Index: if_axen.c
===
RCS file: /cvs/src/sys/dev/usb/if_axen.c,v
retrieving revision 1.10
diff -u -p -r1.10 if_axen.c
--- if_axen.c 12 Jan 2015 18:18:42 - 1.10
+++ if_axen.c 15 Jan 2015 14:02:56 -
@@ -176,7 +176,7 @@ int
axen_miibus_readreg(struct device *dev, int phy, int reg)
{
struct axen_softc *sc = (void *)dev;
- usbd_status err;
+ int err;
uWord val;
int ival;
@@ -212,7 +212,7 @@ void
axen_miibus_writereg(struct device *dev, int phy, int reg, int val)
{
struct axen_softc *sc = (void *)dev;
- usbd_status err;
+ int err;
uWord uval;
if (usbd_is_dying(sc-axen_udev))
@@ -1184,7 +1184,6 @@ axen_tick_task(void *xsc)
{
int s;
struct axen_softc *sc;
- struct ifnet*ifp;
struct mii_data *mii;
sc = xsc;
@@ -1195,7 +1194,6 @@ axen_tick_task(void *xsc)
if (usbd_is_dying(sc-axen_udev))
return;
- ifp = GET_IFP(sc);
mii = GET_MII(sc);
if (mii == NULL)
return;
syslog over TLS
Hi,
This diff enables sending syslog messages over TLS.
To implement the buffer layer, I have copied evbuffer.c from libevent
and changed TCP to TLS where necessary. This way I made a buffertls
wrapper around bufferevent. This might be integrated into libevent
later.
It still has some limitations:
- No certificate validation. This will get a bit tricky because
of privsep.
- Wrong format. The TLS RFC requires length-message encoding, I
use message-newline inherited from TCP.
- Not all lost messages are logged.
- At SIGHUP messages may get lost.
- Man page is missing. You can active it with @tls://ip-address.
comment, test, ok?
bluhm
Index: usr.sbin/syslogd/Makefile
===
RCS file: /data/mirror/openbsd/cvs/src/usr.sbin/syslogd/Makefile,v
retrieving revision 1.6
diff -u -p -r1.6 Makefile
--- usr.sbin/syslogd/Makefile 5 Oct 2014 18:14:01 - 1.6
+++ usr.sbin/syslogd/Makefile 15 Jan 2015 13:26:09 -
@@ -1,9 +1,9 @@
# $OpenBSD: Makefile,v 1.6 2014/10/05 18:14:01 bluhm Exp $
PROG= syslogd
-SRCS= syslogd.c ttymsg.c privsep.c privsep_fdpass.c ringbuf.c
+SRCS= syslogd.c ttymsg.c privsep.c privsep_fdpass.c ringbuf.c evbuffer_tls.c
MAN= syslogd.8 syslog.conf.5
-LDADD= -levent
-DPADD= ${LIBEVENT}
+LDADD= -levent -ltls -lssl -lcrypto
+DPADD= ${LIBEVENT} ${LIBTLS} ${LIBSSL} ${LIBCRYPTO}
.include bsd.prog.mk
Index: usr.sbin/syslogd/evbuffer_tls.c
===
RCS file: usr.sbin/syslogd/evbuffer_tls.c
diff -N usr.sbin/syslogd/evbuffer_tls.c
--- /dev/null 1 Jan 1970 00:00:00 -
+++ usr.sbin/syslogd/evbuffer_tls.c 15 Jan 2015 15:18:01 -
@@ -0,0 +1,357 @@
+/* $OpenBSD$ */
+
+/*
+ * Copyright (c) 2002-2004 Niels Provos pro...@citi.umich.edu
+ * Copyright (c) 2014-2015 Alexander Bluhm bl...@openbsd.org
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *notice, this list of conditions and the following disclaimer in the
+ *documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include sys/types.h
+#include sys/time.h
+#include sys/ioctl.h
+
+#include errno.h
+#include event.h
+#include stdio.h
+#include stdlib.h
+#include string.h
+#include stdarg.h
+#include tls.h
+
+#include evbuffer_tls.h
+
+/* prototypes */
+
+void bufferevent_read_pressure_cb(struct evbuffer *, size_t, size_t, void *);
+int evtls_read(struct evbuffer *, int, int, struct tls *);
+int evtls_write(struct evbuffer *, int, struct tls *);
+
+static int
+bufferevent_add(struct event *ev, int timeout)
+{
+ struct timeval tv, *ptv = NULL;
+
+ if (timeout) {
+ timerclear(tv);
+ tv.tv_sec = timeout;
+ ptv = tv;
+ }
+
+ return (event_add(ev, ptv));
+}
+
+static void
+buffertls_readcb(int fd, short event, void *arg)
+{
+ struct buffertls *buftls = arg;
+ struct bufferevent *bufev = buftls-bt_bufev;
+ struct tls *ctx = buftls-bt_ctx;
+ int res = 0;
+ short what = EVBUFFER_READ;
+ size_t len;
+ int howmuch = -1;
+
+ if (event == EV_TIMEOUT) {
+ what |= EVBUFFER_TIMEOUT;
+ goto error;
+ }
+
+ /*
+* If we have a high watermark configured then we don't want to
+* read more data than would make us reach the watermark.
+*/
+ if (bufev-wm_read.high != 0) {
+ howmuch = bufev-wm_read.high - EVBUFFER_LENGTH(bufev-input);
+ /* we might have lowered the watermark, stop reading */
+ if (howmuch = 0) {
+ struct evbuffer *buf = bufev-input;
+ event_del(bufev-ev_read);
+
