rpki-client: limit number of RSC checklist entries?

2022-05-31 Thread Theo Buehler
When compared to manifest FileAndHash, the RSC code doesn't limit the size of the FileNameAndHash list. Should we do this for consistency? The situation is of course not quite the same since we're in -f mode. However, we do impose limits on the sizes of other resources, so it looks like a missing

Re: rpki-client: implement rsc-08.txt with templates

2022-05-31 Thread Job Snijders
On Tue, May 31, 2022 at 04:16:20PM +0200, Claudio Jeker wrote: > On Tue, May 31, 2022 at 01:16:19PM +0200, Theo Buehler wrote: > > I chose to implement the constrained versions of the RFC 3779 types from > > the draft because the OpenSSL RFC 3779 code has static IPAddrBlocks_it, > > so we have to w

Re: start unlocking kbind(2)

2022-05-31 Thread Martin Pieuchot
On 18/05/22(Wed) 15:53, Alexander Bluhm wrote: > On Tue, May 17, 2022 at 10:44:54AM +1000, David Gwynne wrote: > > + cookie = SCARG(uap, proc_cookie); > > + if (pr->ps_kbind_addr == pc) { > > + membar_datadep_consumer(); > > + if (pr->ps_kbind_cookie != cookie) > > +

Re: rpki-client: implement rsc-08.txt with templates

2022-05-31 Thread Claudio Jeker
On Tue, May 31, 2022 at 01:16:19PM +0200, Theo Buehler wrote: > I chose to implement the constrained versions of the RFC 3779 types from > the draft because the OpenSSL RFC 3779 code has static IPAddrBlocks_it, > so we have to work around that anyway. This isn't quite minimal, but it > avoids asymm

TLSv1.3 PSK: add support for psk_key_exchange_modes extension

2022-05-31 Thread Theo Buehler
The diff below implements sending and parsing the psk_key_exchange_modes extension. Only PSK_DHE_KE will be supported, so clients only indicate support for this mode and servers ignore all other modes (i.e., PSK_KE). This is currently gated behind a use_psk_dhe_ke Boolean in the TLSv1.3 handshake

TLSv1.3 PSK: reject PSK without psk_key_exchange_modes

2022-05-31 Thread Theo Buehler
RFC 8446, 4.2.9: A client MUST provide a "psk_key_exchange_modes" extension if it offers a "pre_shared_key" extension. If clients offer "pre_shared_key" without a "psk_key_exchange_modes" extension, servers MUST abort the handshake. The check below will make servers abort the handshak

rpki-client: implement rsc-08.txt with templates

2022-05-31 Thread Theo Buehler
I chose to implement the constrained versions of the RFC 3779 types from the draft because the OpenSSL RFC 3779 code has static IPAddrBlocks_it, so we have to work around that anyway. This isn't quite minimal, but it avoids asymmetry between ASIdentifiers and IPAddrBlocks and it's cleaner than reus

Re: ix(4): Add support for TCP Large Receive Offloading

2022-05-31 Thread Stuart Henderson
Might need "make obj" -- Sent from a phone, apologies for poor formatting. On 31 May 2022 10:22:46 Hrvoje Popovski wrote: On 27.5.2022. 18:25, Jan Klemkow wrote: Hi, The following diff enables the TCP Large Receive Offloading feature for ix(4) interfaces. It also includes a default off sy

Re: ix(4): Add support for TCP Large Receive Offloading

2022-05-31 Thread Hrvoje Popovski
On 31.5.2022. 11:36, Theo Buehler wrote: >> smc24# cd /usr/src && make includes > > Do 'cd /usr/src && make obj' first. > Yes, thank you ...

Re: ix(4): Add support for TCP Large Receive Offloading

2022-05-31 Thread Theo Buehler
> smc24# cd /usr/src && make includes Do 'cd /usr/src && make obj' first.

Re: ix(4): Add support for TCP Large Receive Offloading

2022-05-31 Thread Hrvoje Popovski
On 27.5.2022. 18:25, Jan Klemkow wrote: > Hi, > > The following diff enables the TCP Large Receive Offloading feature for > ix(4) interfaces. It also includes a default off sysctl(2) switch. > > The TCP single stream receiving performance increased from 3.6 Gbit/s to > 9.4 Gbit/s. Measured from