clear pf state when reconnecting a udp socket

2020-04-21 Thread Tim Kuijsten
Whenever a connected UDP socket is connected to another peer, any previous state should be cleared in PF so that only datagrams from the newly connected peer are deliverd to the socket. Without this patch the following scenario can occur on machines with PF enabled using keep state on matching

Re: [PATCH] correcting in-sane ntpd.conf

2019-12-09 Thread Tim Kuijsten
> Nor do you bring up the traffic to the IP addresses offered by > pool.ntp.org. That traffic has a pattern easily distinguished as > "system startup". > > What's the difference? There isn't. Yet you brought up only google. I can understand why someone would be ok with sending some packets to

unveil and renameat

2019-08-01 Thread Tim Kuijsten
Today I finally got to try unveil(2) and retrofit it into one of my applications. I really like it. But there was one thing that tripped me up for a bit. When trying to move a file from one directory into a subdirectory I kept getting an ENOENT when trying to accomplish this with renameat(2).

Re: Grammar and style edits to installation guide

2019-07-09 Thread Tim Kuijsten
Ian McWilliam wrote: > Isn't Unix a trademark of the Open Group? Hence the usage of Unix-like or > Un*x.. That trademark is UNIX, all caps. According to [APUEv3]: "The Open Group owns the UNIX trademark and uses the Single UNIX Specification to define the interfaces an implementation must

cross-reference htobe64(3) in htonl(3)

2019-02-12 Thread Tim Kuijsten
Found out about htobe64(3) after grepping through the source. -Tim Index: htonl.3 === RCS file: /cvs/src/lib/libc/net/htonl.3,v retrieving revision 1.4 diff -u -p -u -r1.4 htonl.3 --- htonl.3 10 Mar 2016 08:42:26 - 1.4

Re: disable the ability to change tun(4) mode from p2p to bcast and back again

2019-02-05 Thread Tim Kuijsten
On Tue, Feb 05, 2019 at 01:50:25PM +1000, David Gwynne wrote: On 4 Feb 2019, at 22:00, Tim Kuijsten wrote: On Mon, Feb 04, 2019 at 12:07:22PM +1000, David Gwynne wrote: Currently you can change a tun interface from being point to point to being a broadcast interface. Why? I'm using

Re: disable the ability to change tun(4) mode from p2p to bcast and back again

2019-02-04 Thread Tim Kuijsten
On Mon, Feb 04, 2019 at 12:07:22PM +1000, David Gwynne wrote: Currently you can change a tun interface from being point to point to being a broadcast interface. Why? I'm using broadcast mode in my own wireguard implementation because there can be more than one peer on the network:

spf walk: lookup aaaa records with "a" mechanism

2018-10-14 Thread Tim Kuijsten
Hi, When the "a" designated sender mechanism is used in an spf txt record, both v4 and v6 addresses are matched according to [1], so let `smtpctl spf walk` resolve both A and records. Current output: $ echo netsend.nl | smtpctl spf walk 80.127.135.115 80.127.98.234 Expected output: $

Re: [patch] acme-client listen option

2017-12-06 Thread Tim Kuijsten
On Tue, Dec 05, 2017 at 01:33:23PM -0700, Theo de Raadt wrote: >That was also the initial design with substantial priv seperation. >It shouldn't be designed to tap another process potentially running >with a different uid. Not wanting to touch processes that run with different user ids, is that

Re: [patch] acme-client listen option

2017-12-05 Thread Tim Kuijsten
That was also the initial design with substantial priv seperation. It shouldn't be designed to tap another process potentially running with a different uid. Not wanting to touch processes that run with different user ids, is that in order to fully eliminate any influence from the other

[patch] acme-client listen option

2017-12-05 Thread Tim Kuijsten
t opts; Index: servproc.c === RCS file: servproc.c diff -N servproc.c --- /dev/null 1 Jan 1970 00:00:00 - +++ servproc.c 5 Dec 2017 11:16:44 - @@ -0,0 +1,108 @@ +/* + * Copyright (c) 2017 Tim Kuijsten &l

acme-client listen option

2017-10-01 Thread Tim Kuijsten
EWDKEY 0x0004 #define ACME_OPT_CHECK 0x0008 +#define ACME_OPT_LISTEN0x0016 struct acme_conf { int opts; Index: servproc.c === RCS file: servproc.c diff -N servproc.c --- /dev/null

plug mem leak in ldapd/btree.c

2016-11-30 Thread Tim Kuijsten
Plug a memory leak in btree_close. From https://github.com/OrangeTide/btree/commit/e186331494b213286934bcc03a1d8c4650836e3b Index: btree.c === RCS file: /cvs/src/usr.sbin/ldapd/btree.c,v retrieving revision 1.36 diff -u -p -r1.36