Re: vlan tagging surgery

2014-04-21 Thread Reyk Floeter
On Mon, Apr 21, 2014 at 09:01:52PM +0200, Henning Brauer wrote: so while so many here were so busy bikeshedding, wasting everyone's time and hindering progress, reyk and I found that several people, including me, had flaws in their testing. unfortunately have to go the vlan_output route. root

Re: libc: #define to remove support for %n from printf(3)?

2014-05-03 Thread Reyk Floeter
On Fri, May 02, 2014 at 06:50:04PM -0600, Bob Beck wrote: What's their hangup with %n? We normally don't like polluting the world with #ifdef OPENSSL_NO_PERCENT_N... We normally nuke stuff like that Well, it is an evil thing that is rarely used and well-known for some format string

Re: [patch] new ssl features for relayd (more forward secrecy, renegotiation interception)

2014-07-02 Thread Reyk Floeter
Hi, On Wed, Jul 02, 2014 at 01:34:51PM +0200, Markus Gebert wrote: Hi there I hope this is the right mailing list to publish a patch. If not, please let me know where to place it or how I should get in contact with the relayd maintainer(s). I've added some new SSL features and config

Re: divert(4) without mbuf tags

2014-07-09 Thread Reyk Floeter
On Tue, Jul 08, 2014 at 11:39:12PM -0400, Lawrence Teo wrote: The current divert(4) implementation allocates an mbuf tag in pf_test() to store the divert port specified by a divert-packet PF rule. The divert_packet() function then looks up that mbuf tag to retrieve the divert port number

new relayd(8) filter rules

2014-07-09 Thread Reyk Floeter
Hi, I just committed a big change to relayd: the new filtering language. tl;dr - I need your help! Please test the new filter rules in relayd -current to eliminate any remaining issues in the new implementation. When I wrote the HTTP support in relayd, I needed a way to filter and manipulate

Re: Proposition

2014-07-11 Thread Reyk Floeter
Hi, On Fri, Jul 11, 2014 at 11:33:19AM +0100, David Carlier wrote: I was wondering if a generic small geoloc lib might interest ? which can load dynamically any geo localisation library via dlopen and so on ... to get, let's say, a country code with an ip address ... can serve for some

Re: [patch] new ssl features for relayd (more forward secrecy, renegotiation interception)

2014-07-11 Thread Reyk Floeter
Hi, On Wed, Jul 02, 2014 at 01:34:51PM +0200, Markus Gebert wrote: I hope this is the right mailing list to publish a patch. If not, please let me know where to place it or how I should get in contact with the relayd maintainer(s). I've added some new SSL features and config options to

Re: Invalid structure spec for SIOCG80211ALLNODES

2014-08-19 Thread Reyk Floeter
On Fri, Aug 15, 2014 at 09:35:03PM +0400, Vadim Zhukov wrote: The SIOCG80211ALLNODES operate on struct ieee80211_nodereq_all, not on struct ieee80211_nodereq, right? If I understand things correctly, we were on a safe side because struct ieee80211_nodereq is larger than struct

Re: newsyslog.conf: add httpd default log files to the rotation

2014-08-27 Thread Reyk Floeter
On Wed, Aug 27, 2014 at 01:52:19PM +0200, Christian Weisgerber wrote: Add httpd default log files to the rotation. Index: newsyslog.conf === RCS file: /cvs/src/etc/newsyslog.conf,v retrieving revision 1.32 diff -u -p -r1.32

Re: Fix slow DHCP requests in /etc/netstart

2014-09-26 Thread Reyk Floeter
On Fri, Sep 26, 2014 at 01:36:24PM +0100, Stuart Henderson wrote: On 2014/09/26 07:42, Alexander Hall wrote: Before performing a dhcp request, /etc/netstart explicitly takes the interface down. As noted (by me) at g2k14, and also at work, this results in a significant delay in getting the

Re: sort ifconfig -C

2014-11-12 Thread Reyk Floeter
On Wed, Nov 12, 2014 at 10:27:30AM -0500, Ted Unangst wrote: the output is easier to interpret and check if it's sorted. OK reyk@ (but remember that we should put it in #ifndef SMALL if we decide to move list_cloners() out of it) Index: ifconfig.c

change spamd to use divert-to instead of rdr-to

2013-06-19 Thread Reyk Floeter
Hi, since we introduced divert-to, we converted most userland proxies and relays to use this new interface instead of rdr-to. spamd is still missing and should switch to divert-to as well. divert-to has many advantages over rdr-to for proxies. For example, it is much easier to use (most of the

Re: divert-to with sockets bound to any

2013-06-19 Thread Reyk Floeter
On Wed, Jun 19, 2013 at 08:00:01PM +0200, Reyk Floeter wrote: OK? I forgot the in6_pcblookup_listen() case, updated diff below. Reyk Index: sys/netinet/in_pcb.c === RCS file: /cvs/src/sys/netinet/in_pcb.c,v retrieving revision

Re: snmpd OPENBSD-PF-MIB table 'match' counters

2013-09-03 Thread Reyk Floeter
On Tue, Sep 03, 2013 at 10:36:15AM +0100, Stuart Henderson wrote: On 2013/09/02 16:36, Joel Knight wrote: Hi, This diff adds the table packet/byte counters for match rules to PF-MIB. You also need to update LAST-UPDATED in the mib file. otherwise OK. I agree. I even tested it.

Re: ntpd jump ahead

2013-09-04 Thread Reyk Floeter
Hi! On Sun, Aug 11, 2013 at 04:47:08PM -0400, Ted Unangst wrote: Nobody seemed to much care about my previous effort to get OpenBSD to play nicely inside a suspended VM. http://marc.info/?l=openbsd-miscm=134324835209706w=2 Well, I do care about VMs! Instead of the kernel, this time I'm

Re: ntpd jump ahead

2013-09-04 Thread Reyk Floeter
On Wed, Sep 04, 2013 at 02:39:16PM +0200, Matthieu Herrb wrote: On Wed, Sep 04, 2013 at 02:28:00PM +0200, Reyk Floeter wrote: Bah. I tend to turn ntpd off and rely on the internal clock synchronization of the hypervisor. But fixing ntpd inside VMs would probably be a big win

Re: ntpd jump ahead

2013-09-04 Thread Reyk Floeter
On Wed, Sep 04, 2013 at 08:45:25AM -0400, Ted Unangst wrote: Bah. I tend to turn ntpd off and rely on the internal clock synchronization of the hypervisor. But fixing ntpd inside VMs would probably be a big win. Can you explain what you do? I have a vmt timedelta sensor that shows host

Re: defer routing table updates on link state changes

2013-09-12 Thread Reyk Floeter
On Thu, Sep 12, 2013 at 06:51:46AM +0200, Claudio Jeker wrote: On Tue, Aug 27, 2013 at 01:39:14PM +0200, Martin Pieuchot wrote: I think that's the right approach but the current code generating interfaces indexes is too clever from my point of view, it tries to reuse the last index if

Re: defer routing table updates on link state changes

2013-09-12 Thread Reyk Floeter
On Thu, Sep 12, 2013 at 05:18:39PM +0200, Martin Pieuchot wrote: For example, you have to query the IfIndex via SNMP to get further information, like the ifName or statistics, and most monitoring systems would save interface information based on the index - they would not recognize that

Re: defer routing table updates on link state changes

2013-09-12 Thread Reyk Floeter
On Thu, Sep 12, 2013 at 07:19:34PM +0200, Mike Belopuhov wrote: either way, we need to move forward on this. we want to use if_index for the purpose of looking up the interface w/o a pointer to the ifnet. should we implement additional indices for that or snmp problem will be dealt with?

Re: defer routing table updates on link state changes

2013-09-12 Thread Reyk Floeter
On Thu, Sep 12, 2013 at 06:28:15PM +0200, Mike Belopuhov wrote: Sure, I do. You're trying to push one thing and you don't want to hear the concerns about a specific detail of it. with all respect, i think you don't. otherwise you wouldn't be asking the questions you're asking. we do

Re: defer routing table updates on link state changes

2013-09-12 Thread Reyk Floeter
On Thu, Sep 12, 2013 at 05:53:42PM +0200, Mike Belopuhov wrote: looks like you misunderstand the problem we're dealing with here. Sure, I do. You're trying to push one thing and you don't want to hear the concerns about a specific detail of it. FWIW it would be interesting to modify tun(4)

Re: defer routing table updates on link state changes

2013-09-12 Thread Reyk Floeter
On Thu, Sep 12, 2013 at 06:59:13PM +0200, Mike Belopuhov wrote: Ok, let's stop this. I don't think you read what I replied before. I didn't say that we're static with if_indexes, just that we shouldn't make it worse. or implement persistent indices in the snmpd itself maybe? Maybe.

Re: defer routing table updates on link state changes

2013-09-13 Thread Reyk Floeter
On Fri, Sep 13, 2013 at 09:53:03AM +0200, Martin Pieuchot wrote: -let snmpd (or sth else) make up ifindices just for that purpose That looks like the best solution to me. If a userland program want to expose following numbers, then it probably needs to create its own indexes anyway, even

Re: defer routing table updates on link state changes

2013-09-13 Thread Reyk Floeter
On Fri, Sep 13, 2013 at 10:45:57AM +0200, Martin Pieuchot wrote: No, that's utterly stupid. The interface index is a value that is supposed to be consistent across the system. How should it be synced with other userland tools? How would you handle it in if_nametoindex and friends? So

Re: enc interface errno

2013-09-27 Thread Reyk Floeter
On Fri, Sep 27, 2013 at 03:24:25PM +0200, Alexander Bluhm wrote: The error return codes for the enc interface seem quite inconsistent. Always return the appropriate errno. ok? OK Reyk bluhm Index: net/if_enc.c === RCS

snmp client (aka walk)

2013-10-01 Thread Reyk Floeter
Hi, I just committed a simple SNMP client implementation to snmpctl/snmpd. You can use it as an in-tree alternative to net-snmp's snmpwalk/snmpget. Examples: $ snmpctl walk 127.0.0.1 $ snmpctl walk printer.my.domain version 1 oid printerWorkingGroup $ snmpctl -n walk 203.0.113.240 oid ifMIB

Re: snmp client (aka walk)

2013-10-01 Thread Reyk Floeter
On Tue, Oct 01, 2013 at 04:08:48PM +0100, Stuart Henderson wrote: Most things are working fine for me. thanks for testing! v4 and v6 with opensnmpd OK (need two instances of the daemon to test this as it only opens one socket). v4 with net-snmp OK (v6 is possibly a bit broken in the

fix snmpd(8) bulk support

2013-10-01 Thread Reyk Floeter
Hi, some time ago, martinh@ fixed the PRs 6468 and 6071 in snmpd. Unfortunately, that broke GETBULK support and nobody noticed. GETBULK calls mps_getnextreq() multiple times and relies on the incremented/updated OID in o. Without this diff, non-table OIDs were not incremented and returned

Re: upd(4) proposal

2014-02-20 Thread Reyk Floeter
On 20.02.2014, at 12:23, Martin Pieuchot mpieuc...@nolizard.org wrote: On 17/02/14(Mon) 01:11, Andre de Oliveira wrote: On Fri, Feb 14, 2014 at 02:20:57PM +0100, Ingo Schwarze wrote: Hi, a few comments regarding the manual: Ingo, thanks for your feedback. Here follows an updated

relayd SSL/TLS keep RSA private keys in separate process

2014-04-09 Thread Reyk Floeter
/null 1 Jan 1970 00:00:00 - +++ ca.c9 Apr 2014 14:02:37 - @@ -0,0 +1,414 @@ +/* $OpenBSD$ */ + +/* + * Copyright (c) 2014 Reyk Floeter r...@openbsd.org + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby

Re: relayd SSL/TLS keep RSA private keys in separate process

2014-04-11 Thread Reyk Floeter
On Wed, Apr 09, 2014 at 04:20:23PM +0200, Reyk Floeter wrote: relayd uses privsep to mitigate the risk of potential attacks. OpenSSL's SSL code wasn't designed with privsep in mind. We already have a hack to load the keys and certificates in the parent process and to send them via imsg

Re: GOST was removed

2014-04-15 Thread Reyk Floeter
Hi, On Tue, Apr 15, 2014 at 09:24:48PM +, �?�?�?�?�? �?�?�?омин wrote: Log message: Remove the GOST engine: It is not compiled or used and depends on the dynamic engine feature that is not enabled in our build. People who need it can still pull it out of the Attic; if it is to have a

Re: relayd SSL/TLS keep RSA private keys in separate process

2014-04-17 Thread Reyk Floeter
On Fri, Apr 11, 2014 at 08:15:27PM -0600, Bob Beck wrote: On Fri, Apr 11, 2014 at 6:09 PM, Reyk Floeter r...@openbsd.org wrote: I did some testing with apache bench (ab) and it shows a negative performance impact when running with multiple preforked relays and concurrent requests

Re: check if chmod was successful

2014-04-18 Thread Reyk Floeter
On Fri, Apr 18, 2014 at 04:00:28PM +0200, Fritjof Bornebusch wrote: Hi guys, this little diff checks if the chmod call was successful or not. Regards, Fritjof Index: rand/randfile.c === RCS file:

Re: vlan vlandev fix

2011-02-17 Thread Reyk Floeter
On Thu, Feb 17, 2011 at 12:45:35PM +0100, Camiel Dobbelaar wrote: On 16-2-2011 14:27, Reyk Floeter wrote: My previous change to vlan(4) allows to change the vlandev and vlan id on-the-fly without re-creating the vlan interface. I hesitated to ask this simple question, because I might

Re: relayd socket splicing

2011-03-06 Thread Reyk Floeter
hi, this diff will break chunked encoding and keep-alive connections where we need to enable splicing for a specified amount of data only and return for the next HTTP header. the env variable should be replaced with a permanent config option in parse.y. reyk On Wed, Mar 02, 2011 at 09:34:14PM

snmpd(8) linkUp/linkDown trap

2011-03-16 Thread Reyk Floeter
hi, the following diff adds the linkUp/Down traps to snmpd. this will help to track interface link state changes via snmp and also virtual link states like carp(4) BACKUP - MASTER transitions. snmpd(8) monitors the link state changes and send traps to the configured receivers accordingly.

Re: Is VPN initiation by traffic possible?

2011-04-15 Thread Reyk Floeter
On Fri, Apr 15, 2011 at 12:37:00PM +0200, Reyk Floeter wrote: Note that iked(8) doesn't support this type of configuration yet. It does understand the acquire/require messages from the kernel but currently requires to have an active flow from an initial IKEv2 handshake. It is on our TODO

Did anyone ever use IPsec socket options?

2011-04-18 Thread Reyk Floeter
Hi, did anyone except itojun ever use the IPsec socket options? It currently only seems to be used by isakmpd/iked to bypass IPsec for IKE traffic but I could not find any code that is using the other modes like require. The attached diff is for testing only and is based on an old KAME ping

Re: snmpd(8) filter-routes

2011-04-21 Thread Reyk Floeter
ok reyk@ but we should think about putting it in all copies of kroute.c On Thu, Apr 21, 2011 at 01:24:36PM +0100, Stuart Henderson wrote: Diff below adds a filter-routes option, defaulting to no. yesno borrowed from bgpd's parser. I've been using a similar diff (but without the config

Re: set skip on ifgroup

2011-05-19 Thread Reyk Floeter
On Thu, May 19, 2011 at 11:26:59AM +0200, Claudio Jeker wrote: To be honest I'm not sure who will do a 'set skip on sis' or 'set skip on em'. I would ;-) Sometimes you have machines with different types of physical interfaces where one type is used for internal stuff like a dedicated pfsync or

Re: Split iked(8) policy creation imsg

2011-05-20 Thread Reyk Floeter
Hi! On Fri, May 20, 2011 at 03:54:03PM +0400, Vadim Zhukov wrote: This patch splits off IMSG_CFG_POLICY into four messages: IMSG_CFG_POLICY_BEGIN IMSG_CFG_POLICY_PROPOSAL IMSG_CFG_POLICY_FLOW IMSG_CFG_POLICY_COMMIT Each new policy should start with IMSG_CFG_POLICY_BEGIN, then

Re: Allow ipsecctl-like grouping in iked(8)

2011-05-20 Thread Reyk Floeter
hi, On Thu, May 19, 2011 at 11:06:44PM +0400, Vadim Zhukov wrote: This patch allows ipsecctl-like flow grouping along with current behavior. It allows to write many-to-many policies in a more compact way, see an example: ikev2 esp \ from { 1.2.3.4, 5.6.7.8 } to { 3.4.5.6, 4.5.6.7} \

Re: Add interface groups for dhcpd, fix whitespaces

2011-05-27 Thread Reyk Floeter
On Fri, May 27, 2011 at 11:11:37AM +0200, Michal Mazurek wrote: Add listening on interface groups for dhcpd, from gilles@' smtpd. the dhcpd bit is interesting. Add static to is_if_in_group in smtpd and relayd. i normally don't use static functions in relayd. Fix whitespaces in

Re: SNMPv3 Support

2012-07-18 Thread Reyk Floeter
yes, I agree. It makes sense to keep the RFC terminology in the implementation but to use the common language in the configuration grammar. developers need to understand the code related to the RFCs, users shouldn't have to learn new terminology for crypto thats is configured in n other places in

Re: SNMPv3 Support

2012-07-18 Thread Reyk Floeter
Hi, On Wed, Jul 18, 2012 at 4:16 PM, Gerhard Roth gerhard_r...@genua.de wrote: thanks for your thorough inspection of my code. I really appreciate this. Please find my answers inline below. Hope I didn't miss one. Your latest diff looks good! I will test and have another look at the diff and

please test: SNMPv3 is now in -current

2012-09-17 Thread Reyk Floeter
Hi, I just committed simple SNMPv3 support based on Gerhard Roth's diff. More testing is appreciated, especially with any other clients except net-snmp. 1. Checkout snmpd(8) from -current (mirrors may take a while to sync) 2. Configure your snmpd.conf with SNMPv3 support: seclevel enc user

relayd multiple backup table diff for testing

2012-09-25 Thread Reyk Floeter
Hi! During n2k12, I started working on partially rewriting the relay HTTP handling and filter language. The filter language will introduce a new grammar, better flexibility, and a reworked code path in the daemon itself. One goal is to allow selection of the forwarding target or table with the

Re: relayd multiple backup table diff for testing

2012-10-02 Thread Reyk Floeter
Hi, any more feedback on this diff? I will move forward and commit this diff soon if nobody complains before. Reyk On Tue, Sep 25, 2012 at 05:29:31PM +0200, Reyk Floeter wrote: Hi! During n2k12, I started working on partially rewriting the relay HTTP handling and filter language

Fix iked's auto-srcid based on the local hostname

2012-10-09 Thread Reyk Floeter
Hi, the iked.conf(5) manpage says: If srcid is omitted, the default is to use the hostname of the local machine, see hostname(1) to set or print the hostname. This was true but I broke it with a commit about two years ago :( The following diff tells ikev2_policy2id() in ca_setreq() that it's

Re: Kill NSC HYPERchannel leftover

2012-10-12 Thread Reyk Floeter
ok reyk@ (i actually tested the diff *g*) Unless miod objects, of course... On Fri, Oct 12, 2012 at 12:39:50PM +0200, Mike Belopuhov wrote: Hi, Unless Miod objects, I'd like to kill this leftover. We don't seem to be ditching AF_* defines, so AF_HYLINK glory will be preserved. OK? diff

relayd: add new load balancing scheduling algorithms

2012-10-15 Thread Reyk Floeter
Hi, the following diff adds support for the following scheduling algorithms: relays + rdrs: - source-hash - random rdrs: - least-states redirect foobar { listen on 198.51.100.24 port 80 forward to servers check tcp mode least-states } relay foobar { listen on

Re: relayd: add new load balancing scheduling algorithms

2012-10-18 Thread Reyk Floeter
Hi! On Mon, Oct 15, 2012 at 01:44:01PM +0200, Reyk Floeter wrote: the following diff adds support for the following scheduling algorithms: relays + rdrs: - source-hash - random rdrs: - least-states I was actually wrong about source-hash and random, they do not work with pf tables

patch: pf source-hash/random with dynamic address pools

2012-11-14 Thread Reyk Floeter
Hi! pf currently only supports the round-robin and least-states methods when using dynamic address pools like tables or interface pools. The following diff adds support for source-hash and random with dynamic pools. source-hash can be used in some cases as an alternative to sticky-address to

Re: ##@!#@# gnu tools

2012-11-15 Thread Reyk Floeter
On Thu, Nov 15, 2012 at 5:11 PM, Marc Espie es...@nerim.net wrote: external people regularly ask but why you don't want to use GNU/m4 GNU/make GNU/whatever ? External people seem to ask weird questions. I just had to dig into autoconf/auto* because it seems to be a must have for a portable

Re: VPN traffic leaks in IPv6/IPv4 dual-stack networks/hosts

2012-11-23 Thread Reyk Floeter
On Fri, Nov 23, 2012 at 12:44:32PM +0100, Henning Brauer wrote: * Fernando Gont ferna...@gont.com.ar [2012-11-23 12:09]: FYI. This is might affect OpenBSD users employing e.g. OpenVPN: http://tools.ietf.org/html/draft-gont-opsec-vpn-leakages. we're way less affected than other OSes, since

Re: set ifp-if_baudrate with IF_Gbps() / IF_Mbps()

2012-11-23 Thread Reyk Floeter
On Fri, Nov 23, 2012 at 11:57:50AM -0200, Gleydson Soares wrote: set ifp-if_baudrate with IF_Gbps() / IF_Mbps(). OK ? Index: if_ste.c === RCS file: /cvs/src/sys/dev/pci/if_ste.c,v retrieving revision 1.48 diff -u -p -r1.48

Re: Display hardmtu with ifconfig hwfeatures

2012-11-23 Thread Reyk Floeter
On Fri, Nov 23, 2012 at 04:04:20PM +, Stuart Henderson wrote: This adds an ioctl to retrieve if_hardmtu, and adds code to display it via ifconfig hwfeatures. $ ifconfig em0 hwfeatures em0: flags=8b43UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST mtu 1500

Re: VPN traffic leaks in IPv6/IPv4 dual-stack networks/hosts

2012-11-23 Thread Reyk Floeter
On Fri, Nov 23, 2012 at 05:01:16PM +0100, Reyk Floeter wrote: Actually, in the iked(8)/IPsec case we could even block all v6 traffic without using PF by simply inserting a single deny flow. For example: # ping6 -w ff02::1%em0 # ipsecctl -vf /etc/ipsec-block.conf flow esp out from ::/0

Re: Display hardmtu with ifconfig hwfeatures

2012-11-23 Thread Reyk Floeter
On Fri, Nov 23, 2012 at 05:46:27PM +, Christian Weisgerber wrote: Stuart Henderson s...@spacehopper.org wrote: This adds an ioctl to retrieve if_hardmtu, and adds code to display it via ifconfig hwfeatures. I'm worried that our drivers don't set this or that the value doesn't

Re: set ifp-if_baudrate with IF_Gbps() / IF_Mbps()

2012-11-25 Thread Reyk Floeter
Am Sonntag, 25. November 2012 schrieb Brad Smith : On Fri, Nov 23, 2012 at 11:57:50AM -0200, Gleydson Soares wrote: set ifp-if_baudrate with IF_Gbps() / IF_Mbps(). OK ? Although it has already been commited its the wrong direction to go in. These should be removed as the MII framework

Re: clonable bpf

2012-11-28 Thread Reyk Floeter
On Tue, Nov 27, 2012 at 10:17 PM, Mike Belopuhov m...@belopuhov.com wrote: apparently it works just fine. the number of clones is limited by the v_specbitmap which currently allows for 64 clones total (per system, not per process). Please clarify: Does it mean 64 cloned bpf devices per

cloneable tun

2012-11-28 Thread Reyk Floeter
Hi, inspired by mikeb@'s clonable bpf patch, this slightly more complex diff implements clonable interface support to tun(4). The idea is to split the fixed relation between device minor number (/dev/tunX) and interface unit (ifconfig tunY). In difference to the current tun(4) implementation,

Re: cloneable tun

2012-11-28 Thread Reyk Floeter
On Wed, Nov 28, 2012 at 10:42 PM, Mark Kettenis mark.kette...@xs4all.nl wrote: But currently /dev/tunN is usable from any programming language that that can do reads and writes. With Reyk's changes you need to do an ioctl even for basic usage, which is at best quirky in languages other than

Re: cloneable tun

2012-11-29 Thread Reyk Floeter
On Thu, Nov 29, 2012 at 10:59 AM, Mike Belopuhov m...@belopuhov.com wrote: But currently /dev/tunN is usable from any programming language that that can do reads and writes. With Reyk's changes you need to do an ioctl even for basic usage, which is at best quirky in languages other than

Re: set ifp-if_baudrate with IF_Gbps() / IF_Mbps()

2012-11-29 Thread Reyk Floeter
On Thu, Nov 29, 2012 at 3:12 PM, Mike Belopuhov m...@belopuhov.com wrote: OK? Please note that pfctl/altq has a bug where bandwidth specification expressed in percentage gets converted to the absolute value when pfctl is run. And since for some NICs in some setups it might take some time

Re: cloneable tun

2012-11-30 Thread Reyk Floeter
On Thu, Nov 29, 2012 at 11:05 PM, Mark Kettenis mark.kette...@xs4all.nl wrote: #!/usr/bin/perl require sys/ioctl.ph; $TUNSIFUNIT = _IOC(IOC_INOUT, ord('t'), 90, 4); open(TUN0, +/dev/tun0) or die open; ioctl(TUN0, $TUNSIFUNIT, $unit = pack(i, -1)) or die ioctl $!; print Returned:

relayd SSL interception

2013-01-22 Thread Reyk Floeter
relay.c --- relay.c 17 Jan 2013 20:34:18 - 1.161 +++ relay.c 22 Jan 2013 15:33:05 - @@ -1,7 +1,7 @@ /* $OpenBSD: relay.c,v 1.161 2013/01/17 20:34:18 bluhm Exp $ */ /* - * Copyright (c) 2006 - 2012 Reyk Floeter r...@openbsd.org + * Copyright (c) 2006 - 2013 Reyk

Re: IKEd support for ECDSA key authentication?

2013-03-12 Thread Reyk Floeter
Hi! Am 11.03.2013 um 02:04 schrieb Jason Hall cake...@gmail.com: I recently started using (open)IKEd, and am quite happy with it. Very easy to configure/use, well documented, and supports many protocols. Following USA's NSA Suite B security recommendations for which protocols to use (because

Re: better filenames for certificates in relayd

2013-03-19 Thread Reyk Floeter
On Tue, Mar 19, 2013 at 05:57:16PM +1000, David Gwynne wrote: this lets the code that picks the filenames to use for certificates fall through to using the services name, instead of just the ip addresses of the service. eg, if i have this in relayd.conf: relay sslnews.eait.uq.edu.au

Re: trunk(4) take MTU from first member port.

2013-05-10 Thread Reyk Floeter
Hi, the diff is needed - I was running into it quite recently when I was trying some QinQ/svlan configurations on trunk. Comments below, otherwise OK reyk On Fri, May 10, 2013 at 02:11:28PM +0100, Stuart Henderson wrote: Index: if_trunk.c

Re: trunk(4) take MTU from first member port.

2013-05-10 Thread Reyk Floeter
On Fri, May 10, 2013 at 04:53:18PM +0200, Mike Belopuhov wrote: if (tr-tr_ac.ac_if.if_mtu != ifp-if_mtu) seems wrong. what about people who want to use trunk between two totally different interfaces for failover? i think the trunk mtu should simply be the lowest common of the group. i

Re: iked(8) and GCM

2013-05-17 Thread Reyk Floeter
Hi, On Fri, May 17, 2013 at 12:55:15PM -0700, Aaron Stellman wrote: Before I proceed, I realize that iked is not yet finished and is missing some important security features. I am just pointing out something that may not be known, and perhaps should be addressed. ... ikev2 esp from

Re: vmxnet3

2013-05-31 Thread Reyk Floeter
Hi, this is some nice work! The new virtual VMXNET3 chipset supports a few features that haven't been available in the previous chipsets, including VLAN Guest Tagging (VGT), or simply the ability to pass tagged VLANs from VMware hosts to external switches, and checksum offloading (hint, hint).

Re: vmxnet3

2013-05-31 Thread Reyk Floeter
=== RCS file: vmx.4 diff -N vmx.4 --- /dev/null 1 Jan 1970 00:00:00 - +++ vmx.4 31 May 2013 19:55:49 - @@ -0,0 +1,111 @@ +.\$OpenBSD$ +.\ +.\ Copyright (c) 2006,2013 Reyk Floeter r...@openbsd.org +.\ +.\ Permission to use, copy, modify, and distribute this software for any

Re: Stop printing excessive numbers of ACPI wakeup devices

2013-06-01 Thread Reyk Floeter
On Sat, Jun 01, 2013 at 08:01:58PM +0200, Gregor Best wrote: On Sat, Jun 01, 2013 at 06:57:21AM -0700, Mike Larkin wrote: [...] Sure, go ahead. [...] Then I propose the following variant of the patch: code and dmesg looks fine, ok reyk@ acpi0: wakeup devices PCI0(S3) USB_(S1)

Call for testing: IPsec diff

2010-07-02 Thread Reyk Floeter
Hi! I need people to test the following IPsec diff on existing setups running -current. This diff will add some cool features for the next release but I first need regression testing with plain old setups (ipsec.conf with static keying or isakmpd); preferrably on IPsecs that are running closely

Re: Call for testing: IPsec diff

2010-07-02 Thread Reyk Floeter
Hi, updating one side should be enough. reyk On Sat, Jul 03, 2010 at 01:15:50AM +0400, Vadim Zhukov wrote: 2010/7/3 Reyk Floeter r...@openbsd.org: Hi! I need people to test the following IPsec diff on existing setups running -current. ??This diff will add some cool features

Re: Call for testing: IPsec diff (update)

2010-07-03 Thread Reyk Floeter
On Fri, Jul 02, 2010 at 10:49:52PM +0200, Reyk Floeter wrote: I need people to test the following IPsec diff on existing setups running -current. This diff will add some cool features for the next release but I first need regression testing with plain old setups (ipsec.conf with static keying

Re: Call for testing: IPsec diff (update)

2010-07-09 Thread Reyk Floeter
On Wed, Jul 07, 2010 at 05:26:22PM +, Christian Weisgerber wrote: Reyk Floeter r...@openbsd.org wrote: --- net/if_bridge.c 2 Jul 2010 02:40:16 - 1.181 +++ net/if_bridge.c 3 Jul 2010 17:22:52 - @@ -152,7 +152,8 @@ u_int8_t bridge_filterrule(struct brl_he struct mbuf

please test vlan(4) diff: allow to change vlan/vlandev on the fly

2010-12-29 Thread Reyk Floeter
Hi! vlan(4) and svlan(4) users should test this diff. It annoys me for some time that vlan(4) does not allow to change its vlan id or parent interface at runtime. The current code returns EBUSY and always forces you to destroy and re-create the interface. The attached diff changes this

Re: relayd: exec program on gateway change

2010-12-29 Thread Reyk Floeter
Hi, On Mon, Dec 27, 2010 at 11:24:20PM +0100, Sebastian Benoit wrote: i am using relayd in router mode for a cable-modem link that sometimes does not work. I need to run a programm to load/unload pf-rules and to restart a proxy with a different config whenever this happens. I remember

more m_free(): possible memory leak in trunk(4)'s broadcast mode

2011-01-28 Thread Reyk Floeter
hi, this will plug another memleak by using m_freem() (free whole mbuf chain) instead m_free() (free first mbuf only). ok? reyk Index: net/if_trunk.c === RCS file: /cvs/src/sys/net/if_trunk.c,v retrieving revision 1.76 diff -u -p

more m_free(): memleak in mpe(4)

2011-01-28 Thread Reyk Floeter
hi, this one also looks suspicious to me... OK? reyk Index: net/if_mpe.c === RCS file: /cvs/src/sys/net/if_mpe.c,v retrieving revision 1.24 diff -u -p -r1.24 if_mpe.c --- net/if_mpe.c21 Jan 2011 17:42:57 - 1.24

Re: [patch] Make tcpbench server non-forking and non-blocking.

2009-06-08 Thread Reyk Floeter
hi, the idea sounds ok, but why just 128? tcpbench is for benchmarking and testing and it should be possible to run more concurrent connections. it could call getrlimit() to get the actual RLIMIT_NOFILE value which is 128 by default but can be much higher. another variant is the way

Re: relayd: convert to siphash

2014-12-12 Thread Reyk Floeter
On Fri, Dec 12, 2014 at 12:57:08PM -0500, Ted Unangst wrote: On Wed, Dec 10, 2014 at 21:51, Max Fillinger wrote: Here's a version without malloc'ing the key. Looks like it still does? + if (sip_key == NULL) { + sip_key =

Re: remove sys/hash.h

2014-12-18 Thread Reyk Floeter
On Thu, Dec 18, 2014 at 03:12:39PM -0500, Ted Unangst wrote: This is pending reyk's relayd patch, which I think is coming soon. After that, we don't need sys/hash.h anywhere in src. relayd is in... There could maybe be ports fallout, but that seems unlikely in most cases because this is an

relayd: source-hash and random for redirections

2014-12-19 Thread Reyk Floeter
Hi, the following diff adds support for source-hash and random modes to relayd's redirections. It depends on the latest pf change. Example: ---snip--- redirect foo { listen on 0.0.0.0 port 8080 forward to foo check tcp port 80 mode source-hash # forward to foo check tcp

Re: httpd: multiple addresses for one server

2015-01-03 Thread Reyk Floeter
On Thu, Jan 01, 2015 at 11:54:46PM -0500, Geoff Steckel wrote: Is there any way todo the equivalent of: server an.example.com listen on 192.168.2.99 listen on 2001.fefe.1.1::99 ?? It appears that the code in parse.y explicitly forbids this and the data structures for a server

Re: httpd: multiple addresses for one server

2015-01-03 Thread Reyk Floeter
On Sat, Jan 03, 2015 at 04:40:19PM +0100, Christopher Zimmermann wrote: Hi, On Sat, 3 Jan 2015 14:42:18 +0100 Reyk Floeter r...@openbsd.org wrote: On Thu, Jan 01, 2015 at 11:54:46PM -0500, Geoff Steckel wrote: Is there any way todo the equivalent of: server an.example.com

Re: httpd: multiple addresses for one server

2015-01-03 Thread Reyk Floeter
On Sat, Jan 03, 2015 at 05:19:16PM +0100, Reyk Floeter wrote: My tests show that memory usage is not the problem but that there's indeed a problem with the pre-opened file descriptors for servers; something that is not necessary with aliases. A simple fix will follow. Here is a fix

Re: netstat Makefile fix

2015-02-07 Thread Reyk Floeter
On Sun, Feb 08, 2015 at 02:53:32AM +0100, Claudio Jeker wrote: Do extend CFLAGS instead forcing it to just -Wall at least that way make DEBUG=-g works again. just also ran into it... OK -- :wq Claudio Index: Makefile ===

Re: syslog over TLS

2015-01-16 Thread Reyk Floeter
On Fri, Jan 16, 2015 at 01:46:09AM +0100, Alexander Bluhm wrote: Hi, This diff enables sending syslog messages over TLS. To implement the buffer layer, I have copied evbuffer.c from libevent and changed TCP to TLS where necessary. This way I made a buffertls wrapper around bufferevent.

Re: syslog over TLS

2015-01-16 Thread Reyk Floeter
to libevent is the right direction. We could change the evbuffer API _in libevent_ to make it easier using it with TCP, libssl, libssl or anything else instead of just TCP. But without adding any TLS code to libevent. Reyk On Fri, Jan 16, 2015 at 10:00:46AM +0100, Reyk Floeter wrote: On Fri

Re: syslog over TLS

2015-01-16 Thread Reyk Floeter
On Fri, Jan 16, 2015 at 12:56:45PM +0100, Alexander Bluhm wrote: On Fri, Jan 16, 2015 at 01:46:09AM +0100, Alexander Bluhm wrote: This diff enables sending syslog messages over TLS. Updated diff after sys/param.h commit. Only some context changed. bluhm Despite my scepticism about

Re: Authenticated TLS contraints in ntpd(8)

2015-02-11 Thread Reyk Floeter
On Thu, Feb 12, 2015 at 02:05:59AM +1300, Carlin Bingham wrote: On Wed, 11 Feb 2015, at 12:32 AM, Reyk Floeter wrote: Let me share the answer to a question that I got in a private mail: On Tue, Feb 10, 2015 at 10:55:53AM +0100, Reyk Floeter wrote: ---snip--- servers pool.ntp.org

Re: syslogd SSL3_WRITE_PENDING:bad write retry

2015-02-16 Thread Reyk Floeter
On Mon, Feb 16, 2015 at 10:03:51PM +0100, Alexander Bluhm wrote: On Mon, Feb 16, 2015 at 10:17:05AM +0100, Reyk Floeter wrote: On Sun, Feb 15, 2015 at 11:21:45PM +0100, Alexander Bluhm wrote: On Fri, Feb 13, 2015 at 02:44:18PM -0500, Ted Unangst wrote: I think this is ok, but it needs

Re: ntpd: prefer sizeof(thing) to sizeof(struct type)

2015-01-12 Thread Reyk Floeter
On Mon, Jan 12, 2015 at 09:02:50AM -0600, Brent Cook wrote: On Fri, Jan 09, 2015 at 05:45:17PM -0500, Ted Unangst wrote: On Fri, Jan 09, 2015 at 15:45, Brent Cook wrote: From: Brent Cook bust...@gmail.com Yeah yeah, a pointer is a pointer (except when it isn't :). I think this

Authenticated TLS contraints in ntpd(8)

2015-02-10 Thread Reyk Floeter
Hi! Theo, Henning, and me developed an idea to utilize TLS in some way for authenticated time in ntpd(8). We are not intending to use it as a direct time source, but as a constraint to verify the NTP responses. I came up with an implementation that has been designed to be an optional,

  1   2   3   4   >