Re: pr_input var args
On Wed, 25 Jan 2017, Alexander Bluhm wrote: > Now since raw_input() and route_input() are gone from pr_input, we can > make the variable parameters of the protocol input functions fixed. I > have decided to add the proto to make it similar to IPv6. My goal is to > have one struct protosw for both IP versions. > > ok? It may just be a feather-weight ok in sys/net*, but: ok guenther@
Re: Special rules for early-open fd's in pledge
> On Wed, Jan 25, 2017 at 12:33:36AM -0700, Theo de Raadt wrote: > > > 2. vmd calls openpty() in the pledged parent whenever a new VM is > > > started - effectively doing ioctls on post-pledge fds. I will > > > probably solve this by opening the pty in the non-pledged "priv" > > > process, and do some additional passing, but then I'll also have to > > > give up its chroot to access /dev/. > > > > > > vmd: ioctl 40287401 post-pledge fd 12 > > > vmd(51681): syscall 54 "tty" > > > > How about opening PATH_PTMDEV early and keeping it open in a > > properly protected process; then create pty pairs as required. > > Oh, yes, I should have looked at openpty() in libutil first :) > That makes sense, I will try it. But please don't become too attached to the proposed semantics. It's a proposal, we need to learn if it actually helps or hinders privsep programs become better.
Re: Special rules for early-open fd's in pledge
On Wed, Jan 25, 2017 at 12:33:36AM -0700, Theo de Raadt wrote: > > 2. vmd calls openpty() in the pledged parent whenever a new VM is > > started - effectively doing ioctls on post-pledge fds. I will > > probably solve this by opening the pty in the non-pledged "priv" > > process, and do some additional passing, but then I'll also have to > > give up its chroot to access /dev/. > > > > vmd: ioctl 40287401 post-pledge fd 12 > > vmd(51681): syscall 54 "tty" > > How about opening PATH_PTMDEV early and keeping it open in a > properly protected process; then create pty pairs as required. Oh, yes, I should have looked at openpty() in libutil first :) That makes sense, I will try it. Reyk
Re: Special rules for early-open fd's in pledge
> 2. vmd calls openpty() in the pledged parent whenever a new VM is > started - effectively doing ioctls on post-pledge fds. I will > probably solve this by opening the pty in the non-pledged "priv" > process, and do some additional passing, but then I'll also have to > give up its chroot to access /dev/. > > vmd: ioctl 40287401 post-pledge fd 12 > vmd(51681): syscall 54 "tty" How about opening PATH_PTMDEV early and keeping it open in a properly protected process; then create pty pairs as required.
Re: Special rules for early-open fd's in pledge
Hi,
two notes about vmd with this diff:
1. "vmm" pledge can be !fdpledged as well as it already pre-opens the
/dev/vmm fd for ioctls. I added the following chunk on top of your
diff and it works as expected:
---snip---
if ((p->p_p->ps_pledge & PLEDGE_VMM)) {
#if NVMM > 0
- if ((fp->f_type == DTYPE_VNODE) &&
+ if (!fdpledged &&
+ (fp->f_type == DTYPE_VNODE) &&
(vp->v_type == VCHR) &&
(cdevsw[major(vp->v_rdev)].d_open == vmmopen)) {
error = pledge_ioctl_vmm(p, com);
if (error == 0)
return 0;
}
-#endif
+#endif /* NVMM > 0 */
}
---snap---
2. vmd calls openpty() in the pledged parent whenever a new VM is
started - effectively doing ioctls on post-pledge fds. I will
probably solve this by opening the pty in the non-pledged "priv"
process, and do some additional passing, but then I'll also have to
give up its chroot to access /dev/.
vmd: ioctl 40287401 post-pledge fd 12
vmd(51681): syscall 54 "tty"
Reyk
On Tue, Jan 24, 2017 at 07:36:47PM -0700, Theo de Raadt wrote:
> Here is the proposed ioctl lock-down policy for file descriptors
> allocated in a process before pledge(2).
>
> The manual page diff is first, that explains the direction this is
> going.
>
> The other supporting code has been commited already, so feel free
> to take this for a ride and let's see what programs need further
> modification to cope with it.
>
> Index: lib/libc/sys/pledge.2
> ===
> RCS file: /cvs/src/lib/libc/sys/pledge.2,v
> retrieving revision 1.39
> diff -u -p -u -r1.39 pledge.2
> --- lib/libc/sys/pledge.2 23 Jan 2017 07:19:39 - 1.39
> +++ lib/libc/sys/pledge.2 24 Jan 2017 10:04:31 -
> @@ -43,6 +43,16 @@ Subsequent calls to
> .Fn pledge
> can reduce the abilities further, but abilities can never be regained.
> .Pp
> +New file descriptors created by a pledged process are annotated internally
> +to permit a greater set of
> +.Xr ioctl 2
> +operations.
> +File descriptors obtained via
> +.Xr dup 2
> +or
> +.Xr recvmsg 2
> +retain the annotation from the process who originally opened them.
> +.Pp
> A process which attempts a restricted operation is killed with an uncatchable
> .Dv SIGABRT ,
> delivering a core file if possible.
> Index: sys/sys/pledge.h
> ===
> RCS file: /cvs/src/sys/sys/pledge.h,v
> retrieving revision 1.30
> diff -u -p -u -r1.30 pledge.h
> --- sys/sys/pledge.h 23 Jan 2017 04:25:05 - 1.30
> +++ sys/sys/pledge.h 23 Jan 2017 11:40:58 -
> @@ -126,7 +126,7 @@ int pledge_adjtime(struct proc *p, const
> int pledge_sendit(struct proc *p, const void *to);
> int pledge_sockopt(struct proc *p, int set, int level, int optname);
> int pledge_socket(struct proc *p, int domain, int state);
> -int pledge_ioctl(struct proc *p, long com, struct file *);
> +int pledge_ioctl(struct proc *p, long com, struct file *, int, int);
> int pledge_ioctl_drm(struct proc *p, long com, dev_t device);
> int pledge_ioctl_vmm(struct proc *p, long com);
> int pledge_flock(struct proc *p);
> Index: sys/kern/kern_pledge.c
> ===
> RCS file: /cvs/src/sys/kern/kern_pledge.c,v
> retrieving revision 1.192
> diff -u -p -u -r1.192 kern_pledge.c
> --- sys/kern/kern_pledge.c23 Jan 2017 05:49:24 - 1.192
> +++ sys/kern/kern_pledge.c24 Jan 2017 08:19:03 -
> @@ -66,6 +66,7 @@
>
> #include "audio.h"
> #include "pf.h"
> +#include "bpfilter.h"
> #include "pty.h"
>
> #if defined(__amd64__) || defined(__i386__)
> @@ -538,6 +539,22 @@ sys_pledge(struct proc *p, void *v, regi
> }
>
> if (SCARG(uap, request)) {
> +#ifdef DIAGNOSTIC
> + if (!ISSET(pr->ps_flags, PS_PLEDGE)) {
> + struct filedesc *fdp = p->p_fd;
> + int fd;
> +
> + fdplock(fdp);
> + for (fd = 0; fd <= fdp->fd_lastfile; fd++) {
> + if (fdp->fd_ofiles[fd] &&
> + (fdp->fd_ofileflags[fd] & UF_PLEDGED))
> + printf("%s: fd %d was set!\n",
> + pr->ps_comm, fd);
> + fdp->fd_ofileflags[fd] &= ~UF_PLEDGED;
> + }
> + fdpunlock(fdp);
> + }
> +#endif
> pr->ps_pledge = flags;
> pr->ps_flags |= PS_PLEDGE;
> }
> @@ -1102,7 +1119,7 @@ pledge_sendit(struct proc *p, const void
> }
>
> int
> -pledge_ioctl(struct proc *p, long com, struct file *fp)
> +pledge_ioctl(struct proc *p, long com, struct file *fp, int fd, int
> fdpledged)
> {
> struct vnode *vp = NULL;
> int error = EPERM;
>
Help with the NET_LOCK()
I just enabled the NET_LOCK() again and I'm looking for test reports. Please go build a kernel from sources or wait for the next snapshot, run it and report back. If you're looking for some small coding tasks related to the NET_LOCK() just do: # sysctl kern.splassert=2 # sysctl kern.pool_debug=2 Then watch for the traces on your console. You'll see something like: Starting stack trace... yield(0,1,d09dac52,f5549dbc,d94e9378) at yield+0xa4 yield(d0bc8f40,1,f5549e18,80,14) at yield+0xa4 pool_get(d0bc8f40,1,f5549ec8,d03ecbfb,d97815f4) at pool_get+0x1ba m_get(1,3,f5549ec0,d03a9362,d0bc22e0) at m_get+0x30 doaccept(d977e6c4,3,cf7ee4f8,cf7ee4ec,2000) at doaccept+0x193 sys_accept(d977e6c4,f5549f5c,f5549f7c,0,f5549fa8) at sys_accept+0x37 syscall() at syscall+0x250 This means accept(2) is doing a memory allocation that can sleep, here with m_get(9), while holding the NET_LOCK(). Even if these should be ok, it is easy to avoid them. In the case of doaccept() a mbuf could be allocated beforehand or simply use the stack for that. Cheers, Martin
Special rules for early-open fd's in pledge
Here is the proposed ioctl lock-down policy for file descriptors
allocated in a process before pledge(2).
The manual page diff is first, that explains the direction this is
going.
The other supporting code has been commited already, so feel free
to take this for a ride and let's see what programs need further
modification to cope with it.
Index: lib/libc/sys/pledge.2
===
RCS file: /cvs/src/lib/libc/sys/pledge.2,v
retrieving revision 1.39
diff -u -p -u -r1.39 pledge.2
--- lib/libc/sys/pledge.2 23 Jan 2017 07:19:39 - 1.39
+++ lib/libc/sys/pledge.2 24 Jan 2017 10:04:31 -
@@ -43,6 +43,16 @@ Subsequent calls to
.Fn pledge
can reduce the abilities further, but abilities can never be regained.
.Pp
+New file descriptors created by a pledged process are annotated internally
+to permit a greater set of
+.Xr ioctl 2
+operations.
+File descriptors obtained via
+.Xr dup 2
+or
+.Xr recvmsg 2
+retain the annotation from the process who originally opened them.
+.Pp
A process which attempts a restricted operation is killed with an uncatchable
.Dv SIGABRT ,
delivering a core file if possible.
Index: sys/sys/pledge.h
===
RCS file: /cvs/src/sys/sys/pledge.h,v
retrieving revision 1.30
diff -u -p -u -r1.30 pledge.h
--- sys/sys/pledge.h23 Jan 2017 04:25:05 - 1.30
+++ sys/sys/pledge.h23 Jan 2017 11:40:58 -
@@ -126,7 +126,7 @@ int pledge_adjtime(struct proc *p, const
intpledge_sendit(struct proc *p, const void *to);
intpledge_sockopt(struct proc *p, int set, int level, int optname);
intpledge_socket(struct proc *p, int domain, int state);
-intpledge_ioctl(struct proc *p, long com, struct file *);
+intpledge_ioctl(struct proc *p, long com, struct file *, int, int);
intpledge_ioctl_drm(struct proc *p, long com, dev_t device);
intpledge_ioctl_vmm(struct proc *p, long com);
intpledge_flock(struct proc *p);
Index: sys/kern/kern_pledge.c
===
RCS file: /cvs/src/sys/kern/kern_pledge.c,v
retrieving revision 1.192
diff -u -p -u -r1.192 kern_pledge.c
--- sys/kern/kern_pledge.c 23 Jan 2017 05:49:24 - 1.192
+++ sys/kern/kern_pledge.c 24 Jan 2017 08:19:03 -
@@ -66,6 +66,7 @@
#include "audio.h"
#include "pf.h"
+#include "bpfilter.h"
#include "pty.h"
#if defined(__amd64__) || defined(__i386__)
@@ -538,6 +539,22 @@ sys_pledge(struct proc *p, void *v, regi
}
if (SCARG(uap, request)) {
+#ifdef DIAGNOSTIC
+ if (!ISSET(pr->ps_flags, PS_PLEDGE)) {
+ struct filedesc *fdp = p->p_fd;
+ int fd;
+
+ fdplock(fdp);
+ for (fd = 0; fd <= fdp->fd_lastfile; fd++) {
+ if (fdp->fd_ofiles[fd] &&
+ (fdp->fd_ofileflags[fd] & UF_PLEDGED))
+ printf("%s: fd %d was set!\n",
+ pr->ps_comm, fd);
+ fdp->fd_ofileflags[fd] &= ~UF_PLEDGED;
+ }
+ fdpunlock(fdp);
+ }
+#endif
pr->ps_pledge = flags;
pr->ps_flags |= PS_PLEDGE;
}
@@ -1102,7 +1119,7 @@ pledge_sendit(struct proc *p, const void
}
int
-pledge_ioctl(struct proc *p, long com, struct file *fp)
+pledge_ioctl(struct proc *p, long com, struct file *fp, int fd, int fdpledged)
{
struct vnode *vp = NULL;
int error = EPERM;
@@ -1137,30 +1154,32 @@ pledge_ioctl(struct proc *p, long com, s
}
}
+#if NBPFILTER > 0
if ((p->p_p->ps_pledge & PLEDGE_BPF)) {
switch (com) {
- case BIOCGSTATS:/* bpf: tcpdump privsep on ^C */
- if (fp->f_type == DTYPE_VNODE &&
- fp->f_ops->fo_ioctl == vn_ioctl)
+ case BIOCGSTATS:/* tcpdump, pflogd */
+ if (!fdpledged &&
+ fp->f_type == DTYPE_VNODE &&
+ vp->v_type == VCHR &&
+ cdevsw[major(vp->v_rdev)].d_open == bpfopen)
return (0);
break;
}
}
+#endif /* NBPFILTER > 0 */
if ((p->p_p->ps_pledge & PLEDGE_TAPE)) {
switch (com) {
- case MTIOCGET:
+ case MTIOCGET: /* pax */
case MTIOCTOP:
- /* for pax(1) and such, checking tapes... */
if (fp->f_type == DTYPE_VNODE &&
(vp->v_type == VCHR || vp->v_type == VBLK))
return (0);
- break;
}
}
- if ((p->p_p->
Re: minor mount.c cleanup
On Wed, Jan 25, 2017 at 10:29:47AM +1000, Theo Buehler wrote:
> * check strdup for malloc failure
> * remove obvious /* NOTREACHED */
> * return instead of exit from main
> * err(1, NULL) instead of err(1, "malloc")
> * mark usage as __dead
Sorry, I sent the wrong version of the diff with an extra free call.
Index: mount.c
===
RCS file: /var/cvs/src/sbin/mount/mount.c,v
retrieving revision 1.69
diff -u -p -r1.69 mount.c
--- mount.c 24 Jan 2017 23:41:44 - 1.69
+++ mount.c 25 Jan 2017 02:23:27 -
@@ -164,7 +164,6 @@ main(int argc, char * const argv[])
case '?':
default:
usage();
- /* NOTREACHED */
}
argc -= optind;
argv += optind;
@@ -212,7 +211,7 @@ main(int argc, char * const argv[])
continue;
prmount(&mntbuf[i]);
}
- exit(rval);
+ return (rval);
}
break;
case 1:
@@ -235,9 +234,8 @@ main(int argc, char * const argv[])
"can't find fstab entry for %s.",
*argv);
} else {
- fs = malloc(sizeof(*fs));
- if (fs == NULL)
- err(1, "malloc");
+ if ((fs = malloc(sizeof(*fs))) == NULL)
+ err(1, NULL);
fs->fs_vfstype = mntbuf->f_fstypename;
fs->fs_spec = mntbuf->f_mntfromname;
}
@@ -283,7 +281,6 @@ main(int argc, char * const argv[])
break;
default:
usage();
- /* NOTREACHED */
}
/*
@@ -299,7 +296,7 @@ main(int argc, char * const argv[])
(void)fclose(mountdfp);
}
- exit(rval);
+ return (rval);
}
int
@@ -310,7 +307,8 @@ hasopt(const char *mntopts, const char *
if (mntopts == NULL)
return (0);
- optbuf = strdup(mntopts);
+ if ((optbuf = strdup(mntopts)) == NULL)
+ err(1, NULL);
found = 0;
for (opt = optbuf; !found && opt != NULL; strsep(&opt, ","))
found = !strncmp(opt, option, strlen(option));
@@ -340,6 +338,8 @@ int
mountfs(const char *vfstype, const char *spec, const char *name,
const char *options, const char *mntopts, int skipmounted)
{
+ char *cp;
+
/* List of directories containing mount_xxx subcommands. */
static const char *edirs[] = {
_PATH_SBIN,
@@ -372,7 +372,9 @@ mountfs(const char *vfstype, const char
}
/* options follows after mntopts, so they get priority over mntopts */
- optbuf = catopt(strdup(mntopts), options);
+ if ((cp = strdup(mntopts)) == NULL)
+ err(1, NULL);
+ optbuf = catopt(cp, options);
if (strcmp(name, "/") == 0) {
if (!hasopt(optbuf, "update"))
@@ -401,7 +403,7 @@ mountfs(const char *vfstype, const char
argvsize = 64;
if((argv = reallocarray(NULL, argvsize, sizeof(char *))) == NULL)
- err(1, "malloc");
+ err(1, NULL);
argc = 0;
argv[argc++] = NULL;/* this should be a full path name */
mangle(optbuf, &argc, argv, argvsize - 4);
@@ -440,7 +442,6 @@ mountfs(const char *vfstype, const char
if (errno == ENOENT)
warn("no mount helper program found for %s", vfstype);
_exit(1);
- /* NOTREACHED */
default:/* Parent. */
free(optbuf);
free(argv);
@@ -673,7 +674,7 @@ maketypelist(char *fslist)
/* Build an array of that many types. */
if ((av = typelist = reallocarray(NULL, i + 1, sizeof(char *))) == NULL)
- err(1, "malloc");
+ err(1, NULL);
av[0] = fslist;
for (i = 1, nextcp = fslist; (nextcp = strchr(nextcp, ',')); i++) {
*nextcp = '\0';
@@ -691,8 +692,10 @@ catopt(char *s0, const char *s1)
if (s0 && *s0) {
if (asprintf(&cp, "%s,%s", s0, s1) == -1)
err(1, NULL);
- } else
- cp = strdup(s1);
+ } else {
+ if ((cp = strdup(s1)) == NULL)
+ err(1, NULL);
+ }
free(s0);
return cp;
@@ -724,10 +727,9 @@ mangle(char *options, int *argcp, const
*argcp = argc;
}
-void
+__dead void
usage(void)
{
-
(void)fprintf(stderr,
"usage: mount [-AadfNruvw] [-t type]\n"
" mount [-dfrsuvw] special | node\n"
minor mount.c cleanup
* check strdup for malloc failure
* remove obvious /* NOTREACHED */
* return instead of exit from main
* err(1, NULL) instead of err(1, "malloc")
* mark usage as __dead
Index: mount.c
===
RCS file: /cvs/src/sbin/mount/mount.c,v
retrieving revision 1.69
diff -u -p -r1.69 mount.c
--- mount.c 24 Jan 2017 23:41:44 - 1.69
+++ mount.c 25 Jan 2017 00:26:48 -
@@ -164,7 +164,6 @@ main(int argc, char * const argv[])
case '?':
default:
usage();
- /* NOTREACHED */
}
argc -= optind;
argv += optind;
@@ -212,7 +211,7 @@ main(int argc, char * const argv[])
continue;
prmount(&mntbuf[i]);
}
- exit(rval);
+ return (rval);
}
break;
case 1:
@@ -235,9 +234,8 @@ main(int argc, char * const argv[])
"can't find fstab entry for %s.",
*argv);
} else {
- fs = malloc(sizeof(*fs));
- if (fs == NULL)
- err(1, "malloc");
+ if ((fs = malloc(sizeof(*fs))) == NULL)
+ err(1, NULL);
fs->fs_vfstype = mntbuf->f_fstypename;
fs->fs_spec = mntbuf->f_mntfromname;
}
@@ -283,7 +281,6 @@ main(int argc, char * const argv[])
break;
default:
usage();
- /* NOTREACHED */
}
/*
@@ -299,7 +296,7 @@ main(int argc, char * const argv[])
(void)fclose(mountdfp);
}
- exit(rval);
+ return (rval);
}
int
@@ -310,7 +307,8 @@ hasopt(const char *mntopts, const char *
if (mntopts == NULL)
return (0);
- optbuf = strdup(mntopts);
+ if ((optbuf = strdup(mntopts)) == NULL)
+ err(1, NULL);
found = 0;
for (opt = optbuf; !found && opt != NULL; strsep(&opt, ","))
found = !strncmp(opt, option, strlen(option));
@@ -340,6 +338,8 @@ int
mountfs(const char *vfstype, const char *spec, const char *name,
const char *options, const char *mntopts, int skipmounted)
{
+ char *cp;
+
/* List of directories containing mount_xxx subcommands. */
static const char *edirs[] = {
_PATH_SBIN,
@@ -372,7 +372,10 @@ mountfs(const char *vfstype, const char
}
/* options follows after mntopts, so they get priority over mntopts */
- optbuf = catopt(strdup(mntopts), options);
+ if ((cp = strdup(mntopts)) == NULL)
+ err(1, NULL);
+ optbuf = catopt(cp, options);
+ free(cp);
if (strcmp(name, "/") == 0) {
if (!hasopt(optbuf, "update"))
@@ -401,7 +404,7 @@ mountfs(const char *vfstype, const char
argvsize = 64;
if((argv = reallocarray(NULL, argvsize, sizeof(char *))) == NULL)
- err(1, "malloc");
+ err(1, NULL);
argc = 0;
argv[argc++] = NULL;/* this should be a full path name */
mangle(optbuf, &argc, argv, argvsize - 4);
@@ -440,7 +443,6 @@ mountfs(const char *vfstype, const char
if (errno == ENOENT)
warn("no mount helper program found for %s", vfstype);
_exit(1);
- /* NOTREACHED */
default:/* Parent. */
free(optbuf);
free(argv);
@@ -673,7 +675,7 @@ maketypelist(char *fslist)
/* Build an array of that many types. */
if ((av = typelist = reallocarray(NULL, i + 1, sizeof(char *))) == NULL)
- err(1, "malloc");
+ err(1, NULL);
av[0] = fslist;
for (i = 1, nextcp = fslist; (nextcp = strchr(nextcp, ',')); i++) {
*nextcp = '\0';
@@ -691,8 +693,10 @@ catopt(char *s0, const char *s1)
if (s0 && *s0) {
if (asprintf(&cp, "%s,%s", s0, s1) == -1)
err(1, NULL);
- } else
- cp = strdup(s1);
+ } else {
+ if ((cp = strdup(s1)) == NULL)
+ err(1, NULL);
+ }
free(s0);
return cp;
@@ -724,10 +728,9 @@ mangle(char *options, int *argcp, const
*argcp = argc;
}
-void
+__dead void
usage(void)
{
-
(void)fprintf(stderr,
"usage: mount [-AadfNruvw] [-t type]\n"
" mount [-dfrsuvw] special | node\n"
Re: pfctl: Kill states within a rdomain
Hi,
thanks, i like this.
but your diff does not seem to be against -current, you started from 6.0
But even with 6.0 i get rejects, maybe you mail client messes this up.
Can you please resend a good diff?
/Benno
Bertrand Provost(provost.bertr...@gmail.com) on 2017.01.24 16:53:02 -0500:
> Hi,
>
> This patch fix `pfctl` to be able to kill states within a rdomain.
> Currently only states in rdomain 0 can be kill when using host or label
> because check is done in ioctl DIOCKILLSTATES
>
> sys/net/pf_ioctl.c:
>`psk->psk_rdomain == sk->rdomain`
>
> I used -V like `arp`, `ping`... but it could be done too with
> `route -T id exec` and `getrtable()` (don't know which one is the
> best here since it related to rdomain and not rtable).
>
> Also `const char *iface` arg was not used in `pfctl_id_kill_states`.
>
> To reproduce the bug:
>
># ifconfig pair1 rdomain 1 10.1.1.1/24 up
># ifconfig pair2 rdomain 2 10.1.1.2/24 up
># ifconfig pair1 patch pair2
># route -T 1 exec ping 10.1.1.2
>
> Then start a server
>
># route -T2 exec nc -vl 10.1.1.2 4242
>
> And connect to it
>
># route -T1 exec nc 10.1.1.2 4242
>
> Display states:
>
># pfctl -v -ss
>all tcp (2) 10.1.1.2:4242 <- (2) 10.1.1.1:13194 ESTABLISHED:ESTABLISHED
> [4248582619 + 16384] wscale 3 [1432845864 + 17376] wscale 3
> age 00:00:58, expires in 23:59:05, 3:2 pkts, 174:116 bytes, rule 1
>
> Kill it
>
># pfctl -k 10.1.1.2
>killed 0 states from 1 sources and 0 destinations
>
> or
>
># pfctl -k 10.1.1.1
>killed 0 states from 1 sources and 0 destinations
>
> But state is still here and connection is still established.
>
># pfctl -v -ss
>all tcp (2) 10.1.1.2:4242 <- (2) 10.1.1.1:13194 ESTABLISHED:ESTABLISHED
> [4248582625 + 16384] wscale 3 [1432845864 + 17376] wscale 3
> age 00:04:49, expires in 23:56:29, 4:3 pkts, 226:174 bytes, rule 1
>
> Regards,
>
> --
> Bertrand Provost
>
> Index: pfctl.8
> ===
> RCS file: /cvs/src/sbin/pfctl/pfctl.8,v
> retrieving revision 1.165
> diff -u -p -r1.165 pfctl.8
> --- pfctl.8 15 Jun 2015 08:48:23 - 1.165
> +++ pfctl.8 24 Jan 2017 21:38:56 -
> @@ -47,6 +47,7 @@
> .Op Fl S Ar statefile
> .Op Fl s Ar modifier Op Fl R Ar id
> .Op Fl t Ar table Fl T Ar command Op Ar address ...
> +.Op Fl V Ar rdomain
> .Op Fl x Ar level
> .Ek
> .Sh DESCRIPTION
> @@ -275,6 +276,12 @@ from rules carrying the label
> .Dq foobar :
> .Pp
> .Dl # pfctl -k label -k foobar
> +.Pp
> +To kill states withing a rdomain (the rdomain of a state is displayed
> +in parentheses before the host by pfctl -s states) use
> +.Fl V Ar rdomain :
> +.Pp
> +.Dl # pfctl -V rdomain -k host
> .Pp
> To kill one specific state by its unique state ID
> (as shown by pfctl -s state -vv),
> Index: pfctl.c
> ===
> RCS file: /cvs/src/sbin/pfctl/pfctl.c,v
> retrieving revision 1.334
> diff -u -p -r1.334 pfctl.c
> --- pfctl.c 14 Jan 2016 12:05:51 - 1.334
> +++ pfctl.c 24 Jan 2017 21:38:56 -
> @@ -69,9 +69,9 @@ int pfctl_clear_src_nodes(int, int);
> int pfctl_clear_states(int, const char *, int);
> void pfctl_addrprefix(char *, struct pf_addr *);
> int pfctl_kill_src_nodes(int, const char *, int);
> -int pfctl_net_kill_states(int, const char *, int);
> -int pfctl_label_kill_states(int, const char *, int);
> -int pfctl_id_kill_states(int, const char *, int);
> +int pfctl_net_kill_states(int, const char *, int, int);
> +int pfctl_label_kill_states(int, const char *, int, int);
> +int pfctl_id_kill_states(int, int);
> void pfctl_init_options(struct pfctl *);
> int pfctl_load_options(struct pfctl *);
> int pfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
> @@ -512,7 +512,7 @@ pfctl_kill_src_nodes(int dev, const char
> }
>
> int
> -pfctl_net_kill_states(int dev, const char *iface, int opts)
> +pfctl_net_kill_states(int dev, const char *iface, int opts, int rdomain)
> {
> struct pfioc_state_kill psk;
> struct addrinfo *res[2], *resp[2];
> @@ -531,6 +531,8 @@ pfctl_net_kill_states(int dev, const cha
> sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
> errx(1, "invalid interface: %s", iface);
>
> + psk.psk_rdomain = rdomain;
> +
> pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
>
> if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
> @@ -618,7 +620,7 @@ pfctl_net_kill_states(int dev, const cha
> }
>
> int
> -pfctl_label_kill_states(int dev, const char *iface, int opts)
> +pfctl_label_kill_states(int dev, const char *iface, int opts, int rdomain)
> {
> struct pfioc_state_kill psk;
>
> @@ -635,6 +637,8 @@ pfctl_label_kill_states(int dev, const c
> sizeof(psk.psk_label))
> errx(1, "label too long: %s", state_kill[1]);
>
> +
Re: ld.so: don't use _dl_exit() for fatal errors
On Tue, 24 Jan 2017, Todd C. Miller wrote: > On Tue, 24 Jan 2017 15:39:49 +1000, Philip Guenther wrote: ... > > +static char ldso[] = "ld.so: "; > > Any reason this can't be const? Good catch, ok guenther@
Re: global mbuf memory limit
On Tue, Jan 24, 2017 at 03:26:42PM +0100, Alexander Bluhm wrote: > On Tue, Jan 24, 2017 at 05:46:31PM +1000, David Gwynne wrote: > > > Apart from the problem that I don't know wether the mutex kills > > > performance, the diff looks good. > > > > the tests ive done and simon mages has done show a slight benefit. > > id expect to see that grow as we use pools more concurrently. > > Then it is OK bluhm@ Also OK claudio@ -- :wq Claudio
pr_input var args
Hi,
Now since raw_input() and route_input() are gone from pr_input, we
can make the variable parameters of the protocol input functions
fixed. I have decided to add the proto to make it similar to IPv6.
My goal is to have one struct protosw for both IP versions.
ok?
bluhm
Index: net/if_etherip.c
===
RCS file: /data/mirror/openbsd/cvs/src/sys/net/if_etherip.c,v
retrieving revision 1.12
diff -u -p -r1.12 if_etherip.c
--- net/if_etherip.c23 Jan 2017 11:37:29 - 1.12
+++ net/if_etherip.c24 Jan 2017 21:03:07 -
@@ -405,7 +405,7 @@ ip_etherip_output(struct ifnet *ifp, str
}
void
-ip_etherip_input(struct mbuf *m, ...)
+ip_etherip_input(struct mbuf *m, int off, int proto)
{
struct mbuf_list ml = MBUF_LIST_INITIALIZER();
struct etherip_softc *sc;
@@ -413,12 +413,6 @@ ip_etherip_input(struct mbuf *m, ...)
struct etherip_header *eip;
struct sockaddr_in *src, *dst;
struct ifnet *ifp = NULL;
- int off;
- va_list ap;
-
- va_start(ap, m);
- off = va_arg(ap, int);
- va_end(ap);
ip = mtod(m, struct ip *);
@@ -458,7 +452,7 @@ ip_etherip_input(struct mbuf *m, ...)
* This is tricky but the path will be removed soon when
* implementation of etherip is removed from gif(4).
*/
- etherip_input(m, off);
+ etherip_input(m, off, proto);
#else
etheripstat.etherip_noifdrops++;
m_freem(m);
Index: net/if_etherip.h
===
RCS file: /data/mirror/openbsd/cvs/src/sys/net/if_etherip.h,v
retrieving revision 1.2
diff -u -p -r1.2 if_etherip.h
--- net/if_etherip.h5 Dec 2015 22:16:27 - 1.2
+++ net/if_etherip.h24 Jan 2017 21:03:07 -
@@ -73,7 +73,7 @@ struct etherip_header {
int ip_etherip_sysctl(int *, uint, void *, size_t *, void *, size_t);
int ip_etherip_output(struct ifnet *, struct mbuf *);
-void ip_etherip_input(struct mbuf *, ...);
+void ip_etherip_input(struct mbuf *, int, int);
#ifdef INET6
int ip6_etherip_output(struct ifnet *, struct mbuf *);
Index: net/if_gif.c
===
RCS file: /data/mirror/openbsd/cvs/src/sys/net/if_gif.c,v
retrieving revision 1.89
diff -u -p -r1.89 if_gif.c
--- net/if_gif.c23 Jan 2017 11:37:29 - 1.89
+++ net/if_gif.c24 Jan 2017 21:03:07 -
@@ -716,17 +716,11 @@ in_gif_output(struct ifnet *ifp, int fam
}
void
-in_gif_input(struct mbuf *m, ...)
+in_gif_input(struct mbuf *m, int off, int proto)
{
- int off;
struct gif_softc *sc;
struct ifnet *gifp = NULL;
struct ip *ip;
- va_list ap;
-
- va_start(ap, m);
- off = va_arg(ap, int);
- va_end(ap);
/* IP-in-IP header is caused by tunnel mode, so skip gif lookup */
if (m->m_flags & M_TUNNEL) {
@@ -767,7 +761,7 @@ in_gif_input(struct mbuf *m, ...)
}
inject:
- ip4_input(m, off); /* No GIF interface was configured */
+ ip4_input(m, off, proto); /* No GIF interface was configured */
return;
}
Index: net/if_gif.h
===
RCS file: /data/mirror/openbsd/cvs/src/sys/net/if_gif.h,v
retrieving revision 1.14
diff -u -p -r1.14 if_gif.h
--- net/if_gif.h28 Sep 2015 08:32:05 - 1.14
+++ net/if_gif.h24 Jan 2017 21:03:07 -
@@ -49,7 +49,7 @@ extern LIST_HEAD(gif_softc_head, gif_sof
int gif_encap(struct ifnet *, struct mbuf **, sa_family_t);
-void in_gif_input(struct mbuf *, ...);
+void in_gif_input(struct mbuf *, int, int);
int in6_gif_input(struct mbuf **, int *, int);
#endif /* _NET_IF_GIF_H_ */
Index: net/if_pfsync.c
===
RCS file: /data/mirror/openbsd/cvs/src/sys/net/if_pfsync.c,v
retrieving revision 1.242
diff -u -p -r1.242 if_pfsync.c
--- net/if_pfsync.c 23 Jan 2017 11:37:29 - 1.242
+++ net/if_pfsync.c 24 Jan 2017 21:03:07 -
@@ -635,7 +635,7 @@ pfsync_state_import(struct pfsync_state
}
void
-pfsync_input(struct mbuf *m, ...)
+pfsync_input(struct mbuf *m, int iphlen, int proto)
{
struct pfsync_softc *sc = pfsyncif;
struct ip *ip = mtod(m, struct ip *);
Index: net/if_pfsync.h
===
RCS file: /data/mirror/openbsd/cvs/src/sys/net/if_pfsync.h,v
retrieving revision 1.49
diff -u -p -r1.49 if_pfsync.h
--- net/if_pfsync.h 20 Jan 2017 05:03:48 - 1.49
+++ net/if_pfsync.h 24 Jan 2017 21:03:07 -
@@ -286,7 +286,7 @@ struct pfsyncreq {
#define PFSYNC_S_DEFER 0xfe
#define PFSYNC_S_NONE 0xff
-void pfsync_input(struct mbuf *, ...);
+void pfsync_input(struct mbuf *, int, int);
intpfsync_sysctl(int *
Re: ld.so: don't use _dl_exit() for fatal errors
On Tue, 24 Jan 2017 15:39:49 +1000, Philip Guenther wrote:
I see this is already in but one minor nit below.
> Index: dl_printf.c
> ===
> RCS file: /cvs/src/libexec/ld.so/dl_printf.c,v
> retrieving revision 1.18
> diff -u -p -r1.18 dl_printf.c
> --- dl_printf.c 23 Jan 2017 13:00:09 - 1.18
> +++ dl_printf.c 24 Jan 2017 05:16:04 -
> @@ -237,4 +239,31 @@ kprintn(int fd, unsigned long ul, int ba
> do {
> putcharfd(*--p, fd);
> } while (p > buf);
> +}
> +
> +static char ldso[] = "ld.so: ";
Any reason this can't be const?
- todd
Index: libexec/ld.so/dl_printf.c
===
RCS file: /cvs/src/libexec/ld.so/dl_printf.c,v
retrieving revision 1.19
diff -u -p -u -r1.19 dl_printf.c
--- libexec/ld.so/dl_printf.c 24 Jan 2017 07:48:36 - 1.19
+++ libexec/ld.so/dl_printf.c 24 Jan 2017 23:20:59 -
@@ -241,7 +241,7 @@ kprintn(int fd, unsigned long ul, int ba
} while (p > buf);
}
-static char ldso[] = "ld.so: ";
+static const char ldso[] = "ld.so: ";
__dead void
_dl_die(const char *fmt, ...)
Re: Two fixes for m_split() in sys/kern/uipc_mbuf.c.
On Tue, Jan 24, 2017 at 03:22:13PM +0100, Imre Vad?sz wrote:
> This patch fixes two issues in m_split() in sys/kern/uipc_mbuf.c, which
> are correctly handled in FreeBSD's m_split():
OK bluhm@
>
> If the m_split() would split an mbuf chain exactly between 2 mbufs (i.e.
> remain == 0), the returned M_PKTHDR might unnecessarily reference an
> mbuf cluster from the first part of the original mbuf chain. So the
> returned mbuf would have the M_EXT flag set in n->m_flags, but with
> n->m_len == 0. Instead m_split should explicitly handle that case.
>
> The second issue fixes a case in m_split() where n->m_len isn't initialized
> explicitly before returning, and also wasn't pre-zeroed by MGETHDR (since
> that calls pool_get without PR_ZERO flag).
>
>
> Index: uipc_mbuf.c
> ===
> RCS file: /cvs/src/sys/kern/uipc_mbuf.c,v
> retrieving revision 1.239
> diff -u -r1.239 uipc_mbuf.c
> --- uipc_mbuf.c 29 Nov 2016 10:22:30 - 1.239
> +++ uipc_mbuf.c 24 Jan 2017 14:07:03 -
> @@ -1013,6 +1013,12 @@
> n->m_pkthdr.len -= len0;
> olen = m0->m_pkthdr.len;
> m0->m_pkthdr.len = len0;
> + if (remain == 0) {
> + n->m_next = m->m_next;
> + m->m_next = NULL;
> + n->m_len = 0;
> + return (n);
> + }
> if (m->m_flags & M_EXT)
> goto extpacket;
> if (remain > MHLEN) {
> @@ -1023,8 +1029,10 @@
> (void) m_free(n);
> m0->m_pkthdr.len = olen;
> return (NULL);
> - } else
> + } else {
> + n->m_len = 0;
> return (n);
> + }
> } else
> MH_ALIGN(n, remain);
> } else if (remain == 0) {
Re: refactor PF option parsing loops
On 24/01/17(Tue) 14:43, Richard Procter wrote: > Hi, > > PF implements six distinct TCP option parsing loops. This patch converts > these to one inline function in pfvar_priv.h, normalises their semantics, > and strips ~100 lines. I like it. > I've laid out the existing semantics below. The new loop implements the > timestamp parser's semantics of "(s-b) (v-3) (t-a) (t-b)". As a result, > > - MSS and WSCALE parsers are stricter about candidate option len. > - MSS normalization is more tolerant of malformed option lists. > > These changes were immaterial to the live traffic I've examined (thanks to > Richard Cziva for help in gathering the data). Is it possible to build regression tests for that?
pfctl: Kill states within a rdomain
Hi,
This patch fix `pfctl` to be able to kill states within a rdomain.
Currently only states in rdomain 0 can be kill when using host or label
because check is done in ioctl DIOCKILLSTATES
sys/net/pf_ioctl.c:
`psk->psk_rdomain == sk->rdomain`
I used -V like `arp`, `ping`... but it could be done too with
`route -T id exec` and `getrtable()` (don't know which one is the
best here since it related to rdomain and not rtable).
Also `const char *iface` arg was not used in `pfctl_id_kill_states`.
To reproduce the bug:
# ifconfig pair1 rdomain 1 10.1.1.1/24 up
# ifconfig pair2 rdomain 2 10.1.1.2/24 up
# ifconfig pair1 patch pair2
# route -T 1 exec ping 10.1.1.2
Then start a server
# route -T2 exec nc -vl 10.1.1.2 4242
And connect to it
# route -T1 exec nc 10.1.1.2 4242
Display states:
# pfctl -v -ss
all tcp (2) 10.1.1.2:4242 <- (2) 10.1.1.1:13194 ESTABLISHED:ESTABLISHED
[4248582619 + 16384] wscale 3 [1432845864 + 17376] wscale 3
age 00:00:58, expires in 23:59:05, 3:2 pkts, 174:116 bytes, rule 1
Kill it
# pfctl -k 10.1.1.2
killed 0 states from 1 sources and 0 destinations
or
# pfctl -k 10.1.1.1
killed 0 states from 1 sources and 0 destinations
But state is still here and connection is still established.
# pfctl -v -ss
all tcp (2) 10.1.1.2:4242 <- (2) 10.1.1.1:13194 ESTABLISHED:ESTABLISHED
[4248582625 + 16384] wscale 3 [1432845864 + 17376] wscale 3
age 00:04:49, expires in 23:56:29, 4:3 pkts, 226:174 bytes, rule 1
Regards,
--
Bertrand Provost
Index: pfctl.8
===
RCS file: /cvs/src/sbin/pfctl/pfctl.8,v
retrieving revision 1.165
diff -u -p -r1.165 pfctl.8
--- pfctl.8 15 Jun 2015 08:48:23 - 1.165
+++ pfctl.8 24 Jan 2017 21:38:56 -
@@ -47,6 +47,7 @@
.Op Fl S Ar statefile
.Op Fl s Ar modifier Op Fl R Ar id
.Op Fl t Ar table Fl T Ar command Op Ar address ...
+.Op Fl V Ar rdomain
.Op Fl x Ar level
.Ek
.Sh DESCRIPTION
@@ -275,6 +276,12 @@ from rules carrying the label
.Dq foobar :
.Pp
.Dl # pfctl -k label -k foobar
+.Pp
+To kill states withing a rdomain (the rdomain of a state is displayed
+in parentheses before the host by pfctl -s states) use
+.Fl V Ar rdomain :
+.Pp
+.Dl # pfctl -V rdomain -k host
.Pp
To kill one specific state by its unique state ID
(as shown by pfctl -s state -vv),
Index: pfctl.c
===
RCS file: /cvs/src/sbin/pfctl/pfctl.c,v
retrieving revision 1.334
diff -u -p -r1.334 pfctl.c
--- pfctl.c 14 Jan 2016 12:05:51 - 1.334
+++ pfctl.c 24 Jan 2017 21:38:56 -
@@ -69,9 +69,9 @@ intpfctl_clear_src_nodes(int, int);
intpfctl_clear_states(int, const char *, int);
void pfctl_addrprefix(char *, struct pf_addr *);
intpfctl_kill_src_nodes(int, const char *, int);
-int pfctl_net_kill_states(int, const char *, int);
-int pfctl_label_kill_states(int, const char *, int);
-int pfctl_id_kill_states(int, const char *, int);
+int pfctl_net_kill_states(int, const char *, int, int);
+int pfctl_label_kill_states(int, const char *, int, int);
+int pfctl_id_kill_states(int, int);
void pfctl_init_options(struct pfctl *);
intpfctl_load_options(struct pfctl *);
intpfctl_load_limit(struct pfctl *, unsigned int, unsigned int);
@@ -512,7 +512,7 @@ pfctl_kill_src_nodes(int dev, const char
}
int
-pfctl_net_kill_states(int dev, const char *iface, int opts)
+pfctl_net_kill_states(int dev, const char *iface, int opts, int rdomain)
{
struct pfioc_state_kill psk;
struct addrinfo *res[2], *resp[2];
@@ -531,6 +531,8 @@ pfctl_net_kill_states(int dev, const cha
sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))
errx(1, "invalid interface: %s", iface);
+ psk.psk_rdomain = rdomain;
+
pfctl_addrprefix(state_kill[0], &psk.psk_src.addr.v.a.mask);
if ((ret_ga = getaddrinfo(state_kill[0], NULL, NULL, &res[0]))) {
@@ -618,7 +620,7 @@ pfctl_net_kill_states(int dev, const cha
}
int
-pfctl_label_kill_states(int dev, const char *iface, int opts)
+pfctl_label_kill_states(int dev, const char *iface, int opts, int rdomain)
{
struct pfioc_state_kill psk;
@@ -635,6 +637,8 @@ pfctl_label_kill_states(int dev, const c
sizeof(psk.psk_label))
errx(1, "label too long: %s", state_kill[1]);
+ psk.psk_rdomain = rdomain;
+
if (ioctl(dev, DIOCKILLSTATES, &psk))
err(1, "DIOCKILLSTATES");
@@ -645,7 +649,7 @@ pfctl_label_kill_states(int dev, const c
}
int
-pfctl_id_kill_states(int dev, const char *iface, int opts)
+pfctl_id_kill_states(int dev, int opts)
{
struct pfioc_state_kill psk;
@@ -2098,6 +2102,7 @@ main(int argc, char *argv[])
int opts = 0;
int optimize = PF_OPTIMIZE_BASIC;
int level;
+ int rdomain = 0;
char
Re: tcpdump(63969): syscall 54 "tty"
On 24.1.2017. 19:03, Sebastien Marie wrote: > On Tue, Jan 24, 2017 at 03:32:25PM +0100, Hrvoje Popovski wrote: >> Hi all, >> >> every time when quitting tcpdump with ^C i see that log on console. >> Source is fetched few minutes ago ... >> >> Don't know is this good or bad so i'm sending it here .. >> >> tcpdump(63969): syscall 54 "tty" >> tcpdump(87912): syscall 54 "tty" >> tcpdump(35062): syscall 54 "tty" >> tcpdump(68817): syscall 54 "tty" >> > > it is error related to pledge(2). > > could you run tcpdump with ktrace -di, and interrupt it quickly with ^C ? > > # ktrace -di tcpdump ... > > A gdb backtrace is also welcome :) > > > The purpose is to check: > - what are the pledge promises: > > 96021 tcpdump CALL pledge(0x34a0d6f4,0) > 96021 tcpdump STRU pledge request="stdio rpath inet unix dns recvfd bpf" > 96021 tcpdump RET pledge 0 > ... > 29420 tcpdump CALL pledge(0x34a0d169,0) > 29420 tcpdump STRU pledge request="stdio" > 29420 tcpdump RET pledge 0 > > - what are the argument passed to ioctl(2) which case pledge failure. > >939 tcpdump CALL ioctl(4,TIOCSPGRP,0xcf7e2824) >939 tcpdump PLDG ioctl, "tty", errno 1 Operation not permitted >939 tcpdump PSIG SIGABRT SIG_DFL >939 tcpdump NAMI "tcpdump.core" > > (here is a error I faked as I don't reproduce your problem). > > Thanks. > Hi, sorry for noise, I haven't updated userland. After updating userland I can't see this log.
Re: pool_debug
Martin Pieuchot wrote: > I'd like to force a yield() for every pool_get(9) using PR_WAITOK, just > like we do with malloc(9), in order to ensure that the NET_LOCK() is not > held across context switches. > > ok? Is there an assertwaitok() missing? Indeed there is. I think that should be added, like in malloc.
Re: tcpdump(63969): syscall 54 "tty"
On Tue, Jan 24, 2017 at 03:32:25PM +0100, Hrvoje Popovski wrote: > Hi all, > > every time when quitting tcpdump with ^C i see that log on console. > Source is fetched few minutes ago ... > > Don't know is this good or bad so i'm sending it here .. > > tcpdump(63969): syscall 54 "tty" > tcpdump(87912): syscall 54 "tty" > tcpdump(35062): syscall 54 "tty" > tcpdump(68817): syscall 54 "tty" > it is error related to pledge(2). could you run tcpdump with ktrace -di, and interrupt it quickly with ^C ? # ktrace -di tcpdump ... A gdb backtrace is also welcome :) The purpose is to check: - what are the pledge promises: 96021 tcpdump CALL pledge(0x34a0d6f4,0) 96021 tcpdump STRU pledge request="stdio rpath inet unix dns recvfd bpf" 96021 tcpdump RET pledge 0 ... 29420 tcpdump CALL pledge(0x34a0d169,0) 29420 tcpdump STRU pledge request="stdio" 29420 tcpdump RET pledge 0 - what are the argument passed to ioctl(2) which case pledge failure. 939 tcpdump CALL ioctl(4,TIOCSPGRP,0xcf7e2824) 939 tcpdump PLDG ioctl, "tty", errno 1 Operation not permitted 939 tcpdump PSIG SIGABRT SIG_DFL 939 tcpdump NAMI "tcpdump.core" (here is a error I faked as I don't reproduce your problem). Thanks. -- Sebastien Marie
Re: In amsdu_decap(), check for n->m_pkthdr.len == 0, not n->m_len == 0
On Tue, Jan 24, 2017 at 03:34:59PM +0100, Imre Vadász wrote:
> Since m_split() in some cases returns an mbuf chain, where the pkthdr element
> contains no data (i.e. m_len == 0), the n->m_len == 0 check in
> sys/net80211/ieee80211_input.c in the amsdu_decap() function sometimes
> signals the end of the AMSDU frame too early.
> Instead it should check the actual length of the data in the remaining
> mbuf chain with n->m_pkthdr.len == 0.
Thanks. This makes sense to me.
Does anyone else want to provide another ok?
BTW, I do not remember ever encountering an AP that sends A-MSDUs, apart
from one I once set up specifically to test this code path. Most APs out
there seem to prefer sending A-MPDUs instead of A-MSDUs.
> Index: sys/net80211/ieee80211_input.c
> ===
> RCS file: /cvs/src/sys/net80211/ieee80211_input.c,v
> retrieving revision 1.184
> diff -u -r1.184 ieee80211_input.c
> --- sys/net80211/ieee80211_input.c16 Jan 2017 09:35:06 - 1.184
> +++ sys/net80211/ieee80211_input.c24 Jan 2017 14:26:19 -
> @@ -1096,7 +1096,7 @@
> }
> ieee80211_deliver_data(ic, m, ni, mcast);
>
> - if (n->m_len == 0) {
> + if (n->m_pkthdr.len == 0) {
> m_freem(n);
> break;
> }
>
In amsdu_decap(), check for n->m_pkthdr.len == 0, not n->m_len == 0
Since m_split() in some cases returns an mbuf chain, where the pkthdr element
contains no data (i.e. m_len == 0), the n->m_len == 0 check in
sys/net80211/ieee80211_input.c in the amsdu_decap() function sometimes
signals the end of the AMSDU frame too early.
Instead it should check the actual length of the data in the remaining
mbuf chain with n->m_pkthdr.len == 0.
Index: sys/net80211/ieee80211_input.c
===
RCS file: /cvs/src/sys/net80211/ieee80211_input.c,v
retrieving revision 1.184
diff -u -r1.184 ieee80211_input.c
--- sys/net80211/ieee80211_input.c 16 Jan 2017 09:35:06 - 1.184
+++ sys/net80211/ieee80211_input.c 24 Jan 2017 14:26:19 -
@@ -1096,7 +1096,7 @@
}
ieee80211_deliver_data(ic, m, ni, mcast);
- if (n->m_len == 0) {
+ if (n->m_pkthdr.len == 0) {
m_freem(n);
break;
}
tcpdump(63969): syscall 54 "tty"
Hi all, every time when quitting tcpdump with ^C i see that log on console. Source is fetched few minutes ago ... Don't know is this good or bad so i'm sending it here .. OpenBSD 6.0-current (GENERIC.MP) #15: Tue Jan 24 15:09:53 CET 2017 hrv...@fw02bcbn.srce.hr:/usr/src/sys/arch/amd64/compile/GENERIC.MP real mem = 12854988800 (12259MB) avail mem = 12460756992 (11883MB) mpath0 at root scsibus0 at mpath0: 256 targets mainbus0 at root bios0 at mainbus0: SMBIOS rev. 2.6 @ 0xcf49c000 (84 entries) bios0: vendor Dell Inc. version "6.4.0" date 07/23/2013 bios0: Dell Inc. PowerEdge R610 acpi0 at bios0: rev 2 acpi0: sleep states S0 S4 S5 acpi0: tables DSDT FACP APIC SPCR HPET DM__ MCFG WD__ SLIC ERST HEST BERT EINJ SRAT TCPA acpi0: wakeup devices PCI0(S5) acpitimer0 at acpi0: 3579545 Hz, 24 bits acpimadt0 at acpi0 addr 0xfee0: PC-AT compat cpu0 at mainbus0: apid 32 (boot processor) cpu0: Intel(R) Xeon(R) CPU E5630 @ 2.53GHz, 2527.38 MHz cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,DCA,SSE4.1,SSE4.2,POPCNT,AES,NXE,PAGE1GB,LONG,LAHF,PERF,ITSC,SENSOR,ARAT cpu0: 256KB 64b/line 8-way L2 cache cpu0: TSC frequency 2527376740 Hz cpu0: smt 0, core 0, package 1 mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges cpu0: apic clock running at 133MHz cpu0: mwait min=64, max=64, C-substates=0.2.1.1, IBE cpu1 at mainbus0: apid 0 (application processor) cpu1: Intel(R) Xeon(R) CPU E5630 @ 2.53GHz, 2527.01 MHz cpu1: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,DCA,SSE4.1,SSE4.2,POPCNT,AES,NXE,PAGE1GB,LONG,LAHF,PERF,ITSC,SENSOR,ARAT cpu1: 256KB 64b/line 8-way L2 cache cpu1: smt 0, core 0, package 0 cpu2 at mainbus0: apid 34 (application processor) cpu2: Intel(R) Xeon(R) CPU E5630 @ 2.53GHz, 2527.01 MHz cpu2: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,DCA,SSE4.1,SSE4.2,POPCNT,AES,NXE,PAGE1GB,LONG,LAHF,PERF,ITSC,SENSOR,ARAT cpu2: 256KB 64b/line 8-way L2 cache cpu2: smt 0, core 1, package 1 cpu3 at mainbus0: apid 2 (application processor) cpu3: Intel(R) Xeon(R) CPU E5630 @ 2.53GHz, 2527.01 MHz cpu3: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,DCA,SSE4.1,SSE4.2,POPCNT,AES,NXE,PAGE1GB,LONG,LAHF,PERF,ITSC,SENSOR,ARAT cpu3: 256KB 64b/line 8-way L2 cache cpu3: smt 0, core 1, package 0 cpu4 at mainbus0: apid 50 (application processor) cpu4: Intel(R) Xeon(R) CPU E5630 @ 2.53GHz, 2527.01 MHz cpu4: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,DCA,SSE4.1,SSE4.2,POPCNT,AES,NXE,PAGE1GB,LONG,LAHF,PERF,ITSC,SENSOR,ARAT cpu4: 256KB 64b/line 8-way L2 cache cpu4: smt 0, core 9, package 1 cpu5 at mainbus0: apid 18 (application processor) cpu5: Intel(R) Xeon(R) CPU E5630 @ 2.53GHz, 2527.01 MHz cpu5: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,DCA,SSE4.1,SSE4.2,POPCNT,AES,NXE,PAGE1GB,LONG,LAHF,PERF,ITSC,SENSOR,ARAT cpu5: 256KB 64b/line 8-way L2 cache cpu5: smt 0, core 9, package 0 cpu6 at mainbus0: apid 52 (application processor) cpu6: Intel(R) Xeon(R) CPU E5630 @ 2.53GHz, 2527.01 MHz cpu6: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,DCA,SSE4.1,SSE4.2,POPCNT,AES,NXE,PAGE1GB,LONG,LAHF,PERF,ITSC,SENSOR,ARAT cpu6: 256KB 64b/line 8-way L2 cache cpu6: smt 0, core 10, package 1 cpu7 at mainbus0: apid 20 (application processor) cpu7: Intel(R) Xeon(R) CPU E5630 @ 2.53GHz, 2527.01 MHz cpu7: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,DCA,SSE4.1,SSE4.2,POPCNT,AES,NXE,PAGE1GB,LONG,LAHF,PERF,ITSC,SENSOR,ARAT cpu7: 256KB 64b/line 8-way L2 cache cpu7: smt 0, core 10, package 0 ioapic0 at mainbus0: apid 0 pa 0xfec0, version 20, 24 pins ioapic1 at mainbus0: apid 1 pa 0xfec8, version 20, 24 pins acpihpet0 at acpi0: 14318179 Hz acpimcfg0 at acpi0 addr 0xe000, bus 0-255 acpiprt0 at acpi0: bus 0 (PCI0) acpiprt1 at acpi0: bus 1 (PEX1) acpiprt2 at acpi0: bus 2 (PEX3) acpiprt3 at acpi0: bus -1 (PEX4) acpiprt4 at acpi0: bus -1 (PEX5) acpiprt5 at acpi0: bus -1 (PEX6) acpiprt6
Re: NET_LOCK() for bpf(4)
On 24.1.2017. 10:59, Martin Pieuchot wrote: > ok? > > Index: net/bpf.c > === > RCS file: /cvs/src/sys/net/bpf.c,v > retrieving revision 1.158 > diff -u -p -r1.158 bpf.c > --- net/bpf.c 9 Jan 2017 19:15:01 - 1.158 > +++ net/bpf.c 21 Jan 2017 00:55:26 - > @@ -624,9 +624,9 @@ bpfwrite(dev_t dev, struct uio *uio, int > if (d->bd_hdrcmplt && dst.ss_family == AF_UNSPEC) > dst.ss_family = pseudo_AF_HDRCMPLT; > > - s = splsoftnet(); > + NET_LOCK(s); > error = ifp->if_output(ifp, m, (struct sockaddr *)&dst, NULL); > - splx(s); > + NET_UNLOCK(s); > > out: > bpf_put(d); > Hi, i'm running this patch on firewall in production with source fetched few minutes ago and everything works fine ... on that firewall i have: carp pf pfsync isakmpd -K4 sasyncd dhcpd dhcpd sync tcpdump -lnqttti pflog0 pflow ipfix
Re: global mbuf memory limit
On Tue, Jan 24, 2017 at 05:46:31PM +1000, David Gwynne wrote: > > Apart from the problem that I don't know wether the mutex kills > > performance, the diff looks good. > > the tests ive done and simon mages has done show a slight benefit. > id expect to see that grow as we use pools more concurrently. Then it is OK bluhm@
Two fixes for m_split() in sys/kern/uipc_mbuf.c.
This patch fixes two issues in m_split() in sys/kern/uipc_mbuf.c, which
are correctly handled in FreeBSD's m_split():
If the m_split() would split an mbuf chain exactly between 2 mbufs (i.e.
remain == 0), the returned M_PKTHDR might unnecessarily reference an
mbuf cluster from the first part of the original mbuf chain. So the
returned mbuf would have the M_EXT flag set in n->m_flags, but with
n->m_len == 0. Instead m_split should explicitly handle that case.
The second issue fixes a case in m_split() where n->m_len isn't initialized
explicitly before returning, and also wasn't pre-zeroed by MGETHDR (since
that calls pool_get without PR_ZERO flag).
Index: uipc_mbuf.c
===
RCS file: /cvs/src/sys/kern/uipc_mbuf.c,v
retrieving revision 1.239
diff -u -r1.239 uipc_mbuf.c
--- uipc_mbuf.c 29 Nov 2016 10:22:30 - 1.239
+++ uipc_mbuf.c 24 Jan 2017 14:07:03 -
@@ -1013,6 +1013,12 @@
n->m_pkthdr.len -= len0;
olen = m0->m_pkthdr.len;
m0->m_pkthdr.len = len0;
+ if (remain == 0) {
+ n->m_next = m->m_next;
+ m->m_next = NULL;
+ n->m_len = 0;
+ return (n);
+ }
if (m->m_flags & M_EXT)
goto extpacket;
if (remain > MHLEN) {
@@ -1023,8 +1029,10 @@
(void) m_free(n);
m0->m_pkthdr.len = olen;
return (NULL);
- } else
+ } else {
+ n->m_len = 0;
return (n);
+ }
} else
MH_ALIGN(n, remain);
} else if (remain == 0) {
Re: [WWW] Reverse chronological order for faq/current.html
On 01/24/17 04:06, Raf Czlonka wrote: ... > Another way to look at it is, "Let me have a look if there's anything > new on faq/current.html - I open the page and, *without* moving > forward, can see straight away if something new has been added. No? > Then I move on with my life without scrolling down or doing anything > else apart from opening the page". Given OpenBSD's rapid development, > new entries on faq/current.html appear quite frequently - I'm only > thinking of the tiny amount of time saved each time. What I think you are not thinking of is that in addition to being a list of things that have changed, it is also a list of changes that have to be done ... often IN PARTICULAR ORDER. As it is, you read down until you hit where you are, then follow the instructions in order. "more difficult" in your argument, but logical. As you propose, you read down until you find where you are not, then change directions and read backwards. That's not intuitive, normal, or reasonable to expect. Most likely, your plan will have people making changes in reverse order...which may often work, but sometimes won't...and won't be the order the developers will be testing. Nick.
Re: document that RES_USE_EDNS0 and RES_USE_DNSSEC currently do nothing
On Tue, Jan 24, 2017 at 08:13:07AM +, Jason McIntyre wrote: > On Tue, Jan 24, 2017 at 09:02:46AM +0100, Kirill Miazine wrote: > > > > Let's give it another try: > > > > a little inconsistency here... we already note that edns does nothing in > resolv.conf(5) but that file makes no mention of dnssec. so i'm not sure > if something needs to be added to resolv.conf(5) too. > > in the meantime i'm ok with the diff if someone wants to ok it. however > the wording we use in resolv.conf(5) is > > By default on OpenBSD this option does nothing. > > i'd rather stick with that, or adjust resolv.conf(5) if there is some > pressing need. > > anyone? > > jmc > i've committed a tweaked version of kirill's diff with some help from jca. jmc
Re: httpd TLS ticket support
> On 24.01.2017, at 12:44, Claudio Jeker wrote:
>
> On Tue, Jan 24, 2017 at 07:52:07AM +0100, Reyk Floeter wrote:
>>
>>> Am 24.01.2017 um 02:54 schrieb Claudio Jeker :
>>>
>>> Since I just added ticket support to libtls here is a diff to enable it
>>> in httpd.
>>>
>>
>> Thanks, comments below.
>>
>
> New version that actually uses a per server tls ticket lifetime. Got a bit
> more complex because there is now multiple timers running.
>
looks good
Reyk
> -
> :wq Claudio
>
> Index: config.c
> ===
> RCS file: /cvs/src/usr.sbin/httpd/config.c,v
> retrieving revision 1.50
> diff -u -p -r1.50 config.c
> --- config.c 6 Nov 2016 10:49:38 - 1.50
> +++ config.c 24 Jan 2017 11:21:35 -
> @@ -146,6 +146,7 @@ config_getcfg(struct httpd *env, struct
> memcpy(&cf, imsg->data, sizeof(cf));
> env->sc_opts = cf.cf_opts;
> env->sc_flags = cf.cf_flags;
> + memcpy(env->sc_tls_sid, cf.cf_tls_sid, sizeof(env->sc_tls_sid));
>
> what = ps->ps_what[privsep_process];
>
> @@ -238,6 +239,9 @@ config_setserver(struct httpd *env, stru
> close(srv->srv_s);
> srv->srv_s = -1;
> }
> +
> + explicit_bzero(&srv->srv_conf.tls_ticket_key,
> + sizeof(srv->srv_conf.tls_ticket_key));
>
> return (0);
> }
> Index: httpd.c
> ===
> RCS file: /cvs/src/usr.sbin/httpd/httpd.c,v
> retrieving revision 1.63
> diff -u -p -r1.63 httpd.c
> --- httpd.c 9 Jan 2017 14:49:22 - 1.63
> +++ httpd.c 24 Jan 2017 11:20:17 -
> @@ -57,6 +57,8 @@ int parent_dispatch_server(int, struct
> struct imsg *);
> intparent_dispatch_logger(int, struct privsep_proc *,
> struct imsg *);
> +void parent_tls_ticket_rekey_start(struct server *);
> +void parent_tls_ticket_rekey(int, short, void *);
>
> struct httpd *httpd_env;
>
> @@ -253,6 +255,9 @@ main(int argc, char *argv[])
> exit(0);
> }
>
> + /* initialize the TLS session id to a random key for all procs */
> + arc4random_buf(env->sc_tls_sid, sizeof(env->sc_tls_sid));
> +
> if (parent_configure(env) == -1)
> fatalx("configuration failed");
>
> @@ -288,6 +293,10 @@ parent_configure(struct httpd *env)
> TAILQ_FOREACH(srv, env->sc_servers, srv_entry) {
> if (srv->srv_conf.flags & SRVFLAG_LOCATION)
> continue;
> + /* start the rekey of the tls ticket keys */
> + if (srv->srv_conf.flags & SRVFLAG_TLS &&
> + srv->srv_conf.tls_ticket_lifetime)
> + parent_tls_ticket_rekey_start(srv);
> if (config_setserver(env, srv) == -1)
> fatal("send server");
> }
> @@ -307,6 +316,7 @@ parent_configure(struct httpd *env)
> continue;
> cf.cf_opts = env->sc_opts;
> cf.cf_flags = env->sc_flags;
> + memcpy(cf.cf_tls_sid, env->sc_tls_sid, sizeof(cf.cf_tls_sid));
>
> proc_compose(env->sc_ps, id, IMSG_CFG_DONE, &cf, sizeof(cf));
> }
> @@ -450,6 +460,38 @@ parent_dispatch_logger(int fd, struct pr
> }
>
> return (0);
> +}
> +
> +void
> +parent_tls_ticket_rekey_start(struct server *srv)
> +{
> + struct timeval tv;
> +
> + server_generate_ticket_key(&srv->srv_conf);
> +
> + evtimer_set(&srv->srv_evt, parent_tls_ticket_rekey, srv);
> + timerclear(&tv);
> + tv.tv_sec = srv->srv_conf.tls_ticket_lifetime / 4;
> + evtimer_add(&srv->srv_evt, &tv);
> +}
> +
> +void
> +parent_tls_ticket_rekey(int fd, short events, void *arg)
> +{
> + struct server *srv = arg;
> + struct timeval tv;
> +
> + server_generate_ticket_key(&srv->srv_conf);
> + proc_compose_imsg(httpd_env->sc_ps, PROC_SERVER, -1,
> + IMSG_TLSTICKET_REKEY, -1, -1, &srv->srv_conf.tls_ticket_key,
> + sizeof(srv->srv_conf.tls_ticket_key));
> + explicit_bzero(&srv->srv_conf.tls_ticket_key,
> + sizeof(srv->srv_conf.tls_ticket_key));
> +
> + evtimer_set(&srv->srv_evt, parent_tls_ticket_rekey, srv);
> + timerclear(&tv);
> + tv.tv_sec = srv->srv_conf.tls_ticket_lifetime / 4;
> + evtimer_add(&srv->srv_evt, &tv);
> }
>
> /*
> Index: httpd.conf.5
> ===
> RCS file: /cvs/src/usr.sbin/httpd/httpd.conf.5,v
> retrieving revision 1.76
> diff -u -p -r1.76 httpd.conf.5
> --- httpd.conf.5 14 Nov 2016 10:28:31 - 1.76
> +++ httpd.conf.5 24 Jan 2017 11:36:16 -
> @@ -556,6 +556,13 @@ will be used (secure protocols; TLSv1.2-
> Refer to the
> .Xr tls_config_parse_protocols 3
> function for other valid protocol string values.
> +.It Ic tickets Ic lifetime Ar seconds
> +Enable TLS session tickets with a
> +.Ar s
Re: httpd TLS ticket support
On Tue, Jan 24, 2017 at 07:52:07AM +0100, Reyk Floeter wrote:
>
> > Am 24.01.2017 um 02:54 schrieb Claudio Jeker :
> >
> > Since I just added ticket support to libtls here is a diff to enable it
> > in httpd.
> >
>
> Thanks, comments below.
>
New version that actually uses a per server tls ticket lifetime. Got a bit
more complex because there is now multiple timers running.
--
:wq Claudio
Index: config.c
===
RCS file: /cvs/src/usr.sbin/httpd/config.c,v
retrieving revision 1.50
diff -u -p -r1.50 config.c
--- config.c6 Nov 2016 10:49:38 - 1.50
+++ config.c24 Jan 2017 11:21:35 -
@@ -146,6 +146,7 @@ config_getcfg(struct httpd *env, struct
memcpy(&cf, imsg->data, sizeof(cf));
env->sc_opts = cf.cf_opts;
env->sc_flags = cf.cf_flags;
+ memcpy(env->sc_tls_sid, cf.cf_tls_sid, sizeof(env->sc_tls_sid));
what = ps->ps_what[privsep_process];
@@ -238,6 +239,9 @@ config_setserver(struct httpd *env, stru
close(srv->srv_s);
srv->srv_s = -1;
}
+
+ explicit_bzero(&srv->srv_conf.tls_ticket_key,
+ sizeof(srv->srv_conf.tls_ticket_key));
return (0);
}
Index: httpd.c
===
RCS file: /cvs/src/usr.sbin/httpd/httpd.c,v
retrieving revision 1.63
diff -u -p -r1.63 httpd.c
--- httpd.c 9 Jan 2017 14:49:22 - 1.63
+++ httpd.c 24 Jan 2017 11:20:17 -
@@ -57,6 +57,8 @@ intparent_dispatch_server(int, struct
struct imsg *);
int parent_dispatch_logger(int, struct privsep_proc *,
struct imsg *);
+voidparent_tls_ticket_rekey_start(struct server *);
+voidparent_tls_ticket_rekey(int, short, void *);
struct httpd *httpd_env;
@@ -253,6 +255,9 @@ main(int argc, char *argv[])
exit(0);
}
+ /* initialize the TLS session id to a random key for all procs */
+ arc4random_buf(env->sc_tls_sid, sizeof(env->sc_tls_sid));
+
if (parent_configure(env) == -1)
fatalx("configuration failed");
@@ -288,6 +293,10 @@ parent_configure(struct httpd *env)
TAILQ_FOREACH(srv, env->sc_servers, srv_entry) {
if (srv->srv_conf.flags & SRVFLAG_LOCATION)
continue;
+ /* start the rekey of the tls ticket keys */
+ if (srv->srv_conf.flags & SRVFLAG_TLS &&
+ srv->srv_conf.tls_ticket_lifetime)
+ parent_tls_ticket_rekey_start(srv);
if (config_setserver(env, srv) == -1)
fatal("send server");
}
@@ -307,6 +316,7 @@ parent_configure(struct httpd *env)
continue;
cf.cf_opts = env->sc_opts;
cf.cf_flags = env->sc_flags;
+ memcpy(cf.cf_tls_sid, env->sc_tls_sid, sizeof(cf.cf_tls_sid));
proc_compose(env->sc_ps, id, IMSG_CFG_DONE, &cf, sizeof(cf));
}
@@ -450,6 +460,38 @@ parent_dispatch_logger(int fd, struct pr
}
return (0);
+}
+
+void
+parent_tls_ticket_rekey_start(struct server *srv)
+{
+ struct timeval tv;
+
+ server_generate_ticket_key(&srv->srv_conf);
+
+ evtimer_set(&srv->srv_evt, parent_tls_ticket_rekey, srv);
+ timerclear(&tv);
+ tv.tv_sec = srv->srv_conf.tls_ticket_lifetime / 4;
+ evtimer_add(&srv->srv_evt, &tv);
+}
+
+void
+parent_tls_ticket_rekey(int fd, short events, void *arg)
+{
+ struct server *srv = arg;
+ struct timeval tv;
+
+ server_generate_ticket_key(&srv->srv_conf);
+ proc_compose_imsg(httpd_env->sc_ps, PROC_SERVER, -1,
+ IMSG_TLSTICKET_REKEY, -1, -1, &srv->srv_conf.tls_ticket_key,
+ sizeof(srv->srv_conf.tls_ticket_key));
+ explicit_bzero(&srv->srv_conf.tls_ticket_key,
+ sizeof(srv->srv_conf.tls_ticket_key));
+
+ evtimer_set(&srv->srv_evt, parent_tls_ticket_rekey, srv);
+ timerclear(&tv);
+ tv.tv_sec = srv->srv_conf.tls_ticket_lifetime / 4;
+ evtimer_add(&srv->srv_evt, &tv);
}
/*
Index: httpd.conf.5
===
RCS file: /cvs/src/usr.sbin/httpd/httpd.conf.5,v
retrieving revision 1.76
diff -u -p -r1.76 httpd.conf.5
--- httpd.conf.514 Nov 2016 10:28:31 - 1.76
+++ httpd.conf.524 Jan 2017 11:36:16 -
@@ -556,6 +556,13 @@ will be used (secure protocols; TLSv1.2-
Refer to the
.Xr tls_config_parse_protocols 3
function for other valid protocol string values.
+.It Ic tickets Ic lifetime Ar seconds
+Enable TLS session tickets with a
+.Ar seconds
+session lifetime.
+It is possible to set
+.Ar seconds
+to default to use the httpd default timeout of 2 hours.
.El
.El
.Sh TYPES
Index: httpd.h
==
Re: refactor PF option parsing loops
Hello Richard, > PF implements six distinct TCP option parsing loops. This patch converts > these to one inline function in pfvar_priv.h, normalises their semantics, > and strips ~100 lines. what is the reason to keep function definition in pfvar_priv.h? I would expect to stick function header to pfvar_priv.h and definition to .c. The only reason, which comes to my mind you want to avoid the extra stack frame for any price. So the only way to give compiler chance to inline the pf_find_tcpopt() is to keep its definition in .h. is my assumption correct? My preference is to put the function to .c. thanks and regards sasha
armv7 stack size bump
The following diff applies to armv7 the same stack limits as on i386. Not touching MAXDSIZ for now. Comments / ok? Index: arch/armv7/include/vmparam.h === RCS file: /d/cvs/src/sys/arch/armv7/include/vmparam.h,v retrieving revision 1.4 diff -u -p -r1.4 vmparam.h --- arch/armv7/include/vmparam.h24 Jun 2015 21:35:01 - 1.4 +++ arch/armv7/include/vmparam.h24 Jan 2017 10:57:42 - @@ -35,12 +35,18 @@ #defineARM_KERNEL_BASE 0xc000U -/* Allow armv7 to have bigger DSIZ than generic arm, allow user to override */ +/* Allow armv7 to have bigger limits than generic arm, allow user to override */ #ifndefMAXDSIZ #defineMAXDSIZ (1024*1024*1024)/* max data size */ #endif #ifndef BRKSIZ #defineBRKSIZ MAXDSIZ /* heap gap size */ +#endif +#ifndefDFLSSIZ +#defineDFLSSIZ (4*1024*1024) /* initial stack size limit */ +#endif +#ifndefMAXSSIZ +#defineMAXSSIZ (32*1024*1024) /* max stack size */ #endif #include -- jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
Re: [WWW] Reverse chronological order for faq/current.html
> On 2017/01/24 09:06, Raf Czlonka wrote: > > Another way to look at it is, "Let me have a look if there's anything > > new on faq/current.html - I open the page and, *without* moving > > forward, can see straight away if something new has been added. > > Since we've been doing it the other way for 12 years, I think it would > likely cause confusion for existing users.. For Raf, http://tinyurl.com/jakb5bb
Re: ld.so: don't use _dl_exit() for fatal errors
> Date: Tue, 24 Jan 2017 19:38:11 +1000 > From: Philip Guenther > > On Tue, 24 Jan 2017, Mark Kettenis wrote: > ... > > Looks ok to me. However: > > > > > @@ -57,6 +57,8 @@ int _dl_getcwd(char *, size_t); > > > int _dl_utrace(const char *, const void *, size_t); > > > int _dl_getentropy(char *, size_t); > > > int _dl_sendsyslog(const char *, size_t, int); > > > +__dead > > > +void _dl_thrkill(pid_t, int, void *); > > > > Doesn't make sense to have __dead on a separate line here. There are > > a couple of those throughout the diff. > > That's how _dl_exit() was declared, with __dead on the preceeding line: > __dead > void_dl_exit(int); > > Could change them all...or wait until someone figures out how to move > syscall.h up a level and be MI... fair enough
NET_LOCK() for bpf(4)
ok? Index: net/bpf.c === RCS file: /cvs/src/sys/net/bpf.c,v retrieving revision 1.158 diff -u -p -r1.158 bpf.c --- net/bpf.c 9 Jan 2017 19:15:01 - 1.158 +++ net/bpf.c 21 Jan 2017 00:55:26 - @@ -624,9 +624,9 @@ bpfwrite(dev_t dev, struct uio *uio, int if (d->bd_hdrcmplt && dst.ss_family == AF_UNSPEC) dst.ss_family = pseudo_AF_HDRCMPLT; - s = splsoftnet(); + NET_LOCK(s); error = ifp->if_output(ifp, m, (struct sockaddr *)&dst, NULL); - splx(s); + NET_UNLOCK(s); out: bpf_put(d);
Re: [WWW] Reverse chronological order for faq/current.html
On 2017/01/24 09:06, Raf Czlonka wrote: > Another way to look at it is, "Let me have a look if there's anything > new on faq/current.html - I open the page and, *without* moving > forward, can see straight away if something new has been added. Since we've been doing it the other way for 12 years, I think it would likely cause confusion for existing users.. > Then I move on with my life without scrolling down or doing anything > else apart from opening the page". Given OpenBSD's rapid development, > new entries on faq/current.html appear quite frequently - I'm only > thinking of the tiny amount of time saved each time. If you're running current, I'd recommend keeping an eye on the source-changes list, then you'll already know if there's something new which affects you :-)
Re: [WWW] Reverse chronological order for faq/current.html
On 01/24/17 04:08, Theo de Raadt wrote: Another way to look at it is, "Let me have a look if there's anything new on faq/current.html - I open the page and, *without* moving forward, can see straight away if something new has been added. No? Then I move on with my life without scrolling down or doing anything else apart from opening the page". Given OpenBSD's rapid development, new entries on faq/current.html appear quite frequently - I'm only thinking of the tiny amount of time saved each time. Yes clearly I'm not considering your valuable time. Raf, think about the physical world. When people add things to a list like a posting on a bulletin board, it goes at the end. People just know to look at the end for anything new. So it is online. The effort to scroll down is pretty small. --STeve Andre'
realloc(3) and MALLOC_MOVE
Hi,
malloc(3) has the nice feature to move (subject to alignment
constraints) allocations that are between the max chunk size (half a
page) and a page size towards the end of the allocated page, to catch
more buffer overflows. Due to the allocation being higher up within a
page, buffer overflows will end up beyond the page in more cases.
Until now, realloc(3) did not handle this in a smart way. When it
encountered an existing moved allocation it always did a
malloc-copy-free dance.
This diff fixes that, at the same time doing more cases without
requesting new pages from the kernel.
Please review and test,
BTW, we cannot use this feature for allocations larger than or equal
to a page, since these should return page-aligned pointers.
-Otto
Index: malloc.c
===
RCS file: /cvs/src/lib/libc/stdlib/malloc.c,v
retrieving revision 1.212
diff -u -p -r1.212 malloc.c
--- malloc.c21 Jan 2017 07:47:42 - 1.212
+++ malloc.c24 Jan 2017 06:08:13 -
@@ -1328,13 +1328,9 @@ ofree(struct dir_info *argpool, void *p)
sz - mopts.malloc_guard,
PAGEROUND(sz - mopts.malloc_guard));
} else {
-#if notyetbecause_of_realloc
/* shifted towards the end */
- if (p != ((char *)r->p) + ((MALLOC_PAGESIZE -
- MALLOC_MINSIZE - sz - mopts.malloc_guard) &
- ~(MALLOC_MINSIZE-1))) {
- }
-#endif
+ if (p != MALLOC_MOVE(r->p, sz))
+ wrterror(pool, "bogus moved pointer %p", p);
p = r->p;
}
if (mopts.malloc_guard) {
@@ -1474,7 +1470,7 @@ orealloc(struct dir_info *argpool, void
if (gnewsz > MALLOC_MAXCHUNK)
gnewsz += mopts.malloc_guard;
- if (newsz > MALLOC_MAXCHUNK && oldsz > MALLOC_MAXCHUNK && p == r->p &&
+ if (newsz > MALLOC_MAXCHUNK && oldsz > MALLOC_MAXCHUNK &&
!mopts.malloc_realloc) {
/* First case: from n pages sized allocation to m pages sized
allocation, no malloc_move in effect */
@@ -1484,7 +1480,7 @@ orealloc(struct dir_info *argpool, void
if (rnewsz > roldsz) {
/* try to extend existing region */
if (!mopts.malloc_guard) {
- void *hint = (char *)p + roldsz;
+ void *hint = (char *)r->p + roldsz;
size_t needed = rnewsz - roldsz;
STATS_INC(pool->cheap_realloc_tries);
@@ -1502,9 +1498,15 @@ gotit:
STATS_ADD(pool->malloc_used, needed);
if (mopts.malloc_junk == 2)
memset(q, SOME_JUNK, needed);
- r->size = newsz;
+ r->size = gnewsz;
+ if (r->p != p) {
+ /* old pointer is moved */
+ memmove(r->p, p, oldsz);
+ p = r->p;
+ }
if (mopts.chunk_canaries)
- fill_canary(p, newsz,
PAGEROUND(newsz));
+ fill_canary(p, newsz,
+ PAGEROUND(newsz));
STATS_SETF(r, f);
STATS_INC(pool->cheap_reallocs);
ret = p;
@@ -1517,30 +1519,45 @@ gotit:
} else if (rnewsz < roldsz) {
/* shrink number of pages */
if (mopts.malloc_guard) {
- if (mprotect((char *)p + roldsz -
+ if (mprotect((char *)r->p + roldsz -
mopts.malloc_guard, mopts.malloc_guard,
PROT_READ | PROT_WRITE))
wrterror(pool, "mprotect");
- if (mprotect((char *)p + rnewsz -
+ if (mprotect((char *)r->p + rnewsz -
mopts.malloc_guard, mopts.malloc_guard,
PROT_NONE))
wrterror(pool, "mprotect");
}
- unmap(pool, (char *)p + rnewsz, roldsz - rnewsz);
+ unmap(pool, (char *)r->p + rnewsz, roldsz - rnewsz);
r->size = gnewsz;
-
Re: ld.so: don't use _dl_exit() for fatal errors
On Tue, 24 Jan 2017, Mark Kettenis wrote: ... > Looks ok to me. However: > > > @@ -57,6 +57,8 @@ int _dl_getcwd(char *, size_t); > > int_dl_utrace(const char *, const void *, size_t); > > int_dl_getentropy(char *, size_t); > > int_dl_sendsyslog(const char *, size_t, int); > > +__dead > > +void _dl_thrkill(pid_t, int, void *); > > Doesn't make sense to have __dead on a separate line here. There are > a couple of those throughout the diff. That's how _dl_exit() was declared, with __dead on the preceeding line: __dead void_dl_exit(int); Could change them all...or wait until someone figures out how to move syscall.h up a level and be MI... Philip
Re: no pointer sign warnings
Perhaps.
Also my position remains that our tree should not avoid -Werror. It
is unmanageable with the number of architectures we support.
> clang complains about pointer sign changes The most simple fix
> would be to disable the warning for clang.
>
> Example from librthread:
>
> /home/patrick/openbsd-src/lib/librthread/rthread_sem.c:316:13: error: passing
> 'const char *' to parameter of type 'const u_int8_t *' (aka 'const unsigned
> char *') converts between pointers to integer
> types with different sign [-Werror,-Wpointer-sign]
> SHA256Data(origpath, strlen(origpath), buf);
>^~~~
> /usr/cross/arm64/usr/include/sha2.h:100:34: note: passing argument to
> parameter here
> char *SHA256Data(const u_int8_t *, size_t, char *)
> ^
>
> Opinions?
>
> Patrick
>
> diff --git a/lib/libcrypto/Makefile b/lib/libcrypto/Makefile
> index 3fb904b470f..5e84ef39a9c 100644
> --- a/lib/libcrypto/Makefile
> +++ b/lib/libcrypto/Makefile
> @@ -14,6 +14,9 @@ CLEANFILES=${PC_FILES} ${VERSION_SCRIPT}
> LCRYPTO_SRC= ${.CURDIR}
>
> CFLAGS+= -Wall -Wundef -Werror
> +.if ${COMPILER_VERSION:L} == "clang"
> +CFLAGS+= -Wno-pointer-sign
> +.endif
>
> .if !defined(NOPIC)
> CFLAGS+= -DDSO_DLFCN -DHAVE_DLFCN_H -DHAVE_FUNOPEN
> diff --git a/lib/librthread/Makefile b/lib/librthread/Makefile
> index 7eed6fedfca..6016c90b1b8 100644
> --- a/lib/librthread/Makefile
> +++ b/lib/librthread/Makefile
> @@ -1,11 +1,16 @@
> #$OpenBSD: Makefile,v 1.43 2016/06/01 04:34:18 tedu Exp $
>
> +.include
> +
> LIB=pthread
> LIBCSRCDIR= ${.CURDIR}/../libc
>
> CFLAGS+=-Wall -g -Werror -Wshadow
> CFLAGS+=-Werror-implicit-function-declaration
> CFLAGS+=-Wsign-compare
> +.if ${COMPILER_VERSION:L} == "clang"
> +CFLAGS+=-Wno-pointer-sign
> +.endif
> CFLAGS+=-I${.CURDIR} -include namespace.h \
> -I${LIBCSRCDIR}/arch/${MACHINE_CPU} -I${LIBCSRCDIR}/include
> CDIAGFLAGS=
> diff --git a/lib/libtls/Makefile b/lib/libtls/Makefile
> index af860bb0670..1b07f1bed62 100644
> --- a/lib/libtls/Makefile
> +++ b/lib/libtls/Makefile
> @@ -1,6 +1,11 @@
> #$OpenBSD: Makefile,v 1.29 2016/11/05 08:12:22 jsing Exp $
>
> +.include
> +
> CFLAGS+= -Wall -Werror -Wimplicit
> +.if ${COMPILER_VERSION:L} == "clang"
> +CFLAGS+= -Wno-pointer-sign
> +.endif
> CFLAGS+= -DLIBRESSL_INTERNAL
>
> CLEANFILES= ${VERSION_SCRIPT}
>
no pointer sign warnings
Hi,
clang complains about pointer sign changes The most simple fix
would be to disable the warning for clang.
Example from librthread:
/home/patrick/openbsd-src/lib/librthread/rthread_sem.c:316:13: error: passing
'const char *' to parameter of type 'const u_int8_t *' (aka 'const unsigned
char *') converts between pointers to integer
types with different sign [-Werror,-Wpointer-sign]
SHA256Data(origpath, strlen(origpath), buf);
^~~~
/usr/cross/arm64/usr/include/sha2.h:100:34: note: passing argument to parameter
here
char *SHA256Data(const u_int8_t *, size_t, char *)
^
Opinions?
Patrick
diff --git a/lib/libcrypto/Makefile b/lib/libcrypto/Makefile
index 3fb904b470f..5e84ef39a9c 100644
--- a/lib/libcrypto/Makefile
+++ b/lib/libcrypto/Makefile
@@ -14,6 +14,9 @@ CLEANFILES=${PC_FILES} ${VERSION_SCRIPT}
LCRYPTO_SRC= ${.CURDIR}
CFLAGS+= -Wall -Wundef -Werror
+.if ${COMPILER_VERSION:L} == "clang"
+CFLAGS+= -Wno-pointer-sign
+.endif
.if !defined(NOPIC)
CFLAGS+= -DDSO_DLFCN -DHAVE_DLFCN_H -DHAVE_FUNOPEN
diff --git a/lib/librthread/Makefile b/lib/librthread/Makefile
index 7eed6fedfca..6016c90b1b8 100644
--- a/lib/librthread/Makefile
+++ b/lib/librthread/Makefile
@@ -1,11 +1,16 @@
# $OpenBSD: Makefile,v 1.43 2016/06/01 04:34:18 tedu Exp $
+.include
+
LIB=pthread
LIBCSRCDIR=${.CURDIR}/../libc
CFLAGS+=-Wall -g -Werror -Wshadow
CFLAGS+=-Werror-implicit-function-declaration
CFLAGS+=-Wsign-compare
+.if ${COMPILER_VERSION:L} == "clang"
+CFLAGS+=-Wno-pointer-sign
+.endif
CFLAGS+=-I${.CURDIR} -include namespace.h \
-I${LIBCSRCDIR}/arch/${MACHINE_CPU} -I${LIBCSRCDIR}/include
CDIAGFLAGS=
diff --git a/lib/libtls/Makefile b/lib/libtls/Makefile
index af860bb0670..1b07f1bed62 100644
--- a/lib/libtls/Makefile
+++ b/lib/libtls/Makefile
@@ -1,6 +1,11 @@
# $OpenBSD: Makefile,v 1.29 2016/11/05 08:12:22 jsing Exp $
+.include
+
CFLAGS+= -Wall -Werror -Wimplicit
+.if ${COMPILER_VERSION:L} == "clang"
+CFLAGS+= -Wno-pointer-sign
+.endif
CFLAGS+= -DLIBRESSL_INTERNAL
CLEANFILES= ${VERSION_SCRIPT}
Re: [WWW] Reverse chronological order for faq/current.html
> Another way to look at it is, "Let me have a look if there's anything > new on faq/current.html - I open the page and, *without* moving > forward, can see straight away if something new has been added. No? > Then I move on with my life without scrolling down or doing anything > else apart from opening the page". Given OpenBSD's rapid development, > new entries on faq/current.html appear quite frequently - I'm only > thinking of the tiny amount of time saved each time. Yes clearly I'm not considering your valuable time.
Re: [WWW] Reverse chronological order for faq/current.html
On Mon, Jan 23, 2017 at 11:46:52PM GMT, Theo de Raadt wrote: > > As faq/current.html[0] grows, each major change is being added at > > the very bottom, chronologically. There already are several other > > pages where this kind of ordering makes sense, i.e. innovations.html[1]. > > > > Given the "current" (unintentional pun) nature of changes on the > > aforementioned page, it seem like reverse chronological order would > > suit it better, as is the case with, i.e. events.html[2]. > > This page includes remedial actions a current-follower needs, which > are generally cut&pasted. Sure. > A reader decides "Where was I last time", then would intuitively > move forward. Yes, that's one way to look at it - it is the way I, and everybody else, have been doing. Another way to look at it is, "Let me have a look if there's anything new on faq/current.html - I open the page and, *without* moving forward, can see straight away if something new has been added. No? Then I move on with my life without scrolling down or doing anything else apart from opening the page". Given OpenBSD's rapid development, new entries on faq/current.html appear quite frequently - I'm only thinking of the tiny amount of time saved each time. > The proposal doesn't make sense to me. Duly noted :^) Raf
Re: freestanding take 2, part 2
Mark Kettenis writes: > So here is a diff that starts using -ffreestanding on amd64 and brings > arm64 and armv7 (which are already using -ffreestanding) in line with > amd64. > > I'd like to get this in to give it some exposure before I start > converting the other architectures. ok -- jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
Re: ld.so: don't use _dl_exit() for fatal errors
> Date: Tue, 24 Jan 2017 15:39:49 +1000
> From: Philip Guenther
>
> So right now, ld.so simply exits iun various error cases, like unknown
> relocation. This isn't great, as it's a normal exit when a linking
> failure really should be an abnormal exit as from a fatal signal. If
> "grep" has a linking failure I want it to *die* instead of meekly
> returning non-zero.
>
> Diff below adds three functions to make fatal error handling simpler:
> - _dl_diedie()
>This makes the process kill itself with SIGKILL via thrkill(2). It
>might be nicer to do SIGABRT, but that can be caught so it would need
>to be prepared to use sigaction and suddenly it seems like overkill.
>
> - _dl_die(fmt, ...)
>This is a printf-like function that prints a prefix of
> "ld.so: progname: "
>then the provided format, and finally it adds a newline and calls
>_dl_diedie(). Makes reporting fatal errors trivial.
>
> - _dl_oom()
>Like _dl_die("out of memory"), for use in the common case of a
>failed malloc/etc
>
>
> The rest of the diff then converts the existing "_dl_printf()+_dl_exit()"
> and "_dl_printf() + forced segfault" cases into calls to _dl_die() or
> _dl_oom() as appropriate. Only places which already used _dl_exit() or
> tried to trigger a segfault have been changed to use these.
>
> Tested on amd64, armv7, loongson, macppc, and sparc64 by building a
> version of libc with the 'vis' line removed from Symbols.list, then
> running 'vis' against that .so and verifying the output is something
> like:
> vis:vis: undefined symbol 'vis'
> ld.so: vis: lazy binding failed!
> Killed
>
> Test results for other archs? oks?
Looks ok to me. However:
> @@ -57,6 +57,8 @@ int _dl_getcwd(char *, size_t);
> int _dl_utrace(const char *, const void *, size_t);
> int _dl_getentropy(char *, size_t);
> int _dl_sendsyslog(const char *, size_t, int);
> +__dead
> +void _dl_thrkill(pid_t, int, void *);
Doesn't make sense to have __dead on a separate line here. There are
a couple of those throughout the diff.
Re: document that RES_USE_EDNS0 and RES_USE_DNSSEC currently do nothing
Jason McIntyre writes: > On Tue, Jan 24, 2017 at 09:02:46AM +0100, Kirill Miazine wrote: >> >> Let's give it another try: >> > > a little inconsistency here... we already note that edns does nothing in > resolv.conf(5) but that file makes no mention of dnssec. so i'm not sure > if something needs to be added to resolv.conf(5) too. > > in the meantime i'm ok with the diff if someone wants to ok it. however > the wording we use in resolv.conf(5) is > > By default on OpenBSD this option does nothing. > > i'd rather stick with that, or adjust resolv.conf(5) if there is some > pressing need. Duh, good catch. > anyone? By default on OpenBSD this option does nothing. would be correct for - "debug" in resolv.conf(5) - RES_DEBUG in resolver(3) Looking at the actual code, though, it appears that they would always be ignored - which is fine I think. Gotta ask the usual suspects. On OpenBSD this option does nothing. looks correct for - "edns0" in resolv.conf(5) - RES_USE_EDNS0 and RES_USE_DNSSEC in resolver(3) No need to specify "By default..." -- jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
freestanding take 2, part 2
So here is a diff that starts using -ffreestanding on amd64 and brings
arm64 and armv7 (which are already using -ffreestanding) in line with
amd64.
I'd like to get this in to give it some exposure before I start
converting the other architectures.
Index: arch/amd64/conf/Makefile.amd64
===
RCS file: /cvs/src/sys/arch/amd64/conf/Makefile.amd64,v
retrieving revision 1.74
diff -u -p -r1.74 Makefile.amd64
--- arch/amd64/conf/Makefile.amd64 29 Nov 2016 09:08:34 - 1.74
+++ arch/amd64/conf/Makefile.amd64 24 Jan 2017 08:29:50 -
@@ -24,14 +24,12 @@ _archdir?= $S/arch/${_arch}
INCLUDES= -nostdinc -I$S -I${.OBJDIR} -I$S/arch
CPPFLAGS= ${INCLUDES} ${IDENT} ${PARAM} -D_KERNEL -MD -MP
CWARNFLAGS=-Werror -Wall -Wimplicit-function-declaration \
- -Wno-main -Wno-uninitialized -Wno-pointer-sign \
+ -Wno-uninitialized -Wno-pointer-sign \
-Wframe-larger-than=2047
CMACHFLAGS=-mcmodel=kernel -mno-red-zone -mno-sse2 -mno-sse -mno-3dnow \
-mno-mmx -msoft-float -fno-omit-frame-pointer
-CMACHFLAGS+= -fno-builtin-printf -fno-builtin-snprintf \
- -fno-builtin-vsnprintf -fno-builtin-log \
- -fno-builtin-log2 -fno-builtin-malloc ${NOPIE_FLAGS}
+CMACHFLAGS+= -ffreestanding ${NOPIE_FLAGS}
.if ${IDENT:M-DNO_PROPOLICE}
CMACHFLAGS+= -fno-stack-protector
.endif
Index: arch/arm64/conf/Makefile.arm64
===
RCS file: /cvs/src/sys/arch/arm64/conf/Makefile.arm64,v
retrieving revision 1.2
diff -u -p -r1.2 Makefile.arm64
--- arch/arm64/conf/Makefile.arm64 19 Dec 2016 09:53:21 - 1.2
+++ arch/arm64/conf/Makefile.arm64 24 Jan 2017 08:29:50 -
@@ -24,15 +24,13 @@ _archdir?= $S/arch/${_arch}
INCLUDES= -nostdinc -I$S -I${.OBJDIR} -I$S/arch
CPPFLAGS= ${INCLUDES} ${IDENT} ${PARAM} -D_KERNEL -D__${_mach}__ -MD -MP
CWARNFLAGS=-Werror -Wall -Wimplicit-function-declaration \
- -Wno-main -Wno-uninitialized -Wno-pointer-sign \
+ -Wno-uninitialized -Wno-pointer-sign \
-Wframe-larger-than=2047
-CMACHFLAGS=-ffreestanding -mcpu=cortex-a57+nofp+nosimd \
+CMACHFLAGS=-mcpu=cortex-a57+nofp+nosimd \
-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer \
-ffixed-x18
-CMACHFLAGS+= -fno-builtin-printf -fno-builtin-snprintf \
- -fno-builtin-vsnprintf -fno-builtin-log \
- -fno-builtin-log2 -fno-builtin-malloc ${NOPIE_FLAGS}
+CMACHFLAGS+= -ffreestanding ${NOPIE_FLAGS}
.if ${IDENT:M-DNO_PROPOLICE}
CMACHFLAGS+= -fno-stack-protector
.endif
Index: arch/armv7/conf/Makefile.armv7
===
RCS file: /cvs/src/sys/arch/armv7/conf/Makefile.armv7,v
retrieving revision 1.20
diff -u -p -r1.20 Makefile.armv7
--- arch/armv7/conf/Makefile.armv7 29 Nov 2016 09:08:34 - 1.20
+++ arch/armv7/conf/Makefile.armv7 24 Jan 2017 08:29:50 -
@@ -24,13 +24,11 @@ _archdir?= $S/arch/${_arch}
INCLUDES= -nostdinc -I$S -I. -I$S/arch
CPPFLAGS= ${INCLUDES} ${IDENT} ${PARAM} -D_KERNEL -D__${_mach}__ -MD -MP
CWARNFLAGS=-Werror -Wall -Wimplicit-function-declaration \
- -Wno-main -Wno-uninitialized -Wno-pointer-sign \
+ -Wno-uninitialized -Wno-pointer-sign \
-Wframe-larger-than=2047
-CMACHFLAGS=-ffreestanding -msoft-float -march=armv6 -Wa,-march=armv7a
-CMACHFLAGS+= -fno-builtin-printf -fno-builtin-snprintf \
- -fno-builtin-vsnprintf -fno-builtin-log \
- -fno-builtin-log2 -fno-builtin-malloc ${NOPIE_FLAGS}
+CMACHFLAGS=-msoft-float -march=armv6 -Wa,-march=armv7a
+CMACHFLAGS+= -ffreestanding ${NOPIE_FLAGS}
.if ${IDENT:M-DNO_PROPOLICE}
CMACHFLAGS+= -fno-stack-protector
.endif
Re: pool_debug
On 24/01/17(Tue) 08:06, Christiano F. Haesbaert wrote: > Not sure I get it, the rwlock when is not released when you yield()). So > this will in fact context switch holding the rwlock for every pool_get(). > Did I miss another a change ? That's true. I'd like to know when that happens and where. The diff below combined with a NET_ASSERT_UNLOCKED() in yield() allows me to find that.
Re: pool_debug
On Tue, 24 Jan 2017 at 09:14, Martin Pieuchot wrote: > On 24/01/17(Tue) 08:06, Christiano F. Haesbaert wrote: > > > Not sure I get it, the rwlock when is not released when you yield()). So > > > this will in fact context switch holding the rwlock for every pool_get(). > > > Did I miss another a change ? > > > > That's true. I'd like to know when that happens and where. The diff > > below combined with a NET_ASSERT_UNLOCKED() in yield() allows me to > > find that. > Ah, I missed the assert, thanks.
Re: document that RES_USE_EDNS0 and RES_USE_DNSSEC currently do nothing
Kirill Miazine writes: > * Kirill Miazine [2017-01-24 08:26]: >>> Index: lib/libc/net/resolver.3 >>> === >>> RCS file: /cvs/src/lib/libc/net/resolver.3,v >>> retrieving revision 1.33 >>> diff -u -p -r1.33 resolver.3 >>> --- lib/libc/net/resolver.3 16 Dec 2015 18:12:42 - 1.33 >>> +++ lib/libc/net/resolver.3 23 Jan 2017 22:53:58 - >>> @@ -187,11 +187,11 @@ This informs DNS servers of a client's r >>> allowing them to take advantage of a non-default receive buffer size, >>> and thus to send larger replies. >>> DNS query packets with the EDNS0 extension are not compatible with >>> -non-EDNS0 DNS servers. >>> +non-EDNS0 DNS servers. At the moment this option does nothing. >> New sentences should start on new lines. >> >>> .It Dv RES_USE_DNSSEC >>> Request that the resolver uses >>> Domain Name System Security Extensions (DNSSEC), >>> -as defined in RFCs 4033, 4034, and 4035. >>> +as defined in RFCs 4033, 4034, and 4035. At the moment this option does >>> nothing. >> Same here. >> > > Let's give it another try: Much more useful than what we currently have. ok jca@ > Index: lib/libc/net/resolver.3 > === > RCS file: /cvs/src/lib/libc/net/resolver.3,v > retrieving revision 1.33 > diff -u -p -r1.33 resolver.3 > --- lib/libc/net/resolver.3 16 Dec 2015 18:12:42 - 1.33 > +++ lib/libc/net/resolver.3 24 Jan 2017 08:02:01 - > @@ -188,10 +188,12 @@ allowing them to take advantage of a non > and thus to send larger replies. > DNS query packets with the EDNS0 extension are not compatible with > non-EDNS0 DNS servers. > +At the moment this option does nothing. > .It Dv RES_USE_DNSSEC > Request that the resolver uses > Domain Name System Security Extensions (DNSSEC), > as defined in RFCs 4033, 4034, and 4035. > +At the moment this option does nothing. > .El > .Pp > The -- jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
Re: document that RES_USE_EDNS0 and RES_USE_DNSSEC currently do nothing
On Tue, Jan 24, 2017 at 09:02:46AM +0100, Kirill Miazine wrote: > > Let's give it another try: > a little inconsistency here... we already note that edns does nothing in resolv.conf(5) but that file makes no mention of dnssec. so i'm not sure if something needs to be added to resolv.conf(5) too. in the meantime i'm ok with the diff if someone wants to ok it. however the wording we use in resolv.conf(5) is By default on OpenBSD this option does nothing. i'd rather stick with that, or adjust resolv.conf(5) if there is some pressing need. anyone? jmc > Index: lib/libc/net/resolver.3 > === > RCS file: /cvs/src/lib/libc/net/resolver.3,v > retrieving revision 1.33 > diff -u -p -r1.33 resolver.3 > --- lib/libc/net/resolver.3 16 Dec 2015 18:12:42 - 1.33 > +++ lib/libc/net/resolver.3 24 Jan 2017 08:02:01 - > @@ -188,10 +188,12 @@ allowing them to take advantage of a non > and thus to send larger replies. > DNS query packets with the EDNS0 extension are not compatible with > non-EDNS0 DNS servers. > +At the moment this option does nothing. > .It Dv RES_USE_DNSSEC > Request that the resolver uses > Domain Name System Security Extensions (DNSSEC), > as defined in RFCs 4033, 4034, and 4035. > +At the moment this option does nothing. > .El > .Pp > The > > >
Re: pool_debug
Not sure I get it, the rwlock when is not released when you yield()). So
this will in fact context switch holding the rwlock for every pool_get().
Did I miss another a change ?
On Tue, 24 Jan 2017 at 07:48, Martin Pieuchot wrote:
> I'd like to force a yield() for every pool_get(9) using PR_WAITOK, just
>
> like we do with malloc(9), in order to ensure that the NET_LOCK() is not
>
> held across context switches.
>
>
>
> ok?
>
>
>
> Index: kern/subr_pool.c
>
> ===
>
> RCS file: /cvs/src/sys/kern/subr_pool.c,v
>
> retrieving revision 1.204
>
> diff -u -p -r1.204 subr_pool.c
>
> --- kern/subr_pool.c21 Nov 2016 01:44:06 - 1.204
>
> +++ kern/subr_pool.c24 Jan 2017 06:29:09 -
>
> @@ -513,7 +513,7 @@ pool_get(struct pool *pp, int flags)
>
> }
>
> mtx_leave(&pp->pr_mtx);
>
>
>
> - if (slowdown && ISSET(flags, PR_WAITOK))
>
> + if ((slowdown || pool_debug == 2) && ISSET(flags, PR_WAITOK))
>
> yield();
>
>
>
> if (v == NULL) {
>
>
>
>
Re: document that RES_USE_EDNS0 and RES_USE_DNSSEC currently do nothing
* Kirill Miazine [2017-01-24 08:26]: >> Index: lib/libc/net/resolver.3 >> === >> RCS file: /cvs/src/lib/libc/net/resolver.3,v >> retrieving revision 1.33 >> diff -u -p -r1.33 resolver.3 >> --- lib/libc/net/resolver.3 16 Dec 2015 18:12:42 - 1.33 >> +++ lib/libc/net/resolver.3 23 Jan 2017 22:53:58 - >> @@ -187,11 +187,11 @@ This informs DNS servers of a client's r >> allowing them to take advantage of a non-default receive buffer size, >> and thus to send larger replies. >> DNS query packets with the EDNS0 extension are not compatible with >> -non-EDNS0 DNS servers. >> +non-EDNS0 DNS servers. At the moment this option does nothing. > New sentences should start on new lines. > >> .It Dv RES_USE_DNSSEC >> Request that the resolver uses >> Domain Name System Security Extensions (DNSSEC), >> -as defined in RFCs 4033, 4034, and 4035. >> +as defined in RFCs 4033, 4034, and 4035. At the moment this option does >> nothing. > Same here. > Let's give it another try: Index: lib/libc/net/resolver.3 === RCS file: /cvs/src/lib/libc/net/resolver.3,v retrieving revision 1.33 diff -u -p -r1.33 resolver.3 --- lib/libc/net/resolver.3 16 Dec 2015 18:12:42 - 1.33 +++ lib/libc/net/resolver.3 24 Jan 2017 08:02:01 - @@ -188,10 +188,12 @@ allowing them to take advantage of a non and thus to send larger replies. DNS query packets with the EDNS0 extension are not compatible with non-EDNS0 DNS servers. +At the moment this option does nothing. .It Dv RES_USE_DNSSEC Request that the resolver uses Domain Name System Security Extensions (DNSSEC), as defined in RFCs 4033, 4034, and 4035. +At the moment this option does nothing. .El .Pp The
