Re: vscsi/iscsid: wait for scsi_probe to complete after connections are established

2021-06-20 Thread Ashton Fagg
Updated diffs attached. - I read style(9) a little more closely and worked out I had some issues, so I corrected those. - Revisited the wording in my proposed documentation to make things a clearer. - My mandoc changes were not lint clean - also fixed. No functional changes to the original

fix stuck connections on iwm(4) and iwx(4)

2021-06-20 Thread Stefan Sperling
I have found the reason for stuck connections over iwm/iwx which people have been reporting against -current. My commit which added support for Rx aggregation offload to these drivers introduced a node leak. In other words, the reference counter of ic_bss is incremented with every received frame,

Re: snmpd(8) Better traphandler flow

2021-06-20 Thread Martijn van Duren
On Fri, 2021-06-11 at 16:13 +0200, Martijn van Duren wrote: > any takers? > > On Fri, 2021-06-04 at 22:11 +0200, Martijn van Duren wrote: > > ping > > > > On Fri, 2021-05-28 at 08:19 +0200, Martijn van Duren wrote: > > > As the original comment said: > > > /* > > >  * This should probably go

Re: tls_load_file.3: tls_config_set_*_file() load files into memory

2021-06-20 Thread Theo Buehler
On Sat, Jun 19, 2021 at 03:34:39PM +, Klemens Nanni wrote: > On Thu, Jun 10, 2021 at 10:26:15PM +, Klemens Nanni wrote: > > tls_config_set_ca_file(3) and tls_config_set_cert_file(3) do not just > > set the file paths (like tls_config_set_ca_path(3) does), they do load > > the given file

Re: Fix unsafe snmpd defaults

2021-06-20 Thread Martijn van Duren
On Sun, 2021-06-20 at 09:18 -0600, Theo de Raadt wrote: > Please don't turn current.html into a series of essays. > > At most, the chunks in this page should highlight that something has changed. > What has changed?  Keep it simple.  People should be taught to re-read the > updated manual page. 

Re: Fix unsafe snmpd defaults

2021-06-20 Thread Theo de Raadt
Please don't turn current.html into a series of essays. At most, the chunks in this page should highlight that something has changed. What has changed? Keep it simple. People should be taught to re-read the updated manual page. Thus the manual pages should be accurate. Using current.html as a

Re: Fix unsafe snmpd defaults

2021-06-20 Thread Martijn van Duren
On Sun, 2021-06-20 at 12:58 +0100, Stuart Henderson wrote: > Index: current.html > === > RCS file: /cvs/www/faq/current.html,v > retrieving revision 1.1071 > diff -u -p -r1.1071 current.html > --- current.html26 May 2021

Re: can alarm(3) fail?

2021-06-20 Thread Todd C . Miller
On Sat, 19 Jun 2021 17:15:43 +0200, Alexander Bluhm wrote: > In regress is some code > if ((int)alarm(10) == -1) > or > if (alarm(30) == (unsigned int)-1) > > The man page alarm(3) says "If an error occurs, the value -1 is > returned". Such things could be written. > > Should we avoid to

Re: Fix unsafe snmpd defaults

2021-06-20 Thread Stuart Henderson
Index: current.html === RCS file: /cvs/www/faq/current.html,v retrieving revision 1.1071 diff -u -p -r1.1071 current.html --- current.html26 May 2021 12:12:58 - 1.1071 +++ current.html20 Jun 2021 11:58:05

Re: Fix unsafe snmpd defaults

2021-06-20 Thread Stuart Henderson
On 2021/06/20 12:46, Martijn van Duren wrote: > And here's the diff to change the crypto defaults. > > Currently snmp(1) and snmpd(8) don't match up by default since snmp(1) > uses md5/des as per RFC3414 (sha-1 is a should, md5 is a must) and > net-snmpd's defaults, where snmpd(8) uses sha-1/des.

Re: Fix unsafe snmpd defaults

2021-06-20 Thread Stuart Henderson
On 2021/06/20 12:12, Martijn van Duren wrote: > I didn't change the example, since the example below shows how to set > up snmpv3 and this example's accompanying text is already on the long > side. I did change the text a little to "for SNMPv2c messages only", > so that it's clearer that this does

Re: Fix unsafe snmpd defaults

2021-06-20 Thread Martijn van Duren
And here's the diff to change the crypto defaults. Currently snmp(1) and snmpd(8) don't match up by default since snmp(1) uses md5/des as per RFC3414 (sha-1 is a should, md5 is a must) and net-snmpd's defaults, where snmpd(8) uses sha-1/des. While I haven't heard that md5 and/or sha1 are broken

Re: Fix unsafe snmpd defaults

2021-06-20 Thread Martijn van Duren
On Tue, 2021-06-15 at 17:39 +0100, Stuart Henderson wrote: > > > > - if the concern is amplification attacks then setting the minlevel to > > > >   authpriv is too high, since you'll silently break logins for users > > > >   that miss the enckey parameter. > > > >   I changed this to always

Re: can alarm(3) fail?

2021-06-20 Thread Alexander Bluhm
> > > On Fri, 18 Jun 2021 15:17:47 -0600, "Theo de Raadt" wrote: > > > > OK. How any pieces of code were found which do that? In regress is some code if ((int)alarm(10) == -1) or if (alarm(30) == (unsigned int)-1) The man page alarm(3) says "If an error occurs, the value -1 is

Re: tcpdump(8): improve dhcp6

2021-06-20 Thread Martijn van Duren
On Thu, 2021-06-17 at 08:06 +0200, Martijn van Duren wrote: > dlg@ asked me for an example output, so here it is: > 07:52:52.326084 fe80::fce1:baff:fed2:8886.dhcpv6-client > > ff02::1:2.dhcpv6-server: [udp sum ok] DHCPv6 Solicit xid 0xdc0732 >     OPTION_CLIENTID: