successful [is spelled] with only one l
NetBSD rev. 1.12
Implement ``one'' prefix to allow a "one shot" operation as if
${rcvar}=yes yet all the other prerequisite tests are still performed.
The existing ``force'' prefix is a sledgehammer that ignores all the
prerequisite checks and always returns a zero exit status; this is a
more gentle approach to the problem of "manipulate this disabled
service without editing rc.conf(5)".
Obtained From: NetBSD
a single lock at the same time.
- Avoid using "own" to refer to holding either a shared or exclusive lock
as it is only really correct for exclusive locks.
- Reword the sentence about sleep-ability to read easier.
Requested by: truckman (1)
device.hints kernel environment variables when disabling ACPI.
Some users are getting confused when they see hint.acpi.0.disabled.
They are confusing it with a sysctl MIB.
Finally, add a reference for device.hints(5) and kenv(1)
in the "SEE ALSO" section of the man page.
PR: docs/62974
Submitted by: Christian S.J. Peron <maneo@bsdpro.com>
is reserved by the loader, and thus any tunable name with that suffix will
be silently discarded.
Document this in the header and man page so that other developers do not
develop so many bumps on the head after banging it against the wall.
Detective work by: Mark Santcroos, grehan
- Document all the policy sysctl's.
- Note that mac_portacl(4) appeared in FreeBSD 5.1.
- A bit of mdoc(7) fixes.
Much of the new text was inspired by the source code comments.
Reviewed by: rwatson
Documented function and macros are:
- DECLARE_GEOM_CLASS(),
- g_attach(),
- g_detach(),
- g_new_bio(),
- g_clone_bio(),
- g_destroy_bio(),
- g_new_consumer(),
- g_destroy_consumer(),
- g_read_data(),
- g_write_data(),
- g_post_event(),
- g_waitfor_event(),
- g_cancel_event(),
- g_new_geomf(),
- g_destroy_geom(),
- g_new_providerf(),
- g_destroy_provider(),
- g_error_provider(),
- g_provider_by_name(),
- g_wither_geom().
and more to come.
I want to thanks following people for help with those documents:
Slawek Zak <zaks@prioris.mini.pw.edu.pl>
Simon L. Nielsen <simon@FreeBSD.org>
Pieter de Boer <g.p.de.boer@st.hanze.nl>
and of course
Poul-Henning Kamp <phk@FreeBSD.org>
Reviewed by: phk, scottl
Approved by: phk, scottl (mentor)
This is the first of two commits; bringing in the kernel support first.
This can be enabled by compiling a kernel with options TCP_SIGNATURE
and FAST_IPSEC.
For the uninitiated, this is a TCP option which provides for a means of
authenticating TCP sessions which came into being before IPSEC. It is
still relevant today, however, as it is used by many commercial router
vendors, particularly with BGP, and as such has become a requirement for
interconnect at many major Internet points of presence.
Several parts of the TCP and IP headers, including the segment payload,
are digested with MD5, including a shared secret. The PF_KEY interface
is used to manage the secrets using security associations in the SADB.
There is a limitation here in that as there is no way to map a TCP flow
per-port back to an SPI without polluting tcpcb or using the SPD; the
code to do the latter is unstable at this time. Therefore this code only
supports per-host keying granularity.
Whilst FAST_IPSEC is mutually exclusive with KAME IPSEC (and thus IPv6),
TCP_SIGNATURE applies only to IPv4. For the vast majority of prospective
users of this feature, this will not pose any problem.
This implementation is output-only; that is, the option is honoured when
responding to a host initiating a TCP session, but no effort is made
[yet] to authenticate inbound traffic. This is, however, sufficient to
interwork with Cisco equipment.
Tested with a Cisco 2501 running IOS 12.0(27), and Quagga 0.96.4 with
local patches. Patches for tcpdump to validate TCP-MD5 sessions are also
available from me upon request.
Sponsored by: sentex.net
