Insist that uid == 0 for client ppp
Disallow client sockets if no password is specified
Don't exit on failure to open client socket for listening
Allow specification of null local password
Use reasonable size (smaller) ``vector''s in auth.c
Fix "passwd ..." usage message
Insist on "all" as arg to "quit" (if any)
Drop client socket connection before Cleanup() when "quit all"
of OpenBSD's elf nlist code for this, and our a.out version. The OpenBSD
version was mainly a seek/read system with a mmap of the string table,
this one simply mmap's the lot (like the a.out version).
Obtained from: a fair chunk from OpenBSD
with libc's version.
lpd: use getopt(3), err(3), add usage(), allow specification of a port #
on the command line as the documentation suggested for more than 10 years.
PR: docs/3290
This tells ppp to loopback packets addressed to
the ppp interface IP coming *from* the tun
device.
This means that you can ping the tun interface IP
from inside :-)
idependently time out any of the FSMs.
Split LCP logging into LCP, IPCP and CCP logging,
and make room in "struct fsm" for the log level
that the state machine should use.
dial-on-demand, packet filtering, idle timeouts, etc). The IPX support
is pretty much there but more work needs to be done in sys-bsd.c for
the interface ioctls (Linux has a very different way of configuring IPX
interfaces).
Along the way some things have temporarily been lost due to very messy
conflicts. I will recover them shortly when I can think clearer.
The main one is the local:remote address override in pap-secrets and
chap-secrets. Some other home-grown features (dns1,dns2) have been
implemented differently. Microsoft's chap client auth hacks have been
implemented. There are bound to be more rough edges... The changes for
connect-max-retries doesn't fit well with the dial-on-demand code.
mixed up versions. Also, these were imported onto the 1.1.2 branch
(since the last one was imported there, sigh) and that causes cvsup in
checkout mode some problems (there isn't any 1.1.1 branch at all!!).
"set stopped" directive. If the timeout occurs
it will cause a "Down" event, hanging up the line
if it's still up. This *isn't* part of the FSM
diagram, but I consider it ok as a "higher level
implementation specific timeout" as specified in
the rfc ;-}
Discussed briefly with: joerg
Output function name for the "pre-prologue" entry, by stealing
it from the next entry.
Output length of basic-block in bytes and product of executions
and length.
so you don't need to re-enter it for each and every filesystem. Heads up!
This change is incompatible with the previous scripting format,
so those folks (all 2 of you) using config files should take a look
at the changes to the sample install.cfg file for the diskLabelEditor's
new calling syntax.
Finally write a man page for this thing, documenting all of the above
and more. I can't drive a stake through this thing's heart without
properly documenting it first, so please consider this step #1 in that
process (to be honest, sysinstall will also live on for some time in
the 2.2. branch since it's unlikely that the new install tools will ever
make it over there - they're strictly 3.0 material).
fixed. Natd now waits with select(2) for buffer space
to become available if write fails.
- Packet aliasing library upgraded to 2.2.
Submitted by: Ari Suutari <suutari@iki.fi>
is _break_ dns lookups entirely, and since reading the relevant docs and
source code does not enlighten for now, I'll remove this until more
basic research has been done into controlling the resolver's timeout
values.
the MEDIA_TIMEOUT variable. Just -current for now on this one as
I'm still wanting to play with this a bit and see what the ramifications
of doing this are.
Requested by: pst
1. Detecting the split /dev/ttyv0 / /dev/console case, e.g. you've
booted with the -h flag and you have a VGA card also.
2. Adding an extra "menu" for selecting terminal type and adding ANSI
to the list of compiled-in terms.
3. Opening the proper file descriptors before disowning ourselves.
Requested by: pst
at the end of gethostanswer()/getanswer()/whatever where it used to
return TRY_AGAIN. This breaks the domain list traversal in ypserv's
async DNS lookup module: it would only retry using the domain(s) from
the 'domain' or 'search' lines in /etc/resolv.conf if __dns_getanswer()
returned TRY_AGAIN.
Changed the test so that either TRY_AGAIN or NO_RECOVERY will work.
This seemed to me the best solution in the event somebody tries to
compile this code on an older system with a different version of BIND.
(You shouldn't do that of course, but then there's a lot of things
in the world that you shouldn't do and people do them anyway.)
is not sane: if the TTL on a pending but unanswered query hits 0 and the
circular queue entry is removed and free()d, the for() loop may still try
to use the entry pointer (which now points at no longer valid memory).
usually, deleting only the last entry off the end of the queue worked, but
if more than one was deleted, the server would crash. I changed things a
bit so this shouldn't happen anymore.
Also arranged to call the prune routine a bit more often.
diffes with NetBSD/OpenBSD. These changes seem to predate the NetBSD/OpenBSD
split, so it is hard to give proper credit for them.
Obtained from: OpenBSD.
overflow patches that were "near" to where these operations are taking
place. The buffer overflows are from OpenBSD. The setuid/seteuid patches
are from NetBSD by way of OpenBSD (they changed them a little), at least from
my read of the tree.
This is the first of a series of OpenBSD lpr/et al merges. It (and them)
should be merged back into 2.2 and/or 2.1 (if requested) branches when they
have been shaken out in -current.
Obtained from: OpenBSD
we decide to do a DNS lookup, we NUL terminate the key string provided
by the client before passing it into the DNS lookup module. This is
actually wrong. Assume the key is 'foo.com'. In this case, key.keydat_val
will be "foo.com" and key.keydat_len will be 7 (seven characters; the
string is not NUL-terminated so it is not 8 as you might expect).
The string "foo.com" is actually allocated by the XDR routines when the
RPC request is decoded; exactly 7 bytes are allocated. By adding a NUL,
the string becomes "foo.com\0", but the '\0' goes into an 8th byte which
was never allocated for this string and which could be anywhere. The result
is that while the initial request may succeed, we could trash other
dynamically allocated structures (like, oh, I dunno, the circular map
cache queue?) and SEGV later. This is in fact what happens.
The fix is to copy the string into a larger local buffer and NUL-terminate
that buffer instead.
Crash first reported by: Ricky Chan <ricky@come.net.uk>
Bug finally located with: Electric Fence 2.0.5
the hostname into. In theory the bind library should do this, but
in practice the limites between system defines and bind defines make
an attack using this vector possible. These patches have been in
use on my systems for three months now, so I am fairly confident about
them. I plan on commiting this to 2.2 and 2.1 in the near future,
as well as many other patches of this nature.
those ideas that, like the Apache server setup, was well-intentioned
but doomed to fail in the face of change. That and the fact that it
shouldn't be part of the installation tool, it should be part of the
post-installation setup tool (which we need to write). Combining the
two utilities into one utility was my first conceptual mistake.
Apologies also to Coranth Gryphon, who worked hard on the Apache
and Samba server setup code. These features were quite useful
for awhile, if that's any consolation, I just simply had the wrong
ideas about where to put them. :-(
In rt_change() remember to update the interface pointer otherwise we will
send the RIP packets to the wrong interface(s) in future.
Update the hash generator and increase the size of the hash tables.
Only use the network and host parts when comparing IPX interface addresses.
Immediately broadscast RIP and SAP changes.
Change the alarm code to use the setitimer() call and only set a flag in
the alarm signal handler. This gets rid of possible race conditions.
Remove the host routing table. IPX RIP cannot do host routes, only net routes.
Make the delay between broadcast packets 50ms. It seems that some Netware
4.x servers is very slow and don't have much input buffering.
Handle received messages about networks and services that go down, better.
Add tracing of RIP and SAP changes. It gets sysloged with a level of
LOG_DEBUG.
