Commit Graph

5673 Commits

Author SHA1 Message Date
Rui Paulo
e2197f8018 Set up the /usr/tests hierarchy.
Populate /usr/tests with the only test programs that currently live
in the tree (those in lib/libcrypt/tests/) and add all the build
machinery to accompany this change.

In particular:

- Add a WITHOUT_TESTS variable that users can define to request that
  no tests be put in /usr/tests.
- Add a top-level Kyuafile for /usr/tests and a way to create similar
  Kyuafiles in top-level subdirectories.
- Add a BSD.tests.dist file to define the directory layout of
  /usr/tests.

Submitted by:	Julio Merino jmmv google.com
Reviewed by:	sjg
MFC after:	2 weeks
2013-10-25 05:25:19 +00:00
Andrey Zonov
34f41cb067 Cleanup empty directories
PR:	conf/167133
2013-10-24 21:58:14 +00:00
Dag-Erling Smørgrav
c614125e67 Add a reload command.
Reviewed by:	hrs
MFC after:	3 days
2013-10-22 07:44:26 +00:00
Dag-Erling Smørgrav
0be7f787bb Start rtsold if necessary.
Reviewed by:	hrs
MFC after:	3 days
2013-10-22 06:53:01 +00:00
Konstantin Belousov
85a0ddfd0b Add a resource limit for the total number of kqueues available to the
user.  Kqueue now saves the ucred of the allocating thread, to
correctly decrement the counter on close.

Under some specific and not real-world use scenario for kqueue, it is
possible for the kqueues to consume memory proportional to the square
of the number of the filedescriptors available to the process.  Limit
allows administrator to prevent the abuse.

This is kernel-mode side of the change, with the user-mode enabling
commit following.

Reported and tested by:	pho
Discussed with:	jmg
Sponsored by:	The FreeBSD Foundation
MFC after:	2 weeks
2013-10-21 16:46:12 +00:00
Hiroki Sato
3ad6f56a5a - Fix jail_parallel_start="YES".
- Fix ip[46].addr when interface parameter is not defined.

Spotted by:	rpaulo
2013-10-21 08:49:46 +00:00
Colin Percival
cabad26453 Add support for "first boot" rc.d scripts. [1]
These scripts, containing
# KEYWORD: firstboot
will only be run if a sentinel file (default: /firstboot, configurable
via the rc.conf ${firstboot_sentinel} variable) exists; this sentinel
file will be deleted at the end of the boot process.

Scripts can request that the system reboot after the first boot by
creating the file ${firstboot_sentinel}-reboot.

This functionality is expected to be useful for embedded systems and
virtual machine images, where it may be desirable to
(a) download and install updates which became available between when
the image was created and when it was "turned on";
(b) download and install packages which may be newer than those
which were available when the image was created;
(c) install packages which run binaries during their install process,
bypassing the problem of cross-architecture installs;
(d) resize filesystems to match the disk onto which a VM image was
installed;
(e) perform initialization tasks relevant to cloud systems (e.g.,
Amazon's Elastic Compute Cloud);
and likely to perform many other one-time initialization functions.

Document this new functionality in rc.conf(5) and rc(8). [2]

Reviewed by:	freebsd-current, freebsd-rc [1]
Reviewed by:	Warren Block [2]
MFC after:	3 days
2013-10-19 21:37:06 +00:00
John-Mark Gurney
ff14d523bb Enable the automatic creation of a certificate (if one does not exists)
and enable the usage by sendmail if sendmail is enabled.  Include and
document knobs to disable this feature and also set the Common Name of
the certificate created.

As the certificate is signed w/ a discarded key, it only helps prevent
Eve, but not Malory from knowing the contents of the emails.

This means that new installs (and people that use the updated freebsd.mc
file) will automaticly have STARTTLS enabled allowing incoming email to
be encrypted in most cases.

Reviewed by:	gshapiro
MFC after:	3 days
Security:	Yes, please.
2013-10-19 18:51:06 +00:00
Dag-Erling Smørgrav
487a635bdc Last few remnants of BIND (hopefully...)
MFC after:	3 days
2013-10-19 10:00:51 +00:00
Hiroki Sato
d3b57253ee - Fix a bug which prevented jails from starting when $jail_conf was used and
no jail name was specified.
- Display error messages when start/stop fails.

Reported by:	swills
2013-10-18 03:44:16 +00:00
Hiroki Sato
b290250058 - Fix "ifname|addr" syntax support in jail_{jname}_ip.
- Create /var/run/jail_{jname}.id because ezjail-admin depends on it.
2013-10-15 04:54:49 +00:00
Hiroki Sato
6fbfa3731b - Normalize jailname. "example.com" is converted to "example_com".
- Fix a bug that some $jail_{jname}_foo variables did not work.
- Fix a bug which prevented $jail_devfs_ruleset from working[1].
- Move $jail_parameters to the last of the configuraiton lines[1].

Reported by:	Jase Thew[1]
Approved by:	re (glebius)
2013-10-14 11:05:13 +00:00
Hiroki Sato
fbd868c9d8 - Add mount.fdescfs parameter to jail(8). This is similar to
mount.devfs but mounts fdescfs.  The mount happens just after
  mount.devfs.

- rc.d/jail now displays whole error message from jail(8) when a jail
  fails to start.

Approved by:	re (gjb)
2013-10-12 17:27:59 +00:00
Mark Murray
cc4d059c03 Merge from project branch. Uninteresting commits are trimmed.
Refactor of /dev/random device. Main points include:

* Userland seeding is no longer used. This auto-seeds at boot time
on PC/Desktop setups; this may need some tweeking and intelligence
from those folks setting up embedded boxes, but the work is believed
to be minimal.

* An entropy cache is written to /entropy (even during installation)
and the kernel uses this at next boot.

* An entropy file written to /boot/entropy can be loaded by loader(8)

* Hardware sources such as rdrand are fed into Yarrow, and are no
longer available raw.

------------------------------------------------------------------------
r256240 | des | 2013-10-09 21:14:16 +0100 (Wed, 09 Oct 2013) | 4 lines

Add a RANDOM_RWFILE option and hide the entropy cache code behind it.
Rename YARROW_RNG and FORTUNA_RNG to RANDOM_YARROW and RANDOM_FORTUNA.
Add the RANDOM_* options to LINT.

------------------------------------------------------------------------
r256239 | des | 2013-10-09 21:12:59 +0100 (Wed, 09 Oct 2013) | 2 lines

Define RANDOM_PURE_RNDTEST for rndtest(4).

------------------------------------------------------------------------
r256204 | des | 2013-10-09 18:51:38 +0100 (Wed, 09 Oct 2013) | 2 lines

staticize struct random_hardware_source

------------------------------------------------------------------------
r256203 | markm | 2013-10-09 18:50:36 +0100 (Wed, 09 Oct 2013) | 2 lines

Wrap some policy-rich code in 'if NOTYET' until we can thresh out
what it really needs to do.

------------------------------------------------------------------------
r256184 | des | 2013-10-09 10:13:12 +0100 (Wed, 09 Oct 2013) | 2 lines

Re-add /dev/urandom for compatibility purposes.

------------------------------------------------------------------------
r256182 | des | 2013-10-09 10:11:14 +0100 (Wed, 09 Oct 2013) | 3 lines

Add missing include guards and move the existing ones out of the
implementation namespace.

------------------------------------------------------------------------
r256168 | markm | 2013-10-08 23:14:07 +0100 (Tue, 08 Oct 2013) | 10 lines

Fix some just-noticed problems:

o Allow this to work with "nodevice random" by fixing where the
MALLOC pool is defined.

o Fix the explicit reseed code. This was correct as submitted, but
in the project branch doesn't need to set the "seeded" bit as this
is done correctly in the "unblock" function.

o Remove some debug ifdeffing.

o Adjust comments.

------------------------------------------------------------------------
r256159 | markm | 2013-10-08 19:48:11 +0100 (Tue, 08 Oct 2013) | 6 lines

Time to eat crow for me.

I replaced the sx_* locks that Arthur used with regular mutexes;
this turned out the be the wrong thing to do as the locks need to
be sleepable. Revert this folly.

# Submitted by:	Arthur Mesh <arthurmesh@gmail.com> (In original diff)

------------------------------------------------------------------------
r256138 | des | 2013-10-08 12:05:26 +0100 (Tue, 08 Oct 2013) | 10 lines

Add YARROW_RNG and FORTUNA_RNG to sys/conf/options.

Add a SYSINIT that forces a reseed during proc0 setup, which happens
fairly late in the boot process.

Add a RANDOM_DEBUG option which enables some debugging printf()s.

Add a new RANDOM_ATTACH entropy source which harvests entropy from the
get_cyclecount() delta across each call to a device attach method.

------------------------------------------------------------------------
r256135 | markm | 2013-10-08 07:54:52 +0100 (Tue, 08 Oct 2013) | 8 lines

Debugging. My attempt at EVENTHANDLER(multiuser) was a failure; use
EVENTHANDLER(mountroot) instead.

This means we can't count on /var being present, so something will
need to be done about harvesting /var/db/entropy/... .

Some policy now needs to be sorted out, and a pre-sync cache needs
to be written, but apart from that we are now ready to go.

Over to review.

------------------------------------------------------------------------
r256094 | markm | 2013-10-06 23:45:02 +0100 (Sun, 06 Oct 2013) | 8 lines

Snapshot.

Looking pretty good; this mostly works now. New code includes:

* Read cached entropy at startup, both from files and from loader(8)
preloaded entropy. Failures are soft, but announced. Untested.

* Use EVENTHANDLER to do above just before we go multiuser. Untested.

------------------------------------------------------------------------
r256088 | markm | 2013-10-06 14:01:42 +0100 (Sun, 06 Oct 2013) | 2 lines

Fix up the man page for random(4). This mainly removes no-longer-relevant
details about HW RNGs, reseeding explicitly and user-supplied
entropy.

------------------------------------------------------------------------
r256087 | markm | 2013-10-06 13:43:42 +0100 (Sun, 06 Oct 2013) | 6 lines

As userland writing to /dev/random is no more, remove the "better
than nothing" bootstrap mode.

Add SWI harvesting to the mix.

My box seeds Yarrow by itself in a few seconds! YMMV; more to follow.

------------------------------------------------------------------------
r256086 | markm | 2013-10-06 13:40:32 +0100 (Sun, 06 Oct 2013) | 11 lines

Debug run. This now works, except that the "live" sources haven't
been tested. With all sources turned on, this unlocks itself in
a couple of seconds! That is no my box, and there is no guarantee
that this will be the case everywhere.

* Cut debug prints.

* Use the same locks/mutexes all the way through.

* Be a tad more conservative about entropy estimates.

------------------------------------------------------------------------
r256084 | markm | 2013-10-06 13:35:29 +0100 (Sun, 06 Oct 2013) | 5 lines

Don't use the "real" assembler mnemonics; older compilers may not
understand them (like when building CURRENT on 9.x).

# Submitted by:	Konstantin Belousov <kostikbel@gmail.com>

------------------------------------------------------------------------
r256081 | markm | 2013-10-06 10:55:28 +0100 (Sun, 06 Oct 2013) | 12 lines

SNAPSHOT.

Simplify the malloc pools; We only need one for this device.

Simplify the harvest queue.

Marginally improve the entropy pool hashing, making it a bit faster
in the process.

Connect up the hardware "live" source harvesting. This is simplistic
for now, and will need to be made rate-adaptive.

All of the above passes a compile test but needs to be debugged.

------------------------------------------------------------------------
r256042 | markm | 2013-10-04 07:55:06 +0100 (Fri, 04 Oct 2013) | 25 lines

Snapshot. This passes the build test, but has not yet been finished or debugged.

Contains:

* Refactor the hardware RNG CPU instruction sources to feed into
the software mixer. This is unfinished. The actual harvesting needs
to be sorted out. Modified by me (see below).

* Remove 'frac' parameter from random_harvest(). This was never
used and adds extra code for no good reason.

* Remove device write entropy harvesting. This provided a weak
attack vector, was not very good at bootstrapping the device. To
follow will be a replacement explicit reseed knob.

* Separate out all the RANDOM_PURE sources into separate harvest
entities. This adds some secuity in the case where more than one
is present.

* Review all the code and fix anything obviously messy or inconsistent.
Address som review concerns while I'm here, like rename the pseudo-rng
to 'dummy'.

# Submitted by:	Arthur Mesh <arthurmesh@gmail.com> (the first item)

------------------------------------------------------------------------
r255319 | markm | 2013-09-06 18:51:52 +0100 (Fri, 06 Sep 2013) | 4 lines

Yarrow wants entropy estimations to be conservative; the usual idea
is that if you are certain you have N bits of entropy, you declare
N/2.

------------------------------------------------------------------------
r255075 | markm | 2013-08-30 18:47:53 +0100 (Fri, 30 Aug 2013) | 4 lines

Remove short-lived idea; thread to harvest (eg) RDRAND enropy into the
usual harvest queues. It was a nifty idea, but too heavyweight.

# Submitted by:	Arthur Mesh <arthurmesh@gmail.com>

------------------------------------------------------------------------
r255071 | markm | 2013-08-30 12:42:57 +0100 (Fri, 30 Aug 2013) | 4 lines

Separate out the Software RNG entropy harvesting queue and thread
into its own files.

# Submitted by:	 Arthur Mesh <arthurmesh@gmail.com>

------------------------------------------------------------------------
r254934 | markm | 2013-08-26 20:07:03 +0100 (Mon, 26 Aug 2013) | 2 lines

Remove the short-lived namei experiment.

------------------------------------------------------------------------
r254928 | markm | 2013-08-26 19:35:21 +0100 (Mon, 26 Aug 2013) | 2 lines

Snapshot; Do some running repairs on entropy harvesting. More needs
to follow.

------------------------------------------------------------------------
r254927 | markm | 2013-08-26 19:29:51 +0100 (Mon, 26 Aug 2013) | 15 lines

Snapshot of current work;

1) Clean up namespace; only use "Yarrow" where it is Yarrow-specific
or close enough to the Yarrow algorithm. For the rest use a neutral
name.

2) Tidy up headers; put private stuff in private places. More could
be done here.

3) Streamline the hashing/encryption; no need for a 256-bit counter;
128 bits will last for long enough.

There are bits of debug code lying around; these will be removed
at a later stage.

------------------------------------------------------------------------
r254784 | markm | 2013-08-24 14:54:56 +0100 (Sat, 24 Aug 2013) | 39 lines

1) example (partially humorous random_adaptor, that I call "EXAMPLE")
 * It's not meant to be used in a real system, it's there to show how
   the basics of how to create interfaces for random_adaptors. Perhaps
   it should belong in a manual page

2) Move probe.c's functionality in to random_adaptors.c
 * rename random_ident_hardware() to random_adaptor_choose()

3) Introduce a new way to choose (or select) random_adaptors via tunable
"rngs_want" It's a list of comma separated names of adaptors, ordered
by preferences. I.e.:
rngs_want="yarrow,rdrand"

Such setting would cause yarrow to be preferred to rdrand. If neither of
them are available (or registered), then system will default to
something reasonable (currently yarrow). If yarrow is not present, then
we fall back to the adaptor that's first on the list of registered
adaptors.

4) Introduce a way where RNGs can play a role of entropy source. This is
mostly useful for HW rngs.

The way I envision this is that every HW RNG will use this
functionality by default. Functionality to disable this is also present.
I have an example of how to use this in random_adaptor_example.c (see
modload event, and init function)

5) fix kern.random.adaptors from
kern.random.adaptors: yarrowpanicblock
to
kern.random.adaptors: yarrow,panic,block

6) add kern.random.active_adaptor to indicate currently selected
adaptor:
root@freebsd04:~ # sysctl kern.random.active_adaptor
kern.random.active_adaptor: yarrow

# Submitted by:	Arthur Mesh <arthurmesh@gmail.com>

Submitted by:	Dag-Erling Smørgrav <des@FreeBSD.org>, Arthur Mesh <arthurmesh@gmail.com>
Reviewed by:	des@FreeBSD.org
Approved by:	re (delphij)
Approved by:	secteam (des,delphij)
2013-10-12 12:57:57 +00:00
Rui Paulo
ec0e2ac611 Remove most of the ATF tools and the _atf user.
This is necessary because ATF is deprecated and it will be replaced by Kyua.

Submitted by:	jmmv@netbsd.org
Reviewed by:	Garrett Cooper
Approved by:	re
2013-10-12 06:06:53 +00:00
Glen Barber
006a42a9cb Turn it all the way up to 11:
- Update FreeBSD version in:
  - UPDATING
  - sys/conf/newvers.sh

- Add 11.0 FreeBSD version for manual pages

- Bump __FreeBSD_version to 1100000

Approved by:	re (implicit)
Sponsored by:	The FreeBSD Foundation
2013-10-10 18:05:13 +00:00
Hiroki Sato
84b354cb9a - Update rc.d/jail to use a jail(8) configuration file instead of
command line options.  The "jail_<jname>_*" rc.conf(5) variables for
  per-jail configuration are automatically converted to
  /var/run/jail.<jname>.conf before the jail(8) utility is invoked.
  This is transparently backward compatible.

- Fix a minor bug in jail(8) which prevented it from returning false
  when jail -r failed.

Approved by:	re (glebius)
2013-10-10 09:32:27 +00:00
Hiroki Sato
a62939d37b Add support for "vnet jname" argument in ifconfig_IF. The vnet keyword
is ignored except for "rc.d/netif vnet{up,down} ifn" because a jail is
usually created after interface initialization on boot time.

"rc.d/netif vnetup ifn" moves ifn into the specified jail.  It is
designed to be used in other scripts like rc.d/jail, not automatically
invoked during the interface initialization.

Approved by:	re (kib)
2013-10-10 07:41:11 +00:00
Mark Murray
842d654ca7 MFC - tracking commit. 2013-10-08 07:02:23 +00:00
Xin LI
8be2d25e2c Reduce priority of host key exists message in sshd startup
script to info.

Approved by:	re (gjb)
2013-10-07 21:39:42 +00:00
Mark Murray
1bd2ddb93a MFC - tracking commit 2013-10-07 07:36:21 +00:00
Dag-Erling Smørgrav
3f84e865bb Add _atf and unbound and move smmsp and mailnull to where they belong.
Approved by:	re (kib)
2013-10-07 07:32:16 +00:00
Mark Murray
241b55d182 As userland writing to /dev/random is no more, remove the "better than nothing" bootstrap mode.
Add SWI harvesting to the mix.

My box seeds Yarrow by itself in a few seconds! YMMV; more to follow.
2013-10-06 12:43:42 +00:00
Hiroki Sato
46232ce0ef Do not attempt to do AF-specific configurations on a interface when
noafif() is true.  The following warning message was displayed when
pflog0 interface existed, for example:

 ifconfig: ioctl(SIOCGIFINFO_IN6): Protocol family not supported

Reported by:	bz
Approved by:	re (gjb)
2013-10-04 04:15:18 +00:00
Hiroki Sato
a0871fdb49 Add epair(4) support in $cloned_interfaces. One should be specified
as "epair0" in $cloned_interfaces and "epair0[ab]" in the others in
rc.conf like the following:

 cloned_interfaces="epair0"
 ifconfig_epair0a="inet 192.168.1.1/24"
 ifconfig_epair0b="inet 192.168.2.1/24"

/etc/rc.d/netif now accepts both "netif start epair0" and "netif start
epair0a".

Approved by:	re (kib)
2013-10-04 02:44:04 +00:00
Glen Barber
de0ce23380 Do not install bluetooth rc(8) scripts if MK_BLUETOOTH = no.
Approved by:	re (glebius)
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
2013-10-03 15:19:16 +00:00
Matthew D Fleming
7c168e960a Fix up typos from r255963 in mtree Makefile. BSD.debug.dist should be
iterated if present, and remove a stray .endif.

Approved by:	re (gjb)
2013-10-03 01:18:06 +00:00
Dag-Erling Smørgrav
e9f6fa6e61 Odds and ends left over from BIND and unnoticed because they didn't
affect 'make universe'.

Approved by:	re (gjb)
2013-10-01 07:19:23 +00:00
Dag-Erling Smørgrav
43cc6a5056 Remove /usr/include/lwres
Approved by:	re (gjb)
2013-09-30 18:00:54 +00:00
Dag-Erling Smørgrav
56b72efe82 Remove BIND.
Approved by:	re (gjb)
2013-09-30 17:23:45 +00:00
Colin Percival
fcde3f1a05 Now that the portsnap buildbox is generating the raw bits for INDEX-10,
add it to the set of INDEX files built by portsnap.

Approved by:	re (marius), portmgr (erwin)
MFC after:	3 days
2013-09-26 10:33:15 +00:00
Dag-Erling Smørgrav
5bec4f6e65 Forgotten in r255825: NETWORKING requires local_unbound.
Approved by:	re (blanket)
2013-09-24 11:49:04 +00:00
Dag-Erling Smørgrav
63d39bea23 Replace the unused /etc/unbound directory with a symlink to /var/unbound.
Approved by:	re (blanket)
2013-09-24 10:04:51 +00:00
Dag-Erling Smørgrav
3f32c6fb56 Move local_unbound up in the rc order.
Approved by:	re (blanket)
2013-09-23 20:03:23 +00:00
Dag-Erling Smørgrav
49cede74ee Add a setup script for unbound(8) called local-unbound-setup. It
generates a configuration suitable for running unbound as a caching
forwarding resolver, and configures resolvconf(8) to update unbound's
list of forwarders in addition to /etc/resolv.conf.  The initial list
is taken from the existing resolv.conf, which is rewritten to point to
localhost.  Alternatively, a list of forwarders can be provided on the
command line.

To assist this script, add an rc.subr command called "enabled" which
does nothing except return 0 if the service is enabled and 1 if it is
not, without going through the usual checks.  We should consider doing
the same for "status", which is currently pointless.

Add an rc script for unbound, called local_unbound.  If there is no
configuration file, the rc script runs local-unbound-setup to generate
one.

Note that these scripts place the unbound configuration files in
/var/unbound rather than /etc/unbound.  This is necessary so that
unbound can reload its configuration while chrooted.  We should
probably provide symlinks in /etc.

Approved by:	re (blanket)
2013-09-23 04:36:51 +00:00
Dag-Erling Smørgrav
ce1a9486a2 Fix indentation.
Approved by:	re (blanket)
2013-09-22 18:31:49 +00:00
Dag-Erling Smørgrav
284c68d92b Ditch the random seeding code, which never really worked as intended.
Add config variables to enable / disable individual host key algorithms.
Clean up the host key generation code.

Approved by:	re (gjb)
MFC after:	3 weeks
2013-09-21 21:34:22 +00:00
Hiroki Sato
da46bc0523 - Fix pidfile handling in sendmail_msp_queue. The pidfile was ignored
and multiple instances were invoked by start/stop cycles.

- Remove redundant start_cmd rewrite.

Approved by:	re (gjb)
Tested by:	jmg
2013-09-17 20:24:03 +00:00
Hiroki Sato
cdb5fa57f9 Fix parsing lines of ifconfig output which include \t in the case of
inet and inet6.

Approved by:	re (delphij)
2013-09-17 20:22:24 +00:00
Dag-Erling Smørgrav
8f8790cdf4 Build and install the Unbound caching DNS resolver daemon.
Approved by:	re (blanket)
2013-09-15 14:51:23 +00:00
Edward Tomasz Napierala
009ea47eb2 Bring in the new iSCSI target and initiator.
Reviewed by:	ken (parts)
Approved by:	re (delphij)
Sponsored by:	FreeBSD Foundation
2013-09-14 15:29:06 +00:00
Cy Schubert
854cb10a58 ipfilter 5.1.2 no longer supports sysctl. Use ipf -V to determine if
available (the kernel module is loaded or compiled into the kernel).

Approved by:	glebius (mentor)
Approved by:	re (blanket)
2013-09-10 13:48:33 +00:00
Dag-Erling Smørgrav
d7510453f3 The correct variable is apparently MACHINE_ARCH, not TARGET_ARCH.
Approved by:	re (blanket)
2013-09-09 17:38:02 +00:00
Dag-Erling Smørgrav
924eb7812b Remove unneeded mappings from libmap32.conf. Move it up one level and
install it on powerpc64 in addition to amd64.

Reviewed by:	kib
Approved by:	re (blanket)
2013-09-09 06:02:30 +00:00
Dag-Erling Smørgrav
773eec475a Add a stock libmap32.conf for amd64. The first two lines have no effect
except to document the hardcoded standard library search path for 32-bit
binaries.  The third line performs the equivalent substitution for the
private library directory.

Ironically, these entries rely on functionality which is only available
in the COMPAT_32BIT version of rtld-elf.

Approved by:	re (blanket)
2013-09-08 09:46:22 +00:00
Dag-Erling Smørgrav
2442cc585a Create a private library directory (LIBPRIVATEDIR) for libraries which
we don't want to expose but which can't or shouldn't be static.

To mark a library as private, define PRIVATELIB in its Makefile.  It
will be installed in LIBPRIVATEDIR, which is normally /usr/lib/private
(or /usr/lib32/private for 32-bit libraries on 64-bit platforms).

To indicate that a program or library depends on a private library,
define USEPRIVATELIB in its Makefile.  The correct version of
LIBPRIVATEDIR will be added to its run-time library search path.

Approved by:	re (blanket)
2013-09-08 09:40:23 +00:00
Dag-Erling Smørgrav
187a8d4b7a authpf needs /var/authpf to exist and be writable by group authpf. 2013-09-05 12:35:23 +00:00
David Chisnall
c354d333b2 Add a c++/v1/tr1 include directory containing symlinks to all of the standard
headrs.

Lots of third-party code expects to find C++03 headers under tr1 because that's
where GNU decided to hide them.  This should fix ports that expect them there.

MFC after:	1 week
2013-09-04 15:02:14 +00:00
Jeremie Le Hen
0185388553 Since r254974, periodic scripts' period can be configured
independently.  There is no reason to leave their options
with the daily ones, so move them to their own section.
Move periodic scripts' options into their own section.  Since r254974,
2013-09-03 07:47:53 +00:00
Xin LI
335c94e632 Create the default router last. This allows using an static
interface route for default routes, which seems to be common
among many dedicated hosting providers.

Reviewed by:	hrs
MFC after:	2 weeks
2013-09-02 23:52:25 +00:00
Ian Lepore
e02916a48a Regenerate after recent addition of FTDI and bluetooth device IDs. 2013-09-01 14:28:12 +00:00
Xin LI
4b0f6e5b60 Add directories that is installed as part of bsdconfig.
These are included unconditionally for now because bsdconfig
is currently installed unconditionally.

This fixes 'make -j 17 installworld' caused by a race
condition.

MFC candidate.
2013-08-29 17:45:13 +00:00
Xin LI
0cfb18af64 Add a few missing language directories for /usr. 2013-08-29 17:40:03 +00:00
Gavin Atkinson
9e9a57a307 After writing a kernel core dump into /var/crash, call sync(8).
If we panic again shortly after boot (say, within 30 seconds), any core
dump we wrote out may be lost on reboot.  In this situation, we really
want to keep that core file, as it may be the only way to have the issue
resolved.  Call sync(8) after writing out the core file and running
crashinfo(8), in the hope that these will not be lost if we panic
again.  sync(8) is only called in the case where there is a core dump
to be written out, so won't be called during normal boots.

Discovered by:	Trying to debug an IPSEC panic
MFC after:	1 week
2013-08-28 15:12:15 +00:00
Jung-uk Kim
b81c4e6563 Fix a typo introduced in r254975. 2013-08-27 22:37:29 +00:00
Jeremie Le Hen
622ceeb3fb Install 450.status-security. 2013-08-27 21:28:12 +00:00
Jeremie Le Hen
69b55c23cb Make the period of each periodic security script configurable.
There are now six additional variables
  weekly_status_security_enable
  weekly_status_security_inline
  weekly_status_security_output
  monthly_status_security_enable
  monthly_status_security_inline
  monthly_status_security_output
alongside their existing daily counterparts.  They all have the same
default values.

All other "daily_status_security_${scriptname}_${whatever}"
variables have been renamed to "security_status_${name}_${whatever}".
A compatibility shim has been introduced for the old variable names,
which we will be able to remove in 11.0-RELEASE.

"security_status_${name}_enable" is still a boolean but a new
"security_status_${name}_period" allows to define the period of
each script.  The value is one of "daily" (the default for backward
compatibility), "weekly", "monthly" and "NO".

Note that when the security periodic scripts are run directly from
crontab(5) (as opposed to being called by daily or weekly periodic
scripts), they will run unless the test is explicitely disabled with a
"NO", either for in the "_enable" or the "_period" variable.

When the security output is not inlined, the mail subject has been
changed from "$host $arg run output" to "$host $arg $period run output".
For instance:
  myfbsd security run output ->  myfbsd security daily run output
I don't think this is considered as a stable API, but feel free to
correct me if I'm wrong.

Finally, I will rearrange periodic.conf(5) and default/periodic.conf
to put the security options in their own section.  I left them in
place for this commit to make reviewing easier.

Reviewed by:	hackers@
2013-08-27 21:20:28 +00:00
Jeremie Le Hen
81e9f2d5d8 Move daily_status_security_noamd next to 200.chkmounts's variables. 2013-08-25 07:46:18 +00:00
Alan Somers
2adf57829e Correctly remove an interface's ipv4 address when the user calls
"/etc/rc.d/netif stop XXX".  The old globbing pattern failed to account for the
possibility of a tab occuring before "inet".

Reviewed by:	will
Approved by:	ken (mentor, implicit)
MFC after:	Never (bug affects head only)
Sponsored by:	Spectra Logic
2013-08-23 23:12:16 +00:00
Peter Wemm
030ee53fa1 Pass pidfile to bsnmpd if it's been changed (parts cut/pasted from
rc.d/rarpd and rc.d/wpa_supplicant)
2013-08-19 05:37:49 +00:00
Peter Wemm
8913b090d0 Revert r254508. 2013-08-19 05:12:38 +00:00
Peter Wemm
25180adf0d Add the optional ability to run as a different user.
Obtained from:	Antique freebsd.org cluster archive images
2013-08-19 04:56:03 +00:00
Erwin Lansing
295eeeb89d Add empty zones for Shared Address Space (RFC 6598)
Approved by:	delphij (mentor)
MFC after:	3 days
Sponsored by:	DK Hostmaster A/S
2013-08-09 07:57:04 +00:00
Rui Paulo
c02f0567ce Regen for if_rsu. 2013-08-04 19:36:46 +00:00
Hiroki Sato
7dce7544fc - Reimplement $gif_interfaces as a variant of $cloned_interfaces.
Newly-configured systems should use $cloned_interfaces.

- Call clone_{up,down}() and ifnet_rename() in rc.d/netif {start,stop}.
  ifnet_rename() now accepts an interface name list as its argument.

- Add rc.d/netif clear.  The "clear" subcommand is basically equivalent to
  "stop" but it does not call clone_down().

- Add "ifname:sticky" keyword into $cloned_interfaces.  If :sticky is
  specified, the interface will not be destroyed in rc.d/netif stop.

- Add cloned_interfaces_sticky={YES,NO}.  This variable globally sets
  :sticky keyword above for all interfaces.  The default value is NO.
  When cloned_interfaces_sticky=YES, :nosticky keyword can be used to
  override it on per interface basis.
2013-08-04 06:36:17 +00:00
Jeremie Le Hen
4b00159792 Include /usr/local/etc/libmap.d/ by default.
PR:		180568
Reviewed by:	bapt
Obtained from:	kib
MFC after:	3 days
2013-08-01 05:50:42 +00:00
Hans Petter Selasky
7dda4bda6b Regenerate usb.conf
MFC after:	1 week
2013-07-26 10:25:18 +00:00
Rui Paulo
041d3f3f09 Add pkgconf files for libusb.
Reviewed by:	hselasky
2013-07-25 03:54:08 +00:00
Hiroki Sato
0d6d097a5f Do not set ND6_IFF_ACCEPT_RTADV on if_bridge(4) interfaces when
ipv6_enable=yes.

MFC after:	3 days
2013-07-21 15:26:25 +00:00
Hiroki Sato
fd1fba7ce3 Fix address range specification with ifconfig(8) options such as:
- inet 192.0.2.1-10 netmask 255.255.255.0 (inet range spec + ifconfig options)
- inet6 2001:db8:1::1-f prefixlen 60 (inet6 range spec + ifconfig options)

If prefixlen or netmask option is specified with CIDR notation at
the same time, the option is used.

Tested by:	Michael Grimm
MFC after:	3 days
2013-07-20 16:58:17 +00:00
Hiroki Sato
1c26ccaba0 - Fix a bug in ipv6_prefix_IF. It did not work with the 64-bit prefix
notation like 2001:db8:1:1.

- Use eui64 flag in ifconfig(8) instead of network6_getladdr()[*] for
  interface indentifier part.

Suggested by:	ume [*]
MFC after:	3 days
2013-07-18 02:58:24 +00:00
Dag-Erling Smørgrav
b88ca6332b When stopping pfsync, remove the pfsync interface's syncpeer setting.
MFC after:	3 days
2013-07-15 08:48:45 +00:00
Andriy Gapon
9a91031836 rc.d/zfs: pass -v option to zfs mount
this should make boot process more informative (and entertaining)
on systems with lots of zfs filesystems.

MFC after:	7 days
2013-07-09 08:59:39 +00:00
Rui Paulo
676ef34c81 wpa_supplicant should be able to reassociate when resuming, so remove a
comment saying it can't.
2013-07-04 07:32:40 +00:00
Alan Somers
6d1014a32b Add syslog(3) support to devd(8).
sbin/devd/devd.cc
        All output will now go to syslog(3) if devd is daemonized, or stderr
        if it's running in the foreground.

sbin/devd/devd.8
        Remove the "-D" flag.  Filtering messages by priority now
	happens in the usual syslog way.  For performance reasons, a few
	extra-verbose debugging statements are now conditional on the "-d" (do
	not daemonize) flag.

etc/syslog.conf
etc/newsyslog.conf
        Direct messages from devd(8) to /var/log/devd.log, but leave it
        disabled by default

Reviewed by:	eadler
Approved by:	gibbs (co-mentor)
MFC after:	never (removed a command-line option from devd)
2013-07-01 21:20:17 +00:00
Hiroki Sato
b8c357fdca Add "ether" and "link" to ifconfig_alias{es,N}. 2013-06-30 19:52:45 +00:00
Xin LI
0094baf78c Don't attempt to do DHCP on certain interfaces, similar to what's done for
ipv6_autoconfif() in r212577.

MFC after:	1 week
2013-06-28 22:25:37 +00:00
Davide Italiano
237abf0c56 - Trim an unused and bogus Makefile for mount_smbfs.
- Reconnect with some minor modifications, in particular now selsocket()
internals are adapted to use sbintime units after recent'ish calloutng
switch.
2013-06-28 21:00:08 +00:00
Hiroki Sato
268a55bc98 - Add vnode-backed swap space specification support. This is enabled when
device names "md" or "md[0-9]*" and a "file" option are specified in
  /etc/fstab like this:

  md    none    swap    sw,file=/swap.bin       0       0

- Add GBDE/GELI encrypted swap space specification support, which
  rc.d/encswap supported.  The /etc/fstab lines are like the following:

  /dev/ada1p1.bde       none    swap    sw      0       0
  /dev/ada1p2.eli       none    swap    sw      0       0

  .eli devices accepts aalgo, ealgo, keylen, and sectorsize as options.

  swapctl(8) can understand an encrypted device in the command line
  like this:

  # swapctl -a /dev/ada2p1.bde

- "-L" flag is added to support "late" option to defer swapon until
  rc.d/mountlate runs.

- rc.d script change:

    rc.d/encswap -> removed
    rc.d/addswap -> just display a warning message if $swapfile is defined
    rc.d/swap1 -> renamed to rc.d/swap
    rc.d/swaplate -> newly added to support "late" option

These changes alleviate a race condition between device creation/removal
and swapon/swapoff.

MFC after:	1 week
Reviewed by:	wblock (manual page)
2013-06-27 18:28:45 +00:00
Rui Paulo
6f79f29583 Implement ifconfig_wlanX="HOSTAP".
Not only this is a bit cleaner, it allows multiple instances of hostapd to be
running on the system host, useful for simultaneous dual-band WiFi.
This is similar to ifconfig_wlanX="WPA" but it uses /etc/hostapd-wlanX.conf.
Compatibility with hostapd_enable=YES/NO was kept.

Reviewed by:	adrian
2013-06-26 04:00:52 +00:00
John Baldwin
d58802817b If daily_status_security_inline is set, the rc value needs to be
forced to 3 so that the output of this script is always displayed.
In fact, setting this flag is identical to setting
daily_status_security_output to an empty string.  To make the logic
less confusing, change the behavior of daily_status_security_inline
such that it just forces daily_status_security_output to an empty
string and then applies the normal logic.

PR:		conf/178611
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>
MFC after:	3 days
2013-06-25 15:45:31 +00:00
Kevin Lo
277a625085 Regenerate usb.conf after r252196.
Spotted by:	rpaulo
2013-06-25 07:17:30 +00:00
Xin LI
b19408db1a Call sshd_precmd instead of sshd_configtest when the operator
requests reload or restart, which, in addition of testing the
configuration, will also generate host keys when they are not
present (previous behavior).

Obtained from:	FreeNAS
Ok'ed by:	bdrewery, des
MFC after:	1 week
2013-06-21 17:23:19 +00:00
Hiroki Sato
740b713999 - Add CIDR notation support like 192.168.1-2.10-16/24 to $ifconfig_IF_aliasN.
This is an extended version of ipv4_addr_IF which supports both IPv4 and
  IPv6, and multiple range specifications.  To avoid to generate too many
  addresses, the maximum number of the generated addresses is currently
  limited to 31.

- Add $ifconfig_IF_aliases, which accepts multiple IP aliases in a variable.

- ipv6_prefix_IF now supports !/64 prefix length.  In addition to the old
  64-bit format (2001:db8:1:1), a full 128-bit format like 2001:db8:1:1::/64
  is supported.

- Replace ifconfig command with $IFCONFIG_CMD variable to support
  a dry-run mode in the future.

- Remove IP aliases before removing all of IPv4 addresses when doing
  "rc.d/netif down".

- Add a DAD wait to network6_getladdr() because it is possible to fail to
  configure an EUI64 address when ipv6_prefix_IF is specified.

A summary of the supported ifconfig_* variables is as follows:

 # IPv4 configuration.
 ifconfig_em0="inet 192.168.0.1"
 # IPv6 configuration.
 ifconfig_em0_ipv6="inet6 2001:db8::1/64"
 # IPv4 address range spec.  Now deprecated.
 ipv4_addr_em0="10.2.1.1-10"
 # IPv6 alias.
 ifconfig_em0_alias0="inet6 2001:db8:5::1 prefixlen 70"
 # IPv4 alias.
 ifconfig_em0_alias1="inet 10.2.2.1/24"
 # IPv4 alias with range spec w/o AF keyword (backward compat).
 ifconfig_em0_alias2="10.3.1.1-10/32"
 # IPv6 alias with range spec.
 ifconfig_em0_alias3="inet6 2001:db8:20-2f::1/64"
 # ifconfig_IF_aliases is just like ifconfig_IF_aliasN.
 ifconfig_em0_aliases="inet 10.3.3.201-204/24 inet6 2001:db8:210-213::1/64 inet 10.1.1.1/24"
 # IPv6 alias (backward compat)
 ipv6_ifconfig_em0_alias0="inet6 2001:db8:f::1/64"
 # IPv6 alias w/o AF keyword (backward compat)
 ipv6_ifconfig_em0_alias1="2001:db8:f:1::1/64"
 # IPv6 prefix.
 ipv6_prefix_em0="2001:db8::/64"

Tested by:	Kimmo Paasiala
2013-06-20 02:29:49 +00:00
Devin Teske
cc56559534 Allow $ntpdate_config to be NULL. Due to a lack of surrounding quotes, when
ntpdate_config was set to NULL the conditional would (counter to prevailing
logic) succeed -- leading to awk attempting to redirect from a NULL pathname
standard-in. While we're here, make the script consistant with itself by
removing the {curlies} around ntpdate_config (they are unnecessary).
2013-06-18 02:37:15 +00:00
Eitan Adler
1cbff2a999 Remove CVS from the base system.
Discussed with:	many
Reviewed by:	peter, zi
Approved by:	core
2013-06-15 20:29:07 +00:00
Chris Rees
c45506efd1 Clean up swapfile memory disk on shutdown
Make the md unit number configurable so that it can be predicted

PR:		bin/168544
Submitted by:	wblock (based on)
Approved by:	kevlo
2013-06-12 16:44:17 +00:00
Rui Paulo
f3259b1bd2 Regen. 2013-06-10 05:45:53 +00:00
Hiroki Sato
ed45ea12ca Add :ifname modifier to specify interface-specific routes into
{,ipv6_}static_routes and rc.d/routing.  For example:

 static_routes="foo bar:em0"
 route_foo="-net 10.0.0.0/24 -gateway 192.168.2.1"
 route_bar="-net 192.168.1.0/24 -gateway 192.168.0.2"

At boot time, all of the static routes are installed as before.
The differences are:

- "/etc/rc.d/netif start/stop <if>" now configures static routes
  with :<if> if any.
- "/etc/rc.d/routing start/stop <af> <if>" works as well.  <af> cannot be
  omitted when <if> is specified, but a keyword "any" or "all" can be used
  for <af> and <if>.
2013-06-09 18:11:36 +00:00
Ed Maste
42f8c5b580 Add a new knob WITH_DEBUG_FILES to control the building of standalone
debug files for userland programs and libraries.  The "-g" debug flag
is automatically applied when WITH_DEBUG_FILES is set.

The debug files are now named ${prog}.debug and ${shlib}.debug for
consistency with other systems and documentation.  In addition they are
installed under /usr/lib/debug, to simplify the process of installing
them if needed after a crash.  Users of bsd.{prog,lib}.mk outside of the
base system place the standalone debug files in a .debug subdirectory.
GDB automatically searches both of these directories for standalone
debug files.

Thanks to everyone who contributed changes, review, and testing during
development.
2013-06-07 21:40:02 +00:00
Jamie Gritton
761d2bb5b9 Refine the "nojail" rc keyword, adding "nojailvnet" for files that don't
apply to most jails but do apply to vnet jails.  This includes adding
a new sysctl "security.jail.vnet" to identify vnet jails.

PR:		conf/149050
Submitted by:	mdodd
MFC after:	3 days
2013-05-19 04:10:34 +00:00
Alan Somers
44e8231cc7 etc/rc.d/syslogd
Add netif as a requirement of syslogd to get lo0 up.  Currently, this
	doesn't affect the rc order, because mountcritremote already depends on
	netif.

Reviewed by:	eadler
Approved by:	kenm (mentor)
MFC after:	2 weeks
2013-05-13 20:28:24 +00:00
Eitan Adler
fc0f2bcf18 Revert r250565 which causes issues for older CPUs
PR:		conf/178504
Requested by:	many
2013-05-12 21:24:18 +00:00
Eitan Adler
e4132b573c Make newsyslog compress logs with xz instead of bzip2 to save space.
PR:		conf/178504
Submitted by:	ak
Reviewed by:	smh
2013-05-12 15:23:59 +00:00
Eitan Adler
2b3b363780 Unconditionally install 210.backup-aliases as many MTAs other than
sendmail support the use of /etc/aliases.

PR:		conf/176098
Submitted by:	ak
MFC after:	2 weeks
2013-05-11 23:55:43 +00:00
Eitan Adler
ba7eea3304 Bring /etc/protocols up to date.
PR:	conf/175397
Submitted by:	ak
2013-05-10 13:57:44 +00:00
Hiroki Sato
6886522d85 - Fix exit status when ip6addrctl_verbose=yes [*]
- Use the absolute pathname for ip6addrctl.
- Use "install" instead of "add" to reduce the number of invocations.

Reported by:	Tatsuki Makino [*]
PR:		conf/175006 [*]
MFC after:	1 week
2013-05-04 15:42:55 +00:00
Chris Rees
b48b774f99 Introduce and use new flag -L to mount for mounting only late filesystems.
Previously, rc.d/mountlate mounted *all* filesystems, causing problems with
background NFS mounts being mounted twice.

PR:		conf/137629
Submitted by:	eadler (original concept)
Reviewed by:	mjg
Approved by:	hrs
2013-05-04 14:00:16 +00:00
Brooks Davis
8dccfa7cab Make an attempt to detect missing MTREE files in distrib-dirs. Not
perfect, but this is just a developer seatbelt.

PR:		conf/176897
Submitted by:	Garrett Cooper <yaneurabeya@gmail.com>
MFC after:	1 week
2013-04-30 19:26:44 +00:00
Gregory Neil Shapiro
67cdc89155 Minor changes to force commit these files so new freebsd*.cf files are
built to use the new sendmail-8.14.6/cf tree.

MFC after:	4 days
2013-04-21 17:11:45 +00:00