| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
CONSIDERATIONS'.
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
| |
convention as src/lib/csu/*/crt1.c.
This will make the follow up diffs easier to see and extract.
|
| |
|
|
|
|
|
|
|
|
| |
file descriptors does not change upon dropping privilege, and include
a likely case of `setuid(non_superuser); exec(...);'.
Sponsored by: DARPA, NAI Labs
Obtained from: TrustedBSD Project
|
|
|
|
|
|
| |
PR: misc/40104
Submitted by: Neal Fachan <neal@isilon.com>
MFC after: 3 days
|
|
|
|
| |
Reviewed by: jmallett
|
| |
|
|
|
|
|
|
| |
scope identifier).
MFC after: 3 weeks
|
|
|
|
|
|
|
| |
scope identifier).
Approved by: des
MFC after: 3 weeks
|
|
|
|
|
|
|
| |
with recent 2553bis.
Obtained from: KAME
MFC after: 3 weeks
|
|
|
|
| |
Pointed out by: julian
|
|
|
|
| |
turn on tracing.
|
|
|
|
|
|
| |
does not know what sort of UFS filesystem this is.
Add some DEBUG(NULL)'s to function entry points.
|
|
|
|
|
|
|
|
| |
the correct location--this section consists solely of security
considerations information.
Sponsored by: DARPA, NAI Labs
Obtained from: TrustedBSD Project
|
| |
|
|
|
|
|
|
|
|
|
| |
the build. It is here to compartmentalise functionality currently duplicated
in many notable programs in the base system. It currently handles block
reads and writes, as well as reading and writing of the filesystem superblock,
and the reading/lookup of inode data. It supports both UFS and UFS2. I
will be maintaining it, and porting programs to use it, however for now, it
is simply being built as part of world.
|
|
|
|
| |
Reviewed by: gallatin, ticso
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The ability to schedule multiple threads per process
(one one cpu) by making ALL system calls optionally asynchronous.
to come: ia64 and power-pc patches, patches for gdb, test program (in tools)
Reviewed by: Almost everyone who counts
(at various times, peter, jhb, matt, alfred, mini, bernd,
and a cast of thousands)
NOTE: this is still Beta code, and contains lots of debugging stuff.
expect slight instability in signals..
|
|
|
|
| |
in /sys/boot/common and are actually used there.
|
|
|
|
|
|
| |
"Make in_cksum work on little endian machines"
This would explain a few things. :-)
|
| |
|
|
|
|
| |
Obtained from: OpenBSD
|
|
|
|
|
| |
"term" according to manpage, i.e. not overwrite it, if already present in
environment.
|
|
|
|
|
|
| |
the process as well as pending on the current thread.
Reported by: Andrew MacIntyre <andymac@bullseye.apana.org.au>
|
|
|
|
| |
Prompted by: wollman
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
|
|
|
|
|
| |
libstdc++ was bumped with the switch to Gcc 3.1, and libpam was bumped with
the switch to OpenPAM.
|
|
|
|
|
| |
libstdc++ was bumped with the switch to Gcc 3.1, and libpam was bumped with
the switch to OpenPAM.
|
|
|
|
| |
Spotted by: bde
|
|
|
|
|
|
|
| |
to the actual implementation. This is to allow libc_r to override
pselect() making it a cancellation point.
Prompted by: wollman
|
|
|
|
| |
Remove fmtcheck from application name space (fix the weak reference).
|
| |
|
|
|
|
|
|
|
|
| |
re-read from the stack mid copy. This may help mitigate the recent
Apache buffer overrun and future overruns of the sort.
Reviewed by: jdp
MFC after: 2 days
|
|
|
|
|
|
| |
fixes the build.
Reported by: dillon.
|
| |
|
|
|
|
| |
Submitted by: bde
|
|
|
|
| |
by RLIMIT_VMEM addition.
|
|
|
|
| |
commit.
|
|
|
|
| |
plugs the hole.
|
| |
|
|
|
|
| |
Noticed by: nectar
|
|
|
|
| |
Submitted by: joost Pol <joost@pine.nl>
|
| |
|
|
|
|
| |
sshd, /usr/bin/login, etc)
|
|
|
|
| |
Style nits.
|
|
|
|
|
|
| |
Submitted by: markm
Mark some _start formal parameters __unused.
|