| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
| |
dhclient(1): correct obvious mismatch in get_char().
Correct switch between current and previous line buffers when
encountering a carriage return in the input.
CID: 1305719
Obtained from: OpenBSD (CVS rev. 1.30)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
dhclient: Log a warning instead of bailing upon "illegal" options
In Azure, the DHCP servers add private option (id 0xf5), which contains
binary form of an IPv4 address. Once this option is converted to string
form, it could contain '$', e.g.
IPv4 address: 100.72.36.54
binary form: 0x64 0x48 0x24 0x36
string form: "dH$6"
dhclient bails upon "illegal" options like the above example, thus the
VM bring-up will fail.
Also as a side note, this "illegal" option detection was added in
OpenBSD ~11years ago:
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sbin/dhclient/dhclient.c?rev=1.50&content-type=text/x-cvsweb-markup
And it was removed along with the removal of script support in OpenBSD
~3years ago:
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sbin/dhclient/dhclient.c?rev=1.159&content-type=text/x-cvsweb-markup
Reported by: Hongxiong Xian <v-hoxian microsoft com>
Reviewed by: jhb, Dexuan Cui <decui microsoft com>
Tested by: Hongxiong Xian <v-hoxian microsoft com>
Analyzed by: Dong Liu <doliu microsoft com>
Sponsored by: Microsoft OSTC
Differential Revision: https://reviews.freebsd.org/D5853
|
|
|
|
|
|
|
| |
Add CAP_FCNTL to the lease file capsicum rights, and limit to
CAP_FCNTL_GETFL. Without CAP_FCNTL_GETFL, the lease file truncation
in rewrite_client_leases() will fail to trim old data when rewriting
the file with a lesser amount of data.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Update most userspace consumers of capability.h to use capsicum.h instead.
auditdistd is not updated as I will make the change upstream and then do a
vendor import sometime in the next week or two.
Note that a significant fraction does not apply, as FreeBSD 10 doesn't
contain a Capsicumised ping, casperd, libcasper, etc. When these features
are merged, the capsicum.h change will need to be merged with them.
Sponsored by: Google, Inc.
|
|
|
|
|
|
|
|
|
|
| |
Add LIBUTIL to DPADD
This will fix "make checkdpadd"
PR: 192759
Approved by: rpaulo (mentor)
Phabric: D623
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- r263220 Migrate tools/regression/sbin/ to the new tests layout.
- r263222 Add Makefile missed in r263220.
- r263226 Migrate tools/regression/{usr.bin/lastcomm,usr.sbin}/ to the new tests layout.
- r263227 Migrate most of tools/regression/usr.bin/ to the new tests layout.
- r263345 Expand tabs that sneaked in into spaces.
- r263346 Migrate tools/regression/usr.bin/make/ to the new tests layout.
- r263348 Add Makefiles missed in r263346.
- r263351 Migrate tools/regression/usr.bin/pkill/ to the new tests layout.
- r263388 Mark multi_test as requiring /usr/share/dict/words.
- r263814 Fix path to the run.pl script to let these tests run.
- r264742 Prevent building tests when bootstrapping make.
This is 'make tinderbox' clean.
|
|
|
|
|
|
|
|
| |
Use CAP_EVENT instead of the deprecated CAP_POLL_EVENT.
PR: 185382 (based on)
Submitted by: Loganaden Velvindron
Reviewed by: pjd
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
in the future in a backward compatible (API and ABI) way.
The cap_rights_t represents capability rights. We used to use one bit to
represent one right, but we are running out of spare bits. Currently the new
structure provides place for 114 rights (so 50 more than the previous
cap_rights_t), but it is possible to grow the structure to hold at least 285
rights, although we can make it even larger if 285 rights won't be enough.
The structure definition looks like this:
struct cap_rights {
uint64_t cr_rights[CAP_RIGHTS_VERSION + 2];
};
The initial CAP_RIGHTS_VERSION is 0.
The top two bits in the first element of the cr_rights[] array contain total
number of elements in the array - 2. This means if those two bits are equal to
0, we have 2 array elements.
The top two bits in all remaining array elements should be 0.
The next five bits in all array elements contain array index. Only one bit is
used and bit position in this five-bits range defines array index. This means
there can be at most five array elements in the future.
To define new right the CAPRIGHT() macro must be used. The macro takes two
arguments - an array index and a bit to set, eg.
#define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL)
We still support aliases that combine few rights, but the rights have to belong
to the same array element, eg:
#define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL)
#define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL)
#define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP)
There is new API to manage the new cap_rights_t structure:
cap_rights_t *cap_rights_init(cap_rights_t *rights, ...);
void cap_rights_set(cap_rights_t *rights, ...);
void cap_rights_clear(cap_rights_t *rights, ...);
bool cap_rights_is_set(const cap_rights_t *rights, ...);
bool cap_rights_is_valid(const cap_rights_t *rights);
void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src);
void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src);
bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little);
Capability rights to the cap_rights_init(), cap_rights_set(),
cap_rights_clear() and cap_rights_is_set() functions are provided by
separating them with commas, eg:
cap_rights_t rights;
cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT);
There is no need to terminate the list of rights, as those functions are
actually macros that take care of the termination, eg:
#define cap_rights_set(rights, ...) \
__cap_rights_set((rights), __VA_ARGS__, 0ULL)
void __cap_rights_set(cap_rights_t *rights, ...);
Thanks to using one bit as an array index we can assert in those functions that
there are no two rights belonging to different array elements provided
together. For example this is illegal and will be detected, because CAP_LOOKUP
belongs to element 0 and CAP_PDKILL to element 1:
cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL);
Providing several rights that belongs to the same array's element this way is
correct, but is not advised. It should only be used for aliases definition.
This commit also breaks compatibility with some existing Capsicum system calls,
but I see no other way to do that. This should be fine as Capsicum is still
experimental and this change is not going to 9.x.
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
|
| |
that looks for interface skips interfaces that are not UP. We need to call
dhclient-script PREINIT before we call discover_interfaces(), so the script has
a chance to bring the interface UP.
Reported by: alfred
|
|
|
|
|
|
|
| |
Sandbox unprivileged process using capability mode.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
|
| |
Revoke all capability rights from STDIN and allow only for write to STDOUT and
STDERR. All those descriptors are redirected to /dev/null.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
|
| |
Once PID is written to the pidfile, revoke all capability rights.
We just want to keep the pidfile open.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
| |
Only allow to overwrite lease file.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
|
|
| |
Limit routing socket so only poll(2) and read(2) are allowed (CAP_POLL_EVENT
and CAP_READ). This prevents unprivileged process from adding, removing or
modifying system routes.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
| |
Limit communication pipe with privileged process to CAP_READ and CAP_WRITE.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
|
|
| |
- Limit bpf descriptor in unprivileged process to CAP_POLL_EVENT, CAP_READ and
allow for SIOCGIFFLAGS, SIOCGIFMEDIA ioctls.
- While here limit bpf descriptor in privileged process to only CAP_WRITE.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
|
|
|
|
|
| |
Currently it was allowed to send any UDP packets from unprivileged process and
possibly any packets because /dev/bpf was open for writing.
Move sending packets to privileged process. Unprivileged process has no longer
access to not connected UDP socket and has only access to /dev/bpf in read-only
mode.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
| |
Shutdown write direction of the routing socket. We only need to read from it.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
|
| |
- Add new request (IMSG_SEND_PACKET) that will be handled by privileged process.
- Add $FreeBSD$.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
|
|
| |
The gethostname(3) function won't work in capability mode, because reading
kern.hostname sysctl is not permitted there. Cache hostname early and use
cached value later.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
| |
|
|
|
|
|
|
|
|
|
| |
Make use of two fields: rfdesc and wfdesc to keep bpf descriptor open for
reading only in rfdesc and bpf descriptor open for writing only in wfdesc.
In the end they will be used by two different processes.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
| |
iov_base field is 'void *' in FreeBSD, no need to cast.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
| |
No caller checks send_packet() return value, so make it void.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
| |
Use the same type for 'from' and 'to' argument in send_packet().
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
| |
Remove unused argument from assemble_hw_header().
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
| |
Remove unused argument from send_packet().
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
| |
Garbage-collect dead prototypes.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
contained in the DHCP offer, and write it out to the lease file
as an unquoted value of the "next-server" keyword. The value is ignored
when the lease is read back by dhclient, however other applications
are free to parse it.
The intent behind this change is to allow easier interoperability
with automated installation systems e.g. Cobbler, Foreman, Razor;
FreeBSD installation kernels can automatically probe the network
to discover deployment servers. There are no plans to MFC this
change unless a backport is specifically requested.
The syntax of the "next-server <ip>" lease keyword is intended to be
identical to that used by the ISC DHCPD server in its configuration files.
The required defines are already present in dhclient but were unused before
this change. (Note: This is NOT the same as Option 66, tftp-server-name).
It has been exercised in a university protocol testbed environment, with
Cobbler and an mfsBSD image containing pc-sysinstall (driven by Cobbler
Cheetah templates). The SYSLINUX memdisk driver is used to boot mfsBSD.
Currently this approach requires that a dedicated system profile has
been created for the node where FreeBSD is to be deployed. If this
is not present, the pc-sysinstall wrapper will be unable to obtain
a node configuration. There is code in progress to allow mfsBSD images
to obtain the required hints from the memdisk environment by parsing
the MBFT ACPI chunk. This is non-standard as it is not linked into
the platform's ACPI RSDT.
Reviewed by: des
|
|
|
|
|
| |
PR: bin/170279
MFC after: 1 week
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
First, don't exit when the link goes down on an interface. Instead,
teach dhclient to track changes in link state and to enter the reboot
state when the link on an interface goes up causing dhclient to attempt
to renew its existing lease.
Second, remove the change I added to clear the old lease when dhclient
exits due to an error (such as ifconfig down). If an interface is
using autoconfiguration it should keep its autoconfiguration as much as
possible. If the next time it needs a configuration it is able to reuse
the previous autoconfiguration, then leaving the settings intact allows
existing connections to survive temporary outages, etc.
PR: bin/166656
MFC after: 1 month
|
|
|
|
|
|
|
|
|
|
| |
link is lost. devd will start a new dhclient instance when link is
restored.
PR: bin/166656
Submitted by: Peter Jeremy (mostly)
Reviewed by: brooks (earlier version from Peter)
MFC after: 1 month
|
| |
|
|
|
|
| |
Sponsored by: Yakaz (http://www.yakaz.com)
|
|
|
|
|
|
|
|
|
|
|
|
| |
In the original Domain Search option patch, an invalid option value
would cause the whole lease to be rejected. However, DHCP servers who
emit such an invalid value are more common than I thought. With this new
patch, just the option is rejected, not the entire lease.
PR: bin/163431
Submitted by: Fabian Keil <fk@fabiankeil.de> (earlier version)
Reviewed by: Fabian Keil <fk@fabiankeil.de>
Sponsored by: Yakaz (http://www.yakaz.com)
|
|
|
|
|
|
| |
we might as well use memcpy; strlcpy is really unnecessary here.
MFC after: 1 week
|
|
|
|
|
|
|
| |
strlcpy appearing to be the size of the source buffer, instead of the
destination.
MFC after: 1 week
|
|
|
|
|
|
|
|
|
|
|
|
| |
that changed 0.0.0.0/0.0.0.0 prefix to 0.0.0.0/255.0.0.0.
In the r228313 this behavior was fixed, and since dhclient-script
got broken.
I'm not sure this fix is a perfect one, it just changes
dhclient-script to set 0.0.0.0/255.0.0.0 explicitly.
PR: kern/163206
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The "domain-search" option (option 119) allows a DHCP server to publish
a list of implicit domain suffixes used during name lookup. This option
is described in RFC 3397.
For instance, if the domain-search option says:
".example.org .example.com"
and one wants to resolve "foobar", the resolver will try:
1. "foobar.example.org"
2. "foobar.example.com"
The file /etc/resolv.conf is updated with a "search" directive if the
DHCP server provides "domain-search".
A regression test suite is included in this patch under
tools/regression/sbin/dhclient.
PR: bin/151940
Sponsored by Yakaz (http://www.yakaz.com)
|
|
|
|
|
|
|
| |
there, clean it up and add some error checks.
Glanced at by: brooks@
MFC after: 3 weeks
|
|
|
|
|
| |
If you don't want to use resolvconf(8) to update /etc/resolv.conf,
you can put resolvconf_enable="NO" into /etc/dhclient-enter-hooks.
|
|
|
|
|
|
|
|
| |
how to configure dhclient to clear the interface of IP numbers prior
to configuring it.
PR: 149351
MFC after: 2 weeks
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
it to configure the interface. When the script is complete, dhclient
monitors the routing socket and will terminate if its address is
deleted or if its interface is removed or brought down.
Because the routing socket is already open when dhclient-script is
run, dhclient ignores address deletions for 10 seconds after the
script was run.
If the address that will be obtained is already configured on the
interface before dhclient starts, and if dhclient-script takes more
than 10 seconds (perhaps due to dhclient-*-hooks latencies), on script
completion, dhclient will immediately and silently exit when it sees
the RTM_DELADDR routing message resulting from the script reassigning
the address to the interface.
This change logs dhclient's reason for exiting and also changes the
10 second timeout to be effective from completion of dhclient-script
rather than from when it was started.
We now ignore RTM_DELADDR and RTM_NEWADDR messages when the message
contains no interface address (which should not happen) rather than
exiting.
Not reviewed by: brooks (timeout)
MFC after: 3 weeks
|
|
|
|
|
|
|
|
|
|
|
|
| |
packets instead of allowing the protocol stack to pick a random source port.
This fixes the behaviour where dhclient would never transition from RENEWING
to BOUND without going through REBINDING in networks which are paranoid about
DHCP spoofing, such as most mainstream cable-broadband ISP networks.
Reviewed by: brooks
Obtained from: OpenBSD (partly - I'm not convinced their solution can work)
MFC after: 1 week (pending re approval)
|
|
|
|
| |
Submitted by: Ulrich Spörlein
|
|
|
|
|
|
|
|
| |
dhclient now terminates when the underlying ifnet is destroyed (e.g.
on card eject).
Reviewed by: brooks
Approved by: re (kib)
|
|
|
|
|
|
|
|
|
|
|
| |
internal buffer sizes.
When we 'append', assume we're appending to text. Some MS dhcp servers will
give us a string with the length including the trailing NUL. when we 'append
domain-name', we get something like "search x.y\000 z" in resolv.conf :(
MFC after: 1 week
Security: A buffer overflow (by one NUL byte) was possible.
|
|
|
|
|
|
| |
PR: bin/127076
Submitted by: jkim
MFC after: 1 week
|
|
|
|
|
|
|
|
| |
In the MPSAFE TTY branch, I noticed PTY's to be leaked, because
dhclient's privileged process was run inside the session of, say, the
login shell. Make sure we call setsid() here.
Approved by: philip (mentor), brooks
|
|
|
|
|
|
| |
for a long time if we get a lease, but DNS isn't working.
MFC after: 1 week
|