aboutsummaryrefslogtreecommitdiff
path: root/usr.sbin/rpc.tlsclntd
Commit message (Collapse)AuthorAgeFilesLines
* usr.sbin: Automated cleanup of cdefs and other formattingWarner Losh2023-11-271-1/+0
| | | | | | | | | | | | | | | | Apply the following automated changes to try to eliminate no-longer-needed sys/cdefs.h includes as well as now-empty blank lines in a row. Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/ Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/ Remove /\n+#if.*\n#endif.*\n+/ Remove /^#if.*\n#endif.*\n/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/ Sponsored by: Netflix
* Remove $FreeBSD$: two-line nroff patternWarner Losh2023-08-161-2/+0
| | | | Remove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-161-1/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* Remove $FreeBSD$: one-line .c patternWarner Losh2023-08-161-2/+0
| | | | Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
* rpc.tls[serv|clnt]d.c: Clean up code for OpenSSL3Rick Macklem2023-06-011-6/+4
| | | | | | | | | | There were several function calls that are deprecated for OpenSSL1.1.1. These have been removed. There was also a function call deprecated for OpenSSL3 and that one has been #ifdef'd on OPENSSL_VERSION_NUMBER. Reviewed by: emaste, ngie Differential Revision: https://reviews.freebsd.org/D40275
* spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDWarner Losh2023-05-121-1/+1
| | | | | | | | | The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch up to that fact and revert to their recommended match of BSD-2-Clause. Discussed with: pfg MFC After: 3 days Sponsored by: Netflix
* report full error string on SSL_connect() failureVladimir Kotal2023-02-271-2/+2
| | | | | Reviewed by: imp Pull Request: https://github.com/freebsd/freebsd-src/pull/575
* rpc.tlsclntd: Check for a tls syscall failure.Rick Macklem2022-12-211-1/+8
| | | | | | | | Although the tls syscall to set up the upcall should not normally fail, the daemon should check for such a failure. This patch adds a check for that failure. MFC after: 1 week
* rpc.tlsclntd.8: Fix the RFC number now that it existsRick Macklem2022-09-231-2/+2
| | | | | | | | | | The RFC for this finally got published and, therefore, now has a number. This patch puts this RFC number in the man page. This is a content change. MFC after: 1 week
* rpc.tlsclntd: Add the -2 option to the usage lineRick Macklem2022-05-221-0/+1
| | | | | | | | | | Commit 72bf76d6b8c9 added the -2 option to use TLS 1.2 NFS-over-TLS mounts. It did not add -2 to the usage message. This patch adds -2 to the usage message. MFC after: 2 weeks
* rpc.tlsclntd: Add the -2 option to the man pageRick Macklem2022-05-221-1/+11
| | | | | | | | | | | | | | | | | | Since the KTLS now supports TLS1.3, the daemons default to version 1.3, since the draft (to be an RFC someday) requires TLS1.3. However, since FreeBSD 13,0, 13,1 uses TLS1.2 for NFS-over-TLS, the "-2" option is added to both daemons for compatibility with FreeBSD 13.0, 13.1. This patch updates the man pages for this. This is a content change. Reviewed by: pauamma_gundo.com MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D35290
* rpc.tlsclntd: Update the man page for the -C optionRick Macklem2022-05-221-7/+16
| | | | | | | | | | | | | Commit f5b40aa0dea6 modifies the -C command line option for rpc.tlsclntd to use the TLS 1.3 SSL_CTX_set_ciphersuites(). This patch updates the man page for this modified command line option. This is a content change. Reviewed by: jhb, pauamma_gundo.com (same change for rpc.tlsservd.8) MFC after: 2 weeks
* rpc.tlsclntd: Modify the -C option to use SSL_CTX_set_ciphersuitesRick Macklem2022-05-221-4/+4
| | | | | | | | | | | | | Commit 0b4f2ab0e913 fixes the krpc so that it can use TLS version 1.3 for NFS-over-TLS, as required by the draft (someday to be an RFC). This patch replaces SSL_CTX_set_cipher_list() with SSL_CTX_set_ciphersuites(), since that is the function that is used for TLS1.3. The man page will be updated in a separate commit. MFC after: 2 weeks
* rpc.tlsclntd: Add an option to force use of TLS version 1.2Rick Macklem2022-05-201-11/+28
| | | | | | | | | | | | | | | | | Commit 0b4f2ab0e913 fixes the krpc so that it can use TLS version 1.3 for NFS-over-TLS, as required by the draft (someday to be an RFC). Since FreeBSD 13.0, 13.1 use TLS version 1.2 for NFS-over-TLS mounts, this command line option may be used so that NFS-over-TLS mounts to 13.0, 13.1 servers will still work. Without the command line option, NFS-over-TLS mounts will use TLS version 1.3. The man page update will be a separate commit. MFC after: 2 weeks
* rpc.tlsclntd, rpc.tlsservd: Fix getopt_long argumentRick Macklem2022-05-051-2/+2
| | | | | | | | The "C" option in the argument to getopt_long() was missing a ":" for both rpc.tlsclntd.c and rpc.tlsservd.c. This patch fixes this. MFC after: 2 weeks
* nfs tls: Update for SSL_OP_ENABLE_KTLS.John Baldwin2021-08-101-0/+5
| | | | | | | | | | | | Upstream OpenSSL (and the KTLS backport) have switched to an opt-in option (SSL_OP_ENABLE_KTLS) in place of opt-out modes (SSL_MODE_NO_KTLS_TX and SSL_MODE_NO_KTLS_RX) for controlling kernel TLS. Reviewed by: rmacklem Sponsored by: Netflix MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D31445
* nfs-over-tls: add user space daemons rpc.tlsclntd and rpc.tlsservdRick Macklem2021-02-183-0/+960
The kernel changes needed for nfs-over-tls have been committed to main. However, nfs-over-tls requires user space daemons to handle the TLS handshake and other non-application data TLS records. There is one daemon (rpc.tlsclntd) for the client side and one daemon (rpc.tlsservd) for the server side, although they share a fair amount of code found in rpc.tlscommon.c and rpc.tlscommon.h. They use a KTLS enabled OpenSSL to perform the actual work and, as such, are only built when MK_OPENSSL_KTLS is set. Communication with the kernel is done via upcall RPCs done on AF_LOCAL sockets and the custom system call rpctls_syscall. Reviewed by: gbe (man pages only), jhb (usr.sbin/Makefile only) Comments by: jhb MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D28430 Relnotes: yes
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-26 09:24:42 +0000