not be mounted unless the -l flag was specified.
Add an rc script, mountlate, which basically runs 'mount -a -l'. It runs
after DAEMON but before LOGIN.
This is useful for things like loopback mounts, because mountcritremote
runs before mountd / nfsd (since /usr might be a remote file system), so
an attempt to mount a loopback network file system in mountcritremote will
fail.
Also add a progress message to mountcritlocal, for the sake of symmetry
with similar messages in mountcritremote and mountlate.
Reviewed by: freebsd-rc
MFC after: 3 weeks
mechanism
o change vlan cloning to use callback and pass all vlan parameters
on create using the new SIOCREATE2 ioctl
o update vlan set logic to match existing practice
with NACK if I don't set it. Setting 'option dhcp-client-identifier' is
alternative but it is inconvenient because I have to keep the list of
all MAC addresses. As bin/94743 pointed out, it is always sent from
Windows clients and I found Mac OS X does the same.
OK'd by: brooks
order to - for example - apply firewall rules to a whole group of
interfaces. This is required for importing pf from OpenBSD 3.9
Obtained from: OpenBSD (with changes)
Discussed on: -net (back in April)
sector size, instead of later failing with an error about /boot/mbr
not being a multiple of the sector size (since we end up with an
assumed sector size of MAX_SEC_SIZE * 2).
- We query the sector size via an IOCTL anyway, so if that succeeds
use that instead of probing for it via read(2) calls. This fixes
the problem with fdisk failing to operate on at least graid3 and
md(4) devices on kernels with src/sys/geom/geom_dev.c before
rev. 1.90, due to fdisk failing to detect the sector size.
- When detecting the root device allow "/" characters in it, which
happens with e.g. gmirror devices.
Reviewed by: cperciva
MFC after: 1 week
- 'tag' & 'untag' action parameters.
- 'tagged' & 'limit' rule options.
Rule examples:
pipe 1 tag tablearg ip from table(1) to any
allow ip from any to table(2) tagged tablearg
allow tcp from table(3) to any 25 setup limit src-addr tablearg
sbin/ipfw/ipfw2.c:
1) new macros
GET_UINT_ARG - support of 'tablearg' keyword, argument range checking.
PRINT_UINT_ARG - support of 'tablearg' keyword.
2) strtoport(): do not silently truncate/accept invalid port list expressions
like: '1,2-abc' or '1,2-3-4' or '1,2-3x4'. style(9) cleanup.
Approved by: glebius (mentor)
MFC after: 1 month
keeping a flag to check whether we actually wanted to mount the filesystem
readonly, setup the options list so that we start off by assuming rw is what's
desired and let later flags change that.
to the init. This prevents zombies from being accumulated.
PR: bin/64198
Tested by: Eugene Grosbein <eugen at www svzserv kemerovo su>
Approved by: kan (mentor)
MFC after: 1 month
Now, encryption algorithm is given using '-e' option, not '-a'.
The '-a' option is now used to specify authentication algorithm.
Supported by: Wheel Sp. z o.o. (http://www.wheel.pl)
- remove call to getmntopts(), and just pass -o options to
nmount(). This removes some confusion as to what options
msdosfs can parse, by pushing the responsibility of option parsing
to the VFS and FS specific code in the kernel.
msdosfs_vfsops.c:
- add "force" and "sync" to msdosfs_opts. They used to be specified
in mount_msdosfs.c, so move them here. It's not clear whethere these
options should be placed into global_opts in vfs_mount.c or not.
Motivated by: marcus
Since tags are kept while packet resides in kernelspace, it's possible to
use other kernel facilities (like netgraph nodes) for altering those tags.
Submitted by: Andrey Elsukov <bu7cher at yandex dot ru>
Submitted by: Vadim Goncharov <vadimnuclight at tpu dot ru>
Approved by: glebius (mentor)
Idea from: OpenBSD PF
MFC after: 1 month
It is no longer needed, because "mount -t reiserfs" calls nmount(2)
directly to mount a ReiserFS file system without the use of
this external mount program.
Approved by: dumbbell
option if none is given in the config file. Also add #ifdefd out
support for sending a client ID based on our MAC address.
PR: bin/94743, bin/76401
Submitted by: Frank Behrens <frank at pinky dot sax dot de>
X-MFC after: 6.1-RELEASE
o Introduce -r and -w keys which allow to load and save a worklist.
o Replace README by man page.
PR: bin/96677
Submitted by: Ulrich Spoerlein
Approved by: phk
MFC after: 1 month
arguments so we do not coredump at "help foo", "back bar" and such.
o Be consistent and print argc - 1 as a command arguments number in
all cases.
PR: bin/37096
Submitted by: Joshua Goodall
MFC after: 1 month
Reset it to 1 for each devd config file so if the parser finds
a syntax error devd(8) will report a correct line number.
Submitted by: Niki Denev
MFC after: 2 weeks
to match the number of inodes on the disk. If we find a directory
entry with a crazy inode number in it, don't look beyond the end
of the bitmap to find that inode's state. Instead skip that directory
entry and print a warning.
Reviewed by: iedowse
MFC after: 3 weeks
wait time for a packet. This allows to:
- Count number of packets received before and after specified
time.
- Shorten time of execution of 'ping -c 1' scripts.
Submitted by: Lytochkin Boris <lytboris gmail.com>
device number at creation time with -u option. Together with XMLizing
mdconfig(8), I broke this functionality.
This change is temporary. Complete fix will be commited soon.
Approved by: cognet (mentor)
a problem with listing large number of md(4) devices. Either 'list' or
'query' mode uses XML.
Additionally, new functionality was introduced. It's possible to pass
multiple devices to -u:
# ./mdconfig -l -u md0,md1
Approved by: cognet (mentor)
- <netipx> headers [1]
- IPX library (libipx)
- IPX support in ifconfig(8)
- IPXrouted(8)
- new MK_NCP option
New MK_NCP build option controls:
- <netncp> and <fs/nwfs> headers
- NCP library (libncp)
- ncplist(1) and ncplogin(1)
- mount_nwfs(8)
- ncp and nwfs kernel modules
User knobs: WITHOUT_IPX, WITHOUT_IPX_SUPPORT, WITHOUT_NCP.
[1] <netsmb/netbios.h> unconditionally uses <netipx> headers
so they are still installed. This needs to be dealt with.
as both have been read from the command line. Still use the callback,
but this time only to verify that both vlan and vlandev have been
found on the command line.
This should allow for control over the relative order of processing
parameters, which is needed to satisfy some caveats of the if_vlan
driver. E.g., MTU cannot be changed on a vlan interface until it's
attached to its parent.
PR: bin/94028
Reviewed by: ru
MFC after: 3 days
As discussed on -current, there is no sensitive info in /sbin/init
to prevent reading it from non-privileged users, nor any reason to
remove the 'x' bit as the first thing the program does is check the
uid and exit if it is not run by root.
Instead (and this is why i make the change), mode 500 prevents
operation when exporting the partition without -maproot=0 to diskless
clients.
All previuos releases are affected by the same problem, so a merge
to RELENG_6 at least would be appropriate (after proper re@ approval
of course).
o multiple modules can be unloaded at once (specified either by id or be
module name)
o exit with EX_USAGE after usage() is called.
o remove unused variables, since we keep command line flags as bitmask,
in 'opt'.
o 'kldload -n ...' does nothing. Add comment to this options.
Additionally:
o Update manual page to conform new functionality.
o Increace WARNS to 6. Because we can.
Approved by: cognet (mentor)
MFC after: 1 week
in the buffer. This isn't exactly the patch that Stephen submitted, but
is based on one of his suggestions.
PR: 93841
Submitted by: Stephen Montgomery-Smith <stephen@math.missouri.edu>
MFC after: 2 weeks
o Also, fdisk_pc98 appears to support -i, so add it to the man page.
o Ditto -v
o Change the name from PC partition table maintenance program to NEC PC-98x1
partition table maintenance program, since it is possible to have a DOS MBR
formatted disk on FreeBSD/pc98 now (although we don't install any tools for
this).
o Merge the -I switch from i386 verison to initialize the partition table
to use the maximum amount possible for a single FreeBSD table.
o Improve warning when the geom method fails (which I think it
always will until geom_pc98 is updated to respond to this ctl message)
o when writing out the boot sector, we have to write out a minimum of
1024 bytes or the sector size. This is different than the i386 case where
we need to write out a minimum of 512 bytes (which is also the minimum
sector size). We already handle this difference on reading, but didn't
in writing, so attempting to write a new partition table would fail.
o Add MID to the -s output, since pc98 users are likely interested in
both of these parameters.
# I can now initialize disks on my pc98 machine either by -I or by
# manually entering the parameters. I don't know if fdisk -B works or not,
# since I'm not willing to risk my only working boot disk to test it..
additional -r (read-only) flag or or -w (read-write) flag,
then assume we want, mount -u -w.
When doing a mount update, this will implicitly pass a "noro" mount
option down to the VFS layer.
vfs_mergeopts() in vfs_mount.c will then remove the "ro" mount option
if it exists in the mount options for a mounted file system.
This means that "mount -u" works the same as "mount -u -w"
and will convert a read-only mount to read-write.
- mount(8) now calls the nmount(2) system call directly, not mount(2)
- specifying a filesystem type with -t will not automatically
invoke an external /sbin/mount_XXXX program....this only happens for
certain file system types. For all other file system types, nmount(2)
is called directly.
doesn't exist or add one that is already present, if the -q flag
is set. Useful for "ipfw -q /dev/stdin" when the command above is
invoked from something like python or TCL to feed commands
down the throat of ipfw.
MFC in: 1 week
supported for a moment.
- Don't allow to use -i when no passphrase is given. Now if iterations is
equal to -1 (not set), we know that we should not ask for the passphrase
on boot.
It still doesn't handle situation when one key is protected with
passphrase and the other is not. There is no quick fix for this.
The complete solution will be to make number of iterations a per-key
value. Because this need metadata format change and is only needed for
devices attached on boot, I'll leave it as it is for now.
MFC after: 3 days
makes it practical to use GBDE for "something you have plus something
you know" security together with a USB flash drive.
Reviewed by: phk
MFC after: 7 days
Presently, ifconfig callbacks are used for L2 configuration, media
and vlan, so actions associated with address assignment, like sending
out a gratuitous ARP, should go when L2 is running already.
This also should fix the problem with setting up vlan interfaces
from rc.conf, when both IP and vlan+vlandev parameters are passed
to ifconfig at once.
Future work: Consider introducing several ifconfig callback lists
to invoke callbacks orderly.
MFC after: 1 week
/tmp may not be writeable yet when dhclient is first run via
/etc/rc.d/netif so using it may not work. Also, writing to a
predictable file in /tmp as root is a really bad idea since a malicious
user may be able to win a race and insert a symlink which will allow
them to cause any file to be overwritten. To solve these problems,
create the tempory file in /var/run which will exist this early and is
writable only by root.
Security: Local risk if users can cause dhclient to run on demand
(such as by unplugging and replugging the network cable).
system is mounted. This prevevents duplicated mounts.
The change I made against the original patch is to fall back to the given
path on realpath(2) failure instead of exiting with an error.
Submitted by: Andreas Kohn <andreas@syndrom23.de>
PR: bin/89782
MFC after: 3 days
circumstances that include circular dependencies.
PR: bin/91789
PR submitted by: Frank Behrens <frank@pinky.sax.de>
Patch submitted by: Divacky Roman <xdivac02@stud.fit.vutbr.cz>
entries from the interface rather than using ifconfig's delete command.
This preserves non-dhclient configured addresses (though they are wiped
out when dhclient is restarted).
MFC after: 1 week
disk. Apparently some people want to use mdmfs as mount_* as a
shortcut for mounting existing file-based file systems.
Note that unlike in the patches from the submitters, this option is
not available in compat mode. Compat mode was supposed to support only
things that mount_mfs used to support. To use this option from fstab,
mdmfs should be called mount_md, not mount_mfs. This distinction has
not always upkept for new options, and those can't be fixed now
without breaking people's systems, but new options should not usually
be allowed in compat mode. (Not sure why -F is allowed there at all.)
PR: 57641
Submitted by: Ruben de Groot
Submitted independently by: Wojciech A. Koszek, for Urzad Miasta Czestochowa
autonumbering is requested, set the unit to 0 instead of -1. This
option is just for output, and "/dev/md-1" looks disconcerting.
Submitted by: Wojciech A. Koszek
kernel is in the order the devices were made, which is not useful to
the user. Also, remove the "%d more" test since the kernel does not
return the complete count in md_pad[0] (maybe it should?).
Submitted by: Wojciech A. Koszek
action argument with the value obtained from table lookup. The feature
is now applicable only to "pipe", "queue", "divert", "tee", "netgraph"
and "ngtee" rules.
An example usage:
ipfw pipe 1000 config bw 1000Kbyte/s
ipfw pipe 4000 config bw 4000Kbyte/s
ipfw table 1 add x.x.x.x 1000
ipfw table 1 add x.x.x.y 4000
ipfw pipe tablearg ip from table(1) to any
In the example above the rule will throw different packets to different pipes.
TODO:
- Support "skipto" action, but without searching all rules.
- Improve parser, so that it warns about bad rules. These are:
- "tablearg" argument to action, but no "table" in the rule. All
traffic will be blocked.
- "tablearg" argument to action, but "table" searches for entry with
a specific value. All traffic will be blocked.
- "tablearg" argument to action, and two "table" looks - for src and
for dst. The last lookup will match.
- number of read I/O requests,
- number of write I/O requests,
- number of read bytes,
- number of written bytes.
Add 'reset' subcommand for resetting statistics.
value (intmax_t) and boolean (int).
Based on that provide three functions:
- gctl_get_ascii()
- gctl_get_int()
- gctl_get_intmax()
- Hide gctl_get_param() function, as it is only used internally in
subr.c.
- Allow to provide argument name as (fmt, ...).
- Assert geom(8) bugs (missing argument is a geom(8) bug).
- Clean-up and simplify the code by using new functions and assumtions
(no more checking for missing argument).
Tested by: regression tests
IPv6 support was committed:
- Stop treating `ip' and `ipv6' as special in `proto' option as they
conflict with /etc/protocols.
- Disuse `ipv4' in `proto' option as it is corresponding to `ipv6'.
- When protocol is specified as numeric, treat it as it is even it is
41 (ipv6).
- Allow zero for protocol as it is valid number of `ip'.
Still, we cannot specify an IPv6 over an IPv4 tunnel like before such
as:
pass ipv6 from any to any
But, now, you can specify it like:
pass ip4 from any to any proto ipv6
PR: kern/89472
Reported by: Ga l Roualland <gael.roualland__at__dial.oleane.com>
MFC after: 1 week
iov address internally through realloc(3). However, since the function
parameter wasn't designed to allow the modified iov being passed back to
the caller, we ended up feeding iov with several corrupted entries(this
depends on how many arguments were pushed into iovec before set_charset())
to nmount(2).
This commit fixes this regression introduced in rev1.37 such that
mount_msdosfs(8) with code page conversion option(-W,-D) enabled works again.
Reviewed by: rodrigc
iov address internally through realloc(3). However, since the function
parameter wasn't designed to allow the modified iov being passed back to
the caller, we end up feeding iov with several corrupted entries(depends on
how many arguments were pushed into iovec before set_charset()) to nmount(2).
This commit fixes this regression introduced in rev1.31 such that
mount_cd9660(8) with code page conversion option(-C) enabled works again.
Reviewed by: rodrigc
external mounting program list as well; otherwise, entry like the following
in /etc/fstab wouldn't work:
/dev/acd0 /mnt/cdrom cd9660 ro,-C=big5 0 0
Reviewed by: rodrigc
