Re: delete pf states by exact flow info and speed it up

2017-04-20 Thread YASUOKA Masahiko
Hi, On Fri, 21 Apr 2017 00:27:04 +0200 Alexandr Nedvedicky wrote: > I finally got to your patch. I'm fine with your to extend pfctl kill > operation. > > I've found just few nits in your change. > > 1) your manpage diff should include one more change below: > 8<---8<---

Re: delete pf states by exact flow info and speed it up

2017-04-20 Thread Alexandr Nedvedicky
Hello, I finally got to your patch. I'm fine with your to extend pfctl kill operation. I've found just few nits in your change. 1) your manpage diff should include one more change below: 8<---8<---8<--8< diff -r c435e977886a -r 40aa0af6

from: getline(3) can fail

2017-04-20 Thread Scott Cheloha
Check whether or not getline(3) failed before exiting. It also couldn't hurt to close fp... especially given that we're freeing line, too, right before exit. Thoughts? -- Scott Cheloha Index: from.c === RCS file: /cvs/src/usr.bin/f

Re: vmd: "local prefix" for L3 interfaces

2017-04-20 Thread Mike Larkin
On Thu, Apr 20, 2017 at 10:03:52PM +0200, Reyk Floeter wrote: > Hi, > > the following diffs allows to change the prefix that is used to > allocated "local interface" (-L) subnets, which is 100.64.0.0/10 by > default. > > So you can just change it in vm.conf, eg. > local prefix 10.0.0.0/8 > > Mos

vmd: "local prefix" for L3 interfaces

2017-04-20 Thread Reyk Floeter
Hi, the following diffs allows to change the prefix that is used to allocated "local interface" (-L) subnets, which is 100.64.0.0/10 by default. So you can just change it in vm.conf, eg. local prefix 10.0.0.0/8 Most people should be fine with the default but sthen@ and chris@ asked for an option

Re: pledge(2): prof promise

2017-04-20 Thread Sebastien Marie
On Thu, Apr 20, 2017 at 12:08:02PM +0200, Sebastien Marie wrote: > > profil(2) syscall itself could be allowed in "stdio" with specifics > arguments: profil(NULL, 0, 0, 0) (but some code inspection should be > done before: extending "stdio" is not neutral - think to programs like > ssh or tcpdump

Re: pledge(2): prof promise

2017-04-20 Thread Sebastien Marie
On Thu, Apr 20, 2017 at 03:34:57AM -0600, Theo de Raadt wrote: > This proposal doesn't make any sense. > > What will you do. Add it to every program? Or add it to none of them? hep. it is a part of the problem I spotted :) > The underlying problem is that the syscall creates a file in some > r

Re: pledge(2): prof promise

2017-04-20 Thread Theo de Raadt
This proposal doesn't make any sense. What will you do. Add it to every program? Or add it to none of them? The underlying problem is that the syscall creates a file in some random place. You haven't handled that. > On Thu, Apr 20, 2017 at 09:52:58AM +0200, Sebastien Marie wrote: > > Could yo

Re: pledge(2): prof promise

2017-04-20 Thread Anton Lindqvist
On Thu, Apr 20, 2017 at 09:52:58AM +0200, Sebastien Marie wrote: > Could you send two separated diffs ? One for uint64_t stuff and another > for profil(2) ? Here's the prof diff. Thanks for the feedback, I will review it more closely later today. Index: lib/libc/sys/pledge.2 =

Re: pledge(2): prof promise

2017-04-20 Thread Anton Lindqvist
On Thu, Apr 20, 2017 at 09:52:58AM +0200, Sebastien Marie wrote: > Could you send two separated diffs ? One for uint64_t stuff and another > for profil(2) ? Coming up, first off the uint64_t diff. While at it, I propose changing the type of code in `struct ktr_pledge` to uint64_t for consistency a

Re: pledge(2): prof promise

2017-04-20 Thread Sebastien Marie
Hi, Could you send two separated diffs ? One for uint64_t stuff and another for profil(2) ? I agree that uint64_t change is required, but I need to deeper check the stuff for profil(2) :) For now, my initial feeling is adding a promise for profiling requires to patch the source code to be able t