Commit Graph

2606 Commits

Author SHA1 Message Date
Denys Vlasenko
7a18b9502a tls: reorder tls_handshake_data fields for smaller size, tweak comments
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-23 16:37:04 +01:00
Denys Vlasenko
b5bf1913d3 tls: send EMPTY_RENEGOTIATION_INFO_SCSV in our client hello
Hoped this can make cdn.kernel.org to like us more. Nope.
While at it, made error reporting more useful.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-23 16:12:17 +01:00
Denys Vlasenko
9492da7e63 tls: set TLS_DEBUG to 0; placate a gcc indentation warning
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-23 01:15:13 +01:00
Denys Vlasenko
9a647c326a separate TLS code into a library, use in in wget
A new applet, ssl_client, is the TLS debug thing now.
It doubles as wget's NOMMU helper.
In MMU mode, wget still forks, but then directly calls TLS code,
without execing.

This can also be applied to sendmail/popmail (SMTPS / SMTP+starttls support)
and nc --ssl (ncat, nmap's nc clone, has such option).

function                                             old     new   delta
tls_handshake                                          -    1691   +1691
tls_run_copy_loop                                      -     443    +443
ssl_client_main                                        -     128    +128
packed_usage                                       30978   31007     +29
wget_main                                           2508    2535     +27
applet_names                                        2553    2560      +7
...
xwrite_encrypted                                     360     342     -18
tls_main                                            2127       -   -2127
------------------------------------------------------------------------------
(add/remove: 4/1 grow/shrink: 13/8 up/down: 2351/-2195)       Total: 156 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-23 01:08:16 +01:00
Denys Vlasenko
12389889c0 ip: better --help
Was:
    Usage: ip [OPTIONS] address|route|link|tunnel|neigh|rule [COMMAND]

    ip [OPTIONS] OBJECT [COMMAND]
    where OBJECT := address|route|link|tunnel|neigh|rule
    OPTIONS := -f[amily] inet|inet6|link | -o[neline]

User: instead of repeating list of OBJECTs twice, you could at least
show available COMMANDs...

Now:
    Usage: ip [OPTIONS] address|route|link|tunnel|neigh|rule [COMMAND]

    OPTIONS := -f[amily] inet|inet6|link | -o[neline]
    COMMAND :=
    ip addr add|del IFADDR dev IFACE | show|flush [dev IFACE] [to PREFIX]
    ip route list|flush|add|del|change|append|replace|test ROUTE
    ip link set IFACE [up|down] [arp on|off] | show [IFACE]
    ip tunnel add|change|del|show [NAME]
        [mode ipip|gre|sit]
        [remote ADDR] [local ADDR] [ttl TTL]
    ip neigh show|flush [to PREFIX] [dev DEV] [nud STATE]
    ip rule [list] | add|del SELECTOR ACTION

While at it, tweak tc --help too (it stays disabled, thus no effect)

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-21 14:27:07 +01:00
Denys Vlasenko
8908c1d4f5 more ip --help fixes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-21 03:56:46 +01:00
Denys Vlasenko
f3d705f41b make --help texts smaller
function                                             old     new   delta
packed_usage                                       31035   30968     -67

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-21 03:46:57 +01:00
Denys Vlasenko
bbc7bee966 make --help texts more uniform
function                                             old     new   delta
packed_usage                                       31062   31035     -27

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-21 02:49:58 +01:00
Denys Vlasenko
f6e20724d4 tls: reorder tls_state fields for smaller offsets
function                                             old     new   delta
xwrite_encrypted                                     363     360      -3
xwrite_and_update_handshake_hash                     117     114      -3
tls_xread_handshake_block                             72      69      -3
tls_error_die                                        211     202      -9
tls_get_outbuf                                        64      49     -15
tls_main                                            2163    2127     -36
tls_xread_record                                     702     639     -63
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 0/7 up/down: 0/-132)           Total: -132 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-21 02:08:34 +01:00
Denys Vlasenko
dd2577f21a tls: send SNI in the client hello
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-20 22:48:41 +01:00
Denys Vlasenko
0af5265180 tls: check size on "MAC-only, no crypt" code path too
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-20 21:23:10 +01:00
Denys Vlasenko
54b927d78b tls: AES decrypt does one unnecessary memmove
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-20 21:19:38 +01:00
Denys Vlasenko
3916139ac4 tls: make input buffer grow as needed
As it turns out, it goes only up to "inbuf_size:4608"
for kernel.org - fixed 18kb buffer was x4 larger than necessary.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-20 20:27:06 +01:00
Denys Vlasenko
38972a8df1 tls: improve i/o loop
With tls_has_buffered_record(), entire kernel.org response
is printed at once, without 6 second pause to see its delayed EOF.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-20 19:11:14 +01:00
Denys Vlasenko
e7863f394e tls: was psAesDecrypt'ing one block too many, trashing buffered data
For the first time

printf "GET / HTTP/1.1\r\nHost: kernel.org\r\n\r\n" | ./busybox tls kernel.org

successfully reads entire server response and TLS shutdown.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-20 18:04:04 +01:00
Denys Vlasenko
179e88bec9 rdate: make it do something remotely sane, facing 32-bit time overflow
function                                             old     new   delta
rdate_main                                           251     254      +3
packed_usage                                       31029   31023      -6

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-20 16:03:48 +01:00
Denys Vlasenko
19e695ebad tls: do not use common_bufsiz
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-20 14:27:58 +01:00
Denys Vlasenko
a0aae9f714 tls: decode alerts and in particular, EOF alert.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-20 14:12:10 +01:00
Denys Vlasenko
abbf17abcc tls: add the i/o loop - largish rework of i/o buffering
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-20 03:15:09 +01:00
Denys Vlasenko
f7806f9d8f tls: fix ROL/ROR x86 optimization
ALWAYS_INLINE:

function                                             old     new   delta
psAesInitKey                                         825     824      -1
ROR                                                    5       -      -5
setup_mix2                                           148     134     -14
psAesDecryptBlock                                   1184    1139     -45
psAesEncryptBlock                                   1193    1102     -91
------------------------------------------------------------------------------
(add/remove: 0/1 grow/shrink: 0/4 up/down: 0/-156)           Total: -156 bytes

ALWAYS_INLINE + __builtin_constant_p(shift_cnt):

function                                             old     new   delta
ROR                                                    5       -      -5
psAesInitKey                                         825     818      -7
setup_mix2                                           148     123     -25
psAesDecryptBlock                                   1184    1078    -106
psAesEncryptBlock                                   1193    1017    -176
------------------------------------------------------------------------------
(add/remove: 0/1 grow/shrink: 0/4 up/down: 0/-319)           Total: -319 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-19 16:45:41 +01:00
Denys Vlasenko
432f1ae2ff tls: tested PSTM_X86_64, not enabling it - too large
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-19 16:32:38 +01:00
Denys Vlasenko
6b1b004845 tls: commented out psPool_t use
function                                             old     new   delta
psAesEncrypt                                         159     162      +3
der_binary_to_pstm                                    42      40      -2
xwrite_and_hash                                      437     434      -3
xread_tls_block                                      446     443      -3
pstm_div_2d                                          449     444      -5
psAesDecrypt                                         179     174      -5
pstm_init_size                                        52      45      -7
pstm_init                                             46      39      -7
pstm_to_unsigned_bin                                 165     157      -8
tls_main                                            1265    1256      -9
pstm_mulmod                                          132     123      -9
pstm_mod                                             125     116      -9
pstm_init_copy                                        93      84      -9
psAesInitKey                                         840     825     -15
send_client_key_exchange                             362     342     -20
psAesInit                                            103      80     -23
psRsaEncryptPub                                      429     403     -26
psAesDecryptBlock                                   1211    1184     -27
psAesEncryptBlock                                   1223    1193     -30
pstm_exptmod                                        1582    1524     -58
pstm_div                                            1557    1472     -85
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 1/20 up/down: 3/-360)          Total: -357 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-19 15:51:00 +01:00
Denys Vlasenko
1bfc4b85a7 ntpd: print result of hostname resolution
This is particularly useful if hostname resolution is triggered by
host non-reachability: I saw this in real-life, without the message
it is not at all obvious that IP that we use for a specific host
has changed.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-19 14:42:34 +01:00
Denys Vlasenko
cccf8e735d tls: teach it to decrypt AES256-encrypted data
This adds decryption only.
There is no MAC verification, code simply throws away MAC.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-19 00:20:45 +01:00
Denys Vlasenko
a9e1866806 tls: trim comments
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-18 21:00:23 +01:00
Denys Vlasenko
b5dfc3dfd6 tls: teach it to send AES256-encrypted data
>> CLIENT_HELLO
wrote 50 bytes
insize:0 tail:0
got block len:74
got HANDSHAKE
<< SERVER_HELLO
insize:79 tail:0
got block len:2397
got HANDSHAKE
<< CERTIFICATE
key bytes:271, first:0x00
server_rsa_pub_key.size:256
insize:2402 tail:0
got block len:4
got HANDSHAKE
<< SERVER_HELLO_DONE
>> CLIENT_KEY_EXCHANGE
wrote 267 bytes
master secret:c51df5b1e3b3f57373cdd8ea28e8ce562059636cf9f585d0b89c7f4bacec97e674d7b91f93e7b500cb64637f240c3b78
client_write_MAC_key:3b0b7e2bab241b629c37eb3a3824f09b39fe71a00876b0c8026dda16ef0d2f82
client_write_key:d36e801470ed2f0a8fc886ac25df57ffbe4265d06e3192122c4ef4df1e32fab2
>> CHANGE_CIPHER_SPEC
from secret: c51df5b1e3b3f57373cdd8ea28e8ce562059636cf9f585d0b89c7f4bacec97e674d7b91f93e7b500cb64637f240c3b78
from labelSeed: 636c69656e742066696e6973686564b22e0e6008b8ee218cc02e4a93e4a42b570535f9b57662e262d43b379d125b69
=> digest: a45bfee8ed6507a2a9920d0c
>> FINISHED
before crypt: 5 hdr + 16 data + 32 hash bytes
writing 5 + 16 IV + 64 encrypted bytes, padding_length:0x0f
wrote 85 bytes
insize:9 tail:0
got block len:1
<< CHANGE_CIPHER_SPEC
insize:6 tail:0
got block len:80
< hdr_type:22 ver:3.3 len:80 type:21 len24:9541723 |1591985b...a3da|

The last line is the server's FINISHED response, encrypted.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-18 20:37:24 +01:00
Denys Vlasenko
b7e9ae6e9f tls: added AES code and made it compile. not used yet
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-18 17:20:27 +01:00
Denys Vlasenko
c8ba23bcec tls: massage writing for encryption support; finer-grained debug
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-18 06:45:50 +01:00
Denys Vlasenko
5d1662ea1c tls: address one easy FIXME, tidy up comments
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-17 18:17:27 +01:00
Denys Vlasenko
e69d78c038 tls: process CHANGE_CIPHER_SPEC and FINISHED from server
Successfully finishes handshake with test servers using NULL-SHA256
cipher.

The "only" thing remaining before there is a chance
this can actually work with real servers is AES encrypt/decrypt.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-17 17:24:11 +01:00
Denys Vlasenko
fe0588df3b tls: rearrange function order, improve comments
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-17 17:04:24 +01:00
Denys Vlasenko
e2cb3b990f tls: make our send_client_finished() pass server check
sha256 hash should be calculated over incoming handshake packets too!

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-17 16:53:36 +01:00
Denys Vlasenko
9a6897a48a tls: format FINISHED message properly for unencrypted, but sha256 signed mode
Now it at least looks correct, but unfortunately "openssl s_server"
says my hash is wrong.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-16 23:26:33 +01:00
Denys Vlasenko
4e08a123b0 Assorted warning fixes and added a comment, no code changes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-16 17:31:05 +01:00
Denys Vlasenko
936e83e694 tls: add sha256 hmac and prf code
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-16 04:25:01 +01:00
Denys Vlasenko
3f8ecd933a tls: rearrange code, add/improve comments, fix whitespace, no real changes here
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 14:16:51 +01:00
Denys Vlasenko
c5540d61f6 tls: send CHANGE_CIPHER_SPEC
To "actually implement it" will take more work...

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 02:17:03 +01:00
Denys Vlasenko
f78ad0938b whitespace fix
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 00:18:22 +01:00
Denys Vlasenko
11d0096516 tls: format and send CLIENT_KEY_EXCHANGE
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4265
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8b217a7:0x30 len:1452 inner_byte @0x8b217ab:0x30
entered der @0x8b217ab:0x30 len:1172 inner_byte @0x8b217af:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8b218b4:0x30 len:418 inner_byte @0x8b218b8:0x30
skipped der 0x30, next byte 0x03
entered der @0x8b218c7:0x03 len:399 inner_byte @0x8b218cb:0x00
key bytes:399, first:0x00
entered der @0x8b218cc:0x30 len:394 inner_byte @0x8b218d0:0x02
binary bytes:385, first:0x00
skipped der 0x02, next byte 0x02
binary bytes:3, first:0x01
server_rsa_pub_key.size:384
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE
insize:9 tail:0
^C

Next step: send CHANGE_CIPHER_SPEC... and actually implement it.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-15 00:12:42 +01:00
Denys Vlasenko
2a17d1fc9b tls: DER length byte 0x81 is actually valid
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-14 22:38:25 +01:00
Denys Vlasenko
b1003f7019 tls: a bit more work
$ ./busybox tls kernel.org
insize:0 tail:0
got block len:74
got HANDSHAKE
got SERVER_HELLO
insize:79 tail:4406
got block len:4392
got HANDSHAKE
got CERTIFICATE
entered der @0x8f7e723:0x30 len:1452 inner_byte @0x8f7e727:0x30
entered der @0x8f7e727:0x30 len:1172 inner_byte @0x8f7e72b:0xa0
skipped der 0xa0, next byte 0x02
skipped der 0x02, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
skipped der 0x30, next byte 0x30
entered der @0x8f7e830:0x30 len:418 inner_byte @0x8f7e834:0x30
skipped der 0x30, next byte 0x03
entered der @0x8f7e843:0x03 len:399 inner_byte @0x8f7e847:0x00
copying key bytes:399, first:0x00
insize:4397 tail:9
got block len:4
got SERVER_HELLO_DONE

Now need to teach it to send ClientKeyExchange...

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-14 13:57:16 +01:00
Denys Vlasenko
ceff6b0ea9 tls: work-in-progress TLS1.2 test applet
function                                             old     new   delta
tls_main                                               -     733    +733
dump                                                   -     230    +230
xread_tls_block                                        -     180    +180
get_der_len                                            -      76     +76
enter_der_item                                         -      70     +70
skip_der_item                                          -      56     +56
get24be                                                -      24     +24
tls_error_die                                          -      19     +19
packed_usage                                       31010   31027     +17
applet_names                                        2549    2553      +4
applet_main                                         1472    1476      +4
applet_suid                                           92      93      +1
applet_install_loc                                   184     185      +1
------------------------------------------------------------------------------
(add/remove: 9/0 grow/shrink: 5/0 up/down: 1415/0)           Total: 1415 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-14 12:49:32 +01:00
Denys Vlasenko
a6f8651911 wget: fix for brain-damaged HTTP servers. Closes 9471
write(3, "GET / HTTP/1.1\r\nUser-Agent: Wget\r\nConnection: close\r\n\r\n", 74) = 74
shutdown(3, SHUT_WR)    = 0
alarm(900)              = 900
read(3, "", 1024)       = 0
write(2, "wget: error getting response\n", 29) = 29
exit(1)

The peer simply does not return anything. It closes its connection.

Probably it detects wget closing its writing end: shutdown(3, SHUT_WR).

The point it, closing write side of the socket is _valid_ for HTTP.
wget sent the full request, it won't be sending anything more:
it will only receive the response, and that's it.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-11 20:16:45 +01:00
Denys Vlasenko
ed15dde60a Move FEATURE_AUTOWIDTH config option to two applets which use it
No code changes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-11 16:35:52 +01:00
Denys Vlasenko
f560422fa0 Big cleanup in config help and description
Redundant help texts (one which only repeats the description)
are deleted.

Descriptions and help texts are trimmed.

Some config options are moved, even across menus.

No config option _names_ are changed.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-10 14:58:54 +01:00
Laurent Bercot
0ef478f01b httpd: fix address family for reverse proxy client socket
When httpd proxies a request to another server, it first creates
an AF_INET socket, then resolves the server name to a sockaddr,
then connects to it. This fails if the server name resolves to
an IPv6 address.

This patch ensures that the socket is created with the correct
address family (AF_INET6 if the server resolves to an IPv6 address
and AF_INET otherwise).

Signed-off-by: Laurent Bercot <ska-dietlibc@skarnet.org>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-08 15:14:38 +01:00
Natanael Copa
b62ea34afe ntpd: improve postponed hostname resolution
Run the namelookup from the main loop so a misspelled first ntp server
name does not block everything forever.

This fixes the following situation which would block forever:
  $ sudo ./busybox ntpd -dn -p foobar  -p pool.ntp.org
  ntpd: bad address 'foobar'
  ntpd: bad address 'foobar'
  ntpd: bad address 'foobar'
  ...

New behavior:
  ntpd: bad address 'foobar'
  ntpd: sending query to 137.190.2.4
  ntpd: reply from 137.190.2.4: offset:-1.009775 delay:0.175550 status:0x24 strat:1 refid:0x00535047 rootdelay:0.000000 reach:0x01
  ntpd: sending query to 137.190.2.4
  ntpd: reply from 137.190.2.4: offset:-1.009605 delay:0.175461 status:0x24 strat:1 refid:0x00535047 rootdelay:0.000000 reach:0x03
  ntpd: sending query to 137.190.2.4
  ntpd: reply from 137.190.2.4: offset:-1.005327 delay:0.167027 status:0x24 strat:1 refid:0x00535047 rootdelay:0.000000 reach:0x07
  ntpd: sending query to 137.190.2.4
  ntpd: bad address 'foobar'
  ntpd: reply from 137.190.2.4: offset:-1.046349 delay:0.248705 status:0x24 strat:1 refid:0x00535047 rootdelay:0.000000 reach:0x0f

This patch is based on Kaarle Ritvanens work.
http://lists.busybox.net/pipermail/busybox/2016-May/084197.html

function                                             old     new   delta
ntpd_main                                           1061    1079     +18
ntp_init                                             556     560      +4
resolve_peer_hostname                                 81      75      -6
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 2/1 up/down: 22/-6)              Total: 16 bytes

Signed-off-by: Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi>
Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-06 16:21:09 +01:00
Denys Vlasenko
c6137ba510 udhcp: tweak config order and menu item names
All other applets are listed simply by their name, no reason why
dumpleases doesn't do that.

Group all udhcpd feature options directly after it.

Put "NOT READY" into udhcpc6 item (some users actually tried to use it,
and complained).

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-04 12:13:38 +01:00
Jörg Krause
c6725b0af6 Fix dependency for IFUPDOWN_UDHCPC_CMD_OPTIONS
Commit a8c696bf09 makes ifup and ifdown
individually selectable, but forgets to update the dependency to
IFUPDOWN_UDHCPC_CMD_OPTIONS, so it is not selectable anymore.

This patch fixes the dependency by checking for IFUP or IFDOWN, instead
of the obsolete IFUPDOWN.

Also, it drops dependency on UDHCPC: udhcpc on the target system
does not have to come from the _same_ binary.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-03 12:29:52 +01:00
Denys Vlasenko
7890035452 tcpudp: define SO_ORIGINAL_DST directly, not via include
musl does not like including linux/netfilter_ipv4.h
(enum / #define collision in two headers, resulting in "3 = 3"
type situation in enum definition).

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-02 10:46:08 +01:00
Denys Vlasenko
100aea8486 Remove FEATURE_IFUPDOWN_IP_BUILTIN and FEATURE_IFUPDOWN_IFCONFIG_BUILTIN
They merely enable ip or ifconfig/route. There is already a way to do this
on the same menuconfig page.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-12-23 15:20:16 +01:00
Denys Vlasenko
9cc3d3ab21 fix breakage found by mass one-applet builds
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-12-23 02:42:26 +01:00
Denys Vlasenko
7c5dea399b ip: make ip aliases individually selectable
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-12-22 22:30:13 +01:00
Denys Vlasenko
5d27cb3640 Make POST upload example script easier to use
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-12-22 15:33:11 +01:00
Denys Vlasenko
4acd393eba Update information on building httpd and wget helpers
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-12-22 15:13:37 +01:00
Lukasz Nowak
b42107f215 libiproute: handle table ids larger than 255
Linux kernel, starting from 2.6.19 allows ip table ids to have 32-bit values.
In order to preserve compatibility, the old 8-bit field: rtm_table is still
in use when table id is lower than 256.

Add support for the 32-bit table id (RTA_TABLE attribute) in:
- ip route print
- ip route modify
- ip rule print
- ip rule modify

Add printing of table ids to ip route.

Changes are compatible with the mainline iproute2 utilities.

These changes are required for compatibility with ConnMan, which by default
uses table ids greater than 255.

function                                             old     new   delta
print_route                                         1588    1637     +49
do_iproute                                          2187    2222     +35
do_iprule                                            955     987     +32
print_rule                                           617     630     +13
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 4/0 up/down: 129/0)             Total: 129 bytes

Signed-off-by: Lukasz Nowak <lnowak@tycoint.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-12-18 18:56:49 +01:00
Denys Vlasenko
1d3a04a3a4 Code style fixes, no code changes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-11-28 01:22:57 +01:00
Denys Vlasenko
f7683cdf83 Convert all udhcp applets to "new style" applet definitions
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-11-23 18:54:59 +01:00
Denys Vlasenko
29e2c45a5b tc: consolidate its disabled bits
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-11-23 09:51:33 +01:00
Denys Vlasenko
8342397801 Make ping6 and traceroute6 selectable independently from ping/traceroute
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-11-23 09:25:57 +01:00
Denys Vlasenko
6bfab0c49f ipneigh: add this shortcur similar to other "ip <CMD>" shortcuts
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-11-23 09:18:05 +01:00
Denys Vlasenko
3148e0c05b Rename FEATURE_FTP_WRITE and FEATURE_FTP_AUTHENTICATION to *_FTPD_*
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-11-23 09:07:44 +01:00
Denys Vlasenko
47367e1d50 Convert all networking/* applets to "new style" applet definitions
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-11-23 09:05:14 +01:00
Denys Vlasenko
9f8eb1ee76 httpd: explain why we use sprintf and why it should be fine
While at it, fix a pathological case where it is not fine:
-r REALM with some 8-kbyte long REALM would overflow the buffer.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-11-22 02:23:35 +01:00
Denys Vlasenko
a8c696bf09 Make ifup and ifdown individually selectable.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-11-14 18:31:07 +01:00
Denys Vlasenko
67fd2f2858 dnsdomainname: split it from "hostname", make it independently selectable
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-11-13 22:35:10 +01:00
Denys Vlasenko
f11c6989ba udhcpc: check read of overload option data byte to be within packet
function                                             old     new   delta
udhcp_get_option                                     220     225      +5

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-25 14:26:36 +02:00
Brian Foley
f9beeb22e2 udhcpc: check read of option length byte to be within packet
function                                             old     new   delta
udhcp_get_option                                     215     220      +5
udhcp_run_script                                     802     803      +1

Signed-off-by: Brian Foley <bpfoley@google.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-25 14:20:55 +02:00
Denys Vlasenko
662634b829 telnetd: ifdef out a buggy error handling code path
Here, not handling the error is would just eat one input 0xff char.
Correct handling would need even more corner case handling,
as-is buggy handling corrupts the buffer.
Since we just been told by kernel that pty is ready,
EAGAIN should not be happening here anyway.

function                                             old     new   delta
telnetd_main                                        1798    1785     -13

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-13 16:17:06 +02:00
Denys Vlasenko
57727d478d telnet: code shrink
put_iac2(w,c) is mostly used with constants, fold them into one arg

function                                             old     new   delta
put_iac2_merged                                        -      46     +46
telnet_main                                         1603    1583     -20
con_escape                                           285     257     -28
put_iac2                                              50       -     -50
------------------------------------------------------------------------------
(add/remove: 1/1 grow/shrink: 0/2 up/down: 46/-98)            Total: -52 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-12 20:42:58 +02:00
Denys Vlasenko
26d88d6bbd telnetd: add another handshake example in comments, no code changes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-12 20:09:22 +02:00
Denys Vlasenko
b6d421b635 telnetd: treat all 2-byte IACs in 240..249 range as NOPs.
A bit of future-proofing. Some of them can stand just being ignored.

function                                             old     new   delta
telnetd_main                                        1791    1798      +7

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-12 19:41:33 +02:00
Denys Vlasenko
122c47ac02 telnetd: fix corner case of input processing of 0xff bytes
I managed to reproduce the bug, with some difficulty.

function                                             old     new   delta
telnetd_main                                        1780    1791     +11

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-12 19:13:46 +02:00
Denys Vlasenko
0190c41bb2 telnetd: fix a corner case where CRLF->CR translation can misbehave
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-12 17:36:57 +02:00
Denys Vlasenko
2a54b3e86e telnetd: fix handling of short writes to pty
If a write to pty is short, remove_iacs() can be run on a buffer repeatedly.
This, for example, can eat 0xff chars (IACs, in telnet terms).

Rework the logic to handle IACs in a special "write to pty" function.

function                                             old     new   delta
telnetd_main                                        1662    1750     +88

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-12 14:54:10 +02:00
Denys Vlasenko
3720a61daf ifupdown: rewrite state file atomically
By user's request.
Decided to not use fcntl(F_SETLKW) in lieu of problems with locking
on networked filesystems. The existence of /var/run/ifstate.new
is treated as a write lock. rename() provides atomicity.

function                                             old     new   delta
ifupdown_main                                       1019    1122    +103

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-09 23:04:16 +02:00
Denys Vlasenko
ec1ea16337 tcpsvd: don't keep shared fd open if fd limit is reached. closes 9331
Also, much improved help text.

function                                             old     new   delta
packed_usage                                       30652   30851    +199
tcpudpsvd_main                                      1782    1784      +2

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-07 15:56:47 +02:00
Denys Vlasenko
2972e2c4ac wget: there is no -s option in GNU Wget 1.18, we should be compatible
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-04 04:23:09 +02:00
Denys Vlasenko
a85740c8af dhcp: merge leases.c and static_leases.c into dhcpd.c
function                                             old     new   delta
send_offer                                           292     461    +169
udhcpd_main                                         1531    1588     +57
read_leases                                          330     332      +2
add_lease                                            314     312      -2
find_lease_by_mac                                     68       -     -68
find_free_or_expired_nip                             174       -    -174
------------------------------------------------------------------------------
(add/remove: 0/4 grow/shrink: 3/1 up/down: 228/-244)          Total: -16 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-04 00:56:58 +02:00
Denys Vlasenko
d2ae66cb3e dhcp: merge most of static_leases.c into dhcpd.c
function                                             old     new   delta
read_staticlease                                     121     222    +101
add_static_lease                                      48       -     -48
log_static_leases                                     68       -     -68
------------------------------------------------------------------------------
(add/remove: 0/2 grow/shrink: 1/0 up/down: 101/-116)          Total: -15 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-04 00:56:58 +02:00
Denys Vlasenko
2bf2931d52 dhcp: merge files.c into dhcpd.c
Added NOINLINE to two function, since my version of gcc would actualy increase
code size otherwise.

I see no size changes.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-10-04 00:56:58 +02:00
Denys Vlasenko
1c32e49bdf traceroute: cleanup and fixes for packet size calculations
Remove FEATURE_TRACEROUTE_SOURCE_ROUTE: it's off by default, and
source routing is not used in real world.

Tested that "traceroute -n ::1 100" and "traceroute -n 127.0.0.1 100"
both send 100 byte IP packets (this matches what traceroute on Fedora
Rawhide is doing).

function                                             old     new   delta
common_traceroute_main                              3731    3738      +7

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-09-28 18:44:48 +02:00
Denys Vlasenko
bcf47eaa1f ifupdown: improve help text, add comment about run-parts error msg
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-09-25 02:05:24 +02:00
Denys Vlasenko
92d98f0612 ifupdown: when flushing addresses with "ip", add label %label%
User report:

or our board we setup eth0:0 on a 10.10.10.x/29 netwrok.

The problem is ip addr flush dev eth0:0 removes all ip addresses from
eth0.  You can see this if you run
ip -stat -stat addr flush dev eth0:0

2: eth0    inet 172.27.105.10/22 brd 172.27.107.255 scope global eth0
       valid_lft forever preferred_lft forever
2: eth0    inet 10.10.10.9/29 scope global eth0:0
       valid_lft forever preferred_lft forever
2: eth0    inet6 fe80::a2f6:fdff:fe18:2b13/64 scope link
       valid_lft forever preferred_lft forever

*** Round 1, deleting 3 addresses ***
*** Flush is complete after 1 round ***

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-09-20 17:31:11 +02:00
Hauke Mehrtens
4ff86df861 libnetlink: fix alignment of netlink messages
A padding to align a message should not only be added between
different attributes of a netlink message, but also at the end of the
message to pad it to the correct size.

Without this patch the following command does not work and returns an
error code:
ip link add type nlmon

Without this ip from busybox sends this:

sendmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000},
	msg_namelen=12, msg_iov=[{iov_base={{len=45, ...},
		"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\22\0\t\0\1nlmon"}, iov_len=45}],
	msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 45
return value: 2

The normal ip utile from iproute2 sends this:

sendmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000},
	msg_namelen=12, msg_iov=[{iov_base={{len=48, ...},
		"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\22\0\t\0\1nlmon\0\0\0"}, iov_len=48}],
	msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48
return value: 0

With this patch ip from busybox sends this:

sendmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000},
	msg_namelen=12, msg_iov=[{iov_base={{len=48, ...},
		"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\22\0\t\0\1nlmon\0\0\0"}, iov_len=48}],
	msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48
return value: 0

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-09-18 22:55:47 +02:00
Denys Vlasenko
ef15970d7e *: placate some compile warnings on OSX
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-09-01 11:16:22 +02:00
Denys Vlasenko
9ff910de6b wget: treat 201,202,203 as success codes too. Closes 9211
This matches "standard" wget.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-08-31 13:28:53 +02:00
Peter Korsgaard
b6355e2bb5 udhcpc: Unconditionally call deconfig script, not only if lease is active
The udhcpc script may be used to setup fallback configuration (E.G. IPv4LL,
fixed IP address, ..) that also needs to be cleaned up on release (E.G.
when SIGUSR2 is called or on shutdown with -R), so unconditionally call
deconfig.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-08-26 18:46:34 +02:00
Denys Vlasenko
de3da6bf87 wget/ssl_helper: update to wolfssl-3.9.8
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-08-21 03:39:39 +02:00
Denys Vlasenko
b11be131b7 ifplugd: if SIOCSIFFLAGS fails with ENODEV, don't die
Some user managed to hit a race where iface is gone between SIOCGIFFLAGS
and SIOCSIFFLAGS (!). If SIOCSIFFLAGS fails, treat it the same as failed
SIOCGIFFLAGS

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-08-16 20:39:52 +02:00
Denys Vlasenko
4548293799 libiproute: eliminate some redundant zero stores
function                                             old     new   delta
do_iprule                                            974     955     -19
rtnl_dump_request                                    173     146     -27
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 0/2 up/down: 0/-46)             Total: -46 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-08-14 02:08:56 +02:00
Denys Vlasenko
34ecc3b7ae ip: fix an improper optimization: req.r.rtm_scope may be nonzero here
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-08-14 01:30:34 +02:00
Miroslav Lichvar
150dc7a2b4 ntpd: respond only to client and symmetric active packets
The busybox NTP implementation doesn't check the NTP mode of packets
received on the server port and responds to any packet with the right
size. This includes responses from another NTP server. An attacker can
send a packet with a spoofed source address in order to create an
infinite loop of responses between two busybox NTP servers. Adding
more packets to the loop increases the traffic between the servers
until one of them has a fully loaded CPU and/or network.

Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-08-01 20:25:06 +02:00
Denys Vlasenko
ed72761843 wget: run s_client helper with -servername HOST
This is necessary for multi-hosted TLSed web sites.

function                                             old     new   delta
spawn_https_helper_openssl                           334     441    +107

Based on a patch by Jeremy Chadwick <jdc@koitsu.org>

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-07-25 21:34:57 +02:00
Denys Vlasenko
9d20297ba8 ssl_helper.sh: strip was invoked incorrectly
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-07-25 17:12:46 +02:00
Denys Vlasenko
e695ac97fd typo fixes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-07-19 17:48:55 +02:00
Denys Vlasenko
237bedd499 getopt32: add new syntax of 'o:+' and 'o:*' for -o NUM and -o LIST
In many cases, this aqllows to drop use of opt_complementary.
Approximately -400 bytes:

function                                             old     new   delta
getopt32                                            1423    1502     +79
opt_string                                            17      18      +1
OPT_STR                                               24      25      +1
uniq_main                                            416     406     -10
timeout_main                                         279     269     -10
sulogin_main                                         270     260     -10
readprofile_main                                    1825    1815     -10
ps_main                                              543     533     -10
pidof_main                                           245     235     -10
pgrep_main                                           611     601     -10
od_main                                             2600    2590     -10
mkfs_minix_main                                     2684    2674     -10
mkfs_ext2_main                                      2603    2593     -10
microcom_main                                        712     702     -10
makemime_main                                        315     305     -10
ionice_main                                          282     272     -10
inetd_main                                          2074    2064     -10
ifplugd_main                                        1144    1134     -10
halt_main                                            353     343     -10
getopt_main                                          636     626     -10
fdisk_main                                          2854    2844     -10
env_main                                             206     196     -10
dmesg_main                                           319     309     -10
conspy_main                                         1214    1204     -10
awk_main                                             981     971     -10
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 3/22 up/down: 81/-220)         Total: -139 bytes
   text	   data	    bss	    dec	    hex	filename
 919373	    906	  14060	 934339	  e41c3	busybox_old
 918969	    906	  14060	 933935	  e402f	busybox_unstripped

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-07-06 21:58:02 +02:00
Denys Vlasenko
0844b5afe2 whois: implement -i
function                                             old     new   delta
whois_main                                           654     675     +21
packed_usage                                       30355   30356      +1

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-07-06 17:16:27 +02:00
Denys Vlasenko
1035c92e2d whois: make it actually work
It was doing way too simplistic work of just querying the server,
no redirects, no query massaging. This required user to know a lot about whois,
and enter at least three queries for each host to get meaningful information.

function                                             old     new   delta
whois_main                                           209     646    +437

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-07-06 15:45:41 +02:00
Denys Vlasenko
ee772a0d90 arp: fix buffer overflow. Closes 9071
function                                             old     new   delta
arp_main                                            1910    1898     -12

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2016-07-04 17:38:01 +02:00