Add missing OCSP token Spotted and OK kirill

usr.sbin/relayd: support multiple resolveble addresses. relayd supports interface name, DNS hostname or interface group at listen on but it binds only to the first discovered IP address which is usually IPv4. Here I changed parser to create a dedicated listener for each discovered and confiugred on a local inerface address. This means that listen on egress port 80 binds to all IPv4 and IPv6 addresses on the egress group. OK: rsadowski@

relayd: allow explicit paths for certificates, keys and OCSP staples Extend the "keypair" keyword in relayd.conf to support optional explicit paths. Previously, relayd enforced a naming convention, looking up files in /etc/ssl and /etc/ssl/private based on the keypair name. This change allows other applications to manage their certificates without having to comply with relayd's internal naming logic. Input and OK kirill@, help form tb@

relayd: support TLS with multiple listeners Fix a bug in relay_inherit() which runs only relay_load_certfiles(conf, rb, NULL) unconditionally which isn't alligned with logic in parser when it parses relay block, where multiple certificates are load as relay_load_certfiles(conf, rb, NULL) only if here no tlscerts (for default host) and otherwise it loads keypairs. OK: rsadowski@

Set User-Agent for HTTP healthchecks Joel Carnat (Thanks) notice that GoToSocial does not like it when we sent no User-Agent and returns an HTTP/418. Lloyd pointed to use RELAYD_SERVERNAME instead hardcoded "relayd" OK sthen, claudio (diff without RELAYD_SERVERNAME)

Standardize logging with bgpd OK claudio@

usr.sbin/relayd: add support for PROXY protocol in TCP relays patch from Christoph Liebender OK: rsadowski@

relayd: add support for client certificates This feature has been requested many times over the years. Various patches were provided by Asherah Connor, Rivo Nurges, Markus Läll and maybe others. These patches always stalled for various reasons. From Sören Tempel, mostly based on Asherah's latest patch. ok florian tb

relayd: improve config validation with -n pf's rule names are limited by 32 characters, so lower the length bounds for redirect names and tags that relayd accepts as valid config but would later fail to load into pf. Also display the offending name on error. from Mark Johnston ok florian

Change adds a 'log' option to relayd.conf(5) rule. The relayd(8) then uses the option to set corresponding `log` action in pf(4) rules it generates to handle network traffic. The patch comes from Giannis Kapetanakis (bilias _from_ edu.physics.uoc.gr). OK sashan@

Unmention/don't explain SSL, drop 9y old "ssl" keyword/deprecation warning Switch "ssl" to "tls" in relayd.conf(5) if you haven't done so in the last ten years, "ssl" is now an error. Say "TLS" not "SSL/TLS" and drop the primer in the TLS RELAYS section. OK benno

Use ibuf_data() instead of accessing ibuf->buf directly. OK tb@

Don't declare variables as "unsigned char *" that are passed to functions that take "char *" arguments. Where such chars are assigned to int or passed to ctype functions, explicitly cast them to unsigned char. For OpenBSD's clang, -Wpointer-sign has been disabled by default, but when the parse.y code was built elsewhere, the compiler would complain. With help from millert@ ok benno@ deraadt@

Don't leak host address. Found with clang static analyzer. OK tb@

Add 'strip' directive Feedback by Olivier Cherrier, Hiltjo Posthuma, Mischa OK benno@

getifaddrs() can return entries where ifa_addr is NULL. Check for this before accessing anything in ifa_addr. ok claudio@

Remove deprecated snmp keyword. OK denis@

Let relayd make use of libagentx. No functional change intended. OK tb@ Enthousiasm from Mischa Peters

Remove trailing spaces & tabs

Rewrite the agentx code of relayd. This new framework should allow us to add new objects easier if so desired and should handle a lot more corner-cases. This commit should also fix the following: - On most (all) tables it omits the *Entry elements, making it not map to OPENBSD-RELAYD-MIB.txt. - sstolen returns the size of the sockaddr_in{,6}, instead of the sin{,6}_addr resulting in garbage data to be put in the ip-field. - relaydSessionPortIn and relaydSessionPortOut are swapped - relaydSessions only uses relaydSessionIndex, while OPENBSD-RELAYD-MIB.txt says it should have 2 indices - miscellaneous minor things related to the AGENTX-protocol, like wonky index handeling and returning NOSUCHINSTANCE where NOSUCHOBJECT should be returned, etc. This commit does remove traps, but it's large enough as is and I intent on adding it soon(tm). It also deprecates the snmp keyword in favour of an agentx keyword. The snmp keyword is still available, but will be removed in the future. Tweaks and OK denis@ on the relayd parts Tweaks and OK claudio@ on the agentx parts "Get it in" deraadt@

Enable TLSv1.3 support in relayd(8) with the help from tb@ jsing@; ok tb@

improve parsing of relay {} sections: - Do not accept multiple protocol statements, as only one will be used, it is better to error out if more arespecified. - do not allow tcp and http options in dns protocol definitions, they are ignored anyway. Suggested by Nick (nick -AT- kousu -DOT- ca) thanks. ok claudio@

remove old log options 'log update/all' that were replaced with 'log state changes/host checks/connection' some time ago. ok reyk@ claudio@ on first version, kn@ noticed that the tokens could be removed too.

Add support for binary protocol health checking. Feedback and guidance from benno@ and reky@. Man page tweaks from jmc@. ok benno@

fix error description on invalid forward ip. OK benno@