relayd: add support for the MKCALENDAR HTTP method relayd is missing this method from the WebDAV/CalDAV extensions. This causes issues when using relayd as a reverse proxy in front of CalDAV servers like Nextcloud. OK kirill@

usr.sbin/relayd: support multiple resolveble addresses. relayd supports interface name, DNS hostname or interface group at listen on but it binds only to the first discovered IP address which is usually IPv4. Here I changed parser to create a dedicated listener for each discovered and confiugred on a local inerface address. This means that listen on egress port 80 binds to all IPv4 and IPv6 addresses on the egress group. OK: rsadowski@

relayd: allow explicit paths for certificates, keys and OCSP staples Extend the "keypair" keyword in relayd.conf to support optional explicit paths. Previously, relayd enforced a naming convention, looking up files in /etc/ssl and /etc/ssl/private based on the keypair name. This change allows other applications to manage their certificates without having to comply with relayd's internal naming logic. Input and OK kirill@, help form tb@

usr.sbin/relayd: add support for PROXY protocol in TCP relays patch from Christoph Liebender OK: rsadowski@

Slightly iprove a confusing wording in the parse.y manuals: The things that need quoting are not necessarily "argument names", and not even necessarily "names" at all, so just talk about "arguments". "I guess?" florian@ and no objection from otto@, both back in July 2025. Actually, the quoting rules are more complicated than the text makes believe, but i do not know how to better describe them. It may not be easy because some suspect the implementation may be somewhat adhoc rather than based on cleary defined lexical rules.

Make internal hyperlinking work by moving custom sections from .Sh to .Ss and the titles from all caps to sentence case such that they match the table of contents, and switch from .Sy to .Sx as needed. OK florian@

In the manual pages for configuration files based on parse.y, describe the syntax of both defining and using macros, rather than exclusively relying on examples, which some of the pages do not even provide. In those pages containing tables of content, also clarify that the "Macros" section contains *definitions* of variables. Both changes were already committed to vm.conf(5) earlier. In those few pages that referenced cpp(1) and m4(1), stop doing that because the macro definition syntax and the macro dereferencing syntax of both languages is totally different from the parse.y syntax. OK florian@, and deraadt also requests keeping these manuals in sync.

relayd: add support for client certificates This feature has been requested many times over the years. Various patches were provided by Asherah Connor, Rivo Nurges, Markus Läll and maybe others. These patches always stalled for various reasons. From Sören Tempel, mostly based on Asherah's latest patch. ok florian tb

add route-to example ok benno@

new sentence, new line

Change adds a 'log' option to relayd.conf(5) rule. The relayd(8) then uses the option to set corresponding `log` action in pf(4) rules it generates to handle network traffic. The patch comes from Giannis Kapetanakis (bilias _from_ edu.physics.uoc.gr). OK sashan@

Unmention/don't explain SSL, drop 9y old "ssl" keyword/deprecation warning Switch "ssl" to "tls" in relayd.conf(5) if you haven't done so in the last ten years, "ssl" is now an error. Say "TLS" not "SSL/TLS" and drop the primer in the TLS RELAYS section. OK benno

Make the tlsv1.0 and tlsv1.1 options in relayd do nothing Also document that fact, and that the existing ssl3 option does nothing. This changes relayd to no longer request tls1.0 or tls1.1 in preparation for the upcoming deprecation of these out of data protocols ok jsing@ bluhm@ tb@ claudio@ benno@

man pages: add missing commas between subordinate and main clauses jmc@ dislikes a comma before "then" in a conditional, so leave those untouched. ok jmc@

remove please from manual pages ok jmc@ sthen@ millert@

Add 'strip' directive Feedback by Olivier Cherrier, Hiltjo Posthuma, Mischa OK benno@

Use metrics instead of statistics. Also point people where in the tree they might be able to find said metrics. OK denis@ jmc@

support for session resumption in TLS1.3 does not exist yet, as confirmed by tb@. While there remove the "no" in front of the statement. text from tb@

session tickets are disabled by default, correct the manpage. ok claudio

Rewrite the agentx code of relayd. This new framework should allow us to add new objects easier if so desired and should handle a lot more corner-cases. This commit should also fix the following: - On most (all) tables it omits the *Entry elements, making it not map to OPENBSD-RELAYD-MIB.txt. - sstolen returns the size of the sockaddr_in{,6}, instead of the sin{,6}_addr resulting in garbage data to be put in the ip-field. - relaydSessionPortIn and relaydSessionPortOut are swapped - relaydSessions only uses relaydSessionIndex, while OPENBSD-RELAYD-MIB.txt says it should have 2 indices - miscellaneous minor things related to the AGENTX-protocol, like wonky index handeling and returning NOSUCHINSTANCE where NOSUCHOBJECT should be returned, etc. This commit does remove traps, but it's large enough as is and I intent on adding it soon(tm). It also deprecates the snmp keyword in favour of an agentx keyword. The snmp keyword is still available, but will be removed in the future. Tweaks and OK denis@ on the relayd parts Tweaks and OK claudio@ on the agentx parts "Get it in" deraadt@

Remove references to snmpd(8) now that agentx support has been removed. Prodded by and OK jmc@

Enable TLSv1.3 support in relayd(8) with the help from tb@ jsing@; ok tb@

Repair the description of "edh [params (none|auto|legacy)]" to configure EDH-based cipher suites with Perfect Forward Secrecy (PFS) for older clients that do not support ECDHE. Problem noticed and initial diff by Jesper Wallin, thanks! ok kn@

ce examples of "Ar arg Ar arg" with "Ar arg arg" and stop the spread;

briefly mention /etc/examples/ in the FILES section of all the manual pages that document the corresponding configuration files; OK jmc@, and general direction discussed with many