relayd: reject obs-fold to prevent parser differentials (RFC 9112 5.2) Replace silent kv_extend normalisation with an unconditional reject. RFC 9112 5.2 permits rejection; it is safer than SP replacement for a forwarding proxy and handles both request and response direction. kv_extend is therefore no longer required. Reported by Stuart Thomas, OK kirill@

relayd: allow explicit paths for certificates, keys and OCSP staples Extend the "keypair" keyword in relayd.conf to support optional explicit paths. Previously, relayd enforced a naming convention, looking up files in /etc/ssl and /etc/ssl/private based on the keypair name. This change allows other applications to manage their certificates without having to comply with relayd's internal naming logic. Input and OK kirill@, help form tb@

Standardize logging with bgpd OK claudio@

usr.sbin/relayd: add support for PROXY protocol in TCP relays patch from Christoph Liebender OK: rsadowski@

relayd: add support for client certificates This feature has been requested many times over the years. Various patches were provided by Asherah Connor, Rivo Nurges, Markus Läll and maybe others. These patches always stalled for various reasons. From Sören Tempel, mostly based on Asherah's latest patch. ok florian tb

remove unused struct

relayd: improve config validation with -n pf's rule names are limited by 32 characters, so lower the length bounds for redirect names and tags that relayd accepts as valid config but would later fail to load into pf. Also display the offending name on error. from Mark Johnston ok florian

Change adds a 'log' option to relayd.conf(5) rule. The relayd(8) then uses the option to set corresponding `log` action in pf(4) rules it generates to handle network traffic. The patch comes from Giannis Kapetanakis (bilias _from_ edu.physics.uoc.gr). OK sashan@

remove prototypes with no matching function

remove ssl_init() it's a noop; nowadays both LibreSSL and OpenSSL libcrypto and libssl initialize themselves automatically before doing anything. ok tb

Simplify and clean up the code. Try to use more ibuf idioms but the mix of types used in these functions make this rather hard. The expected data checks are still not great but a step in the right direction. OK tb@

relayd(8): change agentx_getsock to return void Only has one return value and it's never checked. ok martijn@, tb@

The output of server_root_strip() is a string. Use the correct format "%s". Same for the output of relay_expand_http(). with and ok claudio@ Found by Cedric Tessier, thanks!

Move TAILQ initialization to files where they are used. These priv-sep daemons all follow a similar design and use TAILQs for tracking control process connections. In most cases, the TAILQs are initialized separate from where they are used. Since the scope of use is generally confined to a specific control process file, this commit also removes any extern definitions and exposing the TAILQ structures to other compilation units. ok bluhm@, tb@

Timed out RSA key ops, may leave uncalled for responses in the imsg return path. These have to be dropped or every subsequent call will cause decrypt errors. Use a sequence number cookie to keep the systems in sync. Diff from niklas@ with some minor adjustments by myself.

remove bogus key hack now that it's handled by libtls no objection claudio@ ok tb@ jsing@

these programs (with common ancestry) had a -fno-common problem related to privsep_procid. ok mortimer

Add 'strip' directive Feedback by Olivier Cherrier, Hiltjo Posthuma, Mischa OK benno@

Rewrite the agentx code of relayd. This new framework should allow us to add new objects easier if so desired and should handle a lot more corner-cases. This commit should also fix the following: - On most (all) tables it omits the *Entry elements, making it not map to OPENBSD-RELAYD-MIB.txt. - sstolen returns the size of the sockaddr_in{,6}, instead of the sin{,6}_addr resulting in garbage data to be put in the ip-field. - relaydSessionPortIn and relaydSessionPortOut are swapped - relaydSessions only uses relaydSessionIndex, while OPENBSD-RELAYD-MIB.txt says it should have 2 indices - miscellaneous minor things related to the AGENTX-protocol, like wonky index handeling and returning NOSUCHINSTANCE where NOSUCHOBJECT should be returned, etc. This commit does remove traps, but it's large enough as is and I intent on adding it soon(tm). It also deprecates the snmp keyword in favour of an agentx keyword. The snmp keyword is still available, but will be removed in the future. Tweaks and OK denis@ on the relayd parts Tweaks and OK claudio@ on the agentx parts "Get it in" deraadt@

Enable TLSv1.3 support in relayd(8) with the help from tb@ jsing@; ok tb@

Add support for binary protocol health checking. Feedback and guidance from benno@ and reky@. Man page tweaks from jmc@. ok benno@

Add support for OCSP stapling Many thanks to Bruno Flueckiger who independently sent a very similar patch. He also tested the one I'm committing that it works as expected. OK tb@

Add support for SNI with new "tls keypair" option to load additional certs. Tested by many (thanks!) Feedback & OK rob@

Move the relay keys/certs into a separate global list and look them up by id. Moving the certs out of the relay struct will help to add multiple SNI certs. Tested by many users (thanks!) Feedback & OK rob@

Move relay_load_*() functions into relayd.c Pass the *env as an explicit argument instead of using the global pointer: The relay_load_certfiles() function is called early before the *env is set up. This does not change anything in the current code as *env is not used by anything in the function (not even ssl_load_key() that is taking it as an argument) but it will be needed by upcoming changes for SNI. Ok rob@