summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-02-13distrib: remove .comment section systematicallySebastien Marie
remove this section as part of crunchgen generated commands. it avoids calling "strip -R .comment" for some but not all architectures. ok deraadt@ danj@
2021-02-13distrib: remove .SUNW_ctf only on kernelsSebastien Marie
the .SUNW_ctf section is added by ctfstrip(1), which is only used for kernels. ok deraadt@ danj@
2021-02-13distrib: merge "cp a b; strip b" to "objcopy -S a b"Sebastien Marie
ok deraadt@ danj@
2021-02-13distrib: remove duplicate strip(1) callsSebastien Marie
"strip -R section" command run "strip" (without option) as well. there is no need to call both. (binaries checked with sha1) original diff from danj@ ok deraadt@
2021-02-13distrib: merge objcopy -Sg and strip commandsSebastien Marie
in the command "objcopy -Sg", the -g option (STRIP_DEBUG) overrides the -S option (STRIP_ALL). so it is the same as "objcopy -g". "strip" command without option is doing STRIP_ALL. merge the both commands to "objcopy -S" ok deraadt@ danj@
2021-02-13distrib: remove STRIPOPTS variable from alpha and sparc64 MakefileSebastien Marie
ok deraadt@ danj@
2021-02-13Revise cnmac(4)'s address filter setupVisa Hankala
Set up the DMAC filter in one go instead of doing it separately for unicast and multicast DMACs. This attempts to make the code a little more readable. The setup should now run a bit faster as well because it now does fewer register accesses. Tested on CN5020, CN6120 and CN7130.
2020-08-03Import LLVM 10.0.0 release including clang, lld and lldb.Patrick Wildt
ok hackroom tested by plenty
2021-02-13Add dynamic address configuration for roadwarrior clients.tobhe
The new 'iface' config option can be used to specify an interface for the virtual addresses received from the peer. Routes are automatically added based on the configured flows. Input from sthen@ and claudio@ ok patrick@
2021-02-13-h does not display version; from larry hynesJason McIntyre
2021-02-13readability fixes; from larry hynesJason McIntyre
2021-02-13various readability fixes; from larry hynesJason McIntyre
2021-02-13Fix some wrong comments and KNF/long line wrapsMike Larkin
2021-02-13Fix a commentMike Larkin
2021-02-13Remove trailing whitespaceMike Larkin
No code/functional change
2021-02-13various readability fixes; from larry hynesJason McIntyre
2021-02-13add some missing articles; from larry hynesJason McIntyre
2021-02-13readability fix; from larry hynesJason McIntyre
2021-02-13comma swap; from larry hynesJason McIntyre
2021-02-13change documented drm nodes to /dev/dri/ and mention powerpc64Jonathan Gray
2021-02-12Fix local and peer addresses in policy lookup for dangling SAstobhe
after ikectl reload. ok patrick@
2021-02-12syncTheo de Raadt
2021-02-12Some people still argue that rand(3) and random(3) have suitable deterministicTheo de Raadt
use cases, so explain the situation a bit more. Since the 80's, I estimate around 5 algorithm changes, so any chosen seed is unrepeatable UB. +The deterministic sequence algorithm changed a number of times since +original development, is underspecified, and should not be relied upon to +remain consistent between platforms and over time. ok jmc kettenis
2021-02-12pf_remove_divert_state() is an entry point into pf, modifying the pf statePatrick Wildt
table. Hence we have to grab both the pf lock and the pf state lock. Found by dlg@ ok bluhm@ sashan@
2021-02-12Xr to ssl(8) which has clues about EC key generation that are still usefulStuart Henderson
to acme-client users.
2021-02-12Tweak ssl(8)'s text about EC generation. Streamline by using "ecparamStuart Henderson
-genkey" rather than separately generating parameters and key. Give a clue that some CAs accept only prime256v1. Show the user where to stop if they're just generating a private key for acme-client and therefore don't need to generate a csr or cert manually. Add xr to acme-client(1) suggest by tb@. ok jmc tb
2021-02-12Fix null pointer dereference in pf_route6(). Embedding scope intoAlexander Bluhm
addresses that come from pf cannot be right, so remove the code. Coverity CID 1501718 OK dlg@ claudio@
2021-02-12Sync cert.pem with Mozilla NSS root CAs, except "GeoTrust Global CA", ok tb@Stuart Henderson
Notably this update removes various old Symantec roots (GeoTrust, thawte, VeriSign) that were set in NSS to be distrusted on 1/1/2021. Nobody should have been using these for years; only certain subCAs signed by these were valid in NSS in that time due to an exemption: https://wiki.mozilla.org/CA/Additional_Trust_Changes#Symantec Notably Apple's "Apple IST CA 2 - G1" which is still in use for some endpoints (it is cross signed by another CA too but these endpoints are publishing the GeoTrust intermediate cert). So for now I have skipped removal of "GeoTrust Global CA" to avoid affecting these sites. Debian ran into this when they updated their cert database and had to back this part out, affected sites are not reachable on Android Firefox and maybe other newer Firefoxes. Some sites that were affected have moved to a different CA in the last few days but others, notably api.push.apple.com, remain (I can only guess that there is a complicated problem involved, possibly cert pinning on old devices - the clock is ticking though as this expires in May 2022 anyway ;) Additions: /C=RO/O=CERTSIGN SA/OU=certSIGN ROOT CA G2 /C=HU/L=Budapest/O=Microsec Ltd./2.5.4.97=VATHU-23584497/CN=e-Szigno Root CA 2017 /C=KR/O=NAVER BUSINESS PLATFORM Corp./CN=NAVER Global Root Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global ECC P256 Certification Authority /C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Global ECC P384 Certification Authority Removals: /C=US/O=GeoTrust Inc./CN=GeoTrust Primary Certification Authority /C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA /C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA 2 /C=US/O=GeoTrust Inc./OU=(c) 2008 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G3 /C=TW/O=Government Root Certification Authority /C=LU/O=LuxTrust S.A./CN=LuxTrust Global Root 2 /C=US/O=thawte, Inc./OU=(c) 2007 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G2 /C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA /C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2008 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G3 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G3 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5 /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2007 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G4 /C=CH/O=WISeKey/OU=Copyright (c) 2005/OU=OISTE Foundation Endorsed/CN=OISTE WISeKey Global Root GA CA
2021-02-12A few more flag combo's to testOtto Moerbeek
2021-02-12syncJonathan Gray
2021-02-12create /dev/ drm nodes with the same names as linuxJonathan Gray
This was proposed by Emil Velikov to simplify libdrm and will remove the need for some patches in ports. /dev/drm0 -> /dev/dri/card0 /dev/drmR128 -> /dev/dri/renderD128 The previous names will remain for a period of time and will later be removed. Major and minor numbers remain the same. libdrm will not be changed to use the new names until known privsep and sandbox use has been updated to allow the new names. ok deraadt@
2021-02-12do not need 66 keys anymoreTheo de Raadt
2021-02-12Do not care about the server socket closing if exiting anyway.Nicholas Marriott
2021-02-12sftp: add missing lsetstat@openssh.com documentationDamien Miller
patch from Mike Frysinger
2021-02-12factor SSH_AGENT_CONSTRAIN_EXTENSION parsing into its own functionDamien Miller
and remove an unused variable; ok dtucker@
2021-02-11Call exuart(4) early attach on arm64.Patrick Wildt
ok kettenis@
2021-02-11Enable exuart(4).Patrick Wildt
ok kettenis@
2021-02-11Don't hardcode com(4)'s major number in exuart(4).Patrick Wildt
ok kettenis@
2021-02-11Explicitly unset IKED_REQ_CERTVALID before sending cert to ca process.tobhe
ok markus@
2021-02-11More route-to fallout in pfctl regress.Alexander Bluhm
2021-02-11sbdrop(): use NULL instead of 0 in pointer assignmentmvs
ok bluhm@
2021-02-11We link `ifp' to `if_list' before we perform if_attachsetup(). It is notmvs
fully initialized because we initialize `if_groups' after linking. It's not triggered because if_attach() and if_unit(9) are serialized by kernel lock and `ifp' is often filled by nulls. Move `if_groups' initialization to if_attach_common() to prevent this. ok bluhm@ claudio@ deraadt@
2021-02-11Link isakmpd dynamically. Mount /usr on NFS via IPsec does notAlexander Bluhm
work anyway. Dynamic binaries help building errata, reduce disk usage and make ROP harder. Also remove an unused bsd.subdir.mk include. OK sthen@ mvs@ deraadt@ tobhe@ patrick@
2021-02-11When clang was changed to -fcommon, perl's P_hash_{seed,state} variablesTheo de Raadt
moved into BSS in the .o, with padding rules following the types -- they are both char[]. Since P_hash_seed is (system-dependent) not a multiple of 8, P_hash_state gets layed out misaligned, which sucks because the hash functions demand 64-bit alignment for both variables. There is the possibility of using misalignment macros, but this is not cheap. Could also use kernel-trap fault repair, but the performance would really suck for something so crucial. The correct fix would be for upstream to declare these types as uint64[], we have requested that in https://github.com/Perl/perl5/issues/18555 In the meantime, carry a diff to roundup P_hash_seed to 64-bit alignment so that P_hash_state will land aligned. ok afresh1
2021-02-11Add missing break in switch statement of rge_activate().Stefan Sperling
CID 1501716 ok kevlo@ and mestre@ had the same diff
2021-02-11Leave out gp initialization from kernel entry on mips64Visa Hankala
On OpenBSD/mips64, the kernel is compiled with -mno-abicalls. This disables gp-relative addressing and essentially makes gp a spare register in the kernel. Hence it is unnecessary to initialize gp when entering the kernel. The _gp symbol is not needed either. Suggested by miod@
2021-02-11"proc: table is full" actually means thread table is full; ok mpi@ sthen@Otto Moerbeek
2021-02-11In the various open functions reduce the fdplock() to only span over theClaudio Jeker
function which need the lock (falloc, fdinsert, fdremove). In most cases it is not correct to hold the lock while calling VFS functions or e.g. closef since those aquire or release long lived VFS locks. OK visa@ mvs@
2021-02-11Initialize var since it's used in a condition a little bit afterwards.Ricardo Mestre
CID 1501713 ok jmatthew@
2021-02-11Initialize the stack local device id variable correctly.anton
CID 1501705
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 21:44:41 +0000