summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-09-14Mechanically replace isc_boolean_t with int.Florian Obser
OK deraadt
2020-09-14Bunch of dead stores and otherwise unused stuff lets us get rid ofFlorian Obser
unix/net.{c.h}. We need to sprinkle in a few #includes that net.h dragged in. OK deraadt
2020-09-14Rewrite isc_time_microdiff() as uelapsed() and put it directlyFlorian Obser
into dig sources, lets us get rid of unix/time.{c,h} OK deraadt
2020-09-14re-enable new x509 chain verifier as the defaultBob Beck
ok tb@
2020-09-14Correctly fix double free introduced on review.Bob Beck
the roots for a ctx are only freed in the free function, not in the clear function, so that a ctx can be re-used with the same roots. ok tb@
2020-09-14No need to check for NULL before calling free.Martijn van Duren
from miod@
2020-09-14Fix double free - review moved the pop_free of roots to x509_verify_ctx_freeBob Beck
so we don't need to pop free the roots separately
2020-09-14revert previous, need to fix a problemBob Beck
2020-09-14Fix comment, ktrace flags are per-process.Martin Pieuchot
2020-09-14Enable the use of the new x509 chain validator by default.Bob Beck
ok jsing@ tb@
2020-09-14syncTheo de Raadt
2020-09-14Connect a client to a server. Both can be current libressl, orAlexander Bluhm
openssl 1.0.2, or openssl 1.1. Pin client or server to a fixed TLS version number. Incompatible versions must fail. Check that client and server have used correct version by grepping in their session print out.
2020-09-13Add regress for SSL_{CTX_,}set_ciphersuites().Joel Sing
2020-09-13Implement SSL_{CTX_,}set_ciphersuites().Joel Sing
OpenSSL added a separate API for configuring TLSv1.3 ciphersuites. Provide this API, while retaining the current behaviour of being able to configure TLSv1.3 via the existing interface. Note that this is not currently exposed in the headers/exported symbols. ok beck@ inoguchi@ tb@
2020-09-13Adapt regress to IFS splitting correction (eval.c -r1.66)Theo Buehler
From Martijn Dekker
2020-09-13Fix "$@" splitting with empty IFSTheo Buehler
One uncommon but useful way of writing shell scripts is to start off by disabling field/word splitting (IFS='') and pathname expansion/globbing (set -f), re-enabling either or both only for the commands that need them, e.g. within a subshell. This helps avoid a lot of snags with field splitting and globbing if you forget to quote a variable somewhere, adding to the general robustness of a script. (In fact it eliminates much of the need to quote variable/parameter expansions, with empty removal remaining as the only issue.) Unfortunately OpenBSD ksh (like all pdksh variants except mksh) has a POSIX compliance bug that is a show stopper for this approach: "$@" does not generate words (arguments) if IFS is empty. As a result, the separate command arguments represented by "$@" become a single argument. So passing on an intact set of positional parameters to a command or function is impossible with field splitting disabled. Of course this is illogical: the quoted special parameter "$@" generates zero or more words, it doesn't split any words, so the contents of IFS (or lack thereof) should be neither here nor there. It's old ksh88 behaviour copied by the original pdksh, but it violates POSIX and it has been fixed many years ago in ksh93 and all other POSIX shells. From Martijn Dekker (who also wrote the above paragraphs) back in 2016. Thanks to Avi Halachmi for reminding us of the issue. ok czarkoff deraadt kn
2020-09-13Add new x509 certificate chain validator in x509_verify.cBob Beck
The new validator finds multiple validated chains to handle the modern PKI cases which may frequently have multiple paths via different intermediates to different roots. It is loosely based on golang's x509 validator This includes integration so that the new validator can be used via X509_verify_cert() as well as a new api x509_verify() which will return multiple chains (similar to go). The new validator is not enabled by default with this commit, this will be changed in a follow on commit. The new public API is not yet exposed, and will be finalized and exposed with a man page and a library minor bump later. ok tb@ inoguchi@ jsing@
2020-09-13Improve handling of BIO_read()/BIO_write() failures in the TLSv1.3 stack.Joel Sing
When BIO returns a failure, it does not always add an error to the error stack. In the case of the legacy stack, this was generally handled by the guesswork performed by SSL_get_error(). However, in the case of the new stack we push an 'unknown' error onto the stack. Improve this situation by specifically checking errno in the case of a BIO_read() or BIO_write() failure. If the error stack is empty then push a SYSerror() with the errno which is preferable to the 'unknown' error later. Noted by bluhm@ via syslogd regress. ok beck@ tb@
2020-09-13unbreak dt-enabled builds; it seems an unrelated change snuck in in -r1.3Jasper Lievisse Adriaanse
also noticed by semarie@
2020-09-13Always use READ(16)/WRITE(16) commands for disks large enough to requireKenneth R Westerback
READ(16)/WRITE(16) to access the last sectors Fixes (at least) large 512E (a.k.a. emulated 512-byte sector) devices plugged into overly helpful USB <-> ATA/ATAPI bridges. Which can tell you they are using 512-byte sector addresses but spontaneously/silently interpret READ(10)/WRITE(10) commands as using 4K sector addresses/sizes. Diagnosed and fix tested with James Cook. Thanks!
2020-09-13The SMC base address and i/o region size is now queried by acpi(4) andMarcus Glocker
doesn't need to be hard coded anymore.
2020-09-13use drm_cache.c from linux 5.7.yJonathan Gray
ok kettenis@
2020-09-13Unbreak tree. Instead of passing struct process to siginit() just pass theClaudio Jeker
struct sigacts since that is the only thing that is modified by siginit.
2020-09-13Spell out n as en for consistency with other parts of the page.Theo Buehler
2020-09-13change pmap wbinvd use to wbinvd_on_all_cpusJonathan Gray
with this we can revert the recent coherency workaround in mesa ok deraadt@ kettenis@
2020-09-13%lln is percent ell ell n (not dee).Claudio Jeker
OK deraadt@
2020-09-13add an ipi for wbinvd and a linux style wbinvd_on_all_cpus() functionJonathan Gray
ok kettenis@ deraadt@
2020-09-13More tests for policy matching via dstid.tobhe
2020-09-13Install /etc/examples/login_ldap.conf with proper mode and ownership.Antoine Jacoutot
tweak from deraadt@ ok martijn@ tb@
2020-09-13Start documenting locks for struct pppoe_softc memberskn
Pretty much all members are under the net lock, some are proctected by both net and kernel lock, e.g. the start routine is called with KERNEL_LOCK(). OK mpi
2020-09-13sort SEE ALSO;Jason McIntyre
2020-09-13Fix various typos in wscons(4) comments.Frederic Cambus
2020-09-13Include <sys/systm.h> directly instead of relying on uvm_map.h to pull it.Martin Pieuchot
2020-09-13Install login_ldap.conf and register it into changelist and mtree/special.Antoine Jacoutot
ok tb@ (who had the same diff) & deraadt@
2020-09-13Test for failure on dstid mismatch.tobhe
2020-09-13Add run-psk-fail test to check for failure on psk mismatch.tobhe
2020-09-13Grep the KERNEL_LOCK in ktrpsig() before calling ktrwrite(). AnotherClaudio Jeker
little step towards moving signal delivery outside of KERNEL_LOCK. OK mpi@
2020-09-13Refactor config setup boilerplate to allow asymmetric test setups.tobhe
Return _ret from TEST_FLOWS to allow known-negative tests.
2020-09-13Initialize sigacts0 before making them visible by setting ps->ps_sigacts.Claudio Jeker
OK mpi@
2020-09-13Get rid of isc_parse_uint32() and replace it with strtonum.Florian Obser
While here use the standard strtonum error messages. input & OK beck, OK kn
2020-09-13remove unused lex statesFlorian Obser
2020-09-13remove unused LEX_OPTsFlorian Obser
2020-09-13No need to refcount the parser, we never hold more than one reference.Florian Obser
2020-09-13add SRBDS cpuid bitsJonathan Gray
2020-09-13Add support for the RK3308 MAC.Jonathan Matthew
ok kettenis@
2020-09-13Correct the property name used to look up the delays for the phy resetJonathan Matthew
process. ok kettenis@ as part of a larger diff
2020-09-12Keep port interface UP on removalkn
There is no reason to change flags on member interfaces when removing them, aggr(4) does not pull its members down either. OK florian bluhm
2020-09-12Let snmp df make use of the new displayhint code, so we don't print randomMartijn van Duren
garbage to the description column if the server gives us that. OK jan@
2020-09-12link btrace(8) to the buildSebastien Marie
Please note that dt(4) still need manual enabling in the kernel. ok deraadt@ sthen@ mpi@
2020-09-12Use the correct type for tls1_set_ec_id()Theo Buehler
The curve_id is a uint16, not an int. ok beck jsing
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-29 17:41:23 +0000