summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-06-28Implement ssl{,_ctx}_security()Theo Buehler
ok beck jsing sthen
2022-06-28Copy the security level stuff in ssl_cert_dup()Theo Buehler
ok beck jsing sthen
2022-06-28Set up the default callback in SSL_CERTTheo Buehler
ok beck jsing sthen
2022-06-28Implement the default security level callbackTheo Buehler
And here is where the fun starts. The tentacles will grow everywhere. ok beck jsing sthen
2022-06-28Provide OPENSSL_TLS_SECURITY_LEVEL defineTheo Buehler
ok beck jsing sthen
2022-06-28Implement SSL_{CTX_}_{g,s}et_security_level(3)Theo Buehler
ok beck jsing sthen
2022-06-28Add security callback, level and ex_data fields to SSL_CERTTheo Buehler
ok beck jsing sthen
2022-06-28Add #defines and prototypes for security level APITheo Buehler
This marks the start of one of the worst API additions in the history of this library. And as everybody knows the bar is high. Very high. ok beck jsing sthen
2022-06-28Add missing colon. Noticed by jmc@Claudio Jeker
2022-06-28On the x13s, using the EfiLoaderData memory type for the memory blockMark Kettenis
that we load the kernel into doesn't work. But changing it to EfiLoaderCode makes it work. Presumably the firmware creates a mapping with executable permissions in that case, which is obviously needed for executing kernel code. ok patrick@, mlarkin@
2022-06-28The x13s uses Memory32Fixed() to describe the windows forwarded by theMark Kettenis
host bridges. Add support for this. ok mlarkin@, patrick@
2022-06-28Negate unsigned then cast to signed.Joel Sing
Avoid undefined behaviour by negating the unsigned value, before casting to int64_t, rather than casting to int64_t then negating. Fixes oss-fuzz #48499 ok tb@
2022-06-28Make sure uvm_swap_get() always sleep and do not return and error.Martin Pieuchot
If no memory was immediately available to decrypt (bounce) a page from swap an error was returned to the fault handler which would result in processes dying when a lot of memory pressure was applied to a system. Note that reading from swap is always done synchronously. ok beck@, kettenis@
2022-06-28Consider pmemrange regions when trying to free pages from the inactive list.Martin Pieuchot
Instead of starting with the first page on the inactive list pick the first one that fits in the range of a given pmemrange region. Fix an issue where the page daemon would be hogging a CPU without freeing any page because the global limits are satisfied. The algorithm could certainly be revisited, the LRU is not really working and there is a huge delay before recovering when the first pages need to be swapped and the system is in OOM situation but at least there is no starvation and the system now recovers. ok beck@, kettenis@
2022-06-28Use new & shiny define for the maximum number of pages of a swap cluster.Martin Pieuchot
ok beck@, kettenis@
2022-06-28Pre-allocate pages in DMA-reachable region to ensure progress in the swapper.Martin Pieuchot
Currently swap encryption is not done in place and some architectures need to bounce pages into a DMA-reachable region for I/Os, for that uvm_swap_io() needs to allocate at most 64K to write a swap cluster to disk. Pre-allocate such amount of memory to be sure the page daemon can make progress in OOM situation. Also introduce a sleeping point to wait for the previous asynchronous I/O holding the pre-allocated pages, there's no point in building clusters if no progress can be made. ok beck@, kettenis@
2022-06-28Reserve a second segment for the page daemon.Martin Pieuchot
This ensures uvm_swap_io() can succeeds even in OOM situations because two uvm_pagermapin() allocations, requiring a segment each, are needed to bounce or encrypt a swap cluster. ok beck@, kettenis@
2022-06-28Hook up bgplgd into the buildClaudio Jeker
2022-06-28Hook up bgplgd. Uses _bgplgd user with id 71:71 add a rc.d script andClaudio Jeker
all the other rc plumbing. OK deraadt@
2022-06-28Fix manpage from jmc@ but also fix the privdrop user to _bgplgdClaudio Jeker
2022-06-28A com_acpi_softc pointer is used as the interrupt callback cookie whichAnton Lindqvist
is later on interpreted as a com_softc pointer. This is not a problem in practice as a com_softc structure is the first member of the com_acpi_softc structure. Using the actual types consistently yields a better symmetry in my opinion between registering the interrupt and the corresponding interrupt handler. ok deraadt@ kettenis@
2022-06-28No need to pass a copy of the bcmdmac_channel structure to predicateAnton Lindqvist
routines. ok deraadt@ kettenis@
2022-06-28Remove commented out variables and excessive blank lines inAnton Lindqvist
pluart_param().
2022-06-28Add bgplgd a fastcgi daemon that provide a REST JSON api to bgpctl.Claudio Jeker
Most code stolen from slowcgi, it just exec bgpctl with -j. Put it in tb@ deraadt@
2022-06-28Don't call pipex_rele_session() when `session' is NULL.Vitaliy Makkoveev
Reported by Hrvoje Popovski. ok bluhm@
2022-06-28Take away bogus error assignment before callback call.Bob Beck
Keep the depth which was needed. This went an error too far, and broke openssl-ruby's callback and error code sensitivity in it's tests. With this removed, both my newly committed regress to verify the same error codes and depths in the callback, and openssl-ruby's tests pass again. ok tb@
2022-06-28Botan 2.19.2 has removed support for the OpenSSL crypto provider.Alexander Bluhm
It was incompatible with OpenSSL 3.0. Remove the regression test to check that LibreSSL crypto works with Botan tests. This is better than to keep an outdated Botan in ports. discussed with tb@ beck@
2022-06-28Move debug-only variable 'i' to be with the other debug-onlyKenneth R Westerback
variables inside the #ifdef DEBUG block using them.
2022-06-28Adapt netstat kvm code to ref count change in struct rtentry.Alexander Bluhm
found by otto@ the hard way
2022-06-28Free ciphers before assigning to themTheo Buehler
While this is not a leak currently, it definitely looks like one. Pointed out by jsing on review of a diff that touched the vicinity a while ago. ok jsing
2022-06-28Remove unused field d_poll from struct cdevsw.Visa Hankala
OK miod@ mpi@
2022-06-28fix syncookies in conjunction with tcp fast port reuse.Henning Brauer
This really pointed out that the place syncookies were hooked in was almost, but not completely right. The way it was the special case for tcp fast port reuse in pf_test_state wasn't hit, because the first packet hitting that was the ACK from the peer finishing the 3WHS, and the reconstructed SYN came after. We're now doing pf_find_state (and *only* that) first, then syncookies, then going on so that the old state is thrown away properly and we get a new one with the sequence number modulator set up correctly Bonus: -11 lines of code tracked down (that took a while) + fixed under contract with Hush Communications Canada; special thanks to Lyndon ok sashan
2022-06-28unbreak build; found the hard way by stspFlorian Obser
2022-06-28syncTheo de Raadt
2022-06-28a start at qualcomm productsTheo de Raadt
2022-06-28rewrite amd64 printing of cache detailsJonathan Gray
Previously we looked at cpuid 0x80000005 for L1/TLB details which Intel documents as reserved. And cpuid 0x80000006 for L2 details. Intel also encode cache details in cpuid 4. AMD have mostly the same encoding with cpuid 0x8000001d 0x80000005/0x80000006 is used as a fallback. Prompted by Intel Tiger Lake and Alder Lake machines returning an associativity value of 7 from cpuid 0x80000006. The previous code would print "disabled L2 cache", 7 is documented by Intel as "See CPUID leaf 04H, sub-leaf 2". tested by Hrvoje Popovski on EPYC 7413, and myself on various machines ok mlarkin@
2022-06-28Move the guts of uvm_aio_aiodone() into a separate function.Martin Pieuchot
This will help dealing with error cases. No functionnal changes.
2022-06-28Don't ask the vlan question unless another network interface exists. ok deraadtStuart Henderson
Avoids a confusing question when no supported network devices is found, i.e. "Available network interfaces are: vlan0. Which network interface do you wish to configure? (or 'done') [vlan0]"
2022-06-28Cleanup the sleep loop in single_thread_check_locked(). The deep checksClaudio Jeker
only matter on entry and the pr->ps_single check is done in the while body. With and OK mpi@
2022-06-28Try to document 'announce policy' and add RFC 9234 to the list in bgpd.8Claudio Jeker
How RFC 9234 support will work in the long run may still change but for now at least tell people how to use it.
2022-06-28The default state of enhanced refresh is no. So flip logic.Claudio Jeker
Fixes config regress. Found by anton@, discussed with tb@
2022-06-28Check for entries in the suberror names arrays that are NULL. Handle themClaudio Jeker
like other unknown ones. Also KNF the code a bit. Was OK tb@ some time ago
2022-06-28Do not clean PG_BUSY before calling uvm_anon_release().Martin Pieuchot
Fix an assertion reported by gkoehler@. ok kettenis@
2022-06-28Do not consider adjacent pages when doing a CoW.Martin Pieuchot
Those pages should already be entered, this speeds up CoW faults. Stolen from NetBSD. ok miod@, kettenis@
2022-06-28Use refcnt API for struct rtentry instead of hand-crafted atomicAlexander Bluhm
operations. OK mvs@
2022-06-28ifconfig(8) return "Not supported" if you try to configure tso on a non-tsoJan Klemkow
supported interface. pointed out by bluhm@ OK bluhm@
2022-06-28Use btrace(8) to debug reference counting. dt(4) provides a staticAlexander Bluhm
tracepoint for each type of refcnt we have. As a start, add inpcb and tdb refcnt. When the counter changes, btrace may print the actual object, the current counter, the change value and optionally the stack trace. discussed with visa@; OK mpi@
2022-06-28gc timeout_count, it's unused and I don't remember what I wanted toFlorian Obser
use it for.
2022-06-28Use smi_string2oid instead of ober_string2oid in parse.y's oid definition.Martijn van Duren
This allows admins to configure oids as pretty symbolic names, next to the current numeric names. OK sthen@
2022-06-28if we can't open the user db, don't try to read from a closed fhMarc Espie