summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-12-04Check DH public key in ssl_kex_peer_public_dhe().Joel Sing
Call DH_check_pub_key() after decoding the peer public key - this will be needed for the server DHE key exchange, but also benefits the client. ok inoguchi@ tb@
2021-12-04Send out dstid as initiator if configured. This makes it easier forTobias Heider
the responder to match the correct policy if multiple are available. ok patrick@
2021-12-04Free cert, key and ocsp_staple on exit of do_keypair_test().Theo Buehler
Reported by Ilya Shipitsine, discussed with jsing
2021-12-04Convert main into single exit to appease asan.Theo Buehler
2021-12-04Explicitly free EVP_MD_CTX to appease asan. Reported by Ilya Shipitsin.Theo Buehler
2021-12-04list backup files created by adduser; from leon fischerJason McIntyre
adjust list width to make it all fit
2021-12-04update the firmware file list, helped by stsp;Jason McIntyre
2021-12-04Consolidate error paths in usbd_new_device, shaving of 14 lines.Anton Lindqvist
ok bluhm@
2021-12-04Do not setup pipes between SERVER processes, they don't talk to eachFlorian Obser
other. Since this generates a full mesh, the amount of filedescriptors needed grows quadratically with the amount of configured prefork processes. Might fix an out of filedescriptor bug that beck is seeing. OK benno
2021-12-04Add regress for ECPKParameters ASN.1 encoding/decoding.Joel Sing
2021-12-04RSA/SHA-1 is not used by default anymore on the serverChristian Weisgerber
2021-12-03add Allwinner H6 supportSASANO Takayoshi
ok kettenis@
2021-12-03support AXP805 PMICSASANO Takayoshi
ok kettenis@
2021-12-03- support I2C connected PMIC, add "early 1" to sxitwi.SASANO Takayoshi
- support axppmic via iic ok kettenis@
2021-12-03Add tdb_delete_locked() to replace duplicate tdb deletion code inTobias Heider
pfkey_flush(). ok bluhm@ mvs@
2021-12-03Perform DMA address translation if required.Mark Kettenis
ok patrick@
2021-12-03Replace asn1_tlc_clear and asn1_tlc_clear_nc macros with a function.Joel Sing
Call the replacement asn1_tlc_invalidate() since it does not actually clear the ASN1_TLC. While here, name the ASN1_TLC variables consistently as ctx, remove a pointless comment and simplify ASN1_item_d2i() slightly. ok inoguchi@ tb@
2021-12-03Group and sort includes.Joel Sing
2021-12-03Call asn1_item_ex_d2i() directly from ASN1_item_d2i()Joel Sing
ASN1_item_ex_d2i() is just a wrapper around the internal asn1_item_ex_d2i() function, so call asn1_item_ex_d2i() directly. ok inoguchi@ tb@
2021-12-03Add TDB reference counting to ipsp_spd_lookup(). If an outputAlexander Bluhm
pointer is passed to the function, it will return a refcounted TDB. The ref happens when ipsp_spd_inp() copies the pointer from ipo->ipo_tdb. The caller of ipsp_spd_lookup() has to unref after using it. tested by Hrvoje Popovski; OK mvs@ tobhe@
2021-12-03Convert ASN1_PCTX_new() to calloc().Joel Sing
Rather than using malloc() and then initialising all struct members to zero values, use calloc(). ok schwarze@ tb@
2021-12-03Use calloc() for X509_CRL_METHOD_new() instead of malloc().Joel Sing
This ensures that if any members are added to this struct, they will be initialised. ok schwarze@ tb@
2021-12-03Rewrite ASN1_STRING_cmp().Joel Sing
This removes nested ifs and uses more sensible variable names. ok schwarze@ tb@
2021-12-03Convert ASN1_STRING_type_new() to calloc().Joel Sing
Rather than using malloc() and then initialising all struct members, use calloc() and only initialise the single non-zero value member. ok schwarze@ tb@
2021-12-03Convert ASN1_OBJECT_new() to calloc().Joel Sing
Rather than using malloc() and then initialising all struct members, use calloc() and only initialise the single non-zero value member. ok schwarze@ tb@
2021-12-03Convert {i2d,d2i}_{,EC_,DSA_,RSA_}PUBKEY{,_bio,_fp}() to templated ASN1Joel Sing
These functions previously used the old ASN1_{d2i,i2d}_{bio,fp}() interfaces. ok inoguchi@ tb@
2021-12-03Fixed-size NOFILE_MAX (from sys/param.h of course) array is crazy, soTheo de Raadt
rewrite to expand the array as needed. ok tb
2021-12-03Switch iwx(4) to new -67 firmware images.Stefan Sperling
iwx-firmware-20211101 must be installed with fw_update(1) before booting a new kernel. sysupgrade(8) will take care of this. Intel has published a related security advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00509.html iwx(4) devices which are using the iwx-Qu-c0-hr-b0-63 image did not receive a firmware update. I have no idea why. Tested: ax200: jmc, stsp, Matthias Schmidt ax201: fkr, stsp
2021-12-03Use calloc() in EVP_PKEY_meth_new() instead of malloc() and settingTheo Buehler
almost all members to 0. Just set the two things that need setting. ok jsing
2021-12-03Fix EVP_PKEY_{asn1,meth}_copy once and for allTheo Buehler
It is very easy to forget to copy over newly added methods. Everyone working in this corner has run into this. Instead, preserve what needs preserving and use a struct copy, so all methods get copied from src to dest. tweak/ok jsing
2021-12-03Revert previousKlemens Nanni
Those scripts are not hooked up to the build yet; I assumed they were without checking, my bad. Reminded by deraadt
2021-12-03Disable probe requests during scans in iwx(4) again.Stefan Sperling
While this is working well for many, some people see device timeouts when using the device unless we disable probe requests during scans. The issue was a lot more visible on iwx(4) with earlier firmware. In fact, iwx(4) did ship with probe requests disabled for most of its existence. I re-enabled them along with a firmware upgrade since I no longer saw the problem. However, the issue prevails for other people. I still have no idea what is causing this. I have already spent enough time trying to track down a proper fix. Unless we receive help from someone who knows about firmware internals the best we can do is trial and error. The problem also existed on iwm(4) 9k devices which we now run with probe requests disabled, too. The only upside of probe requests is that scans can complete faster, with the downside of a potential privacy leak (the previously selected SSID is exposed). So, overall, we do not lose much here. Patch tested for a week by Laurence Tratt who is no longer seeing device timeouts which were relatively frequent before.
2021-12-03Apply the same MAX_IP_SIZE limit to ROA files as it is done on certificates.Claudio Jeker
OK job@ tb@
2021-12-03Implement a bgscan_done() handler for iwm(4).Stefan Sperling
Required to prevent breakage of roaming with new Intel firmware on 9k devices. Tested: 8265: Aaron Poffenberger, stsp 9260: florian 9560: sthen
2021-12-03Implement a bgscan_done() handler for iwx(4).Stefan Sperling
Fixes roaming-related hangs observed by jmc@. Tested: ax200: jmc, stsp
2021-12-03Introduce an optional driver-specific bgscan_done() handler whichStefan Sperling
allows the driver to take control of the roaming teardown sequence. This handler allows drivers to ensure that race conditions between firmware state and net80211 state are avoided, and will be used by the iwm(4) and iwx(4) drivers soon. Split the existing roaming teardown sequence into two steps, one step for tearing down Tx block ack sessions which sends a DELBA frame, and a second step for flushing Tx rings followed by sending a DEAUTH frame. We used to queue both frames, expecting to switch APs once both were sent. Now we effectively expect everything to be sent before we queue a final DEAUTH frame, and wait for just this frame to be sent before switching. This already made issues on iwm/iwx less frequent but by itself this was not enough to close all races for those drivers. It should however help when adding background scan support to a non-firmware device driver. Tested, with driver patches: iwm 8265: Aaron Poffenberger, stsp iwm 9260: florian iwm 9560: sthen iwx ax200: jmc, stsp
2021-12-03Ignore ADDBA requests from our AP while we are roaming away from it.Stefan Sperling
Noticed while testing iwm/iwx roaming patches, where my AP would request a new Rx BA session when we had already decided to roam away. There is no need to set up a new Rx BA session with our old AP which we would have to immediately tear down again anyway.
2021-12-03Ship mpi's helpers, see share/btrace/Makefile r1.1:Klemens Nanni
--- Provide common btrace(8) scripts . kprofile.bt - to save kernel stackframces and produce flamegraphs . runqlat.bt - to measure the latency of the scheduler runqueues
2021-12-03Clarify manpageJob Snijders
OK claudio@
2021-12-03Dump more data in the hopes of figuring out why this test occasionallyAnton Lindqvist
fails.
2021-12-03Bring back the recently reverted change, this time without the invertedAnton Lindqvist
conditional. Repeating the previous commit messsage: Assert that at least one report id is claimed during multiple report ids attachment. Should prevent uhidev drivers from doing the wrong thing in their corresponding match routine. Tested by dv@
2021-12-02hash full host:port when asked to hash output, fixes hashes for non-Damien Miller
default ports. bz3367 ok dtucker@
2021-12-02improve the testing of credentials against inserted FIDO keys a littleDamien Miller
more: ask the token whether a particular key belongs to it in cases where the token support on-token user- verification (e.g. biometrics) rather than just assuming that it will accept it. Will reduce spurious "Confirm user presence" notifications for key handles that relate to FIDO keys that are not currently inserted in at least some cases. Motivated by bz3366; by Pedro Martelletto
2021-12-02move check_sk_options() up so we can use it earlierDamien Miller
2021-12-02ssh-rsa is no longer in the default for PubkeyAcceptedAlgorithms.Darren Tucker
2021-12-02bsearch(3): support arrays with more than INT_MAX elementsScott Soule Cheloha
The "lim" variable needs to be a size_t to match nmemb, otherwise we get undefined behavior when nmemb exceeds INT_MAX. Prompted by a blog post by Joshua Bloch: https://ai.googleblog.com/2006/06/extra-extra-read-all-about-it-nearly.html Fixed by Chris Torek a long time ago: https://svnweb.freebsd.org/csrg/lib/libc/stdlib/bsearch.c?revision=51742&view=markup ok millert@
2021-12-02unmount real root partition from /mnt before the cgi/random actionsTheo de Raadt
which run asyncronously and can grab vnodes race to make the umount fail spuriously problem seen and diagnosed by Yuichiro NAITO ok florian
2021-12-02Tell testers which packages to install right away (and why)Klemens Nanni
Other regress tests do it differently; just fix/thouch those that did not mention any package name at all. This helps grepping logs for SKIPPED to find instructions for the next run.
2021-12-02Log that kern.allowdt=1 is needed and whereKlemens Nanni
This helps grepping logs for SKIPPED to find instructions for the next run.
2021-12-02Tell testers which packages to install right awayKlemens Nanni
OK bluhm
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 12:50:16 +0000