summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-08-06syncTheo de Raadt
2019-08-05Test realpath and unveil if the root directory is written as "//".Alexander Bluhm
2019-08-05Kernel realpath(3) and unveil(2) did not work correctly if the rootAlexander Bluhm
directory was written as "//". If there is no non-slash character in the path name, use the spacial case for root. found by gmake regression tests; OK naddy@ benno@
2019-08-05Many key types are supported now, so take care to check the sizeChristian Weisgerber
restrictions and apply the default size only to the matching key type. tweak and ok dtucker@
2019-08-056.7 packages keyChristian Weisgerber
2019-08-05Allow an optional stride in the vcpu specification. This makes it possibleMark Kettenis
to allocate virtual CPUs but not assign them to domains. This way you can give domains exclusive access to a core without assigning all threads of that core to the domain.
2019-08-05dhclient.leases(5) is not required for dhclient(8) to work, so justKenneth R Westerback
carry on if it can't be accessed. e.g. if /var/db is not present in single user mode.
2019-08-05If the leases file cannot be opened for writing, just issue a warningKenneth R Westerback
and carry-on. Similar to treatment of /etc/resolv.conf[.tail]. Lets /var/db/dhclient.leases.if be on RO filesystem.
2019-08-05Link regress realpath-unmount to build.Alexander Bluhm
2019-08-05Call realpath(3) in combination with chroot(2) and chdir(2).Alexander Bluhm
Use umount(8) to check that the mountpoint leaks no vnode. from Moritz Buhl
2019-08-05Kernel realpath(3) had the same vnode leakage bug like unveil(2).Alexander Bluhm
If parent and lookup vnode are equal, namei(9) locks them once but reference counts twice. from Moritz Buhl
2019-08-05Remove the unused function parameter rootvnode from unveil_add_vnode().Alexander Bluhm
2019-08-05Add a comment why network_bulk() is not using send_filterset(). UsingClaudio Jeker
send_filterset() would result in a use after free because send_filterset() frees the set after sending but network_bulk() runs in a loop.
2019-08-05Don't use a 0 element to determine the end of an OID when comparing twoMartijn van Duren
OIDS. This can result in false equality matches. OK claudio@
2019-08-05There's no reason why the first digit of an OID can't be 0.Martijn van Duren
OK claudio@ "Good find" deraadt@
2019-08-05Remove -port option from s_server since it is same as -acceptKinichiro Inoguchi
ok schwarze@
2019-08-05Remove now-redundant perm_ok arg since sshkey_load_private_type willDarren Tucker
now return SSH_ERR_KEY_BAD_PERMISSIONS in that case. Patch from jitendra.sharma at intel.com, ok djm@
2019-08-05try to be more compliant with the spec by implementing marker responses.David Gwynne
i hope, i didn't test this that hard.
2019-08-05Cleanup config reload in the RDE. Use the bgpd_conf struct to store setsClaudio Jeker
and l3vpns instead of temporary globals. Also rework rde_reload_done to free filters and sets earlier. The soft-reconfiguration process no longer needs the previous filters / sets to do its work since there is a full Adj-RIB-Out. OK benno@
2019-08-05Favor vn_close() in the error path of diskmapioctl() since side-effectsanton
caused by calling vn_open() with write permissions must be reverted. Otherwise, the vfs subsystem could panic while releasing the last vnode reference if the writecount is still positive. ok visa@ Reported-by: syzbot+4724df09d9ab0fdca28a@syzkaller.appspotmail.com Reported-by: syzbot+a430606fd528645559db@syzkaller.appspotmail.com
2019-08-05Change the order how filtersets are passed during config reloads. InsteadClaudio Jeker
of sending them after e.g. the filter rule send them before. The benefit is that the filterset is present when a rule is added and so the filter rule is complete at that moment. OK benno@
2019-08-05Allow concurrent reads of the f_offset field of struct file byanton
serializing both read/write operations using the existing file mutex. The vnode lock still grants exclusive write access to the offset; the mutex is only used to make the actual write atomic and prevent any concurrent reader from observing intermediate values. ok mpi@ visa@
2019-08-05sis(4) calls mii_phy_reset(); add explicit dependency on mii_phy in configStefan Sperling
from grunk@
2019-08-05add a manual page for smbiosJonathan Gray
ok kettenis@
2019-08-05Add support for the SD (scroll down) escape sequence, GitHub issue 1861.Nicholas Marriott
2019-08-05Xr pf 4David Gwynne
2019-08-05document how to make technically non-compliant TPMRsDavid Gwynne
2019-08-05run pf against ip packets coming in and out of the two ports.David Gwynne
the idea and a good chunk of the implementation is copied from bridge(4). note that IP packets inside "service delimited" traffic, ie, vlan, svlan, or bpe encapsulated traffic, are not considered IP and will therefore not be given to pf to look at. if you want to filter that you'll need to configure vlan/svlan/bpe interfaces to get past their headers, and then configure them with their own tpmrs. hopefully the interface input handlers were established in the right order.
2019-08-05pay some lip service to TPMR compliance according to 802.1Q-2018David Gwynne
the spec says we should filter packets destined to a list of ethernet addresses. im currently interpreting "filter" as meaning dropping, which this diff does. however, one of the addresses to filter is the one lacp uses by default and not a lot of lacp implementations (read switches) support the configuration of a different address. i still need lacp to go over tpmr, and because i can't change the address, this diff also has a way to configure tpmr to still allow the packets through.
2019-08-04Simplify _dl_find_symbol(). Currently, it returns three values:Philip Guenther
- the symbol it found, returned via the second argument - the base offset of the the object it was found in, via the return value - optionally: the object it was found in, returned via the last argument Instead, return a struct with the symbol and object pointers and let the caller get the base offset from the object's obj_base member. On at least aarch64, amd64, mips64, powerpc, and sparc64, a two word struct like this is passed in registers. ok mpi@, kettenis@
2019-08-04Fix a typo I noticed reviewing the smbios code cleanup diff.kmos
(stirng -> string) ok kettenis@ who pointed out I should fix the new arm64 smbiosvar.h too
2019-08-04Ensure that a posted write completes when re-enabling interruptsVisa Hankala
or sending an IPI.
2019-08-04Add support for X-Gene/eMAG variant.Mark Kettenis
2019-08-04Add arm64 asm for stackpivot regress test.mortimer
2019-08-04Cleanup the bios(4)/smbios(4) code a bit. Fix some KNF issues, reduceMark Kettenis
differences between the i386 and amd64 versions of the code and switch to using the standard C integer exact width integer types. ok deraadt@
2019-08-04crank version, following fchmod changeTheo de Raadt
2019-08-04Unmap tables once we're done with them.Mark Kettenis
2019-08-04Implement smbios support on arm64.Mark Kettenis
ok deraadt@, jsg@
2019-08-04Test that unmount works after calling unlink(2) with relativeAlexander Bluhm
directories obtained by chdir(2).
2019-08-04Remove unused files.Visa Hankala
2019-08-04Remove the old, unfinished octeon bootloader.Visa Hankala
2019-08-04Revise the way how the octeon bootloader is built. The originalVisa Hankala
approach was not right, and there is still room for improvement. OK deraadt@
2019-08-04Calling unveil(2) with the current directory leaked a vnode. EvenAlexander Bluhm
if the parent and the lookup vnode are equal, namei(9) reference counts both. So release the parent vnode uncoditionally. OK visa@
2019-08-04tweak the iavf text a little, and add an entry to pci.4;Jason McIntyre
ok jmatthew
2019-08-03permit maxusers to grow up to 128Theo de Raadt
2019-08-01Call unveil(2) in combination with unlink(2) and chroot(2).Alexander Bluhm
Use umount(8) to check that the mountpoint leaks no vnode.
2019-08-03There are some pretty big arm64 machines so crank maxusers to 80.Theo de Raadt
2019-08-03good idea to make next-generation keys available well before heading into ↵Theo de Raadt
release.
2019-08-03R.I.P. itimerround(); ok mpi@cheloha
2019-08-03Mention dhclient vs AUTOCONF4.Kenneth R Westerback
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-21 00:44:09 +0000