summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-12-21Replace the term "security key" with "(FIDO) authenticator".Christian Weisgerber
The polysemous use of "key" was too confusing. Input from markus@. ok jmc@
2019-12-21Replace modular version with origin BSDi version with our updates.Todd C. Miller
In 2001 login_passwd was made modular so we could use the same source for passwd and kerberos auth. Now that we no longer have kerberos integrated we can simplify login_passwd. OK deraadt@
2019-12-21upon connect to remote host extract hostname from banner when possible thenGilles Chehade
generate link-greeting smtp-out report event
2019-12-21Restore source-file -q behaviour, broken in r1.42; OK nicm@Tim van der Molen
2019-12-21yet another mostly cosmetic diffMarc Espie
- rename context into localvars, which is more meaningful and less generic - instantiate the random rumbling at the start of gnode.h with actual variable names - explain and group gnode.h variables better - make some comments terser/more meaningful okay millert@
2019-12-21those fields only hold true/false valueMarc Espie
make it obvious okay millert@
2019-12-21rename a few variable/functions to have better names.Marc Espie
adjust comments to be more meaningful reorder predecessors/successors fields in an order that makes more sense to me. okay millert@
2019-12-21rename built_status constants to be less quirkyMarc Espie
fold back BEINGMADE and BUILDING which mean the same thing GC CYCLE/ENDCYCLE okay millert@
2019-12-21tweak buffer handling a bit:Marc Espie
- make BufExpand a real function, zap BufOverflow - sprinkle assert that justify the arithmetic - use unsigned constants - fix a bug in the unlikely condition where Buf_printf would exactly match the buffer boundary and Buf_Retrieve would be called right after okay millert@
2019-12-21The man page actually didn't explain its main parameters!Marc Espie
fix glaring omission okay schwarze@, jmc@
2019-12-21Add arm64 support for lldb.mortimer
"Go for it" kettenis@
2019-12-21Fix DDR4 DIMM size calculation.Mark Kettenis
ok claudio@
2019-12-21if a filter was attached to a relay action in config, notify instance thatGilles Chehade
it can register smtp-out events
2019-12-21start bringing smtp-out reporting code, lacks some events stillGilles Chehade
2019-12-21add FILTER_SUBSYSTEM_SMTP_OUT to filter_subsystem enum and add filter nameGilles Chehade
to struct dispatcher_remote, this will reduce the smtp-out reporting diff
2019-12-21keep track of DATA length in mta_session, will be needed for smtp-outGilles Chehade
reporting
2019-12-21keep track of the relay action in relays, will be used for smtp-outGilles Chehade
reporting
2019-12-21do not pass rdns, fcrdns, ss_src and ss_dest with IMSG_FILTER_SMTP_BEGIN,Gilles Chehade
but gather the information from the link-connect reporting event instead. this removes redundant code and makes it easier to prepare for smtp-out.
2019-12-21s/__arm64__/__aarch64__/gMark Kettenis
It helps when you commit from the machine you actually tested on.
2019-12-21Disable FP exception masking tests on armv7 and arm64. ARM hardware doesn'tMark Kettenis
implement this feature. ok blum@ (a while back)
2019-12-21do not generate smtp reports for unfiltered sessions, the events will beGilles Chehade
discarded in lookup process anyways and this goes in the way of smtp-out work
2019-12-21Warn that auth_call(3) users should include a "--" argument beforeJonathan Gray
non-optional arguments to stop getopt(3) processing. ok deraadt@
2019-12-21In "4.2BSD System Manual" (/usr/doc/sysman in 4.2BSD source)Jonathan Gray
mmap(), munman(), madvise() and mprotect() are described as planned for later releases. A fully functional mmap(2) supporting shared libraries first appeared in SunOS 4.0 along with msync(2). SunOS 4.1 added madvise(3) and replaced msync(2) with mctl(2) which was was used to implement msync(3), mlock(3) and munlock(3). While some of these functions appear as empty or ifdef'd functions in 4.1cBSD and later it was not until the Mach VM was integrated with Net/2 that most of them were implemented. Though the CSRG releases never supported shared libraries or madvise(). mlock()/munlock() were not in Net/2 as they were added by hibler in 1993, but were in 4.4BSD. madvise(2) was implemented for UVM in NetBSD 1.5 and ported to OpenBSD 2.7. For now instead of trying to accurately describe when interfaces first appeared in other systems correct when they were first available in CSRG or OpenBSD releases, retaining the text in mmap(2) discussing SunOS 4.0. madvise(2) 4.4BSD -> OpenBSD 2.7 mmap2(2) 4.4BSD -> 4.3BSD Net/2 mprotect(2) 4.4BSD -> 4.3BSD Net/2 msync(2) 4.4BSD -> 4.3BSD Net/2 munmap(2) 4.1cBSD -> 4.3BSD Net/2
2019-12-21unit tests for ForwardAgent=/path; from Eric ChiangDamien Miller
2019-12-21Allow forwarding a different agent socket to the path specified byDamien Miller
$SSH_AUTH_SOCK, by extending the existing ForwardAgent option to accepting an explicit path or the name of an environment variable in addition to yes/no. Patch by Eric Chiang, manpage by me; ok markus@
2019-12-20Fix the sem_timedwait(3) test.cheloha
The recent clock_getres(2) changes made it so that clock_getres(2) returns the granularity of the active timecounter. This is usually much finer than that of hardclock(9), so we can no longer use clock_getres(2) to fudge our upper timeout return bound. The test is failing because it thinks our sem_timedwait(3) call is returning with too much latency. We can still get the hardclock(9) granularity via the kern.clockrate sysctl(2), though, so just use that to fudge the upper bound. While here, we ought to be checking that we return after the requested absolute timeout, not that we were asleep for a particular interval. Breakage reported by mpi@. ok mpi@
2019-12-20Remove blurb about IDN support, which we disable.Jeremie Courreges-Anglas
Input from and ok jmc@
2019-12-20The IPsec policy check for IPComp bundles has been fixed in theAlexander Bluhm
kernel. So we can make the test config stricter. Change the type of ipcomp bundle flows from use to dontacq.
2019-12-20SSH U2F keys can now be used as host keys. Fix a garden path sentence.Christian Weisgerber
ok markus@
2019-12-20drand48(3) returns values in [0.0, 1.0).Theo Buehler
From j@bitminer.ca with input from Andras Farkas, deraadt, joerg@netbsd "fix however you feel best!" jmc
2019-12-20The mcount.po target is special cased here since mcount.c should not beTheo Buehler
compiled with pie or profiling enabled. This was missed when the independent depend target was removed. Align this target with the inference rules in bsd.lib.mk. This now creates mcount.d as it should and fixes 'make clean' which previously left mcount.po.d behind. ok guenther
2019-12-20Convert various boolean_t/TRUE/FALSE to int/1/0 in mips64 memory code.Visa Hankala
OK mpi@
2019-12-20Replace a lonely TRUE.Visa Hankala
OK mpi@
2019-12-20Convert boolean_t/TRUE/FALSE to int/1/0 in mips64 pmap.Visa Hankala
Rename variables for clarity while here. OK mpi@
2019-12-20Fix build.Visa Hankala
2019-12-20Make iwm(4) clear/set selected bits in the HW_IF_CONFIG register, ratherStefan Sperling
than writing a hard-coded bit pattern to this register. Matches what Intel's Linux driver does, so it should be the right thing to do. Tested on 8265 by Tracey Emery and myself.
2019-12-20Make athn(4) use a constant Tx retry rate while MiRA is probing.Stefan Sperling
Matches what iwm(4) has been doing for a long time to ensure that a good initial Tx rate will be chosen. Tested by Tracey Emery on AR9281.
2019-12-20Ignore new Rx block ack agreements until the WPA handshake is done.Stefan Sperling
Some peers will eagerly try to negotiate block ack (asking us to reserve buffer space) before they are done authenticating themselves. No thanks. Just let them try again later. ok mpi@
2019-12-20Have net80211 actually update the Rx block ack sequence number window,Stefan Sperling
as well as pulling frames off the Rx block ack reordering queue, when an incoming frame above the current seqnum window forces us to slide the window forward, potentially losing frames within the old window. Leaving the seqnum window out of sync with the queue would cause needlessly long stalls in traffic until the window moved again for some other reason. Problem observed on lossy wifi whenever netstat -W indicated an increasing "input block ack window slides" counter. With this fix, stalled frames can be observed only for a relatively short amount of time whenever one or more frames in the current window are lost. ok mpi@
2019-12-20Split out show functions into a new file called output.cClaudio Jeker
OK benno@
2019-12-20Try to bind to port 53 before opening the control socket.Florian Obser
The bind might fail if another daemon is running while the control socket opening will succeed. Then we end up with an overwritten control socket, unwind exiting and no control socket to the already running unwind. Found the hard way by deraadt OK deraadt, mestre, kn, pamela
2019-12-20Disable TSX when MSR_ARCH_CAPABILITIES sets TSX_CTRL.Jonathan Gray
Even with the latest microcode this is not set on all CPUs with TSX, but is set on CPUs which don't need MDS mitigations. MDS mitigations also mitigate TSX Asynchronous Abort (TAA) but aren't done if the CPU claims to not be affected by MDS (MDS_NO). According to "Deep Dive: Intel Transactional Synchronization Extensions (Intel TSX) Asynchronous Abort" CPUs requiring additional mitigations for this are: 06-8e-0c Whiskey Lake (ULT refresh) 06-55-0{6,7} 2nd Gen Xeon Scalable Processors based on Cascade Lake 06-9e-0d Coffee Lake R Currently TSX is disabled unconditionally when possible even if TAA_NO is set. We don't currently do MDS mitigations on i386. Attempt to disable TSX regardless to match amd64.
2019-12-20Disable TSX when MSR_ARCH_CAPABILITIES sets TSX_CTRL.Jonathan Gray
Even with the latest microcode this is not set on all CPUs with TSX, but is set on CPUs which don't need MDS mitigations. MDS mitigations also mitigate TSX Asynchronous Abort (TAA) but aren't done if the CPU claims to not be affected by MDS (MDS_NO). According to "Deep Dive: Intel Transactional Synchronization Extensions (Intel TSX) Asynchronous Abort" CPUs requiring additional mitigations for this are: 06-8e-0c Whiskey Lake (ULT refresh) 06-55-0{6,7} 2nd Gen Xeon Scalable Processors based on Cascade Lake 06-9e-0d Coffee Lake R Currently TSX is disabled unconditionally when possible even if TAA_NO is set. ok bluhm@ guenther@ deraadt@ tested by bluhm@ on i5-8365U (06-8e-0c).
2019-12-20Shuffle the fmt_timeframe functions and change fmt_timeframe() to avoidClaudio Jeker
printing negative time frames (caused by jumping the system clock back in time). OK benno@
2019-12-20Change show_mrt_dump() to call show_rib() instead of the internalClaudio Jeker
show_rib_detail() and show_rib_brief() functions. OK benno@
2019-12-20don't need this directory eitherTheo de Raadt
2019-12-20Move always unsupported keywords to be grouped with the other ones.Darren Tucker
Move oSecurityProvider to match the order in the OpCodes enum. Patch from openbsd@academicsolutions.ch, ok djm@
2019-12-20Remove obsolete opcodes from the configuation enum. Patch fromDarren Tucker
openbsd@academicsolutions.ch, ok djm@
2019-12-20Remove now-obsolete config options from example in comment. Patch fromDarren Tucker
openbsd@academicsolutions.ch, ok djm@
2019-12-19spelling; from bryan stensonJason McIntyre
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 06:34:42 +0000