| Age | Commit message (Collapse) | Author |
|---|
|
the hardware provides crypto offload, zlib offload, and an rng.
this code only supports the rng at the moment.
this device is present on their amd seatlle platforms, and very
present on their epyc stuff.
ok kettenis@ jmatthew@
|
|
|
|
ok deraadt@
|
|
|
|
|
|
|
|
ok krw@ mpi@
|
|
|
|
put it back.
|
|
having mobileip in gre makes it hard to cut gre up. the current mobileip
code is also broken, so this is def and improvement. it also makes it
easy to disable and remove mobileip in the future.
ok claudio@ henning@
|
|
when syncookies are on, pf will blindly answer each and every SYN with a
syncookie-SYNACK. Upon reception of the ACK completing the 3WHS, pf will
reconstruct the original SYN, shove it through pf_test, where state will
be created if the ruleset permits it. Then massage the freshly created state
(we won't see the SYNACK), set up the sequence number modulator, and call
into the existing synproxy code to start the 3WHS with the backend host.
Add an - somewhat basic for now - adaptive mode where syncookies get enabled
if a certain percentage of the state table is filled up with half-open tcp
connections. This makes pf firewalls resilient against large synflood
attacks.
syncookies are off by default until we gained more experience, considered
experimental for now.
see http://bulabula.org/papers/2017/bsdcan/ for more details.
joint work with sashan@, widely discussed and with lots of input by many
|
|
cause 'make release' fail the first time around after building GENERIC
if /usr/obj/ wasn't cleaned out properly. The proper fix would be to
implement privdrop for kernel builds but this is trickier than it looks
at first sight.
discussed with deraadt
|
|
remove the #ifdef KPROF which seems to be unused since that year.
OK mpi@
|
|
Makes the linker generate a correct i386 gap.o file.
ok kettenis@, deraadt@
|
|
ok kettenis
|
|
the code has rotted, and obviously hasnt been used for ages. it is
also hard to make mpsafe. if we need something like this again it
would be better to do it from scratch.
ok tedu@ visa@
|
|
Suggested by and OK mpi, OK visa
|
|
TCP_FACK was disabled by provos@ in June 1999.
TCP_FACK is an algorithm that decides that when something is lost, all
not SACKed packets until the most forward SACK are lost. It may be a
correct estimate, if network does not reorder packets.
OK visa@ mpi@ mikeb@
|
|
OK deraadt, mpi, visa, job
|
|
FullMAC, in comparison to SoftMAC, does most WiFi handling in the
firmware that's running on the controller. This means we have to
work around the net80211 stack while still implementing all the
WiFi interfaces to userland.
This driver is still in early development. So far it can connect
to open WiFis over the USB bus. SDIO and PCIe support, for devices
like the Raspberry Pi 3 or the Macbooks, is not yet implemented.
Also mbufs on the transmit path leak and are not yet freed.
ok stsp@
|
|
|
|
ok deraadt@
|
|
|
|
From yasuoka.
I really want this fixed in a different way after release is finished.
|
|
ok deraadt@
|
|
|
|
functionnalities are available in GENERIC.
ok jasper@, deraadt@, guenther@, dlg@
|
|
|
|
|
|
if we compile pf, ipsec, pipex or nfsserver.
Suggested by mpi some time ago.
Tweak & OK bluhm
deraadt assumes it's fair
|
|
Prompted by a bugreport by naddy that IPv6 autoconfiguration is broken
in the installer.
OK mpi, "go for it" deraadt
|
|
a partial solution to cross compiling the kernel with KARL.
OK deraadt@ a while ago
|
|
Discussed with and OK henning@ at d2k17 as a part of a larger diff.
|
|
by implementing an arc4random_uniform(3) clone with beloved jot(1) and
using it.
discussed with and ok deraadt
|
|
we use gapdummy.o
|
|
directives. binutils requires it, and binutils is the authoritative
parser in this regard. This means arm64 +lld remains broken (but all
the other architectures work)
|
|
expression line. Removing the extra semicolons makes both ld and
ldd accept the link script generated, although ldd produces a wrong
object file on arm64; ok kettenis@ deraadt@
|
|
architectures we must also link against a gapdummy.o to repair the ABI
of the resulting .o file. Woe is me.
Also repair install: target to update the linkkit & hash when a kernel
is installed.
ok rpe tb mlarkin and tested by others also
|
|
|
|
And anyways, everything is ELF now.
|
|
pointed out by kettenis
|
|
|
|
discussed with patrick
|
|
|
|
run so that this locore0.o is always at the start of the executable.
But randomize the link order of all other .o files in the kernel, so
that their exec/rodata/data/bss segments land all over the place.
Late during kernel boot, unmap the early startup code.
As a result, the internal layout of every newly build bsd kernel is
different from past kernels. Internal relative offsets are not known
to an outside attacker. The only known offsets are in the startup code,
which has been unmapped.
Ramdisk kernels cannot be compiled like this, because they are gzip'd.
When the internal pointer references change, the compression dictionary
bloats and results in poorer compression.
ok kettenis mlarkin visa, also thanks to tedu for getting me back to this
|
|
only active during hibernation, preallocating the the submission and completion
queues during attach as they need to be page-aligned.
tested on an x270 that successfully hibernates now.
ok dlg@
|
|
abstraction. First step of making PF_KEY a bit more like PF_ROUTE.
OK mpi@
|
|
tcp md5. OK mpi@
|
|
OK sthen, visa
|
|
This introduces a 32-bit constant time AES implementation from
Thomas Pornin originally for BearSSL and then adjusted by Thomas
and myself to fit OpenBSD kernel. One of the additional features
is an API for encryption and decryption subkey expansion in the
format specified by NIST in FIPS 197.
Tested by myself and naddy@, ok djm@
|
