summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Set errno to EINVAL, instead of letting ERANGE escape out.tedu2015-02-241-2/+4
| | | | | | Printing strerror() in that case will say result too large, even if rounds is actually too small. invalid is less specific, but less incorrect. ok millert
* increase prefbuf size so that 'encrypt -b 000000000000000000000012' works.tedu2015-02-241-3/+5
| | | | | | | noticed by Andre Smagin. also check snprintf for overflow so we get better error messages if somebody decides to pad with even more zeroes, and avoid possible truncations.
* add -v (show ASCII art) to -l's synopsis; ok djm@naddy2015-02-242-4/+5
|
* typo, frantisek holopespie2015-02-241-3/+3
|
* Mark up filenames with Pa.bentley2015-02-241-8/+8
| | | | ok reyk@
* Explain in a comment that atoi() is safe here.bluhm2015-02-241-1/+2
| | | | OK deraadt@
* further silence spurious error message even when -v is specifieddjm2015-02-231-2/+2
| | | | (e.g. to get visual host keys); reported by naddy@
* document the quirks cve mechanism. Better late than neverespie2015-02-231-2/+14
|
* Add support for the RTL8411B chipphessler2015-02-232-4/+5
| | | | | | Verified working by Peter Hansteen OK deraadt@, millert@, stsp@
* fix a race condition by using a mux socket rather than andjm2015-02-231-3/+6
| | | | ineffectual wait statement
* Use the rewritten (index file appended) uri as DOCUMENT_URI.chrisz2015-02-231-2/+2
| | | | OK florian@
* Convert a table unsupported by mandoc to a columnated list.bentley2015-02-231-34/+34
| | | | | | | While here, correctly mark up time_t as a variable type and use prettier double quotes. ok schwarze@
* Allow to specify CGI variables as macros in redirection strings, eg.reyk2015-02-234-7/+170
| | | | | | block return 301 "http://www.example.com/$REQUEST_URI" OK tedu@ florian@
* fourth batch of perlpod(1) to mdoc(7) conversionschwarze2015-02-2337-1276/+2521
|
* add an XXX to remind me to improve sshkey_load_publicdjm2015-02-231-1/+4
|
* silence a spurious error message when listing fingerprints fordjm2015-02-231-2/+2
| | | | known_hosts; bz#2342
* fix setting/clearing of TTY raw mode around UpdateHostKeys=askdjm2015-02-231-4/+9
| | | | confirmation question; reported by Herb Goldman
* oops, in NAME, don't nag about the comma after .Nmschwarze2015-02-231-1/+5
|
* improve NAME section diagnostics;schwarze2015-02-2310-53/+70
| | | | confusing messages reported by Jan Stary <hans at stare dot cz>
* Fix an issues that was found by halex@: we didn't set the return_urireyk2015-02-231-9/+18
| | | | | | | in non-location virtual hosts. Add comments clarify the variable-length values. OK halex@
* Add -O0 to the DEBUG example. Figured out while analysing core dumpsreyk2015-02-231-2/+2
| | | | with halex@. No binary change - it is commented out.
* More iwm(4) whitespace fixes from NetBSD.stsp2015-02-232-26/+26
|
* Add return_uri to serverconfig_reset() to avoid using garbage from thereyk2015-02-231-1/+2
| | | | | | imsg buffer. Debugging & OK halex@
* Make iwm(4) re-read the firmware image from disk on if down/up like otherstsp2015-02-232-30/+32
| | | | | drivers do. While here remove unused fields from struct iwm_fw_info. test and ok brad@ phessler@
* oops, cdfs must be built. spotted by todd, here is the correct diffderaadt2015-02-231-2/+2
|
* expr no longer needed on media, thanks to halex and todd and rpederaadt2015-02-2318-36/+18
|
* While slick, this isn't accessing multiple directories concurrently, soguenther2015-02-221-29/+35
| | | | | | | | using *at functions is equivalent to chdir()ing, which eases portability. Tested with mixes of absolute and relative paths. Eliminate a FILE leak too. prodded by jsing@
* syncjsing2015-02-2219-55/+55
|
* Bump libcrypto and libssl majors, due to various recent churn.jsing2015-02-224-4/+4
| | | | Discussed with/requested by deraadt@ at the conclusion of s2k15.
* Reluctantly add server-side support for TLS_FALLBACK_SCSV.jsing2015-02-2215-25/+159
| | | | | | | | | | | | | | | | | | | | | | | | | | This allows for clients that willingly choose to perform a downgrade and attempt to establish a second connection at a lower protocol after the previous attempt unexpectedly failed, to be notified and have the second connection aborted, if the server does in fact support a higher protocol. TLS has perfectly good version negotiation and client-side fallback is dangerous. Despite this, in order to maintain maximum compatability with broken web servers, most mainstream browsers implement this. Furthermore, TLS_FALLBACK_SCSV only works if both the client and server support it and there is effectively no way to tell if this is the case, unless you control both ends. Unfortunately, various auditors and vulnerability scanners (including certain online assessment websites) consider the presence of a not yet standardised feature to be important for security, even if the clients do not perform client-side downgrade or the server only supports current TLS protocols. Diff is loosely based on OpenSSL with some inspiration from BoringSSL. Discussed with beck@ and miod@. ok bcook@
* There is not much point constructing an SSL_CIPHER, then callingjsing2015-02-222-14/+6
| | | | | ssl3_cipher_get_value() to get the cipher suite value that we just put in the struct - use the cipher suite value directly.
* Remove IMPLEMENT_STACK_OF noops.jsing2015-02-224-8/+4
|
* Update for recent verify related naming changes.jsing2015-02-222-28/+28
|
* Bump libtls major due to symbol removal.jsing2015-02-221-3/+2
|
* Rename tls_config_insecure_noverifyhost() tojsing2015-02-227-28/+27
| | | | | | | tls_config_insecure_noverifyname(), so that it is more accurate and keeps inline with the distinction between DNS hostname and server name. Requested by tedu@ during s2k15.
* Check return values when setting dheparams and ecdhecurve for the defaultjsing2015-02-221-11/+14
| | | | configuration.
* Set the TLS ciphers to "compat" mode, restoring the previous behaviour.jsing2015-02-224-9/+19
|
* In the interests of being secure by default, make the default TLS ciphersjsing2015-02-222-2/+17
| | | | | | | be those that are TLSv1.2 with AEAD and PFS. Provide a "compat" mode that allows the previous default ciphers to be selected. Discussed with tedu@ during s2k15.
* Correct PAGE_MASK usage in radeon_vm_map_gart(). Linux definesjsg2015-02-221-2/+2
| | | | | | | | | | | PAGE_MASK to be (~(PAGE_SIZE - 1)) where as our kernel defines it as (PAGE_SIZE - 1). It is possible to flag a CS as wanting to use GPU VM for cayman/aruba hardware though in practice Mesa won't submit a CS flagged with GPU VM for these unless overriden via RADEON_VA=true in the environment. For Southern Islands radeons on the other hand GPU VM is required and flagged by default.
* Give RS* IGP radeons a better chance of working thanks to Imre Vadaszjsg2015-02-222-5/+5
| | | | | | | | | | | | | | for debugging the problem on RS690 and coming up with an initial diff. Align the gart table allocation to the size of the allocation (rounded up to nearest page size by bus_dmamem_alloc). Matches the behaviour of the original Linux code's use of pci_alloc_consistent()/dma_alloc_coherent(). Correct PAGE_MASK usage in rs400_gart_set_page(). Linux defines PAGE_MASK to be (~(PAGE_SIZE - 1)) where as our kernel defines it as (PAGE_SIZE - 1). Most of the other occurances in the drm code have been adjusted accordingly but this one seems to have been missed.
* Recent changes haven't been completely stable, so revert for the 5.7 releaseguenther2015-02-2110-700/+127
| | | | requested by deraadt@
* make "ssh-add -d" properly remove a corresponding certificate, and alsohalex2015-02-211-4/+10
| | | | | | not whine and fail if there is none ok djm@
* explain how tls_accept_socket works.tedu2015-02-211-2/+9
|
* correct paths to configuration files being written/updated;djm2015-02-212-5/+5
| | | | they live in $OBJ not cwd; some by Roumen Petrov
* tls_config_set_protocols is really void. Greg Martin.tedu2015-02-211-3/+3
|
* fill out docs a bit more, notably the read/write again behaviors.tedu2015-02-211-3/+27
| | | | ok jsing
* Escape quotes when expanding macro arguments.schwarze2015-02-214-29/+96
| | | | This fixes a bug naddy@ found in plan9/rc(1).
* Fix iwm(4) man page bug symptom description: If the MAC address is changedstsp2015-02-211-2/+2
| | | | | then iwm(4) stops passing traffic. Firmware crashes were only observed with my local patches, not the in-tree version of the driver.
* Remove mention of firmware version numbers from the iwm(4) man page.stsp2015-02-211-2/+2
| | | | | The number stated was incorrect and there is no real reason to mention them in the first place. Discussed with sthen.
* In iwm(4), fix an inverted check for hardware-ready state. From NetBSD.stsp2015-02-211-2/+2
| | | | Pointed out by brad.
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.