summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* rephrase example in a more consistent wayespie2021-02-101-9/+8
|
* Add a instruction barrier between writing CCSELR_EL1 and reading CCSIDR_EL1kettenis2021-02-101-1/+4
| | | | | | | | to guarantee that we read the cache parameters of the cache we just selected. The required ISB instruction is present in the examples in the ARM ARM. Fixes the the report on the cores in Apple's M1 SoC. ok patrick@
* If pf changes the routing table when sending packets, the kernelbluhm2021-02-101-2/+15
| | | | | | | | could get stuck in an endless recursion during TCP path MTU discovery. Create a dynamic host route in ip_output() that can be used by tcp_mtudisc() to store the MTU. Reported by Peter Mueller and Sebastian Sturm OK claudio@
* Add med test, this no longer fails in -currentclaudio2021-02-101-2/+2
|
* Use the same check in kernel and ifconfig for group names. ifconfigbluhm2021-02-101-9/+9
| | | | | | delete group does not need name sanitation. The kernel will just report that it does not exist. OK deraadt@ gnezdo@ anton@ mvs@ claudio@
* Interface group names must fit into IFNAMSIZ and be unique. Butbluhm2021-02-101-3/+5
| | | | | | | | | | | | the kernel made the unique check before trunkating with strlcpy(). So there could be two interface groups with the same name. The kif is created by a name lookup. The trunkated names are equal, so there was only one kif owned by both groups. When the groups got destroyed, the single kif was removed twice from the RB tree. Check length of group name before doing the unique check. The empty group name was allowed and is now invalid. Reported-by: syzbot+f47e8296ebd559f9bbff@syzkaller.appspotmail.com OK deraadt@ gnezdo@ anton@ mvs@ claudio@
* Remove `sc_dead' logic from pppac(4). It is used to preventmvs2021-02-101-9/+3
| | | | | | | | | | pppac_ioctl() be called on dying pppac(4) interface. But now if_detach() makes dying `ifp' inaccessible and waits for references which are in-use in ioctl(2) path. This logic is not required anymore. Also if_detach() was moved before klist_invalidate() to prevent the case while pppac_qstart() bump `sc_rsel'. ok yasuoka@
* as usual, stuff got removed without updating the documentationespie2021-02-101-75/+2
| | | | GC www/drupal7 description
* Move UNIX domain sockets out of kernel lock. The new `unp_lock' rwlock(9)mvs2021-02-103-63/+192
| | | | | | | | used as solock()'s backend to protect the whole layer. With feedback from mpi@. ok bluhm@ claudio@
* Use ~/.tmux.conf as an example rather than /etc/passwd, suggested bynicm2021-02-101-6/+6
| | | | deraadt@.
* some spacing/grammar fixes from dave voutila;jmc2021-02-101-7/+5
|
* only amd64 & arm64 lldb work at the momentderaadt2021-02-102-2/+12
|
* cast large to reduce warning on 32-bit machines (an ELF type is printed with %ll)deraadt2021-02-101-2/+2
|
* Make sure that switching the console from serial to framebuffer workskettenis2021-02-092-22/+25
| | | | | | for framebuffer nodes under / and /chosen. ok patrick@
* pfsync_state_import() must not be called with the pf state lock held,patrick2021-02-091-3/+1
| | | | | | | | | since the actual modification of the state table is done by a call to pf_state_insert(), which takes the pf state lock itself. Other calls to pfsync_state_import() also only have the pf lock. Reported-by: syzbot+d6ea8620b43dc69ecbc6@syzkaller.appspotmail.com ok bluhm@
* syncpatrick2021-02-0910-0/+30
|
* Build and install lldb.patrick2021-02-092-4/+4
| | | | Discussed with deraadt@
* rc: ensure that vfs.mounts.nfs check works without NFSnaddy2021-02-091-2/+2
| | | | | | | | If NFS isn't compiled into the kernel, sysctl -n vfs.mounts.nfs will produce no numerical output. Make sure that we always have a valid arithmetic expression. Reported by and ok patrick@
* Add optional 'group none' transform for child SAs and fix handling oftobhe2021-02-093-8/+39
| | | | | | | | | | | | 'group none'. We currently send no transform of type DH by default, which should be equivalent to explicitly sending a single DH transform of type 'none'. However, the proposal matching logic had a bug where these two would not match, effectively breaking the ability to negotiate optional PFS. This commit fixes the bug but continues to send no DH proposal by default to remain backwards compatible with older versions. ok patrick@
* Fix lldb.mortimer2021-02-092-14/+4
| | | | | | | | Map deliberately invalid signal to zero when passing to PT_STEP and P_CONTINUE. Also clean up getting Environment so setting LLDB_DEBUGSERVER env vars works again. ok patrick@
* These regress tests expect coredumps to be written so run them withclaudio2021-02-092-2/+2
| | | | | ulimit -c unlimited. Also simplify the logic a bit as requested by bluhm@. OK bluhm@ deraadt@
* These regress test expect coredumps as an effect of the test so runclaudio2021-02-092-4/+4
| | | | | the tests with ulimit -c unlimited to make sure coredumps are written. OK bluhm@ deraadt@
* Walk over all results from getaddrinfo() instead of giving up after theclaudio2021-02-091-2/+1
| | | | | | | first entry. This way ocspcheck will try all returned IPs to contact the OCSP server. Found by the regress test and a resolv.conf file with 'family inet6 inet4'. OK kn@ deraadt@
* syncderaadt2021-02-091-0/+2
|
* ddb: when a new wsdisplay console attaches, resize ddb cols/rows to itjcs2021-02-093-3/+19
| | | | ok visa
* Do not expand times and #() inside #().nicm2021-02-091-3/+5
|
* Activate use of PF_LOCK() by removing the WITH_PF_LOCK ifdefs.patrick2021-02-095-42/+5
| | | | | Silence from the network group ok sashan@
* syncderaadt2021-02-091-0/+1
|
* Add a barrier between reading the cqe flags and the command ID, whichjmatthew2021-02-091-1/+3
| | | | | | | | should ensure that we don't read a stale command ID and complete the wrong scsi io. powerpc64 base builds were crashing like this fairly regularly. ok deraadt@ dlg@
* 7.0 firmware keysthen2021-02-081-0/+2
|
* 7.0 packages keynaddy2021-02-081-0/+2
|
* correct return type for compressBound();jmc2021-02-081-3/+3
| | | | from pedro martelletto
* change discipline name from "RAID1C" to "RAID 1C" to match the man pagesstsp2021-02-081-2/+2
|
* add RAID 1C to the list of supported softraid(4) disciplinesstsp2021-02-081-2/+14
|
* Remove maxburst feature from tcp_outputjan2021-02-082-6/+3
| | | | OK bluhm@, claudio@, deraadt@
* syncderaadt2021-02-081-0/+1
|
* Make bioctl properly verify raidlevels specified via the -c option.stsp2021-02-081-1/+3
| | | | | | | Trailing characters in the option argument were ignored, such that -cC1 (typo of -c1C) was interpreted as -cC instead of being rejected. ok jsing@
* Update DTLS client hello due to ECC changes.jsing2021-02-081-5/+8
|
* Remove bogus DTLS checks to disable ECC and OCSP.jsing2021-02-082-10/+3
| | | | | | | ECC and OCSP can be used with DTLS, so remove bogus checks that currently prevent it. These are long lasting remnants from the original OpenSSL code. ok tb@
* Enforce read ahead with DTLS.jsing2021-02-081-5/+5
| | | | | | | DTLS is largely broken/useless without read ahead being enabled, so enforce it for DTLS. This behaviour matches both our documentation and OpenSSL. ok tb@
* Use dtls1_retrieve_buffered_record() to load buffered application data.jsing2021-02-081-11/+3
| | | | | | | Replace the current copy of dtls1_retrieve_buffered_record() with a call to it instead. ok tb@
* add future 7.0 base keyderaadt2021-02-081-0/+2
|
* Clean up kernel IPsec flows and security associations on shutdown.tobhe2021-02-083-10/+33
| | | | | Discussed with sthen@ ok patrick@
* Add "pipe" variants of the "copy-pipe" commands which do not copy, fromnicm2021-02-082-10/+80
| | | | Christian Zangl.
* Start refcounting interface groups with 1. if_creategroup() returnsbluhm2021-02-082-13/+15
| | | | | | | a new object that is already refcounted, so carp attach does not reach into internal structures. Add kasserts to detect counter overflow or underflow. OK mvs@
* Add a RAID1C (raid1 + crypto) softraid(8) discipline.stsp2021-02-081-0/+325
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RAID1C discipline encrypts data like the CRYPTO discipline, and accepts multiple chunks during creation and assembly like the RAID1 discipline. To deal with failing disks a RAID1C volume may be assembled with a smaller number of chunks than the volume was created with. The volume will then come up in degraded state. If the volume is now detached and assembled again with the correct number of chunks, any re-added chunks will require a rebuild. Consequently, assembling RAID1C volumes requires careful attention to the chunks passed via 'bioctl -l'. If a chunk is accidentally omitted from the command line during volume assembly, then this chunk will need to be rebuilt. At least one known-good chunk is required in order to assemble the volume. Like CRYPTO, RAID1C supports passphrase and key-disk authentication. Key-disk based volumes are assembled automatically if the key disk is present while the system is booting up. Unlike CRYPTO and RAID1, there is no boot support for RAID1C yet. RAID1C largely reuses existing code of RAID1 and CRYPTO disciplines. At present RAID1C's discipline-specific data structure is shared with that of the CRYPTO discipline to allow re-use of existing CRYPTO code. A custom RAID1C data structure would require CRYPTO code to access struct sr_crypto via a pointer instead of via a member field of struct sr_discipline. ok jsing@
* Add a RAID1C (raid1 + crypto) softraid(8) discipline.stsp2021-02-086-38/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RAID1C discipline encrypts data like the CRYPTO discipline, and accepts multiple chunks during creation and assembly like the RAID1 discipline. To deal with failing disks a RAID1C volume may be assembled with a smaller number of chunks than the volume was created with. The volume will then come up in degraded state. If the volume is now detached and assembled again with the correct number of chunks, any re-added chunks will require a rebuild. Consequently, assembling RAID1C volumes requires careful attention to the chunks passed via 'bioctl -l'. If a chunk is accidentally omitted from the command line during volume assembly, then this chunk will need to be rebuilt. At least one known-good chunk is required in order to assemble the volume. Like CRYPTO, RAID1C supports passphrase and key-disk authentication. Key-disk based volumes are assembled automatically if the key disk is present while the system is booting up. Unlike CRYPTO and RAID1, there is no boot support for RAID1C yet. RAID1C largely reuses existing code of RAID1 and CRYPTO disciplines. At present RAID1C's discipline-specific data structure is shared with that of the CRYPTO discipline to allow re-use of existing CRYPTO code. A custom RAID1C data structure would require CRYPTO code to access struct sr_crypto via a pointer instead of via a member field of struct sr_discipline. ok jsing@
* Revert the convertion of per-process thread into a SMR_TAILQ.mpi2021-02-0815-66/+52
| | | | | We did not reach a consensus about using SMR to unlock single_thread_set() so there's no point in keeping this change.
* Extend binary operators support, required for more filter features.mpi2021-02-084-88/+150
| | | | Improve debugging of filters and print operator names in debug output.
* Also print the recently added caRepository URI alongside rpkiManifestclaudio2021-02-081-1/+2
| | | | and rpkiNotify SIA.
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.