summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* These regress test expect coredumps as an effect of the test so runclaudio2021-02-092-4/+4
| | | | | the tests with ulimit -c unlimited to make sure coredumps are written. OK bluhm@ deraadt@
* Walk over all results from getaddrinfo() instead of giving up after theclaudio2021-02-091-2/+1
| | | | | | | first entry. This way ocspcheck will try all returned IPs to contact the OCSP server. Found by the regress test and a resolv.conf file with 'family inet6 inet4'. OK kn@ deraadt@
* syncderaadt2021-02-091-0/+2
|
* ddb: when a new wsdisplay console attaches, resize ddb cols/rows to itjcs2021-02-093-3/+19
| | | | ok visa
* Do not expand times and #() inside #().nicm2021-02-091-3/+5
|
* Activate use of PF_LOCK() by removing the WITH_PF_LOCK ifdefs.patrick2021-02-095-42/+5
| | | | | Silence from the network group ok sashan@
* syncderaadt2021-02-091-0/+1
|
* Add a barrier between reading the cqe flags and the command ID, whichjmatthew2021-02-091-1/+3
| | | | | | | | should ensure that we don't read a stale command ID and complete the wrong scsi io. powerpc64 base builds were crashing like this fairly regularly. ok deraadt@ dlg@
* 7.0 firmware keysthen2021-02-081-0/+2
|
* 7.0 packages keynaddy2021-02-081-0/+2
|
* correct return type for compressBound();jmc2021-02-081-3/+3
| | | | from pedro martelletto
* change discipline name from "RAID1C" to "RAID 1C" to match the man pagesstsp2021-02-081-2/+2
|
* add RAID 1C to the list of supported softraid(4) disciplinesstsp2021-02-081-2/+14
|
* Remove maxburst feature from tcp_outputjan2021-02-082-6/+3
| | | | OK bluhm@, claudio@, deraadt@
* syncderaadt2021-02-081-0/+1
|
* Make bioctl properly verify raidlevels specified via the -c option.stsp2021-02-081-1/+3
| | | | | | | Trailing characters in the option argument were ignored, such that -cC1 (typo of -c1C) was interpreted as -cC instead of being rejected. ok jsing@
* Update DTLS client hello due to ECC changes.jsing2021-02-081-5/+8
|
* Remove bogus DTLS checks to disable ECC and OCSP.jsing2021-02-082-10/+3
| | | | | | | ECC and OCSP can be used with DTLS, so remove bogus checks that currently prevent it. These are long lasting remnants from the original OpenSSL code. ok tb@
* Enforce read ahead with DTLS.jsing2021-02-081-5/+5
| | | | | | | DTLS is largely broken/useless without read ahead being enabled, so enforce it for DTLS. This behaviour matches both our documentation and OpenSSL. ok tb@
* Use dtls1_retrieve_buffered_record() to load buffered application data.jsing2021-02-081-11/+3
| | | | | | | Replace the current copy of dtls1_retrieve_buffered_record() with a call to it instead. ok tb@
* add future 7.0 base keyderaadt2021-02-081-0/+2
|
* Clean up kernel IPsec flows and security associations on shutdown.tobhe2021-02-083-10/+33
| | | | | Discussed with sthen@ ok patrick@
* Add "pipe" variants of the "copy-pipe" commands which do not copy, fromnicm2021-02-082-10/+80
| | | | Christian Zangl.
* Start refcounting interface groups with 1. if_creategroup() returnsbluhm2021-02-082-13/+15
| | | | | | | a new object that is already refcounted, so carp attach does not reach into internal structures. Add kasserts to detect counter overflow or underflow. OK mvs@
* Add a RAID1C (raid1 + crypto) softraid(8) discipline.stsp2021-02-081-0/+325
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RAID1C discipline encrypts data like the CRYPTO discipline, and accepts multiple chunks during creation and assembly like the RAID1 discipline. To deal with failing disks a RAID1C volume may be assembled with a smaller number of chunks than the volume was created with. The volume will then come up in degraded state. If the volume is now detached and assembled again with the correct number of chunks, any re-added chunks will require a rebuild. Consequently, assembling RAID1C volumes requires careful attention to the chunks passed via 'bioctl -l'. If a chunk is accidentally omitted from the command line during volume assembly, then this chunk will need to be rebuilt. At least one known-good chunk is required in order to assemble the volume. Like CRYPTO, RAID1C supports passphrase and key-disk authentication. Key-disk based volumes are assembled automatically if the key disk is present while the system is booting up. Unlike CRYPTO and RAID1, there is no boot support for RAID1C yet. RAID1C largely reuses existing code of RAID1 and CRYPTO disciplines. At present RAID1C's discipline-specific data structure is shared with that of the CRYPTO discipline to allow re-use of existing CRYPTO code. A custom RAID1C data structure would require CRYPTO code to access struct sr_crypto via a pointer instead of via a member field of struct sr_discipline. ok jsing@
* Add a RAID1C (raid1 + crypto) softraid(8) discipline.stsp2021-02-086-38/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RAID1C discipline encrypts data like the CRYPTO discipline, and accepts multiple chunks during creation and assembly like the RAID1 discipline. To deal with failing disks a RAID1C volume may be assembled with a smaller number of chunks than the volume was created with. The volume will then come up in degraded state. If the volume is now detached and assembled again with the correct number of chunks, any re-added chunks will require a rebuild. Consequently, assembling RAID1C volumes requires careful attention to the chunks passed via 'bioctl -l'. If a chunk is accidentally omitted from the command line during volume assembly, then this chunk will need to be rebuilt. At least one known-good chunk is required in order to assemble the volume. Like CRYPTO, RAID1C supports passphrase and key-disk authentication. Key-disk based volumes are assembled automatically if the key disk is present while the system is booting up. Unlike CRYPTO and RAID1, there is no boot support for RAID1C yet. RAID1C largely reuses existing code of RAID1 and CRYPTO disciplines. At present RAID1C's discipline-specific data structure is shared with that of the CRYPTO discipline to allow re-use of existing CRYPTO code. A custom RAID1C data structure would require CRYPTO code to access struct sr_crypto via a pointer instead of via a member field of struct sr_discipline. ok jsing@
* Revert the convertion of per-process thread into a SMR_TAILQ.mpi2021-02-0815-66/+52
| | | | | We did not reach a consensus about using SMR to unlock single_thread_set() so there's no point in keeping this change.
* Extend binary operators support, required for more filter features.mpi2021-02-084-88/+150
| | | | Improve debugging of filters and print operator names in debug output.
* Also print the recently added caRepository URI alongside rpkiManifestclaudio2021-02-081-1/+2
| | | | and rpkiNotify SIA.
* Extract the 1.3.6.1.5.5.7.48.5 (caRepository) SIA from the certificate.claudio2021-02-082-4/+54
| | | | | | Make sure that the caRepository matches the start of the URI of rpkiManifest. The MFT must be a file inside the caRepository. OK tb@
* Do not hold onto the fdplock longer then needed. Release the lock afterclaudio2021-02-081-6/+9
| | | | | | | the initial falloc() calls and then regrab it for the fdinsert() or fdremove() calls respectiviely. Also move closef() outside of the lock. This replaces the previously reverted lock order change that was reverted. OK mvs@ visa@
* Include "focused" in client flags, from Dan Aloni in GitHub issue 2558.nicm2021-02-081-1/+3
|
* Simplify sleep_setup API to two operations in preparation for splittingmpi2021-02-0811-160/+94
| | | | | | | | | | | | the SCHED_LOCK(). Putting a thread on a sleep queue is reduce to the following: sleep_setup(); /* check condition or release lock */ sleep_finish(); Previous version ok cheloha@, jmatthew@, ok claudio@
* route-to rules take ips, not interfaces with optional ips.dlg2021-02-071-13/+13
| | | | another gentle reminder by bluhm@ who pointed out i missed some
* i missed a dup-to when tweaking route-to things to takes ips, not ifaces.dlg2021-02-071-1/+1
| | | | gentle reminded by bluhm@
* Absorb ssl3_get_algorithm2() into ssl_get_handshake_evp_md().jsing2021-02-074-22/+19
| | | | | | | | The mess that is ssl_get_algorithm2() only exists to upgrade the handshake MAC of a pre-TLSv1.2 cipher suite to SHA256 when used with TLSv1.2. We can readily do this in ssl_get_handshake_evp_md(), which is far more readable. ok tb@
* Correct handshake MAC/PRF for various TLSv1.2 cipher suites.jsing2021-02-071-8/+8
| | | | | | | | For some reason various TLSv1.2 cipher suites were added with the default handshake MAC and PRF, rather than the SHA256 handshake MAC and PRF. This gets patched up in ssl3_get_algorithm2(), hence goes unnoticed. ok tb@
* Factor out the legacy stack version checks.jsing2021-02-074-28/+24
| | | | | | | Also check for explicit version numbers, rather than just the major version value. ok tb@
* Enable auto DHE and disable session tickets for some tests.jsing2021-02-071-12/+13
| | | | This allows us to drop the server messages that we intend on dropping.
* Only probe for DNS64 presence when we know that we can talk to the slaacdflorian2021-02-071-2/+3
| | | | | | | | | provided nameservers, i.e. the stub resolver check succeeded. Previously we would only probe DNS64 on network change but would not reschedule when it failed. Sometimes (most of the time?) this failes because our address is still tentative or a default route has not yet been installed. OK phessler
* syncderaadt2021-02-0714-225/+225
|
* Free X509_STOREs in ca_shutdown().tobhe2021-02-071-1/+3
|
* Fix address leaks in expand_flows().tobhe2021-02-071-3/+5
| | | | ok patrick@
* while learning (teachgammon(1)) you might want to save your game so "{w,c}path"mestre2021-02-061-2/+2
| | | | pledge(2) permissions are required
* switch clang to -fno-common by defaultnaddy2021-02-063-21/+6
| | | | | | | | | | Common variables will be flagged as errors by default. This can be overridden with -fcommon. Cherry-pick this change that will be part of LLVM11. We bring it forward so we can finish fixing the fallout in the ports tree. ok deraadt@ sthen@ mglocker@
* 6.9-betaderaadt2021-02-065-14/+14
|
* Revert delayed opening of trust anchor file. The code was somewhatflorian2021-02-063-62/+16
| | | | | | ugly and the underlying problem (dhclient and unwind playing well together) should be solved differently. Final straw was jca reporting that it breaks his setup.
* Simplex interface sends packet back without hardware checksumbluhm2021-02-062-15/+34
| | | | | | | | offloading. The checksum must be calculated in software. Use the same condition in ether_resolve() to send the broadcast packet back to the stack and in in_ifcap_cksum() to force software checksumming. This fixes regress/sys/kern/sosplice/loop. OK procter@
* In the end UTF-8 did not become a terminal feature, should not be listednicm2021-02-061-4/+2
| | | | in man page.
* Mention Netgear ProSecure UTM25.visa2021-02-061-2/+4
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.