etc/rc.d/sshd: revision 1.30
etc/rc.d/sshd: revision 1.33
etc/rc.d/sshd: revision 1.34
etc/rc.d/sshd: revision 1.35
simplify more (from rudolf)
/etc/rc.d/sshd: New check cmd and reload precmd.
- check cmd: run `sshd -t' to check sshd_config file
- reload precmd: run check cmd before reloading so we don't nuke sshd
if there's an error in the sshd_config file
(It is still possible to effectively nuke sshd by changing the
configuration tosomething that won't work on your network, but at
least we avoid making sshd just exit on reload when you make a typo
in a config option.)
/etc/rc.d/sshd: Stop generating DSA host keys by default.
If you want them you can generate them yourself, but in this day and
age (Monday and 2023, specifically) there's no reason to be using DSA
except for compatibility with ancient legacy software.
/etc/rc.d/sshd: Use default curve for ECDSA keygen, not NIST P-521.
The default is NIST P-256, which:
(a) has plenty of cryptanalytic security,
(b) performs better on essentially all platforms (smaller enough that
even the advantage of the Mersenne prime structure of P-521 can't
compete), and
(c) likely gets more scrutiny on implementations than P-521 since it's
more widespread.
sys/net/route.c: revision 1.237
route: run workqueue kthreads with KERNEL_LOCK unless NET_MPSAFE
Without KERNEL_LOCK, rt_timer_work and rt_free_work can run in parallel
with other LWPs running in the network stack, which eventually results
in say use-after-free of a deleted route.
external/apache2/mDNSResponder/dist/mDNSShared/PlatformCommon.c: revision 1.7
external/apache2/mDNSResponder/dist/mDNSPosix/PosixDaemon.c: revision 1.16
mdnsd(8): restore fixes for PR bin/46758, lost on resolving merge conflicts.
Original commit message from Roy Marples:
"Derive our primary interface and address by trying to connect to an
address in the TEST-NET-2 network as noted in RFC5737 instead of using
the 1.1.1.1 address. Also, use port 7 (echo) for better style.
Fixes PR bin/46758 thanks to Lloyd Parkes."
bin/date/Makefile up to 1.16
bin/date/date.1 up to 1.54
bin/date/date.c up to 1.65
Add -R option for displaying time in RFC 5322 format, similar to GNU date.
Add -f option to set the time. From FreeBSD.
sys/dev/ipmi.c: revision 1.10
Ignore non-recoverable and critical limits smaller than the warning limits.
These are usually invalid.
Name the limit flags to make code more readable.
sys/arch/amiga/stand/loadbsd/loadbsd.c: revision 1.38
distrib/amiga/stand/loadbsd.uue: revision 1.4
sys/arch/amiga/stand/loadbsd/startit.s: revision 1.1
sys/arch/amiga/stand/loadbsd/Makefile: revision 1.5
sys/arch/amiga/stand/loadbsd/vmakefile: revision 1.1
sys/arch/amiga/stand/loadbsd/README: revision 1.6
Update loadbsd source and distribution binary to version 3.3.
- Loading the kernel to the highest priority memory segment is default now.
- New option -l to revert the to the previous behaviour of largest segment.
- New option -M to define a minimum size for the memory segment.
- Fixed some warnings and typos.
- Put assembler inline source into its own source text startit.s.
- Can be built with Bebbo's gcc6 Amiga port or with vbcc.
sys/lib/libsa/subr_prf.c: revision 1.30
libsa/printf: Do not fetch long va_arg as long long.
This does real harm iff all of the following conditions are satisfied:
(1) On ILP32 architectures.
(2) Both LIBSA_PRINTF_LONGLONG_SUPPORT and LIBSA_PRINTF_WIDTH_SUPPORT
compile-time options are enabled.
(3) Width field is used with 'l' modifier.
This is an implicit-fallthrough bug, but unfortunately, GCC 10.4 cannot
find this out somehow...
external/gpl3/gcc/usr.bin/libdecnumber/Makefile: revision 1.9
external/gpl3/gcc/usr.bin/common/Makefile: revision 1.12
external/gpl3/gcc/usr.bin/backend/Makefile: revision 1.67
external/gpl3/gcc/usr.bin/common-target/Makefile: revision 1.12
external/gpl3/gcc/usr.bin/frontend/Makefile: revision 1.15
external/gpl3/gcc/usr.bin/libcpp/Makefile: revision 1.10
gcc: fix build with clang++ HOST_CXX
Define HOSTPROG_CXX before .include anything that brings in bsd.own.mk.
This ensures that HOST_DBG (etc) gets assigned before HOST_CFLAGS
and HOST_CXXFLAGS is created.
backend: .include <bsd.init.mk> much earlier, as per the other directories.
Fixes backend build when using clang++ as the host compiler (e.g., macOS),
because backend host tools are now built with -O.
Inspired by https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255760
Fixes PR toolchain/57014
external/apache2/mDNSResponder/dist/mDNSPosix/PosixDaemon.c: revision 1.15
reapply changes for the built-in drop-privs support by tsarna.
this commit doesn't reapply "dumping of the unicast server list
to the DumpStateLog debugging output" enhancement.
It doesn't build anymore, no idea how to rewrite.
Should fix PR 57442. Needs pull-ups for netbsd-9, netbsd-10.
sys/arch/xen/conf/files.xen (apply patch)
Build fix to define the SELFRELOC option for XEN kernels.
This is not needed in newer branches as those include amd64/conf/files.amd64
from x86/conf/files.x86 (and get the definition via that path)
sys/ufs/ffs/ffs_snapshot.c: revision 1.155
ffs: apply the remaining ffs_snapshot.c part of this FreeBSD commit:
commit 364ed814e7285c8216d8a201d3ab3674eb34ce29
Author: Kirk McKusick <mckusick@FreeBSD.org>
Date: Thu Dec 9 21:24:00 2004 +0000
Fixes a bug that caused UFS2 filesystems bigger than 2TB to
prematurely report that they were full and/or to panic the kernel
with the message ``ffs_clusteralloc: allocated out of group''.
Submitted by: Henry Whincup <henry@jot.to>
MFC after: 1 week
all the other changes in that commit were applied previously by others:
- sborrill commmitted ffs_alloc.c rev 1.123 in 2009
- simonb committed ffs_alloc.c rev 1.110 in 2008
- the ffs_clusteralloc() part is not needed because we no longer have
that function.
fixes PR 57307
share/man/man8/man8.x86/boot.8: revision 1.27
sys/arch/i386/stand/efiboot/version: revision 1.3
share/man/man8/man8.x86/boot.8: revision 1.28 (via patch)
share/man/man8/man8.x86/boot.8: revision 1.29 (via patch)
sys/arch/i386/stand/lib/exec.c: revision 1.79
sys/arch/i386/stand/efiboot/efiboot.c: revision 1.13
sys/arch/i386/stand/efiboot/bootx64/efibootx64.c: revision 1.6
sys/arch/i386/stand/efiboot/bootia32/efibootia32.c: revision 1.6
sys/arch/i386/stand/efiboot/boot.c: revision 1.22
sys/arch/amd64/amd64/locore.S: revision 1.219
sys/arch/i386/stand/efiboot/bootia32/startprog32.S: revision 1.3
sys/arch/i386/stand/efiboot/efiboot.h: revision 1.12
sys/arch/amd64/conf/files.amd64: revision 1.121
sys/arch/amd64/conf/std.amd64: revision 1.13
share/man/man8/man8.x86/pxeboot.8: revision 1.6
sys/arch/i386/stand/efiboot/bootx64/startprog64.S: revision 1.4
sys/arch/amd64/amd64/locore.S: revision 1.220
share/man/man8/man8.x86/dosboot.8: revision 1.4
share/man/man4/options.4: revision 1.524
Add reloc keyworkd to let EFI bootstrap load amd64 kernel at any address
EFI bootstrap assumes it can copy the amd64 kernel to its ELF load
address (that is KERNTEXTOFF - KERNBASE = 0x200000), but it can
clash with previous UEFI memory allocation, as described here:
http://mail-index.netbsd.org/tech-kern/2023/04/07/msg028833.html
This change adds a reloc keyword for controling where the EFI
boostrap will copy the kernel image. Possible values are:
default - the default and prior behavior, copy at 0x200000.
none - do not copy and use the kernel image where it was loaded.
address - specify an explicit address where to copy the kernel.
This comes with an amd64 kernel patch that makes it self-relocatable.
It first discover where it was loaded in memory, and if this is
different than the expected 0x200000, hhe the kernel relocates
itself and start over at the right address.
Merge x86 boot options in x86/boot(8) and add undocumented UEFI options
We were supposed to keep the option list in x86/boot(8), x86/dosoot(8)
and x86/pxeboot(8) in sync, but it did not happen, hence it may work
better with all the options in x86/boot(8). Also add the undocumented
UEFI boot options.
Add a SELFRELOC kernel option for the sake of documentation clarity.
Instead of telling that x86/boot(8) reloc command needs a kernel able
to self relocate, we can tell it needs a kernel built with the
SELFRELOC option. This keeps the reader from wondering what could
make a kernel able to self relocate.
Remove XXX todo marker left by mistake
Raise the version for new feature (here reloc command)
Suggested by Masanobu SAITOH
sys/arch/dreamcast/dev/microcode/aica_armcode.h: revision 1.5
sys/arch/dreamcast/dev/microcode/aica_arm_locore.S: revision 1.4
sys/arch/dreamcast/dev/microcode/aica_arm_locore.S: revision 1.5
sys/arch/dreamcast/dev/microcode/Makefile: revision 1.6
sys/arch/dreamcast/dev/microcode/aica_arm.c: revision 1.7
sys/arch/dreamcast/dev/microcode/aica_arm.c: revision 1.8
arm side of aica(4) sometimes became unresponsive when audioplay was performed several times.
- disabled data cache at startup.
- compiled with cross-arm-none-eabi-gcc-8.3.0nb4 of pkg.
- added memset() in asm because gcc8 (and later) detects the zero clear part in
own bzero function and calls memset internally, and bzero were replaced with memset.
improve comment, update mailaddr, and remove clause 3 from my licenses.
sys/arch/luna68k/luna68k/mainbus.c: revision 1.20
Fix device name for xpbus at mainbus for LUNA-II, missed on psgpam merge.
Fortunately harmless because xpbus_match() doesn't check ma_name in
mainbus_attach_args.
usr.sbin/iostat/iostat.c: revision 1.68
Fix processing of the archaic arg format (BACKWARD_COMPATIBILITY) so it
doesn't repeat the processing every iteration. Repeatedly seeing the wait
interval does no harm, but setting the iteration count (reps) over and
over again rather defeats its purpose.
libexec/ld.elf_so/rtld.c: revision 1.212
ld.elf_so(8): Make fork take a shared, not exclusive, lock.
We only need to ensure that there are no concurrent modifications to
the rtld data structures in flight, since the threads that began
those modifications will not exist in the child and will therefore be
unable to complete them in the child.
A shared lock suffices to ensure there are no such concurrent
modifications in flight; an exclusive lock is not necessary, and can
cause deadlock if fork is executed from a signal handler, which is
explicitly allowed by POSIX (and our own sigaction(2) man page) which
marks fork as async-signal-safe.
PR lib/56979
sys/uvm/uvm_map.c: revision 1.395
uvm(9): Fix 19-year-old bug in assertion about mmap hint.
Previously this would _first_ remember the original hint, and _then_
clamp the hint to the VM map's range:
orig_hint = hint;
if (hint < vm_map_min(map)) { /* check ranges ... */
if (flags & UVM_FLAG_FIXED) {
UVMHIST_LOG(maphist,"<- VA below map range",0,0,0,0);
return (NULL);
}
hint = vm_map_min(map);
...
KASSERTMSG(!topdown || hint <= orig_hint, "hint: %#jx, orig_hint: %#jx",
(uintmax_t)hint, (uintmax_t)orig_hint);
Even if nothing else happens in the ellipsis, taking the branch
guarantees the assertion will fail in the topdown case.
sys/uvm/uvm_mmap.c: revision 1.180
mmap(2): If we fail with a hint, try again without it.
`Hint' here means nonzero addr, but no MAP_FIXED or MAP_TRYFIXED.
This is suboptimal -- we could teach uvm_mmap to do a fancier search
using the address as a hint. But this should do for now.
Candidate fix for PR kern/55533.
external/bsd/fetch/dist/libfetch/common.c: revision 1.3
external/bsd/fetch/dist/libfetch/common.c: revision 1.4
Use SNI.
Shut down SSL when closing connection.
sys/nfs/nfs_serv.c: revision 1.184
sys/nfs/nfs_srvsubs.c: revision 1.17
sys/nfs/nfsm_subs.h: revision 1.56
sys/nfs/nfsm_subs.h: revision 1.57
nfs: Use unsigned fhlen so we don't trip over negative values.
nfs: Avoid integer overflow in nfs_namei bounds check.
nfs: Use unsigned name lengths so we don't trip over negative ones.
- nfsm_strsiz is only used with uint32_t in callers, but let's not
leave it as a rake to step on.
- nfsm_srvnamesiz is abused with signed s. The internal conversion
to unsigned serves to reject both negative and too-large values in
such callers.
XXX Should make all callers use unsigned, rather than flipping back
and forth between signed and unsigned for name lengths.
nfs: Avoid free of uninitialized on bad name size in create, mknod.
XXX These error branches are a nightmare and need to be more
systematically cleaned up. Even if they are correct now, they are
impossible to audit and extremely fragile in case anyone ever needs
to make other changes to them.
distrib/amiga/stand/xdevtostream.uue: revision 1.1
distrib/amiga/stand/device-streams-2.2.1.lha.uue: revision 1.1
distrib/amiga/stand/rdbinfo.uue: revision 1.2
distrib/amiga/stand/device-streams.tar.gz.uue: file removal
distrib/amiga/stand/Makefile: revision 1.6
distrib/amiga/stand/device-streams-2.2.1-src.tar.gz.uue: revision 1.1
distrib/amiga/stand/device-streams.README.md: revision 1.1
distrib/amiga/stand/update: revision 1.1
distrib/amiga/stand/xstreamtodev.uue: revision 1.2
Update device-streams binaries from Roc Valles
- Split device-streams.tar.gz.uue into seperate source and
binaries device-streams-2.2.1-src.tar.gz and device-streams-2.2.1.lha
to match upstream
- Add device-streams.README.md from upstream
- Add simple 'update' script to help updating next time
- Binaries now avoid 32 bit file offset issues (they use 64 bit
offsets where supported, and otherwise avoid corrupting data due
to 32 bit limits)
- Binaries now built with updated bebbo/amiga-gcc toolchain
Pullup: netbsd-10, netbsd-9 and possibly netbsd-8
sys/netinet6/raw_ip6.c: revision 1.183 (via patch)
sys/netinet6/ip6_output.c: revision 1.233
in6: reject setting negative values but -1 via setsockopt(IPV6_CHECKSUM)
Same as OpenBSD.
in6: make sure a user-specified checksum field is within a packet
From OpenBSD
sys/dev/vnd.c: revision 1.288
Do not limit the number of pending requests for the worker thread.
With wedge on vnd it prevents a deadlock when requests get queued with
biodone() -> dkstart() -> vndstrategy().
Fixes PR kern/57263 "vnd locks up when using vn_rdwr"
usr.sbin/npf/npf-params.7: revision 1.9
sys/net/npf/npf_params.c: revision 1.6
PR kern/55654:
Switch default for parameter npf ip4.reassembly to 1.
This makes the NPF default configuration comply with host
requirements for IPv4.
build.sh: revision 1.366 via patch
Avoid the dependency on a populated tooldir (or building the tools)
when simply doing mkrepro-timestamp and the current repository setups
does not actually require it.
martin