operation kauth_authorize_system().
KAUTH_SYSTEM_MOUNT / KAUTH_REQ_SYSTEM_MOUNT_NEW wants the to be
covered vnode and the mount flags, not the mount structure.
Fix for PR kern/55602: zpool panic on mounting zfs filesystem
else sys.mk will attempt to write it to the source tree,
which may be r/o and fail.
XXX may cause updates builds to fail because a file listed
in .depend won't exist anymore.
add method to transform both the "__foo__" and "@foo@"
version of various transforms, while upstream are converting
from the former to the latter it seems. convert all the
common transforms to this method.
expand the grep for .pc files to look for missing @foo@
fixes to the man page genration, and ignore a few things
(thanks uwe@ - .IN lines, and stuff between tab(@) and .TE.)
xorg-server __default_font_path__ -> @default_font_path@,
and xfree86 transform xconfigdir, xkbdir, and modulepath
using new both method.
Reset STACK_BOUNDARY to default, 16, to fix strange freeze for amiga,
when kernel is compiled by GCC8.
For m68k, the stack pointer is required to be aligned to 16-bit boundary
by architecture. Whereas System V ABI demands it to be aligned to 32-bit
boundary.
According to the document, STACK_BOUNDARY is ``the minimum alignment
enforced by hardware for the stack pointer on this machine.'' Whereas,
PREFERRED_STACK_BOUNDARY should be used ``if you wish to preserve a
certain alignment for the stack pointer, greater than what the hardware
enforces.''
Therefore, STACK_BOUNDARY and PREFERRED_STACK_BOUNDARY should be 16 and
32, respectively, for m68k. This is how Linux/m68k does.
GCC 8 generates codes that wisely allocate 64-bit objects on stack by
using STACK_BOUNDARY. This corrupts the stack frame if it is not properly
aligned.
Since the architecture only guarantees the stack pointer to be aligned to
16-bit boundary, it is not aligned to 32-bit boundary in an instance in
general. If the interrupt occurs at this moment, the interrupt handler
spoils the stack frame as explained above, which results in the mysterious
kernel freezes.
I guess that similar failures can occur even for userland with signal.
With this setting, amiga kernel works just fine as far as I can see.
Furthermore, I've confirmed for amiga, mac68k, and sun3,
(1) Kernel compiled by patched GCC8 works with
(1-a) userland built by GCC7 and non-modified GCC8, and
(1-b) userland built by patched GCC8.
(2) Userland binaries compiled by GCC7 and non-modified GCC8 work fine
with kernel and base libraries built by patched GCC8.
(3) There's no regression observed for tests/kernel, tests/lib/libc/sys,
and tests/lib/libc/gen.
This also fixes sun2 kernel to a considerable extent. With non-modified
GCC8, sun2 kernel crashes in strange ways during the early boot stages.
With this change, it boots singleuser.
OK mrg
Version 4.4.2
22 January 2020
Release Notes
NEW FEATURES
Please note that that ISC DHCP is now licensed under the Mozilla Public License,
MPL 2.0. Please see https://www.mozilla.org/en-US/MPL/2.0/ to read the MPL 2.0
license terms.
While release 4.4.2 is primarily a maintenance release that addresses a number
of defects, it does introduce a few new features:
- Keama - Keama is a migration utility that assists in converting ISC DHCP
server configuration files to Kea configuration files. It is found in the
keama subdirectory and includes a README.md file with instructions on how
to build it as well as a manpage on its usage.
- Two new server parameters related to ping checking were added:
1. ping-cltt-secs which allows the user to specify the number of seconds
that must elapse since CLTT before a ping check is conducted.
2. ping-timeout-ms which allows the user to specify the amount of time the
server waits for a ping-check response in milliseconds rather than in
seconds.
In general, the areas of focus for ISC DHCP 4.4 were:
1. Dynamic DNS additions
2. dhclient improvements
3. Support for dynamic shared libraries
Dynamic DNS Improvements:
- We added three new server configuration parameters which influence DDNS
conflict resolution:
1. ddns-dual-stack-mixed-mode - alters DNS conflict resolution behavior
to mitigate issues with non-compliant clients in dual stack environments.
2. ddns-guard-id-must-match - relaxes the DHCID RR client id matching
requirement of DNS conflict resolution.
3. ddns-other-guard-is-dynamic - alters dual-stack-mixed-mode behavior to
allow unguarded DNS entries to be overwritten in certain cases
- The server now honors update-static-leases parameter for static DHCPv6
hosts.
dhclient Improvements:
- We've added three command line parameters to dhclient:
1. --prefix-len-hint - directs dhclient to use the given length as
the prefix length hint when requesting prefixes
2. --decline-wait-time - instructs the client to wait the given number
of seconds after declining an IPv4 address before issuing a discover
3. --address-prefix-len - specifies the prefix length passed by dhclient
into the client script (via the environment variable ip6_prefixlen) with
each IPv6 address. We added this parameter because we have changed the
default value from 64 to 128 in order to be compliant with RFC3315bis
draft (-09, page 64) and RFC5942, Section 4, point 1.
**WARNING**: The new default value of 128 may not be backwardly compatible
with your environment. If you are operating without a router, such as
between VMs on a host, you may find they cannot see each other with prefix
length of 128. In such cases, you'll need to either provide routing or use
the command line parameter to set the value to 64. Alternatively you may
change the default at compile time by setting DHCLIENT_DEFAULT_PREFIX_LEN
in includes/site.h.
- dhclient will now generate a DHCPv6 DECLINE message when the client script
indicates a DAD failure
Dynamic shared library support:
Configure script, configure.ac+lt, which supports libtool is now provided
with the source tar ball. This script can be used to configure ISC DHCP
to build with libtool and thus use dynamic shared libraries.
Other Highlights:
- The server now supports dhcp-cache-threshold for DHCPv6 operations
- The server now supports DHPv6 address allocation based on EUI-64 DUIDs
- Experimental support for alternate relay port in the both the server
and relay for IPv4, IPv6 and 4o6 (see: draft-ietf-dhc-relay-port-10.txt)
For information on how to install, configure and run this software, as
well as how to find documentation and report bugs, please consult the
README file.
ISC DHCP uses standard GNU configure for installation. Please review the
output of "./configure --help" to see what options are available.
The system has only been tested on Linux, FreeBSD, and Solaris, and may not
work on other platforms. Please report any problems and suggested fixes to
<dhcp-users@isc.org>.
ISC DHCP is open source software maintained by Internet Systems
Consortium. This product includes cryptographic software written
by Eric Young (eay@cryptsoft.com).
Changes since 4.4.2b1 (Bug Fixes)
- Added a clarification on DHCPINFORMs and server authority to
dhcpd.conf.5
[Gitlab #37]
- Only emit lease scrubbing log messages when DEBUG_FAILOVER_MESSAGES
is defined.
[Gitlab #72]
- Added the interface name to socket initialization failure log messages.
Prior to this the log messages stated only the error reason without
stating the target interface.
[Gitlab #75]
- Corrected buffer pointer logic in dhcrelay functions that manipulate
agent relay options. Thanks to Thomas Imbert of MSRC Vulnerabilities
& Mitigations for reporting the issue.
[#71]
- Corrected unresolved symbol errors building relay_unittests when
configured to build using libtool.
[#80]
Changes since 4.4.1 (New Features)
- A new configuration parameter, ping-cltt-secs (v4 operation only), has
been added to allow the user to specify the number of seconds that must
elapse since CLTT before a ping check is conducted. Prior to this, the
value was hard coded at 60 seconds. Please see the server man pages for
a more detailed discussion.
[ISC-Bugs #36283]
- A new configuration parameter, ping-timeout-ms (v4 operation only),
has been added that allows the user to specify the amount of time
the server waits for a ping-check response in milliseconds rather
than in seconds (via ping-timeout). When greater than zero, the value
of ping-timeout-ms will override the value of ping-timeout. Thanks
to Jay Doran from Bluecat Networks for suggesting this feature.
[Gitlab #10]
- An experimental tool called, Keama (KEA Migration Assistant), which helps
translate ISC DHCP configurations to Kea configurations, is now included
in the distribution.
[Gitlab #34]
Changes since 4.4.1 (Bug Fixes)
- Corrected a misuse of the BIND9 DDNS API which caused DDNS updates to be
carried out over TCP rather than UDP. The coding error was exposed by
migration to BIND9 9.11. Thanks to Jinmei Tatuya at Infoblox for
reporting the issue.
[ISC-Bugs #47757]
- Bind9 now defaults to requiring python to build. The Makefile for
building Bind9 when bundled with ISC DHCP was modified to turn off
this dependency.
[Gitlab #3]
- Corrected a dual-stack mixed-mode issue that occurs when both
ddns-guard-id-must-match and ddns-other-guard-is-dynamic
are enabled and that caused the server to incorrectly interpret
the presence of a guard record belonging to another client as
a case of no guard record at all. Thanks to Fernando Soto
from BlueCat Networks for reporting this issue.
[Gitlab #1]
- Corrected a compilation issue that occurred when building without DNS
update ability (e.g. by undefining NSUPDATE).
[Gitlab #16]
- Corrected an issue that was causing the server, when running in
DHPCv4 mode, to segfault when class lease limits are reached.
Thanks to Peter Nagy at Porion-Digital for reporting the matter
and submitting a patch.
[Gitlab #13]
- Made minor changes to eliminate warnings when compiled with GCC 9.
Thanks to Brett Neumeier for bringing the matter to our attention.
[Gitlab #15]
- Fixed potential memory leaks in parser error message generation
spotted by Coverity, CIDs: 1448191, 1448193, 1448194, 1448195
[Gitlab #30]
- Updated URL of IEEE oui.txt in contrib/dhcp-lease-list.pl. Thanks
to Tommy Smith for contributing the patch.
[Gitlab #26]
- Fixed define flags when using SO_BINDTODEVICE. Thanks to Joe LeVeque for
reporting the issue.
[GitLab #19]
- Applied a patch from OpenBSD to always set the scope id of outbound
DHPCv6 packets. Note this change only applies when compiling under
OpenBSD. Thanks to Brad Smith at OpenBSD from bringing it to our
attention.
[Gitlab #33]
- Modified dhclient to not discard config file leases that are
duplicates of server-provided leases and to retain such leases
after they have been used as the fallback active lease and
DHCP service has been restored. This allows them to be used
more than once during the lifetime of a dhclient instance.
This applies to DHCPv4 operation only.
[Gitlab #9]
- Corrected a number of reference counter and zero-length buffer leaks.
Thanks to Christopher Ertl of MSRC Vulnerabilities & Mitigations for
pointing them out.
[Gitlab #57]
- Closed a small window of time between the installation of graceful
shutdown signal handlers and application context startup, during which
the receipt of shutdown signal would cause a REQUIRE() assertion to
occur. Note this issue is only visible when compiling with
ENABLE_GENTLE_SHUTDOWN defined.
[Gitlab #53]
- Corrected a buffer overflow that can occur when retrieving zone
names that are more than 255 characters in length.
[Gitlab #20]
- The "d" domain name option format was incorrectly handled as text
instead of RFC 1035 wire format. Thanks to Jay Doran at BlueCat Networks
for reporting this issue.
[Gitlab #2]
- Improved the error message issued when a host declaration has both
a uid and a dhcp-client-identifier. Server configuration parsing will
now fail if a host declaration specifies more than one uid.
[Gitlab #7]
- Updated developer's documentation on building and running unit tests.
Removed support for --with-atf=bind as BIND9 no longer bundles in ATF
source.
[Gitlab #35]
- Fixed a syntax error in ldap.c which cropped up under Ubuntu
18.04.1/gcc 7.4.0. Thanks to Charles Hedrick for pointing it out.
[Gitlab #51]
- Added clarification to dhcp-options.5 section on ip-address values
describing the first-use DNS resolution of options with hostnames as
values (e.g. next-server).
[Gitlab #28]
- The option format for the server option omapi-key was changed to a
format type 'k' (key name); while server options ldap-port and
ldap-init-retry were changed to 'L' (unsigned 32-bit integer). These
three options were inadvertantly broken when the 'd' format content
was changed to comply with RFC 1035 wire format (see Gitlab #2).
[Gitlab #68]
5458. [bug] Prevent a theoretically possible NULL dereference caused
by a data race between zone_maintenance() and
dns_zone_setview_helper(). [GL #1627]
5455. [bug] named could crash when cleaning dead nodes in
lib/dns/rbtdb.c that were being reused. [GL #1968]
5454. [bug] Address a startup crash that occurred when the server
was under load and the root zone had not yet been
loaded. [GL #1862]
5453. [bug] named crashed on shutdown when a new rndc connection was
received during shutdown. [GL #1747]
5452. [bug] The "blackhole" ACL was accidentally disabled for client
queries. [GL #1936]
5451. [func] Add 'rndc dnssec -status' command. [GL #1612]
5449. [bug] Fix a socket shutdown race in netmgr udp. [GL #1938]
5448. [bug] Fix a race condition in isc__nm_tcpdns_send().
[GL #1937]
5447. [bug] IPv6 addresses ending in "::" could break YAML
parsing. A "0" is now appended to such addresses
in YAML output from dig, mdig, delv, and dnstap-read.
[GL #1952]
5446. [bug] The validator could fail to accept a properly signed
RRset if an unsupported algorithm appeared earlier in
the DNSKEY RRset than a supported algorithm. It could
also stop if it detected a malformed public key.
[GL #1689]
5444. [bug] 'rndc dnstap -roll <value>' did not limit the number of
saved files to <value>. [GL !3728]
5443. [bug] The "primary" and "secondary" keywords, when used
as parameters for "check-names", were not
processed correctly and were being ignored. [GL #1949]
5441. [bug] ${LMDB_CFLAGS} was missing from make/includes.in.
[GL #1955]
5440. [test] Properly handle missing kyua. [GL #1950]
5439. [bug] The DS RRset returned by dns_keynode_dsset() was used in
a non-thread-safe manner. [GL #1926]
--- 9.16.4 released ---
5438. [bug] Fix a race in TCP accepting code. [GL #1930]
5437. [bug] Fix a data race in lib/dns/resolver.c:log_formerr().
[GL #1808]
5436. [security] It was possible to trigger an INSIST when determining
whether a record would fit into a TCP message buffer.
(CVE-2020-8618) [GL #1850]
5435. [tests] Add RFC 4592 responses examples to the wildcard system
test. [GL #1718]
5434. [security] It was possible to trigger an INSIST in
lib/dns/rbtdb.c:new_reference() with a particular zone
content and query patterns. (CVE-2020-8619) [GL #1111]
[GL #1718]
5431. [func] Reject DS records at the zone apex when loading
master files. Log but otherwise ignore attempts to
add DS records at the zone apex via UPDATE. [GL #1798]
5430. [doc] Update docs - with netmgr, a separate listening socket
is created for each IPv6 interface (just as with IPv4).
[GL #1782]
5428. [bug] Clean up GSSAPI resources in nsupdate only after taskmgr
has been destroyed. Thanks to Petr Menšík. [GL !3316]
5426. [bug] Don't abort() when setting SO_INCOMING_CPU on the socket
fails. [GL #1911]
5425. [func] The default value of "max-stale-ttl" has been changed
from 1 week to 12 hours. [GL #1877]
5424. [bug] With KASP, when creating a successor key, the "goal"
state of the current active key (predecessor) was not
changed and thus never removed from the zone. [GL #1846]
5423. [bug] Fix a bug in keymgr_key_has_successor(): it incorrectly
returned true if any other key in the keyring had a
successor. [GL #1845]
5422. [bug] When using dnssec-policy, print correct key timing
metadata. [GL #1843]
5421. [bug] Fix a race that could cause named to crash when looking
up the nodename of an RBT node if the tree was modified.
[GL #1857]
5420. [bug] Add missing isc_{mutex,conditional}_destroy() calls
that caused a memory leak on FreeBSD. [GL #1893]
5418. [bug] delv failed to parse deprecated trusted-keys-style
trust anchors. [GL #1860]
5416. [bug] Fix a lock order inversion in lib/isc/unix/socket.c.
[GL #1859]
5415. [test] Address race in dnssec system test that led to
test failures. [GL #1852]
5414. [test] Adjust time allowed for journal truncation to occur
in nsupdate system test to avoid test failure.
[GL #1855]
5413. [test] Address race in autosign system test that led to
test failures. [GL #1852]
5412. [bug] 'provide-ixfr no;' failed to return up-to-date responses
when the serial was greater than or equal to the
current serial. [GL #1714]
5411. [cleanup] TCP accept code has been refactored to use a single
accept() and pass the accepted socket to child threads
for processing. [GL !3320]
5409. [performance] When looking up NSEC3 data in a zone database, skip the
check for empty non-terminal nodes; the NSEC3 tree does
not have any. [GL #1834]
5408. [protocol] Print Extended DNS Errors if present in OPT record.
[GL #1835]
5407. [func] Zone timers are now exported via statistics channel.
Thanks to Paul Frieden, Verizon Media. [GL #1232]
5405. [bug] 'named-checkconf -p' could include spurious text in
server-addresses statements due to an uninitialized DSCP
value. [GL #1812]
Some highlights in no particular order:
%destructor was somehow lost from the list that follows, it should be
part of it.
Use .Ic for yacc directives when they are defined, .Ql otherwise.
Use explicit .Sq Li (instead of .Ql) in description of %destructor to
make sure the result is consistently quoted. It more readable that
way.
Use .Va and .Vt where appropriate.
C preprocessor directives are marked up with .No (a nop), so that it's
easy to switch them to something else if need be. For now just use
them as plain words.
- add .../xorg subdir to the path
- add dbe and present extensions, both wanted via linkage
.. but maybe these shouldn't be built? they're not in sets.
All these port specific X11R6 servers just used MI wscons, and
all of them have been switched to Xorg servers with wsfb driver etc.
Even if someone wants a smaller monolithic server, it should be
written as a MI "Xwscons" server.
- use ${X11INCS.DIX} in <bsd.x11.mk>
- explicitly undef HAVE_XORG_CONFIG_H to avoid reference to
hw/xfree86/common in mi/miinitext.c
- remove -DHAVE_DIX_CONFIG_H which is already defined in
${X11FLAGS.DIX} and pulled via Makefile.servermod
XXX: -DHAVE_STRCASECMP should also be moved to ${X11FLAGS.DIX},
or should be pulled via include/dix-config.h?
If there is no matching interface given, but interface matching is enabled
then all interfaces on the system will try to be initialized.
Non wireless interfaces will fail and the loopback device will be one
of these, so just log a diagnostic rather than an error.
