The length/scale example at the beginning is not all literal.
Fix remaining "quoted" words to use .Dq
Fix a few small inline code snippets to be literal.
While here, disable periodic scanning by default on NetBSD as it's
no longer needed.
The user can still enable it though with a positive number to the -U
option.
kardel@ So far I see no other issues from the pitfalls I know of
With the correct #defines mini_event.c and winsock_event.c are
compiled but practically unused.
What is exposed is not part of the public API, but appease the
peanut gallery.
Messages such as RTM_IFNFO or RTM_IFANNOUNCE could have been lost.
As such, sync the state of our internal driver to the state of the
system interfaces as reported by getifaddrs(2).
This change requires the routing socket be placed in non-blocking
mode. While here, set the routing and inet sockets to close on exec.
* DHCP: For anonymous, just use a generic ClientID
* link: Split hardware address randomisation out of anonymous option
* link: Only report hardware changes for active interfaces
* link: Report errors obtaining recv buffer size on overflow
* hooks: Add NOCARRIER_ROAMING reason
* hooks: interface_order now reflects priorities again
- Support continuing to install to /var/db/pkg if it exists and the
new pkgdb doesn't.
In the future, we can warn about this once we have tested advice that
we can give to users who want to move the location of pkgdb.
- Don't do anything about /var/db/pkg on non-NetBSD-base.
This creates conflicts with other package managers that also install to
/var/db/pkg.
hid_linux: return FIDO_OK if no devices are found.
hid_osx:
repair communication with U2F tokens, gh#166;
reliability fixes.
fido2-{assert,cred}: new options to explicitly toggle UP, UV.
Support for configurable report lengths.
New API calls:
fido_cbor_info_maxcredcntlst;
fido_cbor_info_maxcredidlen;
fido_cred_aaguid_len;
fido_cred_aaguid_ptr;
fido_dev_get_touch_begin;
fido_dev_get_touch_status.
Use COSE_ECDH_ES256 with CTAP_CBOR_CLIENT_PIN; gh#154.
Allow CTAP messages up to 2048 bytes; gh#171.
Ensure we only list USB devices by default.
Version 1.4.0 (2020-04-15)
hid_hidapi: hidapi backend; enable with -DUSE_HIDAPI=1.
Fall back to U2F if the key claims to, but does not support FIDO2.
FIDO2 credential protection (credprot) support.
New API calls:
fido_cbor_info_fwversion;
fido_cred_prot;
fido_cred_set_prot;
fido_dev_set_transport_functions;
fido_set_log_handler.
Support for FreeBSD.
Support for C++.
Support for MSYS.
Fixed EdDSA and RSA self-attestation.
Version 1.3.1 (2020-02-19)
fix zero-ing of le1 and le2 when talking to a U2F device.
dropping sk-libfido2 middleware, please find it in the openssh tree.
With the following changes:
* DHCP: If error adding the address in oneshot, exit with failure
* DHCP: Only listen to the address if we successfully added it
* DHCP6: Fix segfault introduced in dhcpcd-9.3.3
* DHCP6: Abort in test mode when an error is returned by server
* options: allow --ia_na=1 and --ia_pd=2 on the command line
* options: Allow duid to take a value
* dhcpcd: Don't create a launcher process if keeping in foreground
* dhcpcd: Add --noconfigure option
* control: Create an unpriv socket for non master mode
* options: Don't log unknown ones when printing pidfile location
Cherry-picked from upstream:
https://git.savannah.gnu.org/gitweb/?p=config.git;a=commit;h=1c4398015583eb77bc043234f5734be055e64bea
Everything except external/apache2/llvm/dist/llvm/cmake/config.guess
is patched, which is under vendor tag and cannot be modified. I expect
that this file is not actually used as we use hand-crafted version of
configure script instead of cmake for building LLVM.
Note that external/apache2/llvm/autoconf/autoconf/config.guess has
already been committed on Oct. 20, but commit message disappeared as
cvs aborted due to "permission denied" when trying to modify the file
mentioned above. Sorry for confusing you.
Also note that GMP uses its own config.guess Patch for
external/lgpl3/gmp/dist/config.guess is provided by ryo@. Thanks!
at least a few pkgsrc packages avoid base sqlite because it fails
this check, and it's probably a surprising performance penalty for
unsuspecting users
I have added a Makefile rule, indicating how to generate the manual
pages again. It has no dependency on the original file, in order to
avoid issues when building: the generation depends in asciidoc and
libxslt, which are not in tools or in the base tree anyway. It should
therefore never trigger, but should be used by the maintainer when
updating pam-u2f.
With this, I believe this PR can be closed.
Tested with "build.sh release" on amd64.
I have generated the manual pages and referenced them into the sets.
It would probably help to add a Makefile rule, indicating how to
generate the manual pages again.
Tested with "build.sh release" on amd64.
Reviewed by Tobias Nygren before the commit.
* Do not write after the end of the array and overwrite the stack when
colon-separated SGR sequences contain empty arguments.
CHANGES FROM 3.1a TO 3.1b
* Fix build on systems without sys/queue.h.
* Fix crash when allow-rename is on and an empty name is set.
CHANGES FROM 3.1 TO 3.1a
* Do not close stdout prematurely in control mode since it is needed to print
exit messages. Prevents hanging when detaching with iTerm2.
CHANGES FROM 3.0a TO 3.1
* Only search the visible part of the history when marking (highlighting)
search terms. This is much faster than searching the whole history and solves
problems with large histories. The count of matches shown is now the visible
matches rather than all matches.
* Search using regular expressions in copy mode. search-forward and
search-backward use regular expressions by default; the incremental versions
do not.
* Turn off mouse mode 1003 as well as the rest when exiting.
* Add selection_active format for when the selection is present but not moving
with the cursor.
* Fix dragging with modifier keys, so binding keys such as C-MouseDrag1Pane and
C-MouseDragEnd1Pane now work.
* Add -a to list-keys to also list keys without notes with -N.
* Do not jump to next word end if already on a word end when selecting a word;
fixes select-word with single character words and vi(1) keys.
* Fix top and bottom pane calculation with pane border status enabled.
* Add support for adding a note to a key binding (with bind-key -N) and use
this to add descriptions to the default key bindings. A new -N flag to
list-keys shows key bindings with notes. Change the default ? binding to use
this to show a readable summary of keys. Also extend command-prompt to return
the name of the key pressed and add a default binding (/) to show the note
for the next key pressed.
* Add support for the iTerm2 DSR 1337 sequence to get the terminal version.
* Treat plausible but invalid keys (like C-BSpace) as literal like any other
unrecognised string passed to send-keys.
* Detect iTerm2 and enable use of DECSLRM (much faster with horizontally split
windows).
* Add -Z to default switch-client command in tree mode.
* Add ~ to quoted characters for %%%.
* Document client exit messages in the manual page.
* Do not let read-only clients limit the size, unless all clients are
read-only.
* Add a number of new formats to inspect what sessions and clients a window is
present or active in.
* Change file reading and writing to go through the client if necessary. This
fixes commands like "tmux loadb /dev/fd/X". Also modify source-file to
support "-" for standard input, like load-buffer and save-buffer.
* Add ~/.config/tmux/tmux.conf to the default search path for configuration
files.
* Bump the escape sequence timeout to five seconds to allow for longer
legitimate sequences.
* Make a best effort to set xpixel and ypixel for each pane and add formats for
them.
* Add push-default to status-left and status-right in status-format[0].
* Do not clear search marks on cursor movement with vi(1) keys.
* Add p format modifier for padding to width and allow multiple substitutions
in a single format.
* Add -f for full size to join-pane (like split-window).
* Do not use bright when emulating 256 colours on an 8 colour terminal because
it is also bold on some terminals.
* Make select-pane -P set window-active-style also to match previous behaviour.
* Do not truncate list-keys output.
* Turn automatic-rename back on if the \033k rename escape sequence is used
with an empty name.
* Add support for percentage sizes for resize-pane ("-x 10%"). Also change
split-window and join-pane -l to accept similar percentages and deprecate the
-p flag.
* Add -F flag to send-keys to expand formats in search-backward and forward
copy mode commands and copy_cursor_word and copy_cursor_line formats for word
and line at cursor in copy mode. Use for default # and * binding with vi(1)
keys.
* Add formats for word and line at cursor position in copy mode.
* Add formats for cursor and selection position in copy mode.
* Support all the forms of RGB colour strings in OSC sequences rather than
requiring two digits.
* Limit lazy resize to panes in attached sessions only.
* Add an option to set the key sent by backspace for those whose system uses ^H
rather than ^?.
* Change new-session -A without a session name (that is, no -s option also) to
attach to the best existing session like attach-session rather than a new
one.
* Add a "latest" window-size option which tries to size windows based on the
most recently used client. This is now the default.
* Add simple support for OSC 7 (result is available in the pane_path format).
* Add push-default and pop-default for styles which change the colours and
attributes used for #[default]. These are used in status-format to restore
the behaviour of window-status-style being the default for
window-status-format.
* Add window_marked_flag.
* Add cursor-down-and-cancel in copy mode.
* Default to previous search string for search-forward and search-backward.
* Add -Z flag to rotate-window, select-pane, swap-pane, switch-client to
preserve zoomed state.
* Add -N to capture-pane to preserve trailing spaces.
* Add reverse sorting in tree, client and buffer modes.
* DHCP: Add support for IPv6-Only Preferred option, RFC 8925.
* BSD: `LINK_STATE_UNKNOWN` is treated as UP once again
* privsep: pass logging to the privileged actioneer
* privsep: allow logfile re-opening to work
* privsep: close BPF socket on ENXIO
* privsep: don't leave a BOOTP BPF listener rebooting in non master mode
* dhcpcd: carrier handling issue fixed from 9.3.0
* dhcpcd: log if interface type is unsupported in debug
* duid: memory leak fixed if UUID wanted but none available
* privsep: fix receiving inet and no BPF running
* privsep: allow gettimeofday for SECCOMP
* privsep: fix stderr redirection again
GCC 9.3 seems to be able to compile rtree.c with -O2:
- No new regressions in ATF.
- System survives over a night, at least, under heavy loads.
On the other hand, unfortunately, GCC 9.3 still miscompiles tcache.c
with -O2 or -O1. For example, even ``gcc -g hello.c'' fails with ICE
if tcache.c is compiled with -O[12] in libc.
* dhcpcd: Backticks have been removed from quoting filenames
* dhcpcd: Only manipulate stdin, stdout and stderr if they are valid
* duid: Adjust option so the type can be specified
* logerr: Don't leak logfile fd to scripts
* privsep: Run the launcher process in the sandbox
* BSD: Use `ifi_link_state` as the single source of truth about carrier
* BSD: Ignore vether(4) devices by default
into '_' to meet sh variable name rules) into a shell string processing
loop.
On my test system, this reduces the total elapsed time for the bin/sh ATF
tests from about 109 secs to about 102 (user cpu from 24.5 to 21, sys cpu
from 34 to 30) and the usr.bin/make tests elapsed time from 42.5 to 40
secs (user from a bit over 15 to a bit over 13, and sys from 16+ to 13+).
(Recorded on an AMD64 domU).
These probably exaggerate the effect, as there are a bunch of quite small
tests, which means the ATF overhead (which this change affects) is a greater
proportion of the total test time than for some other tests where most of
the time is spent actually testing.
But I am fairly confident that there will be at least some improvement.
This could be further improved by removing the cmdsub invocation method,
and instead passing the name of a variable containing the string to
normalise (with the result returned in that same var) - but that would
mean altering all the callers as well. Some other time maybe.
* route: ensure IPv4LL routes come last in priority
* DHCP: fix many issues with extending the last lease
* privsep: don't read control group from config in privsep
* privsep: only the master process responds to signals
* privsep: use a socketpair for stderr/stdin rather than dupping /dev/null
* privsep: right limit stdin/stderr/stdout
* privsep: dumping a lease is now run in a sandbox
* options: check if kernel supports INET or INET6 before enabling default
* options: let clientid override a prior duid
* options: allow -1 to represent infinity for requested lease time
* dhcpcd: fix a crash initing a new interface after route overflow
right now. new address-of-packed-member and format-overflow
warnings have new GCC_NO_ADDR_OF_PACKED_MEMBER amd
GCC_NO_FORMAT_OVERFLOW variables to remove these warnings.
apply to a bunch of the tree. mostly, these are real bugs that
should be fixed, but in many cases, only by removing the 'packed'
attribute from some structure that doesn't really need it. (i
looked at many different ones, and while perhaps 60-80% were
already properly aligned, it wasn't clear to me that the uses
were always coming from sane data vs network alignment, so it
doesn't seem safe to remove packed without careful research for
each affect struct.) clang already warned (and was not erroring)
for many of these cases, but gcc picked up dozens more.
Some highlights in no particular order:
%destructor was somehow lost from the list that follows, it should be
part of it.
Use .Ic for yacc directives when they are defined, .Ql otherwise.
Use explicit .Sq Li (instead of .Ql) in description of %destructor to
make sure the result is consistently quoted. It more readable that
way.
Use .Va and .Vt where appropriate.
C preprocessor directives are marked up with .No (a nop), so that it's
easy to switch them to something else if need be. For now just use
them as plain words.
If there is no matching interface given, but interface matching is enabled
then all interfaces on the system will try to be initialized.
Non wireless interfaces will fail and the loopback device will be one
of these, so just log a diagnostic rather than an error.
Fix crash due to out-of-bounds access with Ctrl-W.
PR is only for nottywerase, but also fix ttywerase case, taken from
OpenBSD via nvi2:
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/vi/vi/v_txt.c#rev1.235d5365d358
Also, comment there is no worry for altwerase specific code, which
seems suspicious at a glance.
Reported by Azuma OKAMOTO.
Thanks for detailed explanation how to reproduce the problem!
Update kyua-cli to C++11 and use unique_ptr instead of auto_ptr,
(with std::move() where appropriate), to avoid deprecated warning by g++ 8.
(I didn't change some of the code that could arguably be refactored
to use unique_ptr or shared_ptr instead of raw pointers
and therefore remove the special case destructor handling).
* inet6: Add support for reporting Mobile IPv6 RA's
* inet6: Report RA Proxy flag if set
* BSD: Allow non NetBSD and OpenBSD to set IN6_IFF_AUTOCONF
* privsep: Don't handle any signals meant for the main process
* eloop: Try and survive a signal storm
* dhcpcd: Add an option to poll the interface carrier state
* script: Make visible some link level parameters to lease dumping
* inet6: Don't regen temp addresses we didn't add
* privsep: Don't limit file writes if logging to a file
* DHCP6: Fix lease timings with nodelay option
* NetBSD: free ARP state once IPv4LL address announced
* NetBSD: Mark RA dervied addresses as AUTOCONF
* BSD: Only mark static routes from dhcpcd.conf as static
* DHCP6: Ensure requested addresses are requested
* DHCP6: Fix prefix length calculation when no prefix specified
* privsep: Implement a resource limited sandbox
* Remove unused subtype_mime (Steve Grubb)
* Remove unused check in okstat (Steve Grubb)
* Fix mime-type in elf binaries by making sure $x is set
* Fix indirect negative offsets broken by OFFNEGATIVE
* Fix GUID equality check
* PR/165: Handle empty array and strings in JSON
* PR/162: Add --exclude-quiet
* Fix memory leak in ascmagic (Steve Grubb)
* Fix string comparison length with ignore whitespace
* Fix mingwin 64 compilation
* PR/159: whitelist getpid needed for file_pipe2file()
* Indicate negative offsets with a flag OFFNEGATIVE
so that -0 works.
* Introduce "offset" magic type that can be used to
detect the file size, and bail on short files.
* document DER better in the magic man page.
* fix memory leaks (SonarQube)
* rewrite confusing loops (SonarQube)
* fix bogus test (SonarQube)
* pass a sized buffer to file_fmttime() (SonarQube)
* Don't allow * in printf formats, or the code itself (Christoph Biedl)
* Introduce a printf output size checker to avoid DoS attacks
* Avoid memory leak on error (oss-fuzz)
* Check length of string on DER before derefercing and add new types
* Add missing DER string (oss-fuzz)
* Add missing DER types, and debugging
* PR/140: Avoid abort with hand-crafted magic file (gockelhahn)
* PR/139: Avoid DoS in printf with hand-crafted magic file (gockelhahn)
* PR/138: Avoid crash with hand-crafted magic file (gockelhahn)
* PR/136: Fix static build by adding a libmagic.pc (Fabrice Fontaine)
* add guid support native support via the "guid" type.
This logic correctly uses strncpy(3) to fully initialize a fixed-width field, and also ensures
NUL-termination on the next line as other users of the field expect.
Add -Werror=stringop-truncation to prevent build failure, when run with MKSANITIZER=yes.
Error was reported when build.sh was run with MKSANITIZER=yes flag.
Reviewed by: kamil@
* Restore dumping leases from stdin
* auth: Only accept RECONFIGURE messages from LL addresses
* auth: Access the RDM monotonic counter file via privsep
* ARP: call arp_announced() when cancelling it
* BSD: fwip(4) interfaces are now ignored by default
* privsep: Ensure IPC buffers are large enough to carry messages
* privsep: Only open RAW sockets for the needed protocols
* privsep: Fix indirect ioctls returning data
* privsep: wait for processes on SIGCHLD rather than when sent a STOP cmd
* eloop: just use ppoll/pollts(2), falling back to pselect(2)
Provide the hook from modern jemalloc to avoid using TSD for the thread
destruction cleanup as it can result in reentrancy crashes if fork is
called from a thread that never called malloc as it will result in a
late malloc from the pre-fork synchronisation handler.
* Leases are stored outside the chroot again
* The chroot directory can now be (and should be) empty [1]
* ARP is now per address rather than per interface
* Filter allowed ioctls in the privileged actioneer
* Filter allowed UDP ports used by sendto(2) in the privileged actioneer
* Filter allowed file paths in the privileged actioneer
* route socket is now drained on overflow as it cannot be
re-opened by the unpriviledged user
* hostname can no longer be clobbered by SLAAC
* grep is no longer used by the test hook
* Interface hardware address type changes are now picked up
* Fixed some RA timing issues
* Fixed nd_* option parsing in dhcpcd.conf
* Allow SIGPIPE in scripts
* Default dhcpcd.conf no longer sends the current hostname
* Default dhcpcd.conf no longer sends a vendorclassid
* [Sec 3610] process_control() should bail earlier on short packets. stenn@
- Reported by Philippe Antoine
* [Sec 3596] Highly predictable timestamp attack. <stenn@ntp.org>
- Reported by Miroslav Lichvar
* [Sec 3592] DoS attack on client ntpd <perlinger@ntp.org>
- Reported by Miroslav Lichvar
* [Bug 3637] Emit the version of ntpd in saveconfig. stenn@
* [Bug 3636] NMEA: combine time/date from multiple sentences <perlinger@ntp.org>
* [Bug 3635] Make leapsecond file hash check optional <perlinger@ntp.org>
* [Bug 3634] Typo in discipline.html, reported by Jason Harrison. stenn@
* [Bug 3628] raw DCF decoding - improve robustness with Zeller's congruence
- implement Zeller's congruence in libparse and libntp <perlinger@ntp.org>
* [Bug 3627] SIGSEGV on FreeBSD-12 with stack limit and stack gap <perlinger@ntp.org>
- integrated patch by Cy Schubert
* [Bug 3620] memory leak in ntpq sysinfo <perlinger@ntp.org>
- applied patch by Gerry Garvey
* [Bug 3619] Honour drefid setting in cooked mode and sysinfo <perlinger@ntp.org>
- applied patch by Gerry Garvey
* [Bug 3617] Add support for ACE III and Copernicus II receivers <perlinger@ntp.org>
- integrated patch by Richard Steedman
* [Bug 3615] accelerate refclock startup <perlinger@ntp.org>
* [Bug 3613] Propagate noselect to mobilized pool servers <stenn@ntp.org>
- Reported by Martin Burnicki
* [Bug 3612] Use-of-uninitialized-value in receive function <perlinger@ntp.org>
- Reported by Philippe Antoine
* [Bug 3611] NMEA time interpreted incorrectly <perlinger@ntp.org>
- officially document new "trust date" mode bit for NMEA driver
- restore the (previously undocumented) "trust date" feature lost with [bug 3577]
* [Bug 3609] Fixing wrong falseticker in case of non-statistic jitter <perlinger@ntp.org>
- mostly based on a patch by Michael Haardt, implementing 'fudge minjitter'
* [Bug 3608] libparse fails to compile on S11.4SRU13 and later <perlinger@ntp.org>
- removed ffs() and fls() prototypes as per Brian Utterback
* [Bug 3604] Wrong param byte order passing into record_raw_stats() in
ntp_io.c <perlinger@ntp.org>
- fixed byte and paramter order as suggested by wei6410@sina.com
* [Bug 3601] Tests fail to link on platforms with ntp_cv_gc_sections_runs=no <perlinger@ntp.org>
* [Bug 3599] Build fails on linux-m68k due to alignment issues <perlinger@ntp.org>
- added padding as suggested by John Paul Adrian Glaubitz
* [Bug 3594] ntpd discards messages coming through nmead <perlinger@ntp.org>
* [Bug 3593] ntpd discards silently nmea messages after the 5th string <perlinger@ntp.org>
* [Bug 3590] Update refclock_oncore.c to the new GPS date API <perlinger@ntp.org>
* [Bug 3585] Unity tests mix buffered and unbuffered output <perlinger@ntp.org>
- stdout+stderr are set to line buffered during test setup now
* [Bug 3583] synchronization error <perlinger@ntp.org>
- set clock to base date if system time is before that limit
* [Bug 3582] gpsdjson refclock fudgetime1 adjustment is doubled <perlinger@ntp.org>
* [Bug 3580] Possible bug ntpq-subs (NULL dereference in dogetassoc) <perlinger@ntp.org>
- Reported by Paulo Neves
* [Bug 3577] Update refclock_zyfer.c to the new GPS date API <perlinger@ntp.org>
- also updates for refclock_nmea.c and refclock_jupiter.c
* [Bug 3576] New GPS date function API <perlinger@ntp.org>
* [Bug 3573] nptdate: missleading error message <perlinger@ntp.org>
* [Bug 3570] NMEA driver docs: talker ID not mentioned, typo <perlinger@ntp.org>
* [Bug 3569] cleanup MOD_NANO/STA_NANO handling for 'ntpadjtimex()' <perlinger@ntp.org>
- sidekick: service port resolution in 'ntpdate'
* [Bug 3550] Reproducible build: Respect SOURCE_DATE_EPOCH <perlinger@ntp.org>
- applied patch by Douglas Royds
* [Bug 3542] ntpdc monlist parameters cannot be set <perlinger@ntp.org>
* [Bug 3533] ntpdc peer_info ipv6 issues <perlinger@ntp.org>
- applied patch by Gerry Garvey
* [Bug 3531] make check: test-decodenetnum fails <perlinger@ntp.org>
- try to harden 'decodenetnum()' against 'getaddrinfo()' errors
- fix wrong cond-compile tests in unit tests
* [Bug 3517] Reducing build noise <perlinger@ntp.org>
* [Bug 3516] Require tooling from this decade <perlinger@ntp.org>
- patch by Philipp Prindeville
* [Bug 3515] Refactor ntpdmain() dispatcher loop and group common code <perlinger@ntp.org>
- patch by Philipp Prindeville
* [Bug 3511] Get rid of AC_LANG_SOURCE() warnings <perlinger@ntp.org>
- patch by Philipp Prindeville
* [Bug 3510] Flatten out the #ifdef nesting in ntpdmain() <perlinger@ntp.org>
- partial application of patch by Philipp Prindeville
* [Bug 3491] Signed values of LFP datatypes should always display a sign
- applied patch by Gerry Garvey & fixed unit tests <perlinger@ntp.org>
* [Bug 3490] Patch to support Trimble Resolution Receivers <perlinger@ntp.org>
- applied (modified) patch by Richard Steedman
* [Bug 3473] RefID of refclocks should always be text format <perlinger@ntp.org>
- applied patch by Gerry Garvey (with minor formatting changes)
* [Bug 3132] Building 4.2.8p8 with disabled local libopts fails <perlinger@ntp.org>
- applied patch by Miroslav Lichvar
* [Bug 3094] ntpd trying to listen for broadcasts on a completely ipv6 network
<perlinger@ntp.org>
* [Bug 2420] ntpd doesn't run and exits with retval 0 when invalid user
is specified with -u <perlinger@ntp.org>
- monitor daemon child startup & propagate exit codes
* [Bug 1433] runtime check whether the kernel really supports capabilities
- (modified) patch by Kurt Roeckx <perlinger@ntp.org>
* Clean up sntp/networking.c:sendpkt() error message. <stenn@ntp.org>
* Provide more detail on unrecognized config file parser tokens. <stenn@ntp.org>
* Startup log improvements. <stenn@ntp.org>
* Update the copyright year.
* html/confopt.html: cleanup. <stenn@ntp.org>
---
(4.2.8p13) 2019/03/07 Released by Harlan Stenn <stenn@ntp.org>
* [Sec 3565] Crafted null dereference attack in authenticated
mode 6 packet <perlinger@ntp.org>
- reported by Magnus Stubman
* [Bug 3560] Fix build when HAVE_DROPROOT is not defined <perlinger@ntp.org>
- applied patch by Ian Lepore
* [Bug 3558] Crash and integer size bug <perlinger@ntp.org>
- isolate and fix linux/windows specific code issue
* [Bug 3556] ntp_loopfilter.c snprintf compilation warnings <perlinger@ntp.org>
- provide better function for incremental string formatting
* [Bug 3555] Tidy up print alignment of debug output from ntpdate <perlinger@ntp.org>
- applied patch by Gerry Garvey
* [Bug 3554] config revoke stores incorrect value <perlinger@ntp.org>
- original finding by Gerry Garvey, additional cleanup needed
* [Bug 3549] Spurious initgroups() error message <perlinger@ntp.org>
- patch by Christous Zoulas
* [Bug 3548] Signature not verified on windows system <perlinger@ntp.org>
- finding by Chen Jiabin, plus another one by me
* [Bug 3541] patch to fix STA_NANO struct timex units <perlinger@ntp.org>
- applied patch by Maciej Szmigiero
* [Bug 3540] Cannot set minsane to 0 anymore <perlinger@ntp.org>
- applied patch by Andre Charbonneau
* [Bug 3539] work_fork build fails when droproot is not supported <perlinger@ntp.org>
- applied patch by Baruch Siach
* [Bug 3538] Build fails for no-MMU targets <perlinger@ntp.org>
- applied patch by Baruch Siach
* [Bug 3535] libparse won't handle GPS week rollover <perlinger@ntp.org>
- refactored handling of GPS era based on 'tos basedate' for
parse (TSIP) and JUPITER clocks
* [Bug 3529] Build failures on Mac OS X 10.13 (High Sierra) <perlinger@ntp.org>
- patch by Daniel J. Luke; this does not fix a potential linker
regression issue on MacOS.
* [Bug 3527 - Backward Incompatible] mode7 clockinfo fudgeval2 packet
anomaly <perlinger@ntp.org>, reported by GGarvey.
- --enable-bug3527-fix support by HStenn
* [Bug 3526] Incorrect poll interval in packet <perlinger@ntp.org>
- applied patch by Gerry Garvey
* [Bug 3471] Check for openssl/[ch]mac.h. <perlinger@ntp.org>
- added missing check, reported by Reinhard Max <perlinger@ntp.org>
* [Bug 1674] runtime crashes and sync problems affecting both x86 and x86_64
- this is a variant of [bug 3558] and should be fixed with it
* Implement --disable-signalled-io
- lock all relevant mutexes just before fork
- unlock all mutexes just after fork in the parent
- full reinit non-spinlocks in the child
This is not using the normal pthread_atfork interface to ensure order of
operation, malloc is used as implementation detail too often.
Add -Wno-error=sign-conversion to prevent build failure, when run with MKLIBCSANITIZER=yes.
Error was reported when build.sh was run with MKLIBCSANITIZER=yes flag.
Reviewed by: kamil@
This avoids leaking NO_STATIC_MODULES into the public header, which
has led to considerable confusion and workarounds in pkgrsc.
PR security/39313
PR security/55216
ok christos
* Control sockets are not opened in test mode
* privsep: no longer aborts if protocol not available
* inet6: Don't regen temporary addresses without a state
* inet6: Reduce RA log spam
* dhcp6: Don't log when things consitently fail
* inet6: Add temporary directive to slaac option [1]
* Ensure current interface flags persist when setting a flag
* DHCP via BPF is now aligned correctly
* CMSG buffers are now aligned correctly
* hostnames are no longer clobbered when being forced and a RA is recieved
[1] dhcpcd no longer looks at any possible kernel settings when deciding to
manage IPv6 temporary addresses or not. You now instruct dhcpcd to do this
in dhcpcd.conf. Playing whack-a-mole with various kernel knobs wasn't fun
and some OS's have or are removing RA and thus temporary address managemnt
from the kernel so said knobs are no longer there.
repository, don't attempt to install it, and don't expect it to
be installed. If a better fix is to return 02-dump, then this
change can be reverted (by anyone, just go ahead and do it).
dhcpcd(8) should also have mention of 02-dump removed, if removing
it was intentional.
0x60006003, which blocks SIGTERM by default, so running something simple
from a hook, like /etc/rc.d/racoon restart does not work. The script
is then stuck waiting for the daemon to die, which it won't since it will
never receive the signal, and the hook never terminates.
* Decode interface complex interface names eth0.100:2 eth0i100:2.
This allows us to ignore some virtual interfaces by default
* ARP: Report L2 header address on conflict for more clarity
* DHCP: Support jumbo frames (untested)
* DHCP6: Clean up old lease on failure to confirm/rebind, etc
* RA: Prefer older routers
* INET6: Obscure prefixes are now calculated correctly
* Privilege Separation
* default hostname is now a blank string rather than localhost
* Leases are now dumped over the control socket - you get RA's now as well.
* Better support for many IPv6 routers
* RTM_MISS filtering
* RA: Deprecate stale addresses by setting pltime 0
* DHCP6: Deprecate stale addresses by setting pltime 0
The noted argument is wrong - if it's already been deleted then the id we
have for it is invalid.
Because we don't track deletions to the ruleset, working it out is
problematic at best.
Instead, if we have already added the rule treat it as a non-op.
This is a valid use case because we might receive a burst of messages
in the downstream application for the same address and process them
one by one. It's not the job of the downstream application to track
blacklistd state.
fd -1 is invalid, so don't query it for protocol, port or address.
fd is supposed to represent how the client is connected, but if we are
parsing route(4) messages or log files then there is no client connection
to interogate.
Cherry-pick upstream patch:
From 2cfda000bc5159d46fd8ead7d1bd3ea1f66f7948 Mon Sep 17 00:00:00 2001
From: Martin Matuska <martin@matuska.org>
Date: Thu, 27 Feb 2020 01:54:19 +0100
Subject: [PATCH] XAR reader: initialize file_queue with 0 and memcpy() if
allocated only
Fixes#1338
Cherry-pick upstream patch:
Fix Undefined Behavior in hash.h
hash.h:200:27, left shift of 250 by 24 places cannot be represented in type 'int'
7fd22f7b2e
Given that we have just checked vallen < len, it can never be the case
that vallen >= len + sizeof(rhostname). This fixes the check so we
actually avoid overflowing the rhostname array.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
From:
8d7970b8f3
Add -Wno-error=maybe-uninitialized in ipsopt.c to prevent build failure.
Error was reported when build.sh was run with MKLIBCSANITIZER=yes flag.
Reviewed by: kamil@
Add -Wno-error=format-overflow in ipmon.c to prevent build failure.
Error was reported when build.sh was run with MKLIBCSANITIZER=yes flag.
Reviewed by: kamil@
Add GCC_NO_STRINGOP_TRUNCATION to refclock_jjy.c to prevent build failure.
Error was reported when build.sh was run with MKLIBCSANITIZER=yes flag.
Reviewed by: kamil@
Type cast uint16_t to size_t to prevent implicit type conversion.
Error was reported when build.sh was run with MKLIBCSANITIZER=yes flag.
gcc version 8.3.0
Reviewed by: roy@, kamil@
Now that both hostapd and wpa_supplicant react to interface flag
changes, there is no need to set or remove IFF_UP.
It should be an administrative flag only.
uwe