www/redmine70: update to 7.0.3
Security and bug fix release: fixes a ReDoS in wiki macro argument
parsing, a reflected XSS and open redirect via back_url, and OAuth
token scope bypasses.
www/redmine61: update to 6.1.6
Security and bug fix release: fixes a ReDoS in wiki macro argument
parsing, a reflected XSS and open redirect via back_url, and OAuth
token scope bypasses.
www/redmine60: update to 6.0.12
Security release: fixes a ReDoS in wiki macro argument parsing, a
reflected XSS and open redirect via back_url, and two private data
leaks via the REST API.
devel/subversion: fix svnserve rc.d status/stop when SVNSERVE_WRAPPER is on
When SVNSERVE_WRAPPER is enabled (now the default), bin/svnserve is
the umask-setting wrapper, which execs straight into bin/svnserve.bin
-- same PID, but the running process image is svnserve.bin, not
svnserve. rc.subr's run_rc_command built-ins (status, stop, restart,
poll) match running processes against procname, defaulting to
command's basename when procname is unset; since command is still the
wrapper path, every one of those built-ins fails to find the actually
running daemon ("svnserve is not running" even while it is).
Set procname explicitly to the real binary path, swapping in .bin via
a new SUB_LIST token when the wrapper is active, same pattern already
used for BINS_TO_STRIP.
Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
Reported by: vvd
if_bnxt: skip HW kTLS on old firmware and add a tunable to disable it
Older Thor2 firmware serves key context allocation requests very
slowly, about a second each. The driver allocates key contexts in
batches of 128, so setting up 500k sessions takes roughly 3900
requests and driver load appears to hang.
Enable hardware kTLS only when the firmware's HWRM interface version
is 1.10.3.99 or newer. Keep the full four-part version in
hwrm_spec_code_ext for the comparison.
Also add a disable_hw_ktls loader tunable that turns hardware kTLS off
for a device without unloading kTLS support, which helps isolate kTLS
problems in the field.
Reviewed by: gallatin
Sponsored by: Broadcom Inc
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60977
if_bnxt: size MRAV from the AV split entry for backing store V2
On RoCE-capable Thor2, attach fails with
HWRM_FUNC_BACKING_STORE_CFG_V2 returning INVALID_PARAMS, as MRAV is
sized the pre-V2 way and the firmware's AV split value is sent as is.
Size MRAV from the AV split entry, and move the legacy entry-count
packing into bnxt_hwrm_func_backing_store_cfg().
Fixes: d5ce906da7c5 ("bnxt_en: Add backing store V2 support")
Reviewed by: gallatin
Sponsored by: Broadcom Inc
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60976
Tcl/Tk: prepare for supporting one version only
Rename lang/tcl90 -> lang/tcl, and x11-toolkits/tk90 -> x11-toolkits/tk.
This is in preparation for sunsetting Tcl/Tk 8.6 and providing one
single version of Tcl/Tk in the ports tree.
PR: 300092 (exp-run)
mail/stalwart-proxy: [NEW PORT] e-mail migration proxy for Stalwart
Stalwart Proxy is a multi-protocol e-mail migration proxy from the
Stalwart Labs team (the authors of mail/stalwart). It routes IMAP,
POP3, ManageSieve, SMTP submission, SMTP/LMTP and HTTP (JMAP) sessions
per account to the right backend, based on the credentials the client
already presents. It is meant for migrating from Dovecot, Cyrus or
older Stalwart versions to Stalwart one mailbox at a time.
PR: 300326
ice(4): Do not leave device non-functional if Tx scheduler config fails
The ice_cfg_tx_topo function attempts to apply Tx scheduler topology
configuration based on NVM parameters, selecting either a 5 or 9 layer
topology. As part of this flow, the driver acquires the "Global Configuration Lock",
which is a hardware resource associated with programming the DDP package
to the device. This "lock" is implemented by firmware as a way to
guarantee that only one PF can program the DDP for a device. Unlike a
traditional lock, once a PF has acquired this lock, no other PF will be
able to acquire it again (including that PF) until a CORER of the device.
However, if configuration of the Tx topology fails, (i.e.
ice_get_set_tx_topo returns an error code), the driver exits
ice_cfg_tx_topo() immediately, and fails to trigger CORER.
While the global configuration lock is held, the firmware rejects most
AdminQ commands, as it is waiting for the DDP package download (or Tx
scheduler topology programming) to occur.
Refactor ice_cfg_tx_topo() to always trigger a CORER after acquiring the
global lock, regardless of success or failure of the topology
configuration.
[14 lines not shown]
