ipfw: hold sleepable "upper half lock" for periodic state expiry
The state expiration may lead to freeing rules, which requires this lock.
Since the lock is sleepable, move the expiry routine from callout context
to a taskqueue. This also should have a positive effect of not running
expensive function as a callout.
Fixes: e3caa360d5d0a73af0de1d293d5b8ff6e900ceb4
Reviewed by: pouria
Differential Revision: https://reviews.freebsd.org/D60869
tcp: refactor tcp_autosndbuf() and associated sysctls
Rename tcp_sndbuf_autoscale() to tcp_autosndbuf(). This matches
complementary tcp_autorcvbuf() that was factored out as a separate
function a few months before tcp_sndbuf_autoscale() was. Move the large
comment to the header of the function. Use unsigned types for all sizing
sysctls and variables and use bool for the switching sysctl. Add a
comment above net.inet.tcp.sendbuf_auto_lowat (default to off) providing a
reference to its origins. Add DTrace probe tcp::send-autoresize,
complementary to the existing tcp::receive-autoresize.
Rack has its own function, just enable the DTrace probe there.
Reviewed by: tuexen
Differential Revision: https://reviews.freebsd.org/D60732
tcp: refactor tcp_autorcvbuf() and associated sysctls
Run the entire function under the socket buffer lock. Make it responsible
to set the new limit or clear SB_AUTOSIZE in case of a failure. Use
unsigned type for newsize, that matches both the sb_hiwat type and min()
argument types. Make byte counter in the tcpcb unsigned, too. Make the
sizing tunables unsigned, and make the switching tunable a boolean. Don't
execute Dtrace probe in case of a failure. Simplify the Dtrace probe to
report only relevant information, the previous probe looked more like a
leftover from a debugging session.
Reviewed by: tuexen
Differential Revision: https://reviews.freebsd.org/D60731
security/wazuh*: update to 4.14.9
- Update cpython bundle to 3.11.17
- Remove obsolete patch file
- Use PYTHON_DISTVERSION for avoid temporarily pkg-plist issues when
system python is updated. The best is keep system python and bundle
python with the same version.
ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-14-9.html
PR: 299490
ping: use CLOCK_REALTIME for ICMP Originate Timestamp
RFC 792 defines the ICMP Originate Timestamp field as milliseconds
since midnight UTC. However, ping(8) currently derives this value
from CLOCK_MONOTONIC, which represents time since an unspecified
starting point and is not related to UTC.
The issue was introduced by commit 1ad76f1b6047, which replaced
gettimeofday(2) with clock_gettime(CLOCK_MONOTONIC) for timekeeping
in ping(8).
Fix this by using CLOCK_REALTIME when generating the ICMP originate
timestamp.
Before:
$ ping -Mt -c1 127.0.0.1
ICMP_TSTAMP
PING 127.0.0.1 (127.0.0.1): 56 data bytes
[17 lines not shown]
ping: fix test timestamp_origin when tstamprepl is disabled
The timestamp_origin test sends an ICMP Timestamp Request (ping -Mt) and parses
the tso/tsr fields out of the reply.
When the sysctl net.inet.icmp.tstamprepl is 0, the kernel silently drops the
request, ping receives no reply, and the sed extraction yields an empty $tso.
The test then fails inside atf_check test -n "$tso" with the unhelpful message
Approved by: maxim
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D57287
(cherry picked from commit ff873565bc2c3e47fe1d070305aa851189ee8bcf)
ping: do a better job with what we received from the net, part 2
When we see a difference between the payload we sent and what we
received, we dump both but we were not prepared for the case when
the received payload is less than we sent. In this case we were trying
to dump more than needed.
Funny enough, 23 years ago I already fixed a similar issue here but
didn't pay attention to this small dumping loop.
Test written by jlduran.
Reviewed by: jlduran
MFC after: 1 month
Found with: Claude Code Sonnet 5
Differential Revision: https://reviews.freebsd.org/D59556
Differential Revision: https://reviews.freebsd.org/D59582
(cherry picked from commit 0b9434d707c71de7b1b62e400e6e780224f0384d)
ping: do a better job checking what we receive from the net
- zero out a buffer for the incoming icmp message that
we are about to parse
- for ICMP_MASKREPLY and ICMP_TSTAMPREPLY responses check their length
and warn and reject them if they are truncated
Without these checks a part of stack allocated struct icmp icp could
be printed out which seems low severity since we already dropped root
privileges by the time icp is allocated.
Reviewed by: glebius
MFC after: 1 month
Found with: Claude Code Sonnet 5
Differential Revision: https://reviews.freebsd.org/D59555
(cherry picked from commit aa6683207d189a0b58ccf8806bd9f8793914bc45)
lang/php8*: Force fresh FreeBSD.org package builds.
No functional changes to the ports.
The packages were built manually today from a temporary branch to
incorporate the RCE fixes without triggering unnecessary rebuilds.
These fixes were cherry-picked onto the previous package build rather
than built from a published branch.
Bump the ports to trigger fresh builds from the published tree,
ensuring reproducibility and accurate package metadata.
MFH: 2026Q4
(cherry picked from commit 44fd248dd4d7337c7e3517d1852be9d3dfd6071c with
lmdb reference removed)
lang/php8*: Force fresh FreeBSD.org package builds.
No functional changes to the ports.
The packages were built manually today from a temporary branch to
incorporate the RCE fixes without triggering unnecessary rebuilds.
These fixes were cherry-picked onto the previous package build rather
than built from a published branch. The cherry-picks also omitted the
lmdb change in 85ba298b7e0.
Bump the ports to trigger fresh builds from the published tree,
ensuring reproducibility and accurate package metadata.
MFH: 2026Q4
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the auth_ldap module from its own source port, and add the
cert_expiry, ip_anon, stream limit_req and syslog5424 modules.
Sponsored by: Netzkommune GmbH
www/nginx-module-syslog5424: Add New Port
The syslog5424 module sends an access line in the format RFC 5424 asks for:
version, RFC 3339 timestamp, hostname, app name, process id, message id and
structured data.
Sponsored by: Netzkommune GmbH
