wg: fix the LINT-NOIP build
We don't have anything to tunnel without INET or INET6, so just smack
it with the same config(5) hammer that ovpn uses and exclude it from
such builds.
Reported by: mjg
Reviewed by: emaste, markj
Differential Revision: https://reviews.freebsd.org/D60896
*/R-cran-*: Use cran.mk's default WWW
Remove WWW from my ports because cran.mk provides a default WWW.
See the entry of 20260914 in /usr/ports/CHANGES.
pf: first-match-wins for nat rules, even in anchors
Ensure we stop evaluating nat rules if we find a match in a nat-anchor.
PR: 299320
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit b5219c068fbc133dde91d5cf48423e34ce27bd4f)
hastd: Use void pointers for opaque data
Use void, not char, for pointers to opaque data in our send and receive
functions.
Sponsored by: Klara, Inc.
Reviewed by: allanjude
Differential Revision: https://reviews.freebsd.org/D60729
auditdistd: Use void pointers for opaque data
Use void, not char, for pointers to opaque data in our send and receive
functions.
Sponsored by: Klara, Inc.
Sponsored by: Qualys, Inc.
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D60728
pf: Keep every chunk of a table that a ruleset defines
libpfctl sends a table definition in chunks of 256 addresses, each as
its own PFNL_CMD_INA_DEFINE. The kernel treated every chunk as a new
definition and replaced the shadow table, so only the last chunk
survived.
Mark the chunks after the first with PF_ID_APPEND and have the kernel
add them to the shadow table in progress. A request without the
attribute still replaces the shadow; one with it and no definition in
progress fails with EINVAL. Old kernels ignore the attribute, so both
halves are needed; the ioctl sends all addresses at once and is not
affected. Mask the flags userland passes to PFR_FLAG_ALLMASK, as
PFR_FLAG_APPEND is kernel-internal.
Add a test that defines a table of 1,000 addresses, also in an anchor.
Reviewed by: kp
Fixes: 219ce3063840 ("pf: convert DIOCRINADEFINE to netlink")
[2 lines not shown]
rk_spi: Do not change the clock with the driver lock held
The clock framework can sleep, it takes the clock topology sx lock. Calling
clk_set_freq() and clk_get_freq() from rk_spi_hw_setup() with the driver
mutex held triggers a witness warning about a sleepable lock acquired after
a non-sleepable one, on the first transfer that raises the clock.
Set the clock in a new function that is called before taking the lock, and
only keep the register setup under the lock.
lang/go127: Update to 1.27.3
Changes:
go1.27.3 (released 2026-10-19) includes security fixes to the
crypto/x509 package.
MFH: 2026Q4
(cherry picked from commit 5bee79d19f2e83f495c859e3d09e5051b984d2b5)
lang/go126: Update to 1.26.10
Changes:
go1.26.10 (released 2026-10-19) includes security fixes to the
crypto/x509 package.
MFH: 2026Q4
(cherry picked from commit a0f298cf6f23862fc8564e0a32d4202a72b9d586)
net/samba424: update to 4.24.8
Changelog:
* BUG 16200: generate_unique_u64() may not protect against veto_value
* BUG 16261: Rename with ReplaceIfExists to a target differing only in case
creates a duplicate instead of replacing (regression in
bb130f32)
* BUG 15962: SMB3 SESSION SETUP responses must always be signed
* BUG 16081: winbindd_child_msg_filter: talloc_get_type_abort crashes when
winbind max domain connections > 1
* BUG 16200: generate_unique_u64() may not protect against veto_value
* BUG 16239: Fix parsing of uppercase "0X" hex values in the "kdc default
domain supported enctypes" smb.conf parameter.
* BUG 16240: smbd temporary mkdir name can exceed NAME_MAX for otherwise
valid client names
* BUG 16258: Python smbconf transaction_start() lacks a talloc stack frame
with CTDB
* BUG 16254: CTDB database operations can be run against incorrect nodes
* BUG 16273: A node can be banned because it tries to run recovery after
[6 lines not shown]
