pf: Drain the overload task before a vnet's rules are freed
pf_src_connlimit() queues an entry for pf_overload_task() when a
source exceeds max-src-conn or max-src-conn-rate and the rule has an
overload table. The entry holds a pointer to the rule, and the task
runs from taskqueue_swi with the vnet of the queue. Nothing drained
the task when the vnet went away: an entry queued just before could
be applied to a rule pf_unload_vnet_purge() had freed, or to a vnet
that was gone.
Drain the task at the start of pf_unload_vnet_purge(), before the
unlinked rules are freed. No packet can queue another by then, as the
hooks are already removed.
Reviewed by: kp
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60529
mail/rspamd: Package hs_helper configs with VECTORSCAN
Follow-up to 8f3058ca4f8 ("mail/rspamd: Add vectorscan support", PR 296532).
Both the HYPERSCAN and VECTORSCAN options pass -DENABLE_HYPERSCAN=ON to
CMake, and conf/worker-hs_helper.{conf,inc} are installed whenever
ENABLE_HYPERSCAN is on (cmake/InstallRspamdFiles.cmake). The packing
list, however, gates those entries on %%HYPERSCAN%% only:
- With VECTORSCAN enabled (the new default on amd64, aarch64 and
powerpc64le) the two files are staged but commented out of the
manifest: check-orphans/check-plist fail and the files are missing
from the package.
- On architectures where the HYPERSCAN option is not defined (aarch64,
powerpc64le, i386, armv7, powerpc, powerpc64) %%HYPERSCAN%% is never
defined in PLIST_SUB, so the literal leaks into the packing list.
The PLIST_SUB block dropped by 8f3058ca4f8 was what defined that
variable on non-amd64.
[6 lines not shown]
pf: Send syncookies from the receiving thread
pf sends outbound packets by offloading them to a single per-vnet SWI handler
through the `V_pf_sendqueue` mbuf queue. A large DDoS attack may overwhelm
that per-vnet queue with syncookie packets and cause contention in the SWI
handler that negatively affects other pf operations.
Fix this by sending the initial syncookie challenge from the context
of the receiving thread. This avoids the syncookie-induced contention on
the `pf_intr` mbuf queue.
Sponsored by: Klara, Inc.
Sponsored by: Entersekt
MFC after: 3 weeks
Reviewed by: kp
Differential Revision: https://reviews.freebsd.org/D59068
(cherry picked from commit bf05236727cf367ee8e22ef47febebb319db9ddb)
mail/rspamd: Add vectorscan support
- Add the VECTORSCAN option for aarch64, amd64 and powerpc64le and enable
it by default; HYPERSCAN stays available on amd64 as an alternative
- Use libarchive from ports explicitly
- Use a relative symlink for newsyslog.conf.d/rspamd.newsyslog.conf
- Drop an unused HYPERSCAN PLIST_SUB block
PR: 296532
Submitted by: Jordan Ostreff <jordan at ostreff.info>
print/miktex: update to 26.5
Build with -fsigned-char: the Pascal-to-C++ translation assumes a signed
char and corrupts its output on aarch64, armv7 and powerpc64le, which is
what NOT_FOR_ARCHS was hiding. hitex and luahbtex need libharfbuzz-subset
when built against the system HarfBuzz.
termcap: add missing capabilities to the xterm-ghostty entry
The entry was imported from the termcap source that Ghostty generates
with infotocap during its build. To fit within 1023 bytes, the
conversion dropped a number of capabilities, most notably all color
support, so termcap consumers such as ls -G and ncurses applications
treated Ghostty as a monochrome terminal.
Split the entry into xterm-ghostty and a ghostty+common fragment, and
restore the following from Ghostty's terminfo definition:
- colors: Co, pa, AF, AB, op, oc, ut, AX
- keys: End, keypad Enter, F10-F12, back tab, mouse prefix
- attributes: italics (ZH/ZR), invisible (mk), acsc map (ac)
- misc: cb, ch, cv, SA/RA, r1, bs, NP, 5i
AF and AB use the plain 256-color form, like xterm-256color, because
termcap cannot express the conditional used by the terminfo entry.
[2 lines not shown]
www/remark42: update to 1.18.0
While here, bring the rc script in line with upstream's options:
- Rename remark_disable_fancy_html_formatting to
remark_disable_fancy_text_formatting; the old name exported a
variable the server does not read.
- Rename the remark_auth_enable and remark_auth_email_subject
defaults to remark_auth_email_enable and remark_auth_email_subj,
the names that are actually exported.
- Add remark_trusted_proxy, remark_auth_ttl_jwt,
remark_auth_ttl_cookie, remark_auth_send_jwt_header,
remark_auth_microsoft_tenant, remark_auth_custom_*,
remark_telegram_api_url and remark_smtp_helo_host.
- Default remark_avatar_uri and remark_ssl_acme_location to the data
directory instead of a path relative to the working directory.
devel/electron{41,42,43,44}: Add AVX512 option to support older CPUs
Builds on older CPUs without AVX512 instructions support fail with the
following error:
In file included from ../../third_party/skia/modules/skcms/src/skcms_TransformSkx.cc:53:
../../third_party/skia/modules/skcms/src/Transform_inl.h:152:15: error: always_inline function '_mm512_cvtph_ps' requires target feature 'avx512f', but would be inlined into function 'F_from_Half' that is compiled without support for 'avx512f'
152 | return (F)_mm512_cvtph_ps((__m256i)half);
Add AVX512 option, which is ON by default (status quo). Users can set
the option to OFF to build on older hardware.
PR: 299208
Reported by: Hiroo Ono <hiroo.ono+freebsd at gmail.com>
Tested by: Hiroo Ono <hiroo.ono+freebsd at gmail.com>
