security/nmap-devel: Fix mksock_bind_addr EINVAL
Fix mksock_bind_addr EINVAL on FreeBSD in service/connect scans.
From https://github.com/nmap/nmap/pull/3439:
Summary
Fixes #3438 — mksock_bind_addr(): Bind to <IP>:0 failed ... Invalid argument (22)
on FreeBSD when running -sV (service version scan).
Root Cause
After commit eb79c42, nsock_iod_set_localaddr() is called for every service
probe whenever a source address can be determined via routing — not only when
the user explicitly requests source binding via -S or -e.
On FreeBSD, the subsequent bind() call fails with EINVAL because the stored
addrlen may equal sizeof(sockaddr_storage) (128 bytes) rather than the
protocol-specific size the POSIX-strict kernel requires:
[23 lines not shown]
pmc: Use distinct names for arguments to the pmc_config constructor
This pacifies shadow warnings from GCC:
usr.sbin/pmc/cmd_pmc_record.cc: In constructor 'pmc_config::pmc_config(const std::__1::string&, uint64_t, cpuset_t)':
usr.sbin/pmc/cmd_pmc_record.cc:96:71: error: declaration of 'cpumask' shadows a member of 'pmc_config' [-Werror=shadow]
96 | pmc_config(const std::string &event, uint64_t count, cpuset_t cpumask)
| ~~~~~~~~~^~~~~~~
usr.sbin/pmc/cmd_pmc_record.cc:90:25: note: shadowed declaration is here
90 | cpuset_t cpumask;
| ^~~~~~~
usr.sbin/pmc/cmd_pmc_record.cc:96:55: error: declaration of 'count' shadows a member of 'pmc_config' [-Werror=shadow]
96 | pmc_config(const std::string &event, uint64_t count, cpuset_t cpumask)
| ~~~~~~~~~^~~~~
usr.sbin/pmc/cmd_pmc_record.cc:89:25: note: shadowed declaration is here
89 | uint64_t count;
| ^~~~~
usr.sbin/pmc/cmd_pmc_record.cc:96:39: error: declaration of 'event' shadows a member of 'pmc_config' [-Werror=shadow]
96 | pmc_config(const std::string &event, uint64_t count, cpuset_t cpumask)
[7 lines not shown]
thunderbolt: Fix v2.0 reset to reliably wait for the reset to finish
The `reg` value was never initialized, so the loop could potentially
abort without a single read of the register. This was found by the
following warning from GCC:
sys/dev/thunderbolt/nhi.c: In function 'nhi_reset_v2':
sys/dev/thunderbolt/nhi.c:272:35: error: 'reg' is used uninitialized [-Werror=uninitialized]
272 | for (size_t i = 0; i < 10 && reg; i++) {
| ^~
sys/dev/thunderbolt/nhi.c:257:18: note: 'reg' was declared here
257 | uint32_t reg;
| ^~~
Reported by: GCC 15
Fixes: efdb82413963 ("thunderbolt: Reset controllers")
exterr: Fix build with GCC on 32-bit architectures
Use an intermediate uintptr_t cast to avoid casting a uint64_t value
directly to void * on 32-bit platforms (including lib32 builds).
lib/libc/gen/uexterr_format.c: In function 'uexterr_format_msg':
lib/libc/gen/uexterr_format.c:248:35: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
248 | PFMT(fmt, (void *)ARG(nextarg));
| ^
lib/libc/gen/uexterr_format.c:144:47: note: in definition of macro 'PFMT'
144 | psz = snprintf(buf, bufsz, f, a); \
| ^
Reported by: GCC 15
Fixes: 2f024a7cfddd ("exterr: relax format restrictions")
security/nmap: Update to 7.991 and rework port
* Remove obsolete mirror in MASTER_SITES
* Import upstream PR #3439 [1]
* Convert multiple variables from ?= to =
* Remove old historical references
* Remove .if !defined(MASTERDIR) definition
* Add libpcap from ports as a permanent dependency, also removes
local patch for bundled version
* Update pcre2 dependency definition
* Sort USES
* Unbundle lua, also removes local patches for bundled version
* Don't extract unbundled libraries
* Remove MAKE_JOBS_UNSAFE
* Rename SSH2 to LIBSSH2 for consistency with tree
* Remove DOCS from OPTIONS_DEFAULT as framework always enables DOCS
* Simplify LibreSSL guard
* Follow Porters Handbook's example about stripping binaries in
post-install section
[5 lines not shown]
net/mosquitto: Rework port
* Unbundle uthash as recommended by Porters Handbook
* Unbundle (lib)websockets as recommended by Porters Handbook
* Make (lib)websockets mandatory, default in all major distros
* Use sqlite helper
* Prefer libedit as upstream provides no way of selecting either libedit
or readline and it'll try to find libedit first
* Remove hack for adding path(s) to localbase, use helper instead
* Disable WITH_HTTP_API as port will otherwise pick up libmicrohttpd
in unclean environments
* Remove REINPLACE_CMD for CMakeLists.txt files as it does nothing
* Remove hardcoded cjson path
PR: 297568
Tested by: leres (maintainer)
math/R-cran-alabama: update 2015.3-1 to 2025.1.0
Upstream changelog: constrOptim.nl now returns a convergence code
when only equality constraints are present.
Submitted by: chris.longros at gmail.com
Differential Revision: https://reviews.freebsd.org/D56058
mail/dovecot24: new port
- adding the new version 2.4 of dovecot, while keeping 2.3 in place
- please note that the config syntax has changed between 2.3
and 2.4 and needs to be manually adapted, so use/upgrade with care
PR: 286695
Reported by: Ian Dickens <ian_dickens at icloud.com>
Author: Jordan Ostreff <jordan at ostreff.info>
Co-authored-by: Sebastian Oswald <sko at rostwald.de>
Discussed with: Sebastian Oswald <sko at rostwald.de>,
Eugene R <genie at geniechka.ru>,
Herbert J. Skuhra <herbert at gojira.at>,
Christos Chatzaras <chris at cretaforce.gr>,
and others
Tested by: Jordan Ostreff <jordan at ostreff.info>
epoch: Fix epoch_drain_callbacks()
This function is supposed to wait until all pending callbacks have been
executed. This is useful in some contexts where we tear down some
context (like a VNET jail and its associated UMA zones) synchronously,
and we want to make sure that all pending asynchronous callbacks (which
may free objects to said UMA zones) have run first.
The implementation schedules a callback on each CPU and waits for them
all to run. This assumes that, on a given CPU, callbacks are executed
in the order that they are pushed. This assumption depends on the
implementation of epoch_call_task() and ck_epoch_poll_deferred(), and it
is not true in general.
Callbacks are pushed onto a per-CPU stack in LIFO order.
ck_epoch_poll_deferred() first pulls out the callbacks from epoch - 2,
which are always safe to execute, and in so doing reorders them such
that the oldest callback as at the top of the stack, so in this case,
epoch_call_task() will execute them in order. However,
[26 lines not shown]
ctl.4: Document the assumption that CTL HA runs only on trusted networks
The CTL High Availablity clustering feature allows a pair of hosts to
implement transparent failover. The implementation uses a TCP
connection to exchange messages. There is no authentication mechanism
and the protocol itself embeds kernel pointers in the messages exchanged
between HA hosts. This property (of CTL_MSG_DATAMOVE messages
specifically), as well as insufficient validation of inbound messages,
mean that anyone able to access a CTL HA port is able to remotely
execute code on that host.
Provide a warning to this effect in the CTL man page.
Approved by: re (cperciva)
Reported by: Ryan of Calif.io
Reviewed by: ziaee, ken, mav
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58622
[3 lines not shown]
ppp: Reject invalid endpoint discriminator options
Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.
Approved by: re (cperciva)
PR: 271910
Reported by: Robert Morris
Reported by: Décio Brandão (0xDBJ)
Reviewed by: emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58554
(cherry picked from commit b9d07a4308226b683b64827e0aaed1180e0da996)
(cherry picked from commit 30b4bdd451ad4ec2470f9a378bd62e948a85ef81)
ppp: Avoid overflow when formatting endpoint discriminator options
Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have. Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.
Approved by: re (cperciva)
Reported by: Joshua Rogers <joshua at joshua.hu>
Tested by: Décio Brandão (0xDBJ)
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58555
(cherry picked from commit e004ff15f87e6aa8f2aa13cd5600ae13457b95f1)
(cherry picked from commit 607c41d8f869243db275a6b1bd6cc66bf58d0f36)
proc: Copy the p_reapsubtree field explicitly during fork
p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
which is copied during fork without any synchronization. However, the
field is not stable except when the proctree lock is held, and indeed
may change if p1's reaper exits or explicitly releases its reaper
status. This state change can race with fork() and leave the child with
an incorrect p_reapsubtree field.
Close the race: explicitly copy the field under the proctree lock during
fork.
Approved by: re (cperciva)
Reported by: syzkaller
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58482
[2 lines not shown]
rawip: Fix handling of checksums in rip6_input()
A v6 raw socket may ask the kernel to validate the checksum of an
inbound packet. If it does, and the validation fails, we discard the
packet, but this isn't really right: other raw sockets may wish to
receive a copy of the packet anyway.
Rework checksum handling to address this problem, and use a flag to
avoid computing the checksum more than once for a given packet.
Approved by: re (cperciva)
Fixes: de2d47842e880281 ("SMR protection for inpcbs")
Reviewed by: pouria, glebius
Reported by: Yunzhi Ke
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58559
(cherry picked from commit 196874ce2e97e3e6425493b1d501e716b356bc36)
(cherry picked from commit 1fe3a2897b4ad7a9b9128efd6ec0c24b371bf5bd)
in_mcast: Fix uninitialized variable usage in inm_merge()
When the first loop in inm_merge() hits an error, generally because it
hit some limit on the number of source filters for a multicast group,
inm_merge() tries to atomically roll back changes to the group source
filter list.
To roll back, it iterates over the global source filter list for the
multicast group, starting at the last entry that we updated ("nims").
But, if we have not yet updated any entries, this variable is
uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
doesn't visit any source filters in this case.
All of the above applies to the v6 case.
Approved by: re (cperciva)
Reported by: Daniel Birtwhistle
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
[3 lines not shown]
