stand: set st_dev/st_ino in the loader's ZFS stat for veriexec
The loader's ZFS implementation never set st_dev or st_ino in
zfs_dnode_stat(). With an uninitialized struct stat, veriexec's device
comparison in lib/libsecureboot/veopen.c read stack garbage and skipped
the matching manifest entry, failing with a spurious "no entry" on ZFS
root under UEFI Secure Boot.
Rather than zeroing the device (which would break veriexec's ability to
tell apart the same path on different datasets), populate st_dev and
st_ino with the same intrinsic identifiers the kernel uses:
- st_dev = the dataset's ds_fsid_guid (as the kernel does via
dmu_objset_fsid_guid()/dsl_dataset_fsid_guid()), already read in
zfs_mount_dataset() and now propagated through struct zfsmount.
- st_ino = the object number resolved in zfs_lookup(), propagated
through struct file (the loader's equivalent of the kernel's z_id).
dev_t and ino_t are 64-bit on FreeBSD, so both are assigned directly
[14 lines not shown]
math/octave-forge-octave_ffmpeg_free: Update to 2.0.0.
- Build will work when ffmpeg updates to version 9.
PR: 297384
Reported by: Daniel Engberg <diizzy at FreeBSD.org>
<If someone else reported the issue>
Mk/Scripts/qa.sh: Filter baselibs() input to improve performance
After the baselibs() fix in f0f863b1a2d6, readelf is executed for each
result from find(1). There are two concerns with this fix:
1. -exec readelf -d {} \; drops the filename from the error messages
readelf prints "File: <name>" headers only when it is supplied with two
or more files, and baselibs() uses ${file} from those headers. So, the
two err() messages in baselibs() will break.
This is moot for now, though, because nothing in the ports tree can
trigger these errors. Those base soname versions for libarchive and
libedit are long gone.
2. Performance hit with one readelf execution per staged file
The costs are high for ports that stage many files. For
emulators/linux_base-rl9, the find returns over 30k hits that the while
[12 lines not shown]
ipfilter: Fix checksum update for NAT_DIVERTOUT
When taking a snapshot of the before ip_len (s1) for comparison with the
after-translated ip_len (s2), we must convert it from network to host
byte order before we can use it. Add the missing ntohs() call.
PR: 296944
MFC after: 3 days
security/wpa_supplicant*: Fix EAPOL_TEST build for non-standard SSL_DEFAULT
The post-build target does not have the same environment variables setup
as the do-build target. This results in the eapol_test binary getting
compiled against the headers of the TLS library specified in
SSL_DEFAULT, but getting linked against the TLS library from the base
system regardless of SSL_DEFAULT, causing build failures when
SSL_DEFAULT is set to a different TLS library/version than the on from
the base system.
Fix this by not using the post-build target to build the eapol_test
binary, but instead conditionally add the eapol_test target to
TARGET_ALL if the EAPOL_TEST option is enabled for the port.
Signed-off-by: Pascal Ernster <git at hardfalcon.net>
net/amnezia-kmod: Update 2.0.11 => 2.0.12
Changelog:
- if_amn: wg_crypto: validate OCF authentication result.
- Check crp_etype after crypto_dispatch() so packets with an invalid
Poly1305 tag are rejected.
- Require a synchronous crypto session before using a stack-allocated
request.
https://github.com/vgrebenschikov/wireguard-amnezia-kmod/releases/tag/v2.0.12
PR: 297625
Security: CVE-2026-58085
Sponsored by: UNIS Labs
MFH: 2026Q3
share/man/man4: Move non-USB man pages out of MK_USB block
uart(4), unix(4) and the gzero(4) MLINK are not USB things, but they
were in the .if ${MK_USB} != "no" block. So if we build with
WITHOUT_USB, these man pages are lost. Move them out of the block.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 1100d9eca9cb2860c58633a9176dd11a30850da4)
share/man/man4: Move non-USB man pages out of MK_USB block
uart(4), unix(4), veriexec(4) and the gzero(4) MLINK are not USB
things, but they were in the .if ${MK_USB} != "no" block. So if we
build with WITHOUT_USB, these man pages are lost. Move them out of
the block.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 1100d9eca9cb2860c58633a9176dd11a30850da4)
fts: add fts_capsicum_test.c
Add three test cases verifying fts(3) Capsicum capability mode:
- fts_dirfd_valid: verifies fts_dirfd is set for all non-root
entries and openat(fts_dirfd, fts_name) identifies the same
inode as fts_accpath
- fts_dirfd_capsicum: verifies complete fts traversal works in
Capsicum capability mode using fts_openat() and fts_dirfd
- fts_dirfd_deep_tree: verifies fts_dirfd + fts_name is correct
at all directory depths (7 non-root entries)
Sponsored by: Google LLC (GSoC 2026)
Reviewed by: asomers
Pull Request: https://github.com/freebsd/freebsd-src/pull/2332
japanese/fcitx5-skk: Depend on ECM unconditionally
The top-level CMakeLists.txt calls find_package(ECM 1.0.0 REQUIRED)
unconditionally, but the port only declared the dependency under the QT6
option, so configure fails with WITHOUT_QT6. Move it out of the option
and make it build-only. ECM is listed in _USE_KDE_LATEST, so USES=kde:6
can be dropped along with it, as done in 95f9a6808973 for the other
fcitx5 ports.
PR: 297622
Approved by: osa (mentor)
japanese/fcitx5-cskk: Depend on ECM unconditionally
The top-level CMakeLists.txt calls find_package(ECM 1.0.0 REQUIRED)
unconditionally, but the port only declared the dependency under the QT5
option, so configure fails with WITHOUT_QT5. Move it out of the option
and make it build-only. ECM is listed in _USE_KDE_LATEST, so USES=kde:5
can be dropped along with it, as done in 95f9a6808973 for the other
fcitx5 ports.
While here, fix the indentation of PORTREVISION.
PR: 297623
Approved by: syobon at syobon.net (maintainer)
Approved by: osa (mentor)
vtnet: move offload functions to virtio_net.h to share them
Move the functions vtnet_rxq_csum() and vtnet_txq_offload() and the
subfunctions they call from if_vtnet.c to virtio_net.h. This allows
us to call these functions from if_tuntap.c and if_ptnet.c.
virtio_net.h already contained a copy of these functions, but a copy
of an outdated version. The functions evolved in if_vtnet.c.
In if_vtnet.c, the copy has never been used because it increments
counters in their own functions.
This patch removes the outdated copy from virtio_net.h and moves the
new version of the functions from if_vtnet.c to virtio_net.h.
if_tuntap.c, if_ptnet.c, and if_vtnet.c just call these functions,
and if_vtnet.c increments its counters depending on the return value.
Reviewed by: tuexen
MFC after: 1 month
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D57299
