rpki-client: reimplement and fix cert inheritance checks
The current implementations of x509_inherits() and x509_any_inherits()
are a bit dumb because they re-parse the RFC 3779 extensions to figure
out if all (or any of) the resources inherit. That's quite expensive.
We have all this information already in struct cert, so let's use that.
In cert.c we have the strangely named cert_as_inherit() which requires
the presence of AS resources and checks that the ASIdentifiers are
marked inherit. (It should probably be called cert_ases_inherit())
A similar approach works for IPAddrBlocks. The main observation is that
inheritance applies to the entire address family. Since the IPAddrBlocks
are sorted by AF, of which there are two, we know that an inherit element
comes at the start or the end of the cert->ips[] array. This leads to
cheap and easy cert_all_ips_inherit() and cert_any_ip_inherits()
implementations.
[34 lines not shown]
rpki-client: add a check that IPv6 can't precede IPv4
RFC 3779 is unambiguous: "When both IPv4 and IPv6 addresses are specified,
the IPv4 addresses MUST precede the IPv6 addresses [...]", so add a check
that this is the case.
ok claudio
audio: Check the AUDIO_MIXER_* ioctl's index for negative values
While most drivers check their input (ex. azalia, uaudio, cmpci, envy
do), a driver like utvfu(4) may allow the AUDIO_MIXER_WRITE ioctl to
trigger an out-of-bounds heap write. This fix ensures that any
present or future low-level audio driver gets an index in its
supported range.
Report and proposed fix by Franz Bettag <franz at bett.ag>. Thanks!
shuffle nvgre packet processing to simplify nvgre ioctls.
nvgre_start could be called both with and without NET_LOCK, so it
had to try and coordinate with nvgre_up and _down without relying
on NET_LOCK, but then it also had to defer sending encapsulated
packets to a task so it could control the scope of NET_LOCK before
calling ip_output and ip6_output.
tom smyth reported issues with the nvgre_down coordination, which
led to restructuring this code.
nvgre now forces all transmit calls to be run from their own task
in the softnet threads, which in turn allows it to take NET_LOCK
itself and rely on it to coordinate access to the gre tunnel
configuration parameters. this simplifies nvgre_down, and also
allows us to remove the extra send task, because the NET_LOCK scope
is already known and controlled. packet reception is done as part
of the ip stack processing, so it already has NET_LOCK arounds its
use of the tunnel config.
[7 lines not shown]
Fix `findpr' dereference after context switch in sysctl_proc_vmmap().
Do the sleeping malloc() before process search. Take the reference on
found process descriptor to make concurrent exit1() wait us during the
sleep within fill_vmmap().
I moved the `oldlen' checks and `start' copyin() before process search
to make the error path shorter. This reorders the error path, but they
are just the passed parameters checks which are not related to
found process.
ok kirill
sys/swap: match swap block devices by device number
Prevent duplicate activation through aliases and retain the registered
vnode through the swapoff close.
Reported by miod@ and Yamasaki Yuu
Ok: claudio@
