Prevent pf dropping TCP state with crafted reset packet.
Revision 1.1212 of pf.c weakened the TCP reset check in stateful
connection tracking to let legitimate resets pass in the backwards
window. Such a reset is accepted only if its acknowledgment number
matches perfectly. But as a workaround for broken stacks, pf
replaces an acknowledgment number of 0 in a reset with the tracked
sequence of the peer. Then the perfect match always succeeds, and
an attacker can spoof resets more easily than intended. Use the
acknowledgment number from the wire, before the workaround has
modified it.
discovered by Minghao Zhang; OK sashan@
Require NRIP Save support for vmm(4) on AMD hosts.
This feature gives a fast, reliable path to accurately advancing
RIP when emulating certain instructions. Most AMD hardware from the
past 15 years should have NRIP Save and nested paging support so
this drops support for AMD hardware from roughly family 11h and
older with some rare exceptions.
Discussed multiple times in the past.
ok mlarkin@
Centralize vmm(4) vcpu yield logic.
Put all checks for "should the vcpu yield?" into the same function
and rename it to better fit semantics ("stop" -> "yield"). This
pulls in some scheduler flag checks that were duplicated between
amd64 cpu-dependent code paths.
sure, mlarkin@
Make vmm(4) exception helpers return void.
None of the vmm_inject_{gp,ud,etc.}() functions can fail. There's
no need to return 0 for all of them, so simplify the function
signature and update call sites to clean things up a bit.
sure, mlarkin@
vmm(4): classify injected #DB as hardware exception.
vmm was incorrectly classifying as a software exception. Change to
hardware exception without an error code.
ok mlarkin@
Use bpf_mfilter in bpf_movein since it operates on an mbuf
With this bpf_filter is no longer used by the kernel and all the code
around it can be hidden from _KERNEL.
OK tb@
Use correct bpf filter calls in ppp(4)
10 years ago the bpf_filter interface was changed and bpf_mfilter was
introduced. bpf_filter no longer support passing an mbuf as pkt by using
a buflen of 0. Finally adjust this code and switch it over to bpf_mfilter.
OK tb@
When a manual page file requested via man(1) is not found in any mandoc.db(5)
but is then found by the fallback search in the file system, do not warn
about an outdated mandoc.db if the manual page tree that contains the
requested file does not contain a mandoc.db file in the first place.
This avoids bogus, annoying warnings in two situations:
(1) when users choose to have their own, private manual page tree
without putting a mandoc.db into it; and
(2) on operating systems allowing a configuration where makewhatis(8)
and mandoc.db(5) are not used at all.
Issue found by Paul Bredbury <brebs at sent.com> on Alpine Linux, where
installing apropos(1) and makewhatis(8) is optional and not the default.
asn1_multi: rework creation of the returned stack
Currently, the ASN1_TYPE ret is created up front and further populated
via a possibly failing call to ASN1_STRING_type_new(). On failure, the
incomplete ret is returned, indicating success to the caller, which may
or may not fail later.
Instead, create the inner ASN1_STRING first, then the ASN1_TYPE. Use
setter API with proper ownership transfer rather than fiddling with
deeply nested ASN1 structures. This way we only succeed if everything
actually succeeded.
ok kenjiro
asn1_multi: plug leak if sk_ASN1_TYPE_push() fails
If the push of typ onto sk fails, the exit path does not free it.
Fix that and avoid function nesting when calling ASN1_generate_v3().
Prompted by a similar fix in OpenSSL
ok kenjiro
IANA has allocated a non-vendor codepoint for ssh-mldsa44-ed25519,
so use it instead of the vendored "@openssh.com" name.
Note: this replaces the vendored name, which was only marked as
experimental and not enabled by default.cw
If you have ssh-mldsa44-ed25519 at openssh.com keys manually configured
in sshd, then you will need to remove them from sshd_config and
restart.
drm: apple: Switch back to drm_atomic_helper_commit_tail_rpm()
From Janne Grunau
bd8ce96f6e76b98940352b18fe735a7943471ed7 in AsahiLinux/linux
This implictly gets rid of drm_atomic_helper_wait_for_flip_done()
and makes graphical output on Apple Silicon machines noticably
snappier.
ok kettenis@ jsg@
Update libexpat to version 2.8.4
Relevant for OpenBSD are security fixes #1321 #1331 #1322, other
changes #1315 #1325 #1334 #1340 #1319 #1320. Library bump is not
necessary.
CVE-2026-66046CVE-2026-76641CVE-2026-76957
OK tb@
Use unveil(2) and clamp down on pledge(2).
The main() program establishes a baseline, allowing the maximum
that might ever be needed: stdio rpath and read access to the MAN_DIR.
The top level page generators (pg_show, pg_search) narrow unveil(2)
to the specific manual page tree selected by the user.
When the selected manual page file has been opened, the pledge is narrowed
to just stdio (in resp_catman, resp_format, pg_searchres, pg_index).
Except for internal errors and bad requests, which error out early,
exactly one of these narrowing codepaths is always trodden.
