BSD Commit Log Search

   Fix operator priority in promisc setting expression. Reported by modern gcc.

   I strongly suspect these tools will work with unveil "/etc" "r" and
   pledge "stdio rpath getpw inet dns".  might even be able to
   remove something after some observation.

   RSA or EC certs in regress run tests with local or remote relayd.

   use err.h family of functions instead of fprintf(stderr and perror

   Abort enhanced capability loop if reading all ones from the device instead
   of looping infinitely; this value isn't allowed by the spec, but there are
   devices behaving that way, from Intel no less.
   ok deraadt@

   Remove unused bridge_tunneluntag().
   ok bluhm@

   Remove global prototype for bufcache_getcleanbuf(), and only compile it
   #ifdef HIBERNATE, for it is not used anywhere else.
   ok deraadt@

   Remove unused cd9660_mmap() and cd9660_seek().
   ok tb@

   Remove unused rc4_getbytes() and Blowfish_expandstate().
   ok tb@

   Remove unused kernel global utsname.
   tweak&ok dgl@

   Comment out zlibVersion() and zlibCompileFlags(), unused in the kernel.
   ok tb@

   vmd(8): add extra mmio region

   this adds a no-op (reads return FFs, writes discarded) mmio region between the
   end of guest RAM and 4GB. specifically recent i686 linux bootloaders/kernels do
   what appear to be errant probes of high PAs in the > 0xc0000000 range, and
   vmd treats all mmio accesses to unmapped regions as fatal.

   this diff adds a region to cover any gap, such that accesses to those addresses
   trap to vmd, which then does what real hw would do. other hypervisors do
   similar things.

   this allieviates the need to assign 4GB ram to these VMs which was previously
   needed to work around the problem.

   ok dv

   I am pretty sure two unveil() and pledge "stdio rpath wpath inet dns"
   will work here.  commiting to collect feedback.

   Use O_NOFOLLOW for the binding dir open

   use the err.h family of functions

   use SOCK_STREAM instead of fcntl O_NONBLOCK

   unveil() and pledge() are pretty easy to add

   use accept4() with SOCK_NONBLOCK rather than fcntl O_NONBLOCK
   ok ratchov

   rpki-client: CRL Number draft is now RFC 9829

   Remove extra C++ test.  Upstream does not support it anymore.

   install media growth

   Add a one line description text to each command, originally from someone
   in GitHub issue 5438.

   sync

   Add missing sentinel to multistate_keepalives.  bz#4028 from dambi at tio.cz.

   Clear session when freeing client, GitHub issue 5712 from Jeong, Heon.

   rpki-client: merge mft certid and isuserid

   The latter was never set and they mean the same thing anyway.

   ok job

   Keep track of the certid of the issuer in a given product

   Will be used to sync a tree of CAs between parser & main process.

   OK tb@

   rpki-client: rework handling of the expire time

   The expire time for certificates was added as a hack for filemode and has
   been unused in normal mode. We can use it to track the expiry time along
   the validating chain of all objects by setting it when validating CAs.

   TAs expire with their not after, intermediate CAs and EE certs expire at
   the minimum of their notafter, their CRL's nextupdate and their issuer's
   expire time. Signed objects inherit the expire time from their EE cert
   (this can be handled more cleanly later on).

   This way we do not need to grab a lock to determine the expire time of any
   object and we can stop walking up the validation chain and look up the same
   CRLs over and over again.

   ok job

   Missing comma.  bz#4015, from calestyo at scientia.org.

   Fix typo in ssh-mldsa44-ed25519. bz#4027, from alarrosa at suse.com