add some options to allow setting or clearing the touch-required
and verify-required flags on FIDO private keys when resetting
the passphrase.
feedback/ok tb@
Allow session-bind at openssh.com requests when the agent is locked,
otherwise forwarding sessions established with an agent was locked
will be treated as local, rather than remote.
Reported by sn0x-sharma
avoid potential realloc use-after-free in the client if a remote
forwarding is added via the local session multiplexing socket
while a remote forwarding open request is pending with the server.
Report and fix from Brian Mingus of Cognatory
Always unzoom before splitting window, for floating panes also. We
already unzoomed for tiled panes and this does the same for floating
panes (until we support having them float over a zoomed pane). From Éric
NICOLAS.
Adjust pstat(8) to the changed KERN_TTY_INFO struct itty.
Also fix up the code path via kvm which requires an extra indirection
and define __need_process. On top of this fix pstat to allow -t & -M
to work together.
OK deraadt@ kettenis@
Change struct itty and with it KERN_TTY_INFO to return the pid of the
session leader process
The t_session pointer is not very useful and only visible to root.
Adjust this similar to a change done in ps(1) and pass the process id
of the session leader instead.
This is a ABI change but KERN_TTY_INFO is only used by pstat(8) and
debian code search did not find any other use.
OK deraadt@ kettenis@
vmd(8): reject empty IMSG_VMDOP_LOAD messages from clients.
Reject empty values (either zero bytes or a single NUL) to prevent
zero-sized allocations, out-of-bounds write of a NUL byte, and
incorrectly triggering a reload event.
Report and original diff by Andrew Griffiths.
ok hshoexer@, mlarkin@
Limit the range of deltas added to the queue.
Instead of storing all deltas larger then our minimum serial number
store only deltas that are either in the range
[min_serial ... min_serial + MAX_RRDP_DELTAS]
or
[current serial - MAX_RRDP_DELTAS ... current serial]
where current serial is the newest announced RRDP serial.
The two ranges normally overlap but if they don't then it limits the
number of elements in the delta queue to 2 * MAX_RRDP_DELTAS.
The first range is used to validate the hashes stored in the RRDP state
file against the notification.xml contents. The second range covers the
deltas we are willing to walk to sync the repo -- it also is the new set
of delta hashes that will be stored in the state file.
Reported by Xin Wang
OK tb@
Adjust bad_addr to also validate that the prefixlen uses a sensible value.
Someone found a way to push a bad prefixlen into a eigrp datagram and that
results in an overflow since the prefixlen is used to know how much data
to use.
This was sitting in my tree for too long
rpc: fix the svc_request() dispatch() callback signature
The prototype in rpc/svc.h already has the correct signature. Match this
in the function definition, the sc_dispatch() member in struct svc_callout,
and in the manual, fixing the documented return type from int to void in
one place.
ok claudio
sndiod: Allocate all midithru structures on the heap
The midithru structures that are used only internally (for MIDI
control of the logical audio sub-device) are allocated when needed
only. Now the MIDITHRU_NMAX macro is simply the number of user-visible
midithru ports. The midithru structures are identified by names,
instead of the indices.
Protect ip6_mforward() with kernel lock in ip6_output().
Multicast forwarding is not MP safe yet and also locked with shared
netlock plus kernel lock elsewhere.
OK sashan@
Remove documentation of OBJ_add_object(3)
This API was removed a long time ago but I forgot to update the manpage
(probably because doing so is slightly non-trivial).
There's still a lot of API here that should be removed. OBJ_add_objects()
seems now unused while OBJ_new_nid() is used by the one consumer that is
single-handedly responsible for at least two dozen APIs that could otherwise
be removed from libcrypto with significant simplifications: security/xca.
It would appear the author is on a quest to figure out how to make use of
whatever undocumented garbage they can find in the openssl headers. That's
of course a hobby project you can pursue for decades.
