extend the "mcast" pledge to allow multicast tweaks on ethernet frame sockets.
this is for lldpd, which wants to receive lldp packets sent to a
multicast address on interfaces as they attach at runtime, which
currently isn't allowed by pledge.
part of a bigger diff that was ok deraadt@
tighten pledge_sockopt()s level/optname checks for different types of sockets
tl;dr: the meaning of the setsockopt and getsockopt level and optname
arguments are dependent on the type of the socket you're working
with, they can't be safely understood without knowing the address
family and protocol.
i think we've been able to ignore to socket address family and
protocol so far by luck, particularly because openbsd (henning)
removed a bunch of address families like AF_IPX and AF_NETATALK.
like AF_INET and AF_INET6, they use values from the wire protocol
as identifiers in the ABI, particularly sub protocol numbers like
IPPROTO_TCP. there's no guarantee these numbers don't overlap with
a protocol from another address family. netipx used IPXPROTO_SPX
like how AF_INET uses IPPROTO_IP, but it's only luck that their
values don't collide with each other or another protocol. this
principle applies to all socktypes though.
this is also reflected in the way sockopts are handled by protocol
[17 lines not shown]
Compose a new imsg when relaying terminate to vmd(8) control.
Instead of forwarding the imsg, which was already consumed in the
parent vmd process, compose a new one to the control process. When
vmd was refactored to use the new imsg api for consuming the payload
instead of reading directly from the underlying ibuf, it caused
proc_forward_imsg() to forward incomplete data.
Instead of mucking about with the underlying ibuf and rewinding it,
update the only case of the consume-then-forward pattern to compose
a new imsg by using proc_compose_imsg().
Original diff and issue from Nick Owens.
rpki-client: remove another layer in the cms code
The cms_parse_validate() -> _internal() split was done for detached
messages, i.e., geofeed. This has been retired for a while now, and
won't come back.
ok claudio
vmm(4): support variable length instructions in VMX paths.
The Intel VMX handlers for things like HLT, RDMSR, etc. perform
strict checks for instruction length. This is excessive and incorrect
given the joys of x86/amd64. There's no need to kill the vcpu if
it was silly enough to prefix a HLT for some strange reason.
"sure", mlarkin@
rpki-client: garbage collect the _parse() functions
The _parse() functions are no longer used and can be removed.
With them gone, cms_parse_validate() becomes internal to cms.c
ok claudio
rpki-client: replace _parse() functions for signed objects
Replace calls to _parse() with calls to signed_object_parse() both
in file mode and in the parser process.
ok claudio
rpki-client: add signed_object_parse()
Now that all signed object parser functions have been unified,
we can replace them all with a single implementation. Add a helper
that returns the appropriate struct signed_obj * for a given rtype
and then use its handlers to allocate, parse, validate and free
the underlying C type. This is wrapped in signed_object_parse().
There is one small subtlety: for mft and tak the parse functions
fail if their _validate handler fails, for the remaining objects
only a flag is set and the handler always succeeds, so checking
the error of ->validate() does not change behavior.
ok claudio
rpki-client: add OID getter to struct signed_obj
This simply returns the OID ASN1_OBJECT created by x509_init_oid()
appropriate for each signed object. We need this for CMS validation.
Since these aren't runtime constants, they can't hang directly off
the static structs.
ok claudio
Improve imsg handling of LS_UPD, LS_FLOOD and LS_SNAP
Instead of passing imsg data around pass the lsa cache ref to lsa_flood
and ls_retrans_list_add. The ref holds all the data needed for those
calls. lsa_cache_add is also changed to pass an ibuf instead of imsg->data
and it is more careful at extracting the data. On top of this
lsa_cache_get becomes unused and is replaced by lsa_cache_ref which is
used in ls_retrans_list_add to increase the refcount on the lsa_ref.
Looks good to tb@
rename Ampere part 0xac3 from 'AmpereOne' to 'AmpereOne AC03'
identify Ampere part 0xac4 as 'AmpereOne AC04'
follows names used by Ampere in errata documents
ok kettenis@
Prevent pf dropping TCP state with crafted reset packet.
Revision 1.1212 of pf.c weakened the TCP reset check in stateful
connection tracking to let legitimate resets pass in the backwards
window. Such a reset is accepted only if its acknowledgment number
matches perfectly. But as a workaround for broken stacks, pf
replaces an acknowledgment number of 0 in a reset with the tracked
sequence of the peer. Then the perfect match always succeeds, and
an attacker can spoof resets more easily than intended. Use the
acknowledgment number from the wire, before the workaround has
modified it.
discovered by Minghao Zhang; OK sashan@
Require NRIP Save support for vmm(4) on AMD hosts.
This feature gives a fast, reliable path to accurately advancing
RIP when emulating certain instructions. Most AMD hardware from the
past 15 years should have NRIP Save and nested paging support so
this drops support for AMD hardware from roughly family 11h and
older with some rare exceptions.
Discussed multiple times in the past.
ok mlarkin@
Centralize vmm(4) vcpu yield logic.
Put all checks for "should the vcpu yield?" into the same function
and rename it to better fit semantics ("stop" -> "yield"). This
pulls in some scheduler flag checks that were duplicated between
amd64 cpu-dependent code paths.
sure, mlarkin@
Make vmm(4) exception helpers return void.
None of the vmm_inject_{gp,ud,etc.}() functions can fail. There's
no need to return 0 for all of them, so simplify the function
signature and update call sites to clean things up a bit.
sure, mlarkin@
vmm(4): classify injected #DB as hardware exception.
vmm was incorrectly classifying as a software exception. Change to
hardware exception without an error code.
ok mlarkin@
Use bpf_mfilter in bpf_movein since it operates on an mbuf
With this bpf_filter is no longer used by the kernel and all the code
around it can be hidden from _KERNEL.
OK tb@
Use correct bpf filter calls in ppp(4)
10 years ago the bpf_filter interface was changed and bpf_mfilter was
introduced. bpf_filter no longer support passing an mbuf as pkt by using
a buflen of 0. Finally adjust this code and switch it over to bpf_mfilter.
OK tb@
