avoid spurious disconnect if connecting as root with
`PermitRootLogin forced-commands-only` enabled and a authorized_keys
entry _without_ a `command=` option before a key _with_ this option.
Anthropic ANT-2026-29SEM083
make `ssh-keygen -lf /key` more strict on detecting the start of
private keys. Previously it would try to parse anything starting from any
line that contained "PRIVATE KEY", now it looks for more of the key header.
Anthropic ANT-2026-1T34TRV0
The adaptive noise immunity code has been present, but never enabled, since
day one, because athn_ani_get_rssi() was never written (it is just a stub).
Put all that code within #if 0 so that it does not waste kernel text.
pf(4) rule item traversal requires state mutex protection
When pf_test() decides whether a log action needs to be
handled for a matching state, it must also hold the
state mutex to stay synchronized with the purge thread,
which may be removing the same state.
Issue kindly reported by Acts1631.
OK henning@
make uncm(4) NCM 1.0 spec compliant
- Payload alignment now matches NCM 1.0
- Reserved bits in bmNtbFormatsSupported are now ignored by the host as
needed for NCM 1.0
- IN NTB size was clamped to 65535 without telling the device
- Initialization order is now alt setting 0 -> NCM parameter requests
-> alt setting 1
- Stop ignoring bmNetworkCapabilities and use GET_ as fallback
- Some cleanup for printing with the right placeholder and moving
variables around
From Jan Scheiber
Tested by Jan and myself on Android phones
Allocate the firmware dma memory segments individually, each aligned
to the next power of two of its size, same as Linux does. Packing
them into one 64KB-aligned buffer makes newer WCN7850 firmware (for
example WLAN.HMT.1.1.c7) crash on the respond-memory request, depending
on where the buffer lands in the physical memory.
This fixes the qwz(4) firmware loading for the Samsung Galaxy Book4
Edge with linux-firmware-20261019.
ok stsp@, kettenis@
Update to 2026fgtz from https://github.com/JodaOrg/global-tz
o Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07.
o No more leap seconds, and leap second tables no longer expire.
o Improve 1965/1966 data for Brazil.
Attach mbuf to the end-of-packet descriptor when sending packets and
swap the DMA mapping accordingly. This prevents a potential use-after-free
by the DMA engine of the network interface discovered by Acts1631.
Fix based on a suggested diff by Acts1631.
ok mvs@
In check_delta() ensure delta list ends with the notification serial
If the delta sequence does not end with the notification serial there
is a hole at the end. The check for this condition was lost in rev1.18.
An RRDP notification with any hole in its delta sequence is invalid and
so error out and fall back to rsync. It is valid to have no deltas at
all so check for that case as well.
Reported by Fedor Vompe via job@
OK tb@
rpki-client: ensure delta list ends with the notification serial
In rrdp_notification.c r1.18 a check ensuring that the delta list ends
with the notification serial was lost. This means a later assert could
trigger. Reinstate a version of this check next to the check that the
delta list starts at the proper spot.
A follow up commit by claudio hardens this some more.
From Fedor Vompe via job
ok claudio
libssl: bump sigalg maximum to 256
With PQ algorithms getting more widely deployed, the formerly generous cap
of 32 sigalgs has long been known to be too tight for a while. A couple of
years back jmatthew ran into interop issues with the oqs provider being
enabled on OmniOS by default. OpenSSL 4.1 now announcing 39 sigalgs, this
is becoming a real-world problem and is first and foremost protecting us
from seamless interop with other stacks.
To this end, introduce a helper shared between client and server to cap
the list size and a macro similar to the one we have for supported groups.
Thanks to DabeDotCom for reporting.
Fixes https://github.com/libressl/portable/issues/1446
ok jsing
