bump datasize of the build user to 2.5G on 64-bit arches
The tight limit of 2176M for other 64-bit architectures was not enough for
sparc64. On 64-bit systems we can afford to be a bit more generous.
login.conf merges are always a bit fiddly.
ok jca sthen
Fix missing 'compatible' string NUL termination in case the compatible
string is => 32 bytes, which caused an out-of-bounds read later on in
the code path:
- Mimic apliic(4), which uses malloc instead of a fix-width array for
the compatible string.
- Also set 'ia_namelen', which should enable parsing of a secondary
compatible string, if it exists.
ok jca@
sys/qwz: handle QoS in native WiFi frames
Rebuild the QoS control field for native WiFi RX frames from descriptor
metadata before passing them to net80211.
On TX, strip the hostside QoS control field when using native WiFi
encapsulation, after deriving the TID for the firmware descriptor.
OK: mglocker@
Introduce reference counters for SysV semaphores to fix the context
switch use-after-free after tsleep in sys_semget().
sys___semctl() has no such problems, because we do complete reload and
re-check of semaphore stuff, however I like to replace all of them
with the only "semaptr != sema[ix]" check. The semaphore was changed, go
to the beginning of sys___semctl() and acquire it again.
Note, seminfo.semmni only grows, so even if `sema' array was
re-allocated, the sema[ix] is still valid.
"go for it" from deraadt
bin/ksh: preserve tildes in completion
Keep leading tilde expressions in the command line after file
completion. Expanding ~user to pw_dir during editing bakes the result of
an early passwd lookup into the command line; if the account changes
before the command is executed, the command uses a stale pathname
instead of the current ~user expansion.
Completion still performs the lookup needed to enumerate pathname
matches, but rewrites matches back to the spelling the user typed and
does not leave a completion only lookup in the homedir cache.
Also complete bare ~user prefixes from the passwd database, so ~us[TAB]
can become ~user before pathname completion continues.
Preserving tilde is the default behaviour.
OK: deraadt@
Tighten up read-only checks on attach-session, detach-client and
switch-client so that a user should be able to only detach their own
client. Reported by John Walker.
Ingore packages with invalid prefixlen.
Rouge router advertisements with a prefixlen > 128 would make slaacd
exit with a fatal error, leading to a denial of service.
The same issue exists in dhcp6leased where a rouge prefix delegation
would make dhcp6leased exit with a fatal error, leading to a denial of
service.
Pointed out by Ivan of Quarkslab.
input & OK deraadt
Add support for external account binding. If we're creating a new account
with the ACME CA, and we have an EAB key and key ID specified with the new
-e command line argument, compute the required hash of the account details
and include it in the new account request.
feedback from florian@ and tb@
tested against security/pebble and Digicert by me, and against Actalis by
rroadrrunner at proton dot me.
ok florian@ tb@
Attach ksmn(4) on 19h/1x devices
Tested on:
cpu0: AMD EPYC 9354P 32-Core Processor, 3250.01 MHz, 19-11-01, patch 0a101154
and fix the assertion ksmn_ccd_attach to allow for devices with 12 CCDs.
ok brynet@ claudio@
Replace assert() with a graceful failure by aborting the http request.
An overlong HTTP line can fill the receive buffer to its max but then
http_get_line() would still return NULL trying to read more data.
Since the buffer is full the assert would trigger. Now the http request
is terminated.
Reported by Frank Denis
OK tb@
