Correctly check whether CAs were previously confirmed
The intention was to check using the state from the previous run, but
this got lost in a refactor.
Reported by Ties de Kock
OK tb@
Prevent fq_codel panic from drop counter wrap
Sustained traffic through a congested fq_codel queue can wrap the
per-flow drop counter to zero, triggering the control_law() assertion
and panicking the kernel. Saturate drops and decrement a nonzero ldrops
to preserve the grace-period delta and prevent the wrap.
Issue reported by Acts1631.
OK sashan@, claudio@
pf(4) yet another race between pf_test() and pf_purge_states()
pf_counters_inc() running on behalf of pf_test() may dereference a
dead memory left behind pf_purge_states(). The reference to state
object is still valid, but other items such as radix tables might
be gone. To stay on the safe side the pf_counters_inc() must
grab state's mutex and check if state itself is on its death
row (->timeout == PFTM_UNLINKED). If it is the case then
pf_counters_inc() must bail out without trying to update counters.
Issue was kindly reported by Acts1631.
OK dlg@
Fix out-of-bounds read on on missing right bracket after character class.
The original code checked for a closing bracket before parsing the
bracket expression. When character class support was added, that
closing bracket can now be part of the character class instead.
Add another check for the closing bracket after parsing character
classes and roll back if we don't find one.
Adapted from an OpenSSH bug report. OK djm@
Limit the number of pending L2TP connections. Previously, an
unlimited number of pending connections could exhaust npppd's memory.
From acts1631
ok mvs
Reject short MPPE packets in npppd. Short MPPE frame underflowed the
RC4 length, that caused RC4 to access across memory until it faults.
From acts1631
ok mvs
Update libexpat to version 2.9.0
Relevant for OpenBSD are security fixes #1392 #1393, bug fixes
#1387, new features #1327 #1323, other changes #1394 #1399 #1400
#1401 #1402 #1404 #1405. Minor library bump is necessary for API
extension.
CVE-2026-102633CVE-2026-77214
OK tb@
sys/octeon: span work queue interrupts across CPUs
It was disabled at octciu.c,v 1.20 to allow fixing logic of ncpus which
leads to issues with devices where used cnmac wasn't mapped to CPU0
Now, since the missed splx() was added at clock.c, v1.54 I revert it back.
OK: visa@
rpki-client: sort arrays before handling temp files for ca state
The handling of the tempfiles is placed in the middle of the preparation
of the arrays to print. This commit moves it a bit down.
There is no goto err between the calloc and the qsort, so this is safe.
ok job
