Restore the OCSP no-check extension method
The conversion of X509V3_EXT_get_nid() from a table to a switch
omitted the OCSP no-check extension method.
Add the missing accessor declaration and switch case.
ok tb@
Improve imsg code, switch to imsgbuf_get and use more imsg_get_data
Switch the IMSG_HOST_DNS call to use imsg_add_strbuf and imsg_get_strbuf.
Also use NI_MAXHOST for the name length.
Also rework IMSG_PW_ENTRY and IMSG_GRP_ENTRY to use imsg_get_len()
and imsg_get_data() to fetch the record. Ensure that the data length
is large enough but not too large to fit into &ir.
ok jmatthew@
The previous fix to bus_dmamap_load() wasn't quite right. We do need
virtual address continuity when we're bouncing. So a !bounce check
was correct, but only in the case when DMA is cache coherent. Note that
this becomes identical to the amd64 equivalent of this code when one
considers that on amd64 DMA is always cache coherent.
ok deraadt@, jca@
pkgconf: simplify unveil handling
Instead of giving fine-grained read access by iterating, use a simple
unveil("/", "r"). pkgconf runs with pledge "stdio rpath wpath cpath unveil"
with closed unveil, and only /dev/null and an optional log file have "rwc".
discussed with deraadt a long time ago, agreement by claudio
ok sthen
relayd: allow setting log level from relayd.conf
Add "log level (brief|verbose)" which sets or clears RELAYD_OPT_VERBOSE
just like relayctl log verbose|brief does at runtime.
This makes sense now because the recent DPRINTF removal turned all
DPRINTF calls into real log_debug calls. Some debug logs moved to
warning. Some remained DPRINF().
Before that change the toggle had almost nothing to gate. All debug
output was compiled out unless relayd was built with DEBUG > 1. So
"log verbose" in relayctl was practically a no-op for users.
It was impossible for the user to work out why the setup/config wasn't
working.
Now the toggle actually does what its name suggests. Pinning the
level in the config file lets it survive restarts and SIGHUP reloads.
OK kirill@
add some options to allow setting or clearing the touch-required
and verify-required flags on FIDO private keys when resetting
the passphrase.
feedback/ok tb@
Allow session-bind at openssh.com requests when the agent is locked,
otherwise forwarding sessions established with an agent was locked
will be treated as local, rather than remote.
Reported by sn0x-sharma
avoid potential realloc use-after-free in the client if a remote
forwarding is added via the local session multiplexing socket
while a remote forwarding open request is pending with the server.
Report and fix from Brian Mingus of Cognatory
Always unzoom before splitting window, for floating panes also. We
already unzoomed for tiled panes and this does the same for floating
panes (until we support having them float over a zoomed pane). From Éric
NICOLAS.
Adjust pstat(8) to the changed KERN_TTY_INFO struct itty.
Also fix up the code path via kvm which requires an extra indirection
and define __need_process. On top of this fix pstat to allow -t & -M
to work together.
OK deraadt@ kettenis@
Change struct itty and with it KERN_TTY_INFO to return the pid of the
session leader process
The t_session pointer is not very useful and only visible to root.
Adjust this similar to a change done in ps(1) and pass the process id
of the session leader instead.
This is a ABI change but KERN_TTY_INFO is only used by pstat(8) and
debian code search did not find any other use.
OK deraadt@ kettenis@
vmd(8): reject empty IMSG_VMDOP_LOAD messages from clients.
Reject empty values (either zero bytes or a single NUL) to prevent
zero-sized allocations, out-of-bounds write of a NUL byte, and
incorrectly triggering a reload event.
Report and original diff by Andrew Griffiths.
ok hshoexer@, mlarkin@
Limit the range of deltas added to the queue.
Instead of storing all deltas larger then our minimum serial number
store only deltas that are either in the range
[min_serial ... min_serial + MAX_RRDP_DELTAS]
or
[current serial - MAX_RRDP_DELTAS ... current serial]
where current serial is the newest announced RRDP serial.
The two ranges normally overlap but if they don't then it limits the
number of elements in the delta queue to 2 * MAX_RRDP_DELTAS.
The first range is used to validate the hashes stored in the RRDP state
file against the notification.xml contents. The second range covers the
deltas we are willing to walk to sync the repo -- it also is the new set
of delta hashes that will be stored in the state file.
Reported by Xin Wang
OK tb@
