Reset getopts to decouple rcctl and daemon_flags; from obsd at mulh.net; OK sthen
ksh(1)'s OPTIND is global and only saved/restored for `function' style functions.
That means passing, e.g. -d to rcctl(8) would leave OPTIND=2 for rc_pre() in
rc.subr(8) scripts using getopts, thus starting (continuing, really) parsing
options at the second argument.
fix some bpf code.
jsg@ pointed out that i was unconditionally calling bpf_mtap when
the convention is to test if the bpf if pointer is set before calling
bpf_mdap.
while here drop incoming packets if the bpf filter tells us to to
be consistent with the if_input handlers.
original nit pointed out by jsg@
i put the wrong version of the esp boot code in.
the way espopen() works on amd64 is different to arm64, and i was
missing the adaptation.
ok jmatthew@
Add local hostname and pid to ~I escape connection info, only display
peer information for TCP connections including source address and port
This provides enough information to uniquely identify a connection on
the host or network.
Actually check that each @lib has its ${LIBname_VERSION}
pkg_create was skipping this check because it had "!$x =~ m/y/"
instead of "$x !~ m/y/". The misplaced "!" warns in Perl 5.42. When
afresh1 fixed the warning, it exposed other problems with the check.
Here, espie rewrites the check to allow @lib versions like
${LIBvala-${API_V}_VERSION} in lang/vala. Substitute every variable
but the one we need, then ensure it matches what we want.
If you upgrade base but keep an old ports tree, then cad/qcad and
devel/libtalloc would fail to package; those 2 ports were fixed by
2025-11-21.
from Marc Espie <marc.espie.openbsd () gmail ! com>
bulk and ok jca@
ok afresh1@
start moving some global pf counters to per cpu counters.
this moves the pfctl_status.fcounters, which includes the state
search counter which is bumped every time the state table is searched.
the places that get a copy of these counters now have to read the
per cpu counters and fold them into a struct pf_status rather than
just copy the global now.
ok sashan@
add support for loading files (kernels) from the efi system partition.
this means you can put the openbsd boot loader and bsd.rd on the
efi boot partition and run the installer that way. this is a port
of the same code i got working on arm64.
ok jmatthew@
Ignore any iterator when traversing nd6 list.
nd6_rtrequest() could crash with a NULL pointer dereference if an
interator in nd6_list was inspected. Skip freeing neigbor discovery
entries and optimization in this unlikely case and try again later.
reported by Mischa and Anton Kasimov; OK mvs@
this is errata/7.8/011_nd6.patch.sig
Fix incomplete mitigation of CVE-2025-11411 in unbound and unwind.
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2025-11411_2_wtests.diff
This extends the previous fix by also scrubbing unsolicited NS RRSets (and
their respective address records) for YXDOMAIN and nodata non-referral answers.
from sthen@ florian@
this is errata/7.8/010_unbound.patch.sig
Fix incomplete mitigation of CVE-2025-11411 in unbound and unwind.
https://nlnetlabs.nl/downloads/unbound/patch_CVE-2025-11411_2_wtests.diff
This extends the previous fix by also scrubbing unsolicited NS RRSets (and
their respective address records) for YXDOMAIN and nodata non-referral answers.
from sthen@ florian@
this is errata/7.7/017_unbound.patch.sig
Fix drm code to avoid spurious tsleep errors leading to crashes
__set_current_state() reimplements parts of sleep_finish() but forgot
to clear P_SINTR. Later another tsleep->sleep_finish() call could
pick up the flag and erroneously return ERESTART early, leading to
crashes in unsuspecting code using tsleep(0, INFSLP).
Issue experienced by Piotr Isajew using iridium on 7.8 and myself
using firefox.
from jca; ok claudio@ mpi@ and most likely kettenis@
this is errata/7.8/007_drm.patch.sig
Fix drm code to avoid spurious tsleep errors leading to crashes
__set_current_state() reimplements parts of sleep_finish() but forgot
to clear P_SINTR. Later another tsleep->sleep_finish() call could
pick up the flag and erroneously return ERESTART early, leading to
crashes in unsuspecting code using tsleep(0, INFSLP).
Issue experienced by Piotr Isajew using iridium on 7.8 and myself
using firefox.
from jca; ok claudio@ mpi@ and most likely kettenis@
this is errata/7.7/015_drm.patch.sig
Add "no banner" option to suppress Server header
Introduces a global and per-server "[no] banner" directive that prevents httpd
from sending the Server HTTP response header and removes server identification
from error documents. The SERVER_SOFTWARE CGI environment variable remains set
as required by RFC 3875.
Diff by Lloyd (thanks), ok kirill@
Clean up confusing logic in CMS_EncryptedData_encrypt()
This makes it easier to read and more in line with other code in
libcrypto. Also add a missing error check for the CMS_set_detached()
call.
ok jsing kenjiro
Fix double free in certificate policies configuration
In nref_nos(), nnums must not be freed on error because in the caller it
is not->noticeref->noticenos and hangs off the POLICYQUALINFO qual which
is freed as part of POLICYQUALINFO_free() in the error path.
ok jsing kenjiro
Ignore any iterator when traversing nd6 list.
nd6_rtrequest() could crash with a NULL pointer dereference if an
interator in nd6_list was inspected. Skip freeing neigbor discovery
entries and optimization in this unlikely case and try again later.
reported by Mischa and Anton Kasimov; OK mvs@
Add missing GZIP_STATIC flag to SRVFLAG_BITS macro
GZIP_STATIC flag at position \33 was missing from the debug string.
Also correct the truncated PATH_REWRITE/NO_PATH_REWRITE flag names.
The PATH_REWRITE and NO_PATH_REWRITE flag names were truncated to
PATH and NO_PATH in the SRVFLAG_BITS string definition.
OK kirill@ deraadt@
vmd(8): Use 32-bit direct kernel launch for both amd64 and i386
When bootet by /boot (or EFI boot loaders) both amd64 and i386
kernel start in a 32-bit mode.
When launching kernel directly (vmctl start -b <path>) vmd(8)
configures a flat 64-bit register set as default register set. The
GDT provides a 32-bit flat code segment.
For the i386 kernel the default register set is reconfigured to
32-bit legacy mode; paging is enabled and uses 4 Mb pages. This
is different to i386 being bootet by /boot. /boot launches the
i386 kernel with paging disabled.
The amd64 kernel uses the default register set, i.e. long mode is
enabled in EFER. However, it uses the 32-bit code segment of the
GDT. Thus ther kernel is effectively running in 32-bit compatibility
mode.
[15 lines not shown]
Implement appl_sysuptime() in favour of smi_getticks().
appl_sysuptime() uses CLOCK_MONOTONIC instead of gettimeofday(), works
on a per context basis as per RFC2741, and puts it in a sane namespace.
Makes sense to tb@
OK jmatthew@
tweak make "magic variables" handling
The idea is that it's shorter to special-case ${@D} and the likes
(two characters variables ending in D or F) instead of having a weird
idx encoding.
Cons:
- this yields an extra "ext" parameter to classify_var
Pros:
- the weird index encoding vanishes
- no need for special treatment if we add more similar variables.
- drastically reduces the size of the switch (and the modulo shrinks from
82 to 36)
- code will recognize constructs like ${?D} and ${?F}, which puts us in
line with FreeBSD and NetBSD bmake, and also with gnu make.
from espie
