rpki-client: sort arrays before handling temp files for ca state
The handling of the tempfiles is placed in the middle of the preparation
of the arrays to print. This commit moves it a bit down.
There is no goto err between the calloc and the qsort, so this is safe.
ok job
drm/amd: Create a device link between APU display and XHCI devices
From Mario Limonciello
b030fde644501d0ed5e604fc01719d1daa9cd472 in linux-6.18.y/6.18.58
75c8746b9d0a0317d8a58aa0efa2ff2f7359908b in mainline linux
Prioritise previously confirmed certification paths
Duplicate SKI might appear because of reuse of a keypair (a poor CA
practise, but not illegal) or because of 'public key stealing', i.e.,
an adversarial CA issues a certificate containing the victim CA's SPKI
and SIA. Because SKI might not be globally unique, certificates have
been tracked by an internal identifier since 2024.
Jacobsen et al., 2026, reported that rpki-client's certification path
loop protection might be exploited if an adversary can race the victim.
This race can happen in the discovery of the logical certification
topology, unrelated to racing repository loading over the network. Any
payload carrying objects (ROAs, ASPAs, etc) discovered through the
adversary's certification path will fail resource containment checks and
the loop guard (entity_process()->filepath_add()) necessarily enforces
each object to be accessed only once. The result is that if the race is
lost, the victim's payloads disappear from view.
Some people incorrectly assert that RPKI resource certificates cannot
[31 lines not shown]
Handle the Emudhra intermediate cert compromise.
See https://emudhra.we-have-a-problem.com/
While likely all of Emudrha will be distrusted soon, currently
a lot of India is using them. 8 intermediates under their CA3
have publicly discoverable keys. the 9 others sign many sites.
For now, remove CA3 from the trust store, thus distrusting all
the intermediates it has signed, then add back the remaining
9 uncompromised intermediates by "promoting" to a root, the
usual intermediate elision technique.
This enables real sites in india using these intermediates
to still work. Assuming Emudhra ends up widely distrusted
soon, we can remove these and the other roots after sites
have had time to get new certificates.
from beck@; OK tb@ sthen@
dbupdate: Be consistent with name in messages.
from dgl@; OK deraadt@
force umask
[45 lines not shown]
Handle the Emudhra intermediate cert compromise.
See https://emudhra.we-have-a-problem.com/
While likely all of Emudrha will be distrusted soon, currently
a lot of India is using them. 8 intermediates under their CA3
have publicly discoverable keys. the 9 others sign many sites.
For now, remove CA3 from the trust store, thus distrusting all
the intermediates it has signed, then add back the remaining
9 uncompromised intermediates by "promoting" to a root, the
usual intermediate elision technique.
This enables real sites in india using these intermediates
to still work. Assuming Emudhra ends up widely distrusted
soon, we can remove these and the other roots after sites
have had time to get new certificates.
from beck@; OK tb@ sthen@
update cert.pem based on newer mozilla ca root store
from sthen@; OK tb@
dbupdate: Be consistent with name in messages.
[48 lines not shown]
Simplify how entries in .nca_history are sorted
"When did it break?" and "what broke?" really are the only two
operationally relevant sorting properties for .nca_history.
OK tb@
Acquire kqueue_ps_list_lock rwlock before the process search and found
`pr' dereference. Otherwise found process can exit1() during context
switch.
Reported by Acts1631. ok claudio
rpki-client: report on non-canonically ordered addresses in ROAs
This adds a warning (under verbose) if the ROAIPAddress families contain
out of order elements. It also warns (always) if IPv6 comes before IPv4.
The JSON output for ROAs in filemode grows a new noncanonical boolean.
ok job
Remove redundant evtimer_pending() and signal_pending() checks
event_del() has no effect when an event is not pending, so there is no
need to check its state before deleting timer and signal events in
ldapd, radiusd, and vmd.
These are mechanical cleanups with no change in event scheduling or
callback behaviour.
Reads OK florian@
Remove redundant evtimer_pending() checks in routing daemons
event_del() has no effect when an event is not pending, so there is no
need to check its state before deleting timers in dvmrpd, eigrpd, ldpd,
ospf6d, ospfd, and ripd.
These are mechanical cleanups with no change in timer or protocol
behaviour.
Reads OK florian@
Remove redundant evtimer_pending() check in tcpbench
event_del() has no effect when an event is not pending, so there is no
need to check its state before deleting the slice timer.
This is a mechanical cleanup with no change in timer behaviour.
Reads OK florian@
Remove redundant evtimer_pending() checks before evtimer_del()
event_del() has no effect when an event is not pending, so there is no
need to check its state before deleting an initialized timer.
This is a mechanical cleanup with no change in timer behaviour.
OK florian@
When unveil was used with a chroot environment it was possible for
unveil_find_cover to loop forever because it was missing a check for the
rootvnode. This would only happen if references existed to directories
outside the chroot, which correct chroot code must not do.
ok deraadt
