update the list of amdgpu files to build with sse
following the linux Makefiles it is amd/display/dc/dml*
and dcn401_soc_and_ip_translator.c
dml2_top_legacy.c is excluded as we don't build it
prompted by a shorter diff from daniel@
rsa_pmeth: also copy saltlen and min_saltlen for RSA-PSS
EVP_PKEY_CTX_dup() failed to copy saltlen and min_saltlen for RSA-PSS and
would therefore use the defaults for the copied context, losing intended
restrictions from the original.
From Frank Denis
get_crl_score: delta CRLs should not be used as full CRLs
The glorious OpenSSL invention called CRL score is backed by muppety code
that is an obvious bug magnet. If extended CRL support is enabled and the
delta CRL has onlySomeReasons, the logic that is supposed to reject delta
certs is not reached. Fix this by pulling it up.
Reported by Frank Denis and Acts1631.
ok kenjiro
Previous commit broke machdep.hibernatedelay. Fix this by recognizing
that we shouldn't overwrite the sleep_mode global when we jump to the
top label.
ok mlarkin@, hshoexer@
libcrypto: rename ec hp methods to include _hp_
The existence of two static functions with the same name, such as
ec_point_at_infinity() breaks my workflow strongly depending on
ctags. Rename the new ones to disambiguate jump targets.
ok jsing
Improve error when SHA256.sig is not found
In the ! DOWNLOAD path, LOCALSRC is a directory passed with -p,
this error happens if there is no SHA256.sig there, which is the
actionable error.
Rework the ls_missing function so that it does NOT download the entire tgz files
when looking for a potential update. It was supposed to be the current behavior
but a few changes years ago silently broke this.
acme-client: treat eab and eab_key as secrets
Wipe them with freezero after use and also make sure to delete possible
remnants of them on unbase64buf_url() failure.
reads fine to florian
ok jmatthew
test: prefix name with parent test
Add parent test's name as a prefix to subtests, in the format
"test-1/sub-test-1/sub-test-2".
This copies Go's format for subtest names, and makes it easier to track
where a test is running when using many nested subtests.
Also add input checks to ensure parent and name are not NULL for
subtests.
ok jsing
acme-client: zero optarg for external account binding
After copying the key-id:key pair, wipe the optarg so that this secret is
not visible to other users during the entire run time (in ps for example).
From Acts1631
reads fine to florian
ok jmatthew
printf(3/9): In the o conversion the # flag asks for a leading zero
Fix for Defect Report #151 in our libc.
https://www.open-std.org/jtc1/sc22/wg14/www/docs/dr_151.html
Original diff from Showta Ishizaki.
ok asou@
also looks correct to me deraadt@
Check signature of local SHA256.sig
We do this by improving the consistency of what we download vs the
file we trust for checksums and filenames.
This has the side effect of no longer writing and leaving an
unexpected SHA256 file with -F but does leave an invalid SHA256.sig
after error to be able to do diagnostics, as requested by sthen@.
While here, also tidy global variable setup for clarity.
Initially noticed by Acts1631 <acts1631kjv () proton ! me>
With much help and OK from dgl@
Correct botched size check in dtls1_preprocess_fragment().
Check message length against max, rather than fragment offset and length.
Due to a various questionable code, this allows for a crafted messsage
to be sent that results in a 21MB allocation, which then promptly results
in an error. Providing that the SSL context is cleared or freed, the
allocation then freed, meaning that this has minimal impact. A similar
fix was landed in OpenSSL in 48c054fec35, although this checks against
dtls1_max_handshake_message_len() rather than max.
Thanks to Abdullah Al Ishtiaq for flagging this.
ok kenjiro@ tb@
Work around smtiic(4) misbehavior to fix RTC setting & reboots
For some reason this i2c chip starts to misbehave after a few
hours/days, and when that happens setting the RTC or halting/rebooting
becomes impossible. Waiting a bit after enabling the device appears to
reliably fix this and alleviates the pain of handling remote machines
such as the riscv64.p ports cluster. There is probably a better fix but
I'm not sure which one exactly.
ok kettenis@
Reduce size of DTLS queues for unprocessed records and application data.
DTLS currently buffers records that contain handshake messages and alerts,
which are in the next epoch and cannot yet be processsed. This is done by
saving the entire buffer that is 16KB in size, regardless of the actual
bytes sent on the wire. With a queue limit of 100 it is possible to send a
small number of bytes on the wire and have the server allocate 1.6MB -
reducing the limit to 16 reduces the allocation to 256KB. This queue will
soon be removed entirely.
DTLS also currently buffers record content from application data where the
handshake has not yet finished. This only buffers the actual content
received on the wire and does not suffer from the same problem, however
reduce the queue size to further limit memory consumption.
ok kenjiro@ tb@
