net/igmpproxy: Fix igmpproxy_conf rc.d knob, document user and chroot
- The rc.d script documented igmpproxy_conf but read igmpproxy_config,
and required_files always pointed to the default path. Honor
igmpproxy_conf, keeping igmpproxy_config as a fallback so existing
setups do not break, and check the file actually in use.
- Add commented user and chroot examples to the sample configuration.
They allow igmpproxy to drop privileges once sysutils/mac_igmpproxy
is loaded.
Sponsored by: Rubicon Communications, LLC ("Netgate")
sysutils/mac_igmpproxy: New port, MAC policy for net/igmpproxy
A MAC framework policy that grants the multicast routing privilege to
a single configurable UID, so net/igmpproxy can drop root and run as
the new igmpproxy user (UID/GID 422). The policy can be tuned or
disabled with the security.mac.igmpproxy.uid and
security.mac.igmpproxy.enabled sysctls.
PR: 291647
net/dhcpdump: Update to 2.00 and switch to the active fork
The original dhcpdump 1.8 has not been maintained for many years. Move
to the dhcpdump-org fork, which Debian and Fedora already ship.
Changes since 1.8 include VLAN (802.1Q/802.1ad) support, reading from
pcap files, an option to dump the whole packet in hex, option 82/121/
249/93/94/116 decoding, updated IANA option names and several fixes for
out-of-bounds reads on crafted packets.
Add a TUI option, enabled by default, for the new interactive session
tracking interface (-t). It depends on devel/yascreen.
PR: 297349
Reported by: diizzy
Sponsored by: Rubicon Communications, LLC ("Netgate")
devel/yascreen: New port, curses replacement library
yascreen is a small curses replacement library for daemons and embedded
applications. It has no external dependencies, supports internal and
external event loops, can work over stdin/stdout or a socket (including
basic telnet sequences) and handles Unicode.
It is needed by the interactive TUI of net/dhcpdump 2.x.
Sponsored by: Rubicon Communications, LLC ("Netgate")
emulators/open-vm-tools: Use fixed name and rcvar in vmware-kmod
vmware-kmod handles two kernel modules by setting name and rcvar from
$kernel_mod and calling run_rc_command twice. Tools that read rcvar
without running the script, such as service -e, see the unexpanded
variable and check the nonexistent $vmware_guest__enable, warning on
every host where the package is installed.
Give the script a fixed name (vmware_guest_kmod) and rcvar
(vmware_guest_kmod_enable), and have start and status loop over the
modules, each honoring its own knob. The script name and rc.conf
knobs are unchanged: vmware_guest_kmod_enable (default YES) still
supplies the defaults for vmware_guest_vmmemctl_enable and
vmware_guest_vmblock_enable, either of which can still be enabled on
its own, and rc.conf.d files for the per-module names are still read.
PR: 300431
Sponsored by: Rubicon Communications, LLC ("Netgate")
security/sudo: Put base system directories first in secure_path
The default sudoers file installed by the port has an active
secure_path line inherited from upstream's configure.ac, which lists
/usr/local/sbin and /usr/local/bin before the base system directories.
That is a Linux convention. On FreeBSD, LOCALBASE belongs to
ports/packages and the base system comes first everywhere else, so a
binary under /usr/local/bin could shadow a base utility when run
through sudo.
Set --with-secure-path-value so the default sudoers uses
/sbin:/bin:/usr/sbin:/usr/bin:${LOCALBASE}/sbin:${LOCALBASE}/bin.
Existing installations that edited /usr/local/etc/sudoers are not
affected.
PR: 299746
Sponsored by: Rubicon Communications, LLC ("Netgate")
security/sudo: Add LOGSRVD option and rc.d script for sudo_logsrvd
- Add a LOGSRVD option, enabled by default so current users see no
change, to build sudo_logsrvd and sudo_sendlog. When disabled the
server, its sample configuration, rc script and man pages are not
installed (--disable-log-server).
- Install an rc.d script for sudo_logsrvd. It is disabled by default,
enable it with sudo_logsrvd_enable=YES.
- Fix the SSL option description. It does not affect sudo itself, only
TLS for sudo_logsrvd and I/O log transfer.
PR: 287631
Reported by: Anton Saietskii <vsasjason at gmail.com>
Sponsored by: Rubicon Communications, LLC ("Netgate")
mail/dma: Update to upstream master (f4e1d913)
The port pinned GH_TAGNAME to a commit that predates the v0.14 tag, so
the package lacked VERIFYCERT and SNI support in TLS. Pin the current
upstream master instead, which contains v0.14 plus following changes:
- LMTP: support relaying to an LMTP endpoint
- AUTH PLAIN support, with clearer syslog output when the server
offers no usable auth mechanism
- HELO fallback when the server rejects EHLO
- Accept "|" as separator between smarthost and password
- Terminate each local mbox message with an empty line (RFC 4155)
- Discard bounce queue items when handling a double bounce
- Cast ctype arguments to unsigned char
- Disambiguate two identical error messages (issue #139)
- Fix building bsd/ after "make obj"; dma.8 and SPDX updates
PR: 299680
Co-Authored by: Philip Dodd <orange.spyderman at gmail.com>
Sponsored by: Rubicon Communications, LLC ("Netgate")
www/worldmonitor: Add New Port
World Monitor is a dashboard that brings together news and geopolitical,
infrastructure and market data on one page. The port installs the
self-hosted web application with its Redis REST proxy, relay and seed
services.
WWW: https://github.com/koala73/worldmonitor
Sponsored by: Netzkommune GmbH
[lld-macho] Don't write chained fixups through misaligned pointers (#238485)
`DYLD_CHAINED_PTR_64` fixups only need to be 4-byte aligned, but later
patched their `next` fields, through pointers to
`dyld_chained_ptr_64_rebase` and `dyld_chained_ptr_64_bind`, which need
8-byte alignment. UBSan has flagged this since #234006 added a
4-byte-aligned fixup to chained-fixups-alignment.s.
Now we build them in locals and memcpy them in and out. arm64e fixups
have to be 8-byte aligned, so those writes are fine as they are. The
test now also has a bind and a `next` field at 4 mod 8, and checks that
the chain still decodes.
Fixes the sanitizer-x86_64-linux-fast failure after #234006:
https://lab.llvm.org/buildbot/#/builders/169/builds/28168
Assisted-by: Claude
Reapply "[SelectionDAG] Narrow (shr (sub A, B), 1) to AVGSUBFLOOR" (#238249) (#238408)
Needed to regenerate 2 tests to remove pzext.h.b.
Original message:
Add combineShiftToAVGSUB, which forms AVGSUBFLOORS/AVGSUBFLOORU on a
narrower type when both operands are known to be extended from it, so
the subtract can't overflow. This is similar to combineShiftToAVG.
The node is only formed if it is legal or custom on the narrow type or
the original type after type legalization. As long as type legalization
won't change the element type. This covers WidenVector, SplitVector and
ScalarizeVector. This can be relaxed in the future.
Remove the RISC-V P extension truncate combine for (P)ASUB(U) since this
is now handled by the generic combine.
[libc] Make ldexpf128/scalbnf128/scalblnf128 use emulated Float128 (#220295)
This makes the three exponent scaling functions ldexpf128, scalbnf128
and scalblnf128 work with the emulated Float128 type, so they can be
used on platforms without native __float128.
Fixes #219759 (part of #216576).
[GlobalISel] Auto-commute combine patterns
Emit both operand orders for constrained commutative generic match
patterns, including each use of a PatFrag. Skip redundant permutations
and enforce MaxPermutations before allocating expanded alternatives.
Give each permutation its own operand expansions so operand indices
cannot leak between alternatives.
Keep commuted immediate patterns available with constant-to-RHS
canonicalization, and consolidate AMDGPU carry rules while preserving
zero-addend and RHS-first matching.
Make the integer and AMDGPU multiply/select helpers accept either operand
order.
Add emitter documentation and TableGen, MIR, and codegen regressions.
[MLIR][ROCDL] Note the deprecation of the <4 x i32> buffer ops
While we don't have a way to flag a MLIR op as deprecated yet, go
ahead and add a note to the old `<4 x i32>` intriinsic ops that
they're actively deprecated.
AI disclosure: Claude made this edit, though I checked the wording and
wrote up this message.
Co-Authored-By: Claude Opus 5 (1M context) <noreply at anthropic.com>
[AMDGPU][docs] Document the <4 x i32> buffer intrinsic deprecation (#231302)
Flag the deprecation of <4 x i32> buffer intrinsics in the release
notes, flagging the migration path and the s.buffer.load subtleties.
AI disclosure: Claude did draft some of this, but I deleted basically
all of it and the words are mine.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply at anthropic.com>
[AMDGPU][NFC] Clean up pre-gfx125x test RUN lines
Drop flags that match defaults: -verify-machineinstrs in .ll tests,
-global-isel=0 in tests without a GlobalISel run, and redundant
-global-isel-abort. Use subarch triples instead of amdgcn plus -mcpu.
Error-only MC runs use -filetype=null.
Change-Id: Ic8e2469780e32dbe204a032fcf9d91a1e8b737d2
Co-Authored-By: Claude Opus 5.5 <noreply at anthropic.com>
[AMDGPU][NFC] Clean up gfx125x test RUN lines (#238105)
Drop flags that match defaults: `-verify-machineinstrs` in `.ll` tests,
`-global-isel=0` in tests without a GlobalISel run, and redundant
`-global-isel-abort`.
Use subarch triples instead of amdgcn plus `-mcpu`.
Error-only MC runs use `-filetype=null`.
[Clang][SYCL] Reject an NVIDIA offload target for SYCL (#229937)
Reject an NVIDIA offload target for SYCL.
Previously, `clang++ -fsycl --offload-arch=sm_80`, or
`--offload-targets=nvptx64-nvidia-cuda`, hit an assertion in the CUDA
toolchain, which supports only CUDA and OpenMP. Clang does not support
SYCL offloading to NVIDIA GPUs without `-foffload-via-llvm`, so the
driver now reports "invalid or unsupported offload target" instead. With
`-foffload-via-llvm`, SYCL offloading to an NVIDIA GPU is unchanged.
[AMDGPU] Add cluster size tests for full multicast load masks (NFC)
Add tests for a cluster load with a full workgroup mask in functions with
no cluster, a fixed cluster of 8 or 16 workgroups, and a cluster size only
known at run time. The checks show the current lowering, which clamps the
mask in all of them.
[AMDGPU] Treat a bitcast between legal types as free
The generic cost model treats a bitcast as free only when both types
are integer types or both are not. AMDGPU keeps integer and
floating-point values in the same registers, so a bitcast between two
legal types is a no-op. A scalar bitcast from i32 to float cost 1, but
the vector bitcast from <2 x i32> to <2 x float> cost 0. The SLP
vectorizer counted this difference as a saving.
A bitcast that involves a type the target legalizes, such as a vector
of i8, keeps its cost, because the lanes may need repacking.
Assisted-by: Claude Opus
[SystemZ][z/OS] Unconditionally use DynamicNoPIC relocation model (#238087)
On z/OS, generated code is always position-independent, so -fpic and
-fno-pic have no effect. Previously, getEffectiveRelocModel() returned
the requested relocation model if one was provided. When -fpic was
passed, TargetMachine:: isPositionIndependent() returned true, enabling
optimizations such as relative lookup tables that generate 32-bit
relative offsets between globals. These are incompatible with the GOFF
binder's requirement for 8-byte relocations in C_WSA64.
This change forces getEffectiveRelocModel() to always return
Reloc::DynamicNoPIC on z/OS, regardless of what the frontend requests.
Assisted-by: IBM Bob
[AMDGPU][NFC] Add bitcast cost tests for legalized types and pointers
Add bitcasts that involve types the target legalizes, such as vectors
of i8, i24 and <2 x i24>, and bitcasts of pointers. Add a gfx7 RUN
line, where i16 and <2 x i16> are not legal.
Assisted-by: Claude Opus
