FreeBSD/src 8f378c8libexec/nuageinit nuageinit nuageinit.7, libexec/nuageinit/tests nuageinit.sh

nuageinit: support allow_public_ssh_keys

Skip importing datasource public keys when set to false.
DeltaFile
+41-0libexec/nuageinit/tests/nuageinit.sh
+10-0libexec/nuageinit/nuageinit.7
+4-2libexec/nuageinit/nuageinit
+55-23 files

FreeBSD/src cd06bf5libexec/nuageinit nuage.lua nuageinit.7, libexec/nuageinit/tests nuageinit.sh

nuageinit: accept lock_passwd for users

Alias cloud-init lock_passwd key alongside locked.
DeltaFile
+30-0libexec/nuageinit/tests/nuageinit.sh
+4-1libexec/nuageinit/nuageinit.7
+1-1libexec/nuageinit/nuage.lua
+35-23 files

FreeBSD/src 8d4d5f2libexec/nuageinit nuageinit, libexec/nuageinit/tests nuageinit.sh

nuageinit: fix ssh_pwauth string handling

Treat "no"/"unchanged" correctly instead of any non-nil value as yes.
DeltaFile
+19-3libexec/nuageinit/nuageinit
+18-0libexec/nuageinit/tests/nuageinit.sh
+37-32 files

FreeBSD/src 8ec1089libexec/nuageinit nuage.lua nuageinit.7, libexec/nuageinit/tests nuageinit.sh

nuageinit: adopt cloud-init disable_root semantics

disable_root now restricts root's authorized_keys instead of setting
PermitRootLogin.

Reported by:    np@
DeltaFile
+29-11libexec/nuageinit/nuageinit
+22-13libexec/nuageinit/nuageinit.7
+16-15libexec/nuageinit/tests/nuageinit.sh
+6-2libexec/nuageinit/nuage.lua
+73-414 files

FreeBSD/src 0484b6asys/fs/autofs autofs_vfsops.c

autofs: try to avoid waiting for timeouts of in-flight requests for forced unmounts

(cherry picked from commit d3c3a705b5e6689798057b764713bfc0e3b69f6a)
DeltaFile
+28-0sys/fs/autofs/autofs_vfsops.c
+28-01 files

FreeBSD/src e84f155sys/fs/autofs autofs_vnops.c

autofs_lookup(): busy the mount point around autofs_trigger()

PR:     294361

(cherry picked from commit b95a859483f1ac0671bde55c0a2fc46f4db5ba4b)
DeltaFile
+11-4sys/fs/autofs/autofs_vnops.c
+11-41 files

FreeBSD/src 9720746usr.bin/calendar/calendars calendar.freebsd

calendars: Add entry for kfv

Reviewed by:    dteske, fuz
Approved by:    dteske (mentor), fuz (mentor)
Differential Revision: https://reviews.freebsd.org/D58700
DeltaFile
+1-0usr.bin/calendar/calendars/calendar.freebsd
+1-01 files

FreeBSD/src 56ce613. .mailmap

mailmap: Add entry for kfv

Reviewed by:    dteske, fuz
Approved by:    dteske (mentor), fuz (mentor)
Differential Revision: https://reviews.freebsd.org/D58700
DeltaFile
+1-0.mailmap
+1-01 files

FreeBSD/src 6ca41d4share/misc committers-src.dot

committers-src: Add new src committer (kfv)

Reviewed by:    dteske, fuz
Approved by:    dteske (mentor), fuz (mentor)
Differential Revision: https://reviews.freebsd.org/D58700
DeltaFile
+5-0share/misc/committers-src.dot
+5-01 files

FreeBSD/src 71ac7ffsys/netpfil/pf pf_if.c, tests/sys/netpfil/pf names.sh

pf: attempt to handle overlapping group and interface names

pf assumes that network groups and network interfaces share a namespace
(that is, a name is unused, a group or an interface, never both a the
same time). Unfortunately this assumption was broken when interface
renaming was introduced.
Attempt to cope with this rather than panicking. Note that this is a
band-aid, not a full solution. The correct fix is for the network stack
to go back to enforcing a single namespace for groups and interfaces.

PR:             297220
Reported by:    Robert Morris
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

(cherry picked from commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d)
DeltaFile
+23-0tests/sys/netpfil/pf/names.sh
+13-6sys/netpfil/pf/pf_if.c
+36-62 files

FreeBSD/src 82255aesys/netpfil/pf pf_if.c

pf: check if a group has a kif before dereferencing it

It's possible for interface groups to not have had a pfi_kkif assigned to
them, so before we pass that pointer to pfi_kkif_update() we must check if it's
actually set.

We've seen panics such as this, where we get an address update for an interface
that belongs to a group without associated pfi_kkif:

        Tracing pid 12 tid 100034 td 0xfffff80100d2a000
        kdb_enter() at kdb_enter+0x33/frame 0xfffffe0067eed340
        panic() at panic+0x43/frame 0xfffffe0067eed3a0
        trap_pfault() at trap_pfault+0x3c9/frame 0xfffffe0067eed3f0
        calltrap() at calltrap+0x8/frame 0xfffffe0067eed3f0
        --- trap 0xc, rip = 0xffffffff8102ebd5, rsp = 0xfffffe0067eed4c0, rbp = 0xfffffe0067eed500 ---
        pfi_kkif_update() at pfi_kkif_update+0x15/frame 0xfffffe0067eed500
        pfi_kkif_update() at pfi_kkif_update+0x1fc/frame 0xfffffe0067eed550
        pfi_ifaddr_event() at pfi_ifaddr_event+0x82/frame 0xfffffe0067eed5a0
        srcaddr_change_event() at srcaddr_change_event+0xa7/frame 0xfffffe0067eed610

    [20 lines not shown]
DeltaFile
+4-2sys/netpfil/pf/pf_if.c
+4-21 files

FreeBSD/src 80d732dsys/netpfil/pf pf_if.c, tests/sys/netpfil/pf names.sh

pf: attempt to handle overlapping group and interface names

pf assumes that network groups and network interfaces share a namespace
(that is, a name is unused, a group or an interface, never both a the
same time). Unfortunately this assumption was broken when interface
renaming was introduced.
Attempt to cope with this rather than panicking. Note that this is a
band-aid, not a full solution. The correct fix is for the network stack
to go back to enforcing a single namespace for groups and interfaces.

PR:             297220
Reported by:    Robert Morris
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

(cherry picked from commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d)
DeltaFile
+23-0tests/sys/netpfil/pf/names.sh
+13-6sys/netpfil/pf/pf_if.c
+36-62 files

FreeBSD/src e4e4d1bsys/netpfil/pf pf_if.c

pf: check if a group has a kif before dereferencing it

It's possible for interface groups to not have had a pfi_kkif assigned to
them, so before we pass that pointer to pfi_kkif_update() we must check if it's
actually set.

We've seen panics such as this, where we get an address update for an interface
that belongs to a group without associated pfi_kkif:

        Tracing pid 12 tid 100034 td 0xfffff80100d2a000
        kdb_enter() at kdb_enter+0x33/frame 0xfffffe0067eed340
        panic() at panic+0x43/frame 0xfffffe0067eed3a0
        trap_pfault() at trap_pfault+0x3c9/frame 0xfffffe0067eed3f0
        calltrap() at calltrap+0x8/frame 0xfffffe0067eed3f0
        --- trap 0xc, rip = 0xffffffff8102ebd5, rsp = 0xfffffe0067eed4c0, rbp = 0xfffffe0067eed500 ---
        pfi_kkif_update() at pfi_kkif_update+0x15/frame 0xfffffe0067eed500
        pfi_kkif_update() at pfi_kkif_update+0x1fc/frame 0xfffffe0067eed550
        pfi_ifaddr_event() at pfi_ifaddr_event+0x82/frame 0xfffffe0067eed5a0
        srcaddr_change_event() at srcaddr_change_event+0xa7/frame 0xfffffe0067eed610

    [20 lines not shown]
DeltaFile
+4-2sys/netpfil/pf/pf_if.c
+4-21 files

FreeBSD/src c64d42csbin/ipfw ipfw2.h main.c

ipfw: rework 32-bit KBI detection

When we run 14.X jail on 15.X host system previous implementation could
not correctly detect 32-bit KBI due to jails can overwrite osreldate.

Add special handling for this case and use detection using
IP_FW_DUMP_SOPTCODES and IP_FW_XGET sockopts version.

Reported by:    Vova Grebenschikov
Fixes:  704ec5e68c44
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D56616
DeltaFile
+102-0sbin/ipfw/ipfw2.c
+7-7sbin/ipfw/main.c
+1-0sbin/ipfw/ipfw2.h
+110-73 files

FreeBSD/src 71e72c9contrib/wpa/src/ap ieee802_11.c, contrib/wpa/src/common proximity_ranging.c qca-vendor.h

wpa: Update to 2.12

Fixes and new features include:

hostapd:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* EHT/IEEE 802.11be/Wi-Fi 7
  - more complete support
  - fix message validation issues that could enable DoS attacks
  - fix group key rekeying
* enable SAE group 20 by default if SAE-EXT-KEY is enabled
* reject unexpected SAE password identifier to avoid DoS attack against
  a specific STA
* mandate use of SAE H2E when using password identifiers
* assign VLAN when using SAE with PMKSA caching
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
  - changing SAE password identifiers
  - EPPKE

    [50 lines not shown]
DeltaFile
+6,124-33contrib/wpa/src/common/qca-vendor.h
+5,003-0contrib/wpa/wpa_supplicant/nan_supplicant.c
+3,381-671contrib/wpa/src/drivers/driver_nl80211.c
+3,106-664contrib/wpa/src/ap/ieee802_11.c
+3,677-0contrib/wpa/src/nan/nan.c
+2,707-0contrib/wpa/src/common/proximity_ranging.c
+23,998-1,368330 files not shown
+89,793-24,630336 files

FreeBSD/src c66a923release Makefile.gce

release/Makefile.gce: migrate gsutil usages to gcloud CLI

Google Cloud recommends migrating from gsutil to gcloud storage CLI.
Update gce-do-upload target to use `gcloud storage buckets create` and
`gcloud storage cp` instead of `gsutil mb` and `gsutil cp` commands.

PR:             conf/297016

(cherry picked from commit 4174cc2f69d36105a735b19fadc9c18497b02b1a)
DeltaFile
+2-2release/Makefile.gce
+2-21 files

FreeBSD/src 164a5a0release Makefile.gce

release/Makefile.gce: migrate gsutil usages to gcloud CLI

Google Cloud recommends migrating from gsutil to gcloud storage CLI.
Update gce-do-upload target to use `gcloud storage buckets create` and
`gcloud storage cp` instead of `gsutil mb` and `gsutil cp` commands.

PR:             conf/297016

(cherry picked from commit 4174cc2f69d36105a735b19fadc9c18497b02b1a)
DeltaFile
+2-2release/Makefile.gce
+2-21 files

FreeBSD/src 135df77sys/dev/usb/controller xhci.c

usb: xhci: allow up to 1s for SET_ADDRESS

Some devices take a little longer, and the spec doesn't really seem to
mandate a maximum.  The common path in usbd_req_set_address() has
already been bumped to 1s and I have a headset (Logitech H390) that does
need a little bit longer, so let's match it in xhci.

Reviewed by:    aokblast
Differential Revision:  https://reviews.freebsd.org/D58717
DeltaFile
+1-1sys/dev/usb/controller/xhci.c
+1-11 files

FreeBSD/src 207d96dcontrib/expat Changes, contrib/expat/doc reference.html

contrib/expat: import expat 2.8.3

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes

Security:       CVE-2026-72522
MFC after:      1 week
DeltaFile
+77-20contrib/expat/Changes
+49-25contrib/expat/lib/xmlparse.c
+70-1contrib/expat/tests/misc_tests.c
+32-1contrib/expat/tests/basic_tests.c
+29-1contrib/expat/doc/reference.html
+5-12contrib/expat/lib/internal.h
+262-6082 files not shown
+455-8288 files

FreeBSD/src ef5aa86. Changes, doc reference.html

Vendor import of expat 2.8.3
DeltaFile
+77-20Changes
+49-25lib/xmlparse.c
+70-1tests/misc_tests.c
+32-1tests/basic_tests.c
+29-1doc/reference.html
+5-12lib/internal.h
+262-6080 files not shown
+450-7786 files

FreeBSD/src a6999a1lib/libifconfig libifconfig.c, sbin/ifconfig ifvfstatus.c

net: Revert the ioctl SR-IOV VF status interface

A native route Netlink interface will replace this stack.

Requested by:   glebius

This reverts commit 1ccf543b21eff6e0828142e5c1d09519247143f4.

This reverts commit 2c04cfa148ec4dd5cef7e228aaea6a05957fcb15.

This reverts commit 2d6114f6d26bf7dfa5ad94e1db9b09ee7108dc7a.

This reverts commit d15f2551b25f79ddcbe289faa95e655100b952da.

This reverts commit ceb282bbd62eed5e84df9abaede0dd183f66997a.

This reverts commit c30021fe0df9e045a17292dbe50dfc054b69871f.

This reverts commit fb1820d23a04856a6d3047b4c088cc8df8f76da1.

    [2 lines not shown]
DeltaFile
+6-278sys/netlink/route/iface.c
+0-212sbin/ifconfig/ifvfstatus.c
+11-163sys/net/if.c
+0-129lib/libifconfig/libifconfig.c
+1-117share/man/man4/rtnetlink.4
+0-117tests/atf_python/sys/netlink/netlink_route.py
+18-1,01632 files not shown
+32-1,76538 files

FreeBSD/src d1eeae7sys/kern kern_linker.c

linker: rely on kick_init running at SI_ORDER_MIDDLE

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D58711
DeltaFile
+3-2sys/kern/kern_linker.c
+3-21 files

FreeBSD/src 413346fsys/dev/usb/serial usb_serial.h usb_serial.c

usb: use SYSINIT(9) order instead of using non-existing subsystem

Found with:             clang -Werror=assign-enum
Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D58710
DeltaFile
+2-2sys/dev/usb/serial/usb_serial.c
+1-1sys/dev/usb/serial/usb_serial.h
+3-32 files

FreeBSD/src e70e257tests/sys/netinet socket_afinet.c

tests/netinet/socket_afinet: multibind second socket can be different

Allows to add tests to the table where the second socket doesn't take
address from the first.  No functional change yet, all tests test the same
conditions.

Differential Revision:  https://reviews.freebsd.org/D58087
DeltaFile
+40-39tests/sys/netinet/socket_afinet.c
+40-391 files

FreeBSD/src 8f6d8a9tests/sys/netinet socket_afinet.c

tests/netinet/socket_afinet: unroll multibind test into a table

The test has 6 dimensions: address family, socket type, socket option on
the first socket, socket option on the second socket, is first socket
bound to specific address or wildcard and is the second socket priveleged
or not.  Before the change 3 dimensions are implemented as 3 nested for()
loops, 2 dimensions are implemented as repetitions in the test body and
one dimension as two actions in the innermost loop.

I'm about to add one more dimension: whether the second socket is bound to
a specific address or wildcard instead of using first socket's
getsockopt(2) result.  Also, there is a change under discussion that would
make SOCK_STREAM sockets behave different to SOCK_DGRAM.  That would break
result consistency in the dimensions of socket type.

We expect that consistency in the dimension of address families shall
never break, thus this one remains a for() loop.  The priveleged & non-
privileged bind(2) attempts also remain as two actions, but expected
results are in the table.  The rest of dimensions are unrolled into a

    [7 lines not shown]
DeltaFile
+165-108tests/sys/netinet/socket_afinet.c
+165-1081 files

FreeBSD/src 1dda8basys/netinet tcp_usrreq.c in_pcb.h, sys/netinet6 in6_pcb.h in6_pcb.c

inpcb: take a pcbinfo database out from single lock

Initialize all three hashes (exact, wild, load balance group) with a per-
bucket lock.  Nothing changes for the packet lookup KPI - it still uses
SMR section for thread safety.  But connect(2) and bind(2) operations gain
parallelism now.

The main concept is that as we lookup inpcb database for editing, we are
accumulating bucket locks necessary to accomplish the operation.  Once all
lookups are complete and we are good to go, the inpcb is inserted (or
moved) and accumulated lock context is released.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D58131
DeltaFile
+429-303sys/netinet/in_pcb.c
+135-96sys/netinet6/in6_pcb.c
+83-9sys/netinet/in_pcb_var.h
+18-31sys/netinet/in_pcb.h
+12-4sys/netinet/tcp_usrreq.c
+0-6sys/netinet6/in6_pcb.h
+677-4496 files

FreeBSD/src 618dc48tests/sys/netinet socket_afinet.c

tests/netinet/socket_afinet: add more tests to multibind

Add tests where first socket and second socket are bound to different
addresses, e.g. first specific and second wildcard and vice versa.

Mark success with SO_REUSEPORT on the second socket as a bug suspect.

Mark failure to bind to INADDR_ANY in presence of other UID's specific
bound socket to the same port as probably too strict.

Differential Revision:  https://reviews.freebsd.org/D58088
DeltaFile
+12-0tests/sys/netinet/socket_afinet.c
+12-01 files

FreeBSD/src a6847basys/kern subr_taskqueue.c

taskqueue: Move wakeup() out of tq_mutex

taskqueue KPI require wakeup() to be called for each completed
task.  With everything else there heavily optimized over the years,
even when doing nothing this wakeup()'s lock/unlock is significant.
Since no external taskqueue consumer can depend on the tq_mutex,
we can move the wakeup() out of it.  It creates some complications
for internal waiters, but those should be much more rare, and can
be handled with separate locked wakeups on demand.

My tests of taskqueue-intensive ZFS RAIDZ writes on 64-core system
show performance improvement from this change ~4%, while same time
reducing CPU usage by several percent due to lower lock contention,
confirmed by CPU profiler.
DeltaFile
+27-4sys/kern/subr_taskqueue.c
+27-41 files

FreeBSD/src c8f3863. ObsoleteFiles.inc, tests/sys/netinet6/frag6 Makefile frag6_01.py

tests/netinet6: remove test that uses Jumbo Payload Option

This test was already marked as always skipped.

Fixes:  069a67374ed9641ff1ada2aecaac1cc61a560649
Reviewed by:            pouria
Differential Revision:  https://reviews.freebsd.org/D58114
DeltaFile
+0-232tests/sys/netinet6/frag6/frag6_01.sh
+0-116tests/sys/netinet6/frag6/frag6_01.py
+4-0ObsoleteFiles.inc
+0-3tests/sys/netinet6/frag6/Makefile
+4-3514 files

FreeBSD/src 0053a4bsys/netinet tcp_var.h

tcp: fix TF_BITS

Add missing TF_DISCONNECTED bit.

Reported by:    Hannes Elfert
Fixes:          40dbb06fa73c ("inpcb: retire INP_DROPPED and in_pcbdrop()")
DeltaFile
+1-1sys/netinet/tcp_var.h
+1-11 files