wg: fix the LINT-NOIP build
We don't have anything to tunnel without INET or INET6, so just smack
it with the same config(5) hammer that ovpn uses and exclude it from
such builds.
Reported by: mjg
Reviewed by: emaste, markj
Differential Revision: https://reviews.freebsd.org/D60896
pf: first-match-wins for nat rules, even in anchors
Ensure we stop evaluating nat rules if we find a match in a nat-anchor.
PR: 299320
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit b5219c068fbc133dde91d5cf48423e34ce27bd4f)
hastd: Use void pointers for opaque data
Use void, not char, for pointers to opaque data in our send and receive
functions.
Sponsored by: Klara, Inc.
Reviewed by: allanjude
Differential Revision: https://reviews.freebsd.org/D60729
auditdistd: Use void pointers for opaque data
Use void, not char, for pointers to opaque data in our send and receive
functions.
Sponsored by: Klara, Inc.
Sponsored by: Qualys, Inc.
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D60728
pf: Keep every chunk of a table that a ruleset defines
libpfctl sends a table definition in chunks of 256 addresses, each as
its own PFNL_CMD_INA_DEFINE. The kernel treated every chunk as a new
definition and replaced the shadow table, so only the last chunk
survived.
Mark the chunks after the first with PF_ID_APPEND and have the kernel
add them to the shadow table in progress. A request without the
attribute still replaces the shadow; one with it and no definition in
progress fails with EINVAL. Old kernels ignore the attribute, so both
halves are needed; the ioctl sends all addresses at once and is not
affected. Mask the flags userland passes to PFR_FLAG_ALLMASK, as
PFR_FLAG_APPEND is kernel-internal.
Add a test that defines a table of 1,000 addresses, also in an anchor.
Reviewed by: kp
Fixes: 219ce3063840 ("pf: convert DIOCRINADEFINE to netlink")
[2 lines not shown]
rk_spi: Do not change the clock with the driver lock held
The clock framework can sleep, it takes the clock topology sx lock. Calling
clk_set_freq() and clk_get_freq() from rk_spi_hw_setup() with the driver
mutex held triggers a witness warning about a sleepable lock acquired after
a non-sleepable one, on the first transfer that raises the clock.
Set the clock in a new function that is called before taking the lock, and
only keep the register setup under the lock.
libc: Add WCHAR_WIDTH in <wchar.h> as well
Define __WCHAR_WIDTH in sys/_types.h and derive WCHAR_WIDTH from
that, the same way as WCHAR_MIN and WCHAR_MAX, in both <wchar.h>
and <stdint.h> as per C23 §7.31.1 and §7.22.3.4, respectively.
Reviewed by: fuz
Approved by: fuz (mentor)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D59385
(cherry picked from commit 72ed6f9c9dc95124cd81158d1c4437484a1b951e)
libc: Remove incorrectly defined __STDC_VERSION_STDBOOL_H__
C23 does not define __STDC_VERSION_STDBOOL_H__ for <stdbool.h>.
Feature test macros of this form only apply to headers where the
standard explicitly mandates one.
Reviewed by: fuz
Approved by: fuz (mentor)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D59136
(cherry picked from commit 2712d1380fcd8dd61d043b2242f20767e8f2f347)
pf: check extension header length.
pf_walk_header6() advances the packet offset for each IPv6 extension
header. It was not checked that this does not exceed the packet
length if no next header was processed. When used with af-to rules,
this could trigger a panic: m_copydata: null mbuf.
from Acts1631; OK henning@ sashan@
MFC after: 1 week
Obtained from: OpenBSD, bluhm <bluhm at openbsd.org>, 6d56112588
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit ccb19b359aae4b7e7315ad61d33d9a35d85849d1)
pf: check AH header length.
pf_walk_header() advances the packet offset for each AH extension
header. It was not checked that this does not exceed the packet
length if no next header was processed. Fix it like in IPv6.
OK henning@ sashan@
MFC after: 1 week
Obtained from: OpenBSD, bluhm <bluhm at openbsd.org>, fcd4e5522e
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit b4d2c9835c0edfddd1d6742afa86d4873ccfad16)
Retire bogus predicts on case statements.
They are ignored by clang.
No functional changes (nor .o changes).
Sponsored by: Rubicon Communications, LLC ("Netgate")
OCI: Remove dead code
We don't need to pick a repository URL when all we're doing is enabling
one which was specified in /etc/pkg/.
Reviewed by: dch, imp
Fixes: c73ae6734899 ("release/tools: use same pkg settings ...")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60868
linux: implement sched_getattr()
This change adds the necessary glue to translate Linux scheduler policy
and priority from FreeBSD so this information is available to Linux
applications.
Please note that this change does not fill in the `.sched_nice` property: this
will be handled in a follow up commit (see bug 299617 for more details).
This unbreaks using the Linux version of Chromium on FreeBSD.
PR: 297468
Signed-off-by: Joao Bonifacio <joaoboni017 at gmail.com>
Pull Request: https://github.com/freebsd/freebsd-src/pull/2370
Reviewed by: olce
Differential Revision: https://reviews.freebsd.org/D60214
pflow: Destroy exporters on module unload
Since 83641335f96c only jail removal destroys exporters. Unloading
pflow with one left trips the assertion in vnet_pflowdetach() or,
without INVARIANTS, leaves pf calling into the freed module the next
time it removes a state that pflow exports.
Reviewed by: kp
Fixes: 83641335f96c ("pf: clean up pflow sockets on jail removal")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
pfctl: Report why a table definition failed
pfctl_ina_define() returns an error number instead of setting errno, but
both of its callers print errno. A table that failed to load was
reported as "cannot define table t: No error: 0", or with a stale errno,
both in the main ruleset (process_tabledef()) and in anchors
(pfctl_load_tables()).
Reviewed by: kp
Fixes: 219ce3063840 ("pf: convert DIOCRINADEFINE to netlink")
Sponsored by: Rubicon Communications, LLC ("Netgate")
networking.7: Scope netif to wlan0
I recently learned that you can restart just wlan0 instead of the entire
netif, which will save you when doing on-device networking like bhyve,
or activting wlan0 when it is booted parked via rc.conf's NOAUTO.
MFC after: 3 days
Reviewed by: bz, bcr
Discussed with: emaste
Differential Revision: https://reviews.freebsd.org/D59586
ossl.4: Canonicalize HARDWARE and add powerpc64
This driver now supports powerpc64, so add that to the list of supported
hardware. Further, rewrite that list into the canonical HARDWARE section
for inclusion in the FreeBSD 16.0 Hardware Release Note.
markj notes that it would be useful to list the CPU features required
for this driver to be usable on these platforms. ngie notes that this
would be good as a table.
Fixes: 5daf8ed625af ("Add GCM support on powerpc64/powerpc64le")
MFC after: the above was scheduled to but has not mfc yet
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D59770
pmc.perf.3: Mark only for amd64 architecture
Manual pages have an optional architecture specifier after the section
number in the document title macro. I highly recommend using it when
expedient, the extra information is available programmatically and it
uses no extra lines in the rendered page.
MFC after: No, pmc.perf.3 is not MFCing
Reviewed by: Anderson Nascimento <anascime at amd.com>
Differential Revision: https://reviews.freebsd.org/D60714
pfctl: Report the error of a failed fingerprint flush
pfctl_flush_fingerprints() returns an error number instead of setting
errno, so a failed flush was reported with whatever errno held: "No
error: 0" on a kernel with ALTQ, ENODEV from the ALTQ probe on one
without. Every "pfctl -f" flushes the fingerprints first, so on a
kernel that predates PFNL_CMD_OSFP_FLUSH every ruleset load fails this
way without saying why.
Reviewed by: kp
Fixes: 75c0a8376204 ("pf: convert DIOCOSFPFLUSH DIOCOSFPGET DIOCOSFPADD to netlink")
Sponsored by: Rubicon Communications, LLC ("Netgate")
bhyve: fix integer overflow in qXfer packet parser
doff + dlen overflows unsigned int when both values are close to UINT_MAX,
causing the wrong branch to execute and passing an unbounded length to
append_binary_data(). Rewrite the comparison to avoid the addition.
Reviewed by: markj
Fixes: f81cdf24ba54 ("bhyve: Add support for XML register definitions")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60847
