HardenedBSD/src 388641d. RELNOTES, sys/dev/hyperv/netvsc if_hn.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+5-3sys/dev/hyperv/netvsc/if_hn.c
+4-0RELNOTES
+9-32 files

HardenedBSD/src 35df47b. RELNOTES, sys/dev/hyperv/netvsc if_hn.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+5-3sys/dev/hyperv/netvsc/if_hn.c
+4-0RELNOTES
+9-32 files

HardenedBSD/src a5ada0acontrib/blocklist FreeBSD-upgrade freebsd-changes.sh, contrib/blocklist/bin blocklistd.c blacklistd.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+97-0contrib/blocklist/FreeBSD-upgrade
+17-13contrib/blocklist/bin/blocklistd.c
+17-13contrib/blocklist/bin/blacklistd.c
+18-0contrib/blocklist/freebsd-changes.sh
+149-264 files

HardenedBSD/src 44f6566sys/dev/hyperv/netvsc if_hn.c

Hyper-V: hn: just call vf's ioctl when changing mtu

When changing mtu, if a vf is attached to the netvsc interface, just
calling its ioctl to change vf's mtu is good enough.

Tested by:      whu
MFC after:      3 days
Sponsored by:   Microsoft
DeltaFile
+5-3sys/dev/hyperv/netvsc/if_hn.c
+5-31 files

HardenedBSD/src b94e4c7. RELNOTES

RELNOTES: Add an entry for 8e3fd450cc53 and friends
DeltaFile
+4-0RELNOTES
+4-01 files

HardenedBSD/src 6edb101contrib/blocklist/bin blacklistd.c

blocklist: blacklist: Chase recent upstream changes

Upstream fixed a couple of bugs:

1. Only attempt to restore the blocking rules if the database file
   exists.  Otherwise, when the service starts for the first time, it
   fails (PR 258411).

2. Revert a commit that removed a call to close(bi->bi_fd), preventing
   the descriptor from being deleted.

PR:             258411
PR:             291680
MFC after:      1 week

(cherry picked from commit 9c844b6110b3768a4fc3ce47cd9d1b30915213ec)
DeltaFile
+17-13contrib/blocklist/bin/blacklistd.c
+17-131 files

HardenedBSD/src 7492932contrib/blocklist/bin blocklistd.c

MFV: Import blocklist 2025-12-15 (8a4b011)

Merge commit 'bfef098f924950a085927b1e7dd6c6db4e651c5c'

Changes:

https://github.com/zoulasc/blocklist/compare/ff13526...8a4b011

PR:             258411
PR:             291680
MFC after:      1 week

(cherry picked from commit 52395203f9ac40d321ed55d93e9887300261d3bf)
DeltaFile
+17-13contrib/blocklist/bin/blocklistd.c
+17-131 files

HardenedBSD/src 4fe8aa4contrib/blocklist FreeBSD-upgrade freebsd-changes.sh

blocklist: Add vendor import instructions

Add vendor import instructions for blocklist.

It includes a "freebsd-changes.sh" script that takes care of adapting
paths and functions into FreeBSD.

Reviewed by:    emaste
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D49510

(cherry picked from commit 715cc257137099e022c7eecea4cd6995bb7604a3)
DeltaFile
+97-0contrib/blocklist/FreeBSD-upgrade
+18-0contrib/blocklist/freebsd-changes.sh
+115-02 files

HardenedBSD/src f1e5376. UPDATING, sys/fs/nfs nfs_commonsubs.c nfsproto.h

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+22-29sys/fs/nfs/nfs_commonsubs.c
+18-14sys/fs/nfsclient/nfs_clrpcops.c
+14-14sys/fs/nfsserver/nfs_nfsdport.c
+13-3sys/fs/nfs/nfsproto.h
+5-5sys/fs/nfs/nfs_var.h
+5-0UPDATING
+77-656 files not shown
+84-7112 files

HardenedBSD/src abd57d4. UPDATING, sys/fs/nfs nfs_commonsubs.c nfsproto.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+22-29sys/fs/nfs/nfs_commonsubs.c
+18-14sys/fs/nfsclient/nfs_clrpcops.c
+14-14sys/fs/nfsserver/nfs_nfsdport.c
+13-3sys/fs/nfs/nfsproto.h
+5-5sys/fs/nfs/nfs_var.h
+5-0UPDATING
+77-656 files not shown
+84-7112 files

HardenedBSD/src 60eb371. UPDATING

UPDATING: Add an entry for commit 9f49f436a9ec
DeltaFile
+5-0UPDATING
+5-01 files

HardenedBSD/src e35191csys/fs/nfs nfsproto.h

nfs: Add some support for POSIX draft ACLs

An internet draft (expected to become an RFC someday)
https://datatracker.ietf.org/doc/draft-ietf-nfsv4-posix-acls
describes an extension to NFSv4.2 to handle POSIX draft ACLs.

This is the final patch in the series that enables
the extension of NFSv4.2 to support POSIX draft ACLs.
At this time, only UFS mounted with the "acls" option
will work, and only for FreeBSD built with these patches.
Patches for client and server for the Linux kernel are
in the works.  (I'll admit my next little project is
cleaning the Linux patches up for submission for upstream.)

To make these changes really useful, the FreeBSD port
of OpenZFS needs to be patched to add POSIX draft ACL
support.  (Support for POSIX draft ACLs is already in
the Linux port of OpenZFS.)


    [4 lines not shown]
DeltaFile
+13-3sys/fs/nfs/nfsproto.h
+13-31 files

HardenedBSD/src 9f49f43sys/fs/nfs nfs_commonsubs.c nfs_var.h, sys/fs/nfsclient nfs_clrpcops.c

nfs: Add some support for POSIX draft ACLs

An internet draft (expected to become an RFC someday)
https://datatracker.ietf.org/doc/draft-ietf-nfsv4-posix-acls
describes an extension to NFSv4.2 to handle POSIX draft ACLs.

This is the fifth of several patches that implement the
above draft.

This one mostly adds an extra argument to two functions
in nfscommon.ko.  Unfortunately, these functions are
called in many places, so the changes are numerous, but
straightforward.

Since the internal KAPI between the NFS modules is changed
by this commit, all of nfscommon.ko, nfscl.ko and nfsd.ko
must be rebuilt from sources.

There should be no semantics change for the series at

    [3 lines not shown]
DeltaFile
+22-29sys/fs/nfs/nfs_commonsubs.c
+18-14sys/fs/nfsclient/nfs_clrpcops.c
+14-14sys/fs/nfsserver/nfs_nfsdport.c
+5-5sys/fs/nfs/nfs_var.h
+2-2sys/fs/nfsserver/nfs_nfsdserv.c
+1-1sys/fs/nfsserver/nfs_nfsdstate.c
+62-653 files not shown
+65-689 files

HardenedBSD/src 1b1fb62sys/dev/usb/quirk usb_quirk.c

Quirk Realtek RTL8153 to config#1 so if_cdce claims it.  Works much better.
DeltaFile
+1-0sys/dev/usb/quirk/usb_quirk.c
+1-01 files

HardenedBSD/src e4bd7c1sys/kern vfs_inotify.c, sys/netpfil/pf pf.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+38-2tests/sys/netpfil/pf/divert-to.sh
+31-0tests/sys/kern/inotify_test.c
+6-4sys/netpfil/pf/pf.c
+1-7tests/sys/netpfil/pf/icmp.py
+2-5sys/kern/vfs_inotify.c
+1-6tests/sys/netpfil/pf/nat66.py
+79-244 files not shown
+93-2910 files

HardenedBSD/src 5f003ccsys/kern vfs_inotify.c, sys/netpfil/pf pf.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+38-2tests/sys/netpfil/pf/divert-to.sh
+31-0tests/sys/kern/inotify_test.c
+6-4sys/netpfil/pf/pf.c
+1-7tests/sys/netpfil/pf/icmp.py
+2-5sys/kern/vfs_inotify.c
+1-6tests/sys/netpfil/pf/nat66.py
+79-244 files not shown
+93-2910 files

HardenedBSD/src f51e9d0tests/sys/fs/fusefs mockfs.cc

fusefs: Fix further intermittency in the BadServer.ShortWrite test case

After being unmounted, the mockfs server would occasionally read from
/dev/fuse again, if the main function didn't exit fast enough, getting
an ENODEV error.  Handle that appropriately.

Reported by:    Siva Mahadevan <me at svmhdvn.name>
Fixes:          d86025c1d49c84c4dc8c3635c83c078ad56e5a53
MFC after:      1 week
Reviewed by:    Siva Mahadevan <me at svmhdvn.name>
Differential Revision: https://reviews.freebsd.org/D54331
DeltaFile
+5-1tests/sys/fs/fusefs/mockfs.cc
+5-11 files

HardenedBSD/src 4f35a84tests/atf_python/sys/net vnet.py, tests/sys/netpfil/pf icmp.py nat66.py

atf_python: support setting interface mtu

Teach the vnet support code to set interface MTU. Some tests make use of
this, so have the framework handle it.

Adapt a few pf tests to use this.

Reviewed by:    melifaro
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D54333
DeltaFile
+1-7tests/sys/netpfil/pf/icmp.py
+1-6tests/sys/netpfil/pf/nat66.py
+6-0tests/atf_python/sys/net/vnet.py
+1-2tests/sys/netpfil/pf/frag6.py
+9-154 files

HardenedBSD/src 3a4275acontrib/telnet/telnet commands.c

telnet: Remove usage of ALIGN

gcc doesn't like ALIGN() being applied to an array type.  Just use
__aligned instead.

Reported by:    Jenkins
Reviewed by:    brooks
Fixes:          80203a27e964 ("Add sys/_align.h replacing machine/_align.h")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54290
DeltaFile
+2-2contrib/telnet/telnet/commands.c
+2-21 files

HardenedBSD/src 15178d8sys/netpfil/pf pf.c, tests/sys/netpfil/pf divert-to.sh

pf: Fix state handling when ICMP packets are diverted

Commit 66f2f1c83247 ("pf: handle divert packets") missed a case that I
happened to hit while testing something.

Add a regression test for the ICMP case, based on the existing test.
Fix a buglet in the existing test (missing whitespace after "[").

Reviewed by:    kp
Sponsored by:   OPNsense
Sponsored by:   Klara, Inc.
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D54321
DeltaFile
+38-2tests/sys/netpfil/pf/divert-to.sh
+6-4sys/netpfil/pf/pf.c
+44-62 files

HardenedBSD/src da8ab13sys/kern vfs_inotify.c, tests/sys/kern inotify_test.c

inotify: Avoid resetting the cookie

The IN_MOVED_FROM and _TO events only apply to names in a watched
directory, never to a watched directory itself.  So, the cookie value
there is always zero, and in particular we should not reset the
caller-provided cookie value, as it may be used later.

Add a regression test.

Reported by:    arrowd
MFC after:      1 week
DeltaFile
+31-0tests/sys/kern/inotify_test.c
+2-5sys/kern/vfs_inotify.c
+33-52 files

HardenedBSD/src bb2c2a1lib/clang/libllvm Makefile, sys/net if_ipsec.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+13-4sys/netipsec/ipsec_input.c
+14-2sys/netipsec/xform_ipcomp.c
+14-2sys/netipsec/xform_ah.c
+10-2sys/net/if_ipsec.c
+11-0lib/clang/libllvm/Makefile
+8-2sys/netipsec/xform_esp.c
+70-123 files not shown
+80-159 files

HardenedBSD/src 69e7d70lib/clang/libllvm Makefile, sys/net if_ipsec.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+13-4sys/netipsec/ipsec_input.c
+14-2sys/netipsec/xform_ipcomp.c
+14-2sys/netipsec/xform_ah.c
+10-2sys/net/if_ipsec.c
+11-0lib/clang/libllvm/Makefile
+8-2sys/netipsec/xform_esp.c
+70-123 files not shown
+80-159 files

HardenedBSD/src 183513dsys/net if_ipsec.c, sys/netipsec ipsec_input.c xform_ah.c

sys/netipsec: ensure sah stability during input callback processing

Citing ae: this fixes some rare panics, that are reported in
derived projects: `panic: esp_input_cb: Unexpected address family'.

Reported by:    ae
Tested by:      ae, Daniel Dubnikov <ddaniel at nvidia.com>
Reviewed by:    ae, Ariel Ehrenberg <aehrenberg at nvidia.com> (previous version)
Sponsored by:   NVidia networking
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D54325
DeltaFile
+13-4sys/netipsec/ipsec_input.c
+14-2sys/netipsec/xform_ah.c
+14-2sys/netipsec/xform_ipcomp.c
+10-2sys/net/if_ipsec.c
+8-2sys/netipsec/xform_esp.c
+5-2sys/netipsec/ipsec.h
+64-141 files not shown
+68-157 files

HardenedBSD/src 3b11262lib/clang/libllvm Makefile

Remove debug crutch I accidentally left in

Fixes:          cf1eaaf41cef
MFC after:      1 week
DeltaFile
+0-1lib/clang/libllvm/Makefile
+0-11 files

HardenedBSD/src cf1eaaflib/clang llvm.build.mk, lib/clang/libllvm Makefile

Reduce number of external symbols in libllvm, libclang and liblldb

In commit 2e47f35be5dc libllvm, libclang and liblldb were converted into
private shared libraries. This allowed clang, lld, lldb, and other llvm
tools to be linked against these shared libraries, which makes them
smaller and avoids duplication.

However, upstream builds the shared libraries using several visibility
options, which reduces the number of external symbols, and makes the
libraries a bit smaller.

On my test machine:
* libprivatellvm.so goes from 75643 to 34706 symbols (~54% reduction)
* libprivateclang.so goes from 53250 to 33531 symbols (~37% reduction)
* libprivatelldb.so goes from 27242 to 18798 symbols (~31% reduction)

Note: to get the full benefit, a clean build is required. Incremental
builds should still work, but I didn't want to force a full rebuild on
everybody.

    [2 lines not shown]
DeltaFile
+12-0lib/clang/libllvm/Makefile
+1-0lib/clang/llvm.build.mk
+13-02 files

HardenedBSD/src f8bbc20sys/fs/nfs nfs_commonsubs.c nfs_commonacl.c, sys/fs/nfsclient nfs_clrpcops.c nfs_clvnops.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+249-23sys/fs/nfs/nfs_commonsubs.c
+193-2sys/fs/nfs/nfs_commonacl.c
+64-77sys/netgraph/ng_ether.c
+53-16sys/fs/nfsclient/nfs_clrpcops.c
+45-15sys/fs/nfsclient/nfs_clvnops.c
+31-18sys/netpfil/ipfw/ip_fw_iface.c
+635-15114 files not shown
+784-25520 files

HardenedBSD/src 7b718ccsys/fs/nfs nfs_commonsubs.c nfs_commonacl.c, sys/fs/nfsclient nfs_clrpcops.c nfs_clvnops.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+249-23sys/fs/nfs/nfs_commonsubs.c
+193-2sys/fs/nfs/nfs_commonacl.c
+64-77sys/netgraph/ng_ether.c
+53-16sys/fs/nfsclient/nfs_clrpcops.c
+45-15sys/fs/nfsclient/nfs_clvnops.c
+31-18sys/netpfil/ipfw/ip_fw_iface.c
+635-15114 files not shown
+784-25520 files

HardenedBSD/src a55c578contrib/netbsd-tests/usr.bin/grep t_grep.sh, usr.bin/grep zgrep.sh

Merge branch 'freebsd/14-stable/main' into hardened/14-stable/master
DeltaFile
+45-7usr.bin/grep/zgrep.sh
+20-4contrib/netbsd-tests/usr.bin/grep/t_grep.sh
+10-0usr.bin/grep/tests/grep_freebsd_test.sh
+75-113 files

HardenedBSD/src 4356ec3sys/kern vfs_bio.c, usr.bin/grep zgrep.sh

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+10-0usr.bin/grep/tests/grep_freebsd_test.sh
+2-2sys/kern/vfs_bio.c
+1-1usr.bin/grep/zgrep.sh
+13-33 files