HardenedBSD/src e34690ecrypto/openssl/crypto/ec ecp_nistz256_table.c curve25519.c, crypto/openssl/ssl s3_lib.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+14,894-9,513crypto/openssl/crypto/ec/ecp_nistz256_table.c
+10,184-10,183crypto/openssl/test/ecdsatest.h
+9,620-1,938crypto/openssl/test/quic_record_test.c
+3,601-3,206crypto/openssl/ssl/s3_lib.c
+2,877-2,722crypto/openssl/test/sslapitest.c
+2,625-2,478crypto/openssl/crypto/ec/curve25519.c
+43,801-30,0403,235 files not shown
+215,463-173,1343,241 files

HardenedBSD/src 43dc4b3tests/sys/fs/fusefs Makefile

Account for the ctl test needing the ctl(4) module

This testcase does not function unless the /dev/ctl/... node exists,
which is created by the ctl(4) module. Require the ctl(4) module to be
loaded so the test can be executed.

MFC after: 1 week
Differential Revision:  https://reviews.freebsd.org/D54518

(cherry picked from commit da59b3147b01203bb18bcd03cce7a6d5916e87c3)
DeltaFile
+3-0tests/sys/fs/fusefs/Makefile
+3-01 files

HardenedBSD/src 1f5795bshare/man/man4 vt.4, share/syscons/fonts INDEX.fonts

INDEX.fonts: Minor maintenance

+ Mention relevance of this file in the vt manual screen.font entry
+ The vidfont manual is in section one, not eight
+ Remove leftover blank line from freebsd tag removal

MFC after:      3 days
DeltaFile
+3-0share/man/man4/vt.4
+1-2share/vt/fonts/INDEX.fonts
+1-2stand/fonts/INDEX.fonts
+1-2share/syscons/fonts/INDEX.fonts
+6-64 files

HardenedBSD/src f43d0accrypto/openssl BSDmakefile

crypto/openssl: fix importing new versions from pristine trees

Prior to this change, CC was not being passed through to Configure,
which was resulting in failures when Configure was running compiler
checks.

Pass through CC via `WRK_ENV` to Configure so the compiler is defined
properly as part of the initial build.

MFC after:      1 month
Fixes:          d18058b7b850 ("crypto/openssl: apply polish to new vendor import process")
Differential Revision:  https://reviews.freebsd.org/D52595

(cherry picked from commit 52c4b76d1dd385fbe33b78172e39a10749b83d13)
DeltaFile
+6-1crypto/openssl/BSDmakefile
+6-11 files

HardenedBSD/src f5828b8sys/sys param.h

Bump `__FreeBSD_version` for ee6882e6b1287aa9

While the change in ee6882e6b1287aa9 was likely benign, this commit is
playing it safe by updating __FreeBSD_version, per the libcrypto
dependencies change, as libcrypto now explicitly depends on libpthread
and has threading support explicitly enabled.

This is a direct commit to stable/15.
DeltaFile
+1-1sys/sys/param.h
+1-11 files

HardenedBSD/src ee6882esecure/lib/libcrypto Makefile, secure/lib/libcrypto/modules Makefile.inc

OpenSSL: update Makefiles to reflect 3.5.1 release

This is a targeted effort to update the INCS and SRCS entries for
libcrypto, the legacy provider, and libssl to match what upstream
(OpenSSL) builds in their respective libraries.

The number of stylistic changes were kept at a minimum.

Another incoming change will reformat this file to make future
maintenance easier.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D52554

(cherry picked from commit d5984d5f29a7c717b88ccd17a85a747792403cdf)
DeltaFile
+30-19secure/lib/libcrypto/Makefile
+36-5secure/lib/libcrypto/modules/legacy/Makefile
+0-7secure/lib/libcrypto/modules/Makefile.inc
+1-1share/mk/src.libnames.mk
+1-1secure/lib/libssl/Makefile
+68-335 files

HardenedBSD/src 48ba16fsys/modules/iwlwifi Makefile

iwlwifi: fix the gcc build

- Only apply the previously added CWARNFLAGS to `drv.c` instead of the
  whole module.
- Only apply `-Wno-initializer-overrides` to CWARNFLAGS in the clang
  scenario as it's not supported with gcc.

This fixes building the module with gcc and avoids accidentally
introducing tech debt with the module, in the event other issues are
accidentally introduced.

MFC after:      3 days
Fixes:          6b627f8858 ("iwlwifi: update Intel's mvm/mld drivers")
Differential Revision:  https://reviews.freebsd.org/D53591

(cherry picked from commit 2ec6a2e5f01120ea8d4e667e7773d8b140e40c75)
DeltaFile
+2-2sys/modules/iwlwifi/Makefile
+2-21 files

HardenedBSD/src 631ff52crypto/openssl FREEBSD-upgrade.md FREEBSD-upgrade

crypto/openssl: update vendor update instructions

This change fills out the requirements for doing vendor updates,
documents the new vendor update process, and guides whoever needs to do
the next version update a bit better than the documentation did prior to
this change so everyone can pitch in with version updates a bit better.

Convert the document to Markdown while here to make it easier to
render/print out the directions in a structured format.

MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D53190

(cherry picked from commit 08cdcff58acb2aec881e42c7f097d6492d864898)
DeltaFile
+202-0crypto/openssl/FREEBSD-upgrade.md
+0-122crypto/openssl/FREEBSD-upgrade
+202-1222 files

HardenedBSD/src 1731fc7crypto/openssl/include/openssl ssl.h bio.h

OpenSSL: update vendor sources to match 3.5.5 content

MFC with:       f25b8c9fb4f58cf61adb47d7570abe7caa6d385d
MFC after:      1 week
DeltaFile
+1,423-1,416crypto/openssl/include/openssl/ssl.h
+538-532crypto/openssl/include/openssl/bio.h
+451-462crypto/openssl/include/openssl/asn1t.h
+403-358crypto/openssl/include/openssl/x509v3.h
+344-346crypto/openssl/include/openssl/x509.h
+331-330crypto/openssl/include/openssl/x509_vfy.h
+3,490-3,444946 files not shown
+15,475-11,782952 files

HardenedBSD/src f25b8c9crypto/openssl/crypto/ec ecp_nistz256_table.c curve25519.c, crypto/openssl/ssl s3_lib.c

openssl: import 3.5.5

This change adds OpenSSL 3.5.5 from upstream [1].

The 3.5.5 artifact was been verified via PGP key [2] and by SHA256 checksum [3].

This is a security release, but also contains several bugfixes. All of
the CVE-worthy issues have already been addressed on the target
branch(es), so the net-result is that this is a bugfix release.

More information about the release (from a high level) can be found in
the release notes [4].

MFC after:      1 week

1. https://github.com/openssl/openssl/releases/download/openssl-3.5.5/openssl-3.5.5.tar.gz
2. https://github.com/openssl/openssl/releases/download/openssl-3.5.5/openssl-3.5.5.tar.gz.asc
3. https://github.com/openssl/openssl/releases/download/openssl-3.5.5/openssl-3.5.5.tar.gz.sha256
4. https://github.com/openssl/openssl/blob/openssl-3.5.5/NEWS.md

    [2 lines not shown]
DeltaFile
+14,894-9,513crypto/openssl/crypto/ec/ecp_nistz256_table.c
+10,184-10,183crypto/openssl/test/ecdsatest.h
+9,620-1,938crypto/openssl/test/quic_record_test.c
+3,601-3,206crypto/openssl/ssl/s3_lib.c
+2,877-2,722crypto/openssl/test/sslapitest.c
+2,625-2,478crypto/openssl/crypto/ec/curve25519.c
+43,801-30,0402,263 files not shown
+199,825-161,2952,269 files

HardenedBSD/src fe81e39usr.bin/sockstat main.c

sockstat: Surround explicit IPv6 addresses with brackets

PR:             254611
Approved by:    otis, tuexen, des
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54375
DeltaFile
+9-1usr.bin/sockstat/main.c
+9-11 files

HardenedBSD/src d195b37sys/kern uipc_socket.c

sctp: fix socket type created by sctp_peeloff()

When calling sctp_peeloff() on a SOCK_SEQPACKET socket, the created
and returned socket has the type SOCK_STREAM.
This is specified in section 9.2 of RFC 6458.

Reported by:    Xin Long
MFC after:      3 days
DeltaFile
+4-2sys/kern/uipc_socket.c
+4-21 files

HardenedBSD/src 1538284lib/libc/resolv res_init.c

libc/resolv: Switch default to loopback address

If no resolver configuration was found, we would fall back to INADDR_ANY
and IN6ADDR_ANY.  This made sense when it was first written thirty or
forty years ago but not today, especially since connecting to INADDR_ANY
or IN6ADDR_ANY is no longer supported.  Switch to the loopback address
and simplify the code.

Note that (as the pre-existing comment in the code states) running
without a resolver configuration is not really supported.  Still, if
we're going to have a hardcoded fallback, it might as well work.

PR:             291790
MFC after:      1 week
Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D55011
DeltaFile
+26-41lib/libc/resolv/res_init.c
+26-411 files

HardenedBSD/src 5b2a4d3sys/sys buf_ring.h

buf_ring: Rename some variables

The elements we store in buffer rings are buffers, so refer to them as
`buf` throughout instead of a mixture of `buf`, `ret`, and `new`,
especially since the latter breaks C++ code that directly or indirectly
includes this header.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    siderop1_netapp.com, markj
Differential Revision:  https://reviews.freebsd.org/D54827

(cherry picked from commit 498fe07257aa75f0f1eb4639f4a6ae39fafda901)
DeltaFile
+5-7sys/sys/buf_ring.h
+5-71 files

HardenedBSD/src 80dec91sys/amd64/conf MINIMAL, sys/i386/conf MINIMAL

MINIMAL: Add virtio_scsi

This allows a MINIMAL kernel to boot in qemu/kvm.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.

(cherry picked from commit 77a6992bf5329e32b0b77608421dafccb125ad37)
DeltaFile
+1-0sys/amd64/conf/MINIMAL
+1-0sys/i386/conf/MINIMAL
+2-02 files

HardenedBSD/src 9855d25sbin/mdmfs mdmfs.c

mdmfs: Fix soft updates logic

Now that newfs(8) has a command-line argument to disable soft updates,
use that instead of running tunefs(8) after the fact to turn them off.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    mckusick, imp
Differential Revision:  https://reviews.freebsd.org/D54783

(cherry picked from commit 4b9620433855b75989164c1a8a8a2e1a9b5fbff2)
DeltaFile
+2-10sbin/mdmfs/mdmfs.c
+2-101 files

HardenedBSD/src f5a51cfsbin/newfs newfs.8 newfs.c

newfs: Add an option to disable soft updates

A previous commit turned soft updates on by default for UFS2 without
providing a way to turn them off.  This corrects that by adding a new -u
flag which forces soft updates (and soft updates journaling) off.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Fixes:          61dece6d27fb ("Enable soft updates by default for UFS2 filesystems.")
Reviewed by:    mckusick
Differential Revision:  https://reviews.freebsd.org/D54576

(cherry picked from commit 68562f8145e8154e7e276897a546995f0d8f3428)

newfs: Add -u to getopt string

Fixes:          68562f8145e8 ("newfs: Add an option to disable soft updates")
(cherry picked from commit 717ae163919e48f000b94f85dc188e0d92261929)
DeltaFile
+18-6sbin/newfs/newfs.8
+7-4sbin/newfs/newfs.c
+25-102 files

HardenedBSD/src 39812c7stand/defaults loader.conf loader.conf.5

loader.conf.5: "console" setting does not document multi-value possiblity

PR:             292595
Approved by:    ziaee, dab, imp, tsoome
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D54843

(cherry picked from commit 240c614d48cb0484bfe7876decdf6bbdcc99ba73)
DeltaFile
+1-1stand/defaults/loader.conf
+1-0stand/defaults/loader.conf.5
+2-12 files

HardenedBSD/src f4c40a5sys/conf files.riscv

riscv: Add ffs.c and ffsdi2.c

These are only needed for GCC, but it doesn't hurt to include these
always.

Reviewed by:    mhorne
Differential Revision:  https://reviews.freebsd.org/D54968
DeltaFile
+2-0sys/conf/files.riscv
+2-01 files

HardenedBSD/src 4c822ddsys/libkern ffsdi2.c ffs.c

libkern: Add libcalls for ffs and __ffsdi2

These are needed when compiling a RISC-V kernel with GCC which does
not inline __builtin_ffs*.

The __ffsdi2 is adapated from the previous ffsl.c.

This partially reverts commit f4db342d44198973c1c7b9005d0c5683a582707e.

Reviewed by:    mhorne
Differential Revision:  https://reviews.freebsd.org/D54967
DeltaFile
+47-0sys/libkern/ffsdi2.c
+47-0sys/libkern/ffs.c
+1-0sys/libkern/quad.h
+95-03 files

HardenedBSD/src 31b2590sys/conf kern.mk

riscv: Enable the zifencei extension explicitly in -march

clang is more tolerant and implies this extension whereas GCC is
stricter and requires it to be included.

Reviewed by:    mhorne
Differential Revision:  https://reviews.freebsd.org/D54965
DeltaFile
+1-1sys/conf/kern.mk
+1-11 files

HardenedBSD/src fe45651stand/libsa Makefile

stand: Add compiler builtins needed by GCC for RISC-V

Reviewed by:    mhorne
Differential Revision:  https://reviews.freebsd.org/D54963
DeltaFile
+3-0stand/libsa/Makefile
+3-01 files

HardenedBSD/src 2e8ef82stand/efi/loader/arch/riscv riscv.ldscript

stand: Use the correct OUTPUT_ARCH in the linker script for RISC-V

Compare to the OUTPUT_ARCH in sys/conf/ldscript.riscv.

Reviewed by:    mhorne
Differential Revision:  https://reviews.freebsd.org/D54962
DeltaFile
+1-1stand/efi/loader/arch/riscv/riscv.ldscript
+1-11 files

HardenedBSD/src 2b01cc1sys/dev/qlnx/qlnxe qlnx_os.c

qlnxe: Avoid out-of-bounds reading the multicast ethernet address

The correct length of an ethernet address is ETHER_ADDR_LEN but not
ETHER_HDR_LEN.

MFC after:      1 week

(cherry picked from commit 85f499be90c15a3de02d1c62ce03b99fab52f925)
DeltaFile
+3-3sys/dev/qlnx/qlnxe/qlnx_os.c
+3-31 files

HardenedBSD/src fdd23fcsys/net sff8436.h

sys/net/sff8436.h: Fix the register address of link length of copper or active cable

The register address of link length of copper or active cable is 146 as
per the SFF-8436 specification [1].

[1] 7.6.2 Upper Memory Map Page 00h SFF-8436 Specification (pdf): https://members.snia.org/document/dl/25896

Reviewed by:    imp, zlei
MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1885
Closes:         https://github.com/freebsd/freebsd-src/pull/1885

(cherry picked from commit a537694b49f719d84e3a69a2b8a3098f603da7d7)
DeltaFile
+1-1sys/net/sff8436.h
+1-11 files

HardenedBSD/src 14484cdshare/man/man9 locking.9

locking.9: Tweak the table column width to fit 80 characters

While here, add some white spaces to improve the readability of source
code.

Reviewed by:    ziaee, #manpages
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54121

(cherry picked from commit 176075e661fc657845d788ab3451e690c4e9bac6)
DeltaFile
+7-7share/man/man9/locking.9
+7-71 files

HardenedBSD/src c162d7fsys/dev/liquidio lio_main.c lio_ioctl.c

lio: Avoid out-of-bounds read or write MAC address

While here, replace loop copying the MAC address with memcpy() for
better readability.

Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54177

(cherry picked from commit 094626d3a5009a56bf1b763dbdfc681ce371dc99)
DeltaFile
+4-6sys/dev/liquidio/lio_main.c
+2-2sys/dev/liquidio/lio_ioctl.c
+6-82 files

HardenedBSD/src 270b9f2sys/dev/mfi mfi_linux.c

mfi: Migrate to use macro LINUX_IOCTL_SET to register linux ioctl handler

Reviewed by:    markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D53158

(cherry picked from commit d12ce84b0d338958b26f6eec86b4967fca8d3bd6)
DeltaFile
+1-9sys/dev/mfi/mfi_linux.c
+1-91 files

HardenedBSD/src 3aa4ae2sys/dev/mrsas mrsas_linux.c

mrsas: Migrate to use macro LINUX_IOCTL_SET to register linux ioctl handler

Reviewed by:    markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D53158

(cherry picked from commit 0a2fb63b4954c540686d387254b65cc6878bd19e)
DeltaFile
+1-9sys/dev/mrsas/mrsas_linux.c
+1-91 files

HardenedBSD/src 957babcsys/amd64/sgx sgx_linux.c

sgx: Migrate to use macro LINUX_IOCTL_SET to register linux ioctl handler

Reviewed by:    markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D53158

(cherry picked from commit 8350f46d9808e6183d5f6bd4aa73d4d4e563b574)
DeltaFile
+1-10sys/amd64/sgx/sgx_linux.c
+1-101 files