A packet with a FIN flag needs to act as a barrier in tcp_flush_queue.
Once a FIN packet is received all following data should simply be
discarded. tcp_input handels this FIN but for that tcp_reass() needs
to properly return TH_FIN when a FIN is processed in tcp_flush_queue.
This reassembly was not quite correct. Unexpected data directly following
the FIN packet was also reassembled and the FIN was actually lost.
The failure to return TH_FIN caused the regression in the previous fix.
tcp_input() passes some FIN packets through reassembly even though they
are in sequence and the queue is empty.
tcp_flush_queue() needs to treat packets with TH_FIN set as a barrier
and stop reassembly after processing this last packet. This ensures that
tcp_reass() returns TH_FIN to tcp_input which then changes the state of
the session. It also ensures that only data up to the FIN packet are
passed to userland.
Reported by Xint Code
OK sashan@
Fix PREF64 option corruption if DNSSL is also set
On octeon (but not amd64) setting both a NAT64 prefix and a search domain
causes the former ICMPv6 option to be corrupted due to how it is added last
in the Router Advertisement packet, following too much zero padding.
Bytes after the DNSSL option are zeroed up the next 8-byte boundary to
align options inside the packet.
Instead of checking alignment of the pointer address somewhere inside the
packet buffer that lives on the stack, which is thus architecture specific,
use their offset, i.e. see how many bytes were already written, in order to
zero-fill what is left between last search domain and next 8-byte boundary.
This makes RAs byte-identical between octeon and amd64 and prevents rad(8)
from sending the kind of invalid packets that clients like slaacd(8) and
gelatod(8) (from ports) need 029_v6daemons for.
OK florian
Fix handing of multi-line blacklist error strings in spamd.conf
When appending the blacklist error string, spamd splits the message
on a newline and continues the message on a new line. There was
a bug where the current pointer was incremented too far, which
resulted in the message being truncated at the newline instead
of continued.
For very long blacklist messages (around 8K) in spamd.conf, this
could result in heap corruption. However, this is very unlikely
in practice.
OK jsg@
Reported by and fix from Dhiraj Mishra
newer gcc is so smart to point out that settime_deadline may be used
uninitialized. of course it is wrong. sprinkle a "= 0" to shut it up.
pointed out by bcook, discussed with, gcc confronted by and ok claudio bcook
newer gcc thinks it's smart (do they call it AI yet?) and points out
peercount may be used unitialized. of course it is utterly wrong.
move peercount = 0 initialization 2 lines up to shut gcc up
pointed out by bcook, dicussed with, gcc-checked by and ok bcook claudio
in control_check(), rename struct sockaddr_un sun to sa - for consistency
with control_init() just underneath, and because "sun" causes problems for
portable on solaris
pretty much from bcook's portable repo, but another name, ok bcook
Enable nwid scanning by doing two things:
1. Disable the 802.11d scanning command for now, since it causes a firmware
error for which we currently have no solution. This isn't a critical
feature, and we can progress without it until we find a solution.
2. Send the HTT software ring setup messages for the receive rings, otherwise
the firmware never initializes its RXDMA pipeline, and delivers no frames
to the host. For that we did port over the
ath12k_dp_rxdma_ring_sel_config_wcn7850() and ath12k_dp_rx_htt_setup()
functions from the linux driver.
Tested and ok kettenis@, kirill@
PFI_FLAG_SKIP may be lost when interface disappears and then reappears
if 'set skip on ...' in pf.conf(5) refers to interface (or interface group)
which is yet to be created in system, then all is good.
However if the interface (or interface group) exists in system at the time
when pf.conf(5) is being loaded to pf(4) the effect of skip flag might get
lost. The scenario for tap0 interface goes as follows:
tap0 (and tap interface) exist in system and is known to pf(4), meaning
'pfctl -sI' reports tap0 and tap.
pf.conf with 'set skip on tap' is loaded. The pf(4) sets the flag on
`kif` instance without obtaining a reference to keep it in table
until skip flag (PFI_FLAG_SKIP) is reset.
tap0 interface is removed from system (ifconfig tap0 destroy),
the tap0 is removed from system and also corresponding kif instance
is removed from pf(4). kif is forgotten together with flag settings. If tap0
[13 lines not shown]
Update to rclone-1.73.5
CVE-2026-41176
rc: add AuthRequired to options/set to prevent auth bypass
rc: snapshot NoAuth at startup to prevent runtime auth bypass
CVE-2026-41179
operations: add AuthRequired to operations/fsinfo to prevent backend
creation
Changelog: https://rclone.org/changelog/#v1-73-5-2026-04-19
OK sthen@
Remove the bootcmd hint for now
On this jupiter box, U-Boot's bootcmd can't be interrupted on the serial
console by pressing any key, Ctrl+C or ESC, even though the official
docs say it should be possible by pressing any key.
sigh
Add post-install hints for boards without distro_bootcmd (like BPi F3/Jupiter)
The default bootcmd is useless on these boards, so suggest some simple
default boot command.
