ocspcheck: do not use OCSP_TRUSTOTHER
Like in libtls, ensure that the provided OCSP staple is validated by an
OCSP trust chain to the root.
From Acts1631
ok beck kenjiro
libtls: fix OCSP responder authorization bypass
If a CA revokes a valid TLS server cert using OCSP, a client configured to
require a valid OCSP staple should always reject that cert. If the server's
private key has been compromised, it was possible to bypass this requirement.
The problem is the behavior of OCSP_TRUSTOTHER which skips chain
validation for the OCSP trust chain to the root and the checking that
the staple was signed by a CA of the validating chain. So remove this flag.
This only affects callers of tls_config_ocsp_require_stapling(). In OpenBSD
base these are reachable in OpenBSD base via opt-in behaviors of nc(1) -T
and ftp(1) -S via the "muststaple" keyword. No ports call these functions.
Reported by Acts1631 and Jiho Kim
ok beck kenjiro
Update to Ruby 4.0.7
This includes fixes for:
CVE-2026-80212: Memory exhaustion through malicious DNS responses
CVE-2026-80213: Hostname validation bypass
lang/gdmd: update to 20260801
Since gdc in gcc was fixed, it can be linked back to build.
It also works well enough to be used as bootstrap compiler for lang/dmd
Recalulate the TCP SACK list after memory exhaustion.
Acts1631 found that tcp(4) can advertise SACK blocks for data that
it has discarded when the global TCP reassembly pool is exhausted.
This can make a sender omit missing data from fast recovery and
wait for its retransmission timer.
This commit clears the receiver SACK report whenever the reassembly
allocation fails, before either path can discard queued data. It
also returns -1 when the new input segment itself is discarded.
The caller maps that value back to zero TCP flags but does not add
the discarded range to the SACK report. On the reuse path, the
accepted current segment is still passed to tcp_update_sack_list(),
after the stale report has been cleared.
from Acts1631; discussed with claudio@ tb@
The MR_DCMD_LD_GET_LIST command doesn't return any data on SAS39xx
controllers. Luckily everything we need is also available through
MR_DCMD_CONF_GET, so we can just rework everything to use that instead.
To enable this, we need to retrieve the configuration during attach.
This gets bioctl, sensors and AEN processing working on SAS39xx.
tested on SAS3108 and SAS3508 by me, on SAS39xx by daharmasterkor at gmail
ok dlg@
Keep our own copy of the certificates sent by the peer.
SSL_get_peer_cert_chain() includes the peer certificate for a client but
not for a server. Build a STACK_OF(X509) owned by libtls that always
starts with the peer certificate, and convert it to PEM with a helper
that takes any STACK_OF(X509).
ok jsing@ tb@
Redesign shutdown of vmd processes and use SIGTERM for hanging vm's.
In preparation for some bigger changes in vmm(4)/vmd(8), improve the
shutdown paths for vmd vm's. For vmd vm processes, the objective is to
make it through cleanup routines (such as sev_shutdown()) in any
conditions where it's safe to continue executing the program. From the
vmd "vmm" process, still use the current VMM_IOC_TERM to signal that
the vcpu's should be terminating, but also fall back to SIGTERM to the
vm process if it doesn't get the hint.
The timeouts may need to be adjusted in the future, but those can be
optimized after the bigger changes land.
Go for it, mlarkin@.
Provide the faulting GPA to vmd(8) for MMIO exits from vmm(4).
The nested page fault on VMX and SVM provides the faulting GPA, so
pass that to userland. This simplifies a lot of the mmio handlers
that can use the GPA without having to translate the GVA. Also
simplify the fatal events for when the GPA isn't known.
Go for it, mlarkin@.
