rpki-client: add a copy of libcrypto's bytestring API
This will be used to replace the terrible CMS API from libcrypto. Longer
term this might also be used to implement better parsers for certs, CRLs
and the signed objects' eContent.
discussed with claudio and job
ok beck
libcrypto/bytestring: add some missing tag classes
This adds tags for NULL, PrintableString, UTCTime, and GeneralizedTime with
names matching BoringSSL.
ok kenjiro
libcrypto/bytestring: remove LIBRESSL_INTERNAL from bytestring.h
This currently marks the LibreSSL-specific additions to this API. It has
no effect other than getting in the way of other projects wanting to use
this since it is always compiled with LIBRESSL_INTERNAL.
ok kenjiro
sysv_shm: claim the vm_shm slot after uvm_map(), not before
sys_shmat() chose a free slot in the per-vmspace vm_shm array, then slept
in uvm_map(), then published into the slot it had chosen. Nothing marked
the slot taken across the sleep, so a sibling thread entering sys_shmat()
scanned the same array, found the same slot still reading -1, and took it
too. Both uvm_map() calls succeed at different addresses and the thread
that stores last wins; the other mapping is left with no vm_shm entry, so
shmdt() returns EINVAL for it and shmexit() cannot drop its shm_nattch.
The permanently raised count keeps IPC_RMID from deallocating the segment,
which then sits in shmsegs[] reachable by nobody; 128 of those and
shmget() returns ENOSPC system-wide.
uvm_map() is the only sleep between choosing the slot and filling it in,
so moving the scan below the map closes the window without a reserved
state that shmdt(), shmexit() and shmfork() would each have to learn
about. EMFILE is now discovered after the mapping exists, so that path
undoes it.
[9 lines not shown]
Backport fixes from libexpat version 2.8.5.
Relevant for OpenBSD are security fixes #1282, bug fixes #1346
#1371, other changes #1354 #1357 #1349 #1360 #1378. Library bump
is not necessary.
CVE-2026-93990
OK deraadt@
this is errata/7.9/033_expat.patch.sig
Backport fixes from libexpat version 2.8.5.
Relevant for OpenBSD are security fixes #1282, bug fixes #1346
#1371, other changes #1354 #1357 #1349 #1360 #1378. Library bump
is not necessary.
CVE-2026-93990
OK deraadt@
this is errata/7.8/069_expat.patch.sig
incorrect object being freed
from Franz Bettag / Bettag Systems
from deraadt@; OK markus@ hshoexer@ sthen@ mvs@
IKEv1 short-HASH heap overflow; second approach for fix
from Franz Bettag / Bettag Systems
from deraadt@; OK sthen@ mvs@
Franz Bettag sent a report & diff repairing the privsep monitor's
dangerous file behavior in /var/run, and I was shocked at what it
does. isakmpd never had a proper diagnosis and control program like
other daemons do, and instead accepts weird commands on a fifo and
splats files dangerously. Some path names can be manipulated. This
2600 line diff removes all of this session debugging mechanism which
is the main cause of that unsafe design. There are no reuseable parts
in that code (it cannot be reconstructed into a proper control program
interface). As a result, the privsep monitor now has unveil to the
config directory, and the network speaking process is "stdio sendfd
route recvfd inet". There is some loss of functionality, since some
[22 lines not shown]
incorrect object being freed
from Franz Bettag / Bettag Systems
from deraadt@; OK markus@ hshoexer@ sthen@ mvs@
IKEv1 short-HASH heap overflow; second approach for fix
from Franz Bettag / Bettag Systems
from deraadt@; OK sthen@ mvs@
Franz Bettag sent a report & diff repairing the privsep monitor's
dangerous file behavior in /var/run, and I was shocked at what it
does. isakmpd never had a proper diagnosis and control program like
other daemons do, and instead accepts weird commands on a fifo and
splats files dangerously. Some path names can be manipulated. This
2600 line diff removes all of this session debugging mechanism which
is the main cause of that unsafe design. There are no reuseable parts
in that code (it cannot be reconstructed into a proper control program
interface). As a result, the privsep monitor now has unveil to the
config directory, and the network speaking process is "stdio sendfd
route recvfd inet". There is some loss of functionality, since some
[22 lines not shown]
If the -width of a .Bl macro is of the form ".word text",
use only the text for measuring the width, assuming the word is a macro,
as a crude approximation of what groff_mdoc(7) does: it sets the
argument in a diversion and measures the width of the diversion.
Ugly formatting first reported by Franco Fichtner (DragonFly BSD) in 2013,
this partial fix first suggested by me in the mandoc TODO file in 2013,
then implemented by Eric van Gyzen (FreeBSD) in 2022.
My fix committed here is slightly smaller than Eric's FreeBSD fix,
does not need an extra function, and stays closer to groff behaviour.
sys/ufshci: increase poll's wait to 500ms
This matches Linux timeout and makes ufshci survives a suspend on
HONOR MagicBook Art 14 Snapdragon
500ms value which matches Linux suggested by kettenis@
OK: mglocker@
vmd(8): fix mmio exit issue on old SVM machines
fix a problem where we didn't pass any instruction length to insn_decode
on some older opterons that don't have SVM decode assist.
ok dv
The path generation must not contain '..' or '/' type patterns or it
can walk upwards and sideways. The privsep open() is now restricted by
a single unveil() inside the config directory, but files in relative config
directories can still be reached and create potentially confusing outcomes.
This is half of a repair from Franz Bettag before I restructured the privsep
to use unveil(), the other half of the repair is not needed because it applies
to code that no longer exists.
ok markus hshoexer bluhm, testing sthen mvs
Franz Bettag sent a report & diff repairing the privsep monitor's
dangerous file behavior in /var/run, and I was shocked at what it
does. isakmpd never had a proper diagnosis and control program like
other daemons do, and instead accepts weird commands on a fifo and
splats files dangerously. Some path names can be manipulated. This
2600 line diff removes all of this session debugging mechanism which
is the main cause of that unsafe design. There are no reuseable parts
in that code (it cannot be reconstructed into a proper control program
interface). As a result, the privsep monitor now has unveil to the
config directory, and the network speaking process is "stdio sendfd
route recvfd inet". There is some loss of functionality, since some
users had gotten used to the decrepit debugging / logging interface to
repair sessions which would not negotiate.
This is almost completely unmaintained code from early OpenBSD days
with an incorrect privsep design, and many users have migrated to
using iked(8) which does IKEv2 protocol. RFC9395 also provides valuable
guidance here. Everyone is urged to avoid using this program. If IKEv1
protocol is still a part of your life roll up sleeves and try to write a
high-quality control interface using lessons from the IKEv2 iked(8) code.
[2 lines not shown]
