Prevent pf dropping TCP state with crafted reset packet.
Revision 1.1212 of pf.c weakened the TCP reset check in stateful
connection tracking to let legitimate resets pass in the backwards
window. Such a reset is accepted only if its acknowledgment number
matches perfectly. But as a workaround for broken stacks, pf
replaces an acknowledgment number of 0 in a reset with the tracked
sequence of the peer. Then the perfect match always succeeds, and
an attacker can spoof resets more easily than intended. Use the
acknowledgment number from the wire, before the workaround has
modified it.
discovered by Minghao Zhang; OK sashan@
Require NRIP Save support for vmm(4) on AMD hosts.
This feature gives a fast, reliable path to accurately advancing
RIP when emulating certain instructions. Most AMD hardware from the
past 15 years should have NRIP Save and nested paging support so
this drops support for AMD hardware from roughly family 11h and
older with some rare exceptions.
Discussed multiple times in the past.
ok mlarkin@
Centralize vmm(4) vcpu yield logic.
Put all checks for "should the vcpu yield?" into the same function
and rename it to better fit semantics ("stop" -> "yield"). This
pulls in some scheduler flag checks that were duplicated between
amd64 cpu-dependent code paths.
sure, mlarkin@
Make vmm(4) exception helpers return void.
None of the vmm_inject_{gp,ud,etc.}() functions can fail. There's
no need to return 0 for all of them, so simplify the function
signature and update call sites to clean things up a bit.
sure, mlarkin@
vmm(4): classify injected #DB as hardware exception.
vmm was incorrectly classifying as a software exception. Change to
hardware exception without an error code.
ok mlarkin@
Use bpf_mfilter in bpf_movein since it operates on an mbuf
With this bpf_filter is no longer used by the kernel and all the code
around it can be hidden from _KERNEL.
OK tb@
Use correct bpf filter calls in ppp(4)
10 years ago the bpf_filter interface was changed and bpf_mfilter was
introduced. bpf_filter no longer support passing an mbuf as pkt by using
a buflen of 0. Finally adjust this code and switch it over to bpf_mfilter.
OK tb@
When a manual page file requested via man(1) is not found in any mandoc.db(5)
but is then found by the fallback search in the file system, do not warn
about an outdated mandoc.db if the manual page tree that contains the
requested file does not contain a mandoc.db file in the first place.
This avoids bogus, annoying warnings in two situations:
(1) when users choose to have their own, private manual page tree
without putting a mandoc.db into it; and
(2) on operating systems allowing a configuration where makewhatis(8)
and mandoc.db(5) are not used at all.
Issue found by Paul Bredbury <brebs at sent.com> on Alpine Linux, where
installing apropos(1) and makewhatis(8) is optional and not the default.
