When testing PKCS11, explicitly allow the module path in ssh-agent.
Allows testing of PKCS11 modules outside system directories.
From Morgan Jones via GHPR602
When loading FIDO2 resident keys, set the comment to the FIDO
application string. This matches the behaviour of ssh-keygen -K
From Arian van Putten via GHPR608
move aggr/trunk input processing into ether_input.
previously it replaced the ifp->if_input function pointer on ethernet
interfaces, which is always ether_input, to intercept packets. this
makes it work the same as bridges (bridge/veb/tpmr) for intercepting
and filtering packets now.
this makes it (more) possible to call ether_input without netlock
(which serialised the modification/use of if_input), and makes it
possible for ethernet interfaces with custom if_input functions
that eventually call ether_input to work as trunk/aggr ports.
Some AMD microcode now has a minimum version for updating with an MSR.
AMD-SB-7033 claims a protection fault will be generated if not at that
level.
The microcode containers can now also have multiple microcode patches
for a given family-model-stepping combination. One with a minimum version,
and one without.
Handle multiple patches and check minimum version using part of the
container header. Limit this check to family 19h and above. The header
is not publically documented and this part seems to have another use on
earlier CPU families.
Fix vmd(8) segfault during vmmci timeout firing.
Need to pass a pointer to the vmmci device. The timeout handler calls
vm_shutdown() so this SIGSEGV exit wasn't being noticed until I attached
to the vm process with gdb.
Repair greetd controlling terminal handling
Use TIOCSCTTY from libc crate, which actually knows about OpenBSD. Then
use it to implement term_tiocsctty. This lets agreety and other child
sessions run with a proper controlling terminal.
ok landry@
ifa_load() in pfctl_parser.c may attempt to read beyond the buffer.
The current ifa_load() is not paranoid enough when it deals with
information which comes from kernel. The function just ignores
sa_len member in socket address returned getifaddrs().
The issue has been reported by anton@. The idea for fix here comes
fromy claudio@.
OK @claudio, @deraadt
