relayd: add ECDSA support to the CA privsep engine
Add an EC_KEY_METHOD that forwards the sign operation to the CA process,
clone the existing RSA engine. ssl_load_pkey() now handles both RSA
and EC keys and attaches the cert hash accordingly.
The engine and signing code was migrated from smtpd from (op@) with
some tweaks by me.
OK op@
vmd(8): validate memory ranges in vmd before vmm(4).
While vmm(4) does its own check on the number of memory ranges, do
the check in vmd(8) to fail fast and provide feedback to the user.
Report and diff by Andrew Griffiths.
ok @hshoexer
authpf(8) read_config() should chop off trailing white space
if administrator mistakenly types into configuration file
anchor=authpf_test
where 'authpf_test' is followed by white space, the authpf(8)
is going to use anchor 'authpf_test ' instead of the 'authpf_test'
which is defined in pf.conf(5) as 'anchor authpf_test/*'
issue kindly reported and patch submitted by
Avinash Duduskar <avinash.duduskar (_at_) gmail (_dot_) com>
OK sashan@
update to got 0.127
- re-add cmdline tests to 'make regress' target (regression from 0.126)
- add version flag (-V, --version) to gotd, gotwebd, and gotsysd
- make 'got merge' accept tags as merge source argument
- do not raise errors when unversioned files are found during got rm -k
- add rm -s ? option for deleting unversioned files from the work tree
- add rm -I option for also deleting ignored unversioned files with rm -s ?
- make 'tog log' reload the work tree's base-commit info during Ctrl-L refresh
- fix failures due to trailing slashes in checkout -p path-prefix argument
- gotwebd: use <meta http-equiv="refresh"> tag to redirect browser after login
- gotwebd.conf: add option which restores legacy redirect using http status 307
Bring back up_generate_addpath_all() using the rib entry queue
add-path send all can take a fair amount of shortcuts compared to the
other add-path send modes. The rib entry queue (struct pq_entry) holds
all the information to update the adj-rib-out.
For general updates just walk the pq list and insert / withdraw all
paths. A path can only be once on the list so the code just needs to
walk it and call up_process_prefix for updates. If up_process_prefix()
returns UP_FILTERED or UP_EXCLUDED then try to withdraw the prefix. This
uses the same codepath as for any withdraw in the queue.
Tested on the NLNOG ring looking glass server.
OK tb@
Document how unveil(2) permissions correspond to various pledge(2) promises.
unveil considers the operation that happens at namei(9) time, but pledge has a
deeper integration into subsystems, therefore pledge can be more precise.
This change is the result of various experiments. For example the "unix" promise
allows creating files when calling bind(2) on an AF_UNIX socket, we found
requiring the "cpath" promise along with "unix" either required extensive
changes or made the promise set too broad. Similiar applies to connect(2) and
"wpath". Instead document that the unveil permissions "c", "w" and "r"
correspond to a larger set of pledge promises.
ok deraadt
make dwpcie_rk3568_link_up less pedantic about what it considers "up".
ie, only report whether the pcie link is up, don't look at the state
of the up link too. this matches linux behaviour fwiw.
after a warm boot (ie, reboot), the re(4) in my rk3528 based radxa
e20c didnt attach because the pcie link was in a power saving state
instead of the ready state this code was expecting.
jmatthew@ and i have also tested this on a bunch of rk356x boards too.
ok jmatthew@ kettenis@
