iked(8): Implement IKEv1 prototype
This change brings the IKEv1 protocol stack to iked -- by running
isakmpd(8) as unprivileged IKEv1 subprocess.
This is experimental and still limited:
- The main and quick mode suites are fixed to aes128cbc, hmac2-256,
modp3072 and ESP aes128cbc, hmac2-256 and PFS modp3072
- Only PSK authentication for now.
Nonetheless, tunnels are established and work . And iked(8) is
able to interop with both isakmpd(8) and iked(8) IKEv1.
If this works out good enough, isakmpd(8) will be retired. One
day.
ok deraadt@
rename page list so i don't have to think as hard.
pages moved between "empty", "part", and "full" lists, but does
empty refer to when all the items in a page are allocated or free?
full could apply to either of those states too depending on your
perspective.
replace these names with "used", "part", and "idle" page lists.
"used" pages have 100% of their items allocated, and "idle" pages
have 0 allocated items. "part" pages are in between still.
jmatthew@ thinks this reads ok.
x11/lxqt: update to 2.5.0.
see https://lxqt-project.org/release/2026/11/05/release-lxqt-2-5-0/
- drops dependency on external x11/menu-cache
- replace session dependency on oxygen for breeze icon theme, follows
lxqt/lxqt-session#411 (pcmanfm-qt & qtplugin still default to oxygen..)
should fix icon issues reported by Robert Carleton.
- fix keymap layout detection in startlxqtwayland
- dues to bugs in qtlayershell, the panel & desktop still crash on
wayland when clicking on it.
pf(4) fix traffic statistics for state created by af-to rules
The af-to states are always matched by inbound packets (PF_IN), therefore when
updating statistics the in vs. out (or request vs. reply) direction must take
address families (af) in the matched packet and in wire state key attached
to matching state into account. This allows pf(4) to choose to bump
either counters for inbound or outbound side.
OK bluhm@
libssl: fix previous and unbreak openssl-ruby regress
tls_key_share.c r1.13 changed behavior of SSL_get_peer_tmp_key() which
can now signal success but not actually succeed if no X25519/dhe/ecdhe
is in use, which is the case in ruby's test_get_ephemeral_key, which
uses kRSA with TLSv1.2 on both sides.
Only allocate the pkey if it's actually going to be used and set. Keep
returning NULL in the other cases. This stops triggering an unexpected
assertion in said test.
ok beck
pf(4): source tracking option flush does not work for NAT states
The flush option for source tracking rule also removes all states
created by offending source address. This does not work when
rule comes with nat-to option and creates NAT states. Those
states are not matched by pf_src_connlimit() when it attempts
to remove those states.
pf_src_connlimit() when removing the states must also chose correct state key
using packet direction to match the state to remove. The state keys differ
when NAT happens. For states created by nat-to rule one needs to use the
stack-side key that contains original address before packet got translated.
The issue was kindly reported and the fix submitted by Acts-1631.
OK bluhm@
Unlock KERN_HOSTNAME and KERN_DOMAINNAME sysctl paths.
Use the new hostname_mtx mutex to protect data. Use the temporary buffer
for exchange with userland. We have some areas outside sysctl layer
where we do read-only kernel-locked access to the hostname and the
domainname, so keep modification under two locks. The mutex could be
pushed in such areas later.
We also do hostname and domainname modification during kernel bootstrap
on diskless stations, but this happens at early startup before rootfs
mount.
ok deraadt
