BSD Commit Log Search

   rpki-client: wrap a line per KNF

   rpki-client: extend test-seqnum to test for cert serials

   rpki-client: disallow certs with zero serialNumber

   Consistency is hard:

   RFC 5280 (eid3200 clarifies) and RFC 6487 disallow a zero serialNumber.

   For extra fun, CRLNumber and manifestNumber are defined via ASN.1
   explicitly allowing zero. So we need some extra dances.

   Arguably eid3200 was resolved the wrong way.

   Serial number issue pointed out by the rpki-rp-benchmark.

   ok claudio

   rpki-client: split some helpers out of cms.c

   There are a bunch of helper functions that are not really CMS specific
   that will be shared by several signed object parsers. Implementations
   go into rpki-der.c and they are prototyped in rpki-der.h. The latter
   should eventually replace rpki-asn1.h.

   ok claudio

   Directly dispatch the files referenced by a mft in the parser.

   There is no need to circle back to the parent process to schedule more work.
   This is the minimal way to handle this and should allow us to further improve
   the MFT handling.

   The work items enqueued by an MFT are put on the global entity queue but
   only after the mft message was enqueued into the output queue.

   OK tb@

   update to freerdp-3.33.0

   Update to 6.17.0

   OK sthen@

   another missing firmload decl; from Crystal Kolipe

   update to py3-xmlschema-4.3.2

   update to py3-elementpath-5.1.4

   update comment

   update to py3-cryptodome-4.3.0

   now uses ARMv8 Cryptography Extensions on aarch64 and has various other
   speed increases: https://www.pycryptodome.org/src/changelog#november-2026

   Update schismtracker to 20261102.

   rpki-client: use strncmp() after x509_location()

   Now that the protocol (always expected to be https:// or rsync://) is
   normalized, we can do a simpler check.

   Prompted by a report by Ties de Kock

   ok claudio

   rpki-client: reject short URIs in x509_location()

   Reject URIs not long enough to hold https:// or rsync://. While "a:///b/c"
   is in principle legal, this isn't plausibly a valid URI that should occur
   in the wild. Reject certs containing this.

   pointed out by/ok claudio

   rpki-client: normalize known URI schemes in x509_location()

   RFC 3986 was written under full influence of the robustness principle,
   necessarily making all code handling URIs complicated and fragile. This
   is further exacerbated by RFC 5280 explicitly mentioning that scheme and
   host part of a URI are case-insensitive (for SAN, not explicitly for a
   URI accessLocation, but that seems implied).

   The schemes explicitly specified by RFC 6487 and friends are rsync and
   https and that's the only ones the callers do anything with. Normalize
   these to be lower case and accept other schemes (and currently no scheme)
   for simplicity. This avoids hitting an errx() in queue_add_from_cert().

   Reported by Ties de Kock

   ok claudio

   update to py3-pip-26.3

   update to nghttp2-1.71.0

   update to py3-cryptodome-test-vectors-1.0.28

   Convert some assert() to simple http request failures with warn message.

   In theory the asserts placed should never be hit since for example at the
   end of a request no outstanding data should be left in the buffers. In
   practice those asserts did trigger too often. Bad servers could remotly
   trigger them and so it is clear that these failures are not assertions.

   Triggered by a report by Ties de Kock
   OK tb@

   Update to nghttp3 1.19.0

   https://github.com/ngtcp2/nghttp3/releases/tag/v1.19.0

   Update to ngtcp2 1.26.0

   https://github.com/ngtcp2/ngtcp2/releases/tag/v1.26.0

   Update to zizmor 1.32.0

   https://github.com/zizmorcore/zizmor/releases/tag/v1.32.0

   Reject receive transfers whose descriptor frame length exceeds the data
   actually transferred.  The descriptor carries a 12-bit frame length and
   the chip accepts frames up to 4095 bytes, but a receive transfer only has
   MCLBYTES minus the descriptor for frame data.

   Trusting the descriptor produced an mbuf extending past its cluster.
   A fragmented IPv4 datagram then carried it into m_cat(), where a default
   kernel panics on a DIAGNOSTIC assertion.

   Report and diff from Acts1631.

   ok miod@ claudio@ kettenis@

   devel/dtools: switch to gdc

   devel/dub: add missed patch

   devel/dub: use LLD and fix build on PowerPC

   Brad Smith pointed that LLD can be used now

   sys/macppc: increase MAXDSIZ to 3Gb

   OK: kettenis@

   Update to tailscale-1.104.4

   From Adriano Barbosa (maintainer)

   Update to navidrome-0.64.2

   From Igor Zornik (maintainer)