sys/qwz: handle QoS in native WiFi frames
Rebuild the QoS control field for native WiFi RX frames from descriptor
metadata before passing them to net80211.
On TX, strip the hostside QoS control field when using native WiFi
encapsulation, after deriving the TID for the firmware descriptor.
OK: mglocker@
Introduce reference counters for SysV semaphores to fix the context
switch use-after-free after tsleep in sys_semget().
sys___semctl() has no such problems, because we do complete reload and
re-check of semaphore stuff, however I like to replace all of them
with the only "semaptr != sema[ix]" check. The semaphore was changed, go
to the beginning of sys___semctl() and acquire it again.
Note, seminfo.semmni only grows, so even if `sema' array was
re-allocated, the sema[ix] is still valid.
"go for it" from deraadt
bin/ksh: preserve tildes in completion
Keep leading tilde expressions in the command line after file
completion. Expanding ~user to pw_dir during editing bakes the result of
an early passwd lookup into the command line; if the account changes
before the command is executed, the command uses a stale pathname
instead of the current ~user expansion.
Completion still performs the lookup needed to enumerate pathname
matches, but rewrites matches back to the spelling the user typed and
does not leave a completion only lookup in the homedir cache.
Also complete bare ~user prefixes from the passwd database, so ~us[TAB]
can become ~user before pathname completion continues.
Preserving tilde is the default behaviour.
OK: deraadt@
Tighten up read-only checks on attach-session, detach-client and
switch-client so that a user should be able to only detach their own
client. Reported by John Walker.
Ingore packages with invalid prefixlen.
Rouge router advertisements with a prefixlen > 128 would make slaacd
exit with a fatal error, leading to a denial of service.
The same issue exists in dhcp6leased where a rouge prefix delegation
would make dhcp6leased exit with a fatal error, leading to a denial of
service.
Pointed out by Ivan of Quarkslab.
input & OK deraadt
Add support for external account binding. If we're creating a new account
with the ACME CA, and we have an EAB key and key ID specified with the new
-e command line argument, compute the required hash of the account details
and include it in the new account request.
feedback from florian@ and tb@
tested against security/pebble and Digicert by me, and against Actalis by
rroadrrunner at proton dot me.
ok florian@ tb@
Attach ksmn(4) on 19h/1x devices
Tested on:
cpu0: AMD EPYC 9354P 32-Core Processor, 3250.01 MHz, 19-11-01, patch 0a101154
and fix the assertion ksmn_ccd_attach to allow for devices with 12 CCDs.
ok brynet@ claudio@
Replace assert() with a graceful failure by aborting the http request.
An overlong HTTP line can fill the receive buffer to its max but then
http_get_line() would still return NULL trying to read more data.
Since the buffer is full the assert would trigger. Now the http request
is terminated.
Reported by Frank Denis
OK tb@
For bgpctl show mrt detail print the last change time as an ISO format time.
If abs_time is set then switch fmt_monotime() to absolute timestamps.
This uses monotime_to_time, gmtime and strftime("%FT%TZ") to get an
ISO format timestamp string.
While there also adjust get_rel_monotime() to be more like
monotime_to_time() and stop treating negative numbers as error.
In fmt_monotime() check the monotime against 0 to print 'Never' for timers
that are not running.
With this bgpctl show mrt detail prints:
Last update: 2019-05-08T20:03:06Z
OK tb@
rfc3779 test: exercise IPAddressFamily_cmp a bit more
This populates an IPAddrBlocks object with not all that sensible data and
tests behavior of serialization and deserialization of this thing. Prior
to x509_addr.c rev 1.96 this would call memcmp() on NULL.
Implement a better fix. The previous fix allowed to overflow in a
different spot. This would still only lead to a crash, and would only be
reachable by arbitrary users if the admin enabled the agentx socket, and
set custom permissions.
OK deraadt@, mvs@
mention that compression could potentially leak information about session
contents (cf. the CRIME attack on TLS) if a connection allows attacker-
controlled traffic over it alongside trused traffic. This might occur
in some forwarding scenarios.
with deraadt@
