BSD Commit Log Search

   Test all mutually supported algorithms, using dropbear's new -Q option
   to query its algorithms where possible.

   Bring in the single-cell redraw parts for floating panes.

   Do not adjust end position when removing partial padding, it does not
   change.

   merge changes from unbound 1.25.1, ok florian

   Check visible ranges when copying screens.

   Add an accessor function needed for floating panes.

   Add window-pane-status-format options and adjust the default second
   status line to show panes, also change how window-style is checked now
   it is a pane option.

   Floating panes clearing bits.

   use I/O submission queue entry size reported by controller

   On the Apple T2 NVMe, 128-byte submission queue entries on I/O
   queues are required instead of the standard 64 bytes.

   ok jmatthew

   Use the new RELINK feature in bsd.prog.mk to build the relink kits.

   rpki-client: use sentinel idiom for timegm(3) error check

   We currently fail on ASN.1 times before the epoch. There is nothing wrong
   in principle with those. Both UTCTime and GeneralizedTimes can represent
   such times and we should be able to accept them.

   Modern OpenSSL and LibreSSL ensure in ASN1_TIME_to_tm() that the times are
   well formed according to the DER, so this call is really only a translation
   step.

   ok claudio deraadt

   ssh: use sentinel idiom for timegm(3) and mktime(3)

   There is nothing wrong with times before the epoch, even -1, so use the
   idiom recently added to the CAVEATS section to figure out whether there
   was an error in the timegm() or mktime() calls.

   We should sweep the tree for this. If anyone is bored, feel free to beat
   me to it...

   ok deraadt djm

   A new variable (RELINK) makes rules for creating a relink tar file and
   installing it in the correct place.  The variable needs to be a test
   command which verifies the re-linked binary works correctly, which
   requires it to exit(0).
   This 1-liner will replace the large adhoc relink tarfile production
   in the Makefiles of various relinked programs.

   Cache border and active border style separately, fixes problem reported
   by Marcel Partap in GitHub issue 5125.

   Remove reference to an option that hasn't been added yet.

   add back the local #undef DEBUG lost with last drm update
   reported by Jan Schreiber

   Sync the nexthop comperators in rde_rib.c and kroute.c

   While nexthop_cmp() already looked for the scope_id for link-local IPv6
   nexthops, knexthop_compare() did not.

   Reported by 7Asecurity
   OK tb@

   Bring in some more floating panes changes - obscured panes need to be
   handled specially in screen_write_* rather than dropping into the client
   redraw (tty.c).

   Add some extra checks to the mrtparser

   Fail if the mrt message length is larger than MRT_MAX_LEN (1MB).
   No message should have such a large size.
   Ensure the dump callback is never called with a mrt peer table
   that is NULL.

   Reported by 7Asecurity
   OK tb@

   Add an explict "--" argument for portable.

   GNU libc getopt allows options out of order with other arguments
   so force getopt to stop option parsing using "--".
   OK tb@

   Add a "--" argv to the execvp of bgpctl for portable.

   GNU libc has this stupid behaviour of allowing options in any order
   and so one needs to terminate the option parsing to be sure none of
   the later user supplied arguments could be interpreted as an option.

   Reported by 7Asecurity
   OK tb@

   Don't fail hard on version mismatch and ignore extra end-of-params messages.

   Replace the lerrx on version mismatch with a lwarnx and error return.
   Switch to ssize_t return for that so that slowcgi_request() can properly
   fail when this happens.

   Also do not execute multiple bgplgd commands when extra end-of-params
   messages are received. Once a command is executed fail to start a 2nd
   one.

   Reported by Frank Denis
   OK tb@

   Improve handling of unknown extended communities

   Ext communities are split over the 3 data fields of struct community.
   All ext communities put the first 2 bytes (type and subtype) into data3.
   For EXT_COMMUNITY_TRANS_IPV4 and EXT_COMMUNITY_TRANS_FOUR_AS a 2-4-2 split
   is used. All other types use a 2-2-4 split this should include all unknown
   types. So add default cases into the various switch statements to make this
   happen.

   Reported by 7Asecurity
   OK tb@

   Increase the MRT attribute buffer to MAX_EXT_PKTSIZE so it works in all cases.

   Dumping messages from peers with extended message capability would fail
   since the MRT code was still limited to the old 4096byte size.

   Reported by 7Asecurity
   OK tb@

   Fix use-after-free problems in parse.y

   In error cases using YYERROR data is freed but the global pointer is not
   reset (to NULL or in the case of curpeer to curgroup). On YYERROR yacc
   still moves on and so any rules using e.g. curpeer do a use-after-free.

   Reported by 7Asecurity
   OK tb@

   Move pt_unref() after the RB_REMOVE() call in rib_remove() to
   prevent use-after-free.

   rib_remove calls pt_unref() before the RB_REMOVE() call which also uses
   re_rib(). re_rib() evaluates re->prefix but pt_unref() could free the
   prefix if the refcount drops to 0.

   Reported by 7Asecurity
   OK tb@

   fix sort_get_clients() indentation; ok nicm@

   Check error result correctly (*cause not cause), pointed out by jsg.

   sync

   newsyslog: add glob(3) support for logfile names

   Allow glob patterns in the logfile_name field of newsyslog.conf(5),
   so that entries like /var/log/app/*.log are expanded at parse time.

   From Alvar Penning, feedback and OK jan@