restrict IMSG_CTL_PROCFD to parent and check process id/instance
IMSG_CTL_PROCFD messages contain a destination process id and instance
number that were used to index internal arrays before being checked.
A child sending bad imsgs could cause out-of-bounds reads or
writes.
Check for a missing fd, a bad process id, or an out-of-range instance
before any array is indexed. Also reject IMSG_CTL_PROCFD that does not
come from the parent.
from Andrew Griffiths, diff by martijn@ and myself, ok martijn@
Switch the default TLS cipher set from "compat" to "secure"
The "secure" keyword only allows TLSv1.3 and the TLSv1.2 AEAD ciphers
that have forward secrecy (ECDHE/DHE). See tls_config_set_ciphers(3)
for details. This is stricter than "HIGH:!aNULL" and drops older
ciphers without AEAD or forward secrecy.
Also update the ciphers text in httpd.conf.5 with the clearer wording
from smtpd.conf.5.
Old peers that need these older ciphers may no longer connect.
idea from Mischa, ok kirill@ ok tb@
Switch the default TLS cipher set from "HIGH:!aNULL" to "secure"
The "secure" keyword only allows TLSv1.3 and the TLSv1.2 AEAD ciphers
that have forward secrecy (ECDHE/DHE). See tls_config_set_ciphers(3)
for details. This is stricter than "HIGH:!aNULL" and drops older
ciphers without AEAD or forward secrecy.
Also update the ciphers text in relayd.conf.5 with the clearer wording
from smtpd.conf.5.
Old peers that need these older ciphers may no longer connect.
idea from Mischa, ok kirill@ ok tb@
Revert the -fno-omit-frame-pointer change (including the clang only
-mno-omit-leaf-frame-pointer). Committed by accident.
Noticed because of commit from miod@
trunk(4): update link state after new port attached
Without this fix, the linkstate is unknown via snmpd till its changed.
yeah, looks good. go for it. dlg@
Seems right to me. deraadt@
Make tsort(1) abort early if input lines contain NUL bytes
tsort works on text files with data separated by whitespace, there is no
need or reason to support NUL as an additional word delimiter. It's
easier to just detect invalid input early, in the two functions which
read data.
Similar diff from espie, ok tb@ renaud@
Set IFXF_MBUF_64BIT so mbufs are allocated in high memory if only
64 bit DMA interfaces exist. Also pass BUS_DMA_64BIT to the
bus_dmamem_alloc() for the kstat counter buffer (rge_ks_sc_seg).
ok bluhm@
