routing: Fix buffer size in merge_nhgrps()
merge_nhgrps() sized its temporary nexthop array as twice
the existing group instead of the sum of both groups.
Fixes: dd945c6ba4ff ("routing: Implement merge of nhgrp in new multipath route")
security/vuxml: FreeBSD private sqlite3 is not vulnerable
Although the FreeBSD base system does ship the vulnerable version of
sqlite3, it is only used internally as a private library. None of the
use cases in the base system is realistically vulnerable.
Approved by: so (gordon)
Discussed with: secteam
Fixes: 2d614195fc56 ("security/vuxml: Add FreeBSD (base) to the
sqlite3 entry")
ssh: use defaultkey sentinel for ML-DSA-44 default host key
servconf_add_hostkey() compares its file argument to defaultkey by
pointer to skip an unreadable default key; the ML-DSA-44 entry passed
the "[default]" literal, so the skip (and the "No host key files found"
fallback) never applied to it.
MFC after: 1 week
Reviewed by: emaste
Fixes: bb5c77e9d281 ("OpenSSH: Update to 10.4p1")
Differential Revision: https://reviews.freebsd.org/D60922
(cherry picked from commit 2d6f961164e4ab7e823972336dc9cfaae6a88ed8)
esp: Allocate the crypto request and its callback state together
esp_input() and esp_output() allocated a cryptop from the crypto layer,
then malloc'ed the xform_data the callback needs, and with ESN a third
buffer for the separate AAD. The callback freed all three. That is
two or three allocation pairs for every packet.
Put the three in one structure, allocated once per packet from a
dedicated UMA zone. The crypto layer provides crypto_initreq() and
crypto_destroyreq() for an embedded cryptop, as wg(4) and ktls use.
The AAD buffer is sized for the ESP header, the longest IV and the
high-order half of the sequence number, which is all the separate AAD
can hold.
No functional change intended.
Reviewed by: markj
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D61395
nvme: honor CRTO for the controller ready timeout
CAP.TO is a 8b field and saturate at 127.5 seconds; a controller
that needs longer reports the real worst case in CRTO.CRWMT.
Waiting only CAP.TO can reset a controller that is still within its declared
recovery time after e.g. an abrupt shutdown.
Taking the larger of CRTO.CRWMT and CAP.TO when CAP.CRWMS show CRTO support.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D59631
atf-check: Add shortcut for not-exit:0
Allow the command to be preceded by an exclamation point, which changes
the default expected result to a clean exit with a non-zero exit code.
MFC after: 1 week
Sponsored by: Klara, Inc.
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D58099
tftpd: Keep proper track of option length
When parsing options, keep track of the length of the unparsed portion
and pass that to get_field() instead of the length of the entire header.
While here, switch both make_options() and parse_options() to using
size_t for sizes and lengths.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D61048
tftpd: Keep proper track of header length
When parsing a header, keep track of the length of the unparsed portion
and pass that to get_field() instead of the length of the entire header.
Reported by: n0ps1ed
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60902
tftpd: Fix off-by-one in get_field()
Due to a logic error, get_field() would behave as if the passed-in size
was one greater than it actually is. Fix it so it always fails if no
terminating NUL is found within the buffer, instead of succeeding if the
first byte past the end is a NUL.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D61032
