mbuf: Match TCP RSS hash types exactly
RSS hash types are encoded values, not independent flags. The bitmask
check in M_HASHTYPE_ISHASH_TCP() also accepts UDP, address-only and opaque
hash types, causing the syncache to retain them instead of falling back
to a software TCP hash.
Compare against the three TCP four-tuple hash types after masking the
inner-header flag. Keep the existing macro interface and use an inline
helper to preserve single evaluation of its argument.
Add ATF coverage for all 256 hash-type byte values, including inner-header
hashes, and verify single evaluation of the mbuf argument.
Reviewed by: cc, gallatin
Fixes: a485399f8834 ("tcp: restrict flowtype copying to specific RSS TCP types")
Sponsored by: BBOX.io
graphics/photoqt: Update to 5.4.1
- Switch to Qt 6
- Rework options for the new WITH_* CMake switches
- Add patch to use extattr(2) for star ratings
- Add patch to show QR/barcode detection when built with ZXingQt
- Enable tests
- Drop patch merged upstream
- Take maintainership
- Remove deprecation
ChangeLog: https://photoqt.org/changelog
MFH: 2026Q4
(cherry picked from commit 2fb8dc192150d854a68f85fc3a1ead3061db2ab6)
atf: refer to `common.mk` using `SRCTOP`
This helps make the dependent Makefile (and the values contained within)
easier to catch when upgrading atf in the future.
MFC after: 1 week
Change invalid reference LE_Set_Scan_Parameters to LE_Set_Scan_Param
hccontrol(8) lists "LE_Set_Scan_Parameters" as a subcommand, but it does
not work on recent releases. Use the LE_Set_Scan_Param instead as that
seems to be the new name according to the source file. Update the man
page accordingly.
PR: 300178
Event: Oslo Hackathon 2026
net/samba423: update to 4.23.13
Changes since 4.23.12
---------------------
* BUG 16097: POSIX ACL backend silently discards errors when processing NT
ACLs with non-canonical ordering
* BUG 15962: SMB3 SESSION SETUP responses must always be signed
* BUG 16081: winbindd_child_msg_filter: talloc_get_type_abort crashes when
winbind max domain connections > 1
* BUG 16239: Fix parsing of uppercase "0X" hex values in the "kdc default
domain supported enctypes" smb.conf parameter.
* BUG 16240: smbd temporary mkdir name can exceed NAME_MAX for otherwise
valid client names
* BUG 16258: Python smbconf transaction_start() lacks a talloc stack frame
with CTDB
* BUG 16254: CTDB database operations can be run against incorrect nodes
Reported by: portscout
[3 lines not shown]
net/samba424: update to 4.24.8
Changelog:
* BUG 16200: generate_unique_u64() may not protect against veto_value
* BUG 16261: Rename with ReplaceIfExists to a target differing only in case
creates a duplicate instead of replacing (regression in
bb130f32)
* BUG 15962: SMB3 SESSION SETUP responses must always be signed
* BUG 16081: winbindd_child_msg_filter: talloc_get_type_abort crashes when
winbind max domain connections > 1
* BUG 16200: generate_unique_u64() may not protect against veto_value
* BUG 16239: Fix parsing of uppercase "0X" hex values in the "kdc default
domain supported enctypes" smb.conf parameter.
* BUG 16240: smbd temporary mkdir name can exceed NAME_MAX for otherwise
valid client names
* BUG 16258: Python smbconf transaction_start() lacks a talloc stack frame
with CTDB
* BUG 16254: CTDB database operations can be run against incorrect nodes
* BUG 16273: A node can be banned because it tries to run recovery after
[11 lines not shown]
net/samba424: avoid SIGFPE in streams_xattr_get_ea_value_fsp
As reported in https://bugzilla.samba.org/show_bug.cgi?id=16278,
upstream commit 5fa43440ebd3 ("vfs: Implement larger streams in multiple
xattrs"), results in many signal 8 (SIGFPE) crashes in smbd child
processes on FreeBSD, if the streams_xattr vfs module is loaded.
This is because streams_xattr_get_ea_value_fsp() can divide by zero, if
the "max xattrs per stream" is left at its default value.
Apply the upstream fix to avoid the crashes.
PR: 299445
Obtained from: https://gitlab.com/samba-team/samba/-/commit/21f8b339
MFH: 2026Q4
Approved by: samba (kiwi)
(cherry picked from commit bca7a3d068b463dcb5ae86e9405c99447b5131d0)
net/samba424: restore missing FreeBSD mDNS/dns_sd support (MDNSRESPONDER)
Three FreeBSD-local patches providing dns_sd/mDNSResponder support
(present identically in net/samba419, 420, 422, and 423) were silently
dropped when net/samba424 was created, all gated behind the
non-default MDNSRESPONDER port option (default is AVAHI):
- source3/wscript/wscript_build: the --enable-dnssd waf option
(dns_sd.h/DNSServiceRegister detection, WITH_DNSSD_SUPPORT define,
dns_sd library linkage into smbd_base and smbclient) never existed
in samba424 at all.
- source3/smbd/dnsregister.c: the FreeNAS-authored mDNS
advertise-per-interface fixes. Only the companion
source3/client/dnsbrowse.c half of this combined patch survived
into samba424; the dnsregister.c half was lost.
- Makefile: MDNSRESPONDER_CONFIGURE_ENABLE=dnssd, so selecting the
MDNSRESPONDER option actually passes --enable-dnssd to waf.
Without all three, selecting MDNSRESPONDER builds without functional
[14 lines not shown]
libthr: Robust tryjoin test
We cannot actually rely on a status (finish) before thr_exit. The
thread needs the kernel signal status=1 to userspace. Before that,
any tryjoin fails. The previous one works as we sleep 1 and should be
enough for normal case.
Reviewed by: kib, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60832
vm_kern: wrap around in kmem_back() when the last domain is empty
kmem_back() picks the domain from the address and, when that domain has
no memory, steps forward until it finds one that does:
domain = (addr >> KVA_QUANTUM_SHIFT) % vm_ndomains;
while (VM_DOMAIN_EMPTY(domain))
domain++;
Nothing stops the walk at vm_ndomains. When the empty domain is the
last one, the loop runs through the unused tail of vm_dom[] (all empty)
and on into whatever follows vm_dom[MAXMEMDOM] in memory, until a word
there happens to look like a non-zero page count; kmem_back_domain()
then allocates from that garbage domain. Ordinary allocations never
get here, because the per-domain arenas and the domainset iterators
skip empty domains. Only the direct callers of kmem_back() do: kinst
(one trampoline per thread, allocated when the module loads) and
memguard.
[6 lines not shown]
dns/cmdns-cli: New port
https://cmdns.dns-oarc.net/ is a custom developed DNS nameserver
that creates dynamic delegated subdomains to enable clients to query
for never-seen-before resource records in order to support a
general-purpose framework for testing DNS resolvers.
This is the command line client that you can run locally,
this will allow you to specify which resolver to test against.
Note: run tests with -done, otherwise it looks like it hangs
Example: cmdns-cli -suite standard -done
