ifconfig: Improve CMIS parsing of breakout configs
This fixes a bug where we do not report all lanes when
a NIC configures a breakout. Eg, we reported all 4
lanes when a NIC configured the optics as 1x400g, but
only printed the first lane's strength when configured as
4x100g.
Fix this by actually parsing the active lane count, rather
than pulling it from the default descriptor.
While here, optionally print page 10h when -vvvv is
specified. This aids in determining how a breakout is configured.
I put it under an extra level of verbosity, as I don't want
to let things get out of hand printing CMIS pages.
Sponsored by: Netflix
Reviewed by: kib, sumit.saxena_broadcom.com
Differential Revision: https://reviews.freebsd.org/D58263
security/vuxml: Fix giflib entry
The update to 6.1.3 already contains in files/ a patch for CVE-2026-26740 so use
lt instead of le to fix the version range.
PR: 296876
pf: attempt to handle overlapping group and interface names
pf assumes that network groups and network interfaces share a namespace
(that is, a name is unused, a group or an interface, never both a the
same time). Unfortunately this assumption was broken when interface
renaming was introduced.
Attempt to cope with this rather than panicking. Note that this is a
band-aid, not a full solution. The correct fix is for the network stack
to go back to enforcing a single namespace for groups and interfaces.
PR: 297220
Reported by: Robert Morris
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
pf: fix securelevel off-by-one
cmd_securelevel is the securelevel at which the call should be denied.
pf (write) calls should be denied at level 3 or up (not at 2 or up as it
was), so increment these all by one.
PR: 296838
MFC after: 4 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D58377
netinet6: Fix some issues with passing v4-mapped groups to IPv6 sockets.
1. EFAULT was happening because sooptcopyin() from inp_join_group() was
seeing the user-space thread descriptor in the faked-up sockopt. So, do
not attempt a user copyin(); defer to C99 initialization nulling sopt_td
for us to force a KVA memcpy().
2. It seems necessary to byte-swap ipv6mr_multiaddr.s6_addr32[3] on amd64
for similar reasons as to how the user-space initialization needed for
passing an IPv4-mapped group address also requires byte-swapping of the
0x0000FFFF field for s6_addr32[2]; it is a direct assignment to a integer
member of a struct, NOT a memcpy().
3. The assignment to imr_interface within in6_v6_mreq_to_v4() was obfuscated
by a cast back to its own type due to use of the IA_SIN() macro. Elided.
With this change, the feature gap seems to be closed; tested with a simple
link-scope IPv4 group under 224.0.0.0/24 with an mlx5(4) SR-IOV VF in bhyve.
[2 lines not shown]
mtest: Add support for exercising IPv4-mapped groups on IPv6 sockets.
This is in lieu of a full Kyua/ATF regression test, as this is an optional
feature that was beyond the scope of IETF's normative references for IPv6
multicast; support has been strictly on a best-effort basis.
Two new commands are added to mtest(8):
u mcast-addr ifname - join IPv4-mapped group on IPv6 socket
v mcast-addr ifname - leave IPv4-mapped group on IPv6 socket
Add an internal helper function __in6_v4_to_v4mapped() to perform the
converse of the IN6_IS_ADDR_V4MAPPED() check to support this use case.
Whilst __in6_v4_to_v4mapped() returns its first argument as a convenience,
avoid the temptation to dereference a pointer to that which we already hold.
Strictly the use of sockunion_t within mtest(8) more generally is a form
of controlled type punning (aliasing). Use a temporary as we overwrite
contents of su; the resultant write would overlap memory locations.
[2 lines not shown]
www/angie-module-lua: Unbreak build after update
The module was updated but files/patch-lua-config still pointed
to the old working directory.
PR: 297198
Reported by: Sebastian Oswald <sko at rostwald.de> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q3
(cherry picked from commit 565dc2c4047d886d51024ec852352e26a7bb7c5a)
www/angie-module-jwt: update 3.4.4 => 3.4.5
Trigger CI on test files and workflow changes
Commit log:
https://github.com/max-lt/nginx-jwt-module/compare/v3.4.4...v3.4.5
PR: 297199
Reported by: Sebastian Oswald <sko at rostwald.de> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q3
www/angie-module-lua: Unbreak build after update
The module was updated but files/patch-lua-config still pointed
to the old working directory.
PR: 297198
Reported by: Sebastian Oswald <sko at rostwald.de> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q3
ppp: Avoid overflow when formatting endpoint discriminator options
Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have. Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.
Reported by: Joshua Rogers <joshua at joshua.hu>
Tested by: Décio Brandão (0xDBJ)
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58555
net-im/libsignal: fix build on powerpc64*
ring-sys 5.0.2] /wrkdirs/usr/ports/net-im/libsignal/work/target/release/build/boring-sys-ef33d39251a122cc/out/boringssl/crypto/fipsmodule/../internal.h:230:2: error: "Must define either OPENSSL_32_BIT or OPENSSL_64_BIT"
