ktls: Add a tunable to disable TLS receive
TLS receive offload is really only beneficial for in-kernel use cases
(such as NFS over TLS) or when using a hardware offload. In addition,
several recent SAs have involved the TLS receive path, but the only
current mitigation for those is to disable TLS offload entirely.
Reviewed by: ziaee, gallatin, markj
Relnotes: yes
Sponsored by: Netflix
Sponsored by: Chelsio Communications
Co-authored-by: John Baldwin <jhb at FreeBSD.org>
Differential Revision: https://reviews.freebsd.org/D57974
ktls: Centralize the check for CBC ciphers
Move the check out of ktls_enable_(rx|tx) and into ktls_create_session.
Reviewed by: gallatin, markj
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D57973
security/vuxml: add FreeBSD SAs issued on 2026-06-30
FreeBSD-SA-26:37.vm affects all supported releases
FreeBSD-SA-26:38.jail affects 15.0R and 15.1R
FreeBSD-SA-26:39.execve affects all supported releases
FreeBSD-SA-26:40.zfs affects all supported releases
FreeBSD-SA-26:41.libalias affects all supported releases
FreeBSD-SA-26:42.unlinkat affects all supported releases
FreeBSD-SA-26:43.tcp affects all supported releases
FreeBSD-SA-26:44.posixshm affects all supported releases
FreeBSD-SA-26:45.audit affects all supported releases
FreeBSD-SA-26:46.ktls affects all supported releases
FreeBSD-SA-26:47.linux affects 14.3R, 14.4R and 15.0R
FreeBSD-SA-26:48.compat32 affects 14.3R, 14.4R and 15.0R
FreeBSD-SA-26:49.iconv affects all supported releases
pkgconf: match the update to version 2.9.93
This update brings spdxtool(1), with the ability to generate software
bill of material files (SBOM) in the SPDX 3.0.1 format (JSON-LD).
Reviewed by: markj
Approved by: markj
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57953
asmc: try PIO before MMIO to avoid false T2 detection
Add hw.asmc.system-state and hw.asmc.board-id read-only sysctls to
expose the T2 system state register and Mac board identifier via SMC.
Try PIO access before MMIO during probe to prevent false T2 detection
on Macs that happen to have something mapped at the T2 BAR address.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57844
net80211: fix CCMP/GCMP AAD for MFP frames
Update ieee80211_crypto_init_aad() to do what 802.11-2020 says -
only mask fc[0] bits 4-6 on data frames, not on management frames.
This (with other diffs to actually negotiate MFP and configure
ath(4) for MFP + software keys) allows the CCMP path to decrypt
CCMP MFP frames in the software path.
Differential Revision: https://reviews.freebsd.org/D57799
asmc: deduplicate sensor converters and cause sysctls
Replace per-type spXX_to_milli() functions with a table-driven
asmc_sensor_convert() that looks up the divisor by SMC type string.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57854
asmc: add system state and board identity sysctls
Add dev.asmc.0.system subtree with read-only sysctls for SMC diagnostic
and identity keys: shutdown_cause (MSSD), sleep_cause (MSSP),
thermal_status (MSAL), time_of_day (CLKT), power_state (MSPS),
board_id (RPlt), and chip_gen (RGEN).
Each sysctl is registered only if the key exists on the hardware.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57853
bhyve: Add CPU pinning diagnostic message
When pinning a vcpu to a hostcpu fails, print out a diagnostic message
to stderr indicating the failing CPU pair.
MFC after: 1 month
Reviewed by: bnovkov
Differential Revision: https://reviews.freebsd.org/D57619
security/wolfssl: Bump PORTREVISION of dependent ports for shlib change (followup of ebd1ab3805d31a82613a1db818e6dc2bf5cdf75d)
wolfssl was updated to 5.9.2 in ebd1ab3805d31a82613a1db818e6dc2bf5cdf75d which
updates from libwolfssl.so.44 to libwolfssl.so.45. Therefore, PORTREVISION bump
is required. ftp/curl and net/libngtcp2-wolfssl are skipped because both ports
have version updates after ebd1ab3805d31a82613a1db818e6dc2bf5cdf75d.
% readelf -d /usr/local/lib/libwolfssl.so | grep SONAME
0x000000000000000e (SONAME) Library soname: [libwolfssl.so.45]
lang/python-tools: Fix build with Python 3.12+
- While I'm here:
- Reorder knobs
- Sort USE_PYTHON
- Remove WRKSRC_SUBDIR
- Cosmetic change
These scripts have been removed from python 3.12+ repository [1][2][3].
===> Patching for py312-python-tools-3.12.13_1
find: byteyears.py: No such file or directory
find: copytime.py: No such file or directory
find: crlf.py: No such file or directory
find: dutree.py: No such file or directory
find: lfcr.py: No such file or directory
find: ptags.py: No such file or directory
find: untabify.py: No such file or directory
*** Error code 1
[5 lines not shown]
devel/py-freebsd: Fix build with Python 3.12+
cc -fno-strict-overflow -Wsign-compare -Wunreachable-code -DNDEBUG -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -fPIC -I/usr/local/include/python3.12 -c src/freebsdmodule.c -o build/temp.freebsd-15.0-RELEASE-p10-amd64-cpython-312/src/freebsdmodule.o
In file included from src/freebsdmodule.c:172:
In file included from src/.sources.def:7:
src/kqueue.c:248:2: error: incompatible pointer to integer conversion initializing 'Py_ssize_t' (aka 'long') with an expression of type 'void *' [-Wint-conversion]
248 | PyObject_HEAD_INIT(NULL)
| ^~~~~~~~~~~~~~~~~~~~~~~~
/usr/local/include/python3.12/object.h:142:9: note: expanded from macro 'PyObject_HEAD_INIT'
142 | (type) \
| ^~~~~~
In file included from src/freebsdmodule.c:172:
In file included from src/.sources.def:7:
src/kqueue.c:556:2: error: incompatible pointer to integer conversion initializing 'Py_ssize_t' (aka 'long') with an expression of type 'void *' [-Wint-conversion]
556 | PyObject_HEAD_INIT(NULL)
| ^~~~~~~~~~~~~~~~~~~~~~~~
/usr/local/include/python3.12/object.h:142:9: note: expanded from macro 'PyObject_HEAD_INIT'
142 | (type) \
| ^~~~~~
[7 lines not shown]
textproc/py-mistune0: Fix build with Python 3.12+
Traceback (most recent call last):
File "<frozen runpy>", line 198, in _run_module_as_main
File "<frozen runpy>", line 88, in _run_code
File "/usr/local/lib/python3.12/site-packages/installer/__main__.py", line 115, in <module>
_main(sys.argv[1:], "python -m installer")
File "/usr/local/lib/python3.12/site-packages/installer/__main__.py", line 100, in _main
with WheelFile.open(wheel) as source:
^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/contextlib.py", line 137, in __enter__
return next(self.gen)
^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/site-packages/installer/sources.py", line 179, in open
with zipfile.ZipFile(path) as f:
^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/zipfile/__init__.py", line 1352, in __init__
self.fp = io.open(file, filemode)
^^^^^^^^^^^^^^^^^^^^^^^
[4 lines not shown]
