BSD Commit Log Search

   httpd: only rekey TLS tickets for the first server on a socket

   With several TLS servers on the same address + port and
   "tls ticket lifetime" option set, httpd died on the first ticket rekey.

   The parent started a rekey timer for every server, but only the first
   one on a socket exists as a struct server in the server processes.
   Start the rekey timer only for that server.

   Reported by James J. Lippard on bugs@ and stsp@, thanks!

   ok stsp@, kirill@

   force umask

   comment on why cachedir is created

   manually detect if this release has no databases available (yet)
   with a nice error message compared to errexit

   Register clock interrupt with ih_number zero and remove way obsolete message
   attempting to explain why 1 had been chosen previously.

   softintr_schedule() being now a simple wrapper over send_softint(), drop it
   and rename send_softint() to softintr_schedule().

   All uses of send_softint are of the form (ih->ih_pil, ih). Drop the first
   argument since it can be easily obtained from the second one. Also drop the
   check for a NULL ih as this will never happen.

   Replace hardcoded 10 for clock interrupt level with matching symbolic constant.
   Remove dead comments.

   All the *tick_trigger() simply wrap sparc64_raise_clockintr(), invoke the
   latter directly.

   All the *tickintr() bodies are nowadays identical, keep only one.

   copyright

   must be run as root
   pointed out by florian

   Sync to unbound 1.26.2; heavy lifting by sthen

   ksh #!, and use consistent $(..) rather than mostly that and a few ``

   Get the pane's bufferevent when needed for replies rather than caching
   it and end up using it after free. GitHub issue 5785 from Alejandro
   Pacheco.

   merge unbound 1.26.2

   import unbound 1.26.2, ok phessler

   CVE-2026-50106, Possible insecure NXDOMAIN for non-existing
   records under a configured island trust anchor underneath an
   insecure parent.

   CVE-2026-96405, Aggregate DNS name chained pointer decompression
   work leads to degradation of service.

   CVE-2026-109125, Possible cache poisoning vulnerability via
   a cache side-channel exposed by 'unwanted-reply-threshold'.

   CVE-2026-35501, Bypass of a configured island trust anchor
   underneath an insecure parent from an attacker-controlled NSEC
   record.

   skip backlight init when there is no display controller

   Avoids a panic on discrete Intel graphics with no display, when
   iterating over connectors to attach a backlight property.
   Connector state is only initialised when there is a display controller.

   reported by obugs at usrx11

   Apply palette to underscore colour before checking for change, same as
   foreground and background.

   rpki-client: use if (verbose) instead of if (verbose > 0) for consistency

   prompted by job

   Rename MODGCC4 -> MODGCC

   OK: sthen@

   Fix status drag targeting across window labels, GitHub issue 5778 from
   Michael Grant.

   Keep a search match in the pane when it has fewer than four rows, from
   someone in GitHub issue 5781.

   Have only one pane own shared corners so they are drawn with the active
   pane, GitHub issue 5784 from Richard Dodson.

   Extend REP limit to allow it to wrap on to the next line, GitHub issue 5780.

   isakmpd(8): Fix various remotely triggerable crashes

    - Only accept authenticated DPD notifications with a well-formed payload.
    - Check the notify payload length against the SPI size.
    - Fail AES key setup on invalid key lengths.
    - Reject encrypted messages whose length is zero or not a multiple
      of the cipher block size.
    - Do not free the caller's certificate in x509_cert_get_key().
    - Do not run exchanges that are already finalized.

   with markus@, some input from tb@, ok deraadt@

   struct mfii_ld_map shouldn't have changed with the addition of MFII_MAX_LD
   as it describes a response to a management command.  Changing this broke
   the driver's ability to see non-raid disks.

   problem reported by sonicsmith at gmail dot com
   ok dlg@

   in dry mode, do not update the hashes remembered for next time

   openssl: warn against use of this pile of garbage for serious use

   ok job kenjiro

   small cleanups. no behavior changes.

   OK deraadt@ tb@