BSD Commit Log Search

   sync libexpat minor bump

   libexpat has new test files to build;  reminded by tb@

   Update libexpat to version 2.9.0

   Relevant for OpenBSD are security fixes #1392 #1393, bug fixes
   #1387, new features #1327 #1323, other changes #1394 #1399 #1400
   #1401 #1402 #1404 #1405.  Minor library bump is necessary for API
   extension.
   CVE-2026-102633 CVE-2026-77214

   OK tb@

   sys/octeon: span work queue interrupts across CPUs

   It was disabled at octciu.c,v 1.20 to allow fixing logic of ncpus which
   leads to issues with devices where used cnmac wasn't mapped to CPU0

   Now, since the missed splx() was added at clock.c, v1.54 I revert it back.

   OK: visa@

   sys/mips64: add missed splx()

   Seems it was missed since clock.c,v 1.47

   OK visa@

   sys/cnmac: enable HW offload for VLAN

   Tested by Nazarenko Mykyta

   OK: kn@, visa@

   Take a reference to client when menu is opened in case it is closed,
   from someone in GitHub issue 5801.

   Do not show a status message on a client with no session, from someone
   in GitHub issue 5799.

   rpki-client: sort arrays before handling temp files for ca state

   The handling of the tempfiles is placed in the middle of the preparation
   of the arrays to print. This commit moves it a bit down.

   There is no goto err between the calloc and the qsort, so this is safe.

   ok job

   Do not crash when locale(1) is run with "--" as its only argument.

   Spotted by vl_ms on Libera IRC

   Keep dead clients on a list so their queue can be flushed and they are
   not leaked, from someone in GitHub issue 5789.

   Free ranges correctly if style is not terminated, GitHub issue 5795 from
   mail at luftaquila dot io.

   Change back to the original working directory if fork fails when
   spawning a pane, GitHub issue 5793 from hrajyw4 at gmail dot com.

   Clear destination char when converting from wchar_t or the result could
   include stack garbage. GitHub issue 5792 from hrajyw4 at gmail dot com.

   httpd: replace server_match by server_bysocket and server_byname

   This reduces the complexity of the code slightly.

   OK kirill@

   drm/amd: Create a device link between APU display and XHCI devices

   From Mario Limonciello
   b030fde644501d0ed5e604fc01719d1daa9cd472 in linux-6.18.y/6.18.58
   75c8746b9d0a0317d8a58aa0efa2ff2f7359908b in mainline linux

   Update lang/ruby module documentation for the removal of Ruby 3.3

   Prioritise previously confirmed certification paths

   Duplicate SKI might appear because of reuse of a keypair (a poor CA
   practise, but not illegal) or because of 'public key stealing', i.e.,
   an adversarial CA issues a certificate containing the victim CA's SPKI
   and SIA. Because SKI might not be globally unique, certificates have
   been tracked by an internal identifier since 2024.

   Jacobsen et al., 2026, reported that rpki-client's certification path
   loop protection might be exploited if an adversary can race the victim.
   This race can happen in the discovery of the logical certification
   topology, unrelated to racing repository loading over the network. Any
   payload carrying objects (ROAs, ASPAs, etc) discovered through the
   adversary's certification path will fail resource containment checks and
   the loop guard (entity_process()->filepath_add()) necessarily enforces
   each object to be accessed only once. The result is that if the race is
   lost, the victim's payloads disappear from view.

   Some people incorrectly assert that RPKI resource certificates cannot

    [31 lines not shown]

   Handle the Emudhra intermediate cert compromise.
   See https://emudhra.we-have-a-problem.com/
   While likely all of Emudrha will be distrusted soon, currently
   a lot of India is using them. 8 intermediates under their CA3
   have publicly discoverable keys. the 9 others sign many sites.
   For now, remove CA3 from the trust store, thus distrusting all
   the intermediates it has signed, then add back the remaining
   9 uncompromised intermediates by "promoting" to a root, the
   usual intermediate elision technique.
   This enables real sites in india using these intermediates
   to still work. Assuming Emudhra ends up widely distrusted
   soon, we can remove these and the other roots after sites
   have had time to get new certificates.
   from beck@; OK tb@ sthen@

   dbupdate: Be consistent with name in messages.
   from dgl@; OK deraadt@

   force umask

    [45 lines not shown]

   Handle the Emudhra intermediate cert compromise.
   See https://emudhra.we-have-a-problem.com/
   While likely all of Emudrha will be distrusted soon, currently
   a lot of India is using them. 8 intermediates under their CA3
   have publicly discoverable keys. the 9 others sign many sites.
   For now, remove CA3 from the trust store, thus distrusting all
   the intermediates it has signed, then add back the remaining
   9 uncompromised intermediates by "promoting" to a root, the
   usual intermediate elision technique.
   This enables real sites in india using these intermediates
   to still work. Assuming Emudhra ends up widely distrusted
   soon, we can remove these and the other roots after sites
   have had time to get new certificates.
   from beck@; OK tb@ sthen@

   update cert.pem based on newer mozilla ca root store
   from sthen@; OK tb@

   dbupdate: Be consistent with name in messages.

    [48 lines not shown]

   Unfold short line

   Fix typo in err message

   OK tb@

   Simplify how entries in .nca_history are sorted

   "When did it break?" and "what broke?" really are the only two
   operationally relevant sorting properties for .nca_history.

   OK tb@

   Use generalized ca struct instead of ca_state for the NCA tree elements

   Suggested by claudio@

   OK tb@

   Acquire kqueue_ps_list_lock rwlock before the process search and found
   `pr' dereference. Otherwise found process can exit1() during context
   switch.

   Reported by Acts1631. ok claudio

   merge nsd 4.15.4

   import nsd 4.15.4, ok florian

   Fire window-layout-changed event when layout is changed by an option.

   Apply timeout to window size queries as well, GitHub issue 5777.

   rpki-client: report on non-canonically ordered addresses in ROAs

   This adds a warning (under verbose) if the ROAIPAddress families contain
   out of order elements. It also warns (always) if IPv6 comes before IPv4.
   The JSON output for ROAs in filemode grows a new noncanonical boolean.

   ok job