relayctl: rework show output and add -v flag
- Added -v flag for more detailed output.
- Replaced tab separators with space-padded, truncated columns (%.Ns) for
stable alignment.
- Added a new "Checks" column for host checks (N/N), replacing the total: N/N
checks sub-line.
- Shortened redirect to rdr in the Type column to stay under 80 columns.
- Without -v: compact status (down); with -v: error inlined (down (tcp connect
timeout)).
- Table status shows host count (N hosts) only with -v.
- retries sub-line only appears with show hosts -v.
- show hosts no longer lists tables; use show summary for that.
OK kirill@
libssl: fix API misuse in legacy finished handling
This looks like a potential out of bounds read or allowing trailing garbage
in peer_finished. It's harmless because CBS_len() is compared against the
s->s3->hs.peer_finished_len a few lines up, thus it is only cosmetic.
discussed with jsing
ok kenjiro
uaudio: Ignore transfer completions if audio is halted
When audio is halted, the pipes are closed and the corresponding usb
transfer completion functions are called immediately. For certain
devices the status of the feedback pipe is USBD_NORMAL_COMPLETION,
which triggers further processing of the received data.
Fixes the harmless "uaudio0: sync play xfer, err = 6" messages on
the console.
Disable the -fomit-frame-pointer optimisation by default.
The frame-pointer is needed to have good backtraces from e.g ddb or
ptrace / btrace. Many other distros did something like this as well since
the benfit of havving easy to work with backtraces outweights the little
overall speedup gained by having an extra register.
Also disable -mno-omit-leaf-frame-pointer by default on llvm.
OK kettenis@
libssl: ensure server selected ALPN was advertised
Per RFC 7301, section 3.2, "In the event that the server supports no
protocols that the client advertises, then the server SHALL respond
with a fatal "no_application_protocol" alert.
If a server does not do that and chooses a protocol that we have not
advertised, we should abort the handshake. The RFC does not specify
an alert for this case. BoringSSL chose illegal_parameter and OpenSSL
decode_error. I slightly prefer illegal_parameter, so went with that.
Reported by Acts1631 with a similar diff.
ok jsing kenjiro
tlsext_alpn_client_process(): rename list and proto
Use server_list and selected instead of list and proto to reduce noise
in the next commit.
ok jsing kenjiro
Make sure to build kernel files with -fno-pie; this had been forgotten while
switching the m88k toolchain to PIE by default, and I am quite impressed
kernels built with PIE objects run without problems.
Remove replaying of the 88100 data pipeline in sigreturn().
This had been added during the r1.18->r1.22 changes to let the testcases from
the devel/libsigsegv run.
Contrary to what I wrote then, the pipeline gets replayed when returning to
userland to invoke the signal handler, so there is no need to do this once more
in sigreturn.
The real fix needed for these testcases to run reliably, was to make sure that
the address used to spill the sigcontext on the process stack would not get
modified while running data_access_emulation(); this logic was eventually
fixed in r1.21, and nothing more is needed.
Thanks to Andrew Griffiths for pointing to my attention that the data fed to
sigreturn() was partially user-controllable, and that carefully crafted
signal handlers could use this behaviour as unprivileged kernel memory read
and write operations.
import upstream pkgconf regress
The Makefile is adapted to bsd.regress.mk from upstream's Makefile.lite
(also imported) in such a way that the diff is as small as possible, so
that it should be reasonably easy for me to keep it in sync with upstream
releases.
Use unveil(2) to restrict write access to mandoc.db(5) and /tmp/
and read access to the selected manpath directory or directories,
but leave global read access open in -t mode.
Tweaks from and looks correct to deraadt@.
Update to pkgconf 3.0.6
This mostly adds OS/2 support. The only change relevant for OpenBSD is
- --variable accepts multiple modules and prints the requested
variable's value for each module, in argument order. --path and
--print-variables remain limited to a single module.
Which is the diff in cli/core.c. Apart from that little to nothing
changes for us (some #ifdefs cause line numbers to change).
ok djm
pkgconf: remove stale file
This somewhat outdated file snuck in by mistake in the last update.
It was not compiled into the binary because libpkgconf precedes cli
in .PATH, so the up-to-date libpkgconf/tuple.c file was used.
Found while working on hooking up upstream pkgconf regress where the
.PATH order was inverted in my WIP.
find,ls: Ensure -ls output matches ls -dils as documented; print the
epoch if localtime() fails. Synchronize the code with ls, so it always
checks localtime()'s return value.
ok tb@
stat: Show the stringified epoch if localtime() fails. Avoids segfault
on out of range time values. The raw value can still be obtained with
stat -f %m.
ok tb@
fw_update could be tricked into treating the untrusted comment as data.
In some situations (-a) this could be passed into fetch(), which did not
validate what it passed to su(1). Use the trusted output of signify and
add stricter validation.
with & ok afresh1@
Rewrite the imsg code to be more modern.
Split the code into independent send and recv functions that properly
send some of the more complex messages without leaking extra data or
causing problems on recv (e.g. by passing string buffers).
This also kills the send_imsg wrapper which kind of is the cause that
everything was passed as one big blob.
OK rsadowski@
