BSD Commit Log Search

   rpki-client: change to sizeof(*ent) rather than using the type

   requested by job

   rpki-client: normalize on ent for struct entity in main.c

   ok job

   err(3) family functions should not be used with trailing \n
   ok tb florian

   Tidy up APC function.

   rpki-client: split entity_new() out of entityq_add()

   Upcoming work by job will use this small helper and doing this now reduces
   the size of the diff.

   ok job

   sys/simplepanel: add suspend and resume power control

   Enable this only for EDO1455.

   OK: deraadt@

   sys/qcdpc: save and restore panel state on suspend and resume

   Enable it only for EDO1455.

   OK: deraadt@

   Rename repo_stat_count_nonfunc to repo_stat_count_ca

   Alignment: this function is no longer being passed a 'nonfunc_ca' but a 'ca'

   OK tb@

   Do not set zero bits, and add imagescroll feature to kitty and ghostty.

   Update sizes when we get a WINSZ response.

   Add a temporary var.

   Track window scrolling for damage.

   Add flags to damage struct.

   Add imagescroll feature and capability.

   Only redraw when a feature changed.

   Handle multiple uncm(4) notifications per interrupt.

   Diff from Mikolaj Kucharski, who wrote:

   CDC 1.2 defines notifications as an 8-byte header carrying the length of
   the data that follows.  I don't know how notifications map to transfers.
   uncm_intr() assumes exactly one per transfer and silently ignores
   anything after it.  This walks the buffer by wLength, with every read
   bounds-checked against the received length.

   ok Jan Schreiber (uncm author), and myself

   Do redraw as two phases for text and images.

   sys/ufs: check vnode identity after vget

   From Acts1631

   OK: claudio@

   Redraw when pixel sizes change.

   Split insertion into the CA tree and the go/no-go on syncing a CA

   OK tb@

   rpki-client: implement filemode CMS prober using CBS

   This removes the last use of the garbage libcrypto CMS API in rpki-client.
   Good riddance.

   ok beck claudio job

   rpki-client: accept indefinite lengths in filemode

   ARIN special. In filemode re-encode the "der" buffer into definite
   length encoding. The DER parser can then deserialize the signed
   object. This miraculously works because of the way CMS signatures
   are computed: signedAttrs MUST be DER encoded (per RFC 5652, 5.3)
   and the value octets of the eContent do not use the invalid encoding
   (but its length octets do!). The signature and the message-digest
   attribute therefore check out despite this modification.

   I say "miraculous" above because this is partly because of how CMS
   works, but ARIN could also have used BER encoding for the eContent,
   breaking this hack. Rumor has it that there used to be a CA out
   there that used to use constructed encoding for octet strings.

   This unbreaks regress after the previous commit.

   ok and "oh dear god" beck
   ok claudio job

   rpki-client regress: get rid of no longer needed compat glue

   rpki-client: implement a CBS-based RFC 6488 parser

   This commit gets rid of the use of the crazy CMS API from libcrypto
   in normal mode, replacing it with CBS-based parsing code written from
   scratch. This only adds about 300 simple lines of code (according to
   cloc) to cms.c. A big part of the additions are copious comments.
                                                                                                    This ensures that whatever is parsed is properly DER encoded.
   One approach of fixing regress and enabling history spelunking
   is in the follow-up commit.

   The parser is essentially zero-copy with the following exceptions:

   - deserialization of the EE cert
   - signature validation needs some contortions because CMS is weird
   - parsing of signing-time

   Since we now get our hands on the raw cert DER, cert_parse_ee_cert()
   can be like the other cert parsing functions (except for the talid).
                                                                                                    This passes the fixture test and the one remaining TODO item is error

    [3 lines not shown]

   rpki-client: use expire time of the signature path for BRKs

   Previously, the expire time in the BRK tree was simply the notAfter in
   the BGPsec Router cert. This diff pushes the expire time for all certs
   to the main process and switches to using the signature path to compute
   the expire time. This way BRKs are treated the same way as VRPs and VAPs
   and will probably expire in the next hours up to a week rather than
   months from now.

   This also makes the data pushed to rtrd and stored in the json output
   match what file mode has reported since forever. Since we're still at
   exactly two BRKs in the entire RPKI it does not currently matter much.

   ok job rcovelli

   httpd: convert imsg handling to imsg_get_ and remove IMSG_SIZE_CHECK macro

   Tweak and OK claudio@

   httpd: use imsg_get_type

   OK tb@ claudio@

   httpd: use imsg_get_data to read ctl_flags

   OK claudio@

   undisable import script cleanup() function; debugging leftover

   fix mistake in rev 1.82 that resulted in an early exit()
   ok deraadt@