system: audit log injection via login username in auth_log()
* prevent syslog.filter splitting our messages
* remove newlines when flushing out local files
PR: GHSA-jjm2-jg4p-3v9q
system: selftest POC with OpenSSL FIPS
Feeds the FIPS config to the OpenSSL config, but needs
an untainted config to run. Wires base OpenSSL to use
the same FIPS module since base does not have one.
Activation confirmed by seeing fips for both base and
ports using:
# /usr(/local)/bin/openssl list -providers
system: selftest POC with OpenSSL FIPS
Feeds the FIPS config to the OpenSSL config, but needs
an untainted config to run. Wires base OpenSSL to use
the same FIPS module since base does not have one.
Activation confirmed by seeing fips for both base and
ports using:
# /usr(/local)/bin/openssl list -providers
interface: replace strstr()/strpos() with more precise str_starts_with()
This works for everything but VLANS which still need to check for an
inlie _vlan for backwards compatibility.
system: give WireGuard the same tunnel priority treatment #10819
In the defaults it may be preferred by default route checking.
For the default route we do not check if these are to be considered
upstream.
rc: add watchdog to shutdown, reboot and reload_all cases (#10813)
This will prevent shutdown/reboot actions from getting stuck indefinitely if a process misbehaves by ignoring the term signal. The timeout is set to 30 seconds and relies on the rc status call to provide a valid pid to determine if a process is stuck.
