phessler [Sat, 24 Feb 2018 10:39:35 +0000 (10:39 +0000)]
add an alias for vmctl show, matches finger memory and the rest of the
*ctl programs
OK mlarkin@ benno@ deraadt@
kettenis [Sat, 24 Feb 2018 09:45:10 +0000 (09:45 +0000)]
Make ncpusfound count the available processors even if they don't attach.
ok patrick@
dlg [Sat, 24 Feb 2018 08:53:36 +0000 (08:53 +0000)]
make the gre flowid output always 2 chars so payloads stay lined up.
dlg [Sat, 24 Feb 2018 07:20:04 +0000 (07:20 +0000)]
when comparing nvgre entries, compare a with b, not a with itself.
dlg [Sat, 24 Feb 2018 06:31:47 +0000 (06:31 +0000)]
return early on some unhandled ioctls rather than err().
kettenis [Fri, 23 Feb 2018 21:47:08 +0000 (21:47 +0000)]
Disable mailbox interrupts on all cores upon attach instead of enabling the
mailbox 0 interrupt on all cores. Seems to make GENERIC.MP work on the rpi3.
krw [Fri, 23 Feb 2018 21:39:58 +0000 (21:39 +0000)]
'partions' -> 'partitions', nuke some erroneous whitespace.
ok otto@
schwarze [Fri, 23 Feb 2018 21:34:37 +0000 (21:34 +0000)]
After opening a file with gzdopen(3), we have to call gzclose(3) or
we leak memory internally used by zlib to keep compression state.
Bug reported by Wolfgang Mueller <vehk at vehk dot de> who also
provided an incomplete patch, part of which i'm using in this commit.
schwarze [Fri, 23 Feb 2018 19:12:09 +0000 (19:12 +0000)]
In bio.h rev. 1.34 2018/02/20 17:15:27, jsing@ provided
BIO_get_new_index(3), in rev. 1.37 2018/02/20 18:13:31, tb@ provided
BIO_meth_get_read(3), BIO_meth_get_puts(3), BIO_meth_get_gets(3),
BIO_meth_get_ctrl(3), BIO_meth_get_create(3), and BIO_meth_get_destroy(3),
and in rev. 1.38 2018/02/20 18:17:17 BIO_meth_get_callback_ctrl(3)
and BIO_meth_set_callback_ctrl(3).
BIO_meth_get_write(3) will become public with the next minor bump.
Merge the documentation from OpenSSL, tweaked by me, OK tb@.
kettenis [Fri, 23 Feb 2018 19:08:56 +0000 (19:08 +0000)]
Get rid of the cpu_on_fn hook and call the psci(4) functions directly instead
like we already do in the code that flushes the BTB.
ok jsg@
schwarze [Fri, 23 Feb 2018 18:53:49 +0000 (18:53 +0000)]
clarify documentation of macro keys
schwarze [Fri, 23 Feb 2018 18:24:41 +0000 (18:24 +0000)]
Logically, the following are are type names - just like .Vt,
some of them with an optional variable name following:
- .Ft
- .Fa in the SYNOPSIS
- .Fn second and later arguments in the SYNOPSIS
So add these to the .Vt macro table in the mandoc.db(5) database.
During my LibreSSL work, i'm getting really tired of typing
$ man -k Vt,Ft,Fa=some_type_name
over and over again; now, this becomes just:
$ man -k Vt=some_type_name
markus [Fri, 23 Feb 2018 15:58:37 +0000 (15:58 +0000)]
Add experimental support for PQC XMSS keys (Extended Hash-Based Signatures)
The code is not compiled in by default (see WITH_XMSS in Makefile.inc)
Joint work with stefan-lukas_gazdag at genua.eu
See https://tools.ietf.org/html/draft-irtf-cfrg-xmss-hash-based-signatures-12
ok djm@
visa [Fri, 23 Feb 2018 15:41:08 +0000 (15:41 +0000)]
Drop redundant bzero() calls. ses_ghash is allocated with M_ZERO, so
it is unnecessary to zero the struct's fields right after allocation.
OK mikeb@
schwarze [Fri, 23 Feb 2018 14:50:21 +0000 (14:50 +0000)]
In dh.h rev. 1.22 2018/02/20 17:38:15, tb@ provided
DH_clear_flags(3), DH_test_flags(3), and DH_set_flags(3),
in rev. 1.24 2018/02/20 18:01:42 DH_set_length(3), and
in rev. 1.25 2018/02/22 16:41:04, jsing@ provided DH_get0_engine(3).
Merge the documentation from OpenSSL, tweaked by me.
schwarze [Fri, 23 Feb 2018 12:16:08 +0000 (12:16 +0000)]
In bn.h rev. 1.38 2018/02/20 17:13:14, jsing@ provided
BN_GENCB_new(3), BN_GENCB_free(3), and BN_GENCB_get_arg(3).
Merge the documentation from OpenSSL, verbatim.
jmc [Fri, 23 Feb 2018 09:50:30 +0000 (09:50 +0000)]
various tweaks; ok dlg
jmc [Fri, 23 Feb 2018 07:38:09 +0000 (07:38 +0000)]
some cleanup for BindInterface and ssh-keyscan;
dlg [Fri, 23 Feb 2018 07:05:39 +0000 (07:05 +0000)]
regen
dlg [Fri, 23 Feb 2018 07:04:57 +0000 (07:04 +0000)]
masanobu saitoh pointed out i had the wrong id for XXV710 SFP28 devs
akoshibe [Fri, 23 Feb 2018 05:17:39 +0000 (05:17 +0000)]
Add unsetrdomain() and option -rdomain to return an interface to routing
domain 0.
OK phessler, henning, deraadt, stsp, benno
djm [Fri, 23 Feb 2018 05:14:05 +0000 (05:14 +0000)]
Add ssh-keyscan -D option to make it print its results in SSHFP format
bz#2821, ok dtucker@
dtucker [Fri, 23 Feb 2018 04:18:46 +0000 (04:18 +0000)]
Add missing braces.
Caught by the tinderbox's -Werror=misleading-indentation, ok djm@
dlg [Fri, 23 Feb 2018 03:03:36 +0000 (03:03 +0000)]
lint fix
djm [Fri, 23 Feb 2018 03:03:00 +0000 (03:03 +0000)]
unbreak interop test after SSHv1 purge;
patch from Colin Watson via bz#2823
dlg [Fri, 23 Feb 2018 03:01:34 +0000 (03:01 +0000)]
add a SECURITY CONSIDERATIONS section.
mdoc(7) says that section goes last, which is where i put it. i
kind of want it before EXAMPLES though.
dlg [Fri, 23 Feb 2018 02:52:28 +0000 (02:52 +0000)]
provide some (probably too many) nvgre(4) examples
djm [Fri, 23 Feb 2018 02:34:33 +0000 (02:34 +0000)]
Add BindInterface ssh_config directive and -B command-line argument
to ssh(1) that directs it to bind its outgoing connection to the
address of the specified network interface.
BindInterface prefers to use addresses that aren't loopback or link-
local, but will fall back to those if no other addresses of the
required family are available on that interface.
Based on patch by Mike Manning in bz#2820, ok dtucker@
dlg [Thu, 22 Feb 2018 23:03:34 +0000 (23:03 +0000)]
try to fix the nvgre words a bit
naddy [Thu, 22 Feb 2018 22:43:20 +0000 (22:43 +0000)]
sync
dlg [Thu, 22 Feb 2018 22:17:01 +0000 (22:17 +0000)]
speeling
schwarze [Thu, 22 Feb 2018 21:53:23 +0000 (21:53 +0000)]
In x509.h rev. 1.32 2018/02/20 17:09:20, jsing@ provided
X509_NAME_get0_der(3). Document it without using anything
from the existing OpenSSL X509_NAME_get0_der(3) manual page
because that page fails to mention the similarity to i2d_X509_NAME(3)
and also fails to explain how both differ, likely causing users
to pick the wrong one for their purposes.
guenther [Thu, 22 Feb 2018 20:36:40 +0000 (20:36 +0000)]
Set the PG_G (global) bit on the special page table entries that are shared
between the u-k and u+k tables, because they're actually in *all* tables.
ok bluhm@ kettenis@ mlarkin@
bluhm [Thu, 22 Feb 2018 20:27:14 +0000 (20:27 +0000)]
The compile time assertion for cpu info did not work with gcc.
Rephrase the condition in a way that both gcc and clang accept it.
OK guenther@
bluhm [Thu, 22 Feb 2018 20:18:59 +0000 (20:18 +0000)]
The GNU assembler does not understand 1ULL, so replace the constant
with 1. Then it compiles with gcc, sign and size do not matter
here.
OK mlarkin@
jsing [Thu, 22 Feb 2018 17:36:55 +0000 (17:36 +0000)]
sync
jsing [Thu, 22 Feb 2018 17:34:42 +0000 (17:34 +0000)]
Bump lib{crypto,ssl,tls} minors due to symbol additions.
jsing [Thu, 22 Feb 2018 17:30:25 +0000 (17:30 +0000)]
Provide SSL_is_server().
jsing [Thu, 22 Feb 2018 17:29:24 +0000 (17:29 +0000)]
Provide SSL_up_ref().
jsing [Thu, 22 Feb 2018 17:27:06 +0000 (17:27 +0000)]
Provide SSL_CTX_get_ciphers().
jsing [Thu, 22 Feb 2018 17:25:18 +0000 (17:25 +0000)]
Provide SSL_SESSION_up_ref().
jsing [Thu, 22 Feb 2018 17:22:02 +0000 (17:22 +0000)]
Provide X509_chain_up_ref().
From BoringSSL.
jsing [Thu, 22 Feb 2018 17:19:31 +0000 (17:19 +0000)]
Provide X509_STORE_get0_objects(), X509_STORE_get_ex_data() and
X509_STORE_set_ex_data().
jsing [Thu, 22 Feb 2018 17:17:09 +0000 (17:17 +0000)]
Provide X509_OBJECT_get0_X509() and X509_OBJECT_get0_X509_CRL().
jsing [Thu, 22 Feb 2018 17:15:09 +0000 (17:15 +0000)]
Provide X509_STORE_up_ref().
jsing [Thu, 22 Feb 2018 17:11:30 +0000 (17:11 +0000)]
Provide X509_STORE_CTX_get0_chain() and X509_STORE_CTX_get0_store().
schwarze [Thu, 22 Feb 2018 17:10:00 +0000 (17:10 +0000)]
In x509.h rev. 1.30 2018/02/20 17:04:58, jsing@ provided
X509_CRL_get0_lastUpdate(3) and X509_CRL_get0_nextUpdate(3).
Document them.
jsing [Thu, 22 Feb 2018 17:09:28 +0000 (17:09 +0000)]
Provide X509_get0_tbs_sigalg().
jsing [Thu, 22 Feb 2018 17:06:42 +0000 (17:06 +0000)]
Provide X509_set1_notBefore() and X509_set1_notAfter().
jsing [Thu, 22 Feb 2018 17:05:35 +0000 (17:05 +0000)]
Provide X509_get0_pubkey().
jsing [Thu, 22 Feb 2018 17:01:44 +0000 (17:01 +0000)]
Provide X509_CRL_set1_lastUpdate() and X509_CRL_set1_nextUpdate().
jsing [Thu, 22 Feb 2018 16:58:45 +0000 (16:58 +0000)]
Provide X509_CRL_get0_extensions() and X509_CRL_get_signature_nid().
jsing [Thu, 22 Feb 2018 16:53:42 +0000 (16:53 +0000)]
Provide X509_CRL_up_ref().
jsing [Thu, 22 Feb 2018 16:50:30 +0000 (16:50 +0000)]
Provide X509_REQ_get_signature_nid().
jsing [Thu, 22 Feb 2018 16:47:50 +0000 (16:47 +0000)]
Provide X509_REVOKED_get0_extensions(), X509_REVOKED_get0_revocationDate()
and X509_REVOKED_get0_serialNumber().
jsing [Thu, 22 Feb 2018 16:41:04 +0000 (16:41 +0000)]
Provide DH_get0_engine().
jsing [Thu, 22 Feb 2018 16:38:43 +0000 (16:38 +0000)]
Provide BIO_up_ref().
schwarze [Thu, 22 Feb 2018 16:26:27 +0000 (16:26 +0000)]
In x509.h rev. 1.30 2018/02/20 17:04:58, jsing@ provided
X509_CRL_get0_signature(3) and in rev. 1.31 2018/02/20 17:06:19
X509_REQ_get0_signature(3). Document them.
schwarze [Thu, 22 Feb 2018 15:22:06 +0000 (15:22 +0000)]
In bn.h rev. 1.37 2018/02/20 17:02:30, jsing@ provided BN_get_rfc*(3)
as aliases for get_rfc*(3). Mention them in the manual page.
jmc [Thu, 22 Feb 2018 13:23:47 +0000 (13:23 +0000)]
various tweaks;
nicm [Thu, 22 Feb 2018 11:42:41 +0000 (11:42 +0000)]
Remove an unused variable.
nicm [Thu, 22 Feb 2018 10:58:12 +0000 (10:58 +0000)]
Check prefix when retrying so it is checked while repeat flag is
set. GitHub issue 1239.
nicm [Thu, 22 Feb 2018 10:54:51 +0000 (10:54 +0000)]
Add exit-empty option to exit server if no sessions (defaults to on).
dlg [Thu, 22 Feb 2018 09:47:12 +0000 (09:47 +0000)]
remove some debug code in nvgre
mpi [Thu, 22 Feb 2018 08:47:20 +0000 (08:47 +0000)]
Always reallocate a new memory chunk when changing the gateway of a
route entry.
This makes sure we pass the correct size to free(9).
Reproted by and ok dlg@
jmc [Thu, 22 Feb 2018 08:46:05 +0000 (08:46 +0000)]
typo;
claudio [Thu, 22 Feb 2018 07:43:29 +0000 (07:43 +0000)]
Same change as rev 1.22 in ospfd:
The IF_EVT_NBR_CHNG event needs to be fired when a neighbor transitions to
a state of 2-Way or higher. There is no need to trigger the event for new
neighbors. With this situations with multiple DRs after a netsplit should
be solved.
OK sthen@ and remi@
claudio [Thu, 22 Feb 2018 07:42:38 +0000 (07:42 +0000)]
The IF_EVT_NBR_CHNG event needs to be fired when a neighbor transitions to
a state of 2-Way or higher. There is no need to trigger the event for new
neighbors. With this situations with multiple DRs after a netsplit should
be solved.
OK sthen@ and remi@
dlg [Thu, 22 Feb 2018 07:33:24 +0000 (07:33 +0000)]
don't get in the way of setting the rdomain on gre(4)
dlg [Thu, 22 Feb 2018 07:27:26 +0000 (07:27 +0000)]
slight tweak
dlg [Thu, 22 Feb 2018 07:24:58 +0000 (07:24 +0000)]
reorganise the manpage with subsections for each type of interface.
the page was getting a bit cumbersome with the arrival of nvgre,
so hopefully this makes it a bit more straightforward.
jmc@ says he can fix stuff as i go
dlg [Thu, 22 Feb 2018 01:35:04 +0000 (01:35 +0000)]
make the Nd lines (subjectively) less worse
dlg [Wed, 21 Feb 2018 22:20:19 +0000 (22:20 +0000)]
implement nvgre(4) based on rfc7637 aka NVGRE
NVGRE is short for Network Virtualization Using Generic Routing
Encapsulation.
it provides an overlay ethernet network with multiple ip peers,
rather than a tunnel to a single peer like egre(4) provides. unlike
egre the vnetid is mandantory and always 24 bits. it offers similar
functionality to vxlan(4).
mikeb [Wed, 21 Feb 2018 21:09:57 +0000 (21:09 +0000)]
Mark VIA padlock as capable of dealing with ESN
There are no actual changes to the driver since the software crypto
driver is called to handle authentication operations.
This enabled padlock to be used when tunnels are setup with iked(8).
Tested by and OK fcambus
rpe [Wed, 21 Feb 2018 20:02:37 +0000 (20:02 +0000)]
Delete the kernel link kit tgz after extraction to align with the
libexec/reorder_kernel script.
OK tb
rpe [Wed, 21 Feb 2018 19:57:21 +0000 (19:57 +0000)]
Tweak comments.
OK tb
rpe [Wed, 21 Feb 2018 19:54:25 +0000 (19:54 +0000)]
If there is one interface, and it is configured via dhcp, and the lease
contains both domain-name and domain-search options make sure to use the
first domain-name entry (there might be multiple).
This issue was noticed by Raf Czlonka, thanks for reporting
Discussed with, tested and OK krw
guenther [Wed, 21 Feb 2018 19:24:15 +0000 (19:24 +0000)]
Meltdown: implement user/kernel page table separation.
On Intel CPUs which speculate past user/supervisor page permission checks,
use a separate page table for userspace with only the minimum of kernel code
and data required for the transitions to/from the kernel (still marked as
supervisor-only, of course):
- the IDT (RO)
- three pages of kernel text in the .kutext section for interrupt, trap,
and syscall trampoline code (RX)
- one page of kernel data in the .kudata section for TLB flush IPIs (RW)
- the lapic page (RW, uncachable)
- per CPU: one page for the TSS+GDT (RO) and one page for trampoline
stacks (RW)
When a syscall, trap, or interrupt takes a CPU from userspace to kernel the
trampoline code switches page tables, switches stacks to the thread's real
kernel stack, then copies over the necessary bits from the trampoline stack.
On return to userspace the opposite occurs: recreate the iretq frame on the
trampoline stack, switch stack, switch page tables, and return to userspace.
mlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing
issues on MP in particular, and drove the final push to completion.
Many rounds of testing by naddy@, sthen@, and others
Thanks to Alex Wilson from Joyent for early discussions about trampolines
and their data requirements.
Per-CPU page layout mostly inspired by DragonFlyBSD.
ok mlarkin@ deraadt@
mpi [Wed, 21 Feb 2018 09:30:02 +0000 (09:30 +0000)]
Call socreate() before falloc() in sys_socket().
This is similar to what we do in sys_socketpair() and will allow us
to grab the KERNEL_LOCK() only after having created a socket.
This time with correct non-blocking check.
Tested by landry@, previous diff ok tedu@
dlg [Wed, 21 Feb 2018 05:20:17 +0000 (05:20 +0000)]
if egre takes the packet, it's done, don't fall through to l3 processing.
dlg [Wed, 21 Feb 2018 05:19:11 +0000 (05:19 +0000)]
whitespace fixes
jsg [Wed, 21 Feb 2018 00:43:03 +0000 (00:43 +0000)]
add bsd.mp
jsg [Wed, 21 Feb 2018 00:04:41 +0000 (00:04 +0000)]
match linux whitespace in ioctl list
kettenis [Tue, 20 Feb 2018 23:57:54 +0000 (23:57 +0000)]
Add GENERIC.MP directory.
kettenis [Tue, 20 Feb 2018 23:48:23 +0000 (23:48 +0000)]
Add GENERIC.MP.
kettenis [Tue, 20 Feb 2018 23:46:48 +0000 (23:46 +0000)]
Release the secondary CPUs.
kettenis [Tue, 20 Feb 2018 23:45:24 +0000 (23:45 +0000)]
Make arm64 pmap (somewhat) mpsafe.
jsg [Tue, 20 Feb 2018 23:44:19 +0000 (23:44 +0000)]
stop mixing bsd and c99 fixed width types and just use c99 types everywhere
tb [Tue, 20 Feb 2018 21:11:15 +0000 (21:11 +0000)]
Fix bogus check. Spotted by brynet, thanks.
tb [Tue, 20 Feb 2018 20:59:19 +0000 (20:59 +0000)]
RSA_get_flags should be RSA_test_flags.
Noted by sthen. Rides previous minor bump.
tb [Tue, 20 Feb 2018 18:51:35 +0000 (18:51 +0000)]
whitespace nit
tb [Tue, 20 Feb 2018 18:20:29 +0000 (18:20 +0000)]
sync
tb [Tue, 20 Feb 2018 18:19:07 +0000 (18:19 +0000)]
Crank lib{crypto,ssl,tls} minors after symbol addition.
tb [Tue, 20 Feb 2018 18:17:17 +0000 (18:17 +0000)]
Provide BIO_meth_{g,s}et_callback_ctrl()
with & ok jsing
tb [Tue, 20 Feb 2018 18:13:31 +0000 (18:13 +0000)]
Provide BIO_meth_get_{create,ctrl,destroy,gets,puts,read}()
ok jsing
tb [Tue, 20 Feb 2018 18:10:27 +0000 (18:10 +0000)]
Zap an 'int' that snuck in.
ok jsing
tb [Tue, 20 Feb 2018 18:07:11 +0000 (18:07 +0000)]
Provide SSL_SESSION_get_protocol_version()
ok jsing
tb [Tue, 20 Feb 2018 18:05:28 +0000 (18:05 +0000)]
Provide EVP_PKEY_get0_EC_KEY() and 'if (ret)' vs 'if (ret != 0)' cosmetics.
ok jsing
tb [Tue, 20 Feb 2018 18:01:42 +0000 (18:01 +0000)]
Provide DH_set_length()
ok jsing
tb [Tue, 20 Feb 2018 17:59:31 +0000 (17:59 +0000)]
Provide DH_bits()
ok jsing