Write the URI received in DHCP option 114 to
/var/run/captive-portal.IFACE atomically, with the legacy option 160 as
a fallback, and remove the file on EXPIRE and FAIL.
Reviewed by: bcr (manpage)
Differential Revision: https://reviews.freebsd.org/D60259
Add DHCP options 114 (captive-portal) and 160 (captive-portal-legacy)
to the default Parameter Request List so that servers advertise the
Captive Portal API URI.
Approved by: emaste
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D60257
Rename option 114 from "url" to "captive-portal" (RFC 8910) and retain
"url" as a deprecated alias. Rename option 160 from the generic
"option-160" to "captive-portal-legacy" (RFC 7710).
Reviewed by: emaste, dch
Apprived by: emaste, dch
Differential Revision: https://reviews.freebsd.org/D60256
selwakeup() only wakes select/poll waiters; it does not notify the kqueue
knote registered on the device, so EVFILT_READ never fired when a frame
became available.
crontab -r only unlinks the crontab file, so spawn it directly with
unlinkat() relative to conf.rootfd. This also makes the crontab
removal work with pw -R.
MFC After: 1 week
rmat() used stat() with a path relative to the current working
directory, so it never found the job files in /var/at/jobs and the
at(1) jobs of a deleted user were never removed.
ef7d0eb948 also broke it by introducing a typo: /usr/sbin/atrm instead
of /usr/bin/artm.
Use fstatat() with the directory fd to stat the job files relative to
the at jobs directory, and unlinkat() them directly instead of spawning
atrm.
Those changes allow us to make it works with pw -R.
MFC After: 1 week
On SIGHUP reload, closelogfiles() frees each F_PIPE filed even when its
pipe process is still running. close_filed() sets f_type to F_UNUSED
before the check, so the condition f_type != F_PIPE is always true and
the filed is freed while its process descriptor is still on the dead
queue and registered in the kqueue. When the child later exits, the
NOTE_EXIT handler dereferences the freed filed (use-after-free) and
never closes the process descriptor, leaving the pipe child as a
persistent zombie.
Capture whether the filed is a pipe with an active process descriptor
before calling close_filed(), and defer the free in that case so the
NOTE_EXIT handler can reap the child and free the filed.
Reviewed by: markj
Fixes: 95381c0139 (syslogd: Use process descriptors)
Differential Revision: https://reviews.freebsd.org/D59319
Support cat -A, -E and -T, which are commonly used by Linux shell
scripts. -E prints a "$" at the end of each line, -T renders tabs
as ^I, and -A is equivalent to -vET.
MFC After: 1 week
Discussed with: jrtc27
Reviewed by: jrtc27, ziaee
Differential Revision: https://reviews.freebsd.org/D59250
Prevent infinite loop in uvideo_vs_negotiation() when a USB camera reports
step=0 in its continuous frame interval descriptor.
Cast fbuf_size calculation to uint64_t to avoid int overflow for large
width/height/bpp combinations.
Reported by: emaste
detach() stopped streaming and called uvideo_vs_close() before
destroy_dev(), so a concurrent close() could race the teardown and call
uvideo_vs_close() a second time (double usbd_transfer_unsetup), and
mtx_destroy() could race a close still holding sc_mtx. sc_streaming
was also read without the lock in both paths.
Reorder detach() to call destroy_dev() first so all in-flight cdev
methods drain before any teardown. Read sc_streaming under sc_mtx in
both detach() and the last-close safety net.
The driver shared a single streaming state and buffer pool across all
open file descriptors, so a second client (e.g. another browser tab)
could disrupt the first: its cleanup STREAMOFF would tear down the
active stream, and stale buffers prevented re-acquisition.
Add per-fd state via devfs cdevpriv tracking whether this fd started
streaming. STREAMOFF and close from a non-streaming fd are no-ops.
STREAMOFF from the streaming fd stops the stream and frees the buffers
so that a new fd can re-acquire the camera. DQBUF returns EPIPE
immediately when buffers are freed instead of waiting for a timeout.
Frame interval data is read from device-supplied frame descriptors whose
bLength may be shorter than the number of intervals declared by
bFrameIntervalType. The continuous branch of uvideo_enum_fivals() read
three intervals unconditionally, and the discrete branch checked the
pointer but not the four bytes that UGETDW() reads, so a short or
malformed descriptor could read past bLength and leak adjacent kernel
memory to userspace. uvideo_vs_parse_desc_frame_max_rate() had the same
class of off-by-up-to-three-bytes read.
Compute the available bytes from bLength and validate before each read.
Reported by: emaste
qbuf(), dqbuf() and read() manipulated sc_mmap_q / sc_mmap_cur /
sc_frames_ready without sc_mtx, racing with the USB transfer callbacks
(producer) that run under the mutex. This could corrupt the queue or
trigger use-after-free.
Take sc_mtx around qbuf(), use mtx_sleep() and protect the queue
operations in dqbuf(), and use mtx_sleep() with a snapshot of sc_fsize
in read().
Also reject S_FMT and S_PARM with EBUSY while streaming: both
re-negotiate the probe/commit controls with the device, which disrupts
the active USB transfers (a second client opening the device would
otherwise freeze the first one's stream).
dwMaxVideoFrameSize comes from the USB probe/commit response and is not
validated. reqbufs() computed buf_size_total with signed int arithmetic
and no bound, so a bogus value could wrap the product to a small size
and yield a too-small buffer with a huge sc_mmap_buffer_size, causing
out-of-bounds writes from the USB transfer callbacks.
Bound the frame size against sc_max_fbuf_size and use overflow-checked
size_t arithmetic for the total and per-buffer offsets.
Reported by: emaste
Allocate the mmap buffer via phys_pager_allocate() and map it into
kernel space with vm_map_find()/vm_map_wire(), instead of a custom
cdev_pager backed by contigmalloc. phys_pager_allocate() is required
over a bare vm_object_allocate(OBJT_PHYS) to initialise un_pager.phys.ops,
otherwise phys_pager_getpages() NULL-derefs during vm_map_wire().
Reviewed by: markj
Reported by: markj
Differential Revision: https://reviews.freebsd.org/D58394
The uvideo driver freed the mmap buffer (contigmalloc'd) in several
paths (VIDIOC_STREAMOFF, last close, detach) without coordinating
with the lifetime of existing user-space mmap mappings. This could
lead to use-after-free when user-space continued to access the
mapped memory after the backing pages had been freed.
Fix this by switching from the simple d_mmap callback to d_mmap_single
with custom cdev_pager_ops, and by attaching the contig buffer to a
single shared vm_object created at REQBUFS time:
- uvideo_reqbufs() allocates a uvideo_mmap_state (independent of the
softc) and a shared vm_object via cdev_pager_allocate() that spans
the whole buffer; the softc holds one reference to it.
- uvideo_cdev_mmap_single() simply hands out additional references to
that shared object; the requested offset selects which buffer is
mapped. The VM system tracks mapping lifetime through the object
reference count, so no per-mapping bookkeeping is needed.
- uvideo_pg_ctor/uvideo_pg_dtor validate the mapping and free the
contig buffer together with the state when the last reference
(softc's own or a user mapping) is dropped.
- uvideo_pg_fault installs a fictitious page for the backing physical
address, following the canonical device-pager pattern: update the
passed-in page in place when it is already fictitious, otherwise
allocate a fake page and vm_page_replace() the busy placeholder,
so that dev_pager_dealloc() does not deadlock.
- uvideo_vs_free_frame() drops the softc's reference instead of
contigfree()'ing directly; if mappings still exist the buffer stays
alive until the last uvideo_pg_dtor().
- VIDIOC_STREAMOFF no longer frees the buffer (per V4L2 spec).
- Last close always releases the buffer (deferred if mappings exist).
- The mmap_state outlives the softc, so the pager dtor can safely
free the buffer even after device detach.
Reported by: 章鱼哥 (@aipyapp) (www.aipyaipy.com)
Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team
Import the device quirk system from OpenBSD to handle UVC devices
that need special handling. This includes:
- UVIDEO_FLAG_ISIGHT_STREAM_HEADER: non-standard streaming header
- UVIDEO_FLAG_REATTACH: needs reattach after firmware upload
- UVIDEO_FLAG_VENDOR_CLASS: incorrectly reports as vendor class
- UVIDEO_FLAG_NOATTACH: device not supported
- UVIDEO_FLAG_FORMAT_INDEX_IN_BMHINT: format index in bmHint
Add quirks table with known devices and lookup function.
Add iSight stream header decoder for Apple iSight cameras.
Obtained from: OpenBSD
Some UVC devices (e.g. Logitech C920) expose more than 8 Processing
Unit descriptors, causing "too many PU descriptors found!" errors.
Increase both limits from 8 to 32 to accommodate such devices.
Increase NFRAMES_MAX from 40 to 128 and IXFERS from 3 to 5 to keep
more packets in flight on the USB bus. This brings throughput from
~13.5 MB/s to ~21 MB/s (for comparison on the same camera webcamd
provided ~20MB/s.
The linux driver also uses 5 IXFERS (but only 32 NFRAMES_MAX)
Tested by: manu
Implement UVC Camera Terminal (CT) controls per UVC 1.5 specification
Table A-12. This adds support for camera-specific controls that are
separate from the Processing Unit controls already supported.
Reviewed by: manu
Differential Revision: https://reviews.freebsd.org/D56962
Add EVFILT_READ kqueue filter so applications using kqueue/kevent
can efficiently wait for video frames instead of polling.
Reviewed by: manu
Differential Revision: https://reviews.freebsd.org/D56961
Port the uvideo(4) driver from OpenBSD. This provides
native USB Video Class (UVC) support for webcams and video capture
devices.
The main changes are adaptation for:
- USB transfer callback model
- isoc data extraction via usbd_copy_out(),
- V4L2 struct alignment for ABI compatibility with v4l_compat.
Note that this implementation can coexist with webcamd.
Reviewed by: manu
Differential Revision: https://reviews.freebsd.org/D56960
The -w option checks word boundaries before and after each potential
match by decoding the adjacent character. This was done via the
heavyweight sscanf(3) with "%lc", which goes through the full scanf
parser and locale-aware mbrtowc(3) machinery even for simple ASCII.
Replace with a three-tier fast path:
1. ASCII bytes (< 0x80): simple isalnum(3) / '_' comparison
2. UTF-8 continuation bytes (0x80-0xBF): interior bytes of a multi-byte
character are always word characters -> no further decoding needed
3. Multi-byte start bytes (>= 0xC0): decode with mbrtowc(3) directly
instead of sscanf(3)/%lc, avoiding scanf parser overhead
Benchmark with ministat(1) (10 runs each):
Worst-case ASCII (100k lines of 100 'a' chars, -w 'a'):
Difference at 95.0% confidence: -15.3% +/- 3.1%
Worst-case Unicode (50k lines of 100 accented 'e', -w 'e'):
Difference at 95.0% confidence: -11.2% +/- 4.7%
Normal -w (500k lines, -w 'the'):
Difference at 95.0% confidence: -18.1% +/- 3.6%
French text (100k lines, -w accented 'ete'):
Difference at 95.0% confidence: -18.0% +/- 4.1%
Non -w case shows no regression.
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D57587
Replace the unconditional fflush(stdout) in grep_printline and
procmatches with a periodic timer that flushes at most once every
100ms. This preserves interactive responsiveness (grep | tee,
grep | tail -f) while avoiding 1M+ write(2) syscalls when
processing large inputs.
The flush interval is tracked via clock_gettime(CLOCK_MONOTONIC)
and a static timespec. --line-buffered continues to flush
immediately via setlinebuf(3), as before.
Benchmark on 1M lines (37MB output to file):
unconditional fflush: 1.90s (sys 1.22s)
periodic 100ms timer: 0.49s (sys 0.007s)
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D57528
Shell variable names cannot be safely quoted with shell_escape() —
only alphanumeric characters are valid. Add validation that set-name
only matches [a-zA-Z0-9]+; invalid values are rejected with a
warning and the rename is skipped entirely.
The hostname value was written inside double quotes in
/etc/rc.conf.d/hostname. POSIX shell performs command substitution
inside double quotes, so a hostname containing $() or backticks would
be executed when the file is sourced (e.g., by rc(8)).
Switch to using the existing shell_escape() helper, which wraps values
in single quotes. In POSIX shell, single-quoted strings are completely
literal — no expansion or substitution of any kind is performed.
While the hostname is already validated to contain only
[a-zA-Z0-9.-], this change provides defense-in-depth so the output
format is safe regardless of future validation changes.
Reported by: Yazdan Soltani <[email protected]>
Posts instance data (hostname, instance_id, public keys) to a URL
using fetch(1). Supports:
- url: target URL
- post: list of data items to send, or 'all'
- tries: number of retry attempts (default 1)
Add support for the 'mounts' cloud-config key which configures
mount points by appending entries to /etc/fstab and creating
the corresponding directories.
Add support for adding the instance hostname to /etc/hosts on the
127.0.0.1 and ::1 localhost lines, matching cloud-init's default
behaviour (manage_etc_hosts: true).
create a revolve_hostname helper to avoid code duplucation.
Add support for the 'bootcmd' cloud-config directive, which allows
running commands very early in the boot process, before the hostname
is set and before the network is configured.
- nuageinit: bootcmd() function follows the same pattern as runcmd(),
writing commands to /var/cache/nuageinit/bootcmds instead of runcmds.
It is the first entry in the pre_network_calls table.
- rc.d/nuageinit: execute /var/cache/nuageinit/bootcmds immediately
after /usr/libexec/nuageinit completes, before unmounting the config
drive. This ensures bootcmd runs before NETWORKING per cloud-init spec.
The unquote() function took a const char * parameter but modified the
string in-place (removing quote characters). Change the parameter to
char * and update callers that passed const char * to cast explicitly.
The 'name' variable could be left uninitialized if neither the
positional argument nor -n is supplied, leading to undefined
behavior when passed to getgroup().
Add missing SSH cloud-config options from cloud-init spec:
- ssh_deletekeys: remove existing SSH host keys on first boot so
new ones are generated automatically by sshd(8).
Implemented as delete_ssh_host_keys() in nuage.lua using lfs.dir()
with a directory existence guard via lfs.attributes().
- disable_root: set PermitRootLogin to 'no' (or a custom value via
disable_root_opts) in /etc/ssh/sshd_config.
- disable_root_opts: optional string or array to override the
PermitRootLogin value used when disable_root is true. Only the
first array element is used.
Replace goto next/list pattern with proper elseif/else control
structure. The goto-based flow was fragile and hard to follow;
the elseif chain makes the validation logic explicit and linear.
Previously update_sshd_config() would assert-fail if sshd_config did
not exist. Now it creates a new file with the given key/value.
Also replace the fragile simultaneous r+ + temp file approach with
a cleaner read-then-write pattern: read all lines into memory, modify
as needed, then write to a temp file and rename. All assert() calls
replaced with proper error handling via warnmsg().
Add test case for missing file creation.
Replace check-then-create patterns with direct creation:
- addsshkey: check what exists before creation, use mkdir_p() for
.ssh directory, handle errors with warnmsg() instead of assert().
Apply chmod/chown only on newly created files/directories.
- adddoas: same pattern for doas.conf and the etc directory.
- addsudo: same pattern for the sudoers file and sudoers.d directory.
All three functions now use warnmsg() for error handling instead of
returning nil,err or using assert().
- f:close(cmd) -> f:close() in adduser() and exec_change_password():
the 'cmd' argument is not standard Lua and is silently ignored.
- Remove dead 'precmd' variable in adduser().
Validate hostnames before writing them:
- Reject empty hostnames
- Reject hostnames longer than 253 characters
- Reject hostnames with invalid characters
- Reject hostnames starting or ending with dot/hyphen
- Reject labels longer than 63 characters
- Reject labels starting or ending with hyphen
Expand the sethostname test to cover all rejection cases.
Update nuage.sh sethostname_body to ignore stderr (warnings).
- Add shell_escape() helper to safely escape shell arguments
- Apply shell_escape to all user-controlled values in shell commands:
adduser (usershow, useradd, lock, primary_group, groups)
addgroup (groupshow, groupadd, members)
exec_change_password (usermod)
settimezone (tzsetup root and timezone)
install_package (pkg package names)
- Escape double quotes in hostname when writing rc.conf.d/hostname
- Add missing 'local' declaration for resolvconf_command in nameservers()
- Escape interface name in resolvconf -a command
- Change open_resolvconf_conf() from 'w' to 'a' mode to prevent
data loss when nameservers() is called multiple times
- Clean up stale resolvconf.conf at the start of each boot
(skip on postnet to preserve config written by first call)
MFC After: 1 day
Ensure the script used is invalid when parsed by libyaml which
highlight the issue revealed in PR295062
while at here validate the mode of the file is properly changed
PR: 295062
MFC After: 1 day
This fixes a regression introduced in cae280931c which prevents
user_data as a shell script to be used
PR: 295062
Reported by: Ross McKelvie <[email protected]>
MFC After: 1 day
Previously, devmatch would stop at the first linker.hints file
found in kern.module_path. This meant modules installed in
/boot/modules/ were invisible to devmatch if /boot/kernel/
contained a linker.hints file (which it always does).
Merge hints from all directories in kern.module_path.
This allows third-party or out-of-tree kernel modules in
/boot/modules/ to be auto-loaded by devmatch just like
built-in modules.
Reviewed by: imp
Differential Revivion: https://reviews.freebsd.org/D56847
This is useful for testing alternative service managers
without modifying /etc/rc
MFC After: 1 weeks
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D56828
This avoid leaking pipe fd in children and simplifies the code
MFC After: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D56120
Baptiste Daroussin