Regenerate using certificate data from NSS 3.131.1.
Upstream dropped emSign_ECC_Root_CA_-_G3.pem entirely; we deliberately
move it to untrusted instead to block its reintroduction through e.g.
an outdated copy of security/ca_root_nss.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60906
Use void, not char, for pointers to opaque data in our send and receive
functions.
Sponsored by: Klara, Inc.
Reviewed by: allanjude
Differential Revision: https://reviews.freebsd.org/D60729
Use void, not char, for pointers to opaque data in our send and receive
functions.
Sponsored by: Klara, Inc.
Sponsored by: Qualys, Inc.
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D60728
All communication between auditdistd senders and receivers and
internally between auditdistd and its worker children passes through the
same pair of send / receive functions. The receive function uses
recv(2) with the MSG_WAITALL flag, which in theory means we should never
get a short read. However, when handing off a socket to a worker child,
we also pass a variable-length string identifying the type of socket
we're passing, and reading this string relies on a short read. This
used to work because the arrival of the descriptor would interrupt the
recv(2) call, but this bug was fixed when the AF_UNIX code was rewritten
a while ago and auditdistd has been broken ever since.
Fixing the length of the protocol name to four characters including the
terminating null solves the short-read bug by never requiring a short
read (nothing else in auditdistd requires one).
PR: 296107
MFC after: 1 week
Reviewed by: js, kevans
Differential Revision: https://reviews.freebsd.org/D59565
When setting up an FTP transfer, we need to dereference the cached
connection before returning after a failure.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60017
When we get a 304 Not Modified response, we need to go through the error
path to properly free any resources we've allocated instead of just
returning NULL directly.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60016
When processing a redirect, if we get multiple Location headers, we free
the previous one using free(new) instead of fetchFreeURL(new), which
leaks new->doc.
While here, rename new to loc since new is a reserved word in C++.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60015
If a URL contains credentials, check that neither the user name nor the
password contain control characters which might confuse the server,
especially in the FTP case.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60008
When reading an FTP or HTTP response, error out if we read 64 kB before
hitting a newline. Otherwise a runaway or malicious server could have
us spinning for quite a while allocating more and more memory before we
gave up or crashed.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60007
The Unicode closing single quotation mark is classified as a homoglyph
and can trip automated code quality checks in downstream CI pipelines or
cause code review UIs to refuse to display a file. If used as an
apostrophe, use the ASCII single quote instead. If used as a closing
single quote, replace with double quotes or no quotes at all.
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: ziaee, obiwac, olce
Differential Revision: https://reviews.freebsd.org/D59911
All communication between hastd nodes and internally between hastd and
its worker children passes through the same pair of send / receive
functions. The receive function uses recv(2) with the MSG_WAITALL flag,
which in theory means we should never get a short read. However, when
handing off a socket to a worker child, we also pass a variable-length
string identifying the type of socket we're passing, and reading this
string relies on a short read. This used to work because the arrival of
the descriptor would interrupt the recv(2) call, but this bug was fixed
when the AF_UNIX code was rewritten a while ago and hastd has been
broken ever since.
Fixing the length of the protocol name to four characters including the
terminating null solves the short-read bug by never requiring a short
read (nothing else in hastd requires one).
Note that this issue appears to have been reported independently first
by Alessandro Sagratini in PR 234576 and then by Martin Vidovic in
D57511. I ended up going in a different direction than Martin's patch,
but his analysis was invaluable, hence the double credit below.
PR: 234576
Reported by: Martin Vidovic <[email protected]>
MFC after: 1 week
Event: EuroBSDcon DevSummit 2026
Reviewed by: xtronom_gmail.com, kevans, glebius, gjb
Differential Revision: https://reviews.freebsd.org/D59521
The script was passing the wrong device name to `graid3 insert` and
didn't notice that the command was failing.
MFC after: 1 week
Event: EuroBSDcon 2026 DevSummit
Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D59564
The lock acquisition in g_raid3_ctl_insert() was improperly dropped a
while ago, making it impossible to add or replace a device in an
existing graid3. This went unnoticed because the tests are broken.
MFC after: 1 week
Fixes: fcf69f3dbc ("Consistently use gctl_get_provider instead of home-grown variants.")
Event: EuroBSDcon 2026 DevSummit
Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D59563
Both kern_renameat() and kern_dup() had arguments named `new`. Rename
their arguments to match their respecitve manual pages.
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D59386
The proto-libnv implementation embedded in hastd pads names and values
out to the nearest multiple of eight bytes, but leaves the padding
uninitialized, leaking up to 14 bytes of recycled heap per pair in a
message.
While here, switch from bcopy() to memcpy().
MFC after: 3 days
Reviewed by: kevans, emaste
Differential Revision: https://reviews.freebsd.org/D59343
Rename the members of struct ebuf to match their function, replace
bcopy() with memcpy(), add comments explaining what each function does.
Reviewed by: kevans, emaste
Differential Revision: https://reviews.freebsd.org/D59310
Prior to FreeBSD 11, vm_cnt was named cnt. When it was renamed, vmstat
was modified to fall back to the old name if the new name was not found.
It's time we dropped this.
Reviewed by: kib, jhb, emaste
Differential Revision: https://reviews.freebsd.org/D59255
Fix nlist(3) consumers that either expected our toolchain to prepend an
underscore to symbol names or expected nlist(3) to ignore the mismatch,
as it did until we overhauled it back in May.
While here, also fix cases where the last element in the list had an
empty string instead of NULL as sentinel.
MFC after: 3 days
Fixes: 4617a6cb82 ("nlist: Handle multiple symbol tables")
Reviewed by: kib, jhb
Differential Revision: https://reviews.freebsd.org/D59254
In headers that existed prior to C23, these should be visible only in
C23 or BSD mode.
Fixes: 0fe73dcf7c ("libc: Add <assert.h> C23 feature test macro")
Fixes: 1f09e35429 ("sys/limits.h: Add BOOL_MAX, BITINT_MAXWIDTH, and C23 feature test macro")
Fixes: cd0727ec70 ("libc: Add <stdio.h> C23 feature test macro")
Fixes: fc9d02cb29 ("libc: Add <time.h> C23 feature test macro")
Fixes: 4aeed6e9d2 ("libc: Add <setjmp.h> C23 feature test macro")
Reviewed by: fuz, kfv, dteske
Differential Revision: https://reviews.freebsd.org/D59272
* Fix case where the source is - and the target exists.
* Only call chflags() (to remove flags that might prevent us from
replacing an existing target) in the exists case; otherwise,
to_sb.st_flags is uninitialized.
* Rename the source file in the stdin test case.
* Extend null and stdin test cases to cover the case where the
target already exists.
PR: 297681
MFC after: 1 week
Fixes: d34870708d ("install: Allow installing stdin")
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59144
The C standard does not require diagnostic messages to be quoted, but
some tools get confused by unbalanced quotes such as the apostrophe in
“don't”. Wrap this message in double quotes to resolve the confusion.
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
The scheduler selection interface uses names that are reserved words in
C++, causing problems for downstream projects that use C++ in the
kernel. Work around this by hiding the interface from C++ compilers
until we can come up with a better solution.
Fixes: ce38acee8d ("Add kern/sched_shim.c")
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: siderop1_netapp.com, imp, kib
Differential Revision: https://reviews.freebsd.org/D58991
Our buffer is half a megabyte, but we are only initializing the first
two bytes. Switching from static to dynamic initialization moves it
from .data to .bss, greatly reducing the size of the binary.
Fixes: cf74b63d61 ("yes: Completely overengineer")
MFC after: 1 week
Sponsored by: Klara, Inc.
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D58890
Tables that have one element per protocol or address family were
previously sized by AF_MAX + 1 since AF_MAX was off by one. Now that
AF_MAX has been corrected, we need to apply the opposite correction to
these tables.
Fixes: ddd850aa77 ("sys/socket.h: Fix AF_MAX")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D58827
Tables that have one element per protocol or address family were
previously sized by AF_MAX + 1 since AF_MAX was off by one. Now that
AF_MAX has been corrected, we need to apply the opposite correction to
these tables.
Fixes: ddd850aa77 ("sys/socket.h: Fix AF_MAX")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: pouria, kevans, glebius
Differential Revision: https://reviews.freebsd.org/D58826
If one of the source files we copy is non-writeable, cp will create a
non-writeable copy. If the original is later modified, cp will fail to
overwrite the copy since it is not writeable. Using cp -f ensures the
copy always succeeds, as long as the object directory is writeable.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
* On SIGINFO, print the current path to stderr rather than stdout.
* Do so immediately, instead of the next time we finish a directory.
* Document this behavior in the manual page.
PR: 296861
MFC after: 1 week
Fixes: d1588599c0 ("Report the next directory being scanned ...")
Reviewed by: wollman
Differential Revision: https://reviews.freebsd.org/D58702
This is a waste of time and results in a use-after-free if linsysfs is
loaded and a USB network interface is in use, since USB devices are
disconnected at shutdown, which triggers a call into linsysfs, which
then tries to destroy a pseudofs node which has already been purged.
MFC after: 1 week
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58359
AF_MAX was always intended to be one more than the greatest allocated
value. Jeff broke this in 2013. Unfortunately, a bunch of people then
decided to adapt to the mistake instead of correcting it.
Fixes: 863c7e4562 (" - Reserve a special AF for SDP. The one we were incorrectly using before was taken by another AF.")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, glebius
Differential Revision: https://reviews.freebsd.org/D58597
* Reorganize the connection loop to make it a little more readable
* Start the timeout clock earlier
* Correctly calculate the poll timeout before calling poll()
* Don't leak the socket on failure
Fixes: 848f360c8f ("libfetch: Apply timeout to connection attempts")
Fixes: b02e02958d ("libfetch: Fix handling of connection failures")
MFC after: 3 days
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58512
Fixes: c8f5e6819d ("pwait: Optionally wait until process is reaped")
Fixes: eddd8aa99c ("pwait: Add a SIGINFO handler")
Fixes: 356d0b79cf ("rc.subr: Fix premature return from wait_for_pids")
Use pwait's new -r option to wait until the target processes have not
only terminated, but also been reaped.
PR: 293183
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58391
Test that pwait without -r reports a process as soon as it terminates,
while pwait with -r does not report it until it has been reaped.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D58385
On SIGINFO, print a space-separated list or remaining processes to
standard error.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kib, markj
Differential Revision: https://reviews.freebsd.org/D58386
If the new -r option is specified, wait until the target process not
only terminates but is reaped.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kib, markj
Differential Revision: https://reviews.freebsd.org/D58314
Add a NOTE_REAP event for EVFILTER_PROC which provides a notification
when the process is reaped.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kib, markj
Differential Revision: https://reviews.freebsd.org/D58313
The time_unit test case uses PID 1 as a target for pwait. This doesn't
work in a jail. Since all we need is a process that we know won't die
while the test is running, we may as well use ourselves.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D58418
The manual page claimed that SIGINFO caused information to be printed to
stdout, when in fact it is printed to stderr, as one would expect. This
has been true ever since the feature was first added in 2003.
MFC after: 1 week
Fixes: 00d321a2b3 ("Add a SIGINFO handler.")
Reviewed by: jilles
Differential Revision: https://reviews.freebsd.org/D58392
In both procdesc_kqops_event() and filt_proc(), the event variable can
have more than one bit set. This means that:
* We cannot compare it directly with NOTE_EXIT; we must binary-and them
instead.
* We cannot binary-or it with the report mask; we must binary-and it
with the request mask first.
MFC after: 1 week
Fixes: 2a5e58c596 ("procdesc: add NOTE_PDSIGCHLD")
Fixes: b328975b9d ("procdesc: report NOTE_PDSIGCHLD for traced and stopped process")
Reviewed by: kib, markj
Differential Revision: https://reviews.freebsd.org/D58395
* Get rid of the pointless LOCALBASE_CTL_LEN mechanism
* Apply minimal normalization to the paths obtained from the environment
or sysctl variable
* Turn the manual page into a manual page
* Add tests
MFC after: 1 week
Reviewed by: se
Differential Revision: https://reviews.freebsd.org/D58362
This is mainy focused on using bool for booleans but also renames some
variables for clarity, adds some explicit comparisons, adds some braces,
with miscellanous style fixes thrown in.
MFC after: 1 week
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D58355
If from_name is "/dev/stdin" or "-" and the target is not a directory,
skip the comparison and copy data from standard input to the target.
MFC after: 1 week
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D58348
We defined CONFIG_DEBUG_FILE only in libwpautils, not in wpa_supplicant,
so all it did was enable code that never got called. Enable it at the
top level so it also applies to wpa_supplicant(8), and the -f option
mentioned in the manual page now actually works.
PR: 281617
MFC after: 1 week
Reviewed by: cy
Differential Revision: https://reviews.freebsd.org/D57723
This allows pkg(7) to be used to bootstrap a jail or chroot, and to
recognize the -j and -r options and pass them through to pkg(8) if
already bootstrapped.
Note that this does not address the issue of repository keys. If using
a signed package repository, you will still need to copy /usr/share/keys
into the target environment before or after bootstrapping, or pkg will
be unable to verify package signatures.
MFC after: 1 week
Reviewed by: imp, bapt
Differential Revision: https://reviews.freebsd.org/D58165
Reduce the amount of copying we do when performing buffered reads.
MFC after: 1 week
Reviewed by: op
Differential Revision: https://reviews.freebsd.org/D58113
Now that fetchTimeout works reliably, setting an alarm is not only no
longer necessary but counterproductive, as it will trigger even if the
connection is not actually stalled but merely slow.
While here, improve the wording of the manual page's description of the
various options for setting a timeout.
MFC after: 1 week
Reviewed by: op
Differential Revision: https://reviews.freebsd.org/D57911
Document the global fetchTimeout variable, now that it works reliably.
MFC after: 1 week
Reviewed by: op
Differential Revision: https://reviews.freebsd.org/D57910
Mark the socket non-blocking before connecting and poll for completion,
applying fetchTimeout if set.
MFC after: 1 week
Reviewed by: op
Differential Revision: https://reviews.freebsd.org/D57909
Previously, we would read FTP control connection messages and HTTP
reponse headers one character at a time. Now, we read as much as will
fit in our buffer and look for a newline. If there is data left over,
it will be reused by the next fetch_getln() call. This also requires
the addition of a fetch_bufread() which takes the buffer into account,
otherwise the start of the HTTP response body will be stuck in the
buffer after we read the last line of the header.
This should noticeably improve HTTP performance, especially for small
transfers.
MFC after: 1 week
Reviewed by: op
Differential Revision: https://reviews.freebsd.org/D57907
* Make fetch_ssl_read() and fetch_ssl_write() behave more like read(2)
and write(2), and drop fetch_socket_read() in favor of read(2).
* Don't request POLLERR, it's implied.
* Don't needlessly set errno, it's relatively costly.
* Always check for EAGAIN from writev(2), otherwise we will abort on a
short write instead of proceeding to poll(2).
* Always check for EAGAIN from poll(2) even though it can't happen on
FreeBSD; POSIX says it can, and it might in the future.
* Rewrite fetch_read() and fetch_writev() to be more similar to each
other. The main difference is that a partial read is treated as
success while a partial write is treated as failure.
PR: 296316
MFC after: 1 week
Reviewed by: op
Differential Revision: https://reviews.freebsd.org/D57906
Unlike its GNU counterpart, our tail(1) has always errored out if given
repetitive or contradictory options, even prior to Keith Bostic's 1991
reimplementation. There is no good reason to continue to do so, not
even tradition, since many other commands (including head(1)) simply
apply the rightmost option in cases like this.
MFC after: 1 week
Reviewed by: allanjude, markj
Differential Revision: https://reviews.freebsd.org/D58192
This is the last remaining piece of GPL software in the base system.
The installer transitioned to bsddialog four years ago, and the last
remaining dialog consumer, dpv, was turned off more than two years ago.
Retire dpv, libdpv, libfigpar (used only by dpv), and dialog itself.
Reviewed by: dteske
Differential Revision: https://reviews.freebsd.org/D55424
In order to merge merge commits (such as vendor imports), we need to
tell git cherry-pick which of the two branches referenced in the commit
is the mainline. In our case, it is always the first.
Approved by: markj
While here, clean up and simplify the existing code.
MFC after: 1 week
Reviewed by: glebius, jhb
Differential Revision: https://reviews.freebsd.org/D57993
When we switched from the BIND4 resolver to the BIND9 resolver, the
sortlist parser was inadvertently disabled due to a missing #define, and
nobody seemed to notice. The sorting code remained enabled in the
resolver, but there was no way to set a sort order.
Reimplement the sortlist parser, but correctly, and update the manual
accordingly. The new parser accepts IPv4 and IPv6 addresses with or
without a mask or prefix length, just like the old one, except IPv6
support was a bit wonky in the original code.
Fixes: 5342d17f09 ("Update the resolver in libc to BIND9's one.")
Relnotes: yes
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57925
This was previously all a single loop in res_init(), apart from option
parsing which we cleaned up in a previous commit. Break it out into
separate functions for reading the configuration line by line, setting
the default domain, setting the search list, and adding a nameserver
to the nameserver list. Sprinkle bounds checks and code comments all
around.
The sortlist code, which has been disabled for the past 20 years, will
be dealt with in a separate commit.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57924
Start the loop by finding the end of the option name, the name-value
separator (if any), and the end of the option. Use those pointers to
simplify matching the option name and parsing the option value, and
validate option names and values more strictly. This means that:
* We no longer accept trailing garbage in an option name or value. For
instance, we would previously interpret “edns0123” as “edns0” and
“timeout:3xyz” as “timeout:3”. This was actually quite lucky because
we also failed to recognize the newline at the end of the option line
as a whitespace character.
* For options that take a numerical argument, we would previously accept
negative values and treat non-numerical arguments as 0, while large
numerical arguments would be capped to the option's maximum permitted
value. Now, any failure to parse the argument, including overflow,
results in the option being left unchanged.
MFC after: 1 week
Relnotes: yes
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57923
* Modernize the markup
* Describe the comment syntax
* Drop obsolete advice
* Capitalize sentences
* Improve the language
* Replace no_tld_query with no-tld-query; both are supported, but all the
other multi-word options use hyphens rather than underscores.
* Add missing ENVIRONMENT section
* Redo the example
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57921
We have separate ports for Ccache 3 and 4. Suggest both, rather than
only the Ccache 3 port. Rearrange the text somewhat to avoid an
excessively ragged edge on a standard 80-column terminal.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58005
In alias_rtsp_out(), we construct a new packet in a fixed-length buffer
before copying it back into the original buffer. We never checked if
the data we were writing to this temporary buffer fit in it, nor if the
result fit in the original buffer.
* Use a dynamically sized allocated buffer instead of a fixed-length
stack buffer.
* Check for overflow before appending to our temporary buffer.
* Check for overflow before copying the data back to the packet buffer.
* While here, use size_t for sizes and bool for booleans.
Approved by: so
Security: FreeBSD-SA-26:41.libalias
Security: CVE-2026-49420
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57753
Dag-Erling Smørgrav