Don't claim void* or (u)intptr_t are the same size as long. This isn't
true for CHERI.
Effort: CHERI upstream
Reviewed by: kib, markj, jhb, emaste
Sponsored by: Innovate UK, DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D52821
With CHERI there now more options than __ILP32__ and __LP64__ so lack of
one does not imply the other. Encourage the use of __SIZEOF_*__ macro
tests in their place.
Effort: CHERI upstreaming
Reviewed by: kib, markj, emaste
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D52820
Align CONFGROUPS with other options like SUBDIRS and FILESGROUPS by
supporting the CONFGROUPS.yes option. This means logic like this:
.if ${MK_FOO} != "no"
CONFGROUPS+= FOO
.endif
can be replaced by:
CONFGROUPS.${MK_FOO}+= FOO
MFC after: 1 week
Reviewed by: imp
Sponsored by: https://www.patreon.com/bsdivy
Differential Revision: https://reviews.freebsd.org/D52923
Disable if IPv6 is not supported, and instead of 10 seconds, default to
one more than the value of net.inet6.ip6.dad_count.
Fixes: 5ead817c3b ("rc: Teach netwait to wait for DAD")
Reviewed by: bz
Differential Revision: https://reviews.freebsd.org/D52905
The "-f" dump option allows a dump of the Heimdal
KDC in a format that the MIT kdb5_util command can
load into a MIT KDC's database.
This makes transitioning from the Heimdal KDC to
the current MIT one feasible without having to
re-create the KDC database from scratch.
glebius@ did the initial work, cherry picking these
commits from the Heimdal sources on github and then doing
extensive merge conflict resolution and other fixes so
that it would build.
Heimdal commit fca5399 authored by Nico Williams:
Initial commit for second approach for multiple kvno. NOT TESTED!
Heimdal commit 57f1545 authored by Nico Williams:
Add support for writing to KDB and dumping HDB to MIT KDB dump format
Before this change Heimdal could read KDBs. Now it can write to
them too.
Heimdal can now also dump HDBs (including KDBs) in MIT format,
which can then be imported with kdb5_util load.
This is intended to help in migrations from MIT to Heimdal by
allowing migrations from Heimdal to MIT so that it is possible
to rollback from Heimdal to MIT should there be any issues. The
idea is to allow a) running Heimdal kdc/kadmind with a KDB, or
b) running Heimdal with an HDB converted from a KDB and then
rollback by dumping the HDB and loading a KDB.
Note that not all TL data types are supported, only two: last
password change and modify-by. This is the minimum necessary.
PKINIT users may need to add support for KRB5_TL_USER_CERTIFICATE,
and for databases with K/M history we may need to add KRB5_TL_MKVNO
support.
This resulted in a Heimdal kadmin that would dump
the KDC database in MIT format. However, there
were issues when this dump was loaded into the
current MIT KDC in FreeBSD current/15.0.
The changes I did to make the dump more useful are listed below:
When "-f MIT" is used for "kadmin -l dump" it writes
the dump out in MIT format. This dump format is understood
by the MIT kdb5_util command. The patch modifies the above
so that the MIT KDC's master key keytab file can be provided
as the argument to "-f" so that the principals are re-encrypted in
it. This allows any principal with at least one strong encryption
type key to work without needing a change_password.
The strong encryption types supported by the Heimdal KDC are:
aes256-cts-hmac-sha1-96
aes128-cts-hmac-sha1-96
The issues my changes address are:
- If there are weak encryption keys in a principal's entry,
MIT's kadmin.local will report that the principcal's entry
is incomplete or corrupted.
- The keys are encrypted in Heimdal's master key. The
"-d" option can be used on the "kadmin -l dump" to
de-encrypt them, but the passwords will not work on the
current MIT KDC.
To try and deal with the above issues, this patch modied the above to:
- Does not dump the weak keys.
- Re-encrypts the strong keys in MIT's master key if the argument
to "-f" is actually a filename which holds the MIT KDC's
master key keytab and not "MIT".
- For principals that only have weak keys, it generates
a fake strong key. This key will not work on the MIT
KDC, but the principal entry will work once a
change_password is done to it.
- It always generates a "modified_by" entry, faking one if
not already present in the Heimdal KDC database.
This was necessary, since the MIT kadmin will
report that the principal entry is "incomplete or
corrupted" without one.
It also fixed a problem where "get principal" no longer
worked after the initial patch was applied.
A man page update will be done as a separate commit.
I believe this commit is acceptable since the Heimdal
sources are now essentially deprecated in favor of the
MIT sources and that this new "-f" patch simplifies
the transition to the MIT KDC.
Discussed with: glebius, cy
MFC after: 3 days
We don't want to put these in clibs (where libc is) since they are not
critical to system operation. Move them to locales, since anyone who
is interested in translated versions of strerror() is going to have
that installed anyway.
While here, add some more documentation to bsd.nls.mk, particularly
the NLSPACKAGE option.
MFC after: 3 seconds
Reviewed by: manu, kib
Sponsored by: https://www.patreon.com/bsdivy
Differential Revision: https://reviews.freebsd.org/D52898
Document descriptions for device drivers always contain registered
trademarks of the manufacturers, but this is not a place for the
registered mark symbol. While here, remove another useless symbol,
the hyphen in the first line comment.
MFC after: 3 days
Previously if WITHOUT_TOOLCHAIN was set we'd create a FreeBSD-clang
package that contained only ar.5. As ar.5 describes the ar format
and doesn't come from Clang/LLVM move it to the FreeBSD-toolchain
package and make it conditional on MK_TOOLCHAIN.
Reviewed by: ivy
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52886
While here, break a long line that agitates the linter.
Fixes: cc16f1b9d9 (Add umass.c)
MFC after: 1 hour
Discussed with: imp, ivy
diff --git a/sys/dev/usb/FILES b/sys/dev/usb/FILES
This manual only describes a tiny amount suitable for the HW Relnotes.
Remove the description section and replace it with a hardware section
which will appear there.
MFC after: 3 minutes
Reported by: ivy
History Ref: 5bcb64f20a (Add mmc and mmcsd)
This manual contains nothing and is only suitable for the HW Relnotes,
but lets get it in so we have something and then can iterate on it.
MFC after: 3 minutes
Fixes: 2ed9833791 (thunderbolt: Import USB4 code)
Discussed with: obiwac
Differential Revision: https://reviews.freebsd.org/D52847
In some configurations, especially in jails, it is possible for the
system to boot so fast that we end up launching daemons while duplicate
address detection is still ongoing. If that happens, said daemons may
fail to bind to IPv6 addresses, as they are still tentative. Teach the
netwait service to wait (up to 10 seconds, by default) for the tentative
flag to vanish.
MFC after: 1 week
Reviewed by: olce
Differential Revision: https://reviews.freebsd.org/D51889
Only i386 lays out structures with weak (4-byte) alightment. It may be
that access works when weakly aligned, but from an ABI perspective, it's
all about struct layout.
Reviewed by: kib, emaste
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D52818
AFACT, this was never accurate. When there was support (such as it was)
for PDP endian it seems to have been spelled PDP_ENDIAN.
Reviewed by: imp, kib, emaste
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D52817
Hardware TCP LRO results in problems in settings with IP forwarding
being enabled. In case of nodes without IP forwarding, using
software LRO is also beneficial in general, since it can provide better
information about what was received on the wire.
Therefore, disable hardware TCP LRO by default.
By tuning the loader tunable, this can be changed.
PR: 263229
Reviewed by: Timo Völker
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D52684
This was previously deprecated and is slated for removal in 15.0.
Users who still need ftpd(8) can install the ftp/freebsd-ftpd port.
Retain the ftp(d) PAM services since other FTP daemons use them.
Update /etc/inetd.conf to point to /usr/local.
Add ftpd to ObsoleteFiles, but do not list configuration files since
users may want to preserve these to use with the freebsd-ftpd port.
There is still some language in the manual referring to ftpd(8)
which is relevant to the port, which has been retained but updated
to reference the port.
MFC after: 3 days
Relnotes: yes
Reviewed by: cperciva
Differential Revision: https://reviews.freebsd.org/D52739
I goofed in the previous commit.
Fixes: 05e5de00b9 ("vn_fullpath.9: Add missing links for described functions")
MFC after: 3 days
Event: EuroBSDCon 2025
Sponsored by: The FreeBSD Foundation
To reflect all the functions that are now described in the manual page.
Fixes: 9f269a0a77 ("MAC/do: Check executable path ...")
MFC after: 3 days
Event: EuroBSDCon 2025
Sponsored by: The FreeBSD Foundation
Introduce vn_fullpath_jail(), which returns a path to the passed vnode
relative to the current jail's root. It will be used by mac_do(4) in
a subsequent commit.
Factor out common code between the new variant and vn_fullpath(). While
here, rework the comments a bit.
Add vn_fullpath_jail() to the vn_fullpath.9 manual page. While here,
document all the existing public vn_fullpath*() functions.
Reviewed by: kib (except latest manual page changes)
MFC after: 3 days
Event: EuroBSDCon 2025
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52757
+ Rewrite SYNOPSIS for consistency
+ Rewrite HARDWARE for HW Relnotes, and add some stragglers
+ Correct mdoc grammar, making sysctls aproposable and linking xrefs
+ Clean up TODO, cannonicalize to CAVEATS, a standard section
+ Editorial pass, tag SPDX
MFC after: 3 days
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D52125
Enable the handling of the IFCAP_RXCSUM_IPV6 handling by handling
IFCAP_RXCSUM and IFCAP_RXCSUM_IPV6 as a pair. Also make clear, that
software and hardware LRO require receive checksum offload.
Reviewed by: Timo Völker
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D52682
The packages target was previously listed under kernel, move it to the
general source make targets listing. Add the update-packages target as
well. Adjust the release building targets with package in their names
to clarify they are unrelated to pkgbase. Add the OBJROOT and REPODIR
variables to ENVIRONMENT.
MFC after: 3 days
Reviewed by: ivy, markj (both previous versions)
Suggestions by: des, emaste, ivy, kevans, markj
Fixes: 1d26746cfd (Document the packages target)
Fixes: 0ac8aa55da (Add incremental packages)
Fixes: 26490d9b74 (allow update-packages for first)
Differential Revision: https://reviews.freebsd.org/D50289
This covers the basic structure of pkgbase, how packages are
distributed, how package sets work, and provides a few example
of actually using pkgbase.
MFC after: 6 hours
Approved by: re (cperciva)
Reviewed by: ziaee, cperciva
Differential Revision: https://reviews.freebsd.org/D52644
John Baldwin