Recent binutils considered the .gnu.warning.symbol section as a fatal error when
run with --fatal-warnings which makes any users of "insecure" functions from
libc failing to build with recent binutils.
Introduce a new macro: LD_FATAL_WARNINGS=no to run ld(1) with
--no-fatal-warnings for the users of "insecure" functions
Differential Revision: https://reviews.freebsd.org/D1320
A _NEW flag passed to _init_flags() to avoid check for double-init.
Differential Revision: https://reviews.freebsd.org/D1208
Reviewed by: jhb, wblock
MFC after: 1 Month
for counter mode), and AES-GCM. Both of these modes have been added to
the aesni module.
Included is a set of tests to validate that the software and aesni
module calculate the correct values. These use the NIST KAT test
vectors. To run the test, you will need to install a soon to be
committed port, nist-kat that will install the vectors. Using a port
is necessary as the test vectors are around 25MB.
All the man pages were updated. I have added a new man page, crypto.7,
which includes a description of how to use each mode. All the new modes
and some other AES modes are present. It would be good for someone
else to go through and document the other modes.
A new ioctl was added to support AEAD modes which AES-GCM is one of them.
Without this ioctl, it is not possible to test AEAD modes from userland.
Add a timing safe bcmp for use to compare MACs. Previously we were using
bcmp which could leak timing info and result in the ability to forge
messages.
Add a minor optimization to the aesni module so that single segment
mbufs don't get copied and instead are updated in place. The aesni
module needs to be updated to support blocked IO so segmented mbufs
don't have to be copied.
We require that the IV be specified for all calls for both GCM and ICM.
This is to ensure proper use of these functions.
Obtained from: p4: //depot/projects/opencrypto
Relnotes: yes
Sponsored by: FreeBSD Foundation
Sponsored by: NetGate
support, make this explicit in src.opts.mk, by updating the default
settings.
The defaults become as follows:
* If the host compiler is not C++11 capable, use gcc and disable clang.
* On x86, enable clang, make it the default cc, and disable gcc.
* On little-endian ARM, enable clang, but not the full build, make it
the default cc, and disable gcc.
* On PowerPC, enable clang, but enable gcc and make that the default cc.
* On everything else, use gcc, and disable clang.
This can be amended later, if we get e.g. sparc64 or big-endian ARM
working with clang.
Reviewed by: imp, brooks
Differential Revision: https://reviews.freebsd.org/D1294
termcap entry reordering requires ex (which is available via usr.bin/vi), which
breaks on build hosts where installworld is run with MK_VI == no (or when
make delete-old is run on ^/projects/building-blocks as vi, et al, are
removed on the branch when the knob is tweaked to => "no")
Reordering termcap was believed to improve performance, but the file is now
accessed via /etc/termcap.db, so /etc/termcap (and /usr/share/misc/termcap by
proxy) access is less preferred.
Reordering the file broke the historical comment <-> entry mapping as well,
which could muddle the purpose of entries in the file, so it could be
potentially harmful to readers in its reordered state.
Discussion took place on hackers@ here:
https://lists.freebsd.org/pipermail/freebsd-hackers/2014-December/046657.html
Discussed with: -hackers, mp
MFC after: 1 month
Sponsored by: EMC / Isilon Storage Division
Set WITH_ELFTOOLCHAIN_TOOLS in src.conf to use the elftoolchain version
of the following tools:
* addr2line
* elfcopy (strip / mcs)
* nm
* size
* strings
Reviewed by: bapt (earlier version)
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D1224
to how they differ. This will assist users in selecting which interface
is more appropriate for their purposes.
Approved by: grog (co-mentor)
MFC after: 2 week
- MK_FILE will conditionalize building lib/libmagic and usr.bin/file
- MK_SQLITE3 will conditionalize building lib/libsqlite3, and will disable
MK_SVN/MK_SVNLITE by proxy
Customize according to MK_GAMES and MK_VI, in particular comment out lines
that would change behavior
Change dot.cshrc and dot.profile to not check for /usr/games/fortune based
on the new behavior in customizing the files
implementation, merge ^/head r275078 through r275117.
Note that all the extraneous mergeinfo is there because Subversion
created it. I'll hopefully be able to remove it again when merging back
to head.
- bootparamd
- bootpd
- finger/fingerd
- ftp/ftpd
- hastctl/hastd
- iscsid, et al
- rbootd
- talk/talkd
- tcpd, et al
- tftp/tftpd
Add src.conf entries for the various components and do a best effort
at adding components to tools/build/mk/OptionalObsoleteFiles.inc
This is a thin wrapper around the kernel interface which should make
it easier to write GPIO applications. gpioctl(8) will be converted to
use this library in a separate commit.
Differential Revision: https://reviews.freebsd.org/D1183
Reviewed by: adrian, loos
Discussed on: arm@, embedded@
Relnotes: yes
LIBADD will automatically set DPADD and LDADD when needed including their
dependencies, LIBADD automatically handles private and internal libs so that
the end user Makefile does not have to care about it.
This allows to reduce overlinking on the base system leaving the framework get
the dependencies properly.
It also allows to built components binaries statically.
To use it:
Replace:
DPADD= ${LIBARCHIVE} ${LIBSSL}
LDADD= -larchive -lssl
by:
LIBADD= archive ssl
Differential Revision: https://reviews.freebsd.org/D1209
Reviewed by: brooks imp
supported hardware list. Judging by the PCI driver attachment, dpt_pci.c
only supports a single adapter rather than the various PCI adapters listed.
The list of EISA adapters listed somewhat overlaps with the device IDs in
dpt_eisa.c. It's not clear which devices are ISA-only devices.
Initially in_matrote() in_clsroute() in their current state was introduced by
r4105 20 years ago. Instead of deleting inactive routes immediately, we kept them
in route table, setting RTPRF_OURS flag and some expire time. After that, either
GC came or RTPRF_OURS got removed on first-packet. It was a good solution
in that days (and probably another decade after that) to keep TCP metrics.
However, after moving metrics to TCP hostcache in r122922, most of in_rmx
functionality became unused. It might had been used for flushing icmp-originated
routes before rte mutexes/refcounting, but I'm not sure about that.
So it looks like this is nearly impossible to make GC do its work nowadays:
in_rtkill() ignores non-RTPRF_OURS routes.
route can only become RTPRF_OURS after dropping last reference via rtfree()
which calls in_clsroute(), which, it turn, ignores UP and non-RTF_DYNAMIC routes.
Dynamic routes can still be installed via received redirect, but they
have default lifetime (no specific rt_expire) and no one has another trie walker
to call RTFREE() on them.
So, the changelist:
* remove custom rnh_match / rnh_close matching function.
* remove all GC functions
* partially revert r256695 (proto3 is no more used inside kernel,
it is not possible to use rt_expire from user point of view, proto3 support
is not complete)
* Finish r241884 (similar to this commit) and remove remaining IPv6 parts
MFC after: 1 month
The canonical standalone debug directory established by the GNU
toolchain is /usr/lib/debug, and we use it when WITH_DEBUG_FILES is set.
Mention it in the file system hierarchy page.
Reviewed by: bcr
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D1134
have chosen different (and more traditional) stateless/statuful
NAT64 as translation mechanism. Last non-trivial commits to both
faith(4) and faithd(8) happened more than 12 years ago, so I assume
it is time to drop RFC3142 in FreeBSD.
No objections from: net@
Split it into two modules: if_gre(4) for GRE encapsulation and
if_me(4) for minimal encapsulation within IP.
gre(4) changes:
* convert to if_transmit;
* rework locking: protect access to softc with rmlock,
protect from concurrent ioctls with sx lock;
* correct interface accounting for outgoing datagramms (count only payload size);
* implement generic support for using IPv6 as delivery header;
* make implementation conform to the RFC 2784 and partially to RFC 2890;
* add support for GRE checksums - calculate for outgoing datagramms and check
for inconming datagramms;
* add support for sending sequence number in GRE header;
* remove support of cached routes. This fixes problem, when gre(4) doesn't
work at system startup. But this also removes support for having tunnels with
the same addresses for inner and outer header.
* deprecate support for various GREXXX ioctls, that doesn't used in FreeBSD.
Use our standard ioctls for tunnels.
me(4):
* implementation conform to RFC 2004;
* use if_transmit;
* use the same locking model as gre(4);
PR: 164475
Differential Revision: D1023
No objections from: net@
Relnotes: yes
Sponsored by: Yandex LLC
Otherwise there's nothing for ctfconvert to do, and it ends up emitting an
error for each object file. Also remove some redundant checks from
bsd.prog.mk and bsd.lib.mk.
Differential Revision: https://reviews.freebsd.org/D1111
Reviewed by: imp
a kludge. However, it also effectively works around the issues for
high -j builds on systems that do not have the rm fixes.
A better fix would be to rmdir here, and fix the places where we're
sloppy and not list all the files we create in CLEANFILES, should
anybody have the time to chase them all to ground.
generating files from various sources instead of calling cat ${.ALLSRC} | sed
The perl case was skipped because it's not being used in the tree at this time
contrib/netbsd-tests
This Makefile snippet handles polluting testcases with -lnetbsd, specific
headers for ATF version differences, and does necessary rewriting for the
testcases to match the format discussed on the TestSuite wiki page
(t_<foo> -> <foo>_test)
One must define SRCTOP (inspired by projects/bmake), OBJTOP, and TESTSRC
(e.g. contrib/netbsd-tests/lib/libc/gen) to use the Makefile snippet
Test programs are specific either via NETBSD_ATF_TESTS_C or NETBSD_ATF_TESTS_SH
C++ analogs aren't currently implemented.
The imported testcases will be cleaned up to use this Makefile snippet pseudo
"API".
Those tunables are used to set a specific mode in vt(4) instead of using
the default mode.
Differential Revision: https://reviews.freebsd.org/D1098
Reviewed by: ak@, emaste@, kwm@
MFC after: 1 week
pjdfstest execution is opt-in and must be done as root due to some of the
assumptions made by the test suite and lack of error checking in the non-root
case
A description of how to execute pjdfstest with kyua is provided in
share/pjdfstest/README
Phabric: D824 (an earlier prototype patch)
MFC after: 1 month
Relnotes: yes
Sponsored by: EMC / Isilon Storage Division
whether the shared request for already shared-locked lock could be
granted. Both problems result in the exclusive locker starvation.
The concurrent exclusive request is indicated by either
LK_EXCLUSIVE_WAITERS or LK_EXCLUSIVE_SPINNERS flags. The reverse
condition, i.e. no exclusive waiters, must check that both flags are
cleared.
Add a flag LK_NODDLKTREAT for shared lock request to indicate that
current thread guarantees that it does not own the lock in shared
mode. This turns back the exclusive lock starvation avoidance code;
see man page update for detailed description.
Use LK_NODDLKTREAT when doing lookup(9).
Reported and tested by: pho
No objections from: attilio
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
of fuword(9) and suword(9). This makes the functions type-compatible
with volatile objects and does not require devolatile force, e.g. in
kern_umtx.c.
Requested by: bde
Reviewed by: jhb
Sponsored by: The FreeBSD Foundation
MFC after: 3 weeks
bsd.progs.mk generates a separate depend file for every program being
built, but then it does not properly tell each submake to use those
individual files. Properly propagate the depend file to use.
Discovered while preparing the update of atf to 0.21 and noticing that
the test programs were not being relinked to the new library.
This change is "make tinderbox" clean.
This code has had an extensive rewrite and a good series of reviews, both by the author and other parties. This means a lot of code has been simplified. Pluggable structures for high-rate entropy generators are available, and it is most definitely not the case that /dev/random can be driven by only a hardware souce any more. This has been designed out of the device. Hardware sources are stirred into the CSPRNG (Yarrow, Fortuna) like any other entropy source. Pluggable modules may be written by third parties for additional sources.
The harvesting structures and consequently the locking have been simplified. Entropy harvesting is done in a more general way (the documentation for this will follow). There is some GREAT entropy to be had in the UMA allocator, but it is disabled for now as messing with that is likely to annoy many people.
The venerable (but effective) Yarrow algorithm, which is no longer supported by its authors now has an alternative, Fortuna. For now, Yarrow is retained as the default algorithm, but this may be changed using a kernel option. It is intended to make Fortuna the default algorithm for 11.0. Interested parties are encouraged to read ISBN 978-0-470-47424-2 "Cryptography Engineering" By Ferguson, Schneier and Kohno for Fortuna's gory details. Heck, read it anyway.
Many thanks to Arthur Mesh who did early grunt work, and who got caught in the crossfire rather more than he deserved to.
My thanks also to folks who helped me thresh this out on whiteboards and in the odd "Hallway track", or otherwise.
My Nomex pants are on. Let the feedback commence!
Reviewed by: trasz,des(partial),imp(partial?),rwatson(partial?)
Approved by: so(des)
expression (:M) is empty, not the not matched (:N) is empty. The former case
means we have not found the TEST_SUBDIR value in SUBDIR
Reported by: rodrigc
X-MFC with: r273803
Pointyhat to: me (did not use a clean install root)
Sponsored by: EMC / Isilon Storage Division
appending the TESTS_SUBDIRS variable to SUBDIR
Duplicate directory entries can cause unexpected side effects, like
installing the same files multiple times. This can be easily
reproduced via the following testcase prior to this commit:
SUBDIR= dir
TESTS_SUBDIRS+= dir
.include <bsd.test.mk>
Sponsored by: EMC / Isilon Storage Division
and casuword(9), but do not mix value read and indication of fault.
I know (or remember) enough assembly to handle x86 and powerpc. For
arm, mips and sparc64, implement fueword() and casueword() as wrappers
around fuword() and casuword(), which means that the functions cannot
distinguish between -1 and fault.
On architectures where fueword() and casueword() are native, implement
fuword() and casuword() using fueword() and casuword(), to reduce
assembly code duplication.
Sponsored by: The FreeBSD Foundation
Tested by: pho
MFC after: 2 weeks (ia64 needs treating)
