Since the KTLS now supports TLS1.3, the daemons default
to version 1.3, since the draft (to be an RFC someday)
requires TLS1.3.
However, since FreeBSD 13,0, 13,1 uses TLS1.2 for
NFS-over-TLS, the "-2" option is added to both daemons
for compatibility with FreeBSD 13.0, 13.1.
This patch updates the man pages for this.
This is a content change.
Reviewed by: pauamma_gundo.com
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D35290
Since the KTLS now supports TLS1.3, the daemons default
to version 1.3, since the draft (to be an RFC someday)
requires TLS1.3.
However, since FreeBSD 13,0, 13,1 uses TLS1.2 for
NFS-over-TLS, the "-2" option is added to both daemons
for compatibility with FreeBSD 13.0, 13.1.
This patch updates the man pages for this.
This is a content change.
Reviewed by: pauamma_gundo.com
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D35290
Commit f5b40aa0de modifies the -C command line option
for rpc.tlsclntd to use the TLS 1.3 SSL_CTX_set_ciphersuites().
This patch updates the man page for this modified command
line option.
This is a content change.
Reviewed by: jhb, pauamma_gundo.com (same change for rpc.tlsservd.8)
MFC after: 2 weeks
Commit 0b4f2ab0e9 fixes the krpc so that it can use TLS
version 1.3 for NFS-over-TLS, as required by
the draft (someday to be an RFC).
This patch replaces SSL_CTX_set_cipher_list() with
SSL_CTX_set_ciphersuites(), since that is the function
that is used for TLS1.3.
The man page will be updated in a separate commit.
MFC after: 2 weeks
Commit 0b4f2ab0e9 fixes the krpc so that it can use TLS
version 1.3 for NFS-over-TLS, as required by
the draft (someday to be an RFC).
This patch replaces SSL_CTX_set_cipher_list() with
SSL_CTX_set_ciphersuites(), since that is the function
that is used for TLS1.3.
The man page has already been updated.
MFC after: 2 weeks
Commit 712aac1389 adds a new -C command line option
to rpc.tlsservd.
This patch updates the man page for this new command
line option.
This is a content change.
Reviewed by: jhb, pauamma_gundo.com
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D35136
bsdinstall(8) has an option to enable moused support.
However, if it is not selected, moused is still started
through the configuration of nondefault devices.
So, automatically add the moused_nondefault_enable="NO"
setting to rc.conf unless moused support is selected.
PR: 227999
Reported by: bcran
Reviewed by: bapt
Differential Revision: https://reviews.freebsd.org/D35193
Commit 0b4f2ab0e9 fixes the krpc so that it can use TLS
version 1.3 for NFS-over-TLS, as required by
the draft (someday to be an RFC).
Since FreeBSD 13.0, 13.1 use TLS version 1.2 for
NFS-over-TLS mounts, this command line option
may be used so that NFS-over-TLS mounts to 13.0, 13.1
servers will still work.
Without the command line option, NFS-over-TLS mounts
will use TLS version 1.3.
The man page update will be a separate commit.
MFC after: 2 weeks
Commit 0b4f2ab0e9 fixes the krpc so that it can use TLS
version 1.3 for NFS-over-TLS, as required by
the draft (someday to be an RFC).
Since FreeBSD 13.0, 13.1 use TLS version 1.2 for
NFS-over-TLS mounts, this command line option
may be used so that mounts from 13.0, 13.1 will still work.
Without the command line option, only TLS version 1.3
mounts are permitted.
The man page update will be a separate commit.
MFC after: 2 weeks
Add a sentence that explains that PATH is set to `/bin:/usr/bin`.
I had to dive into `jexec.c` to find this out.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D35251
Makefile.arm64 relies on being included via Makefile.${MACHINE}. This
only works when arm64 is the only aarch64 architecture. Switch to
Makefile.aarch64 so downstream CheriBSD can use the file when building
for Morello which uses a differen ${MACHINE} value.
Sponsored by: Innovate UK
When a new FS image is created we need to calculate how much space each
file is going to consume.
Fix two bugs in that logic:
1) Count the space needed for indirect blocks for large files.
1) Normally the trailing data of a file is written to a block of frag
size, 4 kB by default.
However for files that use indirect blocks a full block is allocated,
32kB by default. Take that into account.
Adjust size calculations to match what is done in ffs_mkfs routine:
* Depending on the UFS version the superblock is stored at a different
offset. Take that into account.
* Add the cylinder group block size.
* All of the above has to be aligned to the block size.
Finally, Remove "ncg" variable. It's always 1 and it was used to
multiply stuff.
PR: 229929
Reviewed by: mckusick
MFC after: 2 weeks
Sponsored by: Semihalf
Submitted by: Kornel Dulęba <mindal@semihalf.com>
Differential Revision: https://reviews.freebsd.org/D35131
Differential Revision: https://reviews.freebsd.org/D35132
Override OSNAME to change the name of the OS in the installer.
This is a first step, the shell changes will be separate.
Reviewed by: allanjude
Approved by: allanjude
Differential Revision: https://reviews.freebsd.org/D34878
Sponsored by: Rubicon Communications, LLC ("Netgate")
Devices that cannot be opened are most likely the install media and
should not be listed as destinations.
Reviewed by: allanjude
Approved by: allanjude
Differential Revision: https://reviews.freebsd.org/D34879
Sponsored by: Rubicon Communications, LLC ("Netgate")
Leave -Wcast-align disabled, at least for now, since there are numerous
instances of that warning in places where buffer pointers are cast to
pointers to various filesystem structures. Fixing this properly would
be too much work for too little gain.
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
This patch adds logging of the version of TLS and cipher
negotiated successfully by the TLS handshake for each client,
if the "-v" command line option has been specified.
This information may be useful for monitoring and debugging
NFS-over-TLS mounts.
MFC after: 2 weeks
virtio-console is currently missing .pe_legacy_config, which prevents any
portN configuration from being parsed, and therefore no sockets will be
created.
Reviewed by: khng
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D35142
The "C" option in the argument to getopt_long() was
missing a ":" for both rpc.tlsclntd.c and rpc.tlsservd.c.
This patch fixes this.
MFC after: 2 weeks
rpc.tlsclntd has a -C command line option for setting
preferred_ciphers. Testing at a recent IETF NFSv4 testing
event showed that setting preferred_ciphers is not normally
needed for the rpc.tlsservd.
This patch modifies rpc.tlsservd to not specify preferred_ciphers
by default, but provides the same -C option as rpc.tlsclntd to
set preferred_ciphers, in case it is needed.
The man page update will be done as a separate commit.
MFC after: 2 weeks
When running zpool export first, boot/efi and dev is still mounted so
zpool export fails. By running bsdinstall umount first the pool can be
cleanly exported.
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D35114
Sponsored by: Beckhoff Automation GmbH & Co. KG
MFC After: 3 days
Throughout the bsdinstall script fd 3 is used by f_dprintf (set through
$TERMINAL_STDOUT_PASSTHRU). By closing file descriptor 3 here, the
final f_dprintf "Installation Completed ... does not work anymore.
By putting the code into a subshell, file descriptors can be edited
without interference with the calling script.
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D35113
Sponsored by: Beckhoff Automation GmbH & Co. KG
MFC after: 3 days
Sometimes the parent-child sshd protocol changes during an upgrade, and
when this happens sshd will not accept new connections until it is
restarted.
PR: 263489
Reviewed by: kevans, gjb
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D35109
After an installation restart (for error or choice) dhclient does not
rebuild resolv.conf so `dialog --mixedform' of "Resolver Configuration"
in bsdinstall/scripts/netconfig draws empty forms. It causes a bad UX,
to see PR262262. Fixed resetting the interface before to run dhclient.
PR: 262262
Reviewed by: bapt
Differential Revision: https://reviews.freebsd.org/D35094
Fix bsdinstall "Auto (UFS) Guided Disk Setup" and sade(8) "Auto".
The problem is a string comparison failure, it arose during the
dialog(3)/bsddialog(3) form conversion:
* dialog uses only form.text while bsdialog differentiates between
form.init and form.value.
* dialog always allocates memory for form values while bsddialog only
when a button is pressed.
Reviewed by: bapt
Differential Revision: https://reviews.freebsd.org/D35033
Now that nvlist_send()/nvlist_recv() are being used, ditch the datagram
socket.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D34863
When invoked by inetd, ctlstat -P will now produce output suitable for
ingestion into Prometheus.
It's a drop-in replacement for https://github.com/Gandi/ctld_exporter,
except that it doesn't report the number of initiators per target, and
it does report time and dma_time.
MFC after: 2 weeks
Sponsored by: Axcient
Relnotes: yes
Reviewed by: bapt, bcr
Differential Revision: https://reviews.freebsd.org/D29901
When exporting sysctls to Prometheus, the exporter replaces "." with
"_". This caused several metrics to alias, confusing the Prometheus
server. Fix it by:
* Renaming the "tcp_log_bucket" UMA zone to "tcp_log_id_bucket". Also,
rename "tcp_log_node" to "tcp_log_id_node" for consistency.
* Not exporting sysctls with "(LEGACY)" in the description. That is
used by ZFS sysctls that have been replaced by others, many of which
alias to the same Prometheus metric name (like "vfs.zfs.arc_max" and
"vfs.zfs.arc.max").
PR: 259607
Reported by: delphij
MFC after: 2 weeks
Sponsored by: Axcient
Reviewed by: delphij,rew,thj
Differential Revision: https://reviews.freebsd.org/D34952
cxgbei needs the ability to return different limits based on the
connection (e.g. if the connection is over a T5 adapter or a T6
adapter as well as factoring in the MTU).
This change plumbs through the changes in the ioctls without changing
any of the backends. The limits callback passed to icl_register now
accepts a second socket argument which holds the integer file
descriptor. To support ABI compatiblity for old binaries, the
callback should return "global" values if the socket fd is zero.
The CTL_ISCSI_LIMITS argument used with CTL_ISCSI by ctld(8) now
accepts the socket fd in a field that was previously part of a
reserved spare field. Old binaries zero this request which results in
passing a socket fd of 0 to the limits callback.
The ISCSIDREQUEST ioctl no longer returns limits. Instead, iscsid(8)
invokes a new ISCSIDLIMITS ioctl after establishing the connection via
connect(2). For ABI compat, if the old ISCSIDREQUEST is invoked, the
global limits are still fetched (with a socket fd of 0) and returned.
Reviewed by: mav
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D34928
This reduces duplication in the two lists and makes it clearer which
ioctls are needed in the ICL_KERNEL_PROXY case.
Reviewed by: mav
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D34927
Since the first unattributed commit in 1981, lpr has attempted to
prevent users from printing executables (and in earlier versions
archives). Archive detection was lost in 1992 when lpr gained a
dependency on a.out.h. No corresponding support was added for ELF files
with the full transiation to ELF in 1998, but a.out support has been
dragged forward to and contaminated platforms that never supported
a.out.
While this feature isn't unuseful, preventing the printing of
a single file format we stopped producing ~20 years ago isn't worth
the costs (however minimal).
Reviewed by: gad, imp, emaste
Differential Revision: https://reviews.freebsd.org/D34901
Queue "roundrobin" in a COP rule means the driver should select queues
for new tids in a round-robin manner.
Reviewed by: jhb@
MFC after: 1 week
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D34922
-A and -m select different output modes output modes for diff3. When
both flags are present gnu diff3 prefers -m, drop the extra -A flag in
etcupdate.
Reviewed by: pstef, 0mp
MFC after: 3 days
Sponsored by: Klara Inc
Differential Revision: <https://reviews.freebsd.org/D###>
Little refactoring to complete the conversion to bsddialog(3),
not functional changes:
* Delete: remaining code for autosizing using BSDDIALOG_AUTOSIZE.
* Add: constants to delete magical numbers and to avoid unclear
returned values.
* Delete: redundant 'conf.button.default_cancel=false', performed by
bsddialog_initconf().
* Add: a new function message_zoneinfo_file() to merge features.
Approved by: bapt (mentor)
Differential Revision: https://reviews.freebsd.org/D34862
These options use the CONS_SCRSHOT ioctl to capture the contents of the
current console, which is not yet supported by vt(4). Disable the
options when vt(4) is in use rather than emitting a possibly confusing
error message.
This change should be reverted if CONS_SCRSHOT is implemented for vt(4).
PR: 263099
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
bsdinstall/partedit: Replace (LGPL) libdialog with (BSD-2-Clause)
libbsddialog. Rewrite diskeditor.c and rename diskmenu.c because
it uses an API for menu totally incompatible with libbsddialog.
This is a User Interface change everything else is unchanged.
Approved by: bapt (mentor)
Differential Revision: https://reviews.freebsd.org/D34639
Arguments passed to flags like -d and -k had ambiguous names like "dir".
Change that to more descriptive names like "homedir".
Also, clarify that -u min,max is for UIDs and -i min,max for GIDs.
MFC after: 1 week
pci_parse_legacy_config splits the options string by comma characters.
strchr returns a pointer to the first occurence of a character. In that
case, it's a comma. So, pci_parse_legacy_config will stop at the first
character and creates a new config node with a name of NULL.
Reviewed by: jhb
Differential Revision: https://reviews.freebsd.org/D34600
At the moment, writes to BAR registers that aren't 4 byte aligned are
ignored. So, there's no overflow yet. Nevertheless, if this behaviour
changes in the future, it could unintentionally, introduce a buffer
overflow. Additionally, some compiler or tools will detect this
potential overflow and complain about it.
Reviewed by: markj
Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com>
Reported-by: Andy Fiddaman <andy@omniosce.org>
Differential Revision: https://reviews.freebsd.org/D34689
fstyp looks for a 0x55 0xAA signature at offset 510, but this is not
required by specifications and is not proivded by the Raspberry Pi Nano
bootloader.
We should really remove the signature check and implement a more
comprehensive BPB validation instead, but it will require more
investigation and testing. For now just add a special case for the
Raspberry Pi Nano bootloader, to avoid introducing regressions or new
false positives.
PR: 262896
Reviewed by: delphij
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D34699
Avoid a null dereference when a value-less jailsys parameter is passed
to "jail -m". There was already code to handle boolean parameters,
but in reality any parameter could be passed without a value.
The order of arguments in the example does not work, because tar thinks
the directory is named -C, which does not exist and reports:
tar: Error opening archive: Failed to open '-C'
Approved by: rpokala@ (src) on IRC
Differential Revision: https://reviews.freebsd.org/D34649
Replace (LGPL) dialog utility with (BSD-2-Clause) bsddialog utility,
'dialog --calendar' is replaced by 'bsddialog --datebox' with same
features but different User Interface.
Approved by: bapt (mentor)
Differential Revision: https://reviews.freebsd.org/D34583
The initial patch had a bug where the full volume syntax, floating point values,
:, + and -, wasn't accepted.
While at it move some defines to enum's.
Fixes: da3d4469ef
Submitted by: christos@
Differential Revision: https://reviews.freebsd.org/D34617
Sponsored by: NVIDIA Networking
dev.volume=X[.X] can now also be written as dev=X[.X] .
Requested by: hselasky@ and bsduck (FreeBSD forums)
Submitted by: christos@
Differential Revision: https://reviews.freebsd.org/D34612
Sponsored by: NVIDIA Networking
NAME_MAX is a better fit since strcat_extension() constructs the
filename of the snapshot file.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D34291
Allows callers of vm_get_name() to retrieve the vm name without having
to allocate a buffer.
While in the vicinity, do minor cleanup in vm_snapshot_basic_metadata().
Reviewed by: jhb
Differential Revision: https://reviews.freebsd.org/D34290
