Commit Graph

4456 Commits

Author SHA1 Message Date
Warner Losh
d9964624bd Push mips support into the tree. 2008-12-11 08:22:20 +00:00
Robert Watson
52267f7411 Merge OpenBSM 1.1 alpha 2 from the OpenBSM vendor branch to head, both
contrib/openbsm (svn merge) and sys/{bsm,security/audit} (manual merge).

- Add OpenBSM contrib tree to include paths for audit(8) and auditd(8).
- Merge support for new tokens, fixes to existing token generation to
  audit_bsm_token.c.
- Synchronize bsm includes and definitions.

OpenBSM history for imported revisions below for reference.

MFC after:      1 month
Sponsored by:   Apple Inc.
Obtained from:  TrustedBSD Project

--

OpenBSM 1.1 alpha 2

- Include files in OpenBSM are now broken out into two parts: library builds
  required solely for user space, and system includes, which may also be
  required for use in the kernels of systems integrating OpenBSM.  Submitted
  by Stacey Son.
- Configure option --with-native-includes allows forcing the use of native
  include for system includes, rather than the versions bundled with OpenBSM.
  This is intended specifically for platforms that ship OpenBSM, have adapted
  versions of the system includes in a kernel source tree, and will use the
  OpenBSM build infrastructure with an unmodified OpenBSM distribution,
  allowing the customized system includes to be used with the OpenBSM build.
  Submitted by Stacey Son.
- Various strcpy()'s/strcat()'s have been changed to strlcpy()'s/strlcat()'s
  or asprintf().  Added compat/strlcpy.h for Linux.
- Remove compatibility defines for old Darwin token constant names; now only
  BSM token names are provided and used.
- Add support for extended header tokens, which contain space for information
  on the host generating the record.
- Add support for setting extended host information in the kernel, which is
  used for setting host information in extended header tokens.  The
  audit_control file now supports a "host" parameter which can be used by
  auditd to set the information; if not present, the kernel parameters won't
  be set and auditd uses unextended headers for records that it generates.

OpenBSM 1.1 alpha 1

- Add option to auditreduce(1) which allows users to invert sense of
  matching, such that BSM records that do not match, are selected.
- Fix bug in audit_write() where we commit an incomplete record in the
  event there is an error writing the subject token.  This was submitted
  by Diego Giagio.
- Build support for Mac OS X 10.5.1 submitted by Eric Hall.
- Fix a bug which resulted in host XML attributes not being arguments so
  that const strings can be passed as arguments to tokens.  This patch was
  submitted by Xin LI.
- Modify the -m option so users can select more then one audit event.
- For Mac OS X, added Mach IPC support for audit trigger messages.
- Fixed a bug in getacna() which resulted in a locking problem on Mac OS X.
- Added LOG_PERROR flag to openlog when -d option is used with auditd.
- AUE events added for Mac OS X Leopard system calls.
2008-12-02 23:26:43 +00:00
Rafal Jaworowski
f6d2be2556 gdb: Remove arm_pc_is_thumb_dummy() and related code.
This is basically an import of the following gdb change:
http://sourceware.org/ml/gdb-cvs/2005-03/msg00143.html (which in effect fixes
problems with gracefully closing down the non-Thumb program being debugged).
2008-11-17 16:37:04 +00:00
Rong-En Fan
d87cbd8b75 - Update instructions for Subversion import
- Remove FREEBSD-vendor as edwin@ is working on a automatically contrib
  software status page generation
2008-11-15 09:30:09 +00:00
Rong-En Fan
5d08fb1f77 - Update ncurses to 5.7-20081102 (5.7 release) and build glue
- This also removes $FreeBSD$ from two now unmodifed source files
  ncurses/tinfo/lib_raw.c and ncurses/tinfo/lib_baudrate.c

MFC after:	2 months (after 7.1 and 6.4 are released)
2008-11-15 09:23:48 +00:00
Gregory Neil Shapiro
3513e2fba4 Merge from vendor dist: Bring in a change already in the sendmail
repository that will allow sendmail to be built with the c99 compiler.

Submitted by: rdivacky
2008-11-15 04:43:54 +00:00
Ed Schouten
279d93aa23 Use strlcpy() instead of strcpy().
Requested by:	mlaier
2008-11-13 20:40:38 +00:00
Ed Schouten
225c0f4b44 Convert telnetd(8) to use posix_openpt(2).
Some time ago I got some reports MPSAFE TTY broke telnetd(8). Even
though it turned out to be a different problem within the TTY code, I
spotted a small issue with telnetd(8). Instead of allocating PTY's using
openpty(3) or posix_openpt(2), it used its own PTY allocation routine.
This means that telnetd(8) still uses /dev/ptyXX-style devices.

I've also increased the size of line[]. Even though 16 should be enough,
we already use 13 bytes ("/dev/pts/999", including '\0'). 32 bytes gives
us a little more freedom.

Also enable -DSTREAMSPTY. Otherwise telnetd(8) strips the PTY's pathname
to the latest slash instead of just removing "/dev/" (e.g. /dev/pts/0 ->
0, instead of pts/0).

Reviewed by:	rink
2008-11-13 19:05:27 +00:00
Robert Watson
4b5f8caf19 Flatten OpenBSM vendor tree in preparation for new OpenBSM vendor
import.
2008-11-12 23:48:20 +00:00
Rong-En Fan
a388f19919 - Flatten the vendor area 2008-11-09 09:06:04 +00:00
Robert Watson
6966d7767a When encoding an smb name, truncate one byte earlier in order than we did
previously in order to ensure it fit properly in the bufer when encoded.
This prevents a debugging printf from firing if a source or destination
host name for an smb mount exceeds 15 characters.

MFC after:	3 days
Obtained from:	Apple, Inc.
2008-11-02 19:48:15 +00:00
Ruslan Ermilov
3b8bd8e77a Actually fix pty detection for autologout setting.
(The fix has been submitted upstream.)
2008-10-20 08:44:14 +00:00
Christian S.J. Peron
154bbe416c Implement zero-copy bpf(4) buffer or "zbuf" support for libpcap. A slightly
different version has been committed upstream in the libpcap vendor branch.
This will allow people to experiment with zero-copy bpf(4) without requiring
external patches.

Note to enable this functionality:

    sysctl net.bpf.zerocopy_enable=1

By default, libpcap will use the legacy buffering method unless this sysctl
variable is set to 1.

For the details about zero-copy bpf(4) implementation see svn change r177548.

Requested by:		many
Discussed with:		sam
In collaboration with:	rwatson
2008-09-16 20:32:29 +00:00
Antoine Brodin
d676c049d7 Fix TELOPT(opt) when opt > TELOPT_TN3270E.
PR:		127194
Submitted by:	Joost Bekkers
MFC after:	1 month
2008-09-13 17:46:50 +00:00
David E. O'Brien
5a33926c5b If arm.h is going to define WCHAR_TYPE, don't assume WCHAR_TYPE_SIZE
doesn't already have a definition.

Reported by:	imp
2008-09-10 15:47:31 +00:00
Ollivier Robert
f8b329f0ed Merge from vendor/ntp/dist: r182856:
Apply updated patch from bin/92839 to avoid two possible buffer overflows.

PR:		bin/92839
Submitted by:	Helge Oldach <freebsdntpd@oldach.net>
2008-09-07 22:15:41 +00:00
David Schultz
9fb02073a3 Make strtof() respect the current rounding mode. 2008-09-03 07:32:06 +00:00
David Schultz
ae2cbf4c64 Merge gdtoa 20080831. This fixes several bugs, including an infinite
loop pointed out by cognet@ that occurs when calling strtod() with a
string representing a number between DBL_MAX and 2*DBL_MAX, when the
rounding mode is anything other than the default.
2008-09-03 07:23:57 +00:00
David Schultz
1d35705154 Flatten vendor/gdtoa/*. 2008-09-03 05:17:02 +00:00
Gregory Neil Shapiro
dbe6d91e5c Fix an ABI breakage found after the import that will be part of the
next version of sendmail.  Putting it in now for the upcoming 7-BETA
and 6-BETA test releases.

Submitted by:	Mike Tancsa
2008-09-02 04:53:24 +00:00
David E. O'Brien
0b4f8552dd We're not quite ready for the full %(endian_spec). 2008-09-01 23:09:45 +00:00
Doug Barton
ac9a011f43 Merge from vendor/bind9/dist as of the 9.4.2-P2 import 2008-09-01 22:54:49 +00:00
David E. O'Brien
1b34d5982b Add __unix__. Tweak __KPRINTF_ATTRIBUTE__ while I'm here. 2008-09-01 22:22:44 +00:00
David E. O'Brien
4bdc01a9f9 Add FreeBSD/MIPS support to GCC. 2008-09-01 18:46:03 +00:00
David E. O'Brien
9dec52bfb2 Turn cc_tools/Makefile and Makefile.tgt into a "linear" read. Shared
parts of the configuration aren't duplicated, and arch-specific exceptions
are made "in-place".  Also clean up the FreeBSD/amd64 config a little.
2008-08-31 23:38:28 +00:00
Tom Rhodes
074d0d4c1d List authentication types supported with "-X" taken from the libtelnet
code.

PR:		121721
2008-08-29 00:04:37 +00:00
Gregory Neil Shapiro
9aa98a5913 Update import/merge instructions for the svn repo 2008-08-28 06:20:43 +00:00
Gregory Neil Shapiro
e3793f7654 Merge sendmail 8.14.3 into HEAD.
Note: As the first merge since the conversion to svn, it includes many
propset changes to get the proper svn:eol-style and svn:mime-type on the
files (as merged from the fixed up vendor/dist area).

MFC after:	3 days
2008-08-28 06:08:29 +00:00
Peter Wemm
6d999fe8d3 Pass 2 of flattening sendmail vendor area. 2008-08-28 02:32:16 +00:00
Peter Wemm
eeb6d312f5 Stage 1 of sendmail dist tree flattening. contrib/sendmail/contrib
prevents doing this in one pass.
2008-08-28 02:25:51 +00:00
Ollivier Robert
ea906c4152 Merge ntpd & friends 4.2.4p5 from vendor/ntp/dist into head. Next commit
will update usr.sbin/ntp to match this.

MFC after:	2 weeks
2008-08-22 15:58:00 +00:00
Ollivier Robert
0814f601e6 Move FREEBSD-upgrade as well. 2008-08-18 14:37:44 +00:00
Ollivier Robert
7d7bbd7429 Move FREEBSD-Xlist in a more proper location. 2008-08-18 14:36:57 +00:00
Ollivier Robert
cce65f4396 Flatten the dist and various 4.n.n trees in preparation of future ntp imports. 2008-08-17 17:37:33 +00:00
David Schultz
7a9e0a96e0 Doc updates for changes in the default values of
-ffancy-math-387 and -mmath-errno.
2008-08-10 19:35:09 +00:00
David Schultz
7a5b5fae94 Make -fno-math-errno the default. Our libm doesn't support the SysV
mistake of setting errno, and never has.  This will need to be fixed
upstream in a more generic way, but the changes are somewhat more
involved.
2008-08-10 19:33:35 +00:00
David Schultz
1b93600c85 Make -mfancy-math-387 the default on FreeBSD, as it is on most other
operating systems. Previously, gcc would inhibit the generation of
fsqrt, fsin, and several other floating point instructions, for the
benefit of the old in-kernel math emulator, which was removed over 5
years ago.
2008-08-10 19:02:57 +00:00
Max Laier
cf179d53ae Fix build when WITHOUT_DYNAMICROOT is specified in src.conf(5). 2008-08-04 22:45:27 +00:00
John Baldwin
2e38385526 Don't attempt authentication at all if it has been disabled via '-a off'.
This works around a bug in HP-UX's telnet client and also gives a much
saner user experience when using FreeBSD's telnet client.

PR:		bin/19405
Submitted by:	Joel Ray Holveck   joelh of gnu.org
MFC after:	1 month
2008-07-28 18:58:16 +00:00
Darren Reed
52c7653383 2020447 IPFilter's NAT can undo name server random port selection
Approved by:	darrenr
MFC after:	1 week
Security:	CERT VU#521769
2008-07-24 12:35:05 +00:00
Dag-Erling Smørgrav
c3c6456251 For unfathomable reasons, ipfilter abuses kernel data structures for its
own purposes.  To pull this off, it defines _KERNEL before including the
headers where these structures are defined.  This leads to no end of
trouble when some of these headers, or other headers that they include,
change, as demonstrated by r180755.

The quick fix in this particular case is to define _WANT_FILE instead of
_KERNEL, conditional on __FreeBSD__.  A better long-term fix is left as
an exercise to the reader.
2008-07-23 16:34:53 +00:00
Giorgos Keramidas
6ae8b92a79 tcsh: fix abort in cleanup_until(), caused by internal xgetpass()
The xgetpass() function pushes a cleanup entry for &osa, but then
attempts to flush the stack until an entry matching &sa.  The two
object pointers do not match, so the stack is popped too much,
and then cleanup_until calls abort() when it unexpectedly hits
the bottom of the cleanup stack.

Reported by:	Paul B. Mahol, onemda at gmail.com,
		Pietro Cerutti, gahr at gahr.ch
PR:		bin/124191
Reviewed by:	mp, kris
MFC after:	2 days
2008-07-20 18:05:18 +00:00
Doug Barton
2e5453748e Merge from vendor/bind9/dist as of the 9.4.2-P1 import, including
the patch from ISC for lib/bind9/check.c and deletion of unused
files in lib/bind.

This version will by default randomize the UDP query source port
(and sequence number of course) for every query.

In order to take advantage of this randomization users MUST have an
appropriate firewall configuration to allow UDP queries to be sent and
answers to be received on random ports; and users MUST NOT specify a
port number using the query-source[-v6] options.

The avoid-v[46]-udp-ports options exist for users who wish to eliminate
certain port numbers from being chosen by named for this purpose. See
the ARM Chatper 6 for more information.

Also please note, this issue applies only to UDP query ports. A random
ephemeral port is always chosen for TCP queries.

This issue applies primarily to name servers whose main purpose is to
resolve random queries (sometimes referred to as "caching" servers, or
more properly as "resolving" servers), although even an "authoritative"
name server will make some queries, primarily at startup time.

All users of BIND are strongly encouraged to upgrade to the latest
version, and to utilize the source port randomization feature.

This update addresses issues raised in:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
http://www.kb.cert.org/vuls/id/800113
http://tools.ietf.org/html/draft-ietf-dnsext-forgery-resilience
2008-07-12 09:38:35 +00:00
Doug Barton
632c4e7871 The vendor area is the proper home for these files now. 2008-07-12 08:46:21 +00:00
Peter Wemm
a988131922 Flatten bind9 vendor work area 2008-07-12 05:00:28 +00:00
Peter Wemm
c6acfe86c7 Merge gnu cpio 2.6 -> 2.8 changes. Unfortunately, we have massive
conflicts due to radically different approaches to security and bug fixes.
In some cases I re-started from the vendor version and reimplemented our
patches.  Fortunately, this is not enabled by default in -current.
2008-07-10 02:08:00 +00:00
Peter Wemm
bb7e869618 Flatten cvs2svn generated import tree. 2008-07-09 23:21:55 +00:00
Peter Wemm
6e62580c07 cvs2svn managed to overlay two different path trees. fix. 2008-07-09 23:07:03 +00:00
David E. O'Brien
b370e2cfea White space fixes. 2008-06-28 15:28:17 +00:00
David E. O'Brien
c4a2958381 Reduce diff to vendor. 2008-06-28 15:17:02 +00:00