strictly a security hole, but neither is it a very good idea. Replace
it with a symlink to /dev/null to happify programs that expect it.
It is suggested that users of the jail environment modify the jail's
syslog.conf to not send stuff to /dev/console, but instead syslog
it somewhere else. Such as a loghost, potentially even to the host
environment's syslog.
Approved by: jkh
for optimizing the unpause operation no-longer exist, and this is much
safer.
When restarting the sequencer, reconstitute the free SCB list on the card.
This deals with a single instruction gap between marking the SCB as free
and actually getting it onto the free list.
Reduce the number of transfer negotiations that occur. In the past, we
renegotiated after every reported check condition status. This ensures
that we catch devices that have unexpectidly reset. In this situation,
the target will always report the check condition before performing a
data-phase. The new behavior is to renegotiate for any check-condition where
the residual matches the orginal data-length of the command (including
0 length transffers). This avoids renegotiations during things like
variable tape block reads, where the check condition is reported only
to indicate the residual of the read.
Revamp the parity error detection logic. We now properly report and
handle injected parity errors in all phases. The old code used to hang
on message-in parity errors.
Correct the reporting of selection timeout errors to the XPT. When
a selection timeout occurs, only the currently selecting command
is flagged with SELTO status instead of aborting all currently active
commands to that target.
Fix flipped arguments in ahc_match_scb and in some of the callers of this
routine. I wish that gcc allowed you to request warnings for enums passed
as ints.
Make ahc_find_msg generically handle all message types.
Work around the target mode data-in wideodd bug in all non-U2 chips.
We can now do sync-wide target mode transfers in target mode across the
hole product line.
Use lastphase exclusively for handling timeouts. The current phase
doesn't take the bus free state into account.
Fix a bug in the timeout handler that could cause corruption of the
disconnected list.
When sending an embedded cdb to a target, ensure that we start on a
quad word boundary in the data-fifo. It seems that unaligned stores
do not work correctly.
chipset to be probed & attached on newer Dell PowerEdge servers, such as
the 2400 and 4400.
Reviewed by: dfr, msmith, jlemon
Tested by: hnokubi@yyy.or.jp (in a previous incantation)
Approved by: jkh
userland in a safer way. Using the NO_MAKEDEV argument in make
distribution prevents the creation of a number of unsafe device nodes
in the jailed /dev, including disk devices, and more. This depends
on an earlier commit to /etc/Makefile to provide the NO_MAKEDEV
support.
Approved by: jkh
/etc/Makefile so that if it is defined, MAKEDEV all is not called
during a make distribution. This helps clean up the messy userland
in jail(), by reducing the number of devices exposed in jail.
Modifications to jail(2) to follow.
Approved by: jkh-arius
ptys in ways that might be unethical, especially towards processes not in
jail, or in other jails.
Submitted by: phk
Reviewed by: rwatson
Approved by: jkh
KAME scoped addr format is changed recently.
before: addr@scope
now: scope%addr
Because the end of IPv6 numeric addr is tend to be truncated in
`netstat -rn ` output, so placing scope part at starting of addr
will be convenient.
Approved by: jkh
Obtained from: KAME project
at the same time.
When rfc1323 and rfc1644 option are enabled by sysctl,
and tcp over IPv6 is tried, kernel panic happens by the
following check in tcp_output(), because now hdrlen is bigger
in such case than before.
/*#ifdef DIAGNOSTIC*/
if (max_linkhdr + hdrlen > MHLEN)
panic("tcphdr too big");
/*#endif*/
So change the above check to compare with MCLBYTES in #ifdef INET6 case.
Also, allocate a mbuf cluster for the header mbuf, in that case.
Bug reported at KAME environment.
Approved by: jkh
Reviewed by: sumikawa
Obtained from: KAME project
Because if ftpd is invoked with -R option, and EPRT is used via firewal
or NAT which don't understand EPRT, then the data connection from ftpd
to ftp client will fail.
Reported By: ume@mahoroba.org
Approved by: jkh
an all.log for logging all messages, and one to demonstrate use of loghosts.
Also, a matching entry in newsyslog.conf for all.log.
Per request of Garrett Wollman, also modified the maillog entry to use the
@T newsyslog time specification mechanism. Because newsyslog doesn't
support the mod date specification machanism, couldn't change other
entries that required more than one execution a month, but less than once
a day.
Approved by: jkh
Reviewed by: freebsd-security
