nonstandard. They differ in the values of certain fields in
the PPPoE frame. Previously, ng_pppoe would start in standard
mode, yet switch to nonstandard one upon reception of a single
nonstandard frame. After having done so, ng_pppoe would be unable
to interact with standard PPPoE peers. Thus, a DoS condition
existed that could be triggered by a buggy peer or malicious party.
Since few people have expressed their displeasure WRT this problem,
the default operation of ng_pppoe is left untouched for now. However,
a new value for the sysctl net.graph.nonstandard_pppoe is introduced,
-1, which will force ng_pppoe stay in standard mode regardless of any
bogus frames floating around.
PR: kern/47920
Submitted by: Gleb Smirnoff <glebius <at> cell.sick.ru>
MFC after: 1 week
1) Fix style issues in comments.
2) Properly namespaceify changes
3) Appropriate sectioning of changes
Not changed: parenthesis around macro rvalue. That would make the additions
inconsistent with the other entries there, merely a different style violation
rather than a clear and obvious improvement so I'm going to have to disagree
with the judges on that one. If someone wishes to adjust *all* the rvalues
to conform to fully parenthesized marco rule, that would be both consistent
and reasonable but that's beyond the scope of the changes I wish to make at
this time.
the throttling state in response to line transitions. Future plans
include adding support for CPU frequency changes.
Add a devd.conf entry for calling this script.
The default values for this are:
performance_cx_lowest="HIGH" # Use HLT (C0) online
performance_throttle_state="HIGH" # 100% (no throttling)
economy_cx_lowest="LOW" # Use the lowest Cx state possible
economy_throttle_state="HIGH" # 100% (no throttling)
definitions for more than one device (usually differentiated by
the PCI subvendor/subdevice ID). Each device also has its own tree
of registry keys. In some cases, each device has the same keys, but
sometimes each device has a unique tree but with overlap. Originally,
I just had ndiscvt(8) dump out all the keys it could find, and we
would try to apply them to every device we could find. Now, each key
has an index number that matches it to a device in the device ID list.
This lets us create just the keys that apply to a particular device.
I also added an extra field to the device list to hold the subvendor
and subdevice ID.
Some devices are generic, i.e. there is no subsystem definition. If
we have a device that doesn't match a specific subsystem value and
we have a generic entry, we use the generic entry.
Implement this in acpi_MatchHid() and acpi_isa_get_compatid(). This
should fix mouse support for some users.
Move all users of AcpiGetObjectInfo() to use dynamic storage instead of
a devinfo on the stack. This is necessary since ACPI-CA needs to
allocate different sized arrays for the CompatList.
(`WITH_OPENLDAP'). Previously, the KDC could fail to start if it was
invoked before `ldconfig'.
This solution was chosen rather than adding an `ldconfig' dependency
to `kerberos' in rcNG, because it is more robust and there is no
guarantee that the LDAP libraries will be in ldconfig's path anyway.
Problem reported by: Sean McNeil <sean@mcneil.com>
wait, rather than the socket label. This avoids reaching up to
the socket layer during connection close, which requires locking
changes. To do this, introduce MAC Framework entry point
mac_create_mbuf_from_inpcb(), which is called from tcp_twrespond()
instead of calling mac_create_mbuf_from_socket() or
mac_create_mbuf_netlayer(). Introduce MAC Policy entry point
mpo_create_mbuf_from_inpcb(), and implementations for various
policies, which generally just copy label data from the inpcb to
the mbuf. Assert the inpcb lock in the entry point since we
require consistency for the inpcb label reference.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
