r340136 kib Nov. 4, 2018, 7:11 p.m.
Existing base causes conflicts for direct execution of ld-elf.so.1
because default linking base for non-PIE binaries is 0x10000.

Reported and tested by:	Mark Millard <marklmi26-fbsd@yahoo.com>
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
ViewVC
r340135 eugen Nov. 4, 2018, 7:10 p.m.
reordered in transit instead of dropping them altogether.
It uses sequence numbers of PPtPGRE packets.

A set of new sysctl(8) added to control this ability or disable it:

net.graph.pptpgre.reorder_max (1) defines maximum length of node's
private reorder queue used to keep data waiting for late packets.
Zero value disables reordering. Default value 1 allows the node to restore
the order for two packets swapped in transit. Greater values allow the node
to deliver packets being late after more packets in sequence
at cost of increased kernel memory usage.

net.graph.pptpgre.reorder_timeout (1) defines time value in miliseconds
used to wait for late packets. It may be useful to increase this
if reordering spot is distant.

MFC after:	1 month
ViewVC
r340134 oshogbo Nov. 4, 2018, 6:52 p.m.
r340133 oshogbo Nov. 4, 2018, 6:24 p.m.
The writeRandomBytes_arc4random is not used if the arc4random_buf
is available. This caused compiler to throw warnings which are treated as
an error in libexpact.

Approved by:	vangyzen
ViewVC
r340132 cem Nov. 4, 2018, 5:56 p.m.
You should not be using DES.  You should not have been using DES for the
past 30 years.

The ed DES-CBC scheme lacked several desirable properties of a sealed
document system, even ignoring DES itself.  In particular, it did not
provide the "integrity" cryptographic property (detection of tampering), and
it treated ASCII passwords as 64-bit keys (instead of using a KDF like
scrypt or PBKDF2).

Some general approaches ed(1) users might consider to replace the removed
DES mode:

1. Full disk encryption with something like AES-XTS.  This is easy to
conceptualize, design, and implement, and it provides confidentiality for
data at rest.  Like CBC, it lacks tampering protection.  Examples include
GELI, LUKS, FileVault2.

2. Encrypted overlay ("stackable") filesystems (EncFS, PEFS?, CryptoFS,
others).

3. Native encryption at the filesystem layer.  Ext4/F2FS, ZFS, APFS, and
NTFS all have some flavor of this.

4. Storing your files unencrypted.  It's not like DES was doing you much
good.

If you have DES-CBC scrambled files produced by ed(1) prior to this change,
you may decrypt them with:

  openssl des-cbc -d -iv 0 -K <key in hex> -in <inputfile> -out <plaintext>

Reviewed by:	allanjude, bapt, emaste
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D17829
ViewVC
r340130 oshogbo Nov. 4, 2018, 5:22 p.m.
The idea behind those functions is not to force consumers to remember that there
is a need to check errno on failure. We already have a caph_enter(3) function
which does the same for cap_enter(2).

MFC after:	2 weeks
ViewVC
r340129 oshogbo Nov. 4, 2018, 5:12 p.m.
We already allow to use poll(2). There is no reason to disallow ppoll(2).

PR:		232495
Submitted by:	Stefan Grundmann <sg2342@googlemail.com>
Reviewed by:	cem, oshogbo
MFC after:	2 weeks
ViewVC
r340128 yuripv Nov. 4, 2018, 4:58 p.m.
While here, use LANG as the proper source to select man pages language/encoding,
falling back to LC_CTYPE.

Reviewed by:	bapt
Approved by:	kib (mentor, implicit)
Differential Revision:	https://reviews.freebsd.org/D17835
ViewVC
r340127 vangyzen Nov. 4, 2018, 4:08 p.m.
Update contrib/expat by merging from the vendor branch.

Update expat_config.h manually, using
    make -C /usr/ports/textproc/expat2 configure
as a baseline.

MFC after:	1 month
Relnotes:	yes
Security:	yes; see contrib/expat/Changes since 2.2.0
Sponsored by:	Dell EMC Isilon
ViewVC
r340115 0mp Nov. 4, 2018, 2:11 p.m.
Submitted by:	Steve Kargl <sgk@troutmask.apl.washington.edu>
Reviewed by:	eadler
Approved by:    krion (mentor, implicit), mat (mentor, implicit)
Differential Revision:	https://reviews.freebsd.org/D17831
ViewVC
r340114 bapt Nov. 4, 2018, 10:14 a.m.
r340113 bapt Nov. 4, 2018, 6:59 a.m.
r340112 bapt Nov. 4, 2018, 6:47 a.m.
Reviewed by:	bdrewery
Differential Revision:	https://reviews.freebsd.org/D3915
ViewVC
r340111 bapt Nov. 4, 2018, 6:39 a.m.
Factorize code by using struct sockaddr_storage to handle both ipv6 and ipv4

Discussed with:	rmacklem
Reviewed by:	manu
MFC after:	1 month
Sponsored by:	Gandi.net
Differential Revision:	https://reviews.freebsd.org/D13223
ViewVC
r340110 eugen Nov. 4, 2018, 6:35 a.m.
Make it clear that ipfw action set for layer2 frames it a bit limited.

PR:			59835
Reviewed by:		yuripv
MFC after:		1 month
Differential Revision:	https://reviews.freebsd.org/D17719
ViewVC