Re: jail_bin_add: script to add binary and libs to chroot

2015-06-08 Thread dan mclaughlin
On Mon, 8 Jun 2015 14:59:28 +0200 Marc Espie wrote: > On Mon, Jun 08, 2015 at 01:46:17AM -0400, dan mclaughlin wrote: > > i figure this should be useful to some. > > any nits welcome. > > Unfortunately, this will become increasingly useless in > gtk-land. > > Compare ldd firefox vs a ktrace of t

Re: [Patch] httpd - don't leak fcgi file descriptors

2015-06-08 Thread Theo de Raadt
> Sure. Fine with me. Wondering if the -1 check is needed. IIRC close(-1); > is save. Anyway you want to add a space after the if. One side effect: it changes errno. But I don't see an impact immediately.

Re: LibreSSL 2.2 fails to connect to webdav.yandex.com

2015-06-08 Thread Alexey Ivanov
> On Jun 6, 2015, at 5:31 AM, Joel Sing wrote: > > On Saturday 06 June 2015, 1edhaz+9sj4olxjt6...@guerrillamail.com wrote: >> Hello, >> >> LibreSSL 2.2 (openbsd-current) fails to connect to >> https://webdav.yandex.com. >> >> OpenSSL 1.0.1m from OpenBSD packages does succeed. >> >> Yandex is

Re: [Patch] httpd - don't leak fcgi file descriptors

2015-06-08 Thread Claudio Jeker
On Mon, Jun 08, 2015 at 09:12:32PM +0200, Joerg Jung wrote: > On Tue, Jun 02, 2015 at 05:47:47PM +0200, Claudio Jeker wrote: > > On Tue, Jun 02, 2015 at 01:50:35PM +0200, Joerg Jung wrote: > > > > > > > Am 01.06.2015 um 01:25 schrieb Todd Mortimer : > > > > > > > > I agree that my patch is more of

Re: [Patch] httpd - don't leak fcgi file descriptors

2015-06-08 Thread Joerg Jung
On Tue, Jun 02, 2015 at 05:47:47PM +0200, Claudio Jeker wrote: > On Tue, Jun 02, 2015 at 01:50:35PM +0200, Joerg Jung wrote: > > > > > Am 01.06.2015 um 01:25 schrieb Todd Mortimer : > > > > > > I agree that my patch is more of a workaround, and it would be > > > better to track down how it is that

Re: jail_bin_add: script to add binary and libs to chroot

2015-06-08 Thread Sebastian Reitenbach
On 06/08/15 07:46, dan mclaughlin wrote: i figure this should be useful to some. any nits welcome. haven't used it ina while, but are you aware of security/jailkit? Sebastian #!/bin/ksh #copies a binary and libs to a chroot fs MYNAME=${0##*/} USAGE="$MYNAME bin jailroot" [[ "$1" = -h ]] &&

Conver bridge(4) to if_input()

2015-06-08 Thread Martin Pieuchot
This is the last pseudo-driver conversion. The idea is to run bridge_input() *before* any ifih on an interface. Doing so allow us to remove the hack between vlan(4) and bridge(4) and simplify the logic for "stacked" ifih. With that net/if_ethersubr.c is now free from "#ifdef NPSEUDODRIVER". As u

bridge_output() without m_buf_tag

2015-06-08 Thread Martin Pieuchot
Diff below moves bridge_output() to if_output(). It fixes the case I already described some weeks ago where you have a physical interface in a bridge and a vlan on top of it which is not in the bridge. It also change the loop prevention code to use M_PROTO1 like in the input path. Tests, comment

Unneeded splnet()

2015-06-08 Thread Martin Pieuchot
bridge_ifenqueue() does not need any spl protection, if_output() already raises it. ok? Index: net/if_bridge.c === RCS file: /cvs/src/sys/net/if_bridge.c,v retrieving revision 1.241 diff -u -p -r1.241 if_bridge.c --- net/if_bridge.c

Re: jail_bin_add: script to add binary and libs to chroot

2015-06-08 Thread Landry Breuil
On Mon, Jun 08, 2015 at 02:59:28PM +0200, Marc Espie wrote: > On Mon, Jun 08, 2015 at 01:46:17AM -0400, dan mclaughlin wrote: > > i figure this should be useful to some. > > any nits welcome. > > Unfortunately, this will become increasingly useless in > gtk-land. > > Compare ldd firefox vs a ktra

Re: jail_bin_add: script to add binary and libs to chroot

2015-06-08 Thread Marc Espie
On Mon, Jun 08, 2015 at 01:46:17AM -0400, dan mclaughlin wrote: > i figure this should be useful to some. > any nits welcome. Unfortunately, this will become increasingly useless in gtk-land. Compare ldd firefox vs a ktrace of the running binary... :(

an XOR improvement of 1%

2015-06-08 Thread Peter J. Philipp
Hi, I have made a patch against 5.7 that improves the speed of xor for amd64 by 1% (timed on a seperate userland program). I tested the userland program against an i386 and a amd64 host, didn't have access to any other architectures. If a hardcore developer thinks this is worth it ... feel fr

Fix for handling SNMP GETBULK Requests

2015-06-08 Thread Gerhard Roth
Hi, there's a bug in snmpd that breaks GETBULK requests for multiple OIDs. Example: # OID1=1.3.6.1.2.1.1.1 # OID2=1.3.6.1.2.1.31.1.1.1.1 # snmpbulkget -Cr3 -c public -v2c localhost $OID1 SNMPv2-MIB::sysDescr.0 = STRING: OpenBSD null 5.7 GENERIC#123 i386 SNMPv2-MIB::sysObjectID.0 =

Re: fix iwm(4) watchdog

2015-06-08 Thread Mark Kettenis
> Date: Mon, 8 Jun 2015 09:03:47 +0200 > From: Stefan Sperling > > The iwm(4) watchdog does two things wrong: > > - It doesn't trigger iwm_init_task so the task remains entirely unused. > > - It clears the IFF_UP interface flag. Only the intel wifi drivers do this, >and I think it's wrong

fix iwm(4) watchdog

2015-06-08 Thread Stefan Sperling
The iwm(4) watchdog does two things wrong: - It doesn't trigger iwm_init_task so the task remains entirely unused. - It clears the IFF_UP interface flag. Only the intel wifi drivers do this, and I think it's wrong. Other wifi drivers don't clear it. The watchdog should attempt to get the