Default TLS configuration of httpd / libtls

2017-08-15 Thread Andreas Bartelt
After responding to a question on misc@ ( http://marc.info/?l=openbsd-misc&m=150280482525307&w=2 ), I've noticed that the part of my response with regard to default-enabled TLS cipher suites on current was wrong. I was testing with an ECDSA-based instead of an RSA-based certificate which render

Re: CID 1452909: Use of untrusted scalar value (pf_table.c)

2017-08-15 Thread Jonathan Gray
On Tue, Aug 15, 2017 at 02:40:32PM +0200, Mike Belopuhov wrote: > Hi, > > Coverity has discovered that we're blindly trusting the value > of pfra_type that we read from the userland supplied pfr_addr > and use it to index an array of pools in pfr_create_kentry. > > I suggest to do two things: add

disabled code in lex

2017-08-15 Thread Michael W. Bombardieri
Hi, Some code in lex has been disabled since import and could possibly be removed. Forwarding patch in case people think it's worth doing. - Michael Index: tables.c === RCS file: /cvs/src/usr.bin/lex/tables.c,v retrieving revision

Re: llvm - xor return pointers

2017-08-15 Thread Todd Mortimer
On Tue, Aug 15, 2017 at 05:12:39PM -0700, Ori Bernstein wrote: > On Sat, 22 Jul 2017 02:25:29 -0400 > Todd Mortimer wrote: > > > xor [rsp], rsp > > > > at the start of each function, and before every RET. > > Wouldn't this break with alloca() or C99 VLAs? > %rbp may work better, if the frame po

Re: CID 1452909: Use of untrusted scalar value (pf_table.c)

2017-08-15 Thread Alexandr Nedvedicky
Hello, > I suggest to do two things: add a check in pfr_validate_addr > that is called after every copyin and also perform the check > in pfr_create_kentry before we attempt to use the value. > > OK? change looks good to me. > > P.S. > What does 'k' table and entry prefix stand for in pf_t

Re: [patch] Add -z and -Z to apmd for automatic suspend/hibernate

2017-08-15 Thread Ingo Schwarze
Whoa, and i promptly sent the wrong example. Here is the working one: schwarze@isnote $ cat /etc/sensorsd.conf hw.sensors.acpiac0.indicator0:low=1:command=/etc/sensorsd/acpiac %2 %3 %4 schwarze@isnote $ cat /etc/sensorsd/acpiac #!/bin/sh export XAUTHORITY=/home/schwarze/.Xauthority lo

Re: [patch] Add -z and -Z to apmd for automatic suspend/hibernate

2017-08-15 Thread Ingo Schwarze
Hi Ted, Ted Unangst wrote on Tue, Aug 15, 2017 at 07:42:39PM -0400: > Jesper Wallin wrote: >> On Sun, Aug 13, 2017 at 09:52:22AM +0200, Martijn van Duren wrote: >>> I've also been bitten by this a couple of times, but you can also solve >>> this via the sensorsd framework, which is how I've done

Re: llvm - xor return pointers

2017-08-15 Thread Ori Bernstein
On Sat, 22 Jul 2017 02:25:29 -0400 Todd Mortimer wrote: > xor [rsp], rsp > > at the start of each function, and before every RET. Wouldn't this break with alloca() or C99 VLAs? %rbp may work better, if the frame pointer is retained. -- Ori Bernstein

Re: [patch] Add -z and -Z to apmd for automatic suspend/hibernate

2017-08-15 Thread Ted Unangst
Jesper Wallin wrote: > On Sun, Aug 13, 2017 at 09:52:22AM +0200, Martijn van Duren wrote: > > I've also been bitten by this a couple of times, but you can also solve > > this via the sensorsd framework, which is how I've done it. > > Yeah, someone on IRC also suggested sensorsd or even ksh and a c

Re: [patch] Add -z and -Z to apmd for automatic suspend/hibernate

2017-08-15 Thread Ted Unangst
Jesper Wallin wrote: > On Mon, Aug 14, 2017 at 05:12:05PM +0200, Klemens Nanni wrote: > > Personally I'd also prefer having this in apmd(8) rather than some other > > daemon or script. Some comments: > > > > You should pass optarg instead of errstr to error(). Either ways error() > > will still ap

Re: ksh(1) history lines allocation

2017-08-15 Thread Rob Pierce
On Tue, Aug 15, 2017 at 02:03:43PM -0400, Jeremie Courreges-Anglas wrote: > On Tue, Aug 15 2017, Rob Pierce wrote: > > [...] > > > I was able to reproduce the problem with a HISTSIZE of 10 which at > > 125000 > > entries rendered my system unusable. With the patch I am running fine with a >

Re: ifstated: stop tracking interface indexes

2017-08-15 Thread Rob Pierce
On Tue, Aug 15, 2017 at 02:37:22PM -0400, Jeremie Courreges-Anglas wrote: > On Tue, Aug 15 2017, Rob Pierce wrote: > > On Mon, Aug 14, 2017 at 11:26:46PM -0400, Jeremie Courreges-Anglas wrote: > >> On Mon, Aug 14 2017, Rob Pierce wrote: > >> > ifstated currently tracks and maintains the index of

Re: ifstated: stop tracking interface indexes

2017-08-15 Thread Jeremie Courreges-Anglas
On Tue, Aug 15 2017, Rob Pierce wrote: > On Mon, Aug 14, 2017 at 11:26:46PM -0400, Jeremie Courreges-Anglas wrote: >> On Mon, Aug 14 2017, Rob Pierce wrote: >> > ifstated currently tracks and maintains the index of each monitored >> > interface >> > and does not maintain interface names. This me

More docs for buffer cache, block sizes, etc.

2017-08-15 Thread Stefan Fritsch
Hi, here are some comments / man page updates for things I have learned in my adventures through msdosfs and vfs_bio.c. I have also added the bread_cluster function to buffercache(9). It would be nice if someone who knows the buffer/disk stuff could review this. Hint for the paragraph on block

Re: ksh(1) history lines allocation

2017-08-15 Thread Jeremie Courreges-Anglas
On Tue, Aug 15 2017, Rob Pierce wrote: [...] > I was able to reproduce the problem with a HISTSIZE of 10 which at 125000 > entries rendered my system unusable. With the patch I am running fine with a > HISTSIZE of 12 and have come back several times after hitting the 1.25x > threshold. >

Re: Implement VFS read clustering for MSDOSFS, third try

2017-08-15 Thread Martijn Rijkeboer
On 08/15/17 17:20, Stefan Fritsch wrote: > Hi, > > this is another try at making read clustering work for msdosfs. > > Last year, mpi@ implemented VFS read clustering for MSDOSFS in > > sys/msdosfs/denode.h 1.28 > sys/msdosfs/msdosfs_vnops.c 1.105 > > This caused regressions when doing seeks pa

Re: Skipping amd errata on hypervisors?

2017-08-15 Thread Theo de Raadt
>I have got a report that openbsd panics on boot with qemu -cpu Opteron_G3 >(but Opteron_G2 works). > >kernel: protection fault trap, code=0 >Stopped at amd64_errata_setmsr+0x14: rdmsr >ddb{0}> >> OpenBSD/amd64 BOOT 3.33 >boot> > >Qemu does not implement all the secret e

Re: Skipping amd errata on hypervisors?

2017-08-15 Thread Mike Larkin
On Tue, Aug 15, 2017 at 05:54:34PM +0200, Stefan Fritsch wrote: > On Tue, 15 Aug 2017, Mike Larkin wrote: > > > On Tue, Aug 15, 2017 at 08:46:59AM -0700, Mike Larkin wrote: > > > On Tue, Aug 15, 2017 at 05:39:29PM +0200, Stefan Fritsch wrote: > > > > I have got a report that openbsd panics on boot

Re: Skipping amd errata on hypervisors?

2017-08-15 Thread Stefan Fritsch
On Tue, 15 Aug 2017, Mike Larkin wrote: > On Tue, Aug 15, 2017 at 08:46:59AM -0700, Mike Larkin wrote: > > On Tue, Aug 15, 2017 at 05:39:29PM +0200, Stefan Fritsch wrote: > > > I have got a report that openbsd panics on boot with qemu -cpu Opteron_G3 > > > (but Opteron_G2 works). > > > > > >

Re: Skipping amd errata on hypervisors?

2017-08-15 Thread Mike Larkin
On Tue, Aug 15, 2017 at 08:46:59AM -0700, Mike Larkin wrote: > On Tue, Aug 15, 2017 at 05:39:29PM +0200, Stefan Fritsch wrote: > > I have got a report that openbsd panics on boot with qemu -cpu Opteron_G3 > > (but Opteron_G2 works). > > > > kernel: protection fault trap, code=0 > > Stoppe

Re: Skipping amd errata on hypervisors?

2017-08-15 Thread Mike Larkin
On Tue, Aug 15, 2017 at 05:39:29PM +0200, Stefan Fritsch wrote: > I have got a report that openbsd panics on boot with qemu -cpu Opteron_G3 > (but Opteron_G2 works). > > kernel: protection fault trap, code=0 > Stopped at amd64_errata_setmsr+0x14: rdmsr > ddb{0}> >> OpenBSD/

Skipping amd errata on hypervisors?

2017-08-15 Thread Stefan Fritsch
I have got a report that openbsd panics on boot with qemu -cpu Opteron_G3 (but Opteron_G2 works). kernel: protection fault trap, code=0 Stopped at amd64_errata_setmsr+0x14: rdmsr ddb{0}> >> OpenBSD/amd64 BOOT 3.33 boot> Qemu does not implement all the secret errata MSR

Implement VFS read clustering for MSDOSFS, third try

2017-08-15 Thread Stefan Fritsch
Hi, this is another try at making read clustering work for msdosfs. Last year, mpi@ implemented VFS read clustering for MSDOSFS in sys/msdosfs/denode.h 1.28 sys/msdosfs/msdosfs_vnops.c 1.105 This caused regressions when doing seeks past the end of the file and had. to be reverted. Then I tried

hfsc_deferred race

2017-08-15 Thread Mike Belopuhov
Hi, I've just triggered an assert in hfsc_deferred (a callout) on an MP kernel running on an SP virtual machine: panic: kernel diagnostic assertion "HFSC_ENABLED(ifq)" failed: file "/home/mike/src/openbsd/sys/net/hfsc.c", line 950 Stopped at db_enter+0x9: leave TIDPIDUID

Re: [patch] Add -z and -Z to apmd for automatic suspend/hibernate

2017-08-15 Thread Jesper Wallin
On Mon, Aug 14, 2017 at 05:12:05PM +0200, Klemens Nanni wrote: > Personally I'd also prefer having this in apmd(8) rather than some other > daemon or script. Some comments: > > You should pass optarg instead of errstr to error(). Either ways error() > will still append since it uses err(3). This l

Re: ifstated: stop tracking interface indexes

2017-08-15 Thread Rob Pierce
On Mon, Aug 14, 2017 at 11:26:46PM -0400, Jeremie Courreges-Anglas wrote: > On Mon, Aug 14 2017, Rob Pierce wrote: > > ifstated currently tracks and maintains the index of each monitored > > interface > > and does not maintain interface names. This means we need to re-index on > > interface depar

CID 1452909: Use of untrusted scalar value (pf_table.c)

2017-08-15 Thread Mike Belopuhov
Hi, Coverity has discovered that we're blindly trusting the value of pfra_type that we read from the userland supplied pfr_addr and use it to index an array of pools in pfr_create_kentry. I suggest to do two things: add a check in pfr_validate_addr that is called after every copyin and also perfo

make get_last_resort_ifid() truely random

2017-08-15 Thread Florian Obser
Rename in6_get_rand_ifi() to get_last_resort_ifid() and delete the old get_last_resort_ifid() function because eww. Also if your system is so constraint that you end up in get_last_resort_ifid() you don't deserve a random ifid that stays stable over reboots. Simplify code a bit since get_ifid() ca

Re: [patch] Add -z and -Z to apmd for automatic suspend/hibernate

2017-08-15 Thread Craig Skinner
Hi Jesper/all, On Sun, 13 Aug 2017 14:13:42 +0200 Jesper Wallin wrote: > > ... someone on IRC also suggested sensorsd or even ksh and a > cronjob. I personally find it a bit too ducttapey though, especially > for a feature one would expect on a laptop. For what its worth, below is an unpriv duc