acme-client: allow configuring key and cert owner

Hi tech@, The following patch expands acme-client config file `domain` blocks to allow for a `owner user:group` directive, which allows to get rid of customs scripts that "fix" permissions for issued certs, mostly needed in ports land. I don't find it too invasive, so I thought it could be merged.

acme-client: print unexpected SANs using strvisx

Here's a diff to clean up the XXX that I added in my previous commit. If the SAN isn't listed in the config file, it could be anything, so let's print it with strvisx(). If the SAN is listed but duplicate, this feels like overkill, so let's not bother. Index: revokeproc.c =

Re: Use `ps_mtx' mutex(9) to protect `ps_ucred' and unlock setuid(2), ...

On Sat, Dec 03, 2022 at 08:45:52PM +0300, Vitaliy Makkoveev wrote: > On Thu, Dec 01, 2022 at 10:50:03PM +0300, Vitaliy Makkoveev wrote: > > On Thu, Dec 01, 2022 at 11:28:59AM -0800, Philip Guenther wrote: > > > On Thu, Dec 1, 2022 at 10:31 AM Vitaliy Makkoveev > > > wrote: > > > ... > > > > > >

Re: Introduce per-sockbuf `sb_state' to use it with SS_CANTSENDMORE

On Sat, Dec 17, 2022 at 11:58:32AM -0700, Theo de Raadt wrote: > Sure something like that is also OK. > > So the previous breakage happened because you wanted a name change so > that bits-into-wrong variable would not happen, but you didn't realize the > namespace stretched into userland. > > So

Re: Introduce per-sockbuf `sb_state' to use it with SS_CANTSENDMORE

Sure something like that is also OK. So the previous breakage happened because you wanted a name change so that bits-into-wrong variable would not happen, but you didn't realize the namespace stretched into userland. So if you can't rename it, it just needs a strong caution. > What about to add

Re: Introduce per-sockbuf `sb_state' to use it with SS_CANTSENDMORE

On Sat, Dec 17, 2022 at 11:42:14AM -0700, Theo de Raadt wrote: > Vitaliy Makkoveev wrote: > > > The reworked diff for `so_snd' SS_CANTSENDMORE state bit. As proposed by > > deraadt@, SS_CANTSENDMORE definition left as is, but used with newly > > introduced socket's buffer state `sb_state'. `sb_st

Re: Introduce per-sockbuf `sb_state' to use it with SS_CANTSENDMORE

Vitaliy Makkoveev wrote: > The reworked diff for `so_snd' SS_CANTSENDMORE state bit. As proposed by > deraadt@, SS_CANTSENDMORE definition left as is, but used with newly > introduced socket's buffer state `sb_state'. `sb_state' ored with > original `so_state' when socket's data exported to the u

Introduce per-sockbuf `sb_state' to use it with SS_CANTSENDMORE

Sorry for previous tree breakage. The reworked diff for `so_snd' SS_CANTSENDMORE state bit. As proposed by deraadt@, SS_CANTSENDMORE definition left as is, but used with newly introduced socket's buffer state `sb_state'. `sb_state' ored with original `so_state' when socket's data exported to the u

Re: ksh, test: test -t file descriptor isn't optional

Bump. In the meantime I did some digging. The issue was introduced by r1.18, 2009-03-01. There, `test -t` should've worked as advertised, as the first check in test_primary would be whether the operand is unary. > Hi tech@, > > Both test.1 and ksh.1 (under the non-POSIX compatibility flag) state

acme-client: simplify acctproc a bit

The diff below has three independent parts which I intend to commit separately. It does not change anything. In op_thumbprint() use EVP_Digest() for simplicity. The conversion is straightforward and it's an obvious win. The second part converts EVP_Sign*() usage to EVP_DigestSign(). This is a bit