Re: pf statekey inp assertion failed

Hello, > The problem is that setting the inp pointer in the statekey to NULL > is delayed until the statekey refcounter reaches 0. So the inp > could get linked to another statekey while the mbuf in the socket > buffer was keeping the refcounter at 1. > > The sk->inp should be set to NULL

Re: ipsec: tdb_unlink() and dst addr update for MOBIKE

On Wed, Jun 21, 2017 at 09:46:44AM +0200, Patrick Wildt wrote: > On Wed, May 31, 2017 at 02:23:12PM +0200, Patrick Wildt wrote: > > Hi, > > > > I'd like to add MOBIKE support to iked, specifically first of all making > > iked as server react to mobile clients changing their IP addresses. One > >

Re: ipsec: tdb_unlink() and dst addr update for MOBIKE

On Wed, May 31, 2017 at 02:23:12PM +0200, Patrick Wildt wrote: > Hi, > > I'd like to add MOBIKE support to iked, specifically first of all making > iked as server react to mobile clients changing their IP addresses. One > thing for that is the kernel part. > > Having MOBIKE means that we need to

[PATCH] iked: Incorrect definition of critical bit (IKEV2_CRITICAL_PAYLOAD)

Hi tech@, I noticed that the definition of IKEV2_CRITICAL_PAYLOAD in ikev2.h is incorrect. According to RFC 7296, Section 3.2 the critical bit is the first/high bit of the second octet of the IKE payload header. An octet with only its first bit set results in a hex value of 0x80, not 0x01.

Re: Finish the link-kit job

On Wed, Jun 21, 2017 at 01:13:31PM -0600, Theo de Raadt wrote: > (config(8) was modified because reaching this point on multiple > architectures was EXCEEEDINGLY PAINFUL. I am desperately trying to > avoid Makefile.* divergence) I don't know if modifying config to write more boilerplate is such

Re: Trapsleds

On Tue, Jun 20, 2017 at 10:34:00PM -0400, Todd Mortimer wrote: > > 2. This patch also hits NOP sleds > 8 bytes on i386. We could also hit > > the NOP sleds between 3 and 7 bytes if there are no objections. > > The attached diff implements the same trapsled mechanism for i386 and > amd64 for all

Finish the link-kit job

We've had the linkkit components in the tree for a while, but it has taken nearly 20 rounds between rpe/tb/myself to get the last few bits finished. So that the link kit is cleanly used at reboot, but also fits in with the practices kernel developers follow. Here are the remaining pieces. 1)

Re: csh(1): stop blocking SIGINT while calling free()

On Wed, Jun 21, 2017 at 09:50:39PM +0200, Anton Lindqvist wrote: > Hi, > Here's a pattern I haven't seen before. This macro is especially hideous > since it make use of the local variable numitems as opposed of items > which is passed as an argument. The previous diff was too aggressive. How

csh(1): minor cleanup

Hi, Some minor nits discovered while getting rid of TIOCSTI: - Sort and split includes according to style(9) - Get rid of unused stdarg.h - Join defines - Fix indent for COMMAND typedef Comments? OK? Index: file.c === RCS file:

csh(1): stop blocking SIGINT while calling free()

Hi, Here's a pattern I haven't seen before. This macro is especially hideous since it make use of the local variable numitems as opposed of items which is passed as an argument. Comments? OK? Index: file.c === RCS file:

xhci: Remove useless semicolon

One semicolon should do just fine here. Index: dev/usb/xhci.c === RCS file: /cvs/src/sys/dev/usb/xhci.c,v retrieving revision 1.72 diff -u -p -r1.72 xhci.c --- dev/usb/xhci.c 10 Mar 2017 11:18:48 - 1.72 +++

[diffs] libcrypto: minor man page fix & question about odd function types

X509_VERIFY_PARAM_set_flags(3) states that X509_VERIFY_PARAM_set_flags() and X509_VERIFY_PARAM_clear_flags() both "return 1 for success or 0 for failure". But both those functions always return 1 (unless param is null, in which case they don't return at all but segfault instead -- but none of the