rpki-client 8.5 has been released
rpki-client 8.5 has just been released and will be available in the rpki-client directory of any OpenBSD mirror soon. rpki-client is a FREE, easy-to-use implementation of the Resource Public Key Infrastructure (RPKI) for Relying Parties (RP) to facilitate validation of BGP announcements. The program queries the global RPKI repository system and validates untrusted network inputs. The program outputs validated ROA payloads, BGPsec Router keys, and ASPA payloads in configuration formats suitable for OpenBGPD and BIRD, and supports emitting CSV and JSON for consumption by other routing stacks. See RFC 6480 and RFC 6811 for a description of how RPKI and BGP Prefix Origin Validation help secure the global Internet routing system. rpki-client was primarily developed by Kristaps Dzonsons, Claudio Jeker, Job Snijders, Theo Buehler, Theo de Raadt and Sebastian Benoit as part of the OpenBSD Project. This release includes the following changes to the previous release: - ASPA support was updated to draft-ietf-sidrops-aspa-profile-16. As part of supporting AFI-agnostic ASPAs, the JSON syntax for Validated ASPA Payloads changed in both filemode and normal output. - Support for gzip and deflate HTTP Content-Encoding compression was added. This allows web servers to send RRDP XML in compressed form, saving around 50% of bandwidth. Zlib was added as a dependency. - File modification timestamps of objects retrieved via RRDP are now deterministically set to prepare the on-disk cache for seamless failovers from RRDP to RSYNC. See draft-ietf-sidrops-cms-signing-time for more information. - A 30%-50% performance improvement was achieved through libcrypto's partial chains certificate validation feature. Already validated non-inheriting CA certificates are now marked as trusted roots. This way it can be ensured that a leaf's delegated resources are properly covered, and at the same time most validation paths are significantly shortened. - Improved detection of RRDP session desynchronization: a check was added to compare whether the delta hashes associated to previously seen serials are different in newly fetched notification files. - Improved handling of RRDP deltas in which objects are published, withdrawn, and published again. - A check to disallow duplicate X.509 certificate extensions was added. - A check to disallow empty sets of IP Addresses or AS numbers in RFC 3779 extensions was added. - A compliance check for the proper X.509 Certificate version and CRL version was added. - A warning is printed when the CMS signing-time attribute in a Signed Object is missing. - Warnings about unrecoverable message digest mismatches now include the manifestNumber to aid debugging the cause. - A check was added to disallow multiple RRDP publish elements for the same file in RRDP snapshots. If this error condition is encountered, the RRDP transfer is failed and the RP falls back to rsync. - A compliance check was added to ensure CMS Signed Objects contain SignedData, in accordance to RFC 6488 section 3 checklist item 1a. - Compliance checks were added for the version, KeyUsage, and ExtendedKeyUsage of EE certificates in Manifest, TAK, and GBR Signed Objects. - A CMS signing-time value being after the X.509 notAfter timestamp was downgraded from an error to a warning. - A bug was fixed in the handling of CA certificates which inherit IP resources. rpki-client works on all operating systems with a libcrypto library based on OpenSSL 1.1 or LibreSSL 3.5, a libtls library compatible with LibreSSL 3.5 or later, and zlib. rpki-client is known to compile and run on at least the following operating systems: Alpine, CentOS, Debian, Fedora, FreeBSD, Red Hat, Rocky, Ubuntu, macOS, and of course OpenBSD! It is our hope that packagers take interest and help adapt rpki-client-portable to more distributions. The mirrors where rpki-client can be found are on https://www.rpki-client.org/portable.html Reporting Bugs: === General bugs may be reported to tech@openbsd.org Portable bugs may be filed at https://github.com/rpki-client/rpki-client-portable We welcome feedback and improvements from the broader community. Thanks to all of the contributors who helped make this release possible. Assistance to coordinate security issues is available via secur...@openbsd.org.
Re: uvm_meter: remove wakeup of proc0
On Sat, Jul 29, 2023 at 11:16:14AM +0200, Claudio Jeker wrote: > proc0 aka the swapper does not do anything. So there is no need to wake it > up. Now the problem is that last time this was tried some inteldrm systems > did hang during bootup because the drm code unexpectedly depended on this > wakeup. > > I think I fixed all possible cases of this in the drm stack and so it is > time to retry this. People with affected machines please give this a try. With this patch my machine hangs on "root on sd0a...", the patch was applied on top of 7b0c383483702d9a26856c2b4754abb44950ed82, dmesg of the last successful boot: OpenBSD 7.3-current (GENERIC.MP) #1320: Fri Jul 28 11:14:52 MDT 2023 dera...@amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP real mem = 8363110400 (7975MB) avail mem = 8089972736 (7715MB) random: good seed from bootblocks mpath0 at root scsibus0 at mpath0: 256 targets mainbus0 at root bios0 at mainbus0: SMBIOS rev. 3.3 @ 0x439de000 (70 entries) bios0: vendor LENOVO version "GCCN32WW" date 11/18/2022 bios0: LENOVO 81X7 efi0 at bios0: UEFI 2.7 efi0: INSYDE Corp. rev 0x59474032 acpi0 at bios0: ACPI 6.1Undefined scope: \\_SB_.PCI0 acpi0: sleep states S0 S4 S5 acpi0: tables DSDT FACP UEFI SSDT SSDT SSDT SSDT SSDT SSDT TPM2 MSDM NHLT SSDT LPIT WSMT SSDT SSDT DBGP DBG2 ECDT HPET APIC MCFG SSDT DMAR SSDT SSDT FPDT PTDT BGRT acpi0: wakeup devices PEG0(S4) PEGP(S4) PEGP(S4) PEGP(S4) XHCI(S4) XDCI(S4) HDAS(S4) RP01(S4) PXSX(S4) RP02(S4) PXSX(S4) RP03(S4) PXSX(S4) RP04(S4) PXSX(S4) RP05(S4) [...] acpitimer0 at acpi0: 3579545 Hz, 24 bits acpiec0 at acpi0 acpihpet0 at acpi0: 1920 Hz acpimadt0 at acpi0 addr 0xfee0: PC-AT compat cpu0 at mainbus0: apid 0 (boot processor) cpu0: 11th Gen Intel(R) Core(TM) i3-1115G4 @ 3.00GHz, 4090.57 MHz, 06-8c-01 cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,AVX512F,AVX512DQ,RDSEED,ADX,SMAP,AVX512IFMA,CLFLUSHOPT,CLWB,PT,AVX512CD,SHA,AVX512BW,AVX512VL,AVX512VBMI,UMIP,PKU,SRBDS_CTRL,MD_CLEAR,IBT,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,IBRS_ALL,SKIP_L1DFL,MDS_NO,IF_PSCHANGE,MISC_PKG_CT,ENERGY_FILT,DOITM,FBSDP_NO,XSAVEOPT,XSAVEC,XGETBV1,XSAVES cpu0: 48KB 64b/line 12-way D-cache, 32KB 64b/line 8-way I-cache, 1MB 64b/line 20-way L2 cache, 6MB 64b/line 12-way L3 cache cpu0: smt 0, core 0, package 0 mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges cpu0: apic clock running at 38MHz cpu0: mwait min=64, max=64, C-substates=0.2.0.1.2.1.1.1, IBE cpu1 at mainbus0: apid 2 (application processor) cpu1: 11th Gen Intel(R) Core(TM) i3-1115G4 @ 3.00GHz, 4090.58 MHz, 06-8c-01 cpu1: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,AVX512F,AVX512DQ,RDSEED,ADX,SMAP,AVX512IFMA,CLFLUSHOPT,CLWB,PT,AVX512CD,SHA,AVX512BW,AVX512VL,AVX512VBMI,UMIP,PKU,SRBDS_CTRL,MD_CLEAR,IBT,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,IBRS_ALL,SKIP_L1DFL,MDS_NO,IF_PSCHANGE,MISC_PKG_CT,ENERGY_FILT,DOITM,FBSDP_NO,XSAVEOPT,XSAVEC,XGETBV1,XSAVES cpu1: 48KB 64b/line 12-way D-cache, 32KB 64b/line 8-way I-cache, 1MB 64b/line 20-way L2 cache, 6MB 64b/line 12-way L3 cache cpu1: smt 0, core 1, package 0 cpu2 at mainbus0: apid 1 (application processor) cpu2: 11th Gen Intel(R) Core(TM) i3-1115G4 @ 3.00GHz, 4090.57 MHz, 06-8c-01 cpu2: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,AVX512F,AVX512DQ,RDSEED,ADX,SMAP,AVX512IFMA,CLFLUSHOPT,CLWB,PT,AVX512CD,SHA,AVX512BW,AVX512VL,AVX512VBMI,UMIP,PKU,SRBDS_CTRL,MD_CLEAR,IBT,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,IBRS_ALL,SKIP_L1DFL,MDS_NO,IF_PSCHANGE,MISC_PKG_CT,ENERGY_FILT,DOITM,FBSDP_NO,XSAVEOPT,XSAVEC,XGETBV1,XSAVES cpu2: 48KB 64b/line 12-way D-cache, 32KB 64b/line 8-way I-cache, 1MB 64b/line 20-way L2 cache, 6MB 64b/line 12-way L3 cache cpu2: smt 1, core 0, package 0 cpu3 at mainbus0: apid 3 (application processor) cpu3: 11th Gen Intel(R) Core(TM) i3-1115G4 @ 3.00GHz, 4090.57 MHz, 06-8c-01 cpu3:
ldd: check read return value to avoid unitialized struct fields [was "ldd: check {,p}read return value consistently"]
Now with a better subject.
I was also wondering about the lack of pledge() other than the newly
added one. That goes because dlopen() can do anything?
Lucas wrote:
> Hi,
>
> I wanted to understand how the pledge execpromises commit worked in ldd
> and went to read it, and noticed that there is both a
>
> if (read(fd, , sizeof(ehdr)) < 0) {
>
> and a
>
> if (pread(fd, phdr, size, ehdr.e_phoff) != size) {
>
> In particular, the "read < 0" confused me quite a lot, but the manpage
> states that, if the file descriptor _is a regular file_ and there are
> enough bytes, it reads to completion. The check for a being a regular
> file is already in place, but there is nothing guarding against a short
> file, so check instead if read == sizeof(ehdr).
>
> -Lucas
diff refs/heads/master refs/heads/ldd-read-rv
commit - 7b0c383483702d9a26856c2b4754abb44950ed82
commit + 862cbcc132ebcd92cb4b44eb1b453ea9ada0bbc3
blob - 9e8c5065cd843ff36d91efcb868b94ffd4c98365
blob + ad624d9cd0e72944b93e951de9b31f57a6258601
--- libexec/ld.so/ldd/ldd.c
+++ libexec/ld.so/ldd/ldd.c
@@ -118,7 +118,7 @@ doit(char *name)
return 1;
}
- if (read(fd, , sizeof(ehdr)) < 0) {
+ if (read(fd, , sizeof(ehdr)) != sizeof(ehdr)) {
warn("read(%s)", name);
close(fd);
return 1;
Re: uvm_meter: remove wakeup of proc0
On Sat, Jul 29, 2023 at 11:16:14AM +0200, Claudio Jeker wrote:
> proc0 aka the swapper does not do anything. So there is no need to wake it
> up. Now the problem is that last time this was tried some inteldrm systems
> did hang during bootup because the drm code unexpectedly depended on this
> wakeup.
>
> I think I fixed all possible cases of this in the drm stack and so it is
> time to retry this. People with affected machines please give this a try.
>
Hi,
With this diff "inteldrm0: msi, ALDERLAKE_P, gen 12" sticks after "root
on ...", "inteldrm0: apic 4 int 16, G45, gen 4" works fine.
> --
> :wq Claudio
>
> Index: uvm/uvm_meter.c
> ===
> RCS file: /cvs/src/sys/uvm/uvm_meter.c,v
> retrieving revision 1.44
> diff -u -p -r1.44 uvm_meter.c
> --- uvm/uvm_meter.c 21 Jun 2023 21:16:21 - 1.44
> +++ uvm/uvm_meter.c 29 Jul 2023 07:48:44 -
> @@ -89,8 +89,6 @@ uvm_meter(void)
> {
> if ((gettime() % 5) == 0)
> uvm_loadav();
> - if (proc0.p_slptime > (maxslp / 2))
> - wakeup();
> }
>
> /*
>
uvm_meter: remove wakeup of proc0
proc0 aka the swapper does not do anything. So there is no need to wake it
up. Now the problem is that last time this was tried some inteldrm systems
did hang during bootup because the drm code unexpectedly depended on this
wakeup.
I think I fixed all possible cases of this in the drm stack and so it is
time to retry this. People with affected machines please give this a try.
--
:wq Claudio
Index: uvm/uvm_meter.c
===
RCS file: /cvs/src/sys/uvm/uvm_meter.c,v
retrieving revision 1.44
diff -u -p -r1.44 uvm_meter.c
--- uvm/uvm_meter.c 21 Jun 2023 21:16:21 - 1.44
+++ uvm/uvm_meter.c 29 Jul 2023 07:48:44 -
@@ -89,8 +89,6 @@ uvm_meter(void)
{
if ((gettime() % 5) == 0)
uvm_loadav();
- if (proc0.p_slptime > (maxslp / 2))
- wakeup();
}
/*
