OpenBSD errata, Jan 31, 2017

2017-02-01 Thread Bob Beck 
An issue has been identified whereby httpd(8) could be subject to a denial
of service attack. Repeated crafted requests could be made from a client
using file-range requests, making the server consume excessive amounts of
memory.

This issue has been fixed in current. For 5.9 and 6.0 the following errata
will disable range header processing in httpd(8) to prevent the problem.

Thanks to Pierre Kim  for reporting
the issue.

https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/017_httpd.patch.sig

https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/034_httpd.patch.sig

fix xlockmore build with clang

2017-02-01 Thread Jonathan Gray 
Sync some xlockmore files with the 5.50 release to fix build errors
with clang of the form:

c++ -c  -DHAVE_CONFIG_H 
-DDEF_FILESEARCHPATH=\"/usr/X11R6/share/X11/app-defaults/%N%C%S:/usr/X11R6/share/X11/app-defaults/%N%S\"
 -I. -I.. -I../.. -I/usr/xenocara/app/xlockmore/xlock/ 
-I/usr/xenocara/app/xlockmore -I/usr/X11R6/include  -I/usr/X11R6/include 
-I/usr/X11R6/include/freetype2 -I/usr/X11R6/include -I/usr/X11R6/include -g -O2 
/usr/xenocara/app/xlockmore/modes/glx/./i_figureeight.cc
/usr/xenocara/app/xlockmore/modes/glx/./i_figureeight.cc:31:47: error: use of 
overloaded operator '^' is ambiguous
  (with operand types 'class TwoJet' and 'int')
  FigureEight(w, h, du*D(size, 0)*(D(u, 0)^(-1)), form, v),
   ~~~^
Index: modes/glx/i_figureeight.cc
===
RCS file: /cvs/xenocara/app/xlockmore/modes/glx/i_figureeight.cc,v
retrieving revision 1.1.1.1
diff -u -p -r1.1.1.1 i_figureeight.cc
--- modes/glx/i_figureeight.cc  26 Nov 2006 11:08:51 -  1.1.1.1
+++ modes/glx/i_figureeight.cc  2 Feb 2017 02:19:08 -
@@ -28,7 +28,7 @@ TwoJetVec AddFigureEight(ThreeJetVec p, 
   TwoJetVec w = Normalize(Cross(h, du))*(TwoJet(size)*1.1);
   return RotateZ(
 TwoJetVec(p) +
-  FigureEight(w, h, du*D(size, 0)*(D(u, 0)^(-1)), form, v),
+  FigureEight(w, h, du*D(size, 0)*(D(u, 0)^((double)-1)), form, v),
 v*(1./n_strips)
   );
 }
Index: modes/glx/i_sphere.cc
===
RCS file: /cvs/xenocara/app/xlockmore/modes/glx/i_sphere.cc,v
retrieving revision 1.1.1.1
diff -u -p -r1.1.1.1 i_sphere.cc
--- modes/glx/i_sphere.cc   26 Nov 2006 11:08:51 -  1.1.1.1
+++ modes/glx/i_sphere.cc   2 Feb 2017 02:21:33 -
@@ -28,16 +28,16 @@ ThreeJet Param1(ThreeJet x) {
   double offset = 0;
   x %= 4;
   if (x > 2) { x = x+(-2); offset = 2; }
-  if (x <= 1) return x*2 + (x^2)*(-1) + offset;
-  else return (x^2) + x*(-2) + (2 + offset);
+  if (x <= 1) return x*2 + (x^(double)2)*(-1) + offset;
+  else return (x^(double)2) + x*(-2) + (2 + offset);
 }
 
 ThreeJet Param2(ThreeJet x) {
   double offset = 0;
   x %= 4;
   if (x > 2) { x = x+(-2); offset = 2; }
-  if (x <= 1) return (x^2) + offset;
-  else return (x^2)*(-1) + x*4 + (-2 + offset);
+  if (x <= 1) return (x^(double)2) + offset;
+  else return (x^(double)2)*(-1) + x*4 + (-2 + offset);
 }
 
 static inline ThreeJet TInterp(double x) {
@@ -48,7 +48,7 @@ ThreeJet UInterp(ThreeJet x) {
   x %= 2;
   if (x > 1)
 x = x*(-1) + 2;
-  return (x^2)*3 + (x^3) * (-2);
+  return (x^(double)2)*3 + (x^(double)3) * (-2);
 }
 
 #define FFPOW 3
@@ -59,7 +59,7 @@ ThreeJet FFInterp(ThreeJet x) {
   x = x*1.06 + -0.05;
   if (x < 0) return ThreeJet(0, 0, 0);
   else if (x > 1) return ThreeJet(0, 0, 0) + 1;
-  else return (x ^ (FFPOW-1)) * (FFPOW) + (x^FFPOW) * (-FFPOW+1);
+  else return (x ^ (double)(FFPOW-1)) * (FFPOW) + (x^(double)FFPOW) * 
(-FFPOW+1);
 }
 
 #define FSPOW 3
@@ -67,7 +67,7 @@ ThreeJet FSInterp(ThreeJet x) {
   x %= 2;
   if (x > 1)
 x = x*(-1) + 2;
-  return ((x ^ (FSPOW-1)) * (FSPOW) + (x^FSPOW) * (-FSPOW+1)) * (-0.2);
+  return ((x ^ (double)(FSPOW-1)) * (FSPOW) + (x^(double)FSPOW) * (-FSPOW+1)) 
* (-0.2);
 }
 
 ThreeJetVec Stage0(ThreeJet u, ThreeJet v) {
Index: modes/glx/i_threejetvec.cc
===
RCS file: /cvs/xenocara/app/xlockmore/modes/glx/i_threejetvec.cc,v
retrieving revision 1.1.1.1
diff -u -p -r1.1.1.1 i_threejetvec.cc
--- modes/glx/i_threejetvec.cc  26 Nov 2006 11:08:51 -  1.1.1.1
+++ modes/glx/i_threejetvec.cc  2 Feb 2017 02:23:09 -
@@ -63,10 +63,10 @@ ThreeJetVec Normalize(ThreeJetVec v) {
 
 ThreeJetVec RotateZ(ThreeJetVec v, ThreeJet angle) {
   ThreeJetVec result;
-  ThreeJet s,c;
+  ThreeJet s, c;
   s = Sin (angle);
   c = Cos (angle);
-  result.x =  v.x*c + v.y*s;
+  result.x = v.x*c + v.y*s;
   result.y = v.x*s*-1 + v.y*c;
   result.z = v.z;
   return result;
@@ -79,13 +79,13 @@ ThreeJetVec RotateY(ThreeJetVec v, Three
   c = Cos (angle);
   result.x = v.x*c + v.z*s*-1;
   result.y = v.y;
-  result.z = v.x*s + v.z*c;
+  result.z = v.x*s + v.z*c;
   return result;
 }
 
 ThreeJetVec RotateX(ThreeJetVec v, ThreeJet angle) {
   ThreeJetVec result;
-  ThreeJet s,c;
+  ThreeJet s, c;
   s = Sin (angle);
   c = Cos (angle);
   result.x = v.x;
@@ -100,5 +100,5 @@ ThreeJetVec InterpolateVec(ThreeJetVec v
 
 ThreeJet Length(ThreeJetVec v)
 {
-  return (v.x^2 + v.y^2) ^ (.5);
+  return (v.x * v.x + v.y * v.y) ^ (.5);
 }
Index: modes/glx/i_twojetvec.cc
===
RCS file: /cvs/xenocara/app/xlockmore/modes/glx/i_twojetvec.cc,v
retrieving revision 1.1.1.1
diff -u -p -r1.1.1.1 i_twojetvec.cc
--- modes/glx/i_twojetvec.cc26 Nov 2006 11:08:51 -  1.1.1.1
+++ modes/glx/i_twojetvec.cc2 Feb 2017 02:23:57 -
@@ -55,10 +55,10

make sosetopt responsible for m_free

2017-02-01 Thread David Hill 
Hello -

This diff makes sosetopt responsible for m_free which is much simpler.
Requested by bluhm@ 

Index: kern/uipc_socket.c
===
RCS file: /cvs/src/sys/kern/uipc_socket.c,v
retrieving revision 1.176
diff -u -p -r1.176 uipc_socket.c
--- kern/uipc_socket.c  1 Feb 2017 20:59:47 -   1.176
+++ kern/uipc_socket.c  2 Feb 2017 00:13:23 -
@@ -1562,6 +1562,7 @@ sosetopt(struct socket *so, int level, i
error = (*so->so_proto->pr_ctloutput)(PRCO_SETOPT, so,
level, optname, m0);
NET_UNLOCK(s);
+   m_free(m0);
return (error);
}
error = ENOPROTOOPT;
@@ -1709,6 +1710,7 @@ sosetopt(struct socket *so, int level, i
error = (*so->so_proto->pr_ctloutput)
(PRCO_SETOPT, so, level, optname, m0);
NET_UNLOCK(s);
+   m_free(m0);
return (error);
}
error = ENOPROTOOPT;
@@ -1741,7 +1743,8 @@ sosetopt(struct socket *so, int level, i
(*so->so_proto->pr_ctloutput)(PRCO_SETOPT, so,
level, optname, m0);
NET_UNLOCK(s);
-   m = NULL;   /* freed by protocol */
+   m_free(m0);
+   m = NULL;
}
}
 bad:
Index: net/rtsock.c
===
RCS file: /cvs/src/sys/net/rtsock.c,v
retrieving revision 1.222
diff -u -p -r1.222 rtsock.c
--- net/rtsock.c1 Feb 2017 20:59:47 -   1.222
+++ net/rtsock.c2 Feb 2017 00:13:23 -
@@ -240,12 +240,8 @@ route_ctloutput(int op, struct socket *s
int error = 0;
unsigned int tid;
 
-   if (level != AF_ROUTE) {
-   error = EINVAL;
-   if (op == PRCO_SETOPT && m)
-   m_free(m);
-   return (error);
-   }
+   if (level != AF_ROUTE)
+   return EINVAL;
 
switch (op) {
case PRCO_SETOPT:
@@ -271,7 +267,6 @@ route_ctloutput(int op, struct socket *s
error = ENOPROTOOPT;
break;
}
-   m_free(m);
break;
case PRCO_GETOPT:
switch (optname) {
Index: netinet/ip_mroute.c
===
RCS file: /cvs/src/sys/netinet/ip_mroute.c,v
retrieving revision 1.108
diff -u -p -r1.108 ip_mroute.c
--- netinet/ip_mroute.c 1 Feb 2017 20:59:47 -   1.108
+++ netinet/ip_mroute.c 2 Feb 2017 00:13:23 -
@@ -209,7 +209,6 @@ ip_mrouter_set(struct socket *so, int op
break;
}
 
-   m_free(m);
return (error);
 }
 
Index: netinet/ip_output.c
===
RCS file: /cvs/src/sys/netinet/ip_output.c,v
retrieving revision 1.335
diff -u -p -r1.335 ip_output.c
--- netinet/ip_output.c 1 Feb 2017 20:59:47 -   1.335
+++ netinet/ip_output.c 2 Feb 2017 00:13:23 -
@@ -853,11 +853,10 @@ ip_ctloutput(int op, struct socket *so, 
int error = 0;
u_int rtid = 0;
 
-   if (level != IPPROTO_IP) {
-   error = EINVAL;
-   if (op == PRCO_SETOPT)
-   (void) m_free(m);
-   } else switch (op) {
+   if (level != IPPROTO_IP)
+   return EINVAL;
+   
+   switch (op) {
case PRCO_SETOPT:
switch (optname) {
case IP_OPTIONS:
@@ -1073,7 +1072,6 @@ ip_ctloutput(int op, struct socket *so, 
error = ENOPROTOOPT;
break;
}
-   m_free(m);
break;
 
case PRCO_GETOPT:
@@ -1235,12 +1233,11 @@ ip_pcbopts(struct mbuf **pcbopt, struct 
 
/* turn off any old options */
m_free(*pcbopt);
-   *pcbopt = 0;
+   *pcbopt = NULL;
if (m == NULL || m->m_len == 0) {
/*
 * Only turning off any previous options.
 */
-   m_free(m);
return (0);
}
 
@@ -1316,7 +1313,6 @@ ip_pcbopts(struct mbuf **pcbopt, struct 
return (0);
 
 bad:
-   (void)m_free(m);
return (EINVAL);
 }
 
Index: netinet/raw_ip.c
===
RCS file: /cvs/src/sys/netinet/raw_ip.c,v
retrieving revision 1.95
diff -u -p -r1.95 raw_ip.c
--- netinet/raw_ip.c1 Feb 2017 20:59:47 -   1.95
+++ netinet/raw_ip.c2 Feb 2017 00:13:23 -
@@ -305,11 +305,8 @@ rip_ctloutput(int op, struct socket *so,
int error = 0;
int dir;
 
-   if (level !=

Re: ip6stat percpu counters

2017-02-01 Thread Alexander Bluhm 
On Tue, Jan 31, 2017 at 02:21:46PM +0100, Jeremie Courreges-Anglas wrote:
> 
> Updated diff that addresses Martin's points:
> - kill IPv6 mbuf stats; don't change the ip6stat structure yet - there
>   are already other fields that are useless
> - add ip6stat_add()
> 
> Keep the M_COUNTERS change separate for now, I can send an updated diff
> later if needed.
> 
> Additionally,
> - stop testing for (newp != NULL) in ip6_sysctl/IPV6CTL_STATS,
>   sysctl_rdstruct in ip6_sysctl_ip6stat already does so for us.
>   I see no harm in returning an error late here.
> - move ip6_sysctl_ip6stat above ip6_sysctl to get rid of an unneeded decl

OK bluhm@

> 
> 
> Index: net/if_bridge.c
> ===
> RCS file: /d/cvs/src/sys/net/if_bridge.c,v
> retrieving revision 1.293
> diff -u -p -r1.293 if_bridge.c
> --- net/if_bridge.c   24 Jan 2017 10:08:30 -  1.293
> +++ net/if_bridge.c   31 Jan 2017 10:53:00 -
> @@ -1692,7 +1692,7 @@ bridge_ip(struct bridge_softc *sc, int d
>   if (m->m_len < sizeof(struct ip6_hdr)) {
>   if ((m = m_pullup(m, sizeof(struct ip6_hdr)))
>   == NULL) {
> - ip6stat.ip6s_toosmall++;
> + ip6stat_inc(ip6s_toosmall);
>   return (NULL);
>   }
>   }
> @@ -1700,7 +1700,7 @@ bridge_ip(struct bridge_softc *sc, int d
>   ip6 = mtod(m, struct ip6_hdr *);
>  
>   if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
> - ip6stat.ip6s_badvers++;
> + ip6stat_inc(ip6s_badvers);
>   goto dropit;
>   }
>  
> Index: net/pf.c
> ===
> RCS file: /d/cvs/src/sys/net/pf.c,v
> retrieving revision 1.1013
> diff -u -p -r1.1013 pf.c
> --- net/pf.c  30 Jan 2017 17:52:24 -  1.1013
> +++ net/pf.c  31 Jan 2017 10:53:00 -
> @@ -5974,7 +5974,7 @@ pf_route6(struct pf_pdesc *pd, struct pf
>  
>   rt = rtalloc(sin6tosa(dst), RT_RESOLVE, rtableid);
>   if (!rtisvalid(rt)) {
> - ip6stat.ip6s_noroute++;
> + ip6stat_inc(ip6s_noroute);
>   goto bad;
>   }
>  
> Index: netinet/ipsec_input.c
> ===
> RCS file: /d/cvs/src/sys/netinet/ipsec_input.c,v
> retrieving revision 1.141
> diff -u -p -r1.141 ipsec_input.c
> --- netinet/ipsec_input.c 29 Jan 2017 19:58:47 -  1.141
> +++ netinet/ipsec_input.c 31 Jan 2017 10:53:00 -
> @@ -985,7 +985,7 @@ ah6_input_cb(struct mbuf *m, int off, in
>*/
>   while (nxt != IPPROTO_DONE) {
>   if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
> - ip6stat.ip6s_toomanyhdr++;
> + ip6stat_inc(ip6s_toomanyhdr);
>   goto bad;
>   }
>  
> @@ -994,7 +994,7 @@ ah6_input_cb(struct mbuf *m, int off, in
>* more sanity checks in header chain processing.
>*/
>   if (m->m_pkthdr.len < off) {
> - ip6stat.ip6s_tooshort++;
> + ip6stat_inc(ip6s_tooshort);
>   goto bad;
>   }
>   nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(, , nxt);
> Index: netinet6/dest6.c
> ===
> RCS file: /d/cvs/src/sys/netinet6/dest6.c,v
> retrieving revision 1.15
> diff -u -p -r1.15 dest6.c
> --- netinet6/dest6.c  14 Mar 2015 03:38:52 -  1.15
> +++ netinet6/dest6.c  31 Jan 2017 10:53:00 -
> @@ -73,7 +73,7 @@ dest6_input(struct mbuf **mp, int *offp,
>   for (optlen = 0; dstoptlen > 0; dstoptlen -= optlen, opt += optlen) {
>   if (*opt != IP6OPT_PAD1 &&
>   (dstoptlen < IP6OPT_MINLEN || *(opt + 1) + 2 > dstoptlen)) {
> - ip6stat.ip6s_toosmall++;
> + ip6stat_inc(ip6s_toosmall);
>   goto bad;
>   }
>  
> Index: netinet6/frag6.c
> ===
> RCS file: /d/cvs/src/sys/netinet6/frag6.c,v
> retrieving revision 1.71
> diff -u -p -r1.71 frag6.c
> --- netinet6/frag6.c  28 Nov 2016 11:12:45 -  1.71
> +++ netinet6/frag6.c  31 Jan 2017 13:00:14 -
> @@ -190,7 +190,7 @@ frag6_input(struct mbuf **mp, int *offp,
>   return IPPROTO_DONE;
>   }
>  
> - ip6stat.ip6s_fragments++;
> + ip6stat_inc(ip6s_fragments);
>  
>   /* offset now points to data portion */
>   offset += sizeof(struct ip6_frag);
> @@ -203,7 +203,7 @@ frag6_input(struct mbuf **mp, int *offp,
>*/
>   fragoff = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK);
>   if (fragoff == 0 && !(ip6f->ip6f_offlg & IP6F_MORE_FRAG)) {
> - ip6stat.ip6s_reassembled++;
> +

Re: Help with the NET_LOCK()

2017-02-01 Thread Hrvoje Popovski 
On 31.1.2017. 21:35, David Hill wrote:
> On Tue, Jan 31, 2017 at 09:11:37PM +0100, Alexander Bluhm wrote:
>> On Tue, Jan 31, 2017 at 12:14:35PM -0500, David Hill wrote:
>>> with mpi@'s suggestion to pass a struct mbuf * 
>> We call mbuf variables m and mbuf pointer mp.  So you should rename
>> *mp to m.
>>
>> The different policy who has to free the mbuf with
>> if (op == PRCO_SETOPT)
>> m_free(*mp);
>> is not nice.  I think it would be better if all the freeing is
>> done in sosetopt and sogetopt.  But this requires more thought
>> and should not be in this diff.  A possible next step.
>>
>> bluhm
>>
> I was thinking sosetopt in a separate diff..
> 
> Updated diff.


In a link below i put whole reboot log from console with source which
includes latest dhill@ commit. There are cca 20K lines in netlock.log


http://kosjenka.srce.hr/~hrvoje/netlock.log

Re: ip6stat percpu counters

2017-02-01 Thread Jeremie Courreges-Anglas 
Jeremie Courreges-Anglas  writes:

> Updated diff that addresses Martin's points:
> - kill IPv6 mbuf stats; don't change the ip6stat structure yet - there
>   are already other fields that are useless
> - add ip6stat_add()
>
> Keep the M_COUNTERS change separate for now, I can send an updated diff
> later if needed.
>
> Additionally,
> - stop testing for (newp != NULL) in ip6_sysctl/IPV6CTL_STATS,
>   sysctl_rdstruct in ip6_sysctl_ip6stat already does so for us.
>   I see no harm in returning an error late here.
> - move ip6_sysctl_ip6stat above ip6_sysctl to get rid of an unneeded decl

I should have done this earlier, but... I baked a release with this on
amd64, no floppy size problem.

-- 
jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF  DDCC 0DFA 74AE 1524 E7EE

ip6_ours()

2017-02-01 Thread Alexander Bluhm 
Hi,

I would like to make ip6_input() more like ipv4_input() and introduce
ip6_ours().

ok?

bluhm

Index: netinet6/ip6_input.c
===
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet6/ip6_input.c,v
retrieving revision 1.175
diff -u -p -r1.175 ip6_input.c
--- netinet6/ip6_input.c29 Jan 2017 19:58:47 -  1.175
+++ netinet6/ip6_input.c1 Feb 2017 19:42:15 -
@@ -120,9 +120,9 @@ struct niqueue ip6intrq = NIQUEUE_INITIA
 struct ip6stat ip6stat;
 
 int ip6_check_rh0hdr(struct mbuf *, int *);
-
 int ip6_hbhchcheck(struct mbuf *, int *, int *, int *);
 int ip6_hopopts_input(u_int32_t *, u_int32_t *, struct mbuf **, int *);
+void ip6_ours(struct mbuf *, int, int);
 struct mbuf *ip6_pullexthdr(struct mbuf *, size_t, int);
 
 static struct mbuf_queue   ip6send_mq;
@@ -179,9 +179,8 @@ ip6_input(struct mbuf *m)
struct ip6_hdr *ip6;
struct sockaddr_in6 sin6;
struct rtentry *rt = NULL;
-   int off, nest;
+   int off, nxt, ours = 0;
u_int16_t src_scope, dst_scope;
-   int nxt, ours = 0;
 #if NPF > 0
struct in6_addr odst;
 #endif
@@ -214,8 +213,7 @@ ip6_input(struct mbuf *m)
if (m->m_len < sizeof(struct ip6_hdr)) {
if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
ip6stat.ip6s_toosmall++;
-   if_put(ifp);
-   return;
+   goto out;
}
}
 
@@ -353,9 +351,7 @@ ip6_input(struct mbuf *m)
ip6_check_rh0hdr(m, )) {
ip6stat.ip6s_badoptions++;
icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, off);
-   /* m is already freed */
-   if_put(ifp);
-   return;
+   goto out;
}
 
if (IN6_IS_ADDR_LOOPBACK(>ip6_src) ||
@@ -391,11 +387,8 @@ ip6_input(struct mbuf *m)
 
 #ifdef MROUTING
if (ip6_mforwarding && ip6_mrouter) {
-   if (ip6_hbhchcheck(m, , , )) {
-   rtfree(rt);
-   if_put(ifp);
-   return; /* m have already been freed */
-   }
+   if (ip6_hbhchcheck(m, , , ))
+   goto out;
 
ip6 = mtod(m, struct ip6_hdr *);
 
@@ -407,14 +400,15 @@ ip6_input(struct mbuf *m)
 * ip6_mforward() returns a non-zero value, the packet
 * must be discarded, else it may be accepted below.
 */
-   if (ip6_mforward(ip6, ifp, m)) {
+   if (ip6_mforward(ip6, ifp, m)) {
ip6stat.ip6s_cantforward++;
goto bad;
}
 
if (!ours)
goto bad;
-   goto ours;
+   ip6_ours(m, off, nxt);
+   goto out;
}
 #endif
if (!ours) {
@@ -484,36 +478,39 @@ ip6_input(struct mbuf *m)
 
   hbhcheck:
 
-   if (ip6_hbhchcheck(m, , , )) {
-   rtfree(rt);
-   if_put(ifp);
-   return; /* m have already been freed */
-   }
+   if (ip6_hbhchcheck(m, , , ))
+   goto out;
 
-   /* adjust pointer */
-   ip6 = mtod(m, struct ip6_hdr *);
+   if (ours) {
+   ip6_ours(m, off, nxt);
+   goto out;
+   }
 
/*
 * Forward if desirable.
 */
-   if (!ours) {
-   ip6_forward(m, rt, srcrt);
-   if_put(ifp);
-   return;
-   }
-#ifdef MROUTING
-  ours:
-#endif
+   ip6_forward(m, rt, srcrt);
+   if_put(ifp);
+   return;
+ bad:
+   m_freem(m);
+ out:
+   rtfree(rt);
+   if_put(ifp);
+}
+
+void
+ip6_ours(struct mbuf *m, int off, int nxt)
+{
+   int nest = 0;
+
/* pf might have changed things */
in6_proto_cksum_out(m, NULL);
 
-   ip6 = mtod(m, struct ip6_hdr *);
-
/*
 * Tell launch routine the next header
 */
ip6stat.ip6s_delivered++;
-   nest = 0;
 
while (nxt != IPPROTO_DONE) {
if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
@@ -543,12 +540,8 @@ ip6_input(struct mbuf *m)
 
nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(, , nxt);
}
-   rtfree(rt);
-   if_put(ifp);
return;
  bad:
-   rtfree(rt);
-   if_put(ifp);
m_freem(m);
 }

Re: Help with the NET_LOCK()

2017-02-01 Thread Alexander Bluhm 
On Tue, Jan 31, 2017 at 03:35:47PM -0500, David Hill wrote:
> Updated diff.

OK bluhm@

> 
> Index: kern/uipc_socket.c
> ===
> RCS file: /cvs/src/sys/kern/uipc_socket.c,v
> retrieving revision 1.175
> diff -u -p -r1.175 uipc_socket.c
> --- kern/uipc_socket.c27 Jan 2017 20:31:42 -  1.175
> +++ kern/uipc_socket.c31 Jan 2017 20:29:37 -
> @@ -1560,7 +1560,7 @@ sosetopt(struct socket *so, int level, i
>   if (so->so_proto && so->so_proto->pr_ctloutput) {
>   NET_LOCK(s);
>   error = (*so->so_proto->pr_ctloutput)(PRCO_SETOPT, so,
> - level, optname, );
> + level, optname, m0);
>   NET_UNLOCK(s);
>   return (error);
>   }
> @@ -1707,7 +1707,7 @@ sosetopt(struct socket *so, int level, i
>   level = dom->dom_protosw->pr_protocol;
>   NET_LOCK(s);
>   error = (*so->so_proto->pr_ctloutput)
> - (PRCO_SETOPT, so, level, optname, );
> + (PRCO_SETOPT, so, level, optname, m0);
>   NET_UNLOCK(s);
>   return (error);
>   }
> @@ -1739,7 +1739,7 @@ sosetopt(struct socket *so, int level, i
>   if (error == 0 && so->so_proto && so->so_proto->pr_ctloutput) {
>   NET_LOCK(s);
>   (*so->so_proto->pr_ctloutput)(PRCO_SETOPT, so,
> - level, optname, );
> + level, optname, m0);
>   NET_UNLOCK(s);
>   m = NULL;   /* freed by protocol */
>   }
> @@ -1758,11 +1758,19 @@ sogetopt(struct socket *so, int level, i
>  
>   if (level != SOL_SOCKET) {
>   if (so->so_proto && so->so_proto->pr_ctloutput) {
> + m = m_get(M_WAIT, MT_SOOPTS);
> + m->m_len = 0;
> +
>   NET_LOCK(s);
>   error = (*so->so_proto->pr_ctloutput)(PRCO_GETOPT, so,
> - level, optname, mp);
> + level, optname, m);
>   NET_UNLOCK(s);
> - return (error);
> + if (error) {
> + m_free(m);
> + return (error);
> + }
> + *mp = m;
> + return (0);
>   } else
>   return (ENOPROTOOPT);
>   } else {
> @@ -1835,7 +1843,6 @@ sogetopt(struct socket *so, int level, i
>   }
>  
>   case SO_RTABLE:
> - (void)m_free(m);
>   if (so->so_proto && so->so_proto->pr_domain &&
>   so->so_proto->pr_domain->dom_protosw &&
>   so->so_proto->pr_ctloutput) {
> @@ -1844,12 +1851,16 @@ sogetopt(struct socket *so, int level, i
>   level = dom->dom_protosw->pr_protocol;
>   NET_LOCK(s);
>   error = (*so->so_proto->pr_ctloutput)
> - (PRCO_GETOPT, so, level, optname, mp);
> + (PRCO_GETOPT, so, level, optname, m);
>   NET_UNLOCK(s);
> - return (error);
> + if (error) {
> + (void)m_free(m);
> + return (error);
> + }
> + break;
>   }
> + (void)m_free(m);
>   return (ENOPROTOOPT);
> - break;
>  
>  #ifdef SOCKET_SPLICE
>   case SO_SPLICE:
> @@ -1880,7 +1891,6 @@ sogetopt(struct socket *so, int level, i
>   }
>   (void)m_free(m);
>   return (EOPNOTSUPP);
> - break;
>  
>   default:
>   (void)m_free(m);
> Index: net/rtsock.c
> ===
> RCS file: /cvs/src/sys/net/rtsock.c,v
> retrieving revision 1.221
> diff -u -p -r1.221 rtsock.c
> --- net/rtsock.c  31 Jan 2017 10:24:41 -  1.221
> +++ net/rtsock.c  31 Jan 2017 20:29:37 -
> @@ -98,7 +98,7 @@ struct walkarg {
>   caddr_t w_where, w_tmem;
>  };
>  
> -int  route_ctloutput(int, struct socket *, int, int, struct mbuf **);
> +int  route_ctloutput(int, struct socket *, int, int, struct mbuf *);
>  void route_input(struct mbuf *m0, sa_family_t);
>  int  route_arp_conflict(struct rtentry *, struct rt_addrinfo *);
>  int  route_cleargateway(struct rtentry *, void *,

Re: fix: cy(4) debug format strings

2017-02-01 Thread Alexander Bluhm 
On Wed, Feb 01, 2017 at 11:45:52AM +0100, Jan Klemkow wrote:
> the kernel does not compile with option CY_DEBUG because of several
> format string mistakes.  This diff fixes them.  It compiles on i386
> and amd64 without any errors.

Commited, Thanks

> Index: cy.c
> ===
> RCS file: /cvs/openbsd/src/sys/dev/ic/cy.c,v
> retrieving revision 1.35
> diff -u -p -r1.35 cy.c
> --- cy.c  31 Oct 2014 09:45:27 -  1.35
> +++ cy.c  1 Feb 2017 10:09:05 -
> @@ -116,7 +116,7 @@ cy_probe_common(bus_space_tag_t memt, bu
>   chip_offs -= (CY32_ADDR_FIX << bustype);
>  
>  #ifdef CY_DEBUG
> - printf("cy: probe chip %d offset 0x%lx ... ",
> + printf("cy: probe chip %d offset 0x%x ... ",
>   cy_chip, chip_offs);
>  #endif
>  
> @@ -446,7 +446,7 @@ cyread(dev, uio, flag)
>   struct tty *tp = cy->cy_tty;
>  
>  #ifdef CY_DEBUG
> - printf("%s read port %d uio 0x%x flag 0x%x\n", sc->sc_dev.dv_xname,
> + printf("%s read port %d uio %p flag 0x%x\n", sc->sc_dev.dv_xname,
>   port, uio, flag);
>  #endif
>  
> @@ -469,7 +469,7 @@ cywrite(dev, uio, flag)
>   struct tty *tp = cy->cy_tty;
>  
>  #ifdef CY_DEBUG
> - printf("%s write port %d uio 0x%x flag 0x%x\n", sc->sc_dev.dv_xname,
> + printf("%s write port %d uio %p flag 0x%x\n", sc->sc_dev.dv_xname,
>   port, uio, flag);
>  #endif
>  
> @@ -511,7 +511,7 @@ cyioctl(dev, cmd, data, flag, p)
>   int error;
>  
>  #ifdef CY_DEBUG
> - printf("%s port %d ioctl cmd 0x%x data 0x%x flag 0x%x\n",
> + printf("%s port %d ioctl cmd 0x%lx data %p flag 0x%x\n",
>   sc->sc_dev.dv_xname, port, cmd, data, flag);
>  #endif
>  
> @@ -596,7 +596,7 @@ cystart(tp)
>   int s;
>  
>  #ifdef CY_DEBUG
> - printf("%s port %d start, tty 0x%x\n", sc->sc_dev.dv_xname, port, tp);
> + printf("%s port %d start, tty %p\n", sc->sc_dev.dv_xname, port, tp);
>  #endif
>  
>   s = spltty();
> @@ -633,7 +633,7 @@ cystop(tp, flag)
>   int s;
>  
>  #ifdef CY_DEBUG
> - printf("%s port %d stop tty 0x%x flag 0x%x\n", sc->sc_dev.dv_xname,
> + printf("%s port %d stop tty %p flag 0x%x\n", sc->sc_dev.dv_xname,
>   port, tp, flag);
>  #endif
>  
> @@ -670,7 +670,7 @@ cyparam(tp, t)
>   int s, opt;
>  
>  #ifdef CY_DEBUG
> - printf("%s port %d param tty 0x%x termios 0x%x\n", sc->sc_dev.dv_xname,
> + printf("%s port %d param tty %p termios %p\n", sc->sc_dev.dv_xname,
>   port, tp, t);
>   printf("ispeed %d ospeed %d\n", t->c_ispeed, t->c_ospeed);
>  #endif
> @@ -1363,7 +1363,7 @@ cd1400_channel_cmd(cy, cmd)
>   u_int waitcnt = 5 * 8 * 1024; /* approx 5 ms */
>  
>  #ifdef CY_DEBUG
> - printf("c1400_channel_cmd cy 0x%x command 0x%x\n", cy, cmd);
> + printf("c1400_channel_cmd cy %p command 0x%x\n", cy, cmd);
>  #endif
>  
>   /* wait until cd1400 is ready to process a new command */

specify curves via ecdhe statement in httpd.conf

2017-02-01 Thread Andreas Bartelt 

Hello,

after reading the LibreSSL accouncement from today, I assumed that 
specifying ecdhe "auto" in /etc/httpd.conf would enable X25519, P-256 
and P-384 on current.


I've noticed that "auto" enables only curves x25519 and P-256 (which is 
what I'd want to use - but somehow unexpected with regard to the 
announcement). Diff is attached which clarifies the meaning of "auto" in 
httpd.conf.5.


There currently seems to be no way to explicitly specify x25519, or to 
specify multiple colon separated curves with the ecdhe statement. Would 
it make sense to change semantics and make the ecdhe statement in 
httpd.conf consistent with the recent changes to openssl s_client 
-groups (e.g., to also allow more common names like P-256 instead of 
prime256v1)?


Best Regards
Andreas
Index: httpd.conf.5
===
RCS file: /cvs/src/usr.sbin/httpd/httpd.conf.5,v
retrieving revision 1.78
diff -u -p -u -r1.78 httpd.conf.5
--- httpd.conf.5	24 Jan 2017 13:28:47 -	1.78
+++ httpd.conf.5	1 Feb 2017 14:18:45 -
@@ -527,7 +527,7 @@ The default is none, which disables DHE 
 .It Ic ecdhe Ar curve
 Specify the ECDHE curve to use for ECDHE cipher suites.
 Valid parameter values are none, auto and the short name of any known curve.
-The default is auto.
+The default is auto which enables curves X25519 and P-256.
 .It Ic key Ar file
 Specify the private key to use for this server.
 The

Re: Sync sys/videoio.h with recent Linux kernel

2017-02-01 Thread Ingo Feinerer 
On Sun, Jan 29, 2017 at 11:23:06AM +0100, Martin Pieuchot wrote:
> On 28/01/17(Sat) 11:55, Ingo Feinerer wrote:
> > in a previous commit
> > (http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/sys/videoio.h?rev=1.12=text/x-cvsweb-markup)
> > we updated our V4L2 API. However, one file (v4l2-common.h) could not be
> > inlined as it was only GPL2 licensed.
> > 
> > After discussion with the authors they agreed to dual license (GPL + BSD) 
> > this
> > file as well
> > (https://git.linuxtv.org/media_tree.git/commit/?id=80100fd9ebb9f2414892a1178d26a4253e6c0bcf)
> > which allows us to fully comply with the V4L2 API. The attached diff
> > implements this and syncs with videodev2.h from the Linux kernel version
> > 4.10-rc5 at the same time
> > (https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/plain/include/uapi/linux/videodev2.h?id=refs/tags/v4.10-rc5).
> > 
> > (The sync with a recent Linux videodev2.h is a prerequisite for updating the
> > port multimedia/libv4l to 1.12.2.)
> > 
> > I compiled a current kernel on amd64. My camera still works fine (tested 
> > with
> > luvcview and baresip in combination with libv4l 1.12.2).
> > 
> > OK?
> 
> This needs to go in a bulk since most users of this API are ports.

May I ask for OKs after naddy@'s successful amd64 bulk build?

Best regards,
Ingo

Re: clang and -Werror vs -Wpointer-sign

2017-02-01 Thread Jonathan Gray 
On Mon, Jan 30, 2017 at 07:28:03PM +0100, Stefan Kempf wrote:
> Jonathan Gray wrote:
> > Base gcc4 changes the defaults to set -Wno-pointer-sign.
> > Base clang does not, I'm not sure where in the llvm code to do so.
> > Base gcc3 does not handle -Wno-pointer-sign.
>  
> I think this should turn off -Wpointer-sign off by default.
> Passing -Wpointer-sign on the command line enables it.
> Not suitable for upstreaming though.

Thanks, your patch seems to be against the older version of llvm
but this works as expected with 4.0 rc1 in tree on arm64.

ok jsg@

> 
> Index: gnu/llvm/tools/clang//include/clang/Basic/DiagnosticSemaKinds.td
> ===
> RCS file: 
> /cvs/src/gnu/llvm/tools/clang/include/clang/Basic/DiagnosticSemaKinds.td,v
> retrieving revision 1.1.1.2
> diff -u -p -r1.1.1.2 DiagnosticSemaKinds.td
> --- gnu/llvm/tools/clang//include/clang/Basic/DiagnosticSemaKinds.td  14 Jan 
> 2017 19:55:48 -  1.1.1.2
> +++ gnu/llvm/tools/clang//include/clang/Basic/DiagnosticSemaKinds.td  30 Jan 
> 2017 18:22:22 -
> @@ -6332,7 +6332,7 @@ def ext_typecheck_convert_incompatible_p
>"sending to parameter of different type}0,1"
>"|%diff{casting $ to type $|casting between types}0,1}2"
>" converts between pointers to integer types with different sign">,
> -  InGroup>;
> +  InGroup>, DefaultIgnore;
>  def ext_typecheck_convert_incompatible_pointer : ExtWarn<
>"incompatible pointer types "
>"%select{%diff{assigning to $ from $|assigning to different types}0,1"
>  
> > Below is a patch to add -Wno-pointer-sign to places that use use
> > -Werror and trigger -Wpointer-sign warnings which breaks the build
> > when building with clang.  Based on an earlier patch from patrick@
> > 
> > Though really the default gcc4 and clang behaviour should be the
> > same one way or the other.
> >
> > Index: lib/libcrypto/Makefile
> > ===
> > RCS file: /cvs/src/lib/libcrypto/Makefile,v
> > retrieving revision 1.14
> > diff -u -p -r1.14 Makefile
> > --- lib/libcrypto/Makefile  21 Jan 2017 09:38:58 -  1.14
> > +++ lib/libcrypto/Makefile  29 Jan 2017 05:10:50 -
> > @@ -14,6 +14,9 @@ CLEANFILES=${PC_FILES} ${VERSION_SCRIPT}
> >  LCRYPTO_SRC=   ${.CURDIR}
> >  
> >  CFLAGS+= -Wall -Wundef -Werror
> > +.if ${COMPILER_VERSION:L} != "gcc3"
> > +CFLAGS+= -Wno-pointer-sign
> > +.endif
> >  
> >  .if !defined(NOPIC)
> >  CFLAGS+= -DDSO_DLFCN -DHAVE_DLFCN_H -DHAVE_FUNOPEN
> > Index: lib/librthread/Makefile
> > ===
> > RCS file: /cvs/src/lib/librthread/Makefile,v
> > retrieving revision 1.43
> > diff -u -p -r1.43 Makefile
> > --- lib/librthread/Makefile 1 Jun 2016 04:34:18 -   1.43
> > +++ lib/librthread/Makefile 29 Jan 2017 05:27:29 -
> > @@ -1,11 +1,16 @@
> >  #  $OpenBSD: Makefile,v 1.43 2016/06/01 04:34:18 tedu Exp $
> >  
> > +.include 
> > +
> >  LIB=pthread
> >  LIBCSRCDIR=${.CURDIR}/../libc
> >  
> >  CFLAGS+=-Wall -g -Werror -Wshadow
> >  CFLAGS+=-Werror-implicit-function-declaration
> >  CFLAGS+=-Wsign-compare
> > +.if ${COMPILER_VERSION:L} != "gcc3"
> > +CFLAGS+= -Wno-pointer-sign
> > +.endif
> >  CFLAGS+=-I${.CURDIR} -include namespace.h \
> > -I${LIBCSRCDIR}/arch/${MACHINE_CPU} -I${LIBCSRCDIR}/include
> >  CDIAGFLAGS=
> > Index: lib/libtls/Makefile
> > ===
> > RCS file: /cvs/src/lib/libtls/Makefile,v
> > retrieving revision 1.30
> > diff -u -p -r1.30 Makefile
> > --- lib/libtls/Makefile 25 Jan 2017 23:53:18 -  1.30
> > +++ lib/libtls/Makefile 29 Jan 2017 05:32:43 -
> > @@ -6,6 +6,9 @@ SUBDIR= man
> >  .endif
> >  
> >  CFLAGS+= -Wall -Werror -Wimplicit
> > +.if ${COMPILER_VERSION:L} != "gcc3"
> > +CFLAGS+= -Wno-pointer-sign
> > +.endif
> >  CFLAGS+= -DLIBRESSL_INTERNAL
> >  
> >  CLEANFILES= ${VERSION_SCRIPT}
> > Index: usr.sbin/ocspcheck/Makefile
> > ===
> > RCS file: /cvs/src/usr.sbin/ocspcheck/Makefile,v
> > retrieving revision 1.2
> > diff -u -p -r1.2 Makefile
> > --- usr.sbin/ocspcheck/Makefile 24 Jan 2017 09:25:27 -  1.2
> > +++ usr.sbin/ocspcheck/Makefile 29 Jan 2017 05:27:10 -
> > @@ -1,5 +1,7 @@
> >  #  $OpenBSD: Makefile,v 1.2 2017/01/24 09:25:27 deraadt Exp $
> >  
> > +.include 
> > +
> >  PROG=  ocspcheck
> >  MAN=   ocspcheck.8
> >  
> > @@ -15,6 +17,9 @@ CFLAGS+= -Wshadow
> >  CFLAGS+= -Wtrigraphs
> >  CFLAGS+= -Wuninitialized
> >  CFLAGS+= -Wunused
> > +.if ${COMPILER_VERSION:L} != "gcc3"
> > +CFLAGS+= -Wno-pointer-sign
> > +.endif
> >  
> >  CFLAGS+= -DLIBRESSL_INTERNAL
> >  
> > 
>

fix: cy(4) debug format strings

2017-02-01 Thread Jan Klemkow 
Hi,

the kernel does not compile with option CY_DEBUG because of several
format string mistakes.  This diff fixes them.  It compiles on i386
and amd64 without any errors.

bye,
Jan

Index: cy.c
===
RCS file: /cvs/openbsd/src/sys/dev/ic/cy.c,v
retrieving revision 1.35
diff -u -p -r1.35 cy.c
--- cy.c31 Oct 2014 09:45:27 -  1.35
+++ cy.c1 Feb 2017 10:09:05 -
@@ -116,7 +116,7 @@ cy_probe_common(bus_space_tag_t memt, bu
chip_offs -= (CY32_ADDR_FIX << bustype);
 
 #ifdef CY_DEBUG
-   printf("cy: probe chip %d offset 0x%lx ... ",
+   printf("cy: probe chip %d offset 0x%x ... ",
cy_chip, chip_offs);
 #endif
 
@@ -446,7 +446,7 @@ cyread(dev, uio, flag)
struct tty *tp = cy->cy_tty;
 
 #ifdef CY_DEBUG
-   printf("%s read port %d uio 0x%x flag 0x%x\n", sc->sc_dev.dv_xname,
+   printf("%s read port %d uio %p flag 0x%x\n", sc->sc_dev.dv_xname,
port, uio, flag);
 #endif
 
@@ -469,7 +469,7 @@ cywrite(dev, uio, flag)
struct tty *tp = cy->cy_tty;
 
 #ifdef CY_DEBUG
-   printf("%s write port %d uio 0x%x flag 0x%x\n", sc->sc_dev.dv_xname,
+   printf("%s write port %d uio %p flag 0x%x\n", sc->sc_dev.dv_xname,
port, uio, flag);
 #endif
 
@@ -511,7 +511,7 @@ cyioctl(dev, cmd, data, flag, p)
int error;
 
 #ifdef CY_DEBUG
-   printf("%s port %d ioctl cmd 0x%x data 0x%x flag 0x%x\n",
+   printf("%s port %d ioctl cmd 0x%lx data %p flag 0x%x\n",
sc->sc_dev.dv_xname, port, cmd, data, flag);
 #endif
 
@@ -596,7 +596,7 @@ cystart(tp)
int s;
 
 #ifdef CY_DEBUG
-   printf("%s port %d start, tty 0x%x\n", sc->sc_dev.dv_xname, port, tp);
+   printf("%s port %d start, tty %p\n", sc->sc_dev.dv_xname, port, tp);
 #endif
 
s = spltty();
@@ -633,7 +633,7 @@ cystop(tp, flag)
int s;
 
 #ifdef CY_DEBUG
-   printf("%s port %d stop tty 0x%x flag 0x%x\n", sc->sc_dev.dv_xname,
+   printf("%s port %d stop tty %p flag 0x%x\n", sc->sc_dev.dv_xname,
port, tp, flag);
 #endif
 
@@ -670,7 +670,7 @@ cyparam(tp, t)
int s, opt;
 
 #ifdef CY_DEBUG
-   printf("%s port %d param tty 0x%x termios 0x%x\n", sc->sc_dev.dv_xname,
+   printf("%s port %d param tty %p termios %p\n", sc->sc_dev.dv_xname,
port, tp, t);
printf("ispeed %d ospeed %d\n", t->c_ispeed, t->c_ospeed);
 #endif
@@ -1363,7 +1363,7 @@ cd1400_channel_cmd(cy, cmd)
u_int waitcnt = 5 * 8 * 1024; /* approx 5 ms */
 
 #ifdef CY_DEBUG
-   printf("c1400_channel_cmd cy 0x%x command 0x%x\n", cy, cmd);
+   printf("c1400_channel_cmd cy %p command 0x%x\n", cy, cmd);
 #endif
 
/* wait until cd1400 is ready to process a new command */