FreeBSD source tree https://cgit-dev.freebsd.org/src-test/atom?h=main 2020-04-23T18:04:52Z 2020-04-23T18:04:52Z Conrad Meyer cem@FreeBSD.org 2020-04-23T18:04:52Z urn:sha1:7575e5c472125406c64f7c190f048fac2420d737 dumpon(8) has not accepted 1024-bit RSA keys since prior to r339784 (2018-10). The manual page language was not updated at that time (oops). The minimum accepted is 2048 bits, which is also a good default choice. Sponsored by: Dell EMC Isilon 2020-04-23T17:56:48Z Conrad Meyer cem@FreeBSD.org 2020-04-23T17:56:48Z urn:sha1:4647ce4fb6ed8e2ac65f663b8513b4a32908810a Preload OpenSSL ERR string data so that the formatted error messages are vaguely meaningful. Add OpenSSL error information to the RSA_public_encrypt() operation failure case in one-time key generation. For obsolescent OpenSSL versions (*cough* FIPS *cough*), pre-seed the PRNG before entering Cap mode, as old versions of OpenSSL are unaware of kernel RNG interfaces aside from /dev/random (such as the long-supported kern.arnd, or the slightly more recent getentropy(3) or getrandom(2)). (RSA_public_encrypt() wants a seeded PRNG to randomize the "PS" portion of PKCS 1.5 padding or the "MGF" pseudo-random function in OAEP padding.) Switch dumpon to encrypt the one-time key with OAEP padding (recommended since 1998; RFC2437) rather than the obsolescent PKCS 1.5 padding (1993; RFC2313). Switch decryptcore to attempt OAEP decryption first, and try PKCS 1.5 decryption on failure. This is intended only for transition convenience, and we should obsolete support for non-OAEP padding in a release or two. Reviewed by: markj MFC After: 2 weeks Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D24534 2020-03-03T22:14:23Z Eric van Gyzen vangyzen@FreeBSD.org 2020-03-03T22:14:23Z urn:sha1:7bef70737b71b2c5e34a55e819b0589a62a4dceb As with gzip, let the dump device be smaller than physical memory when using zstd and full dumps. Also print the error message if the size check fails, even if -v is not specified. Failing silently is not friendly. Reviewed by: cem markj MFC after: 2 weeks Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D23923 2019-12-11T17:37:53Z Simon J. Gerraty sjg@FreeBSD.org 2019-12-11T17:37:53Z urn:sha1:2c9a9dfc187d171de6b92654d71b977f067ed641 Update a bunch of Makefile.depend files as a result of adding Makefile.depend.options files Reviewed by: bdrewery MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D22494 2019-12-11T17:37:37Z Simon J. Gerraty sjg@FreeBSD.org 2019-12-11T17:37:37Z urn:sha1:5ab1c5846ff41be24b1f6beb0317bf8258cd4409 Leaf directories that have dependencies impacted by options need a Makefile.depend.options file to avoid churn in Makefile.depend DIRDEPS for cases such as OPENSSL, TCP_WRAPPERS etc can be set in local.dirdeps-options.mk which can add to those set in Makefile.depend.options See share/mk/dirdeps-options.mk Reviewed by: bdrewery MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D22469 2019-05-23T20:12:24Z Conrad Meyer cem@FreeBSD.org 2019-05-23T20:12:24Z urn:sha1:8298529226ff732083fd0392a78855997cbd5f14 Add Chacha20 mode to Encrypted Kernel Crash Dumps. Chacha20 does not require messages to be multiples of block size, so it is valid to use the cipher on non-block-sized messages without the explicit padding AES-CBC would require. Therefore, allow use with simultaneous dump compression. (Continue to disallow use of AES-CBC EKCD with compression.) dumpon(8) gains a -C cipher flag to select between chacha and aes-cbc. It defaults to chacha if no -C option is provided. The man page documents this behavior. Relnotes: sure Sponsored by: Dell EMC Isilon 2019-05-22T03:52:39Z Mark Johnston markj@FreeBSD.org 2019-05-22T03:52:39Z urn:sha1:48faa24b09a46f343a1ba55ac9ba4961bb7d6e40 Event: Waterloo Hackathon 2019 2019-05-22T03:49:38Z Mark Johnston markj@FreeBSD.org 2019-05-22T03:49:38Z urn:sha1:73cc16949ae35fe24b67918b0630f2fd0d4c830c Reviewed by: cem MFC after: 1 week Event: Waterloo Hackathon 2019 Differential Revision: https://reviews.freebsd.org/D20345 2019-05-06T18:24:07Z Conrad Meyer cem@FreeBSD.org 2019-05-06T18:24:07Z urn:sha1:6b6e2954dd65ec08e73efb0f2e8bfb2278a07dc6 Allow users to specify multiple dump configurations in a prioritized list. This enables fallback to secondary device(s) if primary dump fails. E.g., one might configure a preference for netdump, but fallback to disk dump as a second choice if netdump is unavailable. This change does not list-ify netdump configuration, which is tracked separately from ordinary disk dumps internally; only one netdump configuration can be made at a time, for now. It also does not implement IPv6 netdump. savecore(8) is already capable of scanning and iterating multiple devices from /etc/fstab or passed on the command line. This change doesn't update the rc or loader variables 'dumpdev' in any way; it can still be set to configure a single dump device, and rc.d/savecore still uses it as a single device. Only dumpon(8) is updated to be able to configure the more complicated configurations for now. As part of revving the ABI, unify netdump and disk dump configuration ioctl / structure, and leave room for ipv6 netdump as a future possibility. Backwards-compatibility ioctls are added to smooth ABI transition, especially for developers who may not keep kernel and userspace perfectly synced. Reviewed by: markj, scottl (earlier version) Relnotes: maybe Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D19996 2018-11-20T18:10:56Z Mark Johnston markj@FreeBSD.org 2018-11-20T18:10:56Z urn:sha1:79dd8f690a418f9b25cfedbbb075640347e8fbd7 CID: 1396919 MFC with: r340547