src/sbin, branch releng/12.1

Fix dhclient heap overflow.

2020-09-02T16:25:31Z

Approved by: so Security: FreeBSD-SA-20:26.dhclient Security: CVE-2020-7461

MFS r352872: MFC r351802:

2019-09-30T14:32:41Z

Correct overflow logic in fullpath(). Obtained from: OpenBSD Approved by: re (gjb)

MFS r352750:

2019-09-26T18:35:26Z

ping6: Use caph_rights_limit(3) for STDIN_FILENO Approved by: re (gjb)

MFC r351318, r351330, r351393, r351398, r351440, r351461, r351548, r352226, r352229

2019-09-16T00:56:33Z

r351318: ping: Add tests of the Internet checksum function Submitted by: Ján Sučan Sponsored by: Google LLC (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21340 r351330: ping: do reverse DNS lookup of the target address When printing replies, ping will now attempt a reverse DNS lookup of the target. That can be suppressed by using the "-n" option. Curiously, ping has always done reverse lookups in certain error paths, but never in the success path. Submitted by: Ján Sučan Sponsored by: Google LLC (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21351 r351393: ping: add a basic functional test Submitted by: Ján Sučan Sponsored by: Google, inc. (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21289 r351398: ping: By default, don't reverse lookup IP addresses ping's default is now not to attempt reverse DNS lookups. The -H flag will enable them. This change is not quite a reversion of r351330. That change made the happy path and error path do reverse lookups consistently; this change changes the default for both paths. Submitted by: Ján Sučan Discussed with: cem MFC-With: 351330 Sponsored by: Google LLC (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21364 r351440: ping: Fix alignment errors This fixes -Wcast-align errors when compiled with WARNS=6. Submitted by: Ján Sučan Sponsored by: Google LLC (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21327 r351461: ping: fix unaligned access to ancillary data Use CMSG_FIRSTHDR rather than assume that an array is correctly aligned. Fixes warnings on sparc64 and powerpcspe. Submitted by: Ján Sučan MFH: 2 weeks Sponsored by: Google LLC (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21406 r351548: ping: raise WARNS level to 6 Submitted by: Ján Sučan Sponsored by: Google LLC (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21405 r352226: ping: fix a string in an error message r352229: ping: Verify whether a datagram timestamp was actually received. ping(8) uses SO_TIMESTAMP, which attaches a timestamp to each IP datagram at the time it's received by the kernel. Except that occasionally it doesn't. Add a check to see whether such a timestamp was actually set before trying to read it. This fixes segfaults that can happen when the kernel doesn't attach a timestamp. The bug has always existed, but prior to r351461 it manifested as an implausible round-trip-time, not a segfault. Reported by: pho MFC-With: 351461

MFC 351064

2019-09-15T20:13:46Z

Don't let swapon trimming wipe the bsd label. Reviewed by: alc Approved by: markj (mentor, implicit)

MFC r352258: Remove Tagged Command Queuing feature reporting.

2019-09-15T17:58:39Z

I never saw those devices myself, FreeBSD never supported them, and it is officially obsolete since ACS-2 specification.

MFC r350994, r350998, r351030, r351033, r351171, r351223, r351226, r351424

2019-09-15T16:53:02Z

r350994: ping: fix data type of a variable for a packet sequence number Submitted by: Ján Sučan Sponsored by: Google, inc. (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21244 r350998: ping: use the monotonic clock to measure durations Submitted by: Ján Sučan Sponsored by: Google, inc. (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21245 r351030: ping: fix triptime calculation after r350998 That revision changed the internal clock to the monotonic, but neglected to change the datagram's timestamp source. Reported by: Oliver Hartmann, Michael Butler Reviewed by: Ján Sučan , allanjude MFC-With: r350998 Differential Revision: https://reviews.freebsd.org/D21258 r351033: ping: Make in_cksum() operate on u_char buffer This fixes -Wcast-align errors for in_cksum() calls when compiled with WARNS=6. Submitted by: Ján Sučan Sponsored by: Google, inc. (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21261 r351171: ping: Move in_cksum() to a separate source file This is a preparation step for adding ATF tests of in_cksum(), which has been modified to operate on unaligned data. ping.o cannot be linked to the test executable because both of them contain 'main' symbol. Submitted by: Ján Sučan Sponsored by: Google, inc. (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21288 r351223: ping: fix -Wformat-truncating warning with GCC Increase buffer size for the string representation of n_time ICMP timestamp is a 32-bit number. In pr_ntime(), number of minutes and seconds is always 2 characters wide. Max. number of hours is 4 characters wide. The buffer size should be at least: 4 + 2 + 2 + 1 (':') + 1 (':') + 1 ('\0') = 11 Submitted by: Ján Sučan Sponsored by: Google, inc. (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21325 r351226: Fix uninitialized variable warnings when MK_CASPER=no Submitted by: Ján Sučan Sponsored by: Google, inc. (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21322 r351424: ping: fix include guard symbol name to reflect the header file name Submitted by: Ján Sučan MFC-With: 351171 Sponsored by: Google LLC (Google Summer of Code 2019) Differential Revision: https://reviews.freebsd.org/D21374

MFC the new fusefs driver

2019-09-15T04:14:31Z

MFC r350665, r350990, r350992, r351039, r351042, r351061, r351066, r351113, r351560, r351961, r351963, r352021, r352025, r352230 r350665: fusefs: merge from projects/fuse2 This commit imports the new fusefs driver. It raises the protocol level from 7.8 to 7.23, fixes many bugs, adds a test suite for the driver, and adds many new features. New features include: * Optional kernel-side permissions checks (-o default_permissions) * Implement VOP_MKNOD, VOP_BMAP, and VOP_ADVLOCK * Allow interrupting FUSE operations * Support named pipes and unix-domain sockets in fusefs file systems * Forward UTIME_NOW during utimensat(2) to the daemon * kqueue support for /dev/fuse * Allow updating mounts with "mount -u" * Allow exporting fusefs file systems over NFS * Server-initiated invalidation of the name cache or data cache * Respect RLIMIT_FSIZE * Try to support servers as old as protocol 7.4 Performance enhancements include: * Implement FUSE's FOPEN_KEEP_CACHE and FUSE_ASYNC_READ flags * Cache file attributes * Cache lookup entries, both positive and negative * Server-selectable cache modes: writethrough, writeback, or uncached * Write clustering * Readahead * Use counter(9) for statistical reporting PR: 199934 216391 233783 234581 235773 235774 235775 PR: 236226 236231 236236 236291 236329 236381 236405 PR: 236327 236466 236472 236473 236474 236530 236557 PR: 236560 236844 237052 237181 237588 238565 Reviewed by: bcr (man pages) Reviewed by: cem, ngie, rpokala, glebius, kib, bde, emaste (post-commit review on project branch) Relnotes: yes Sponsored by: The FreeBSD Foundation Pull Request: https://reviews.freebsd.org/D21110 r350990: fusefs: add SVN Keywords to the test files Reported by: SVN pre-commit hooks MFC-With: r350665 Sponsored by: The FreeBSD Foundation r350992: fusefs: skip some tests when unsafe aio is disabled MFC-With: r350665 Sponsored by: The FreeBSD Foundation r351039: fusefs: fix intermittency in the default_permissions.Unlink.ok test The test needs to expect a FUSE_FORGET operation. Most of the time the test would pass anyway, because by chance FUSE_FORGET would arrive after the unmount. MFC-With: 350665 Sponsored by: The FreeBSD Foundation r351042: fusefs: Fix the size of fuse_getattr_in In FUSE protocol 7.9, the size of the FUSE_GETATTR request has increased. However, the fusefs driver is currently not sending the additional fields. In our implementation, the additional fields are always zero, so I there haven't been any test failures until now. But fusefs-lkl requires the request's length to be correct. Fix this bug, and also enhance the test suite to catch similar bugs. PR: 239830 MFC-With: 350665 Sponsored by: The FreeBSD Foundation r351061: fusefs: fix the 32-bit build after 351042 Reported by: jhb MFC-With: 351042 Sponsored by: The FreeBSD Foundation r351066: fusefs: fix conditional from r351061 The entirety of r351061 was a copy/paste error. I'm sorry I've been comitting so hastily. Reported by: rpokala Reviewed by: rpokala MFC-With: 351061 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D21265 r351113: fusefs: don't send the namespace during listextattr The FUSE_LISTXATTR operation always returns the full list of a file's extended attributes, in all namespaces. There's no way to filter the list server-side. However, currently FreeBSD's fusefs driver sends a namespace string with the FUSE_LISTXATTR request. That behavior was probably copied from fuse_vnop_getextattr, which has an attribute name argument. It's been there ever since extended attribute support was added in r324620. This commit removes it. Reviewed by: cem Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D21280 r351560: fusefs: Fix some bugs regarding the size of the LISTXATTR list * A small error in r338152 let to the returned size always being exactly eight bytes too large. * The FUSE_LISTXATTR operation works like Linux's listxattr(2): if the caller does not provide enough space, then the server should return ERANGE rather than return a truncated list. That's true even though in FUSE's case the kernel doesn't provide space to the client at all; it simply requests a maximum size for the list. We previously weren't handling the case where the server returns ERANGE even though the kernel requested as much size as the server had told us it needs; that can happen due to a race. * We also need to ensure that a pathological server that always returns ERANGE no matter what size we request in FUSE_LISTXATTR won't cause an infinite loop in the kernel. As of this commit, it will instead cause an infinite loop that exits and enters the kernel on each iteration, allowing signals to be processed. Reviewed by: cem Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D21287 r351961: Coverity fixes in fusefs(5) CID 1404532 fixes a signed vs unsigned comparison error in fuse_vnop_bmap. It could potentially have resulted in VOP_BMAP reporting too many consecutive blocks. CID 1404364 is much worse. It was an array access by an untrusted, user-provided variable. It could potentially have resulted in a malicious file system crashing the kernel or worse. Reported by: Coverity Reviewed by: emaste Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D21466 r351963: fusefs: coverity cleanup in the tests Address the following defects reported by Coverity: * Structurally dead code (CID 1404366): set m_quit before FAIL, not after * Unchecked return value of sysctlbyname (CID 1404321) * Unchecked return value of stat(2) (CID 1404471) * Unchecked return value of open(2) (CID 1404402, 1404529) * Unchecked return value of dup(2) (CID 1404478) * Buffer overflows. These are all false positives caused by the fact that Coverity thinks I'm using a buffer to store strings, when in fact I'm really just using it to store a byte array that happens to be initialized with a string. I'm changing the type from char to uint8_t in the hopes that it will placate Coverity. (CID 1404338, 1404350, 1404367, 1404376, 1404379, 1404381, 1404388, 1404403, 1404425, 1404433, 1404434, 1404474, 1404480, 1404484, 1404503, 1404505) * False positive file descriptor leak. I'm going to try to fix this with Coverity modeling, but I'll also change an EXPECT to ASSERT so we don't perform meaningless assertions after the failure. (CID 1404320, 1404324, 1404440, 1404445). * Unannotated file descriptor leak. This will be followed up by a Coverity modeling change. (CID 1404326, 1404334, 1404336, 1404357, 1404361, 1404372, 1404391, 1404395, 1404409, 1404430, 1404448, 1404451, 1404455, 1404457, 1404458, 1404460) * Uninitialized variables in C++ constructors (CID 1404327, 1404346). In the case of m_maxphys, this actually led to part of the FUSE_INIT's response being set to stack garbage during the WriteCluster::clustering test. * Uninitialized sun_len field in struct sockaddr_un (CID 1404330, 1404371, 1404429). Reported by: Coverity Reviewed by: emaste Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D21457 r352021: fusefs: suppress some Coverity resource leak CIDs in the tests The fusefs tests deliberately leak file descriptors. To do otherwise would add extra complications to the tests' mock FUSE server. This annotation should hopefully convince Coverity to shut up about the leaks. Reviewed by: uqs Sponsored by: The FreeBSD Foundation r352025: mount_fusefs: fix a segfault on memory allocation failure Reported by: Coverity Coverity CID: 1354188 Sponsored by: The FreeBSD Foundation r352230: fusefs: Fix iosize for FUSE_WRITE in 7.8 compat mode When communicating with a FUSE server that implements version 7.8 (or older) of the FUSE protocol, the FUSE_WRITE request structure is 16 bytes shorter than normal. The protocol version check wasn't applied universally, leading to an extra 16 bytes being sent to such servers. The extra bytes were allocated and bzero()d, so there was no information disclosure. Reviewed by: emaste MFC-With: r350665 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D21557

MFC r352211: bectl(8): Add a "check" command

2019-09-15T02:46:40Z

This command simply returns 0 at the moment and explicitly takes no arguments. This should be used by utilities wanting to see if bectl can operate on the system they're running, or with a specific root (`bectl -r`). It may grow more checks than "will libbe successfully init" in the future, but for now this is enough as that checks for the dataset mounted at "/" and that it looks capable of being a BE root (e.g. it's not a top-level dataset) bectl commands can now specify if they want to be silent, and this will turn off libbe_print_on_error so they can control the output as needed. This is already used in `bectl check`, and may be turned on in the future for some other commands where libbe errors are better suppressed as the failure mode may be obvious.

MFC r351813, r352092: bectl(8) list sorting

2019-09-15T02:36:50Z

MFC r351813: bectl(8): implement sorting for 'bectl list' output Allow 'bectl list' to sort output by a given property name. The property name is passed in using a command-line flag, '-c' for ascending order and '-C' for descending order. The properties allowed to sort by are: - name (the default output, even if '-c' or '-C' are not used) - creation - origin - used - usedds - usedsnap - usedrefreserv The default output for 'bectl list' is now ascending alphabetical order of BE name. To sort by creation time from earliest to latest, the command would be 'bectl list -c creation' MFC r352092: bectl(8): initialize reverse earlier This turns into a warning in GCC 4.2 that 'reverse' may be used uninitialized in this function. While I don't immediately see where it's deciding this from (there's only two paths that make column != NULL, and they both set reverse), initializing reverse earlier is good for clarity.