14 files changed, 168 insertions, 65 deletions

diff --git a/lib/Makefile b/lib/Makefile
index 4332aa13a70c..58c3753ec8e5 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -70,8 +70,6 @@ SUBDIR=	${SUBDIR_BOOTSTRAP} \
 	libpathconv \
 	libpcap \
 	libpjdlog \
-	libpmc \
-	libpmcstat \
 	${_libproc} \
 	libprocstat \
 	libregex \
@@ -200,6 +198,7 @@ _libdl=		libdl
 .endif
 
 SUBDIR.${MK_OPENSSL}+=	libmp
+SUBDIR.${MK_PMC}+=	libpmc libpmcstat
 SUBDIR.${MK_RADIUS_SUPPORT}+=	libradius
 SUBDIR.${MK_SENDMAIL}+=	libmilter libsm libsmdb libsmutil
 SUBDIR.${MK_TELNET}+=	libtelnet
diff --git a/lib/libc/locale/collate.c b/lib/libc/locale/collate.c
index 5017433a9d98..15ce3b2f52e8 100644
--- a/lib/libc/locale/collate.c
+++ b/lib/libc/locale/collate.c
@@ -84,7 +84,8 @@ destruct_collate(void *t)
 void *
 __collate_load(const char *encoding, __unused locale_t unused)
 {
-	if (strcmp(encoding, "C") == 0 || strcmp(encoding, "POSIX") == 0) {
+	if (strcmp(encoding, "C") == 0 || strcmp(encoding, "POSIX") == 0 ||
+	    strncmp(encoding, "C.", 2) == 0) {
 		return &__xlocale_C_collate;
 	}
 	struct xlocale_collate *table = calloc(sizeof(struct xlocale_collate), 1);
@@ -122,7 +123,8 @@ __collate_load_tables_l(const char *encoding, struct xlocale_collate *table)
 	table->__collate_load_error = 1;
 
 	/* 'encoding' must be already checked. */
-	if (strcmp(encoding, "C") == 0 || strcmp(encoding, "POSIX") == 0) {
+	if (strcmp(encoding, "C") == 0 || strcmp(encoding, "POSIX") == 0 ||
+	    strncmp(encoding, "C.", 2) == 0) {
 		return (_LDP_CACHE);
 	}
 
diff --git a/lib/libc/locale/ldpart.c b/lib/libc/locale/ldpart.c
index ed794337e115..889291cf3168 100644
--- a/lib/libc/locale/ldpart.c
+++ b/lib/libc/locale/ldpart.c
@@ -63,7 +63,8 @@ __part_load_locale(const char *name,
 	size_t		namesize, bufsize;
 
 	/* 'name' must be already checked. */
-	if (strcmp(name, "C") == 0 || strcmp(name, "POSIX") == 0) {
+	if (strcmp(name, "C") == 0 || strcmp(name, "POSIX") == 0 ||
+	    strncmp(name, "C.", 2) == 0) {
 		*using_locale = 0;
 		return (_LDP_CACHE);
 	}
diff --git a/lib/libcapsicum/Makefile b/lib/libcapsicum/Makefile
index 85a0a56c2ba2..1adf57666f7e 100644
--- a/lib/libcapsicum/Makefile
+++ b/lib/libcapsicum/Makefile
@@ -8,6 +8,7 @@ MAN+=	capsicum_helpers.3
 
 MLINKS+=capsicum_helpers.3 caph_enter.3
 MLINKS+=capsicum_helpers.3 caph_enter_casper.3
+MLINKS+=capsicum_helpers.3 caph_rights_limit.3
 MLINKS+=capsicum_helpers.3 caph_limit_stream.3
 MLINKS+=capsicum_helpers.3 caph_limit_stdin.3
 MLINKS+=capsicum_helpers.3 caph_limit_stderr.3
diff --git a/lib/libcapsicum/capsicum_helpers.3 b/lib/libcapsicum/capsicum_helpers.3
index c22a201d8f43..8d4b875bf94c 100644
--- a/lib/libcapsicum/capsicum_helpers.3
+++ b/lib/libcapsicum/capsicum_helpers.3
@@ -24,7 +24,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd July 18, 2018
+.Dd November 4, 2018
 .Dt CAPSICUM_HELPERS 3
 .Os
 .Sh NAME
@@ -34,7 +34,12 @@
 .Nm caph_limit_stdout ,
 .Nm caph_limit_stdio ,
 .Nm caph_cache_tzdata ,
-.Nm caph_cache_catpages
+.Nm caph_cache_catpages ,
+.Nm caph_enter ,
+.Nm caph_enter_casper ,
+.Nm caph_rights_limit ,
+.Nm caph_ioctls_limit ,
+.Nm caph_fcntls_limit
 .Nd "set of the capsicum helpers, part of the libcapsicum"
 .Sh LIBRARY
 .Lb libcapsicum
@@ -45,7 +50,11 @@
 .Ft int
 .Fn caph_enter_casper "void"
 .Ft int
-.Fn caph_limit_stream "int fd" "int flags"
+.Fn caph_rights_limit "inf fd" "const cap_righst_t *rights"
+.Ft int
+.Fn caph_ioctls_limit "inf fd" "const unsigned long *cmds" "size_t ncmds"
+.Ft int
+.Fn caph_fcntls_limit "inf fd" "uint32_t fcntlrights"
 .Ft int
 .Fn caph_limit_stdin "void"
 .Ft int
@@ -60,9 +69,17 @@
 .Fn caph_cache_catpages "void"
 .Sh DESCRIPTION
 The
-.Nm caph_enter
-is equivalent to the
-.Xr cap_enter 2
+.Nm caph_enter ,
+.Nm caph_rights_limit ,
+.Nm caph_ioctls_limit
+and
+.Nm caph_fcntls_limit
+are respectively equivalent to
+.Xr cap_enter 2 ,
+.Xr cap_rights_limit 2 ,
+.Xr cap_ioctls_limit 2
+and
+.Xr cap_fcntls_limit 2 ,
 it returns success when the kernel is built without support of the capability
 mode.
 .Pp
@@ -125,4 +142,5 @@ among others.
 .Ed
 .Sh SEE ALSO
 .Xr cap_enter 2 ,
+.Xr cap_rights_limit 2 ,
 .Xr rights 4
diff --git a/lib/libcapsicum/capsicum_helpers.h b/lib/libcapsicum/capsicum_helpers.h
index 60c894f35a6e..d1c46e74f388 100644
--- a/lib/libcapsicum/capsicum_helpers.h
+++ b/lib/libcapsicum/capsicum_helpers.h
@@ -136,6 +136,35 @@ caph_enter(void)
 	return (0);
 }
 
+static __inline int
+caph_rights_limit(int fd, const cap_rights_t *rights)
+{
+
+	if (cap_rights_limit(fd, rights) < 0 && errno != ENOSYS)
+		return (-1);
+
+	return (0);
+}
+
+static __inline int
+caph_ioctls_limit(int fd, const unsigned long *cmds, size_t ncmds)
+{
+
+	if (cap_ioctls_limit(fd, cmds, ncmds) < 0 && errno != ENOSYS)
+		return (-1);
+
+	return (0);
+}
+
+static __inline int
+caph_fcntls_limit(int fd, uint32_t fcntlrights)
+{
+
+	if (cap_fcntls_limit(fd, fcntlrights) < 0 && errno != ENOSYS)
+		return (-1);
+
+	return (0);
+}
 
 static __inline int
 caph_enter_casper(void)
diff --git a/lib/libcasper/libcasper/libcasper.3 b/lib/libcasper/libcasper/libcasper.3
index 95a6e21014f4..d1804b8ab25a 100644
--- a/lib/libcasper/libcasper/libcasper.3
+++ b/lib/libcasper/libcasper/libcasper.3
@@ -28,7 +28,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd March 6, 2018
+.Dd November 5, 2018
 .Dt LIBCASPER 3
 .Os
 .Sh NAME
@@ -161,9 +161,11 @@ it means there are no limits set.
 The
 .Fn cap_limit_set
 function sets limits for the given capability.
-The limits are provided as
+The limits are provided as a
 .Xr nvlist 9 .
 The exact format depends on the service the capability represents.
+.Fn cap_limit_set
+frees the limits regardless of whether the operation succeeds or fails.
 .Pp
 The
 .Fn cap_send_nvlist
diff --git a/lib/libcasper/services/cap_dns/Makefile b/lib/libcasper/services/cap_dns/Makefile
index eebe1d000c9c..cec3bb180a6a 100644
--- a/lib/libcasper/services/cap_dns/Makefile
+++ b/lib/libcasper/services/cap_dns/Makefile
@@ -30,6 +30,7 @@ MLINKS+=cap_dns.3 libcap_dns.3
 MLINKS+=cap_dns.3 cap_gethostbyname.3
 MLINKS+=cap_dns.3 cap_gethostbyname2.3
 MLINKS+=cap_dns.3 cap_gethostbyaddr.3
+MLINKS+=cap_dns.3 cap_getaddrinfo.3
 MLINKS+=cap_dns.3 cap_getnameinfo.3
 MLINKS+=cap_dns.3 cap_dns_type_limit.3
 MLINKS+=cap_dns.3 cap_dns_family_limit.3
diff --git a/lib/libcasper/services/cap_dns/cap_dns.3 b/lib/libcasper/services/cap_dns/cap_dns.3
index da0e511cdca4..bc38e6bf3dd8 100644
--- a/lib/libcasper/services/cap_dns/cap_dns.3
+++ b/lib/libcasper/services/cap_dns/cap_dns.3
@@ -24,14 +24,15 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd March 18, 2018
+.Dd November 4, 2018
 .Dt CAP_DNS 3
 .Os
 .Sh NAME
+.Nm cap_getaddrinfo ,
+.Nm cap_getnameinfo ,
 .Nm cap_gethostbyname ,
 .Nm cap_gethostbyname2 ,
 .Nm cap_gethostbyaddr ,
-.Nm cap_getnameinfo ,
 .Nm cap_dns_type_limit ,
 .Nm cap_dns_family_limit
 .Nd "library for getting network host entry in capability mode"
@@ -41,6 +42,10 @@
 .In sys/nv.h
 .In libcasper.h
 .In casper/cap_dns.h
+.Ft int
+.Fn cap_getaddrinfo "cap_channel_t *chan" "const char *hostname" "const char *servname" "const struct addrinfo *hints" "struct addrinfo **res"
+.Ft int
+.Fn cap_getnameinfo "cap_channel_t *chan" "const struct sockaddr *sa" "socklen_t salen" "char *host" "size_t hostlen" "char *serv" "size_t servlen" "int flags"
 .Ft "struct hostent *"
 .Fn cap_gethostbyname "const cap_channel_t *chan" "const char *name"
 .Ft "struct hostent *"
@@ -48,12 +53,23 @@
 .Ft "struct hostent *"
 .Fn cap_gethostbyaddr "const cap_channel_t *chan" "const void *addr" "socklen_t len" "int af"
 .Ft "int"
-.Fn cap_getnameinfo "const cap_channel_t *chan" "const void *name" "int namelen"
-.Ft "int"
 .Fn cap_dns_type_limit "cap_channel_t *chan" "const char * const *types" "size_t ntypes"
 .Ft "int"
 .Fn cap_dns_family_limit "const cap_channel_t *chan" "const int *families" "size_t nfamilies"
 .Sh DESCRIPTION
+.Bf -symbolic
+The
+.Fn cap_getaddrinfo ,
+and
+.Fn cap_getnameinfo ,
+functions are preferred over the
+.Fn cap_gethostbyname ,
+.Fn cap_gethostbyname2 ,
+and
+.Fn cap_gethostbyaddr
+functions.
+.Ef
+.Pp
 The functions
 .Fn cap_gethostbyname ,
 .Fn cap_gethostbyname2 ,
@@ -118,19 +134,21 @@ or
 .Dv NAME .
 The
 .Dv ADDR
-means that functions
-.Fn cap_gethostbyname ,
-.Fn cap_gethostbyname2
+means that reverse DNS lookups are allowed with
+.Fn cap_getnameinfo
 and
 .Fn cap_gethostbyaddr
-are allowed.
+functions.
 In case when
 .Va type
 is set to
 .Dv NAME
-the
-.Fn cap_getnameinfo
-function is allowed.
+the name resolution is allowed with
+.Fn cap_getaddrinfo ,
+.Fn cap_gethostbyname ,
+and
+.Fn cap_gethostbyname2
+functions.
 .It family ( NV_TYPE_NUMBER )
 The
 .Va family
@@ -144,19 +162,22 @@ capability to create the
 casper service and uses it to resolve an IP address.
 .Bd -literal
 cap_channel_t *capcas, *capdns;
-const char *typelimit = "ADDR";
-int familylimit;
+int familylimit, error;
 const char *ipstr = "127.0.0.1";
-struct in_addr ip;
-struct hostent *hp;
+const char *typelimit = "ADDR";
+char hname[NI_MAXHOST];
+struct addrinfo hints, *res;
 
 /* Open capability to Casper. */
 capcas = cap_init();
 if (capcas == NULL)
 	err(1, "Unable to contact Casper");
 
+/* Cache NLA for gai_strerror. */
+caph_cache_catpages();
+
 /* Enter capability mode sandbox. */
-if (cap_enter() < 0 && errno != ENOSYS)
+if (caph_enter() < 0)
 	err(1, "Unable to enter capability mode");
 
 /* Use Casper capability to create capability to the system.dns service. */
@@ -167,28 +188,34 @@ if (capdns == NULL)
 /* Close Casper capability, we don't need it anymore. */
 cap_close(capcas);
 
-/* Limit system.dns to reverse DNS lookups. */
-if (cap_dns_type_limit(capdns, &typelimit, 1) < 0)
-	err(1, "Unable to limit access to the system.dns service");
-
 /* Limit system.dns to reserve IPv4 addresses */
 familylimit = AF_INET;
 if (cap_dns_family_limit(capdns, &familylimit, 1) < 0)
 	err(1, "Unable to limit access to the system.dns service");
 
-/* Convert IP address in C-string to in_addr. */
-if (!inet_aton(ipstr, &ip))
-	errx(1, "Unable to parse IP address %s.", ipstr);
+/* Convert IP address in C-string to struct sockaddr. */
+memset(&hints, 0, sizeof(hints));
+hints.ai_family = familylimit;
+hints.ai_flags = AI_NUMERICHOST;
+error = cap_getaddrinfo(capdns, ipstr, NULL, &hints, &res);
+if (error != 0)
+       errx(1, "cap_getaddrinfo(): %s: %s", ipstr, gai_strerror(error));
+
+/* Limit system.dns to reverse DNS lookups. */
+if (cap_dns_type_limit(capdns, &typelimit, 1) < 0)
+	err(1, "Unable to limit access to the system.dns service");
 
 /* Find hostname for the given IP address. */
-hp = cap_gethostbyaddr(capdns, (const void *)&ip, sizeof(ip), AF_INET);
-if (hp == NULL)
-	errx(1, "No name associated with %s.", ipstr);
+error = cap_getnameinfo(capdns, res->ai_addr, res->ai_addrlen, hname, sizeof(hname),
+    NULL, 0, 0);
+if (error != 0)
+	errx(1, "cap_getnameinfo(): %s: %s", ipstr, gai_strerror(error));
 
-printf("Name associated with %s is %s.\\n", ipstr, hp->h_name);
+printf("Name associated with %s is %s.\\n", ipstr, hname);
 .Ed
 .Sh SEE ALSO
 .Xr cap_enter 2 ,
+.Xr caph_enter 3 ,
 .Xr err 3 ,
 .Xr gethostbyaddr 3 ,
 .Xr gethostbyname 3 ,
diff --git a/lib/libcasper/services/cap_dns/cap_dns.c b/lib/libcasper/services/cap_dns/cap_dns.c
index 6f8de34713d8..319abb35f4ee 100644
--- a/lib/libcasper/services/cap_dns/cap_dns.c
+++ b/lib/libcasper/services/cap_dns/cap_dns.c
@@ -524,7 +524,7 @@ dns_getnameinfo(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout)
 	socklen_t salen;
 	int error, flags;
 
-	if (!dns_allowed_type(limits, "NAME"))
+	if (!dns_allowed_type(limits, "ADDR"))
 		return (NO_RECOVERY);
 
 	error = 0;
@@ -617,7 +617,7 @@ dns_getaddrinfo(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout)
 	unsigned int ii;
 	int error, family, n;
 
-	if (!dns_allowed_type(limits, "ADDR"))
+	if (!dns_allowed_type(limits, "NAME"))
 		return (NO_RECOVERY);
 
 	hostname = dnvlist_get_string(nvlin, "hostname", NULL);
diff --git a/lib/libcasper/services/cap_dns/tests/dns_test.c b/lib/libcasper/services/cap_dns/tests/dns_test.c
index ce99b54f2942..f95209b3320e 100644
--- a/lib/libcasper/services/cap_dns/tests/dns_test.c
+++ b/lib/libcasper/services/cap_dns/tests/dns_test.c
@@ -393,7 +393,8 @@ main(void)
 	CHECK(cap_dns_family_limit(capdns, families, 2) == 0);
 
 	CHECK(runtest(capdns) ==
-	    (GETHOSTBYNAME | GETHOSTBYNAME2_AF_INET | GETHOSTBYNAME2_AF_INET6));
+	    (GETHOSTBYNAME | GETHOSTBYNAME2_AF_INET | GETHOSTBYNAME2_AF_INET6 |
+	    GETADDRINFO_AF_INET | GETADDRINFO_AF_INET6));
 
 	cap_close(capdns);
 
@@ -419,9 +420,7 @@ main(void)
 	CHECK(cap_dns_family_limit(capdns, families, 2) == 0);
 
 	CHECK(runtest(capdns) ==
-	    (GETHOSTBYADDR_AF_INET | GETHOSTBYADDR_AF_INET6 |
-	    GETADDRINFO_AF_INET | GETADDRINFO_AF_INET6));
-
+	    (GETHOSTBYADDR_AF_INET | GETHOSTBYADDR_AF_INET6));
 	cap_close(capdns);
 
 	/*
@@ -512,7 +511,8 @@ main(void)
 	CHECK(cap_dns_family_limit(capdns, families, 1) == -1 &&
 	    errno == ENOTCAPABLE);
 
-	CHECK(runtest(capdns) == (GETHOSTBYNAME | GETHOSTBYNAME2_AF_INET));
+	CHECK(runtest(capdns) ==
+	    (GETHOSTBYNAME | GETHOSTBYNAME2_AF_INET | GETADDRINFO_AF_INET));
 
 	cap_close(capdns);
 
@@ -548,7 +548,8 @@ main(void)
 	CHECK(cap_dns_family_limit(capdns, families, 1) == -1 &&
 	    errno == ENOTCAPABLE);
 
-	CHECK(runtest(capdns) == GETHOSTBYNAME2_AF_INET6);
+	CHECK(runtest(capdns) ==
+	    (GETHOSTBYNAME2_AF_INET6 | GETADDRINFO_AF_INET6));
 
 	cap_close(capdns);
 
@@ -584,7 +585,7 @@ main(void)
 	CHECK(cap_dns_family_limit(capdns, families, 1) == -1 &&
 	    errno == ENOTCAPABLE);
 
-	CHECK(runtest(capdns) == (GETHOSTBYADDR_AF_INET | GETADDRINFO_AF_INET));
+	CHECK(runtest(capdns) == GETHOSTBYADDR_AF_INET);
 
 	cap_close(capdns);
 
@@ -620,8 +621,7 @@ main(void)
 	CHECK(cap_dns_family_limit(capdns, families, 1) == -1 &&
 	    errno == ENOTCAPABLE);
 
-	CHECK(runtest(capdns) == (GETHOSTBYADDR_AF_INET6 |
-	    GETADDRINFO_AF_INET6));
+	CHECK(runtest(capdns) == GETHOSTBYADDR_AF_INET6);
 
 	cap_close(capdns);
 
@@ -657,7 +657,8 @@ main(void)
 	    errno == ENOTCAPABLE);
 
 	/* Do the limits still hold? */
-	CHECK(runtest(capdns) == (GETHOSTBYNAME | GETHOSTBYNAME2_AF_INET));
+	CHECK(runtest(capdns) == (GETHOSTBYNAME | GETHOSTBYNAME2_AF_INET |
+	    GETADDRINFO_AF_INET));
 
 	cap_close(capdns);
 
@@ -691,8 +692,7 @@ main(void)
 	    errno == ENOTCAPABLE);
 
 	/* Do the limits still hold? */
-	CHECK(runtest(capdns) == (GETHOSTBYADDR_AF_INET6 |
-	    GETADDRINFO_AF_INET6));
+	CHECK(runtest(capdns) == GETHOSTBYADDR_AF_INET6);
 
 	cap_close(capdns);
 
diff --git a/lib/libcasper/services/cap_grp/cap_grp.c b/lib/libcasper/services/cap_grp/cap_grp.c
index 4347f4fbc942..7134b0cd8432 100644
--- a/lib/libcasper/services/cap_grp/cap_grp.c
+++ b/lib/libcasper/services/cap_grp/cap_grp.c
@@ -157,7 +157,7 @@ group_unpack(const nvlist_t *nvl, struct group *grp, char *buffer,
 	if (!nvlist_exists_string(nvl, "gr_name"))
 		return (EINVAL);
 
-	memset(grp, 0, sizeof(*grp));
+	explicit_bzero(grp, sizeof(*grp));
 
 	error = group_unpack_string(nvl, "gr_name", &grp->gr_name, &buffer,
 	    &bufsize);
diff --git a/lib/libexpat/expat_config.h b/lib/libexpat/expat_config.h
index 6deefc419f46..d335df9f776d 100644
--- a/lib/libexpat/expat_config.h
+++ b/lib/libexpat/expat_config.h
@@ -1,5 +1,8 @@
 /* $FreeBSD$ */
 
+/* expat_config.h.  Generated from expat_config.h.in by configure.  */
+/* expat_config.h.in.  Generated from configure.ac by autoheader.  */
+
 #include <machine/endian.h>
 
 /* 1234 = LIL_ENDIAN, 4321 = BIGENDIAN */
@@ -9,6 +12,12 @@
 #define BYTEORDER 4321
 #endif
 
+/* Define to 1 if you have the `arc4random' function. */
+#define HAVE_ARC4RANDOM 1
+
+/* Define to 1 if you have the `arc4random_buf' function. */
+#define HAVE_ARC4RANDOM_BUF 1
+
 /* Define to 1 if you have the `bcopy' function. */
 #define HAVE_BCOPY 1
 
@@ -21,9 +30,15 @@
 /* Define to 1 if you have the `getpagesize' function. */
 #define HAVE_GETPAGESIZE 1
 
+/* Define to 1 if you have the `getrandom' function. */
+#define HAVE_GETRANDOM 1
+
 /* Define to 1 if you have the <inttypes.h> header file. */
 #define HAVE_INTTYPES_H 1
 
+/* Define to 1 if you have the `bsd' library (-lbsd). */
+/* #undef HAVE_LIBBSD */
+
 /* Define to 1 if you have the `memmove' function. */
 #define HAVE_MEMMOVE 1
 
@@ -45,6 +60,9 @@
 /* Define to 1 if you have the <string.h> header file. */
 #define HAVE_STRING_H 1
 
+/* Define to 1 if you have `syscall' and `SYS_getrandom'. */
+#define HAVE_SYSCALL_GETRANDOM 1
+
 /* Define to 1 if you have the <sys/param.h> header file. */
 #define HAVE_SYS_PARAM_H 1
 
@@ -57,9 +75,11 @@
 /* Define to 1 if you have the <unistd.h> header file. */
 #define HAVE_UNISTD_H 1
 
-/* Define to the sub-directory in which libtool stores uninstalled libraries.
-   */
-#undef LT_OBJDIR
+/* Define to the sub-directory where libtool stores uninstalled libraries. */
+#define LT_OBJDIR ".libs/"
+
+/* Name of package */
+#define PACKAGE "expat"
 
 /* Define to the address where bug reports for this package should be sent. */
 #define PACKAGE_BUGREPORT "expat-bugs@libexpat.org"
@@ -68,7 +88,7 @@
 #define PACKAGE_NAME "expat"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "expat 2.1.0"
+#define PACKAGE_STRING "expat 2.2.6"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "expat"
@@ -77,11 +97,14 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "2.1.0"
+#define PACKAGE_VERSION "2.2.6"
 
 /* Define to 1 if you have the ANSI C header files. */
 #define STDC_HEADERS 1
 
+/* Version number of package */
+#define VERSION "2.2.6"
+
 /* whether byteorder is bigendian */
 #if BYTE_ORDER == BIG_ENDIAN
 #define WORDS_BIGENDIAN
@@ -93,15 +116,15 @@
    point. */
 #define XML_CONTEXT_BYTES 1024
 
+/* Define to include code reading entropy from `/dev/urandom'. */
+#define XML_DEV_URANDOM 1
+
 /* Define to make parameter entity parsing functionality available. */
 #define XML_DTD 1
 
 /* Define to make XML Namespaces functionality available. */
 #define XML_NS 1
 
-/* Define to __FUNCTION__ or "" if `__func__' does not conform to ANSI C. */
-/* #undef __func__ */
-
 /* Define to empty if `const' does not conform to ANSI C. */
 /* #undef const */
 
diff --git a/lib/libexpat/libbsdxml.3 b/lib/libexpat/libbsdxml.3
index 0d706ea7219d..d93dae89e7d4 100644
--- a/lib/libexpat/libbsdxml.3
+++ b/lib/libexpat/libbsdxml.3
@@ -25,7 +25,7 @@
 .\"
 .\" $FreeBSD$
 .\"/
-.Dd February 26, 2013
+.Dd November 2, 2018
 .Dt LIBBSDXML 3
 .Os
 .Sh NAME
@@ -36,7 +36,7 @@
 .Sh DESCRIPTION
 The
 .Nm
-library is a verbatim copy of the eXpat XML library version 2.1.0.
+library is a verbatim copy of the eXpat XML library version 2.2.6.
 .Pp
 The
 .Nm