| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
As per RFC5061 "4.2. New Parameter Types" the add/delete IP address
parameters (0xc001, 0xc002) may not be present in an INIT or INIT-ACK
chunk. They are only allowed to be present in an ASCONF chunk.
This also prevents unbounded recursion while parsing an SCTP packet.
Approved by: so
Security: FreeBSD-SA-26:14.pf
Security: CVE-2026-7164
PR: 294799
Reported by: Igor Gabriel Sousa e Souza
MFC after: 3 days
Sponsored by: Orange Business Services
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
pmap_pkru_update_range() did not handle the case where a PDPE has PG_PS
set. More generally, the SET_PKRU and CLEAR_PKRU sysarch
implementations did not check whether the request covers a "boundary" vm
map entry. Fix this, add the missing PG_PS test, and add some tests.
Approved by: so
Security: FreeBSD-SA-26:11.amd64
Security: CVE-2026-6386
Reported by: Nicholas Carlini <npc@anthropic.com>
Reviewed by: kib, alc
Differential Revision: https://reviews.freebsd.org/D56184
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The TIOCNOTTY handler detaches the calling process from its controlling
terminal. It clears the link from the session to the tty, but not the
pointers from the tty to the session and process group. This means that
sess_release() doesn't call tty_rel_sess(), and that pgdelete() doesn't
call tty_rel_pgrp(), so the pointers are left dangling.
Fix this by clearing pointers in tty_drop_ctty(). Add a standalone
regression test.
Approved by: so
Security: FreeBSD-SA-26:10.tty
Security: CVE-2026-5398
Reported by: Nicholas Carlini <npc@anthropic.com>
Reviewed by: kib, kevans
Fixes: 1b50b999f9b5 ("tty: implement TIOCNOTTY")
Differential Revision: https://reviews.freebsd.org/D56046
|
| |
|
|
|
|
|
|
|
|
| |
There's been a problem where rules which differed only in address ranges
were considered duplicates and not added. Test for this.
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit ab74151e8d097b263237942c0b12277098bc9533)
|
| |
|
|
|
|
| |
MFC after: 3 weeks
(cherry picked from commit 5843b8ee02e99527c28f579acfc1f48e10033529)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
pf was too strict when validating SCTP tags. When a server receives a
retransmitted INIT it will reply with a random initiate tag every time.
However, pf saves the first initiate tag and expects every subsequent INIT_ACK
retransmission to have the same tag. This is not the case, leading to endless
INIT/INIT_ACK cycles.
Allow the tag to be updated as long as we've not gone past COOKIE_WAIT.
Add a test case to verify this.
MFC after: 2 weeks
See also: https://redmine.pfsense.org/issues/16516
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit bc3b72ff48953551e0e8bd6e5a2c718ecd973285)
|
| |
|
|
|
|
|
|
| |
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D50533
(cherry picked from commit a5dac34f6e98c47bd7cb1946e39cc45432e167a8)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The in-tree ZFS test suite is somewhat outdated and I see a number of
failures there. I tend to think that we want to integrate the OpenZFS
test suite somehow, replacing the legacy one, though it's also possible
to run that as a separate test suite.
In any case, if one wants to run the OpenZFS test suite separately, it's
useful to be able to disable installation of the legacy ZFS test suite,
so let's provide a src.conf option to do that.
Reviewed by: asomers
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D46476
(cherry picked from commit 24affded3d4ec5fafb6b22f773ec1e20d73b9b03)
|
| |
|
|
|
|
|
|
|
|
|
| |
Unterminated strings in the anchor or name could cause crashes.
Validate them, and add a test case.
Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com>
MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 1da3c0ca5b1decaa9cf55859cd134bdcd1218116)
|
| |
|
|
|
|
|
|
|
|
|
| |
Both for the DIOCADDSTATE ioctl and for states imported through pfsync packets.
Add a test case to exercise this code path.
Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com>
MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit faacc0d968816cf8714c974b6d8df6191cfb0e0d)
|
| |
|
|
|
|
| |
Approved by: so
(cherry picked from commit 1dd66c6ac2c146f540b2ff825fbee442354aeee5)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Tunnel IPv[46] traffic over IPv[46] should still function when the
gif(4) interface is member of a if_bridge(4) interface, aka the
EtherIP setup.
PR: 227450
Reviewed by: kp
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D51682
(cherry picked from commit 04d0dc4c0c65592a21225cff43f25e0a0da64eb9)
(cherry picked from commit e5f01421ddbfee935546271121e6254472dcc7f5)
|
| |
|
|
|
|
|
|
|
|
| |
While here, rename basic to 4in4 to be consistent with other tests.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D51566
(cherry picked from commit 62439516cc9bba32ed2406f340326c4d37e4cc59)
(cherry picked from commit c2806cddc64766b69daa42b4fb192f767e4b4705)
|
| |
|
|
|
|
|
|
|
|
|
|
| |
When object files for programs are built using bsd.prog.mk, and WITH_PIE
is enabled, the extension used is still plain ".o". To be consistent
with bsd.lib.mk, and to allow changes in WITH_PIE settings to propagate
correctly, the extension should be ".pieo" instead.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D49966
(cherry picked from commit 245bb0110639fe963086fb2903143dbd4e6ac48c)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
pfctl_show_nat() is called recursively to print nat anchors. This passes the
anchor path, but this path was modified by pfctl_show_nat(), leading to issues
printing the anchors.
Make a copy of the path ('npath') before we modify it. Ensure we do this
correctly by sprinking in 'const', and add a test case to verify that we do now
print things correctly.
Reported by: Thomas Pasqualini <thomas.pasqualini@orange.com>
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 58164dcb55d62ca73b5e550b8344bf61e2d8a47a)
|
| |
|
|
|
| |
Event: Tokyo Hackathon 202503
(cherry picked from commit 36586800803d24f1137d861bbaf487a6bde16a09)
|
| |
|
|
|
| |
Event: Tokyo Hackathon 202503
(cherry picked from commit c849f533326026501c28cb2c344b16723862551a)
|
| |
|
|
|
|
|
|
|
| |
After 04207850a9b9 it is required that key length is not zero.
Add some key to avoid error.
Reported by: markj
(cherry picked from commit b6708045590712930c533e916e3d6fdfe48ec5ba)
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
io.cc relies on `std::setw(..)`, which is exported by the iomanip C++
header. Newer versions of GoogleTest don't export this header, so add
the explicit include.
This unbreaks the build with GoogleTest 1.15.2.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D47194
(cherry picked from commit 0077477f215c851fe15c9ea12cfb005125c4238a)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
`INSTANTIATE_TEST_CASE_P` has been replaced with `INSTANTIATE_TEST_SUITE_P`.
Replace all uses of the former macro with the latter macro.
While here, address the fact that the latter macro doesn't permit some
of the constructions that the former macro did, e.g., empty parameters,
etc.
Conflicts:
tests/sys/fs/fusefs/fallocate.cc (fix applied manually)
tests/sys/fs/fusefs/io.cc (change reverted)
MFC after: 2 weeks
Reviewed by: asomers
Differential Revision: https://reviews.freebsd.org/D41398
(cherry picked from commit 811e0a31acafd6ab21f89bec8ba0fb8c09f258d2)
|
| |
|
|
|
|
|
|
|
|
|
|
| |
While here, add one additional IPv4 link-local address to test_46_nofilter
to cover the IPv4 RT_SCOPE_LINK case.
Reviewed by: melifaro, #network
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D49226
(cherry picked from commit 5d8b48487acc8375675f2b7c4507c98ac5d0bf75)
(cherry picked from commit e84a17db1cc034b87df7660dadb709a019140c3c)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The reassembly state will be dropped after timeout, all related
fragments are dropped until that. This is conforming to RFC 5722.
- Sort pf_fragment fields while there.
- If the fr_queue is empty, we had overlapping fragments, don't add
new ones.
- If we detect overlapping IPv6 fragments, flush the fr_queue and
drop all fragments immediately.
- Rearrange debug output, to make clear what happens.
- An IPv4 fragment that is totaly overlapped does not inclease the
bad fragment counter.
- Put an KASSERT into pf_isfull_fragment() to make sure that the
fr_queue is never emtpy there.
discussed with Fernando Gont; ok henning@
Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 8b45f36762
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 6a3266f72e437aecf3edcfb8aa919466b270d548)
|
| |
|
|
|
| |
(cherry picked from commit e53b83a849e3a34772d0a0ed26eb0cb4aeeec71d)
(cherry picked from commit e4e6423ef3d2a787583d88a87a11748217602759)
|
| |
|
|
|
|
|
|
|
|
| |
Fix a leak of a fuse_ticket structure. The leak mostly affected
NFS-exported fuse file systems, and was triggered by a failure during
FUSE_LOOKUP.
Sponsored by: ConnectWise
(cherry picked from commit 969d1aa4dbfcbccd8de965f7761203208bf04e46)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
The FUSE_NO_OPEN_SUPPORT and FUSE_NO_OPENDIR_SUPPORT flags
are only meant to indicate kernel features, and should be ignored
if they appear in the FUSE_INIT reply flags.
Also fix the corresponding test cases.
Reviewed by: Alan Somers <asomers@FreeBSD.org>
Signed-off-by: CismonX <admin@cismon.net>
Pull Request: https://github.com/freebsd/freebsd-src/pull/1509
(cherry picked from commit f0f596bd955e5b48c55db502e79fc652ac8970d3)
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Verify that we reset the cleared time when we zero an address' counters in
a table.
PR: 282877, 282984
Reviewed by: kp
MFC after: 2 weeks
Signed-off-by: Leonid Evdokimov <leon@darkk.net.ru>
Differential Revision: https://reviews.freebsd.org/D48242
(cherry picked from commit 0749d8134300b8e3c956e161890ab496247d2542)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When processing an SCTP ASCONF we re-run the rules processing to check
if the new state should be allowed as well. We used to do so against the
'all' interface, to allow new connections to use any interface.
This is problematic for two reasons, the first being it may unexpectedly
bypass interface restrictions. The more important one is that it
can trigger panics. If the ruleset contains a rule which filters on
interface group we'd attempt to process the group list for the 'all'
interface. As this isn't a real interface it doesn't have an associated
struct ifnet, and we end up dereferencing a NULL pointer.
Solve this by not overriding the interface, instead leaving the physical
interface the SCTP ASCONF arrived on. This implies that we may end up
binding to that interface (if if-bound), and thus denying traffic on
other interfaces. Users can allow this anyway by setting 'state-policy
floating' on the relevant SCTP rules. This arguably better reflects user
intent as well. That is, we'll consider SCTP multihomed states to be
floating if we're in floating mode, and if-bound if we're if-bound.
Update the test cases to account for this, while adding a "pass on
lo" (i.e. pass on an interface group") rule to provoke this issue. Add
separate test cases for the floating and if-bound scenarios.
Reported by: Franco Fichtner <franco@opnsense.org>
MFC after: 3 weeks
Sponsored by: Orange Business Services
(cherry picked from commit c22c9879845653abb365e468daaa621e3f8f767a)
|
| |
|
|
|
|
|
|
|
|
| |
This will make it easier for scripts to detect idle hosts in tables.
PR: 282984
Reviewed by: kp
MFC after: 2 weeks
(cherry picked from commit 5b59b0c61e29f684a019afdd2848ffe2d5604e0c)
|
| |
|
|
|
|
|
|
|
|
|
|
| |
The ioctl DIOCRCLRASTATS provides the functionality of clearing stats
not only for the whole table for for addresses stored in that table. The
functionality was missing from pfctl, though. Add it now.
PR: 282877
Obtained from: OpenBSD, kirill <kirill@openbsd.org>, e496dff3a7
MFC after: 3 weeks
(cherry picked from commit 6463b6b59152fb1695bbe0de78f6e2675c5a765a)
|
| |
|
|
|
|
|
|
|
|
|
| |
The update to py-twisted 24.7.0 broke EPSV mode in twisted's ftp server.
Work around this by disabling EPSV (and thus using PASV).
PR: 282154
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 9cd6ab45a44607ea862c8bbb2ebaa8a7521178ff)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
From scapy 2.6.0 it now removes (sets to None) the IP checksum in its defrag
code. We typically ask for IPv4 or IPv6 defragmentation, which causes check
function failures.
Just skip the checksum verificiation here, because we're going to notice
incorrect checksums even if the tests don't directly verify it.
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 6b8096fa5f6f81e2959cbb2ca857c4e134273da2)
|
| |
|
|
|
|
|
|
|
|
| |
These ones were unambiguous cases where the Foundation was the only
listed copyright holder.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 5c2bc3db201a4fe8d7911cf816bea104d5dc2138)
(cherry picked from commit f06d322e9d925ab56a4aa8210a67637d4d341ab6)
|
| |
|
|
|
|
|
|
|
|
| |
Reviewed by: Pierre Pronchery <pierre@freebsdfoundation.org>
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: Axcient
(cherry picked from commit 60d717baf2144cf344ec9b47d715ce837b5d46d4)
(cherry picked from commit e9329a869c8137b955b2b3487ac0dadabf540bda)
|
| |
|
|
|
|
|
|
|
| |
Also check repeated calls.
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit d154dc21130b607d7903f276dd6d463b990f33f7)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Some SCTP implementations will abort connections and then later re-use the same
port numbers (i.e. both src and dst) for a new connection, before pf has fully
purged the old connection.
Apply the same hack we already have for similarly misbehaving TCP
implementations and forcibly remove the old state so we can create a new one.
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 82e021443a76b1f210cfb929a495185179606868)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Many of the tests create temporary files. pid files, log files, tcpdump
captures, ... We should take care to ensure they're stored in the temporary
working directory Kyua creates rather than in the root directory.
This ensures there are no conflicts between simultaneously running tests, and
also keeps the root directory clean.
MFC after: 1 month
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit b0fcf4d5222bfdbbc0e2af2b14f0d73704706aa0)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
(e.g. traceroute with icmp)
ok henning, jsing
Also extend the test case to cover this scenario.
PR: 280701
Obtained from: OpenBSD
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 89f6723288b0d27d3f14f93e6e83f672fa2b8aca)
|
| |
|
|
|
|
|
|
| |
PR: 280701
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 34063cb714602972b6d985ad747fc8f66a8daae1)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When creating a state for ICMP (v4 or v6) packets we only used the ID, which
means that we could confuse different ICMP types. For example, if we allowed
neighbour discovery but not ICMPv6 echo requests an ND packet could create a
state that the echo request would match.
Test that this is now fixed.
Reported by: Enrico Bassetti <e.bassetti@tudelft.nl>
MFC after: 1 day
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit b9f0dbc3d006e0b904ee4275d54459f4edd65bb8)
|
| |
|
|
|
|
|
|
|
| |
The test body somehow wound up in the cleanup function.
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit fe0c82a603ce069786ee81604315f499fd965546)
|
| |
|
|
| |
(cherry picked from commit 8ed5170c66ec4914e90c2f3657227ceb9e35193f)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Background:
If a user does pathconf(_, _PC_MIN_HOLE_SIZE) on a fusefs file system,
the kernel must actually issue a FUSE_LSEEK operation in order to
determine whether the server supports it. We cache that result, so we
only have to send FUSE_LSEEK the first time that _PC_MIN_HOLE_SIZE is
requested on any given mountpoint.
Problem 1:
Unlike fpathconf, pathconf operates on files that may not be open. But
FUSE_LSEEK requires the file to be open. As described in PR 278135,
FUSE_LSEEK cannot be sent for unopened files, causing _PC_MIN_HOLE_size
to wrongly report EINVAL. We never noticed that before because the
fusefs test suite only uses fpathconf, not pathconf. Fix this bug by
opening the file if necessary.
Problem 2:
On a completely sparse file, with no data blocks at all, FUSE_LSEEK with
SEEK_DATA would fail to ENXIO. That's correct behavior, but
fuse_vnop_pathconf wrongly interpreted that as "FUSE_LSEEK not
supported". Fix the interpretation.
PR: 278135
Sponsored by: Axcient
Differential Revision: https://reviews.freebsd.org/D44618
(cherry picked from commit 6efba04df3f8c77b9b12f1df3e5124a7249b82fc)
|
| |
|
|
|
|
|
|
|
| |
Remove assumptions in two test cases that maxphys won't be huge.
Reported by: kib
Sponsored by: Axcient
(cherry picked from commit b2792a300ddb8d8334b234fe7744f5141cc96103)
|
| |
|
|
|
|
|
|
|
|
|
| |
The tests try to read kern.maxphys sysctl into int value, while
unsigned long is required. Not sure when this was broken, seems like
since cd8537910406e.
Reviewed by: asomers
Differential Revision: https://reviews.freebsd.org/D45053
(cherry picked from commit e9b411d273336647e61704213964b995952a44fd)
|
| |
|
|
|
|
|
|
| |
PR: 279225
MFC after: 3 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 8b28ec3861d5b3e9fd8a60dbfda13059a5301281)
|
| |
|
|
| |
(cherry picked from commit 39f5d8dd1b2fea7cff0770efb0bc3d6e33e24279)
|
| |
|
|
|
|
|
| |
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D43464
(cherry picked from commit 8bae22bbbe6571da9259e0d43ffa8a56f4b3e171)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A number of tests create a bridge, but did not check if if_bridge.ko is loaded.
We usually get away with that, because `ifconfig bridge create` autoloads the
module, but if we run the tests in a jail (e.g. because of kyua's upcoming
execenv.jail.params feature) we can't load the module and these tests can fail.
Check if the module is loaded, skip the test if it is not.
Reviewed by: markj
MFC after: 1 week
Event: Kitchener-Waterloo Hackathon 202406
Differential Revision: https://reviews.freebsd.org/D45487
(cherry picked from commit 480ad4055314efbfff7eedbb34272031d836ba89)
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Capability rights passed to cap_rights_* are not simple bitmaks and
cannot be ORed together in general (although it will work for certain
subsets of rights).
PR: 277057
Fixes: e5e1d9c7b781 ("path_test: Add a test case for...")
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 8d1348f55aed6873f34f54bc3b275b73ef0ff66d)
(cherry picked from commit ea3910c452cf44342e0b65d6283aebeb77a10863)
|
| |
|
|
| |
(cherry picked from commit 09dd7240acf1fc50061246013ce318404d70c4e0)
|