peter [Tue, 11 Jul 2000 09:50:15 +0000 (09:50 +0000)]
Fix out-of-sync defaults. PermitRootLogin is supposed to be 'no' but
sshd's internal default was 'yes'. (if some cracker managed to trash
/etc/ssh/sshd_config, then root logins could be reactivated)
peter [Tue, 11 Jul 2000 09:31:19 +0000 (09:31 +0000)]
Try and fix the worst of some highly bogus malloc/free resource
management involving rcmd_af(), getaddrinfo(), freeaddrinfo(), etc.
We set *ahost to point to ai->canonname; and later free the ai-> stuff
and still leave the old pointers in *ahost to the freed data.
Perhaps the best way to deal with this is a static buffer or a static
strdup() that is freed on the next iteration or something. This gives
me headaches just thinking about this.
The new 'AJ' default for malloc() tripped this up.
green [Tue, 11 Jul 2000 06:47:38 +0000 (06:47 +0000)]
One should never allocate 4-kilobyte structs and such on the interrupt
stack. It's bad for your machine's health.
Make the two huge structs in reseed() static to prevent crashes. This
is the bug that people have been running into and panic()ing on for the
past few days.
Fix a bug when talking to non-freebsd machines where carriage return
was being interperated and displayed as ^M on the remote side.
Old curses used to change the behavior of the tty and how carriage
return was interperated via STDIN. ncurses does this on a per-window
basis within the library rather than using the tty modes. Since
talk is bypassing ncurses, it was missing the conversion.
Always install loader.4th, defaults/loader.conf, and support.4th instead of
only doing so if loader.rc does not exist. This fixes the problem where
installworld doesn't update /boot/loader.4th, resulting in device.hints not
being loaded after updating past the config(8) changes, which resulted in
mcclock0 not being probed, and a nice kernel panic during boot.
Remove the XE_DEBUG define. It shouldn't be defined now that things
are working. Add a small blurb about XE_DEBUG as it might be useful
to some people troubelshooting problems in the future.
Don't call printf with no format string. This is technically a security
vulnerability and could in principle be used to upload a new kernel from the
bootloader :-)
Do the same thing for TurboLaser that was done for Rawhide- make room
for secondary (bridged) PCI busses by making primary PCI instances
16 units apart.
Coordinate with change to mcpcia_pci.c- major primary busses on each
hose are 16 PCI instances apart. This allows us to recognize secondary
PCI busses (at least to a first level) until the pci infrastructure is
fixed.
Turn on support for secondary cycles, too. Redo debug printouts.
Don't let the infrastructure assign the 'next' PCI bus for us.
Instead, for now (until we get a pci infrastructure cleanup),
assign the PCI bus number to be mcpcia bus instance << 4. This
is to allow secondary bridges some room to be recongnized on
4100 systems.
- Remove use of programs in /usr like sed as possible. In this
time, I have no idea if there is equivalence of printf. So, stf
setup still depends on /usr. In addition, prefix(8) and gifconfig(8)
are in /usr/sbin. Should we move these into /sbin?
- Sync with latest stf behavior. Latest stf doesn't have link-local
address. And, latest stf is not gif but stf.
altoffset() always returned whenever it recursed, because at the end
of the processing of the recursion, "scan" would be pointing to O_CH
(or O_QUEST), which would then be interpreted as being the end character
for altoffset().
We avoid this by properly increasing scan before leaving the switch.
Without this, something like (a?b?)?cc would result in a g->moffset of
1 instead of 2.
I added a case to the soon-to-be-imported regex(3) test code to catch
this error.
Since g->moffset points to the _maximum_ offset at which the must
string may be found (from the beginning of the pattern), the point
at which must is found minus that offset may actually point to some
place before the start of the text.
In that case, make start = start.
Alternatively, this could be tested for in the preceding if, but it
did not occur to me. :-)
be more cautious about tcp option length field. drop bogus ones earlier.
not sure if there is a real threat or not, but it seems that there's
possibility for overrun/underrun (like non-NOP option with optlen > cnt).
Yarrow tweaks; separate the fast and slow reseed tasks so that they don't
stomp on each other; provide constant names (as enums) for the harvester
to use (makes it more self-documenting).
reject empty scopeid. use strtoul() for checking all-numericness of
portname. explicitly reject empty numeric portname.
sync with kame. based on comments from itohy@netbsd.org
peter [Sat, 8 Jul 2000 08:33:40 +0000 (08:33 +0000)]
Initial kenv(1) hack for dumping the kernel environment. This can be
used to extract modified boot hints to make loader(8)-time changes
"sticky". It tries to use \ style quoting so that it can be used directly
with foo.conf files. It can also extract specific variables.
projects / FreeBSD / FreeBSD.git / log