Heavy DNSSEC Validation Load Can Cause a "Bad Cache" Assertion Failure
in BIND9
High numbers of queries with DNSSEC validation enabled can cause an
assertion failure in named, caused by using a "bad cache" data structure
before it has been initialized.
marius [Sun, 22 Jul 2012 14:32:49 +0000 (14:32 +0000)]
MFC: r238621
Revert the use of BUS_DMA_ALLOCNOW when creating the DMA tag for user
data introduced in r236061 (MFC'ed to stable/9 in r237186). Using that
flag doesn't make that much sense on this case as the DMA maps using
it are also created during sym_pci_attach(). Moreover, due to the
maxsegsz parameter used, doing so may exhaust the bounce pages pool
on architectures requiring bounce pages. [1]
While at it, use a slightly more appropriate maxsegsz parameter.
PR: 169526
Submitted by: Mike Watters [1]
Approved by: re (kib)
MFC r238063:
- Make ipfw's sched rules case insensitive, for user-friendliness.
- Add a note to the ipfw(8) man page about the rules no longer being
case sensitive.
- Fix some typos in the man page.
MFC r238617:
Fix several reads beyond the mapped first page of the binary in the
ELF parser. Specifically, do not allow note reader and interpreter
path comparision in the brandelf code to read past end of the page.
This may happen if specially crafter ELF image is activated.
Revert to the old behavior of allocating table/table entries using
M_NOWAIT. Currently, the code allows for sleeping in the ioctl path
to guarantee allocation. However code also handles ENOMEM gracefully, so
propagate this error back to user-space, rather than sleeping while
holding the global pf mutex.
dim [Tue, 17 Jul 2012 18:04:34 +0000 (18:04 +0000)]
MFC r238429:
Pull in r159895 from upstream clang trunk:
When marking virtual functions as used for a class' vtable, mark all functions
which will appear in the vtable as used, not just those ones which were
declared within the class itself. Fixes an issue reported as comment#3 in
PR12763 -- we sometimes assert in codegen if we try to emit a reference to a
function declaration which we've not marked as referenced. This also matches
gcc's observed behavior.
This should fix clang assertions when building certain components of the
LibreOffice port.
Bugfix: Send up a COMM UP notification for active 1-to-1 style sockets
also in the case where the assoc comes up due to a remotely
started handshake (collision case).
Approved by: re@
In g_mirror_regular_request() upon successful delivery treat
BIO_DELETE requests same way as BIO_WRITE removing them from
queue. This fixes panic with BIO_DELETE operations on geom_mirror.
Make geom_mirror more friendly to SSDs. To properly support TRIM,
we need to pass BIO_DELETE requests down to providers that support
it. Also, we need to announce our support for BIO_DELETE to upper
consumer. This requires:
- In g_mirror_start() return true for "GEOM::candelete" request.
- In g_mirror_init_disk() probe below provider for "GEOM::candelete"
attribute, and mark disk with a flag if it does support BIO_DELETE.
- In g_mirror_register_request() distribute BIO_DELETE requests only
to those disks, that do support it.
Note that we announce "GEOM::candelete" as true unconditionally of
whether we have TRIM-capable media down below or not. This is made
intentionally, because upper consumer (usually UFS) requests the
attribite only once at mount time. And if user ever migrates his
mirror from HDDs to SSDs, then he/she would get TRIM working without
remounting filesystem.
MFC r237573:
Add more locale-specific functions to the relevant man pages and
Makefiles:
- libc/stdtime/strftime.3
- libc/stdtime/strptime.3
- libc/stdlib/strfmon.3
des [Sun, 15 Jul 2012 11:39:35 +0000 (11:39 +0000)]
MFH r236751: document sha256 / sha512 support
MFH r236892: remove mention of auth.conf from programs that don't use it
MFH r236963: remove dead code relating to auth.conf
MFH r236965 r236966 r236967 r237005 r237006 r237011: retire auth.conf
Implement handling of "atomic fragements" as outlined in
draft-gont-6man-ipv6-atomic-fragments to mitigate one class of
possible fragmentation-based attacks.
As mentioned in the commit message of r237571 (copied from a prototype
patch of mine) also check if the 2nd in6_setscope() failed and return
the error in that case.
Fix a bug in code that calculates the number of the first interrupt
vector for a port. This affected the gigabit ports of T422 cards (the
ones with 2x10G ports and 2x1G ports).
Fix improper L4 header handling for IPv6 packets passed via DLT_RAW.
Set netflow v9 observation domain value to fib number instead of node id.
This fixes multi-fib netflow v9 export.
Use time_uptime instead of getnanotime for accouting integer number of seconds.
Simplify IP pointer recovery in case of mbuf reallocation.
When allocation of labels on files is implicitly disabled due to MAC
policy configuration, avoid leaking resources following failed calls
to get and set MAC labels by file descriptor.
Reported by: Mateusz Guzik <mjguzik at gmail.com> + clang scan-build
When initialising the CP0 status register during boot on 64-bit MIPS,
set all three of the kernel, supervisor, and user-mode 64-bit mode
flags. While FreeBSD does not currently use the supervisor ring (and
hence this is effectively a NOP on most systems), doing this avoids
triggering an exception on 64-bit MIPS CPUs that don't support 32-bit
compatibility mode, and therefore don't allow clearing the SX bit.
Reviewed by: gonzo
Sponsored by: DARPA, SRI International
Merge a local fix to OpenBSM's libauditd to avoid a directory descriptor
leak when iterating over possible audit trail directories. This fix will
be merged upstream in an identical form, but hasn't yet appeared in an
OpenBSM release.
MFC r237049:
Pass flowid explicitly through the stack instead of taking it from
the mbuf chain at different places.
While there: Fix several bugs related to VRFs.
It turns out that too many drivers are not only parsing the L2/3/4
headers for TSO but also for generic checksum offloading. Ideally we
would only have one common function shared amongst all drivers, and
perhaps when updating them for IPv6 we should introduce that.
Eventually we should provide the meta information along with mbufs to
avoid (re-)parsing entirely.
To not break IPv6 (checksums and offload) and to be able to MFC the
changes without risking to hurt 3rd party drivers, duplicate the v4
framework, as other OSes have done as well.
Introduce interface capability flags for TX/RX checksum offload with
IPv6, to allow independent toggling (where possible). Add CSUM_*_IPV6
flags for UDP/TCP over IPv6, and reserve further for SCTP, and IPv6
fragmentation. Define CSUM_DELAY_DATA_IPV6 as we do for legacy IP and
add an alias for CSUM_DATA_VALID_IPV6.
This pretty much brings IPv6 handling in line with IPv4.
TSO is still handled in a different way and not via if_hwassist.
Update ifconfig to allow (un)setting of the new capability flags.
Update loopback to announce the new capabilities and if_hwassist flags.
Individual driver updates will have to follow, as will SCTP.
Removed the IFCAP_ prefix when printing the IPv6 checksum capabilities.
Factor out the tcp_hc_getmtu() call. As the comments say it
applies to both v4 and v6, so only write it once making it easier
to read the protocol family specifc code.
In case forwarding is turned on for a given address family, refuse to
queue the packet for LRO and tell the driver to directly pass it on.
This avoids re-assembly and later re-fragmentation problems when
forwarding.
It's not the best solution but the simplest and most effective for
the moment.
Make TCP LRO work properly with VIMAGE kernels rather than just panicing.
There's no VIMAGE context set there yet as this is before if_ethersubr.c.
Add code to handle pre-checked TCP checksums as indicated by mbuf
flags to save the entire computation for validation if not needed.
In the IPv6 TCP output path only compute the pseudo-header checksum,
set the checksum offset in the mbuf field along the appropriate flag
as done in IPv4.
In tcp_respond() just initialize the IPv6 payload length to 0 as
ip6_output() will properly set it.
Defer checksum calulations on UDP6 output and respect the mbuf
flags set by NICs having done checksum validation for us already,
thus saving the computing time in the input path as well.
Add support for delayed checksum calculations in the IPv6
output path. We currently cannot offload to the card if we
add extension headers (which incl. fragmentation).
Fix two SCTP offload support copy&paste bugs: calculate
checksums if fragmenting and no need to flag IPv4 header
checksums in the IPv6 forwarding path.
Correctly get the payload length in host byte order. While we
already plan to support >64k payload here, the IPv6 header payload
length obviously is only 16 bit and the calculations need to be right.
Hide the ip6aux functions. The only one referenced outside ip6_input.c
is not compiled in yet (__notyet__) in route6.c (r235954, r238231).
We do have accessor functions that should be used.
Significantly update tcp_lro for mostly two things:
1) introduce basic support for IPv6 without extension headers.
2) try hard to also get the incremental checksum updates right,
especially also in the IPv4 case for the IP and TCP header.
Move variables around for better locality, factor things out into
functions, allow checksum updates to be compiled out, ...
Leave a few comments on further things to look at in the future,
though that is not the full list.
Update drivers with appropriate #includes as needed for IPv6 data
type in LRO.
in_cksum.h required ip.h to be included for struct ip. To be
able to use some general checksum functions like in_addword()
in a non-IPv4 context, limit the (also exported to user space)
IPv4 specific functions to the times, when the ip.h header is
present and IPVERSION is defined (to 4).
Introduce a (for now copied stripped down) in6_cksum_pseudo()
function. We should be able to use this from in6_cksum() but
we should also ponder possible MD specific improvements.
It takes an extra csum argument to allow for easy checks as
will be done by the upper layer protocol input paths.
Optimize in6_cksum(), re-ordering work and limiting variable
initialization, removing a bzero() for mostly re-initialized
struct values, making use of the newly introduced in6_getscope(),
as well as converting an if/panic to a KASSERT().
Allow tso4 and tso6 be set individually given we have the bits.
This will help with drivers not working as expected during the
transition time and later.
Call set_terminal_mode() after video mode change, not before, because
video mode change always reset terminal mode to xterm.
It allows things like 'vidcontrol -T cons25 80x30' works as supposed,
and allows 'allscreens_flags="-T cons25 80x30"' in /etc/rc.conf too.
MFC r238022:
Remove 14 not very useful characters " HDA CODEC PCM" from HDA pcm
device names to shorten them. PulseAudio reported to have problems with
names longer then 63 chars and at least in XMMS long names are inconvinient.
MFC r238011:
Restore GPIO config quirks handling, lost during last big refactoring.
This fixes sound from speakers on some laptops, including MacBook Pro.
projects / FreeBSD / stable / 9.git / log