sync with OpenBSD -current

etc/skel/dot.version

@@ -1 +1 @@
-# SecBSD 1.4-4ca0067: Tue Nov 21 07:49:44 UTC 2023 (Mictlantecuhtli)
+# SecBSD 1.4-f3e820c: Wed Nov 22 20:09:10 UTC 2023 (Mictlantecuhtli)

gnu/usr.sbin/mkhybrid/src/defaults.h

@@ -2,7 +2,7 @@
  * Header file defaults.h - assorted default values for character strings in
  * the volume descriptor.
  *
- * 	$Id: defaults.h,v 1.1 2000/10/10 20:40:13 beck Exp $
+ * 	$Id: defaults.h,v 1.2 2023/11/21 08:46:06 jmatthew Exp $
  */
 
 #define  PREPARER_DEFAULT 	NULL
@@ -17,6 +17,7 @@
 #define  VOLUME_ID_DEFAULT 	"CDROM"
 #define  BOOT_CATALOG_DEFAULT   "boot.catalog"
 #define  BOOT_IMAGE_DEFAULT     NULL
+#define  EFI_BOOT_IMAGE_DEFAULT NULL
 #ifdef APPLE_HYB
 #define	 DEFTYPE		"TEXT"  /* default Apple TYPE */
 #define  DEFCREATOR		"unix"  /* default Apple CREATOR */

gnu/usr.sbin/mkhybrid/src/eltorito.c

@@ -44,6 +44,8 @@
 static struct eltorito_validation_entry valid_desc;
 static struct eltorito_defaultboot_entry default_desc;
 static struct eltorito_boot_descriptor gboot_desc;
+static struct eltorito_sectionheader_entry shdr_desc;
+static struct eltorito_defaultboot_entry efi_desc;
 
 static int tvd_write	__PR((FILE * outfile));
 
@@ -120,8 +122,9 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
     int				bootcat;
     int				checksum;
     unsigned char		      * checksum_ptr;
-    struct directory_entry      * de;
+    struct directory_entry      * de = NULL;
     struct directory_entry      * de2;
+    struct directory_entry      * efi_de = NULL;
     int				i;
     int				nsectors;
     
@@ -149,8 +152,12 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
      * now adjust boot catalog
      * lets find boot image first 
      */
+    if (boot_image != NULL)
 	de=search_tree_file(root, boot_image);
-    if (!de) 
+    if (efi_boot_image != NULL)
+        efi_de=search_tree_file(root, efi_boot_image);
+
+    if (de == NULL && efi_boot_image == NULL)
     {
 	fprintf(stderr,"Uh oh, I cant find the boot image!\n");
 	exit(1);
@@ -162,7 +169,8 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
      */
     memset(&valid_desc, 0, sizeof(valid_desc));
     valid_desc.headerid[0] = 1;
-    valid_desc.arch[0] = EL_TORITO_ARCH_x86;
+    valid_desc.arch[0] =
+	(boot_image != NULL)? EL_TORITO_ARCH_x86 : EL_TORITO_ARCH_EFI;
     
     /*
      * we'll shove start of publisher id into id field, may get truncated
@@ -198,6 +206,8 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
     checksum = -checksum;
     set_721(valid_desc.cksum, (unsigned int) checksum);
     
+    if (de == NULL)
+	goto skip_x86;
     /*
      * now make the initial/default entry for boot catalog 
      */
@@ -279,6 +289,27 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
 #endif
     set_731(default_desc.bootoff, 
 	    (unsigned int) get_733(de->isorec.extent));
+ skip_x86:
+    /*
+     * add the EFI boot image, if specified
+     */
+    if (efi_de != NULL) {
+	if (de != NULL) {
+	    memset(&shdr_desc, 0, sizeof(shdr_desc));
+	    shdr_desc.header_id[0] = EL_TORITO_SHDR_ID_LAST_SHDR;
+	    shdr_desc.platform_id[0] = EL_TORITO_ARCH_EFI;
+	    set_721(shdr_desc.entry_count, 1);
+	}
+
+	memset(&efi_desc, 0, sizeof(efi_desc));
+	efi_desc.boot_id[0] = EL_TORITO_BOOTABLE;
+	set_721(efi_desc.loadseg, 0);
+	efi_desc.arch[0] = EL_TORITO_ARCH_EFI;
+
+	nsectors = ((efi_de->size + 511) & ~(511))/512;
+	set_721(efi_desc.nsect, nsectors);
+	set_731(efi_desc.bootoff, (unsigned int)get_733(efi_de->isorec.extent));
+    }
 
     /*
      * now write it to disk 
@@ -295,7 +326,14 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
      * write out 
      */
     write(bootcat, &valid_desc, 32);
+    if (de != NULL)
+    {
 	write(bootcat, &default_desc, 32);
+	if (efi_de != NULL)
+	    write(bootcat, &shdr_desc, sizeof(shdr_desc));
+    }
+    if (efi_de != NULL)
+	write(bootcat, &efi_desc, sizeof(efi_desc));
     close(bootcat);
 } /* get_torito_desc(... */
 

gnu/usr.sbin/mkhybrid/src/iso9660.h

@@ -21,7 +21,7 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
 
 /*
- * 	$Id: iso9660.h,v 1.1 2000/10/10 20:40:16 beck Exp $
+ * 	$Id: iso9660.h,v 1.2 2023/11/21 08:46:06 jmatthew Exp $
  */
 
 #ifndef _ISOFS_FS_H
@@ -52,6 +52,7 @@ struct iso_volume_descriptor {
 #define EL_TORITO_ARCH_x86 0
 #define EL_TORITO_ARCH_PPC 1
 #define EL_TORITO_ARCH_MAC 2
+#define EL_TORITO_ARCH_EFI 0xEF
 #define EL_TORITO_BOOTABLE 0x88
 #define EL_TORITO_MEDIA_NOEMUL 0
 #define EL_TORITO_MEDIA_12FLOP  1
@@ -129,6 +130,16 @@ struct eltorito_defaultboot_entry {
         char pad2                       [ISODCL ( 13,   32)];
 };
 
+/* El Torito section header entry in boot catalog */
+struct eltorito_sectionheader_entry {
+#define EL_TORITO_SHDR_ID_SHDR		0x90
+#define EL_TORITO_SHDR_ID_LAST_SHDR	0x91
+	char header_id			[ISODCL (  1,    1)]; /* 711 */
+	char platform_id		[ISODCL (  2,    2)];
+	char entry_count		[ISODCL (  3,    4)]; /* 721 */
+	char id				[ISODCL (  5,   32)];
+};
+
 
 /* We use this to help us look up the parent inode numbers. */
 

gnu/usr.sbin/mkhybrid/src/mkhybrid.8

@@ -2,7 +2,7 @@
 .\" To print, first run through tbl
 .\" -*- nroff -*-
 .\"
-.\" $Id: mkhybrid.8,v 1.4 2022/07/11 03:11:49 daniel Exp $
+.\" $Id: mkhybrid.8,v 1.5 2023/11/21 08:46:06 jmatthew Exp $
 .\"
 .TH MKHYBRID 8 "7 April 1999" "Version 1.12b5.1"
 .SH NAME
@@ -46,6 +46,10 @@ mkhybrid \- create an hybrid ISO9660/JOLIET/HFS filesystem with optional Rock Ri
 .B \-D
 ]
 [
+.B \-e
+.I efi_boot_image
+]
+[
 .B \-hide
 .I glob
 ]
@@ -474,6 +478,18 @@ Do not use deep directory relocation, and instead just pack them in the
 way we see them.  This violates the ISO9660 standard, but it works on many
 systems.  Use with caution.
 .TP
+.BI \-e " efi_boot_image
+Specifies the path and filename of the EFI boot image to be used when making
+an "El Torito" bootable CD.
+The pathname must be relative to the source path specified to
+.B mkhybrid.
+The file should contain an EFI system partition image.
+The
+.B \-e
+option can be used with or without the
+.B \-b
+option.
+.TP
 .B \-f
 Follow symbolic links when generating the filesystem.  When this option is not
 in use, symbolic links will be entered using Rock Ridge if enabled, otherwise

gnu/usr.sbin/mkhybrid/src/mkisofs.c

@@ -110,6 +110,7 @@ char * volume_id = VOLUME_ID_DEFAULT;
 char * system_id = SYSTEM_ID_DEFAULT;
 char * boot_catalog = BOOT_CATALOG_DEFAULT;
 char * boot_image = BOOT_IMAGE_DEFAULT;
+char * efi_boot_image = EFI_BOOT_IMAGE_DEFAULT;
 int volume_set_size = 1;
 int volume_sequence_number = 1;
 
@@ -274,6 +275,8 @@ static const struct ld_option ld_options[] =
       'd', NULL, "Omit trailing periods from filenames", ONE_DASH },
   { {"disable-deep-relocation", no_argument, NULL, 'D'},
       'D', NULL, "Disable deep directory relocation", ONE_DASH },
+  { {"eltorito-boot-efi", required_argument, NULL, 'e' },
+      'e', "FILE", "Set El Torito EFI boot image name" , ONE_DASH },
   { {"follow-links", no_argument, NULL, 'f'},
       'f', NULL, "Follow symbolic links", ONE_DASH },
   { {"help", no_argument, NULL, OPTION_HELP},
@@ -865,6 +868,14 @@ int FDECL2(main, int, argc, char **, argv){
 		exit(1);
 	}
 	break;
+      case 'e':
+	use_eltorito++;
+	efi_boot_image = optarg;
+	if (efi_boot_image == NULL) {
+		fprintf(stderr,"Required EFI boot image pathname missing\n");
+		exit(1);
+	}
+	break;
       case 'c':
 	use_eltorito++;
 	boot_catalog = optarg;  /* pathname of the boot image on cd */

gnu/usr.sbin/mkhybrid/src/mkisofs.h

@@ -20,7 +20,7 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
 
 /*
- * 	$Id: mkisofs.h,v 1.4 2015/09/09 20:02:31 miod Exp $
+ * 	$Id: mkisofs.h,v 1.5 2023/11/21 08:46:06 jmatthew Exp $
  */
 
 /* APPLE_HYB James Pearson j.pearson@ge.ucl.ac.uk 12/3/99 */
@@ -462,6 +462,7 @@ extern char * system_id;
 extern char * volume_id;
 extern char * boot_catalog;
 extern char * boot_image;
+extern char * efi_boot_image;
 extern int volume_set_size;
 extern int volume_sequence_number;
 

lib/libc/asr/getaddrinfo_async.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: getaddrinfo_async.c,v 1.60 2023/11/20 12:15:16 florian Exp $	*/
+/*	$OpenBSD: getaddrinfo_async.c,v 1.61 2023/11/21 15:26:56 florian Exp $	*/
 /*
  * Copyright (c) 2012 Eric Faurot <eric@openbsd.org>
  *
@@ -115,7 +115,7 @@ getaddrinfo_async_run(struct asr_query *as, struct asr_result *ar)
 	char		 fqdn[MAXDNAME];
 	const char	*str;
 	struct addrinfo	*ai;
-	int		 i, family, r, is_localhost;
+	int		 i, family, r, is_localhost = 0;
 	FILE		*f;
 	union {
 		struct sockaddr		sa;
@@ -228,6 +228,7 @@ getaddrinfo_async_run(struct asr_query *as, struct asr_result *ar)
 
 		ar->ar_gai_errno = 0;
 
+		if (!(ai->ai_flags & AI_NUMERICHOST))
 			is_localhost = _asr_is_localhost(as->as.ai.hostname);
 		/*
 		 * If hostname is NULL, "localhost" or falls within the

lib/libc/asr/gethostnamadr_async.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: gethostnamadr_async.c,v 1.48 2023/11/20 12:15:16 florian Exp $	*/
+/*	$OpenBSD: gethostnamadr_async.c,v 1.49 2023/11/22 13:19:31 florian Exp $	*/
 /*
  * Copyright (c) 2012 Eric Faurot <eric@openbsd.org>
  *
@@ -205,7 +205,8 @@ gethostnamadr_async_run(struct asr_query *as, struct asr_result *ar)
 			}
 
 			if (!hnok_lenient(as->as.hostnamadr.name)) {
-				ar->ar_gai_errno = EAI_FAIL;
+				ar->ar_h_errno = NETDB_INTERNAL;
+				ar->ar_errno = EINVAL;
 				async_set_state(as, ASR_STATE_HALT);
 				break;
 			}

lib/libcrypto/ec/ec_print.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_print.c,v 1.13 2023/07/07 13:54:45 beck Exp $ */
+/* $OpenBSD: ec_print.c,v 1.14 2023/11/21 22:17:15 tb Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
  *
@@ -63,8 +63,7 @@ EC_POINT_point2bn(const EC_GROUP *group, const EC_POINT *point,
 	size_t buf_len = 0;
 	unsigned char *buf;
 
-	buf_len = EC_POINT_point2oct(group, point, form,
+	buf_len = EC_POINT_point2oct(group, point, form, NULL, 0, ctx);
-	    NULL, 0, ctx);
 	if (buf_len == 0)
 		return NULL;
 

lib/libcrypto/ec/eck_prn.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: eck_prn.c,v 1.28 2023/07/07 13:54:45 beck Exp $ */
+/* $OpenBSD: eck_prn.c,v 1.30 2023/11/21 22:05:33 tb Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -160,10 +160,6 @@ ECParameters_print(BIO *bp, const EC_KEY *x)
 }
 LCRYPTO_ALIAS(ECParameters_print);
 
-static int
-print_bin(BIO *fp, const char *str, const unsigned char *num,
-    size_t len, int off);
-
 static int
 ecpk_print_asn1_parameters(BIO *bp, const EC_GROUP *group, int off)
 {
@@ -289,8 +285,33 @@ ecpk_print_explicit_parameters(BIO *bp, const EC_GROUP *group, int off)
 	if (!bn_printf(bp, cofactor, off, "Cofactor: "))
 		goto err;
 	if ((seed = EC_GROUP_get0_seed(group)) != NULL) {
+		size_t i;
+
 		seed_len = EC_GROUP_get_seed_len(group);
-		if (!print_bin(bp, "Seed:", seed, seed_len, off))
+
+		/* XXX - ecx_buf_print() has a CBS version of this - dedup. */
+		if (!BIO_indent(bp, off, 128))
+			goto err;
+		if (BIO_printf(bp, "Seed:") <= 0)
+			goto err;
+
+		for (i = 0; i < seed_len; i++) {
+			const char *sep = ":";
+
+			if (i % 15 == 0) {
+				if (BIO_printf(bp, "\n") <= 0)
+					goto err;
+				if (!BIO_indent(bp, off + 4, 128))
+					goto err;
+			}
+
+			if (i + 1 == seed_len)
+				sep = "";
+			if (BIO_printf(bp, "%02x%s", seed[i], sep) <= 0)
+				goto err;
+		}
+
+		if (BIO_printf(bp, "\n") <= 0)
 			goto err;
 	}
 
@@ -316,38 +337,3 @@ ECPKParameters_print(BIO *bp, const EC_GROUP *group, int off)
 	return ecpk_print_explicit_parameters(bp, group, off);
 }
 LCRYPTO_ALIAS(ECPKParameters_print);
-
-static int
-print_bin(BIO *fp, const char *name, const unsigned char *buf,
-    size_t len, int off)
-{
-	size_t i;
-	char str[128];
-
-	if (buf == NULL)
-		return 1;
-	if (off) {
-		if (off > 128)
-			off = 128;
-		memset(str, ' ', off);
-		if (BIO_write(fp, str, off) <= 0)
-			return 0;
-	}
-	if (BIO_printf(fp, "%s", name) <= 0)
-		return 0;
-
-	for (i = 0; i < len; i++) {
-		if ((i % 15) == 0) {
-			str[0] = '\n';
-			memset(&(str[1]), ' ', off + 4);
-			if (BIO_write(fp, str, off + 1 + 4) <= 0)
-				return 0;
-		}
-		if (BIO_printf(fp, "%02x%s", buf[i], ((i + 1) == len) ? "" : ":") <= 0)
-			return 0;
-	}
-	if (BIO_write(fp, "\n", 1) <= 0)
-		return 0;
-
-	return 1;
-}

lib/libssl/Makefile

@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.80 2023/07/06 07:56:32 beck Exp $
+# $OpenBSD: Makefile,v 1.81 2023/11/22 15:55:28 tb Exp $
 
 .include <bsd.own.mk>
 .ifndef NOMAN
@@ -44,7 +44,6 @@ SRCS= \
 	pqueue.c \
 	s3_cbc.c \
 	s3_lib.c \
-	ssl_algs.c \
 	ssl_asn1.c \
 	ssl_both.c \
 	ssl_cert.c \

lib/libssl/ssl.h

@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl.h,v 1.231 2023/11/19 15:51:49 tb Exp $ */
+/* $OpenBSD: ssl.h,v 1.232 2023/11/22 15:43:42 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1395,8 +1395,6 @@ void SSL_set_accept_state(SSL *s);
 
 long SSL_get_default_timeout(const SSL *s);
 
-int SSL_library_init(void );
-
 char *SSL_CIPHER_description(const SSL_CIPHER *, char *buf, int size);
 STACK_OF(X509_NAME) *SSL_dup_CA_list(const STACK_OF(X509_NAME) *sk);
 
@@ -2352,6 +2350,7 @@ void ERR_load_SSL_strings(void);
 #define OPENSSL_INIT_SSL_DEFAULT	_OPENSSL_INIT_FLAG_NOOP
 
 int OPENSSL_init_ssl(uint64_t opts, const void *settings);
+int SSL_library_init(void);
 
 #ifdef  __cplusplus
 }

lib/libssl/ssl_algs.c

@@ -1,125 +0,0 @@
-/* $OpenBSD: ssl_algs.c,v 1.32 2023/07/08 16:40:13 beck Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/lhash.h>
-#include <openssl/objects.h>
-#include <openssl/opensslconf.h>
-
-#include "ssl_local.h"
-
-int
-SSL_library_init(void)
-{
-
-#ifndef OPENSSL_NO_DES
-	EVP_add_cipher(EVP_des_cbc());
-	EVP_add_cipher(EVP_des_ede3_cbc());
-#endif
-#ifndef OPENSSL_NO_RC4
-	EVP_add_cipher(EVP_rc4());
-#if !defined(OPENSSL_NO_MD5) && (defined(__x86_64) || defined(__x86_64__))
-	EVP_add_cipher(EVP_rc4_hmac_md5());
-#endif
-#endif
-#ifndef OPENSSL_NO_RC2
-	EVP_add_cipher(EVP_rc2_cbc());
-	/* Not actually used for SSL/TLS but this makes PKCS#12 work
-	 * if an application only calls SSL_library_init().
-	 */
-	EVP_add_cipher(EVP_rc2_40_cbc());
-#endif
-	EVP_add_cipher(EVP_aes_128_cbc());
-	EVP_add_cipher(EVP_aes_192_cbc());
-	EVP_add_cipher(EVP_aes_256_cbc());
-	EVP_add_cipher(EVP_aes_128_gcm());
-	EVP_add_cipher(EVP_aes_256_gcm());
-	EVP_add_cipher(EVP_aes_128_cbc_hmac_sha1());
-	EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1());
-#ifndef OPENSSL_NO_CAMELLIA
-	EVP_add_cipher(EVP_camellia_128_cbc());
-	EVP_add_cipher(EVP_camellia_256_cbc());
-#endif
-#ifndef OPENSSL_NO_GOST
-	EVP_add_cipher(EVP_gost2814789_cfb64());
-	EVP_add_cipher(EVP_gost2814789_cnt());
-#endif
-
-	EVP_add_digest(EVP_md5());
-	EVP_add_digest(EVP_md5_sha1());
-	EVP_add_digest_alias(SN_md5, "ssl2-md5");
-	EVP_add_digest_alias(SN_md5, "ssl3-md5");
-
-	EVP_add_digest(EVP_sha1()); /* RSA with sha1 */
-	EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
-	EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
-	EVP_add_digest(EVP_sha224());
-	EVP_add_digest(EVP_sha256());
-	EVP_add_digest(EVP_sha384());
-	EVP_add_digest(EVP_sha512());
-#ifndef OPENSSL_NO_GOST
-	EVP_add_digest(EVP_gostr341194());
-	EVP_add_digest(EVP_gost2814789imit());
-	EVP_add_digest(EVP_streebog256());
-	EVP_add_digest(EVP_streebog512());
-#endif
-
-	return (1);
-}
-LSSL_ALIAS(SSL_library_init);

lib/libssl/ssl_init.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_init.c,v 1.4 2023/07/08 16:40:13 beck Exp $ */
+/* $OpenBSD: ssl_init.c,v 1.6 2023/11/22 15:53:53 tb Exp $ */
 /*
  * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
  *
@@ -26,12 +26,18 @@
 
 static pthread_t ssl_init_thread;
 
+int
+SSL_library_init(void)
+{
+	return OPENSSL_init_ssl(0, NULL);
+}
+LSSL_ALIAS(SSL_library_init);
+
 static void
 OPENSSL_init_ssl_internal(void)
 {
 	ssl_init_thread = pthread_self();
 	SSL_load_error_strings();
-	SSL_library_init();
 }
 
 int

lib/libtls/tls_verify.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_verify.c,v 1.28 2023/06/01 07:32:25 tb Exp $ */
+/* $OpenBSD: tls_verify.c,v 1.29 2023/11/22 18:23:09 op Exp $ */
 /*
  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
  *
@@ -244,7 +244,7 @@ tls_check_common_name(struct tls *ctx, X509 *cert, const char *name,
 		 * certificate as hostile.
 		 */
 		tls_set_errorx(ctx, "error verifying name '%s': "
-		    "Certificate subject contains mutiple Common Name fields, "
+		    "Certificate subject contains multiple Common Name fields, "
 		    "probably a malicious or malformed certificate", name);
 		goto err;
 	}

libexec/snmpd/snmpd_metrics/mib.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: mib.c,v 1.6 2023/10/24 18:27:26 martijn Exp $	*/
+/*	$OpenBSD: mib.c,v 1.7 2023/11/21 08:49:08 martijn Exp $	*/
 
 /*
  * Copyright (c) 2022 Martijn van Duren <martijn@openbsd.org>
@@ -3270,7 +3270,11 @@ main(int argc, char *argv[])
 		switch (ch) {
 		case 'C':
 			if (strcmp(optarg, "filter-routes") == 0) {
-				conf.sc_rtfilter = 1;
+				conf.sc_rtfilter = ROUTE_FILTER(RTM_NEWADDR) |
+				    ROUTE_FILTER(RTM_DELADDR) |
+				    ROUTE_FILTER(RTM_IFINFO) |
+				    ROUTE_FILTER(RTM_IFANNOUNCE);
+
 			}
 			break;
 		case 'c':

sys/arch/amd64/amd64/cpu.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: cpu.c,v 1.176 2023/10/24 13:20:09 claudio Exp $	*/
+/*	$OpenBSD: cpu.c,v 1.177 2023/11/22 18:50:10 bluhm Exp $	*/
 /* $NetBSD: cpu.c,v 1.1 2003/04/26 18:39:26 fvdl Exp $ */
 
 /*-
@@ -1023,10 +1023,11 @@ cpu_hatch(void *v)
 
 		identifycpu(ci);
 
-		/* Signal we're done */
-		atomic_clearbits_int(&ci->ci_flags, CPUF_IDENTIFY);
 		/* Prevent identifycpu() from running again */
 		atomic_setbits_int(&ci->ci_flags, CPUF_IDENTIFIED);
+
+		/* Signal we're done */
+		atomic_clearbits_int(&ci->ci_flags, CPUF_IDENTIFY);
 	}
 
 	/* These have to run after identifycpu() */

sys/conf/files

@@ -1,4 +1,4 @@
-#	$OpenBSD: files,v 1.725 2023/08/07 01:59:38 dlg Exp $
+#	$OpenBSD: files,v 1.726 2023/11/21 14:00:13 bluhm Exp $
 #	$NetBSD: files,v 1.87 1996/05/19 17:17:50 jonathan Exp $
 
 #	@(#)files.newconf	7.5 (Berkeley) 5/10/93
@@ -752,7 +752,7 @@ file kern/subr_xxx.c
 file kern/sys_futex.c
 file kern/sys_generic.c
 file kern/sys_pipe.c
-file kern/sys_process.c			ptrace
+file kern/sys_process.c			ptrace | dt
 file kern/sys_socket.c
 file kern/syscalls.c			syscall_debug
 file kern/sysv_ipc.c			sysvshm | sysvsem | sysvmsg

sys/dev/hid/hidkbd.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: hidkbd.c,v 1.9 2023/07/09 08:02:13 tobhe Exp $	*/
+/*	$OpenBSD: hidkbd.c,v 1.10 2023/11/22 18:19:25 tobhe Exp $	*/
 /*      $NetBSD: ukbd.c,v 1.85 2003/03/11 16:44:00 augustss Exp $        */
 
 /*
@@ -143,6 +143,9 @@ static const struct hidkbd_translation apple_fn_trans[] = {
 	{ 60, 127 },	/* F3 -> audio mute */
 	{ 61, 129 },	/* F4 -> audio lower */
 	{ 62, 128 },	/* F5 -> audio raise */
+	{ 65, 234 },	/* F8 -> backlight toggle */
+	{ 66, 236 },	/* F9 -> backlight lower */
+	{ 67, 235 },	/* F10 -> backlight raise */
 #else
 	{ 63, 102 },	/* F6 -> sleep */
 	{ 67, 127 },	/* F10 -> audio mute */
@@ -569,6 +572,9 @@ hidkbd_decode(struct hidkbd *kbd, struct hidkbd_data *ud)
 			case 129:
 			case 232:
 			case 233:
+			case 234:
+			case 235:
+			case 236:
 				wskbd_input(kbd->sc_wskbddev,
 				    key & RELEASE ?  WSCONS_EVENT_KEY_UP :
 				      WSCONS_EVENT_KEY_DOWN, key & CODEMASK);

sys/dev/usb/makemap.awk

@@ -1,5 +1,5 @@
 #! /usr/bin/awk -f
-#	$OpenBSD: makemap.awk,v 1.16 2023/07/09 08:02:13 tobhe Exp $
+#	$OpenBSD: makemap.awk,v 1.17 2023/11/22 18:19:25 tobhe Exp $
 #
 # Copyright (c) 2005, Miodrag Vallat
 #
@@ -31,7 +31,7 @@
 #
 
 BEGIN {
-	rcsid = "$OpenBSD: makemap.awk,v 1.16 2023/07/09 08:02:13 tobhe Exp $"
+	rcsid = "$OpenBSD: makemap.awk,v 1.17 2023/11/22 18:19:25 tobhe Exp $"
 	ifdepth = 0
 	ignore = 0
 	declk = 0
@@ -343,6 +343,9 @@ $1 == "#define" || $1 == "#undef" {
 			lines[126] = "    KC(126),\tKS_Find,"
 			lines[232] = "    KC(232),\tKS_Cmd_BrightnessUp,"
 			lines[233] = "    KC(233),\tKS_Cmd_BrightnessDown,"
+			lines[234] = "    KC(234),\tKS_Cmd_KbdBacklightToggle,"
+			lines[235] = "    KC(235),\tKS_Cmd_KbdBacklightUp,"
+			lines[236] = "    KC(236),\tKS_Cmd_KbdBacklightDown,"
 		}
 
 		for (i = 0; i < 256; i++)

sys/dev/usb/ukbdmap.c

@@ -1,10 +1,10 @@
-/*	$OpenBSD: ukbdmap.c,v 1.48 2023/07/09 08:04:09 tobhe Exp $	*/
+/*	$OpenBSD: ukbdmap.c,v 1.49 2023/11/22 18:22:53 tobhe Exp $	*/
 
 /*
  * THIS FILE IS AUTOMAGICALLY GENERATED.  DO NOT EDIT.
  *
  * generated by:
- *	OpenBSD: makemap.awk,v 1.16 2023/07/09 08:02:13 tobhe Exp 
+ *	OpenBSD: makemap.awk,v 1.17 2023/11/22 18:19:25 tobhe Exp 
  * generated from:
  */
 /*	OpenBSD: wskbdmap_mfii.c,v 1.48 2023/01/23 09:36:40 nicm Exp  */
@@ -187,6 +187,9 @@ static const keysym_t ukbd_keydesc_us[] = {
     KC(231),	KS_Meta_R,
     KC(232),	KS_Cmd_BrightnessUp,
     KC(233),	KS_Cmd_BrightnessDown,
+    KC(234),	KS_Cmd_KbdBacklightToggle,
+    KC(235),	KS_Cmd_KbdBacklightUp,
+    KC(236),	KS_Cmd_KbdBacklightDown,
 };
 
 #if !defined(WSKBD_NO_INTL_LAYOUTS)

sys/dev/wscons/wskbd.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: wskbd.c,v 1.115 2023/07/09 08:02:14 tobhe Exp $ */
+/* $OpenBSD: wskbd.c,v 1.116 2023/11/22 18:19:25 tobhe Exp $ */
 /* $NetBSD: wskbd.c,v 1.80 2005/05/04 01:52:16 augustss Exp $ */
 
 /*
@@ -177,12 +177,21 @@ struct wskbd_softc {
 #if NAUDIO > 0
 	void	*sc_audiocookie;
 #endif
+	struct task sc_kbd_backlight_task;
+	u_int	sc_kbd_backlight_cmd;
 #if NWSDISPLAY > 0
 	struct task sc_brightness_task;
 	int	sc_brightness_steps;
 #endif
 };
 
+enum wskbd_kbd_backlight_cmds {
+	KBD_BACKLIGHT_NONE,
+	KBD_BACKLIGHT_UP,
+	KBD_BACKLIGHT_DOWN,
+	KBD_BACKLIGHT_TOGGLE,
+};
+
 #define MOD_SHIFT_L		(1 << 0)
 #define MOD_SHIFT_R		(1 << 1)
 #define MOD_SHIFTLOCK		(1 << 2)
@@ -249,6 +258,8 @@ void	wskbd_set_keymap(struct wskbd_softc *, struct wscons_keymap *, int);
 
 int	(*wskbd_get_backlight)(struct wskbd_backlight *);
 int	(*wskbd_set_backlight)(struct wskbd_backlight *);
+
+void	wskbd_kbd_backlight_task(void *);
 #if NWSDISPLAY > 0
 void	wskbd_brightness_task(void *);
 #endif
@@ -406,6 +417,7 @@ wskbd_attach(struct device *parent, struct device *self, void *aux)
 		bcopy(ap->keymap, &sc->id->t_keymap, sizeof(sc->id->t_keymap));
 	}
 
+	task_set(&sc->sc_kbd_backlight_task, wskbd_kbd_backlight_task, sc);
 #if NWSDISPLAY > 0
 	timeout_set(&sc->sc_repeat_ch, wskbd_repeat, sc);
 	task_set(&sc->sc_brightness_task, wskbd_brightness_task, sc);
@@ -1544,6 +1556,21 @@ internal_command(struct wskbd_softc *sc, u_int *type, keysym_t ksym,
 #endif
 #endif
 
+	switch (ksym) {
+	case KS_Cmd_KbdBacklightUp:
+		atomic_store_int(&sc->sc_kbd_backlight_cmd, KBD_BACKLIGHT_UP);
+		task_add(systq, &sc->sc_kbd_backlight_task);
+		return (1);
+	case KS_Cmd_KbdBacklightDown:
+		atomic_store_int(&sc->sc_kbd_backlight_cmd, KBD_BACKLIGHT_DOWN);
+		task_add(systq, &sc->sc_kbd_backlight_task);
+		return (1);
+	case KS_Cmd_KbdBacklightToggle:
+		atomic_store_int(&sc->sc_kbd_backlight_cmd, KBD_BACKLIGHT_TOGGLE);
+		task_add(systq, &sc->sc_kbd_backlight_task);
+		return (1);
+	}
+
 #if NWSDISPLAY > 0
 	switch(ksym) {
 	case KS_Cmd_BrightnessUp:
@@ -1899,6 +1926,32 @@ wskbd_set_keymap(struct wskbd_softc *sc, struct wscons_keymap *map, int maplen)
 	sc->sc_maplen = maplen;
 }
 
+void
+wskbd_kbd_backlight_task(void *arg)
+{
+	struct wskbd_softc *sc = arg;
+	struct wskbd_backlight data;
+	int step, val;
+	u_int cmd;
+
+	if (wskbd_get_backlight == NULL || wskbd_set_backlight == NULL)
+		return;
+
+	cmd  = atomic_swap_uint(&sc->sc_kbd_backlight_cmd, 0);
+	if (cmd != KBD_BACKLIGHT_UP &&
+	    cmd != KBD_BACKLIGHT_DOWN &&
+	    cmd != KBD_BACKLIGHT_TOGGLE)
+		return;
+
+	(*wskbd_get_backlight)(&data);
+	step = (data.max - data.min + 1) / 8;
+	val = (cmd == KBD_BACKLIGHT_UP) ?  data.curval + step :
+	    (cmd == KBD_BACKLIGHT_DOWN) ?  data.curval - step :
+	    (data.curval) ?  0 : (data.max - data.min + 1) / 2;
+	data.curval = (val > 0xff) ?  0xff : (val < 0) ? 0 : val;
+	(*wskbd_set_backlight)(&data);
+}
+
 #if NWSDISPLAY > 0
 void
 wskbd_brightness_task(void *arg)

sys/dev/wscons/wsksymdef.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: wsksymdef.h,v 1.41 2023/07/09 08:02:14 tobhe Exp $	*/
+/*	$OpenBSD: wsksymdef.h,v 1.42 2023/11/22 18:19:25 tobhe Exp $	*/
 /*	$NetBSD: wsksymdef.h,v 1.34.4.1 2000/07/07 09:49:54 hannken Exp $ */
 
 /*-
@@ -668,6 +668,9 @@
 #define KS_Cmd_ScrollFwd	0xf42d
 #define KS_Cmd_KbdReset		0xf42e
 #define KS_Cmd_Sleep		0xf42f
+#define KS_Cmd_KbdBacklightToggle		0xf430
+#define KS_Cmd_KbdBacklightUp		0xf431
+#define KS_Cmd_KbdBacklightDown		0xf432
 
 /*
  * Group 5 (internal)

sys/kern/sys_process.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: sys_process.c,v 1.94 2023/06/10 19:30:48 kettenis Exp $	*/
+/*	$OpenBSD: sys_process.c,v 1.95 2023/11/21 14:00:13 bluhm Exp $	*/
 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
 
 /*-
@@ -818,6 +818,7 @@ process_checktracestate(struct process *curpr, struct process *tr,
 	return 0;
 }
 
+#endif /* PTRACE */
 
 /*
  * Check if a process is allowed to fiddle with the memory of another.
@@ -886,4 +887,3 @@ process_domem(struct proc *curp, struct process *tr, struct uio *uio, int req)
 
 	return error;
 }
-#endif

usr.bin/awk/FIXES

@@ -25,6 +25,18 @@ THIS SOFTWARE.
 This file lists all bug fixes, changes, etc., made since the 
 second edition of the AWK book was published in September 2023.
 
+Nov 20, 2023
+	rewrite of fnematch to fix a number of issues, including
+	extraneous output, out-of-bounds access, number of bytes
+	to push back after a failed match etc.
+	thanks to Miguel Pineiro Jr.
+
+Nov 15, 2023
+	Man page edit, regression test fixes. thanks to Arnold Robbins
+	consolidation of sub and gsub into dosub, removing duplicate
+	code. thanks to Miguel Pineiro Jr.
+	gcc replaced with cc everywhere.
+
 Oct 30, 2023:
 	multiple fixes and a minor code cleanup.
 	disabled utf-8 for non-multibyte locales, such as C or POSIX.

usr.bin/awk/b.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: b.c,v 1.47 2023/11/15 18:56:53 millert Exp $	*/
+/*	$OpenBSD: b.c,v 1.48 2023/11/22 01:01:21 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -770,59 +770,6 @@ int nematch(fa *f, const char *p0)	/* non-empty match, for sub */
 
 #define MAX_UTF_BYTES	4	// UTF-8 is up to 4 bytes long
 
-// Read one rune at a time from the given FILE*. Return both
-// the bytes and the actual rune.
-
-struct runedata {
-	int rune;
-	size_t len;
-	char bytes[6];
-};
-
-struct runedata getrune(FILE *fp)
-{
-	struct runedata result;
-	int c, i, next;
-
-	memset(&result, 0, sizeof(result));
-
-	c = getc(fp);
-	if (c == EOF)
-		return result;	// result.rune == 0 --> EOF
-	else if (c < 128 || awk_mb_cur_max == 1) {
-		result.bytes[0] = c;
-		result.len = 1;
-		result.rune = c;
-
-		return result;
-	}
-
-	// need to get bytes and fill things in
-	result.bytes[0] = c;
-	result.len = 1;
-
-	next = 1;
-	for (i = 1; i < MAX_UTF_BYTES; i++) {
-		c = getc(fp);
-		if (c == EOF)
-			break;
-		result.bytes[next++] = c;
-		result.len++;
-	}
-
-	// put back any extra input bytes
-	int actual_len = u8_nextlen(result.bytes);
-	while (result.len > actual_len) {
-		ungetc(result.bytes[--result.len], fp);
-	}
-
-	result.bytes[result.len] = '\0';
-	(void) u8_rune(& result.rune, (uschar *) result.bytes);
-
-	return result;
-}
-
-
 /*
  * NAME
  *     fnematch
@@ -840,60 +787,76 @@ struct runedata getrune(FILE *fp)
 
 bool fnematch(fa *pfa, FILE *f, char **pbuf, int *pbufsize, int quantum)
 {
-	char *buf = *pbuf;
+	char *i, *j, *k, *buf = *pbuf;
 	int bufsize = *pbufsize;
-	int i, j, k, ns, s;
+	int c, n, ns, s;
-	struct runedata r;
 
 	s = pfa->initstat;
 	patlen = 0;
 
 	/*
-	 * All indices relative to buf.
+	 * buf <= i <= j <= k <= buf+bufsize
-	 * i <= j <= k <= bufsize
 	 *
-	 * i: origin of active substring (first byte of first character)
+	 * i: origin of active substring
-	 * j: current character		(last byte of current character)
+	 * j: current character
-	 * k: destination of next getc()
+	 * k: destination of the next getc
 	 */
-	i = -1, k = 0;
-        do {
-		j = i++;
-		do {
-			r = getrune(f);
-			if (r.len == 0) {
-				r.len = 1;	// store NUL byte for EOF
-			}
-			j += r.len;
-			if (j >= bufsize) {
-				if (!adjbuf(&buf, &bufsize, j+1, quantum, 0, "fnematch"))
-					FATAL("stream '%.30s...' too long", buf);
-			}
-			memcpy(buf + k, r.bytes, r.len);
-			k += r.len;
 
-			if ((ns = get_gototab(pfa, s, r.rune)) != 0)
+	i = j = k = buf;
+
+	do {
+		/*
+		 * Call u8_rune with at least MAX_UTF_BYTES ahead in
+		 * the buffer until EOF interferes.
+		 */
+		if (k - j < MAX_UTF_BYTES) {
+			if (k + MAX_UTF_BYTES > buf + bufsize) {
+				adjbuf(&buf, &bufsize,
+				    bufsize + MAX_UTF_BYTES,
+				    quantum, 0, "fnematch");
+			}
+			for (n = MAX_UTF_BYTES ; n > 0; n--) {
+				*k++ = (c = getc(f)) != EOF ? c : 0;
+				if (c == EOF) {
+					if (ferror(f))
+						FATAL("fnematch: getc error");
+					break;
+				}
+			}
+		}
+
+		j += u8_rune(&c, (uschar *)j);
+
+		if ((ns = get_gototab(pfa, s, c)) != 0)
 			s = ns;
 		else
-				s = cgoto(pfa, s, r.rune);
+			s = cgoto(pfa, s, c);
 
 		if (pfa->out[s]) {	/* final state */
-				patlen = j - i + 1;
+			patbeg = i;
-				if (r.rune == 0)	/* don't count $ */
+			patlen = j - i;
+			if (c == 0)	/* don't count $ */
 				patlen--;
 		}
-		} while (buf[j] && s != 1);
+
+		if (c && s != 1)
+			continue;  /* origin i still viable, next j */
+		if (patlen)
+			break;     /* best match found */
+
+		/* no match at origin i, next i and start over */
+		i += u8_rune(&c, (uschar *)i);
+		if (c == 0)
+			break;    /* no match */
+		j = i;
 		s = 2;
-		if (r.len > 1)
+	} while (1);
-			i += r.len - 1;	// i incremented around the loop
-	} while (buf[i] && !patlen);
 
 	/* adjbuf() may have relocated a resized buffer. Inform the world. */
 	*pbuf = buf;
 	*pbufsize = bufsize;
 
 	if (patlen) {
-		patbeg = buf + i;
 		/*
 		 * Under no circumstances is the last character fed to
 		 * the automaton part of the match. It is EOF's nullbyte,
@@ -905,10 +868,11 @@ bool fnematch(fa *pfa, FILE *f, char **pbuf, int *pbufsize, int quantum)
 		 * (except for EOF's nullbyte, if present) and null
 		 * terminate the buffer.
 		 */
-		for (; r.len > 0; r.len--)
+		do
-			if (buf[--k] && ungetc(buf[k], f) == EOF)
+			if (*--k && ungetc(*k, f) == EOF)
-				FATAL("unable to ungetc '%c'", buf[k]);
+				FATAL("unable to ungetc '%c'", *k);
-		buf[k-patlen] = '\0';
+		while (k > patbeg + patlen);
+		*k = '\0';
 		return true;
 	}
 	else

usr.bin/awk/main.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.64 2023/10/31 01:08:51 millert Exp $	*/
+/*	$OpenBSD: main.c,v 1.65 2023/11/22 01:01:21 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -23,7 +23,7 @@ ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
 THIS SOFTWARE.
 ****************************************************************/
 
-const char	*version = "version 20231030";
+const char	*version = "version 20231120";
 
 #define DEBUG
 #include <stdio.h>

usr.bin/awk/maketab.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: maketab.c,v 1.21 2023/10/30 17:52:54 millert Exp $	*/
+/*	$OpenBSD: maketab.c,v 1.22 2023/11/22 01:01:21 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -53,8 +53,8 @@ struct xx
 	{ ARRAY, "array", NULL },
 	{ INDIRECT, "indirect", "$(" },
 	{ SUBSTR, "substr", "substr" },
-	{ SUB, "sub", "sub" },
+	{ SUB, "dosub", "sub" },
-	{ GSUB, "gsub", "gsub" },
+	{ GSUB, "dosub", "gsub" },
 	{ INDEX, "sindex", "sindex" },
 	{ SPRINTF, "awksprintf", "sprintf " },
 	{ ADD, "arith", " + " },

usr.bin/awk/proto.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: proto.h,v 1.22 2023/09/17 14:49:44 millert Exp $	*/
+/*	$OpenBSD: proto.h,v 1.23 2023/11/22 01:01:21 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -199,8 +199,7 @@ extern	FILE	*openfile(int, const char *, bool *);
 extern	const char	*filename(FILE *);
 extern	Cell	*closefile(Node **, int);
 extern	void	closeall(void);
-extern	Cell	*sub(Node **, int);
+extern	Cell	*dosub(Node **, int);
-extern	Cell	*gsub(Node **, int);
 extern	Cell	*gensub(Node **, int);
 
 extern	FILE	*popen(const char *, const char *);

usr.bin/awk/run.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: run.c,v 1.80 2023/10/28 22:38:22 millert Exp $	*/
+/*	$OpenBSD: run.c,v 1.81 2023/11/22 01:01:21 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -2518,169 +2518,143 @@ static void flush_all(void)
 
 void backsub(char **pb_ptr, const char **sptr_ptr);
 
-Cell *sub(Node **a, int nnn)	/* substitute command */
+Cell *dosub(Node **a, int subop)        /* sub and gsub */
 {
-	const char *sptr, *q;
-	Cell *x, *y, *result;
-	char *t, *buf, *pb;
 	fa *pfa;
+	int tempstat;
+	char *repl;
+	Cell *x;
+
+	char *buf = NULL;
+	char *pb = NULL;
 	int bufsz = recsize;
 
-	if ((buf = (char *) malloc(bufsz)) == NULL)
+	const char *r, *s;
-		FATAL("out of memory in sub");
+	const char *start;
-	x = execute(a[3]);	/* target string */
+	const char *noempty = NULL;      /* empty match disallowed here */
-	t = getsval(x);
+	size_t m = 0;                    /* match count */
-	if (a[0] == NULL)	/* 0 => a[1] is already-compiled regexpr */
+	size_t whichm;                   /* which match to select, 0 = global */
-		pfa = (fa *) a[1];	/* regular expression */
+	int mtype;                       /* match type */
-	else {
+
-		y = execute(a[1]);
+	if (a[0] == NULL) {	/* 0 => a[1] is already-compiled regexpr */
-		pfa = makedfa(getsval(y), 1);
+		pfa = (fa *) a[1];
-		tempfree(y);
+	} else {
-	}
+		x = execute(a[1]);
-	y = execute(a[2]);	/* replacement string */
+		pfa = makedfa(getsval(x), 1);
-	result = False;
-	if (pmatch(pfa, t)) {
-		sptr = t;
-		adjbuf(&buf, &bufsz, 1+patbeg-sptr, recsize, 0, "sub");
-		pb = buf;
-		while (sptr < patbeg)
-			*pb++ = *sptr++;
-		sptr = getsval(y);
-		while (*sptr != '\0') {
-			adjbuf(&buf, &bufsz, 5+pb-buf, recsize, &pb, "sub");
-			if (*sptr == '\\') {
-				backsub(&pb, &sptr);
-			} else if (*sptr == '&') {
-				sptr++;
-				adjbuf(&buf, &bufsz, 1+patlen+pb-buf, recsize, &pb, "sub");
-				for (q = patbeg; q < patbeg+patlen; )
-					*pb++ = *q++;
-			} else
-				*pb++ = *sptr++;
-		}
-		*pb = '\0';
-		if (pb > buf + bufsz)
-			FATAL("sub result1 %.30s too big; can't happen", buf);
-		sptr = patbeg + patlen;
-		if ((patlen == 0 && *patbeg) || (patlen && *(sptr-1))) {
-			adjbuf(&buf, &bufsz, 1+strlen(sptr)+pb-buf, 0, &pb, "sub");
-			while ((*pb++ = *sptr++) != '\0')
-				continue;
-		}
-		if (pb > buf + bufsz)
-			FATAL("sub result2 %.30s too big; can't happen", buf);
-		setsval(x, buf);	/* BUG: should be able to avoid copy */
-		result = True;
-	}
 		tempfree(x);
-	tempfree(y);
-	free(buf);
-	return result;
 	}
 
-Cell *gsub(Node **a, int nnn)	/* global substitute */
+	x = execute(a[2]);	/* replacement string */
-{
+	repl = tostring(getsval(x));
-	Cell *x, *y;
+	tempfree(x);
-	char *rptr, *pb;
-	const char *q, *t, *sptr;
-	char *buf;
-	fa *pfa;
-	int mflag, tempstat, num;
-	int bufsz = recsize;
-	int charlen = 0;
 
-	if ((buf = (char *) malloc(bufsz)) == NULL)
+	switch (subop) {
-		FATAL("out of memory in gsub");
+	case SUB:
-	mflag = 0;	/* if mflag == 0, can replace empty string */
+		whichm = 1;
-	num = 0;
+		x = execute(a[3]);    /* source string */
-	x = execute(a[3]);	/* target string */
+		break;
-	t = getsval(x);
+	case GSUB:
-	if (a[0] == NULL)	/* 0 => a[1] is already-compiled regexpr */
+		whichm = 0;
-		pfa = (fa *) a[1];	/* regular expression */
+		x = execute(a[3]);    /* source string */
-	else {
+		break;
-		y = execute(a[1]);
+	default:
-		pfa = makedfa(getsval(y), 1);
+		FATAL("dosub: unrecognized subop: %d", subop);
-		tempfree(y);
 	}
-	y = execute(a[2]);	/* replacement string */
+
-	if (pmatch(pfa, t)) {
+	start = getsval(x);
+	while (pmatch(pfa, start)) {
+		if (buf == NULL) {
+			if ((pb = buf = malloc(bufsz)) == NULL)
+				FATAL("out of memory in dosub");
 			tempstat = pfa->initstat;
 			pfa->initstat = 2;
-		pb = buf;
+		}
-		rptr = getsval(y);
+
-		do {
+		/* match types */
-			if (patlen == 0 && *patbeg != '\0') {	/* matched empty string */
+		#define	MT_IGNORE  0  /* unselected or invalid */
-				if (mflag == 0) {	/* can replace empty */
+		#define MT_INSERT  1  /* selected, empty */
-					num++;
+		#define MT_REPLACE 2  /* selected, not empty */
-					sptr = rptr;
+
-					while (*sptr != '\0') {
+		/* an empty match just after replacement is invalid */
-						adjbuf(&buf, &bufsz, 5+pb-buf, recsize, &pb, "gsub");
+
-						if (*sptr == '\\') {
+		if (patbeg == noempty && patlen == 0) {
-							backsub(&pb, &sptr);
+			mtype = MT_IGNORE;    /* invalid, not counted */
-						} else if (*sptr == '&') {
+		} else if (whichm == ++m || whichm == 0) {
-							sptr++;
+			mtype = patlen ? MT_REPLACE : MT_INSERT;
-							adjbuf(&buf, &bufsz, 1+patlen+pb-buf, recsize, &pb, "gsub");
+		} else {
-							for (q = patbeg; q < patbeg+patlen; )
+			mtype = MT_IGNORE;    /* unselected, but counted */
-								*pb++ = *q++;
+		}
-						} else
+
-							*pb++ = *sptr++;
+		/* leading text: */
+		if (patbeg > start) {
+			adjbuf(&buf, &bufsz, (pb - buf) + (patbeg - start),
+				recsize, &pb, "dosub");
+			s = start;
+			while (s < patbeg)
+				*pb++ = *s++;
+		}
+
+		if (mtype == MT_IGNORE)
+			goto matching_text;  /* skip replacement text */
+
+		r = repl;
+		while (*r != 0) {
+			adjbuf(&buf, &bufsz, 5+pb-buf, recsize, &pb, "dosub");
+			if (*r == '\\') {
+				backsub(&pb, &r);
+			} else if (*r == '&') {
+				r++;
+				adjbuf(&buf, &bufsz, 1+patlen+pb-buf, recsize,
+					&pb, "dosub");
+				for (s = patbeg; s < patbeg+patlen; )
+					*pb++ = *s++;
+			} else {
+				*pb++ = *r++;
 			}
 		}
-				if (*t == '\0')	/* at end */
+
-					goto done;
+matching_text:
-				adjbuf(&buf, &bufsz, 2+pb-buf, recsize, &pb, "gsub");
+		if (mtype == MT_REPLACE || *patbeg == '\0')
-				charlen = u8_nextlen(t);
+			goto next_search;  /* skip matching text */
-				while (charlen-- > 0)
+		
-					*pb++ = *t++;
+		if (patlen == 0)
-				if (pb > buf + bufsz)	/* BUG: not sure of this test */
+			patlen = u8_nextlen(patbeg);
-					FATAL("gsub result0 %.30s too big; can't happen", buf);
+		adjbuf(&buf, &bufsz, (pb-buf) + patlen, recsize, &pb, "dosub");
-				mflag = 0;
+		s = patbeg;
+		while (s < patbeg + patlen)
+			*pb++ = *s++;
+
+next_search:
+		start = patbeg + patlen;
+		if (m == whichm || *patbeg == '\0')
+			break;
+		if (mtype == MT_REPLACE)
+			noempty = start;
+
+		#undef MT_IGNORE
+		#undef MT_INSERT
+		#undef MT_REPLACE
 	}
-			else {	/* matched nonempty string */
+
-				num++;
+	xfree(repl);
-				sptr = t;
+
-				adjbuf(&buf, &bufsz, 1+(patbeg-sptr)+pb-buf, recsize, &pb, "gsub");
+	if (buf != NULL) {
-				while (sptr < patbeg)
-					*pb++ = *sptr++;
-				sptr = rptr;
-				while (*sptr != '\0') {
-					adjbuf(&buf, &bufsz, 5+pb-buf, recsize, &pb, "gsub");
-					if (*sptr == '\\') {
-						backsub(&pb, &sptr);
-					} else if (*sptr == '&') {
-						sptr++;
-						adjbuf(&buf, &bufsz, 1+patlen+pb-buf, recsize, &pb, "gsub");
-						for (q = patbeg; q < patbeg+patlen; )
-							*pb++ = *q++;
-					} else
-						*pb++ = *sptr++;
-				}
-				t = patbeg + patlen;
-				if (patlen == 0 || *t == '\0' || *(t-1) == '\0')
-					goto done;
-				if (pb > buf + bufsz)
-					FATAL("gsub result1 %.30s too big; can't happen", buf);
-				mflag = 1;
-			}
-		} while (pmatch(pfa,t));
-		sptr = t;
-		adjbuf(&buf, &bufsz, 1+strlen(sptr)+pb-buf, 0, &pb, "gsub");
-		while ((*pb++ = *sptr++) != '\0')
-			continue;
-	done:	if (pb < buf + bufsz)
-			*pb = '\0';
-		else if (*(pb-1) != '\0')
-			FATAL("gsub result2 %.30s truncated; can't happen", buf);
-		setsval(x, buf);	/* BUG: should be able to avoid copy + free */
 		pfa->initstat = tempstat;
+
+		/* trailing text */
+		adjbuf(&buf, &bufsz, 1+strlen(start)+pb-buf, 0, &pb, "dosub");
+		while ((*pb++ = *start++) != '\0')
+			;
+
+		setsval(x, buf);
+		free(buf);
 	}
+
 	tempfree(x);
-	tempfree(y);
 	x = gettemp();
 	x->tval = NUM;
-	x->fval = num;
+	x->fval = m;
-	free(buf);
+	return x;
-	return(x);
 }
 
 Cell *gensub(Node **a, int nnn)	/* global selective substitute */

usr.bin/ftp/main.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.139 2023/11/09 18:18:59 kn Exp $	*/
+/*	$OpenBSD: main.c,v 1.141 2023/11/22 02:20:54 kn Exp $	*/
 /*	$NetBSD: main.c,v 1.24 1997/08/18 10:20:26 lukem Exp $	*/
 
 /*
@@ -618,7 +618,7 @@ main(volatile int argc, char *argv[])
 			if (pipeout) {
 #ifndef SMALL
 			    if (!resume) {
-				if (pledge("stdio rpath dns tty inet proc exec fattr",
+				if (pledge("stdio rpath dns tty inet fattr",
 				    NULL) == -1)
 					err(1, "pledge");
 			    } else
@@ -640,7 +640,7 @@ main(volatile int argc, char *argv[])
 			}
 
 			rval = auto_fetch(argc, argv, outfile);
-			if (rval >= 0)		/* -1 == connected and cd-ed */
+			if (rval >= 0 || pipeout) /* -1 == connected and cd-ed */
 				exit(rval);
 		} else {
 #ifndef SMALL

usr.bin/openssl/apps.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: apps.c,v 1.66 2023/07/23 11:39:29 tb Exp $ */
+/* $OpenBSD: apps.c,v 1.67 2023/11/21 17:56:19 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -1716,7 +1716,7 @@ args_verify(char ***pargs, int *pargc, int *badarg, BIO *err,
 		}
 		(*pargs)++;
 	} else if (strcmp(arg, "-purpose") == 0) {
-		X509_PURPOSE *xptmp;
+		const X509_PURPOSE *xptmp;
 		if (!argn)
 			*badarg = 1;
 		else {

usr.bin/openssl/cms.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: cms.c,v 1.34 2023/04/14 15:27:13 tb Exp $ */
+/* $OpenBSD: cms.c,v 1.35 2023/11/21 17:56:19 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -1140,7 +1140,7 @@ cms_usage(void)
 
 	fprintf(stderr, "\nValid purposes:\n\n");
 	for (i = 0; i < X509_PURPOSE_get_count(); i++) {
-		X509_PURPOSE *ptmp = X509_PURPOSE_get0(i);
+		const X509_PURPOSE *ptmp = X509_PURPOSE_get0(i);
 		fprintf(stderr, "  %-18s%s\n", X509_PURPOSE_get0_sname(ptmp),
 		    X509_PURPOSE_get0_name(ptmp));
 	}

usr.bin/openssl/verify.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: verify.c,v 1.17 2023/04/14 15:27:13 tb Exp $ */
+/* $OpenBSD: verify.c,v 1.18 2023/11/21 17:56:19 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -251,7 +251,7 @@ verify_usage(void)
 
 	fprintf(stderr, "\nValid purposes:\n\n");
 	for (i = 0; i < X509_PURPOSE_get_count(); i++) {
-		X509_PURPOSE *ptmp = X509_PURPOSE_get0(i);
+		const X509_PURPOSE *ptmp = X509_PURPOSE_get0(i);
 		fprintf(stderr, "  %-18s%s\n", X509_PURPOSE_get0_sname(ptmp),
 		    X509_PURPOSE_get0_name(ptmp));
 	}

usr.bin/openssl/x509.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: x509.c,v 1.34 2023/11/13 11:50:36 tb Exp $ */
+/* $OpenBSD: x509.c,v 1.35 2023/11/21 17:56:19 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -86,7 +86,7 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
     X509 *x, X509 *xca, EVP_PKEY *pkey, STACK_OF(OPENSSL_STRING) *sigopts,
     char *serial, int create, int days, int clrext, CONF *conf, char *section,
     ASN1_INTEGER *sno);
-static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);
+static int purpose_print(BIO *bio, X509 *cert, const X509_PURPOSE *pt);
 
 static struct {
 	char *alias;
@@ -1022,7 +1022,7 @@ x509_main(int argc, char **argv)
 			}
 #endif
 			else if (cfg.pprint == i) {
-				X509_PURPOSE *ptmp;
+				const X509_PURPOSE *ptmp;
 				int j;
 
 				BIO_printf(STDout, "Certificate purposes:\n");
@@ -1534,10 +1534,10 @@ sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *digest,
 }
 
 static int
-purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt)
+purpose_print(BIO *bio, X509 *cert, const X509_PURPOSE *pt)
 {
 	int id, i, idret;
-	char *pname;
+	const char *pname;
 
 	id = X509_PURPOSE_get_id(pt);
 	pname = X509_PURPOSE_get0_name(pt);

usr.sbin/dhcpd/dhcp-options.5

@@ -1,4 +1,4 @@
-.\"	$OpenBSD: dhcp-options.5,v 1.32 2022/03/31 17:27:29 naddy Exp $
+.\"	$OpenBSD: dhcp-options.5,v 1.33 2023/11/22 18:06:44 florian Exp $
 .\"
 .\" Copyright (c) 1995, 1996, 1997, 1998 The Internet Software Consortium.
 .\" All rights reserved.
@@ -36,7 +36,7 @@
 .\" see ``http://www.isc.org/isc''.  To learn more about Vixie
 .\" Enterprises, see ``http://www.vix.com''.
 .\"
-.Dd $Mdocdate: March 31 2022 $
+.Dd $Mdocdate: November 22 2023 $
 .Dt DHCP-OPTIONS 5
 .Os
 .Sh NAME
@@ -346,6 +346,10 @@ This option specifies whether the client should configure its IP layer
 for packet forwarding.
 A value of 0 means disable IP forwarding, and a value of 1 means enable
 IP forwarding.
+.It Ic option ipv6-only-preferred Ar uint32 ;
+This option specifies that a NAT64 is available and the pool is IPv6-mostly
+capable.
+This option is specified in RFC 8925.
 .It Ic option irc-server Ar ip-address Oo , Ar ip-address ... Oc ;
 The
 .Ic irc-server

usr.sbin/dhcpd/tables.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: tables.c,v 1.14 2019/05/08 22:00:55 krw Exp $	*/
+/*	$OpenBSD: tables.c,v 1.15 2023/11/22 18:06:44 florian Exp $	*/
 
 /* Tables of information... */
 
@@ -184,7 +184,7 @@ struct option dhcp_options[256] = {
 	{ "option-105", "X",				&dhcp_universe, 105 },
 	{ "option-106", "X",				&dhcp_universe, 106 },
 	{ "option-107", "X",				&dhcp_universe, 107 },
-	{ "option-108", "X",				&dhcp_universe, 108 },
+	{ "ipv6-only-preferred", "L",			&dhcp_universe, 108 },
 	{ "option-109", "X",				&dhcp_universe, 109 },
 	{ "option-110", "X",				&dhcp_universe, 110 },
 	{ "option-111", "X",				&dhcp_universe, 111 },

usr.sbin/pkg_add/OpenBSD/PackingElement.pm

@@ -1,5 +1,5 @@
 # ex:ts=8 sw=4:
-# $OpenBSD: PackingElement.pm,v 1.289 2023/07/04 14:41:26 espie Exp $
+# $OpenBSD: PackingElement.pm,v 1.290 2023/11/22 11:18:37 espie Exp $
 #
 # Copyright (c) 2003-2014 Marc Espie <espie@openbsd.org>
 #
@@ -828,6 +828,8 @@ sub new($class, $args)
 		return OpenBSD::PackingElement::AlwaysUpdate->new_with_hash($1);
 	} elsif ($args eq 'always-update') {
 		return OpenBSD::PackingElement::AlwaysUpdate->new;
+	} elsif ($args eq 'updatedb') {
+		return OpenBSD::PackingElement::UpdateDB->new;
 	} elsif ($args eq 'is-branch') {
 		return OpenBSD::PackingElement::IsBranch->new;
 	} else {
@@ -867,6 +869,13 @@ package OpenBSD::PackingElement::Firmware;
 our @ISA=qw(OpenBSD::PackingElement::ManualInstallation);
 sub category($) { 'firmware' }
 
+package OpenBSD::PackingElement::UpdateDB;
+our @ISA=qw(OpenBSD::PackingElement::UniqueOption);
+sub category($)
+{
+	'updatedb';
+}
+
 package OpenBSD::PackingElement::AlwaysUpdate;
 our @ISA=qw(OpenBSD::PackingElement::UniqueOption);
 

usr.sbin/snmpd/parse.y

@@ -1,4 +1,4 @@
-/*	$OpenBSD: parse.y,v 1.82 2023/11/12 20:04:35 martijn Exp $	*/
+/*	$OpenBSD: parse.y,v 1.83 2023/11/21 08:47:04 martijn Exp $	*/
 
 /*
  * Copyright (c) 2007, 2008, 2012 Reyk Floeter <reyk@openbsd.org>
@@ -331,13 +331,7 @@ main		: LISTEN ON listen_udptcp
 			free($2);
 		}
 		| RTFILTER yesno		{
-			if ($2 == 1)
+			conf->sc_rtfilter = $2;
-				conf->sc_rtfilter = ROUTE_FILTER(RTM_NEWADDR) |
-				    ROUTE_FILTER(RTM_DELADDR) |
-				    ROUTE_FILTER(RTM_IFINFO) |
-				    ROUTE_FILTER(RTM_IFANNOUNCE);
-			else
-				conf->sc_rtfilter = 0;
 		}
 		| seclevel {
 			conf->sc_min_seclevel = $1;