From owner-svn-src-stable-9@FreeBSD.ORG Sun Apr 5 06:54:29 2015 Return-Path: Delivered-To: svn-src-stable-9@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 7D2B73D5; Sun, 5 Apr 2015 06:54:29 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 67DC8273; Sun, 5 Apr 2015 06:54:29 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t356sTcM047481; Sun, 5 Apr 2015 06:54:29 GMT (envelope-from mav@FreeBSD.org) Received: (from mav@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t356sTH0047480; Sun, 5 Apr 2015 06:54:29 GMT (envelope-from mav@FreeBSD.org) Message-Id: <201504050654.t356sTH0047480@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: mav set sender to mav@FreeBSD.org using -f From: Alexander Motin Date: Sun, 5 Apr 2015 06:54:29 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r281105 - stable/9/sys/cddl/contrib/opensolaris/uts/common/fs/zfs X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Apr 2015 06:54:29 -0000 Author: mav Date: Sun Apr 5 06:54:28 2015 New Revision: 281105 URL: https://svnweb.freebsd.org/changeset/base/281105 Log: MFC r280822: Some cosmetic polishing. No functional change. Modified: stable/9/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c Directory Properties: stable/9/ (props changed) stable/9/sys/ (props changed) stable/9/sys/cddl/contrib/opensolaris/ (props changed) Modified: stable/9/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c ============================================================================== --- stable/9/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c Sun Apr 5 06:53:29 2015 (r281104) +++ stable/9/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c Sun Apr 5 06:54:28 2015 (r281105) @@ -4027,10 +4027,10 @@ arc_init(void) #endif #endif /* sun */ /* set min cache to 1/32 of all memory, or 16MB, whichever is more */ - arc_c_min = MAX(arc_c / 4, 64<<18); + arc_c_min = MAX(arc_c / 4, 16 << 20); /* set max to 1/2 of all memory, or all but 1GB, whichever is more */ - if (arc_c * 8 >= 1<<30) - arc_c_max = (arc_c * 8) - (1<<30); + if (arc_c * 8 >= 1 << 30) + arc_c_max = (arc_c * 8) - (1 << 30); else arc_c_max = arc_c_min; arc_c_max = MAX(arc_c * 5, arc_c_max); @@ -4040,9 +4040,9 @@ arc_init(void) * Allow the tunables to override our calculations if they are * reasonable (ie. over 16MB) */ - if (zfs_arc_max > 64<<18 && zfs_arc_max < kmem_size()) + if (zfs_arc_max > 16 << 20 && zfs_arc_max < kmem_size()) arc_c_max = zfs_arc_max; - if (zfs_arc_min > 64<<18 && zfs_arc_min <= arc_c_max) + if (zfs_arc_min > 16 << 20 && zfs_arc_min <= arc_c_max) arc_c_min = zfs_arc_min; #endif From owner-svn-src-stable-9@FreeBSD.ORG Mon Apr 6 12:49:39 2015 Return-Path: Delivered-To: svn-src-stable-9@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 1033) id 77879EE1; Mon, 6 Apr 2015 12:49:39 +0000 (UTC) Date: Mon, 6 Apr 2015 12:49:39 +0000 From: Alexey Dokuchaev To: John Baldwin Subject: Re: svn commit: r280973 - in stable: 10/sys/amd64/amd64 10/sys/dev/acpica 10/sys/i386/i386 10/sys/kern 10/sys/sys 10/sys/x86/x86 9/sys/amd64/amd64 9/sys/dev/acpica 9/sys/i386/i386 9/sys/kern 9/sys/sys ... Message-ID: <20150406124939.GA48665@FreeBSD.org> References: <201504020102.t3212lTO021499@svn.freebsd.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <201504020102.t3212lTO021499@svn.freebsd.org> User-Agent: Mutt/1.5.23 (2014-03-12) Cc: svn-src-stable@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, svn-src-stable-9@freebsd.org X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Apr 2015 12:49:39 -0000 On Thu, Apr 02, 2015 at 01:02:47AM +0000, John Baldwin wrote: > New Revision: 280973 > URL: https://svnweb.freebsd.org/changeset/base/280973 > > Log: > MFC 276724: > On some Intel CPUs with a P-state but not C-state invariant TSC the TSC > may also halt in C2 and not just C3 (it seems that in some cases the BIOS > advertises its C3 state as a C2 state in _CST). Just play it safe and > disable both C2 and C3 states if a user forces the use of the TSC as the > timecounter on such CPUs. Does it apply to stable/8 as well? Any preliminary testing I might have to conduct first? ./danfe From owner-svn-src-stable-9@FreeBSD.ORG Mon Apr 6 14:27:40 2015 Return-Path: Delivered-To: svn-src-stable-9@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 8D8289A5; Mon, 6 Apr 2015 14:27:40 +0000 (UTC) Received: from bigwig.baldwin.cx (bigwig.baldwin.cx [IPv6:2001:470:1f11:75::1]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 61B8BF09; Mon, 6 Apr 2015 14:27:40 +0000 (UTC) Received: from ralph.baldwin.cx (pool-173-54-116-245.nwrknj.fios.verizon.net [173.54.116.245]) by bigwig.baldwin.cx (Postfix) with ESMTPSA id 17958B93C; Mon, 6 Apr 2015 10:27:39 -0400 (EDT) From: John Baldwin To: Alexey Dokuchaev Subject: Re: svn commit: r280973 - in stable: 10/sys/amd64/amd64 10/sys/dev/acpica 10/sys/i386/i386 10/sys/kern 10/sys/sys 10/sys/x86/x86 9/sys/amd64/amd64 9/sys/dev/acpica 9/sys/i386/i386 9/sys/kern 9/sys/sys ... Date: Mon, 06 Apr 2015 10:25:17 -0400 Message-ID: <1845061.qZcGbcMHKr@ralph.baldwin.cx> User-Agent: KMail/4.14.2 (FreeBSD/10.1-STABLE; KDE/4.14.2; amd64; ; ) In-Reply-To: <20150406124939.GA48665@FreeBSD.org> References: <201504020102.t3212lTO021499@svn.freebsd.org> <20150406124939.GA48665@FreeBSD.org> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7 (bigwig.baldwin.cx); Mon, 06 Apr 2015 10:27:39 -0400 (EDT) Cc: svn-src-stable@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, svn-src-stable-9@freebsd.org X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Apr 2015 14:27:40 -0000 On Monday, April 06, 2015 12:49:39 PM Alexey Dokuchaev wrote: > On Thu, Apr 02, 2015 at 01:02:47AM +0000, John Baldwin wrote: > > New Revision: 280973 > > URL: https://svnweb.freebsd.org/changeset/base/280973 > > > > Log: > > MFC 276724: > > On some Intel CPUs with a P-state but not C-state invariant TSC the TSC > > may also halt in C2 and not just C3 (it seems that in some cases the BIOS > > advertises its C3 state as a C2 state in _CST). Just play it safe and > > disable both C2 and C3 states if a user forces the use of the TSC as the > > timecounter on such CPUs. > > Does it apply to stable/8 as well? Any preliminary testing I might have to > conduct first? It needs some manual patching to apply to 8 (8 doesn't have the merged tsc.c in sys/x86/x86 for example). At this point in 8's life cycle I'm not inclined to merge non-trivial changes that need manual fixups, etc. -- John Baldwin From owner-svn-src-stable-9@FreeBSD.ORG Mon Apr 6 14:45:41 2015 Return-Path: Delivered-To: svn-src-stable-9@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 46C307DD; Mon, 6 Apr 2015 14:45:41 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 306B8155; Mon, 6 Apr 2015 14:45:41 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t36EjfXl072219; Mon, 6 Apr 2015 14:45:41 GMT (envelope-from dim@FreeBSD.org) Received: (from dim@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t36Ejf9B072218; Mon, 6 Apr 2015 14:45:41 GMT (envelope-from dim@FreeBSD.org) Message-Id: <201504061445.t36Ejf9B072218@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: dim set sender to dim@FreeBSD.org using -f From: Dimitry Andric Date: Mon, 6 Apr 2015 14:45:41 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r281148 - in stable: 10/bin/expr 9/bin/expr X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Apr 2015 14:45:41 -0000 Author: dim Date: Mon Apr 6 14:45:40 2015 New Revision: 281148 URL: https://svnweb.freebsd.org/changeset/base/281148 Log: MFC r280357: Build expr with -fwrapv, since it relies on signed integer wrapping having defined behavior. Reported by: rodrigc Modified: stable/9/bin/expr/Makefile Directory Properties: stable/9/ (props changed) stable/9/bin/ (props changed) stable/9/bin/expr/ (props changed) Changes in other areas also in this revision: Modified: stable/10/bin/expr/Makefile Directory Properties: stable/10/ (props changed) Modified: stable/9/bin/expr/Makefile ============================================================================== --- stable/9/bin/expr/Makefile Mon Apr 6 13:55:33 2015 (r281147) +++ stable/9/bin/expr/Makefile Mon Apr 6 14:45:40 2015 (r281148) @@ -4,4 +4,7 @@ PROG= expr SRCS= expr.y YFLAGS= +# expr relies on signed integer wrapping +CFLAGS+= -fwrapv + .include From owner-svn-src-stable-9@FreeBSD.ORG Mon Apr 6 14:50:55 2015 Return-Path: Delivered-To: svn-src-stable-9@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 285A7CCC; Mon, 6 Apr 2015 14:50:55 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id F343A243; Mon, 6 Apr 2015 14:50:54 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t36EosBT075632; Mon, 6 Apr 2015 14:50:54 GMT (envelope-from dim@FreeBSD.org) Received: (from dim@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t36EosDP075631; Mon, 6 Apr 2015 14:50:54 GMT (envelope-from dim@FreeBSD.org) Message-Id: <201504061450.t36EosDP075631@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: dim set sender to dim@FreeBSD.org using -f From: Dimitry Andric Date: Mon, 6 Apr 2015 14:50:54 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r281149 - in stable: 10/contrib/libc++/include 9/contrib/libc++/include X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Apr 2015 14:50:55 -0000 Author: dim Date: Mon Apr 6 14:50:54 2015 New Revision: 281149 URL: https://svnweb.freebsd.org/changeset/base/281149 Log: MFC r280864: Pull in r233552 from upstream libc++ trunk (by Eric Fiselier): [libcxx] Fix PR22771 - Support access control SFINAE in the library version of is_convertible. Summary: Currently the conversion check does not take place in a context where access control SFINAE is applied. This patch changes the context of the test expression so that SFINAE occurs if access control does not permit the conversion. Related bug: https://llvm.org/bugs/show_bug.cgi?id=22771 Reviewers: mclow.lists, rsmith, dim Reviewed By: dim Subscribers: dim, rodrigc, emaste, cfe-commits Differential Revision: http://reviews.llvm.org/D8461 This fixes building clang, and other programs using libc++, with newer versions of gcc (specifically, gcc 4.8 and higher). Reported by: rodrigc Modified: stable/9/contrib/libc++/include/type_traits Directory Properties: stable/9/ (props changed) stable/9/contrib/ (props changed) stable/9/contrib/libc++/ (props changed) Changes in other areas also in this revision: Modified: stable/10/contrib/libc++/include/type_traits Directory Properties: stable/10/ (props changed) Modified: stable/9/contrib/libc++/include/type_traits ============================================================================== --- stable/9/contrib/libc++/include/type_traits Mon Apr 6 14:45:40 2015 (r281148) +++ stable/9/contrib/libc++/include/type_traits Mon Apr 6 14:50:54 2015 (r281149) @@ -842,7 +842,16 @@ template struct _ namespace __is_convertible_imp { -template char __test(_Tp); +template void __test_convert(_Tp); + +template +struct __is_convertible_test : public false_type {}; + +template +struct __is_convertible_test<_From, _To, + decltype(__test_convert<_To>(_VSTD::declval<_From>()))> : public true_type +{}; + template __two __test(...); #ifndef _LIBCPP_HAS_NO_RVALUE_REFERENCES template _Tp&& __source(); @@ -877,10 +886,8 @@ template ::value> struct __is_convertible : public integral_constant(__is_convertible_imp::__source<_T1>())) == 1 -#else - sizeof(__is_convertible_imp::__test<_T2>(__is_convertible_imp::__source<_T1>())) == 1 + __is_convertible_imp::__is_convertible_test<_T1, _T2>::value +#if defined(_LIBCPP_HAS_NO_RVALUE_REFERENCES) && !(!is_function<_T1>::value && !is_reference<_T1>::value && is_reference<_T2>::value && (!is_const::type>::value || is_volatile::type>::value) From owner-svn-src-stable-9@FreeBSD.ORG Tue Apr 7 02:55:23 2015 Return-Path: Delivered-To: svn-src-stable-9@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id D231D8D8; Tue, 7 Apr 2015 02:55:23 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id BCF61DCD; Tue, 7 Apr 2015 02:55:23 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t372tNtM030938; Tue, 7 Apr 2015 02:55:23 GMT (envelope-from bdrewery@FreeBSD.org) Received: (from bdrewery@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t372tNBO030936; Tue, 7 Apr 2015 02:55:23 GMT (envelope-from bdrewery@FreeBSD.org) Message-Id: <201504070255.t372tNBO030936@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: bdrewery set sender to bdrewery@FreeBSD.org using -f From: Bryan Drewery Date: Tue, 7 Apr 2015 02:55:23 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r281186 - stable/9/crypto/openssh X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2015 02:55:23 -0000 Author: bdrewery Date: Tue Apr 7 02:55:22 2015 New Revision: 281186 URL: https://svnweb.freebsd.org/changeset/base/281186 Log: MFC r280360: Document "none" for VersionAddendum. Modified: stable/9/crypto/openssh/ssh_config.5 stable/9/crypto/openssh/sshd_config.5 Directory Properties: stable/9/crypto/openssh/ (props changed) Modified: stable/9/crypto/openssh/ssh_config.5 ============================================================================== --- stable/9/crypto/openssh/ssh_config.5 Tue Apr 7 02:53:14 2015 (r281185) +++ stable/9/crypto/openssh/ssh_config.5 Tue Apr 7 02:55:22 2015 (r281186) @@ -35,7 +35,7 @@ .\" .\" $OpenBSD: ssh_config.5,v 1.185 2014/02/23 20:11:36 djm Exp $ .\" $FreeBSD$ -.Dd February 23, 2014 +.Dd March 22, 2015 .Dt SSH_CONFIG 5 .Os .Sh NAME @@ -1421,6 +1421,9 @@ Specifies a string to append to the regu OS- or site-specific modifications. The default is .Dq FreeBSD-20140420 . +The value +.Dq none +may be used to disable this. .It Cm VisualHostKey If this flag is set to .Dq yes , Modified: stable/9/crypto/openssh/sshd_config.5 ============================================================================== --- stable/9/crypto/openssh/sshd_config.5 Tue Apr 7 02:53:14 2015 (r281185) +++ stable/9/crypto/openssh/sshd_config.5 Tue Apr 7 02:55:22 2015 (r281186) @@ -35,7 +35,7 @@ .\" .\" $OpenBSD: sshd_config.5,v 1.172 2014/02/27 22:47:07 djm Exp $ .\" $FreeBSD$ -.Dd February 27, 2014 +.Dd March 22, 2015 .Dt SSHD_CONFIG 5 .Os .Sh NAME @@ -1254,6 +1254,9 @@ Optionally specifies additional text to sent by the server upon connection. The default is .Dq FreeBSD-20140420 . +The value +.Dq none +may be used to disable this. .It Cm X11DisplayOffset Specifies the first display number available for .Xr sshd 8 Ns 's From owner-svn-src-stable-9@FreeBSD.ORG Tue Apr 7 18:07:17 2015 Return-Path: Delivered-To: svn-src-stable-9@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 27856239; Tue, 7 Apr 2015 18:07:17 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 11CDBC4C; Tue, 7 Apr 2015 18:07:17 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t37I7G41065141; Tue, 7 Apr 2015 18:07:16 GMT (envelope-from davidcs@FreeBSD.org) Received: (from davidcs@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t37I7GOJ065140; Tue, 7 Apr 2015 18:07:16 GMT (envelope-from davidcs@FreeBSD.org) Message-Id: <201504071807.t37I7GOJ065140@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: davidcs set sender to davidcs@FreeBSD.org using -f From: David C Somayajulu Date: Tue, 7 Apr 2015 18:07:16 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r281217 - stable/9/sys/dev/bxe X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2015 18:07:17 -0000 Author: davidcs Date: Tue Apr 7 18:07:16 2015 New Revision: 281217 URL: https://svnweb.freebsd.org/changeset/base/281217 Log: MFC r281006 When an mbuf allocation fails in the receive path, the mbuf containing the received packet is not sent to the host network stack and is reused again on the receive ring. Remaining received packets in the ring are not processed in that invocation of bxe_rxeof() and defered to the task thread Modified: stable/9/sys/dev/bxe/bxe.c Directory Properties: stable/9/sys/ (props changed) stable/9/sys/dev/ (props changed) Modified: stable/9/sys/dev/bxe/bxe.c ============================================================================== --- stable/9/sys/dev/bxe/bxe.c Tue Apr 7 18:06:46 2015 (r281216) +++ stable/9/sys/dev/bxe/bxe.c Tue Apr 7 18:07:16 2015 (r281217) @@ -3257,7 +3257,7 @@ bxe_rxeof(struct bxe_softc *sc, uint16_t bd_cons, bd_prod, bd_prod_fw, comp_ring_cons; uint16_t hw_cq_cons, sw_cq_cons, sw_cq_prod; int rx_pkts = 0; - int rc; + int rc = 0; BXE_FP_RX_LOCK(fp); @@ -3399,6 +3399,10 @@ bxe_rxeof(struct bxe_softc *sc, (sc->max_rx_bufs != RX_BD_USABLE) ? bd_prod : bd_cons); if (rc != 0) { + + /* we simply reuse the received mbuf and don't post it to the stack */ + m = NULL; + BLOGE(sc, "mbuf alloc fail for fp[%02d] rx chain (%d)\n", fp->index, rc); fp->eth_q_stats.rx_soft_errors++; @@ -3487,6 +3491,9 @@ next_cqe: sw_cq_cons = RCQ_NEXT(sw_cq_cons); /* limit spinning on the queue */ + if (rc != 0) + break; + if (rx_pkts == sc->rx_budget) { fp->eth_q_stats.rx_budget_reached++; break; From owner-svn-src-stable-9@FreeBSD.ORG Tue Apr 7 20:20:46 2015 Return-Path: Delivered-To: svn-src-stable-9@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id BE6EE406; Tue, 7 Apr 2015 20:20:46 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id A7130E03; Tue, 7 Apr 2015 20:20:46 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t37KKk4w032129; Tue, 7 Apr 2015 20:20:46 GMT (envelope-from delphij@FreeBSD.org) Received: (from delphij@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t37KKjgd032124; Tue, 7 Apr 2015 20:20:45 GMT (envelope-from delphij@FreeBSD.org) Message-Id: <201504072020.t37KKjgd032124@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: delphij set sender to delphij@FreeBSD.org using -f From: Xin LI Date: Tue, 7 Apr 2015 20:20:45 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r281231 - in stable: 8/contrib/ntp/ntpd 8/sys/netinet 8/sys/netinet6 9/contrib/ntp/ntpd 9/sys/netinet 9/sys/netinet6 X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2015 20:20:46 -0000 Author: delphij Date: Tue Apr 7 20:20:44 2015 New Revision: 281231 URL: https://svnweb.freebsd.org/changeset/base/281231 Log: Improve patch for SA-15:04.igmp to solve a potential buffer overflow. Fix multiple vulnerabilities of ntp. [SA-15:07] Fix Denial of Service with IPv6 Router Advertisements. [SA-15:09] Modified: stable/9/contrib/ntp/ntpd/ntp_crypto.c stable/9/contrib/ntp/ntpd/ntp_proto.c stable/9/sys/netinet/igmp.c stable/9/sys/netinet6/nd6_rtr.c Changes in other areas also in this revision: Modified: stable/8/contrib/ntp/ntpd/ntp_crypto.c stable/8/contrib/ntp/ntpd/ntp_proto.c stable/8/sys/netinet/igmp.c stable/8/sys/netinet6/nd6_rtr.c Modified: stable/9/contrib/ntp/ntpd/ntp_crypto.c ============================================================================== --- stable/9/contrib/ntp/ntpd/ntp_crypto.c Tue Apr 7 20:20:24 2015 (r281230) +++ stable/9/contrib/ntp/ntpd/ntp_crypto.c Tue Apr 7 20:20:44 2015 (r281231) @@ -93,6 +93,7 @@ #define TAI_1972 10 /* initial TAI offset (s) */ #define MAX_LEAP 100 /* max UTC leapseconds (s) */ #define VALUE_LEN (6 * 4) /* min response field length */ +#define MAX_VALLEN (65535 - VALUE_LEN) #define YEAR (60 * 60 * 24 * 365) /* seconds in year */ /* @@ -137,8 +138,8 @@ static u_int ident_scheme = 0; /* server */ static int crypto_verify P((struct exten *, struct value *, struct peer *)); -static int crypto_encrypt P((struct exten *, struct value *, - keyid_t *)); +static int crypto_encrypt P((const u_char *, u_int, keyid_t *, + struct value *)); static int crypto_alice P((struct peer *, struct value *)); static int crypto_alice2 P((struct peer *, struct value *)); static int crypto_alice3 P((struct peer *, struct value *)); @@ -446,6 +447,12 @@ crypto_recv( tstamp = ntohl(ep->tstamp); fstamp = ntohl(ep->fstamp); vallen = ntohl(ep->vallen); + /* + * Bug 2761: I hope this isn't too early... + */ + if ( vallen == 0 + || len - VALUE_LEN < vallen) + return XEVNT_LEN; } switch (code) { @@ -488,7 +495,7 @@ crypto_recv( break; if (vallen == 0 || vallen > MAXHOSTNAME || - len < VALUE_LEN + vallen) { + len - VALUE_LEN < vallen) { rval = XEVNT_LEN; break; } @@ -1250,7 +1257,8 @@ crypto_xmit( vallen = ntohl(ep->vallen); if (vallen == 8) { strcpy(certname, sys_hostname); - } else if (vallen == 0 || vallen > MAXHOSTNAME) { + } else if (vallen == 0 || vallen > MAXHOSTNAME || + len - VALUE_LEN < vallen) { rval = XEVNT_LEN; break; @@ -1407,7 +1415,10 @@ crypto_xmit( * anything goes wrong. */ case CRYPTO_COOK | CRYPTO_RESP: - if ((opcode & 0xffff) < VALUE_LEN) { + vallen = ntohl(ep->vallen); /* Must be <64k */ + if ( vallen == 0 + || (vallen >= MAX_VALLEN) + || (opcode & 0x0000ffff) < VALUE_LEN + vallen) { rval = XEVNT_LEN; break; } @@ -1420,10 +1431,11 @@ crypto_xmit( } tcookie = peer->pcookie; } - if ((rval = crypto_encrypt(ep, &vtemp, &tcookie)) == - XEVNT_OK) + if ((rval = crypto_encrypt((const u_char *)ep->pkt, vallen, &tcookie, &vtemp)) + == XEVNT_OK) { len += crypto_send(fp, &vtemp); - value_free(&vtemp); + value_free(&vtemp); + } break; /* @@ -1558,10 +1570,15 @@ crypto_verify( * are rounded up to the next word. */ vallen = ntohl(ep->vallen); + if ( vallen == 0 + || vallen > MAX_VALLEN) + return (XEVNT_LEN); i = (vallen + 3) / 4; siglen = ntohl(ep->pkt[i++]); - if (len < VALUE_LEN + ((vallen + 3) / 4) * 4 + ((siglen + 3) / - 4) * 4) + if ( siglen > MAX_VALLEN + || len - VALUE_LEN < ((vallen + 3) / 4) * 4 + || len - VALUE_LEN - ((vallen + 3) / 4) * 4 + < ((siglen + 3) / 4) * 4) return (XEVNT_LEN); /* @@ -1627,6 +1644,7 @@ crypto_verify( * avoid doing the sign exchange. */ EVP_VerifyInit(&ctx, peer->digest); + /* XXX: the "+ 12" needs to be at least documented... */ EVP_VerifyUpdate(&ctx, (u_char *)&ep->tstamp, vallen + 12); if (EVP_VerifyFinal(&ctx, (u_char *)&ep->pkt[i], siglen, pkey) <= 0) return (XEVNT_SIG); @@ -1641,10 +1659,10 @@ crypto_verify( /* - * crypto_encrypt - construct encrypted cookie and signature from - * extension field and cookie + * crypto_encrypt - construct vp (encrypted cookie and signature) from + * the public key and cookie. * - * Returns + * Returns: * XEVNT_OK success * XEVNT_PUB bad or missing public key * XEVNT_CKY bad or missing cookie @@ -1652,24 +1670,21 @@ crypto_verify( */ static int crypto_encrypt( - struct exten *ep, /* extension pointer */ - struct value *vp, /* value pointer */ - keyid_t *cookie /* server cookie */ + const u_char *ptr, /* Public Key */ + u_int vallen, /* Length of Public Key */ + keyid_t *cookie, /* server cookie */ + struct value *vp /* value pointer */ ) { EVP_PKEY *pkey; /* public key */ EVP_MD_CTX ctx; /* signature context */ tstamp_t tstamp; /* NTP timestamp */ u_int32 temp32; - u_int len; - u_char *ptr; /* * Extract the public key from the request. */ - len = ntohl(ep->vallen); - ptr = (u_char *)ep->pkt; - pkey = d2i_PublicKey(EVP_PKEY_RSA, NULL, &ptr, len); + pkey = d2i_PublicKey(EVP_PKEY_RSA, NULL, &ptr, vallen); if (pkey == NULL) { msyslog(LOG_ERR, "crypto_encrypt %s\n", ERR_error_string(ERR_get_error(), NULL)); @@ -1683,9 +1698,9 @@ crypto_encrypt( memset(vp, 0, sizeof(struct value)); vp->tstamp = htonl(tstamp); vp->fstamp = hostval.tstamp; - len = EVP_PKEY_size(pkey); - vp->vallen = htonl(len); - vp->ptr = emalloc(len); + vallen = EVP_PKEY_size(pkey); + vp->vallen = htonl(vallen); + vp->ptr = emalloc(vallen); temp32 = htonl(*cookie); if (!RSA_public_encrypt(4, (u_char *)&temp32, vp->ptr, pkey->pkey.rsa, RSA_PKCS1_OAEP_PADDING)) { @@ -1705,9 +1720,9 @@ crypto_encrypt( vp->sig = emalloc(sign_siglen); EVP_SignInit(&ctx, sign_digest); EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12); - EVP_SignUpdate(&ctx, vp->ptr, len); - if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) - vp->siglen = htonl(len); + EVP_SignUpdate(&ctx, vp->ptr, vallen); + if (EVP_SignFinal(&ctx, vp->sig, &vallen, sign_pkey)) + vp->siglen = htonl(sign_siglen); return (XEVNT_OK); } @@ -1794,6 +1809,9 @@ crypto_ident( * call in the protocol module. * * Returns extension field pointer (no errors). + * + * XXX: opcode and len should really be 32-bit quantities and + * we should make sure that str is not too big. */ struct exten * crypto_args( @@ -1805,11 +1823,14 @@ crypto_args( tstamp_t tstamp; /* NTP timestamp */ struct exten *ep; /* extension field pointer */ u_int len; /* extension field length */ + size_t slen; tstamp = crypto_time(); len = sizeof(struct exten); - if (str != NULL) - len += strlen(str); + if (str != NULL) { + slen = strlen(str); + len += slen; + } ep = emalloc(len); memset(ep, 0, len); if (opcode == 0) @@ -1829,8 +1850,8 @@ crypto_args( ep->fstamp = hostval.tstamp; ep->vallen = 0; if (str != NULL) { - ep->vallen = htonl(strlen(str)); - memcpy((char *)ep->pkt, str, strlen(str)); + ep->vallen = htonl(slen); + memcpy((char *)ep->pkt, str, slen); } else { ep->pkt[0] = peer->associd; } @@ -1844,6 +1865,8 @@ crypto_args( * Returns extension field length. Note: it is not polite to send a * nonempty signature with zero timestamp or a nonzero timestamp with * empty signature, but these rules are not enforced here. + * + * XXX This code won't work on a box with 16-bit ints. */ u_int crypto_send( @@ -2212,7 +2235,8 @@ crypto_bob( tstamp_t tstamp; /* NTP timestamp */ BIGNUM *bn, *bk, *r; u_char *ptr; - u_int len; + u_int len; /* extension field length */ + u_int vallen = 0; /* value length */ /* * If the IFF parameters are not valid, something awful @@ -2227,8 +2251,11 @@ crypto_bob( /* * Extract r from the challenge. */ - len = ntohl(ep->vallen); - if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) { + vallen = ntohl(ep->vallen); + len = ntohl(ep->opcode) & 0x0000ffff; + if (vallen == 0 || len < VALUE_LEN || len - VALUE_LEN < vallen) + return XEVNT_LEN; + if ((r = BN_bin2bn((u_char *)ep->pkt, vallen, NULL)) == NULL) { msyslog(LOG_ERR, "crypto_bob %s\n", ERR_error_string(ERR_get_error(), NULL)); return (XEVNT_ERR); @@ -2240,7 +2267,7 @@ crypto_bob( */ bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new(); sdsa = DSA_SIG_new(); - BN_rand(bk, len * 8, -1, 1); /* k */ + BN_rand(bk, vallen * 8, -1, 1); /* k */ BN_mod_mul(bn, dsa->priv_key, r, dsa->q, bctx); /* b r mod q */ BN_add(bn, bn, bk); BN_mod(bn, bn, dsa->q, bctx); /* k + b r mod q */ @@ -2254,19 +2281,25 @@ crypto_bob( /* * Encode the values in ASN.1 and sign. */ - tstamp = crypto_time(); - memset(vp, 0, sizeof(struct value)); - vp->tstamp = htonl(tstamp); - vp->fstamp = htonl(if_fstamp); - len = i2d_DSA_SIG(sdsa, NULL); - if (len <= 0) { + vallen = i2d_DSA_SIG(sdsa, NULL); + if (vallen == 0) { msyslog(LOG_ERR, "crypto_bob %s\n", ERR_error_string(ERR_get_error(), NULL)); DSA_SIG_free(sdsa); return (XEVNT_ERR); } - vp->vallen = htonl(len); - ptr = emalloc(len); + if (vallen > MAX_VALLEN) { + msyslog(LOG_ERR, "crypto_bob: signature is too big: %d", + vallen); + DSA_SIG_free(sdsa); + return (XEVNT_LEN); + } + memset(vp, 0, sizeof(struct value)); + tstamp = crypto_time(); + vp->tstamp = htonl(tstamp); + vp->fstamp = htonl(if_fstamp); + vp->vallen = htonl(vallen); + ptr = emalloc(vallen); vp->ptr = ptr; i2d_DSA_SIG(sdsa, &ptr); DSA_SIG_free(sdsa); @@ -2277,11 +2310,12 @@ crypto_bob( if (tstamp < cinfo->first || tstamp > cinfo->last) return (XEVNT_PER); + /* XXX: more validation to make sure the sign fits... */ vp->sig = emalloc(sign_siglen); EVP_SignInit(&ctx, sign_digest); EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12); - EVP_SignUpdate(&ctx, vp->ptr, len); - if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) + EVP_SignUpdate(&ctx, vp->ptr, vallen); + if (EVP_SignFinal(&ctx, vp->sig, &vallen, sign_pkey)) vp->siglen = htonl(len); return (XEVNT_OK); } Modified: stable/9/contrib/ntp/ntpd/ntp_proto.c ============================================================================== --- stable/9/contrib/ntp/ntpd/ntp_proto.c Tue Apr 7 20:20:24 2015 (r281230) +++ stable/9/contrib/ntp/ntpd/ntp_proto.c Tue Apr 7 20:20:44 2015 (r281231) @@ -459,7 +459,7 @@ receive( while (has_mac > 0) { int temp; - if (has_mac % 4 != 0 || has_mac < 0) { + if (has_mac % 4 != 0 || has_mac < MIN_MAC_LEN) { sys_badlength++; return; /* bad MAC length */ } @@ -483,6 +483,13 @@ receive( return; /* bad MAC length */ } } + /* + * If has_mac is < 0 we had a malformed packet. + */ + if (has_mac < 0) { + sys_badlength++; + return; /* bad length */ + } #ifdef OPENSSL pkeyid = tkeyid = 0; #endif /* OPENSSL */ @@ -942,12 +949,9 @@ receive( } /* - * Update the origin and destination timestamps. If - * unsynchronized or bogus abandon ship. If the crypto machine + * If unsynchronized or bogus abandon ship. If the crypto machine * breaks, light the crypto bit and plaint the log. */ - peer->org = p_xmt; - peer->rec = rbufp->recv_time; if (peer->flash & PKT_TEST_MASK) { #ifdef OPENSSL if (crypto_flags && (peer->flags & FLAG_SKEY)) { @@ -978,10 +982,11 @@ receive( * versions. If symmetric modes, return a crypto-NAK. The peer * should restart the protocol. */ - } else if (!AUTH(peer->keyid || (restrict_mask & RES_DONTTRUST), - is_authentic)) { + } else if (!AUTH(peer->keyid || has_mac || + (restrict_mask & RES_DONTTRUST), is_authentic)) { peer->flash |= TEST5; - if (hismode == MODE_ACTIVE || hismode == MODE_PASSIVE) + if (has_mac && + (hismode == MODE_ACTIVE || hismode == MODE_PASSIVE)) fast_xmit(rbufp, MODE_ACTIVE, 0, restrict_mask); return; /* bad auth */ } @@ -989,7 +994,12 @@ receive( /* * That was hard and I am sweaty, but the packet is squeaky * clean. Get on with real work. + * + * Update the origin and destination timestamps. */ + peer->org = p_xmt; + peer->rec = rbufp->recv_time; + peer->received++; peer->timereceived = current_time; if (is_authentic == AUTH_OK) Modified: stable/9/sys/netinet/igmp.c ============================================================================== --- stable/9/sys/netinet/igmp.c Tue Apr 7 20:20:24 2015 (r281230) +++ stable/9/sys/netinet/igmp.c Tue Apr 7 20:20:44 2015 (r281231) @@ -1534,7 +1534,6 @@ igmp_input(struct mbuf *m, int off) struct igmpv3 *igmpv3; uint16_t igmpv3len; uint16_t nsrc; - int srclen; IGMPSTAT_INC(igps_rcv_v3_queries); igmpv3 = (struct igmpv3 *)igmp; @@ -1542,8 +1541,8 @@ igmp_input(struct mbuf *m, int off) * Validate length based on source count. */ nsrc = ntohs(igmpv3->igmp_numsrc); - srclen = sizeof(struct in_addr) * nsrc; - if (nsrc * sizeof(in_addr_t) > srclen) { + if (nsrc * sizeof(in_addr_t) > + UINT16_MAX - iphlen - IGMP_V3_QUERY_MINLEN) { IGMPSTAT_INC(igps_rcv_tooshort); return; } @@ -1552,7 +1551,7 @@ igmp_input(struct mbuf *m, int off) * this scope. */ igmpv3len = iphlen + IGMP_V3_QUERY_MINLEN + - srclen; + sizeof(struct in_addr) * nsrc; if ((m->m_flags & M_EXT || m->m_len < igmpv3len) && (m = m_pullup(m, igmpv3len)) == NULL) { Modified: stable/9/sys/netinet6/nd6_rtr.c ============================================================================== --- stable/9/sys/netinet6/nd6_rtr.c Tue Apr 7 20:20:24 2015 (r281230) +++ stable/9/sys/netinet6/nd6_rtr.c Tue Apr 7 20:20:44 2015 (r281231) @@ -296,8 +296,16 @@ nd6_ra_input(struct mbuf *m, int off, in } if (nd_ra->nd_ra_retransmit) ndi->retrans = ntohl(nd_ra->nd_ra_retransmit); - if (nd_ra->nd_ra_curhoplimit) - ndi->chlim = nd_ra->nd_ra_curhoplimit; + if (nd_ra->nd_ra_curhoplimit) { + if (ndi->chlim < nd_ra->nd_ra_curhoplimit) + ndi->chlim = nd_ra->nd_ra_curhoplimit; + else if (ndi->chlim != nd_ra->nd_ra_curhoplimit) { + log(LOG_ERR, "RA with a lower CurHopLimit sent from " + "%s on %s (current = %d, received = %d). " + "Ignored.\n", ip6_sprintf(ip6bufs, &ip6->ip6_src), + if_name(ifp), ndi->chlim, nd_ra->nd_ra_curhoplimit); + } + } dr = defrtrlist_update(&dr0); } From owner-svn-src-stable-9@FreeBSD.ORG Wed Apr 8 19:49:43 2015 Return-Path: Delivered-To: svn-src-stable-9@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 130C5C05; Wed, 8 Apr 2015 19:49:43 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id EC8CCEA5; Wed, 8 Apr 2015 19:49:42 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t38JngC5001081; Wed, 8 Apr 2015 19:49:42 GMT (envelope-from delphij@FreeBSD.org) Received: (from delphij@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t38Jnd0S001068; Wed, 8 Apr 2015 19:49:39 GMT (envelope-from delphij@FreeBSD.org) Message-Id: <201504081949.t38Jnd0S001068@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: delphij set sender to delphij@FreeBSD.org using -f From: Xin LI Date: Wed, 8 Apr 2015 19:49:39 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r281273 - in stable/9: contrib/bind9 contrib/bind9/bin/check contrib/bind9/bin/dig contrib/bind9/bin/dig/include/dig contrib/bind9/bin/dnssec contrib/bind9/bin/named contrib/bind9/bin/n... X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Apr 2015 19:49:43 -0000 Author: delphij Date: Wed Apr 8 19:49:38 2015 New Revision: 281273 URL: https://svnweb.freebsd.org/changeset/base/281273 Log: Update BIND to 9.9.7. This is a direct commit to stable/9 because BIND is no longer in -HEAD. Added: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch11.html - copied unchanged from r281268, vendor/bind9/dist/doc/arm/Bv9ARM.ch11.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch12.html - copied unchanged from r281268, vendor/bind9/dist/doc/arm/Bv9ARM.ch12.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch13.html - copied unchanged from r281268, vendor/bind9/dist/doc/arm/Bv9ARM.ch13.html stable/9/contrib/bind9/doc/arm/notes-wrapper.xml - copied unchanged from r281268, vendor/bind9/dist/doc/arm/notes-wrapper.xml stable/9/contrib/bind9/doc/arm/notes.html - copied unchanged from r281268, vendor/bind9/dist/doc/arm/notes.html stable/9/contrib/bind9/doc/arm/notes.pdf - copied unchanged from r281268, vendor/bind9/dist/doc/arm/notes.pdf stable/9/contrib/bind9/doc/arm/notes.xml - copied unchanged from r281268, vendor/bind9/dist/doc/arm/notes.xml stable/9/contrib/bind9/lib/dns/rdata/generic/openpgpkey_61.c - copied unchanged from r281268, vendor/bind9/dist/lib/dns/rdata/generic/openpgpkey_61.c stable/9/contrib/bind9/lib/dns/rdata/generic/openpgpkey_61.h - copied unchanged from r281268, vendor/bind9/dist/lib/dns/rdata/generic/openpgpkey_61.h Modified: stable/9/contrib/bind9/CHANGES stable/9/contrib/bind9/COPYRIGHT stable/9/contrib/bind9/FAQ.xml stable/9/contrib/bind9/README stable/9/contrib/bind9/bin/check/named-checkconf.c stable/9/contrib/bind9/bin/dig/dig.1 stable/9/contrib/bind9/bin/dig/dig.docbook stable/9/contrib/bind9/bin/dig/dig.html stable/9/contrib/bind9/bin/dig/dighost.c stable/9/contrib/bind9/bin/dig/host.c stable/9/contrib/bind9/bin/dig/include/dig/dig.h stable/9/contrib/bind9/bin/dig/nslookup.c stable/9/contrib/bind9/bin/dnssec/dnssec-dsfromkey.c stable/9/contrib/bind9/bin/dnssec/dnssec-importkey.c stable/9/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.c stable/9/contrib/bind9/bin/dnssec/dnssec-keygen.8 stable/9/contrib/bind9/bin/dnssec/dnssec-keygen.c stable/9/contrib/bind9/bin/dnssec/dnssec-keygen.docbook stable/9/contrib/bind9/bin/dnssec/dnssec-keygen.html stable/9/contrib/bind9/bin/dnssec/dnssec-settime.8 stable/9/contrib/bind9/bin/dnssec/dnssec-settime.c stable/9/contrib/bind9/bin/dnssec/dnssec-settime.docbook stable/9/contrib/bind9/bin/dnssec/dnssec-settime.html stable/9/contrib/bind9/bin/dnssec/dnssec-signzone.c stable/9/contrib/bind9/bin/dnssec/dnssec-verify.c stable/9/contrib/bind9/bin/dnssec/dnssectool.c stable/9/contrib/bind9/bin/dnssec/dnssectool.h stable/9/contrib/bind9/bin/named/client.c stable/9/contrib/bind9/bin/named/config.c stable/9/contrib/bind9/bin/named/include/named/globals.h stable/9/contrib/bind9/bin/named/interfacemgr.c stable/9/contrib/bind9/bin/named/main.c stable/9/contrib/bind9/bin/named/named.html stable/9/contrib/bind9/bin/named/query.c stable/9/contrib/bind9/bin/named/server.c stable/9/contrib/bind9/bin/named/update.c stable/9/contrib/bind9/bin/named/zoneconf.c stable/9/contrib/bind9/bin/nsupdate/nsupdate.c stable/9/contrib/bind9/bin/rndc/rndc.c stable/9/contrib/bind9/config.h.in stable/9/contrib/bind9/configure.in stable/9/contrib/bind9/doc/arm/Bv9ARM-book.xml stable/9/contrib/bind9/doc/arm/Bv9ARM.ch01.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch02.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch03.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch04.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch05.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch06.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch07.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch08.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch09.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch10.html stable/9/contrib/bind9/doc/arm/Bv9ARM.html stable/9/contrib/bind9/doc/arm/Bv9ARM.pdf stable/9/contrib/bind9/doc/arm/Makefile.in stable/9/contrib/bind9/doc/arm/dnssec.xml stable/9/contrib/bind9/doc/arm/man.arpaname.html stable/9/contrib/bind9/doc/arm/man.ddns-confgen.html stable/9/contrib/bind9/doc/arm/man.dig.html stable/9/contrib/bind9/doc/arm/man.dnssec-checkds.html stable/9/contrib/bind9/doc/arm/man.dnssec-coverage.html stable/9/contrib/bind9/doc/arm/man.dnssec-dsfromkey.html stable/9/contrib/bind9/doc/arm/man.dnssec-keyfromlabel.html stable/9/contrib/bind9/doc/arm/man.dnssec-keygen.html stable/9/contrib/bind9/doc/arm/man.dnssec-revoke.html stable/9/contrib/bind9/doc/arm/man.dnssec-settime.html stable/9/contrib/bind9/doc/arm/man.dnssec-signzone.html stable/9/contrib/bind9/doc/arm/man.dnssec-verify.html stable/9/contrib/bind9/doc/arm/man.genrandom.html stable/9/contrib/bind9/doc/arm/man.host.html stable/9/contrib/bind9/doc/arm/man.isc-hmac-fixup.html stable/9/contrib/bind9/doc/arm/man.named-checkconf.html stable/9/contrib/bind9/doc/arm/man.named-checkzone.html stable/9/contrib/bind9/doc/arm/man.named-journalprint.html stable/9/contrib/bind9/doc/arm/man.named.html stable/9/contrib/bind9/doc/arm/man.nsec3hash.html stable/9/contrib/bind9/doc/arm/man.nsupdate.html stable/9/contrib/bind9/doc/arm/man.rndc-confgen.html stable/9/contrib/bind9/doc/arm/man.rndc.conf.html stable/9/contrib/bind9/doc/arm/man.rndc.html stable/9/contrib/bind9/lib/bind9/api stable/9/contrib/bind9/lib/bind9/check.c stable/9/contrib/bind9/lib/bind9/getaddresses.c stable/9/contrib/bind9/lib/dns/adb.c stable/9/contrib/bind9/lib/dns/api stable/9/contrib/bind9/lib/dns/diff.c stable/9/contrib/bind9/lib/dns/dispatch.c stable/9/contrib/bind9/lib/dns/gen.c stable/9/contrib/bind9/lib/dns/include/dns/dispatch.h stable/9/contrib/bind9/lib/dns/include/dns/log.h stable/9/contrib/bind9/lib/dns/include/dns/rbt.h stable/9/contrib/bind9/lib/dns/include/dns/request.h stable/9/contrib/bind9/lib/dns/journal.c stable/9/contrib/bind9/lib/dns/keytable.c stable/9/contrib/bind9/lib/dns/log.c stable/9/contrib/bind9/lib/dns/master.c stable/9/contrib/bind9/lib/dns/masterdump.c stable/9/contrib/bind9/lib/dns/message.c stable/9/contrib/bind9/lib/dns/name.c stable/9/contrib/bind9/lib/dns/nsec3.c stable/9/contrib/bind9/lib/dns/openssldh_link.c stable/9/contrib/bind9/lib/dns/opensslecdsa_link.c stable/9/contrib/bind9/lib/dns/opensslgost_link.c stable/9/contrib/bind9/lib/dns/private.c stable/9/contrib/bind9/lib/dns/rbt.c stable/9/contrib/bind9/lib/dns/rbtdb.c stable/9/contrib/bind9/lib/dns/rdata.c stable/9/contrib/bind9/lib/dns/rdata/generic/cdnskey_60.c stable/9/contrib/bind9/lib/dns/rdata/generic/cds_59.c stable/9/contrib/bind9/lib/dns/rdata/generic/keydata_65533.c stable/9/contrib/bind9/lib/dns/rdata/generic/nsec3_50.c stable/9/contrib/bind9/lib/dns/rdata/generic/opt_41.c stable/9/contrib/bind9/lib/dns/rdata/generic/rrsig_46.c stable/9/contrib/bind9/lib/dns/rdata/generic/sig_24.c stable/9/contrib/bind9/lib/dns/rdata/generic/spf_99.h stable/9/contrib/bind9/lib/dns/rdata/generic/txt_16.c stable/9/contrib/bind9/lib/dns/rdataset.c stable/9/contrib/bind9/lib/dns/request.c stable/9/contrib/bind9/lib/dns/resolver.c stable/9/contrib/bind9/lib/dns/rootns.c stable/9/contrib/bind9/lib/dns/spnego_asn1.c stable/9/contrib/bind9/lib/dns/tkey.c stable/9/contrib/bind9/lib/dns/tsig.c stable/9/contrib/bind9/lib/dns/validator.c stable/9/contrib/bind9/lib/dns/zone.c stable/9/contrib/bind9/lib/dns/zt.c stable/9/contrib/bind9/lib/export/isc/Makefile.in stable/9/contrib/bind9/lib/export/isc/unix/Makefile.in stable/9/contrib/bind9/lib/export/samples/nsprobe.c stable/9/contrib/bind9/lib/export/samples/sample-request.c stable/9/contrib/bind9/lib/export/samples/sample-update.c stable/9/contrib/bind9/lib/irs/getnameinfo.c stable/9/contrib/bind9/lib/isc/api stable/9/contrib/bind9/lib/isc/hash.c stable/9/contrib/bind9/lib/isc/hmacmd5.c stable/9/contrib/bind9/lib/isc/hmacsha.c stable/9/contrib/bind9/lib/isc/httpd.c stable/9/contrib/bind9/lib/isc/include/isc/platform.h.in stable/9/contrib/bind9/lib/isc/include/isc/radix.h stable/9/contrib/bind9/lib/isc/include/isc/ratelimiter.h stable/9/contrib/bind9/lib/isc/md5.c stable/9/contrib/bind9/lib/isc/mem.c stable/9/contrib/bind9/lib/isc/radix.c stable/9/contrib/bind9/lib/isc/ratelimiter.c stable/9/contrib/bind9/lib/isc/result.c stable/9/contrib/bind9/lib/isc/sha1.c stable/9/contrib/bind9/lib/isc/sha2.c stable/9/contrib/bind9/lib/isc/unix/app.c stable/9/contrib/bind9/lib/isc/unix/include/isc/net.h stable/9/contrib/bind9/lib/isc/unix/include/isc/time.h stable/9/contrib/bind9/lib/isc/unix/net.c stable/9/contrib/bind9/lib/isc/unix/socket.c stable/9/contrib/bind9/lib/isc/unix/stdio.c stable/9/contrib/bind9/lib/isc/unix/time.c stable/9/contrib/bind9/lib/isccfg/api stable/9/contrib/bind9/lib/isccfg/parser.c stable/9/contrib/bind9/lib/lwres/api stable/9/contrib/bind9/lib/lwres/compat.c stable/9/contrib/bind9/lib/lwres/gethost.c stable/9/contrib/bind9/lib/lwres/man/lwres.html stable/9/contrib/bind9/lib/lwres/man/lwres_buffer.html stable/9/contrib/bind9/lib/lwres/man/lwres_config.html stable/9/contrib/bind9/lib/lwres/man/lwres_context.html stable/9/contrib/bind9/lib/lwres/man/lwres_gabn.html stable/9/contrib/bind9/lib/lwres/man/lwres_gai_strerror.html stable/9/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.html stable/9/contrib/bind9/lib/lwres/man/lwres_gethostent.html stable/9/contrib/bind9/lib/lwres/man/lwres_getipnode.html stable/9/contrib/bind9/lib/lwres/man/lwres_getnameinfo.html stable/9/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.html stable/9/contrib/bind9/lib/lwres/man/lwres_gnba.html stable/9/contrib/bind9/lib/lwres/man/lwres_hstrerror.html stable/9/contrib/bind9/lib/lwres/man/lwres_inetntop.html stable/9/contrib/bind9/lib/lwres/man/lwres_noop.html stable/9/contrib/bind9/lib/lwres/man/lwres_packet.html stable/9/contrib/bind9/lib/lwres/man/lwres_resutil.html stable/9/contrib/bind9/version stable/9/lib/bind/config.h stable/9/lib/bind/dns/code.h stable/9/lib/bind/dns/dns/enumclass.h stable/9/lib/bind/dns/dns/enumtype.h stable/9/lib/bind/dns/dns/rdatastruct.h stable/9/lib/bind/isc/isc/platform.h Directory Properties: stable/9/contrib/bind9/ (props changed) Modified: stable/9/contrib/bind9/CHANGES ============================================================================== --- stable/9/contrib/bind9/CHANGES Wed Apr 8 19:46:13 2015 (r281272) +++ stable/9/contrib/bind9/CHANGES Wed Apr 8 19:49:38 2015 (r281273) @@ -1,11 +1,145 @@ - --- 9.9.6-P2 released --- + --- 9.9.7 released --- + + --- 9.9.7rc2 released --- + +4061. [bug] Handle timeout in legacy system test. [RT #38573] + +4060. [bug] dns_rdata_freestruct could be called on a + uninitialised structure when handling a error. + [RT #38568] + +4059. [bug] Addressed valgrind warnings. [RT #38549] + +4058. [bug] UDP dispatches could use the wrong pseudorandom + number generator context. [RT #38578] + +4056. [bug] Fixed several small bugs in automatic trust anchor + management, including a memory leak and a possible + loss of key state information. [RT #38458] + +4057. [bug] 'dnssec-dsfromkey -T 0' failed to add ttl field. + [RT #38565] 4053. [security] Revoking a managed trust anchor and supplying an untrusted replacement could cause named to crash with an assertion failure. (CVE-2015-1349) [RT #38344] - --- 9.9.6-P1 released --- +4052. [bug] Fix a leak of query fetchlock. [RT #38454] + +4050. [bug] RPZ could send spurious SERVFAILs in response + to duplicate queries. [RT #38510] + +4049. [bug] CDS and CDNSKEY had the wrong attributes. [RT #38491] + +4048. [bug] adb hash table was not being grown. [RT #38470] + + --- 9.9.7rc1 released --- + +4047. [cleanup] "named -V" now reports the current running versions + of OpenSSL and the libxml2 libraries, in addition to + the versions that were in use at build time. + +4046. [bug] Accounting of "total use" in memory context + statistics was not correct. [RT #38370] + +4045. [bug] Skip to next master on dns_request_createvia4 failure. + [RT #25185] + +4044. [bug] Change 3955 was not complete, resulting in an assertion + failure if the timing was just right. [RT #38352] + +4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381] + +4038. [bug] Add 'rpz' flag to node and use it to determine whether + to call dns_rpz_delete. This should prevent unbalanced + add / delete calls. [RT #36888] + +4037. [bug] also-notify was ignoring the tsig key when checking + for duplicates resulting in some expected notify + messages not being sent. [RT #38369] + +4035. [bug] Close temporary and NZF FILE pointers before moving + the former into the latter's place, as required on + Windows. [RT #38332] + +4032. [bug] Built-in "empty" zones did not correctly inherit the + "allow-transfer" ACL from the options or view. + [RT #38310] + +4031. [bug] named-checkconf -z failed to report a missing file + with a hint zone. [RT #38294] + +4028. [bug] $GENERATE with a zero step was not being caught as a + error. A $GENERATE with a / but no step was not being + caught as a error. [RT #38262] + +3973. [test] Added hooks for Google Performance Tools CPU profiler, + including real-time/wall-clock profiling. Use + "configure --with-gperftools-profiler" to enable. + [RT #37339] + + --- 9.9.7b1 released --- + +4027. [port] Net::DNS 0.81 compatibility. [RT #38165] + +4026. [bug] Fix RFC 3658 reference in dig +sigchase. [RT #38173] + +4025. [port] bsdi: failed to build. [RT #38047] + +4024. [bug] dns_rdata_opt_first, dns_rdata_opt_next, + dns_rdata_opt_current, dns_rdata_txt_first, + dns_rdata_txt_next and dns_rdata_txt_current were + documented but not implemented. These have now been + implemented. + + dns_rdata_spf_first, dns_rdata_spf_next and + dns_rdata_spf_current were documented but not + implemented. The prototypes for these + functions have been removed. [RT #38068] + +4023. [bug] win32: socket handling with explicit ports and + invoking named with -4 was broken for some + configurations. [RT #38068] + +4021. [bug] Adjust max-recursion-queries to accommodate + the need for more queries when the cache is + empty. [RT #38104] + +4020. [bug] Change 3736 broke nsupdate's SOA MNAME discovery + resulting in updates being sent to the wrong server. + [RT #37925] + +4019. [func] If named is not configured to validate the answer + then allow fallback to plain DNS on timeout even + when we know the server supports EDNS. [RT #37978] + +4018. [bug] Fall back to plain DNS when EDNS queries are being + dropped was failing. [RT #37965] + +4017. [test] Add system test to check lookups to legacy servers + with broken DNS behavior. [RT #37965] + +4016. [bug] Fix a dig segfault due to bad linked list usage. + [RT #37591] + +4015. [bug] Nameservers that are skipped due to them being + CNAMEs were not being logged. They are now logged + to category 'cname' as per BIND 8. [RT #37935] + +4014. [bug] When including a master file origin_changed was + not being properly set leading to a potentially + spurious 'inherited owner' warning. [RT #37919] + +4012. [bug] Check returned status of OpenSSL digest and HMAC + functions when they return one. Note this applies + only to FIPS capable OpenSSL libraries put in + FIPS mode and MD5. [RT #37944] + +4011. [bug] master's list port inheritance was not properly + implemented. [RT #37792] + +4007. [doc] Remove acl forward reference restriction. [RT #37772] 4006. [security] A flaw in delegation handling could be exploited to put named into an infinite loop. This has @@ -19,6 +153,99 @@ "max-recursion-depth" option, and the query limit via the "max-recursion-queries" option. [RT #37580] +4004. [bug] When delegations had AAAA glue but not A, a + reference could be leaked causing an assertion + failure on shutdown. [RT #37796] + +4000. [bug] NXDOMAIN redirection incorrectly handled NXRRSET + from the redirect zone. [RT #37722] + +3998. [bug] isc_radix_search was returning matches that were + too precise. [RT #37680] + +3997. [protocol] Add OPENGPGKEY record. [RT# 37671] + +3996. [bug] Address use after free on out of memory error in + keyring_add. [RT #37639] + +3995. [bug] receive_secure_serial holds the zone lock for too + long. [RT #37626] + +3990. [testing] Add tests for unknown DNSSEC algorithm handling. + [RT #37541] + +3989. [cleanup] Remove redundant dns_db_resigned calls. [RT #35748] + +3987. [func] Handle future Visual Studio 14 incompatible changes. + [RT #37380] + +3986. [doc] Add the BIND version number to page footers + in the ARM. [RT #37398] + +3985. [doc] Describe how +ndots and +search interact in dig. + [RT #37529] + +3982. [doc] Include release notes in product documentation. + [RT #37272] + +3981. [bug] Cache DS/NXDOMAIN independently of other query types. + [RT #37467] + +3978. [test] Added a unit test for Diffie-Hellman key + computation, completing change #3974. [RT #37477] + +3976. [bug] When refreshing managed-key trust anchors, clear + any cached trust so that they will always be + revalidated with the current set of secure + roots. [RT #37506] + +3974. [bug] Handle DH_compute_key() failure correctly in + openssldh_link.c. [RT #37477] + +3972. [bug] Fix host's usage statement. [RT #37397] + +3971. [bug] Reduce the cascading failures due to a bad $TTL line + in named-checkconf / named-checkzone. [RT #37138] + +3970. [contrib] Fixed a use after free bug in the SDB LDAP driver. + [RT #37237] + +3968. [bug] Silence spurious log messages when using 'named -[46]'. + [RT #37308] + +3967. [test] Add test for inlined signed zone in multiple views + with different DNSKEY sets. [RT #35759] + +3966. [bug] Missing dns_db_closeversion call in receive_secure_db. + [RT #35746] + +3962. [bug] 'dig +topdown +trace +sigchase' address unhandled error + conditions. [RT #34663] + +3961. [bug] Forwarding of SIG(0) signed UPDATE messages failed with + BADSIG. [RT #37216] + +3960. [bug] 'dig +sigchase' could loop forever. [RT #37220] + +3959. [bug] Updates could be lost if they arrived immediately + after a rndc thaw. [RT #37233] + +3958. [bug] Detect when writeable files have multiple references + in named.conf. [RT #37172] + +3957. [bug] "dnssec-keygen -S" failed for ECCGOST, ECDSAP256SHA256 + and ECDSAP384SHA384. [RT #37183] + +3955. [bug] Notify messages due to changes are no longer queued + behind startup notify messages. [RT #24454] + +3954. [bug] Unchecked mutex init in dlz_dlopen_driver.c [RT #37112] + +3953. [bug] Don't escape semi-colon in TXT fields. [RT #37159] + +3952. [bug] dns_name_fullcompare failed to set *nlabelsp when the + two name pointers were the same. [RT #37176] + --- 9.9.6 released --- 3950. [port] Changed the bin/python Makefile to work around a @@ -63,7 +290,7 @@ 3922. [bug] When resigning, dnssec-signzone was removing all signatures from delegation nodes. It now - retains DS and (if applicable) NSEC signatures. + retains DS and (if applicable) NSEC signatures. [RT #36946] 3921. [bug] AD was inappropriately set on RPZ responses. [RT #36833] Modified: stable/9/contrib/bind9/COPYRIGHT ============================================================================== --- stable/9/contrib/bind9/COPYRIGHT Wed Apr 8 19:46:13 2015 (r281272) +++ stable/9/contrib/bind9/COPYRIGHT Wed Apr 8 19:49:38 2015 (r281273) @@ -1,4 +1,4 @@ -Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") +Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") Copyright (C) 1996-2003 Internet Software Consortium. Permission to use, copy, modify, and/or distribute this software for any Modified: stable/9/contrib/bind9/FAQ.xml ============================================================================== --- stable/9/contrib/bind9/FAQ.xml Wed Apr 8 19:46:13 2015 (r281272) +++ stable/9/contrib/bind9/FAQ.xml Wed Apr 8 19:49:38 2015 (r281273) @@ -1,7 +1,7 @@