commit b17da5b
Michael Forney
·
2026-05-20 08:17:08 +0000 UTC
parent 3c4affc
openbsd: Update to 7.9
13 files changed,
+285,
-184
1@@ -1,4 +1,4 @@
2-From edf250c633bef40e7e37dafc9fc393dd2ad9074f Mon Sep 17 00:00:00 2001
3+From 6409a0c0efb552c6cbb8b8da17328bb65dd3473d Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Tue, 10 Apr 2018 13:37:14 -0700
6 Subject: [PATCH] m4: Use hand-written lexer to avoid cycle in bootstrap
7@@ -209,12 +209,12 @@ index 00000000000..fa19fc65035
8 +}
9 diff --git a/usr.bin/m4/tokenizer.l b/usr.bin/m4/tokenizer.l
10 deleted file mode 100644
11-index 94f02fb6085..00000000000
12+index 36f9b58853c..00000000000
13 --- a/usr.bin/m4/tokenizer.l
14 +++ /dev/null
15 @@ -1,109 +0,0 @@
16 -%{
17--/* $OpenBSD: tokenizer.l,v 1.10 2017/06/17 01:55:16 bcallah Exp $ */
18+-/* $OpenBSD: tokenizer.l,v 1.11 2025/11/05 17:10:45 tb Exp $ */
19 -/*
20 - * Copyright (c) 2004 Marc Espie <espie@cvs.openbsd.org>
21 - *
22@@ -276,7 +276,7 @@ index 94f02fb6085..00000000000
23 -%%
24 -
25 -int32_t
26--number()
27+-number(void)
28 -{
29 - long l;
30 -
31@@ -289,7 +289,7 @@ index 94f02fb6085..00000000000
32 -}
33 -
34 -int32_t
35--parse_radix()
36+-parse_radix(void)
37 -{
38 - long base;
39 - char *next;
40@@ -323,5 +323,5 @@ index 94f02fb6085..00000000000
41 -}
42 -
43 --
44-2.17.0
45+2.54.0
46
1@@ -1,17 +1,28 @@
2-From 941679ac1af45e3359fa28172cd9339727c08a17 Mon Sep 17 00:00:00 2001
3+From 36bb1d71b1e6963feb61fdf13c3e2f1cd55b0f5c Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Mon, 2 Dec 2019 21:11:04 -0800
6 Subject: [PATCH] nc: Portability fixes from libressl-portable
7
8 ---
9- usr.bin/nc/netcat.c | 55 +++++++++++++++++++++++++++++++++++++++------
10- 1 file changed, 48 insertions(+), 7 deletions(-)
11+ usr.bin/nc/netcat.c | 59 +++++++++++++++++++++++++++++++++++++++------
12+ 1 file changed, 52 insertions(+), 7 deletions(-)
13
14 diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c
15-index e3c9c939e24..9d182198089 100644
16+index 9361ff50cd9..4fd399a6f89 100644
17 --- a/usr.bin/nc/netcat.c
18 +++ b/usr.bin/nc/netcat.c
19-@@ -93,9 +93,13 @@ int zflag; /* Port Scan Flag */
20+@@ -73,6 +73,10 @@
21+ #define TLS_CCERT (1 << 3)
22+ #define TLS_MUSTSTAPLE (1 << 4)
23+
24++#ifndef IPTOS_DSCP_VA
25++#define IPTOS_DSCP_VA 0xb0
26++#endif
27++
28+ /* Command Line Options */
29+ int dflag; /* detached, no stdin */
30+ int Fflag; /* fdpass sock to stdout */
31+@@ -93,9 +97,13 @@ int zflag; /* Port Scan Flag */
32 int Dflag; /* sodebug */
33 int Iflag; /* TCP receive buffer size */
34 int Oflag; /* TCP send buffer size */
35@@ -25,7 +36,7 @@ index e3c9c939e24..9d182198089 100644
36
37 int usetls; /* use TLS */
38 const char *Cflag; /* Public cert file */
39-@@ -271,12 +275,14 @@ main(int argc, char *argv[])
40+@@ -271,12 +279,14 @@ main(int argc, char *argv[])
41 case 'u':
42 uflag = 1;
43 break;
44@@ -40,7 +51,7 @@ index e3c9c939e24..9d182198089 100644
45 case 'v':
46 vflag = 1;
47 break;
48-@@ -323,9 +329,11 @@ main(int argc, char *argv[])
49+@@ -323,9 +333,11 @@ main(int argc, char *argv[])
50 case 'o':
51 oflag = optarg;
52 break;
53@@ -52,7 +63,7 @@ index e3c9c939e24..9d182198089 100644
54 case 'T':
55 errstr = NULL;
56 errno = 0;
57-@@ -349,9 +357,11 @@ main(int argc, char *argv[])
58+@@ -349,9 +361,11 @@ main(int argc, char *argv[])
59 argc -= optind;
60 argv += optind;
61
62@@ -64,7 +75,7 @@ index e3c9c939e24..9d182198089 100644
63
64 /* Cruft to make sure options are clean, and used properly. */
65 if (argc == 1 && family == AF_UNIX) {
66-@@ -928,7 +938,10 @@ remote_connect(const char *host, const char *port, struct addrinfo hints,
67+@@ -930,7 +944,10 @@ remote_connect(const char *host, const char *port, struct addrinfo hints,
68 char *ipaddr)
69 {
70 struct addrinfo *res, *res0;
71@@ -76,7 +87,7 @@ index e3c9c939e24..9d182198089 100644
72
73 if ((error = getaddrinfo(host, port, &hints, &res0)))
74 errx(1, "getaddrinfo for host \"%s\" port %s: %s", host,
75-@@ -943,8 +956,10 @@ remote_connect(const char *host, const char *port, struct addrinfo hints,
76+@@ -945,8 +962,10 @@ remote_connect(const char *host, const char *port, struct addrinfo hints,
77 if (sflag || pflag) {
78 struct addrinfo ahints, *ares;
79
80@@ -87,7 +98,7 @@ index e3c9c939e24..9d182198089 100644
81 memset(&ahints, 0, sizeof(struct addrinfo));
82 ahints.ai_family = res->ai_family;
83 ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
84-@@ -1036,8 +1051,11 @@ int
85+@@ -1038,8 +1057,11 @@ int
86 local_listen(const char *host, const char *port, struct addrinfo hints)
87 {
88 struct addrinfo *res, *res0;
89@@ -100,7 +111,7 @@ index e3c9c939e24..9d182198089 100644
90
91 /* Allow nodename to be null. */
92 hints.ai_flags |= AI_PASSIVE;
93-@@ -1057,9 +1075,11 @@ local_listen(const char *host, const char *port, struct addrinfo hints)
94+@@ -1059,9 +1081,11 @@ local_listen(const char *host, const char *port, struct addrinfo hints)
95 res->ai_protocol)) == -1)
96 continue;
97
98@@ -112,7 +123,7 @@ index e3c9c939e24..9d182198089 100644
99
100 set_common_sockopts(s, res->ai_family);
101
102-@@ -1564,11 +1584,13 @@ set_common_sockopts(int s, int af)
103+@@ -1571,11 +1595,13 @@ set_common_sockopts(int s, int af)
104 {
105 int x = 1;
106
107@@ -126,7 +137,7 @@ index e3c9c939e24..9d182198089 100644
108 if (Dflag) {
109 if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
110 &x, sizeof(x)) == -1)
111-@@ -1579,9 +1601,16 @@ set_common_sockopts(int s, int af)
112+@@ -1586,9 +1612,16 @@ set_common_sockopts(int s, int af)
113 IP_TOS, &Tflag, sizeof(Tflag)) == -1)
114 err(1, "set IP ToS");
115
116@@ -143,7 +154,7 @@ index e3c9c939e24..9d182198089 100644
117 }
118 if (Iflag) {
119 if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
120-@@ -1605,13 +1634,17 @@ set_common_sockopts(int s, int af)
121+@@ -1612,13 +1645,17 @@ set_common_sockopts(int s, int af)
122 }
123
124 if (minttl != -1) {
125@@ -162,7 +173,7 @@ index e3c9c939e24..9d182198089 100644
126 }
127 }
128
129-@@ -1841,14 +1874,22 @@ help(void)
130+@@ -1849,14 +1886,22 @@ help(void)
131 \t-P proxyuser\tUsername for proxy authentication\n\
132 \t-p port\t Specify local port for remote connects\n\
133 \t-R CAfile CA bundle\n\
134@@ -190,5 +201,5 @@ index e3c9c939e24..9d182198089 100644
135 \t-W recvlimit Terminate after receiving a number of packets\n\
136 \t-w timeout Timeout for connects and final net reads\n\
137 --
138-2.49.0
139+2.54.0
140
1@@ -1,4 +1,4 @@
2-From c3aab43559f17feb64a29f8b0d395532cb423e8b Mon Sep 17 00:00:00 2001
3+From 9121d31f3ca0d49395846334752b6e820da66cf4 Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Wed, 15 Apr 2020 20:26:16 -0700
6 Subject: [PATCH] acme-client: Fix build with old bison versions
7@@ -8,10 +8,10 @@ Subject: [PATCH] acme-client: Fix build with old bison versions
8 1 file changed, 1 insertion(+)
9
10 diff --git a/usr.sbin/acme-client/parse.y b/usr.sbin/acme-client/parse.y
11-index 20818328d92..f392e516b63 100644
12+index 5b9795f948b..14a3cec8203 100644
13 --- a/usr.sbin/acme-client/parse.y
14 +++ b/usr.sbin/acme-client/parse.y
15-@@ -97,6 +97,7 @@ typedef struct {
16+@@ -100,6 +100,7 @@ typedef struct {
17 } v;
18 int lineno;
19 } YYSTYPE;
20@@ -20,5 +20,5 @@ index 20818328d92..f392e516b63 100644
21 %}
22
23 --
24-2.26.1
25+2.54.0
26
1@@ -1,4 +1,4 @@
2-From 666a050e706230ba5b0316a316100d8c7e86c93c Mon Sep 17 00:00:00 2001
3+From df8af384d7c22f6bfee93e6ff1f9bcf501549664 Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Thu, 4 Jun 2020 21:42:18 -0700
6 Subject: [PATCH] m4: Declare dopaste only when it's used
7@@ -8,19 +8,19 @@ Subject: [PATCH] m4: Declare dopaste only when it's used
8 1 file changed, 2 insertions(+)
9
10 diff --git a/usr.bin/m4/eval.c b/usr.bin/m4/eval.c
11-index d226505cab3..fe9fbde3d9c 100644
12+index 9ee73fcd3d6..ba828074a5a 100644
13 --- a/usr.bin/m4/eval.c
14 +++ b/usr.bin/m4/eval.c
15-@@ -61,7 +61,9 @@ static void dodump(const char *[], int);
16+@@ -61,7 +61,9 @@ static void dodumpdef(const char *[], int);
17 static void dotrace(const char *[], int, int);
18 static void doifelse(const char *[], int);
19- static int doincl(const char *);
20+ static int doinclude(const char *);
21 +#ifdef EXTENDED
22 static int dopaste(const char *);
23 +#endif
24- static void dochq(const char *[], int);
25- static void dochc(const char *[], int);
26+ static void dochangequote(const char *[], int);
27+ static void dochangecom(const char *[], int);
28 static void dom4wrap(const char *);
29 --
30-2.27.0
31+2.54.0
32
1@@ -1,4 +1,4 @@
2-From d287356e4da2f2bc232df9bc13821738ffbe5299 Mon Sep 17 00:00:00 2001
3+From 0f55823084233ab6980c6c1beb9a2fedadc7a5ee Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Fri, 23 Apr 2021 20:10:05 -0700
6 Subject: [PATCH] acme-client: Fix signed-ness of base64buf_url input
7@@ -9,8 +9,8 @@ This make most of the pointer casts unnecessary.
8 usr.sbin/acme-client/base64.c | 2 +-
9 usr.sbin/acme-client/extern.h | 2 +-
10 usr.sbin/acme-client/keyproc.c | 5 +++--
11- usr.sbin/acme-client/revokeproc.c | 6 ++++--
12- 5 files changed, 18 insertions(+), 14 deletions(-)
13+ usr.sbin/acme-client/revokeproc.c | 5 +++--
14+ 5 files changed, 17 insertions(+), 14 deletions(-)
15
16 diff --git a/usr.sbin/acme-client/acctproc.c b/usr.sbin/acme-client/acctproc.c
17 index da3d49107ae..9e97a8bb760 100644
18@@ -96,10 +96,10 @@ index 2b6377f0d81..0d84ad4b458 100644
19 size_t i, sz;
20 char *buf;
21 diff --git a/usr.sbin/acme-client/extern.h b/usr.sbin/acme-client/extern.h
22-index 46a1387f5bc..37820e6cfb6 100644
23+index 8b500561744..990c784f706 100644
24 --- a/usr.sbin/acme-client/extern.h
25 +++ b/usr.sbin/acme-client/extern.h
26-@@ -244,7 +244,7 @@ int checkexit_ext(int *, pid_t, enum comp);
27+@@ -241,7 +241,7 @@ int checkexit_ext(int *, pid_t, enum comp);
28 * Returns a buffer or NULL on allocation error.
29 */
30 size_t base64len(size_t);
31@@ -109,20 +109,20 @@ index 46a1387f5bc..37820e6cfb6 100644
32 /*
33 * JSON parsing routines.
34 diff --git a/usr.sbin/acme-client/keyproc.c b/usr.sbin/acme-client/keyproc.c
35-index a3b6666c279..f0df9f292d4 100644
36+index bab74c2b385..4360156b9c0 100644
37 --- a/usr.sbin/acme-client/keyproc.c
38 +++ b/usr.sbin/acme-client/keyproc.c
39-@@ -77,7 +77,8 @@ int
40- keyproc(int netsock, const char *keyfile, const char **alts, size_t altsz,
41- enum keytype keytype)
42+@@ -76,7 +76,8 @@ add_ext(STACK_OF(X509_EXTENSION) *sk, int nid, const char *value)
43+ int
44+ keyproc(int netsock, struct domain_c *domain)
45 {
46 - char *der64 = NULL, *der = NULL, *dercp;
47 + char *der64 = NULL;
48 + unsigned char *der = NULL, *dercp;
49 char *sans = NULL, *san = NULL;
50 FILE *f;
51- size_t i, sansz;
52-@@ -238,7 +239,7 @@ keyproc(int netsock, const char *keyfile, const char **alts, size_t altsz,
53+ size_t sansz;
54+@@ -234,7 +235,7 @@ keyproc(int netsock, struct domain_c *domain)
55 } else if ((der = dercp = malloc(len)) == NULL) {
56 warn("malloc");
57 goto out;
58@@ -132,21 +132,20 @@ index a3b6666c279..f0df9f292d4 100644
59 goto out;
60 } else if ((der64 = base64buf_url(der, len)) == NULL) {
61 diff --git a/usr.sbin/acme-client/revokeproc.c b/usr.sbin/acme-client/revokeproc.c
62-index 65170078226..493a9ea9752 100644
63+index 6fe34043129..c0963a278fb 100644
64 --- a/usr.sbin/acme-client/revokeproc.c
65 +++ b/usr.sbin/acme-client/revokeproc.c
66-@@ -77,7 +77,9 @@ revokeproc(int fd, const char *certfile, int force,
67- int revocate, const char *const *alts, size_t altsz)
68+@@ -79,7 +79,8 @@ revokeproc(int fd, const char *certfile, int force,
69+ int revocate, struct domain_c *domain)
70 {
71 GENERAL_NAMES *sans = NULL;
72 - char *der = NULL, *dercp, *der64 = NULL;
73 + unsigned char *der = NULL, *dercp;
74 + char *der64 = NULL;
75-+ char *san = NULL, *str, *tok;
76- int rc = 0, cc, i, len;
77- size_t *found = NULL;
78+ int rc = 0, cc, sanidx, len, j, k;
79+ int *found_altnames = NULL;
80 FILE *f = NULL;
81-@@ -260,7 +262,7 @@ revokeproc(int fd, const char *certfile, int force,
82+@@ -320,7 +321,7 @@ revokeproc(int fd, const char *certfile, int force,
83 } else if ((der = dercp = malloc(len)) == NULL) {
84 warn("malloc");
85 goto out;
86@@ -156,5 +155,5 @@ index 65170078226..493a9ea9752 100644
87 goto out;
88 } else if ((der64 = base64buf_url(der, len)) == NULL) {
89 --
90-2.49.0
91+2.54.0
92
1@@ -1,4 +1,4 @@
2-From 6abdd6eef47b5ff9a34536acbec947d2c9a3cebc Mon Sep 17 00:00:00 2001
3+From 4ad4ffcb7c731ae48c97b93760d7625724a991bc Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Fri, 23 Apr 2021 23:14:16 -0700
6 Subject: [PATCH] acme-client: Port to BearSSL
7@@ -8,9 +8,9 @@ Subject: [PATCH] acme-client: Port to BearSSL
8 usr.sbin/acme-client/certproc.c | 5 -
9 usr.sbin/acme-client/key.c | 329 ++++++++++++++++++++++++------
10 usr.sbin/acme-client/key.h | 22 +-
11- usr.sbin/acme-client/keyproc.c | 198 ++++++------------
12- usr.sbin/acme-client/revokeproc.c | 260 +++++++++++------------
13- 6 files changed, 566 insertions(+), 546 deletions(-)
14+ usr.sbin/acme-client/keyproc.c | 192 ++++++-----------
15+ usr.sbin/acme-client/revokeproc.c | 319 +++++++++++------------------
16+ 6 files changed, 568 insertions(+), 597 deletions(-)
17
18 diff --git a/usr.sbin/acme-client/acctproc.c b/usr.sbin/acme-client/acctproc.c
19 index 9e97a8bb760..8d66dac49d9 100644
20@@ -951,7 +951,7 @@ index 272d36eb09a..12abdec813c 100644
21
22 #endif /* ! KEY_H */
23 diff --git a/usr.sbin/acme-client/keyproc.c b/usr.sbin/acme-client/keyproc.c
24-index f0df9f292d4..fc7de74b616 100644
25+index 4360156b9c0..19b8077a8fb 100644
26 --- a/usr.sbin/acme-client/keyproc.c
27 +++ b/usr.sbin/acme-client/keyproc.c
28 @@ -18,55 +18,18 @@
29@@ -1013,40 +1013,41 @@ index f0df9f292d4..fc7de74b616 100644
30 /*
31 * Create an X509 certificate from the private key we have on file.
32 * To do this, we first open the key file, then jail ourselves.
33-@@ -77,18 +40,20 @@ int
34- keyproc(int netsock, const char *keyfile, const char **alts, size_t altsz,
35- enum keytype keytype)
36+@@ -76,19 +39,20 @@ add_ext(STACK_OF(X509_EXTENSION) *sk, int nid, const char *value)
37+ int
38+ keyproc(int netsock, struct domain_c *domain)
39 {
40 - char *der64 = NULL;
41 - unsigned char *der = NULL, *dercp;
42 - char *sans = NULL, *san = NULL;
43 - FILE *f;
44-- size_t i, sansz;
45+- size_t sansz;
46 - void *pp;
47 - EVP_PKEY *pkey = NULL;
48 - X509_REQ *x = NULL;
49-- X509_NAME *name = NULL;
50-- int len, rc = 0, cc, nid, newkey = 0;
51+- int len, rc = 0, cc, nid, newkey = 0, first;
52 - mode_t prev;
53 - STACK_OF(X509_EXTENSION) *exts = NULL;
54+- struct altname_c *ac;
55+- const char *keyfile = domain->key;
56 + char *der64 = NULL;
57 + unsigned char *der = NULL;
58 + FILE *f;
59-+ size_t i;
60 + struct key *pkey = NULL;
61 + struct x509cert_req req;
62 + struct x509cert_skey skey;
63 + struct x509cert_dn dn;
64-+ struct x509cert_rdn rdn;
65 + struct x509cert_item item;
66-+ int len, rc = 0, newkey = 0;
67++ int len, rc = 0, newkey = 0, i;
68 + mode_t prev;
69++ struct altname_c *ac;
70++ const char *keyfile = domain->key;
71 +
72 + req.alts = NULL;
73
74 /*
75 * First, open our private key file read-only or write-only if
76-@@ -110,8 +75,6 @@ keyproc(int netsock, const char *keyfile, const char **alts, size_t altsz,
77+@@ -110,8 +74,6 @@ keyproc(int netsock, struct domain_c *domain)
78
79 /* File-system, user, and sandbox jail. */
80
81@@ -1055,7 +1056,7 @@ index f0df9f292d4..fc7de74b616 100644
82 if (pledge("stdio", NULL) == -1) {
83 warn("pledge");
84 goto out;
85-@@ -145,102 +108,61 @@ keyproc(int netsock, const char *keyfile, const char **alts, size_t altsz,
86+@@ -145,98 +107,65 @@ keyproc(int netsock, struct domain_c *domain)
87 * Then set it as the X509 requester's key.
88 */
89
90@@ -1081,29 +1082,6 @@ index f0df9f292d4..fc7de74b616 100644
91 + break;
92 }
93
94- /* Now specify the common name that we'll request. */
95-
96-- if ((name = X509_NAME_new()) == NULL) {
97-- warnx("X509_NAME_new");
98-- goto out;
99-- } else if (!X509_NAME_add_entry_by_txt(name, "CN",
100-- MBSTRING_ASC, (u_char *)alts[0], -1, -1, 0)) {
101-- warnx("X509_NAME_add_entry_by_txt: CN=%s", alts[0]);
102-- goto out;
103-- } else if (!X509_REQ_set_subject_name(x, name)) {
104-- warnx("X509_req_set_issuer_name");
105-- goto out;
106-- }
107-+ rdn.oid = x509cert_oid_CN;
108-+ rdn.val.tag = X509CERT_ASN1_UTF8STRING;
109-+ rdn.val.val = alts[0];
110-+ rdn.val.len = strlen(alts[0]);
111-+ rdn.val.enc = NULL;
112-+ dn.rdn = &rdn;
113-+ dn.rdn_len = 1;
114-+ req.subject.enc = x509cert_dn_encoder;
115-+ req.subject.val = &dn;
116-
117 - /*
118 - * Now add the SAN extensions.
119 - * This was lifted more or less directly from demos/x509/mkreq.c
120@@ -1111,22 +1089,29 @@ index f0df9f292d4..fc7de74b616 100644
121 - * (The zeroth altname is the domain name.)
122 - * TODO: is this the best way of doing this?
123 - */
124-+ /* Now add the SAN extension. */
125++ /* Use an empty subject. */
126
127 - nid = NID_subject_alt_name;
128 - if ((exts = sk_X509_EXTENSION_new_null()) == NULL) {
129 - warnx("sk_X509_EXTENSION_new_null");
130-+ req.alts_len = altsz;
131-+ req.alts = calloc(altsz, sizeof(req.alts[0]));
132+- goto out;
133+- }
134+- /* Initialise to empty string. */
135+- if ((sans = strdup("")) == NULL) {
136+- warn("strdup");
137++ dn.rdn = NULL;
138++ dn.rdn_len = 0;
139++ req.subject.enc = x509cert_dn_encoder;
140++ req.subject.val = &dn;
141++
142++ /* Now add the SAN extension. */
143++
144++ req.alts_len = domain->altname_count;
145++ req.alts = calloc(domain->altname_count, sizeof(req.alts[0]));
146 + if (req.alts == NULL) {
147 + warn("calloc");
148 goto out;
149 }
150-- /* Initialise to empty string. */
151-- if ((sans = strdup("")) == NULL) {
152-- warn("strdup");
153-- goto out;
154-- }
155 - sansz = strlen(sans) + 1;
156
157 - /*
158@@ -1136,9 +1121,23 @@ index f0df9f292d4..fc7de74b616 100644
159 - */
160 + /* Add a dNSName SAN entry for each alternate name. */
161
162- for (i = 0; i < altsz; i++) {
163-- cc = asprintf(&san, "%sDNS:%s",
164-- i ? "," : "", alts[i]);
165+- first = 1;
166++ i = 0;
167+ TAILQ_FOREACH(ac, &domain->altname_list, entry) {
168+ switch (ac->idtype) {
169+ case ID_DNS:
170+- cc = asprintf(&san, "%sDNS:%s", first ? "" : ",",
171+- ac->domain);
172++ req.alts[i].tag = X509CERT_SAN_DNSNAME;
173++ req.alts[i].val = ac->domain;
174++ req.alts[i].len = strlen(ac->domain);
175+ break;
176+ case ID_IP:
177+- cc = asprintf(&san, "%sIP:%s", first ? "" : ",",
178+- ac->domain);
179+- break;
180+- }
181+- first = 0;
182 - if (cc == -1) {
183 - warn("asprintf");
184 - goto out;
185@@ -1146,8 +1145,9 @@ index f0df9f292d4..fc7de74b616 100644
186 - pp = recallocarray(sans, sansz, sansz + strlen(san), 1);
187 - if (pp == NULL) {
188 - warn("recallocarray");
189-- goto out;
190-- }
191++ warnx("ID_IP is not supported");
192+ goto out;
193+ }
194 - sans = pp;
195 - sansz += strlen(san);
196 - strlcat(sans, san, sansz);
197@@ -1169,9 +1169,7 @@ index f0df9f292d4..fc7de74b616 100644
198 - if (!X509_REQ_sign(x, pkey, EVP_sha256())) {
199 - warnx("X509_sign");
200 - goto out;
201-+ req.alts[i].tag = X509CERT_SAN_DNSNAME;
202-+ req.alts[i].val = alts[i];
203-+ req.alts[i].len = strlen(alts[i]);
204++ i++;
205 }
206
207 - /* Now, serialise to DER, then base64. */
208@@ -1196,14 +1194,13 @@ index f0df9f292d4..fc7de74b616 100644
209 goto out;
210 } else if ((der64 = base64buf_url(der, len)) == NULL) {
211 warnx("base64buf_url");
212-@@ -265,12 +187,8 @@ out:
213+@@ -261,11 +190,8 @@ out:
214 fclose(f);
215 free(der);
216 free(der64);
217 - free(sans);
218 - free(san);
219 - X509_REQ_free(x);
220-- X509_NAME_free(name);
221 - EVP_PKEY_free(pkey);
222 - ERR_print_errors_fp(stderr);
223 - ERR_free_strings();
224@@ -1213,10 +1210,19 @@ index f0df9f292d4..fc7de74b616 100644
225 return rc;
226 }
227 diff --git a/usr.sbin/acme-client/revokeproc.c b/usr.sbin/acme-client/revokeproc.c
228-index 493a9ea9752..82e31792f3b 100644
229+index c0963a278fb..2109d7a8799 100644
230 --- a/usr.sbin/acme-client/revokeproc.c
231 +++ b/usr.sbin/acme-client/revokeproc.c
232-@@ -22,73 +22,53 @@
233+@@ -15,8 +15,6 @@
234+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
235+ */
236+
237+-#include <sys/socket.h>
238+-#include <arpa/inet.h>
239+ #include <assert.h>
240+ #include <ctype.h>
241+ #include <err.h>
242+@@ -24,71 +22,54 @@
243 #include <stdio.h>
244 #include <stdlib.h>
245 #include <string.h>
246@@ -1291,18 +1297,17 @@ index 493a9ea9752..82e31792f3b 100644
247
248 int
249 revokeproc(int fd, const char *certfile, int force,
250- int revocate, const char *const *alts, size_t altsz)
251+ int revocate, struct domain_c *domain)
252 {
253 - GENERAL_NAMES *sans = NULL;
254 - unsigned char *der = NULL, *dercp;
255 - char *der64 = NULL;
256-- char *san = NULL, *str, *tok;
257-- int rc = 0, cc, i, len;
258-- size_t *found = NULL;
259+- int rc = 0, cc, sanidx, len, j, k;
260+- int *found_altnames = NULL;
261 + static const unsigned char dnsname[] = {0, 2};
262 + char buf[8192], *pos, *sans = NULL, *der64 = NULL;
263-+ int rc = 0, cc, state, err;
264-+ size_t i, j, n, len = 0, altlen, altmax, eltsz;
265++ int rc = 0, cc, i, eltsz, state, err;
266++ size_t n, len = 0, altlen, altmax;
267 FILE *f = NULL;
268 - X509 *x = NULL;
269 + br_pem_decoder_context pc;
270@@ -1315,11 +1320,11 @@ index 493a9ea9752..82e31792f3b 100644
271 enum revokeop op, rop;
272 time_t notafter, notbefore, cert_validity;
273 time_t remaining_validity, renew_allow;
274-- size_t j;
275++ struct altname_c *ac;
276
277 /*
278 * First try to open the certificate before we drop privileges
279-@@ -103,8 +83,6 @@ revokeproc(int fd, const char *certfile, int force,
280+@@ -103,8 +84,6 @@ revokeproc(int fd, const char *certfile, int force,
281
282 /* File-system and sandbox jailing. */
283
284@@ -1328,7 +1333,7 @@ index 493a9ea9752..82e31792f3b 100644
285 if (pledge("stdio", NULL) == -1) {
286 warn("pledge");
287 goto out;
288-@@ -128,44 +106,88 @@ revokeproc(int fd, const char *certfile, int force,
289+@@ -128,45 +107,89 @@ revokeproc(int fd, const char *certfile, int force,
290 goto out;
291 }
292
293@@ -1397,12 +1402,13 @@ index 493a9ea9752..82e31792f3b 100644
294 + br_x509_decoder_get_notbefore(&xd, &days, &secs);
295 + notbefore = 86400ll * (days - 719528) + 86400;
296 +
297-+ for (i = 0, altmax = 0; i < altsz; ++i) {
298-+ altlen = strlen(alts[i]) + 1;
299++ altmax = 0;
300++ TAILQ_FOREACH(ac, &domain->altname_list, entry) {
301++ altlen = strlen(ac->domain) + 1;
302 + if (altlen > altmax)
303 + altmax = altlen;
304 + }
305-+ eltsz = altsz + 1;
306++ eltsz = domain->altname_count + 1;
307 + if ((elts = calloc(eltsz, sizeof(elts[0]))) == NULL ||
308 + (sans = calloc(eltsz, altmax)) == NULL) {
309 + warn("calloc");
310@@ -1426,7 +1432,8 @@ index 493a9ea9752..82e31792f3b 100644
311 - /* An array of buckets: the number of entries found. */
312 + /* Extract list of SAN entries from the certificate. */
313
314-- if ((found = calloc(altsz, sizeof(size_t))) == NULL) {
315+- if ((found_altnames = (int *)calloc(domain->altname_count,
316+- sizeof(int))) == NULL) {
317 - warn("calloc");
318 + br_x509_minimal_init(&xc, &br_sha256_vtable, NULL, 0);
319 + br_x509_minimal_set_hash(&xc, br_sha256_ID, &br_sha256_vtable);
320@@ -1443,90 +1450,147 @@ index 493a9ea9752..82e31792f3b 100644
321 goto out;
322 }
323
324-@@ -174,63 +196,37 @@ revokeproc(int fd, const char *certfile, int force,
325+@@ -175,121 +198,37 @@ revokeproc(int fd, const char *certfile, int force,
326 * configuration file and that all domains are represented only once.
327 */
328
329-- for (i = 0; i < sk_GENERAL_NAME_num(sans); i++) {
330+- for (sanidx = 0; sanidx < sk_GENERAL_NAME_num(sans); sanidx++) {
331 - GENERAL_NAME *gen_name;
332-- const ASN1_IA5STRING *name;
333-- const unsigned char *name_buf;
334+- char *name_buf = NULL;
335 - int name_len;
336-- int name_type;
337+- struct altname_c *ac;
338 -
339-- gen_name = sk_GENERAL_NAME_value(sans, i);
340+- gen_name = sk_GENERAL_NAME_value(sans, sanidx);
341 - assert(gen_name != NULL);
342 -
343-- name = GENERAL_NAME_get0_value(gen_name, &name_type);
344-- if (name_type != GEN_DNS)
345+- if (gen_name->type == GEN_IPADD) {
346+- char ip_buf[INET6_ADDRSTRLEN];
347+- const char *ip;
348+-
349+- name_len = ASN1_STRING_length(gen_name->d.iPAddress);
350+- switch (name_len) {
351+- case 4:
352+- ip = inet_ntop(AF_INET,
353+- ASN1_STRING_get0_data(gen_name->d.iPAddress),
354+- ip_buf, INET6_ADDRSTRLEN);
355+- break;
356+- case 16:
357+- ip = inet_ntop(AF_INET6,
358+- ASN1_STRING_get0_data(gen_name->d.iPAddress),
359+- ip_buf, INET6_ADDRSTRLEN);
360+- break;
361+- default:
362+- ip = NULL;
363++ TAILQ_FOREACH(ac, &domain->altname_list, entry) {
364++ for (i = 0; i < eltsz; i++) {
365++ if (elts[i].status == 1 &&
366++ strcmp(ac->domain, elts[i].buf) == 0) {
367++ elts[i].status = 0;
368+ break;
369+ }
370+- if (ip == NULL) {
371+- warnx("invalid IP address");
372+- continue;
373+- }
374+- name_len = asprintf(&name_buf, "%s", ip);
375+- } else if (gen_name->type == GEN_DNS) {
376+- name_len = ASN1_STRING_length(gen_name->d.dNSName);
377+- name_len = asprintf(&name_buf, "%.*s",
378+- name_len,
379+- ASN1_STRING_get0_data(gen_name->d.dNSName));
380+- } else
381 - continue;
382 -
383-- /* name_buf isn't a C string and could contain embedded NULs. */
384-- name_buf = ASN1_STRING_get0_data(name);
385-- name_len = ASN1_STRING_length(name);
386+- if (name_len == -1) {
387+- warn("asprintf");
388+- continue;
389+ }
390 -
391-- for (j = 0; j < altsz; j++) {
392-- if ((size_t)name_len != strlen(alts[j]))
393-- continue;
394-- if (memcmp(name_buf, alts[j], name_len) == 0)
395-+ for (i = 0; i < altsz; i++) {
396-+ for (j = 0; j < eltsz; j++) {
397-+ if (elts[j].status == 1 &&
398-+ strcmp(alts[i], elts[j].buf) == 0) {
399-+ elts[j].status = 0;
400- break;
401+- j = 0;
402+- TAILQ_FOREACH(ac, &domain->altname_list, entry) {
403+- if (strcmp(name_buf, ac->domain) == 0) {
404+- found_altnames[j]++;
405+- break;
406+- }
407+- /* increment if didn't match */
408+- j++;
409 - }
410-- if (j == altsz) {
411+- if (j >= domain->altname_count) {
412+- /* we haven't matched any */
413 - if (revocate) {
414 - char *visbuf;
415 -
416 - visbuf = calloc(4, name_len + 1);
417 - if (visbuf == NULL) {
418-- warn("%s: unexpected SAN", certfile);
419+- warn("%s: unexpected SAN in "
420+- "certificate", certfile);
421+- free(name_buf);
422 - goto out;
423 - }
424 - strvisx(visbuf, name_buf, name_len, VIS_SAFE);
425-- warnx("%s: unexpected SAN entry: %s",
426-- certfile, visbuf);
427+- warnx("%s: unexpected SAN entry in "
428+- "certificate: %s", certfile, visbuf);
429 - free(visbuf);
430+- free(name_buf);
431 - goto out;
432- }
433+- }
434 - force = 2;
435 - continue;
436- }
437-- if (found[j]++) {
438-+ if (j == eltsz) {
439+- }
440+- /* should not reach here if j is out of bounds */
441+- if (found_altnames[j] > 1) {
442++ if (i == eltsz) {
443 if (revocate) {
444-- warnx("%s: duplicate SAN entry: %.*s",
445-- certfile, name_len, name_buf);
446-+ warnx("%s: domain not listed: %s", certfile, alts[i]);
447+- char *visbuf;
448+- visbuf = calloc(4, name_len + 1);
449+- if (visbuf == NULL) {
450+- warn("%s: duplicate SAN in "
451+- "certificate", certfile);
452+- free(name_buf);
453+- goto out;
454+- }
455+- warnx("%s: duplicate SAN entry in "
456+- "certificate: %s", certfile, visbuf);
457+- free(name_buf);
458+- free(visbuf);
459++ warnx("%s: domain not listed: %s", certfile, ac->domain);
460 goto out;
461 }
462 force = 2;
463 }
464+-
465+- free(name_buf);
466 }
467
468-- for (j = 0; j < altsz; j++) {
469-- if (found[j])
470+- for (j = 0; j < domain->altname_count; j++) {
471+- struct altname_c *ac;
472+-
473+- if (found_altnames[j])
474 + for (i = 0; i < eltsz; i++) {
475 + if (elts[i].status == 0)
476 continue;
477 if (revocate) {
478-- warnx("%s: domain not listed: %s", certfile, alts[j]);
479+- k = 0;
480+- TAILQ_FOREACH(ac, &domain->altname_list, entry) {
481+- if (j == k)
482+- break;
483+- k++;
484 + char *visbuf;
485 +
486 + if (elts[i].status != 1 ||
487 + stravis(&visbuf, elts[i].buf, VIS_SAFE) < 0) {
488 + warnx("%s: unexpected SAN", certfile);
489 + goto out;
490-+ }
491+ }
492+- warnx("%s: domain not listed: %s", certfile,
493+- ac->domain);
494 + warnx("%s: unexpected SAN entry: %s",
495 + certfile, visbuf);
496 + free(visbuf);
497 goto out;
498 }
499 force = 2;
500-@@ -256,16 +252,7 @@ revokeproc(int fd, const char *certfile, int force,
501+@@ -315,16 +254,7 @@ revokeproc(int fd, const char *certfile, int force,
502 if (cc <= 0)
503 goto out;
504
505@@ -1544,14 +1608,14 @@ index 493a9ea9752..82e31792f3b 100644
506 warnx("base64buf_url");
507 goto out;
508 } else if (writestr(fd, COMM_CSR, der64) >= 0)
509-@@ -339,12 +326,9 @@ out:
510+@@ -398,12 +328,9 @@ out:
511 close(fd);
512 if (f != NULL)
513 fclose(f);
514 - X509_free(x);
515 - GENERAL_NAMES_free(sans);
516 - free(der);
517-- free(found);
518+- free(found_altnames);
519 + free(cert.data);
520 + free(sans);
521 + free(elts);
522@@ -1561,5 +1625,5 @@ index 493a9ea9752..82e31792f3b 100644
523 return rc;
524 }
525 --
526-2.49.0
527+2.54.0
528
1@@ -1,4 +1,4 @@
2-From 0b4249dea4ec148875be7a7fedc8ec0873043c71 Mon Sep 17 00:00:00 2001
3+From e3267bbd5f0e3f8ea9caf07c92f58b046100901a Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Thu, 20 May 2021 13:44:35 -0700
6 Subject: [PATCH] nc: Add option to disable certificate time checking
7@@ -22,7 +22,7 @@ index 2ffdcd1ea60..ecff109e395 100644
8 which requires a client certificate on incoming connections; or
9 .Cm muststaple ,
10 diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c
11-index 9d182198089..74d18595309 100644
12+index 4fd399a6f89..982b65592fe 100644
13 --- a/usr.bin/nc/netcat.c
14 +++ b/usr.bin/nc/netcat.c
15 @@ -70,8 +70,9 @@
16@@ -35,9 +35,9 @@ index 9d182198089..74d18595309 100644
17 +#define TLS_CCERT (1 << 4)
18 +#define TLS_MUSTSTAPLE (1 << 5)
19
20- /* Command Line Options */
21- int dflag; /* detached, no stdin */
22-@@ -551,6 +552,8 @@ main(int argc, char *argv[])
23+ #ifndef IPTOS_DSCP_VA
24+ #define IPTOS_DSCP_VA 0xb0
25+@@ -557,6 +558,8 @@ main(int argc, char *argv[])
26 errx(1, "clientcert is only valid with -l");
27 if (TLSopt & TLS_NONAME)
28 tls_config_insecure_noverifyname(tls_cfg);
29@@ -46,7 +46,7 @@ index 9d182198089..74d18595309 100644
30 if (TLSopt & TLS_NOVERIFY) {
31 if (tls_expecthash != NULL)
32 errx(1, "-H and -T noverify may not be used "
33-@@ -1712,6 +1715,7 @@ process_tls_opt(char *s, int *flags)
34+@@ -1724,6 +1727,7 @@ process_tls_opt(char *s, int *flags)
35 { "clientcert", TLS_CCERT, NULL },
36 { "muststaple", TLS_MUSTSTAPLE, NULL },
37 { "noname", TLS_NONAME, NULL },
38@@ -55,5 +55,5 @@ index 9d182198089..74d18595309 100644
39 { "protocols", -1, &tls_protocols },
40 { NULL, -1, NULL },
41 --
42-2.49.0
43+2.54.0
44
1@@ -1,4 +1,4 @@
2-From 87c6da40a600a00d331d1d7f8968fd4ee933377a Mon Sep 17 00:00:00 2001
3+From ef9e08a9597e02425f9da0f43486e0cdfa1a4a1e Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Wed, 4 Mar 2026 15:27:54 -0800
6 Subject: [PATCH] acme-client: Fix enum/int mismatch in declaration of
7@@ -9,10 +9,10 @@ Subject: [PATCH] acme-client: Fix enum/int mismatch in declaration of
8 1 file changed, 1 insertion(+), 1 deletion(-)
9
10 diff --git a/usr.sbin/acme-client/extern.h b/usr.sbin/acme-client/extern.h
11-index 37820e6cfb6..3c780ebf777 100644
12+index 990c784f706..32127182548 100644
13 --- a/usr.sbin/acme-client/extern.h
14 +++ b/usr.sbin/acme-client/extern.h
15-@@ -252,7 +252,7 @@ char *base64buf_url(const unsigned char *, size_t);
16+@@ -249,7 +249,7 @@ char *base64buf_url(const unsigned char *, size_t);
17 */
18 struct jsmnn *json_parse(const char *, size_t);
19 void json_free(struct jsmnn *);
20@@ -22,5 +22,5 @@ index 37820e6cfb6..3c780ebf777 100644
21 int json_parse_challenge(struct jsmnn *, struct chng *);
22 void json_free_order(struct order *);
23 --
24-2.49.0
25+2.54.0
26
1@@ -1,4 +1,4 @@
2-From 4da7b308eb6d8c7947d3ea0106a49c8ab6e3481a Mon Sep 17 00:00:00 2001
3+From bcaddae8de94a8d2d448a287b42a75a7306999b7 Mon Sep 17 00:00:00 2001
4 From: Michael Forney <mforney@mforney.org>
5 Date: Sun, 17 May 2026 01:40:40 -0700
6 Subject: [PATCH] nc: Use explicit cast for pointer sign conversion
7@@ -8,10 +8,10 @@ Subject: [PATCH] nc: Use explicit cast for pointer sign conversion
8 1 file changed, 1 insertion(+), 1 deletion(-)
9
10 diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c
11-index 74d18595309..bb170967d8e 100644
12+index 982b65592fe..82f1686fa6f 100644
13 --- a/usr.bin/nc/netcat.c
14 +++ b/usr.bin/nc/netcat.c
15-@@ -1751,7 +1751,7 @@ save_peer_cert(struct tls *tls_ctx, FILE *fp)
16+@@ -1763,7 +1763,7 @@ save_peer_cert(struct tls *tls_ctx, FILE *fp)
17 const char *pem;
18 size_t plen;
19
1@@ -0,0 +1,27 @@
2+From 62369cc52d95e6998078951d9fcb633b2c013954 Mon Sep 17 00:00:00 2001
3+From: Michael Forney <mforney@mforney.org>
4+Date: Wed, 20 May 2026 01:56:37 -0700
5+Subject: [PATCH] Add fallback define for __pledge_open
6+
7+---
8+ lib/libc/gen/readpassphrase.c | 4 ++++
9+ 1 file changed, 4 insertions(+)
10+
11+diff --git a/lib/libc/gen/readpassphrase.c b/lib/libc/gen/readpassphrase.c
12+index c3bf85fb3eb..47f9c5707b5 100644
13+--- a/lib/libc/gen/readpassphrase.c
14++++ b/lib/libc/gen/readpassphrase.c
15+@@ -36,6 +36,10 @@
16+ #define TCSASOFT 0
17+ #endif
18+
19++#ifndef __OpenBSD__
20++#define __pledge_open open
21++#endif
22++
23+ static volatile sig_atomic_t signo[_NSIG];
24+
25+ static void handler(int);
26+--
27+2.54.0
28+
+2,
-2
1@@ -1,2 +1,2 @@
2-1f20cc61f3b5bc9be69be131f9c897635ca6c3b4eba3a69e938a68e74139f48a src.tar.gz
3-e24904caaee40e8774816b20f30983626f4a5434e04b4768a9ef451dc4bc39eb sys.tar.gz
4+fb305c553059b48e8ee64539f392b783cb38a67865823f6f6a94f3b220a1268b src.tar.gz
5+c9ef294021ef7aafd5f18ffe8ebfed63394e5a86d65d7436d6db78551f9d57f1 sys.tar.gz
+2,
-2
1@@ -1,5 +1,5 @@
2 remote-name
3-url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.8/src.tar.gz"
4+url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.9/src.tar.gz"
5
6 remote-name
7-url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.8/sys.tar.gz"
8+url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.9/sys.tar.gz"
+1,
-1
1@@ -1 +1 @@
2-7.8 r3
3+7.9