commit b17da5b

Michael Forney  ·  2026-05-20 08:17:08 +0000 UTC
parent 3c4affc
openbsd: Update to 7.9
13 files changed,  +285, -184
+6, -6
 1@@ -1,4 +1,4 @@
 2-From edf250c633bef40e7e37dafc9fc393dd2ad9074f Mon Sep 17 00:00:00 2001
 3+From 6409a0c0efb552c6cbb8b8da17328bb65dd3473d Mon Sep 17 00:00:00 2001
 4 From: Michael Forney <mforney@mforney.org>
 5 Date: Tue, 10 Apr 2018 13:37:14 -0700
 6 Subject: [PATCH] m4: Use hand-written lexer to avoid cycle in bootstrap
 7@@ -209,12 +209,12 @@ index 00000000000..fa19fc65035
 8 +}
 9 diff --git a/usr.bin/m4/tokenizer.l b/usr.bin/m4/tokenizer.l
10 deleted file mode 100644
11-index 94f02fb6085..00000000000
12+index 36f9b58853c..00000000000
13 --- a/usr.bin/m4/tokenizer.l
14 +++ /dev/null
15 @@ -1,109 +0,0 @@
16 -%{
17--/* $OpenBSD: tokenizer.l,v 1.10 2017/06/17 01:55:16 bcallah Exp $ */
18+-/* $OpenBSD: tokenizer.l,v 1.11 2025/11/05 17:10:45 tb Exp $ */
19 -/*
20 - * Copyright (c) 2004 Marc Espie <espie@cvs.openbsd.org>
21 - *
22@@ -276,7 +276,7 @@ index 94f02fb6085..00000000000
23 -%%
24 -
25 -int32_t
26--number()
27+-number(void)
28 -{
29 -	long l;
30 -
31@@ -289,7 +289,7 @@ index 94f02fb6085..00000000000
32 -}
33 -
34 -int32_t
35--parse_radix()
36+-parse_radix(void)
37 -{
38 -	long base;
39 -	char *next;
40@@ -323,5 +323,5 @@ index 94f02fb6085..00000000000
41 -}
42 -
43 -- 
44-2.17.0
45+2.54.0
46 
+28, -17
  1@@ -1,17 +1,28 @@
  2-From 941679ac1af45e3359fa28172cd9339727c08a17 Mon Sep 17 00:00:00 2001
  3+From 36bb1d71b1e6963feb61fdf13c3e2f1cd55b0f5c Mon Sep 17 00:00:00 2001
  4 From: Michael Forney <mforney@mforney.org>
  5 Date: Mon, 2 Dec 2019 21:11:04 -0800
  6 Subject: [PATCH] nc: Portability fixes from libressl-portable
  7 
  8 ---
  9- usr.bin/nc/netcat.c | 55 +++++++++++++++++++++++++++++++++++++++------
 10- 1 file changed, 48 insertions(+), 7 deletions(-)
 11+ usr.bin/nc/netcat.c | 59 +++++++++++++++++++++++++++++++++++++++------
 12+ 1 file changed, 52 insertions(+), 7 deletions(-)
 13 
 14 diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c
 15-index e3c9c939e24..9d182198089 100644
 16+index 9361ff50cd9..4fd399a6f89 100644
 17 --- a/usr.bin/nc/netcat.c
 18 +++ b/usr.bin/nc/netcat.c
 19-@@ -93,9 +93,13 @@ int	zflag;					/* Port Scan Flag */
 20+@@ -73,6 +73,10 @@
 21+ #define TLS_CCERT	(1 << 3)
 22+ #define TLS_MUSTSTAPLE	(1 << 4)
 23+ 
 24++#ifndef IPTOS_DSCP_VA
 25++#define IPTOS_DSCP_VA	0xb0
 26++#endif
 27++
 28+ /* Command Line Options */
 29+ int	dflag;					/* detached, no stdin */
 30+ int	Fflag;					/* fdpass sock to stdout */
 31+@@ -93,9 +97,13 @@ int	zflag;					/* Port Scan Flag */
 32  int	Dflag;					/* sodebug */
 33  int	Iflag;					/* TCP receive buffer size */
 34  int	Oflag;					/* TCP send buffer size */
 35@@ -25,7 +36,7 @@ index e3c9c939e24..9d182198089 100644
 36  
 37  int	usetls;					/* use TLS */
 38  const char    *Cflag;				/* Public cert file */
 39-@@ -271,12 +275,14 @@ main(int argc, char *argv[])
 40+@@ -271,12 +279,14 @@ main(int argc, char *argv[])
 41  		case 'u':
 42  			uflag = 1;
 43  			break;
 44@@ -40,7 +51,7 @@ index e3c9c939e24..9d182198089 100644
 45  		case 'v':
 46  			vflag = 1;
 47  			break;
 48-@@ -323,9 +329,11 @@ main(int argc, char *argv[])
 49+@@ -323,9 +333,11 @@ main(int argc, char *argv[])
 50  		case 'o':
 51  			oflag = optarg;
 52  			break;
 53@@ -52,7 +63,7 @@ index e3c9c939e24..9d182198089 100644
 54  		case 'T':
 55  			errstr = NULL;
 56  			errno = 0;
 57-@@ -349,9 +357,11 @@ main(int argc, char *argv[])
 58+@@ -349,9 +361,11 @@ main(int argc, char *argv[])
 59  	argc -= optind;
 60  	argv += optind;
 61  
 62@@ -64,7 +75,7 @@ index e3c9c939e24..9d182198089 100644
 63  
 64  	/* Cruft to make sure options are clean, and used properly. */
 65  	if (argc == 1 && family == AF_UNIX) {
 66-@@ -928,7 +938,10 @@ remote_connect(const char *host, const char *port, struct addrinfo hints,
 67+@@ -930,7 +944,10 @@ remote_connect(const char *host, const char *port, struct addrinfo hints,
 68      char *ipaddr)
 69  {
 70  	struct addrinfo *res, *res0;
 71@@ -76,7 +87,7 @@ index e3c9c939e24..9d182198089 100644
 72  
 73  	if ((error = getaddrinfo(host, port, &hints, &res0)))
 74  		errx(1, "getaddrinfo for host \"%s\" port %s: %s", host,
 75-@@ -943,8 +956,10 @@ remote_connect(const char *host, const char *port, struct addrinfo hints,
 76+@@ -945,8 +962,10 @@ remote_connect(const char *host, const char *port, struct addrinfo hints,
 77  		if (sflag || pflag) {
 78  			struct addrinfo ahints, *ares;
 79  
 80@@ -87,7 +98,7 @@ index e3c9c939e24..9d182198089 100644
 81  			memset(&ahints, 0, sizeof(struct addrinfo));
 82  			ahints.ai_family = res->ai_family;
 83  			ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
 84-@@ -1036,8 +1051,11 @@ int
 85+@@ -1038,8 +1057,11 @@ int
 86  local_listen(const char *host, const char *port, struct addrinfo hints)
 87  {
 88  	struct addrinfo *res, *res0;
 89@@ -100,7 +111,7 @@ index e3c9c939e24..9d182198089 100644
 90  
 91  	/* Allow nodename to be null. */
 92  	hints.ai_flags |= AI_PASSIVE;
 93-@@ -1057,9 +1075,11 @@ local_listen(const char *host, const char *port, struct addrinfo hints)
 94+@@ -1059,9 +1081,11 @@ local_listen(const char *host, const char *port, struct addrinfo hints)
 95  		    res->ai_protocol)) == -1)
 96  			continue;
 97  
 98@@ -112,7 +123,7 @@ index e3c9c939e24..9d182198089 100644
 99  
100  		set_common_sockopts(s, res->ai_family);
101  
102-@@ -1564,11 +1584,13 @@ set_common_sockopts(int s, int af)
103+@@ -1571,11 +1595,13 @@ set_common_sockopts(int s, int af)
104  {
105  	int x = 1;
106  
107@@ -126,7 +137,7 @@ index e3c9c939e24..9d182198089 100644
108  	if (Dflag) {
109  		if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
110  		    &x, sizeof(x)) == -1)
111-@@ -1579,9 +1601,16 @@ set_common_sockopts(int s, int af)
112+@@ -1586,9 +1612,16 @@ set_common_sockopts(int s, int af)
113  		    IP_TOS, &Tflag, sizeof(Tflag)) == -1)
114  			err(1, "set IP ToS");
115  
116@@ -143,7 +154,7 @@ index e3c9c939e24..9d182198089 100644
117  	}
118  	if (Iflag) {
119  		if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
120-@@ -1605,13 +1634,17 @@ set_common_sockopts(int s, int af)
121+@@ -1612,13 +1645,17 @@ set_common_sockopts(int s, int af)
122  	}
123  
124  	if (minttl != -1) {
125@@ -162,7 +173,7 @@ index e3c9c939e24..9d182198089 100644
126  	}
127  }
128  
129-@@ -1841,14 +1874,22 @@ help(void)
130+@@ -1849,14 +1886,22 @@ help(void)
131  	\t-P proxyuser\tUsername for proxy authentication\n\
132  	\t-p port\t	Specify local port for remote connects\n\
133  	\t-R CAfile	CA bundle\n\
134@@ -190,5 +201,5 @@ index e3c9c939e24..9d182198089 100644
135  	\t-W recvlimit	Terminate after receiving a number of packets\n\
136  	\t-w timeout	Timeout for connects and final net reads\n\
137 -- 
138-2.49.0
139+2.54.0
140 
+4, -4
 1@@ -1,4 +1,4 @@
 2-From c3aab43559f17feb64a29f8b0d395532cb423e8b Mon Sep 17 00:00:00 2001
 3+From 9121d31f3ca0d49395846334752b6e820da66cf4 Mon Sep 17 00:00:00 2001
 4 From: Michael Forney <mforney@mforney.org>
 5 Date: Wed, 15 Apr 2020 20:26:16 -0700
 6 Subject: [PATCH] acme-client: Fix build with old bison versions
 7@@ -8,10 +8,10 @@ Subject: [PATCH] acme-client: Fix build with old bison versions
 8  1 file changed, 1 insertion(+)
 9 
10 diff --git a/usr.sbin/acme-client/parse.y b/usr.sbin/acme-client/parse.y
11-index 20818328d92..f392e516b63 100644
12+index 5b9795f948b..14a3cec8203 100644
13 --- a/usr.sbin/acme-client/parse.y
14 +++ b/usr.sbin/acme-client/parse.y
15-@@ -97,6 +97,7 @@ typedef struct {
16+@@ -100,6 +100,7 @@ typedef struct {
17  	} v;
18  	int lineno;
19  } YYSTYPE;
20@@ -20,5 +20,5 @@ index 20818328d92..f392e516b63 100644
21  %}
22  
23 -- 
24-2.26.1
25+2.54.0
26 
+7, -7
 1@@ -1,4 +1,4 @@
 2-From 666a050e706230ba5b0316a316100d8c7e86c93c Mon Sep 17 00:00:00 2001
 3+From df8af384d7c22f6bfee93e6ff1f9bcf501549664 Mon Sep 17 00:00:00 2001
 4 From: Michael Forney <mforney@mforney.org>
 5 Date: Thu, 4 Jun 2020 21:42:18 -0700
 6 Subject: [PATCH] m4: Declare dopaste only when it's used
 7@@ -8,19 +8,19 @@ Subject: [PATCH] m4: Declare dopaste only when it's used
 8  1 file changed, 2 insertions(+)
 9 
10 diff --git a/usr.bin/m4/eval.c b/usr.bin/m4/eval.c
11-index d226505cab3..fe9fbde3d9c 100644
12+index 9ee73fcd3d6..ba828074a5a 100644
13 --- a/usr.bin/m4/eval.c
14 +++ b/usr.bin/m4/eval.c
15-@@ -61,7 +61,9 @@ static void	dodump(const char *[], int);
16+@@ -61,7 +61,9 @@ static void	dodumpdef(const char *[], int);
17  static void	dotrace(const char *[], int, int);
18  static void	doifelse(const char *[], int);
19- static int	doincl(const char *);
20+ static int	doinclude(const char *);
21 +#ifdef EXTENDED
22  static int	dopaste(const char *);
23 +#endif
24- static void	dochq(const char *[], int);
25- static void	dochc(const char *[], int);
26+ static void	dochangequote(const char *[], int);
27+ static void	dochangecom(const char *[], int);
28  static void	dom4wrap(const char *);
29 -- 
30-2.27.0
31+2.54.0
32 
+18, -19
 1@@ -1,4 +1,4 @@
 2-From d287356e4da2f2bc232df9bc13821738ffbe5299 Mon Sep 17 00:00:00 2001
 3+From 0f55823084233ab6980c6c1beb9a2fedadc7a5ee Mon Sep 17 00:00:00 2001
 4 From: Michael Forney <mforney@mforney.org>
 5 Date: Fri, 23 Apr 2021 20:10:05 -0700
 6 Subject: [PATCH] acme-client: Fix signed-ness of base64buf_url input
 7@@ -9,8 +9,8 @@ This make most of the pointer casts unnecessary.
 8  usr.sbin/acme-client/base64.c     |  2 +-
 9  usr.sbin/acme-client/extern.h     |  2 +-
10  usr.sbin/acme-client/keyproc.c    |  5 +++--
11- usr.sbin/acme-client/revokeproc.c |  6 ++++--
12- 5 files changed, 18 insertions(+), 14 deletions(-)
13+ usr.sbin/acme-client/revokeproc.c |  5 +++--
14+ 5 files changed, 17 insertions(+), 14 deletions(-)
15 
16 diff --git a/usr.sbin/acme-client/acctproc.c b/usr.sbin/acme-client/acctproc.c
17 index da3d49107ae..9e97a8bb760 100644
18@@ -96,10 +96,10 @@ index 2b6377f0d81..0d84ad4b458 100644
19  	size_t	 i, sz;
20  	char	*buf;
21 diff --git a/usr.sbin/acme-client/extern.h b/usr.sbin/acme-client/extern.h
22-index 46a1387f5bc..37820e6cfb6 100644
23+index 8b500561744..990c784f706 100644
24 --- a/usr.sbin/acme-client/extern.h
25 +++ b/usr.sbin/acme-client/extern.h
26-@@ -244,7 +244,7 @@ int		 checkexit_ext(int *, pid_t, enum comp);
27+@@ -241,7 +241,7 @@ int		 checkexit_ext(int *, pid_t, enum comp);
28   * Returns a buffer or NULL on allocation error.
29   */
30  size_t		 base64len(size_t);
31@@ -109,20 +109,20 @@ index 46a1387f5bc..37820e6cfb6 100644
32  /*
33   * JSON parsing routines.
34 diff --git a/usr.sbin/acme-client/keyproc.c b/usr.sbin/acme-client/keyproc.c
35-index a3b6666c279..f0df9f292d4 100644
36+index bab74c2b385..4360156b9c0 100644
37 --- a/usr.sbin/acme-client/keyproc.c
38 +++ b/usr.sbin/acme-client/keyproc.c
39-@@ -77,7 +77,8 @@ int
40- keyproc(int netsock, const char *keyfile, const char **alts, size_t altsz,
41-     enum keytype keytype)
42+@@ -76,7 +76,8 @@ add_ext(STACK_OF(X509_EXTENSION) *sk, int nid, const char *value)
43+ int
44+ keyproc(int netsock, struct domain_c *domain)
45  {
46 -	char		*der64 = NULL, *der = NULL, *dercp;
47 +	char		*der64 = NULL;
48 +	unsigned char	*der = NULL, *dercp;
49  	char		*sans = NULL, *san = NULL;
50  	FILE		*f;
51- 	size_t		 i, sansz;
52-@@ -238,7 +239,7 @@ keyproc(int netsock, const char *keyfile, const char **alts, size_t altsz,
53+ 	size_t		 sansz;
54+@@ -234,7 +235,7 @@ keyproc(int netsock, struct domain_c *domain)
55  	} else if ((der = dercp = malloc(len)) == NULL) {
56  		warn("malloc");
57  		goto out;
58@@ -132,21 +132,20 @@ index a3b6666c279..f0df9f292d4 100644
59  		goto out;
60  	} else if ((der64 = base64buf_url(der, len)) == NULL) {
61 diff --git a/usr.sbin/acme-client/revokeproc.c b/usr.sbin/acme-client/revokeproc.c
62-index 65170078226..493a9ea9752 100644
63+index 6fe34043129..c0963a278fb 100644
64 --- a/usr.sbin/acme-client/revokeproc.c
65 +++ b/usr.sbin/acme-client/revokeproc.c
66-@@ -77,7 +77,9 @@ revokeproc(int fd, const char *certfile, int force,
67-     int revocate, const char *const *alts, size_t altsz)
68+@@ -79,7 +79,8 @@ revokeproc(int fd, const char *certfile, int force,
69+     int revocate, struct domain_c *domain)
70  {
71  	GENERAL_NAMES			*sans = NULL;
72 -	char				*der = NULL, *dercp, *der64 = NULL;
73 +	unsigned char			*der = NULL, *dercp;
74 +	char				*der64 = NULL;
75-+	char				*san = NULL, *str, *tok;
76- 	int				 rc = 0, cc, i, len;
77- 	size_t				*found = NULL;
78+ 	int				 rc = 0, cc, sanidx, len, j, k;
79+ 	int				*found_altnames = NULL;
80  	FILE				*f = NULL;
81-@@ -260,7 +262,7 @@ revokeproc(int fd, const char *certfile, int force,
82+@@ -320,7 +321,7 @@ revokeproc(int fd, const char *certfile, int force,
83  		} else if ((der = dercp = malloc(len)) == NULL) {
84  			warn("malloc");
85  			goto out;
86@@ -156,5 +155,5 @@ index 65170078226..493a9ea9752 100644
87  			goto out;
88  		} else if ((der64 = base64buf_url(der, len)) == NULL) {
89 -- 
90-2.49.0
91+2.54.0
92 
+176, -112
  1@@ -1,4 +1,4 @@
  2-From 6abdd6eef47b5ff9a34536acbec947d2c9a3cebc Mon Sep 17 00:00:00 2001
  3+From 4ad4ffcb7c731ae48c97b93760d7625724a991bc Mon Sep 17 00:00:00 2001
  4 From: Michael Forney <mforney@mforney.org>
  5 Date: Fri, 23 Apr 2021 23:14:16 -0700
  6 Subject: [PATCH] acme-client: Port to BearSSL
  7@@ -8,9 +8,9 @@ Subject: [PATCH] acme-client: Port to BearSSL
  8  usr.sbin/acme-client/certproc.c   |   5 -
  9  usr.sbin/acme-client/key.c        | 329 ++++++++++++++++++++++++------
 10  usr.sbin/acme-client/key.h        |  22 +-
 11- usr.sbin/acme-client/keyproc.c    | 198 ++++++------------
 12- usr.sbin/acme-client/revokeproc.c | 260 +++++++++++------------
 13- 6 files changed, 566 insertions(+), 546 deletions(-)
 14+ usr.sbin/acme-client/keyproc.c    | 192 ++++++-----------
 15+ usr.sbin/acme-client/revokeproc.c | 319 +++++++++++------------------
 16+ 6 files changed, 568 insertions(+), 597 deletions(-)
 17 
 18 diff --git a/usr.sbin/acme-client/acctproc.c b/usr.sbin/acme-client/acctproc.c
 19 index 9e97a8bb760..8d66dac49d9 100644
 20@@ -951,7 +951,7 @@ index 272d36eb09a..12abdec813c 100644
 21  
 22  #endif /* ! KEY_H */
 23 diff --git a/usr.sbin/acme-client/keyproc.c b/usr.sbin/acme-client/keyproc.c
 24-index f0df9f292d4..fc7de74b616 100644
 25+index 4360156b9c0..19b8077a8fb 100644
 26 --- a/usr.sbin/acme-client/keyproc.c
 27 +++ b/usr.sbin/acme-client/keyproc.c
 28 @@ -18,55 +18,18 @@
 29@@ -1013,40 +1013,41 @@ index f0df9f292d4..fc7de74b616 100644
 30  /*
 31   * Create an X509 certificate from the private key we have on file.
 32   * To do this, we first open the key file, then jail ourselves.
 33-@@ -77,18 +40,20 @@ int
 34- keyproc(int netsock, const char *keyfile, const char **alts, size_t altsz,
 35-     enum keytype keytype)
 36+@@ -76,19 +39,20 @@ add_ext(STACK_OF(X509_EXTENSION) *sk, int nid, const char *value)
 37+ int
 38+ keyproc(int netsock, struct domain_c *domain)
 39  {
 40 -	char		*der64 = NULL;
 41 -	unsigned char	*der = NULL, *dercp;
 42 -	char		*sans = NULL, *san = NULL;
 43 -	FILE		*f;
 44--	size_t		 i, sansz;
 45+-	size_t		 sansz;
 46 -	void		*pp;
 47 -	EVP_PKEY	*pkey = NULL;
 48 -	X509_REQ	*x = NULL;
 49--	X509_NAME	*name = NULL;
 50--	int		 len, rc = 0, cc, nid, newkey = 0;
 51+-	int		 len, rc = 0, cc, nid, newkey = 0, first;
 52 -	mode_t		 prev;
 53 -	STACK_OF(X509_EXTENSION) *exts = NULL;
 54+-	struct altname_c	 *ac;
 55+-	const char	*keyfile = domain->key;
 56 +	char			*der64 = NULL;
 57 +	unsigned char		*der = NULL;
 58 +	FILE			*f;
 59-+	size_t			 i;
 60 +	struct key		*pkey = NULL;
 61 +	struct x509cert_req	 req;
 62 +	struct x509cert_skey	 skey;
 63 +	struct x509cert_dn	 dn;
 64-+	struct x509cert_rdn	 rdn;
 65 +	struct x509cert_item	 item;
 66-+	int			 len, rc = 0, newkey = 0;
 67++	int			 len, rc = 0, newkey = 0, i;
 68 +	mode_t			 prev;
 69++	struct altname_c	*ac;
 70++	const char		*keyfile = domain->key;
 71 +
 72 +	req.alts = NULL;
 73  
 74  	/*
 75  	 * First, open our private key file read-only or write-only if
 76-@@ -110,8 +75,6 @@ keyproc(int netsock, const char *keyfile, const char **alts, size_t altsz,
 77+@@ -110,8 +74,6 @@ keyproc(int netsock, struct domain_c *domain)
 78  
 79  	/* File-system, user, and sandbox jail. */
 80  
 81@@ -1055,7 +1056,7 @@ index f0df9f292d4..fc7de74b616 100644
 82  	if (pledge("stdio", NULL) == -1) {
 83  		warn("pledge");
 84  		goto out;
 85-@@ -145,102 +108,61 @@ keyproc(int netsock, const char *keyfile, const char **alts, size_t altsz,
 86+@@ -145,98 +107,65 @@ keyproc(int netsock, struct domain_c *domain)
 87  	 * Then set it as the X509 requester's key.
 88  	 */
 89  
 90@@ -1081,29 +1082,6 @@ index f0df9f292d4..fc7de74b616 100644
 91 +		break;
 92  	}
 93  
 94- 	/* Now specify the common name that we'll request. */
 95- 
 96--	if ((name = X509_NAME_new()) == NULL) {
 97--		warnx("X509_NAME_new");
 98--		goto out;
 99--	} else if (!X509_NAME_add_entry_by_txt(name, "CN",
100--		MBSTRING_ASC, (u_char *)alts[0], -1, -1, 0)) {
101--		warnx("X509_NAME_add_entry_by_txt: CN=%s", alts[0]);
102--		goto out;
103--	} else if (!X509_REQ_set_subject_name(x, name)) {
104--		warnx("X509_req_set_issuer_name");
105--		goto out;
106--	}
107-+	rdn.oid = x509cert_oid_CN;
108-+	rdn.val.tag = X509CERT_ASN1_UTF8STRING;
109-+	rdn.val.val = alts[0];
110-+	rdn.val.len = strlen(alts[0]);
111-+	rdn.val.enc = NULL;
112-+	dn.rdn = &rdn;
113-+	dn.rdn_len = 1;
114-+	req.subject.enc = x509cert_dn_encoder;
115-+	req.subject.val = &dn;
116- 
117 -	/*
118 -	 * Now add the SAN extensions.
119 -	 * This was lifted more or less directly from demos/x509/mkreq.c
120@@ -1111,22 +1089,29 @@ index f0df9f292d4..fc7de74b616 100644
121 -	 * (The zeroth altname is the domain name.)
122 -	 * TODO: is this the best way of doing this?
123 -	 */
124-+	/* Now add the SAN extension. */
125++	/* Use an empty subject. */
126  
127 -	nid = NID_subject_alt_name;
128 -	if ((exts = sk_X509_EXTENSION_new_null()) == NULL) {
129 -		warnx("sk_X509_EXTENSION_new_null");
130-+	req.alts_len = altsz;
131-+	req.alts = calloc(altsz, sizeof(req.alts[0]));
132+-		goto out;
133+-	}
134+-	/* Initialise to empty string. */
135+-	if ((sans = strdup("")) == NULL) {
136+-		warn("strdup");
137++	dn.rdn = NULL;
138++	dn.rdn_len = 0;
139++	req.subject.enc = x509cert_dn_encoder;
140++	req.subject.val = &dn;
141++
142++	/* Now add the SAN extension. */
143++
144++	req.alts_len = domain->altname_count;
145++	req.alts = calloc(domain->altname_count, sizeof(req.alts[0]));
146 +	if (req.alts == NULL) {
147 +		warn("calloc");
148  		goto out;
149  	}
150--	/* Initialise to empty string. */
151--	if ((sans = strdup("")) == NULL) {
152--		warn("strdup");
153--		goto out;
154--	}
155 -	sansz = strlen(sans) + 1;
156  
157 -	/*
158@@ -1136,9 +1121,23 @@ index f0df9f292d4..fc7de74b616 100644
159 -	 */
160 +	/* Add a dNSName SAN entry for each alternate name. */
161  
162- 	for (i = 0; i < altsz; i++) {
163--		cc = asprintf(&san, "%sDNS:%s",
164--		    i ? "," : "", alts[i]);
165+-	first = 1;
166++	i = 0;
167+ 	TAILQ_FOREACH(ac, &domain->altname_list, entry) {
168+ 		switch (ac->idtype) {
169+ 		case ID_DNS:
170+-			cc = asprintf(&san, "%sDNS:%s", first ? "" : ",",
171+-			    ac->domain);
172++			req.alts[i].tag = X509CERT_SAN_DNSNAME;
173++			req.alts[i].val = ac->domain;
174++			req.alts[i].len = strlen(ac->domain);
175+ 			break;
176+ 		case ID_IP:
177+-			cc = asprintf(&san, "%sIP:%s", first ? "" : ",",
178+-			    ac->domain);
179+-			break;
180+-		}
181+-		first = 0;
182 -		if (cc == -1) {
183 -			warn("asprintf");
184 -			goto out;
185@@ -1146,8 +1145,9 @@ index f0df9f292d4..fc7de74b616 100644
186 -		pp = recallocarray(sans, sansz, sansz + strlen(san), 1);
187 -		if (pp == NULL) {
188 -			warn("recallocarray");
189--			goto out;
190--		}
191++			warnx("ID_IP is not supported");
192+ 			goto out;
193+ 		}
194 -		sans = pp;
195 -		sansz += strlen(san);
196 -		strlcat(sans, san, sansz);
197@@ -1169,9 +1169,7 @@ index f0df9f292d4..fc7de74b616 100644
198 -	if (!X509_REQ_sign(x, pkey, EVP_sha256())) {
199 -		warnx("X509_sign");
200 -		goto out;
201-+		req.alts[i].tag = X509CERT_SAN_DNSNAME;
202-+		req.alts[i].val = alts[i];
203-+		req.alts[i].len = strlen(alts[i]);
204++		i++;
205  	}
206  
207 -	/* Now, serialise to DER, then base64. */
208@@ -1196,14 +1194,13 @@ index f0df9f292d4..fc7de74b616 100644
209  		goto out;
210  	} else if ((der64 = base64buf_url(der, len)) == NULL) {
211  		warnx("base64buf_url");
212-@@ -265,12 +187,8 @@ out:
213+@@ -261,11 +190,8 @@ out:
214  		fclose(f);
215  	free(der);
216  	free(der64);
217 -	free(sans);
218 -	free(san);
219 -	X509_REQ_free(x);
220--	X509_NAME_free(name);
221 -	EVP_PKEY_free(pkey);
222 -	ERR_print_errors_fp(stderr);
223 -	ERR_free_strings();
224@@ -1213,10 +1210,19 @@ index f0df9f292d4..fc7de74b616 100644
225  	return rc;
226  }
227 diff --git a/usr.sbin/acme-client/revokeproc.c b/usr.sbin/acme-client/revokeproc.c
228-index 493a9ea9752..82e31792f3b 100644
229+index c0963a278fb..2109d7a8799 100644
230 --- a/usr.sbin/acme-client/revokeproc.c
231 +++ b/usr.sbin/acme-client/revokeproc.c
232-@@ -22,73 +22,53 @@
233+@@ -15,8 +15,6 @@
234+  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
235+  */
236+ 
237+-#include <sys/socket.h>
238+-#include <arpa/inet.h>
239+ #include <assert.h>
240+ #include <ctype.h>
241+ #include <err.h>
242+@@ -24,71 +22,54 @@
243  #include <stdio.h>
244  #include <stdlib.h>
245  #include <string.h>
246@@ -1291,18 +1297,17 @@ index 493a9ea9752..82e31792f3b 100644
247  
248  int
249  revokeproc(int fd, const char *certfile, int force,
250-     int revocate, const char *const *alts, size_t altsz)
251+     int revocate, struct domain_c *domain)
252  {
253 -	GENERAL_NAMES			*sans = NULL;
254 -	unsigned char			*der = NULL, *dercp;
255 -	char				*der64 = NULL;
256--	char				*san = NULL, *str, *tok;
257--	int				 rc = 0, cc, i, len;
258--	size_t				*found = NULL;
259+-	int				 rc = 0, cc, sanidx, len, j, k;
260+-	int				*found_altnames = NULL;
261 +	static const unsigned char	 dnsname[] = {0, 2};
262 +	char				 buf[8192], *pos, *sans = NULL, *der64 = NULL;
263-+	int				 rc = 0, cc, state, err;
264-+	size_t				 i, j, n, len = 0, altlen, altmax, eltsz;
265++	int				 rc = 0, cc, i, eltsz, state, err;
266++	size_t				 n, len = 0, altlen, altmax;
267  	FILE				*f = NULL;
268 -	X509				*x = NULL;
269 +	br_pem_decoder_context		 pc;
270@@ -1315,11 +1320,11 @@ index 493a9ea9752..82e31792f3b 100644
271  	enum revokeop			 op, rop;
272  	time_t				 notafter, notbefore, cert_validity;
273  	time_t				 remaining_validity, renew_allow;
274--	size_t				 j;
275++	struct altname_c		*ac;
276  
277  	/*
278  	 * First try to open the certificate before we drop privileges
279-@@ -103,8 +83,6 @@ revokeproc(int fd, const char *certfile, int force,
280+@@ -103,8 +84,6 @@ revokeproc(int fd, const char *certfile, int force,
281  
282  	/* File-system and sandbox jailing. */
283  
284@@ -1328,7 +1333,7 @@ index 493a9ea9752..82e31792f3b 100644
285  	if (pledge("stdio", NULL) == -1) {
286  		warn("pledge");
287  		goto out;
288-@@ -128,44 +106,88 @@ revokeproc(int fd, const char *certfile, int force,
289+@@ -128,45 +107,89 @@ revokeproc(int fd, const char *certfile, int force,
290  		goto out;
291  	}
292  
293@@ -1397,12 +1402,13 @@ index 493a9ea9752..82e31792f3b 100644
294 +	br_x509_decoder_get_notbefore(&xd, &days, &secs);
295 +	notbefore = 86400ll * (days - 719528) + 86400;
296 +
297-+	for (i = 0, altmax = 0; i < altsz; ++i) {
298-+		altlen = strlen(alts[i]) + 1;
299++	altmax = 0;
300++	TAILQ_FOREACH(ac, &domain->altname_list, entry) {
301++		altlen = strlen(ac->domain) + 1;
302 +		if (altlen > altmax)
303 +			altmax = altlen;
304 +	}
305-+	eltsz = altsz + 1;
306++	eltsz = domain->altname_count + 1;
307 +	if ((elts = calloc(eltsz, sizeof(elts[0]))) == NULL ||
308 +	    (sans = calloc(eltsz, altmax)) == NULL) {
309 +		warn("calloc");
310@@ -1426,7 +1432,8 @@ index 493a9ea9752..82e31792f3b 100644
311 -	/* An array of buckets: the number of entries found. */
312 +	/* Extract list of SAN entries from the certificate. */
313  
314--	if ((found = calloc(altsz, sizeof(size_t))) == NULL) {
315+-	if ((found_altnames = (int *)calloc(domain->altname_count,
316+-	    sizeof(int))) == NULL) {
317 -		warn("calloc");
318 +	br_x509_minimal_init(&xc, &br_sha256_vtable, NULL, 0);
319 +	br_x509_minimal_set_hash(&xc, br_sha256_ID, &br_sha256_vtable);
320@@ -1443,90 +1450,147 @@ index 493a9ea9752..82e31792f3b 100644
321  		goto out;
322  	}
323  
324-@@ -174,63 +196,37 @@ revokeproc(int fd, const char *certfile, int force,
325+@@ -175,121 +198,37 @@ revokeproc(int fd, const char *certfile, int force,
326  	 * configuration file and that all domains are represented only once.
327  	 */
328  
329--	for (i = 0; i < sk_GENERAL_NAME_num(sans); i++) {
330+-	for (sanidx = 0; sanidx < sk_GENERAL_NAME_num(sans); sanidx++) {
331 -		GENERAL_NAME		*gen_name;
332--		const ASN1_IA5STRING	*name;
333--		const unsigned char	*name_buf;
334+-		char			*name_buf = NULL;
335 -		int			 name_len;
336--		int			 name_type;
337+-		struct altname_c	*ac;
338 -
339--		gen_name = sk_GENERAL_NAME_value(sans, i);
340+-		gen_name = sk_GENERAL_NAME_value(sans, sanidx);
341 -		assert(gen_name != NULL);
342 -
343--		name = GENERAL_NAME_get0_value(gen_name, &name_type);
344--		if (name_type != GEN_DNS)
345+-		if (gen_name->type == GEN_IPADD) {
346+-			char		 ip_buf[INET6_ADDRSTRLEN];
347+-			const char	*ip;
348+-
349+-			name_len = ASN1_STRING_length(gen_name->d.iPAddress);
350+-			switch (name_len) {
351+-			case 4:
352+-				ip = inet_ntop(AF_INET,
353+-				    ASN1_STRING_get0_data(gen_name->d.iPAddress),
354+-				    ip_buf, INET6_ADDRSTRLEN);
355+-				break;
356+-			case 16:
357+-				ip = inet_ntop(AF_INET6,
358+-				    ASN1_STRING_get0_data(gen_name->d.iPAddress),
359+-				    ip_buf, INET6_ADDRSTRLEN);
360+-				break;
361+-			default:
362+-				ip = NULL;
363++	TAILQ_FOREACH(ac, &domain->altname_list, entry) {
364++		for (i = 0; i < eltsz; i++) {
365++			if (elts[i].status == 1 &&
366++			    strcmp(ac->domain, elts[i].buf) == 0) {
367++				elts[i].status = 0;
368+ 				break;
369+ 			}
370+-			if (ip == NULL) {
371+-				warnx("invalid IP address");
372+-				continue;
373+-			}
374+-			name_len = asprintf(&name_buf, "%s", ip);
375+-		} else if (gen_name->type == GEN_DNS) {
376+-			name_len = ASN1_STRING_length(gen_name->d.dNSName);
377+-			name_len = asprintf(&name_buf, "%.*s",
378+-			    name_len,
379+-			    ASN1_STRING_get0_data(gen_name->d.dNSName));
380+-		} else
381 -			continue;
382 -
383--		/* name_buf isn't a C string and could contain embedded NULs. */
384--		name_buf = ASN1_STRING_get0_data(name);
385--		name_len = ASN1_STRING_length(name);
386+-		if (name_len == -1) {
387+-			warn("asprintf");
388+-			continue;
389+ 		}
390 -
391--		for (j = 0; j < altsz; j++) {
392--			if ((size_t)name_len != strlen(alts[j]))
393--				continue;
394--			if (memcmp(name_buf, alts[j], name_len) == 0)
395-+	for (i = 0; i < altsz; i++) {
396-+		for (j = 0; j < eltsz; j++) {
397-+			if (elts[j].status == 1 &&
398-+			    strcmp(alts[i], elts[j].buf) == 0) {
399-+				elts[j].status = 0;
400- 				break;
401+-		j = 0;
402+-		TAILQ_FOREACH(ac, &domain->altname_list, entry) {
403+-			if (strcmp(name_buf, ac->domain) == 0) {
404+-				found_altnames[j]++;
405+-				break;
406+-			}
407+-			/* increment if didn't match */
408+-			j++;
409 -		}
410--		if (j == altsz) {
411+-		if (j >= domain->altname_count) {
412+-			/* we haven't matched any */
413 -			if (revocate) {
414 -				char *visbuf;
415 -
416 -				visbuf = calloc(4, name_len + 1);
417 -				if (visbuf == NULL) {
418--					warn("%s: unexpected SAN", certfile);
419+-					warn("%s: unexpected SAN in "
420+-					    "certificate", certfile);
421+-					free(name_buf);
422 -					goto out;
423 -				}
424 -				strvisx(visbuf, name_buf, name_len, VIS_SAFE);
425--				warnx("%s: unexpected SAN entry: %s",
426--				    certfile, visbuf);
427+-				warnx("%s: unexpected SAN entry in "
428+-				    "certificate: %s", certfile, visbuf);
429 -				free(visbuf);
430+-				free(name_buf);
431 -				goto out;
432- 			}
433+-			}
434 -			force = 2;
435 -			continue;
436- 		}
437--		if (found[j]++) {
438-+		if (j == eltsz) {
439+-		}
440+-		/* should not reach here if j is out of bounds */
441+-		if (found_altnames[j] > 1) {
442++		if (i == eltsz) {
443  			if (revocate) {
444--				warnx("%s: duplicate SAN entry: %.*s",
445--				    certfile, name_len, name_buf);
446-+				warnx("%s: domain not listed: %s", certfile, alts[i]);
447+-				char *visbuf;
448+-				visbuf = calloc(4, name_len + 1);
449+-				if (visbuf == NULL) {
450+-					warn("%s: duplicate SAN in "
451+-					    "certificate", certfile);
452+-					free(name_buf);
453+-					goto out;
454+-				}
455+-				warnx("%s: duplicate SAN entry in "
456+-				    "certificate: %s", certfile, visbuf);
457+-				free(name_buf);
458+-				free(visbuf);
459++				warnx("%s: domain not listed: %s", certfile, ac->domain);
460  				goto out;
461  			}
462  			force = 2;
463  		}
464+-
465+-		free(name_buf);
466  	}
467  
468--	for (j = 0; j < altsz; j++) {
469--		if (found[j])
470+-	for (j = 0; j < domain->altname_count; j++) {
471+-		struct altname_c	*ac;
472+-
473+-		if (found_altnames[j])
474 +	for (i = 0; i < eltsz; i++) {
475 +		if (elts[i].status == 0)
476  			continue;
477  		if (revocate) {
478--			warnx("%s: domain not listed: %s", certfile, alts[j]);
479+-			k = 0;
480+-			TAILQ_FOREACH(ac, &domain->altname_list, entry) {
481+-				if (j == k)
482+-					break;
483+-				k++;
484 +			char *visbuf;
485 +
486 +			if (elts[i].status != 1 ||
487 +			    stravis(&visbuf, elts[i].buf, VIS_SAFE) < 0) {
488 +				warnx("%s: unexpected SAN", certfile);
489 +				goto out;
490-+			}
491+ 			}
492+-			warnx("%s: domain not listed: %s", certfile,
493+-			    ac->domain);
494 +			warnx("%s: unexpected SAN entry: %s",
495 +			    certfile, visbuf);
496 +			free(visbuf);
497  			goto out;
498  		}
499  		force = 2;
500-@@ -256,16 +252,7 @@ revokeproc(int fd, const char *certfile, int force,
501+@@ -315,16 +254,7 @@ revokeproc(int fd, const char *certfile, int force,
502  		if (cc <= 0)
503  			goto out;
504  
505@@ -1544,14 +1608,14 @@ index 493a9ea9752..82e31792f3b 100644
506  			warnx("base64buf_url");
507  			goto out;
508  		} else if (writestr(fd, COMM_CSR, der64) >= 0)
509-@@ -339,12 +326,9 @@ out:
510+@@ -398,12 +328,9 @@ out:
511  	close(fd);
512  	if (f != NULL)
513  		fclose(f);
514 -	X509_free(x);
515 -	GENERAL_NAMES_free(sans);
516 -	free(der);
517--	free(found);
518+-	free(found_altnames);
519 +	free(cert.data);
520 +	free(sans);
521 +	free(elts);
522@@ -1561,5 +1625,5 @@ index 493a9ea9752..82e31792f3b 100644
523  	return rc;
524  }
525 -- 
526-2.49.0
527+2.54.0
528 
+7, -7
 1@@ -1,4 +1,4 @@
 2-From 0b4249dea4ec148875be7a7fedc8ec0873043c71 Mon Sep 17 00:00:00 2001
 3+From e3267bbd5f0e3f8ea9caf07c92f58b046100901a Mon Sep 17 00:00:00 2001
 4 From: Michael Forney <mforney@mforney.org>
 5 Date: Thu, 20 May 2021 13:44:35 -0700
 6 Subject: [PATCH] nc: Add option to disable certificate time checking
 7@@ -22,7 +22,7 @@ index 2ffdcd1ea60..ecff109e395 100644
 8  which requires a client certificate on incoming connections; or
 9  .Cm muststaple ,
10 diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c
11-index 9d182198089..74d18595309 100644
12+index 4fd399a6f89..982b65592fe 100644
13 --- a/usr.bin/nc/netcat.c
14 +++ b/usr.bin/nc/netcat.c
15 @@ -70,8 +70,9 @@
16@@ -35,9 +35,9 @@ index 9d182198089..74d18595309 100644
17 +#define TLS_CCERT	(1 << 4)
18 +#define TLS_MUSTSTAPLE	(1 << 5)
19  
20- /* Command Line Options */
21- int	dflag;					/* detached, no stdin */
22-@@ -551,6 +552,8 @@ main(int argc, char *argv[])
23+ #ifndef IPTOS_DSCP_VA
24+ #define IPTOS_DSCP_VA	0xb0
25+@@ -557,6 +558,8 @@ main(int argc, char *argv[])
26  			errx(1, "clientcert is only valid with -l");
27  		if (TLSopt & TLS_NONAME)
28  			tls_config_insecure_noverifyname(tls_cfg);
29@@ -46,7 +46,7 @@ index 9d182198089..74d18595309 100644
30  		if (TLSopt & TLS_NOVERIFY) {
31  			if (tls_expecthash != NULL)
32  				errx(1, "-H and -T noverify may not be used "
33-@@ -1712,6 +1715,7 @@ process_tls_opt(char *s, int *flags)
34+@@ -1724,6 +1727,7 @@ process_tls_opt(char *s, int *flags)
35  		{ "clientcert",		TLS_CCERT,		NULL },
36  		{ "muststaple",		TLS_MUSTSTAPLE,		NULL },
37  		{ "noname",		TLS_NONAME,		NULL },
38@@ -55,5 +55,5 @@ index 9d182198089..74d18595309 100644
39  		{ "protocols",		-1,			&tls_protocols },
40  		{ NULL,			-1,			NULL },
41 -- 
42-2.49.0
43+2.54.0
44 
+4, -4
 1@@ -1,4 +1,4 @@
 2-From 87c6da40a600a00d331d1d7f8968fd4ee933377a Mon Sep 17 00:00:00 2001
 3+From ef9e08a9597e02425f9da0f43486e0cdfa1a4a1e Mon Sep 17 00:00:00 2001
 4 From: Michael Forney <mforney@mforney.org>
 5 Date: Wed, 4 Mar 2026 15:27:54 -0800
 6 Subject: [PATCH] acme-client: Fix enum/int mismatch in declaration of
 7@@ -9,10 +9,10 @@ Subject: [PATCH] acme-client: Fix enum/int mismatch in declaration of
 8  1 file changed, 1 insertion(+), 1 deletion(-)
 9 
10 diff --git a/usr.sbin/acme-client/extern.h b/usr.sbin/acme-client/extern.h
11-index 37820e6cfb6..3c780ebf777 100644
12+index 990c784f706..32127182548 100644
13 --- a/usr.sbin/acme-client/extern.h
14 +++ b/usr.sbin/acme-client/extern.h
15-@@ -252,7 +252,7 @@ char		*base64buf_url(const unsigned char *, size_t);
16+@@ -249,7 +249,7 @@ char		*base64buf_url(const unsigned char *, size_t);
17   */
18  struct jsmnn	*json_parse(const char *, size_t);
19  void		 json_free(struct jsmnn *);
20@@ -22,5 +22,5 @@ index 37820e6cfb6..3c780ebf777 100644
21  int		 json_parse_challenge(struct jsmnn *, struct chng *);
22  void		 json_free_order(struct order *);
23 -- 
24-2.49.0
25+2.54.0
26 
+3, -3
 1@@ -1,4 +1,4 @@
 2-From 4da7b308eb6d8c7947d3ea0106a49c8ab6e3481a Mon Sep 17 00:00:00 2001
 3+From bcaddae8de94a8d2d448a287b42a75a7306999b7 Mon Sep 17 00:00:00 2001
 4 From: Michael Forney <mforney@mforney.org>
 5 Date: Sun, 17 May 2026 01:40:40 -0700
 6 Subject: [PATCH] nc: Use explicit cast for pointer sign conversion
 7@@ -8,10 +8,10 @@ Subject: [PATCH] nc: Use explicit cast for pointer sign conversion
 8  1 file changed, 1 insertion(+), 1 deletion(-)
 9 
10 diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c
11-index 74d18595309..bb170967d8e 100644
12+index 982b65592fe..82f1686fa6f 100644
13 --- a/usr.bin/nc/netcat.c
14 +++ b/usr.bin/nc/netcat.c
15-@@ -1751,7 +1751,7 @@ save_peer_cert(struct tls *tls_ctx, FILE *fp)
16+@@ -1763,7 +1763,7 @@ save_peer_cert(struct tls *tls_ctx, FILE *fp)
17  	const char *pem;
18  	size_t plen;
19  
+27, -0
 1@@ -0,0 +1,27 @@
 2+From 62369cc52d95e6998078951d9fcb633b2c013954 Mon Sep 17 00:00:00 2001
 3+From: Michael Forney <mforney@mforney.org>
 4+Date: Wed, 20 May 2026 01:56:37 -0700
 5+Subject: [PATCH] Add fallback define for __pledge_open
 6+
 7+---
 8+ lib/libc/gen/readpassphrase.c | 4 ++++
 9+ 1 file changed, 4 insertions(+)
10+
11+diff --git a/lib/libc/gen/readpassphrase.c b/lib/libc/gen/readpassphrase.c
12+index c3bf85fb3eb..47f9c5707b5 100644
13+--- a/lib/libc/gen/readpassphrase.c
14++++ b/lib/libc/gen/readpassphrase.c
15+@@ -36,6 +36,10 @@
16+ #define TCSASOFT 0
17+ #endif
18+ 
19++#ifndef __OpenBSD__
20++#define __pledge_open open
21++#endif
22++
23+ static volatile sig_atomic_t signo[_NSIG];
24+ 
25+ static void handler(int);
26+-- 
27+2.54.0
28+
+2, -2
1@@ -1,2 +1,2 @@
2-1f20cc61f3b5bc9be69be131f9c897635ca6c3b4eba3a69e938a68e74139f48a  src.tar.gz
3-e24904caaee40e8774816b20f30983626f4a5434e04b4768a9ef451dc4bc39eb  sys.tar.gz
4+fb305c553059b48e8ee64539f392b783cb38a67865823f6f6a94f3b220a1268b  src.tar.gz
5+c9ef294021ef7aafd5f18ffe8ebfed63394e5a86d65d7436d6db78551f9d57f1  sys.tar.gz
+2, -2
1@@ -1,5 +1,5 @@
2 remote-name
3-url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.8/src.tar.gz"
4+url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.9/src.tar.gz"
5 
6 remote-name
7-url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.8/sys.tar.gz"
8+url = "https://cloudflare.cdn.openbsd.org/pub/OpenBSD/7.9/sys.tar.gz"
+1, -1
1@@ -1 +1 @@
2-7.8 r3
3+7.9