HBSD: Update hbsd-update for 12-stable

See merge request !68

Signed-off-by: Loic <loic.f@hardenedbsd.org>
Reviewed-by: Shawn Webb <shawn.webb@hardenedbsd.org>
(cherry picked from commit d1a32942)

Improved display especially when the -V (Verbose output) option is used.
Signed-off-by: Loic <loic.f@hardenedbsd.org>
MFC-to:		13-STABLE
MFC-to:		12-STABLE
(cherry picked from commit 18369f86)

- Fixes a tabulation problem.
- Adds an example for the '-t tmpdir' option.
Signed-off-by: Loic <loic.f@hardenedbsd.org>
MFC-to:		13-STABLE
MFC-to:		12-STABLE
(cherry picked from commit e1607958)

The commit 6c1ebef2

 ("HBSD: Tell hbsd-update to skip /boot/efi")
is not enough to solve the problem encountered with tar.

Adding an exclude for /boot/efi.
Signed-off-by: Loic <loic.f@hardenedbsd.org>
Reported-by:	@PKraszewski and @zsalab
issue:		#43
MFC-to:		13-STABLE
MFC-to:		12-STABLE
(cherry picked from commit 781c18cf)

Remove the "No such file or directory" warning generate by find.
Signed-off-by: Loic <loic.f@hardenedbsd.org>
(cherry picked from commit d8866044)

We now use the fetch_update for 'download only' function.
This function has the advantage to control the checksum of the download file.
Please note that there is no more resumption of the interrupted download.
Reported-by: Shawn Webb <shawn.webb@hardenedbsd.org>
Signed-off-by: Loic <loic.f@hardenedbsd.org>
(cherry picked from commit b61c6a82)

Add option '-F' for download the latest update archive.
The option is able to resume an interrupted download.

Fix issues #57

 signaled by Shawn Webb.
Signed-off-by: Loic <loic.f@hardenedbsd.org>
(cherry picked from commit 762bdf24)

When we issue a request to pf and expect a serialised nvlist as a reply
we have to supply a suitable buffer to the kernel.
The required size for this buffer is difficult to predict, and may be
(slightly) different from request to request.
If it's insufficient the kernel will return ENOSPC. Teach libpfctl to
catch this and send the request again with a larger buffer.

MFC after:	2 weeks
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34908

(cherry picked from commit 7ed19f5c)

When asked to print rules recursively, correctly recurse for anchors
included in pf.conf with "anchorname/*".

PR:		262590
Reviewed by:	kp
MFC after:	3 weeks

(cherry picked from commit d86cf443)

Because the maximum number of endpoint contexts is stored there.

Tested by:	ehaupt@
PR:		262882
Sponsored by:	NVIDIA Networking

(cherry picked from commit 09dd1adf)

Only drop BULK and INTERRUPT endpoints, to reset the data toggle,
because for other endpoint types this is not critical.

Tested by:	ehaupt@
PR:		262882
Sponsored by:	NVIDIA Networking

(cherry picked from commit e276d281)

While recovery command executed, some other commands from the periph
may complete, that may affect periph_links of this CCB.  So restoring
original CCB we must keep current periph_links as more up to date.

I've found this triggering assertions with debug kernel and suspect
some memory corruptions otherwise when spun down disk receives two
or sometimes more concurrent requests.

MFC after:	1 week
Sponsored by:	iXsystems, Inc.

(cherry picked from commit 404f0011)

This is direct commit to stable/12 as newer branches
do not have the problem.

PR:		263750
Reviewed by:	emaste
Tested by:	Julian H. Stacey <jhs at berklix.com>

(cherry picked from commit 34252e89)

I intend to move these into lib/libthr/tests/ and connect to kyua.  This
is a first step to address warnings emitted when building using standard
make infrastructure.

Reviewed by:	markj
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D34306

(cherry picked from commit ef135466)
(cherry picked from commit 7bfe5e45)
(cherry picked from commit 2e545745ce2ecbe966434fa5edc9b60d82b43c17)

11.x is no longer supported.

(cherry picked from commit 2e6ec1e4)
(cherry picked from commit 89d405a5)

With the upgrade to OpenSSH 6.7p1 in commit a0ee8cc6 we replaced
WITH_OPENSSL ifdefs with an OPENSSL_VERSION macro, later changing it
to OPENSSL_VERSION_STRING.

A few years later OpenSSH made an equivalent change (with a different
macro name), in commit 4d94b031ff88.  Switch to the macro name they
chose.

MFC after:	1 week
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit 6e24fe61)
(cherry picked from commit 41406f9251c0e186fe820f70e9da0606bff71dae)

Panasas was seeing a higher-than-expected number of link-flap events.
After joint debugging with the switch vendor, we determined there were
problems on both sides; either of which might cause the occasional
event, but together caused lots of them.

On the switch side, an internal queuing issue was causing LACP PDUs --
which should be sent every second, in short-timeout mode -- to sometimes
be sent slightly later than they should have been. In some cases, two
successive PDUs were late, but we never saw three late PDUs in a row.

On the FreeBSD side, we saw a link-flap event every time there were two
late PDUs, while the spec says that it takes *three* seconds of downtime
to trigger that event. It turns out that if a PDU was received shortly
before the timer code was run, it would decrement less than a full
second after the PDU arrived. Then two delayed PDUs would cause two
additional decrements, causing it to reach zero less than three seconds
after the most-recent on-time PDU.

The solution is to note the time a PDU arrives, and only decrement if at
least a full second has elapsed since then.

Reported by:	Greg Foster <gfoster@panasas.com>
Reviewed by:	gallatin
Tested by:	Greg Foster <gfoster@panasas.com>
MFC after:	3 days
Sponsored by:	Panasas
Differential Revision:	https://reviews.freebsd.org/D35070

(cherry picked from commit 00a80538)

Support for this directive has been removed in config(8) on main,
which leaves us unable to build LINT with newer config(8).  It's
believed that mcount-based profiling didn't really work on modern
systems anyways, so the value of testing this is low.

We avoid providing limited backwards compatibility here to continue and
warn folks that may somehow be deploying real-world configs with `profile`
specified.

This is a direct commit to stable/12, but a partial MFC of aa3ea612.

Use the drop and enable endpoint context commands to force a reset of
the data toggle for USB 2.0 and USB 3.0 after:
 - clear endpoint halt command (when the driver wishes).
 - set config command (when the kernel or user-space wants).
 - set alternate setting command (only affected endpoints).

Some XHCI HW implementations may not allow the endpoint reset command when
the endpoint context is not in the halted state.

Reported by:		Juniper and Gary Jennejohn
MFC after:		1 week
Sponsored by:		NVIDIA Networking

(cherry picked from commit cda31e73)

Currently if an e1000 interface is set to a fixed media configuration,
for gigabit, it will participate in auto-negotiation as required by
IEEE 802.3-2018 Clause 37. However, if set to fixed media configuration
for 100 or 10, it does NOT participate in auto-negotiation.

By my reading of Clauses 28 and 37, while auto-negotiation is optional
for 100 and 10, it is not prohibited and is, in fact, "highly
recommended".

This patch enables auto-negotiation for fixed 100 and 10 media
configuration, in a similar manner to that already performed for 1000.
I.e., the patch enables advertising of just the manually configured
settings with the goal of allowing the remote end to match the manually
configured settings if it has them available.

To be clear, this patch does NOT allow an em(4) interface that has been
manually configured with specific media settings to respond to
auto-negotiation by then configuring different parameters to those that
were manually configured. The intent of this patch is to fully comply
with the requirements of Clause 37, but for 100 and 10.

The need for this has arisen on an em(4) link where the other end is
under a different administrative control and is set to full
auto-negotiation. Due to the cable length GigE is not working well. It
is desired to set the em(4) end to "media 100baseTX mediatype
full-duplex" which does work when both ends are configured that way.
Currently, because em(4) does not participate in autoneg for this
setting, the remote defaults to half-duplex - i.e., there's a duplex
mismatch and things don't work. With this patch, em(4) would inform the
remote that it has only 100baseTX full, the remote would match that and
it will work.

Approved by:	erj
Differential Revision:	https://reviews.freebsd.org/D34449

(cherry picked from commit 9ab4dfce)

Update mc filter array before changing RCTL flags as in 5a3eb620

Approved by:	grehan

(cherry picked from commit 07ede751)

Update mc filter array before changing FCTRL flags, similar to 5a3eb620

Approved by:	grehan

(cherry picked from commit 395cc55d)

Coverity points out that if counter was NULL when passed to
pfr_pool_get() we could potentially end up dereferencing it.
Happily all users of the function pass a non-NULL pointer. Enforce this
by assertion and remove the pointless NULL check.

Reported by:	Coverity (CID 273309)
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")

(cherry picked from commit efc64d02)

Move the use of 'sc' to after the NULL check.
It's very unlikely that we'd actually hit this, but Coverity is correct
that it's not a good idea to dereference the pointer and only then NULL
check it.

Reported by:	Coverity (CID 1398362)
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 43020350)

pfi_kkif_attach() always returns non-NULL, and we dereference the
pointer before we check it, so that's pointless.

Reported by:	Coverity (CID 1007345)
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")

(cherry picked from commit ed6287c1)

15b1eb14 changed the callout code to store the CALLOUT_SHAREDLOCK flag
in c_iflags (where it used to be c_flags), but failed to update the
check in softclock_call_cc(). This resulted in the callout code always
taking the write lock, even if a read lock had been requested (with
the CALLOUT_SHAREDLOCK flag in callout_init_rm()).

Reviewed by:	markj
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34959

(cherry picked from commit a879e40c)

Suggested by:	emaste
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit 9340d69e)
(cherry picked from commit 59269984)

We already set it earlier in do_setup_env().

Fixes:		19261079 ("openssh: update to OpenSSH v8.7p1")
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit 19780592)