src, branch releng/14.1

Add UPDATING entries and bump version.

2025-02-21T02:45:32+00:00

Approved by:	so

ssh: Bump VersionAddendum for CVE fixes

2025-02-21T02:45:28+00:00

Security:	FreeBSD-SA-25:05.openssh
Approved by:	so
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit 62df41ae0a71e77ccb1e8fae06d82eec5dff441a)
(cherry picked from commit 24ce323f020fb1ee1b463e524a7a6c15f47ec2a4)

ssh: Fix cases where error codes were not correctly set

2025-02-21T02:39:27+00:00

Obtained from:	OpenSSH 38df39ecf278
Security:	CVE-2025-26465
Security:	FreeBSD-SA-25:05.openssh
Approved by:	so
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit 170059d6d33cf4e890067097f3c0beb3061cabbd)
(cherry picked from commit 4ad8c195cf54411e3b3fa0bec227eb83ca078404)

ssh: Don't reply to PING in preauth phase or during KEX

2025-02-21T02:39:07+00:00

Obtained from:	OpenSSH 5e07dee272c3
Security:	CVE-2025-26466
Security:	FreeBSD-SA-25:05.openssh
Approved by:	so
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit 8a16d0831e70530b2fbd682e748bd051de35f192)
(cherry picked from commit 34798cb576bbd2064ab8da372112482bf8e2a7e6)

Add UPDATING entries and bump version

2025-01-29T18:46:31+00:00

Approved by:	so

etcupdate: Restrict access to the conflicts directory

2025-01-29T17:13:21+00:00

In the window during conflict resolution, copies of installed files with
conflicts are added here with the default mode.  Restrict access.

Approved by:	so
Security:	FreeBSD-SA-25:03.etcupdate
PR:		277470
Reviewed by:	philip, jhb, emaste
Differential Revision:	https://reviews.freebsd.org/D48576

(cherry picked from commit c43ae7ab4bf89c2b274c1cbefe663c456e9211d1)
(cherry picked from commit 93836ff92be84a1d4e7611577ffe116a0e30d008)

OpenSSH: correct logic error in ObscureKeystrokeTiming

2025-01-29T17:13:08+00:00

Cherry-pick fix:
upstream: when sending ObscureKeystrokeTiming chaff packets, we
can't rely on channel_did_enqueue to tell that there is data to send. This
flag indicates that the channels code enqueued a packet on _this_ ppoll()
iteration, not that data was enqueued in _any_ ppoll() iteration in the
timeslice. ok markus@

OpenBSD-Commit-ID: 009b74fd2769b36b5284a0188ade182f00564136

Approved by:	so
Security:	FreeBSD-SA-25:01.openssh
Obtained from:	openssh-portable 146c420d29d0
Reviewed by:	gordon
Sponsored by:	The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D45823

(cherry picked from commit b81424adf7181d816c10b1345aaa3305ab0ec304)
(cherry picked from commit bf9a275b24f6655616cc691555fe1a36ed5e4338)

contrib/tzdata: import tzdata 2025a

2025-01-29T17:12:52+00:00

Changes: https://github.com/eggert/tz/blob/2025a/NEWS

Approved by:	so
Security:	FreeBSD-EN-25:03.tzdata

(cherry picked from commit 46226b0162ba03986b1de2c790804b37dd8e64d6)
(cherry picked from commit a158d26e89f2e3274ba1064e3fd6b341c6fcb07c)

contrib/tzdata: import tzdata 2024b

2025-01-29T17:12:35+00:00

Changes: https://github.com/eggert/tz/blob/2024b/NEWS

Approved by:	so
Security:	FreeBSD-EN-25:03.tzdata

(cherry picked from commit e273650f2c538034b45f78e670a89cbf333ab6db)
(cherry picked from commit 7eb0b02bc4eddee6c916ab6a01ec92e0b9dc867e)

tarfs: Fix the size of struct tarfs_fid and add a static assert

2025-01-29T17:12:27+00:00

File system specific *fid structures are copied into the generic
struct fid defined in sys/mount.h.
As such, they cannot be larger than struct fid.

This patch packs the structure and checks via a __Static_assert().

Approved by:	so
Security:	FreeBSD-SA-25:02.fs
Reviewed by:	markj
MFC after:	2 weeks

(cherry picked from commit 4db1b113b15158c7d134df83e7a7201cf46d459b)
(cherry picked from commit 155987e2019089a5bd2eef77ed7bcc5cc26c362e)