pf(4) pf_state_import() can be bit more paranoid
Add sanity check for queue priority assigned to state
via 'set prio' rule action. The priority must fit
to bounds used by kernel (<= IFQ_MAXPRIO)
Issue reported and patch submitted by Acts1631
OK renaud@, OK henning@
update to caddy-2.11.8
"This patch release is a big batch of bug fixes and security hardening,
plus a handful of small additions. This release is cut from our 2.11
maintenance branch: fixes are backported from master. We recommend
upgrading, especially if you serve PHP or use {host} in file paths."
https://github.com/caddyserver/caddy/releases/tag/v2.11.8
unveil: Limit count of visited covers to ps_uvvcount, this avoids an
infinite loop with a particular construction of unveils.
from Acts1631
from dgl@
this is errata/8.0/009_unveil.patch.sig
unveil: Limit count of visited covers to ps_uvvcount, this avoids an
infinite loop with a particular construction of unveils.
from Acts1631
from dgl@
this is errata/7.9/044_unveil.patch.sig
Prevent fq_codel panic from drop counter wrap
Sustained traffic through a congested fq_codel queue can wrap the
per-flow drop counter to zero, triggering the control_law() assertion
and panicking the kernel. Saturate drops and decrement a nonzero ldrops
to preserve the grace-period delta and prevent the wrap.
Issue reported by Acts1631.
from bket@; OK sashan@ claudio@
this is errata/8.0/008_pffq.patch.sig
Prevent fq_codel panic from drop counter wrap
Sustained traffic through a congested fq_codel queue can wrap the
per-flow drop counter to zero, triggering the control_law() assertion
and panicking the kernel. Saturate drops and decrement a nonzero ldrops
to preserve the grace-period delta and prevent the wrap.
Issue reported by Acts1631.
from bket@; OK sashan@ claudio@
this is errata/7.9/043_pffq.patch.sig
using sizeof is recommended practice
from deraadt@
remove comma after final SEE ALSO reference
from jsg@
isakmpd(8): Fix various remotely triggerable crashes
- Only accept authenticated DPD notifications with a well-formed payload.
- Check the notify payload length against the SPI size.
- Fail AES key setup on invalid key lengths.
- Reject encrypted messages whose length is zero or not a multiple
of the cipher block size.
- Do not free the caller's certificate in x509_cert_get_key().
- Do not run exchanges that are already finalized.
from hshoexer@; with markus@, some input from tb@, OK deraadt@
this is errata/8.0/006_isakmpd.patch.sig
Avoid infinite loop when parsing PFKEY replies
In bgpd, iked, isakmpd, ldpd and sasyncd we have similar code to
parse PFKEY replies from the kernel. To avoid an infinite loop on
malformed replies validate the SADB extension size.
For consistency with the other daemons rewrite the parsing loop of
iked.
sasyncd already validates the extension size, so no change needed.
from hshoexer@; OK claudio@ tb@ tobhe@
isakmpd(8): Fix NULL dereference in message_alloc_reply() callers
message_alloc_reply() dereferences the returned pointer of
message_alloc() without a NULL check. Add one so callers can handle
the failure.
Also add NULL checks at both call sites in exchange.c.
from hshoexer@; test & OK sthen@
isakmpd(8): Fix possible unaligned 32 bit read
When validating IPsec SPIs in a DELETE message, access to the
32 bit SPI value might be unaligned. On platforms requiring strict
[106 lines not shown]
pf(4) tcp scrub is prone to UAF when state times for matching packet
Yet another race between pf_test() and pf_purge_states() driven
by timeout thread. This time pf_test_state() may touch freed memory
in pf_normalize_tcp_stateful() when dereferencing ->scrub member.
Issue reported and patch submitted by Acts1631
OK OK renaud@, OK henning@
