pf(4) pf_state_import() can be bit more paranoid
Add sanity check for queue priority assigned to state
via 'set prio' rule action. The priority must fit
to bounds used by kernel (<= IFQ_MAXPRIO)
Issue reported and patch submitted by Acts1631
OK renaud@, OK henning@
unveil: Limit count of visited covers to ps_uvvcount, this avoids an
infinite loop with a particular construction of unveils.
from Acts1631
from dgl@
this is errata/8.0/009_unveil.patch.sig
unveil: Limit count of visited covers to ps_uvvcount, this avoids an
infinite loop with a particular construction of unveils.
from Acts1631
from dgl@
this is errata/7.9/044_unveil.patch.sig
Prevent fq_codel panic from drop counter wrap
Sustained traffic through a congested fq_codel queue can wrap the
per-flow drop counter to zero, triggering the control_law() assertion
and panicking the kernel. Saturate drops and decrement a nonzero ldrops
to preserve the grace-period delta and prevent the wrap.
Issue reported by Acts1631.
from bket@; OK sashan@ claudio@
this is errata/8.0/008_pffq.patch.sig
Prevent fq_codel panic from drop counter wrap
Sustained traffic through a congested fq_codel queue can wrap the
per-flow drop counter to zero, triggering the control_law() assertion
and panicking the kernel. Saturate drops and decrement a nonzero ldrops
to preserve the grace-period delta and prevent the wrap.
Issue reported by Acts1631.
from bket@; OK sashan@ claudio@
this is errata/7.9/043_pffq.patch.sig
using sizeof is recommended practice
from deraadt@
remove comma after final SEE ALSO reference
from jsg@
isakmpd(8): Fix various remotely triggerable crashes
- Only accept authenticated DPD notifications with a well-formed payload.
- Check the notify payload length against the SPI size.
- Fail AES key setup on invalid key lengths.
- Reject encrypted messages whose length is zero or not a multiple
of the cipher block size.
- Do not free the caller's certificate in x509_cert_get_key().
- Do not run exchanges that are already finalized.
from hshoexer@; with markus@, some input from tb@, OK deraadt@
this is errata/8.0/006_isakmpd.patch.sig
Avoid infinite loop when parsing PFKEY replies
In bgpd, iked, isakmpd, ldpd and sasyncd we have similar code to
parse PFKEY replies from the kernel. To avoid an infinite loop on
malformed replies validate the SADB extension size.
For consistency with the other daemons rewrite the parsing loop of
iked.
sasyncd already validates the extension size, so no change needed.
from hshoexer@; OK claudio@ tb@ tobhe@
isakmpd(8): Fix NULL dereference in message_alloc_reply() callers
message_alloc_reply() dereferences the returned pointer of
message_alloc() without a NULL check. Add one so callers can handle
the failure.
Also add NULL checks at both call sites in exchange.c.
from hshoexer@; test & OK sthen@
isakmpd(8): Fix possible unaligned 32 bit read
When validating IPsec SPIs in a DELETE message, access to the
32 bit SPI value might be unaligned. On platforms requiring strict
[106 lines not shown]
pf(4) tcp scrub is prone to UAF when state times for matching packet
Yet another race between pf_test() and pf_purge_states() driven
by timeout thread. This time pf_test_state() may touch freed memory
in pf_normalize_tcp_stateful() when dereferencing ->scrub member.
Issue reported and patch submitted by Acts1631
OK OK renaud@, OK henning@
Rework how rtables are allocated and reduce use of RT_TABLEID_MAX
Currently rtables use multiple arrays to do lookups and the reallocation
logic is complex and not race free. Replace all of this with a much
simpler lookup that is inspired by the if_idxmap used to map interfaces.
Use a single SMR backed object that contains the size and the array
of rtable pointers. This array can only grow and objects referenced
from the array are never freed. So the life-cycle becomes much simpler.
To make this work struct rtable needs to include all information
contained in a rtable / rdomain. This includes the sourceaddr per table,
the loopback interface index, the rtable to rdomain mapping and in the
future also the multicast router data. Once a struct rtable is allocated
it is never freed.
At the same time reduce the usage of RT_TABLEID_MAX and have rtable_exists
do the check against the real limit. In general code like SIOCSLIFPHYRTABLE
only need to verify that the rdomainid is non-negative and the upper limit
[3 lines not shown]
During DVACT_SUSPEND, after ensuring the soft state was good, this
would try to reset the chip, then keep trying to restart it, pretty
much iteratively, and would reach into sleeping logic. This is obviously
incorrect and not neccessary. Unfortunately this diff is since noone
has showed up with one of these devices in years.
Do not compile helper functions only used by the regress test, or by the
hibernate code, unless we are building the regress test, or a kernel with
option HIBERNATE.
rpki-client: disallow certs with zero serialNumber
Consistency is hard:
RFC 5280 (eid3200 clarifies) and RFC 6487 disallow a zero serialNumber.
For extra fun, CRLNumber and manifestNumber are defined via ASN.1
explicitly allowing zero. So we need some extra dances.
Arguably eid3200 was resolved the wrong way.
Serial number issue pointed out by the rpki-rp-benchmark.
ok claudio
rpki-client: split some helpers out of cms.c
There are a bunch of helper functions that are not really CMS specific
that will be shared by several signed object parsers. Implementations
go into rpki-der.c and they are prototyped in rpki-der.h. The latter
should eventually replace rpki-asn1.h.
ok claudio
Directly dispatch the files referenced by a mft in the parser.
There is no need to circle back to the parent process to schedule more work.
This is the minimal way to handle this and should allow us to further improve
the MFT handling.
The work items enqueued by an MFT are put on the global entity queue but
only after the mft message was enqueued into the output queue.
OK tb@
rpki-client: use strncmp() after x509_location()
Now that the protocol (always expected to be https:// or rsync://) is
normalized, we can do a simpler check.
Prompted by a report by Ties de Kock
ok claudio
rpki-client: reject short URIs in x509_location()
Reject URIs not long enough to hold https:// or rsync://. While "a:///b/c"
is in principle legal, this isn't plausibly a valid URI that should occur
in the wild. Reject certs containing this.
pointed out by/ok claudio
rpki-client: normalize known URI schemes in x509_location()
RFC 3986 was written under full influence of the robustness principle,
necessarily making all code handling URIs complicated and fragile. This
is further exacerbated by RFC 5280 explicitly mentioning that scheme and
host part of a URI are case-insensitive (for SAN, not explicitly for a
URI accessLocation, but that seems implied).
The schemes explicitly specified by RFC 6487 and friends are rsync and
https and that's the only ones the callers do anything with. Normalize
these to be lower case and accept other schemes (and currently no scheme)
for simplicity. This avoids hitting an errx() in queue_add_from_cert().
Reported by Ties de Kock
ok claudio
