Print TLS and short read errors to stderr and not stdout
Code paths that are not only used in interactive mode should log to
stderr. Adjust some TLS and a short file read error to use warnx.
Diff by Pontus Stenetorp (pontus at stenetorp dot se)
OK deraadt@ tb@
Correct EMSGSIZE handling in msgbuf_read to retry without control message
In msgbuf_read() the EMSGSIZE handling needs to retry without the control
buffer so that the message is read without the fd and forcing the kernel
to close the buffer). Else the call will fail immediatly again and the
system will busy loop.
OK tb@
Change overflow check in ibuf_get_strbuf
ibuf_get_strbuf is too picky about the terminating NUL byte.
If the sender did not use ibuf_add_strbuf() then the buffer may
not be padded with 0 at the end. This triggers the EOVERFLOW case
even though the string is probably short enough.
Make ibuf_get_strbuf more robust by checking the string length.
If the string is shorter than the buffer pad the rest with 0. On
overflow force a '\0' byte at the end and return EOVERFLOW.
OK tb@
relayctl: switch to imsg_get_* API
Use imsg_get_data() with size validation instead of casting imsg->data
directly and imsg_get_type/len/id/pid() instead of imsg->hdr.* acc
Structs like rdr/table/host.... carry embedded string buffers like name, label.
When such a struct crosses a privilege boundary the receiver cannot Structs
that the string is actually NUL terminated, so force a '\0' in the last byte
after imsg_get_data(). Not strictly required here because relayd is the sender,
but a good habit for imsg consumers.
embedded string buffer hint by claudio@, OK claudio@
Move check of public key type against allowed algorithms to before
parsing of the key sent by the peer.
This removes at least some key parsing and verification paths from
the pre-auth attack surface.
Suggested by Christopher Paul Rohlf of Anthropic, ok deraadt@
Update to samba-4.24.5
Security release addressing CTDB protocol bounds checking issues
(CVE-2026-58224). AD and DNS/KDC vulnerabilities do not affect standard
OpenBSD builds. Details:
https://www.samba.org/samba/history/samba-4.24.5.html
Tested by Ian McWilliam (maintainer).
Update to samba-4.24.5
Security release addressing CTDB protocol bounds checking issues
(CVE-2026-58224). AD and DNS/KDC vulnerabilities do not affect standard
OpenBSD builds. Details:
https://www.samba.org/samba/history/samba-4.24.5.html
Tested by Ian McWilliam (maintainer).
