isakmpd(8): Fix various remotely triggerable crashes
- Only accept authenticated DPD notifications with a well-formed payload.
- Check the notify payload length against the SPI size.
- Fail AES key setup on invalid key lengths.
- Reject encrypted messages whose length is zero or not a multiple
of the cipher block size.
- Do not free the caller's certificate in x509_cert_get_key().
- Do not run exchanges that are already finalized.
with markus@, some input from tb@, ok deraadt@
struct mfii_ld_map shouldn't have changed with the addition of MFII_MAX_LD
as it describes a response to a management command. Changing this broke
the driver's ability to see non-raid disks.
problem reported by sonicsmith at gmail dot com
ok dlg@
Fix smime and cms exit status on option parsing errors
Initialize ret to 1 before parsing options so parsing failures return
an error instead of success.
Reported by jumpifnotzero
Fix https://github.com/libressl/portable/issues/1440
ok tb@
initial draft of dbupdate(8) for updating (signed) zoneinfo and cert.pem
from a new cdn.openbsd.org/pub/OpenBSD/dbupdates/ directory. We can't
do this nicely with syspatch(8) because it requires patches in sequence
so a new tool had to be written. It is intentionally kept very simple
so that it can be studied because we intend to run this in root cron,
(the non-simple parts figure out quickly when not to update).
looked at by sthen beck lucas dgl
Handle the Emudhra intermediate cert compromise.
See https://emudhra.we-have-a-problem.com/
While likely all of Emudrha will be distrusted soon, currently
a lot of India is using them. 8 intermediates under their CA3
have publicly discoverable keys. the 9 others sign many sites.
For now, remove CA3 from the trust store, thus distrusting all
the intermediates it has signed, then add back the remaining
9 uncompromised intermediates by "promoting" to a root, the
usual intermediate elision technique.
This enables real sites in india using these intermediates
to still work. Assuming Emudhra ends up widely distrusted
soon, we can remove these and the other roots after sites
have had time to get new certificates.
ok tb@ sthen@
the clock applet should only monitor /etc/localtime
in additional monitor /etc with kqueue and filter for /etc/localtime
because the symlink can change and that will not be picked up by
monitoring /etc/localtime itself
