Reserve the first MB of the DVA address space because qwx(4) doesn't
succeed in doing DMA when the DVA is 0x1000 and PCI-PCI bridges may not
forward address in part of that first MB as well.
ok chris@
Error out on presence of Content-Length and Transfer-Encoding headers
for GET, HEAD and other methods that should have no body.
Ignoring the Content-Length header makes httpd vulnerable to
HTTP request smuggling. A crafted GET request may embed an extra
HTTP request which could bypass a proxy or WAF but then is handled
by httpd.
Remove the special case for TRACE and CONNECT in the Content-Length
handling. Move those checks into the method switch at the end of the
header parsing phase and by that also cover more methods including
GET and HEAD. If either header is present simply abort the connection,
nobody should send extra data along GET and HEAD requests.
Add an an explicit HTTP_METHOD_TRACE case above the default case
to indicated that we deliberately don't handle TRACE requests.
This security vulnerability was found by Nicola Staller of SySS GmbH.
With and OK rsadowski@ previous version also OK florian@
enable forced resolvers that aren't in a preference block
allows a config such as:
preference { autoconf }
forwarder { 127.0.0.1 port 5300 }
force forwarder { local }
also fix a typo while i'm here
ok florian
regress/mmap: Test hints in VM-area edge cases
Test mmap(2) with hint above VM_MAXUSER_ADDRESS without MAP_FIXED.
This tests uvm_map.c,v 1.355.
Also test the lower boundary below PAGE_SIZE.
ok kettenis@
Security update to vaultwarden-1.35.4
This release contains security fixes:
- GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to
access a cipher from a different user (fully encrypted) if they
already know its internal UUID.
- GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with
manager-level access within an organization to modify collections they
can access, even if they do not have management permissions for them.
- GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with
manager-level access within an organization to modify collections they
are not assigned. These are private for now, pending CVE assignment.
Changes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.4
OK kirill@
update to freerdp-2.11.8
remove PORTROACH marker, this is the last 2.x release (updating is
blocked, 3.x needs a more complete posix timers implementation)
pledge "tmppath" goes away because it sucks. The history is kind of
sad: unveil(2) was invented by Bob Beck and myself because a couple
of us struggled and couldn't expand the "tmppath" mechanism to general use.
unveil(2) ended up being kind of "upside down" different, and so we never
deleted "tmppath" because the refactorings seemed complicated.
However over the last two weeks, we're removed all the "tmppath" in base
pretty easily, and the 18 ports using it have also been fixed.
The majority of situations now use unveil "/tmp" "rwc", unveil "/" "r" or
similar, and then pledge "rpath wpath cpath", and this is generally needed
to satisfy the mkstemp(3) family of functions in libc.
Use of "tmppath" will now cause pledge(2) to return EINVAL. There is
no backwards compatible way of mimic the behaviour correctly using
kernel-internal unveil hackery.
Prompted by a report from David Leadbeater; and extensive conversations
with beck and semarie.
Update various lifetimes.
This raises the router, dns and nat64 lifetimes from 30 minutes to 60
minutes and lowers the prefix valid lifetime from 90 minutes to 60
minutes.
This brings us in line with the values of draft-ietf-6man-slaac-renum
which is going to be published soon.
Aligning all these lifetimes to a single value (60 minutes) makes
sense because the information is transmitted in one router
advertisement packet. It does not make sense for one piece of
information to time out before another.
OK phessler
Call igmp_sendpkt() and mld6_sendpkt() with pktinfo argument.
Gather all information needed to send an IGMP or MLD6 packet in a
struct pktinfo. This allows splitting access to multicast data
structures from sending packets. Then adding locks to multicast
will be easier.
OK mvs@
