www/sope: fix build with llvm 22
change some types to fix -Wincompatible-pointer-types warnings turned
errors with 22, and put a -Wno-error=incompatible-pointer-types on the
one i have no idea how to fix. Objective-C definitely is a weird language...
DNS0x20[1] can randomise the case of domain names returned by lookup
to force some more uniqueness in queries to reduce the likelihood
of spoofing attacks succeeding.
Normally this should be hidden from the user by the resolver, but
in some cases it can leak through. When it does, it can mess up
ssh's CanonicalizePermittedCNAMEs.
Fix this by forcing the name we received from the system resolver to
lowercase.
bz3966, report and fix by Martin D Kealey
[1] https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00
Fix two separate one-byte out-of-cound reads
1) if a server sent an empty reply to a SSH2_FXP_REALPATH request
2) if a batch command used the full 2048 byte buffer but ended in a
literal backslash character
Both reported by Zhenpeng (Leo) Lin from depthfirst
ok markus@
make the transport protocol stricter by disconnecting if the peer
sends non-KEX messages during a key re-exchange.
Previously an evil peer could continue sending non-KEX messages
without penalty, causing memory to be wasted up until the
connection terminated or the server/client hit a OOM limit.
reported by Marko Jevtic; ok markus@
stricter validation of the transport state passed from the
unprivileged preauth sshd-auth process to the user-privileged
postauth sshd-session process.
These are harmless unless an attacker had an exploit for sshd-auth
in which case they could be used for post-auth memory DoS or to
crash you own session in a new and exciting way.
Reported by bylee3 and Kayky Vinicius
ok markus
Enforce a maximum size for usernames in agent key use constraints
Along with the match_pattern() performance change that was just
committed this avoids a denial-of-service where an agent client could
waste CPU on an agent by sending user constraints with lots of
wildcards.
Reported by Huzaifa Sidhpurwala of Redhat
ok markus
flesh out match_pattern() tests, including a new comparison test of
the new NFA-based implementation against the original one for all
possible combinations of short inputs and patterns constructed from
a small dictionary of possibilities.
Replace the old recursive match_pattern() with an implementation
that uses a NFA for matching. This avoids the exponential worst-
case behaviour for the old implementation.
ok markus@
sysutils/whowatch: fix build with llvm22
Fix a type error in a configure snippet that broke with LLVM 22.
While here, sync up some prototypes to eliminate a slew of warnings.