the new configuration dump code emits configuration directives with
capitalisation (previously they were all lowercase), so make the tests
that consume them insensitive to case
big refactor of sshd config management code.
This generates much of the initialisation, defaults and keyword table
code from a set of macros rather than hand coding them. These same
macros are also used to generate serialisation and deserialisation
code.
The macros are admittedly ugly but have the advantage of forcing a
good degree of consistency across places that need to stay in sync
with each other.
The new de/serialisation code is used to pass configurations across
the various sshd-* process boundaries. This removes the need to pass
around raw text configurations that need to be re-parsed as well as
eliminating some raw pointer leakage across the processes where
structures were previously clumsily serialised.
feedback/ok markus@
Don't fail hard on version mismatch and ignore extra end-of-params messages.
Replace the lerrx on version mismatch with a lwarnx and error return.
Switch to ssize_t return for that so that slowcgi_request() can properly
fail when this happens.
Also do not execute multiple commands when extra end-of-params messages
are received. Once a command is executed fail to start a 2nd one.
Same diff as bgplgd rev. 1.9
Reported by Frank Denis
OK florian@ tb@
DNS0x20[1] can randomise the case of domain names returned by lookup
to force some more uniqueness in queries to reduce the likelihood
of spoofing attacks succeeding.
Normally this should be hidden from the user by the resolver, but
in some cases it can leak through. When it does, it can mess up
ssh's CanonicalizePermittedCNAMEs.
Fix this by forcing the name we received from the system resolver to
lowercase.
bz3966, report and fix by Martin D Kealey
[1] https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00
Fix two separate one-byte out-of-cound reads
1) if a server sent an empty reply to a SSH2_FXP_REALPATH request
2) if a batch command used the full 2048 byte buffer but ended in a
literal backslash character
Both reported by Zhenpeng (Leo) Lin from depthfirst
ok markus@
make the transport protocol stricter by disconnecting if the peer
sends non-KEX messages during a key re-exchange.
Previously an evil peer could continue sending non-KEX messages
without penalty, causing memory to be wasted up until the
connection terminated or the server/client hit a OOM limit.
reported by Marko Jevtic; ok markus@
stricter validation of the transport state passed from the
unprivileged preauth sshd-auth process to the user-privileged
postauth sshd-session process.
These are harmless unless an attacker had an exploit for sshd-auth
in which case they could be used for post-auth memory DoS or to
crash you own session in a new and exciting way.
Reported by bylee3 and Kayky Vinicius
ok markus
Enforce a maximum size for usernames in agent key use constraints
Along with the match_pattern() performance change that was just
committed this avoids a denial-of-service where an agent client could
waste CPU on an agent by sending user constraints with lots of
wildcards.
Reported by Huzaifa Sidhpurwala of Redhat
ok markus
flesh out match_pattern() tests, including a new comparison test of
the new NFA-based implementation against the original one for all
possible combinations of short inputs and patterns constructed from
a small dictionary of possibilities.
Replace the old recursive match_pattern() with an implementation
that uses a NFA for matching. This avoids the exponential worst-
case behaviour for the old implementation.
ok markus@
Handle sections that specify alignment as 0 when loading an ELF interpreter
(i.e. ld.so). Since the smallest possible alignment actually is a the
page size just start with that and only increase it if a larger alignment
is requested. Also reject interpreters without loadable segments, just
like we did for ld.so a few weeks ago.
Distilled from a report by Andrew Griffiths.
ok jsg@, deraadt@
Validate size of chunks copied to piglet during hibernate unpack
Ensure that the compressed size of the chunk read from the hibernate image
will fit into the reserved space in the piglet for such chunks. Prevents
chunks with invalid sizes from overrunning the piglet. Such corrupted
chunks could be present in tampered or corrupt on-disk hibernate images.
Reported by Frank Denis
Validate sizes against integer overflow when reading chunks in unhibernate
Validate that chunk sizes stored in the chunktable don't result in integer
overflow. Such invalid chunk sizes could be present in tampered or corrupt
on-disk hibernate images.
Reported by Frank Denis
Prevent overread when reading the chunktable in unhibernate
Ensure we don't read past the end of the chunktable, which could happen
with a tampered or corrupted on-disk hibernate image.
Reported by Frank Denis
