BSD Commit Log Search

   only allow an NFS server to set file type on a new vnode

   Otherwise, a malicous server could aid a local user in avoiding access
   controls.

   This reverts nfs_subs.c rev 1.3.  Which was part of a commit to fix the
   use of automount with direct maps.

   reported by Andrew Griffiths
   from jsg@

   this is errata/7.9/016_nfs.patch.sig

   only allow an NFS server to set file type on a new vnode

   Otherwise, a malicous server could aid a local user in avoiding access
   controls.

   This reverts nfs_subs.c rev 1.3.  Which was part of a commit to fix the
   use of automount with direct maps.

   reported by Andrew Griffiths
   from jsg@

   this is errata/7.8/052_nfs.patch.sig

   Clamp numeric arguments of terminal escape sequences to an arbitrary value of
   100,000. The existing logic would happily process as many digits as provided,
   which could make the values wraparound at 2**32, or be considered as negative
   values if cast to a signed type, leading to incorrect processing.

   Bug report by Acts1631.
   from miod@

   this is errata/7.9/017_wscons.patch.sig

   Clamp numeric arguments of terminal escape sequences to an arbitrary value of
   100,000. The existing logic would happily process as many digits as provided,
   which could make the values wraparound at 2**32, or be considered as negative
   values if cast to a signed type, leading to incorrect processing.

   Bug report by Acts1631.
   from miod@

   this is errata/7.8/053_wscons.patch.sig

   sys/uvm: validate anonymous object pager requests

   uao_get() trusts the requested page range before allocating pages and
   looking up swap slots; an invalid request can therefore allocate a page
   outside the object and read beyond its swap slot array. Validate the
   request before page lookup or allocation, preserving optional fault
   clustering at the object boundary.

   Reject nonpositive page counts and starting page indices outside the
   object; require the entire range for PGO_ALLPAGES, or a centeridx within
   both the request and the object otherwise. Compare against the remaining
   page count in voff_t and derive pageidx from the validated firstpage,
   avoiding overflow in the bounds check and unchecked narrowing.

   Reported by Andrew Griffiths, thanks!
   from kirill@; OK kettenis@

   this is errata/7.9/018_shmat.patch.sig

   sys/uvm: validate anonymous object pager requests

   uao_get() trusts the requested page range before allocating pages and
   looking up swap slots; an invalid request can therefore allocate a page
   outside the object and read beyond its swap slot array. Validate the
   request before page lookup or allocation, preserving optional fault
   clustering at the object boundary.

   Reject nonpositive page counts and starting page indices outside the
   object; require the entire range for PGO_ALLPAGES, or a centeridx within
   both the request and the object otherwise. Compare against the remaining
   page count in voff_t and derive pageidx from the validated firstpage,
   avoiding overflow in the bounds check and unchecked narrowing.

   Reported by Andrew Griffiths, thanks!
   from kirill@; OK kettenis@

   this is errata/7.8/054_shmat.patch.sig

   use mode_t and symbolic settings; ok millert

   Backport all changes from libexpat version 2.8.4.

   Relevant for OpenBSD are security fixes #1321 #1331 #1322, other
   changes #1315 #1325 #1334 #1340 #1319 #1320.  Library bump is not
   necessary.
   CVE-2026-66046 CVE-2026-76641 CVE-2026-76957

   from bluhm@; OK tb@

   this is errata/7.9/019_expat.patch.sig

   Backport all changes from libexpat version 2.8.4.

   Relevant for OpenBSD are security fixes #1321 #1331 #1322, other
   changes #1315 #1325 #1334 #1340 #1319 #1320.  Library bump is not
   necessary.
   CVE-2026-66046 CVE-2026-76641 CVE-2026-76957

   from bluhm@; OK tb@

   this is errata/7.8/055_expat.patch.sig

   Assign connections a 64 bit identifier rather than using the socket fd to
   identify them between subprocesses.

   Based on a report from Franz Bettag of Bettag Systems
   from jmatthew@; OK deraadt@

   this is errata/7.9/021_ldapd.patch.sig

   Assign connections a 64 bit identifier rather than using the socket fd to
   identify them between subprocesses.

   Based on a report from Franz Bettag of Bettag Systems
   from jmatthew@; OK deraadt@

   this is errata/7.8/057_ldapd.patch.sig

   sync

   bpf_validate: change len argument to u_int

   All callers of bpf_validate use unsigned values and bpf_validate
   does the same internally.

   OK tb@

   test eqn(7) at the end of a column list with no .It macros;
   related to mdoc_validate.c rev. 1.312

   Fix a logic error in post_bl() that could cause a NULL pointer access.

   When a column list does not use explicit .It macros and contains
   at least one text line followed by a node generated on the roff(7)
   level, for example an eqn(7) node, and then nothing more, in
   particular no following .It macro, the code wraps the node generated
   on the roff level in an implicit .It macro.  After moving the node
   into the new .It macro, the loop variable "nchild" iterating over
   the children of .Bl must be set to NULL to exit the while loop.
   Instead, the loop variable remained pointing at the moved node, and
   the loop tried to move it again, resulting in an access to its
   "prev" pointer, which is of course NULL in this situation.

   Hippolyte Doncieu de la Batie <hippolyte.doncieu at gmail.com>
   found this bug using clang-14 with libFuzzer
   and drafted an almost correct patch to fix it.
   The first half of his patch was correct;
   i slightly rearranged it with no functional change
   to make the code two lines shorter and easier to read.

    [4 lines not shown]

   use getprogname() instead of manually repeating the argv deconstruction

   iked, ntpd, and bgpd are the final 3 programs to move to getexecpath(3)
   and execv(3).

   rpki-client: rework cms_parse_validate() further

   This diff pulls the signed object handling into cms_parse_validate(),
   thereby simplifying the signature quite a bit. signed_object_parse()
   remains as a thin wrapper of cms_parse_validate() for now. Perhaps we
   will need a signed_object_parse_filemode(), for example.

   One benefit of doing this is that the CMS_ContentInfo object lives
   during the entire signd object validation, so we no longer need to
   create a copy of its eContent OCTET STRING for further processing.

   ok claudio

   rpki-client: move cms_object_from_rtype() a bit up

   ok claudio

   rpki-client: fix handling of inherited resources in leaves

   It's been publicly known at least since Frank Denis's "security audit"
   dumps back in May that the RFC 3779 inheritance handling in libcrypto's
   path validation is broken. Namely, if the certificate to be validated
   inherits resources, X509v3_asid_validate_path(3) and friends can succeed
   even if one of the certs on the path does not have the corresponding
   resource delegation extension at all. RFC 3779's sections 2.3 and 3.3
   clearly require that every cert on the entire validating path have the
   relevant INR delegation extensions. Frank Denis flagged this for ASIDs,
   but it is obvious that IP addresses have the same problem.

   For rpki-client, one of the very few (if not the only) consumers of this
   code in libcrypto, this doesn't matter all that much because it duplicates
   much of the work on INR validation. Per the specification, EE certs with
   inherit elements are only in MFTs, TAKs (of which there are none) and
   the no longer supported GBRs (of which there is one - malformed). Correct
   nesting and presence of RFC 3779 extensions is ensured by rpki-client
   except for the leaf.

    [33 lines not shown]

   Another relatively simple getexecpath(3) + execv(3) conversion.
   ok rsadowski

   Johann Hoepfner found 5 places where un-terminated strings in pf ioctl's
   were handled incorrectly but his solution of silently truncating them and
   potentially acting on the wrong object decided from the string didn't
   satisfy me.  I started over, and identified all un-terminated strings
   using strlnen and made them return ENAMETOOLONG. There were roughly 40
   occurances of this type of bug.
   ok sashan

   Move code around to result in the same list of case statements in
   _bpf_filter and bpf_validate.

   Also encode BPF_LDX|BPF_MSH|BPF_B as BPF_LDX|BPF_B|BPF_MSH, all other
   BPF_LD / BPD_LDX instructions have BPF_{W,H,B} in 2nd position.

   OK tb@

   Add remain-on-exit failed-key and a -D flag to new-pane to have a modal
   pane wait for Escape/C-c. Both to allow better compatibility with
   popups.

   Change imsg handling for kroute change and delete imsg messages

   Pass the imsg to kr_delete() and kr_change(). For kr_delete() a simple
   imsg_get_data call can be used. In kr_change() it is a bit more complex
   since the imsg is an array of struct kroute. So take the ibuf, validate
   the len and pull the first value in kr_change.

   Put the single OSPF route codepath into its own kr_change_one() function
   and simplify kr_change_fib() since it now only does RTM_ADD.
   kr_change_fib still uses ibuf_data internally since it needs to access the
   array of kroutes over and over again.

   Reads ok to tb@

   use .Va for errno variable

   Allow IPPROTO_IP / IP_TOS on AF_INET6 sockets to go through to the
   netinet6 code, which will quickly return EINVAL.  Too much software
   tries this.  Issue noticed in chrome by kirill
   discussions with kirill and robert.

   Learn the execpath executable from either of AUX_execpath or
   AUX_openbsd_execpath (the first will be deleted in about a week
   when kernels have crossed over)
   ok kettenis

   Export the new AUX_openbsd_execpath 4001 as well as the (soon to be removed)
   AUX_execpath.
   ok kettenis

   Using AUX_execpath 15 collides with Linux use of the portable space,
   so let's use AUX_openbsd_execpath 4001 instead so that tools can tell
   the difference.
   Expand ELF_AUX_ENTRIES to 13 temporarily, and keep providing 15 for
   a while until people's kernels are updated through this phase.
   ok kettenis