Use unveil(2) to restrict write access to mandoc.db(5) and /tmp/
and read access to the selected manpath directory or directories,
but leave global read access open in -t mode.
Tweaks from and looks correct to deraadt@.
Update to pkgconf 3.0.6
This mostly adds OS/2 support. The only change relevant for OpenBSD is
- --variable accepts multiple modules and prints the requested
variable's value for each module, in argument order. --path and
--print-variables remain limited to a single module.
Which is the diff in cli/core.c. Apart from that little to nothing
changes for us (some #ifdefs cause line numbers to change).
ok djm
pkgconf: remove stale file
This somewhat outdated file snuck in by mistake in the last update.
It was not compiled into the binary because libpkgconf precedes cli
in .PATH, so the up-to-date libpkgconf/tuple.c file was used.
Found while working on hooking up upstream pkgconf regress where the
.PATH order was inverted in my WIP.
find,ls: Ensure -ls output matches ls -dils as documented; print the
epoch if localtime() fails. Synchronize the code with ls, so it always
checks localtime()'s return value.
ok tb@
stat: Show the stringified epoch if localtime() fails. Avoids segfault
on out of range time values. The raw value can still be obtained with
stat -f %m.
ok tb@
fw_update could be tricked into treating the untrusted comment as data.
In some situations (-a) this could be passed into fetch(), which did not
validate what it passed to su(1). Use the trusted output of signify and
add stricter validation.
with & ok afresh1@
Rewrite the imsg code to be more modern.
Split the code into independent send and recv functions that properly
send some of the more complex messages without leaking extra data or
causing problems on recv (e.g. by passing string buffers).
This also kills the send_imsg wrapper which kind of is the cause that
everything was passed as one big blob.
OK rsadowski@
Fix kr_change to add missing rtlabel references and update routes when
only the label changes.
rtlabel_tag2id() does not take a reference for the rtlabel id so a call
to rtlabel_ref() is needed here. This mirrors the rtlabel_unref calls.
In the nexthop already present case one needs to adjust the kn to update
the ext_tag and rtlabel in case those changed. With this the rtlabel to
external-tag mapping should work more reliable.
OK bluhm@
rsa_eay: Replace handrolled BN_bn2binpad with the real thing
Just a tiny little bit of lipstick on this entelodont. This is simpler
and does not change behavior as BN_bn2binpad() returns -1 on failure and
num on success.
jsing points out that BN_bn2binpad() is constant time.
ok jsing kenjiro
PS: henning, you owe me a significant amount of quality beverages for
making me look at this particular tire fire (and corresponding XS files).
libcrypto: harden cms_kek_cipher() a bit
When AES key unwrap with padding is in use, the EVP interface breaks its
contract and writes more than the outlen it initially reports to the output
buffer. This is an old, sneaky trap that the muppet set eons ago and many
victims walked right into it, including the muppet himself.
If inlen is larger than outlen, allocate inlen bytes to unwrap with padding
to avoid a buffer overwrite. This is a variant of OpenSSL's fix. Since we
do not support AES keywrap with padding no actual bufer overwrite occurs
here at the moment, but if we ever chose to do so (unlikely) this trap
would be avoided. There's plenty more traps that the next round of scas
will surely find in this absolute trashfire of CMS support code.
ok kenjiro
Do not try to configure 0.0.0.0 (INADDR_ANY) on an interface.
If we indicate a preference for IPv6-only (DHCP option 108), the
server does not offer an IP address (indicated by INADDR_ANY), so we
must first check if the server supported option 108 before checking if
we received an IPv4 offer.
Logic error pointed out and diff provided by acts1631 at proton.me,
thanks!
Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback returns 1
While not the advised way of using the verify callback (either by OpenSSL
or by us) in production, sometimes folks like to return 1 from everything
in the callback and then check the error return and make decicions about
things.
This fix ensures that such callbacks will see the hostname mismatch and
be able to act upon them.
Reported by Alexander Aleksandrovic Klimov
ok tb@
Do not hardcode /usr/src/ in one of the files containing desired output.
This is expected to fix a test failure that anton@ reported with BSDSRCDIR set.
Fix control message handling in recvit to avoid out of bounds write
to userland
Because of the use of a unsigned variable to track the length of the
control buffer recvit can underflow that variable because of an unchecked
ALIGN(). This can be triggered by passing a too short buffer that is not a
multiple of _ALIGNBYTES + 1. In such a case the kernel copies out data past
the provided buffer.
On top of addding the missing overflow check this also uses the proper
socklen_t type for the msg_controllen and uses an unsigned int for the
still overloaded variable i.
The security implications of this are mainly theoretical. The correct use
of control message handling requires the use of CMSG_SPACE which ensures
the buffer size is properly rounded. In base only dig uses a buffer that
is not correctly rounded at the same time it is oversized enough to not
matter.
[2 lines not shown]
find: check localtime() return before calling strftime on it
landry saw "find dir -ls" crash with fs corruption. dgl reproduced with
touch foo && perl -e'utime 2**63, 2**63, "foo"' && find foo -ls
which could have been added to regress if there was any...
ok deraadt
rpki-client: reject some signed objects with BER encoding
ARIN finally fixed their shit and no longer distributes malformed ROAs.
Detect one symptom of their malformedness. This is a very unsatisfactory
kludge since it only detects indefinite length encoding at the outermost
layer, but this will hopefully help avoid regressions. libcrypto's ASN.1
parser is not going to help making the world a cleaner place.
fine with claudio, ok job
rpki-client: unconditionally warn about incorrect RSA parameters
Now that ARIN have fixed their old ROAs, this encoding no longer occurs
in the wild, so enabling this warning does no harm. Ideally we'd error,
but a Postel-inspired MUST that has been sprinkled across numerous RFCs
ensured that this had to be tolerated for more than a quarter of a century
and will continue to be for at least another one.
discussed with claudio job
