./PaxHeaders.17043/2.700407550001756001161000000000036101675603350011253xustar0030 atime=1783509427.808696221 2.7004075500017560011610000000000001016756033500102565ustar00ssyncsync2.7/PaxHeaders.17043/alpha00407550001756001161000000000036101675603350012203xustar0030 atime=1783509427.808696221 2.7/alpha004075500017560011610000000000001016756033500113435ustar00ssyncsync2.7/PaxHeaders.17043/common00407550001756001161000000000036101675610450012405xustar0030 atime=1783509427.808696221 2.7/common004075500017560011610000000000001016756104500115455ustar00ssyncsync2.7/common/PaxHeaders.17043/001_ipf.patch01004440001756001161000000000036071144035400014622xustar0030 atime=1783509427.808696221 2.7/common/001_ipf.patch010044400017560011610000000536610711440354000140020ustar00ssyncsyncThis patch affects both kernel and userland. Make sure you have both kenel and userland sources before applying this patch. Apply by doing: # cd /usr/src # patch -p0 < 001_ipf.patch now, build a kernel. Eg, for GENERIC: # cd sys/arch/i386/conf # config GENERIC # cd ../compile/GENERIC # make clean && make depend && make # cp /bsd /bsd.old # cp bsd /bsd Export headers to userland # cd /usr/src # make includes And now rebuild userland # cd /usr/src/sbin/ipf # make obj && make cleandir && make && make install # cd /usr/src/sbin/ipnat # make obj && make cleandir && make && make install # cd /usr/src/sbin/ipfstat # make obj && make cleandir && make && make install # cd /usr/src/usr.sbin/ipmon # make obj && make cleandir && make && make install # cd /usr/src/usr.sbin/ipftest # make obj && make cleandir && make && make install Reboot to activate the new ipf. To check that all was successful, do: # ipf -V You should see something like: ipf: IP Filter: v3.3.16 (184) Kernel: IP Filter: v3.3.16 Running: yes Log Flags: 0 = none set Default: pass all, Logging: available Active list: 0 Index: sys/netinet/ipl.h =================================================================== RCS file: /cvs/src/sys/netinet/ipl.h,v retrieving revision 1.10 retrieving revision 1.11 diff -u -r1.10 -r1.11 --- sys/netinet/ipl.h 2000/05/10 20:40:53 1.10 +++ sys/netinet/ipl.h 2000/05/24 21:59:11 1.11 @@ -1,4 +1,4 @@ -/* $OpenBSD: ipl.h,v 1.10 2000/05/10 20:40:53 deraadt Exp $ */ +/* $OpenBSD: ipl.h,v 1.11 2000/05/24 21:59:11 kjell Exp $ */ /* * Copyright (C) 1993-1999 by Darren Reed. @@ -13,6 +13,6 @@ #ifndef __IPL_H__ #define __IPL_H__ -#define IPL_VERSION "IP Filter: v3.3.14" +#define IPL_VERSION "IP Filter: v3.3.16" #endif Index: sys/netinet/fil.c =================================================================== RCS file: /cvs/src/sys/netinet/fil.c,v retrieving revision 1.24 retrieving revision 1.25 diff -u -r1.24 -r1.25 --- sys/netinet/fil.c 2000/05/10 20:40:52 1.24 +++ sys/netinet/fil.c 2000/05/24 21:59:10 1.25 @@ -1,4 +1,4 @@ -/* $OpenBSD: fil.c,v 1.24 2000/05/10 20:40:52 deraadt Exp $ */ +/* $OpenBSD: fil.c,v 1.25 2000/05/24 21:59:10 kjell Exp $ */ /* * Copyright (C) 1993-1998 by Darren Reed. @@ -9,7 +9,7 @@ */ #if !defined(lint) static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-1996 Darren Reed"; -static const char rcsid[] = "@(#)$IPFilter: fil.c,v 2.3.2.18 2000/04/25 16:21:09 darrenr Exp $"; +static const char rcsid[] = "@(#)$IPFilter: fil.c,v 2.3.2.20 2000/05/22 06:57:42 darrenr Exp $"; #endif #include @@ -99,9 +99,7 @@ second; } # define FR_VERBOSE(verb_pr) verbose verb_pr # define FR_DEBUG(verb_pr) debug verb_pr -# define SEND_RESET(ip, qif, if, m, fin) send_reset(ip, if) # define IPLLOG(a, c, d, e) ipllog() -# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip) #else /* #ifndef _KERNEL */ # define FR_IFVERBOSE(ex,second,verb_pr) ; # define FR_IFDEBUG(ex,second,verb_pr) ; @@ -111,23 +109,6 @@ # if SOLARIS || defined(__sgi) extern KRWLOCK_T ipf_mutex, ipf_auth, ipf_nat; extern kmutex_t ipf_rw; -# endif -# if SOLARIS -# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, \ - ip, qif) -# define SEND_RESET(ip, qif, if, fin) send_reset(fin, ip, qif) -# define ICMP_ERROR(b, ip, t, c, if, dst) \ - icmp_error(ip, t, c, if, dst) -# else /* SOLARIS */ -# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip) -# ifdef linux -# define SEND_RESET(ip, qif, if, fin) send_reset(ip, ifp) -# define ICMP_ERROR(b, ip, t, c, if, dst) icmp_send(b,t,c,0,if) -# else -# define SEND_RESET(ip, qif, if, fin) send_reset(fin, ip) -# define ICMP_ERROR(b, ip, t, c, if, dst) \ - send_icmp_err(ip, t, c, if, dst) -# endif /* linux */ # endif /* SOLARIS || __sgi */ #endif /* _KERNEL */ @@ -247,12 +228,17 @@ if (!off && (icmp->icmp_type == ICMP_ECHOREPLY || icmp->icmp_type == ICMP_ECHO)) minicmpsz = ICMP_MINLEN; + if (!off && (icmp->icmp_type == ICMP_TSTAMP || icmp->icmp_type == ICMP_TSTAMPREPLY)) - minicmpsz = 20; /* type(1) + code(1) + cksum(2) + id(2) + seq(2) + 3*timestamp(3*4) */ + minicmpsz = 20; +/* type(1) + code(1) + cksum(2) + id(2) + seq(2) + 3*timestamp(3*4) */ + if (!off && (icmp->icmp_type == ICMP_MASKREQ || icmp->icmp_type == ICMP_MASKREPLY)) - minicmpsz = 12; /* type(1) + code(1) + cksum(2) + id(2) + seq(2) + mask(4) */ + minicmpsz = 12; +/* type(1) + code(1) + cksum(2) + id(2) + seq(2) + mask(4) */ + if ((!(ip->ip_len >= hlen + minicmpsz) && !off) || (off && off < sizeof(struct icmp))) fi->fi_fl |= FI_SHORT; @@ -632,6 +618,16 @@ */ m->m_flags &= ~M_CANFASTFWD; # endif /* M_CANFASTFWD */ +# ifdef CSUM_DELAY_DATA + /* + * disable delayed checksums. + */ + if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { + in_delayed_cksum(m); + m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; + } +# endif /* CSUM_DELAY_DATA */ + if ((ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP || ip->ip_p == IPPROTO_ICMP)) { @@ -764,7 +760,7 @@ * then pretend we've dropped it already. */ if ((pass & FR_AUTH)) - if (FR_NEWAUTH(m, fin, ip, qif) != 0) + if (fr_newauth((mb_t *)m, fin, ip) != 0) #ifdef _KERNEL m = *mp = NULL; #else @@ -894,17 +890,11 @@ dst = ip->ip_dst; else dst.s_addr = 0; -# if SOLARIS - ICMP_ERROR(q, ip, ICMP_UNREACH, fin->fin_icode, - qif, dst); -# else - ICMP_ERROR(m, ip, ICMP_UNREACH, fin->fin_icode, - ifp, dst); -# endif + send_icmp_err(ip, ICMP_UNREACH, fin, dst); ATOMIC_INC(frstats[0].fr_ret); } else if (((pass & FR_RETMASK) == FR_RETRST) && !(fin->fin_fi.fi_fl & FI_SHORT)) { - if (SEND_RESET(ip, qif, ifp, fin) == 0) { + if (send_reset(ip, fin) == 0) { ATOMIC_INC(frstats[1].fr_ret); } } @@ -1197,7 +1187,7 @@ * SUCH DAMAGE. * * @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94 - * $IPFilter: fil.c,v 2.3.2.18 2000/04/25 16:21:09 darrenr Exp $ + * $IPFilter: fil.c,v 2.3.2.20 2000/05/22 06:57:42 darrenr Exp $ */ /* * Copy data from an mbuf chain starting "off" bytes from the beginning, Index: sys/netinet/ip_auth.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_auth.c,v retrieving revision 1.13 retrieving revision 1.14 diff -u -r1.13 -r1.14 --- sys/netinet/ip_auth.c 2000/05/01 06:16:47 1.13 +++ sys/netinet/ip_auth.c 2000/05/24 21:59:10 1.14 @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_auth.c,v 1.13 2000/05/01 06:16:47 kjell Exp $ */ +/* $OpenBSD: ip_auth.c,v 1.14 2000/05/24 21:59:10 kjell Exp $ */ /* * Copyright (C) 1998 by Darren Reed & Guido van Rooij. @@ -8,7 +8,7 @@ * to the original author and the contributors. */ #if !defined(lint) -static const char rcsid[] = "@(#)$IPFilter: ip_auth.c,v 2.1.2.3 2000/04/25 16:21:12 darrenr Exp $"; +static const char rcsid[] = "@(#)$IPFilter: ip_auth.c,v 2.1.2.4 2000/05/22 06:57:45 darrenr Exp $"; #endif #include @@ -198,17 +198,14 @@ * If we do, store it and wake up any user programs which are waiting to * hear about these events. */ -int fr_newauth(m, fin, ip -#if defined(_KERNEL) && SOLARIS -, qif) -qif_t *qif; -#else -) -#endif +int fr_newauth(m, fin, ip) mb_t *m; fr_info_t *fin; ip_t *ip; { +#if defined(_KERNEL) && SOLARIS + qif_t *qif = fin->fin_qif; +#endif int i; WRITE_ENTER(&ipf_auth); Index: sys/netinet/ip_auth.h =================================================================== RCS file: /cvs/src/sys/netinet/ip_auth.h,v retrieving revision 1.7 retrieving revision 1.8 diff -u -r1.7 -r1.8 --- sys/netinet/ip_auth.h 2000/03/13 23:40:17 1.7 +++ sys/netinet/ip_auth.h 2000/05/24 21:59:11 1.8 @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_auth.h,v 1.7 2000/03/13 23:40:17 kjell Exp $ */ +/* $OpenBSD: ip_auth.h,v 1.8 2000/05/24 21:59:11 kjell Exp $ */ /* * Copyright (C) 1997-1998 by Darren Reed & Guido Van Rooij. @@ -7,7 +7,7 @@ * provided that this notice is preserved and due credit is given * to the original author and the contributors. * - * $IPFilter: ip_auth.h,v 2.1 1999/08/04 17:29:54 darrenr Exp $ + * $IPFilter: ip_auth.h,v 2.1.2.1 2000/05/22 06:57:47 darrenr Exp $ * */ #ifndef __IP_AUTH_H__ @@ -56,11 +56,7 @@ extern void fr_authexpire __P((void)); extern void fr_authunload __P((void)); extern mb_t *fr_authpkts[]; -#if defined(_KERNEL) && SOLARIS -extern int fr_newauth __P((mb_t *, fr_info_t *, ip_t *, qif_t *)); -#else extern int fr_newauth __P((mb_t *, fr_info_t *, ip_t *)); -#endif #if defined(__NetBSD__) || defined(__OpenBSD__) extern int fr_auth_ioctl __P((caddr_t, u_long, frentry_t *, frentry_t **)); #else Index: sys/netinet/ip_fil.h =================================================================== RCS file: /cvs/src/sys/netinet/ip_fil.h,v retrieving revision 1.19 retrieving revision 1.20 diff -u -r1.19 -r1.20 --- sys/netinet/ip_fil.h 2000/05/10 20:40:53 1.19 +++ sys/netinet/ip_fil.h 2000/05/24 21:59:11 1.20 @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_fil.h,v 1.19 2000/05/10 20:40:53 deraadt Exp $ */ +/* $OpenBSD: ip_fil.h,v 1.20 2000/05/24 21:59:11 kjell Exp $ */ /* * Copyright (C) 1993-1998 by Darren Reed. @@ -8,7 +8,7 @@ * to the original author and the contributors. * * @(#)ip_fil.h 1.35 6/5/96 - * $IPFilter: ip_fil.h,v 2.3.2.9 2000/03/08 11:43:30 darrenr Exp $ + * $IPFilter: ip_fil.h,v 2.3.2.11 2000/05/22 06:57:50 darrenr Exp $ */ #ifndef __IP_FIL_H__ @@ -459,11 +459,12 @@ extern int ipflog_read __P((minor_t, struct uio *)); extern int ipflog __P((u_int, ip_t *, fr_info_t *, mb_t *)); extern int ipllog __P((int, fr_info_t *, void **, size_t *, int *, int)); +extern int send_icmp_err __P((ip_t *, int, fr_info_t *, struct in_addr)); +extern int send_reset __P((ip_t *, fr_info_t *)); # if SOLARIS extern int fr_check __P((ip_t *, int, void *, int, qif_t *, mb_t **)); extern int (*fr_checkp) __P((ip_t *, int, void *, int, qif_t *, mb_t **)); -extern int icmp_error __P((ip_t *, int, int, qif_t *, struct in_addr)); # if SOLARIS2 >= 7 extern int iplioctl __P((dev_t, int, intptr_t, int, cred_t *, int *)); # else @@ -472,7 +473,6 @@ extern int iplopen __P((dev_t *, int, int, cred_t *)); extern int iplclose __P((dev_t, int, int, cred_t *)); extern int ipfsync __P((void)); -extern int send_reset __P((fr_info_t *, ip_t *, qif_t *)); extern int ipfr_fastroute __P((qif_t *, ip_t *, mblk_t *, mblk_t **, fr_info_t *, frdest_t *)); extern void copyin_mblk __P((mblk_t *, size_t, size_t, char *)); @@ -485,12 +485,6 @@ # else /* SOLARIS */ extern int fr_check __P((ip_t *, int, void *, int, mb_t **)); extern int (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **)); -# ifdef linux -extern int send_reset __P((tcpiphdr_t *, struct ifnet *)); -# else -extern int send_reset __P((fr_info_t *, struct ip *)); -extern int send_icmp_err __P((ip_t *, int, int, void *, struct in_addr)); -# endif extern int ipfr_fastroute __P((mb_t *, fr_info_t *, frdest_t *)); extern size_t mbufchainlen __P((mb_t *)); # ifdef __sgi Index: sys/netinet/ip_fil.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_fil.c,v retrieving revision 1.34 retrieving revision 1.35 diff -u -r1.34 -r1.35 --- sys/netinet/ip_fil.c 2000/05/01 06:16:47 1.34 +++ sys/netinet/ip_fil.c 2000/05/24 21:59:11 1.35 @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_fil.c,v 1.34 2000/05/01 06:16:47 kjell Exp $ */ +/* $OpenBSD: ip_fil.c,v 1.35 2000/05/24 21:59:11 kjell Exp $ */ /* * Copyright (C) 1993-1998 by Darren Reed. @@ -9,7 +9,7 @@ */ #if !defined(lint) static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-1995 Darren Reed"; -static const char rcsid[] = "@(#)$IPFilter: ip_fil.c,v 2.4.2.20 2000/04/18 16:31:27 darrenr Exp $"; +static const char rcsid[] = "@(#)$IPFilter: ip_fil.c,v 2.4.2.21 2000/05/22 06:57:47 darrenr Exp $"; #endif #ifndef SOLARIS @@ -144,7 +144,7 @@ #endif #ifdef _KERNEL static int (*fr_savep) __P((ip_t *, int, void *, int, struct mbuf **)); -static int send_ip __P((struct mbuf *, ip_t *)); +static int send_ip __P((ip_t *, fr_info_t *, struct mbuf *)); # ifdef __sgi extern kmutex_t ipf_rw; extern KRWLOCK_T ipf_mutex; @@ -914,12 +914,11 @@ * send_reset - this could conceivably be a call to tcp_respond(), but that * requires a large amount of setting up and isn't any more efficient. */ -int send_reset(fin, oip) -fr_info_t *fin; +int send_reset(oip, fin) struct ip *oip; +fr_info_t *fin; { struct tcphdr *tcp, *tcp2; - struct tcpiphdr *tp; struct mbuf *m; int tlen = 0; ip_t *ip; @@ -942,13 +941,12 @@ m->m_len = sizeof(*tcp2) + sizeof(*ip); # if BSD >= 199306 m->m_data += max_linkhdr; - m->m_pkthdr.len = m->m_len; + m->m_pkthdr.len = sizeof(*tcp2) + sizeof(*ip); m->m_pkthdr.rcvif = (struct ifnet *)0; # endif - bzero(mtod(m, char *), sizeof(struct tcpiphdr)); ip = mtod(m, struct ip *); - tp = mtod(m, struct tcpiphdr *); - tcp2 = (struct tcphdr *)((char *)ip + sizeof(*ip)); + bzero((char *)ip, sizeof(*tcp2) + sizeof(*ip)); + tcp2 = (struct tcphdr *)(ip + 1); ip->ip_src.s_addr = oip->ip_dst.s_addr; ip->ip_dst.s_addr = oip->ip_src.s_addr; @@ -959,27 +957,25 @@ tcp2->th_ack = htonl(tcp2->th_ack); tcp2->th_off = sizeof(*tcp2) >> 2; tcp2->th_flags = TH_RST|TH_ACK; - tp->ti_pr = oip->ip_p; - tp->ti_len = htons(sizeof(struct tcphdr)); + ip->ip_p = IPPROTO_TCP; + ip->ip_len = htons(sizeof(struct tcphdr)); tcp2->th_sum = in_cksum(m, sizeof(*ip) + sizeof(*tcp2)); + ip->ip_id = oip->ip_id; ip->ip_tos = oip->ip_tos; - ip->ip_p = oip->ip_p; ip->ip_len = sizeof(*ip) + sizeof(*tcp2); - return send_ip(m, ip); + return send_ip(ip, fin, m); } -static int send_ip(m, ip) +static int send_ip(ip, fin, m) +fr_info_t *fin; struct mbuf *m; ip_t *ip; { -# if (defined(__FreeBSD_version) && (__FreeBSD_version >= 220000)) || \ - (defined(_BSDI_VERSION) && (_BSDI_VERSION >= 199802)) - struct route ro; -# endif - + ip->ip_v = IPVERSION; + ip->ip_hl = (sizeof(*ip) >> 2); # if (BSD < 199306) || defined(__sgi) ip->ip_ttl = tcp_ttl; # else @@ -988,44 +984,35 @@ # ifdef IPSEC m->m_pkthdr.rcvif = NULL; -# endif -# if defined(__FreeBSD_version) && (__FreeBSD_version >= 220000) - { - int err; - - bzero((char *)&ro, sizeof(ro)); - err = ip_output(m, (struct mbuf *)0, &ro, 0, 0); - if (ro.ro_rt) - RTFREE(ro.ro_rt); - return err; - } -# else - /* - * extra 0 in case of multicast - */ -# if _BSDI_VERSION >= 199802 - return ip_output(m, (struct mbuf *)0, &ro, 0, 0, NULL); -# else -# if defined(__OpenBSD__) - return ip_output(m, (struct mbuf *)0, 0, 0, 0, NULL); -# else - return ip_output(m, (struct mbuf *)0, 0, 0, 0); -# endif -# endif # endif + return ipfr_fastroute(m, fin, NULL); } -int send_icmp_err(oip, type, code, ifp, dst) +int send_icmp_err(oip, type, fin, dst) ip_t *oip; -int type, code; -void *ifp; +int type; +fr_info_t *fin; struct in_addr dst; { struct icmp *icmp; struct mbuf *m; ip_t *nip; + int code; + if ((oip->ip_p == IPPROTO_ICMP) && !(fin->fin_fi.fi_fl & FI_SHORT)) + switch (ntohs(fin->fin_data[0]) >> 8) + { + case ICMP_ECHO : + case ICMP_TSTAMP : + case ICMP_IREQ : + case ICMP_MASKREQ : + break; + default : + return 0; + } + + code = fin->fin_icode; # if (BSD < 199306) || defined(__sgi) m = m_get(M_DONTWAIT, MT_HEADER); # else @@ -1044,8 +1031,6 @@ nip = mtod(m, ip_t *); icmp = (struct icmp *)(nip + 1); - nip->ip_v = IPVERSION; - nip->ip_hl = (sizeof(*nip) >> 2); nip->ip_p = IPPROTO_ICMP; nip->ip_id = oip->ip_id; nip->ip_sum = 0; @@ -1053,7 +1038,7 @@ nip->ip_tos = oip->ip_tos; nip->ip_len = sizeof(*nip) + sizeof(*icmp) + 8; if (dst.s_addr == 0) { - if (fr_ifpaddr(ifp, &dst) == -1) + if (fr_ifpaddr(fin->fin_ifp, &dst) == -1) return -1; } nip->ip_src = dst; @@ -1077,7 +1062,7 @@ } # endif icmp->icmp_cksum = ipf_cksum((u_short *)icmp, sizeof(*icmp) + 8); - return send_ip(m, nip); + return send_ip(nip, fin, m); } @@ -1119,10 +1104,10 @@ register struct ip *ip, *mhip; register struct mbuf *m = m0; register struct route *ro; - int len, off, error = 0, hlen; + int len, off, error = 0, hlen, code; + struct ifnet *ifp, *sifp; struct sockaddr_in *dst; struct route iproute; - struct ifnet *ifp; frentry_t *fr; hlen = fin->fin_hlen; @@ -1136,7 +1121,13 @@ dst->sin_family = AF_INET; fr = fin->fin_fr; - ifp = fdp->fd_ifp; + if (fdp) + ifp = fdp->fd_ifp; + else { + ifp = fin->fin_ifp; + dst->sin_addr = ip->ip_dst; + } + /* * In case we're here due to "to " being used with "keep state", * check that we're going in the correct direction. @@ -1145,9 +1136,10 @@ if ((ifp != NULL) && (fdp == &fr->fr_tif)) return -1; dst->sin_addr = ip->ip_dst; - } else + } else if (fdp) dst->sin_addr = fdp->fd_ip.s_addr ? fdp->fd_ip : ip->ip_dst; -# ifdef __bsdi__ + +# if BSD >= 199306 dst->sin_len = sizeof(*dst); # endif # if (BSD >= 199306) && !defined(__NetBSD__) && !defined(__bsdi__) && \ @@ -1161,7 +1153,7 @@ rtalloc(ro); # endif if (!ifp) { - if (!(fin->fin_fr->fr_flags & FR_FASTROUTE)) { + if (!fr || !(fr->fr_flags & FR_FASTROUTE)) { error = -2; goto bad; } @@ -1191,8 +1183,10 @@ ATOMIC_INC(frstats[1].fr_acct); } fin->fin_fr = NULL; - (void) fr_checkstate(ip, fin); - (void) ip_natout(ip, fin); + if (!fr || !(fr->fr_flags & FR_RETMASK)) { + (void) fr_checkstate(ip, fin); + (void) ip_natout(ip, fin); + } } else ip->ip_sum = 0; /* @@ -1316,9 +1310,15 @@ RTFREE(ro->ro_rt); return 0; bad: - if (error == EMSGSIZE) - (void) send_icmp_err(ip, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, - ifp, ip->ip_dst); + if (error == EMSGSIZE) { + sifp = fin->fin_ifp; + fin->fin_ifp = ifp; + code = fin->fin_icode; + fin->fin_icode = ICMP_UNREACH_NEEDFRAG; + (void) send_icmp_err(ip, ICMP_UNREACH, fin, ip->ip_dst); + fin->fin_ifp = sifp; + fin->fin_icode = code; + } m_freem(m); goto done; } Index: sys/netinet/ip_nat.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_nat.c,v retrieving revision 1.31 retrieving revision 1.32 diff -u -r1.31 -r1.32 --- sys/netinet/ip_nat.c 2000/05/10 20:40:53 1.31 +++ sys/netinet/ip_nat.c 2000/05/24 21:59:11 1.32 @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_nat.c,v 1.31 2000/05/10 20:40:53 deraadt Exp $ */ +/* $OpenBSD: ip_nat.c,v 1.32 2000/05/24 21:59:11 kjell Exp $ */ /* * Copyright (C) 1995-1998 by Darren Reed. @@ -11,7 +11,7 @@ */ #if !defined(lint) static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; -static const char rcsid[] = "@(#)$IPFilter: ip_nat.c,v 2.2.2.15 2000/04/25 16:21:13 darrenr Exp $"; +static const char rcsid[] = "@(#)$IPFilter: ip_nat.c,v 2.2.2.18 2000/05/19 15:52:29 darrenr Exp $"; #endif #if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL) @@ -326,11 +326,17 @@ { #ifdef IPFILTER_LOG case SIOCIPFFB : + { + int tmp; + if (!(mode & FWRITE)) error = EPERM; - else - *(int *)data = ipflog_clear(IPL_LOGNAT); + else { + tmp = ipflog_clear(IPL_LOGNAT); + IWCOPY((char *)&tmp, (char *)data, sizeof(tmp)); + } break; + } #endif case SIOCADNAT : if (!(mode & FWRITE)) { @@ -800,7 +806,7 @@ port += MAPBLK_MINPORT; port = htons(port); } - } else if (!np->in_nip && + } else if (!np->in_outip && (np->in_outmsk == 0xffffffff)) { /* * 0/32 - use the interface's IP address. @@ -811,7 +817,7 @@ return NULL; } in.s_addr = ntohl(in.s_addr); - } else if (!np->in_nip && !np->in_outmsk) { + } else if (!np->in_outip && !np->in_outmsk) { /* * 0/0 - use the original source address/port. */ Index: sys/netinet/ip_state.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_state.c,v retrieving revision 1.21 retrieving revision 1.22 diff -u -r1.21 -r1.22 --- sys/netinet/ip_state.c 2000/05/01 06:16:47 1.21 +++ sys/netinet/ip_state.c 2000/05/24 21:59:11 1.22 @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_state.c,v 1.21 2000/05/01 06:16:47 kjell Exp $ */ +/* $OpenBSD: ip_state.c,v 1.22 2000/05/24 21:59:11 kjell Exp $ */ /* * Copyright (C) 1995-1998 by Darren Reed. @@ -9,7 +9,7 @@ */ #if !defined(lint) static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-1995 Darren Reed"; -static const char rcsid[] = "@(#)$IPFilter: ip_state.c,v 2.3.2.23 2000/04/25 16:21:16 darrenr Exp $"; +static const char rcsid[] = "@(#)$IPFilter: ip_state.c,v 2.3.2.25 2000/05/22 06:57:53 darrenr Exp $"; #endif #include @@ -232,8 +232,12 @@ case SIOCIPFFB : if (!(mode & FWRITE)) error = EPERM; - else - *(int *)data = ipflog_clear(IPL_LOGSTATE); + else { + int tmp; + + tmp = ipflog_clear(IPL_LOGSTATE); + IWCOPY((char *)&tmp, data, sizeof(tmp)); + } break; #endif case SIOCGIPST : @@ -314,6 +318,8 @@ { register tcphdr_t *tcp = (tcphdr_t *)fin->fin_dp; + if (tcp->th_flags & TH_RST) + return NULL; /* * The endian of the ports doesn't matter, but the ack and * sequence numbers do as we do mathematics on them later. Index: sbin/ipf/HISTORY =================================================================== RCS file: /cvs/src/sbin/ipf/HISTORY,v retrieving revision 1.7 retrieving revision 1.8 diff -u -r1.7 -r1.8 --- sbin/ipf/HISTORY 2000/05/01 06:16:48 1.7 +++ sbin/ipf/HISTORY 2000/05/24 21:59:11 1.8 @@ -1,4 +1,4 @@ -# $OpenBSD: HISTORY,v 1.7 2000/05/01 06:16:48 kjell Exp $ +# $OpenBSD: HISTORY,v 1.8 2000/05/24 21:59:11 kjell Exp $ # # NOTE: Quite a few patches and suggestions come from other sources, to whom # I'm greatly indebted, even if no names are mentioned. @@ -21,6 +21,27 @@ # and especially those who have found the time to port IP Filter to new # platforms. # +3.3.16 23/05/2000 - Released + +don't add TCP state if it is an RST packet and (attempt) to send out +RST/ICMP packets in a manner that bypasses IP Filter. + +add patch to work with 4.0_STABLE delayed checksums + +3.3.15 20/05/2000 - Released + +fix destination being 0/32 in NAT map rules + +fix ipmon -F + +3.3.14 10/05/2000 - Released + +Fix bug in dealing with "hlen == 1 and opt > 1" - Itojun + +ignore previous NAT mappings for 0/0 and 0/32 rules + +struct friostat got too big for SunOS4 + 3.3.13 26/04/2000 - Released Fix parsing of "range" with "portmap" 2.7/common/PaxHeaders.17043/002_ef.patch01004440001756001161000000000036071134113400014433xustar0030 atime=1783509427.808696221 2.7/common/002_ef.patch010044400017560011610000000017530711341134000136060ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 002_ef.patch And then rebuild your kernel. Index: sys/dev/isa/if_ef_isapnp.c =================================================================== RCS file: /cvs/src/sys/dev/isa/if_ef_isapnp.c,v retrieving revision 1.5 retrieving revision 1.6 diff -u -r1.5 -r1.6 --- sys/dev/isa/if_ef_isapnp.c 1999/12/02 20:55:06 1.5 +++ sys/dev/isa/if_ef_isapnp.c 2000/05/26 16:24:30 1.6 @@ -1,4 +1,4 @@ -/* $OpenBSD: if_ef_isapnp.c,v 1.5 1999/12/02 20:55:06 jason Exp $ */ +/* $OpenBSD: if_ef_isapnp.c,v 1.6 2000/05/26 16:24:30 jason Exp $ */ /* * Copyright (c) 1999 Jason L. Wright (jason@thought.net) @@ -353,7 +353,7 @@ struct ifreq *ifr = (struct ifreq *)data; int s, error = 0; - s = splnet(); + s = splimp(); if ((error = ether_ioctl(ifp, &sc->sc_arpcom, cmd, data)) > 0) { splx(s); @@ -374,6 +374,7 @@ efinit(sc); break; } + break; case SIOCSIFMEDIA: case SIOCGIFMEDIA: error = ifmedia_ioctl(ifp, ifr, &sc->sc_mii.mii_media, cmd); 2.7/common/PaxHeaders.17043/003_bridge.patch01004440001756001161000000000036071134113400015276xustar0030 atime=1783509427.808696221 2.7/common/003_bridge.patch010044400017560011610000000037230711341134000144500ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 003_bridge.patch And then rebuild your kernel. Index: sys/net/if_bridge.c =================================================================== RCS file: /cvs/src/sys/net/if_bridge.c,v retrieving revision 1.29 retrieving revision 1.30 diff -u -r1.29 -r1.30 --- sys/net/if_bridge.c 2000/04/10 13:34:54 1.29 +++ sys/net/if_bridge.c 2000/05/25 00:30:27 1.30 @@ -1,4 +1,4 @@ -/* $OpenBSD: if_bridge.c,v 1.29 2000/04/10 13:34:54 jason Exp $ */ +/* $OpenBSD: if_bridge.c,v 1.30 2000/05/25 00:30:27 jason Exp $ */ /* * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net) @@ -1093,24 +1093,21 @@ /* * Unicast, make sure it's not for us. */ - ifl = LIST_FIRST(&sc->sc_iflist); - while (ifl != NULL) { - if (ifl->ifp->if_type == IFT_ETHER) { - ac = (struct arpcom *)ifl->ifp; - if (bcmp(ac->ac_enaddr, eh->ether_dhost, - ETHER_ADDR_LEN) == 0) { + for (ifl = LIST_FIRST(&sc->sc_iflist);ifl; ifl = LIST_NEXT(ifl,next)) { + if (ifl->ifp->if_type != IFT_ETHER) + continue; + ac = (struct arpcom *)ifl->ifp; + if (bcmp(ac->ac_enaddr, eh->ether_dhost, ETHER_ADDR_LEN) == 0) { + if (ifl->bif_flags & IFBIF_LEARNING) bridge_rtupdate(sc, - (struct ether_addr *)&eh->ether_dhost[0], + (struct ether_addr *)&eh->ether_dhost, ifp, 0, IFBAF_DYNAMIC); - return (m); - } - if (bcmp(ac->ac_enaddr, eh->ether_shost, - ETHER_ADDR_LEN) == 0) { - m_freem(m); - return (NULL); - } + return (m); } - ifl = LIST_NEXT(ifl, next); + if (bcmp(ac->ac_enaddr, eh->ether_shost, ETHER_ADDR_LEN) == 0) { + m_freem(m); + return (NULL); + } } M_PREPEND(m, sizeof(struct ether_header), M_DONTWAIT); if (m == NULL) @@ -1166,9 +1163,8 @@ if (SIMPLEQ_FIRST(&p->bif_brlout) && bridge_filterrule(SIMPLEQ_FIRST(&p->bif_brlout), eh) == - BRL_ACTION_BLOCK) { + BRL_ACTION_BLOCK) continue; - } /* If last one, reuse the passed-in mbuf */ if (LIST_NEXT(p, next) == NULL) { 2.7/common/PaxHeaders.17043/004_route.patch01004440001756001161000000000036071144035400015205xustar0030 atime=1783509427.808696221 2.7/common/004_route.patch010044400017560011610000000024770711440354000143640ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 004_route.patch And then rebuild your kernel. Index: sys/net/route.c =================================================================== RCS file: /cvs/src/sys/net/route.c,v retrieving revision 1.18 retrieving revision 1.19 diff -u -r1.18 -r1.19 --- sys/net/route.c 2000/03/23 16:37:52 1.18 +++ sys/net/route.c 2000/05/21 22:19:07 1.19 @@ -1,4 +1,4 @@ -/* $OpenBSD: route.c,v 1.18 2000/03/23 16:37:52 art Exp $ */ +/* $OpenBSD: route.c,v 1.19 2000/05/21 22:19:07 provos Exp $ */ /* $NetBSD: route.c,v 1.14 1996/02/13 22:00:46 christos Exp $ */ /* @@ -343,7 +343,7 @@ goto done; /* * Create a new entry if we just got back a wildcard entry - * or the the lookup failed. This is necessary for hosts + * or the lookup failed. This is necessary for hosts * which use routing redirects generated by smart gateways * to dynamically build the routing tables. */ @@ -498,11 +498,11 @@ if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT)) panic ("rtrequest delete"); rt = (struct rtentry *)rn; - rt->rt_flags &= ~RTF_UP; if (rt->rt_gwroute) { rt = rt->rt_gwroute; RTFREE(rt); (rt = (struct rtentry *)rn)->rt_gwroute = NULL; } + rt->rt_flags &= ~RTF_UP; if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest) ifa->ifa_rtrequest(RTM_DELETE, rt, SA(NULL)); rttrash++; 2.7/common/PaxHeaders.17043/005_ipopts.patch01004440001756001161000000000036071144035400015366xustar0030 atime=1783509427.808696221 2.7/common/005_ipopts.patch010044400017560011610000000066670711440354000145520ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 005_ipopts.patch And then rebuild your kernel. Index: sys/netinet/ip_icmp.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_icmp.c,v retrieving revision 1.20 retrieving revision 1.21 diff -u -r1.20 -r1.21 --- sys/netinet/ip_icmp.c 1999/12/28 07:43:40 1.20 +++ sys/netinet/ip_icmp.c 2000/05/15 11:07:32 1.21 @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_icmp.c,v 1.20 1999/12/28 07:43:40 itojun Exp $ */ +/* $OpenBSD: ip_icmp.c,v 1.21 2000/05/15 11:07:32 itojun Exp $ */ /* $NetBSD: ip_icmp.c,v 1.19 1996/02/13 23:42:22 christos Exp $ */ /* @@ -594,8 +594,11 @@ if (opt == IPOPT_NOP) len = 1; else { + if (cnt < IPOPT_OLEN + sizeof(*cp)) + break; len = cp[IPOPT_OLEN]; - if (len <= 0 || len > cnt) + if (len < IPOPT_OLEN + sizeof(*cp) || + len > cnt) break; } /* Index: sys/netinet/ip_input.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_input.c,v retrieving revision 1.55 retrieving revision 1.56 diff -u -r1.55 -r1.56 --- sys/netinet/ip_input.c 2000/05/10 03:22:39 1.55 +++ sys/netinet/ip_input.c 2000/05/15 11:07:33 1.56 @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_input.c,v 1.55 2000/05/10 03:22:39 jason Exp $ */ +/* $OpenBSD: ip_input.c,v 1.56 2000/05/15 11:07:33 itojun Exp $ */ /* $NetBSD: ip_input.c,v 1.30 1996/03/16 23:53:58 christos Exp $ */ /* @@ -866,8 +866,12 @@ if (opt == IPOPT_NOP) optlen = 1; else { + if (cnt < IPOPT_OLEN + sizeof(*cp)) { + code = &cp[IPOPT_OLEN] - (u_char *)ip; + goto bad; + } optlen = cp[IPOPT_OLEN]; - if (optlen <= 0 || optlen > cnt) { + if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) { code = &cp[IPOPT_OLEN] - (u_char *)ip; goto bad; } @@ -955,6 +959,10 @@ break; case IPOPT_RR: + if (optlen < IPOPT_OFFSET + sizeof(*cp)) { + code = &cp[IPOPT_OLEN] - (u_char *)ip; + goto bad; + } if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { code = &cp[IPOPT_OFFSET] - (u_char *)ip; goto bad; Index: sys/netinet/ip_output.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_output.c,v retrieving revision 1.68 retrieving revision 1.69 diff -u -r1.68 -r1.69 --- sys/netinet/ip_output.c 2000/05/04 20:15:38 1.68 +++ sys/netinet/ip_output.c 2000/05/15 11:07:33 1.69 @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_output.c,v 1.68 2000/05/04 20:15:38 niklas Exp $ */ +/* $OpenBSD: ip_output.c,v 1.69 2000/05/15 11:07:33 itojun Exp $ */ /* $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $ */ /* @@ -896,8 +896,16 @@ *dp++ = IPOPT_NOP; optlen = 1; continue; - } else - optlen = cp[IPOPT_OLEN]; + } +#ifdef DIAGNOSTIC + if (cnt < IPOPT_OLEN + sizeof(*cp)) + panic("malformed IPv4 option passed to ip_optcopy"); +#endif + optlen = cp[IPOPT_OLEN]; +#ifdef DIAGNOSTIC + if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) + panic("malformed IPv4 option passed to ip_optcopy"); +#endif /* bogus lengths should have been caught by ip_dooptions */ if (optlen > cnt) optlen = cnt; @@ -1281,8 +1289,10 @@ if (opt == IPOPT_NOP) optlen = 1; else { + if (cnt < IPOPT_OLEN + sizeof(*cp)) + goto bad; optlen = cp[IPOPT_OLEN]; - if (optlen <= IPOPT_OLEN || optlen > cnt) + if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) goto bad; } switch (opt) { 2.7/common/PaxHeaders.17043/007_cd9660.patch01004440001756001161000000000036071176331400014771xustar0030 atime=1783509427.808696221 2.7/common/007_cd9660.patch010044400017560011610000000051450711763314000141430ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 007_cd9660.patch And then rebuild your kernel. Index: sys/isofs/cd9660/cd9660_extern.h =================================================================== RCS file: /cvs/src/sys/isofs/cd9660/cd9660_extern.h,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- sys/isofs/cd9660/cd9660_extern.h 2000/02/07 04:57:15 1.4 +++ sys/isofs/cd9660/cd9660_extern.h 2000/06/07 23:25:08 1.5 @@ -84,8 +84,8 @@ #define lblkno(imp, loc) ((loc) >> (imp)->im_bshift) #define blksize(imp, ip, lbn) ((imp)->logical_block_size) -int cd9660_mount __P((struct mount *, - const char *, caddr_t, struct nameidata *, struct proc *)); +int cd9660_mount __P((struct mount *, const char *, caddr_t, + struct nameidata *, struct proc *)); int cd9660_start __P((struct mount *, int, struct proc *)); int cd9660_unmount __P((struct mount *, int, struct proc *)); int cd9660_root __P((struct mount *, struct vnode **)); @@ -96,6 +96,8 @@ int cd9660_fhtovp __P((struct mount *, struct fid *, struct vnode **)); int cd9660_vptofh __P((struct vnode *, struct fid *)); int cd9660_init __P((struct vfsconf *)); +int cd9660_check_export __P((struct mount *, struct mbuf *, int *, + struct ucred **)); #define cd9660_sysctl ((int (*) __P((int *, u_int, void *, size_t *, void *, \ size_t, struct proc *)))eopnotsupp) Index: sys/isofs/cd9660/cd9660_vfsops.c =================================================================== RCS file: /cvs/src/sys/isofs/cd9660/cd9660_vfsops.c,v retrieving revision 1.19 retrieving revision 1.20 diff -u -r1.19 -r1.20 --- sys/isofs/cd9660/cd9660_vfsops.c 2000/02/07 04:57:15 1.19 +++ sys/isofs/cd9660/cd9660_vfsops.c 2000/06/07 23:25:08 1.20 @@ -77,7 +77,8 @@ cd9660_fhtovp, cd9660_vptofh, cd9660_init, - cd9660_sysctl + cd9660_sysctl, + cd9660_check_export }; /* @@ -962,5 +963,31 @@ printf("vptofh: ino %d, start %ld\n", ifhp->ifid_ino,ifhp->ifid_start); #endif + return (0); +} + +/* + * Verify a remote client has export rights and return these rights via + * exflagsp and credanonp. + */ +int +cd9660_check_export(mp, nam, exflagsp, credanonp) + register struct mount *mp; + struct mbuf *nam; + int *exflagsp; + struct ucred **credanonp; +{ + register struct netcred *np; + register struct iso_mnt *imp = VFSTOISOFS(mp); + + /* + * Get the export permission structure for this tuple. + */ + np = vfs_export_lookup(mp, &imp->im_export, nam); + if (np == NULL) + return (EACCES); + + *exflagsp = np->netc_exflags; + *credanonp = &np->netc_anon; return (0); } 2.7/common/PaxHeaders.17043/008_msdosfs.patch01004440001756001161000000000036071176331400015535xustar0030 atime=1783509427.808696221 2.7/common/008_msdosfs.patch010044400017560011610000000055060711763314000147100ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 008_msdosfs.patch And then rebuild your kernel. Index: sys/msdosfs/msdosfs_vnops.c =================================================================== RCS file: /cvs/src/sys/msdosfs/msdosfs_vnops.c,v retrieving revision 1.21 retrieving revision 1.22 diff -u -r1.21 -r1.22 --- sys/msdosfs/msdosfs_vnops.c 1999/02/26 03:28:13 1.21 +++ sys/msdosfs/msdosfs_vnops.c 2000/06/07 15:04:06 1.22 @@ -1,4 +1,4 @@ -/* $OpenBSD: msdosfs_vnops.c,v 1.21 1999/02/26 03:28:13 art Exp $ */ +/* $OpenBSD: msdosfs_vnops.c,v 1.22 2000/06/07 15:04:06 art Exp $ */ /* $NetBSD: msdosfs_vnops.c,v 1.63 1997/10/17 11:24:19 ws Exp $ */ /*- @@ -1060,7 +1060,7 @@ vrele(fdvp); if (doingdirectory && newparent) { if (error) /* write access check above */ - goto bad; + goto bad1; if (xp != NULL) vput(tvp); /* @@ -1086,19 +1086,19 @@ if (xp->de_Attributes & ATTR_DIRECTORY) { if (!dosdirempty(xp)) { error = ENOTEMPTY; - goto bad; + goto bad1; } if (!doingdirectory) { error = ENOTDIR; - goto bad; + goto bad1; } cache_purge(tdvp); } else if (doingdirectory) { error = EISDIR; - goto bad; + goto bad1; } if ((error = removede(dp, xp)) != 0) - goto bad; + goto bad1; vput(tvp); xp = NULL; } @@ -1109,7 +1109,7 @@ * file/directory. */ if ((error = uniqdosname(VTODE(tdvp), tcnp, toname)) != 0) - goto abortit; + goto bad1; /* * Since from wasn't locked at various places above, @@ -1150,7 +1150,6 @@ if (doingdirectory) panic("rename: lost dir entry"); vrele(ap->a_fvp); - VOP_UNLOCK(fvp, 0, p); if (newparent) VOP_UNLOCK(fdvp, 0, p); xp = NULL; @@ -1175,7 +1174,6 @@ bcopy(oldname, ip->de_Name, 11); if (newparent) VOP_UNLOCK(fdvp, 0, p); - VOP_UNLOCK(fvp, 0, p); goto bad; } ip->de_refcnt++; @@ -1184,7 +1182,6 @@ /* XXX should really panic here, fs is corrupt */ if (newparent) VOP_UNLOCK(fdvp, 0, p); - VOP_UNLOCK(fvp, 0, p); goto bad; } if (!doingdirectory) { @@ -1194,7 +1191,6 @@ /* XXX should really panic here, fs is corrupt */ if (newparent) VOP_UNLOCK(fdvp, 0, p); - VOP_UNLOCK(fvp, 0, p); goto bad; } if (ip->de_dirclust != MSDOSFSROOT) @@ -1221,26 +1217,25 @@ if (error) { /* XXX should really panic here, fs is corrupt */ brelse(bp); - VOP_UNLOCK(fvp, 0, p); goto bad; } dotdotp = (struct direntry *)bp->b_data + 1; putushort(dotdotp->deStartCluster, dp->de_StartCluster); if ((error = bwrite(bp)) != 0) { /* XXX should really panic here, fs is corrupt */ - VOP_UNLOCK(fvp, 0, p); goto bad; } } - VOP_UNLOCK(fvp, 0, p); bad: + VOP_UNLOCK(fvp, 0, p); + vrele(fdvp); +bad1: if (xp) vput(tvp); vput(tdvp); out: ip->de_flag &= ~DE_RENAME; - vrele(fdvp); vrele(fvp); return (error); 2.7/common/PaxHeaders.17043/009_isakmpd.patch01004440001756001161000000000036071201037400015500xustar0030 atime=1783509427.808696221 2.7/common/009_isakmpd.patch010044400017560011610000000033460712010374000146530ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 009_isakmpd.patch cd sbin/isakmpd make obj && make cleandir && make depend && make && make install Finally, kill and restart isakmpd. No configuration changes are necessary. Index: sbin/isakmpd/ike_quick_mode.c =================================================================== RCS file: /cvs/src/sbin/isakmpd/ike_quick_mode.c,v retrieving revision 1.34 diff -u -r1.34 ike_quick_mode.c --- sbin/isakmpd/ike_quick_mode.c 2000/04/07 22:05:19 1.34 +++ sbin/isakmpd/ike_quick_mode.c 2000/06/09 20:55:03 @@ -118,6 +118,7 @@ X509_NAME *subject; RSA *key; #endif + extern char *policy_callback(char *); /* If there is no policy setup, everything fails. */ if (keynote_sessid < 0) @@ -128,6 +129,9 @@ policy_sa = sa; policy_isakmp_sa = isakmp_sa; + /* Reset information */ + policy_callback(KEYNOTE_CALLBACK_INITIALIZE); + /* Set the return values; true/false for now at least. */ return_values[0] = "false"; /* Order of values in array is important. */ return_values[1] = "true"; @@ -243,6 +247,7 @@ /* Ask policy. */ result = LK (kn_do_query, (keynote_sessid, return_values, RETVALUES_NUM)); + policy_callback(KEYNOTE_CALLBACK_CLEANUP); /* Just to make sure */ /* Remove authorizer from the session. */ LK (kn_remove_authorizer, (keynote_sessid, principal)); Index: sbin/isakmpd/policy.c =================================================================== RCS file: /cvs/src/sbin/isakmpd/policy.c,v retrieving revision 1.12 diff -u -r1.12 policy.c --- sbin/isakmpd/policy.c 2000/05/02 14:35:27 1.12 +++ sbin/isakmpd/policy.c 2000/06/09 20:55:05 @@ -146,7 +146,7 @@ return dst; } -static char * +char * policy_callback (char *name) { struct proto *proto; 2.7/common/PaxHeaders.17043/012_dhclient.patch01004440001756001161000000000036071253177400015650xustar0030 atime=1783509427.808696221 2.7/common/012_dhclient.patch010044400017560011610000000447420712531774000150300ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 012_dhclient.patch cd usr.sbin/dhcp/ make obj && make cleandir && make depend && make && make install Finally, kill and restart dhclient. No configuration changes are necessary. ========================================================================== --- usr.sbin/dhcp/dhclient/dhclient.c.orig Sun Jun 25 03:53:25 2000 +++ usr.sbin/dhcp/dhclient/dhclient.c Sun Jun 25 03:53:50 2000 @@ -91,7 +91,6 @@ u_int16_t remote_port; int log_priority; int no_daemon; -int save_scripts; int onetry; static void usage PROTO ((void)); @@ -124,8 +123,6 @@ ntohs (local_port)); } else if (!strcmp (argv [i], "-d")) { no_daemon = 1; - } else if (!strcmp (argv [i], "-D")) { - save_scripts = 1; } else if (!strcmp (argv [i], "-1")) { onetry = 1; } else if (argv [i][0] == '-') { @@ -1771,47 +1768,76 @@ /* Variables holding name of script and file pointer for writing to script. Needless to say, this is not reentrant - only one script can be invoked at a time. */ -char scriptName [256]; -FILE *scriptFile; +char **scriptEnv = NULL; +int scriptEnvsize = 0; + +void script_set_env (name, value) + char *name; + char *value; +{ + int i, namelen; + + namelen = strlen(name); + + for (i = 0; scriptEnv[i]; i++) { + if (strncmp(scriptEnv[i], name, namelen) == 0 && + scriptEnv[i][namelen] == '=') + break; + } + if (scriptEnv[i]) { + /* Reuse the slot. */ + free(scriptEnv[i]); + } else { + /* New variable. Expand if necessary. */ + if (i >= scriptEnvsize - 1) { + scriptEnvsize += 50; + scriptEnv = realloc(scriptEnv, scriptEnvsize); + if (scriptEnv == NULL) + error("script_set_env: no memory for variable"); + } + /* Need to set the NULL pointer at end of array beyond + the new slot. */ + scriptEnv[i + 1] = NULL; + } + /* Allocate space and format the variable in the appropriate slot. */ + scriptEnv[i] = malloc(strlen(name) + 1 + strlen(value) + 1); + if (scriptEnv[i] == NULL) + error("script_set_env: no memory for variable assignment"); + + snprintf(scriptEnv[i], strlen(name) + 1 + strlen(value) + 1, + "%s=%s", name, value); +} + +void script_flush_env() +{ + int i; + + for (i = 0; scriptEnv[i]; i++) { + free(scriptEnv[i]); + scriptEnv[i] = NULL; + } +} void script_init (ip, reason, medium) struct interface_info *ip; char *reason; struct string_list *medium; { - int fd; -#ifndef HAVE_MKSTEMP + scriptEnvsize = 100; + scriptEnv = malloc(scriptEnvsize * sizeof(char *)); - do { -#endif - strcpy (scriptName, "/tmp/dcsXXXXXX"); -#ifdef HAVE_MKSTEMP - fd = mkstemp (scriptName); -#else - mktemp (scriptName); - fd = creat (scriptName, 0600); - } while (fd < 0); -#endif + if (scriptEnv == NULL) + error ("script_init: no memory for environment initialization"); + + scriptEnv[0] = NULL; -#ifdef HAVE_MKSTEMP - if (fd == -1) - error ("can't write script file: %m"); -#endif - - scriptFile = fdopen (fd, "w"); - if (!scriptFile) - error ("can't write script file: %m"); - fprintf (scriptFile, "#!/bin/sh\n\n"); if (ip) { - fprintf (scriptFile, "interface=\"%s\"\n", ip -> name); - fprintf (scriptFile, "export interface\n"); + script_set_env ("interface", ip -> name); } if (medium) { - fprintf (scriptFile, "medium=\"%s\"\n", medium -> string); - fprintf (scriptFile, "export medium\n"); + script_set_env ("medium", medium -> string); } - fprintf (scriptFile, "reason=\"%s\"\n", reason); - fprintf (scriptFile, "export reason\n"); + script_set_env ("reason", reason); } void script_write_params (ip, prefix, lease) @@ -1821,11 +1847,11 @@ { int i; u_int8_t dbuf [1500]; + char name[1024], value[1024]; int len; - fprintf (scriptFile, "%sip_address=\"%s\"\n", - prefix, piaddr (lease -> address)); - fprintf (scriptFile, "export %sip_address\n", prefix); + snprintf (name, sizeof(name), "%sip_address", prefix); + script_set_env (name, piaddr (lease -> address)); /* For the benefit of Linux (and operating systems which may have similar needs), compute the network address based on @@ -1843,42 +1869,37 @@ lease -> options [DHO_SUBNET_MASK].data, lease -> options [DHO_SUBNET_MASK].len); netmask.len = lease -> options [DHO_SUBNET_MASK].len; - + subnet = subnet_number (lease -> address, netmask); if (subnet.len) { - fprintf (scriptFile, "%snetwork_number=\"%s\";\n", - prefix, piaddr (subnet)); - fprintf (scriptFile, "export %snetwork_number\n", - prefix); - + snprintf (name, sizeof(name), "%snetwork_number", + prefix); + script_set_env (name, piaddr (subnet)); + if (!lease -> options [DHO_BROADCAST_ADDRESS].len) { broadcast = broadcast_addr (subnet, netmask); if (broadcast.len) { - fprintf (scriptFile, - "%s%s=\"%s\";\n", prefix, - "broadcast_address", - piaddr (broadcast)); - fprintf (scriptFile, - "export %s%s\n", prefix, - "broadcast_address"); + snprintf (name, sizeof(name), + "%sbroadcast_address", + prefix); + script_set_env (name, + piaddr (broadcast)); } } } } - + if (lease -> filename) { - fprintf (scriptFile, "%sfilename=\"%s\";\n", - prefix, lease -> filename); - fprintf (scriptFile, "export %sfilename\n", prefix); + snprintf (name, sizeof(name), "%sfilename", prefix); + script_set_env (name, lease -> filename); } if (lease -> server_name) { - fprintf (scriptFile, "%sserver_name=\"%s\";\n", - prefix, lease -> server_name); - fprintf (scriptFile, "export %sserver_name\n", prefix); + snprintf (name, sizeof(name), "%sserver_name", prefix); + script_set_env (name, lease -> server_name); } for (i = 0; i < 256; i++) { u_int8_t *dp; - + if (ip -> client -> config -> defaults [i].len) { if (lease -> options [i].len) { switch (ip -> client -> @@ -1948,35 +1969,54 @@ } if (len) { char *s = dhcp_option_ev_name (&dhcp_options [i]); - - fprintf (scriptFile, "%s%s=\"%s\"\n", prefix, s, - pretty_print_option (i, dp, len, 0, 0)); - fprintf (scriptFile, "export %s%s\n", prefix, s); + + snprintf (name, sizeof(name), "%s%s", prefix, s); + script_set_env (name, pretty_print_option (i, dp, len, 0, 0)); } } - fprintf (scriptFile, "%sexpiry=\"%d\"\n", - prefix, (int)lease -> expiry); /* XXX */ - fprintf (scriptFile, "export %sexpiry\n", prefix); + snprintf (name, sizeof(name), "%sexpiry", prefix); + snprintf (value, sizeof(value), "%d", (int)lease -> expiry); /* XXX */ + script_set_env (name, value); } int script_go (ip) struct interface_info *ip; { - int rval; + char *p, *script_name, *script_argv[2]; + pid_t pid, wait_pid; + int status; if (ip) - fprintf (scriptFile, "%s\n", - ip -> client -> config -> script_name); + script_name = ip -> client -> config -> script_name; else - fprintf (scriptFile, "%s\n", - top_level_config.script_name); - fprintf (scriptFile, "exit $?\n"); - fclose (scriptFile); - chmod (scriptName, 0700); - rval = system (scriptName); - if (!save_scripts) - unlink (scriptName); - return rval; + script_name = top_level_config.script_name; + + if ((p = strrchr(script_name, '/')) != NULL) + p++; + else + p = script_name; + + script_argv[0] = p; + script_argv[1] = NULL; + + if ((pid = fork()) < 0) + error("Can't fork script: %m"); + + if (pid == 0) { + execve(script_name, script_argv, scriptEnv); + error("script_go: exec: %m"); + } + script_flush_env(); + + wait_pid = wait((int *) &status); + + if (wait_pid != -1) { + if (wait_pid != pid) + error ("got wrong pid"); + if (WIFEXITED(status) || WIFSIGNALED(status)) + return (WEXITSTATUS(status)); + } + return (-1); } char *dhcp_option_ev_name (option) --- usr.sbin/dhcp/dhclient/scripts/dhclient-script.orig Sun Jun 25 03:52:55 2000 +++ usr.sbin/dhcp/dhclient/scripts/dhclient-script Sun Jun 25 03:55:56 2000 @@ -3,98 +3,107 @@ # $OpenBSD: dhclient-script,v 1.5 2000/04/20 08:14:21 angelos Exp $ # -if [ x$new_network_number != x ]; then - echo New Network Number: $new_network_number +if [ "x$new_network_number" != "x" ]; then + echo "New Network Number: $new_network_number" fi -if [ x$new_broadcast_address != x ]; then - echo New Broadcast Address: $new_broadcast_address +if [ "x$new_broadcast_address" != "x" ]; then + echo "New Broadcast Address: $new_broadcast_address" new_broadcast_arg="broadcast $new_broadcast_address" fi -if [ x$old_broadcast_address != x ]; then +if [ "x$old_broadcast_address" != "x" ]; then old_broadcast_arg="broadcast $old_broadcast_address" fi -if [ x$new_subnet_mask != x ]; then +if [ "x$new_subnet_mask" != "x" ]; then new_netmask_arg="netmask $new_subnet_mask" fi -if [ x$old_subnet_mask != x ]; then +if [ "x$old_subnet_mask" != "x" ]; then old_netmask_arg="netmask $old_subnet_mask" fi -if [ x$alias_subnet_mask != x ]; then +if [ "x$alias_subnet_mask" != "x" ]; then alias_subnet_arg="netmask $alias_subnet_mask" fi -if [ x$reason = xMEDIUM ]; then - ifconfig $interface $medium - ifconfig $interface inet -alias 0.0.0.0 $medium >/dev/null 2>&1 +if [ "x$reason" = "xMEDIUM" ]; then + ifconfig "$interface" "$medium" + ifconfig "$interface" inet -alias 0.0.0.0 "$medium" >/dev/null 2>&1 sleep 1 exit 0 fi -if [ x$reason = xPREINIT ]; then - if [ x$alias_ip_address != x ]; then - ifconfig $interface inet -alias $alias_ip_address > /dev/null 2>&1 - route delete $alias_ip_address 127.0.0.1 > /dev/null 2>&1 +if [ "x$reason" = "xPREINIT" ]; then + if [ "x$alias_ip_address" != "x" ]; then + ifconfig "$interface" inet -alias "$alias_ip_address" > /dev/null 2>&1 + route delete "$alias_ip_address" 127.0.0.1 > /dev/null 2>&1 fi - ifconfig $interface inet 0.0.0.0 netmask 0.0.0.0 \ + ifconfig "$interface" inet 0.0.0.0 netmask 0.0.0.0 \ broadcast 255.255.255.255 up exit 0 fi -if [ x$reason = xARPCHECK ] || [ x$reason = xARPSEND ]; then +if [ "x$reason" = "xARPCHECK" ] || [ "x$reason" = "xARPSEND" ]; then exit 0; fi -if [ x$reason = xBOUND ] || [ x$reason = xRENEW ] || \ - [ x$reason = xREBIND ] || [ x$reason = xREBOOT ]; then - if [ x$old_ip_address != x ] && [ x$alias_ip_address != x ] && \ - [ x$alias_ip_address != x$old_ip_address ]; then - ifconfig $interface inet -alias $alias_ip_address > /dev/null 2>&1 - route delete $alias_ip_address 127.0.0.1 > /dev/null 2>&1 - fi - if [ x$old_ip_address != x ] && [ x$old_ip_address != x$new_ip_address ]; then - ifconfig $interface inet -alias $old_ip_address $medium - route delete $old_ip_address 127.1 >/dev/null 2>&1 - for router in $old_routers; do - route delete default $router >/dev/null 2>&1 +if [ "x$reason" = "xBOUND" ] || [ "x$reason" = "xRENEW" ] || \ + [ "x$reason" = "xREBIND" ] || [ "x$reason" = "xREBOOT" ]; then + if [ "x$old_ip_address" != "x" ] && [ "x$alias_ip_address" != "x" ] && \ + [ "x$alias_ip_address" != "x$old_ip_address" ]; then + ifconfig "$interface" inet -alias "$alias_ip_address" > /dev/null 2>&1 + route delete "$alias_ip_address" 127.0.0.1 > /dev/null 2>&1 + fi + if [ "x$old_ip_address" != "x" ] && [ "x$old_ip_address" != "x$new_ip_address" ]; then + if [ "x$medium" != "x" ]; then + ifconfig "$interface" inet -alias "$old_ip_address" "$medium" + else + ifconfig "$interface" inet -alias "$old_ip_address" + fi + route delete "$old_ip_address" 127.1 >/dev/null 2>&1 + for router in "$old_routers"; do + route delete default "$router" >/dev/null 2>&1 done if [ "$old_static_routes" != "" ]; then set $old_static_routes while [ $# -gt 1 ]; do - route delete $1 $2 + route delete "$1" "$2" shift; shift done fi arp -n -a | sed -n -e 's/^.*(\(.*\)) at .*$/arp -n -d \1/p' |sh fi - if [ x$old_ip_address = x ] || [ x$old_ip_address != x$new_ip_address ] || \ - [ x$reason = xBOUND ] || [ x$reason = xREBOOT ]; then - ifconfig $interface inet $new_ip_address $new_netmask_arg \ - $new_broadcast_arg $medium - route add $new_ip_address 127.1 >/dev/null 2>&1 - for router in $new_routers; do - route add default $router >/dev/null 2>&1 + if [ "x$old_ip_address" = "x" ] || [ "x$old_ip_address" != "x$new_ip_address" ] || \ + [ "x$reason" = "xBOUND" ] || [ "x$reason" = "xREBOOT" ]; then + if [ "x$medium" != "x" ]; then + ifconfig "$interface" inet "$new_ip_address" $new_netmask_arg \ + $new_broadcast_arg "$medium" + else + ifconfig "$interface" inet "$new_ip_address" $new_netmask_arg \ + $new_broadcast_arg + fi + route add "$new_ip_address" 127.1 >/dev/null 2>&1 + for router in "$new_routers"; do + route add default "$router" >/dev/null 2>&1 done if [ "$new_static_routes" != "" ]; then - set $new_static_routes + set "$new_static_routes" while [ $# -gt 1 ]; do - route add $1 $2 + route add "$1" "$2" shift; shift done fi fi - if [ x$new_ip_address != x$alias_ip_address ] && [ x$alias_ip_address != x ]; + if [ "x$new_ip_address" != "x$alias_ip_address" ] && [ "x$alias_ip_address" != "x" ]; then - ifconfig $interface inet alias $alias_ip_address $alias_subnet_arg - route add $alias_ip_address 127.0.0.1 + ifconfig "$interface" inet alias "$alias_ip_address" $alias_subnet_arg + route add "$alias_ip_address" 127.0.0.1 fi - if [ x$new_domain_name != x ]; + if [ "x$new_domain_name" != "x" ]; then if [ -n "$new_domain_name_servers" ]; then - echo search $new_domain_name >/etc/resolv.conf - for nameserver in $new_domain_name_servers; do - echo nameserver $nameserver >>/etc/resolv.conf + echo "search $new_domain_name" >/etc/resolv.conf + for nameserver in "$new_domain_name_servers"; do + echo "nameserver $nameserver" >>/etc/resolv.conf done if [ -f /etc/resolv.conf.tail ]; then cat /etc/resolv.conf.tail >>/etc/resolv.conf @@ -104,66 +113,75 @@ fi fi -if [ x$reason = xEXPIRE ] || [ x$reason = xFAIL ]; then - if [ x$alias_ip_address != x ]; then - ifconfig $interface inet -alias $alias_ip_address > /dev/null 2>&1 - route delete $alias_ip_address 127.0.0.1 > /dev/null 2>&1 - fi - if [ x$old_ip_address != x ]; then - ifconfig $interface inet -alias $old_ip_address $medium - route delete $old_ip_address 127.1 >/dev/null 2>&1 - for router in $old_routers; do - route delete default $router >/dev/null 2>&1 +if [ "x$reason" = "xEXPIRE" ] || [ "x$reason" = "xFAIL" ]; then + if [ "x$alias_ip_address" != "x" ]; then + ifconfig "$interface" inet -alias "$alias_ip_address" > /dev/null 2>&1 + route delete "$alias_ip_address" 127.0.0.1 > /dev/null 2>&1 + fi + if [ "x$old_ip_address" != "x" ]; then + if [ "x$medium" != "x" ]; then + ifconfig "$interface" inet -alias "$old_ip_address" "$medium" + else + ifconfig "$interface" inet -alias "$old_ip_address" + fi + route delete "$old_ip_address" 127.1 >/dev/null 2>&1 + for router in "$old_routers"; do + route delete default "$router" >/dev/null 2>&1 done if [ "$old_static_routes" != "" ]; then - set $old_static_routes + set "$old_static_routes" while [ $# -gt 1 ]; do - route delete $1 $2 + route delete "$1" "$2" shift; shift done fi arp -n -a | sed -n -e 's/^.*(\(.*\)) at .*$/arp -n -d \1/p' \ |sh >/dev/null 2>&1 fi - if [ x$alias_ip_address != x ]; then - ifconfig $interface inet alias $alias_ip_address $alias_subnet_arg - route add $alias_ip_address 127.0.0.1 + if [ "x$alias_ip_address" != "x" ]; then + ifconfig "$interface" inet alias "$alias_ip_address" $alias_subnet_arg + route add "$alias_ip_address" 127.0.0.1 fi exit 0 fi -if [ x$reason = xTIMEOUT ]; then - if [ x$alias_ip_address != x ]; then - ifconfig $interface inet -alias $alias_ip_address > /dev/null 2>&1 - route delete $alias_ip_address 127.0.0.1 > /dev/null 2>&1 +if [ "x$reason" = "xTIMEOUT" ]; then + if [ "x$alias_ip_address" != "x" ]; then + ifconfig "$interface" inet -alias "$alias_ip_address" > /dev/null 2>&1 + route delete "$alias_ip_address" 127.0.0.1 > /dev/null 2>&1 + fi + if [ "x$medium" != "x" ]; then + ifconfig "$interface" inet "$new_ip_address" $new_netmask_arg \ + $new_broadcast_arg "$medium" + else + ifconfig "$interface" inet "$new_ip_address" $new_netmask_arg \ + $new_broadcast_arg fi - ifconfig $interface inet $new_ip_address $new_netmask_arg \ - $new_broadcast_arg $medium sleep 1 if [ "$new_routers" != "" ]; then - set $new_routers - if ping -q -c 1 -w 1 $1; then - if [ x$new_ip_address != x$alias_ip_address ] && \ - [ x$alias_ip_address != x ]; then - ifconfig $interface inet alias $alias_ip_address $alias_subnet_arg - route add $alias_ip_address 127.0.0.1 + set "$new_routers" + if ping -q -c 1 -w 1 "$1"; then + if [ "x$new_ip_address" != "x$alias_ip_address" ] && \ + [ "x$alias_ip_address" != "x" ]; then + ifconfig "$interface" inet alias "$alias_ip_address" $alias_subnet_arg + route add "$alias_ip_address" 127.0.0.1 fi - route add $new_ip_address 127.1 >/dev/null 2>&1 - for router in $new_routers; do - route add default $router >/dev/null 2>&1 + route add "$new_ip_address" 127.1 >/dev/null 2>&1 + for router in "$new_routers"; do + route add default "$router" >/dev/null 2>&1 done if [ "$new_static_routes" != "" ]; then - set $new_static_routes + set "$new_static_routes" while [ $# -gt 1 ]; do - route add $1 $2 + route add "$1" "$2" shift; shift done fi if [ "$new_domain_name" != "" ]; then if [ -n "$new_domain_name_servers" ]; then - echo search $new_domain_name >/etc/resolv.conf.std - for nameserver in $new_domain_name_servers; do - echo nameserver $nameserver >>/etc/resolv.conf.std + echo "search $new_domain_name" >/etc/resolv.conf.std + for nameserver in "$new_domain_name_servers"; do + echo "nameserver $nameserver" >>/etc/resolv.conf.std done if [ -f /etc/resolv.conf.tail ]; then cat /etc/resolv.conf.tail >>/etc/resolv.conf.std @@ -177,14 +195,18 @@ fi fi fi - ifconfig $interface inet -alias $new_ip_address $medium - for router in $old_routers; do - route delete default $router >/dev/null 2>&1 + if [ "x$medium" != "x" ]; then + ifconfig "$interface" inet -alias "$new_ip_address" "$medium" + else + ifconfig "$interface" inet -alias "$new_ip_address" + fi + for router in "$old_routers"; do + route delete default "$router" >/dev/null 2>&1 done if [ "$old_static_routes" != "" ]; then - set $old_static_routes + set "$old_static_routes" while [ $# -gt 1 ]; do - route delete $1 $2 + route delete "$1" "$2" shift; shift done fi 2.7/common/PaxHeaders.17043/013_libedit.patch01004440001756001161000000000036071305473400015470xustar0030 atime=1783509427.808696221 2.7/common/013_libedit.patch010044400017560011610000000027740713054734000146470ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 013_libedit.patch cd lib/libedit make obj && make depend && make && make install Index: lib/libedit/el.c =================================================================== RCS file: /cvs/src/lib/libedit/el.c,v retrieving revision 1.6 diff -u -r1.6 el.c --- lib/libedit/el.c 1997/06/29 23:40:48 1.6 +++ lib/libedit/el.c 2000/06/28 18:01:26 @@ -1,4 +1,4 @@ -/* $OpenBSD: el.c,v 1.6 1997/06/29 23:40:48 millert Exp $ */ +/* $OpenBSD: el.c,v 1.7 2000/06/28 17:45:25 dugsong Exp $ */ /* $NetBSD: el.c,v 1.6 1997/04/24 18:54:16 christos Exp $ */ /*- @@ -41,7 +41,7 @@ #if 0 static char sccsid[] = "@(#)el.c 8.2 (Berkeley) 1/3/94"; #else -static char rcsid[] = "$OpenBSD: el.c,v 1.6 1997/06/29 23:40:48 millert Exp $"; +static char rcsid[] = "$OpenBSD: el.c,v 1.7 2000/06/28 17:45:25 dugsong Exp $"; #endif #endif /* not lint && not SCCSID */ @@ -296,14 +296,11 @@ char *ptr, path[MAXPATHLEN]; if (fname == NULL) { - fname = &elpath[1]; - if ((fp = fopen(fname, "r")) == NULL) { - if (issetugid() != 0 || (ptr = getenv("HOME")) == NULL) - return -1; - fname = strncpy(path, ptr, sizeof(path) - 1); - path[sizeof(path) - 1] = '\0'; - (void)strncat(path, elpath, sizeof(path) - strlen(path)); - } + ptr = getenv("HOME"); + if (issetugid() != 0 || ptr == NULL || *ptr == '\0') + return -1; + (void) snprintf(path, sizeof(path), "%s%s", ptr, elpath); + fname = path; } if ((fp = fopen(fname, "r")) == NULL) 2.7/common/PaxHeaders.17043/018_mopd.patch01004440001756001161000000000036071305473400015020xustar0030 atime=1783509427.808696221 2.7/common/018_mopd.patch010044400017560011610000000044540713054734000141740ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 018_mopd.patch cd usr.sbin/mopd make obj && make depend && make && make install Index: usr.sbin/mopd/mopd/process.c =================================================================== RCS file: /cvs/src/usr.sbin/mopd/mopd/process.c,v retrieving revision 1.3 diff -u -r1.3 process.c --- usr.sbin/mopd/mopd/process.c 2000/02/20 17:45:34 1.3 +++ usr.sbin/mopd/mopd/process.c 2000/07/05 22:37:29 @@ -1,4 +1,4 @@ -/* $OpenBSD: process.c,v 1.3 2000/02/20 17:45:34 bitblt Exp $ */ +/* $OpenBSD: process.c,v 1.8 2000/07/04 23:46:23 maja Exp $ */ /* * Copyright (c) 1993-95 Mats O Jansson. All rights reserved. @@ -30,7 +30,7 @@ */ #ifndef LINT -static char rcsid[] = "$OpenBSD: process.c,v 1.3 2000/02/20 17:45:34 bitblt Exp $"; +static char rcsid[] = "$OpenBSD: process.c,v 1.8 2000/07/04 23:46:23 maja Exp $"; #endif #include "os.h" @@ -267,7 +267,7 @@ dllist[slot].a_lseek = 0; dllist[slot].count = 0; - if (dllist[slot].dl_bsz >= 1492) + if ((dllist[slot].dl_bsz >= 1492) || (dllist[slot].dl_bsz == 0)) dllist[slot].dl_bsz = 1492; if (dllist[slot].dl_bsz == 1030) /* VS/uVAX 2000 needs this */ dllist[slot].dl_bsz = 1000; @@ -353,7 +353,7 @@ snprintf(line,sizeof(line), "%x:%x:%x:%x:%x:%x Load completed", dst[0],dst[1],dst[2],dst[3],dst[4],dst[5]); - syslog(LOG_INFO, line); + syslog(LOG_INFO, "%s", line); return; } @@ -438,7 +438,7 @@ { u_char tmpc; u_short moplen; - u_char pfile[17], mopcode; + u_char pfile[129], mopcode; char filename[FILENAME_MAX]; char line[100]; int i,nfd,iindex; @@ -487,6 +487,8 @@ rpr_pgty = mopGetChar(pkt,index); /* Program Type */ tmpc = mopGetChar(pkt,index); /* Software ID Len */ + if (tmpc > sizeof(pfile) - 1) + return; for (i = 0; i < tmpc; i++) { pfile[i] = mopGetChar(pkt,index); pfile[i+1] = '\0'; @@ -529,7 +531,7 @@ src[0],src[1],src[2], src[3],src[4],src[5],trans,pfile); } - syslog(LOG_INFO, line); + syslog(LOG_INFO, "%s", line); } else { if ((mopCmpEAddr(dst,ii->eaddr) == 0)) { dl_rpr->ldfd = open(filename, O_RDONLY, 0); @@ -538,7 +540,7 @@ "%x:%x:%x:%x:%x:%x Send me %s", src[0],src[1],src[2], src[3],src[4],src[5],pfile); - syslog(LOG_INFO, line); + syslog(LOG_INFO, "%s", line); } } 2.7/common/PaxHeaders.17043/019_ftpd.patch01004440001756001161000000000036071305473400015017xustar0030 atime=1783509427.808696221 2.7/common/019_ftpd.patch010044400017560011610000000027040713054734000141670ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 019_ftpd.patch cd libexec/ftpd make obj && make depend && make && make install Index: libexec/ftpd/ftpd.c =================================================================== RCS file: /cvs/src/libexec/ftpd/ftpd.c,v retrieving revision 1.71 diff -u -r1.71 ftpd.c --- libexec/ftpd/ftpd.c 2000/04/29 14:02:59 1.71 +++ libexec/ftpd/ftpd.c 2000/07/05 22:06:23 @@ -135,7 +135,7 @@ #include #endif -static char version[] = "Version 6.4/OpenBSD"; +static char version[] = "Version 6.5/OpenBSD"; extern off_t restart_point; extern char cbuf[]; @@ -1011,7 +1011,7 @@ "%s: anonymous/%.*s", remotehost, (int)(sizeof(proctitle) - sizeof(remotehost) - sizeof(": anonymous/")), passwd); - setproctitle(proctitle); + setproctitle("%s", proctitle); #endif /* HASSETPROCTITLE */ if (logging) syslog(LOG_INFO, "ANONYMOUS FTP LOGIN FROM %s, %s", @@ -1021,7 +1021,7 @@ #ifdef HASSETPROCTITLE snprintf(proctitle, sizeof(proctitle), "%s: %s", remotehost, pw->pw_name); - setproctitle(proctitle); + setproctitle("%s", proctitle); #endif /* HASSETPROCTITLE */ if (logging) syslog(LOG_INFO, "FTP LOGIN FROM %s as %s", @@ -2009,7 +2009,7 @@ remotehost[sizeof(remotehost)-1] = '\0'; #ifdef HASSETPROCTITLE snprintf(proctitle, sizeof(proctitle), "%s: connected", remotehost); - setproctitle(proctitle); + setproctitle("%s", proctitle); #endif /* HASSETPROCTITLE */ if (logging) 2.7/common/PaxHeaders.17043/021_X11_libs.patch01004440001756001161000000000036071335261400015433xustar0030 atime=1783509427.808696221 2.7/common/021_X11_libs.patch010044400017560011610000000423670713352614000146140ustar00ssyncsyncSome problems were discovered in X11 libraries which can cause DoS in libICE and xdm. Also some potiential buffer overflow may occur in XKB options parsing (although they can't be exploited in OpenBSD's default setup where the X servers are not setuid). This patch fixes all these problems: Apply by doing: cd "the directory containing your X11 source dir" patch -p0 < 021_X11_libs.patch And then rebuild your X11 tree: cd X11 make all make install Index: X11/xc/lib/ICE/ICElibint.h diff -u X11/xc/lib/ICE/ICElibint.h:1.1 X11/xc/lib/ICE/ICElibint.h:1.2 --- X11/xc/lib/ICE/ICElibint.h:1.1 Fri Sep 5 02:58:32 1997 +++ X11/xc/lib/ICE/ICElibint.h Mon Jul 10 15:17:09 2000 @@ -288,20 +288,21 @@ } -#define SKIP_STRING(_pBuf, _swap) \ +#define SKIP_STRING(_pBuf, _swap, _end, _bail) \ { \ CARD16 _len; \ EXTRACT_CARD16 (_pBuf, _swap, _len); \ - _pBuf += _len; \ - if (PAD32 (2 + _len)) \ - _pBuf += PAD32 (2 + _len); \ -} + _pBuf += _len + PAD32(2+_len); \ + if (_pBuf > _end) { \ + _bail; \ + } \ +} -#define SKIP_LISTOF_STRING(_pBuf, _swap, _count) \ +#define SKIP_LISTOF_STRING(_pBuf, _swap, _count, _end, _bail) \ { \ int _i; \ for (_i = 0; _i < _count; _i++) \ - SKIP_STRING (_pBuf, _swap); \ + SKIP_STRING (_pBuf, _swap, _end, _bail); \ } Index: X11/xc/lib/ICE/process.c diff -u X11/xc/lib/ICE/process.c:1.1 X11/xc/lib/ICE/process.c:1.2 --- X11/xc/lib/ICE/process.c:1.1 Fri Sep 5 02:58:32 1997 +++ X11/xc/lib/ICE/process.c Mon Jul 10 15:17:10 2000 @@ -63,7 +63,11 @@ return (0); \ } - +#define BAIL_STRING(_iceConn, _opcode, _pStart) {\ + _IceErrorBadLength (_iceConn, 0, _opcode, IceFatalToConnection);\ + IceDisposeCompleteMessage (_iceConn, _pStart);\ + return (0);\ +} /* * IceProcessMessages: @@ -819,7 +823,7 @@ int myAuthCount, hisAuthCount; int found, i, j; char *myAuthName, **hisAuthNames; - char *pData, *pStart; + char *pData, *pStart, *pEnd; char *vendor = NULL; char *release = NULL; int myAuthIndex = 0; @@ -843,10 +847,18 @@ } pData = pStart; - - SKIP_STRING (pData, swap); /* vendor */ - SKIP_STRING (pData, swap); /* release */ - SKIP_LISTOF_STRING (pData, swap, (int) message->authCount);/* auth names */ + pEnd = pStart + (length << 3); + + SKIP_STRING (pData, swap, pEnd, + BAIL_STRING(iceConn, ICE_ConnectionSetup, + pStart)); /* vendor */ + SKIP_STRING (pData, swap, pEnd, + BAIL_STRING(iceConn, ICE_ConnectionSetup, + pStart)); /* release */ + SKIP_LISTOF_STRING (pData, swap, (int) message->authCount, pEnd, + BAIL_STRING(iceConn, ICE_ConnectionSetup, + pStart)); /* auth names */ + pData += (message->versionCount * 4); /* versions */ CHECK_COMPLETE_SIZE (iceConn, ICE_ConnectionSetup, @@ -1685,7 +1697,7 @@ { iceConnectionReplyMsg *message; - char *pData, *pStart; + char *pData, *pStart, *pEnd; Bool replyReady; CHECK_AT_LEAST_SIZE (iceConn, ICE_ConnectionReply, @@ -1701,9 +1713,14 @@ } pData = pStart; + pEnd = pStart + (length << 3); - SKIP_STRING (pData, swap); /* vendor */ - SKIP_STRING (pData, swap); /* release */ + SKIP_STRING (pData, swap, pEnd, + BAIL_STRING (iceConn, ICE_ConnectionReply, + pStart)); /* vendor */ + SKIP_STRING (pData, swap, pEnd, + BAIL_STRING (iceConn, ICE_ConnectionReply, + pStart)); /* release */ CHECK_COMPLETE_SIZE (iceConn, ICE_ConnectionReply, length, pData - pStart + SIZEOF (iceConnectionReplyMsg), @@ -1789,7 +1806,7 @@ int found, i, j; char *myAuthName, **hisAuthNames; char *protocolName; - char *pData, *pStart; + char *pData, *pStart, *pEnd; char *vendor = NULL; char *release = NULL; int accept_setup_now = 0; @@ -1824,11 +1841,20 @@ } pData = pStart; + pEnd = pStart + (length << 3); - SKIP_STRING (pData, swap); /* proto name */ - SKIP_STRING (pData, swap); /* vendor */ - SKIP_STRING (pData, swap); /* release */ - SKIP_LISTOF_STRING (pData, swap, (int) message->authCount);/* auth names */ + SKIP_STRING (pData, swap, pEnd, + BAIL_STRING(iceConn, ICE_ProtocolSetup, + pStart)); /* proto name */ + SKIP_STRING (pData, swap, pEnd, + BAIL_STRING(iceConn, ICE_ProtocolSetup, + pStart)); /* vendor */ + SKIP_STRING (pData, swap, pEnd, + BAIL_STRING(iceConn, ICE_ProtocolSetup, + pStart)); /* release */ + SKIP_LISTOF_STRING (pData, swap, (int) message->authCount, pEnd, + BAIL_STRING(iceConn, ICE_ProtocolSetup, + pStart)); /* auth names */ pData += (message->versionCount * 4); /* versions */ CHECK_COMPLETE_SIZE (iceConn, ICE_ProtocolSetup, @@ -2170,7 +2196,7 @@ { iceProtocolReplyMsg *message; - char *pData, *pStart; + char *pData, *pStart, *pEnd; Bool replyReady; CHECK_AT_LEAST_SIZE (iceConn, ICE_ProtocolReply, @@ -2186,9 +2212,14 @@ } pData = pStart; + pEnd = pStart + (length << 3); - SKIP_STRING (pData, swap); /* vendor */ - SKIP_STRING (pData, swap); /* release */ + SKIP_STRING (pData, swap, pEnd, + BAIL_STRING(iceConn, ICE_ProtocolReply, + pStart)); /* vendor */ + SKIP_STRING (pData, swap, pEnd, + BAIL_STRING(iceConn, ICE_ProtocolReply, + pStart)); /* release */ CHECK_COMPLETE_SIZE (iceConn, ICE_ProtocolReply, length, pData - pStart + SIZEOF (iceProtocolReplyMsg), Index: X11/xc/lib/X11/GetProp.c diff -u X11/xc/lib/X11/GetProp.c:1.1 X11/xc/lib/X11/GetProp.c:1.2 --- X11/xc/lib/X11/GetProp.c:1.1 Fri Sep 5 02:58:44 1997 +++ X11/xc/lib/X11/GetProp.c Mon Jul 10 15:20:35 2000 @@ -76,21 +76,24 @@ */ case 8: nbytes = netbytes = reply.nItems; - if (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1)) + if (nbytes + 1 > 0 && + (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1))) _XReadPad (dpy, (char *) *prop, netbytes); break; case 16: nbytes = reply.nItems * sizeof (short); netbytes = reply.nItems << 1; - if (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1)) + if (nbytes + 1 > 0 && + (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1))) _XRead16Pad (dpy, (short *) *prop, netbytes); break; case 32: nbytes = reply.nItems * sizeof (long); netbytes = reply.nItems << 2; - if (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1)) + if (nbytes + 1 > 0 && + (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1))) _XRead32 (dpy, (long *) *prop, netbytes); break; Index: X11/xc/lib/X11/OpenDis.c diff -u X11/xc/lib/X11/OpenDis.c:1.1 X11/xc/lib/X11/OpenDis.c:1.2 --- X11/xc/lib/X11/OpenDis.c:1.1 Fri Sep 5 02:58:48 1997 +++ X11/xc/lib/X11/OpenDis.c Mon Jul 10 15:20:35 2000 @@ -371,6 +371,14 @@ dpy->max_request_size = u.setup->maxRequestSize; mask = dpy->resource_mask; dpy->resource_shift = 0; + if (!mask) + { + fprintf (stderr, "Xlib: connection to \"%s\" invalid setup\n", + fullname); + OutOfMemory(dpy, setup); + return (NULL); + } + while (!(mask & 1)) { dpy->resource_shift++; mask = mask >> 1; @@ -390,6 +398,13 @@ (void) strncpy(dpy->vendor, u.vendor, vendorlen); dpy->vendor[vendorlen] = '\0'; vendorlen = (vendorlen + 3) & ~3; /* round up */ +/* + * validate setup length + */ + if ((int) setuplength - sz_xConnSetup - vendorlen < 0) { + OutOfMemory(dpy, setup); + return (NULL); + } memmove (setup, u.vendor + vendorlen, (int) setuplength - sz_xConnSetup - vendorlen); u.vendor = setup; @@ -568,6 +583,8 @@ if (_XReply (dpy, (xReply *) &reply, 0, xFalse)) { if (reply.format == 8 && reply.propertyType == XA_STRING && + (reply.nItems + 1 > 0) && + (reply.nItems <= req->longLength * 4) && (dpy->xdefaults = Xmalloc (reply.nItems + 1))) { _XReadPad (dpy, dpy->xdefaults, reply.nItems); dpy->xdefaults[reply.nItems] = '\0'; Index: X11/xc/lib/X11/XlibInt.c diff -u X11/xc/lib/X11/XlibInt.c:1.3 X11/xc/lib/X11/XlibInt.c:1.4 --- X11/xc/lib/X11/XlibInt.c:1.3 Tue Aug 24 12:11:19 1999 +++ X11/xc/lib/X11/XlibInt.c Mon Jul 10 15:20:35 2000 @@ -38,6 +38,8 @@ #define NEED_EVENTS #define NEED_REPLIES +#define GENERIC_LENGTH_LIMIT (1 << 29) + #include "Xlibint.h" #include #include @@ -1689,6 +1691,17 @@ != (char *)rep) continue; } + /* + * Don't accept ridiculously large values for + * generic.length; doing so could cause stack-scribbling + * problems elsewhere. + */ + if (rep->generic.length > GENERIC_LENGTH_LIMIT) { + rep->generic.length = GENERIC_LENGTH_LIMIT; + (void) fprintf(stderr, + "Xlib: suspiciously long reply length %d set to %d", + rep->generic.length, GENERIC_LENGTH_LIMIT); + } if (extra <= rep->generic.length) { if (extra > 0) /* @@ -1827,6 +1840,13 @@ #endif if (len > *lenp) _XEatData(dpy, len - *lenp); + } + if (len < SIZEOF(xReply)) + { + _XIOError (dpy); + buf += *lenp; + *lenp = 0; + return buf; } if (len >= *lenp) { buf += *lenp; Index: X11/xc/programs/Xserver/os/secauth.c diff -u X11/xc/programs/Xserver/os/secauth.c:1.1 X11/xc/programs/Xserver/os/secauth.c:1.3 --- X11/xc/programs/Xserver/os/secauth.c:1.1 Fri Sep 5 03:15:14 1997 +++ X11/xc/programs/Xserver/os/secauth.c Mon Jul 10 15:23:26 2000 @@ -47,7 +47,7 @@ ClientPtr client; char **reason; { - char *policy = *dataP; + CARD8 *policy = *(CARD8 **)dataP; int length; Bool permit; int nPolicies; @@ -61,13 +61,13 @@ } permit = (*policy++ == 0); - nPolicies = *policy++; + nPolicies = (CARD8) *policy++; length -= 2; sitePolicies = SecurityGetSitePolicyStrings(&nSitePolicies); - while (nPolicies) { + while (nPolicies > 0) { int strLen, sitePolicy; if (length == 0) { @@ -75,7 +75,7 @@ return FALSE; } - strLen = *policy++; + strLen = (CARD8) *policy++; if (--length < strLen) { *reason = InvalidPolicyReason; return FALSE; @@ -87,7 +87,7 @@ { char *testPolicy = sitePolicies[sitePolicy]; if ((strLen == strlen(testPolicy)) && - (strncmp(policy, testPolicy, strLen) == 0)) + (strncmp((char *)policy, testPolicy, strLen) == 0)) { found = TRUE; /* need to continue parsing the policy... */ break; @@ -107,7 +107,7 @@ } *data_lengthP = length; - *dataP = policy; + *dataP = (char *)policy; return TRUE; } Index: X11/xc/programs/Xserver/os/xdmcp.c diff -u X11/xc/programs/Xserver/os/xdmcp.c:1.1.1.2 X11/xc/programs/Xserver/os/xdmcp.c:1.2 --- X11/xc/programs/Xserver/os/xdmcp.c:1.1.1.2 Fri Jan 8 10:56:48 1999 +++ X11/xc/programs/Xserver/os/xdmcp.c Mon Jul 10 15:26:07 2000 @@ -1,5 +1,5 @@ /* $XConsortium: xdmcp.c /main/34 1996/12/02 10:23:29 lehors $ */ -/* $XFree86: xc/programs/Xserver/os/xdmcp.c,v 3.9.2.1 1998/12/18 11:56:34 dawes Exp $ */ +/* $XFree86: xc/programs/Xserver/os/xdmcp.c,v 3.9.2.2 2000/02/08 20:32:12 dawes Exp $ */ /* * Copyright 1989 Network Computing Devices, Inc., Mountain View, California. * @@ -290,7 +290,10 @@ return (i + 1); } if (strcmp(argv[i], "-port") == 0) { - ++i; + if (++i == argc) { + ErrorF("Xserver: missing port number in command line\n"); + exit(1); + } xdm_udp_port = atoi(argv[i]); return (i + 1); } @@ -300,18 +303,28 @@ } if (strcmp(argv[i], "-class") == 0) { ++i; + if (++i == argc) { + ErrorF("Xserver: missing class name in command line\n"); + exit(1); + } defaultDisplayClass = argv[i]; return (i + 1); } #ifdef HASXDMAUTH if (strcmp(argv[i], "-cookie") == 0) { - ++i; + if (++i == argc) { + ErrorF("Xserver: missing cookie data in command line\n"); + exit(1); + } xdmAuthCookie = argv[i]; return (i + 1); } #endif if (strcmp(argv[i], "-displayID") == 0) { - ++i; + if (++i == argc) { + ErrorF("Xserver: missing displayID in command line\n"); + exit(1); + } XdmcpRegisterManufacturerDisplayID (argv[i], strlen (argv[i])); return (i + 1); } Index: X11/xc/programs/Xserver/xkb/ddxLoad.c diff -u X11/xc/programs/Xserver/xkb/ddxLoad.c:1.1.1.3 X11/xc/programs/Xserver/xkb/ddxLoad.c:1.2 --- X11/xc/programs/Xserver/xkb/ddxLoad.c:1.1.1.3 Sat Nov 28 01:49:13 1998 +++ X11/xc/programs/Xserver/xkb/ddxLoad.c Mon Jul 10 15:28:10 2000 @@ -24,7 +24,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. ********************************************************/ -/* $XFree86: xc/programs/Xserver/xkb/ddxLoad.c,v 3.19.2.3 1998/09/27 12:59:29 hohndel Exp $ */ +/* $XFree86: xc/programs/Xserver/xkb/ddxLoad.c,v 3.19.2.4 2000/06/15 23:24:07 dawes Exp $ */ #include #include @@ -139,10 +139,8 @@ +strlen(file)+strlen(xkm_output_dir) +strlen(outFile)+53 > PATH_MAX) { -#ifdef DEBUG ErrorF("compiler command for keymap (%s) exceeds max length\n", names->keymap); -#endif return False; } #ifndef __EMX__ @@ -169,10 +167,8 @@ +strlen(file)+strlen(xkm_output_dir) +strlen(outFile)+49 > PATH_MAX) { -#ifdef DEBUG ErrorF("compiler command for keymap (%s) exceeds max length\n", names->keymap); -#endif return False; } sprintf(cmd,"xkbcomp -w %d -xkm %s%s -em1 %s -emp %s -eml %s keymap/%s %s%s.xkm", @@ -236,6 +232,10 @@ sprintf(keymap,"server-%s",display); } else { + if (strlen(names->keymap) > PATH_MAX - 1) { + ErrorF("name of keymap (%s) exceeds max length\n", names->keymap); + return False; + } strcpy(keymap,names->keymap); } @@ -254,10 +254,8 @@ +strlen(POST_ERROR_MSG1)+strlen(xkm_output_dir) +strlen(keymap)+48 > PATH_MAX) { -#ifdef DEBUG ErrorF("compiler command for keymap (%s) exceeds max length\n", names->keymap); -#endif return False; } #ifndef WIN32 @@ -294,10 +292,8 @@ +strlen(ERROR_PREFIX)+strlen(POST_ERROR_MSG1) +strlen(xkm_output_dir)+strlen(keymap)+44 > PATH_MAX) { -#ifdef DEBUG ErrorF("compiler command for keymap (%s) exceeds max length\n", names->keymap); -#endif return False; } #ifndef WIN32 Index: X11/xc/programs/Xserver/xkb/xkbInit.c diff -u X11/xc/programs/Xserver/xkb/xkbInit.c:1.1.1.2 X11/xc/programs/Xserver/xkb/xkbInit.c:1.3 --- X11/xc/programs/Xserver/xkb/xkbInit.c:1.1.1.2 Sat Mar 7 09:21:55 1998 +++ X11/xc/programs/Xserver/xkb/xkbInit.c Mon Jul 10 15:28:10 2000 @@ -24,7 +24,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. ********************************************************/ -/* $XFree86: xc/programs/Xserver/xkb/xkbInit.c,v 3.12.2.2 1998/02/24 13:20:07 dawes Exp $ */ +/* $XFree86: xc/programs/Xserver/xkb/xkbInit.c,v 3.12.2.3 2000/06/15 21:58:34 dawes Exp $ */ #include #include @@ -915,8 +915,13 @@ #endif else if (strncmp(argv[i], "-xkbmap", 7) == 0) { if(++i < argc) { - XkbInitialMap= argv[i]; - return 2; + if (strlen(argv[i]) < PATH_MAX) { + XkbInitialMap= argv[i]; + return 2; + } else { + ErrorF("-xkbmap pathname too long\n"); + return -1; + } } else { return -1; @@ -924,8 +929,13 @@ } else if (strncmp(argv[i], "-xkbdb", 7) == 0) { if(++i < argc) { - XkbDB= argv[i]; - return 2; + if (strlen(argv[i]) < PATH_MAX) { + XkbDB= argv[i]; + return 2; + } else { + ErrorF("-xkbdb pathname too long\n"); + return -1; + } } else { return -1; Index: X11/xc/programs/xauth/process.c diff -u X11/xc/programs/xauth/process.c:1.2 X11/xc/programs/xauth/process.c:1.3 --- X11/xc/programs/xauth/process.c:1.2 Tue Feb 15 00:15:35 2000 +++ X11/xc/programs/xauth/process.c Mon Jul 10 15:30:21 2000 @@ -769,7 +769,7 @@ static int write_auth_file (tmp_nam) char *tmp_nam; { - FILE *fp; + FILE *fp = NULL; int fd; AuthList *list; @@ -779,7 +779,6 @@ strcpy (tmp_nam, xauth_filename); strcat (tmp_nam, "-n"); /* for new */ (void) unlink (tmp_nam); - fp = fopen (tmp_nam, "wb"); /* umask is still set to 0077 */ /* CPhipps 2000/02/12 - fix file unlink/fopen race */ fd = open(tmp_nam, O_WRONLY|O_CREAT|O_EXCL, 0600); if (fd != -1) fp = fdopen(fd, "wb"); Index: X11/xc/programs/xfs/os/waitfor.c diff -u X11/xc/programs/xfs/os/waitfor.c:1.1 X11/xc/programs/xfs/os/waitfor.c:1.2 --- X11/xc/programs/xfs/os/waitfor.c:1.1 Fri Sep 5 03:16:07 1997 +++ X11/xc/programs/xfs/os/waitfor.c Mon Jul 10 15:32:38 2000 @@ -1,5 +1,5 @@ /* $XConsortium: waitfor.c /main/15 1996/08/30 14:22:34 kaleb $ */ -/* $XFree86: xc/programs/xfs/os/waitfor.c,v 3.5 1997/01/18 07:02:48 dawes Exp $ */ +/* $XFree86: xc/programs/xfs/os/waitfor.c,v 3.5.2.1 2000/06/15 21:58:35 dawes Exp $ */ /* * waits for input */ @@ -212,7 +212,7 @@ while (clientsReadable.fds_bits[i]) { curclient = ffs(clientsReadable.fds_bits[i]) - 1; conn = ConnectionTranslation[curclient + (i << 5)]; - FD_CLR (curclient, &clientsReadable); + clientsReadable.fds_bits[i] &= ~(((fd_mask)1L) << curclient); client = clients[conn]; if (!client) continue; 2.7/common/PaxHeaders.17043/023_xlock.patch01004440001756001161000000000036071464267400015204xustar0030 atime=1783509427.808696221 2.7/common/023_xlock.patch010044400017560011610000000030040714642674000143460ustar00ssyncsyncApply by doing: cd "the directory containing your X11 source dir" patch -p0 < 023_xlock.patch To recompile and install xlock: cd X11/xc/programs/xlockmore xmkmf make Makefiles make && make install Index: X11/xc/programs/xlockmore/xlock/xlock.c =================================================================== RCS file: /cvs/X11/xc/programs/xlockmore/xlock/xlock.c,v retrieving revision 1.5 diff -u -r1.5 xlock.c --- X11/xc/programs/xlockmore/xlock/xlock.c 2000/04/15 09:46:00 1.5 +++ X11/xc/programs/xlockmore/xlock/xlock.c 2000/08/16 13:46:14 @@ -296,13 +296,13 @@ /* Put on the PROGCLASS.background/foreground resources. */ s = (char *) malloc(50); - (void) strcpy(s, progclass); - (void) strcat(s, ".background: black"); + (void) strlcpy(s, progclass, 50); + (void) strlcat(s, ".background: black", 50); defaults[i++] = s; s = (char *) malloc(50); - (void) strcpy(s, progclass); - (void) strcat(s, ".foreground: white"); + (void) strlcpy(s, progclass, 50); + (void) strlcat(s, ".foreground: white", 50); defaults[i++] = s; /* Copy the lines out of the `app_defaults' var and into this array. */ @@ -944,7 +944,7 @@ #if defined( HAVE_SYSLOG_H ) && defined( USE_SYSLOG ) extern Display *dsp; - syslog(SYSLOG_WARNING, buf); + syslog(SYSLOG_WARNING, "%s", buf); if (!nolock) { if (strstr(buf, "unable to open display") == NULL) syslogStop(XDisplayString(dsp)); @@ -953,7 +953,7 @@ closelog(); } #else - (void) fprintf(stderr, buf); + (void) fprintf(stderr, "%s", buf); #endif exit(1); } 2.7/common/PaxHeaders.17043/024_ipsec.patch01004440001756001161000000000036071613275400015163xustar0030 atime=1783509427.808696221 2.7/common/024_ipsec.patch010044400017560011610000000024150716132754000143320ustar00ssyncsyncBad ESP/AH packets could cause a crash under certain conditions. Apply by doing: cd /usr/src patch -p0 < 024_ipsec.patch And then rebuild your kernel. Index: sys/netinet/ipsec_input.c =================================================================== RCS file: /cvs/src/sys/netinet/ipsec_input.c,v retrieving revision 1.23 diff -u -r1.23 ipsec_input.c --- sys/netinet/ipsec_input.c 2000/03/29 10:15:22 1.23 +++ sys/netinet/ipsec_input.c 2000/09/18 16:39:30 @@ -1,4 +1,4 @@ -/* $OpenBSD: ipsec_input.c,v 1.23 2000/03/29 10:15:22 angelos Exp $ */ +/* $OpenBSD: ipsec_input.c,v 1.31 2000/09/17 19:52:24 angelos Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), @@ -130,6 +130,13 @@ return EOPNOTSUPP; } + if (m->m_pkthdr.len - skip < 2 * sizeof(u_int32_t)) + { + m_freem(m); + IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops); + return EINVAL; + } + /* Retrieve the SPI from the relevant IPsec header */ if (sproto == IPPROTO_ESP) m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi); @@ -287,6 +294,7 @@ ip = mtod(m, struct ip *); ip->ip_len = htons(m->m_pkthdr.len); HTONS(ip->ip_id); + HTONS(ip->ip_off); ip->ip_sum = 0; ip->ip_sum = in_cksum(m, ip->ip_hl << 2); prot = ip->ip_p; 2.7/common/PaxHeaders.17043/025_pw_error.patch01004440001756001161000000000036071662727400015726xustar0030 atime=1783509427.808696221 2.7/common/025_pw_error.patch010044400017560011610000000013040716627274000150710ustar00ssyncsyncThe pw_error(3) function was vulnerable to a format string attack. Apply by doing: cd /usr/src patch -p0 < 025_pw_error.patch And then rebuild and install libutil. cd lib/libutil make depend make make install Index: lib/libutil/passwd.c =================================================================== RCS file: /cvs/src/lib/libutil/passwd.c,v retrieving revision 1.20 retrieving revision 1.21 diff -u -r1.20 -r1.21 --- lib/libutil/passwd.c 1998/11/16 07:10:32 1.20 +++ lib/libutil/passwd.c 2000/06/30 16:00:07 1.21 @@ -579,7 +579,7 @@ char *master = pw_file(_PATH_MASTERPASSWD); if (err) - warn(name); + warn("%s", name); if (master) warnx("%s: unchanged", master); pw_abort(); 2.7/common/PaxHeaders.17043/026_talkd.patch01004440001756001161000000000036071702573400015161xustar0030 atime=1783509427.808696221 2.7/common/026_talkd.patch010044400017560011610000000011020717025734000143200ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 026_talkd.patch cd libexec/talkd make obj && make depend && make && make install Index: libexec/talkd/announce.c =================================================================== RCS file: /cvs/src/libexec/talkd/announce.c,v retrieving revision 1.8 retrieving revision 1.9 diff -u -r1.8 -r1.9 --- libexec/talkd/announce.c 1998/08/18 03:42:10 1.8 +++ libexec/talkd/announce.c 2000/07/06 00:01:45 1.9 @@ -160,6 +160,6 @@ *(bptr++) = '\n'; } *bptr = '\0'; - fprintf(tf, big_buf); + fprintf(tf, "%s", big_buf); fflush(tf); } 2.7/common/PaxHeaders.17043/027_curses.patch01004440001756001161000000000036071702573400015367xustar0030 atime=1783509427.808696221 2.7/common/027_curses.patch010044400017560011610000000076510717025734000145450ustar00ssyncsyncThe following patch disables the use of a ~/.terminfo directory in setuid/setgid programs. Normally, curses will use a terminal description in the ~/.terminfo directory in preference to the system terminfo database. This change is consistent with curses' treatment of the TERMCAP, TERMINFO, TERMINFO_DIRS, and TERMPATH environment variables. The patch also prevents the contents of the TERMCAP environment variable from being used as a terminal description. Apply by doing: cd /usr/src patch -p0 < 027_curses.patch Then rebuild curses cd lib/libcurses make depend make make install Index: lib/libcurses/tinfo/read_termcap.c =================================================================== RCS file: /cvs/src/lib/libcurses/tinfo/read_termcap.c,v retrieving revision 1.8 diff -u -r1.8 read_termcap.c --- lib/libcurses/tinfo/read_termcap.c 2000/04/14 19:14:02 1.8 +++ lib/libcurses/tinfo/read_termcap.c 2000/10/09 14:38:16 @@ -784,7 +784,7 @@ pvec = pathvec; tbuf = bp; p = pathbuf; - cp = getenv("TERMCAP"); + cp = issetugid() ? NULL : getenv("TERMCAP"); /* * TERMCAP can have one of two things in it. It can be the name of a file @@ -798,21 +798,23 @@ #define MY_PATH_DEF "/etc/termcap /usr/share/misc/termcap" if (issetugid()) strlcpy(pathbuf, MY_PATH_DEF, PBUFSIZ); - else if (!is_pathname(cp)) { /* no TERMCAP or it holds an entry */ - if ((termpath = getenv("TERMPATH")) != 0) { - strlcpy(pathbuf, termpath, PBUFSIZ); - } else { - if ((home = getenv("HOME")) != 0 && - strlen(home) < PBUFSIZ) { /* setup path */ - p += strlen(home); /* path, looking in */ - strcpy(pathbuf, home); /* $HOME first */ - *p++ = '/'; - } /* if no $HOME look in current directory */ - strlcpy(p, ".termcap " MY_PATH_DEF, - (size_t) (PBUFSIZ - (p - pathbuf))); - } - } else /* user-defined name in TERMCAP */ - strlcpy(pathbuf, cp, PBUFSIZ); /* still can be tokenized */ + else { + if (!is_pathname(cp)) { /* no TERMCAP or it holds an entry */ + if ((termpath = getenv("TERMPATH")) != 0) { + strlcpy(pathbuf, termpath, PBUFSIZ); + } else { + if ((home = getenv("HOME")) != 0 && *home != '\0' && + strlen(home) < PBUFSIZ) { /* setup path */ + p += strlen(home); /* path, looking in */ + strcpy(pathbuf, home); /* $HOME first */ + *p++ = '/'; + } /* if no $HOME look in cwd */ + strlcpy(p, ".termcap " MY_PATH_DEF, + (size_t) (PBUFSIZ - (p - pathbuf))); + } + } else /* user-defined name in TERMCAP */ + strlcpy(pathbuf, cp, PBUFSIZ); /* still can be tokenized */ + } *fname++ = pathbuf; /* tokenize path into vector of names */ while (*++p) { @@ -974,7 +976,7 @@ char pathbuf[PATH_MAX]; termpaths[filecount] = 0; - if ((tc = getenv("TERMCAP")) != 0 && (!issetugid() || !is_pathname(tc))) { + if (!issetugid() && (tc = getenv("TERMCAP"))) { if (is_pathname(tc)) { /* interpret as a filename */ ADD_TC(tc, 0); } else if (_nc_name_match(tc, tn, "|:")) { /* treat as a capability file */ @@ -1007,7 +1009,7 @@ #define PRIVATE_CAP "%s/.termcap" - if (!issetugid() && (h = getenv("HOME")) != NULL + if (!issetugid() && (h = getenv("HOME")) != NULL && *h != '\0' && (strlen(h) + sizeof(PRIVATE_CAP)) < PATH_MAX) { /* user's .termcap, if any, should override it */ (void) strcpy(envhome, h); Index: lib/libcurses/tinfo/home_terminfo.c =================================================================== RCS file: /cvs/src/lib/libcurses/tinfo/home_terminfo.c,v retrieving revision 1.2 diff -u -r1.2 home_terminfo.c --- lib/libcurses/tinfo/home_terminfo.c 1999/03/02 06:23:28 1.2 +++ lib/libcurses/tinfo/home_terminfo.c 2000/10/09 14:39:11 @@ -51,8 +51,8 @@ char *home; static char *temp = 0; - if (temp == 0) { - if ((home = getenv("HOME")) != 0 + if (temp == 0 && !issetugid()) { + if ((home = getenv("HOME")) != 0 && *home != '\0' && my_length <= PATH_MAX) { temp = typeMalloc(char, my_length); if (temp == 0) 2.7/common/PaxHeaders.17043/028_format_strings.patch01004440001756001161000000000036071702573400017125xustar0030 atime=1783509427.808696221 2.7/common/028_format_strings.patch010044400017560011610000000125420717025734000162760ustar00ssyncsyncThe following patch fixes several printf-style format string bugs. Note that the 'eeprom' program is only available on the sparc platform. Apply by doing: cd /usr/src patch -p0 < 028_format_strings.patch The rebuild the affected programs: cd usr.bin/fstat make depend && make && make install cd ../passwd make depend && make && make install cd ../top make depend && make && make install cd ../su make depend && make && make install cd ../ssh make depend && make && make install # sparc only cd ../../usr.sbin/eeprom make depend && make && make install Index: usr.bin/fstat/fstat.c =================================================================== RCS file: /cvs/src/usr.bin/fstat/fstat.c,v retrieving revision 1.26 diff -u -r1.26 fstat.c --- usr.bin/fstat/fstat.c 2000/01/17 16:26:19 1.26 +++ usr.bin/fstat/fstat.c 2000/10/09 14:51:06 @@ -1018,7 +1018,7 @@ DEVS *cur; if (stat(filename, &statbuf)) { - warn(filename); + warn("%s", filename); return(0); } if ((cur = malloc(sizeof(DEVS))) == NULL) Index: usr.bin/passwd/yp_passwd.c =================================================================== RCS file: /cvs/src/usr.bin/passwd/yp_passwd.c,v retrieving revision 1.12 diff -u -r1.12 yp_passwd.c --- usr.bin/passwd/yp_passwd.c 1998/07/13 02:15:01 1.12 +++ usr.bin/passwd/yp_passwd.c 2000/10/09 14:51:06 @@ -72,7 +72,7 @@ int err, eval; { if(err) - warn(name); + warn("%s", name); warnx("YP passwd database unchanged."); exit(eval); Index: usr.bin/su/su.c =================================================================== RCS file: /cvs/src/usr.bin/su/su.c,v retrieving revision 1.31 diff -u -r1.31 su.c --- usr.bin/su/su.c 1998/03/25 21:27:27 1.31 +++ usr.bin/su/su.c 2000/10/09 14:51:06 @@ -300,7 +300,7 @@ (void)setpriority(PRIO_PROCESS, 0, prio); execv(shell, np); - err(1, shell); + err(1, "%s", shell); } int Index: usr.sbin/eeprom/eehandlers.c =================================================================== RCS file: /cvs/src/usr.sbin/eeprom/eehandlers.c,v retrieving revision 1.5 diff -u -r1.5 eehandlers.c --- usr.sbin/eeprom/eehandlers.c 1996/08/31 12:56:06 1.5 +++ usr.sbin/eeprom/eehandlers.c 2000/10/09 14:51:06 @@ -79,14 +79,14 @@ } #define FAILEDREAD(kt) { \ - warnx(err_str); \ + warnx("%s", err_str); \ warnx("failed to read field `%s'", (kt)->kt_keyword); \ ++eval; \ return; \ } #define FAILEDWRITE(kt) { \ - warnx(err_str); \ + warnx("%s", err_str); \ warnx("failed to update field `%s'", (kt)->kt_keyword); \ ++eval; \ return; \ Index: usr.sbin/eeprom/main.c =================================================================== RCS file: /cvs/src/usr.sbin/eeprom/main.c,v retrieving revision 1.5 diff -u -r1.5 main.c --- usr.sbin/eeprom/main.c 1998/07/08 22:13:26 1.5 +++ usr.sbin/eeprom/main.c 2000/10/09 14:51:06 @@ -264,7 +264,7 @@ * the generic op_handler. */ if ((cp = op_handler(keyword, arg)) != NULL) - warnx(cp); + warnx("%s", cp); return; } else #endif /* __sparc__ */ Index: usr.bin/top/top.c =================================================================== RCS file: /cvs/src/usr.bin/top/top.c,v retrieving revision 1.3 diff -u -r1.3 top.c --- usr.bin/top/top.c 1999/05/23 17:19:21 1.3 +++ usr.bin/top/top.c 2000/10/09 14:51:06 @@ -761,7 +761,7 @@ { if ((errmsg = kill_procs(tempbuf2)) != NULL) { - new_message(MT_standout, errmsg); + new_message(MT_standout, "%s", errmsg); putchar('\r'); no_command = Yes; } @@ -778,7 +778,7 @@ { if ((errmsg = renice_procs(tempbuf2)) != NULL) { - new_message(MT_standout, errmsg); + new_message(MT_standout, "%s", errmsg); putchar('\r'); no_command = Yes; } Index: usr.bin/ssh/auth-rsa.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/auth-rsa.c,v retrieving revision 1.23 diff -u -r1.23 auth-rsa.c --- usr.bin/ssh/auth-rsa.c 2000/04/29 18:11:51 1.23 +++ usr.bin/ssh/auth-rsa.c 2000/10/09 14:51:06 @@ -186,8 +186,8 @@ } if (fail) { fclose(f); - log(buf); - packet_send_debug(buf); + log("%s",buf); + packet_send_debug("%s",buf); restore_uid(); return 0; } Index: usr.bin/ssh/auth2.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/auth2.c,v retrieving revision 1.8 diff -u -r1.8 auth2.c --- usr.bin/ssh/auth2.c 2000/05/08 17:42:24 1.8 +++ usr.bin/ssh/auth2.c 2000/10/09 14:51:06 @@ -433,8 +433,8 @@ } } if (fail) { - log(buf); fclose(f); + log("%s",buf); restore_uid(); return 0; } Index: usr.bin/ssh/ssh-keygen.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/ssh-keygen.c,v retrieving revision 1.25 diff -u -r1.25 ssh-keygen.c --- usr.bin/ssh/ssh-keygen.c 2000/05/08 18:23:07 1.25 +++ usr.bin/ssh/ssh-keygen.c 2000/10/09 14:51:06 @@ -123,13 +123,13 @@ exit(1); } dsa_make_key_blob(k, &blob, &len); - fprintf(stdout, SSH_COM_MAGIC_BEGIN "\n"); + fprintf(stdout, "%s\n", SSH_COM_MAGIC_BEGIN); fprintf(stdout, "Comment: \"%d-bit DSA, converted from openssh by %s@%s\"\n", BN_num_bits(k->dsa->p), pw->pw_name, hostname); dump_base64(stdout, blob, len); - fprintf(stdout, SSH_COM_MAGIC_END "\n"); + fprintf(stdout, "%s\n", SSH_COM_MAGIC_END); key_free(k); xfree(blob); exit(0); 2.7/common/PaxHeaders.17043/029_sendmail.patch01004440001756001161000000000036071702573400015661xustar0030 atime=1783509427.808696221 2.7/common/029_sendmail.patch010044400017560011610000000074640717025734000150410ustar00ssyncsyncThere is an unexploitable buffer overflow in sendmail's test mode (-bt). This patch also allows one to cause sendmail to drop privileges by defining _FFR_TESTMODE_DROP_PRIVS in the Makefile. Apply by doing: cd /usr/src patch -p0 < 029_sendmail.patch And then rebuild and install sendmail: cd gnu/usr.sbin/sendmail make depend make make install Index: gnu/usr.sbin/sendmail/sendmail/macro.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/macro.c,v retrieving revision 1.1.1.1 retrieving revision 1.2 diff -u -r1.1.1.1 -r1.2 --- gnu/usr.sbin/sendmail/sendmail/macro.c 2000/04/02 19:05:45 1.1.1.1 +++ gnu/usr.sbin/sendmail/sendmail/macro.c 2000/10/09 23:45:01 1.2 @@ -377,7 +377,7 @@ *ep = p + 1; if (tTd(35, 14)) dprintf("%c\n", *p); - return *p; + return ((unsigned int)*p) & 0xff; } bp = mbuf; while (*++p != '\0' && *p != '}' && bp < &mbuf[sizeof mbuf - 1]) @@ -401,7 +401,7 @@ else if (mbuf[1] == '\0') { /* ${x} == $x */ - mid = mbuf[0]; + mid = ((unsigned int)mbuf[0]) & 0xff; p++; } else @@ -428,6 +428,11 @@ } if (ep != NULL) *ep = p; + if (mid < 0 || mid > MAXMACROID) + { + syserr("Unable to assign macro/class ID (mid = 0x%x)", mid); + mid = 0; + } if (tTd(35, 14)) dprintf("0x%x\n", mid); return mid; Index: gnu/usr.sbin/sendmail/sendmail/main.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/main.c,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- gnu/usr.sbin/sendmail/sendmail/main.c 2000/04/07 19:20:41 1.2 +++ gnu/usr.sbin/sendmail/sendmail/main.c 2000/10/09 23:45:01 1.3 @@ -1517,6 +1517,15 @@ { char buf[MAXLINE]; +#if _FFR_TESTMODE_DROP_PRIVS + dp = drop_privileges(TRUE); + if (dp != EX_OK) + { + CurEnv->e_id = NULL; + finis(TRUE, dp); + } +#endif /* _FFR_TESTMODE_DROP_PRIVS */ + if (isatty(fileno(stdin))) Verbose = 2; Index: gnu/usr.sbin/sendmail/sendmail/readcf.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/readcf.c,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- gnu/usr.sbin/sendmail/sendmail/readcf.c 2000/04/07 19:20:43 1.2 +++ gnu/usr.sbin/sendmail/sendmail/readcf.c 2000/10/09 23:45:01 1.3 @@ -2985,7 +2985,7 @@ dprintf("setclass(%s, %s)\n", macname(class), str); s = stab(str, ST_CLASS, ST_ENTER); - setbitn(class, s->s_class); + setbitn(((unsigned int)class) & 0xff, s->s_class); } } /* Index: gnu/usr.sbin/sendmail/sendmail/stab.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/stab.c,v retrieving revision 1.1.1.1 retrieving revision 1.2 diff -u -r1.1.1.1 -r1.2 --- gnu/usr.sbin/sendmail/sendmail/stab.c 2000/04/02 19:05:48 1.1.1.1 +++ gnu/usr.sbin/sendmail/sendmail/stab.c 2000/10/09 23:45:01 1.2 @@ -306,6 +306,7 @@ register STAB **shead; register STAB *s; + dst = ((unsigned int)dst) & 0xff; for (shead = SymTab; shead < &SymTab[STABSIZE]; shead++) { for (s = *shead; s != NULL; s = s->s_next) Index: gnu/usr.sbin/sendmail/sendmail/Makefile =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/Makefile,v retrieving revision 1.6 diff -u -r1.6 Makefile --- gnu/usr.sbin/sendmail/sendmail/Makefile 2000/04/06 15:45:44 1.6 +++ gnu/usr.sbin/sendmail/sendmail/Makefile 2000/10/09 23:51:01 @@ -5,6 +5,9 @@ WANT_LIBWRAP=1 WANT_LIBSMUTIL=1 +# To casue sendmail to drop privs in test mode (-bt) uncomment the following +#ENVDEF+= -D_FFR_TESTMODE_DROP_PRIVS + SRCS= main.c alias.c arpadate.c bf_torek.c clock.c collect.c \ conf.c control.c convtime.c daemon.c deliver.c domain.c \ envelope.c err.c headers.c macro.c map.c mci.c milter.c \ 2.7/common/PaxHeaders.17043/030_telnetd.patch01004440001756001161000000000036071705301400015504xustar0030 atime=1783509427.808696221 2.7/common/030_telnetd.patch010044400017560011610000000017200717053014000146510ustar00ssyncsynctelnetd does not strip out the TERMINFO, TERMINFO_DIRS, TERMPATH and TERMCAP (when it starts with a '/') environment variables. Apply by doing: cd /usr/src patch -p0 < 030_telnetd.patch And then rebuild and install telnetd: cd libexec/telnetd make depend make make install Index: libexec/telnetd/sys_term.c =================================================================== RCS file: /cvs/src/libexec/telnetd/sys_term.c,v retrieving revision 1.19 diff -u -r1.19 sys_term.c --- libexec/telnetd/sys_term.c 2000/09/15 07:13:47 1.19 +++ libexec/telnetd/sys_term.c 2000/10/10 15:57:18 @@ -1850,6 +1850,10 @@ if (strncmp(*cpp, "LD_", 3) && strncmp(*cpp, "_RLD_", 5) && strncmp(*cpp, "LIBPATH=", 8) && + strncmp(*cpp, "TERMINFO=", 9) && + strncmp(*cpp, "TERMINFO_DIRS=", 14) && + strncmp(*cpp, "TERMPATH=", 9) && + strncmp(*cpp, "TERMCAP=/", 9) && strncmp(*cpp, "ENV=", 4) && strncmp(*cpp, "IFS=", 4)) *cpp2++ = *cpp; 2.7/common/PaxHeaders.17043/031_httpd.patch01004440001756001161000000000036071732361400015177xustar0030 atime=1783509427.808696221 2.7/common/031_httpd.patch010044400017560011610000000702540717323614000143540ustar00ssyncsyncApache has several bugs in mod_rewrite and mod_vhost_alias that could cause arbirtary files on the server to be exposed under certain configurations. if you are using theses modules. Apply by doing: cd /usr/src patch -p0 < 031_httpd_patch cd usr.sbin/httpd make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper depend make -f Makefile.bsd-wrapper make -f Makefile.bsd-wrapper install Index: usr.sbin/httpd/src/modules/standard/mod_rewrite.c =================================================================== RCS file: /cvs/src/usr.sbin/httpd/src/modules/standard/mod_rewrite.c,v retrieving revision 1.5 diff -u -r1.5 mod_rewrite.c --- usr.sbin/httpd/src/modules/standard/mod_rewrite.c 2000/01/25 18:30:02 1.5 +++ usr.sbin/httpd/src/modules/standard/mod_rewrite.c 2000/10/18 20:27:27 @@ -1130,20 +1130,7 @@ r->filename); return OK; } - else if ( (strlen(r->filename) > 7 && - strncasecmp(r->filename, "http://", 7) == 0) - || (strlen(r->filename) > 8 && - strncasecmp(r->filename, "https://", 8) == 0) - || (strlen(r->filename) > 9 && - strncasecmp(r->filename, "gopher://", 9) == 0) - || (strlen(r->filename) > 6 && - strncasecmp(r->filename, "ftp://", 6) == 0) - || (strlen(r->filename) > 5 && - strncasecmp(r->filename, "ldap:", 5) == 0) - || (strlen(r->filename) > 5 && - strncasecmp(r->filename, "news:", 5) == 0) - || (strlen(r->filename) > 7 && - strncasecmp(r->filename, "mailto:", 7) == 0)) { + else if (is_absolute_uri(r->filename)) { /* it was finally rewritten to a remote URL */ /* skip 'scheme:' */ @@ -1394,20 +1381,7 @@ "%s [OK]", dconf->directory, r->filename); return OK; } - else if ( (strlen(r->filename) > 7 && - strncasecmp(r->filename, "http://", 7) == 0) - || (strlen(r->filename) > 8 && - strncasecmp(r->filename, "https://", 8) == 0) - || (strlen(r->filename) > 9 && - strncasecmp(r->filename, "gopher://", 9) == 0) - || (strlen(r->filename) > 6 && - strncasecmp(r->filename, "ftp://", 6) == 0) - || (strlen(r->filename) > 5 && - strncasecmp(r->filename, "ldap:", 5) == 0) - || (strlen(r->filename) > 5 && - strncasecmp(r->filename, "news:", 5) == 0) - || (strlen(r->filename) > 7 && - strncasecmp(r->filename, "mailto:", 7) == 0)) { + else if (is_absolute_uri(r->filename)) { /* it was finally rewritten to a remote URL */ /* because we are in a per-dir context @@ -1745,7 +1719,6 @@ char *output; const char *vary; char newuri[MAX_STRING_LEN]; - char env[MAX_STRING_LEN]; regex_t *regexp; regmatch_t regmatch[MAX_NMATCH]; backrefinfo *briRR = NULL; @@ -1913,20 +1886,7 @@ * (`RewriteRule - [E=...]') */ if (strcmp(output, "-") == 0) { - for (i = 0; p->env[i] != NULL; i++) { - /* 1. take the string */ - ap_cpystrn(env, p->env[i], sizeof(env)); - /* 2. expand $N (i.e. backrefs to RewriteRule pattern) */ - expand_backref_inbuffer(r->pool, env, sizeof(env), briRR, '$'); - /* 3. expand %N (i.e. backrefs to latest RewriteCond pattern) */ - expand_backref_inbuffer(r->pool, env, sizeof(env), briRC, '%'); - /* 4. expand %{...} (i.e. variables) */ - expand_variables_inbuffer(r, env, sizeof(env)); - /* 5. expand ${...} (RewriteMap lookups) */ - expand_map_lookups(r, env, sizeof(env)); - /* and add the variable to Apache's structures */ - add_env_variable(r, env); - } + do_expand_env(r, p->env, briRR, briRC); if (p->forced_mimetype != NULL) { if (perdir == NULL) { /* In the per-server context we can force the MIME-type @@ -1961,17 +1921,7 @@ * that there is something to replace, so we create the * substitution URL string in `newuri'. */ - /* 1. take the output string */ - ap_cpystrn(newuri, output, sizeof(newuri)); - /* 2. expand $N (i.e. backrefs to RewriteRule pattern) */ - expand_backref_inbuffer(r->pool, newuri, sizeof(newuri), briRR, '$'); - /* 3. expand %N (i.e. backrefs to latest RewriteCond pattern) */ - expand_backref_inbuffer(r->pool, newuri, sizeof(newuri), briRC, '%'); - /* 4. expand %{...} (i.e. variables) */ - expand_variables_inbuffer(r, newuri, sizeof(newuri)); - /* 5. expand ${...} (RewriteMap lookups) */ - expand_map_lookups(r, newuri, sizeof(newuri)); - /* and log the result... */ + do_expand(r, output, newuri, sizeof(newuri), briRR, briRC); if (perdir == NULL) { rewritelog(r, 2, "rewrite %s -> %s", uri, newuri); } @@ -1983,20 +1933,7 @@ * Additionally do expansion for the environment variable * strings (`RewriteRule .. .. [E=]'). */ - for (i = 0; p->env[i] != NULL; i++) { - /* 1. take the string */ - ap_cpystrn(env, p->env[i], sizeof(env)); - /* 2. expand $N (i.e. backrefs to RewriteRule pattern) */ - expand_backref_inbuffer(r->pool, env, sizeof(env), briRR, '$'); - /* 3. expand %N (i.e. backrefs to latest RewriteCond pattern) */ - expand_backref_inbuffer(r->pool, env, sizeof(env), briRC, '%'); - /* 4. expand %{...} (i.e. variables) */ - expand_variables_inbuffer(r, env, sizeof(env)); - /* 5. expand ${...} (RewriteMap lookups) */ - expand_map_lookups(r, env, sizeof(env)); - /* and add the variable to Apache's structures */ - add_env_variable(r, env); - } + do_expand_env(r, p->env, briRR, briRC); /* * Now replace API's knowledge of the current URI: @@ -2012,16 +1949,8 @@ * location, i.e. if it's not starting with either a slash * or a fully qualified URL scheme. */ - i = strlen(r->filename); - if ( prefixstrip - && !( r->filename[0] == '/' - || ( (i > 7 && strncasecmp(r->filename, "http://", 7) == 0) - || (i > 8 && strncasecmp(r->filename, "https://", 8) == 0) - || (i > 9 && strncasecmp(r->filename, "gopher://", 9) == 0) - || (i > 6 && strncasecmp(r->filename, "ftp://", 6) == 0) - || (i > 5 && strncasecmp(r->filename, "ldap:", 5) == 0) - || (i > 5 && strncasecmp(r->filename, "news:", 5) == 0) - || (i > 7 && strncasecmp(r->filename, "mailto:", 7) == 0)))) { + if (prefixstrip && r->filename[0] != '/' + && !is_absolute_uri(r->filename)) { rewritelog(r, 3, "[per-dir %s] add per-dir prefix: %s -> %s%s", perdir, r->filename, perdir, r->filename); r->filename = ap_pstrcat(r->pool, perdir, r->filename, NULL); @@ -2085,14 +2014,7 @@ * redirection (`RewriteRule .. ://...') then * directly force an external HTTP redirect. */ - i = strlen(r->filename); - if ( (i > 7 && strncasecmp(r->filename, "http://", 7) == 0) - || (i > 8 && strncasecmp(r->filename, "https://", 8) == 0) - || (i > 9 && strncasecmp(r->filename, "gopher://", 9) == 0) - || (i > 6 && strncasecmp(r->filename, "ftp://", 6) == 0) - || (i > 5 && strncasecmp(r->filename, "ldap:", 5) == 0) - || (i > 5 && strncasecmp(r->filename, "news:", 5) == 0) - || (i > 7 && strncasecmp(r->filename, "mailto:", 7) == 0) ) { + if (is_absolute_uri(r->filename)) { if (perdir == NULL) { rewritelog(r, 2, "implicitly forcing redirect (rc=%d) with %s", @@ -2163,16 +2085,7 @@ * Construct the string we match against */ - /* 1. take the string */ - ap_cpystrn(input, p->input, sizeof(input)); - /* 2. expand $N (i.e. backrefs to RewriteRule pattern) */ - expand_backref_inbuffer(r->pool, input, sizeof(input), briRR, '$'); - /* 3. expand %N (i.e. backrefs to latest RewriteCond pattern) */ - expand_backref_inbuffer(r->pool, input, sizeof(input), briRC, '%'); - /* 4. expand %{...} (i.e. variables) */ - expand_variables_inbuffer(r, input, sizeof(input)); - /* 5. expand ${...} (RewriteMap lookups) */ - expand_map_lookups(r, input, sizeof(input)); + do_expand(r, p->input, input, sizeof(input), briRR, briRC); /* * Apply the patterns @@ -2194,7 +2107,7 @@ } } else if (strcmp(p->pattern, "-l") == 0) { -#if !defined(OS2) && !defined(WIN32) +#if !defined(OS2) && !defined(WIN32) && !defined(NETWARE) if (lstat(input, &sb) == 0) { if (S_ISLNK(sb.st_mode)) { rc = 1; @@ -2211,12 +2124,7 @@ } else if (strcmp(p->pattern, "-U") == 0) { /* avoid infinite subrequest recursion */ - if (strlen(input) > 0 /* nonempty path, and */ - && ( r->main == NULL /* - either not in a subrequest */ - || ( r->main->uri != NULL /* - or in a subrequest... */ - && r->uri != NULL /* ...and URIs aren't NULL... */ - /* ...and sub/main URIs differ */ - && strcmp(r->main->uri, r->uri) != 0) ) ) { + if (strlen(input) > 0 && subreq_ok(r)) { /* run a URI-based subrequest */ rsub = ap_sub_req_lookup_uri(input, r); @@ -2235,12 +2143,7 @@ } else if (strcmp(p->pattern, "-F") == 0) { /* avoid infinite subrequest recursion */ - if (strlen(input) > 0 /* nonempty path, and */ - && ( r->main == NULL /* - either not in a subrequest */ - || ( r->main->uri != NULL /* - or in a subrequest... */ - && r->uri != NULL /* ...and URIs aren't NULL... */ - /* ...and sub/main URIs differ */ - && strcmp(r->main->uri, r->uri) != 0) ) ) { + if (strlen(input) > 0 && subreq_ok(r)) { /* process a file-based subrequest: * this differs from -U in that no path translation is done. @@ -2314,8 +2217,161 @@ ** +-------------------------------------------------------+ */ + /* ** +** perform all the expansions on the input string +** leaving the result in the supplied buffer +** +*/ + +static void do_expand(request_rec *r, char *input, char *buffer, int nbuf, + backrefinfo *briRR, backrefinfo *briRC) +{ + char *inp, *outp; + size_t span, space; + + /* + * for security reasons this expansion must be perfomed in a + * single pass, otherwise an attacker can arrange for the result + * of an earlier expansion to include expansion specifiers that + * are interpreted by a later expansion, producing results that + * were not intended by the administrator. + */ + + inp = input; + outp = buffer; + space = nbuf - 1; /* room for '\0' */ + + for (;;) { + span = strcspn(inp, "$%"); + if (span > space) { + span = space; + } + memcpy(outp, inp, span); + inp += span; + outp += span; + space -= span; + if (space == 0 || *inp == '\0') { + break; + } + /* now we have a '$' or a '%' */ + if (inp[1] == '{') { + char *endp; + endp = find_closing_bracket(inp+2, '{', '}'); + if (endp == NULL) { + goto skip; + } + *endp = '\0'; + if (inp[0] == '$') { + /* ${...} map lookup expansion */ + /* + * To make rewrite maps useful the lookup key and + * default values must be expanded, so we make + * recursive calls to do the work. For security + * reasons we must never expand a string that includes + * verbatim data from the network. The recursion here + * isn't a problem because the result of expansion is + * only passed to lookup_map() so it cannot be + * re-expanded, only re-looked-up. Another way of + * looking at it is that the recursion is entirely + * driven by the syntax of the nested curly brackets. + */ + char *key, *dflt, *result; + char xkey[MAX_STRING_LEN]; + char xdflt[MAX_STRING_LEN]; + char *empty = ""; + key = strchr(inp, ':'); + if (key == NULL) { + goto skip; + } + *key++ = '\0'; + dflt = strchr(key, '|'); + if (dflt == NULL) { + dflt = empty; + } + else { + *dflt++ = '\0'; + } + do_expand(r, key, xkey, sizeof(xkey), briRR, briRC); + do_expand(r, dflt, xdflt, sizeof(xdflt), briRR, briRC); + result = lookup_map(r, inp+2, xkey); + if (result == NULL) { + result = xdflt; + } + span = ap_cpystrn(outp, result, space) - outp; + key[-1] = ':'; + if (dflt != empty) { + dflt[-1] = '|'; + } + } + else if (inp[0] == '%') { + /* %{...} variable lookup expansion */ + span = ap_cpystrn(outp, lookup_variable(r, inp+2), space) - outp; + } + else { + span = 0; + } + *endp = '}'; + inp = endp+1; + outp += span; + space -= span; + continue; + } + else if (ap_isdigit(inp[1])) { + int n = inp[1] - '0'; + backrefinfo *bri = NULL; + if (inp[0] == '$') { + /* $N RewriteRule regexp backref expansion */ + bri = briRR; + } + else if (inp[0] == '%') { + /* %N RewriteCond regexp backref expansion */ + bri = briRC; + } + /* see ap_pregsub() in src/main/util.c */ + if (bri && n <= bri->nsub && + bri->regmatch[n].rm_eo > bri->regmatch[n].rm_so) { + span = bri->regmatch[n].rm_eo - bri->regmatch[n].rm_so; + if (span > space) { + span = space; + } + memcpy(outp, bri->source + bri->regmatch[n].rm_so, span); + outp += span; + space -= span; + } + inp += 2; + continue; + } + skip: + *outp++ = *inp++; + space--; + } + *outp++ = '\0'; +} + + +/* +** +** perform all the expansions on the environment variables +** +*/ + +static void do_expand_env(request_rec *r, char *env[], + backrefinfo *briRR, backrefinfo *briRC) +{ + int i; + char buf[MAX_STRING_LEN]; + + for (i = 0; env[i] != NULL; i++) { + do_expand(r, env[i], buf, sizeof(buf), briRR, briRC); + add_env_variable(r, buf); + } +} + + +/* +** ** split out a QUERY_STRING part from ** the current URI string ** @@ -2442,20 +2498,12 @@ static void fully_qualify_uri(request_rec *r) { - int i; char buf[32]; const char *thisserver; char *thisport; int port; - i = strlen(r->filename); - if (!( (i > 7 && strncasecmp(r->filename, "http://", 7) == 0) - || (i > 8 && strncasecmp(r->filename, "https://", 8) == 0) - || (i > 9 && strncasecmp(r->filename, "gopher://", 9) == 0) - || (i > 6 && strncasecmp(r->filename, "ftp://", 6) == 0) - || (i > 5 && strncasecmp(r->filename, "ldap:", 5) == 0) - || (i > 5 && strncasecmp(r->filename, "news:", 5) == 0) - || (i > 7 && strncasecmp(r->filename, "mailto:", 7) == 0))) { + if (!is_absolute_uri(r->filename)) { thisserver = ap_get_server_name(r); port = ap_get_server_port(r); @@ -2484,45 +2532,24 @@ /* ** -** Expand the %0-%9 or $0-$9 regex backreferences +** return non-zero if the URI is absolute (includes a scheme etc.) ** */ -static void expand_backref_inbuffer(pool *p, char *buf, int nbuf, - backrefinfo *bri, char c) +static int is_absolute_uri(char *uri) { - register int i; - - /* protect existing $N and & backrefs and replace N with $N backrefs */ - for (i = 0; buf[i] != '\0' && i < nbuf; i++) { - if (buf[i] == '\\' && (buf[i+1] != '\0' && i < (nbuf-1))) { - i++; /* protect next */ - } - else if (buf[i] == '&') { - buf[i] = '\001'; - } - else if (c != '$' && buf[i] == '$' && (buf[i+1] >= '0' && buf[i+1] <= '9')) { - buf[i] = '\002'; - i++; /* speedup */ - } - else if (buf[i] == c && (buf[i+1] >= '0' && buf[i+1] <= '9')) { - buf[i] = '$'; - i++; /* speedup */ - } + int i = strlen(uri); + if ( (i > 7 && strncasecmp(uri, "http://", 7) == 0) + || (i > 8 && strncasecmp(uri, "https://", 8) == 0) + || (i > 9 && strncasecmp(uri, "gopher://", 9) == 0) + || (i > 6 && strncasecmp(uri, "ftp://", 6) == 0) + || (i > 5 && strncasecmp(uri, "ldap:", 5) == 0) + || (i > 5 && strncasecmp(uri, "news:", 5) == 0) + || (i > 7 && strncasecmp(uri, "mailto:", 7) == 0) ) { + return 1; } - - /* now apply the standard regex substitution function */ - ap_cpystrn(buf, ap_pregsub(p, buf, bri->source, - bri->nsub+1, bri->regmatch), nbuf); - - /* restore the original $N and & backrefs */ - for (i = 0; buf[i] != '\0' && i < nbuf; i++) { - if (buf[i] == '\001') { - buf[i] = '&'; - } - else if (buf[i] == '\002') { - buf[i] = '$'; - } + else { + return 0; } } @@ -2571,121 +2598,8 @@ } #endif -/* -** -** mapfile expansion support -** i.e. expansion of MAP lookup directives -** ${:} in RewriteRule rhs -** -*/ -#define limit_length(n) (n > LONG_STRING_LEN-1 ? LONG_STRING_LEN-1 : n) -static void expand_map_lookups(request_rec *r, char *uri, int uri_len) -{ - char newuri[MAX_STRING_LEN]; - char *cpI; - char *cpIE; - char *cpO; - char *cpT; - char *cpT2; - char mapname[LONG_STRING_LEN]; - char mapkey[LONG_STRING_LEN]; - char defaultvalue[LONG_STRING_LEN]; - int n; - - cpI = uri; - cpIE = cpI+strlen(cpI); - cpO = newuri; - while (cpI < cpIE) { - if (cpI+6 < cpIE && strncmp(cpI, "${", 2) == 0) { - /* missing delimiter -> take it as plain text */ - if ( strchr(cpI+2, ':') == NULL - || strchr(cpI+2, '}') == NULL) { - memcpy(cpO, cpI, 2); - cpO += 2; - cpI += 2; - continue; - } - cpI += 2; - - cpT = strchr(cpI, ':'); - n = cpT-cpI; - memcpy(mapname, cpI, limit_length(n)); - mapname[limit_length(n)] = '\0'; - cpI += n+1; - - cpT2 = strchr(cpI, '|'); - cpT = strchr(cpI, '}'); - if (cpT2 != NULL && cpT2 < cpT) { - n = cpT2-cpI; - memcpy(mapkey, cpI, limit_length(n)); - mapkey[limit_length(n)] = '\0'; - cpI += n+1; - - n = cpT-cpI; - memcpy(defaultvalue, cpI, limit_length(n)); - defaultvalue[limit_length(n)] = '\0'; - cpI += n+1; - } - else { - n = cpT-cpI; - memcpy(mapkey, cpI, limit_length(n)); - mapkey[limit_length(n)] = '\0'; - cpI += n+1; - - defaultvalue[0] = '\0'; - } - - cpT = lookup_map(r, mapname, mapkey); - if (cpT != NULL) { - n = strlen(cpT); - if (cpO + n >= newuri + sizeof(newuri)) { - ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, - r, "insufficient space in " - "expand_map_lookups, aborting"); - return; - } - memcpy(cpO, cpT, n); - cpO += n; - } - else { - n = strlen(defaultvalue); - if (cpO + n >= newuri + sizeof(newuri)) { - ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, - r, "insufficient space in " - "expand_map_lookups, aborting"); - return; - } - memcpy(cpO, defaultvalue, n); - cpO += n; - } - } - else { - cpT = strstr(cpI, "${"); - if (cpT == NULL) - cpT = cpI+strlen(cpI); - n = cpT-cpI; - if (cpO + n >= newuri + sizeof(newuri)) { - ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, - r, "insufficient space in " - "expand_map_lookups, aborting"); - return; - } - memcpy(cpO, cpI, n); - cpO += n; - cpI += n; - } - } - *cpO = '\0'; - ap_cpystrn(uri, newuri, uri_len); - return; -} - -#undef limit_length - - - /* ** +-------------------------------------------------------+ ** | | @@ -3109,7 +3023,9 @@ char *fname; piped_log *pl; int rewritelog_flags = ( O_WRONLY|O_APPEND|O_CREAT ); -#ifdef WIN32 +#if defined(NETWARE) + mode_t rewritelog_mode = ( S_IREAD|S_IWRITE ); +#elif defined(WIN32) mode_t rewritelog_mode = ( _S_IREAD|_S_IWRITE ); #else mode_t rewritelog_mode = ( S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH ); @@ -3267,7 +3183,9 @@ ** +-------------------------------------------------------+ */ -#ifdef WIN32 +#if defined(NETWARE) +#define REWRITELOCK_MODE ( S_IREAD|S_IWRITE ) +#elif defined(WIN32) #define REWRITELOCK_MODE ( _S_IREAD|_S_IWRITE ) #else #define REWRITELOCK_MODE ( S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH ) @@ -3275,10 +3193,6 @@ static void rewritelock_create(server_rec *s, pool *p) { - rewrite_server_conf *conf; - - conf = ap_get_module_config(s->module_config, &rewrite_module); - /* only operate if a lockfile is used */ if (lockname == NULL || *(lockname) == '\0') { return; @@ -3307,10 +3221,6 @@ static void rewritelock_open(server_rec *s, pool *p) { - rewrite_server_conf *conf; - - conf = ap_get_module_config(s->module_config, &rewrite_module); - /* only operate if a lockfile is used */ if (lockname == NULL || *(lockname) == '\0') { return; @@ -3483,53 +3393,6 @@ */ -static void expand_variables_inbuffer(request_rec *r, char *buf, int buf_len) -{ - char *newbuf; - newbuf = expand_variables(r, buf); - if (strcmp(newbuf, buf) != 0) { - ap_cpystrn(buf, newbuf, buf_len); - } - return; -} - -static char *expand_variables(request_rec *r, char *str) -{ - char output[MAX_STRING_LEN]; - char input[MAX_STRING_LEN]; - char *cp; - char *cp2; - char *cp3; - int expanded; - char *outp; - char *endp; - - ap_cpystrn(input, str, sizeof(input)); - output[0] = '\0'; - outp = output; - endp = output + sizeof(output); - expanded = 0; - for (cp = input; cp < input+MAX_STRING_LEN; ) { - if ((cp2 = strstr(cp, "%{")) != NULL) { - if ((cp3 = strstr(cp2, "}")) != NULL) { - *cp2 = '\0'; - outp = ap_cpystrn(outp, cp, endp - outp); - - cp2 += 2; - *cp3 = '\0'; - outp = ap_cpystrn(outp, lookup_variable(r, cp2), endp - outp); - - cp = cp3+1; - expanded = 1; - continue; - } - } - outp = ap_cpystrn(outp, cp, endp - outp); - break; - } - return expanded ? ap_pstrdup(r->pool, output) : str; -} - static char *lookup_variable(request_rec *r, char *var) { const char *result; @@ -3869,11 +3732,11 @@ char *p; n = 0; - for (p=key; *p != '\0'; ++p) { - n = n * 53711 + 134561 + (unsigned)(*p & 0xff); + for (p = key; *p != '\0'; p++) { + n = ((n << 5) + n) ^ (unsigned long)(*p++); } - return n % CACHE_TLB_ROWS; + return (int)(n % CACHE_TLB_ROWS); } static cacheentry *cache_tlb_lookup(cachetlbentry *tlb, cacheentry *elt, @@ -4156,6 +4019,23 @@ } +/* +** +** check that a subrequest won't cause infinite recursion +** +*/ + +static int subreq_ok(request_rec *r) +{ + /* + * either not in a subrequest, or in a subrequest + * and URIs aren't NULL and sub/main URIs differ + */ + return (r->main == NULL || + (r->main->uri != NULL && r->uri != NULL && + strcmp(r->main->uri, r->uri) != 0)); +} + /* ** @@ -4291,12 +4171,27 @@ } return 0; } + +/* +** +** Find end of bracketed expression +** s points after the opening bracket +** +*/ -#ifdef NETWARE -int main(int argc, char *argv[]) +static char *find_closing_bracket(char *s, int left, int right) { - ExitThread(TSR_THREAD, 0); + int depth; + + for (depth = 1; *s; ++s) { + if (*s == right && --depth == 0) { + return s; + } + else if (*s == left) { + ++depth; + } + } + return NULL; } -#endif /*EOF*/ Index: usr.sbin/httpd/src/modules/standard/mod_rewrite.h =================================================================== RCS file: /cvs/src/usr.sbin/httpd/src/modules/standard/mod_rewrite.h,v retrieving revision 1.4 diff -u -r1.4 mod_rewrite.h --- usr.sbin/httpd/src/modules/standard/mod_rewrite.h 2000/01/25 18:30:03 1.4 +++ usr.sbin/httpd/src/modules/standard/mod_rewrite.h 2000/10/18 20:27:27 @@ -168,7 +168,7 @@ #include #endif #endif -#ifdef AIX +#if defined(AIX) || defined(AIXIA64) #undef USE_FLOCK #define USE_FCNTL 1 #include @@ -420,14 +420,17 @@ char *perdir, backrefinfo *briRR, backrefinfo *briRC); +static void do_expand(request_rec *r, char *input, char *buffer, int nbuf, + backrefinfo *briRR, backrefinfo *briRC); +static void do_expand_env(request_rec *r, char *env[], + backrefinfo *briRR, backrefinfo *briRC); + /* URI transformation function */ static void splitout_queryargs(request_rec *r, int qsappend); static void fully_qualify_uri(request_rec *r); static void reduce_uri(request_rec *r); -static void expand_backref_inbuffer(pool *p, char *buf, int nbuf, - backrefinfo *bri, char c); +static int is_absolute_uri(char *uri); static char *expand_tildepaths(request_rec *r, char *uri); -static void expand_map_lookups(request_rec *r, char *uri, int uri_len); /* rewrite map support functions */ static char *lookup_map(request_rec *r, char *name, char *key); @@ -466,8 +469,6 @@ static int rewritemap_program_child(void *cmd, child_info *pinfo); /* env variable support */ -static void expand_variables_inbuffer(request_rec *r, char *buf, int buf_len); -static char *expand_variables(request_rec *r, char *str); static char *lookup_variable(request_rec *r, char *var); static char *lookup_header(request_rec *r, const char *name); @@ -486,6 +487,7 @@ static int parseargline(char *str, char **a1, char **a2, char **a3); static int prefix_stat(const char *path, struct stat *sb); static void add_env_variable(request_rec *r, char *s); +static int subreq_ok(request_rec *r); /* File locking */ static void fd_lock(request_rec *r, int fd); @@ -493,6 +495,9 @@ /* Lexicographic Comparison */ static int compare_lexicography(char *cpNum1, char *cpNum2); + + /* Find end of bracketed expression */ +static char *find_closing_bracket(char *s, int left, int right); #endif /* _MOD_REWRITE_H */ Index: usr.sbin/httpd/src/modules/standard/mod_vhost_alias.c =================================================================== RCS file: /cvs/src/usr.sbin/httpd/src/modules/standard/mod_vhost_alias.c,v retrieving revision 1.1 diff -u -r1.1 mod_vhost_alias.c --- usr.sbin/httpd/src/modules/standard/mod_vhost_alias.c 1999/09/29 06:29:57 1.1 +++ usr.sbin/httpd/src/modules/standard/mod_vhost_alias.c 2000/10/18 20:27:27 @@ -412,25 +412,23 @@ mva_sconf_t *conf; const char *name, *map, *uri; mva_mode_e mode; - int cgi; + const char *cgi; conf = (mva_sconf_t *) ap_get_module_config(r->server->module_config, &vhost_alias_module); - if (!strncmp(r->uri, "/cgi-bin/", 9)) { + cgi = strstr(r->uri, "cgi-bin/"); + if (cgi && cgi - r->uri != strspn(r->uri, "/")) { + cgi = NULL; + } + if (cgi) { mode = conf->cgi_root_mode; map = conf->cgi_root; - uri = r->uri + 8; - /* - * can't force cgi immediately because we might not handle this - * call if the mode is wrong - */ - cgi = 1; + uri = cgi + strlen("cgi-bin"); } else if (r->uri[0] == '/') { mode = conf->doc_root_mode; map = conf->doc_root; uri = r->uri; - cgi = 0; } else { return DECLINED; 2.7/common/PaxHeaders.17043/032_xtrans.patch01004440001756001161000000000036071757441400015402xustar0030 atime=1783509427.808696221 2.7/common/032_xtrans.patch010044400017560011610000000064440717574414000145570ustar00ssyncsyncThere are 2 potential overflows in xtrans, which may be exploitable. One of them is documented in Apply by doing: cd "the directory containing your X11 source dir" patch -p0 < 030_xtrans.patch And then rebuild your X11 tree: cd X11 make build "DESTDIR=/" Note: tcl/tk 8.0.5 is required to build X11 from source. Index: X11/xc/lib/xtrans/Xtrans.c =================================================================== RCS file: /cvs/X11/xc/lib/xtrans/Xtrans.c,v retrieving revision 1.1.1.3 retrieving revision 1.2 diff -u -u -r1.1.1.3 -r1.2 --- X11/xc/lib/xtrans/Xtrans.c 1999/08/24 17:41:25 1.1.1.3 +++ X11/xc/lib/xtrans/Xtrans.c 2000/10/14 15:47:31 1.2 @@ -178,7 +178,7 @@ * a case insensitive match. */ - strncpy (protobuf, protocol, PROTOBUFSIZE); + strncpy (protobuf, protocol, PROTOBUFSIZE - 1); for (i = 0; i < PROTOBUFSIZE && protobuf[i] != '\0'; i++) if (isupper (protobuf[i])) Index: X11/xc/lib/xtrans/Xtranssock.c =================================================================== RCS file: /cvs/X11/xc/lib/xtrans/Xtranssock.c,v retrieving revision 1.4 retrieving revision 1.6 diff -u -u -r1.4 -r1.6 --- X11/xc/lib/xtrans/Xtranssock.c 1999/08/24 18:11:21 1.4 +++ X11/xc/lib/xtrans/Xtranssock.c 2000/10/13 21:04:23 1.6 @@ -754,6 +754,29 @@ } +#ifdef UNIXCONN +static int +set_sun_path(const char *port, const char *upath, char *path) +{ + struct sockaddr_un s; + int maxlen = sizeof(s.sun_path) - 1; + + if (!port || !*port || !path) + return -1; + + if (*port == '/') { /* a full pathname */ + if (strlen(port) > maxlen) + return -1; + sprintf(path, "%s", port); + } else { + if (strlen(port) + strlen(upath) > maxlen) + return -1; + sprintf(path, "%s%s", upath, port); + } + return 0; +} +#endif + #ifdef TRANS_SERVER static int @@ -957,10 +980,9 @@ sockname.sun_family = AF_UNIX; if (port && *port) { - if (*port == '/') { /* a full pathname */ - sprintf (sockname.sun_path, "%s", port); - } else { - sprintf (sockname.sun_path, "%s%s", UNIX_PATH, port); + if (set_sun_path(port, UNIX_PATH, sockname.sun_path) != 0) { + PRMSG (1, "SocketUNIXCreateListener: path too long\n", 0, 0, 0); + return TRANS_CREATE_LISTENER_FAILED; } } else { sprintf (sockname.sun_path, "%s%d", UNIX_PATH, getpid()); @@ -1604,10 +1626,9 @@ sockname.sun_family = AF_UNIX; - if (*port == '/') { /* a full pathname */ - sprintf (sockname.sun_path, "%s", port); - } else { - sprintf (sockname.sun_path, "%s%s", UNIX_PATH, port); + if (set_sun_path(port, UNIX_PATH, sockname.sun_path) != 0) { + PRMSG (1, "SocketUNIXCreateListener: path too long\n", 0, 0, 0); + return TRANS_CREATE_LISTENER_FAILED; } #if defined(BSD44SOCKETS) && !defined(Lynx) @@ -1623,10 +1644,9 @@ * This is gross, but it was in Xlib */ old_sockname.sun_family = AF_UNIX; - if (*port == '/') { /* a full pathname */ - sprintf (old_sockname.sun_path, "%s", port); - } else { - sprintf (old_sockname.sun_path, "%s%s", OLD_UNIX_PATH, port); + if (set_sun_path(port, OLD_UNIX_PATH, old_sockname.sun_path) != 0) { + PRMSG (1, "SocketUNIXConnect: path too long\n", 0, 0, 0); + return TRANS_CONNECT_FAILED; } old_namelen = strlen (old_sockname.sun_path) + sizeof (old_sockname.sun_family); 2.7/common/PaxHeaders.17043/033_execsubr.patch01004440001756001161000000000036072014533600015673xustar0030 atime=1783509427.808696221 2.7/common/033_execsubr.patch010044400017560011610000000016710720145336000150450ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 033_execsubr.patch And then rebuild your kernel. Index: sys/kern/exec_subr.c =================================================================== RCS file: /cvs/src/sys/kern/exec_subr.c,v retrieving revision 1.7 diff -u -r1.7 exec_subr.c --- sys/kern/exec_subr.c 1999/11/05 01:18:01 1.7 +++ sys/kern/exec_subr.c 2000/11/06 18:57:27 @@ -1,4 +1,4 @@ -/* $OpenBSD: exec_subr.c,v 1.7 1999/11/05 01:18:01 mickey Exp $ */ +/* $OpenBSD: exec_subr.c,v 1.9 2000/11/06 16:19:52 art Exp $ */ /* $NetBSD: exec_subr.c,v 1.9 1994/12/04 03:10:42 mycroft Exp $ */ /* @@ -154,12 +154,13 @@ * map the vnode in using uvm_map. */ - /* checks imported from uvm_mmap, needed? */ if (cmd->ev_len == 0) return(0); if (cmd->ev_offset & PAGE_MASK) return(EINVAL); if (cmd->ev_addr & PAGE_MASK) + return(EINVAL); + if (cmd->ev_len & PAGE_MASK) return(EINVAL); /* 2.7/common/PaxHeaders.17043/035_sshforwarding.patch01004440001756001161000000000036072051535600016740xustar0030 atime=1783509427.808696221 2.7/common/035_sshforwarding.patch010044400017560011610000000035060720515356000161110ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 035_sshforwarding.patch And then rebuild and install ssh. cd usr.bin/ssh make obj make depend make make install Index: usr.bin/ssh/clientloop.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/clientloop.c,v retrieving revision 1.26 diff -u -r1.26 clientloop.c --- usr.bin/ssh/clientloop.c 2000/05/08 17:42:24 1.26 +++ usr.bin/ssh/clientloop.c 2000/11/10 21:43:12 @@ -31,6 +31,8 @@ #include "dispatch.h" +extern Options options; + /* Flag indicating that stdin should be redirected from /dev/null. */ extern int stdin_null_flag; @@ -734,7 +736,6 @@ int client_loop(int have_pty, int escape_char_arg) { - extern Options options; double start_time, total_time; int len; char buf[100]; @@ -974,7 +975,7 @@ debug("client_input_channel_open: ctype %s rchan %d win %d max %d", ctype, rchan, rwindow, rmaxpack); - if (strcmp(ctype, "x11") == 0) { + if (strcmp(ctype, "x11") == 0 && options.forward_x11) { int sock; char *originator; int originator_port; @@ -1046,11 +1047,14 @@ dispatch_set(SSH_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation); dispatch_set(SSH_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure); dispatch_set(SSH_MSG_PORT_OPEN, &channel_input_port_open); - dispatch_set(SSH_SMSG_AGENT_OPEN, &auth_input_open_request); dispatch_set(SSH_SMSG_EXITSTATUS, &client_input_exit_status); dispatch_set(SSH_SMSG_STDERR_DATA, &client_input_stderr_data); dispatch_set(SSH_SMSG_STDOUT_DATA, &client_input_stdout_data); - dispatch_set(SSH_SMSG_X11_OPEN, &x11_input_open); + + dispatch_set(SSH_SMSG_AGENT_OPEN, options.forward_agent ? + &auth_input_open_request : NULL); + dispatch_set(SSH_SMSG_X11_OPEN, options.forward_x11 ? + &x11_input_open : NULL); } void client_init_dispatch_15() 2.7/common/PaxHeaders.17043/037_ftpd.patch01004440001756001161000000000036072131111600015004xustar0030 atime=1783509427.808696221 2.7/common/037_ftpd.patch010044400017560011610000000020310721311116000141450ustar00ssyncsyncThis patch fixes a one-byte buffer overflow. Apply by doing: cd /usr/src patch -p0 < 037_ftpd.patch And then rebuild and install ftpd: cd libexec/ftpd make obj make depend make make install Index: libexec/ftpd/ftpd.c =================================================================== RCS file: /cvs/src/libexec/ftpd/ftpd.c,v retrieving revision 1.71.2.1 diff -u -r1.71.2.1 ftpd.c --- libexec/ftpd/ftpd.c 2000/07/05 22:20:08 1.71.2.1 +++ libexec/ftpd/ftpd.c 2000/12/05 17:12:01 @@ -1924,15 +1924,21 @@ replydirname(name, message) const char *name, *message; { + char *p, *ep; char npath[MAXPATHLEN]; - int i; - for (i = 0; *name != '\0' && i < sizeof(npath) - 1; i++, name++) { - npath[i] = *name; - if (*name == '"') - npath[++i] = '"'; + p = npath; + ep = &npath[sizeof(npath) - 1]; + while (*name) { + if (*name == '"' && ep - p >= 2) { + *p++ = *name++; + *p++ = '"'; + } else if (ep - p >= 1) + *p++ = *name++; + else + break; } - npath[i] = '\0'; + *p = '\0'; reply(257, "\"%s\" %s", npath, message); } 2.7/common/PaxHeaders.17043/038_named.patch01004440001756001161000000000036072352123600015144xustar0030 atime=1783509427.808696221 2.7/common/038_named.patch010044400017560011610000000253720723521236000143220ustar00ssyncsyncThis patch fixes several buffer overflows in ISC's BIND 4.9. Apply by doing: cd /usr/src patch -p0 < 038_named.patch And rebuild named by doing: cd usr.sbin/named make obj make depend make make install Index: usr.sbin/named/Makefile =================================================================== RCS file: /cvs/src/usr.sbin/named/Makefile,v retrieving revision 1.10 diff -u -r1.10 Makefile --- usr.sbin/named/Makefile 2000/03/29 20:32:55 1.10 +++ usr.sbin/named/Makefile 2001/01/30 02:36:35 @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.10 2000/03/29 20:32:55 deraadt Exp $ +# $OpenBSD: Makefile,v 1.10.4.1 2001/01/30 00:06:40 jason Exp $ SUBDIR= named named-xfer ndc reload restart dig nslookup \ host dnsquery @@ -6,6 +6,6 @@ SUBDIR+= doc/bog .endif -VER= 4.9.7-REL +VER= 4.9.8-REL .include Index: usr.sbin/named/libresolv/res_comp.c =================================================================== RCS file: /cvs/src/usr.sbin/named/libresolv/res_comp.c,v retrieving revision 1.3 diff -u -r1.3 res_comp.c --- usr.sbin/named/libresolv/res_comp.c 1998/05/22 07:09:08 1.3 +++ usr.sbin/named/libresolv/res_comp.c 2001/01/30 02:36:35 @@ -1,4 +1,4 @@ -/* $OpenBSD: res_comp.c,v 1.3 1998/05/22 07:09:08 millert Exp $ */ +/* $OpenBSD: res_comp.c,v 1.3.10.1 2001/01/30 00:06:01 jason Exp $ */ /* * ++Copyright++ 1985, 1993 @@ -60,7 +60,7 @@ static char sccsid[] = "@(#)res_comp.c 8.1 (Berkeley) 6/4/93"; static char rcsid[] = "$From: res_comp.c,v 8.14 1998/05/11 04:19:47 vixie Exp $"; #else -static char rcsid[] = "$OpenBSD: res_comp.c,v 1.3 1998/05/22 07:09:08 millert Exp $"; +static char rcsid[] = "$OpenBSD: res_comp.c,v 1.3.10.1 2001/01/30 00:06:01 jason Exp $"; #endif #endif /* LIBC_SCCS and not lint */ @@ -801,6 +801,25 @@ if (ns_name_pton(src, tmp, sizeof tmp) == -1) return (-1); return (ns_name_pack(tmp, dst, dstsiz, dnptrs, lastdnptr)); +} + +/* + * Reset dnptrs so that there are no active references to pointers at or + * after src. + */ +void +ns_name_rollback(src, dnptrs, lastdnptr) + const u_char *src; + const u_char **dnptrs; + const u_char **lastdnptr; +{ + while (dnptrs < lastdnptr && *dnptrs != NULL) { + if (*dnptrs >= src) { + *dnptrs = NULL; + break; + } + dnptrs++; + } } /* Index: usr.sbin/named/named/ns_forw.c =================================================================== RCS file: /cvs/src/usr.sbin/named/named/ns_forw.c,v retrieving revision 1.4 diff -u -r1.4 ns_forw.c --- usr.sbin/named/named/ns_forw.c 1998/05/22 00:47:38 1.4 +++ usr.sbin/named/named/ns_forw.c 2001/01/30 02:36:41 @@ -1,11 +1,11 @@ -/* $OpenBSD: ns_forw.c,v 1.4 1998/05/22 00:47:38 millert Exp $ */ +/* $OpenBSD: ns_forw.c,v 1.4.10.1 2001/01/30 00:06:02 jason Exp $ */ #if !defined(lint) && !defined(SABER) #if 0 static char sccsid[] = "@(#)ns_forw.c 4.32 (Berkeley) 3/3/91"; static char rcsid[] = "$From: ns_forw.c,v 8.19 1996/12/02 09:27:36 vixie Exp $"; #else -static char rcsid[] = "$OpenBSD: ns_forw.c,v 1.4 1998/05/22 00:47:38 millert Exp $"; +static char rcsid[] = "$OpenBSD: ns_forw.c,v 1.4.10.1 2001/01/30 00:06:02 jason Exp $"; #endif #endif /* not lint */ @@ -291,17 +291,23 @@ * dname and a_rr are the problematic other name server. */ static void -nslookupComplain(sysloginfo, queryname, complaint, dname, a_rr, nsdp) - const char *sysloginfo, *queryname, *complaint, *dname; +nslookupComplain(sysloginfo, net_queryname, complaint, net_dname, a_rr, nsdp) + const char *sysloginfo, *net_queryname, *complaint, *net_dname; const struct databuf *a_rr, *nsdp; { + char queryname[64], dname[64]; #ifdef STATS char nsbuf[20]; char abuf[20]; #endif - char *a, *ns; + const char *a, *ns; const char *a_type; int print_a; + + strncpy(queryname, net_queryname, (sizeof queryname) - 1); + queryname[(sizeof queryname) - 1] = '\0'; + strncpy(dname, net_dname, (sizeof dname) - 1); + dname[(sizeof dname) - 1] = '\0'; dprintf(2, (ddt, "NS '%s' %s\n", dname, complaint)); if (sysloginfo && queryname && !haveComplained(queryname, complaint)) Index: usr.sbin/named/named/ns_req.c =================================================================== RCS file: /cvs/src/usr.sbin/named/named/ns_req.c,v retrieving revision 1.6 diff -u -r1.6 ns_req.c --- usr.sbin/named/named/ns_req.c 1998/05/22 07:09:18 1.6 +++ usr.sbin/named/named/ns_req.c 2001/01/30 02:36:47 @@ -1,11 +1,11 @@ -/* $OpenBSD: ns_req.c,v 1.6 1998/05/22 07:09:18 millert Exp $ */ +/* $OpenBSD: ns_req.c,v 1.6.10.1 2001/01/30 00:06:03 jason Exp $ */ #if !defined(lint) && !defined(SABER) #if 0 static char sccsid[] = "@(#)ns_req.c 4.47 (Berkeley) 7/1/91"; static char rcsid[] = "$From: ns_req.c,v 8.30 1998/05/11 04:19:45 vixie Exp $"; #else -static char rcsid[] = "$OpenBSD: ns_req.c,v 1.6 1998/05/22 07:09:18 millert Exp $"; +static char rcsid[] = "$OpenBSD: ns_req.c,v 1.6.10.1 2001/01/30 00:06:03 jason Exp $"; #endif #endif /* not lint */ @@ -243,6 +243,14 @@ hp->qr = 1; /* set Response flag */ hp->ra = (NoRecurse == 0); + if (hp->rcode == FORMERR) { + hp->qdcount = htons(0); + hp->ancount = htons(0); + hp->nscount = htons(0); + hp->arcount = htons(0); + cp = msg + HFIXEDSZ; + } + n = doaddinfo(hp, cp, buflen); cp += n; buflen -= n; @@ -1012,12 +1020,12 @@ GETSHORT(class, *cpp); *cpp += INT32SZ; /* ttl */ GETSHORT(dlen, *cpp); - *cpp += dlen; - if (*cpp != eom) { + if (*cpp + dlen != eom) { dprintf(1, (ddt, "FORMERR IQuery message length off\n")); hp->rcode = FORMERR; return (Finish); } + *cpp += dlen; /* * not all inverse queries are handled. @@ -1223,6 +1231,25 @@ } /* + * Reset dnptrs so that there are no active references to pointers at or + * after src. + */ +static void +ns_name_rollback(src, dnptrs, lastdnptr) + const u_char *src; + const u_char **dnptrs; + const u_char **lastdnptr; +{ + while (dnptrs < lastdnptr && *dnptrs != NULL) { + if (*dnptrs >= src) { + *dnptrs = NULL; + break; + } + dnptrs++; + } +} + +/* * Copy databuf into a resource record for replies. * Return size of RR if OK, -1 if buffer is full. */ @@ -1294,11 +1321,11 @@ } #endif if ((n = dn_comp(name, buf, buflen, dnptrs, edp)) < 0) - return (-1); + goto cleanup; cp = buf + n; buflen -= n; if (buflen < 0) - return (-1); + goto cleanup; PUTSHORT((u_int16_t)type, cp); PUTSHORT((u_int16_t)dp->d_class, cp); PUTLONG(ttl, cp); @@ -1311,7 +1338,7 @@ case T_PTR: n = dn_comp((char *)dp->d_data, cp, buflen, dnptrs, edp); if (n < 0) - return (-1); + goto cleanup; PUTSHORT((u_int16_t)n, sp); cp += n; break; @@ -1321,7 +1348,7 @@ /* Store domain name in answer */ n = dn_comp((char *)dp->d_data, cp, buflen, dnptrs, edp); if (n < 0) - return (-1); + goto cleanup; PUTSHORT((u_int16_t)n, sp); cp += n; if (doadd) @@ -1335,15 +1362,15 @@ cp1 = dp->d_data; n = dn_comp((char *)cp1, cp, buflen, dnptrs, edp); if (n < 0) - return (-1); + goto cleanup; cp += n; buflen -= type == T_SOA ? n + 5 * INT32SZ : n; if (buflen < 0) - return (-1); + goto cleanup; cp1 += strlen((char *)cp1) + 1; n = dn_comp((char *)cp1, cp, buflen, dnptrs, edp); if (n < 0) - return (-1); + goto cleanup; cp += n; if (type == T_SOA) { cp1 += strlen((char *)cp1) + 1; @@ -1361,7 +1388,7 @@ /* copy order */ buflen -= INT16SZ; if (buflen < 0) - return (-1); + goto cleanup; bcopy(cp1, cp, INT16SZ); cp += INT16SZ; cp1 += INT16SZ; @@ -1371,7 +1398,7 @@ /* copy preference */ buflen -= INT16SZ; if (buflen < 0) - return (-1); + goto cleanup; bcopy(cp1, cp, INT16SZ); cp += INT16SZ; cp1 += INT16SZ; @@ -1382,7 +1409,7 @@ n = *cp1++; buflen -= n + 1; if (buflen < 0) - return (-1); + goto cleanup; dprintf(1, (ddt, "size of n at flags = %d\n", n)); *cp++ = n; bcopy(cp1,cp,n); @@ -1395,7 +1422,7 @@ n = *cp1++; buflen -= n + 1; if (buflen < 0) - return (-1); + goto cleanup; *cp++ = n; bcopy(cp1,cp,n); cp += n; @@ -1407,7 +1434,7 @@ n = *cp1++; buflen -= n + 1; if (buflen < 0) - return (-1); + goto cleanup; *cp++ = n; bcopy(cp1,cp,n); cp += n; @@ -1420,7 +1447,7 @@ n = dn_comp((char *)cp1, cp, buflen, dnptrs, edp); dprintf(1, (ddt, "dn_comp's n = %u\n", n)); if (n < 0) - return (-1); + goto cleanup; cp += n; /* save data length */ @@ -1438,7 +1465,7 @@ cp1 = dp->d_data; if ((buflen -= INT16SZ) < 0) - return (-1); + goto cleanup; /* copy preference */ bcopy(cp1, cp, INT16SZ); @@ -1448,7 +1475,7 @@ if (type == T_SRV) { buflen -= INT16SZ*2; if (buflen < 0) - return (-1); + goto cleanup; bcopy(cp1, cp, INT16SZ*2); cp += INT16SZ*2; cp1 += INT16SZ*2; @@ -1456,7 +1483,7 @@ n = dn_comp((char *)cp1, cp, buflen, dnptrs, edp); if (n < 0) - return (-1); + goto cleanup; cp += n; /* save data length */ @@ -1470,7 +1497,7 @@ cp1 = dp->d_data; if ((buflen -= INT16SZ) < 0) - return (-1); + goto cleanup; /* copy preference */ bcopy(cp1, cp, INT16SZ); @@ -1479,13 +1506,13 @@ n = dn_comp((char *)cp1, cp, buflen, dnptrs, edp); if (n < 0) - return (-1); + goto cleanup; cp += n; buflen -= n; cp1 += strlen((char *)cp1) + 1; n = dn_comp((char *)cp1, cp, buflen, dnptrs, edp); if (n < 0) - return (-1); + goto cleanup; cp += n; /* save data length */ @@ -1500,7 +1527,7 @@ /* first just copy over the type_covered, algorithm, */ /* labels, orig ttl, two timestamps, and the footprint */ if ((dp->d_size - 18) > buflen) - return (-1); /* out of room! */ + goto cleanup; bcopy( cp1, cp, 18 ); cp += 18; cp1 += 18; @@ -1509,7 +1536,7 @@ /* then the signer's name */ n = dn_comp((char *)cp1, cp, buflen, NULL, NULL); if (n < 0) - return (-1); + goto cleanup; cp += n; buflen -= n; cp1 += strlen((char*)cp1)+1; @@ -1517,7 +1544,7 @@ /* finally, we copy over the variable-length signature */ n = dp->d_size - (u_int16_t)((cp1 - dp->d_data)); if (n > buflen) - return (-1); /* out of room! */ + goto cleanup; bcopy(cp1, cp, n); cp += n; @@ -1528,12 +1555,19 @@ default: if (dp->d_size > buflen) - return (-1); + goto cleanup; bcopy(dp->d_data, cp, dp->d_size); PUTSHORT((u_int16_t)dp->d_size, sp); cp += dp->d_size; } return (cp - buf); + + cleanup: + /* Rollback RR. */ + ns_name_rollback(buf, (const u_char **)dnptrs, + (const u_char **)(dnptrs + + sizeof dnptrs / sizeof dnptrs[0])); + return (-1); } #if defined(__STDC__) || defined(__GNUC__) @@ -1649,6 +1683,11 @@ dprintf(5, (ddt, "addinfo: not enough room, remaining msglen = %d\n", save_msglen)); + /* Rollback RRset. */ + ns_name_rollback(save_cp, + (const u_char **)dnptrs, + (const u_char **)(dnptrs + + sizeof dnptrs / sizeof dnptrs[0])); cp = save_cp; msglen = save_msglen; count = save_count; 2.7/common/PaxHeaders.17043/039_sudo.patch01004440001756001161000000000036072454051600015036xustar0030 atime=1783509427.808696221 2.7/common/039_sudo.patch010044400017560011610000000023050724540516000142030ustar00ssyncsyncFix a buffer overflow in sudo. Apply by doing: cd /usr/src; patch -p0 < 039_sudo.patch And rebuild sudo by doing: cd usr.bin/sudo make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper depend make -f Makefile.bsd-wrapper make -f Makefile.bsd-wrapper install Index: usr.bin/sudo/logging.c =================================================================== RCS file: /cvs/src/usr.bin/sudo/logging.c,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- usr.bin/sudo/logging.c 2000/03/27 03:44:38 1.2 +++ usr.bin/sudo/logging.c 2001/02/19 15:13:42 1.3 @@ -112,7 +112,8 @@ /* * Log the full line, breaking into multiple syslog(3) calls if necessary */ - for (p = msg, count = 0; count < strlen(msg) / MAXSYSLOGLEN + 1; count++) { + for (p = msg, count = 0; *p && count < strlen(msg) / MAXSYSLOGLEN + 1; + count++) { if (strlen(p) > MAXSYSLOGLEN) { /* * Break up the line into what will fit on one syslog(3) line @@ -135,7 +136,7 @@ *tmp = save; /* restore saved character */ /* Eliminate leading whitespace */ - for (p = tmp; *p != ' '; p++) + for (p = tmp; *p != ' ' && *p !='\0'; p++) ; } else { if (count == 0) 2.7/common/PaxHeaders.17043/040_readline.patch01004440001756001161000000000036072550563600015644xustar0030 atime=1783509427.808696221 2.7/common/040_readline.patch010044400017560011610000000036130725505636000150140ustar00ssyncsyncOpen history files with a restrictive mode (user read/write only). Do not read/write history files in '.' if $HOME is not set. Apply by doing: cd /usr/src patch -p0 < 040_readline.patch And rebuild binutils by doing: cd /usr/src/gnu/usr.bin/binutils make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper depend make -f Makefile.bsd-wrapper make -f Makefile.bsd-wrapper install Index: gnu/usr.bin/binutils/readline/history.c =================================================================== RCS file: /cvs/src/gnu/usr.bin/binutils/readline/history.c,v retrieving revision 1.2 diff -u -r1.2 history.c --- gnu/usr.bin/binutils/readline/history.c 1996/11/23 03:53:32 1.2 +++ gnu/usr.bin/binutils/readline/history.c 2001/03/18 01:17:12 @@ -464,7 +464,7 @@ home = getenv ("HOME"); if (!home) - home = "."; + return (NULL); return_val = (char *)xmalloc (2 + strlen (home) + strlen (".history")); @@ -499,8 +499,10 @@ int file, current_line; struct stat finfo; - input = history_filename (filename); - file = open (input, O_RDONLY, 0666); + if ((input = history_filename (filename))) + file = open (input, O_RDONLY, 0666); + else + file = -1; if ((file < 0) || (stat (input, &finfo) == -1)) @@ -584,7 +586,7 @@ struct stat finfo; filename = history_filename (fname); - if (stat (filename, &finfo) == -1) + if (!filename || stat (filename, &finfo) == -1) goto truncate_exit; file = open (filename, O_RDONLY, 0666); @@ -621,7 +623,7 @@ break; } - file = open (filename, O_WRONLY | O_TRUNC | O_CREAT, 0666); + file = open (filename, O_WRONLY | O_TRUNC | O_CREAT, 0600); if (file == -1) goto truncate_exit; @@ -656,7 +658,7 @@ else mode = O_WRONLY | O_APPEND; - if ((file = open (output, mode, 0666)) == -1) + if (!output || (file = open (output, mode, 0600)) == -1) { if (output) free (output); 2.7/PaxHeaders.17043/hp30000407550001756001161000000000036101675603350011750xustar0030 atime=1783509427.808696221 2.7/hp300004075500017560011610000000000001016756033500111105ustar00ssyncsync2.7/PaxHeaders.17043/i38600407550001756001161000000000036101675610500011602xustar0030 atime=1783509427.808696221 2.7/i386004075500017560011610000000000001016756105000107425ustar00ssyncsync2.7/i386/PaxHeaders.17043/011_an.patch01004440001756001161000000000036071230625400013645xustar0030 atime=1783509427.808696221 2.7/i386/011_an.patch010044400017560011610000000031510712306254000130120ustar00ssyncsync- Fix an off-by-one error that caused uvm_fault when changing the config with ancontrol(8). - Do not allow regular users to change the configuration of the device. Apply by doing: cd /usr/src patch -p0 < 011_an.patch And then rebuild your kernel. Index: sys/dev/ic/an.c =================================================================== RCS file: /cvs/src/sys/dev/ic/an.c,v retrieving revision 1.2 retrieving revision 1.4 diff -u -r1.2 -r1.4 --- sys/dev/ic/an.c 2000/04/06 04:01:49 1.2 +++ sys/dev/ic/an.c 2000/06/18 03:56:07 1.4 @@ -1,4 +1,4 @@ -/* $OpenBSD: an.c,v 1.2 2000/04/06 04:01:49 mickey Exp $ */ +/* $OpenBSD: an.c,v 1.4 2000/06/18 03:56:07 aaron Exp $ */ /* * Copyright (c) 1997, 1998, 1999 @@ -97,6 +97,7 @@ #include #include #include +#include #include #include #ifdef ANCACHE @@ -797,7 +798,7 @@ case AN_RID_GENCONFIG: cfg = (struct an_ltv_genconfig *)areq; - ifa = ifnet_addrs[ifp->if_index - 1]; + ifa = ifnet_addrs[ifp->if_index]; sdl = (struct sockaddr_dl *)ifa->ifa_addr; bcopy((char *)&cfg->an_macaddr, (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN); @@ -879,6 +880,7 @@ struct an_softc *sc; struct an_req areq; struct ifreq *ifr; + struct proc *p = curproc; struct ifaddr *ifa = (struct ifaddr *)data; s = splimp(); @@ -960,6 +962,9 @@ error = copyout(&areq, ifr->ifr_data, sizeof(areq)); break; case SIOCSAIRONET: + error = suser(p->p_ucred, &p->p_acflag); + if (error) + break; error = copyin(ifr->ifr_data, &areq, sizeof(areq)); if (error) break; 2.7/i386/PaxHeaders.17043/014_pcvt.patch01004440001756001161000000000036071302765400014233xustar0030 atime=1783509427.808696221 2.7/i386/014_pcvt.patch010044400017560011610000000063450713027654000134100ustar00ssyncsyncThis is version 2 of this patch. Version one still had a few bugs in it. The PC console driver (PCVT) has two bugs. Display problems can result if reverse video mode is turned on or off twice in a row. This patch also fixes a problem with scrolling region handling that has been seen by many users trying to use the BitchX irc client with the screen program. Apply by doing: cd /usr/src patch -p0 < 014_pcvt.patch And then rebuild your kernel. Index: sys/arch/i386/isa/pcvt/pcvt_out.c =================================================================== RCS file: /cvs/src/sys/arch/i386/isa/pcvt/pcvt_out.c,v retrieving revision 1.21 retrieving revision 1.25 diff -u -r1.21 -r1.25 --- sys/arch/i386/isa/pcvt/pcvt_out.c 2000/04/09 20:21:30 1.21 +++ sys/arch/i386/isa/pcvt/pcvt_out.c 2000/07/05 03:10:34 1.25 @@ -1,4 +1,4 @@ -/* $OpenBSD: pcvt_out.c,v 1.21 2000/04/09 20:21:30 aaron Exp $ */ +/* $OpenBSD: pcvt_out.c,v 1.25 2000/07/05 03:10:34 aaron Exp $ */ /* * Copyright (c) 1992, 1995 Hellmuth Michaelis and Joerg Wunsch. @@ -216,12 +216,10 @@ } if(svsp->lnm) { svsp->cur_offset -= svsp->col; - svsp->cur_offset += svsp->maxcol; svsp->col = 0; } - else { - svsp->cur_offset += svsp->maxcol; - } + svsp->row = svsp->cur_offset / svsp->maxcol; + svsp->cur_offset += svsp->maxcol; check_scroll(svsp); break; @@ -358,6 +356,7 @@ if (svsp->lastchar && svsp->m_awm && (svsp->lastrow == svsp->row)) { + svsp->row = svsp->cur_offset / svsp->maxcol; svsp->cur_offset++; svsp->col = 0; svsp->lastchar = 0; @@ -1304,7 +1303,7 @@ { /* we write within scroll region */ - if(svsp->cur_offset >= ((svsp->scrr_end + 1) * svsp->maxcol)) + if(svsp->row == svsp->scrr_end) { /* the following piece of code has to be protected */ /* from trying to switch to another virtual screen */ Index: sys/arch/i386/isa/pcvt/pcvt_vtf.c =================================================================== RCS file: /cvs/src/sys/arch/i386/isa/pcvt/pcvt_vtf.c,v retrieving revision 1.15 retrieving revision 1.16 diff -u -r1.15 -r1.16 --- sys/arch/i386/isa/pcvt/pcvt_vtf.c 2000/04/12 13:20:41 1.15 +++ sys/arch/i386/isa/pcvt/pcvt_vtf.c 2000/05/31 23:31:42 1.16 @@ -1,4 +1,4 @@ -/* $OpenBSD: pcvt_vtf.c,v 1.15 2000/04/12 13:20:41 aaron Exp $ */ +/* $OpenBSD: pcvt_vtf.c,v 1.16 2000/05/31 23:31:42 aaron Exp $ */ /* * Copyright (c) 1992, 1995 Hellmuth Michaelis and Joerg Wunsch. @@ -182,8 +182,7 @@ break; case 7: /* reverse */ - svsp->vtsgr |= VT_INVERSE; - if (pcdisp) { + if (pcdisp && !(svsp->vtsgr & VT_INVERSE)) { if ((setcolor >> 8) == 0) setcolor = (FG_LIGHTGREY << 8); setcolor = (((setcolor >> 8) & 0x88) | @@ -191,6 +190,7 @@ ((setcolor >> 8) << 4)) & 0x77)) << 8; colortouched = 1; } + svsp->vtsgr |= VT_INVERSE; break; case 22: /* not bold */ @@ -218,13 +218,13 @@ break; case 27: /* not reverse */ - svsp->vtsgr &= ~VT_INVERSE; - if (pcdisp) { + if (pcdisp && (svsp->vtsgr & VT_INVERSE)) { setcolor = (((setcolor >> 8) & 0x88) | ((((setcolor >> 8) >> 4) | ((setcolor >> 8) << 4)) & 0x77)) << 8; colortouched = 1; } + svsp->vtsgr &= ~VT_INVERSE; break; case 30: /* foreground colors */ 2.7/i386/PaxHeaders.17043/015_ste.patch01004440001756001161000000000036071275551400014055xustar0030 atime=1783509427.808696221 2.7/i386/015_ste.patch010044400017560011610000000021130712755514000132170ustar00ssyncsyncThe ste(4) driver supporting Ethernet cards based on the Sundance ST201 chipset (i.e., the D-Link 550TX) has a bug which causes the machine to panic at boot-time. Apply by doing: cd /usr/src patch -p0 < 015_ste.patch And then rebuild your kernel. Index: sys/dev/pci/if_ste.c =================================================================== RCS file: /cvs/src/sys/dev/pci/if_ste.c,v retrieving revision 1.6 retrieving revision 1.7 diff -u -r1.6 -r1.7 --- sys/dev/pci/if_ste.c 2000/02/15 02:28:15 1.6 +++ sys/dev/pci/if_ste.c 2000/06/27 20:09:42 1.7 @@ -1,4 +1,4 @@ -/* $OpenBSD: if_ste.c,v 1.6 2000/02/15 02:28:15 jason Exp $ */ +/* $OpenBSD: if_ste.c,v 1.7 2000/06/27 20:09:42 aaron Exp $ */ /* * Copyright (c) 1997, 1998, 1999 * Bill Paul . All rights reserved. @@ -1101,6 +1101,7 @@ cd = &sc->ste_cdata; ld = sc->ste_ldata; for (i = 0; i < STE_TX_LIST_CNT; i++) { + cd->ste_tx_chain[i].ste_ptr = &ld->ste_tx_list[i]; cd->ste_tx_chain[i].ste_phys = vtophys(&ld->ste_tx_list[i]); if (i == (STE_TX_LIST_CNT - 1)) cd->ste_tx_chain[i].ste_next = 2.7/i386/PaxHeaders.17043/016_xlhash.patch01004440001756001161000000000036071275551400014552xustar0030 atime=1783509427.808696221 2.7/i386/016_xlhash.patch010044400017560011610000000011640712755514000137210ustar00ssyncsyncxl multicast setup is incorrect (affects IPV6 and anything else that depends on multicast filters). Apply by doing: cd /usr/src patch -p0 < 016_xlhash.patch And then rebuild your kernel. Index: sys/dev/ic/xl.c =================================================================== RCS file: /cvs/src/sys/dev/ic/xl.c,v retrieving revision 1.2 diff -u -r1.2 xl.c --- sys/dev/ic/xl.c 2000/04/18 14:32:49 1.2 +++ sys/dev/ic/xl.c 2000/07/02 17:48:57 @@ -673,6 +673,7 @@ goto allmulti; } h = xl_calchash(enm->enm_addrlo); + CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_HASH|h); mcnt++; ETHER_NEXT_MULTI(step, enm); } 2.7/PaxHeaders.17043/m68k00407550001756001161000000000036101675603350011703xustar0030 atime=1783509427.808696221 2.7/m68k004075500017560011610000000000001016756033500110435ustar00ssyncsync2.7/PaxHeaders.17043/pmax00407550001756001161000000000036101675610460012063xustar0030 atime=1783509427.808696221 2.7/pmax004075500017560011610000000000001016756104600112235ustar00ssyncsync2.7/pmax/PaxHeaders.17043/020_pmax_msgbuf.patch01004440001756001161000000000036071322631400016032xustar0030 atime=1783509427.808696221 2.7/pmax/020_pmax_msgbuf.patch010044400017560011610000000066720713226314000152120ustar00ssyncsyncThe code for handling the messages buffer wasn't up to date in the 2.7 source. Access to /kern/msgbuf would hang the system and dmesg would just fail with illegal address. This patch fixes both problems. Apply by doing: cd /usr/src patch -p0 < 020_pmax_msgbuf.patch And then rebuild your kernel. Index: sys/arch/pmax/include/param.h =================================================================== RCS file: /cvs/src/sys/arch/pmax/include/param.h,v retrieving revision 1.8 retrieving revision 1.9 diff -u -r1.8 -r1.9 --- sys/arch/pmax/include/param.h 1997/06/10 14:19:01 1.8 +++ sys/arch/pmax/include/param.h 2000/07/04 05:46:23 1.9 @@ -1,3 +1,4 @@ +/* $OpenBSD: param.h,v 1.9 2000/07/04 05:46:23 maja Exp $ */ /* $NetBSD: param.h,v 1.18 1997/02/26 01:45:41 jonathan Exp $ */ /* @@ -104,6 +105,8 @@ #define NMBCLUSTERS 1024 /* map size, max cluster allocation */ #endif #endif + +#define MSGBUFSIZE NBPG #ifdef _KERNEL #ifndef _LOCORE Index: sys/arch/pmax/pmax/machdep.c =================================================================== RCS file: /cvs/src/sys/arch/pmax/pmax/machdep.c,v retrieving revision 1.23 retrieving revision 1.24 diff -u -r1.23 -r1.24 --- sys/arch/pmax/pmax/machdep.c 2000/03/23 09:59:55 1.23 +++ sys/arch/pmax/pmax/machdep.c 2000/07/04 05:46:23 1.24 @@ -1,3 +1,4 @@ +/* $OpenBSD: machdep.c,v 1.24 2000/07/04 05:46:23 maja Exp $ */ /* $NetBSD: machdep.c,v 1.67 1996/10/23 20:04:40 mhitch Exp $ */ /* @@ -147,7 +148,6 @@ #else int bufpages = 0; #endif -int msgbufmapped = 0; /* set when safe to use msgbuf */ int maxmem; /* max memory per process */ int physmem; /* max supported memory, changes to actual */ int physmem_boardmax; /* {model,simm}-specific bound on physmem */ @@ -678,10 +678,10 @@ /* * Initialize error message buffer (at end of core). */ - maxmem -= btoc(sizeof (struct msgbuf)); + maxmem -= btoc(MSGBUFSIZE); msgbufp = (struct msgbuf *)(MIPS_PHYS_TO_KSEG0(maxmem << PGSHIFT)); - msgbufmapped = 1; - + initmsgbuf((caddr_t)msgbufp, round_page(MSGBUFSIZE)); + /* * Allocate space for system data structures. * The first available kernel virtual address is in "v". @@ -792,6 +792,11 @@ pmapdebug = 0; #endif + for (i = 0; i < btoc(MSGBUFSIZE); i++) + pmap_enter(pmap_kernel(), (vm_offset_t)msgbufp, + maxmem + i * NBPG, VM_PROT_READ|VM_PROT_WRITE, TRUE, + VM_PROT_READ|VM_PROT_WRITE); + /* * Good {morning,afternoon,evening,night}. */ @@ -1195,6 +1200,7 @@ dumpsys() { int error; + extern int msgbufmapped; /* Save registers. */ savectx((struct user *)&dumppcb, 0); Index: sys/arch/pmax/pmax/mem.c =================================================================== RCS file: /cvs/src/sys/arch/pmax/pmax/mem.c,v retrieving revision 1.8 retrieving revision 1.9 diff -u -r1.8 -r1.9 --- sys/arch/pmax/pmax/mem.c 1999/11/22 19:22:01 1.8 +++ sys/arch/pmax/pmax/mem.c 2000/07/04 05:46:23 1.9 @@ -1,3 +1,4 @@ +/* $OpenBSD: mem.c,v 1.9 2000/07/04 05:46:23 maja Exp $ */ /* $NetBSD: mem.c,v 1.7 1995/09/29 21:53:29 jonathan Exp $ */ /* @@ -129,8 +130,9 @@ c = min(iov->iov_len, MAXPHYS); if (v < MIPS_KSEG0_START) return (EFAULT); - if (v + c > MIPS_PHYS_TO_KSEG0(avail_end + - sizeof (struct msgbuf)) && + if (v + c > MIPS_PHYS_TO_KSEG0(avail_end) && + !((caddr_t)v >= (caddr_t)msgbufp && + (caddr_t)v < (caddr_t)msgbufp+MSGBUFSIZE) && (v < MIPS_KSEG2_START || !kernacc((caddr_t)v, c, uio->uio_rw == UIO_READ ? B_READ : B_WRITE))) 2.7/PaxHeaders.17043/ports00407550001756001161000000000036101675610470012266xustar0030 atime=1783509427.808696221 2.7/ports004075500017560011610000000000001016756104700114265ustar00ssyncsync2.7/ports/PaxHeaders.17043/017_screen.patch01004440001756001161000000000036071772161600015222xustar0030 atime=1783509427.808696221 2.7/ports/017_screen.patch010044400017560011610000000031630717721616000143720ustar00ssyncsyncApply by doing: If the unpatched screen is already installed: cd /usr/ports/misc/screen make deinstall Otherwise start here: cd /usr/ports patch -p0 < 017_screen.patch cd misc/screen make clean make install Index: misc/screen/Makefile =================================================================== RCS file: /cvs/ports/misc/screen/Makefile,v retrieving revision 1.19 diff -u -r1.19 Makefile --- misc/screen/Makefile 2000/03/24 22:11:50 1.19 +++ misc/screen/Makefile 2000/07/03 18:22:59 @@ -1,6 +1,7 @@ -# $OpenBSD: Makefile,v 1.19 2000/03/24 22:11:50 espie Exp $ +# $OpenBSD: Makefile,v 1.22 2000/06/23 18:59:39 brad Exp $ DISTNAME= screen-3.9.5 +PKGNAME= screen-3.9.5p1 CATEGORIES= misc NEED_VERSION= 1.218 MASTER_SITES= ftp://ftp.uni-erlangen.de/pub/utilities/screen/ \ @@ -20,6 +21,8 @@ FAKE= Yes post-install: + @rm -f ${PREFIX}/bin/screen + @cd ${PREFIX}/bin; ln -sf screen-3.9.5 screen ${INSTALL_DATA_DIR} ${PREFIX}/lib/screen ${INSTALL_DATA} ${WRKSRC}/etc/etcscreenrc ${PREFIX}/lib/screen/screenrc ${INSTALL_DATA} ${WRKSRC}/terminfo/screencap ${PREFIX}/lib/screen Index: misc/screen/pkg/PLIST =================================================================== RCS file: /cvs/ports/misc/screen/pkg/PLIST,v retrieving revision 1.7 diff -u -r1.7 PLIST --- misc/screen/pkg/PLIST 2000/05/10 21:54:47 1.7 +++ misc/screen/pkg/PLIST 2000/07/03 18:23:00 @@ -1,6 +1,6 @@ +@comment $OpenBSD: PLIST,v 1.10 2000/06/23 18:59:40 brad Exp $ +bin/screen bin/screen-3.9.5 -@exec ln -sf %B%f %B/screen -@unexec rm -f %B/screen man/man1/screen.1 @unexec install-info --delete %D/info/screen.info %D/info/dir info/screen.info 2.7/PaxHeaders.17043/powerpc00407550001756001161000000000036101675603350012575xustar0030 atime=1783509427.808696221 2.7/powerpc004075500017560011610000000000001016756033500117355ustar00ssyncsync2.7/PaxHeaders.17043/sparc00407550001756001161000000000036101675610460012226xustar0030 atime=1783509427.808696221 2.7/sparc004075500017560011610000000000001016756104600113665ustar00ssyncsync2.7/sparc/PaxHeaders.17043/034_zsconsole.patch01004440001756001161000000000036072027163600015716xustar0030 atime=1783509427.808696221 2.7/sparc/034_zsconsole.patch010044400017560011610000000011370720271636000150650ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 034_zsconsole.patch And then rebuild your kernel. Index: sys/arch/sparc/dev/zs.c =================================================================== RCS file: /cvs/src/sys/arch/sparc/dev/zs.c,v retrieving revision 1.22 retrieving revision 1.22.6.1 diff -u -r1.22 -r1.22.6.1 --- sys/arch/sparc/dev/zs.c 1999/09/20 02:49:25 1.22 +++ sys/arch/sparc/dev/zs.c 2000/11/10 20:19:25 1.22.6.1 @@ -948,7 +948,7 @@ #endif ienab_bis(IE_ZSSOFT); } - return (intflags & ZSHARD_WAS_SERVICED); + return (intflags & ZSHARD_WAS_SERVICED) ? 1 : -1 /* XXX */; } static int 2.7/sparc/PaxHeaders.17043/036_qe.patch01004440001756001161000000000036072051535600014306xustar0030 atime=1783509427.818688377 2.7/sparc/036_qe.patch010044400017560011610000000250720720515356000134610ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 036_qe.patch And then re-config(8) and rebuild your kernel. Index: sys/arch/sparc/conf/files.sparc =================================================================== RCS file: /cvs/src/sys/arch/sparc/conf/files.sparc,v retrieving revision 1.35 retrieving revision 1.38 diff -u -r1.35 -r1.38 --- sys/arch/sparc/conf/files.sparc 1999/11/08 15:36:10 1.35 +++ sys/arch/sparc/conf/files.sparc 2000/11/16 15:47:56 1.38 @@ -112,7 +112,7 @@ attach be at qec file arch/sparc/dev/be.c be -device qe: ifnet, ether +device qe: ifnet, ether, ifmedia attach qe at qec file arch/sparc/dev/qe.c qe Index: sys/arch/sparc/dev/qe.c =================================================================== RCS file: /cvs/src/sys/arch/sparc/dev/qe.c,v retrieving revision 1.8 retrieving revision 1.13 diff -u -r1.8 -r1.13 --- sys/arch/sparc/dev/qe.c 1999/12/08 22:46:10 1.8 +++ sys/arch/sparc/dev/qe.c 2000/11/17 17:38:32 1.13 @@ -1,7 +1,7 @@ -/* $OpenBSD: qe.c,v 1.8 1999/12/08 22:46:10 jason Exp $ */ +/* $OpenBSD: qe.c,v 1.13 2000/11/17 17:38:32 jason Exp $ */ /* - * Copyright (c) 1998 Jason L. Wright. + * Copyright (c) 1998, 2000 Jason L. Wright. * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -50,6 +50,7 @@ #include #include #include +#include #include #ifdef INET @@ -96,6 +97,8 @@ void qe_read __P((struct qesoftc *, int, int)); struct mbuf * qe_get __P((struct qesoftc *, int, int)); void qe_mcreset __P((struct qesoftc *)); +void qe_ifmedia_sts __P((struct ifnet *, struct ifmediareq *)); +int qe_ifmedia_upd __P((struct ifnet *)); struct cfdriver qe_cd = { NULL, "qe", DV_IFNET @@ -163,6 +166,12 @@ ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST; + ifmedia_init(&sc->sc_ifmedia, IFM_IMASK, + qe_ifmedia_upd, qe_ifmedia_sts); + ifmedia_add(&sc->sc_ifmedia, + IFM_MAKEWORD(IFM_ETHER, IFM_10_T, 0, 0), 0, NULL); + ifmedia_set(&sc->sc_ifmedia, IFM_ETHER | IFM_10_T); + /* Attach the interface. */ if_attach(ifp); ether_ifattach(ifp); @@ -248,17 +257,21 @@ { struct qe_cregs *cr = sc->sc_cr; struct qe_mregs *mr = sc->sc_mr; - int tries; + int n; - tries = 200; mr->biucc = QE_MR_BIUCC_SWRST; - while ((mr->biucc & QE_MR_BIUCC_SWRST) && --tries) + for (n = 200; n > 0; n--) { + if ((mr->biucc & QE_MR_BIUCC_SWRST) == 0) + break; DELAY(20); + } - tries = 200; cr->ctrl = QE_CR_CTRL_RESET; - while ((cr->ctrl & QE_CR_CTRL_RESET) && --tries) + for (n = 200; n > 0; n--) { + if ((cr->ctrl & QE_CR_CTRL_RESET) == 0) + break; DELAY(20); + } } /* @@ -268,12 +281,8 @@ qereset(sc) struct qesoftc *sc; { - int s; - - s = splnet(); qestop(sc); qeinit(sc); - splx(s); } void @@ -281,11 +290,14 @@ struct ifnet *ifp; { struct qesoftc *sc = ifp->if_softc; + int s; log(LOG_ERR, "%s: device timeout\n", sc->sc_dev.dv_xname); ++sc->sc_arpcom.ac_if.if_oerrors; + s = splnet(); qereset(sc); + splx(s); } /* @@ -422,7 +434,6 @@ rst = 1; } - if (why & QE_CR_STAT_LCOLL) { printf("%s: late tx transmission\n", sc->sc_dev.dv_xname); ifp->if_oerrors++; @@ -637,12 +648,6 @@ qestop(sc); qeinit(sc); } -#ifdef IEDEBUG - if (ifp->if_flags & IFF_DEBUG) - sc->sc_debug = IED_ALL; - else - sc->sc_debug = 0; -#endif break; case SIOCADDMULTI: @@ -656,10 +661,15 @@ * Multicast list has changed; set the hardware filter * accordingly. */ - qe_mcreset(sc); + if (ifp->if_flags & IFF_UP) + qeinit(sc); error = 0; } break; + case SIOCGIFMEDIA: + case SIOCSIFMEDIA: + error = ifmedia_ioctl(ifp, ifr, &sc->sc_ifmedia, cmd); + break; default: if ((error = ether_ioctl(ifp, &sc->sc_arpcom, cmd, data)) > 0) { splx(s); @@ -683,29 +693,30 @@ int s = splimp(); int i; + qestop(sc); + /* * Allocate descriptor ring and buffers, if not already done */ if (sc->sc_desc == NULL) sc->sc_desc_dva = (struct qe_desc *) dvma_malloc( sizeof(struct qe_desc), &sc->sc_desc, M_NOWAIT); + bzero(sc->sc_desc, sizeof(struct qe_desc)); + if (sc->sc_bufs == NULL) sc->sc_bufs_dva = (struct qe_bufs *) dvma_malloc( sizeof(struct qe_bufs), &sc->sc_bufs, M_NOWAIT); - - for (i = 0; i < QE_TX_RING_MAXSIZE; i++) { + bzero(sc->sc_bufs, sizeof(struct qe_bufs)); + + for (i = 0; i < QE_TX_RING_MAXSIZE; i++) sc->sc_desc->qe_txd[i].tx_addr = (u_int32_t) &sc->sc_bufs_dva->tx_buf[i % QE_TX_RING_SIZE][0]; - sc->sc_desc->qe_txd[i].tx_flags = 0; - } for (i = 0; i < QE_RX_RING_MAXSIZE; i++) { sc->sc_desc->qe_rxd[i].rx_addr = (u_int32_t) &sc->sc_bufs_dva->rx_buf[i % QE_RX_RING_SIZE][0]; if ((i / QE_RX_RING_SIZE) == 0) sc->sc_desc->qe_rxd[i].rx_flags = QE_RXD_OWN | QE_RXD_LENGTH; - else - sc->sc_desc->qe_rxd[i].rx_flags = 0; } cr->rxds = (u_int32_t) &sc->sc_desc_dva->qe_rxd[0]; @@ -714,49 +725,55 @@ sc->sc_first_td = sc->sc_last_td = sc->sc_no_td = 0; sc->sc_last_rd = 0; - qestop(sc); - cr->rimask = 0; cr->timask = 0; cr->qmask = 0; - cr->mmask = QE_CR_MMASK_RXCOLL; - cr->rxwbufptr = cr->rxrbufptr = sc->sc_channel * qec->sc_msize; - cr->txwbufptr = cr->txrbufptr = cr->rxrbufptr + qec->sc_rsize; + cr->mmask = QE_CR_MMASK_RXCOLL | QE_CR_MMASK_CLOSS; cr->ccnt = 0; cr->pipg = 0; + cr->rxwbufptr = cr->rxrbufptr = sc->sc_channel * qec->sc_msize; + cr->txwbufptr = cr->txrbufptr = cr->rxrbufptr + qec->sc_rsize; - mr->phycc = QE_MR_PHYCC_ASEL; - mr->xmtfc = QE_MR_XMTFC_APADXMT; - mr->rcvfc = 0; - mr->imr = QE_MR_IMR_CERRM | QE_MR_IMR_RCVINTM; + /* + * When switching from mace<->qec always guarantee an sbus + * turnaround (if last op was read, perform a dummy write, and + * vice versa). + */ + i = cr->qmask; /* dummy */ + mr->biucc = QE_MR_BIUCC_BSWAP | QE_MR_BIUCC_64TS; mr->fifofc = QE_MR_FIFOCC_TXF16 | QE_MR_FIFOCC_RXF32 | QE_MR_FIFOCC_RFWU | QE_MR_FIFOCC_TFWU; + mr->xmtfc = QE_MR_XMTFC_APADXMT; + mr->rcvfc = 0; + mr->imr = QE_MR_IMR_CERRM | QE_MR_IMR_RCVINTM; + mr->phycc = QE_MR_PHYCC_ASEL; mr->plscc = QE_MR_PLSCC_TP; + qe_ifmedia_upd(ifp); + mr->iac = QE_MR_IAC_ADDRCHG | QE_MR_IAC_PHYADDR; + for (i = 100; i > 0; i--) { + if ((mr->iac & QE_MR_IAC_ADDRCHG) == 0) + break; + DELAY(2); + } mr->padr = sc->sc_arpcom.ac_enaddr[0]; mr->padr = sc->sc_arpcom.ac_enaddr[1]; mr->padr = sc->sc_arpcom.ac_enaddr[2]; mr->padr = sc->sc_arpcom.ac_enaddr[3]; mr->padr = sc->sc_arpcom.ac_enaddr[4]; mr->padr = sc->sc_arpcom.ac_enaddr[5]; - - mr->iac = QE_MR_IAC_ADDRCHG | QE_MR_IAC_LOGADDR; - for (i = 0; i < 8; i++) - mr->ladrf = 0; + qe_mcreset(sc); mr->iac = 0; - delay(50000); - if ((mr->phycc & QE_MR_PHYCC_LNKFL) == QE_MR_PHYCC_LNKFL) - printf("%s: no carrier\n", sc->sc_dev.dv_xname); - i = mr->mpc; /* cleared on read */ - qe_mcreset(sc); - ifp->if_flags |= IFF_RUNNING; ifp->if_flags &= ~IFF_OACTIVE; + + mr->maccc = QE_MR_MACCC_ENXMT | QE_MR_MACCC_ENRCV | + ((ifp->if_flags & IFF_PROMISC) ? QE_MR_MACCC_PROM : 0); splx(s); } @@ -911,19 +928,17 @@ u_int16_t hash[4]; u_int8_t octet, *ladrp = (u_int8_t *)&hash[0]; int i, j; - - if (ifp->if_flags & IFF_PROMISC) { - mr->maccc = QE_MR_MACCC_PROM | QE_MR_MACCC_ENXMT | - QE_MR_MACCC_ENRCV; - return; - } +allmulti: if (ifp->if_flags & IFF_ALLMULTI) { mr->iac = QE_MR_IAC_ADDRCHG | QE_MR_IAC_LOGADDR; + for (i = 100; i > 0; i--) { + if ((mr->iac & QE_MR_IAC_ADDRCHG) == 0) + break; + DELAY(2); + } for (i = 0; i < 8; i++) mr->ladrf = 0xff; - mr->iac = 0; - mr->maccc = QE_MR_MACCC_ENXMT | QE_MR_MACCC_ENRCV; return; } @@ -943,12 +958,8 @@ * which the range is big enough to require * all bits set.) */ - mr->iac = QE_MR_IAC_ADDRCHG | QE_MR_IAC_LOGADDR; - for (i = 0; i < 8; i++) - mr->ladrf = 0xff; - mr->iac = 0; ifp->if_flags |= IFF_ALLMULTI; - break; + goto allmulti; } crc = 0xffffffff; @@ -973,9 +984,46 @@ } mr->iac = QE_MR_IAC_ADDRCHG | QE_MR_IAC_LOGADDR; + for (i = 100; i > 0; i--) { + if ((mr->iac & QE_MR_IAC_ADDRCHG) == 0) + break; + DELAY(2); + } for (i = 0; i < 8; i++) mr->ladrf = ladrp[i]; - mr->iac = 0; +} + +void +qe_ifmedia_sts(ifp, ifmr) + struct ifnet *ifp; + struct ifmediareq *ifmr; +{ + struct qesoftc *sc = (struct qesoftc *)ifp->if_softc; + u_int8_t phycc; + + ifmr->ifm_active = IFM_ETHER | IFM_10_T; + phycc = sc->sc_mr->phycc; + if ((phycc & QE_MR_PHYCC_DLNKTST) == 0) { + ifmr->ifm_status |= IFM_AVALID; + if (phycc & QE_MR_PHYCC_LNKFL) + ifmr->ifm_status &= ~IFM_ACTIVE; + else + ifmr->ifm_status |= IFM_ACTIVE; + } +} + +int +qe_ifmedia_upd(ifp) + struct ifnet *ifp; +{ + struct qesoftc *sc = (struct qesoftc *)ifp->if_softc; + int media = sc->sc_ifmedia.ifm_media; + + if (IFM_TYPE(media) != IFM_ETHER) + return (EINVAL); + + if (IFM_SUBTYPE(media) != IFM_10_T) + return (EINVAL); - mr->maccc = QE_MR_MACCC_ENXMT | QE_MR_MACCC_ENRCV; + return (0); } Index: sys/arch/sparc/dev/qereg.h =================================================================== RCS file: /cvs/src/sys/arch/sparc/dev/qereg.h,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- sys/arch/sparc/dev/qereg.h 1999/03/12 18:56:18 1.4 +++ sys/arch/sparc/dev/qereg.h 2000/11/16 15:47:57 1.5 @@ -1,7 +1,7 @@ -/* $OpenBSD: qereg.h,v 1.4 1999/03/12 18:56:18 jason Exp $ */ +/* $OpenBSD: qereg.h,v 1.5 2000/11/16 15:47:57 jason Exp $ */ /* - * Copyright (c) 1998 Jason L. Wright. + * Copyright (c) 1998, 2000 Jason L. Wright. * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -255,6 +255,7 @@ /* qe_mregs.plscc: pls config control. */ #define QE_MR_PLSCC_XMTSEL 0x08 /* tx mode select */ +#define QE_MR_PLSCC_PORTMASK 0x06 /* media mask */ #define QE_MR_PLSCC_GPSI 0x06 /* use gpsi connector */ #define QE_MR_PLSCC_DAI 0x04 /* use dai connector */ #define QE_MR_PLSCC_TP 0x02 /* use twistedpair connector */ Index: sys/arch/sparc/dev/qevar.h =================================================================== RCS file: /cvs/src/sys/arch/sparc/dev/qevar.h,v retrieving revision 1.3 retrieving revision 1.4 diff -u -r1.3 -r1.4 --- sys/arch/sparc/dev/qevar.h 1999/02/24 06:57:45 1.3 +++ sys/arch/sparc/dev/qevar.h 2000/11/16 15:47:57 1.4 @@ -1,7 +1,7 @@ -/* $OpenBSD: qevar.h,v 1.3 1999/02/24 06:57:45 jason Exp $ */ +/* $OpenBSD: qevar.h,v 1.4 2000/11/16 15:47:57 jason Exp $ */ /* - * Copyright (c) 1998 Jason L. Wright. + * Copyright (c) 1998, 2000 Jason L. Wright. * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -48,4 +48,5 @@ int sc_no_td, sc_first_td, sc_last_td; int sc_last_rd; + struct ifmedia sc_ifmedia; };