./PaxHeaders.56026/3.200407550001756001161000000000036101675603350011253xustar0030 atime=1783552627.868695755 3.2004075500017560011610000000000001016756033500102525ustar00ssyncsync3.2/PaxHeaders.56026/alpha00407550001756001161000000000036101675603350012203xustar0030 atime=1783552627.868695755 3.2/alpha004075500017560011610000000000001016756033500113375ustar00ssyncsync3.2/PaxHeaders.56026/amiga00407550001756001161000000000036101675603350012174xustar0030 atime=1783552627.868695755 3.2/amiga004075500017560011610000000000001016756033500113305ustar00ssyncsync3.2/PaxHeaders.56026/common00407550001756001161000000000036101675607530012412xustar0030 atime=1783552627.868695755 3.2/common004075500017560011610000000000001016756075300115465ustar00ssyncsync3.2/common/PaxHeaders.56026/001_kadmin.patch01004440001756001161000000000036075616661600015326xustar0030 atime=1783552627.868695755 3.2/common/001_kadmin.patch010044400017560011610000000025430756166616000144730ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 001_kadmin.patch If kadmind is running, kill it: kill `cat /var/run/kadmind.pid` Rebuild and install kadmin and kadmind following these steps: cd kerberosIV/lib/sl make obj cleandir depend make cd ../../../kerberosV/lib/roken make obj cleandir depend make cd ../../libexec/kadmind make obj cleandir depend make && make install cd ../../usr.sbin/kadmin make obj cleandir depend make && make install Restart kadmind if needed: /usr/libexec/kadmind & Index: kerberosV/src/kadmin/version4.c =================================================================== RCS file: /cvs/src/kerberosV/src/kadmin/version4.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.6.1 diff -u -r1.1.1.1 -r1.1.1.1.6.1 --- kerberosV/src/kadmin/version4.c 25 May 2001 07:49:46 -0000 1.1.1.1 +++ kerberosV/src/kadmin/version4.c 4 Nov 2002 14:15:38 -0000 1.1.1.1.6.1 @@ -822,6 +822,13 @@ off += _krb5_get_int(msg + off, &rlen, 4); memset(&authent, 0, sizeof(authent)); authent.length = message.length - rlen - KADM_VERSIZE - 4; + + if(authent.length >= MAX_KTXT_LEN) { + krb5_warnx(context, "received bad rlen (%lu)", (unsigned long)rlen); + make_you_loose_packet (KADM_LENGTH_ERROR, reply); + return; + } + memcpy(authent.dat, (char*)msg + off, authent.length); off += authent.length; 3.2/common/PaxHeaders.56026/002_pfbridge.patch01004440001756001161000000000036075621367600015645xustar0030 atime=1783552627.868695755 3.2/common/002_pfbridge.patch010044400017560011610000000037230756213676000150130ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 002_pfbridge.patch And then rebuild your kernel. Index: sys/net/if_bridge.c =================================================================== RCS file: /cvs/src/sys/net/if_bridge.c,v retrieving revision 1.102 retrieving revision 1.102.2.1 diff -u -r1.102 -r1.102.2.1 --- sys/net/if_bridge.c 7 Aug 2002 18:44:39 -0000 1.102 +++ sys/net/if_bridge.c 4 Nov 2002 14:33:50 -0000 1.102.2.1 @@ -1,4 +1,4 @@ -/* $OpenBSD: if_bridge.c,v 1.102 2002/08/07 18:44:39 jason Exp $ */ +/* $OpenBSD: if_bridge.c,v 1.102.2.1 2002/11/04 14:33:50 jason Exp $ */ /* * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net) @@ -2470,7 +2470,7 @@ struct mbuf *m; { struct llc llc; - struct mbuf *m0 = m; + struct mbuf *m0; int s, len, error = 0; int hassnap = 0; #ifdef INET @@ -2507,6 +2507,9 @@ if (hassnap) m_adj(m, LLC_SNAPFRAMELEN); + if (m->m_len < sizeof(struct ip) && + (m = m_pullup(m, sizeof(struct ip))) == NULL) + goto dropit; ip = mtod(m, struct ip *); NTOHS(ip->ip_len); NTOHS(ip->ip_off); @@ -2522,7 +2525,7 @@ if (error == EMSGSIZE) goto dropit; - for (m = m0; m; m = m0) { + for (; m; m = m0) { m0 = m->m_nextpkt; m->m_nextpkt = 0; if (error == 0) { Index: sys/netinet/ip_output.c =================================================================== RCS file: /cvs/src/sys/netinet/ip_output.c,v retrieving revision 1.149 retrieving revision 1.149.2.1 diff -u -r1.149 -r1.149.2.1 --- sys/netinet/ip_output.c 24 Jun 2002 23:57:28 -0000 1.149 +++ sys/netinet/ip_output.c 4 Nov 2002 14:33:50 -0000 1.149.2.1 @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_output.c,v 1.149 2002/06/24 23:57:28 itojun Exp $ */ +/* $OpenBSD: ip_output.c,v 1.149.2.1 2002/11/04 14:33:50 jason Exp $ */ /* $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $ */ /* @@ -734,7 +734,7 @@ if (error == EMSGSIZE) goto bad; - for (m = m0; m; m = m0) { + for (; m; m = m0) { m0 = m->m_nextpkt; m->m_nextpkt = 0; if (error == 0) 3.2/common/PaxHeaders.56026/003_smrsh.patch01004440001756001161000000000036075621367600015220xustar0030 atime=1783552627.868695755 3.2/common/003_smrsh.patch010044400017560011610000000040110756213676000143550ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 003_smrsh.patch And then rebuild and install smrsh: cd gnu/usr.sbin/sendmail/libsm make obj make depend make cd ../smrsh make obj make depend make make install Index: gnu/usr.sbin/sendmail/smrsh/smrsh.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/smrsh/smrsh.c,v retrieving revision 1.9 retrieving revision 1.9.2.1 diff -u -r1.9 -r1.9.2.1 --- gnu/usr.sbin/sendmail/smrsh/smrsh.c 3 Jun 2002 17:25:47 -0000 1.9 +++ gnu/usr.sbin/sendmail/smrsh/smrsh.c 4 Nov 2002 14:29:09 -0000 1.9.2.1 @@ -57,6 +57,8 @@ #include #include #include +#include +#include #include #include #include @@ -145,6 +147,7 @@ char *newenv[2]; char pathbuf[1000]; char specialbuf[32]; + struct stat st; #ifndef DEBUG # ifndef LOG_MAIL @@ -302,6 +305,38 @@ (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "Trying %s\n", cmdbuf); #endif /* DEBUG */ + if (stat(cmdbuf, &st) < 0) + { + /* can't stat it */ + (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, + "%s: %s not available for sendmail programs (stat failed)\n", + prg, cmd); + if (p != NULL) + *p = ' '; +#ifndef DEBUG + syslog(LOG_CRIT, "uid %d: attempt to use %s (stat failed)", + (int) getuid(), cmd); +#endif /* ! DEBUG */ + exit(EX_UNAVAILABLE); + } + if (!S_ISREG(st.st_mode) +#ifdef S_ISLNK + && !S_ISLNK(st.st_mode) +#endif /* S_ISLNK */ + ) + { + /* can't stat it */ + (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, + "%s: %s not available for sendmail programs (not a file)\n", + prg, cmd); + if (p != NULL) + *p = ' '; +#ifndef DEBUG + syslog(LOG_CRIT, "uid %d: attempt to use %s (not a file)", + (int) getuid(), cmd); +#endif /* ! DEBUG */ + exit(EX_UNAVAILABLE); + } if (access(cmdbuf, X_OK) < 0) { /* oops.... crack attack possiblity */ 3.2/common/PaxHeaders.56026/004_pool.patch01004440001756001161000000000036075624075600015035xustar0030 atime=1783552627.868695755 3.2/common/004_pool.patch010044400017560011610000000023720756240756000142020ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 004_pool.patch And then rebuild your kernel. Index: sys/kern/subr_pool.c =================================================================== RCS file: /cvs/src/sys/kern/subr_pool.c,v retrieving revision 1.32 retrieving revision 1.32.2.1 diff -u -r1.32 -r1.32.2.1 --- sys/kern/subr_pool.c 23 Jul 2002 15:31:36 -0000 1.32 +++ sys/kern/subr_pool.c 4 Nov 2002 15:30:36 -0000 1.32.2.1 @@ -1,4 +1,4 @@ -/* $OpenBSD: subr_pool.c,v 1.32 2002/07/23 15:31:36 art Exp $ */ +/* $OpenBSD: subr_pool.c,v 1.32.2.1 2002/11/04 15:30:36 jason Exp $ */ /* $NetBSD: subr_pool.c,v 1.61 2001/09/26 07:14:56 chs Exp $ */ /*- @@ -1947,6 +1947,7 @@ if ((res = (*pa->pa_alloc)(org, flags)) != NULL) return (res); } + break; } s = splvm(); simple_lock(&pa->pa_slock); @@ -1961,12 +1962,15 @@ pool_allocator_free(struct pool *pp, void *v) { struct pool_allocator *pa = pp->pr_alloc; + int s; (*pa->pa_free)(pp, v); + s = splvm(); simple_lock(&pa->pa_slock); if ((pa->pa_flags & PA_WANT) == 0) { simple_unlock(&pa->pa_slock); + splx(s); return; } @@ -1978,9 +1982,9 @@ } simple_unlock(&pp->pr_slock); } - wakeup(pa); pa->pa_flags &= ~PA_WANT; simple_unlock(&pa->pa_slock); + splx(s); } /* 3.2/common/PaxHeaders.56026/005_named.patch01004440001756001161000000000036075646447600015160xustar0030 atime=1783552627.868695755 3.2/common/005_named.patch010044400017560011610000000327170756464476000143330ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 005_named.patch And then rebuild and install named: cd usr.sbin/named make obj depend make && make install Index: usr.sbin/named/Makefile =================================================================== RCS file: /cvs/src/usr.sbin/named/Makefile,v retrieving revision 1.11 diff -u -r1.11 Makefile --- usr.sbin/named/Makefile 28 Jan 2001 02:18:13 -0000 1.11 +++ usr.sbin/named/Makefile 15 Nov 2002 00:13:27 -0000 @@ -6,6 +6,6 @@ SUBDIR+= doc/bog .endif -VER= 4.9.8-REL +VER= 4.9.11-REL .include Index: usr.sbin/named/libresolv/getnetnamadr.c =================================================================== RCS file: /cvs/src/usr.sbin/named/libresolv/getnetnamadr.c,v retrieving revision 1.4 diff -u -r1.4 getnetnamadr.c --- usr.sbin/named/libresolv/getnetnamadr.c 26 Jun 2002 06:08:17 -0000 1.4 +++ usr.sbin/named/libresolv/getnetnamadr.c 15 Nov 2002 00:13:27 -0000 @@ -105,10 +105,11 @@ register int n; u_char *eom; int type, class, ancount, qdcount, haveanswer, i, nchar; - char aux1[30], aux2[30], ans[30], *in, *st, *pauxt, *bp, **ap, - *paux1 = &aux1[0], *paux2 = &aux2[0], flag = 0, *ep; -static struct netent net_entry; -static char *net_aliases[MAXALIASES], netbuf[PACKETSZ]; + char aux1[30], aux2[30], *in, *st, *pauxt, *bp, **ap, + *paux1 = &aux1[0], *paux2 = &aux2[0], *ep; + static struct netent net_entry; + static char *net_aliases[MAXALIASES], netbuf[PACKETSZ]; + static char ans[MAXDNAME]; /* * find first satisfactory answer @@ -138,8 +139,14 @@ h_errno = TRY_AGAIN; return (NULL); } - while (qdcount-- > 0) - cp += __dn_skipname(cp, eom) + QFIXEDSZ; + while (qdcount-- > 0) { + n = __dn_skipname(cp, eom); + if (n < 0 || (cp + n + QFIXEDSZ) > eom) { + h_errno = NO_RECOVERY; + return(NULL); + } + cp += n + QFIXEDSZ; + } ap = net_aliases; *ap = NULL; net_entry.n_aliases = net_aliases; @@ -150,7 +157,7 @@ break; cp += n; ans[0] = '\0'; - (void)strcpy(&ans[0], bp); + (void)strcpy(ans, bp); GETSHORT(type, cp); GETSHORT(class, cp); cp += INT32SZ; /* TTL */ @@ -162,11 +169,13 @@ return (NULL); } cp += n; - *ap++ = bp; - bp += strlen(bp) + 1; - net_entry.n_addrtype = - (class == C_IN) ? AF_INET : AF_UNSPEC; - haveanswer++; + if ((ap + 2) < &net_aliases[MAXALIASES]) { + *ap++ = bp; + bp += strlen(bp) + 1; + net_entry.n_addrtype = + (class == C_IN) ? AF_INET : AF_UNSPEC; + haveanswer++; + } } } if (haveanswer) { @@ -177,26 +186,33 @@ net_entry.n_net = 0L; break; case BYNAME: - in = *net_entry.n_aliases; - net_entry.n_name = &ans[0]; + ap = net_entry.n_aliases; + next_alias: + in = *ap++; + if (in == NULL) { + h_errno = HOST_NOT_FOUND; + return (NULL); + } + net_entry.n_name = ans; aux2[0] = '\0'; for (i = 0; i < 4; i++) { for (st = in, nchar = 0; - *st != '.'; + isdigit((unsigned char)*st); st++, nchar++) ; - if (nchar != 1 || *in != '0' || flag) { - flag = 1; - (void)strncpy(paux1, - (i==0) ? in : in-1, - (i==0) ?nchar : nchar+1); - paux1[(i==0) ? nchar : nchar+1] = '\0'; - pauxt = paux2; - paux2 = strcat(paux1, paux2); - paux1 = pauxt; - } + if (*st != '.' || nchar == 0 || nchar > 3) + goto next_alias; + if (i != 0) + nchar++; + (void)strncpy(paux1, in, nchar); + paux1[nchar] = '\0'; + pauxt = paux2; + paux2 = strcat(paux1, paux2); + paux1 = pauxt; in = ++st; } + if (strcasecmp(in, "IN-ADDR.ARPA") != 0) + goto next_alias; net_entry.n_net = inet_network(paux2); break; } Index: usr.sbin/named/named/Makefile =================================================================== RCS file: /cvs/src/usr.sbin/named/named/Makefile,v retrieving revision 1.4 diff -u -r1.4 Makefile --- usr.sbin/named/named/Makefile 11 May 2002 00:20:20 -0000 1.4 +++ usr.sbin/named/named/Makefile 15 Nov 2002 00:13:27 -0000 @@ -10,13 +10,15 @@ ns_init.c ns_main.c ns_maint.c ns_ncache.c ns_req.c ns_resp.c \ ns_sort.c ns_stats.c ns_udp.c ns_validate.c storage.c tree.c MAN= named.8 +CLEANFILES+= version.c CFLAGS+=${INCLUDE} ${CONFIG} -makeversionc: + +version.c: Version.c ${.CURDIR}/../Makefile (u=root d=`pwd` h=localhost t=`date +%c`; \ sed -e "s|%WHEN%|$${t}|" -e "s|%VERSION%|"${VER}"|" \ -e "s|%WHOANDWHERE%|$${u}@$${h}:$${d}|" \ - < ${.CURDIR}/Version.c > ${.CURDIR}/version.c) + < ${.CURDIR}/Version.c > version.c) .include .include "../../Makefile.inc" Index: usr.sbin/named/named/db_defs.h =================================================================== RCS file: /cvs/src/usr.sbin/named/named/db_defs.h,v retrieving revision 1.3 diff -u -r1.3 db_defs.h --- usr.sbin/named/named/db_defs.h 22 May 1998 00:47:31 -0000 1.3 +++ usr.sbin/named/named/db_defs.h 15 Nov 2002 00:13:27 -0000 @@ -68,7 +68,7 @@ #define INVHASHSZ 919 /* size of inverse hash table */ /* max length of data in RR data field */ -#define MAXDATA 2048 +#define MAXDATA (3*MAXDNAME + 5*INT32SZ) #define DB_ROOT_TIMBUF 3600 #define TIMBUF 300 Index: usr.sbin/named/named/ns_ncache.c =================================================================== RCS file: /cvs/src/usr.sbin/named/named/ns_ncache.c,v retrieving revision 1.4 diff -u -r1.4 ns_ncache.c --- usr.sbin/named/named/ns_ncache.c 22 May 1998 07:09:17 -0000 1.4 +++ usr.sbin/named/named/ns_ncache.c 15 Nov 2002 00:13:27 -0000 @@ -81,8 +81,8 @@ u_int16_t atype; u_char *tp = cp; u_char *cp1; - u_char data[MAXDNAME*2 + INT32SZ*5]; - size_t len = sizeof data; + u_char data[MAXDATA]; + u_char *eod = data + sizeof(data); /* we store NXDOMAIN as T_SOA regardless of the query type */ if (hp->rcode == NXDOMAIN) @@ -109,7 +109,7 @@ rdatap = tp; /* origin */ - n = dn_expand(msg, eom, tp, (char*)data, len); + n = dn_expand(msg, eom, tp, (char*)data, eod - data); if (n < 0) { dprintf(3, (ddt, "ncache: form error 2\n")); return; @@ -117,9 +117,8 @@ tp += n; n = strlen((char*)data) + 1; cp1 = data + n; - len -= n; /* mail */ - n = dn_expand(msg, msg + msglen, tp, (char*)cp1, len); + n = dn_expand(msg, msg + msglen, tp, (char*)cp1, eod - cp1); if (n < 0) { dprintf(3, (ddt, "ncache: form error 2\n")); return; @@ -127,20 +126,20 @@ tp += n; n = strlen((char*)cp1) + 1; cp1 += n; - len -= n; n = 5 * INT32SZ; + if (n > (eod - cp1)) /* Can't happen. See MAXDATA. */ + return; BOUNDS_CHECK(tp, n); bcopy(tp, cp1, n); /* serial, refresh, retry, expire, min */ cp1 += n; - len -= n; tp += n; if (tp != rdatap + dlen) { dprintf(3, (ddt, "ncache: form error 2\n")); return; } /* store the zone of the soa record */ - n = dn_expand(msg, msg + msglen, cp, (char*)cp1, len); + n = dn_expand(msg, msg + msglen, cp, (char*)cp1, eod - cp1); if (n < 0) { dprintf(3, (ddt, "ncache: form error 2\n")); return; Index: usr.sbin/named/named/ns_req.c =================================================================== RCS file: /cvs/src/usr.sbin/named/named/ns_req.c,v retrieving revision 1.10 diff -u -r1.10 ns_req.c --- usr.sbin/named/named/ns_req.c 28 May 2002 01:23:13 -0000 1.10 +++ usr.sbin/named/named/ns_req.c 15 Nov 2002 00:13:27 -0000 @@ -1526,7 +1526,7 @@ /* first just copy over the type_covered, algorithm, */ /* labels, orig ttl, two timestamps, and the footprint */ - if ((dp->d_size - 18) > buflen) + if (buflen < 18) goto cleanup; bcopy( cp1, cp, 18 ); cp += 18; Index: usr.sbin/named/named/ns_resp.c =================================================================== RCS file: /cvs/src/usr.sbin/named/named/ns_resp.c,v retrieving revision 1.8 diff -u -r1.8 ns_resp.c --- usr.sbin/named/named/ns_resp.c 9 Jun 2002 01:27:29 -0000 1.8 +++ usr.sbin/named/named/ns_resp.c 15 Nov 2002 00:13:27 -0000 @@ -1676,7 +1676,7 @@ * to BOUNDS_CHECK() here. */ cp1 += (n = strlen((char *)cp1) + 1); - n1 = sizeof(data) - n; + n1 = sizeof(data) - n - INT16SZ; n = dn_expand(msg, eom, cp, (char *)cp1, n1); if (n < 0) { hp->rcode = FORMERR; @@ -1694,7 +1694,7 @@ break; case T_SIG: { - u_long origTTL, exptime, signtime, timetilexp, now; + u_int32_t origTTL, exptime, signtime, timetilexp, now; /* Check signature time, expiration, and adjust TTL. */ /* This code is similar to that in db_load.c. */ @@ -1715,8 +1715,18 @@ ttl = origTTL; } + /* + * Check that expire and signature times are internally + * consistant. + */ + if (!SEQ_GT(exptime, signtime) && exptime != signtime) { + dprintf(3, (ddt, + "ignoring SIG: signature expires before it was signed")); + return ((cp - rrp) + dlen); + } + /* Don't let bogus signers "sign" in the future. */ - if (signtime > now) { + if (SEQ_GT(signtime, now)) { dprintf(3, (ddt, "ignoring SIG: signature date %s is in the future\n", p_secstodate (signtime))); @@ -1724,7 +1734,7 @@ } /* Ignore received SIG RR's that are already expired. */ - if (exptime <= now) { + if (SEQ_GT(exptime, now)) { dprintf(3, (ddt, "ignoring SIG: expiration %s is in the past\n", p_secstodate (exptime))); Index: usr.sbin/named/named/ns_udp.c =================================================================== RCS file: /cvs/src/usr.sbin/named/named/ns_udp.c,v retrieving revision 1.1 diff -u -r1.1 ns_udp.c --- usr.sbin/named/named/ns_udp.c 12 Mar 1997 10:42:36 -0000 1.1 +++ usr.sbin/named/named/ns_udp.c 15 Nov 2002 00:13:28 -0000 @@ -81,7 +81,7 @@ res = lseek(fd, offset, SEEK_SET); if (res != offset) { - dprintf(1, (ddt, "ns_udp: lseek %ul failed %lu %d\n", + dprintf(1, (ddt, "ns_udp: lseek %lu failed %lu %d\n", offset, res, errno)); goto cleanup; } @@ -97,7 +97,7 @@ sum = 1; lseek(fd, offset, SEEK_SET); if (res != offset) { - dprintf(1, (ddt, "ns_udp: lseek %ul failed %lu %d\n", + dprintf(1, (ddt, "ns_udp: lseek %lu failed %lu %d\n", offset, res, errno)); goto cleanup; } Index: usr.sbin/named/named/version.c =================================================================== RCS file: usr.sbin/named/named/version.c diff -N usr.sbin/named/named/version.c --- usr.sbin/named/named/version.c 30 Jan 2001 20:56:10 -0000 1.5 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,95 +0,0 @@ -/* $OpenBSD: version.c,v 1.5 2001/01/30 20:56:10 niklas Exp $ */ - -/* - * @(#)Version.c 4.9 (Berkeley) 7/21/90 - * $From: Version.c,v 8.2 1997/06/01 20:34:34 vixie Exp $ - */ - -#ifndef lint -#if 0 -char sccsid[] = "@(#)named 4.9.8-REL Tue Jan 30 21:50:03 2001 root@localhost:/usr/src/usr.sbin/named/named/obj"; -char rcsid[] = "$From: Version.c,v 8.2 1997/06/01 20:34:34 vixie Exp $"; -#else -char rcsid[] = "$OpenBSD: version.c,v 1.5 2001/01/30 20:56:10 niklas Exp $"; -#endif -#endif /* not lint */ - -char Version[] = "named 4.9.8-REL Tue Jan 30 21:50:03 2001\n\troot@localhost:/usr/src/usr.sbin/named/named/obj"; -char ShortVersion[] = "4.9.8-REL"; - -#ifdef COMMENT - -SCCS/s.Version.c: - -D 4.8.3 90/06/27 17:05:21 bloom 37 35 00031/00028/00079 -Version distributed with 4.3 Reno tape (June 1990) - -D 4.8.2 89/09/18 13:57:11 bloom 35 34 00020/00014/00087 -Interim fixes release - -D 4.8.1 89/02/08 17:12:15 karels 34 33 00026/00017/00075 -branch for 4.8.1 - -D 4.8 88/07/09 14:27:00 karels 33 28 00043/00031/00049 -4.8 is here! - -D 4.7 87/11/20 13:15:52 karels 25 24 00000/00000/00062 -4.7.3 beta - -D 4.6 87/07/21 12:15:52 karels 25 24 00000/00000/00062 -4.6 declared stillborn - -D 4.5 87/02/10 12:33:25 kjd 24 18 00000/00000/00062 -February 1987, Network Release. Child (bind) grows up, parent (kevin) leaves home. - -D 4.4 86/10/01 10:06:26 kjd 18 12 00020/00017/00042 -October 1, 1986 Network Distribution - -D 4.3 86/06/04 12:12:18 kjd 12 7 00015/00028/00044 -Version distributed with 4.3BSD - -D 4.2 86/04/30 20:57:16 kjd 7 1 00056/00000/00016 -Network distribution Freeze and one more version until 4.3BSD - -D 1.1 86/04/30 19:30:00 kjd 1 0 00016/00000/00000 -date and time created 86/04/30 19:30:00 by kjd - -code versions: - -Makefile - Makefile 4.14 (Berkeley) 2/28/88 -db.h - db.h 4.13 (Berkeley) 2/17/88 -db_dump.c - db_dump.c 4.20 (Berkeley) 2/17/88 -db_load.c - db_load.c 4.26 (Berkeley) 2/28/88 -db_lookup.c - db_lookup.c 4.14 (Berkeley) 2/17/88 -db_reload.c - db_reload.c 4.15 (Berkeley) 2/28/88 -db_save.c - db_save.c 4.13 (Berkeley) 2/17/88 -db_update.c - db_update.c 4.16 (Berkeley) 2/28/88 -ns_forw.c - ns_forw.c 4.26 (Berkeley) 3/28/88 -ns_init.c - ns_init.c 4.23 (Berkeley) 2/28/88 -ns_main.c - Copyright (c) 1986 Regents of the University of California.\n\ - ns_main.c 4.30 (Berkeley) 3/7/88 -ns_maint.c - ns_maint.c 4.23 (Berkeley) 2/28/88 -ns_req.c - ns_req.c 4.32 (Berkeley) 3/31/88 -ns_resp.c - ns_resp.c 4.50 (Berkeley) 4/7/88 -ns_sort.c - ns_sort.c 4.3 (Berkeley) 2/17/88 -ns_stats.c - ns_stats.c 4.3 (Berkeley) 2/17/88 -newvers.sh - newvers.sh 4.4 (Berkeley) 3/28/88 - -#endif /* COMMENT */ Index: usr.sbin/named/named-xfer/Makefile =================================================================== RCS file: /cvs/src/usr.sbin/named/named-xfer/Makefile,v retrieving revision 1.4 diff -u -r1.4 Makefile --- usr.sbin/named/named-xfer/Makefile 11 May 2002 00:20:20 -0000 1.4 +++ usr.sbin/named/named-xfer/Makefile 15 Nov 2002 00:15:13 -0000 @@ -12,5 +12,11 @@ BINDIR= /var/named LDSTATIC= ${STATIC} +version.c: Version.c ${.CURDIR}/../Makefile + (u=root d=`pwd` h=localhost t=`date +%c`; \ + sed -e "s|%WHEN%|$${t}|" -e "s|%VERSION%|"${VER}"|" \ + -e "s|%WHOANDWHERE%|$${u}@$${h}:$${d}|" \ + < ${.CURDIR}/../named/Version.c > version.c) + .include .include "../../Makefile.inc" 3.2/common/PaxHeaders.56026/006_cvs.patch01004440001756001161000000000036076127171600014655xustar0030 atime=1783552627.868695755 3.2/common/006_cvs.patch010044400017560011610000000017230761271716000140210ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 006_cvs.patch And then rebuild and install cvs: cd gnu/usr.bin/cvs make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper make -f Makefile.bsd-wrapper install Index: gnu/usr.bin/cvs/src/server.c =================================================================== RCS file: /cvs/src/gnu/usr.bin/cvs/src/server.c,v retrieving revision 1.26 diff -u -r1.26 server.c --- gnu/usr.bin/cvs/src/server.c 29 Sep 2001 00:00:39 -0000 1.26 +++ gnu/usr.bin/cvs/src/server.c 21 Jan 2003 03:31:02 -0000 @@ -977,9 +977,6 @@ return; } - if (dir_name != NULL) - free (dir_name); - dir_len = strlen (dir); /* Check for a trailing '/'. This is not ISDIRSEP because \ in the @@ -994,6 +991,9 @@ "E protocol error: invalid directory syntax in %s", dir); return; } + + if (dir_name != NULL) + free (dir_name); dir_name = malloc (strlen (server_temp_dir) + dir_len + 40); if (dir_name == NULL) 3.2/common/PaxHeaders.56026/007_ssl.patch01004440001756001161000000000036076256177600014675xustar0030 atime=1783552627.868695755 3.2/common/007_ssl.patch010044400017560011610000000103370762561776000140420ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 007_ssl.patch And then rebuild and install OpenSSL: rm -fr /usr/obj/lib/libssl cd lib/libssl make obj make depend make make install Index: lib/libssl/src/crypto/mem.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/mem.c,v retrieving revision 1.6 diff -u -p -r1.6 mem.c --- lib/libssl/src/crypto/mem.c 2002/09/14 11:18:02 1.6 +++ lib/libssl/src/crypto/mem.c 2003/02/22 04:58:05 @@ -251,6 +251,8 @@ void *CRYPTO_malloc_locked(int num, cons { void *ret = NULL; + if (num < 0) return NULL; + allow_customize = 0; if (malloc_debug_func != NULL) { @@ -283,6 +285,8 @@ void *CRYPTO_malloc(int num, const char { void *ret = NULL; + if (num < 0) return NULL; + allow_customize = 0; if (malloc_debug_func != NULL) { @@ -305,6 +309,8 @@ void *CRYPTO_realloc(void *str, int num, if (str == NULL) return CRYPTO_malloc(num, file, line); + + if (num < 0) return NULL; if (realloc_debug_func != NULL) realloc_debug_func(str, NULL, num, file, line, 0); Index: lib/libssl/src/ssl/s3_pkt.c =================================================================== RCS file: /cvs/src/lib/libssl/src/ssl/s3_pkt.c,v retrieving revision 1.7 diff -u -p -r1.7 s3_pkt.c --- lib/libssl/src/ssl/s3_pkt.c 2002/09/10 16:31:57 1.7 +++ lib/libssl/src/ssl/s3_pkt.c 2003/02/22 04:58:05 @@ -238,6 +238,8 @@ static int ssl3_get_record(SSL *s) unsigned int mac_size; int clear=0; size_t extra; + int decryption_failed_or_bad_record_mac = 0; + unsigned char *mac = NULL; rr= &(s->s3->rrec); sess=s->session; @@ -353,8 +355,11 @@ again: /* SSLerr() and ssl3_send_alert() have been called */ goto err; - /* otherwise enc_err == -1 */ - goto decryption_failed_or_bad_record_mac; + /* Otherwise enc_err == -1, which indicates bad padding + * (rec->length has not been changed in this case). + * To minimize information leaked via timing, we will perform + * the MAC computation anyway. */ + decryption_failed_or_bad_record_mac = 1; } #ifdef TLS_DEBUG @@ -380,28 +385,46 @@ printf("\n"); SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG); goto f_err; #else - goto decryption_failed_or_bad_record_mac; + decryption_failed_or_bad_record_mac = 1; #endif } /* check the MAC for rr->input (it's in mac_size bytes at the tail) */ - if (rr->length < mac_size) + if (rr->length >= mac_size) { + rr->length -= mac_size; + mac = &rr->data[rr->length]; + } + else + { + /* record (minus padding) is too short to contain a MAC */ #if 0 /* OK only for stream ciphers */ al=SSL_AD_DECODE_ERROR; SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT); goto f_err; #else - goto decryption_failed_or_bad_record_mac; + decryption_failed_or_bad_record_mac = 1; + rr->length = 0; #endif } - rr->length-=mac_size; i=s->method->ssl3_enc->mac(s,md,0); - if (memcmp(md,&(rr->data[rr->length]),mac_size) != 0) + if (mac == NULL || memcmp(md, mac, mac_size) != 0) { - goto decryption_failed_or_bad_record_mac; + decryption_failed_or_bad_record_mac = 1; } } + if (decryption_failed_or_bad_record_mac) + { + /* A separate 'decryption_failed' alert was introduced with TLS 1.0, + * SSL 3.0 only has 'bad_record_mac'. But unless a decryption + * failure is directly visible from the ciphertext anyway, + * we should not reveal which kind of error occured -- this + * might become visible to an attacker (e.g. via a logfile) */ + al=SSL_AD_BAD_RECORD_MAC; + SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC); + goto f_err; + } + /* r->length is now just compressed */ if (s->expand != NULL) { @@ -443,14 +466,6 @@ printf("\n"); return(1); -decryption_failed_or_bad_record_mac: - /* Separate 'decryption_failed' alert was introduced with TLS 1.0, - * SSL 3.0 only has 'bad_record_mac'. But unless a decryption - * failure is directly visible from the ciphertext anyway, - * we should not reveal which kind of error occured -- this - * might become visible to an attacker (e.g. via logfile) */ - al=SSL_AD_BAD_RECORD_MAC; - SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC); f_err: ssl3_send_alert(s,SSL3_AL_FATAL,al); err: 3.2/common/PaxHeaders.56026/008_httpd.patch01004440001756001161000000000036076263413600015207xustar0030 atime=1783552627.868695755 3.2/common/008_httpd.patch010044400017560011610000000206750762634136000143620ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 008_httpd.patch And then rebuild and install httpd and it's modules: cd usr.sbin/httpd make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper depend make -f Makefile.bsd-wrapper make -f Makefile.bsd-wrapper install If httpd had been started, you might want to run apachectl stop apachectl start afterwards. Index: usr.sbin/httpd/src/main/http_main.c =================================================================== RCS file: /cvs/src/usr.sbin/httpd/src/main/http_main.c,v retrieving revision 1.25.2.1 retrieving revision 1.25.2.2 diff -u -p -r1.25.2.1 -r1.25.2.2 --- usr.sbin/httpd/src/main/http_main.c 8 Nov 2002 00:04:04 -0000 1.25.2.1 +++ usr.sbin/httpd/src/main/http_main.c 24 Feb 2003 02:09:38 -0000 1.25.2.2 @@ -1,4 +1,4 @@ -/* $OpenBSD: http_main.c,v 1.25.2.1 2002/11/08 00:04:04 jason Exp $ */ +/* $OpenBSD: http_main.c,v 1.25.2.2 2003/02/24 02:09:38 margarida Exp $ */ /* ==================================================================== * The Apache Software License, Version 1.1 @@ -5176,6 +5176,7 @@ static void standalone_main(int argc, ch } ap_set_version(); /* create our server_version string */ ap_init_modules(pconf, server_conf); + ap_init_etag(pconf); version_locked++; /* no more changes to server_version */ if(!is_graceful && !is_chrooted) Index: usr.sbin/httpd/src/main/http_protocol.c =================================================================== RCS file: /cvs/src/usr.sbin/httpd/src/main/http_protocol.c,v retrieving revision 1.13 retrieving revision 1.13.2.1 diff -u -p -r1.13 -r1.13.2.1 --- usr.sbin/httpd/src/main/http_protocol.c 19 Jul 2002 21:31:16 -0000 1.13 +++ usr.sbin/httpd/src/main/http_protocol.c 24 Feb 2003 02:09:39 -0000 1.13.2.1 @@ -1,3 +1,4 @@ +/* $OpenBSD: http_protocol.c,v 1.13.2.1 2003/02/24 02:09:39 margarida Exp $ */ /* ==================================================================== * The Apache Software License, Version 1.1 * @@ -76,6 +77,7 @@ #include "util_date.h" /* For parseHTTPdate and BAD_DATE */ #include #include "http_conf_globals.h" +#include "ap_sha1.h" #define SET_BYTES_SENT(r) \ do { if (r->sent_bodyct) \ @@ -276,7 +278,10 @@ static int byterange_boundary(request_re API_EXPORT(int) ap_set_byterange(request_rec *r) { const char *range, *if_range, *match; + char *bbuf, *b; + u_int32_t rbuf[12]; /* 48 bytes yields 64 base64 chars */ long length, start, end, one_start = 0, one_end = 0; + size_t u; int ranges, empty; if (!r->clength || r->assbackwards) @@ -322,8 +327,20 @@ API_EXPORT(int) ap_set_byterange(request * caller will perform if we return 1. */ r->range = range; - r->boundary = ap_psprintf(r->pool, "%lx%lx", - r->request_time, (long) getpid()); + for (u = 0; u < sizeof(rbuf)/sizeof(rbuf[0]); u++) + rbuf[u] = htonl(arc4random()); + + bbuf = ap_palloc(r->pool, ap_base64encode_len(sizeof(rbuf))); + ap_base64encode(bbuf, (const unsigned char *)rbuf, sizeof(rbuf)); + for (b = bbuf; *b != '\0'; b++) { + if (((b - bbuf) + 1) % 7 == 0) + *b = '-'; + else if (!isalnum(*b)) + *b = 'a'; + } + + r->boundary = bbuf; + length = 0; ranges = 0; empty = 1; @@ -646,7 +663,7 @@ API_EXPORT(int) ap_meets_conditions(requ * could be modified again in as short an interval. We rationalize the * modification time we're given to keep it from being in the future. */ -API_EXPORT(char *) ap_make_etag(request_rec *r, int force_weak) +API_EXPORT(char *) ap_make_etag_orig(request_rec *r, int force_weak) { char *etag; char *weak; @@ -3106,4 +3123,164 @@ API_EXPORT(void) ap_send_error_response( ap_kill_timeout(r); ap_finalize_request_protocol(r); ap_rflush(r); +} + +/* + * The shared hash context, copies of which are used by all children for + * etag generation. ap_init_etag() must be called once before all the + * children are created. We use a secret hash initialization value + * so that people can't brute-force inode numbers. + */ +static AP_SHA1_CTX baseCtx; + +int ap_create_etag_state(pool *pconf) +{ + u_int32_t rnd; + unsigned int u; + int fd; + const char* filename; + + filename = ap_server_root_relative(pconf, "logs/etag-state"); + ap_server_strip_chroot(filename, 0); + + if ((fd = open(filename, O_CREAT|O_WRONLY|O_TRUNC|O_NOFOLLOW, 0640)) == + -1) { + ap_log_error(APLOG_MARK, APLOG_CRIT, NULL, + "could not create %s", filename); + exit(-1); + } + + if (fchown(fd, -1, ap_group_id) == -1) { + ap_log_error(APLOG_MARK, APLOG_CRIT, NULL, + "could not chown %s", filename); + exit(-1); + } + + /* generate random bytes and write them */ + for (u = 0; u < 4; u++) { + rnd = arc4random(); + if (write(fd, &rnd, sizeof(rnd)) == -1) { + ap_log_error(APLOG_MARK, APLOG_CRIT, NULL, + "could not write to %s", filename); + exit(-1); + } + } + + close (fd); +} + +API_EXPORT(void) ap_init_etag(pool *pconf) +{ + if (ap_read_etag_state(pconf) == -1) { + ap_create_etag_state(pconf); + if (ap_read_etag_state(pconf) == -1) { + ap_log_error(APLOG_MARK, APLOG_CRIT, NULL, + "could not initialize etag state"); + exit(-1); + } + } +} + +int ap_read_etag_state(pool *pconf) +{ + struct stat st; + u_int32_t rnd; + unsigned int u; + int fd; + const char* filename; + + ap_SHA1Init(&baseCtx); + + filename = ap_server_root_relative(pconf, "logs/etag-state"); + ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_NOTICE, NULL, + "Initializing etag from %s", filename); + + ap_server_strip_chroot(filename, 0); + + if ((fd = open(filename, O_RDONLY|O_NOFOLLOW, 0640)) == -1) + return (-1); + + fchmod(fd, S_IRUSR|S_IWUSR|S_IRGRP); + fchown(fd, -1, ap_group_id); + + if (fstat(fd, &st) == -1) { + ap_log_error(APLOG_MARK, APLOG_CRIT, NULL, + "could not fstat %s", filename); + exit(-1); + } + + if (st.st_size != sizeof(rnd)*4) { + return (-1); + } + + /* read 4 random 32-bit uints from file and update the hash context */ + for (u = 0; u < 4; u++) { + if (read(fd, &rnd, sizeof(rnd)) < sizeof(rnd)) + return (-1); + + ap_SHA1Update_binary(&baseCtx, (const unsigned char *)&rnd, + sizeof(rnd)); + } + + if (close(fd) == -1) { + ap_log_error(APLOG_MARK, APLOG_CRIT, NULL, + "could not properly close %s", filename); + exit(-1); + } +} + +API_EXPORT(char *) ap_make_etag(request_rec *r, int force_weak) +{ + AP_SHA1_CTX hashCtx; + core_dir_config *cfg; + etag_components_t etag_bits; + int weak; + unsigned char md[SHA_DIGESTSIZE]; + unsigned int i; + + memcpy(&hashCtx, &baseCtx, sizeof(hashCtx)); + + cfg = (core_dir_config *)ap_get_module_config(r->per_dir_config, + &core_module); + etag_bits = (cfg->etag_bits & (~ cfg->etag_remove)) | cfg->etag_add; + if (etag_bits == ETAG_UNSET) + etag_bits = ETAG_BACKWARD; + + weak = ((r->request_time - r->mtime <= 1) || force_weak); + + if (r->finfo.st_mode != 0) { + if (etag_bits & ETAG_NONE) { + ap_table_setn(r->notes, "no-etag", "omit"); + return ""; + } + if (etag_bits & ETAG_INODE) { + ap_SHA1Update_binary(&hashCtx, + (const unsigned char *)&r->finfo.st_dev, + sizeof(r->finfo.st_dev)); + ap_SHA1Update_binary(&hashCtx, + (const unsigned char *)&r->finfo.st_ino, + sizeof(r->finfo.st_ino)); + } + if (etag_bits & ETAG_SIZE) + ap_SHA1Update_binary(&hashCtx, + (const unsigned char *)&r->finfo.st_size, + sizeof(r->finfo.st_size)); + if (etag_bits & ETAG_MTIME) + ap_SHA1Update_binary(&hashCtx, + (const unsigned char *)&r->mtime, + sizeof(r->mtime)); + } + else { + weak = 1; + ap_SHA1Update_binary(&hashCtx, (const unsigned char *)&r->mtime, + sizeof(r->mtime)); + } + ap_SHA1Final(md, &hashCtx); + return ap_psprintf(r->pool, "%s\"" + "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x" + "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x" + "\"", weak ? "W/" : "", + md[0], md[1], md[2], md[3], md[4], md[5], md[6], md[7], + md[8], md[9], md[10], md[11], md[12], md[13], md[14], md[15], + md[16], md[17], md[18], md[19]); } 3.2/common/PaxHeaders.56026/009_sendmail.patch01004440001756001161000000000036076305765600015670xustar0030 atime=1783552627.868695755 3.2/common/009_sendmail.patch010044400017560011610000000271030763057656000150340ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 009_sendmail.patch And then rebuild and install sendmail: cd gnu/usr.sbin/sendmail make depend make make install Restart sendmail if necessary: kill -HUP `sed q /var/run/sendmail.pid` Index: gnu/usr.sbin/sendmail/sendmail/headers.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/headers.c,v retrieving revision 1.9 retrieving revision 1.9.2.1 diff -u -r1.9 -r1.9.2.1 --- gnu/usr.sbin/sendmail/sendmail/headers.c 15 Sep 2002 02:23:35 -0000 1.9 +++ gnu/usr.sbin/sendmail/sendmail/headers.c 3 Mar 2003 17:19:45 -0000 1.9.2.1 @@ -676,8 +676,8 @@ if (buf[0] != '\0') { if (bitset(H_FROM, h->h_flags)) - expand(crackaddr(buf), buf, sizeof buf, - e); + expand(crackaddr(buf, e), + buf, sizeof buf, e); h->h_value = sm_rpool_strdup_x(e->e_rpool, buf); h->h_flags &= ~H_DEFAULT; } @@ -998,7 +998,11 @@ ** it and replaces it with "$g". The parse is totally ad hoc ** and isn't even guaranteed to leave something syntactically ** identical to what it started with. However, it does leave -** something semantically identical. +** something semantically identical if possible, else at least +** syntactically correct. +** +** For example, it changes "Real Name (Comment)" +** to "Real Name <$g> (Comment)". ** ** This algorithm has been cleaned up to handle a wider range ** of cases -- notably quoted and backslash escaped strings. @@ -1007,6 +1011,7 @@ ** ** Parameters: ** addr -- the address to be cracked. +** e -- the current envelope. ** ** Returns: ** a pointer to the new version. @@ -1019,28 +1024,50 @@ ** be copied if it is to be reused. */ +#define SM_HAVE_ROOM ((bp < buflim) && (buflim <= bufend)) + +/* +** Append a character to bp if we have room. +** If not, punt and return $g. +*/ + +#define SM_APPEND_CHAR(c) \ + do \ + { \ + if (SM_HAVE_ROOM) \ + *bp++ = (c); \ + else \ + goto returng; \ + } while (0) + +#if MAXNAME < 10 +ERROR MAXNAME must be at least 10 +#endif /* MAXNAME < 10 */ + char * -crackaddr(addr) +crackaddr(addr, e) register char *addr; + ENVELOPE *e; { register char *p; register char c; - int cmtlev; - int realcmtlev; - int anglelev, realanglelev; - int copylev; - int bracklev; - bool qmode; - bool realqmode; - bool skipping; - bool putgmac = false; - bool quoteit = false; - bool gotangle = false; - bool gotcolon = false; + int cmtlev; /* comment level in input string */ + int realcmtlev; /* comment level in output string */ + int anglelev; /* angle level in input string */ + int copylev; /* 0 == in address, >0 copying */ + int bracklev; /* bracket level for IPv6 addr check */ + bool addangle; /* put closing angle in output */ + bool qmode; /* quoting in original string? */ + bool realqmode; /* quoting in output string? */ + bool putgmac = false; /* already wrote $g */ + bool quoteit = false; /* need to quote next character */ + bool gotangle = false; /* found first '<' */ + bool gotcolon = false; /* found a ':' */ register char *bp; char *buflim; char *bufhead; char *addrhead; + char *bufend; static char buf[MAXNAME + 1]; if (tTd(33, 1)) @@ -1055,25 +1082,22 @@ ** adjusted later if we find them. */ + buflim = bufend = &buf[sizeof(buf) - 1]; bp = bufhead = buf; - buflim = &buf[sizeof buf - 7]; p = addrhead = addr; - copylev = anglelev = realanglelev = cmtlev = realcmtlev = 0; + copylev = anglelev = cmtlev = realcmtlev = 0; bracklev = 0; - qmode = realqmode = false; + qmode = realqmode = addangle = false; while ((c = *p++) != '\0') { /* - ** If the buffer is overful, go into a special "skipping" - ** mode that tries to keep legal syntax but doesn't actually - ** output things. + ** Try to keep legal syntax using spare buffer space + ** (maintained by buflim). */ - skipping = bp >= buflim; - - if (copylev > 0 && !skipping) - *bp++ = c; + if (copylev > 0) + SM_APPEND_CHAR(c); /* check for backslash escapes */ if (c == '\\') @@ -1088,8 +1112,8 @@ p--; goto putg; } - if (copylev > 0 && !skipping) - *bp++ = c; + if (copylev > 0) + SM_APPEND_CHAR(c); goto putg; } @@ -1097,8 +1121,14 @@ if (c == '"' && cmtlev <= 0) { qmode = !qmode; - if (copylev > 0 && !skipping) + if (copylev > 0 && SM_HAVE_ROOM) + { + if (realqmode) + buflim--; + else + buflim++; realqmode = !realqmode; + } continue; } if (qmode) @@ -1110,15 +1140,15 @@ cmtlev++; /* allow space for closing paren */ - if (!skipping) + if (SM_HAVE_ROOM) { buflim--; realcmtlev++; if (copylev++ <= 0) { if (bp != bufhead) - *bp++ = ' '; - *bp++ = c; + SM_APPEND_CHAR(' '); + SM_APPEND_CHAR(c); } } } @@ -1128,7 +1158,7 @@ { cmtlev--; copylev--; - if (!skipping) + if (SM_HAVE_ROOM) { realcmtlev--; buflim++; @@ -1139,7 +1169,7 @@ else if (c == ')') { /* syntax error: unmatched ) */ - if (copylev > 0 && !skipping) + if (copylev > 0 && SM_HAVE_ROOM) bp--; } @@ -1157,7 +1187,7 @@ /* ** Check for DECnet phase IV ``::'' (host::user) - ** or ** DECnet phase V ``:.'' syntaxes. The latter + ** or DECnet phase V ``:.'' syntaxes. The latter ** covers ``user@DEC:.tay.myhost'' and ** ``DEC:.tay.myhost::user'' syntaxes (bletch). */ @@ -1166,10 +1196,10 @@ { if (cmtlev <= 0 && !qmode) quoteit = true; - if (copylev > 0 && !skipping) + if (copylev > 0) { - *bp++ = c; - *bp++ = *p; + SM_APPEND_CHAR(c); + SM_APPEND_CHAR(*p); } p++; goto putg; @@ -1180,41 +1210,43 @@ bp = bufhead; if (quoteit) { - *bp++ = '"'; + SM_APPEND_CHAR('"'); /* back up over the ':' and any spaces */ --p; - while (isascii(*--p) && isspace(*p)) + while (p > addr && + isascii(*--p) && isspace(*p)) continue; p++; } for (q = addrhead; q < p; ) { c = *q++; - if (bp < buflim) + if (quoteit && c == '"') { - if (quoteit && c == '"') - *bp++ = '\\'; - *bp++ = c; + SM_APPEND_CHAR('\\'); + SM_APPEND_CHAR(c); } + else + SM_APPEND_CHAR(c); } if (quoteit) { if (bp == &bufhead[1]) bp--; else - *bp++ = '"'; + SM_APPEND_CHAR('"'); while ((c = *p++) != ':') - { - if (bp < buflim) - *bp++ = c; - } - *bp++ = c; + SM_APPEND_CHAR(c); + SM_APPEND_CHAR(c); } /* any trailing white space is part of group: */ - while (isascii(*p) && isspace(*p) && bp < buflim) - *bp++ = *p++; + while (isascii(*p) && isspace(*p)) + { + SM_APPEND_CHAR(*p); + p++; + } copylev = 0; putgmac = quoteit = false; bufhead = bp; @@ -1223,10 +1255,7 @@ } if (c == ';' && copylev <= 0 && !ColonOkInAddr) - { - if (bp < buflim) - *bp++ = c; - } + SM_APPEND_CHAR(c); /* check for characters that may have to be quoted */ if (strchr(MustQuoteChars, c) != NULL) @@ -1254,42 +1283,45 @@ /* oops -- have to change our mind */ anglelev = 1; - if (!skipping) - realanglelev = 1; + if (SM_HAVE_ROOM) + { + if (!addangle) + buflim--; + addangle = true; + } bp = bufhead; if (quoteit) { - *bp++ = '"'; + SM_APPEND_CHAR('"'); /* back up over the '<' and any spaces */ --p; - while (isascii(*--p) && isspace(*p)) + while (p > addr && + isascii(*--p) && isspace(*p)) continue; p++; } for (q = addrhead; q < p; ) { c = *q++; - if (bp < buflim) + if (quoteit && c == '"') { - if (quoteit && c == '"') - *bp++ = '\\'; - *bp++ = c; + SM_APPEND_CHAR('\\'); + SM_APPEND_CHAR(c); } + else + SM_APPEND_CHAR(c); } if (quoteit) { if (bp == &buf[1]) bp--; else - *bp++ = '"'; + SM_APPEND_CHAR('"'); while ((c = *p++) != '<') - { - if (bp < buflim) - *bp++ = c; - } - *bp++ = c; + SM_APPEND_CHAR(c); + SM_APPEND_CHAR(c); } copylev = 0; putgmac = quoteit = false; @@ -1301,13 +1333,14 @@ if (anglelev > 0) { anglelev--; - if (!skipping) + if (SM_HAVE_ROOM) { - realanglelev--; - buflim++; + if (addangle) + buflim++; + addangle = false; } } - else if (!skipping) + else if (SM_HAVE_ROOM) { /* syntax error: unmatched > */ if (copylev > 0) @@ -1316,7 +1349,7 @@ continue; } if (copylev++ <= 0) - *bp++ = c; + SM_APPEND_CHAR(c); continue; } @@ -1324,30 +1357,42 @@ putg: if (copylev <= 0 && !putgmac) { - if (bp > bufhead && bp[-1] == ')') - *bp++ = ' '; - *bp++ = MACROEXPAND; - *bp++ = 'g'; + if (bp > buf && bp[-1] == ')') + SM_APPEND_CHAR(' '); + SM_APPEND_CHAR(MACROEXPAND); + SM_APPEND_CHAR('g'); putgmac = true; } } /* repair any syntactic damage */ - if (realqmode) + if (realqmode && bp < bufend) *bp++ = '"'; - while (realcmtlev-- > 0) + while (realcmtlev-- > 0 && bp < bufend) *bp++ = ')'; - while (realanglelev-- > 0) + if (addangle && bp < bufend) *bp++ = '>'; - *bp++ = '\0'; + *bp = '\0'; + if (bp < bufend) + goto success; + + returng: + /* String too long, punt */ + buf[0] = '<'; + buf[1] = MACROEXPAND; + buf[2]= 'g'; + buf[3] = '>'; + buf[4]= '\0'; + sm_syslog(LOG_ALERT, e->e_id, + "Dropped invalid comments from header address"); + success: if (tTd(33, 1)) { sm_dprintf("crackaddr=>`"); xputs(buf); sm_dprintf("'\n"); } - return buf; } /* Index: gnu/usr.sbin/sendmail/sendmail/main.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/main.c,v retrieving revision 1.15 retrieving revision 1.15.2.1 diff -u -r1.15 -r1.15.2.1 --- gnu/usr.sbin/sendmail/sendmail/main.c 15 Sep 2002 02:23:35 -0000 1.15 +++ gnu/usr.sbin/sendmail/sendmail/main.c 3 Mar 2003 17:19:45 -0000 1.15.2.1 @@ -4227,7 +4227,7 @@ "Usage: /parse address\n"); return; } - q = crackaddr(p); + q = crackaddr(p, e); (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "Cracked address = "); xputs(q); Index: gnu/usr.sbin/sendmail/sendmail/parseaddr.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/parseaddr.c,v retrieving revision 1.13 retrieving revision 1.13.2.1 diff -u -r1.13 -r1.13.2.1 --- gnu/usr.sbin/sendmail/sendmail/parseaddr.c 15 Sep 2002 02:23:36 -0000 1.13 +++ gnu/usr.sbin/sendmail/sendmail/parseaddr.c 3 Mar 2003 17:19:45 -0000 1.13.2.1 @@ -2508,7 +2508,7 @@ if (bitset(RF_CANONICAL, flags) || bitnset(M_NOCOMMENT, m->m_flags)) fancy = "\201g"; else - fancy = crackaddr(name); + fancy = crackaddr(name, e); /* ** Turn the name into canonical form. Index: gnu/usr.sbin/sendmail/sendmail/sendmail.h =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/sendmail.h,v retrieving revision 1.15 retrieving revision 1.15.2.1 diff -u -r1.15 -r1.15.2.1 --- gnu/usr.sbin/sendmail/sendmail/sendmail.h 15 Sep 2002 02:23:36 -0000 1.15 +++ gnu/usr.sbin/sendmail/sendmail/sendmail.h 3 Mar 2003 17:19:45 -0000 1.15.2.1 @@ -325,7 +325,7 @@ /* functions */ extern void cataddr __P((char **, char **, char *, int, int)); -extern char *crackaddr __P((char *)); +extern char *crackaddr __P((char *, ENVELOPE *)); extern bool emptyaddr __P((ADDRESS *)); extern ADDRESS *getctladdr __P((ADDRESS *)); extern int include __P((char *, bool, ADDRESS *, ADDRESS **, int, ENVELOPE *)); 3.2/common/PaxHeaders.56026/010_lprm.patch01004440001756001161000000000036076313201600015016xustar0030 atime=1783552627.868695755 3.2/common/010_lprm.patch010044400017560011610000000035440763132016000141650ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 010_lprm.patch And then rebuild and install lprm: cd usr.sbin/lpr make obj make depend && make && make install Index: usr.sbin/lpr/common_source/rmjob.c =================================================================== RCS file: /cvs/src/usr.sbin/lpr/common_source/rmjob.c,v retrieving revision 1.14 diff -u -r1.14 rmjob.c --- usr.sbin/lpr/common_source/rmjob.c 8 Jun 2002 01:53:43 -0000 1.14 +++ usr.sbin/lpr/common_source/rmjob.c 5 Mar 2003 00:31:41 -0000 @@ -333,6 +333,7 @@ { char *cp; int i, rem; + size_t n; char buf[BUFSIZ]; if (!remote) @@ -344,18 +345,26 @@ */ fflush(stdout); - (void)snprintf(buf, sizeof(buf)-2, "\5%s %s", RP, all ? "-all" : person); - cp = buf + strlen(buf); - for (i = 0; i < users && cp-buf+1+strlen(user[i]) < sizeof buf - 2; i++) { - cp += strlen(cp); + /* the trailing space will be replaced with a newline later */ + n = snprintf(buf, sizeof(buf), "\5%s %s ", RP, all ? "-all" : person); + if (n == -1 || n >= sizeof(buf)) + goto bad; + cp = buf + n; + for (i = 0; i < users; i++) { + n = strlcpy(cp, user[i], sizeof(buf) - (cp - buf + 1)); + if (n >= sizeof(buf) - (cp - buf + 1)) + goto bad; + cp += n; *cp++ = ' '; - strcpy(cp, user[i]); } - for (i = 0; i < requests && cp-buf+10 < sizeof(buf) - 2; i++) { - cp += strlen(cp); - (void)sprintf(cp, " %d", requ[i]); + *cp = '\0'; + for (i = 0; i < requests; i++) { + n = snprintf(cp, sizeof(buf) - (cp - buf), "%d ", requ[i]); + if (n == -1 || n >= sizeof(buf) - (cp - buf)) + goto bad; + cp += n; } - strcat(cp, "\n"); + cp[-1] = '\n'; /* replace space with newline, leave the NUL */ rem = getport(RM, 0); if (rem < 0) { if (from != host) @@ -380,6 +389,10 @@ (void)sigaction(SIGALRM, &osa, NULL); (void)close(rem); } + return; +bad: + printf("remote buffer too large\n"); + return; } static void 3.2/common/PaxHeaders.56026/011_blinding.patch01004440001756001161000000000036076355417600015652xustar0030 atime=1783552627.868695755 3.2/common/011_blinding.patch010044400017560011610000000046570763554176000150270ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 011_blinding.patch And then rebuild and install OpenSSL: rm -fr /usr/obj/lib/libssl cd lib/libssl make obj make cleandir make depend make make install Index: lib/libssl/src/crypto/rsa/rsa_eay.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/rsa/rsa_eay.c,v retrieving revision 1.10 retrieving revision 1.10.2.1 diff -u -r1.10 -r1.10.2.1 --- lib/libssl/src/crypto/rsa/rsa_eay.c 7 Jun 2002 03:45:34 -0000 1.10 +++ lib/libssl/src/crypto/rsa/rsa_eay.c 19 Mar 2003 01:18:19 -0000 1.10.2.1 @@ -193,6 +193,25 @@ return(r); } +static int rsa_eay_blinding(RSA *rsa, BN_CTX *ctx) + { + int ret = 1; + CRYPTO_w_lock(CRYPTO_LOCK_RSA); + /* Check again inside the lock - the macro's check is racey */ + if(rsa->blinding == NULL) + ret = RSA_blinding_on(rsa, ctx); + CRYPTO_w_unlock(CRYPTO_LOCK_RSA); + return ret; + } + +#define BLINDING_HELPER(rsa, ctx, err_instr) \ + do { \ + if(((rsa)->flags & RSA_FLAG_BLINDING) && \ + ((rsa)->blinding == NULL) && \ + !rsa_eay_blinding(rsa, ctx)) \ + err_instr \ + } while(0) + /* signing */ static int RSA_eay_private_encrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) @@ -237,8 +256,8 @@ goto err; } - if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL)) - RSA_blinding_on(rsa,ctx); + BLINDING_HELPER(rsa, ctx, goto err;); + if (rsa->flags & RSA_FLAG_BLINDING) if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; @@ -316,8 +335,8 @@ goto err; } - if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL)) - RSA_blinding_on(rsa,ctx); + BLINDING_HELPER(rsa, ctx, goto err;); + if (rsa->flags & RSA_FLAG_BLINDING) if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; Index: lib/libssl/src/crypto/rsa/rsa_lib.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/rsa/rsa_lib.c,v retrieving revision 1.6 retrieving revision 1.6.2.1 diff -u -r1.6 -r1.6.2.1 --- lib/libssl/src/crypto/rsa/rsa_lib.c 15 May 2002 02:29:16 -0000 1.6 +++ lib/libssl/src/crypto/rsa/rsa_lib.c 19 Mar 2003 01:18:19 -0000 1.6.2.1 @@ -70,7 +70,13 @@ RSA *RSA_new(void) { - return(RSA_new_method(NULL)); + RSA *r=RSA_new_method(NULL); + +#ifndef OPENSSL_NO_FORCE_RSA_BLINDING + r->flags|=RSA_FLAG_BLINDING; +#endif + + return r; } void RSA_set_default_method(const RSA_METHOD *meth) 3.2/common/PaxHeaders.56026/012_kpr.patch01004440001756001161000000000036076360125600014651xustar0030 atime=1783552627.868695755 3.2/common/012_kpr.patch010044400017560011610000000050660763601256000140210ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 012_kpr.patch And then rebuild and install OpenSSL: rm -fr /usr/obj/lib/libssl cd lib/libssl make obj make cleandir make depend make make install Index: lib/libssl/src/ssl/s3_srvr.c =================================================================== RCS file: /cvs/src/lib/libssl/src/ssl/s3_srvr.c,v retrieving revision 1.14 retrieving revision 1.14.2.1 diff -u -r1.14 -r1.14.2.1 --- lib/libssl/src/ssl/s3_srvr.c 14 Sep 2002 11:18:03 -0000 1.14 +++ lib/libssl/src/ssl/s3_srvr.c 19 Mar 2003 23:39:12 -0000 1.14.2.1 @@ -1441,7 +1441,7 @@ if (i != SSL_MAX_MASTER_KEY_LENGTH) { al=SSL_AD_DECODE_ERROR; - SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); + /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */ } if ((al == -1) && !((p[0] == (s->client_version>>8)) && (p[1] == (s->client_version & 0xff)))) @@ -1457,30 +1457,29 @@ (p[0] == (s->version>>8)) && (p[1] == (s->version & 0xff)))) { al=SSL_AD_DECODE_ERROR; - SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); - goto f_err; + /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */ + + /* The Klima-Pokorny-Rosa extension of Bleichenbacher's attack + * (http://eprint.iacr.org/2003/052/) exploits the version + * number check as a "bad version oracle" -- an alert would + * reveal that the plaintext corresponding to some ciphertext + * made up by the adversary is properly formatted except + * that the version number is wrong. To avoid such attacks, + * we should treat this just like any other decryption error. */ + p[0] = (char)(int) "CAN-2003-0131 patch 2003-03-20"; } } if (al != -1) { -#if 0 - goto f_err; -#else /* Some decryption failure -- use random value instead as countermeasure * against Bleichenbacher's attack on PKCS #1 v1.5 RSA padding - * (see RFC 2246, section 7.4.7.1). - * But note that due to length and protocol version checking, the - * attack is impractical anyway (see section 5 in D. Bleichenbacher: - * "Chosen Ciphertext Attacks Against Protocols Based on the RSA - * Encryption Standard PKCS #1", CRYPTO '98, LNCS 1462, pp. 1-12). - */ + * (see RFC 2246, section 7.4.7.1). */ ERR_clear_error(); i = SSL_MAX_MASTER_KEY_LENGTH; p[0] = s->client_version >> 8; p[1] = s->client_version & 0xff; RAND_pseudo_bytes(p+2, i-2); /* should be RAND_bytes, but we cannot work around a failure */ -#endif } s->session->master_key_length= 3.2/common/PaxHeaders.56026/013_kerberos.patch01004440001756001161000000000036076375263600015703xustar0030 atime=1783552627.868695755 3.2/common/013_kerberos.patch010044400017560011610000000122420763752636000150450ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 013_kerberos.patch And then rebuild and install the Kerberos 5 KDC: cd kerberosV/lib/roken make obj make cleandir make depend make cd ../../libexec/kdc make obj make cleandir make depend make make install Index: kerberosV/src/kdc/524.c =================================================================== RCS file: /cvs/src/kerberosV/src/kdc/524.c,v retrieving revision 1.1.1.3 retrieving revision 1.1.1.3.4.1 diff -u -r1.1.1.3 -r1.1.1.3.4.1 --- kerberosV/src/kdc/524.c 6 Feb 2002 08:54:50 -0000 1.1.1.3 +++ kerberosV/src/kdc/524.c 22 Mar 2003 21:26:30 -0000 1.1.1.3.4.1 @@ -251,6 +251,14 @@ free_EncTicketPart(&et); goto out; } + if (!enable_v4_cross_realm && strcmp (et.crealm, t->realm) != 0) { + kdc_log(0, "524 cross-realm %s -> %s disabled", et.crealm, + t->realm); + free_EncTicketPart(&et); + ret = KRB5KDC_ERR_POLICY; + goto out; + } + ret = encode_v4_ticket(buf + sizeof(buf) - 1, sizeof(buf), &et, &t->sname, &len); free_EncTicketPart(&et); Index: kerberosV/src/kdc/config.c =================================================================== RCS file: /cvs/src/kerberosV/src/kdc/config.c,v retrieving revision 1.1.1.3 retrieving revision 1.1.1.3.4.1 diff -u -r1.1.1.3 -r1.1.1.3.4.1 --- kerberosV/src/kdc/config.c 6 Feb 2002 08:54:50 -0000 1.1.1.3 +++ kerberosV/src/kdc/config.c 22 Mar 2003 21:26:30 -0000 1.1.1.3.4.1 @@ -67,6 +67,7 @@ char *v4_realm; int enable_v4 = -1; int enable_524 = -1; +int enable_v4_cross_realm = -1; int enable_kaserver = -1; #endif @@ -100,6 +101,10 @@ { "524", 0, arg_negative_flag, &enable_524, "don't respond to 524 requests" }, + { "kerberos4-cross-realm", 0, arg_flag, + &enable_v4_cross_realm, + "respond to kerberos 4 requests from foreign realms" + }, { "v4-realm", 'r', arg_string, &v4_realm, "realm to serve v4-requests for" @@ -301,6 +306,12 @@ if(enable_v4 == -1) enable_v4 = krb5_config_get_bool_default(context, cf, TRUE, "kdc", "enable-kerberos4", NULL); + if(enable_v4_cross_realm == -1) + enable_v4_cross_realm = + krb5_config_get_bool_default(context, NULL, + FALSE, "kdc", + "enable-kerberos4-cross-realm", + NULL); if(enable_524 == -1) enable_524 = krb5_config_get_bool_default(context, cf, enable_v4, "kdc", "enable-524", NULL); @@ -325,8 +336,11 @@ "kdc", "v4-realm", NULL); - if(p) + if(p != NULL) { v4_realm = strdup(p); + if (v4_realm == NULL) + krb5_errx(context, 1, "out of memory"); + } } if (enable_kaserver == -1) enable_kaserver = krb5_config_get_bool_default(context, cf, FALSE, @@ -355,6 +369,8 @@ #ifdef KRB4 if(v4_realm == NULL){ v4_realm = malloc(40); /* REALM_SZ */ + if (v4_realm == NULL) + krb5_errx(context, 1, "out of memory"); krb_get_lrealm(v4_realm, 1); } #endif Index: kerberosV/src/kdc/kdc.8 =================================================================== RCS file: /cvs/src/kerberosV/src/kdc/kdc.8,v retrieving revision 1.2 retrieving revision 1.2.6.1 diff -u -r1.2 -r1.2.6.1 --- kerberosV/src/kdc/kdc.8 25 Jun 2001 04:43:37 -0000 1.2 +++ kerberosV/src/kdc/kdc.8 22 Mar 2003 21:26:30 -0000 1.2.6.1 @@ -1,4 +1,4 @@ -.\" $KTH: kdc.8,v 1.13 2001/06/08 21:35:32 joda Exp $ +.\" $Id: kdc.8,v 1.2.6.1 2003/03/22 21:26:30 margarida Exp $ .\" .Dd July 27, 1997 .Dt KDC 8 @@ -19,6 +19,7 @@ .Fl -v4-realm= Ns Ar string .Xc .Oc +.Op Fl -kerberos4-cross-realm .Op Fl K | Fl -no-kaserver .Op Fl r Ar realm .Op Fl -v4-realm= Ns Ar realm @@ -56,6 +57,12 @@ .Xc Gives an upper limit on the size of the requests that the kdc is willing to handle. +.It Xo +.Fl -kerberos4-cross-realm +.Xc +respond to kerberos 4 requests from foreign realms. +This is a known security hole and should not be enabled unless you +understand the consequences and are willing to live with them. .It Xo .Fl H Ns , .Fl -enable-http Index: kerberosV/src/kdc/kdc_locl.h =================================================================== RCS file: /cvs/src/kerberosV/src/kdc/kdc_locl.h,v retrieving revision 1.3 retrieving revision 1.3.4.1 diff -u -r1.3 -r1.3.4.1 --- kerberosV/src/kdc/kdc_locl.h 6 Feb 2002 09:10:02 -0000 1.3 +++ kerberosV/src/kdc/kdc_locl.h 22 Mar 2003 21:26:30 -0000 1.3.4.1 @@ -67,6 +67,7 @@ extern char *v4_realm; extern int enable_v4; extern int enable_524; +extern int enable_v4_cross_realm; extern krb5_boolean enable_kaserver; #endif Index: kerberosV/src/kdc/kerberos4.c =================================================================== RCS file: /cvs/src/kerberosV/src/kdc/kerberos4.c,v retrieving revision 1.2 retrieving revision 1.2.2.1 diff -u -r1.2 -r1.2.2.1 --- kerberosV/src/kdc/kerberos4.c 6 Jun 2002 00:37:36 -0000 1.2 +++ kerberosV/src/kdc/kerberos4.c 22 Mar 2003 21:26:30 -0000 1.2.2.1 @@ -430,6 +430,13 @@ goto out2; } + if (!enable_v4_cross_realm && strcmp(realm, v4_realm) != 0) { + kdc_log(0, "krb4 Cross-realm %s -> %s disabled", realm, v4_realm); + make_err_reply(reply, KERB_ERR_PRINCIPAL_UNKNOWN, + "Can't hop realms"); + goto out2; + } + if(strcmp(sname, "changepw") == 0){ kdc_log(0, "Bad request for changepw ticket"); make_err_reply(reply, KERB_ERR_PRINCIPAL_UNKNOWN, 3.2/common/PaxHeaders.56026/014_sendmail.patch01004440001756001161000000000036076417635600015664xustar0030 atime=1783552627.868695755 3.2/common/014_sendmail.patch010044400017560011610000000152600764176356000150310ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 014_sendmail.patch And then rebuild and install sendmail: cd gnu/usr.sbin/sendmail make depend make make install Restart sendmail if necessary: kill -HUP `sed q /var/run/sendmail.pid` Index: gnu/usr.sbin/sendmail/cf/README =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/cf/README,v retrieving revision 1.15 retrieving revision 1.15.2.1 diff -u -r1.15 -r1.15.2.1 --- gnu/usr.sbin/sendmail/cf/README 15 Sep 2002 02:23:35 -0000 1.15 +++ gnu/usr.sbin/sendmail/cf/README 31 Mar 2003 01:01:46 -0000 1.15.2.1 @@ -3630,6 +3630,7 @@ confMAX_MIME_HEADER_LENGTH MaxMimeHeaderLength [undefined] Maximum length of certain MIME header field values. + If not set, sendmail uses 2048/1024. confCONNECTION_RATE_THROTTLE ConnectionRateThrottle [undefined] The maximum number of connections permitted per second per @@ -4311,4 +4312,4 @@ 8 DNS based blacklists 9 special local rulesets (1 and 2) -$Revision: 1.15 $, Last updated $Date: 2002/09/15 02:23:35 $ +$Revision: 1.15.2.1 $, Last updated $Date: 2003/03/31 01:01:46 $ Index: gnu/usr.sbin/sendmail/sendmail/README =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/README,v retrieving revision 1.14 retrieving revision 1.14.2.1 diff -u -r1.14 -r1.14.2.1 --- gnu/usr.sbin/sendmail/sendmail/README 26 Jun 2002 04:48:55 -0000 1.14 +++ gnu/usr.sbin/sendmail/sendmail/README 31 Mar 2003 01:01:47 -0000 1.14.2.1 @@ -475,6 +475,9 @@ parameter of main(). USE_DOUBLE_FORK By default this is on (1). Set it to 0 to suppress the extra fork() used to avoid intermediate zombies. +ALLOW_255 Do not convert (char)0xff to (char)0x7f in headers etc. + This can also be done at runtime with the command line + option -d82.101. +-----------------------+ @@ -1768,4 +1771,4 @@ version.c The version number and information about this version of sendmail. -(Version $Revision: 1.14 $, last update $Date: 2002/06/26 04:48:55 $ ) +(Version $Revision: 1.14.2.1 $, last update $Date: 2003/03/31 01:01:47 $ ) Index: gnu/usr.sbin/sendmail/sendmail/collect.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/collect.c,v retrieving revision 1.13 retrieving revision 1.13.2.1 diff -u -r1.13 -r1.13.2.1 --- gnu/usr.sbin/sendmail/sendmail/collect.c 15 Sep 2002 02:23:35 -0000 1.13 +++ gnu/usr.sbin/sendmail/sendmail/collect.c 31 Mar 2003 01:01:47 -0000 1.13.2.1 @@ -434,6 +434,7 @@ OpMode != MD_ARPAFTP)) { + SM_ASSERT(pbp < peekbuf + sizeof(peekbuf)); *pbp++ = c; c = '.'; } @@ -445,6 +446,7 @@ else { /* push back the ".\rx" */ + SM_ASSERT(pbp < peekbuf + sizeof(peekbuf)); *pbp++ = c; if (OpMode != MD_SMTP && OpMode != MD_DAEMON && @@ -615,6 +617,7 @@ } /* trim off trailing CRLF or NL */ + SM_ASSERT(bp > buf); if (*--bp != '\n' || *--bp != '\r') bp++; *bp = '\0'; Index: gnu/usr.sbin/sendmail/sendmail/conf.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/conf.c,v retrieving revision 1.16 retrieving revision 1.16.2.1 diff -u -r1.16 -r1.16.2.1 --- gnu/usr.sbin/sendmail/sendmail/conf.c 15 Sep 2002 02:23:35 -0000 1.16 +++ gnu/usr.sbin/sendmail/sendmail/conf.c 31 Mar 2003 01:01:47 -0000 1.16.2.1 @@ -330,6 +330,8 @@ DontProbeInterfaces = DPI_PROBEALL; DoubleBounceAddr = "postmaster"; MaxHeadersLength = MAXHDRSLEN; + MaxMimeHeaderLength = MAXLINE; + MaxMimeFieldLength = MaxMimeHeaderLength / 2; MaxForwardEntries = 0; FastSplit = 1; #if SASL Index: gnu/usr.sbin/sendmail/sendmail/deliver.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/deliver.c,v retrieving revision 1.16 retrieving revision 1.16.2.1 diff -u -r1.16 -r1.16.2.1 --- gnu/usr.sbin/sendmail/sendmail/deliver.c 15 Sep 2002 02:23:35 -0000 1.16 +++ gnu/usr.sbin/sendmail/sendmail/deliver.c 31 Mar 2003 01:01:47 -0000 1.16.2.1 @@ -1154,7 +1154,7 @@ /* Need to account for IPv6 bracketed addresses */ if (*a == '[') braclev++; - else if (*a == '[' && braclev > 0) + else if (*a == ']' && braclev > 0) braclev--; else if (*a == ':' && braclev <= 0) { @@ -4700,7 +4700,11 @@ { pos += bp - buf; if (c != '\r') + { + SM_ASSERT(pbp < peekbuf + + sizeof(peekbuf)); *pbp++ = c; + } } bp = buf; @@ -4740,6 +4744,7 @@ } /* had a naked carriage return */ + SM_ASSERT(pbp < peekbuf + sizeof(peekbuf)); *pbp++ = c; c = '\r'; ostate = OS_INLINE; @@ -4768,7 +4773,11 @@ else if ((d = sm_io_getc(e->e_dfp, SM_TIME_DEFAULT)) != SM_IO_EOF) + { + SM_ASSERT(pbp < peekbuf + + sizeof(peekbuf)); *pbp++ = d; + } if (d == '\n' || d == SM_IO_EOF) { @@ -4818,6 +4827,8 @@ mci->mci_mailer->m_eol); } ostate = OS_HEAD; + SM_ASSERT(pbp < peekbuf + + sizeof(peekbuf)); *pbp++ = c; continue; } Index: gnu/usr.sbin/sendmail/sendmail/parseaddr.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/parseaddr.c,v retrieving revision 1.13 retrieving revision 1.13.2.2 diff -u -r1.13 -r1.13.2.2 --- gnu/usr.sbin/sendmail/sendmail/parseaddr.c 15 Sep 2002 02:23:36 -0000 1.13 +++ gnu/usr.sbin/sendmail/sendmail/parseaddr.c 31 Mar 2003 01:01:47 -0000 1.13.2.2 @@ -608,7 +608,7 @@ }; -#define NOCHAR -1 /* signal nothing in lookahead token */ +#define NOCHAR (-1) /* signal nothing in lookahead token */ char ** prescan(addr, delim, pvpbuf, pvpbsize, delimptr, toktab) @@ -694,6 +694,7 @@ /* see if there is room */ if (q >= &pvpbuf[pvpbsize - 5]) { + addrtoolong: usrerr("553 5.1.1 Address too long"); if (strlen(addr) > MAXNAME) addr[MAXNAME] = '\0'; @@ -705,11 +706,15 @@ } /* squirrel it away */ +#if !ALLOW_255 + if ((char) c == (char) -1 && !tTd(82, 101)) + c &= 0x7f; +#endif /* !ALLOW_255 */ *q++ = c; } /* read a new input character */ - c = *p++; + c = (*p++) & 0x00ff; if (c == '\0') { /* diagnose and patch up bad syntax */ @@ -764,6 +769,9 @@ } else if (c != '!' || state == QST) { + /* see if there is room */ + if (q >= &pvpbuf[pvpbsize - 5]) + goto addrtoolong; *q++ = '\\'; continue; } @@ -849,6 +857,9 @@ /* new token */ if (tok != q) { + /* see if there is room */ + if (q >= &pvpbuf[pvpbsize - 5]) + goto addrtoolong; *q++ = '\0'; if (tTd(22, 36)) { 3.2/common/PaxHeaders.56026/015_realpath.patch01004440001756001161000000000036077136437400015666xustar0030 atime=1783552627.868695755 3.2/common/015_realpath.patch010044400017560011610000000032440771364374000150320ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 015_realpath.patch And then rebuild and install libc: cd lib/libc make obj cleandir depend make && make install Note that programs that are linked statically will not pick up the change unless they are rebuilt. This includes the contents of /bin and /sbin. The following static binaries use realpath(3): /bin/mv, /bin/systrace, /sbin/mount, /sbin/mount_*, /sbin/mountd, /sbin/umount Of those, the most important to rebuild is /sbin/mountd. Index: lib/libc/stdlib/realpath.c =================================================================== RCS file: /cvs/src/lib/libc/stdlib/realpath.c,v retrieving revision 1.7 retrieving revision 1.7.2.1 diff -u -r1.7 -r1.7.2.1 --- lib/libc/stdlib/realpath.c 24 May 2002 21:22:37 -0000 1.7 +++ lib/libc/stdlib/realpath.c 3 Aug 2003 02:29:29 -0000 1.7.2.1 @@ -60,7 +60,7 @@ char *resolved; { struct stat sb; - int fd, n, rootd, serrno; + int fd, n, needslash, serrno; char *p, *q, wbuf[MAXPATHLEN]; int symlinks = 0; @@ -134,18 +134,18 @@ * happens if the last component is empty, or the dirname is root. */ if (resolved[0] == '/' && resolved[1] == '\0') - rootd = 1; + needslash = 0; else - rootd = 0; + needslash = 1; if (*wbuf) { - if (strlen(resolved) + strlen(wbuf) + rootd + 1 > MAXPATHLEN) { + if (strlen(resolved) + strlen(wbuf) + needslash >= MAXPATHLEN) { errno = ENAMETOOLONG; goto err1; } - if (rootd == 0) - (void)strcat(resolved, "/"); - (void)strcat(resolved, wbuf); + if (needslash) + (void)strlcat(resolved, "/", MAXPATHLEN); + (void)strlcat(resolved, wbuf, MAXPATHLEN); } /* Go back to where we came from. */ 3.2/common/PaxHeaders.56026/016_sendmail.patch01004440001756001161000000000036077223227400015655xustar0030 atime=1783552627.868695755 3.2/common/016_sendmail.patch010044400017560011610000000014760772232274000150260ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 016_sendmail.patch And then rebuild and install sendmail: cd gnu/usr.sbin/sendmail make depend make make install Restart sendmail if necessary: kill -HUP `sed q /var/run/sendmail.pid` Index: gnu/usr.sbin/sendmail/sendmail/sm_resolve.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/sm_resolve.c,v retrieving revision 1.3 retrieving revision 1.3.2.1 diff -u -r1.3 -r1.3.2.1 --- gnu/usr.sbin/sendmail/sendmail/sm_resolve.c 26 Jun 2002 04:48:55 -0000 1.3 +++ gnu/usr.sbin/sendmail/sendmail/sm_resolve.c 25 Aug 2003 18:37:02 -0000 1.3.2.1 @@ -233,6 +233,7 @@ dns_free_data(r); return NULL; } + memset(*rr, 0, sizeof(**rr)); (*rr)->rr_domain = sm_strdup(host); if ((*rr)->rr_domain == NULL) { 3.2/common/PaxHeaders.56026/017_sshbuffer.patch01004440001756001161000000000036077315233400016050xustar0030 atime=1783552627.868695755 3.2/common/017_sshbuffer.patch010044400017560011610000000052130773152334000152120ustar00ssyncsyncNOTE: this is the second revision of this patch Apply by doing: cd /usr/src patch -p0 < 017_sshbuffer.patch cd usr.bin/ssh make obj make cleandir make depend make && make install Do not forget to restart sshd(8). If you started sshd(8) with a full path (i.e. /usr/sbin/sshd) you can simply send it a SIGHUP and it will re-exec itself. E.g. kill -HUP `cat /var/run/sshd.pid` Index: usr.bin/ssh/buffer.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/buffer.c,v retrieving revision 1.16 diff -u -r1.16 buffer.c --- usr.bin/ssh/buffer.c 26 Jun 2002 08:54:18 -0000 1.16 +++ usr.bin/ssh/buffer.c 17 Sep 2003 00:53:39 -0000 @@ -23,8 +23,11 @@ void buffer_init(Buffer *buffer) { - buffer->alloc = 4096; - buffer->buf = xmalloc(buffer->alloc); + const u_int len = 4096; + + buffer->alloc = 0; + buffer->buf = xmalloc(len); + buffer->alloc = len; buffer->offset = 0; buffer->end = 0; } @@ -34,8 +37,10 @@ void buffer_free(Buffer *buffer) { - memset(buffer->buf, 0, buffer->alloc); - xfree(buffer->buf); + if (buffer->alloc > 0) { + memset(buffer->buf, 0, buffer->alloc); + xfree(buffer->buf); + } } /* @@ -69,6 +74,7 @@ void * buffer_append_space(Buffer *buffer, u_int len) { + u_int newlen; void *p; if (len > 0x100000) @@ -98,11 +104,13 @@ goto restart; } /* Increase the size of the buffer and retry. */ - buffer->alloc += len + 32768; - if (buffer->alloc > 0xa00000) + + newlen = buffer->alloc + len + 32768; + if (newlen > 0xa00000) fatal("buffer_append_space: alloc %u not supported", - buffer->alloc); - buffer->buf = xrealloc(buffer->buf, buffer->alloc); + newlen); + buffer->buf = xrealloc(buffer->buf, newlen); + buffer->alloc = newlen; goto restart; /* NOTREACHED */ } Index: usr.bin/ssh/channels.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/channels.c,v retrieving revision 1.183 diff -u -r1.183 channels.c --- usr.bin/ssh/channels.c 17 Sep 2002 07:47:02 -0000 1.183 +++ usr.bin/ssh/channels.c 17 Sep 2003 00:53:41 -0000 @@ -228,12 +228,13 @@ if (found == -1) { /* There are no free slots. Take last+1 slot and expand the array. */ found = channels_alloc; - channels_alloc += 10; if (channels_alloc > 10000) fatal("channel_new: internal error: channels_alloc %d " "too big.", channels_alloc); + channels = xrealloc(channels, + (channels_alloc + 10) * sizeof(Channel *)); + channels_alloc += 10; debug2("channel: expanding %d", channels_alloc); - channels = xrealloc(channels, channels_alloc * sizeof(Channel *)); for (i = found; i < channels_alloc; i++) channels[i] = NULL; } 3.2/common/PaxHeaders.56026/018_sendmail.patch01004440001756001161000000000036077317741400015664xustar0030 atime=1783552627.868695755 3.2/common/018_sendmail.patch010044400017560011610000000050770773177414000150360ustar00ssyncsyncNOTE: this is the second revision of the patch Apply by doing: cd /usr/src patch -p0 < 018_sendmail.patch And then rebuild and install sendmail: cd gnu/usr.sbin/sendmail make depend make make install Restart sendmail if necessary: kill -HUP `sed q /var/run/sendmail.pid` Index: gnu/usr.sbin/sendmail/sendmail/parseaddr.c =================================================================== RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/parseaddr.c,v retrieving revision 1.13.2.2 diff -u -r1.13.2.2 parseaddr.c --- gnu/usr.sbin/sendmail/sendmail/parseaddr.c 31 Mar 2003 01:01:47 -0000 1.13.2.2 +++ gnu/usr.sbin/sendmail/sendmail/parseaddr.c 17 Sep 2003 17:14:08 -0000 @@ -700,7 +700,11 @@ addr[MAXNAME] = '\0'; returnnull: if (delimptr != NULL) + { + if (p > addr) + p--; *delimptr = p; + } CurEnv->e_to = saveto; return NULL; } @@ -1000,6 +1004,8 @@ } if (pvp == NULL) return EX_USAGE; + if (maxatom <= 0) + return EX_USAGE; /* ** Run through the list of rewrite rules, applying @@ -1866,6 +1872,7 @@ register ENVELOPE *e; { bool tempfail = false; + int maxatom; struct mailer **mp; register struct mailer *m; register char *p; @@ -1880,6 +1887,7 @@ printav(tv); } + maxatom = MAXATOM; if (a == NULL) a = (ADDRESS *) sm_rpool_malloc_x(e->e_rpool, sizeof *a); memset((char *) a, '\0', sizeof *a); @@ -1919,14 +1927,22 @@ return a; } mname = *++tv; + --maxatom; /* extract host and user portions */ if (*++tv != NULL && (**tv & 0377) == CANONHOST) + { hostp = ++tv; + --maxatom; + } else hostp = NULL; + --maxatom; while (*tv != NULL && (**tv & 0377) != CANONUSER) + { tv++; + --maxatom; + } if (*tv == NULL) { syserr("554 5.3.5 buildaddr: no user"); @@ -1937,6 +1953,7 @@ else if (hostp != NULL) cataddr(hostp, tv - 1, hbuf, sizeof hbuf, '\0'); cataddr(++tv, NULL, ubuf, sizeof ubuf, ' '); + --maxatom; /* save away the host name */ if (sm_strcasecmp(mname, "error") == 0) @@ -2041,6 +2058,7 @@ { p++; tv++; + --maxatom; a->q_flags |= QNOTREMOTE; } @@ -2071,11 +2089,11 @@ !bitset(RF_SENDERADDR|RF_HEADERADDR, flags)) { /* sender addresses done later */ - (void) REWRITE(tv, 2, e); + (void) rewrite(tv, 2, 0, e, maxatom); if (m->m_re_rwset > 0) - (void) REWRITE(tv, m->m_re_rwset, e); + (void) rewrite(tv, m->m_re_rwset, 0, e, maxatom); } - (void) REWRITE(tv, 4, e); + (void) rewrite(tv, 4, 0, e, maxatom); /* save the result for the command line/RCPT argument */ cataddr(tv, NULL, ubuf, sizeof ubuf, '\0'); 3.2/common/PaxHeaders.56026/019_pfnorm.patch01004440001756001161000000000036077374607400015376xustar0030 atime=1783552627.868695755 3.2/common/019_pfnorm.patch010044400017560011610000000234030773746074000145410ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 019_pfnorm.patch And then rebuild your kernel. Index: sys/net/pf_norm.c =================================================================== RCS file: /cvs/src/sys/net/pf_norm.c,v retrieving revision 1.35 retrieving revision 1.35.2.1 diff -u -r1.35 -r1.35.2.1 --- sys/net/pf_norm.c 28 Jun 2002 00:08:23 -0000 1.35 +++ sys/net/pf_norm.c 24 Sep 2003 19:20:31 -0000 1.35.2.1 @@ -105,10 +105,10 @@ void pf_flush_fragments(void); void pf_free_fragment(struct pf_fragment *); struct pf_fragment *pf_find_fragment(struct ip *, struct pf_frag_tree *); -struct mbuf *pf_reassemble(struct mbuf **, struct pf_fragment *, +struct mbuf *pf_reassemble(struct mbuf **, struct pf_fragment **, struct pf_frent *, int); struct mbuf *pf_fragcache(struct mbuf **, struct ip*, - struct pf_fragment *, int, int, int *); + struct pf_fragment **, int, int, int *); u_int16_t pf_cksum_fixup(u_int16_t, u_int16_t, u_int16_t); int pf_normalize_tcp(int, struct ifnet *, struct mbuf *, int, int, void *, struct pf_pdesc *); @@ -324,7 +324,7 @@ } struct mbuf * -pf_reassemble(struct mbuf **m0, struct pf_fragment *frag, +pf_reassemble(struct mbuf **m0, struct pf_fragment **frag, struct pf_frent *frent, int mff) { struct mbuf *m = *m0, *m2; @@ -335,33 +335,33 @@ u_int16_t off = ip->ip_off; u_int16_t max = ip->ip_len + off; - KASSERT(frag == NULL || BUFFER_FRAGMENTS(frag)); + KASSERT(*frag == NULL || BUFFER_FRAGMENTS(*frag)); /* Strip off ip header */ m->m_data += hlen; m->m_len -= hlen; /* Create a new reassembly queue for this packet */ - if (frag == NULL) { - frag = pool_get(&pf_frag_pl, PR_NOWAIT); - if (frag == NULL) { + if (*frag == NULL) { + *frag = pool_get(&pf_frag_pl, PR_NOWAIT); + if (*frag == NULL) { pf_flush_fragments(); - frag = pool_get(&pf_frag_pl, PR_NOWAIT); - if (frag == NULL) + *frag = pool_get(&pf_frag_pl, PR_NOWAIT); + if (*frag == NULL) goto drop_fragment; } - frag->fr_flags = 0; - frag->fr_max = 0; - frag->fr_src = frent->fr_ip->ip_src; - frag->fr_dst = frent->fr_ip->ip_dst; - frag->fr_p = frent->fr_ip->ip_p; - frag->fr_id = frent->fr_ip->ip_id; - frag->fr_timeout = time.tv_sec; - LIST_INIT(&frag->fr_queue); + (*frag)->fr_flags = 0; + (*frag)->fr_max = 0; + (*frag)->fr_src = frent->fr_ip->ip_src; + (*frag)->fr_dst = frent->fr_ip->ip_dst; + (*frag)->fr_p = frent->fr_ip->ip_p; + (*frag)->fr_id = frent->fr_ip->ip_id; + (*frag)->fr_timeout = time.tv_sec; + LIST_INIT(&(*frag)->fr_queue); - RB_INSERT(pf_frag_tree, &pf_frag_tree, frag); - TAILQ_INSERT_HEAD(&pf_fragqueue, frag, frag_next); + RB_INSERT(pf_frag_tree, &pf_frag_tree, *frag); + TAILQ_INSERT_HEAD(&pf_fragqueue, *frag, frag_next); /* We do not have a previous fragment */ frep = NULL; @@ -372,7 +372,7 @@ * Find a fragment after the current one: * - off contains the real shifted offset. */ - LIST_FOREACH(frea, &frag->fr_queue, fr_next) { + LIST_FOREACH(frea, &(*frag)->fr_queue, fr_next) { if (frea->fr_ip->ip_off > off) break; frep = frea; @@ -419,45 +419,46 @@ insert: /* Update maximum data size */ - if (frag->fr_max < max) - frag->fr_max = max; + if ((*frag)->fr_max < max) + (*frag)->fr_max = max; /* This is the last segment */ if (!mff) - frag->fr_flags |= PFFRAG_SEENLAST; + (*frag)->fr_flags |= PFFRAG_SEENLAST; if (frep == NULL) - LIST_INSERT_HEAD(&frag->fr_queue, frent, fr_next); + LIST_INSERT_HEAD(&(*frag)->fr_queue, frent, fr_next); else LIST_INSERT_AFTER(frep, frent, fr_next); /* Check if we are completely reassembled */ - if (!(frag->fr_flags & PFFRAG_SEENLAST)) + if (!((*frag)->fr_flags & PFFRAG_SEENLAST)) return (NULL); /* Check if we have all the data */ off = 0; - for (frep = LIST_FIRST(&frag->fr_queue); frep; frep = next) { + for (frep = LIST_FIRST(&(*frag)->fr_queue); frep; frep = next) { next = LIST_NEXT(frep, fr_next); off += frep->fr_ip->ip_len; - if (off < frag->fr_max && + if (off < (*frag)->fr_max && (next == NULL || next->fr_ip->ip_off != off)) { DPFPRINTF(("missing fragment at %d, next %d, max %d\n", off, next == NULL ? -1 : next->fr_ip->ip_off, - frag->fr_max)); + (*frag)->fr_max)); return (NULL); } } - DPFPRINTF(("%d < %d?\n", off, frag->fr_max)); - if (off < frag->fr_max) + DPFPRINTF(("%d < %d?\n", off, (*frag)->fr_max)); + if (off < (*frag)->fr_max) return (NULL); /* We have all the data */ - frent = LIST_FIRST(&frag->fr_queue); + frent = LIST_FIRST(&(*frag)->fr_queue); KASSERT(frent != NULL); if ((frent->fr_ip->ip_hl << 2) + off > IP_MAXPACKET) { DPFPRINTF(("drop: too big: %d\n", off)); - pf_free_fragment(frag); + pf_free_fragment(*frag); + *frag = NULL; return (NULL); } next = LIST_NEXT(frent, fr_next); @@ -479,11 +480,12 @@ m_cat(m, m2); } - ip->ip_src = frag->fr_src; - ip->ip_dst = frag->fr_dst; + ip->ip_src = (*frag)->fr_src; + ip->ip_dst = (*frag)->fr_dst; /* Remove from fragment queue */ - pf_remove_fragment(frag); + pf_remove_fragment(*frag); + *frag = NULL; hlen = ip->ip_hl << 2; ip->ip_len = off + hlen; @@ -511,7 +513,7 @@ } struct mbuf * -pf_fragcache(struct mbuf **m0, struct ip *h, struct pf_fragment *frag, int mff, +pf_fragcache(struct mbuf **m0, struct ip *h, struct pf_fragment **frag, int mff, int drop, int *nomem) { struct mbuf *m = *m0; @@ -521,41 +523,41 @@ u_int16_t max = ip_len + off; int hosed = 0; - KASSERT(frag == NULL || !BUFFER_FRAGMENTS(frag)); + KASSERT(*frag == NULL || !BUFFER_FRAGMENTS(*frag)); /* Create a new range queue for this packet */ - if (frag == NULL) { - frag = pool_get(&pf_cache_pl, PR_NOWAIT); - if (frag == NULL) { + if (*frag == NULL) { + *frag = pool_get(&pf_cache_pl, PR_NOWAIT); + if (*frag == NULL) { pf_flush_fragments(); - frag = pool_get(&pf_cache_pl, PR_NOWAIT); - if (frag == NULL) + *frag = pool_get(&pf_cache_pl, PR_NOWAIT); + if (*frag == NULL) goto no_mem; } /* Get an entry for the queue */ cur = pool_get(&pf_cent_pl, PR_NOWAIT); if (cur == NULL) { - pool_put(&pf_cache_pl, frag); + pool_put(&pf_cache_pl, *frag); goto no_mem; } pf_ncache++; - frag->fr_flags = PFFRAG_NOBUFFER; - frag->fr_max = 0; - frag->fr_src = h->ip_src; - frag->fr_dst = h->ip_dst; - frag->fr_p = h->ip_p; - frag->fr_id = h->ip_id; - frag->fr_timeout = time.tv_sec; + (*frag)->fr_flags = PFFRAG_NOBUFFER; + (*frag)->fr_max = 0; + (*frag)->fr_src = h->ip_src; + (*frag)->fr_dst = h->ip_dst; + (*frag)->fr_p = h->ip_p; + (*frag)->fr_id = h->ip_id; + (*frag)->fr_timeout = time.tv_sec; cur->fr_off = off; cur->fr_end = max; - LIST_INIT(&frag->fr_cache); - LIST_INSERT_HEAD(&frag->fr_cache, cur, fr_next); + LIST_INIT(&(*frag)->fr_cache); + LIST_INSERT_HEAD(&(*frag)->fr_cache, cur, fr_next); - RB_INSERT(pf_frag_tree, &pf_cache_tree, frag); - TAILQ_INSERT_HEAD(&pf_cachequeue, frag, frag_next); + RB_INSERT(pf_frag_tree, &pf_cache_tree, *frag); + TAILQ_INSERT_HEAD(&pf_cachequeue, *frag, frag_next); DPFPRINTF(("fragcache[%d]: new %d-%d\n", h->ip_id, off, max)); @@ -567,7 +569,7 @@ * - off contains the real shifted offset. */ frp = NULL; - LIST_FOREACH(fra, &frag->fr_cache, fr_next) { + LIST_FOREACH(fra, &(*frag)->fr_cache, fr_next) { if (fra->fr_off > off) break; frp = fra; @@ -752,21 +754,22 @@ pass: /* Update maximum data size */ - if (frag->fr_max < max) - frag->fr_max = max; + if ((*frag)->fr_max < max) + (*frag)->fr_max = max; /* This is the last segment */ if (!mff) - frag->fr_flags |= PFFRAG_SEENLAST; + (*frag)->fr_flags |= PFFRAG_SEENLAST; /* Check if we are completely reassembled */ - if ((frag->fr_flags & PFFRAG_SEENLAST) && - LIST_FIRST(&frag->fr_cache)->fr_off == 0 && - LIST_FIRST(&frag->fr_cache)->fr_end == frag->fr_max) { + if (((*frag)->fr_flags & PFFRAG_SEENLAST) && + LIST_FIRST(&(*frag)->fr_cache)->fr_off == 0 && + LIST_FIRST(&(*frag)->fr_cache)->fr_end == (*frag)->fr_max) { /* Remove from fragment queue */ DPFPRINTF(("fragcache[%d]: done 0-%d\n", h->ip_id, - frag->fr_max)); - pf_free_fragment(frag); + (*frag)->fr_max)); + pf_free_fragment(*frag); + *frag = NULL; } return (m); @@ -775,8 +778,8 @@ *nomem = 1; /* Still need to pay attention to !IP_MF */ - if (!mff && frag) - frag->fr_flags |= PFFRAG_SEENLAST; + if (!mff && *frag != NULL) + (*frag)->fr_flags |= PFFRAG_SEENLAST; m_freem(m); return (NULL); @@ -784,15 +787,15 @@ drop_fragment: /* Still need to pay attention to !IP_MF */ - if (!mff && frag) - frag->fr_flags |= PFFRAG_SEENLAST; + if (!mff && *frag != NULL) + (*frag)->fr_flags |= PFFRAG_SEENLAST; if (drop) { /* This fragment has been deemed bad. Don't reass */ - if ((frag->fr_flags & PFFRAG_DROP) == 0) + if (((*frag)->fr_flags & PFFRAG_DROP) == 0) DPFPRINTF(("fragcache[%d]: dropping overall fragment\n", h->ip_id)); - frag->fr_flags |= PFFRAG_DROP; + (*frag)->fr_flags |= PFFRAG_DROP; } m_freem(m); @@ -897,12 +900,12 @@ /* Might return a completely reassembled mbuf, or NULL */ DPFPRINTF(("reass frag %d @ %d-%d\n", h->ip_id, fragoff, max)); - *m0 = m = pf_reassemble(m0, frag, frent, mff); + *m0 = m = pf_reassemble(m0, &frag, frent, mff); if (m == NULL) return (PF_DROP); - if (frag && (frag->fr_flags & PFFRAG_DROP)) + if (frag != NULL && (frag->fr_flags & PFFRAG_DROP)) goto drop; h = mtod(m, struct ip *); @@ -931,7 +934,7 @@ goto bad; } - *m0 = m = pf_fragcache(m0, h, frag, mff, + *m0 = m = pf_fragcache(m0, h, &frag, mff, (r->rule_flag & PFRULE_FRAGDROP) ? 1 : 0, &nomem); if (m == NULL) { if (nomem) @@ -946,7 +949,7 @@ goto no_mem; m_tag_prepend(m, mtag); } - if (frag && (frag->fr_flags & PFFRAG_DROP)) + if (frag != NULL && (frag->fr_flags & PFFRAG_DROP)) goto drop; goto fragment_pass; } 3.2/common/PaxHeaders.56026/020_asn1.patch01004440001756001161000000000036077372101400014712xustar0030 atime=1783552627.868695755 3.2/common/020_asn1.patch010044400017560011610000000103730773721014000140570ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 020_asn1.patch And then rebuild and install OpenSSL: cd lib/libssl make obj make depend make make install Index: lib/libssl/src/crypto/asn1/asn1_lib.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/asn1_lib.c,v retrieving revision 1.10 diff -u -r1.10 asn1_lib.c --- lib/libssl/src/crypto/asn1/asn1_lib.c 10 Sep 2002 16:31:54 -0000 1.10 +++ lib/libssl/src/crypto/asn1/asn1_lib.c 3 Oct 2003 22:20:24 -0000 @@ -104,10 +104,12 @@ l<<=7L; l|= *(p++)&0x7f; if (--max == 0) goto err; + if (l > (INT_MAX >> 7L)) goto err; } l<<=7L; l|= *(p++)&0x7f; tag=(int)l; + if (--max == 0) goto err; } else { Index: lib/libssl/src/crypto/asn1/tasn_dec.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/tasn_dec.c,v retrieving revision 1.2 diff -u -r1.2 tasn_dec.c --- lib/libssl/src/crypto/asn1/tasn_dec.c 14 Sep 2002 11:18:02 -0000 1.2 +++ lib/libssl/src/crypto/asn1/tasn_dec.c 3 Oct 2003 22:20:24 -0000 @@ -691,6 +691,7 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it) { + ASN1_VALUE **opval = NULL; ASN1_STRING *stmp; ASN1_TYPE *typ = NULL; int ret = 0; @@ -705,6 +706,7 @@ *pval = (ASN1_VALUE *)typ; } else typ = (ASN1_TYPE *)*pval; if(utype != typ->type) ASN1_TYPE_set(typ, utype, NULL); + opval = pval; pval = (ASN1_VALUE **)&typ->value.ptr; } switch(utype) { @@ -796,7 +798,12 @@ ret = 1; err: - if(!ret) ASN1_TYPE_free(typ); + if(!ret) + { + ASN1_TYPE_free(typ); + if (opval) + *opval = NULL; + } return ret; } Index: lib/libssl/src/crypto/x509/x509_vfy.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/x509/x509_vfy.c,v retrieving revision 1.6 diff -u -r1.6 x509_vfy.c --- lib/libssl/src/crypto/x509/x509_vfy.c 15 May 2002 02:29:17 -0000 1.6 +++ lib/libssl/src/crypto/x509/x509_vfy.c 3 Oct 2003 22:20:24 -0000 @@ -674,7 +674,7 @@ ok=(*cb)(0,ctx); if (!ok) goto end; } - if (X509_verify(xs,pkey) <= 0) + else if (X509_verify(xs,pkey) <= 0) /* XXX For the final trusted self-signed cert, * this is a waste of time. That check should * optional so that e.g. 'openssl x509' can be Index: lib/libssl/src/ssl/s3_clnt.c =================================================================== RCS file: /cvs/src/lib/libssl/src/ssl/s3_clnt.c,v retrieving revision 1.12 diff -u -r1.12 s3_clnt.c --- lib/libssl/src/ssl/s3_clnt.c 23 Sep 2002 21:32:28 -0000 1.12 +++ lib/libssl/src/ssl/s3_clnt.c 3 Oct 2003 22:20:24 -0000 @@ -1752,6 +1752,7 @@ *(d++)=SSL3_MT_CERTIFICATE_VERIFY; l2n3(n,d); + s->state=SSL3_ST_CW_CERT_VRFY_B; s->init_num=(int)n+4; s->init_off=0; } Index: lib/libssl/src/ssl/s3_srvr.c =================================================================== RCS file: /cvs/src/lib/libssl/src/ssl/s3_srvr.c,v retrieving revision 1.14.2.1 diff -u -r1.14.2.1 s3_srvr.c --- lib/libssl/src/ssl/s3_srvr.c 19 Mar 2003 23:39:12 -0000 1.14.2.1 +++ lib/libssl/src/ssl/s3_srvr.c 3 Oct 2003 22:20:24 -0000 @@ -425,10 +425,11 @@ if (ret == 2) s->state = SSL3_ST_SR_CLNT_HELLO_C; else { - /* could be sent for a DH cert, even if we - * have not asked for it :-) */ - ret=ssl3_get_client_certificate(s); - if (ret <= 0) goto end; + if (s->s3->tmp.cert_request) + { + ret=ssl3_get_client_certificate(s); + if (ret <= 0) goto end; + } s->init_num=0; s->state=SSL3_ST_SR_KEY_EXCH_A; } @@ -838,6 +839,9 @@ } /* TLS does not mind if there is extra stuff */ +#if 0 /* SSL 3.0 does not mind either, so we should disable this test + * (was enabled in 0.9.6d through 0.9.6j and 0.9.7 through 0.9.7b, + * in earlier SSLeay/OpenSSL releases this test existed but was buggy) */ if (s->version == SSL3_VERSION) { if (p < (d+n)) @@ -849,6 +853,7 @@ goto f_err; } } +#endif /* Given s->session->ciphers and SSL_get_ciphers, we must * pick a cipher */ @@ -1346,6 +1351,7 @@ s->init_num += 4; #endif + s->state = SSL3_ST_SW_CERT_REQ_B; } /* SSL3_ST_SW_CERT_REQ_B */ 3.2/common/PaxHeaders.56026/021_arp.patch01004440001756001161000000000036077374607400014650xustar0030 atime=1783552627.868695755 3.2/common/021_arp.patch010044400017560011610000000147600773746074000140210ustar00ssyncsyncApply by doing: cd /usr/src patch -p0 < 021_arp.patch And then rebuild your kernel. Index: sys/net/route.c =================================================================== RCS file: /cvs/src/sys/net/route.c,v retrieving revision 1.35 diff -u -r1.35 route.c --- net/route.c 2003/02/12 14:41:07 1.35 +++ net/route.c 2003/09/26 21:21:46 @@ -1,4 +1,4 @@ -/* $OpenBSD: route.c,v 1.35 2003/02/12 14:41:07 jason Exp $ */ +/* $OpenBSD: route.c,v 1.37 2003/08/26 08:33:12 itojun Exp $ */ /* $NetBSD: route.c,v 1.14 1996/02/13 22:00:46 christos Exp $ */ /* @@ -143,6 +143,9 @@ struct sockaddr wildcard; /* zero valued cookie for wildcard searches */ static int okaytoclone(u_int, int); +static int rtdeletemsg(struct rtentry *); +static int rtflushclone1(struct radix_node *, void *); +static void rtflushclone(struct radix_node_head *, struct rtentry *); #ifdef IPSEC @@ -453,6 +456,67 @@ } /* + * Delete a route and generate a message + */ +static int +rtdeletemsg(rt) + struct rtentry *rt; +{ + int error; + struct rt_addrinfo info; + + /* + * Request the new route so that the entry is not actually + * deleted. That will allow the information being reported to + * be accurate (and consistent with route_output()). + */ + bzero((caddr_t)&info, sizeof(info)); + info.rti_info[RTAX_DST] = rt_key(rt); + info.rti_info[RTAX_NETMASK] = rt_mask(rt); + info.rti_info[RTAX_GATEWAY] = rt->rt_gateway; + info.rti_flags = rt->rt_flags; + error = rtrequest1(RTM_DELETE, &info, &rt); + + rt_missmsg(RTM_DELETE, &info, info.rti_flags, error); + + /* Adjust the refcount */ + if (error == 0 && rt->rt_refcnt <= 0) { + rt->rt_refcnt++; + rtfree(rt); + } + return (error); +} + +static int +rtflushclone1(rn, arg) + struct radix_node *rn; + void *arg; +{ + struct rtentry *rt, *parent; + + rt = (struct rtentry *)rn; + parent = (struct rtentry *)arg; + if ((rt->rt_flags & RTF_CLONED) != 0 && rt->rt_parent == parent) + rtdeletemsg(rt); + return 0; +} + +static void +rtflushclone(rnh, parent) + struct radix_node_head *rnh; + struct rtentry *parent; +{ + +#ifdef DIAGNOSTIC + if (!parent || (parent->rt_flags & RTF_CLONING) == 0) + panic("rtflushclone: called with a non-cloning route"); + if (!rnh->rnh_walktree) + panic("rtflushclone: no rnh_walktree"); +#endif + rnh->rnh_walktree(rnh, rtflushclone1, (void *)parent); +} + +/* * Routing table ioctl interface. */ int @@ -599,7 +663,7 @@ struct rtentry **ret_nrt; { int s = splsoftnet(); int error = 0; - register struct rtentry *rt; + register struct rtentry *rt, *crt; register struct radix_node *rn; register struct radix_node_head *rnh; struct ifaddr *ifa; @@ -614,6 +678,11 @@ case RTM_DELETE: if ((rn = rnh->rnh_deladdr(dst, netmask, rnh)) == NULL) senderr(ESRCH); + rt = (struct rtentry *)rn; + if ((rt->rt_flags & RTF_CLONING) != 0) { + /* clean up any cloned children */ + rtflushclone(rnh, rt); + } if (rn->rn_flags & (RNF_ACTIVE | RNF_ROOT)) panic ("rtrequest delete"); rt = (struct rtentry *)rn; @@ -621,6 +690,10 @@ rt = rt->rt_gwroute; RTFREE(rt); (rt = (struct rtentry *)rn)->rt_gwroute = NULL; } + if (rt->rt_parent) { + rt->rt_parent->rt_refcnt--; + rt->rt_parent = NULL; + } rt->rt_flags &= ~RTF_UP; if ((ifa = rt->rt_ifa) && ifa->ifa_rtrequest) ifa->ifa_rtrequest(RTM_DELETE, rt, info); @@ -636,8 +709,11 @@ case RTM_RESOLVE: if (ret_nrt == NULL || (rt = *ret_nrt) == NULL) senderr(EINVAL); + if ((rt->rt_flags & RTF_CLONING) == 0) + senderr(EINVAL); ifa = rt->rt_ifa; - flags = rt->rt_flags & ~RTF_CLONING; + flags = rt->rt_flags & ~(RTF_CLONING | RTF_STATIC); + flags |= RTF_CLONED; gateway = rt->rt_gateway; if ((netmask = rt->rt_genmask) == NULL) flags |= RTF_HOST; @@ -663,15 +739,6 @@ rt_maskedcopy(dst, ndst, netmask); } else Bcopy(dst, ndst, dst->sa_len); - rn = rnh->rnh_addaddr((caddr_t)ndst, (caddr_t)netmask, - rnh, rt->rt_nodes); - if (rn == NULL) { - if (rt->rt_gwroute) - rtfree(rt->rt_gwroute); - Free(rt_key(rt)); - Free(rt); - senderr(EEXIST); - } ifa->ifa_refcnt++; rt->rt_ifa = ifa; rt->rt_ifp = ifa->ifa_ifp; @@ -682,12 +749,38 @@ */ rt->rt_rmx = (*ret_nrt)->rt_rmx; /* copy metrics */ rt->rt_parent = *ret_nrt; /* Back ptr. to parent. */ + rt->rt_parent->rt_refcnt++; + } + rn = rnh->rnh_addaddr((caddr_t)ndst, (caddr_t)netmask, + rnh, rt->rt_nodes); + if (rn == NULL && (crt = rtalloc1(ndst, 0)) != NULL) { + /* overwrite cloned route */ + if ((crt->rt_flags & RTF_CLONED) != 0) { + rtdeletemsg(crt); + rn = rnh->rnh_addaddr((caddr_t)ndst, + (caddr_t)netmask, rnh, rt->rt_nodes); + } + RTFREE(crt); + } + if (rn == 0) { + IFAFREE(ifa); + if ((rt->rt_flags & RTF_CLONED) != 0 && rt->rt_parent) + rtfree(rt->rt_parent); + if (rt->rt_gwroute) + rtfree(rt->rt_gwroute); + Free(rt_key(rt)); + Free(rt); + senderr(EEXIST); } if (ifa->ifa_rtrequest) ifa->ifa_rtrequest(req, rt, info); if (ret_nrt) { *ret_nrt = rt; rt->rt_refcnt++; + } + if ((rt->rt_flags & RTF_CLONING) != 0) { + /* clean up any cloned children */ + rtflushclone(rnh, rt); } break; } Index: sys/net/route.h =================================================================== RCS file: /cvs/src/sys/net/route.h,v retrieving revision 1.16 diff -u -r1.16 route.h --- net/route.h 2003/02/12 14:41:07 1.16 +++ net/route.h 2003/09/26 21:21:46 @@ -143,6 +143,7 @@ #define RTF_PROTO3 0x2000 /* protocol specific routing flag */ #define RTF_PROTO2 0x4000 /* protocol specific routing flag */ #define RTF_PROTO1 0x8000 /* protocol specific routing flag */ +#define RTF_CLONED 0x10000 /* this is a cloned route */ #ifndef _KERNEL /* obsoleted */ Index: sys/netinet/if_ether.c =================================================================== RCS file: /cvs/src/sys/netinet/if_ether.c,v retrieving revision 1.45.4.1 diff -u -r1.45.4.1 if_ether.c --- netinet/if_ether.c 2003/05/12 04:07:20 1.45.4.1 +++ netinet/if_ether.c 2003/09/26 21:21:49 @@ -719,10 +719,18 @@ rt->rt_refcnt--; if ((rt->rt_flags & RTF_GATEWAY) || (rt->rt_flags & RTF_LLINFO) == 0 || rt->rt_gateway->sa_family != AF_LINK) { - if (create) + if (create) { log(LOG_DEBUG, "arplookup: unable to enter address for %s\n", inet_ntoa(sin.sin_addr)); + if (rt->rt_refcnt <= 0 && + (rt->rt_flags & RTF_CLONED) != 0) { + rtrequest(RTM_DELETE, + (struct sockaddr *)rt_key(rt), + rt->rt_gateway, rt_mask(rt), rt->rt_flags, + 0); + } + } return (0); } return ((struct llinfo_arp *)rt->rt_llinfo); 3.2/PaxHeaders.56026/hp30000407550001756001161000000000036101675603350011750xustar0030 atime=1783552627.868695755 3.2/hp300004075500017560011610000000000001016756033500111045ustar00ssyncsync3.2/PaxHeaders.56026/i38600407550001756001161000000000036101675603350011607xustar0030 atime=1783552627.868695755 3.2/i386004075500017560011610000000000001016756033500107435ustar00ssyncsync3.2/PaxHeaders.56026/m68k00407550001756001161000000000036101675603350011703xustar0030 atime=1783552627.868695755 3.2/m68k004075500017560011610000000000001016756033500110375ustar00ssyncsync3.2/PaxHeaders.56026/mac68k00407550001756001161000000000036101675603350012207xustar0030 atime=1783552627.868695755 3.2/mac68k004075500017560011610000000000001016756033500113435ustar00ssyncsync3.2/PaxHeaders.56026/macppc00407550001756001161000000000036101675603350012361xustar0030 atime=1783552627.868695755 3.2/macppc004075500017560011610000000000001016756033500115155ustar00ssyncsync3.2/PaxHeaders.56026/mvme68k00407550001756001161000000000036101675603350012413xustar0030 atime=1783552627.868695755 3.2/mvme68k004075500017560011610000000000001016756033500115475ustar00ssyncsync3.2/PaxHeaders.56026/ports00407550001756001161000000000036101675603350012265xustar0030 atime=1783552627.868695755 3.2/ports004075500017560011610000000000001016756033500114215ustar00ssyncsync3.2/PaxHeaders.56026/sparc00407550001756001161000000000036101675603350012226xustar0030 atime=1783552627.868695755 3.2/sparc004075500017560011610000000000001016756033500113625ustar00ssyncsync3.2/PaxHeaders.56026/sparc6400407550001756001161000000000036101675603350012400xustar0030 atime=1783552627.868695755 3.2/sparc64004075500017560011610000000000001016756033500115345ustar00ssyncsync3.2/PaxHeaders.56026/vax00407550001756001161000000000036101675603350011714xustar0030 atime=1783552627.868695755 3.2/vax004075500017560011610000000000001016756033500110505ustar00ssyncsync