./PaxHeaders.42570/5.700407550001756001161000000000036126033631120011250xustar0030 atime=1783552627.998688368 5.7004075500017560011610000000000001260336311200102505ustar00ssyncsync5.7/PaxHeaders.42570/common00407550001756001161000000000036126716627230012422xustar0030 atime=1783552627.998688368 5.7/common004075500017560011610000000000001267166272300115575ustar00ssyncsync5.7/common/PaxHeaders.42570/008_smtpd.patch.sig01006440001756001161000000000074125363311010015772xustar0030 mtime=1434038849.134121834 30 atime=1783552628.008688802 5.7/common/008_smtpd.patch.sig010064400017560011610000000071441253633110100151400ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb0EA8qodxX6VJYgaKQ3ItV2Y4dDimPZmWCykm5ztSqf9Mfu82xxgoXSmFUWXqTBSg5P17RPyVPyruRaJKTIsEwk= OpenBSD 5.7 errata 8, Jun 9, 2015: Fix multiple reliability issues in smtpd: * local user can cause smtpd to fail by writing an invalid imsg to control socket. * local user can prevent smtpd from serving new requests by exhausting descriptors. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 008_smtpd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install smtpd: cd /usr/src/usr.sbin/smtpd make obj make make install Index: usr.sbin/smtpd/control.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/control.c,v retrieving revision 1.102 diff -u -p -u -p -r1.102 control.c --- usr.sbin/smtpd/control.c 20 Jan 2015 17:37:54 -0000 1.102 +++ usr.sbin/smtpd/control.c 8 Jun 2015 21:04:45 -0000 @@ -73,9 +73,11 @@ extern const char *backend_stat; static uint32_t connid = 0; static struct tree ctl_conns; +static struct tree ctl_count; static struct stat_digest digest; -#define CONTROL_FD_RESERVE 5 +#define CONTROL_FD_RESERVE 5 +#define CONTROL_MAXCONN_PER_CLIENT 32 static void control_imsg(struct mproc *p, struct imsg *imsg) @@ -279,6 +281,7 @@ control(void) signal(SIGHUP, SIG_IGN); tree_init(&ctl_conns); + tree_init(&ctl_count); memset(&digest, 0, sizeof digest); digest.startup = time(NULL); @@ -327,6 +330,9 @@ control_accept(int listenfd, short event socklen_t len; struct sockaddr_un sun; struct ctl_conn *c; + size_t *count; + uid_t euid; + gid_t egid; if (getdtablesize() - getdtablecount() < CONTROL_FD_RESERVE) goto pause; @@ -343,9 +349,26 @@ control_accept(int listenfd, short event session_socket_blockmode(connfd, BM_NONBLOCK); - c = xcalloc(1, sizeof(*c), "control_accept"); - if (getpeereid(connfd, &c->euid, &c->egid) == -1) + if (getpeereid(connfd, &euid, &egid) == -1) fatal("getpeereid"); + + count = tree_get(&ctl_count, euid); + if (count == NULL) { + count = xcalloc(1, sizeof *count, "control_accept"); + tree_xset(&ctl_count, euid, count); + } + + if (*count == CONTROL_MAXCONN_PER_CLIENT) { + close(connfd); + log_warnx("warn: too many connections to control socket " + "from user with uid %lu", (unsigned long int)euid); + return; + } + (*count)++; + + c = xcalloc(1, sizeof(*c), "control_accept"); + c->euid = euid; + c->egid = egid; c->id = ++connid; c->mproc.proc = PROC_CLIENT; c->mproc.handler = control_dispatch_ext; @@ -365,6 +388,14 @@ pause: static void control_close(struct ctl_conn *c) { + size_t *count; + + count = tree_xget(&ctl_count, c->euid); + (*count)--; + if (*count == 0) { + tree_xpop(&ctl_count, c->euid); + free(count); + } tree_xpop(&ctl_conns, c->id); mproc_clear(&c->mproc); free(c); Index: usr.sbin/smtpd/mproc.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/mproc.c,v retrieving revision 1.11 diff -u -p -u -p -r1.11 mproc.c --- usr.sbin/smtpd/mproc.c 16 Jan 2015 06:40:20 -0000 1.11 +++ usr.sbin/smtpd/mproc.c 8 Jun 2015 21:04:45 -0000 @@ -186,6 +186,14 @@ mproc_dispatch(int fd, short event, void for (;;) { if ((n = imsg_get(&p->imsgbuf, &imsg)) == -1) { + + if (smtpd_process == PROC_CONTROL && + p->proc == PROC_CLIENT) { + log_warnx("warn: client sent invalid imsg " + "over control socket"); + p->handler(p, NULL); + return; + } log_warn("fatal: %s: error in imsg_get for %s", proc_name(smtpd_process), p->name); fatalx(NULL); 5.7/common/PaxHeaders.42570/019_obj2txt.patch.sig01006440001756001161000000000074126100341620016241xustar0030 mtime=1444952178.842225887 30 atime=1783552628.008688802 5.7/common/019_obj2txt.patch.sig010064400017560011610000000034761261003416200154130ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb2juCQbNQzCE5BmI/W+ycMC6aGqIzX0e7UyQrHuCA7ME8SijyOYRmVXJ/aAGXvASiKgFvhxrAEM3MmdT/nAyNQA= OpenBSD 5.7 errata 19, Oct 15, 2015: The OBJ_obj2txt function in libcrypto contains a one byte buffer overrun and memory leak, as reported by Qualys Security. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 019_obj2txt.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install libcrypto: cd src/lib/libcrypto make obj make depend make make install Index: lib/libssl/src/crypto/objects/obj_dat.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/objects/obj_dat.c,v retrieving revision 1.31 diff -u -p -r1.31 obj_dat.c --- lib/libssl/src/crypto/objects/obj_dat.c 8 Aug 2014 04:53:43 -0000 1.31 +++ lib/libssl/src/crypto/objects/obj_dat.c 14 Oct 2015 21:59:44 -0000 @@ -491,7 +491,6 @@ OBJ_obj2txt(char *buf, int buf_len, cons { int i, ret = 0, len, nid, first = 1, use_bn; BIGNUM *bl = NULL; - char *bndec = NULL; unsigned long l; const unsigned char *p; @@ -567,14 +566,16 @@ OBJ_obj2txt(char *buf, int buf_len, cons } if (use_bn) { + char *bndec; + bndec = BN_bn2dec(bl); if (!bndec) goto err; i = snprintf(buf, buf_len, ".%s", bndec); + free(bndec); if (i == -1) goto err; if (i >= buf_len) { - buf += buf_len; buf_len = 0; } else { buf += i; @@ -586,7 +587,6 @@ OBJ_obj2txt(char *buf, int buf_len, cons if (i == -1) goto err; if (i >= buf_len) { - buf += buf_len; buf_len = 0; } else { buf += i; @@ -598,13 +598,11 @@ OBJ_obj2txt(char *buf, int buf_len, cons } out: - free(bndec); BN_free(bl); return ret; err: ret = 0; - buf[0] = '\0'; goto out; } 5.7/common/PaxHeaders.42570/021_clientcert.patch.sig01006440001756001161000000000074126302214430016774xustar0030 mtime=1449206563.071581228 30 atime=1783552628.008688802 5.7/common/021_clientcert.patch.sig010064400017560011610000000025541263022144300161420ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb9nwe5ejJkFIRePsdQp8RQsCErF3noaEaVflJlEfeDvvY8BYhoqJKov8hLit4sBdW8E16mLrZIBdfQSB7FUPygc= OpenBSD 5.7 errata 21, Dec 3, 2015: CVE-2015-3194 - NULL pointer dereference in client certificate validation Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 021_clientcert.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install libcrypto: cd /usr/src/lib/libcrypto make obj make depend make make install Index: lib/libssl/src/crypto/rsa/rsa_ameth.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/rsa/rsa_ameth.c,v retrieving revision 1.14 retrieving revision 1.14.6.1 diff -u -p -u -p -r1.14 -r1.14.6.1 --- lib/libssl/src/crypto/rsa/rsa_ameth.c 11 Feb 2015 04:05:14 -0000 1.14 +++ lib/libssl/src/crypto/rsa/rsa_ameth.c 4 Dec 2015 04:13:43 -0000 1.14.6.1 @@ -298,7 +298,7 @@ rsa_pss_decode(const X509_ALGOR *alg, X5 if (pss->maskGenAlgorithm) { ASN1_TYPE *param = pss->maskGenAlgorithm->parameter; if (OBJ_obj2nid(pss->maskGenAlgorithm->algorithm) == NID_mgf1 && - param->type == V_ASN1_SEQUENCE) { + param && param->type == V_ASN1_SEQUENCE) { p = param->value.sequence->data; plen = param->value.sequence->length; *pmaskHash = d2i_X509_ALGOR(NULL, &p, plen); 5.7/common/PaxHeaders.42570/010_tcp_persist.patch.sig01006440001756001161000000000074125514752150017207xustar0030 mtime=1436973709.208903723 30 atime=1783552628.008688802 5.7/common/010_tcp_persist.patch.sig010064400017560011610000000040431255147521500163500ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb1W0cLwIa4jEVqEbfbRAGS88N9kYbqEIPQoOeEh4Pc+hQ0bFi3PPqyyPKzSvWUqZM4EgYQiyqB5UbOi/TwjyLg4= OpenBSD 5.7 errata 10, July 14, 2015 A TCP socket can become confused and not properly cleanup resources. Apply patch using: signify -Vep /etc/signify/openbsd-57-base.pub -x 010_tcp_persist.patch.sig \ -m - | (cd /usr/src && patch -p0) Then build and install a new kernel cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/netinet/tcp_output.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/tcp_output.c,v retrieving revision 1.108 diff -u -p -r1.108 tcp_output.c --- sys/netinet/tcp_output.c 19 Dec 2014 17:14:40 -0000 1.108 +++ sys/netinet/tcp_output.c 13 Jul 2015 16:09:43 -0000 @@ -1008,6 +1008,32 @@ send: tp->t_rxtshift = 0; } } + + if (len == 0 && so->so_snd.sb_cc && + TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 && + TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) { + /* + * Avoid a situation where we do not set persist timer + * after a zero window condition. For example: + * 1) A -> B: packet with enough data to fill the window + * 2) B -> A: ACK for #1 + new data (0 window + * advertisement) + * 3) A -> B: ACK for #2, 0 len packet + * + * In this case, A will not activate the persist timer, + * because it chose to send a packet. Unless tcp_output + * is called for some other reason (delayed ack timer, + * another input packet from B, socket syscall), A will + * not send zero window probes. + * + * So, if you send a 0-length packet, but there is data + * in the socket buffer, and neither the rexmt or + * persist timer is already set, then activate the + * persist timer. + */ + tp->t_rxtshift = 0; + tcp_setpersist(tp); + } } else if (SEQ_GT(tp->snd_nxt + len, tp->snd_max)) tp->snd_max = tp->snd_nxt + len; 5.7/common/PaxHeaders.42570/014_sshd.patch.sig01006440001756001161000000000074125641561240015614xustar0030 mtime=1439751252.769594461 30 atime=1783552628.008688802 5.7/common/014_sshd.patch.sig010064400017560011610000000022461256415612400147600ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUbxEaE6oNKs6un2a9hNnXElN+EO1qiqjnAga2v8AbXZzlOmLfpuI13qnyVe+hlQq2my+ZCh+LfLigqGqIMVUSpgQ= OpenBSD 5.7 errata 14, Aug 16, 2015: Fix permissions to disallow other users writing to pseudo terminals. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 014_sshd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install sshd: cd /usr/src/usr.bin/ssh make obj make depend make make install Index: usr.bin/ssh/sshpty.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/sshpty.c,v retrieving revision 1.29 retrieving revision 1.29.2.1 diff -u -p -r1.29 -r1.29.2.1 --- usr.bin/ssh/sshpty.c 3 Sep 2014 18:55:07 -0000 1.29 +++ usr.bin/ssh/sshpty.c 12 Aug 2015 20:22:42 -0000 1.29.2.1 @@ -142,7 +142,7 @@ pty_setowner(struct passwd *pw, const ch /* Determine the group to make the owner of the tty. */ grp = getgrnam("tty"); gid = (grp != NULL) ? grp->gr_gid : pw->pw_gid; - mode = (grp != NULL) ? 0622 : 0600; + mode = (grp != NULL) ? 0620 : 0600; /* * Change owner and mode of the tty as required. 5.7/common/PaxHeaders.42570/013_patch.patch.sig01006440001756001161000000000074125565745620015764xustar0030 mtime=1438316914.026011991 30 atime=1783552628.008688802 5.7/common/013_patch.patch.sig010064400017560011610000000032121255657456200151220ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb9QmNtbRWSkZday2HFut2V3vLYdrzdrPhP9+tjmNSCP80RznxEG5F8xBFCrQ5q72NXRApbEC78rss1OSsrU/igs= OpenBSD 5.7 errata 13, Jul 30, 2015: Substitution commands might contain a newline in the replacement pattern (escaped with a backslash before it), causing patch's understanding of the state the ed child process is in to diverge from reality. This can lead to patch unwillingly feeding '!' (execute shell command) lines to ed. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 013_patch.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install the patch utility: cd /usr/src/usr.bin/patch make obj make make install Index: usr.bin/patch/pch.c =================================================================== RCS file: /cvs/src/usr.bin/patch/pch.c,v retrieving revision 1.51.2.1 diff -u -p -u -p -r1.51.2.1 pch.c --- usr.bin/patch/pch.c 27 Jul 2015 16:10:54 -0000 1.51.2.1 +++ usr.bin/patch/pch.c 30 Jul 2015 23:36:35 -0000 @@ -1402,7 +1402,19 @@ do_ed_script(void) *t != '\0' && strchr("acdis", *t) != NULL) { if (pipefp != NULL) fputs(buf, pipefp); - if (*t != 'd' && *t != 's') { + if (*t == 's') { + for (;;) { + bool continued = false; + t = buf + strlen(buf) - 1; + while (--t >= buf && *t == '\\') + continued = !continued; + if (!continued || + pgets(buf, sizeof buf, pfp) == NULL) + break; + if (pipefp != NULL) + fputs(buf, pipefp); + } + } else if (*t != 'd') { while (pgets(buf, sizeof buf, pfp) != NULL) { p_input_line++; if (pipefp != NULL) 5.7/common/PaxHeaders.42570/022_ssh.patch.sig01006440001756001161000000000074126457415770015463xustar0030 mtime=1452786559.821889454 30 atime=1783552628.008688802 5.7/common/022_ssh.patch.sig010064400017560011610000000042501264574157700146240ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb3Vs1F4qjsTjbNnrgMAi2bE71NQ9TArEK+zdpKcJAbiNickc0kd2YVETE4wx4/FS6l6NdUmKWwQ9juK7EF3DLwE= OpenBSD 5.7 errata 22, Jan 14, 2016: Experimental roaming code in the ssh client could be tricked by a hostile sshd server, potentially leaking key material. CVE-2016-0777 and CVE-0216-0778. Prevent this problem immediately by adding the line "UseRoaming no" to /etc/ssh/ssh_config. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 022_ssh.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install sshd: cd /usr/src/usr.bin/ssh make obj make depend make make install Index: usr.bin/ssh/readconf.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/readconf.c,v retrieving revision 1.232 diff -u -p -r1.232 readconf.c --- usr.bin/ssh/readconf.c 16 Feb 2015 22:13:32 -0000 1.232 +++ usr.bin/ssh/readconf.c 13 Jan 2016 23:16:03 -0000 @@ -1648,7 +1648,7 @@ initialize_options(Options * options) options->tun_remote = -1; options->local_command = NULL; options->permit_local_command = -1; - options->use_roaming = -1; + options->use_roaming = 0; options->visual_host_key = -1; options->ip_qos_interactive = -1; options->ip_qos_bulk = -1; @@ -1821,8 +1821,7 @@ fill_default_options(Options * options) options->tun_remote = SSH_TUNID_ANY; if (options->permit_local_command == -1) options->permit_local_command = 0; - if (options->use_roaming == -1) - options->use_roaming = 1; + options->use_roaming = 0; if (options->visual_host_key == -1) options->visual_host_key = 0; if (options->ip_qos_interactive == -1) Index: usr.bin/ssh/ssh.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/ssh.c,v retrieving revision 1.416 diff -u -p -r1.416 ssh.c --- usr.bin/ssh/ssh.c 3 Mar 2015 06:48:58 -0000 1.416 +++ usr.bin/ssh/ssh.c 13 Jan 2016 23:16:03 -0000 @@ -1879,9 +1879,6 @@ ssh_session2(void) fork_postauth(); } - if (options.use_roaming) - request_roaming(); - return client_loop(tty_flag, tty_flag ? options.escape_char : SSH_ESCAPECHAR_NONE, id); } 5.7/common/PaxHeaders.42570/024_in6bind.patch.sig01006440001756001161000000000074126716627230016213xustar0030 mtime=1458005459.747509026 30 atime=1783552628.008688802 5.7/common/024_in6bind.patch.sig010064400017560011610000000050621267166272300153560ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb3GjDaPQFiOvoEeoxAw3kvHggyye/SfvPLo4LBg+j5bdoGh8tbZ3BvgC4TsGYOFWOzmzm19m5/RqZljWpI65Ogs= OpenBSD 5.7 errata 24, Mar 16, 2016: Insufficient checks in IPv6 socket binding and UDP IPv6 option processing allow a local user to send UDP packets with a source (IPv6 address + port) already reserved by another user. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 024_in6bind.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/netinet6/in6_pcb.c =================================================================== RCS file: /cvs/src/sys/netinet6/in6_pcb.c,v diff -u -p -r1.67 in6_pcb.c --- sys/netinet6/in6_pcb.c 5 Dec 2014 15:50:04 -0000 1.67 +++ sys/netinet6/in6_pcb.c 14 Mar 2016 15:38:28 -0000 @@ -262,7 +262,16 @@ in6_pcbbind(struct inpcb *inp, struct mb if (ntohs(lport) < IPPORT_RESERVED && (error = suser(p, 0))) return error; - + if (so->so_euid) { + t = in_pcblookup(head, + (struct in_addr *)&zeroin6_addr, 0, + (struct in_addr *)&sin6->sin6_addr, lport, + INPLOOKUP_WILDCARD | INPLOOKUP_IPV6, + inp->inp_rtableid); + if (t && + (so->so_euid != t->inp_socket->so_euid)) + return EADDRINUSE; + } t = in_pcblookup(head, (struct in_addr *)&zeroin6_addr, 0, (struct in_addr *)&sin6->sin6_addr, lport, Index: sys/netinet6/udp6_output.c =================================================================== RCS file: /cvs/src/sys/netinet6/udp6_output.c,v diff -u -p -r1.33 udp6_output.c --- sys/netinet6/udp6_output.c 5 Dec 2014 15:50:04 -0000 1.33 +++ sys/netinet6/udp6_output.c 14 Mar 2016 15:38:28 -0000 @@ -165,6 +165,23 @@ udp6_output(struct inpcb *in6p, struct m if (in6p->inp_lport == 0 && (error = in6_pcbsetport(laddr, in6p, p)) != 0) goto release; + + if (!IN6_ARE_ADDR_EQUAL(&in6p->inp_laddr6, laddr) && + (in6p->inp_socket->so_euid != 0)) { + struct inpcb *t; + + t = in_pcblookup(in6p->inp_table, + (struct in_addr *)&zeroin6_addr, 0, + (struct in_addr *)laddr, in6p->inp_lport, + (INPLOOKUP_WILDCARD | INPLOOKUP_IPV6), + in6p->inp_rtableid); + if (t && + (t->inp_socket->so_euid != + in6p->inp_socket->so_euid)) { + error = EADDRINUSE; + goto release; + } + } } else { if (IN6_IS_ADDR_UNSPECIFIED(&in6p->inp_faddr6)) { error = ENOTCONN; 5.7/common/PaxHeaders.42570/004_smtpd.patch.sig01006440001756001161000000000074125150045530015773xustar0030 mtime=1429473643.406122822 30 atime=1783552628.008688802 5.7/common/004_smtpd.patch.sig010064400017560011610000000110221251500455300151270ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb8smQUXkRDAGHvHDTOQFniVsBdx+zL0f0wobZgQ5MJ+GmXI7mYqlrg+ZRNLfW4NqrSzaoiQmhupoxxr/Di/zPww= OpenBSD 5.7 errata 4, Apr 19, 2015 Incorrect logic in smtpd(8) can lead to unexpected client disconnect, invalid certificate in SNI negotiation or server crash. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 004_smtpd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install smtpd: cd /usr/src/usr.sbin/smtpd make clean make obj make make install Index: usr.sbin/smtpd/smtp_session.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/smtp_session.c,v retrieving revision 1.227 diff -u -p -r1.227 smtp_session.c --- usr.sbin/smtpd/smtp_session.c 20 Jan 2015 17:37:54 -0000 1.227 +++ usr.sbin/smtpd/smtp_session.c 16 Apr 2015 21:53:47 -0000 @@ -191,6 +191,7 @@ static uint8_t dsn_notify_str_to_uint8(c static void smtp_auth_failure_pause(struct smtp_session *); static void smtp_auth_failure_resume(int, short, void *); static int smtp_sni_callback(SSL *, int *, void *); +static const char *smtp_sni_get_servername(struct smtp_session *); static void smtp_filter_connect(struct smtp_session *, struct sockaddr *); static void smtp_filter_rset(struct smtp_session *); @@ -852,7 +853,7 @@ smtp_session_imsg(struct mproc *p, struc pkiname = s->smtpname; ssl_ctx = dict_get(env->sc_ssl_dict, pkiname); - ssl = ssl_smtp_init(ssl_ctx, smtp_sni_callback, s); + ssl = ssl_smtp_init(ssl_ctx, smtp_sni_callback); io_set_read(&s->io); io_start_tls(&s->io, ssl); @@ -1031,6 +1032,7 @@ smtp_io(struct io *io, int evt) { struct ca_cert_req_msg req_ca_cert; struct smtp_session *s = io->arg; + const char *sn; char *line; size_t len, i; X509 *x; @@ -1048,6 +1050,14 @@ smtp_io(struct io *io, int evt) s->kickcount = 0; s->phase = PHASE_INIT; + sn = smtp_sni_get_servername(s); + if (sn) { + if (strlcpy(s->sni, sn, sizeof s->sni) >= sizeof s->sni) { + smtp_free(s, "client SNI exceeds max hostname length"); + return; + } + } + if (smtp_verify_certificate(s)) { io_pause(&s->io, IO_PAUSE_IN); break; @@ -2139,26 +2149,24 @@ smtp_auth_failure_pause(struct smtp_sess evtimer_add(&s->pause, &tv); } +static const char * +smtp_sni_get_servername(struct smtp_session *s) +{ + return SSL_get_servername(s->io.ssl, TLSEXT_NAMETYPE_host_name); +} + static int smtp_sni_callback(SSL *ssl, int *ad, void *arg) { const char *sn; - struct smtp_session *s = arg; void *ssl_ctx; sn = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name); if (sn == NULL) return SSL_TLSEXT_ERR_NOACK; - if (strlcpy(s->sni, sn, sizeof s->sni) >= sizeof s->sni) { - log_warnx("warn: client SNI exceeds max hostname length"); - return SSL_TLSEXT_ERR_NOACK; - } ssl_ctx = dict_get(env->sc_ssl_dict, sn); - if (ssl_ctx == NULL) { - log_info("smtp-in: No PKI entry for requested SNI \"%s\"" - "on session %016"PRIx64, sn, s->id); + if (ssl_ctx == NULL) return SSL_TLSEXT_ERR_NOACK; - } SSL_set_SSL_CTX(ssl, ssl_ctx); return SSL_TLSEXT_ERR_OK; } Index: usr.sbin/smtpd/smtpd.h =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/smtpd.h,v retrieving revision 1.473 diff -u -p -r1.473 smtpd.h --- usr.sbin/smtpd/smtpd.h 20 Jan 2015 17:37:54 -0000 1.473 +++ usr.sbin/smtpd/smtpd.h 16 Apr 2015 21:53:47 -0000 @@ -1322,7 +1322,7 @@ int fork_proc_backend(const char *, cons /* ssl_smtpd.c */ void *ssl_mta_init(void *, char *, off_t); -void *ssl_smtp_init(void *, void *, void *); +void *ssl_smtp_init(void *, void *); /* stat_backend.c */ Index: usr.sbin/smtpd/ssl_smtpd.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/ssl_smtpd.c,v retrieving revision 1.8 diff -u -p -r1.8 ssl_smtpd.c --- usr.sbin/smtpd/ssl_smtpd.c 16 Jan 2015 06:40:21 -0000 1.8 +++ usr.sbin/smtpd/ssl_smtpd.c 16 Apr 2015 21:53:47 -0000 @@ -82,7 +82,7 @@ dummy_verify(int ok, X509_STORE_CTX *sto } void * -ssl_smtp_init(void *ssl_ctx, void *sni, void *arg) +ssl_smtp_init(void *ssl_ctx, void *sni) { SSL *ssl = NULL; int (*cb)(SSL *,int *,void *) = sni; @@ -91,10 +91,8 @@ ssl_smtp_init(void *ssl_ctx, void *sni, SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, dummy_verify); - if (cb) { + if (cb) SSL_CTX_set_tlsext_servername_callback(ssl_ctx, cb); - SSL_CTX_set_tlsext_servername_arg(ssl_ctx, arg); - } if ((ssl = SSL_new(ssl_ctx)) == NULL) goto err; 5.7/common/PaxHeaders.42570/015_relayd.patch.sig01006440001756001161000000000074126023003470016123xustar0030 mtime=1443463399.702936161 30 atime=1783552628.008688802 5.7/common/015_relayd.patch.sig010064400017560011610000000364711260230034700152760ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb305RQbAZ3BNddG21lovpLcx/MxcRtwVkmTLMM3EO5tS5H8DVYUocvaFTDE31T/Ff2DeJJEaP/3qH88rtEaL+ww= OpenBSD 5.7 errata 15, Sept 28, 2015: Various problems were identified in relayd and merged back from current to 5.7 in this maintanance update. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 015_relayd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install the patch utility: cd /usr/src/usr.sbin/relayd make obj make depend make make install Index: usr.sbin/relayd/ca.c =================================================================== RCS file: /cvs/src/usr.sbin/relayd/ca.c,v retrieving revision 1.12 diff -u -p -r1.12 ca.c --- usr.sbin/relayd/ca.c 22 Jan 2015 17:42:09 -0000 1.12 +++ usr.sbin/relayd/ca.c 28 Sep 2015 17:43:06 -0000 @@ -417,11 +417,14 @@ rsae_keygen(RSA *rsa, int bits, BIGNUM * void ca_engine_init(struct relayd *x_env) { - ENGINE *e; + ENGINE *e = NULL; const char *errstr, *name; if (env == NULL) env = x_env; + + if (rsa_default != NULL) + return; if ((e = ENGINE_get_default_RSA()) == NULL) { if ((e = ENGINE_new()) == NULL) { Index: usr.sbin/relayd/config.c =================================================================== RCS file: /cvs/src/usr.sbin/relayd/config.c,v retrieving revision 1.24 diff -u -p -r1.24 config.c --- usr.sbin/relayd/config.c 22 Jan 2015 17:42:09 -0000 1.24 +++ usr.sbin/relayd/config.c 28 Sep 2015 17:43:06 -0000 @@ -142,7 +142,7 @@ config_purge(struct relayd *env, u_int r if (what & CONFIG_TABLES && env->sc_tables != NULL) { while ((table = TAILQ_FIRST(env->sc_tables)) != NULL) - purge_table(env->sc_tables, table); + purge_table(env, env->sc_tables, table); env->sc_tablecount = 0; } if (what & CONFIG_RDRS && env->sc_rdrs != NULL) { Index: usr.sbin/relayd/parse.y =================================================================== RCS file: /cvs/src/usr.sbin/relayd/parse.y,v retrieving revision 1.203 diff -u -p -r1.203 parse.y --- usr.sbin/relayd/parse.y 8 Feb 2015 04:50:32 -0000 1.203 +++ usr.sbin/relayd/parse.y 28 Sep 2015 17:43:06 -0000 @@ -531,12 +531,12 @@ rdroptsl : forwardmode TO tablespec inte if ($3->conf.check == CHECK_NOCHECK) { yyerror("table %s has no check", $3->conf.name); - purge_table(conf->sc_tables, $3); + purge_table(conf, conf->sc_tables, $3); YYERROR; } if (rdr->backup) { yyerror("only one backup table is allowed"); - purge_table(conf->sc_tables, $3); + purge_table(conf, conf->sc_tables, $3); YYERROR; } if (rdr->table) { @@ -1930,7 +1930,7 @@ routeoptsl : ROUTE address '/' NUMBER { if (router->rt_gwtable) { yyerror("router %s table already specified", router->rt_conf.name); - purge_table(conf->sc_tables, $3); + purge_table(conf, conf->sc_tables, $3); YYERROR; } router->rt_gwtable = $3; @@ -3091,7 +3091,7 @@ table_inherit(struct table *tb) goto fail; } if ((oldtb = table_findbyconf(conf, tb)) != NULL) { - purge_table(NULL, tb); + purge_table(conf, NULL, tb); return (oldtb); } @@ -3134,7 +3134,7 @@ table_inherit(struct table *tb) return (tb); fail: - purge_table(NULL, tb); + purge_table(conf, NULL, tb); return (NULL); } Index: usr.sbin/relayd/pfe.c =================================================================== RCS file: /cvs/src/usr.sbin/relayd/pfe.c,v retrieving revision 1.79 diff -u -p -r1.79 pfe.c --- usr.sbin/relayd/pfe.c 8 Feb 2015 01:39:06 -0000 1.79 +++ usr.sbin/relayd/pfe.c 28 Sep 2015 17:43:06 -0000 @@ -289,8 +289,11 @@ pfe_dispatch_relay(int fd, struct privse return (0); /* XXX */ memcpy(s, imsg->data, sizeof(*s)); TAILQ_FOREACH(t, &env->sc_sessions, se_entry) { - if (t->se_id == s->se_id) /* duplicate registration */ + /* duplicate registration */ + if (t->se_id == s->se_id) { + free(s); return (0); + } if (t->se_id > s->se_id) break; } Index: usr.sbin/relayd/relay.c =================================================================== RCS file: /cvs/src/usr.sbin/relayd/relay.c,v retrieving revision 1.191 diff -u -p -r1.191 relay.c --- usr.sbin/relayd/relay.c 6 Feb 2015 01:37:11 -0000 1.191 +++ usr.sbin/relayd/relay.c 28 Sep 2015 17:43:06 -0000 @@ -829,6 +829,12 @@ relay_read(struct bufferevent *bev, void relay_close(con, strerror(errno)); } +/* + * Splice sockets from cre to cre->dst if applicable. Returns: + * -1 socket splicing has failed + * 0 socket splicing is currently not possible + * 1 socket splicing was successful + */ int relay_splice(struct ctl_relay_event *cre) { @@ -878,7 +884,7 @@ relay_splice(struct ctl_relay_event *cre DPRINTF("%s: session %d: splice dir %d, maximum %lld, successful", __func__, con->se_id, cre->dir, cre->toread); - return (0); + return (1); } int @@ -988,7 +994,7 @@ relay_error(struct bufferevent *bev, sho dst = EVBUFFER_OUTPUT(cre->dst->bev); if (EVBUFFER_LENGTH(dst)) return; - } else + } else if (cre->toread == TOREAD_UNLIMITED || cre->toread == 0) return; relay_close(con, "done"); @@ -1041,6 +1047,12 @@ relay_accept(int fd, short event, void * if ((con = calloc(1, sizeof(*con))) == NULL) goto err; + /* Pre-allocate log buffer */ + con->se_haslog = 0; + con->se_log = evbuffer_new(); + if (con->se_log == NULL) + goto err; + con->se_in.s = s; con->se_in.ssl = NULL; con->se_out.s = -1; @@ -1094,14 +1106,6 @@ relay_accept(int fd, short event, void * return; } - /* Pre-allocate log buffer */ - con->se_haslog = 0; - con->se_log = evbuffer_new(); - if (con->se_log == NULL) { - relay_close(con, "failed to allocate log buffer"); - return; - } - if (rlay->rl_conf.flags & F_DIVERT) { slen = sizeof(con->se_out.ss); if (getsockname(s, (struct sockaddr *)&con->se_out.ss, @@ -1265,7 +1269,7 @@ relay_from_table(struct rsession *con) return (-1); } host = rlt->rlt_host[idx]; - DPRINTF("%s: session %d: table %s host %s, p 0x%08x, idx %d", + DPRINTF("%s: session %d: table %s host %s, p 0x%016llx, idx %d", __func__, con->se_id, table->conf.name, host->conf.name, p, idx); while (host != NULL) { DPRINTF("%s: session %d: host %s", __func__, @@ -1404,8 +1408,10 @@ relay_connect_retry(int fd, short sig, v struct relay *rlay = con->se_relay; int bnds = -1; - if (relay_inflight < 1) - fatalx("relay_connect_retry: no connection in flight"); + if (relay_inflight < 1) { + log_warnx("relay_connect_retry: no connection in flight"); + relay_inflight = 1; + } DPRINTF("%s: retry %d of %d, inflight: %d",__func__, con->se_retrycount, con->se_retry, relay_inflight); @@ -1462,6 +1468,10 @@ relay_connect_retry(int fd, short sig, v return; } + if (rlay->rl_conf.flags & F_TLSINSPECT) + con->se_out.state = STATE_PRECONNECT; + else + con->se_out.state = STATE_CONNECTED; relay_inflight--; DPRINTF("%s: inflight decremented, now %d",__func__, relay_inflight); @@ -1480,9 +1490,14 @@ relay_connect_retry(int fd, short sig, v int relay_preconnect(struct rsession *con) { + int rv; + log_debug("%s: session %d: process %d", __func__, con->se_id, privsep_process); - return (relay_connect(con)); + rv = relay_connect(con); + if (con->se_out.state == STATE_CONNECTED) + con->se_out.state = STATE_PRECONNECT; + return (rv); } int @@ -1492,18 +1507,28 @@ relay_connect(struct rsession *con) struct timeval evtpause = { 1, 0 }; int bnds = -1, ret; + /* relay_connect should only be called once per relay */ + if (con->se_out.state == STATE_CONNECTED) { + log_debug("%s: connect already called once", __func__); + return (0); + } + /* Connection is already established but session not active */ - if ((rlay->rl_conf.flags & F_TLSINSPECT) && con->se_out.s != -1) { + if ((rlay->rl_conf.flags & F_TLSINSPECT) && + con->se_out.state == STATE_PRECONNECT) { if (con->se_out.ssl == NULL) { log_debug("%s: tls connect failed", __func__); return (-1); } relay_connected(con->se_out.s, EV_WRITE, con); + con->se_out.state = STATE_CONNECTED; return (0); } - if (relay_inflight < 1) - fatalx("relay_connect: no connection in flight"); + if (relay_inflight < 1) { + log_warnx("relay_connect: no connection in flight"); + relay_inflight = 1; + } getmonotime(&con->se_tv_start); @@ -1551,6 +1576,9 @@ relay_connect(struct rsession *con) event_del(&rlay->rl_ev); evtimer_add(&con->se_inflightevt, &evtpause); evtimer_add(&rlay->rl_evt, &evtpause); + + /* this connect is pending */ + con->se_out.state = STATE_PENDING; return (0); } else { if (con->se_retry) { @@ -1568,6 +1596,7 @@ relay_connect(struct rsession *con) } } + con->se_out.state = STATE_CONNECTED; relay_inflight--; DPRINTF("%s: inflight decremented, now %d",__func__, relay_inflight); @@ -1669,6 +1698,7 @@ relay_close(struct rsession *con, const event_add(&rlay->rl_ev, NULL); } } + con->se_out.state = STATE_INIT; if (con->se_out.buf != NULL) free(con->se_out.buf); Index: usr.sbin/relayd/relay_http.c =================================================================== RCS file: /cvs/src/usr.sbin/relayd/relay_http.c,v retrieving revision 1.43 diff -u -p -r1.43 relay_http.c --- usr.sbin/relayd/relay_http.c 22 Jan 2015 17:42:09 -0000 1.43 +++ usr.sbin/relayd/relay_http.c 28 Sep 2015 17:43:06 -0000 @@ -35,6 +35,7 @@ #include #include #include +#include #include "relayd.h" #include "http.h" @@ -146,6 +147,7 @@ relay_httpdesc_free(struct http_descript desc->query_val = NULL; } kv_purge(&desc->http_headers); + desc->http_lastheader = NULL; } void @@ -210,7 +212,7 @@ relay_read_http(struct bufferevent *bev, else value = strchr(key, ':'); if (value == NULL) { - if (cre->line == 1) { + if (cre->line <= 2) { free(line); relay_abort_http(con, 400, "malformed", 0); return; @@ -271,8 +273,10 @@ relay_read_http(struct bufferevent *bev, goto lookup; } else if (cre->line == 1 && cre->dir == RELAY_DIR_REQUEST) { if ((desc->http_method = relay_httpmethod_byname(key)) - == HTTP_METHOD_NONE) + == HTTP_METHOD_NONE) { + free(line); goto fail; + } /* * Decode request path and query */ @@ -415,7 +419,7 @@ relay_read_http(struct bufferevent *bev, relay_reset_http(cre); done: if (cre->dir == RELAY_DIR_REQUEST && cre->toread <= 0 && - cre->dst->bev == NULL) { + cre->dst->state != STATE_CONNECTED) { if (rlay->rl_conf.fwdmode == FWD_TRANS) { relay_bindanyreq(con, 0, IPPROTO_TCP); return; @@ -430,11 +434,18 @@ relay_read_http(struct bufferevent *bev, relay_close(con, "last http read (done)"); return; } + switch (relay_splice(cre)) { + case -1: + relay_close(con, strerror(errno)); + case 1: + return; + case 0: + break; + } + bufferevent_enable(bev, EV_READ); if (EVBUFFER_LENGTH(src) && bev->readcb != relay_read_http) bev->readcb(bev, arg); - bufferevent_enable(bev, EV_READ); - if (relay_splice(cre) == -1) - relay_close(con, strerror(errno)); + /* The callback readcb() might have freed the session. */ return; fail: relay_abort_http(con, 500, strerror(errno), 0); @@ -484,9 +495,10 @@ relay_read_httpcontent(struct buffereven } if (con->se_done) goto done; + bufferevent_enable(bev, EV_READ); if (bev->readcb != relay_read_httpcontent) bev->readcb(bev, arg); - bufferevent_enable(bev, EV_READ); + /* The callback readcb() might have freed the session. */ return; done: relay_close(con, "last http content read"); @@ -601,9 +613,10 @@ relay_read_httpchunks(struct bufferevent next: if (con->se_done) goto done; + bufferevent_enable(bev, EV_READ); if (EVBUFFER_LENGTH(src)) bev->readcb(bev, arg); - bufferevent_enable(bev, EV_READ); + /* The callback readcb() might have freed the session. */ return; done: @@ -1363,7 +1376,7 @@ relay_match_actions(struct ctl_relay_eve struct kvlist *matches, struct kvlist *actions) { struct rsession *con = cre->con; - struct kv *kv; + struct kv *kv, *tmp; /* * Apply the following options instantly (action per match). @@ -1382,7 +1395,7 @@ relay_match_actions(struct ctl_relay_eve */ if (matches == NULL) { /* 'pass' or 'block' rule */ - TAILQ_FOREACH(kv, &rule->rule_kvlist, kv_rule_entry) { + TAILQ_FOREACH_SAFE(kv, &rule->rule_kvlist, kv_rule_entry, tmp) { TAILQ_INSERT_TAIL(actions, kv, kv_action_entry); TAILQ_REMOVE(&rule->rule_kvlist, kv, kv_rule_entry); } Index: usr.sbin/relayd/relayd.c =================================================================== RCS file: /cvs/src/usr.sbin/relayd/relayd.c,v retrieving revision 1.138 diff -u -p -r1.138 relayd.c --- usr.sbin/relayd/relayd.c 22 Jan 2015 17:42:09 -0000 1.138 +++ usr.sbin/relayd/relayd.c 28 Sep 2015 17:43:06 -0000 @@ -546,12 +546,13 @@ parent_dispatch_ca(int fd, struct privse } void -purge_table(struct tablelist *head, struct table *table) +purge_table(struct relayd *env, struct tablelist *head, struct table *table) { struct host *host; while ((host = TAILQ_FIRST(&table->hosts)) != NULL) { TAILQ_REMOVE(&table->hosts, host, entry); + TAILQ_REMOVE(&env->sc_hosts, host, globalentry); if (event_initialized(&host->cte.ev)) { event_del(&host->cte.ev); close(host->cte.s); @@ -766,18 +767,13 @@ kv_purge(struct kvtree *keys) void kv_free(struct kv *kv) { - if (kv->kv_type == KEY_TYPE_NONE) - return; - if (kv->kv_key != NULL) { - free(kv->kv_key); - } - kv->kv_key = NULL; - if (kv->kv_value != NULL) { - free(kv->kv_value); - } - kv->kv_value = NULL; - kv->kv_matchtree = NULL; - kv->kv_match = NULL; + /* + * This function does not clear memory referenced by + * kv_children or stuff on the tailqs. Use kv_delete() instead. + */ + + free(kv->kv_key); + free(kv->kv_value); memset(kv, 0, sizeof(*kv)); } Index: usr.sbin/relayd/relayd.h =================================================================== RCS file: /cvs/src/usr.sbin/relayd/relayd.h,v retrieving revision 1.207 diff -u -p -r1.207 relayd.h --- usr.sbin/relayd/relayd.h 22 Jan 2015 17:42:09 -0000 1.207 +++ usr.sbin/relayd/relayd.h 28 Sep 2015 17:43:06 -0000 @@ -180,6 +180,13 @@ enum tlsreneg_state { TLSRENEG_ABORT = 3 /* the connection should be aborted */ }; +enum relay_state { + STATE_INIT, + STATE_PENDING, + STATE_PRECONNECT, + STATE_CONNECTED +}; + struct ctl_relay_event { int s; in_port_t port; @@ -200,6 +207,7 @@ struct ctl_relay_event { int line; int done; int timedout; + enum relay_state state; enum direction dir; u_int8_t *buf; @@ -1253,7 +1261,8 @@ struct ca_pkey *pkey_add(struct relayd * int expand_string(char *, size_t, const char *, const char *); void translate_string(char *); void purge_key(char **, off_t); -void purge_table(struct tablelist *, struct table *); +void purge_table(struct relayd *, struct tablelist *, + struct table *); void purge_relay(struct relayd *, struct relay *); char *digeststr(enum digest_type, const u_int8_t *, size_t, char *); const char *canonicalize_host(const char *, char *, size_t); Index: usr.sbin/relayd/ssl.c =================================================================== RCS file: /cvs/src/usr.sbin/relayd/ssl.c,v retrieving revision 1.28 diff -u -p -r1.28 ssl.c --- usr.sbin/relayd/ssl.c 22 Jan 2015 17:42:09 -0000 1.28 +++ usr.sbin/relayd/ssl.c 28 Sep 2015 17:43:06 -0000 @@ -454,6 +454,7 @@ ssl_load_pkey(const void *data, size_t d EVP_PKEY_free(pkey); if (x509 != NULL) X509_free(x509); + free(exdata); return (0); } 5.7/common/PaxHeaders.42570/009_openssl.patch.sig01006440001756001161000000000074125363342660016346xustar0030 mtime=1434040502.199808549 30 atime=1783552628.008688802 5.7/common/009_openssl.patch.sig010064400017560011610000000072061253633426600155130ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb/RUef97IvNWdo/ATqh/E6SLVblpV5x/ydtJGAYlpfJKMm1aZS25L9Mv37ogb9SMlj2CEzyxLy4ZtWqNfiHGvAg= OpenBSD 5.7 errata 9, June 11, 2015 Fix several defects from OpenSSL. These include: CVE-2015-1788 - Malformed ECParameters causes infinite loop CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time CVE-2015-1792 - CMS verify infinite loop with unknown hash function Several other issues did not apply or were already fixed. One low severity issue is still in review. For further details, please refer to https://www.openssl.org/news/secadv_20150611.txt Apply patch using: signify -Vep /etc/signify/openbsd-57-base.pub -x 009_openssl.patch.sig \ -m - | (cd /usr/src && patch -p0) Then build and install libcrypto cd /usr/src/lib/libcrypto/crypto make obj make make install Index: lib/libssl/src/crypto/bn/bn_gf2m.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/bn/bn_gf2m.c,v retrieving revision 1.18 diff -u -p -r1.18 bn_gf2m.c --- lib/libssl/src/crypto/bn/bn_gf2m.c 10 Feb 2015 09:50:12 -0000 1.18 +++ lib/libssl/src/crypto/bn/bn_gf2m.c 11 Jun 2015 16:21:08 -0000 @@ -745,8 +745,13 @@ BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM ubits--; } - if (ubits <= BN_BITS2 && udp[0] == 1) - break; + if (ubits <= BN_BITS2) { + /* See if poly was reducible. */ + if (udp[0] == 0) + goto err; + if (udp[0] == 1) + break; + } if (ubits < vbits) { i = ubits; Index: lib/libssl/src/crypto/cms/cms_smime.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/cms/cms_smime.c,v retrieving revision 1.12 diff -u -p -r1.12 cms_smime.c --- lib/libssl/src/crypto/cms/cms_smime.c 11 Jul 2014 12:12:39 -0000 1.12 +++ lib/libssl/src/crypto/cms/cms_smime.c 11 Jun 2015 16:21:09 -0000 @@ -132,7 +132,7 @@ do_free_upto(BIO *f, BIO *upto) tbio = BIO_pop(f); BIO_free(f); f = tbio; - } while (f != upto); + } while (f != NULL && f != upto); } else BIO_free_all(f); } Index: lib/libssl/src/crypto/x509/x509_vfy.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/x509/x509_vfy.c,v retrieving revision 1.40 diff -u -p -r1.40 x509_vfy.c --- lib/libssl/src/crypto/x509/x509_vfy.c 11 Feb 2015 02:17:59 -0000 1.40 +++ lib/libssl/src/crypto/x509/x509_vfy.c 11 Jun 2015 16:21:09 -0000 @@ -1650,34 +1650,57 @@ X509_cmp_time(const ASN1_TIME *ctm, time memcpy(p, str, 10); p += 10; str += 10; + i -= 10; } else { if (i < 13) return 0; memcpy(p, str, 12); p += 12; str += 12; + i -= 12; } + if (i < 1) + return 0; if ((*str == 'Z') || (*str == '-') || (*str == '+')) { *(p++) = '0'; *(p++) = '0'; } else { + if (i < 2) + return 0; *(p++) = *(str++); *(p++) = *(str++); + i -= 2; + if (i < 1) + return 0; /* Skip any fractional seconds... */ if (*str == '.') { str++; - while ((*str >= '0') && (*str <= '9')) + i--; + while (i > 1 && (*str >= '0') && (*str <= '9')) { str++; + i--; + } } } *(p++) = 'Z'; *(p++) = '\0'; - if (*str == 'Z') + if (i < 1) + return 0; + if (*str == 'Z') { + if (i != 1) + return 0; offset = 0; - else { + } else { + if (i != 5) + return 0; if ((*str != '+') && (*str != '-')) + return 0; + if (str[1] < '0' || str[1] > '9' || + str[2] < '0' || str[2] > '9' || + str[3] < '0' || str[3] > '9' || + str[4] < '0' || str[4] > '9') return 0; offset = ((str[1] - '0') * 10 + (str[2] - '0')) * 60; offset += (str[3] - '0') * 10 + (str[4] - '0'); 5.7/common/PaxHeaders.42570/016_uvm.patch.sig01006440001756001161000000000074126023766500015465xustar0030 mtime=1443495336.149076211 30 atime=1783552628.008688802 5.7/common/016_uvm.patch.sig010064400017560011610000000021401260237665000146220ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb2HWeatwdxk+2VayL7NkRT1ozC2ujJV/mx41aN1bnZAN3obsqL4eIeRfmM8nyklZtTqlgkwiNbRkS06mxvy4Hw0= OpenBSD 5.7 errata 16, Sep 28, 2015: An incorrect operation in uvm could result in system panics. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 016_uvm.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/uvm/uvm_km.c =================================================================== RCS file: /cvs/src/sys/uvm/uvm_km.c,v retrieving revision 1.126 diff -u -p -r1.126 uvm_km.c --- sys/uvm/uvm_km.c 7 Feb 2015 08:21:24 -0000 1.126 +++ sys/uvm/uvm_km.c 28 Sep 2015 18:07:55 -0000 @@ -259,7 +259,6 @@ uvm_km_pgremove(struct uvm_object *uobj, slot = uao_dropswap(uobj, curoff >> PAGE_SHIFT); if (pp != NULL) { - atomic_clearbits_int(&pp->pg_flags, PQ_AOBJ); uvm_lock_pageq(); uvm_pagefree(pp); uvm_unlock_pageq(); 5.7/common/PaxHeaders.42570/002_libxfont.patch.sig01006440001756001161000000000074125022061340016462xustar0030 mtime=1426656348.754901829 30 atime=1783552627.998688368 5.7/common/002_libxfont.patch.sig010064400017560011610000000066001250220613400156240ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb/i6Zv0S1o/mr+5IUVDaH3BH8A5gl2BXF58bJZvZMrBPZfU5Yp77VFJwYTzCmPuNo72VmRxjnjkK8UsZzV/bjAo= OpenBSD 5.7 errata 2, March 18, 2015 More BDF file parsing issues in libXfont Afer IOActive's Ilja van Sprundel who found a number of issues in 2014, additional testing by Alan Coopersmith and William Robinet with the American Fuzzy Lop (afl) tool uncovered two more issues in the parsing of BDF font files. Apply patch using: signify -Vep /etc/signify/openbsd-57-base.pub -x 002_libxfont.patch.sig \ -m - | (cd /usr/xenocara && patch -p0) Then build and install a new libXfont: cd /usr/xenocara/lib/libXont make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper build Index: lib/libXfont/src/bitmap/bdfread.c =================================================================== RCS file: /cvs/OpenBSD/xenocara/lib/libXfont/src/bitmap/bdfread.c,v retrieving revision 1.8 diff -u -p -u -r1.8 bdfread.c --- lib/libXfont/src/bitmap/bdfread.c 7 Jan 2014 20:42:20 -0000 1.8 +++ lib/libXfont/src/bitmap/bdfread.c 17 Mar 2015 21:46:25 -0000 @@ -62,8 +62,16 @@ from The Open Group. #if HAVE_STDINT_H #include -#elif !defined(INT32_MAX) -#define INT32_MAX 0x7fffffff +#else +# ifndef INT32_MAX +# define INT32_MAX 0x7fffffff +# endif +# ifndef INT16_MAX +# define INT16_MAX 0x7fff +# endif +# ifndef INT16_MIN +# define INT16_MIN (0 - 0x8000) +# endif #endif #define INDICES 256 @@ -417,6 +425,12 @@ bdfReadCharacters(FontFilePtr file, Font bdfError("DWIDTH y value must be zero\n"); goto BAILOUT; } + /* xCharInfo metrics are stored as INT16 */ + if ((wx < 0) || (wx > INT16_MAX)) { + bdfError("character '%s' has out of range width, %d\n", + charName, wx); + goto BAILOUT; + } line = bdfGetLine(file, lineBuf, BDFLINELEN); if ((!line) || (sscanf((char *) line, "BBX %d %d %d %d", &bw, &bh, &bl, &bb) != 4)) { bdfError("bad 'BBX'\n"); @@ -427,6 +441,14 @@ bdfReadCharacters(FontFilePtr file, Font charName, bw, bh); goto BAILOUT; } + /* xCharInfo metrics are read as int, but stored as INT16 */ + if ((bl > INT16_MAX) || (bl < INT16_MIN) || + (bb > INT16_MAX) || (bb < INT16_MIN) || + (bw > (INT16_MAX - bl)) || (bh > (INT16_MAX - bb))) { + bdfError("character '%s' has out of range metrics, %d %d %d %d\n", + charName, bl, (bl+bw), (bh+bb), -bb); + goto BAILOUT; + } line = bdfGetLine(file, lineBuf, BDFLINELEN); if ((line) && (bdfIsPrefix(line, "ATTRIBUTES"))) { for (p = line + strlen("ATTRIBUTES "); @@ -458,7 +480,10 @@ bdfReadCharacters(FontFilePtr file, Font ci->metrics.descent = -bb; ci->metrics.characterWidth = wx; ci->bits = NULL; - bdfReadBitmap(ci, file, bit, byte, glyph, scan, bitmapsSizes); + if (!bdfReadBitmap(ci, file, bit, byte, glyph, scan, bitmapsSizes)) { + bdfError("could not read bitmap for character '%s'\n", charName); + goto BAILOUT; + } ci++; ndx++; } else @@ -604,7 +629,9 @@ bdfReadProperties(FontFilePtr file, Font bdfError("missing 'STARTPROPERTIES'\n"); return (FALSE); } - if (sscanf((char *) line, "STARTPROPERTIES %d", &nProps) != 1) { + if ((sscanf((char *) line, "STARTPROPERTIES %d", &nProps) != 1) || + (nProps <= 0) || + (nProps > ((INT32_MAX / sizeof(FontPropRec)) - BDF_GENPROPS))) { bdfError("bad 'STARTPROPERTIES'\n"); return (FALSE); } 5.7/common/PaxHeaders.42570/011_execve.patch.sig01006440001756001161000000000074125554301360016125xustar0030 mtime=1438003294.125346816 30 atime=1783552628.008688802 5.7/common/011_execve.patch.sig010064400017560011610000000024161255543013600152700ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb8vNDYBGp1TsHUcH29QGc6aLBaXKj2RqkDSjc6JefFn6l8hkUtxK/TUZesvTgIR8mqjr2saXQALAHG5Rbq7TMAQ= OpenBSD 5.7 errata 11, Jul 26, 2015: A kernel memory leak could be triggered by an unprivileged user in a failure case when using execve under systrace. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 011_execve.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/kern_exec.c =================================================================== RCS file: /cvs/src/sys/kern/kern_exec.c,v retrieving revision 1.160 diff -u -p -r1.160 kern_exec.c --- sys/kern/kern_exec.c 9 Feb 2015 11:52:47 -0000 1.160 +++ sys/kern/kern_exec.c 27 Jul 2015 00:23:35 -0000 @@ -785,12 +785,12 @@ exec_abort: free_pack_abort: free(pack.ep_hdr, M_EXEC, 0); + if (pathbuf != NULL) + pool_put(&namei_pool, pathbuf); exit1(p, W_EXITCODE(0, SIGABRT), EXIT_NORMAL); /* NOTREACHED */ atomic_clearbits_int(&pr->ps_flags, PS_INEXEC); - if (pathbuf != NULL) - pool_put(&namei_pool, pathbuf); return (0); } 5.7/common/PaxHeaders.42570/017_smtpd.patch.sig01006440001756001161000000000074126034525720016005xustar0030 mtime=1443779962.046788513 30 atime=1783552628.008688802 5.7/common/017_smtpd.patch.sig010064400017560011610000000441211260345257200151470ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb5QpPlASpaoPFs56PtGdpAg3pxLR7NzfwhYBhK8F2J6aHa+gWU4uG+yAhaJv0LPnyimISakK2WpsAlwSw+Ydtw8= OpenBSD 5.7 errata 17, Oct 1, 2015: Fix multiple reliability and security issues in smtpd: * local and remote users could make smtpd crash or stop serving requests. * a buffer overflow in the unprivileged, non-chrooted smtpd (lookup) process could allow a local user to cause a crash or potentially execute arbitrary code. * a use-after-free in the unprivileged, non-chrooted smtpd (lookup) process could allow a remote attacker to cause a crash or potentially execute arbitrary code. * hardlink and symlink attacks allowed a local user to unset chflags or leak the first line of an arbitrary file. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 017_smtpd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install smtpd: cd /usr/src/usr.sbin/smtpd make obj make depend make make install Index: usr.sbin/smtpd/control.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/control.c,v retrieving revision 1.102.2.1 diff -u -p -r1.102.2.1 control.c --- usr.sbin/smtpd/control.c 11 Jun 2015 19:25:36 -0000 1.102.2.1 +++ usr.sbin/smtpd/control.c 1 Oct 2015 22:39:01 -0000 @@ -71,7 +71,7 @@ static void control_broadcast_verbose(in static struct stat_backend *stat_backend = NULL; extern const char *backend_stat; -static uint32_t connid = 0; +static uint64_t connid = 0; static struct tree ctl_conns; static struct tree ctl_count; static struct stat_digest digest; @@ -366,10 +366,14 @@ control_accept(int listenfd, short event } (*count)++; + do { + ++connid; + } while (tree_get(&ctl_conns, connid)); + c = xcalloc(1, sizeof(*c), "control_accept"); c->euid = euid; c->egid = egid; - c->id = ++connid; + c->id = connid; c->mproc.proc = PROC_CLIENT; c->mproc.handler = control_dispatch_ext; c->mproc.data = c; Index: usr.sbin/smtpd/lka.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/lka.c,v retrieving revision 1.175 diff -u -p -r1.175 lka.c --- usr.sbin/smtpd/lka.c 20 Jan 2015 17:37:54 -0000 1.175 +++ usr.sbin/smtpd/lka.c 1 Oct 2015 22:39:01 -0000 @@ -185,6 +185,7 @@ lka_imsg(struct mproc *p, struct imsg *i free(req_ca_vrfy_smtp->chain_cert_len); free(req_ca_vrfy_smtp->cert); free(req_ca_vrfy_smtp); + req_ca_vrfy_smtp = NULL; return; case IMSG_SMTP_AUTHENTICATE: @@ -306,6 +307,7 @@ lka_imsg(struct mproc *p, struct imsg *i free(req_ca_vrfy_mta->chain_cert_len); free(req_ca_vrfy_mta->cert); free(req_ca_vrfy_mta); + req_ca_vrfy_mta = NULL; return; case IMSG_MTA_LOOKUP_CREDENTIALS: Index: usr.sbin/smtpd/lka_session.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/lka_session.c,v retrieving revision 1.69 diff -u -p -r1.69 lka_session.c --- usr.sbin/smtpd/lka_session.c 20 Jan 2015 17:37:54 -0000 1.69 +++ usr.sbin/smtpd/lka_session.c 1 Oct 2015 22:39:01 -0000 @@ -800,6 +800,10 @@ lka_expand_format(char *buf, size_t len, if (exptoklen == 0) return 0; + /* writing expanded token at ptmp will overflow tmpbuf */ + if (sizeof (tmpbuf) - (ptmp - tmpbuf) <= exptoklen) + return 0; + memcpy(ptmp, exptok, exptoklen); pbuf = ebuf + 1; ptmp += exptoklen; Index: usr.sbin/smtpd/mproc.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/mproc.c,v retrieving revision 1.11.2.1 diff -u -p -r1.11.2.1 mproc.c --- usr.sbin/smtpd/mproc.c 11 Jun 2015 19:25:36 -0000 1.11.2.1 +++ usr.sbin/smtpd/mproc.c 1 Oct 2015 22:39:01 -0000 @@ -42,6 +42,7 @@ static void mproc_dispatch(int, short, void *); static ssize_t msgbuf_write2(struct msgbuf *); +static ssize_t imsg_read_nofd(struct imsgbuf *); int mproc_fork(struct mproc *p, const char *path, char *argv[]) @@ -151,7 +152,12 @@ mproc_dispatch(int fd, short event, void if (event & EV_READ) { - if ((n = imsg_read(&p->imsgbuf)) == -1) { + if (p->proc == PROC_CLIENT) + n = imsg_read_nofd(&p->imsgbuf); + else + n = imsg_read(&p->imsgbuf); + + if (n == -1) { log_warn("warn: %s -> %s: imsg_read", proc_name(smtpd_process), p->name); fatal("exiting"); @@ -281,6 +287,29 @@ again: msgbuf_drain(msgbuf, n); return (n); +} + +/* This should go into libutil */ +static ssize_t +imsg_read_nofd(struct imsgbuf *ibuf) +{ + ssize_t n; + char *buf; + size_t len; + + buf = ibuf->r.buf + ibuf->r.wpos; + len = sizeof(ibuf->r.buf) - ibuf->r.wpos; + + again: + if ((n = recv(ibuf->fd, buf, len, 0)) == -1) { + if (errno != EINTR && errno != EAGAIN) + goto fail; + goto again; + } + + ibuf->r.wpos += n; +fail: + return (n); } void Index: usr.sbin/smtpd/mta_session.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/mta_session.c,v retrieving revision 1.71 diff -u -p -r1.71 mta_session.c --- usr.sbin/smtpd/mta_session.c 20 Jan 2015 17:37:54 -0000 1.71 +++ usr.sbin/smtpd/mta_session.c 1 Oct 2015 22:39:01 -0000 @@ -1520,12 +1520,28 @@ mta_start_tls(struct mta_session *s) static int mta_verify_certificate(struct mta_session *s) { +#define MAX_CERTS 16 +#define MAX_CERT_LEN (MAX_IMSGSIZE - (IMSG_HEADER_SIZE + sizeof(req_ca_vrfy))) struct ca_vrfy_req_msg req_ca_vrfy; struct iovec iov[2]; X509 *x; STACK_OF(X509) *xchain; - int i; const char *pkiname; + unsigned char *cert_der[MAX_CERTS]; + int cert_len[MAX_CERTS]; + int i, cert_count, res; + + res = 0; + memset(cert_der, 0, sizeof(cert_der)); + memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy); + + if (s->relay->pki_name) + pkiname = s->relay->pki_name; + else + pkiname = s->helo; + if (strlcpy(req_ca_vrfy.pkiname, pkiname, sizeof req_ca_vrfy.pkiname) + >= sizeof req_ca_vrfy.pkiname) + return 0; x = SSL_get_peer_certificate(s->io.ssl); if (x == NULL) @@ -1540,47 +1556,68 @@ mta_verify_certificate(struct mta_sessio * */ + cert_len[0] = i2d_X509(x, &cert_der[0]); + X509_free(x); + + if (cert_len[0] < 0) { + log_warnx("warn: failed to encode certificate"); + goto end; + } + log_debug("debug: certificate 0: len=%d", cert_len[0]); + if (cert_len[0] > (int)MAX_CERT_LEN) { + log_warnx("warn: certificate too long"); + goto end; + } + + if (xchain) { + cert_count = sk_X509_num(xchain); + log_debug("debug: certificate chain len: %d", cert_count); + if (cert_count >= MAX_CERTS) { + log_warnx("warn: certificate chain too long"); + goto end; + } + } + else + cert_count = 0; + + for (i = 0; i < cert_count; ++i) { + x = sk_X509_value(xchain, i); + cert_len[i+1] = i2d_X509(x, &cert_der[i+1]); + if (cert_len[i+1] < 0) { + log_warnx("warn: failed to encode certificate"); + goto end; + } + log_debug("debug: certificate %i: len=%d", i+1, cert_len[i+1]); + if (cert_len[i+1] > (int)MAX_CERT_LEN) { + log_warnx("warn: certificate too long"); + goto end; + } + } + tree_xset(&wait_ssl_verify, s->id, s); s->flags |= MTA_WAIT; /* Send the client certificate */ - memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy); - if (s->relay->pki_name) - pkiname = s->relay->pki_name; - else - pkiname = s->helo; - if (strlcpy(req_ca_vrfy.pkiname, pkiname, sizeof req_ca_vrfy.pkiname) - >= sizeof req_ca_vrfy.pkiname) - return 0; - req_ca_vrfy.reqid = s->id; - req_ca_vrfy.cert_len = i2d_X509(x, &req_ca_vrfy.cert); - if (xchain) - req_ca_vrfy.n_chain = sk_X509_num(xchain); + req_ca_vrfy.cert_len = cert_len[0]; + req_ca_vrfy.n_chain = cert_count; iov[0].iov_base = &req_ca_vrfy; iov[0].iov_len = sizeof(req_ca_vrfy); - iov[1].iov_base = req_ca_vrfy.cert; - iov[1].iov_len = req_ca_vrfy.cert_len; + iov[1].iov_base = cert_der[0]; + iov[1].iov_len = cert_len[0]; m_composev(p_lka, IMSG_MTA_SSL_VERIFY_CERT, 0, 0, -1, iov, nitems(iov)); - free(req_ca_vrfy.cert); - X509_free(x); - if (xchain) { - /* Send the chain, one cert at a time */ - for (i = 0; i < sk_X509_num(xchain); ++i) { - memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy); - req_ca_vrfy.reqid = s->id; - x = sk_X509_value(xchain, i); - req_ca_vrfy.cert_len = i2d_X509(x, &req_ca_vrfy.cert); - iov[0].iov_base = &req_ca_vrfy; - iov[0].iov_len = sizeof(req_ca_vrfy); - iov[1].iov_base = req_ca_vrfy.cert; - iov[1].iov_len = req_ca_vrfy.cert_len; - m_composev(p_lka, IMSG_MTA_SSL_VERIFY_CHAIN, 0, 0, -1, - iov, nitems(iov)); - free(req_ca_vrfy.cert); - } + memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy); + req_ca_vrfy.reqid = s->id; + + /* Send the chain, one cert at a time */ + for (i = 0; i < cert_count; ++i) { + req_ca_vrfy.cert_len = cert_len[i+1]; + iov[1].iov_base = cert_der[i+1]; + iov[1].iov_len = cert_len[i+1]; + m_composev(p_lka, IMSG_MTA_SSL_VERIFY_CHAIN, 0, 0, -1, + iov, nitems(iov)); } /* Tell lookup process that it can start verifying, we're done */ @@ -1589,7 +1626,13 @@ mta_verify_certificate(struct mta_sessio m_compose(p_lka, IMSG_MTA_SSL_VERIFY, 0, 0, -1, &req_ca_vrfy, sizeof req_ca_vrfy); - return 1; + res = 1; + + end: + for (i = 0; i < MAX_CERTS; ++i) + free(cert_der[i]); + + return res; } static const char * Index: usr.sbin/smtpd/smtp_session.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/smtp_session.c,v retrieving revision 1.227.2.1 diff -u -p -r1.227.2.1 smtp_session.c --- usr.sbin/smtpd/smtp_session.c 19 Apr 2015 20:30:33 -0000 1.227.2.1 +++ usr.sbin/smtpd/smtp_session.c 1 Oct 2015 22:39:02 -0000 @@ -146,6 +146,7 @@ struct smtp_session { size_t rcptfail; TAILQ_HEAD(, smtp_rcpt) rcpts; + size_t datain; size_t datalen; FILE *ofile; int hdrdone; @@ -263,11 +264,6 @@ dataline_callback(const char *line, void len = strlen(line) + 1; - if (s->datalen + len > env->sc_maxsize) { - s->msgflags |= MF_ERROR_SIZE; - return; - } - if (fprintf(s->ofile, "%s\n", line) != (int)len) { s->msgflags |= MF_ERROR_IO; return; @@ -1821,6 +1817,13 @@ smtp_message_write(struct smtp_session * if (*line == '\0') s->hdrdone = 1; + /* account for newline */ + s->datain += strlen(line) + 1; + if (s->datain > env->sc_maxsize) { + s->msgflags |= MF_ERROR_SIZE; + return; + } + /* check for loops */ if (!s->hdrdone) { if (strncasecmp("Received: ", line, 10) == 0) @@ -1903,6 +1906,7 @@ smtp_message_reset(struct smtp_session * s->msgflags = 0; s->destcount = 0; s->rcptcount = 0; + s->datain = 0; s->datalen = 0; s->rcvcount = 0; s->hdrdone = 0; @@ -2054,12 +2058,28 @@ smtp_mailaddr(struct mailaddr *maddr, ch static int smtp_verify_certificate(struct smtp_session *s) { +#define MAX_CERTS 16 +#define MAX_CERT_LEN (MAX_IMSGSIZE - (IMSG_HEADER_SIZE + sizeof(req_ca_vrfy))) struct ca_vrfy_req_msg req_ca_vrfy; struct iovec iov[2]; X509 *x; STACK_OF(X509) *xchain; - int i; const char *pkiname; + unsigned char *cert_der[MAX_CERTS]; + int cert_len[MAX_CERTS]; + int i, cert_count, res; + + res = 0; + memset(cert_der, 0, sizeof(cert_der)); + memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy); + + if (s->listener->pki_name[0]) + pkiname = s->listener->pki_name; + else + pkiname = s->smtpname; + if (strlcpy(req_ca_vrfy.pkiname, pkiname, sizeof req_ca_vrfy.pkiname) + >= sizeof req_ca_vrfy.pkiname) + return 0; x = SSL_get_peer_certificate(s->io.ssl); if (x == NULL) @@ -2074,47 +2094,67 @@ smtp_verify_certificate(struct smtp_sess * */ - tree_xset(&wait_ssl_verify, s->id, s); + cert_len[0] = i2d_X509(x, &cert_der[0]); + X509_free(x); - /* Send the client certificate */ - memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy); - if (s->listener->pki_name[0]) - pkiname = s->listener->pki_name; + if (cert_len[0] < 0) { + log_warnx("warn: failed to encode certificate"); + goto end; + } + log_debug("debug: certificate 0: len=%d", cert_len[0]); + if (cert_len[0] > (int)MAX_CERT_LEN) { + log_warnx("warn: certificate too long"); + goto end; + } + + if (xchain) { + cert_count = sk_X509_num(xchain); + log_debug("debug: certificate chain len: %d", cert_count); + if (cert_count >= MAX_CERTS) { + log_warnx("warn: certificate chain too long"); + goto end; + } + } else - pkiname = s->smtpname; + cert_count = 0; - if (strlcpy(req_ca_vrfy.pkiname, pkiname, sizeof req_ca_vrfy.pkiname) - >= sizeof req_ca_vrfy.pkiname) - return 0; + for (i = 0; i < cert_count; ++i) { + x = sk_X509_value(xchain, i); + cert_len[i+1] = i2d_X509(x, &cert_der[i+1]); + if (cert_len[i+1] < 0) { + log_warnx("warn: failed to encode certificate"); + goto end; + } + log_debug("debug: certificate %i: len=%d", i+1, cert_len[i+1]); + if (cert_len[i+1] > (int)MAX_CERT_LEN) { + log_warnx("warn: certificate too long"); + goto end; + } + } + tree_xset(&wait_ssl_verify, s->id, s); + + /* Send the client certificate */ req_ca_vrfy.reqid = s->id; - req_ca_vrfy.cert_len = i2d_X509(x, &req_ca_vrfy.cert); - if (xchain) - req_ca_vrfy.n_chain = sk_X509_num(xchain); + req_ca_vrfy.cert_len = cert_len[0]; + req_ca_vrfy.n_chain = cert_count; iov[0].iov_base = &req_ca_vrfy; iov[0].iov_len = sizeof(req_ca_vrfy); - iov[1].iov_base = req_ca_vrfy.cert; - iov[1].iov_len = req_ca_vrfy.cert_len; + iov[1].iov_base = cert_der[0]; + iov[1].iov_len = cert_len[0]; m_composev(p_lka, IMSG_SMTP_SSL_VERIFY_CERT, 0, 0, -1, iov, nitems(iov)); - free(req_ca_vrfy.cert); - X509_free(x); - if (xchain) { - /* Send the chain, one cert at a time */ - for (i = 0; i < sk_X509_num(xchain); ++i) { - memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy); - req_ca_vrfy.reqid = s->id; - x = sk_X509_value(xchain, i); - req_ca_vrfy.cert_len = i2d_X509(x, &req_ca_vrfy.cert); - iov[0].iov_base = &req_ca_vrfy; - iov[0].iov_len = sizeof(req_ca_vrfy); - iov[1].iov_base = req_ca_vrfy.cert; - iov[1].iov_len = req_ca_vrfy.cert_len; - m_composev(p_lka, IMSG_SMTP_SSL_VERIFY_CHAIN, 0, 0, -1, - iov, nitems(iov)); - free(req_ca_vrfy.cert); - } + memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy); + req_ca_vrfy.reqid = s->id; + + /* Send the chain, one cert at a time */ + for (i = 0; i < cert_count; ++i) { + req_ca_vrfy.cert_len = cert_len[i+1]; + iov[1].iov_base = cert_der[i+1]; + iov[1].iov_len = cert_len[i+1]; + m_composev(p_lka, IMSG_SMTP_SSL_VERIFY_CHAIN, 0, 0, -1, + iov, nitems(iov)); } /* Tell lookup process that it can start verifying, we're done */ @@ -2123,7 +2163,13 @@ smtp_verify_certificate(struct smtp_sess m_compose(p_lka, IMSG_SMTP_SSL_VERIFY, 0, 0, -1, &req_ca_vrfy, sizeof req_ca_vrfy); - return 1; + res = 1; + + end: + for (i = 0; i < MAX_CERTS; ++i) + free(cert_der[i]); + + return res; } static void Index: usr.sbin/smtpd/smtpd.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/smtpd.c,v retrieving revision 1.238 diff -u -p -r1.238 smtpd.c --- usr.sbin/smtpd/smtpd.c 20 Jan 2015 17:37:54 -0000 1.238 +++ usr.sbin/smtpd/smtpd.c 1 Oct 2015 22:39:02 -0000 @@ -349,7 +349,8 @@ parent_sig_handler(int sig, short event, } else asprintf(&cause, "exited okay"); } else - fatalx("smtpd: unexpected cause of SIGCHLD"); + /* WIFSTOPPED or WIFCONTINUED */ + continue; if (pid == purge_pid) purge_pid = -1; @@ -1063,19 +1064,34 @@ offline_enqueue(char *name) if (pid == 0) { char *envp[2], *p, *tmp; + int fd; FILE *fp; size_t len; arglist args; + if (closefrom(STDERR_FILENO + 1) == -1) + _exit(1); + memset(&args, 0, sizeof(args)); - if (lstat(path, &sb) == -1) { - log_warn("warn: smtpd: lstat: %s", path); + if ((fd = open(path, O_RDONLY|O_NOFOLLOW|O_NONBLOCK)) == -1) { + log_warn("warn: smtpd: open: %s", path); _exit(1); } - if (chflags(path, 0) == -1) { - log_warn("warn: smtpd: chflags: %s", path); + if (fstat(fd, &sb) == -1) { + log_warn("warn: smtpd: fstat: %s", path); + _exit(1); + } + + if (! S_ISREG(sb.st_mode)) { + log_warnx("warn: smtpd: file %s (uid %d) not regular", + path, sb.st_uid); + _exit(1); + } + + if (sb.st_nlink != 1) { + log_warnx("warn: smtpd: file %s is hard-link", path); _exit(1); } @@ -1086,19 +1102,17 @@ offline_enqueue(char *name) _exit(1); } - if (! S_ISREG(sb.st_mode)) { - log_warnx("warn: smtpd: file %s (uid %d) not regular", - path, sb.st_uid); + if (fchflags(fd, 0) == -1) { + log_warn("warn: smtpd: chflags: %s", path); _exit(1); } if (setgroups(1, &pw->pw_gid) || setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) || - setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) || - closefrom(STDERR_FILENO + 1) == -1) + setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid)) _exit(1); - if ((fp = fopen(path, "r")) == NULL) + if ((fp = fdopen(fd, "r")) == NULL) _exit(1); if (chdir(pw->pw_dir) == -1 && chdir("/") == -1) @@ -1198,7 +1212,7 @@ parent_forward_open(char *username, char } do { - fd = open(pathname, O_RDONLY); + fd = open(pathname, O_RDONLY|O_NOFOLLOW|O_NONBLOCK); } while (fd == -1 && errno == EINTR); if (fd == -1) { if (errno == ENOENT) @@ -1207,7 +1221,11 @@ parent_forward_open(char *username, char errno = EAGAIN; return -1; } - log_warn("warn: smtpd: parent_forward_open: %s", pathname); + if (errno == ELOOP) + log_warnx("warn: smtpd: parent_forward_open: %s: " + "cannot follow symbolic links", pathname); + else + log_warn("warn: smtpd: parent_forward_open: %s", pathname); return -1; } Index: usr.sbin/smtpd/util.c =================================================================== RCS file: /cvs/src/usr.sbin/smtpd/util.c,v retrieving revision 1.112 diff -u -p -r1.112 util.c --- usr.sbin/smtpd/util.c 20 Jan 2015 17:37:54 -0000 1.112 +++ usr.sbin/smtpd/util.c 1 Oct 2015 22:39:02 -0000 @@ -513,9 +513,6 @@ nextsub: return 1; } -/* - * Check file for security. Based on usr.bin/ssh/auth.c. - */ int secure_file(int fd, char *path, char *userdir, uid_t uid, int mayread) { @@ -533,7 +530,7 @@ secure_file(int fd, char *path, char *us /* Check the open file to avoid races. */ if (fstat(fd, &st) < 0 || !S_ISREG(st.st_mode) || - (st.st_uid != 0 && st.st_uid != uid) || + st.st_uid != uid || (st.st_mode & (mayread ? 022 : 066)) != 0) return 0; 5.7/common/PaxHeaders.42570/012_patch.patch.sig01006440001756001161000000000074125554301360015746xustar0030 mtime=1438003294.125346816 30 atime=1783552628.008688802 5.7/common/012_patch.patch.sig010064400017560011610000000207041255543013600151110ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb3l+tgZZQKsklOraYkbvz4oSif9fVFwKeDSdfx9yR9X5UbXbtDJ1E8uXRoyfS6iI8evpmVFkDBGTNVwF+mu9QA4= OpenBSD 5.7 errata 12, Jul 26, 2015: The patch utility could be made to invoke arbitrary commands via the obsolete RCS support when processing a crafted input file. This patch deletes the RCS support. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 012_patch.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install the patch utility: cd /usr/src/usr.bin/patch make obj make make install Index: usr.bin/patch/common.h =================================================================== RCS file: /cvs/src/usr.bin/patch/common.h,v retrieving revision 1.28 diff -u -p -r1.28 common.h --- usr.bin/patch/common.h 25 Nov 2014 10:26:07 -0000 1.28 +++ usr.bin/patch/common.h 27 Jul 2015 00:22:37 -0000 @@ -41,10 +41,6 @@ #define BUFFERSIZE 1024 #define LINENUM_MAX LONG_MAX -#define RCSSUFFIX ",v" -#define CHECKOUT "co -l %s" -#define RCSDIFF "rcsdiff %s > /dev/null" - #define ORIGEXT ".orig" #define REJEXT ".rej" Index: usr.bin/patch/inp.c =================================================================== RCS file: /cvs/src/usr.bin/patch/inp.c,v retrieving revision 1.43 diff -u -p -r1.43 inp.c --- usr.bin/patch/inp.c 5 Feb 2015 12:59:57 -0000 1.43 +++ usr.bin/patch/inp.c 27 Jul 2015 00:22:37 -0000 @@ -132,7 +132,7 @@ static bool plan_a(const char *filename) { int ifd, statfailed; - char *p, *s, lbuf[MAXLINELEN]; + char *p, *s; struct stat filestat; off_t i; ptrdiff_t sz; @@ -162,67 +162,8 @@ plan_a(const char *filename) close(creat(filename, 0666)); statfailed = stat(filename, &filestat); } - if (statfailed && check_only) - fatal("%s not found, -C mode, can't probe further\n", filename); - /* For nonexistent or read-only files, look for RCS versions. */ - if (statfailed || - /* No one can write to it. */ - (filestat.st_mode & 0222) == 0 || - /* I can't write to it. */ - ((filestat.st_mode & 0022) == 0 && filestat.st_uid != getuid())) { - char *cs = NULL, *filebase, *filedir; - struct stat cstat; - - filebase = basename(filename); - filedir = dirname(filename); - - /* Leave room in lbuf for the diff command. */ - s = lbuf + 20; - -#define try(f, a1, a2, a3) \ - (snprintf(s, sizeof lbuf - 20, f, a1, a2, a3), stat(s, &cstat) == 0) - - if (try("%s/RCS/%s%s", filedir, filebase, RCSSUFFIX) || - try("%s/RCS/%s%s", filedir, filebase, "") || - try("%s/%s%s", filedir, filebase, RCSSUFFIX)) { - snprintf(buf, sizeof buf, CHECKOUT, filename); - snprintf(lbuf, sizeof lbuf, RCSDIFF, filename); - cs = "RCS"; - } else if (statfailed) - fatal("can't find %s\n", filename); - /* - * else we can't write to it but it's not under a version - * control system, so just proceed. - */ - if (cs) { - if (!statfailed) { - if ((filestat.st_mode & 0222) != 0) - /* The owner can write to it. */ - fatal("file %s seems to be locked " - "by somebody else under %s\n", - filename, cs); - /* - * It might be checked out unlocked. See if - * it's safe to check out the default version - * locked. - */ - if (verbose) - say("Comparing file %s to default " - "%s version...\n", - filename, cs); - if (system(lbuf)) - fatal("can't check out file %s: " - "differs from default %s version\n", - filename, cs); - } - if (verbose) - say("Checking out file %s from %s...\n", - filename, cs); - if (system(buf) || stat(filename, &filestat)) - fatal("can't check out file %s from %s\n", - filename, cs); - } - } + if (statfailed) + fatal("can't find %s\n", filename); filemode = filestat.st_mode; if (!S_ISREG(filemode)) fatal("%s is not a normal file--can't patch\n", filename); Index: usr.bin/patch/patch.1 =================================================================== RCS file: /cvs/src/usr.bin/patch/patch.1,v retrieving revision 1.28 diff -u -p -r1.28 patch.1 --- usr.bin/patch/patch.1 22 Nov 2014 15:49:28 -0000 1.28 +++ usr.bin/patch/patch.1 27 Jul 2015 00:22:37 -0000 @@ -478,15 +478,6 @@ file names or, for a non-context diff, t .Dq index file name, and choose the file name with the fewest path components, the shortest basename, and the shortest total file name length (in that order). -.It -If no file exists, -.Nm -checks for the existence of the files in an RCS directory -(using the appropriate suffix) using the criteria specified -above. -If found, -.Nm -will attempt to get or check out the file. .It If no suitable file was found to patch, the patch file is a context or unified diff, and the old file was zero length, the new file name is Index: usr.bin/patch/pch.c =================================================================== RCS file: /cvs/src/usr.bin/patch/pch.c,v retrieving revision 1.51 diff -u -p -r1.51 pch.c --- usr.bin/patch/pch.c 5 Feb 2015 12:59:57 -0000 1.51 +++ usr.bin/patch/pch.c 27 Jul 2015 00:22:37 -0000 @@ -1457,17 +1457,8 @@ posix_name(const struct file_name *names } if (path == NULL && !assume_exists) { /* - * No files found, look for something we can checkout from - * RCS dirs. Same order as above. - */ - for (i = 0; i < MAX_FILE; i++) { - if (names[i].path != NULL && - (path = checked_in(names[i].path)) != NULL) - break; - } - /* - * Still no match? Check to see if the diff could be creating - * a new file. + * No files found, check to see if the diff could be + * creating a new file. */ if (path == NULL && ok_to_create_file && names[NEW_FILE].path != NULL) @@ -1478,7 +1469,7 @@ posix_name(const struct file_name *names } static char * -compare_names(const struct file_name *names, bool assume_exists, int phase) +compare_names(const struct file_name *names, bool assume_exists) { size_t min_components, min_baselen, min_len, tmp; char *best = NULL; @@ -1495,9 +1486,7 @@ compare_names(const struct file_name *na min_components = min_baselen = min_len = SIZE_MAX; for (i = INDEX_FILE; i >= OLD_FILE; i--) { path = names[i].path; - if (path == NULL || - (phase == 1 && !names[i].exists && !assume_exists) || - (phase == 2 && checked_in(path) == NULL)) + if (path == NULL || (!names[i].exists && !assume_exists)) continue; if ((tmp = num_components(path)) > min_components) continue; @@ -1528,17 +1517,12 @@ best_name(const struct file_name *names, { char *best; - best = compare_names(names, assume_exists, 1); - if (best == NULL) { - best = compare_names(names, assume_exists, 2); - /* - * Still no match? Check to see if the diff could be creating - * a new file. - */ - if (best == NULL && ok_to_create_file && - names[NEW_FILE].path != NULL) - best = names[NEW_FILE].path; - } + best = compare_names(names, assume_exists); + + /* No match? Check to see if the diff could be creating a new file. */ + if (best == NULL && ok_to_create_file) + best = names[NEW_FILE].path; + return best ? xstrdup(best) : NULL; } Index: usr.bin/patch/util.c =================================================================== RCS file: /cvs/src/usr.bin/patch/util.c,v retrieving revision 1.39 diff -u -p -r1.39 util.c --- usr.bin/patch/util.c 16 Jan 2015 06:40:10 -0000 1.39 +++ usr.bin/patch/util.c 27 Jul 2015 00:22:37 -0000 @@ -388,30 +388,6 @@ fetchname(const char *at, bool *exists, return name; } -/* - * Takes the name returned by fetchname and looks in RCS directory - * for a checked in version. - */ -char * -checked_in(char *file) -{ - char *filebase, *filedir, tmpbuf[PATH_MAX]; - struct stat filestat; - - filebase = basename(file); - filedir = dirname(file); - -#define try(f, a1, a2, a3) \ -(snprintf(tmpbuf, sizeof tmpbuf, f, a1, a2, a3), stat(tmpbuf, &filestat) == 0) - - if (try("%s/RCS/%s%s", filedir, filebase, RCSSUFFIX) || - try("%s/RCS/%s%s", filedir, filebase, "") || - try("%s/%s%s", filedir, filebase, RCSSUFFIX)) - return file; - - return NULL; -} - void version(void) { Index: usr.bin/patch/util.h =================================================================== RCS file: /cvs/src/usr.bin/patch/util.h,v retrieving revision 1.16 diff -u -p -r1.16 util.h --- usr.bin/patch/util.h 13 Dec 2014 10:31:07 -0000 1.16 +++ usr.bin/patch/util.h 27 Jul 2015 00:22:37 -0000 @@ -27,7 +27,6 @@ */ char *fetchname(const char *, bool *, int); -char *checked_in(char *); int backup_file(const char *); int move_file(const char *, const char *); int copy_file(const char *, const char *); 5.7/common/PaxHeaders.42570/018_kevent.patch.sig01006440001756001161000000000074126075162600016152xustar0030 mtime=1444846768.722969024 30 atime=1783552628.008688802 5.7/common/018_kevent.patch.sig010064400017560011610000000047121260751626000153160ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb5devK/uahbzwFKgDO9JZqwSpWJxMHKW8UMB5djLh/eapHcXySUcVLv9uHS1LSWhwwdZpMV0kqn6t7UMBwqD5w8= OpenBSD 5.7 errata 18, Oct 14, 2015: A problem with timer kevents could result in a kernel hang (local denial of service). Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 018_kevent.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/kern_event.c =================================================================== RCS file: /cvs/src/sys/kern/kern_event.c,v retrieving revision 1.61 retrieving revision 1.61.2.1 diff -u -p -r1.61 -r1.61.2.1 --- sys/kern/kern_event.c 19 Dec 2014 05:59:21 -0000 1.61 +++ sys/kern/kern_event.c 14 Oct 2015 18:12:25 -0000 1.61.2.1 @@ -1,4 +1,4 @@ -/* $OpenBSD: kern_event.c,v 1.61 2014/12/19 05:59:21 tedu Exp $ */ +/* $OpenBSD: kern_event.c,v 1.61.2.1 2015/10/14 18:12:25 sthen Exp $ */ /*- * Copyright (c) 1999,2000,2001 Jonathan Lemon @@ -323,22 +323,28 @@ filt_proc(struct knote *kn, long hint) return (kn->kn_fflags != 0); } +static void +filt_timer_timeout_add(struct knote *kn) +{ + struct timeval tv; + int tticks; + + tv.tv_sec = kn->kn_sdata / 1000; + tv.tv_usec = (kn->kn_sdata % 1000) * 1000; + tticks = tvtohz(&tv); + timeout_add(kn->kn_hook, tticks ? tticks : 1); +} + void filt_timerexpire(void *knx) { struct knote *kn = knx; - struct timeval tv; - int tticks; kn->kn_data++; KNOTE_ACTIVATE(kn); - if ((kn->kn_flags & EV_ONESHOT) == 0) { - tv.tv_sec = kn->kn_sdata / 1000; - tv.tv_usec = (kn->kn_sdata % 1000) * 1000; - tticks = tvtohz(&tv); - timeout_add((struct timeout *)kn->kn_hook, tticks); - } + if ((kn->kn_flags & EV_ONESHOT) == 0) + filt_timer_timeout_add(kn); } @@ -349,22 +355,16 @@ int filt_timerattach(struct knote *kn) { struct timeout *to; - struct timeval tv; - int tticks; if (kq_ntimeouts > kq_timeoutmax) return (ENOMEM); kq_ntimeouts++; - tv.tv_sec = kn->kn_sdata / 1000; - tv.tv_usec = (kn->kn_sdata % 1000) * 1000; - tticks = tvtohz(&tv); - kn->kn_flags |= EV_CLEAR; /* automatically set */ to = malloc(sizeof(*to), M_KEVENT, M_WAITOK); timeout_set(to, filt_timerexpire, kn); - timeout_add(to, tticks); kn->kn_hook = to; + filt_timer_timeout_add(kn); return (0); } 5.7/common/PaxHeaders.42570/023_sshd.patch.sig01006440001756001161000000000074126702576400015617xustar0030 mtime=1457610656.321968707 30 atime=1783552628.008688802 5.7/common/023_sshd.patch.sig010064400017560011610000000050001267025764000147520ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb+vi10cqgMKu2LfcwOkFdyx8OskgpLkH/O/AEOTn1gEsaBmr4HvlTlnd9Z8egvmDvfB1SL4pcM6+g3+kcS5TtwI= OpenBSD 5.7 errata 23, Mar 10, 2016: Lack of credential sanitization allows injection of commands to xauth(1). More information: http://www.openssh.com/txt/x11fwd.adv Prevent this problem immediately by not using the "X11Forwarding" feature (which is disabled by default). Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 023_sshd.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install sshd: cd /usr/src/usr.bin/ssh make obj make depend make make install Index: usr.bin/ssh/session.c =================================================================== RCS file: /cvs/src/usr.bin/ssh/session.c,v retrieving revision 1.277 diff -u -p -u -r1.277 session.c --- usr.bin/ssh/session.c 16 Jan 2015 06:40:12 -0000 1.277 +++ usr.bin/ssh/session.c 9 Mar 2016 17:03:04 -0000 @@ -40,6 +40,7 @@ #include #include +#include #include #include #include @@ -255,6 +256,22 @@ do_authenticated(Authctxt *authctxt) do_cleanup(authctxt); } +/* Check untrusted xauth strings for metacharacters */ +static int +xauth_valid_string(const char *s) +{ + size_t i; + + for (i = 0; s[i] != '\0'; i++) { + if (!isalnum((u_char)s[i]) && + s[i] != '.' && s[i] != ':' && s[i] != '/' && + s[i] != '-' && s[i] != '_' && s[i] != '[' && + s[i] != ']') + return 0; + } + return 1; +} + /* * Prepares for an interactive session. This is called after the user has * been successfully authenticated. During this message exchange, pseudo @@ -328,7 +345,13 @@ do_authenticated1(Authctxt *authctxt) s->screen = 0; } packet_check_eom(); - success = session_setup_x11fwd(s); + if (xauth_valid_string(s->auth_proto) && + xauth_valid_string(s->auth_data)) + success = session_setup_x11fwd(s); + else { + success = 0; + error("Invalid X11 forwarding data"); + } if (!success) { free(s->auth_proto); free(s->auth_data); @@ -1800,7 +1823,13 @@ session_x11_req(Session *s) s->screen = packet_get_int(); packet_check_eom(); - success = session_setup_x11fwd(s); + if (xauth_valid_string(s->auth_proto) && + xauth_valid_string(s->auth_data)) + success = session_setup_x11fwd(s); + else { + success = 0; + error("Invalid X11 forwarding data"); + } if (!success) { free(s->auth_proto); free(s->auth_data); 5.7/common/PaxHeaders.42570/005_httpd.patch.sig01006440001756001161000000000074125204437470016000xustar0030 mtime=1430407143.189327707 30 atime=1783552628.008688802 5.7/common/005_httpd.patch.sig010064400017560011610000000030371252044374700151430ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb7LsFgSrQ2cEEMLLd5O+80Cq0cAPVVKWxX+D8JdSRVKs/Vg4KOCUdPQ2smJZwK/ESOvPxY90Yiw1gpElQgHNQgk= OpenBSD 5.7 errata 5, Apr 30, 2015: Logging to a log file is only possible after the logging system was initialized. Trying to log too early allows a remote user to crash httpd. Apply by doing: cd /usr/src signify -Vep /etc/signify/openbsd-57-base.pub -x 005_httpd.patch.sig -m - | \ patch -p0 And then rebuild and install httpd: cd usr.sbin/httpd make obj make make install Index: usr.sbin/httpd/server.c =================================================================== RCS file: /cvs/src/usr.sbin/httpd/server.c,v retrieving revision 1.60 diff -u -p -r1.60 server.c --- usr.sbin/httpd/server.c 23 Feb 2015 09:52:28 -0000 1.60 +++ usr.sbin/httpd/server.c 23 Apr 2015 17:32:46 -0000 @@ -851,6 +851,11 @@ server_accept(int fd, short event, void if ((clt = calloc(1, sizeof(*clt))) == NULL) goto err; + /* Pre-allocate log buffer */ + clt->clt_log = evbuffer_new(); + if (clt->clt_log == NULL) + goto err; + clt->clt_s = s; clt->clt_fd = -1; clt->clt_toread = TOREAD_UNLIMITED; @@ -895,13 +900,6 @@ server_accept(int fd, short event, void clt->clt_output = evbuffer_new(); if (clt->clt_output == NULL) { server_close(clt, "failed to allocate output buffer"); - return; - } - - /* Pre-allocate log buffer */ - clt->clt_log = evbuffer_new(); - if (clt->clt_log == NULL) { - server_close(clt, "failed to allocate log buffer"); return; } 5.7/common/PaxHeaders.42570/007_tar.patch.sig01006440001756001161000000000074125204437470015445xustar0030 mtime=1430407143.189327707 30 atime=1783552628.008688802 5.7/common/007_tar.patch.sig010064400017560011610000001056551252044374700146210ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb9+47vPMyTiirxqsHUcYDiiXEt6SXOBcjbsj5N1VDmGwE0d/o63ktPMErEqGkHQscRZj770tpnABLVegjbrfxAA= OpenBSD 5.7 errata 7, Apr 30, 2015: tar/pax/cpio had multiple issues: * extracting a malicious archive could create files outside of the current directory without using pre-existing symlinks to 'escape', and could change the timestamps and modes on preexisting files * tar without -P would permit extraction of paths with ".." components * there was a buffer overflow in the handling of pax extension headers, Apply by doing: cd /usr/src signify -Vep /etc/signify/openbsd-57-base.pub -x 007_tar.patch.sig -m - | \ patch -p0 Then build and install pax: cd /usr/src/bin/pax make obj make make install Index: bin/pax/ar_subs.c =================================================================== RCS file: /cvs/src/bin/pax/ar_subs.c,v retrieving revision 1.41 diff -u -p -r1.41 ar_subs.c --- bin/pax/ar_subs.c 21 Feb 2015 22:48:23 -0000 1.41 +++ bin/pax/ar_subs.c 30 Apr 2015 05:13:05 -0000 @@ -165,6 +165,8 @@ extract(void) int fd; time_t now; + sltab_start(); + arcn = &archd; /* * figure out archive type; pass any format specific options to the @@ -360,6 +362,7 @@ popd: (void)(*frmt->end_rd)(); (void)sigprocmask(SIG_BLOCK, &s_mask, NULL); ar_close(0); + sltab_process(0); proc_dir(0); pat_chk(); } @@ -758,6 +761,8 @@ copy(void) ARCHD archd; char dirbuf[PAXPATHLEN+1]; + sltab_start(); + arcn = &archd; /* * set up the destination dir path and make sure it is a directory. We @@ -969,6 +974,7 @@ copy(void) */ (void)sigprocmask(SIG_BLOCK, &s_mask, NULL); ar_close(0); + sltab_process(0); proc_dir(0); ftree_chk(); } Index: bin/pax/extern.h =================================================================== RCS file: /cvs/src/bin/pax/extern.h,v retrieving revision 1.49 diff -u -p -r1.49 extern.h --- bin/pax/extern.h 21 Feb 2015 22:48:23 -0000 1.49 +++ bin/pax/extern.h 30 Apr 2015 05:13:05 -0000 @@ -147,6 +147,8 @@ int set_ids(char *, uid_t, gid_t); int fset_ids(char *, int, uid_t, gid_t); void set_pmode(char *, mode_t); void fset_pmode(char *, int, mode_t); +int set_attr(const struct file_times *, int _force_times, mode_t, int _do_mode, + int _in_sig); int file_write(int, char *, int, int *, int *, int, char *); void file_flush(int, char *, int); void rdfile_close(ARCHD *, int *); @@ -200,6 +202,7 @@ int pat_sel(ARCHD *); int pat_match(ARCHD *); int mod_name(ARCHD *); int set_dest(ARCHD *, char *, int); +int has_dotdot(const char *); /* * pax.c @@ -261,18 +264,29 @@ void purg_lnk(ARCHD *); void lnk_end(void); int ftime_start(void); int chk_ftime(ARCHD *); +int sltab_start(void); +int sltab_add_sym(const char *_path, const char *_value, mode_t _mode); +int sltab_add_link(const char *, const struct stat *); +void sltab_process(int _in_sig); int name_start(void); int add_name(char *, int, char *); void sub_name(char *, int *, size_t); +#ifndef NOCPIO int dev_start(void); int add_dev(ARCHD *); int map_dev(ARCHD *, u_long, u_long); +#else +# define dev_start() 0 +# define add_dev(x) 0 +# define map_dev(x,y,z) 0 +#endif /* NOCPIO */ int atdir_start(void); void atdir_end(void); void add_atdir(char *, dev_t, ino_t, time_t, time_t); -int get_atdir(dev_t, ino_t, time_t *, time_t *); +int do_atdir(const char *, dev_t, ino_t); int dir_start(void); void add_dir(char *, struct stat *, int); +void delete_dir(dev_t, ino_t); void proc_dir(int _in_sig); u_int st_hash(const char *, int, int); Index: bin/pax/file_subs.c =================================================================== RCS file: /cvs/src/bin/pax/file_subs.c,v retrieving revision 1.44 diff -u -p -r1.44 file_subs.c --- bin/pax/file_subs.c 21 Feb 2015 22:48:23 -0000 1.44 +++ bin/pax/file_subs.c 30 Apr 2015 05:13:06 -0000 @@ -56,10 +56,6 @@ mk_link(char *, struct stat *, char *, i * and setting access modes, uid/gid and times of files */ -#define FILEBITS (S_ISVTX | S_IRWXU | S_IRWXG | S_IRWXO) -#define SETBITS (S_ISUID | S_ISGID) -#define ABITS (FILEBITS | SETBITS) - /* * file_creat() * Create and open a file. @@ -170,6 +166,7 @@ int lnk_creat(ARCHD *arcn) { struct stat sb; + int res; /* * we may be running as root, so we have to be sure that link target @@ -187,7 +184,18 @@ lnk_creat(ARCHD *arcn) return(-1); } - return(mk_link(arcn->ln_name, &sb, arcn->name, 0)); + res = mk_link(arcn->ln_name, &sb, arcn->name, 0); + if (res == 0) { + /* check for a hardlink to a placeholder symlink */ + res = sltab_add_link(arcn->name, &sb); + + if (res < 0) { + /* arrgh, it failed, clean up */ + unlink(arcn->name); + } + } + + return (res); } /* @@ -291,6 +299,7 @@ mk_link(char *to, struct stat *to_sb, ch syswarn(1, errno, "Unable to remove %s", from); return(-1); } + delete_dir(sb.st_dev, sb.st_ino); } else if (unlink(from) < 0) { if (!ign) { syswarn(1, errno, "Unable to remove %s", from); @@ -344,7 +353,7 @@ node_creat(ARCHD *arcn) struct stat sb; char target[PATH_MAX]; char *nm = arcn->name; - int len; + int len, defer_pmode = 0; /* * create node based on type, if that fails try to unlink the node and @@ -404,7 +413,21 @@ badlink: nm); return(-1); case PAX_SLK: - res = symlink(arcn->ln_name, nm); + if (arcn->ln_name[0] != '/' && + !has_dotdot(arcn->ln_name)) + res = symlink(arcn->ln_name, nm); + else { + /* + * absolute symlinks and symlinks with ".." + * have to be deferred to prevent the archive + * from bootstrapping itself to outside the + * working directory. + */ + res = sltab_add_sym(nm, arcn->ln_name, + arcn->sb.st_mode); + if (res == 0) + defer_pmode = 1; + } break; case PAX_CTG: case PAX_HLK: @@ -458,7 +481,7 @@ badlink: */ if (!pmode || res) arcn->sb.st_mode &= ~(SETBITS); - if (pmode) + if (pmode && !defer_pmode) set_pmode(nm, arcn->sb.st_mode); if (arcn->type == PAX_DIR && strcmp(NM_CPIO, argv0) != 0) { @@ -469,33 +492,36 @@ badlink: * rights. This allows nodes in the archive that are children * of this directory to be extracted without failure. Both time * and modes will be fixed after the entire archive is read and - * before pax exits. + * before pax exits. To do that safely, we want the dev+ino + * of the directory we created. */ - if (access(nm, R_OK | W_OK | X_OK) < 0) { - if (lstat(nm, &sb) < 0) { - syswarn(0, errno,"Could not access %s (stat)", - arcn->name); - set_pmode(nm,file_mode | S_IRWXU); - } else { - /* - * We have to add rights to the dir, so we make - * sure to restore the mode. The mode must be - * restored AS CREATED and not as stored if - * pmode is not set. - */ - set_pmode(nm, - ((sb.st_mode & FILEBITS) | S_IRWXU)); - if (!pmode) - arcn->sb.st_mode = sb.st_mode; - } + if (lstat(nm, &sb) < 0) { + syswarn(0, errno,"Could not access %s (stat)", nm); + } else if (access(nm, R_OK | W_OK | X_OK) < 0) { + /* + * We have to add rights to the dir, so we make + * sure to restore the mode. The mode must be + * restored AS CREATED and not as stored if + * pmode is not set. + */ + set_pmode(nm, + ((sb.st_mode & FILEBITS) | S_IRWXU)); + if (!pmode) + arcn->sb.st_mode = sb.st_mode; /* - * we have to force the mode to what was set here, - * since we changed it from the default as created. + * we have to force the mode to what was set + * here, since we changed it from the default + * as created. */ + arcn->sb.st_dev = sb.st_dev; + arcn->sb.st_ino = sb.st_ino; add_dir(nm, &(arcn->sb), 1); - } else if (pmode || patime || pmtime) + } else if (pmode || patime || pmtime) { + arcn->sb.st_dev = sb.st_dev; + arcn->sb.st_ino = sb.st_ino; add_dir(nm, &(arcn->sb), 0); + } } if (patime || pmtime) @@ -539,6 +565,7 @@ unlnk_exist(char *name, int type) syswarn(1,errno,"Unable to remove directory %s", name); return(-1); } + delete_dir(sb.st_dev, sb.st_ino); return(0); } @@ -766,6 +793,60 @@ fset_pmode(char *fnm, int fd, mode_t mod } /* + * set_attr() + * Given a DIRDATA, restore the mode and times as indicated, but + * only after verifying that it's the directory that we wanted. + */ +int +set_attr(const struct file_times *ft, int force_times, mode_t mode, + int do_mode, int in_sig) +{ + struct stat sb; + int fd, r; + + if (!do_mode && !force_times && !patime && !pmtime) + return (0); + + /* + * We could legitimately go through a symlink here, + * so do *not* use O_NOFOLLOW. The dev+ino check will + * protect us from evil. + */ + fd = open(ft->ft_name, O_RDONLY | O_DIRECTORY); + if (fd == -1) { + if (!in_sig) + syswarn(1, errno, "Unable to restore mode and times" + " for directory: %s", ft->ft_name); + return (-1); + } + + if (fstat(fd, &sb) == -1) { + if (!in_sig) + syswarn(1, errno, "Unable to stat directory: %s", + ft->ft_name); + r = -1; + } else if (ft->ft_ino != sb.st_ino || ft->ft_dev != sb.st_dev) { + if (!in_sig) + paxwarn(1, "Directory vanished before restoring" + " mode and times: %s", ft->ft_name); + r = -1; + } else { + /* Whew, it's a match! Is there anything to change? */ + if (do_mode && (mode & ABITS) != (sb.st_mode & ABITS)) + fset_pmode(ft->ft_name, fd, mode); + if (((force_times || patime) && ft->ft_atime != sb.st_atime) || + ((force_times || pmtime) && ft->ft_mtime != sb.st_mtime)) + fset_ftime(ft->ft_name, fd, ft->ft_mtime, + ft->ft_atime, force_times); + r = 0; + } + close(fd); + + return (r); +} + + +/* * file_write() * Write/copy a file (during copy or archive extract). This routine knows * how to copy files with lseek holes in it. (Which are read as file @@ -957,15 +1038,15 @@ rdfile_close(ARCHD *arcn, int *fd) if (*fd < 0) return; - (void)close(*fd); - *fd = -1; - if (!tflag) - return; - /* * user wants last access time reset */ - set_ftime(arcn->org_name, arcn->sb.st_mtime, arcn->sb.st_atime, 1); + if (tflag) + fset_ftime(arcn->org_name, *fd, arcn->sb.st_mtime, + arcn->sb.st_atime, 1); + + (void)close(*fd); + *fd = -1; } /* Index: bin/pax/ftree.c =================================================================== RCS file: /cvs/src/bin/pax/ftree.c,v retrieving revision 1.36 diff -u -p -r1.36 ftree.c --- bin/pax/ftree.c 21 Feb 2015 22:48:23 -0000 1.36 +++ bin/pax/ftree.c 30 Apr 2015 05:13:06 -0000 @@ -337,8 +337,6 @@ int next_file(ARCHD *arcn) { int cnt; - time_t atime; - time_t mtime; /* * ftree_sel() might have set the ftree_skip flag if the user has the @@ -393,10 +391,10 @@ next_file(ARCHD *arcn) * remember to force the time (this is -t on a read * directory, not a created directory). */ - if (!tflag || (get_atdir(ftent->fts_statp->st_dev, - ftent->fts_statp->st_ino, &mtime, &atime) < 0)) + if (!tflag) continue; - set_ftime(ftent->fts_path, mtime, atime, 1); + do_atdir(ftent->fts_path, ftent->fts_statp->st_dev, + ftent->fts_statp->st_ino); continue; case FTS_DC: /* Index: bin/pax/pat_rep.c =================================================================== RCS file: /cvs/src/bin/pax/pat_rep.c,v retrieving revision 1.37 diff -u -p -r1.37 pat_rep.c --- bin/pax/pat_rep.c 21 Feb 2015 22:48:23 -0000 1.37 +++ bin/pax/pat_rep.c 30 Apr 2015 05:13:06 -0000 @@ -583,6 +583,25 @@ range_match(char *pattern, int test) } /* + * has_dotdot() + * Returns true iff the supplied path contains a ".." component. + */ + +int +has_dotdot(const char *path) +{ + const char *p = path; + + while ((p = strstr(p, "..")) != NULL) { + if ((p == path || p[-1] == '/') && + (p[2] == '/' || p[2] == '\0')) + return (1); + p += 2; + } + return (0); +} + +/* * mod_name() * modify a selected file name. first attempt to apply replacement string * expressions, then apply interactive file rename. We apply replacement @@ -630,6 +649,30 @@ mod_name(ARCHD *arcn) if (rmleadslash < 2) { rmleadslash = 2; paxwarn(0, "Removing leading / from absolute path names in the archive"); + } + } + if (rmleadslash) { + const char *last = NULL; + const char *p = arcn->name; + + while ((p = strstr(p, "..")) != NULL) { + if ((p == arcn->name || p[-1] == '/') && + (p[2] == '/' || p[2] == '\0')) + last = p + 2; + p += 2; + } + if (last != NULL) { + last++; + paxwarn(1, "Removing leading \"%.*s\"", + (int)(last - arcn->name), arcn->name); + arcn->nlen = strlen(last); + if (arcn->nlen > 0) + memmove(arcn->name, last, arcn->nlen + 1); + else { + arcn->name[0] = '.'; + arcn->name[1] = '\0'; + arcn->nlen = 1; + } } } Index: bin/pax/pax.c =================================================================== RCS file: /cvs/src/bin/pax/pax.c,v retrieving revision 1.40 diff -u -p -r1.40 pax.c --- bin/pax/pax.c 21 Feb 2015 22:48:23 -0000 1.40 +++ bin/pax/pax.c 30 Apr 2015 05:13:06 -0000 @@ -311,6 +311,7 @@ sig_cleanup(int which_sig) (void) write(STDERR_FILENO, errbuf, strlen(errbuf)); ar_close(1); + sltab_process(1); proc_dir(1); if (tflag) atdir_end(); Index: bin/pax/pax.h =================================================================== RCS file: /cvs/src/bin/pax/pax.h,v retrieving revision 1.24 diff -u -p -r1.24 pax.h --- bin/pax/pax.h 21 Feb 2015 22:48:23 -0000 1.24 +++ bin/pax/pax.h 30 Apr 2015 05:13:06 -0000 @@ -211,6 +211,20 @@ typedef struct { } FSUB; /* + * Time data for a given file. This is usually embedded in a structure + * indexed by dev+ino, by name, by order in the archive, etc. set_attr() + * takes one of these and will only change the times or mode if the file + * at the given name has the indicated dev+ino. + */ +struct file_times { + ino_t ft_ino; /* inode number to verify */ + time_t ft_mtime; /* times to set */ + time_t ft_atime; + char *ft_name; /* name of file to set the times on */ + dev_t ft_dev; /* device number to verify */ +}; + +/* * Format Specific Options List * * Used to pass format options to the format options handler @@ -228,6 +242,10 @@ typedef struct oplist { #define MAJOR(x) major(x) #define MINOR(x) minor(x) #define TODEV(x, y) makedev((x), (y)) + +#define FILEBITS (S_ISVTX | S_IRWXU | S_IRWXG | S_IRWXO) +#define SETBITS (S_ISUID | S_ISGID) +#define ABITS (FILEBITS | SETBITS) /* * General Defines Index: bin/pax/tables.c =================================================================== RCS file: /cvs/src/bin/pax/tables.c,v retrieving revision 1.44 diff -u -p -r1.44 tables.c --- bin/pax/tables.c 21 Feb 2015 22:48:23 -0000 1.44 +++ bin/pax/tables.c 30 Apr 2015 05:13:07 -0000 @@ -37,6 +37,7 @@ #include #include #include +#include #include #include #include @@ -73,8 +74,6 @@ static size_t dirsize; /* size of dirp static size_t dircnt = 0; /* entries in dir time/mode storage */ static int ffd = -1; /* tmp file for file time table name storage */ -static DEVT *chk_dev(dev_t, int); - /* * hard link table routines * @@ -463,6 +462,343 @@ chk_ftime(ARCHD *arcn) } /* + * escaping (absolute or w/"..") symlink table routines + * + * By default, an archive shouldn't be able extract to outside of the + * current directory. What should we do if the archive contains a symlink + * whose value is either absolute or contains ".." components? What we'll + * do is initially create the path as an empty file (to block attempts to + * reference _through_ it) and instead record its path and desired + * final value and mode. Then once all the other archive + * members are created (but before the pass to set timestamps on + * directories) we'll process those records, replacing the placeholder with + * the correct symlink and setting them to the correct mode, owner, group, + * and timestamps. + * + * Note: we also need to handle hardlinks to symlinks (barf) as well as + * hardlinks whose target is replaced by a later entry in the archive (barf^2). + * + * So we track things by dev+ino of the placeholder file, associating with + * that the value and mode of the final symlink and a list of paths that + * should all be hardlinks of that. We'll 'store' the symlink's desired + * timestamps, owner, and group by setting them on the placeholder file. + * + * The operations are: + * a) create an escaping symlink: create the placeholder file and add an entry + * for the new link + * b) create a hardlink: do the link. If the target turns out to be a + * zero-length file whose dev+ino are in the symlink table, then add this + * path to the list of names for that link + * c) perform deferred processing: for each entry, check each associated path: + * if it's a zero-length file with the correct dev+ino then recreate it as + * the specified symlink or hardlink to the first such + */ + +struct slpath { + char *sp_path; + struct slpath *sp_next; +}; +struct slinode { + ino_t sli_ino; + char *sli_value; + struct slpath sli_paths; + struct slinode *sli_fow; /* hash table chain */ + dev_t sli_dev; + mode_t sli_mode; +}; + +static struct slinode **slitab = NULL; + +/* + * sltab_start() + * create the hash table + * Return: + * 0 if the table and file was created ok, -1 otherwise + */ + +int +sltab_start(void) +{ + + if ((slitab = calloc(SL_TAB_SZ, sizeof *slitab)) == NULL) { + syswarn(1, errno, "symlink table"); + return(-1); + } + + return(0); +} + +/* + * sltab_add_sym() + * Create the placeholder and tracking info for an escaping symlink. + * Return: + * 0 on success, -1 otherwise + */ + +int +sltab_add_sym(const char *path0, const char *value0, mode_t mode) +{ + struct stat sb; + struct slinode *s; + struct slpath *p; + char *path, *value; + u_int indx; + int fd; + + /* create the placeholder */ + fd = open(path0, O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC, 0600); + if (fd == -1) + return (-1); + if (fstat(fd, &sb) == -1) { + unlink(path0); + close(fd); + return (-1); + } + close(fd); + + if (havechd && *path0 != '/') { + if ((path = realpath(path0, NULL)) == NULL) { + syswarn(1, errno, "Cannot canonicalize %s", path0); + unlink(path0); + return (-1); + } + } else if ((path = strdup(path0)) == NULL) { + syswarn(1, errno, "defered symlink path"); + unlink(path0); + return (-1); + } + if ((value = strdup(value0)) == NULL) { + syswarn(1, errno, "defered symlink value"); + unlink(path); + free(path); + return (-1); + } + + /* now check the hash table for conflicting entry */ + indx = (sb.st_ino ^ sb.st_dev) % SL_TAB_SZ; + for (s = slitab[indx]; s != NULL; s = s->sli_fow) { + if (s->sli_ino != sb.st_ino || s->sli_dev != sb.st_dev) + continue; + + /* + * One of our placeholders got removed behind our back and + * we've reused the inode. Weird, but clean up the mess. + */ + free(s->sli_value); + free(s->sli_paths.sp_path); + p = s->sli_paths.sp_next; + while (p != NULL) { + struct slpath *next_p = p->sp_next; + + free(p->sp_path); + free(p); + p = next_p; + } + goto set_value; + } + + /* Normal case: create a new node */ + if ((s = malloc(sizeof *s)) == NULL) { + syswarn(1, errno, "defered symlink"); + unlink(path); + free(path); + free(value); + return (-1); + } + s->sli_ino = sb.st_ino; + s->sli_dev = sb.st_dev; + s->sli_fow = slitab[indx]; + slitab[indx] = s; + +set_value: + s->sli_paths.sp_path = path; + s->sli_paths.sp_next = NULL; + s->sli_value = value; + s->sli_mode = mode; + return (0); +} + +/* + * sltab_add_link() + * A hardlink was created; if it looks like a placeholder, handle the + * tracking. + * Return: + * 0 if things are ok, -1 if something went wrong + */ + +int +sltab_add_link(const char *path, const struct stat *sb) +{ + struct slinode *s; + struct slpath *p; + u_int indx; + + if (!S_ISREG(sb->st_mode) || sb->st_size != 0) + return (1); + + /* find the hash table entry for this hardlink */ + indx = (sb->st_ino ^ sb->st_dev) % SL_TAB_SZ; + for (s = slitab[indx]; s != NULL; s = s->sli_fow) { + if (s->sli_ino != sb->st_ino || s->sli_dev != sb->st_dev) + continue; + + if ((p = malloc(sizeof *p)) == NULL) { + syswarn(1, errno, "deferred symlink hardlink"); + return (-1); + } + if (havechd && *path != '/') { + if ((p->sp_path = realpath(path, NULL)) == NULL) { + syswarn(1, errno, "Cannot canonicalize %s", + path); + free(p); + return (-1); + } + } else if ((p->sp_path = strdup(path)) == NULL) { + syswarn(1, errno, "defered symlink hardlink path"); + free(p); + return (-1); + } + + /* link it in */ + p->sp_next = s->sli_paths.sp_next; + s->sli_paths.sp_next = p; + return (0); + } + + /* not found */ + return (1); +} + + +static int +sltab_process_one(struct slinode *s, struct slpath *p, const char *first, + int in_sig) +{ + struct stat sb; + char *path = p->sp_path; + mode_t mode; + int err; + + /* + * is it the expected placeholder? This can fail legimately + * if the archive overwrote the link with another, later entry, + * so don't warn. + */ + if (stat(path, &sb) != 0 || !S_ISREG(sb.st_mode) || sb.st_size != 0 || + sb.st_ino != s->sli_ino || sb.st_dev != s->sli_dev) + return (0); + + if (unlink(path) && errno != ENOENT) { + if (!in_sig) + syswarn(1, errno, "deferred symlink removal"); + return (0); + } + + err = 0; + if (first != NULL) { + /* add another hardlink to the existing symlink */ + if (linkat(AT_FDCWD, first, AT_FDCWD, path, 0) == 0) + return (0); + + /* + * Couldn't hardlink the symlink for some reason, so we'll + * try creating it as its own symlink, but save the error + * for reporting if that fails. + */ + err = errno; + } + + if (symlink(s->sli_value, path)) { + if (!in_sig) { + const char *qualifier = ""; + if (err) + qualifier = " hardlink"; + else + err = errno; + + syswarn(1, err, "deferred symlink%s: %s", + qualifier, path); + } + return (0); + } + + /* success, so set the id, mode, and times */ + mode = s->sli_mode; + if (pids) { + /* if can't set the ids, force the set[ug]id bits off */ + if (set_ids(path, sb.st_uid, sb.st_gid)) + mode &= ~(SETBITS); + } + + if (pmode) + set_pmode(path, mode); + + if (patime || pmtime) + set_ftime(path, sb.st_mtime, sb.st_atime, 0); + + /* + * If we tried to link to first but failed, then this new symlink + * might be a better one to try in the future. Guess from the errno. + */ + if (err == 0 || err == ENOENT || err == EMLINK || err == EOPNOTSUPP) + return (1); + return (0); +} + +/* + * sltab_process() + * Do all the delayed process for escape symlinks + */ + +void +sltab_process(int in_sig) +{ + struct slinode *s; + struct slpath *p; + char *first; + u_int indx; + + if (slitab == NULL) + return; + + /* walk across the entire hash table */ + for (indx = 0; indx < SL_TAB_SZ; indx++) { + while ((s = slitab[indx]) != NULL) { + /* pop this entry */ + slitab[indx] = s->sli_fow; + + first = NULL; + p = &s->sli_paths; + while (1) { + struct slpath *next_p; + + if (sltab_process_one(s, p, first, in_sig)) { + if (!in_sig) + free(first); + first = p->sp_path; + } else if (!in_sig) + free(p->sp_path); + + if ((next_p = p->sp_next) == NULL) + break; + *p = *next_p; + if (!in_sig) + free(next_p); + } + if (!in_sig) { + free(first); + free(s->sli_value); + free(s); + } + } + } + if (!in_sig) + free(slitab); + slitab = NULL; +} + + +/* * Interactive rename table routines * * The interactive rename table keeps track of the new names that the user @@ -607,6 +943,7 @@ sub_name(char *oname, int *onamelen, siz */ } +#ifndef NOCPIO /* * device/inode mapping table routines * (used with formats that store device and inodes fields) @@ -647,6 +984,8 @@ sub_name(char *oname, int *onamelen, siz * (for more info see table.h for the data structures involved). */ +static DEVT *chk_dev(dev_t, int); + /* * dev_start() * create the device mapping table @@ -872,6 +1211,7 @@ map_dev(ARCHD *arcn, u_long dev_mask, u_ paxwarn(0, "Archive may create improper hard links when extracted"); return(0); } +#endif /* NOCPIO */ /* * directory access/mod time reset table routines (for directories READ by pax) @@ -938,7 +1278,7 @@ atdir_end(void) * not read by pax. Read time reset is controlled by -t. */ for (; pt != NULL; pt = pt->fow) - set_ftime(pt->name, pt->mtime, pt->atime, 1); + set_attr(&pt->ft, 1, 0, 0, 0); } } @@ -968,7 +1308,7 @@ add_atdir(char *fname, dev_t dev, ino_t indx = ((unsigned)ino) % A_TAB_SZ; if ((pt = atab[indx]) != NULL) { while (pt != NULL) { - if ((pt->ino == ino) && (pt->dev == dev)) + if ((pt->ft.ft_ino == ino) && (pt->ft.ft_dev == dev)) break; pt = pt->fow; } @@ -986,11 +1326,11 @@ add_atdir(char *fname, dev_t dev, ino_t sigfillset(&allsigs); sigprocmask(SIG_BLOCK, &allsigs, &savedsigs); if ((pt = malloc(sizeof *pt)) != NULL) { - if ((pt->name = strdup(fname)) != NULL) { - pt->dev = dev; - pt->ino = ino; - pt->mtime = mtime; - pt->atime = atime; + if ((pt->ft.ft_name = strdup(fname)) != NULL) { + pt->ft.ft_dev = dev; + pt->ft.ft_ino = ino; + pt->ft.ft_mtime = mtime; + pt->ft.ft_atime = atime; pt->fow = atab[indx]; atab[indx] = pt; sigprocmask(SIG_SETMASK, &savedsigs, NULL); @@ -1015,7 +1355,7 @@ add_atdir(char *fname, dev_t dev, ino_t */ int -get_atdir(dev_t dev, ino_t ino, time_t *mtime, time_t *atime) +do_atdir(const char *name, dev_t dev, ino_t ino) { ATDIR *pt; ATDIR **ppt; @@ -1033,7 +1373,7 @@ get_atdir(dev_t dev, ino_t ino, time_t * ppt = &(atab[indx]); while (pt != NULL) { - if ((pt->ino == ino) && (pt->dev == dev)) + if ((pt->ft.ft_ino == ino) && (pt->ft.ft_dev == dev)) break; /* * no match, go to next one @@ -1045,19 +1385,19 @@ get_atdir(dev_t dev, ino_t ino, time_t * /* * return if we did not find it. */ - if (pt == NULL) + if (pt == NULL || pt->ft.ft_name == NULL || + strcmp(name, pt->ft.ft_name) == 0) return(-1); /* - * found it. return the times and remove the entry from the table. + * found it. set the times and remove the entry from the table. */ + set_attr(&pt->ft, 1, 0, 0, 0); sigfillset(&allsigs); sigprocmask(SIG_BLOCK, &allsigs, &savedsigs); *ppt = pt->fow; sigprocmask(SIG_SETMASK, &savedsigs, NULL); - *mtime = pt->mtime; - *atime = pt->atime; - free(pt->name); + free(pt->ft.ft_name); free(pt); return(0); } @@ -1077,12 +1417,8 @@ get_atdir(dev_t dev, ino_t ino, time_t * * times and file permissions specified by the archive are stored. After all * files have been extracted (or copied), these directories have their times * and file modes reset to the stored values. The directory info is restored in - * reverse order as entries were added to the data file from root to leaf. To - * restore atime properly, we must go backwards. The data file consists of - * records with two parts, the file name followed by a DIRDATA trailer. The - * fixed sized trailer contains the size of the name plus the off_t location in - * the file. To restore we work backwards through the file reading the trailer - * then the file name. + * reverse order as entries were added from root to leaf: to restore atime + * properly, we must go backwards. */ /* @@ -1150,14 +1486,16 @@ add_dir(char *name, struct stat *psb, in sigprocmask(SIG_SETMASK, &savedsigs, NULL); } dblk = &dirp[dircnt]; - if ((dblk->name = strdup(name)) == NULL) { + if ((dblk->ft.ft_name = strdup(name)) == NULL) { paxwarn(1, "Unable to store mode and times for created" " directory: %s", name); return; } - dblk->mode = psb->st_mode & 0xffff; - dblk->mtime = psb->st_mtime; - dblk->atime = psb->st_atime; + dblk->ft.ft_mtime = psb->st_mtime; + dblk->ft.ft_atime = psb->st_atime; + dblk->ft.ft_ino = psb->st_ino; + dblk->ft.ft_dev = psb->st_dev; + dblk->mode = psb->st_mode & ABITS; dblk->frc_mode = frc_mode; sigprocmask(SIG_BLOCK, &allsigs, &savedsigs); ++dircnt; @@ -1165,6 +1503,35 @@ add_dir(char *name, struct stat *psb, in } /* + * delete_dir() + * When we rmdir a directory, we may want to make sure we don't + * later warn about being unable to set its mode and times. + */ + +void +delete_dir(dev_t dev, ino_t ino) +{ + DIRDATA *dblk; + char *name; + size_t i; + + if (dirp == NULL) + return; + for (i = 0; i < dircnt; i++) { + dblk = &dirp[i]; + + if (dblk->ft.ft_name == NULL) + continue; + if (dblk->ft.ft_dev == dev && dblk->ft.ft_ino == ino) { + name = dblk->ft.ft_name; + dblk->ft.ft_name = NULL; + free(name); + break; + } + } +} + +/* * proc_dir(int in_sig) * process all file modes and times stored for directories CREATED * by pax. If in_sig is set, we're in a signal handler and can't @@ -1184,17 +1551,22 @@ proc_dir(int in_sig) */ cnt = dircnt; while (cnt-- > 0) { + dblk = &dirp[cnt]; + /* + * If we remove a directory we created, we replace the + * ft_name with NULL. Ignore those. + */ + if (dblk->ft.ft_name == NULL) + continue; + /* * frc_mode set, make sure we set the file modes even if * the user didn't ask for it (see file_subs.c for more info) */ - dblk = &dirp[cnt]; - if (pmode || dblk->frc_mode) - set_pmode(dblk->name, dblk->mode); - if (patime || pmtime) - set_ftime(dblk->name, dblk->mtime, dblk->atime, 0); + set_attr(&dblk->ft, 0, dblk->mode, pmode || dblk->frc_mode, + in_sig); if (!in_sig) - free(dblk->name); + free(dblk->ft.ft_name); } if (!in_sig) Index: bin/pax/tables.h =================================================================== RCS file: /cvs/src/bin/pax/tables.h,v retrieving revision 1.14 diff -u -p -r1.14 tables.h --- bin/pax/tables.h 21 Feb 2015 22:48:23 -0000 1.14 +++ bin/pax/tables.h 30 Apr 2015 05:13:07 -0000 @@ -50,6 +50,7 @@ #define N_TAB_SZ 541 /* interactive rename hash table */ #define D_TAB_SZ 317 /* unique device mapping table */ #define A_TAB_SZ 317 /* ftree dir access time reset table */ +#define SL_TAB_SZ 317 /* escape symlink tables */ #define MAXKEYLEN 64 /* max number of chars for hash */ #define DIRP_SIZE 64 /* initial size of created dir table */ @@ -143,12 +144,8 @@ typedef struct dlist { */ typedef struct atdir { - ino_t ino; - time_t mtime; /* access and mod time to reset to */ - time_t atime; - char *name; /* name of directory to reset */ + struct file_times ft; struct atdir *fow; - dev_t dev; /* dev and inode for fast lookup */ } ATDIR; /* @@ -162,9 +159,7 @@ typedef struct atdir { */ typedef struct dirdata { - time_t mtime; /* mtime to set */ - time_t atime; /* atime to set */ - char *name; /* file name */ - u_int16_t mode; /* file mode to restore */ + struct file_times ft; + u_int16_t mode; /* file mode to restore */ u_int16_t frc_mode; /* do we force mode settings? */ } DIRDATA; Index: bin/pax/tar.c =================================================================== RCS file: /cvs/src/bin/pax/tar.c,v retrieving revision 1.55 diff -u -p -r1.55 tar.c --- bin/pax/tar.c 21 Feb 2015 22:48:23 -0000 1.55 +++ bin/pax/tar.c 30 Apr 2015 05:13:07 -0000 @@ -58,7 +58,7 @@ static char *name_split(char *, int); static int ul_oct(u_long, char *, int, int); static int uqd_oct(u_quad_t, char *, int, int); #ifndef SMALL -static int rd_xheader(ARCHD *, char *, off_t, char); +static int rd_xheader(ARCHD *arcn, int, off_t); #endif static uid_t uid_nobody; @@ -734,7 +734,7 @@ ustar_id(char *blk, int size) int ustar_rd(ARCHD *arcn, char *buf) { - HD_USTAR *hd; + HD_USTAR *hd = (HD_USTAR *)buf; char *dest; int cnt = 0; dev_t devmajor; @@ -746,18 +746,30 @@ ustar_rd(ARCHD *arcn, char *buf) */ if (ustar_id(buf, BLKMULT) < 0) return(-1); + +#ifndef SMALL +reset: +#endif memset(arcn, 0, sizeof(*arcn)); arcn->org_name = arcn->name; arcn->sb.st_nlink = 1; - hd = (HD_USTAR *)buf; #ifndef SMALL - /* Process the Extended header. */ + /* Process Extended headers. */ if (hd->typeflag == XHDRTYPE || hd->typeflag == GHDRTYPE) { - if (rd_xheader(arcn, buf, - (off_t)asc_ul(hd->size, sizeof(hd->size), OCT), - hd->typeflag) < 0) + if (rd_xheader(arcn, hd->typeflag == GHDRTYPE, + (off_t)asc_ul(hd->size, sizeof(hd->size), OCT)) < 0) return (-1); + + /* Update and check the ustar header. */ + if (rd_wrbuf(buf, BLKMULT) != BLKMULT) + return (-1); + if (ustar_id(buf, BLKMULT) < 0) + return(-1); + + /* if the next block is another extension, reset the values */ + if (hd->typeflag == XHDRTYPE || hd->typeflag == GHDRTYPE) + goto reset; } #endif @@ -1193,51 +1205,84 @@ expandname(char *buf, size_t len, char * #ifndef SMALL -#define MINXHDRSZ 6 +/* shortest possible extended record: "5 a=\n" */ +#define MINXHDRSZ 5 + +/* longest record we'll accept */ +#define MAXXHDRSZ BLKMULT static int -rd_xheader(ARCHD *arcn, char *buf, off_t size, char typeflag) +rd_xheader(ARCHD *arcn, int global, off_t size) { - off_t len; + char buf[MAXXHDRSZ]; + unsigned long len; char *delim, *keyword; - char *nextp, *p; + char *nextp, *p, *end; + int pad, ret = 0; - if (size < MINXHDRSZ) { - paxwarn(1, "Invalid extended header length"); - return (-1); - } - if (rd_wrbuf(buf, size) != size) - return (-1); - if (rd_skip((off_t)BLKMULT - size) < 0) - return (-1); + /* before we alter size, make note of how much we have to skip */ + pad = TAR_PAD((unsigned)size); - for (p = buf; size > 0; size -= len, p = nextp) { - if (!isdigit((unsigned char)*p)) { + p = end = buf; + while (size > 0 || p < end) { + if (size > 0) { + int rdlen; + + /* shift stuff down */ + if (p > buf) { + memmove(buf, p, end - p); + end -= p - buf; + p = buf; + } + + /* fill starting at end */ + rdlen = MINIMUM(size, (buf + sizeof buf) - end); + if (rd_wrbuf(end, rdlen) != rdlen) { + ret = -1; + break; + } + size -= rdlen; + end += rdlen; + } + + /* [p, end) is good */ + if (memchr(p, ' ', end - p) == NULL || + !isdigit((unsigned char)*p)) { paxwarn(1, "Invalid extended header record"); - return (-1); + ret = -1; + break; } errno = 0; - len = strtoll(p, &delim, 10); - if (*delim != ' ' || (errno == ERANGE && - (len == LLONG_MIN || len == LLONG_MAX)) || + len = strtoul(p, &delim, 10); + if (*delim != ' ' || (errno == ERANGE && len == ULONG_MAX) || len < MINXHDRSZ) { paxwarn(1, "Invalid extended header record length"); - return (-1); + ret = -1; + break; } - if (len > size) { - paxwarn(1, "Extended header record length %lld is " - "out of range", (long long)len); - return (-1); + if (len > end - p) { + paxwarn(1, "Extended header record length %lu is " + "out of range", len); + /* if we can just toss this record, do so */ + len -= end - p; + if (len <= size && rd_skip(len) == 0) { + size -= len; + p = end = buf; + continue; + } + ret = -1; + break; } nextp = p + len; keyword = p = delim + 1; p = memchr(p, '=', len); if (!p || nextp[-1] != '\n') { paxwarn(1, "Malformed extended header record"); - return (-1); + ret = -1; + break; } *p++ = nextp[-1] = '\0'; - if (typeflag == XHDRTYPE) { + if (!global) { if (!strcmp(keyword, "path")) { arcn->nlen = strlcpy(arcn->name, p, sizeof(arcn->name)); @@ -1246,11 +1291,11 @@ rd_xheader(ARCHD *arcn, char *buf, off_t sizeof(arcn->ln_name)); } } + p = nextp; } - /* Update the ustar header. */ - if (rd_wrbuf(buf, BLKMULT) != BLKMULT) + if (rd_skip(size + pad) < 0) return (-1); - return (0); + return (ret); } #endif 5.7/common/PaxHeaders.42570/006_elf.patch.sig01006440001756001161000000000074125204752530015421xustar0030 mtime=1430420139.092266083 30 atime=1783552628.008688802 5.7/common/006_elf.patch.sig010064400017560011610000000037041252047525300145650ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUby4OBLM0n2MCFo9TM/FWZlryKfa4mLnPMEgi87dSLa8HTEXN15Z0YumeDyfsnFVHyQHjtL6106R1LxIOtJ/6pww= OpenBSD 5.7 errata 6, Apr 30, 2015: Missing validity checks in the kernel ELF loader meant malformed binaries could trigger kernel panics or view kernel memory. Apply by doing: cd /usr/src signify -Vep /etc/signify/openbsd-57-base.pub -x 006_elf.patch.sig -m - | \ patch -p0 Then build and install a new kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/kern/exec_elf.c =================================================================== RCS file: /cvs/src/sys/kern/exec_elf.c,v retrieving revision 1.112 diff -u -p -r1.112 exec_elf.c --- sys/kern/exec_elf.c 10 Feb 2015 23:39:57 -0000 1.112 +++ sys/kern/exec_elf.c 30 Apr 2015 18:41:25 -0000 @@ -362,6 +362,8 @@ ELFNAME(load_file)(struct proc *p, char for (i = 0; i < eh.e_phnum; i++) { if (ph[i].p_type == PT_LOAD) { + if (ph[i].p_filesz > ph[i].p_memsz) + goto bad1; loadmap[idx].vaddr = trunc_page(ph[i].p_vaddr); loadmap[idx].memsz = round_page (ph[i].p_vaddr + ph[i].p_memsz - loadmap[idx].vaddr); @@ -549,14 +551,20 @@ ELFNAME2(exec,makecmds)(struct proc *p, for (i = 0, pp = ph; i < eh->e_phnum; i++, pp++) { if (pp->p_type == PT_INTERP && !interp) { - if (pp->p_filesz >= MAXPATHLEN) + if (pp->p_filesz < 2 || pp->p_filesz > MAXPATHLEN) goto bad; interp = pool_get(&namei_pool, PR_WAITOK); if ((error = ELFNAME(read_from)(p, epp->ep_vp, pp->p_offset, interp, pp->p_filesz)) != 0) { goto bad; } + if (interp[pp->p_filesz - 1] != '\0') + goto bad; } else if (pp->p_type == PT_LOAD) { + if (pp->p_filesz > pp->p_memsz) { + error = EINVAL; + goto bad; + } if (base_ph == NULL) base_ph = pp; } else if (pp->p_type == PT_PHDR) { 5.7/common/PaxHeaders.42570/003_openssl.patch.sig01006440001756001161000000000074125025537130016331xustar0030 mtime=1426773963.040030174 30 atime=1783552628.008688802 5.7/common/003_openssl.patch.sig010064400017560011610000000401061250255371300154720ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUb0JdJEUfGxEAJYYvNhYebENIoKYQJ6ScxVoXYFtlLcF01ZRz75CQx25VP8NQhyIClqTYaByKnMRZoaRste1ljQQ= OpenBSD 5.7 errata 3, March 19, 2015 Fix several crash causing defects from OpenSSL. These include: CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp CVE-2015-0287 - ASN.1 structure reuse memory corruption CVE-2015-0288 - X509_to_X509_REQ NULL pointer deref CVE-2015-0289 - PKCS7 NULL pointer dereferences Several other issues did not apply or were already fixed. Refer to https://www.openssl.org/news/secadv_20150319.txt Apply patch using: signify -Vep /etc/signify/openbsd-57-base.pub -x 003_openssl.patch.sig \ -m - | (cd /usr/src && patch -p0) Then build and install libcrypto and libssl cd /usr/src/lib/libcrypto/crypto make obj make make install cd /usr/src/lib/libssl/ssl make obj make make install Index: lib/libssl/src/crypto/asn1/a_int.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/a_int.c,v retrieving revision 1.25 diff -u -p -r1.25 a_int.c --- lib/libssl/src/crypto/asn1/a_int.c 10 Feb 2015 08:33:10 -0000 1.25 +++ lib/libssl/src/crypto/asn1/a_int.c 18 Mar 2015 05:45:40 -0000 @@ -268,7 +268,7 @@ c2i_ASN1_INTEGER(ASN1_INTEGER **a, const err: ASN1err(ASN1_F_C2I_ASN1_INTEGER, i); - if ((ret != NULL) && ((a == NULL) || (*a != ret))) + if (a == NULL || *a != ret) M_ASN1_INTEGER_free(ret); return (NULL); } @@ -335,7 +335,7 @@ d2i_ASN1_UINTEGER(ASN1_INTEGER **a, cons err: ASN1err(ASN1_F_D2I_ASN1_UINTEGER, i); - if ((ret != NULL) && ((a == NULL) || (*a != ret))) + if (a == NULL || *a != ret) M_ASN1_INTEGER_free(ret); return (NULL); } Index: lib/libssl/src/crypto/asn1/a_set.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/a_set.c,v retrieving revision 1.16 diff -u -p -r1.16 a_set.c --- lib/libssl/src/crypto/asn1/a_set.c 11 Jul 2014 08:44:47 -0000 1.16 +++ lib/libssl/src/crypto/asn1/a_set.c 18 Mar 2015 05:45:40 -0000 @@ -225,7 +225,7 @@ d2i_ASN1_SET(STACK_OF(OPENSSL_BLOCK) **a return ret; err: - if (ret != NULL && (a == NULL || *a != ret)) { + if (a == NULL || *a != ret) { if (free_func != NULL) sk_OPENSSL_BLOCK_pop_free(ret, free_func); else Index: lib/libssl/src/crypto/asn1/a_type.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/a_type.c,v retrieving revision 1.15 diff -u -p -r1.15 a_type.c --- lib/libssl/src/crypto/asn1/a_type.c 10 Feb 2015 08:33:10 -0000 1.15 +++ lib/libssl/src/crypto/asn1/a_type.c 18 Mar 2015 05:45:40 -0000 @@ -119,7 +119,9 @@ ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b case V_ASN1_OBJECT: result = OBJ_cmp(a->value.object, b->value.object); break; - + case V_ASN1_BOOLEAN: + result = a->value.boolean - b->value.boolean; + break; case V_ASN1_NULL: result = 0; /* They do not have content. */ break; Index: lib/libssl/src/crypto/asn1/d2i_pr.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/d2i_pr.c,v retrieving revision 1.13 diff -u -p -r1.13 d2i_pr.c --- lib/libssl/src/crypto/asn1/d2i_pr.c 11 Feb 2015 03:19:37 -0000 1.13 +++ lib/libssl/src/crypto/asn1/d2i_pr.c 18 Mar 2015 05:45:40 -0000 @@ -118,7 +118,7 @@ d2i_PrivateKey(int type, EVP_PKEY **a, c return (ret); err: - if ((ret != NULL) && ((a == NULL) || (*a != ret))) + if (a == NULL || *a != ret) EVP_PKEY_free(ret); return (NULL); } Index: lib/libssl/src/crypto/asn1/d2i_pu.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/d2i_pu.c,v retrieving revision 1.12 diff -u -p -r1.12 d2i_pu.c --- lib/libssl/src/crypto/asn1/d2i_pu.c 11 Jul 2014 08:44:47 -0000 1.12 +++ lib/libssl/src/crypto/asn1/d2i_pu.c 18 Mar 2015 05:45:40 -0000 @@ -130,7 +130,7 @@ d2i_PublicKey(int type, EVP_PKEY **a, co return (ret); err: - if ((ret != NULL) && ((a == NULL) || (*a != ret))) + if (a == NULL || *a != ret) EVP_PKEY_free(ret); return (NULL); } Index: lib/libssl/src/crypto/asn1/n_pkey.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/n_pkey.c,v retrieving revision 1.25 diff -u -p -r1.25 n_pkey.c --- lib/libssl/src/crypto/asn1/n_pkey.c 11 Feb 2015 04:00:39 -0000 1.25 +++ lib/libssl/src/crypto/asn1/n_pkey.c 18 Mar 2015 05:45:40 -0000 @@ -340,11 +340,11 @@ d2i_RSA_NET(RSA **a, const unsigned char return NULL; } - if ((enckey->os->length != 11) || (strncmp("private-key", - (char *)enckey->os->data, 11) != 0)) { + /* XXX 11 == strlen("private-key") */ + if (enckey->os->length != 11 || + memcmp("private-key", enckey->os->data, 11) != 0) { ASN1err(ASN1_F_D2I_RSA_NET, ASN1_R_PRIVATE_KEY_HEADER_MISSING); - NETSCAPE_ENCRYPTED_PKEY_free(enckey); - return NULL; + goto err; } if (OBJ_obj2nid(enckey->enckey->algor->algorithm) != NID_rc4) { ASN1err(ASN1_F_D2I_RSA_NET, Index: lib/libssl/src/crypto/asn1/tasn_dec.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/tasn_dec.c,v retrieving revision 1.25 diff -u -p -r1.25 tasn_dec.c --- lib/libssl/src/crypto/asn1/tasn_dec.c 14 Feb 2015 15:23:57 -0000 1.25 +++ lib/libssl/src/crypto/asn1/tasn_dec.c 19 Mar 2015 10:14:04 -0000 @@ -238,8 +238,16 @@ ASN1_item_ex_d2i(ASN1_VALUE **pval, cons if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL)) goto auxerr; - /* Allocate structure */ - if (!*pval && !ASN1_item_ex_new(pval, it)) { + if (*pval) { + /* Free up and zero CHOICE value if initialised */ + i = asn1_get_choice_selector(pval, it); + if ((i >= 0) && (i < it->tcount)) { + tt = it->templates + i; + pchptr = asn1_get_field_ptr(pval, tt); + ASN1_template_free(pchptr, tt); + asn1_set_choice_selector(pval, -1, it); + } + } else if (!ASN1_item_ex_new(pval, it)) { ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR); goto err; @@ -324,6 +332,19 @@ ASN1_item_ex_d2i(ASN1_VALUE **pval, cons if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL)) goto auxerr; + + /* Free up and zero any ADB found */ + for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) { + if (tt->flags & ASN1_TFLG_ADB_MASK) { + const ASN1_TEMPLATE *seqtt; + ASN1_VALUE **pseqval; + seqtt = asn1_do_adb(pval, tt, 1); + if (!seqtt) + goto err; + pseqval = asn1_get_field_ptr(pval, seqtt); + ASN1_template_free(pseqval, seqtt); + } + } /* Get each field entry */ for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) { Index: lib/libssl/src/crypto/asn1/x_x509.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/asn1/x_x509.c,v retrieving revision 1.23 diff -u -p -r1.23 x_x509.c --- lib/libssl/src/crypto/asn1/x_x509.c 11 Feb 2015 04:00:39 -0000 1.23 +++ lib/libssl/src/crypto/asn1/x_x509.c 18 Mar 2015 05:45:40 -0000 @@ -313,16 +313,20 @@ d2i_X509_AUX(X509 **a, const unsigned ch /* Save start position */ q = *pp; - ret = d2i_X509(a, pp, length); + ret = d2i_X509(NULL, pp, length); /* If certificate unreadable then forget it */ if (!ret) return NULL; /* update length */ length -= *pp - q; - if (!length) - return ret; - if (!d2i_X509_CERT_AUX(&ret->aux, pp, length)) - goto err; + if (length > 0) { + if (!d2i_X509_CERT_AUX(&ret->aux, pp, length)) + goto err; + } + if (a != NULL) { + X509_free(*a); + *a = ret; + } return ret; err: Index: lib/libssl/src/crypto/ec/ec_asn1.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/ec/ec_asn1.c,v retrieving revision 1.12 diff -u -p -r1.12 ec_asn1.c --- lib/libssl/src/crypto/ec/ec_asn1.c 10 Feb 2015 05:43:09 -0000 1.12 +++ lib/libssl/src/crypto/ec/ec_asn1.c 18 Mar 2015 05:45:40 -0000 @@ -999,19 +999,19 @@ d2i_ECPKParameters(EC_GROUP ** a, const if ((params = d2i_ECPKPARAMETERS(NULL, in, len)) == NULL) { ECerr(EC_F_D2I_ECPKPARAMETERS, EC_R_D2I_ECPKPARAMETERS_FAILURE); - ECPKPARAMETERS_free(params); - return NULL; + goto err; } if ((group = ec_asn1_pkparameters2group(params)) == NULL) { ECerr(EC_F_D2I_ECPKPARAMETERS, EC_R_PKPARAMETERS2GROUP_FAILURE); - ECPKPARAMETERS_free(params); - return NULL; + goto err; } - if (a && *a) + + if (a != NULL) { EC_GROUP_clear_free(*a); - if (a) *a = group; + } +err: ECPKPARAMETERS_free(params); return (group); } @@ -1039,7 +1039,6 @@ i2d_ECPKParameters(const EC_GROUP * a, u EC_KEY * d2i_ECPrivateKey(EC_KEY ** a, const unsigned char **in, long len) { - int ok = 0; EC_KEY *ret = NULL; EC_PRIVATEKEY *priv_key = NULL; @@ -1054,12 +1053,9 @@ d2i_ECPrivateKey(EC_KEY ** a, const unsi } if (a == NULL || *a == NULL) { if ((ret = EC_KEY_new()) == NULL) { - ECerr(EC_F_D2I_ECPRIVATEKEY, - ERR_R_MALLOC_FAILURE); + ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_MALLOC_FAILURE); goto err; } - if (a) - *a = ret; } else ret = *a; @@ -1109,17 +1105,19 @@ d2i_ECPrivateKey(EC_KEY ** a, const unsi goto err; } } - ok = 1; + + EC_PRIVATEKEY_free(priv_key); + if (a != NULL) + *a = ret; + return (ret); + err: - if (!ok) { - if (ret) - EC_KEY_free(ret); - ret = NULL; - } + if (a == NULL || *a != ret) + EC_KEY_free(ret); if (priv_key) EC_PRIVATEKEY_free(priv_key); - return (ret); + return (NULL); } int @@ -1232,8 +1230,6 @@ d2i_ECParameters(EC_KEY ** a, const unsi ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_MALLOC_FAILURE); return NULL; } - if (a) - *a = ret; } else ret = *a; @@ -1241,6 +1237,9 @@ d2i_ECParameters(EC_KEY ** a, const unsi ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_EC_LIB); return NULL; } + + if (a != NULL) + *a = ret; return ret; } Index: lib/libssl/src/crypto/pkcs7/pk7_doit.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c,v retrieving revision 1.31 diff -u -p -r1.31 pk7_doit.c --- lib/libssl/src/crypto/pkcs7/pk7_doit.c 7 Feb 2015 13:19:15 -0000 1.31 +++ lib/libssl/src/crypto/pkcs7/pk7_doit.c 18 Mar 2015 06:11:19 -0000 @@ -261,6 +261,28 @@ PKCS7_dataInit(PKCS7 *p7, BIO *bio) PKCS7_RECIP_INFO *ri = NULL; ASN1_OCTET_STRING *os = NULL; + if (p7 == NULL) { + PKCS7err(PKCS7_F_PKCS7_DATAINIT, PKCS7_R_INVALID_NULL_POINTER); + return NULL; + } + + /* + * The content field in the PKCS7 ContentInfo is optional, + * but that really only applies to inner content (precisely, + * detached signatures). + * + * When reading content, missing outer content is therefore + * treated as an error. + * + * When creating content, PKCS7_content_new() must be called + * before calling this method, so a NULL p7->d is always + * an error. + */ + if (p7->d.ptr == NULL) { + PKCS7err(PKCS7_F_PKCS7_DATAINIT, PKCS7_R_NO_CONTENT); + return NULL; + } + i = OBJ_obj2nid(p7->type); p7->state = PKCS7_S_HEADER; @@ -417,6 +439,17 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pk unsigned char *ek = NULL, *tkey = NULL; int eklen = 0, tkeylen = 0; + if (p7 == NULL) { + PKCS7err(PKCS7_F_PKCS7_DATADECODE, + PKCS7_R_INVALID_NULL_POINTER); + return NULL; + } + + if (p7->d.ptr == NULL) { + PKCS7err(PKCS7_F_PKCS7_DATADECODE, PKCS7_R_NO_CONTENT); + return NULL; + } + i = OBJ_obj2nid(p7->type); p7->state = PKCS7_S_HEADER; @@ -691,6 +724,17 @@ PKCS7_dataFinal(PKCS7 *p7, BIO *bio) STACK_OF(PKCS7_SIGNER_INFO) *si_sk = NULL; ASN1_OCTET_STRING *os = NULL; + if (p7 == NULL) { + PKCS7err(PKCS7_F_PKCS7_DATAFINAL, + PKCS7_R_INVALID_NULL_POINTER); + return 0; + } + + if (p7->d.ptr == NULL) { + PKCS7err(PKCS7_F_PKCS7_DATAFINAL, PKCS7_R_NO_CONTENT); + return 0; + } + EVP_MD_CTX_init(&ctx_tmp); i = OBJ_obj2nid(p7->type); p7->state = PKCS7_S_HEADER; @@ -736,6 +780,7 @@ PKCS7_dataFinal(PKCS7 *p7, BIO *bio) /* If detached data then the content is excluded */ if (PKCS7_type_is_data(p7->d.sign->contents) && p7->detached) { M_ASN1_OCTET_STRING_free(os); + os = NULL; p7->d.sign->contents->d.data = NULL; } break; @@ -750,6 +795,7 @@ PKCS7_dataFinal(PKCS7 *p7, BIO *bio) if (PKCS7_type_is_data(p7->d.digest->contents) && p7->detached) { M_ASN1_OCTET_STRING_free(os); + os = NULL; p7->d.digest->contents->d.data = NULL; } break; @@ -815,22 +861,32 @@ PKCS7_dataFinal(PKCS7 *p7, BIO *bio) M_ASN1_OCTET_STRING_set(p7->d.digest->digest, md_data, md_len); } - if (!PKCS7_is_detached(p7) && !(os->flags & ASN1_STRING_FLAG_NDEF)) { - char *cont; - long contlen; - btmp = BIO_find_type(bio, BIO_TYPE_MEM); - if (btmp == NULL) { - PKCS7err(PKCS7_F_PKCS7_DATAFINAL, - PKCS7_R_UNABLE_TO_FIND_MEM_BIO); + if (!PKCS7_is_detached(p7)) { + /* + * NOTE: only reach os == NULL here because detached + * digested data support is broken? + */ + if (os == NULL) goto err; + if (!(os->flags & ASN1_STRING_FLAG_NDEF)) { + char *cont; + long contlen; + + btmp = BIO_find_type(bio, BIO_TYPE_MEM); + if (btmp == NULL) { + PKCS7err(PKCS7_F_PKCS7_DATAFINAL, + PKCS7_R_UNABLE_TO_FIND_MEM_BIO); + goto err; + } + contlen = BIO_get_mem_data(btmp, &cont); + /* + * Mark the BIO read only then we can use its copy + * of the data instead of making an extra copy. + */ + BIO_set_flags(btmp, BIO_FLAGS_MEM_RDONLY); + BIO_set_mem_eof_return(btmp, 0); + ASN1_STRING_set0(os, (unsigned char *)cont, contlen); } - contlen = BIO_get_mem_data(btmp, &cont); - /* Mark the BIO read only then we can use its copy of the data - * instead of making an extra copy. - */ - BIO_set_flags(btmp, BIO_FLAGS_MEM_RDONLY); - BIO_set_mem_eof_return(btmp, 0); - ASN1_STRING_set0(os, (unsigned char *)cont, contlen); } ret = 1; err: @@ -905,6 +961,17 @@ PKCS7_dataVerify(X509_STORE *cert_store, STACK_OF(X509) *cert; X509 *x509; + if (p7 == NULL) { + PKCS7err(PKCS7_F_PKCS7_DATAVERIFY, + PKCS7_R_INVALID_NULL_POINTER); + return 0; + } + + if (p7->d.ptr == NULL) { + PKCS7err(PKCS7_F_PKCS7_DATAVERIFY, PKCS7_R_NO_CONTENT); + return 0; + } + if (PKCS7_type_is_signed(p7)) { cert = p7->d.sign->cert; } else if (PKCS7_type_is_signedAndEnveloped(p7)) { @@ -941,6 +1008,7 @@ PKCS7_dataVerify(X509_STORE *cert_store, return PKCS7_signatureVerify(bio, p7, si, x509); err: + return ret; } Index: lib/libssl/src/crypto/pkcs7/pk7_lib.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c,v retrieving revision 1.14 diff -u -p -r1.14 pk7_lib.c --- lib/libssl/src/crypto/pkcs7/pk7_lib.c 12 Jul 2014 16:03:37 -0000 1.14 +++ lib/libssl/src/crypto/pkcs7/pk7_lib.c 18 Mar 2015 05:45:40 -0000 @@ -460,6 +460,8 @@ PKCS7_set_digest(PKCS7 *p7, const EVP_MD STACK_OF(PKCS7_SIGNER_INFO) * PKCS7_get_signer_info(PKCS7 *p7) { + if (p7 == NULL || p7->d.ptr == NULL) + return (NULL); if (PKCS7_type_is_signed(p7)) { return (p7->d.sign->signer_info); } else if (PKCS7_type_is_signedAndEnveloped(p7)) { Index: lib/libssl/src/crypto/x509/x509_req.c =================================================================== RCS file: /cvs/src/lib/libssl/src/crypto/x509/x509_req.c,v retrieving revision 1.16 diff -u -p -r1.16 x509_req.c --- lib/libssl/src/crypto/x509/x509_req.c 28 Sep 2014 10:50:33 -0000 1.16 +++ lib/libssl/src/crypto/x509/x509_req.c 18 Mar 2015 05:46:07 -0000 @@ -94,7 +94,9 @@ X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey if (!X509_REQ_set_subject_name(ret, X509_get_subject_name(x))) goto err; - pktmp = X509_get_pubkey(x); + if ((pktmp = X509_get_pubkey(x)) == NULL) + goto err; + i = X509_REQ_set_pubkey(ret, pktmp); EVP_PKEY_free(pktmp); if (!i) Index: lib/libssl/src/ssl/d1_lib.c =================================================================== RCS file: /cvs/src/lib/libssl/src/ssl/d1_lib.c,v retrieving revision 1.27 diff -u -p -r1.27 d1_lib.c --- lib/libssl/src/ssl/d1_lib.c 9 Feb 2015 10:53:28 -0000 1.27 +++ lib/libssl/src/ssl/d1_lib.c 18 Mar 2015 05:45:40 -0000 @@ -443,6 +443,9 @@ dtls1_listen(SSL *s, struct sockaddr *cl { int ret; + /* Ensure there is no state left over from a previous invocation */ + SSL_clear(s); + SSL_set_options(s, SSL_OP_COOKIE_EXCHANGE); s->d1->listen = 1; 5.7/common/PaxHeaders.42570/020_rsn.patch.sig01006440001756001161000000000074126201647500015447xustar0030 mtime=1447094760.271175042 30 atime=1783552628.008688802 5.7/common/020_rsn.patch.sig010064400017560011610000000033051262016475000146100ustar00ssyncsyncuntrusted comment: signature from openbsd 5.7 base secret key RWSvUZXnw9gUbzlqxwSdqP/pZmYC8V1nvdAZ9A5dNmHGczeQrT493IMx1ndKCIVOzolPKwXR5Ahft4HOAFg2WDxSTw8XSpjJggo= OpenBSD 5.7 errata 20, Nov 9, 2015 Insufficient validation of RSN element group cipher values in 802.11 beacons and probe responses could result in system panics. Apply by doing: signify -Vep /etc/signify/openbsd-57-base.pub -x 020_rsn.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/net80211/ieee80211_input.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_input.c,v retrieving revision 1.132 diff -u -p -r1.132 ieee80211_input.c --- sys/net80211/ieee80211_input.c 9 Feb 2015 03:09:57 -0000 1.132 +++ sys/net80211/ieee80211_input.c 8 Nov 2015 12:04:42 -0000 @@ -1232,7 +1232,9 @@ ieee80211_parse_rsn_body(struct ieee8021 if (frm + 4 > efrm) return 0; rsn->rsn_groupcipher = ieee80211_parse_rsn_cipher(frm); - if (rsn->rsn_groupcipher == IEEE80211_CIPHER_USEGROUP) + if (rsn->rsn_groupcipher == IEEE80211_CIPHER_NONE || + rsn->rsn_groupcipher == IEEE80211_CIPHER_USEGROUP || + rsn->rsn_groupcipher == IEEE80211_CIPHER_BIP) return IEEE80211_STATUS_BAD_GROUP_CIPHER; frm += 4; @@ -1296,6 +1298,8 @@ ieee80211_parse_rsn_body(struct ieee8021 if (frm + 4 > efrm) return 0; rsn->rsn_groupmgmtcipher = ieee80211_parse_rsn_cipher(frm); + if (rsn->rsn_groupmgmtcipher != IEEE80211_CIPHER_BIP) + return IEEE80211_STATUS_BAD_GROUP_CIPHER; return IEEE80211_STATUS_SUCCESS; }