summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-10-04merge in the rest of unbound-1.9.4 (we already had the only code change)Stuart Henderson
2019-10-04better link "set" and "SET OPTIONS";Jason McIntyre
original diff from sven falempin, tweaked a bit by myself; ok sthen
2019-10-04Add support for setting the CPU clock frequencies. This enables DVFS.Mark Kettenis
2019-10-04Buff; also, specify router-id per rfc6286.Richard Procter
MPLS VPN cluesticks supplied by Dylan Hall ok claudio@ jmc@
2019-10-04Fix a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey.Theo Buehler
(Note that the CMS code is currently disabled.) Port of Edlinger's Fix for CVE-2019-1563 from OpenSSL 1.1.1 (old license) tests from bluhm@ ok jsing commit e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f Author: Bernd Edlinger <bernd.edlinger@hotmail.de> Date: Sun Sep 1 00:16:28 2019 +0200 Fix a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey An attack is simple, if the first CMS_recipientInfo is valid but the second CMS_recipientInfo is chosen ciphertext. If the second recipientInfo decodes to PKCS #1 v1.5 form plaintext, the correct encryption key will be replaced by garbage, and the message cannot be decoded, but if the RSA decryption fails, the correct encryption key is used and the recipient will not notice the attack. As a work around for this potential attack the length of the decrypted key must be equal to the cipher default key length, in case the certifiate is not given and all recipientInfo are tried out. The old behaviour can be re-enabled in the CMS code by setting the CMS_DEBUG_DECRYPT flag. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9777) (cherry picked from commit 5840ed0cd1e6487d247efbc1a04136a41d7b3a37)
2019-10-04Convert the child_list member from a linked list to a vector.Philip Guenther
ok mpi@
2019-10-04Use a valid curve when constructing an EC_KEY that looks like X25519.Joel Sing
The recent EC group cofactor change results in stricter validation, which causes the EC_GROUP_set_generator() call to fail. Issue reported and fix tested by rsadowski@ ok tb@
2019-10-04Provide internal RSA_padding_{add,check}_PKCS1_OAEP_mgf1() functions.Joel Sing
These are internal only for now and will be made public at a later date. The RSA_padding_{add,check}_PKCS1_OAEP() functions become wrappers around the *_mgf1() variant. ok tb@ inoguchi@ (as part of a larger diff)
2019-10-04Instead of calling fatal() when pftable additions and deletions mixClaudio Jeker
commit the pending work and therefore start a new worklist. The delayed commits can cause such situations to happen and there is no reason to panic because of this. Problem found by jmc@ OK benno@
2019-10-04Avoid a path traversal bug in s_server on Windows.Brent Cook
openssl s_server has an arbitrary read vulnerability on Windows when run with the -WWW or -HTTP options, due to an incomplete path check logic. Thanks to Jobert Abma for reporting. ok tb@
2019-10-04remove strict \r check, the downside overweights the advantages, we'llGilles Chehade
revisit a proper fix post release committing on behalf of martijn@, ok eric@ and I
2019-10-04Re-enable call to intel_hpd_poll_init() in vlv_display_power_well_deinit().Jonathan Gray
Allows valleyview and cherryview machines to boot without a display connected. Previously they would get flooded by HPD events. HPD is known to not work on valleyview and cherryview when powerwells are shut off. Reported by jan@ on tech@ with valleyview and km at krot.org on bugs@ with cherryview.
2019-10-04the formatting for the mini synopses in this page did not render wellJason McIntyre
on html or groff. the solution, to replace the non-standard .nr macros with a hang list, was provided by ingo - thanks! ok schwarze
2019-10-04gif shouldn't include netinet/ip_ether.h, cos gif doesnt do etherip.David Gwynne
ip_ether.h is where netinet/ip_ipip.h got the forward declaration for struct tdb from though, so fix that before cutting ip_ether.h out of gif.
2019-10-04get rid of prototypes for mplsip_input and mplsip_output. they don't exist.David Gwynne
2019-10-04fix memory leak in error path; bz#3074Damien Miller
patch from krishnaiah.bommu@intel.com, ok dtucker
2019-10-04spaceDamien Miller
2019-10-04more sshsig regress tests: check key revocation, the check-novalidateDamien Miller
signature test mode and signing keys in ssh-agent. From Sebastian Kinne (slightly tweaked)
2019-10-04Check for gmtime failure in moduli generation. Based on patch fromDarren Tucker
krishnaiah.bommu@intel.com, ok djm@
2019-10-04disable POOL_DEBUG for releaseJonathan Gray
ok deraadt@
2019-10-03poll(2), ppoll(2), select(2), pselect(2): always set P_SELECT before tsleepcheloha
When I introduced the tsleep loops in r1.23 I screwed it up and introduced a bug: on EWOULDBLOCK we loop but fail to reset P_SELECT, so the thread will continue to sleep but miss all relevant descriptor activity after INT_MAX ticks have elapsed. Spotted by mpi@ back in July. ok mpi@
2019-10-03Move towards making RSA OAEP functions handle arbitrary message digests.Joel Sing
Based on OpenSSL 1.1.1. ok tb@, inoguchi@ (on an earlier/larger diff)
2019-10-03use a more common options order in SYNOPSIS and sync usage();Jason McIntyre
while here, no need for Bk/Ek; ok dtucker
2019-10-03sysctl global nosuidcoredump was being inspected twice inside coredump(),Theo de Raadt
with a sleep between. Reorganize the code for a single check. ok anton beck florian mpi
2019-10-03Properly initalize the ICMP message to zero to avoid leaking 4-byteClaudio Jeker
of uninitialised memory in the sent icmp echorequest. Reported by Adarsh Dinesh (adarsh.dinesh at gmail com) OK florian@ deraadt@
2019-10-03Fix CVE-2019-16866Florian Obser
--- Recent versions of Unbound contain a problem that may cause Unbound to crash after receiving a specially crafted query. This issue can only be triggered by queries received from addresses allowed by Unbound's ACL. --- tested by benno, tb
2019-10-03 Document /auto_upgrade.conf.Florian Obser
While here Xr autoinstall(8). Prompted by a question from jungle boogie on bugs@ OK deraadt Input & OK jmc
2019-10-03Make relayd properly return the next element, even if the requested elementMartijn van Duren
doesn't exist in its own structure. This could greatly be improved upon, but it makes snmp walk on its mib work. OK claudio@
2019-10-03For getnext request check if the requested oid or one of its parentMartijn van Duren
elements exists and is a (agentx) registered element. If so, forward the getnext to the subagent, else get the actual next element. This is only a partial fix, but lets us at least (together with a different patch for relayd) walk relayd's elements. OK claudio@
2019-10-03Now that we have snmp set, we can fully remove the dependency on netsnmp.Martijn van Duren
2019-10-03Implement snmp set.Martijn van Duren
Manpage help jmc@ schwarze@ OK semarie@ claudio@
2019-10-03Use a malloc'd buffer for lsk since commands can be very long, from Gregory ↵Nicholas Marriott
Pakosz.
2019-10-03remove device_tree_address from rpi config.txtJonathan Gray
U-Boot has been built with CONFIG_OF_BOARD for a year now ok patrick@
2019-10-03Do not lazily use BUFSIZ for "I don't care what size" when buildingNicholas Marriott
strings because it is only guaranteed to be 256 bytes and even the default 1024 is not always enough. Reported by Gregory Pakosz.
2019-10-03no need to increment argv and decrement argc, we're not using them laterGilles Chehade
2019-10-03no need to set n to 0 right before assigning it ret value from io_printf()Gilles Chehade
2019-10-03Update Spleen kernel fonts to version 1.5.0, bringing the followingFrederic Cambus
improvements: - Tweak the digit '7' for consistency with other sizes (5x8 version) - Tweak the digit '2' for consistency with other sizes (12x24 version) - Shift the middle bar of the digit '3' one pixel up, for better alignement (12x24 version) - Make the 'Z' and 'z' characters more balanced, as is the case with other sizes (12x24 version) - Make the slash inside the digit '0' one pixel thiner (32x64 version) OK patrick@, "go ahead" kettenis@
2019-10-03memset struct ip_addr before assigning values to it. in the IPv4 caseClaudio Jeker
12 bytes of the struct were not touched and left uninitialized which is not the idea. Diff from Alexandre Hamada (hamada at registro dot br)
2019-10-03Switch the bpf of umb(4) from DTL_RAW to DTL_LOOP. DTL_RAW is limited toClaudio Jeker
ip only whereas DTL_LOOP passes the address family of the packet and so supports more address families. To make this work umb_decap() prepends the AF to the packet and which is consumed then by umb_input(). Similar umb_output() sets ph_family in the mbuf header which is used by umb_start(). OK deraadt@ dlg@
2019-10-03use the right argv element for the error message.Sebastien Marie
ok martijn@
2019-10-03remove useless check and dead codeGilles Chehade
2019-10-03Use a better algorithm for calculating the grpsym library order.Philip Guenther
The existing code did a full recursive walk for O(horrible). Instead, keep a single list of nodes plus the index of the first node whose children haven't been scanned; lookup until that index catches the end, appending the unscanned children of the node at the index. This also makes the grpsym list order match that calculated by FreeBSD and glibc in dependency trees with inconsistent ordering of dependent libs. To make this easier and more cache friendly, convert grpsym_list to a vector: the size is bounded by the number of objects currently loaded. Other, related fixes: * increment the grpsym generation number _after_ pushing the loading object onto its grpsym list, to avoid double counting it * increment the grpsym generation number when building the grpsym list for an already loaded object that's being dlopen()ed, to avoid incomplete grpsym lists * use a more accurate test of whether an object already has a grpsym list Prompted by a diff from Nathanael Rensen (nathanael (at) list.polymorpheus.com) that pointed to _dl_cache_grpsym_list() as a performance bottleneck. Much proding from robert@, sthen@, aja@, jca@ no problem reports after being in snaps ok mpi@
2019-10-03check imsg_flush() return value and fatal() if == -1Gilles Chehade
2019-10-03make it obvious we don't care about text_to_mailaddr() return values, we'veGilles Chehade
already checked it upfront and wouldn't reach this point if it didn't parse correctly.
2019-10-03free() destination server copy, not a real leak since the program is shortGilles Chehade
lived but still
2019-10-03fix wrong sizeof in lka reporters initGilles Chehade
2019-10-03we should never hit the smtp reports with an s->tx set to NULL but betterGilles Chehade
be safe than sorry, check upfront
2019-10-03fix possible use-after-free in error code pathGilles Chehade
2019-10-03fatal() if imsg_flush() call fails in table procGilles Chehade
2019-10-03fix memory leak in error code pathGilles Chehade
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-13 14:53:26 +0000