summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-06-05Ensure that sess_cert is not NULL before trying to use it.Joel Sing
Fixes CVE-2014-3470, from OpenSSL. ok deraadt@
2014-06-05Avoid a buffer overflow that can be triggered by sending specially craftedJoel Sing
DTLS fragments. Fix for CVE-2014-0195, from OpenSSL. Reported to OpenSSL by Juri Aedla. ok deraadt@ beck@
2014-06-05ssl_sess_cert_new() can return NULL. Fix two cases where the return valueJoel Sing
is unchecked, which would result in a later null pointer dereference. While here, RSA_free, DH_free and EC_KEY_free all have implicit NULL checks, so avoid repeating them here. ok beck@
2014-06-05Ensure that we do not process a ChangeCipherSpec with an empty masterJoel Sing
secret. This is an additional safeguard against early ChangeCipherSpec handling. From OpenSSL. ok deraadt@
2014-06-05Be selective as to when ChangeCipherSpec messages will be accepted.Joel Sing
Without this an early ChangeCipherSpec message would result in session keys being generated, along with the Finished hash for the handshake, using an empty master secret. For a detailed analysis see: https://www.imperialviolet.org/2014/06/05/earlyccs.html This is a fix for CVE-2014-0224, from OpenSSL. This issue was reported to OpenSSL by KIKUCHI Masashi. Unfortunately the recent OpenSSL commit was the first we were made aware of the issue. ok deraadt@ sthen@
2014-06-05Reduce code running as root by trying to create all needed socketsFlorian Obser
first, remember which failed, drop privs and then decide which sockets are needed and close the others. Only error out if the creation of a needed socket failed. That is it is non-fatal if tracerouting an INET4 address and the INET6 socket creations failed. prodding deraadt@; OK benno@
2014-06-05More KNF.Joel Sing
2014-06-05add malloc.cOtto Moerbeek
2014-06-05Move to (slightly stripped) version of libc malloc; ok deraadt@Otto Moerbeek
2014-06-05Fix sendmail improper close-on-exec flag handling (CVE-2014-3956)Jasper Lievisse Adriaanse
From FreeBSD SA-14:11 ok millert@
2014-06-05Extended precision floating-point numbers have an explicit integer part bit.Mark Kettenis
Correctly account for this bit, otherwise we'll get the wrong result for some inputs. ok martynas@, daniel@
2014-06-05Add support for COLUMNS env variable, inspired by FreeBSD but with a dashPhilip Guenther
of strtonum() from millert@ sprinkled on top. Also, we've always supported TZ for formatting dates, so say so. ok jmc@ millert@
2014-06-05work-around issue in makewhatis, that expects its current dir to NOT be /.Marc Espie
okay aja@, miod@ until Ingo figures things out. (This fixes the ///sr/ports/pobj/p5-YAML-0.84/fake-amd64/usr/local/man/man3p/YAML::Loader::Base.3p: fopen: No such file or directory style errors)
2014-06-05Improve the divert(4) example program:Lawrence Teo
- Remove unnecessary includes - bzero -> memset - Better sanity checks and return value checks - Use the tcphdr struct instead of tcpiphdr so that the program will work even if there are IP options - Use more conventional variable names and buffer sizes Also add myself to the copyright. ok deraadt@ sthen@
2014-06-04Sanitize use of client_opaque_prf_input: set it to NULL immediately afterMiod Vallat
free()ing it, rather than in conditional code. Also do not bother setting server_opaque_prf_input (server, not client) to NULL in conditional code 10 lines after explicitely free()ing it and setting it to NULL (were the developers afraid of zombie pointers?) ok guenther@
2014-06-04Apply "unifdef -D__STDC__" to libc/arch/*/SYS.hMatthew Dempsky
A while back, pascal@ converted our system call stubs from using "cpp | as" to "cc -x assembler-with-cpp", so there's no need to stay compatible with ancient preprocessor semantics. ok miod
2014-06-04Fix a leak that can occur when len == 0, and as a result we leak a \0 byte.Loganaden Velvindron
(From Frantisek Boranek) OK from miod@
2014-06-04In fusefs_unmount() we need to send the FBT_DESTROY fusebuf only ifSylvestre Gallon
vflush(9) succeed. Problem reported by Helg Bredow. OK sthen@
2014-06-04without overthinking it, replace a few memcmp calls with CRYPTO_memcmpTed Unangst
where it is feasible to do so. better safe than sorry.
2014-06-04Clearing the data toggle bit only makes sense for endpoints that use it,Martin Pieuchot
since this function is optional get rid of the no-op ones. ok ratchov@
2014-06-04Only use ifa_ifwithaddr() to check if the binding address is on theMartin Pieuchot
system. Yes, this is ugly for the moment because OpenBSD prevents you from binding a tcp socket to broadcast address and checking for a broadcast address is... funny! If you've ever wondered why would lead people to write: ina.s_addr != ia->ia_addr.sin_addr.s_addr instead of: ina.s_addr == ia->ia_broadaddr.sin_addr.s_addr Well this is because all the IPv4 addresses belonging to your lo(4) interfaces match the second idiom. Hopefully we'll get rid of this hack soon. ok jca@, mikeb@
2014-06-04datalen is additional data, sync traceroute6 to traceroute. Also "nnFlorian Obser
byte packets" in the first line of traceroute output is the length of the complete IP packet, fix this for traceroute6. OK benno@
2014-06-04Use C99 initializers for pipe and bus methods.Martin Pieuchot
Apart from improving readability, this will help us reduce the number of no-op functions now that some of them are optional. ok ratchov@
2014-06-04Replace ICMP6ECHOLEN define with sizeof()Florian Obser
OK benno@
2014-06-04Stop using a global variable to do address lookups.Martin Pieuchot
ok blambert@, mikeb@
2014-06-04Do not skip or add a byte for the report ID when manipulating data.Martin Pieuchot
This is not compatible to our current schema where one kernel device is attached per report ID of every USB HID device since the drivers already strip the data buffers. Fix a parsing issue reported by henning@
2014-06-04Properly compare endpoint addresses: ignore the direction bit whichAlexandre Ratchov
is not part of the address. From Remco <remco at d-compu.dyndns.org>, thanks! ok mpi@
2014-06-04While it may be smart to use the radix tree for exports it is not OK toClaudio Jeker
use the domain specific tree initialisation method for this since that one is multipath enabled and assumes that the radix node is part of a struct rtentry. This code uses a different struct and so the multipath modifies wrong fields and breaks stuff in mysterious ways. Since we only support AF_INET here anyway simplify the code and only have one radix_node_head pointer instead of AF_MAX ones. Fixes NFS server issues reported by rpe@, OK rpe@, guenther@, sthen@
2014-06-04undo my "no TZ support" notes; guenther says they're wrongJason McIntyre
ok guenther
2014-06-04Remove assigned but unused local variables and macro from vfwprintf().Stefan Sperling
Found by Elliott @ google ok mpi@
2014-06-04fix a fd leak in an error pathJonathan Gray
2014-06-04TMPDIR is an extension;Jason McIntyre
2014-06-04IL are marked xsi;Jason McIntyre
2014-06-04- document sigintJason McIntyre
- \*(Gt -> >, per ingo ok millert guenther
2014-06-04- make note of some xsi optionsJason McIntyre
- even though "am i" is case insensitive, lowercase one example for consistency ok millert guenther
2014-06-03Fix sentinel style.Kenji Aoyama
ok miod@
2014-06-03some macro fixes, and use Sq over Dq for single letter markup;Jason McIntyre
2014-06-03sort previous;Jason McIntyre
2014-06-03mark as xsi;Jason McIntyre
\*(Gt -> >, per ingo;
2014-06-03standard EXIT STATUS and \*(Lt -> <, as per ingo;Jason McIntyre
2014-06-03Mention new devices supported by run(4). Partly based on FreeBSD's run(4) page.Stefan Sperling
2014-06-03Accept -C as an alias for -c. The -C option should be locale-aware,Todd C. Miller
but we don't have collation support yet. Man bits OK jmc@
2014-06-03-s is marked obsolete, so do not document it as an extension; while here,Jason McIntyre
\*(Gt -> >, on ingo's advice;
2014-06-03document "longname" as an extension; while here, tidy up EXAMPLES and addJason McIntyre
an ENVIRONMENT section; ok millert sobrado
2014-06-03-a, -o, and () are marked by posix as obsolete; the finer details areJason McIntyre
left to the user to investigate, on guenther's advice; ok guenther
2014-06-03Actually, we've handled FIFOs on stdin in accordance with POSIX since 1996.Philip Guenther
query and ok jmc@
2014-06-03remove set but not used variableCharles Longeau
found while building portable OpenNTPD ok henning@
2014-06-03revert previous: guenther says it's wrong;Jason McIntyre
2014-06-03Make zyd(4) compile with ZYD_DEBUG.Stefan Sperling
ok krw@ kettenis@ mpi@
2014-06-03Fix an off-by-one in zyd_rxeof().Stefan Sperling
ok krw@ kettenis@ mpi@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-04 05:51:22 +0000