the same binary.
I first decided to random-relink smtpd because of some recent close
calls (in the IPC codepaths, which could have played part in lateral
movement following a primary hole). Then it dawned on me that I can
random relink each of the privsep binaries to be unique, in the same
style as sshd.
Each binary now contains a lot of code it does not need (and is not
reached, but the code remains). That can be refactored as a later
step.
The new /etc/rc relink code will automaticall pick these up.
vague approval martijn, gilles, millert
verification (SSH doesn't depend on these properties)
Pointed out by Soatok Dreamseeker
Add an explicit-seed variant of the keygen function.
feedback / "looks fine" tb@
RFC 9112 section 6.1 requires an intermediary that forwards a message
carrying Transfer-Encoding to remove any received Content-Length first.
relayd already parses the body as chunked in this case, but previously
left Content-Length in the header tree, so the backend could receive
both framing fields and choose a different message boundary.
When chunked framing is selected, remove Content-Length before header
emission; this preserves relayd's chunked body handling while avoiding
CL.TE ambiguity downstream.
Reproted by: Stuart Thomas
OK: rsaodwski@
RFC 9112 sections 6.1 and 6.3 identify a request containing both
Transfer-Encoding and Content-Length as ambiguous request smuggling
input. httpd is the origin server, not an intermediary, so it should not
rewrite the message and continue processing it.
Reject chunked requests that also carry Content-Length before method
specific body handling or FastCGI parameter generation; this avoids
exposing inconsistent framing metadata to applications.
Reproted by: Stuart Thomas
OK: rsaodwski@
Replace silent kv_extend normalisation with an unconditional reject.
RFC 9112 5.2 permits rejection; it is safer than SP replacement
for a forwarding proxy and handles both request and response direction.
kv_extend is therefore no longer required.
Reported by Stuart Thomas, OK kirill@
Replace silent kv_extend normalisation with an unconditional 400.
RFC 9112 5.2 explicitly permits rejection; it is the safer choice
over SP replacement, which hides parser ambiguity downstream.
Reported by Stuart Thomas, OK kirill@
Implement a custom bgscan_done() handler which waits for Tx queues to
drain and handles the AP switch properly by disassociating the device
from our old AP while we still have the old AP's MAC address available
in ic_bss.
Previously, the qwx_newstate task would run a firmware disassociation
sequence with the _new_ AP's MAC address before trying to associate.
The firmware didn't like this and we ran into errors such as:
qwx0: delete key 3 failed: error 58
qwx0: failed to delete peer vdev_id 0 addr xx:xx:xx:xx:xx:xx ret 58
qwx0: unable to delete BSS peer: 58
tested by ajacoutot@ and myself on amd64, and by phessler@ on arm64
ok phessler@, "it works great" ajacoutot@
This helps with situations where we would fail to receive the initial
EAPOL frame during WPA handshakes with the AP, in particular when
roaming between APs.
tested by ajacoutot@ and myself on amd64, and by phessler@ on arm64
UVIDEO_FLAG_VENDOR_CLASS has been broken since r1.147: attach selected
only UICLASS_VIDEO interfaces, even after match accepted a device whose
video control interface incorrectly reports UICLASS_VENDOR.
Restore the vendor class path in attach, and add the remaining Logitech
vendor class UVC devices listed by Linux for which usbdevs already has
product IDs.
Issue reported and tested by "requiem." on Logitech QuickCam Pro5000
OK: mglocker@
sizes up to be a multiple of the ELF word size and adds checks to prevent
out of bounds access.
Based on a report and diff from Andrew Griffiths.
ok jsg@, deraadt@
After close to 20 years of 4-byte AS support in bgpd it is time to enforce
it. The fall back code from 2-byte AS to 4-byte AS is non-trivial and
the RFC is way to optimistic and ignores many possible error conditions.
All relevant BGP implementations support 4-byte ASnums so it is a
misconfiguration to not use this by default. Most implementations do this
by default.
In the unlikely cases where 2-byte AS support is still needed one can
fall back to the previous default by using 'announce as-4byte yes'.
OK tb@ job@
Mergin AS4_PATH into ASPATH can be done a bit simpler by using the fact
that AS4_PATH must be a subset of ASPATH. The resulting path has the same
size and layout as the ASPATH. bgpd inflates the 2-byte ASPATH to 4-byte
representation early on so this simplifies the merge.
When mering the path be strict and any difference in the two paths triggers
a treat-as-withdraw error. Something is off so refuse to work with this path.
This is harsher than RFC 6793 but the concerns then no longer matter.
Use ibuf for all the buffers to have memory safety during this merge operation.
OK tb@
These are directories that are created by
setusercontext(LOGIN_SETXDGENV) and should be available as long as
a session with the XDG_RUNTIME_DIR env variable pointing at them exists.
Since we don't track such sessions, we can't have daily(8) remove such
directories blindly. This looks like an oversight in the initial commit.
Diff proposed by dah4ae (at) posteo (dot) de, ok ajacoutot@
deraadt