diff options
Diffstat (limited to 'website/static/security/patches')
20 files changed, 1147 insertions, 0 deletions
diff --git a/website/static/security/patches/EN-25:15/arm64.patch b/website/static/security/patches/EN-25:15/arm64.patch new file mode 100644 index 0000000000..c5c5ea4b31 --- /dev/null +++ b/website/static/security/patches/EN-25:15/arm64.patch @@ -0,0 +1,11 @@ +--- sys/arm64/arm64/elf32_machdep.c.orig ++++ sys/arm64/arm64/elf32_machdep.c +@@ -195,7 +195,7 @@ + register_t *ap; + struct syscall_args *sa; + int error, i, nap, narg; +- unsigned int args[4]; ++ unsigned int args[6]; + + nap = 4; + p = td->td_proc; diff --git a/website/static/security/patches/EN-25:15/arm64.patch.asc b/website/static/security/patches/EN-25:15/arm64.patch.asc new file mode 100644 index 0000000000..5b8cae892e --- /dev/null +++ b/website/static/security/patches/EN-25:15/arm64.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjJlBIACgkQbljekB8A +Gu/RohAA4pWcgChN+oBJGkiwMVH8mj+pdLE0aIbC3EVPEMfcF3twv2ZHrI+L38p6 +sRL1tMohZQFkA1NmTNnxf/qZmwnMei1nqeTTkfCHZPMBUeeoFh7TK9gl+qpGTcJr +WibRnC2breqD63sQXvaSihPo2ayc0AWDrDE8XRLEHgYE4EV940nFyb0elr8cV+4P +EaXOGn3vN9k7xYnPXwlX9Nt8MoYpY0LJFONCcBhpZNyun+VR3GaUBuGe9fyfMZYP +znNBdH4Kx5wwd3rEa2uo/ErLA1HU2E5BXrjE99VGHt+GNn8TgIxC4oS1+jKV56oM +/4VeeBlouIAM266opHtzk6OsQC5H9FyilM6XjSr1G80HfKYz3h1zPwIMRYKuI7sr +lQd7/XotZKkBIGy5bNeouwPhqt5iXerbDBNq+i80AoxQcLup+GEKmNRmkiahyetm +nj6dJRwtn1f8Fy8w3sMeH9UswFBi8j/oUcQ48GQ8s4BxcYKFkm4+aViYYa85AlSp +awFDp2un/oZIR8KNalAQI5cPTSyG6E/G2Ssg08ThhDrXANF9hPuzKodmc69+okVX +5EoC8wAVYG1mdR2V/7nQO478w8yRu+ne9bvQvAup7umdwGR7psNMB+Zua6zl1WsJ +8I2N8jC5w32scN7pzVNfdwYD5S8eLZB8iFQ6WlxKE/LhTJ7lXEw= +=pygX +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/EN-25:16/vfs.patch b/website/static/security/patches/EN-25:16/vfs.patch new file mode 100644 index 0000000000..226ae9f81a --- /dev/null +++ b/website/static/security/patches/EN-25:16/vfs.patch @@ -0,0 +1,52 @@ +--- sys/kern/vfs_syscalls.c.orig ++++ sys/kern/vfs_syscalls.c +@@ -5050,11 +5050,12 @@ + size_t retlen; + void *rl_rcookie, *rl_wcookie; + off_t inoff, outoff, savinoff, savoutoff; +- bool foffsets_locked; ++ bool foffsets_locked, foffsets_set; + + infp = outfp = NULL; + rl_rcookie = rl_wcookie = NULL; + foffsets_locked = false; ++ foffsets_set = false; + error = 0; + retlen = 0; + +@@ -5122,6 +5123,8 @@ + } + foffset_lock_pair(infp1, &inoff, outfp1, &outoff, 0); + foffsets_locked = true; ++ } else { ++ foffsets_set = true; + } + savinoff = inoff; + savoutoff = outoff; +@@ -5180,11 +5183,12 @@ + vn_rangelock_unlock(invp, rl_rcookie); + if (rl_wcookie != NULL) + vn_rangelock_unlock(outvp, rl_wcookie); ++ if ((foffsets_locked || foffsets_set) && ++ (error == EINTR || error == ERESTART)) { ++ inoff = savinoff; ++ outoff = savoutoff; ++ } + if (foffsets_locked) { +- if (error == EINTR || error == ERESTART) { +- inoff = savinoff; +- outoff = savoutoff; +- } + if (inoffp == NULL) + foffset_unlock(infp, inoff, 0); + else +@@ -5193,6 +5197,9 @@ + foffset_unlock(outfp, outoff, 0); + else + *outoffp = outoff; ++ } else if (foffsets_set) { ++ *inoffp = inoff; ++ *outoffp = outoff; + } + if (outfp != NULL) + fdrop(outfp, td); diff --git a/website/static/security/patches/EN-25:16/vfs.patch.asc b/website/static/security/patches/EN-25:16/vfs.patch.asc new file mode 100644 index 0000000000..5d302e77f4 --- /dev/null +++ b/website/static/security/patches/EN-25:16/vfs.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjJlBQACgkQbljekB8A +Gu9MZBAAghcIHmJAoGyWlG9gEsbEMRWmg9KDcNZuJ6oJM3EzRw/d7nzfvFHQUkk4 +5Seao9EexaN6XO/sq4v+6dVYh3c1lrlBTK7dHA0Mt9XSCip202Fh4rzZA5QhhjhD +8WwaF1J/y1FZv0ag5Z8XJxCIQCz49V/VctObzhq5PpB1XF+Axbddz2H80Jxb27Kh +GEcbKW66+CfVtL3AAhpvCUfgLyEciS1qhfC2tnNrIEl2gSlEqj7AaZ/fx4v/F1QK +ixo0nFQyox13HrlOMWgJBQJM1bCjwueERVmZSnT88SG9cro+LiEdzrbY+ITAMtqT +lA2oQ8AbOYYVPvwc0fnlDlxhwmjFzMSCm+mQQ/haYVrLrIcMeJ8SzV/gxEuamkpi +C0lgf5Y4mzv102CKUygghuOfNnOi0zFjCTqSf5q/7TwaNuelYn/kndMOj9qFFCjn +Wtvvn1BPVnnsLj2xgr1w4V6BnZDjo+xLujLQKOYt5x1RrlPQ/pEt3WNg/ekldLEy +Po4Hzmih/DLfqUo3ttKI4ZXeTisv7KmHE4woy/ok+FZ4U+SxaWKalEoNab7MgTRm +nV7jfMA4AiiK5jkK/3TCPvc82TktgufH19IVuCrMe1RocVxfjIGtXoJ0osLG1YIL +pGlJ5/MXZQLGE4oPi4wb2lErHwpogfS6Jq0prnXE6IbLAi6EHFk= +=Yxtv +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/EN-25:17/bnxt.patch b/website/static/security/patches/EN-25:17/bnxt.patch new file mode 100644 index 0000000000..796f2332bf --- /dev/null +++ b/website/static/security/patches/EN-25:17/bnxt.patch @@ -0,0 +1,44 @@ +--- sys/dev/bnxt/bnxt_en/if_bnxt.c.orig ++++ sys/dev/bnxt/bnxt_en/if_bnxt.c +@@ -4609,34 +4609,34 @@ + + case HWRM_PORT_PHY_QCFG_OUTPUT_PHY_TYPE_40G_ACTIVE_CABLE: + media_type = BNXT_MEDIA_AC; +- return; ++ break; + + case HWRM_PORT_PHY_QCFG_OUTPUT_PHY_TYPE_1G_BASECX: + media_type = BNXT_MEDIA_BASECX; +- return; ++ break; + + case HWRM_PORT_PHY_QCFG_OUTPUT_PHY_TYPE_1G_BASET: + case HWRM_PORT_PHY_QCFG_OUTPUT_PHY_TYPE_BASET: + case HWRM_PORT_PHY_QCFG_OUTPUT_PHY_TYPE_BASETE: + media_type = BNXT_MEDIA_BASET; +- return; ++ break; + + case HWRM_PORT_PHY_QCFG_OUTPUT_PHY_TYPE_BASEKX: + media_type = BNXT_MEDIA_BASEKX; +- return; ++ break; + + case HWRM_PORT_PHY_QCFG_OUTPUT_PHY_TYPE_SGMIIEXTPHY: + media_type = BNXT_MEDIA_BASESGMII; +- return; ++ break; + + case HWRM_PORT_PHY_QCFG_OUTPUT_PHY_TYPE_UNKNOWN: + /* Only Autoneg is supported for TYPE_UNKNOWN */ +- return; ++ break; + + default: + /* Only Autoneg is supported for new phy type values */ + device_printf(softc->dev, "phy type %d not supported by driver\n", phy_type); +- return; ++ break; + } + + switch (link_info->sig_mode) { diff --git a/website/static/security/patches/EN-25:17/bnxt.patch.asc b/website/static/security/patches/EN-25:17/bnxt.patch.asc new file mode 100644 index 0000000000..6e25f45b25 --- /dev/null +++ b/website/static/security/patches/EN-25:17/bnxt.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjJlBYACgkQbljekB8A +Gu/wNRAAsT7ZDT8E6cuOTcv2lZMKjYdW4gVdM8FQPbHrWm1GgURK7Gm9X6HPmSEC +kZRO4aYr3CDuPPLkUQk6PvQybIrZWq2/MkNu3OqnN4ByUCb1qzIIBMWAgzwyKZjT +rkh0VXgIHB0AMbecUsvX6y0J99eesxi0FG1zuGu9YrtKPwdM2ZejEaK+Ix5owpbP +czcvxcr6iLU7HJQgl7vWM0lnmKCUzTu/X+UH/UEyX8NRIfBdnsW39QheDR8/2ony +aL3z9V8I0rczQSxsRBFn4cDl4vYQ87zrtu8eai1hj9NQ1yCUuP5tqICBR0Ljwn+Q +oDlkZaVp/KgTVX1b5JxxU2EAHYAdVFBz9c1wJ7hz4ciuC4+luVFSZljz9tnrniuK +GmS/xPt9HirPFqH2GeYrdD8a58eKmr0ew9kL3upf49cITRvfIiwn8KSUzbakNok2 +SmKeAO7ScgCfS2I9xWj/VYiePwKsd2tPQ8/TgZfeHxKrFdwzpm1GZsacqX9kymvX +7r7Kl6VjNhuv2sLeEgd25GtG9i6G0bFXJJhC4ZUCkW5LCULIOywUdGEQ1HAvIvlb +ppHCIXZavoHYyXWRaPTAfxj6v9UdxHFzChK4AG21I4Chh28EutvDTG675HQ7FScd +ICnCu+g4bDgVJcWkwp+Ou5ViYFQM0e7WgJoBQ23krj6VFj0D0T4= +=66Ry +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/EN-25:18/freebsd-update.patch b/website/static/security/patches/EN-25:18/freebsd-update.patch new file mode 100644 index 0000000000..df93f7bb03 --- /dev/null +++ b/website/static/security/patches/EN-25:18/freebsd-update.patch @@ -0,0 +1,32 @@ +--- usr.sbin/freebsd-update/freebsd-update.sh.orig ++++ usr.sbin/freebsd-update/freebsd-update.sh +@@ -3111,10 +3111,28 @@ + grep -E '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' > INDEX-NEW + install_from_index INDEX-NEW || return 1 + +- # Install new shared libraries next ++ # Next, in order, libsys, libc, and libthr. + grep -vE '^/boot/' $1/INDEX-NEW | + grep -vE '^[^|]+\|d\|' | + grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/libsys\.so\.[0-9]+\|' > INDEX-NEW ++ install_from_index INDEX-NEW || return 1 ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/libc\.so\.[0-9]+\|' > INDEX-NEW ++ install_from_index INDEX-NEW || return 1 ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/libthr\.so\.[0-9]+\|' > INDEX-NEW ++ install_from_index INDEX-NEW || return 1 ++ ++ # Install the rest of the shared libraries next ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' | ++ grep -vE '^[^|]*/lib/(libsys|libc|libthr)\.so\.[0-9]+\|' | + grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + install_from_index INDEX-NEW || return 1 + diff --git a/website/static/security/patches/EN-25:18/freebsd-update.patch.asc b/website/static/security/patches/EN-25:18/freebsd-update.patch.asc new file mode 100644 index 0000000000..f44b92f70d --- /dev/null +++ b/website/static/security/patches/EN-25:18/freebsd-update.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjb+yMACgkQbljekB8A +Gu85Mw/9HtHqy0ZseVpE6OhJy4+6pG00tCnQq/ERCbycGkyZziJakwCQFviEx0MO +MUSta9g8MhysdMLNTRl9wwaiEGoXxXZvRaEEFB0Crf4Fvt4V4QLzU7WUxgbfa4kp +wQOad+xzfe/7KLiUk70OHh1ODfYydC8NVPCoIT+pbkHzdGvaqEKXR8vtjs7Myf7V +M7Y6GhRs9tDvA63TEBWEVLP1wVTJ3sYGopeyzKU7xNBEngih5LaP17BOXMlA74rR +zrNxIkRTJe+gPAbMUyZ7OdmbdtzeYtcbwZN+7uf4Vd2xSP0VjqNlC8goKdPNw2kN +71mrGpejtDSqvT23RCPA3ek5dqDFsl+2h2MfUstNLofnKSO4H6pq0I61PZbYDDkY +VVgNdybqzs/lFsL4VNFS5dbaoa6OiBpX2yo2b7AUwaqtP4n6qKSaO2yTBsZfxoAs +nTZkCzbVCzlqP4JXCDdmjvnAhaf0DxEx7QsSj5YCp5RihIqXaE+XZ4LlQFt0HgDr +2iLLX2V9g3g966CKcXI0vVt/vzOqpakrcBpnslW0b6+rhthe1MTIhgdDLvpmJ5DX +a35bUeKqqxCq9yiPDKE0RpABnxSKEWGB+asVErLNRga97wf5fUojTmtLURALMIY8 +OSCW9nsI8iCX/4+eB3OfuWPpW9Z9IGB19CDMgdnVUnozBgjv0cM= +=saMY +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-25:08/openssl-13.patch b/website/static/security/patches/SA-25:08/openssl-13.patch new file mode 100644 index 0000000000..ff46f32c81 --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-13.patch @@ -0,0 +1,11 @@ +--- crypto/openssl/crypto/cms/cms_pwri.c.orig ++++ crypto/openssl/crypto/cms/cms_pwri.c +@@ -215,7 +215,7 @@ + /* Check byte failure */ + goto err; + } +- if (inlen < (size_t)(tmp[0] - 4)) { ++ if (inlen < 4 + (size_t)tmp[0]) { + /* Invalid length value */ + goto err; + } diff --git a/website/static/security/patches/SA-25:08/openssl-13.patch.asc b/website/static/security/patches/SA-25:08/openssl-13.patch.asc new file mode 100644 index 0000000000..b8cb1f7718 --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-13.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjb+0IACgkQbljekB8A +Gu+lIg/+Lolkw+WssmbgxxZdypCud/7HTk/+M4YdBPMtoZYFec/Mzpw9ok+MUs2O +7Ev1mc0rQ9Rcfw5PEe6tKvC3MMFtWOcHNr3QqkkvkAA2nsxCeEPIBHyQiEm347PU +ntraIANMy+MbmaegU5+vyzpZQxBl6erAc+9p7eyMFBJtFzRCZV2SIPV4lUrgYsKq +WyjM7o7jRfOcn7aZ6X+pPnUjQY6jkJQIiHqytdG8XTIkzDvcpy88g9Yg1qxBwi// +ESgZWIHdU4kbChQJPFfYGYUFZ2tn15iMRjmjQA6SKCWpJNq56r3PLNCQ7Z99KCe8 +dAs0Uw0ZPQZuZVMNb3XV4W/MEDWc+2I9HUXwJfA6RFDbm71sj9XTwBYskEDPcD+q +w3OMkG184EUgqrZazaO2MLas+X7aaMwn7Dvr+zCjREfKp8s6Qar5nKgjP7XoBmTg +ewez2FEUmjdt7SIq5K81Xjmnd7Qu069Yztw/YavCHcQOpwf7Iea1etH9ynMQ0jEb +zAgO++HJJiN6+Noahcauet8L5TsjJIoZd8DTB2g0fONt1S5HCtklnBptyDfispBO +pWf059PG079wiTmL/qT1x4UnYnyZs32HghR9+R4tOkSFs3RiVMaGk8ZnIL+Nmp3v +sRx3so9zFU0TBVww9eRe9/ve4MKd+AqJJe8X1iioDvk7l8JyUTw= +=NXRd +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-25:08/openssl-14.patch b/website/static/security/patches/SA-25:08/openssl-14.patch new file mode 100644 index 0000000000..10c55dd60a --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-14.patch @@ -0,0 +1,21 @@ +--- crypto/openssl/crypto/cms/cms_pwri.c.orig ++++ crypto/openssl/crypto/cms/cms_pwri.c +@@ -228,7 +228,7 @@ + /* Check byte failure */ + goto err; + } +- if (inlen < (size_t)(tmp[0] - 4)) { ++ if (inlen < 4 + (size_t)tmp[0]) { + /* Invalid length value */ + goto err; + } +--- crypto/openssl/crypto/http/http_lib.c.orig ++++ crypto/openssl/crypto/http/http_lib.c +@@ -267,6 +267,7 @@ + /* strip leading '[' and trailing ']' from escaped IPv6 address */ + sl -= 2; + strncpy(host, server + 1, sl); ++ host[sl] = '\0'; + server = host; + } + diff --git a/website/static/security/patches/SA-25:08/openssl-14.patch.asc b/website/static/security/patches/SA-25:08/openssl-14.patch.asc new file mode 100644 index 0000000000..43ac390451 --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-14.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjb+0MACgkQbljekB8A +Gu8Mrg//Wx7TovEbu7hCYrBcs3+LwhVEQh2S6V7APXHtoXIY6Tp56b0ii60F5nBY +a8LSKYqb+sZlTgRt2IHU/gFAzHJAPB5zb2Vc+//T6l192mS8sI+Z3lgJQ8IvWaW5 +g3RI/iukDMo2He7xrXgtGukJjKOen/Y0gphb5kXApBgdw5I/yPXFhbF1WmfB13aN +M8gfhr7fuRBd+BXQ6S/q0WSNg0cwQkiA1fy0iE6xaIfeX6I44sxGBU7yKWnxfGfS +crExJdfVFTv+9duMRIjQovDAEheQBAd5ZJLnTUHmJX0pCP9Qv1Mg0rGchvVzKlSg +Q0GXLABmuyq81XwMHz9enW0xzTWmp1/9gCyL9+O/x5EeQnYqOSarWDxFg3G9qYyF +1TGAX7oj3PJ3s7HkHoBKKN3tR7pHjIi+EHkXFnbpA8Pik8rLY54kwMPHXSL153o7 +DNKyn41sx76+yBckiWKvNq6yIzRiFCcuQ8IwOVMNZ+bkw4M14HjSRs0+aDlmkvgG +Hs5tqWH0qdo5wMMp09aVizlXgTfTSZhdRxW/cUdS+XPBKJ7ogvTI/M9TDn33BzuP +oex1SeoBIRInKKMW6EipisAE9B6jnvfH5gsh2f0XpUDqX5vWBjOpxiF4hZLmPvti +nt18T+/ScdIwHebnKUob70hf3mTGxLpnPNH5eM8SdkMsJORGook= +=DhAy +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-25:08/openssl-15.patch b/website/static/security/patches/SA-25:08/openssl-15.patch new file mode 100644 index 0000000000..f4678a9583 --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-15.patch @@ -0,0 +1,173 @@ +--- crypto/openssl/crypto/cms/cms_pwri.c.orig ++++ crypto/openssl/crypto/cms/cms_pwri.c +@@ -242,7 +242,7 @@ + /* Check byte failure */ + goto err; + } +- if (inlen < (size_t)(tmp[0] - 4)) { ++ if (inlen < 4 + (size_t)tmp[0]) { + /* Invalid length value */ + goto err; + } +--- crypto/openssl/crypto/ec/ecp_sm2p256.c.orig ++++ crypto/openssl/crypto/ec/ecp_sm2p256.c +@@ -56,10 +56,6 @@ + 0xffffffffffffffff, 0xffffffff00000000, + 0xffffffffffffffff, 0xfffffffeffffffff + }; +-ALIGN32 static const BN_ULONG def_ord[P256_LIMBS] = { +- 0x53bbf40939d54123, 0x7203df6b21c6052b, +- 0xffffffffffffffff, 0xfffffffeffffffff +-}; + + ALIGN32 static const BN_ULONG ONE[P256_LIMBS] = {1, 0, 0, 0}; + +@@ -177,13 +173,6 @@ + BN_MOD_INV(out, in, ecp_sm2p256_div_by_2, ecp_sm2p256_sub, def_p); + } + +-/* Modular inverse mod order |out| = |in|^(-1) % |ord|. */ +-static ossl_inline void ecp_sm2p256_mod_ord_inverse(BN_ULONG* out, +- const BN_ULONG* in) { +- BN_MOD_INV(out, in, ecp_sm2p256_div_by_2_mod_ord, ecp_sm2p256_sub_mod_ord, +- def_ord); +-} +- + /* Point double: R <- P + P */ + static void ecp_sm2p256_point_double(P256_POINT *R, const P256_POINT *P) + { +@@ -454,52 +443,6 @@ + } + #endif + +-/* +- * Convert Jacobian coordinate point into affine coordinate (x,y) +- */ +-static int ecp_sm2p256_get_affine(const EC_GROUP *group, +- const EC_POINT *point, +- BIGNUM *x, BIGNUM *y, BN_CTX *ctx) +-{ +- ALIGN32 BN_ULONG z_inv2[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG z_inv3[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG x_aff[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG y_aff[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG point_x[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG point_y[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG point_z[P256_LIMBS] = {0}; +- +- if (EC_POINT_is_at_infinity(group, point)) { +- ECerr(ERR_LIB_EC, EC_R_POINT_AT_INFINITY); +- return 0; +- } +- +- if (ecp_sm2p256_bignum_field_elem(point_x, point->X) <= 0 +- || ecp_sm2p256_bignum_field_elem(point_y, point->Y) <= 0 +- || ecp_sm2p256_bignum_field_elem(point_z, point->Z) <= 0) { +- ECerr(ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE); +- return 0; +- } +- +- ecp_sm2p256_mod_inverse(z_inv3, point_z); +- ecp_sm2p256_sqr(z_inv2, z_inv3); +- +- if (x != NULL) { +- ecp_sm2p256_mul(x_aff, point_x, z_inv2); +- if (!bn_set_words(x, x_aff, P256_LIMBS)) +- return 0; +- } +- +- if (y != NULL) { +- ecp_sm2p256_mul(z_inv3, z_inv3, z_inv2); +- ecp_sm2p256_mul(y_aff, point_y, z_inv3); +- if (!bn_set_words(y, y_aff, P256_LIMBS)) +- return 0; +- } +- +- return 1; +-} +- + /* r = sum(scalar[i]*point[i]) */ + static int ecp_sm2p256_windowed_mul(const EC_GROUP *group, + P256_POINT *r, +@@ -689,44 +632,6 @@ + return 1; + } + +-static int ecp_sm2p256_inv_mod_ord(const EC_GROUP *group, BIGNUM *r, +- const BIGNUM *x, BN_CTX *ctx) +-{ +- int ret = 0; +- ALIGN32 BN_ULONG t[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG out[P256_LIMBS] = {0}; +- +- if (bn_wexpand(r, P256_LIMBS) == NULL) { +- ECerr(ERR_LIB_EC, ERR_R_BN_LIB); +- goto err; +- } +- +- if ((BN_num_bits(x) > 256) || BN_is_negative(x)) { +- BIGNUM *tmp; +- +- if ((tmp = BN_CTX_get(ctx)) == NULL +- || !BN_nnmod(tmp, x, group->order, ctx)) { +- ECerr(ERR_LIB_EC, ERR_R_BN_LIB); +- goto err; +- } +- x = tmp; +- } +- +- if (!ecp_sm2p256_bignum_field_elem(t, x)) { +- ECerr(ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE); +- goto err; +- } +- +- ecp_sm2p256_mod_ord_inverse(out, t); +- +- if (!bn_set_words(r, out, P256_LIMBS)) +- goto err; +- +- ret = 1; +-err: +- return ret; +-} +- + const EC_METHOD *EC_GFp_sm2p256_method(void) + { + static const EC_METHOD ret = { +@@ -747,7 +652,7 @@ + ossl_ec_GFp_simple_point_copy, + ossl_ec_GFp_simple_point_set_to_infinity, + ossl_ec_GFp_simple_point_set_affine_coordinates, +- ecp_sm2p256_get_affine, ++ ossl_ec_GFp_simple_point_get_affine_coordinates, + 0, 0, 0, + ossl_ec_GFp_simple_add, + ossl_ec_GFp_simple_dbl, +@@ -763,7 +668,7 @@ + ecp_sm2p256_field_mul, + ecp_sm2p256_field_sqr, + 0 /* field_div */, +- 0 /* field_inv */, ++ ossl_ec_GFp_simple_field_inv, + 0 /* field_encode */, + 0 /* field_decode */, + 0 /* field_set_to_one */, +@@ -779,7 +684,7 @@ + ossl_ecdsa_simple_sign_setup, + ossl_ecdsa_simple_sign_sig, + ossl_ecdsa_simple_verify_sig, +- ecp_sm2p256_inv_mod_ord, ++ 0, /* use constant‑time fallback for inverse mod order */ + 0, /* blind_coordinates */ + 0, /* ladder_pre */ + 0, /* ladder_step */ +--- crypto/openssl/crypto/http/http_lib.c.orig ++++ crypto/openssl/crypto/http/http_lib.c +@@ -263,6 +263,7 @@ + /* strip leading '[' and trailing ']' from escaped IPv6 address */ + sl -= 2; + strncpy(host, server + 1, sl); ++ host[sl] = '\0'; + server = host; + } + diff --git a/website/static/security/patches/SA-25:08/openssl-15.patch.asc b/website/static/security/patches/SA-25:08/openssl-15.patch.asc new file mode 100644 index 0000000000..452a1fbaaa --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-15.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjb+0QACgkQbljekB8A +Gu+tUg//daQG6OHScuUNTvwR9d3kOqeiEcA2hiaMg7BuPlaimq6+o4/Nsrxuu5z1 +l2l1seZXGP1iTXAWAjxL1d8ceVBJ4mqO3yhIg5qDF3rlhCNpHf8Fphl0yu7SQohx +wBVx2RcZ8ldq+TmvgNywWeEeuuJ5D4CukPHPAjIv1+/NB/P+NsrkC37YZ88bfckF +0oAqF6b2KONV3hBVVSAjMhoR3esDOoqp7yGwpzBsiDb7EANj+wMd1aYuUtp3bOHH +dZa0uGLEBITzd2s/rGEfsF7os0UdJFv0GJ2SZXxHUV80coIyKSxccFAwnxI1/CVY +8ji20zfYtdVmwn2ZhnVCO3n95HqAsiglX35LrrXSoohC3nx9XcCQr3BlYc6G6icC +9RnCeI6sFjAQ7x46fnYy51BrfgTmmRrTmGDbbGrrwphNP8QrrrXBRD7TIaHKmQgj +nTS7VsQya/X9pnQHTIxjmOPQ6gVLrZ0w6nBRyNC8HkjcCv+jOLXcyf+8flNTI84/ +dmuh9c/xDqzhXgUaEe4SHW9NtL9ohV7/l/Qt1FgXOV/VzHuK+kLtCXz9KskIsUYc +kKg0UPFuP0t0UgDimkXx3eLctEyfmJtbL/j1iLUqV442REkK+QttyJILV0GmMpQy +KvIHb9/sQnC65TpP3oyxbVcrasosNRhvaILmtzXvIInlqHC0OhQ= +=lGPI +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-25:09/netinet-13.patch b/website/static/security/patches/SA-25:09/netinet-13.patch new file mode 100644 index 0000000000..49031737eb --- /dev/null +++ b/website/static/security/patches/SA-25:09/netinet-13.patch @@ -0,0 +1,244 @@ +--- sys/netinet/in_pcb.c.orig ++++ sys/netinet/in_pcb.c +@@ -2668,6 +2668,7 @@ + struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; + struct inpcbport *phd; + u_int32_t hashkey_faddr; ++ bool connected; + + INP_WLOCK_ASSERT(inp); + INP_HASH_WLOCK_ASSERT(pcbinfo); +@@ -2676,11 +2677,15 @@ + ("in_pcbinshash: INP_INHASHLIST")); + + #ifdef INET6 +- if (inp->inp_vflag & INP_IPV6) ++ if (inp->inp_vflag & INP_IPV6) { + hashkey_faddr = INP6_PCBHASHKEY(&inp->in6p_faddr); +- else ++ connected = !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr); ++ } else + #endif +- hashkey_faddr = inp->inp_faddr.s_addr; ++ { ++ hashkey_faddr = inp->inp_faddr.s_addr; ++ connected = inp->inp_faddr.s_addr != INADDR_ANY; ++ } + + pcbhash = &pcbinfo->ipi_hashbase[INP_PCBHASH(hashkey_faddr, + inp->inp_lport, inp->inp_fport, pcbinfo->ipi_hashmask)]; +@@ -2689,10 +2694,12 @@ + INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_porthashmask)]; + + /* +- * Add entry to load balance group. +- * Only do this if SO_REUSEPORT_LB is set. ++ * Ignore SO_REUSEPORT_LB if the socket is connected. Really this case ++ * should be an error, but for UDP sockets it is not, and some ++ * applications erroneously set it on connected UDP sockets, so we can't ++ * change this without breaking compatibility. + */ +- if ((inp->inp_flags2 & INP_REUSEPORT_LB) != 0) { ++ if (!connected && (inp->inp_flags2 & INP_REUSEPORT_LB) != 0) { + int error = in_pcbinslbgrouphash(inp, M_NODOM); + if (error != 0) + return (error); +@@ -2761,6 +2768,7 @@ + struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; + struct inpcbhead *head; + u_int32_t hashkey_faddr; ++ bool connected; + + INP_WLOCK_ASSERT(inp); + INP_HASH_WLOCK_ASSERT(pcbinfo); +@@ -2769,11 +2777,19 @@ + ("in_pcbrehash: !INP_INHASHLIST")); + + #ifdef INET6 +- if (inp->inp_vflag & INP_IPV6) ++ if (inp->inp_vflag & INP_IPV6) { + hashkey_faddr = INP6_PCBHASHKEY(&inp->in6p_faddr); +- else ++ connected = !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr); ++ } else + #endif +- hashkey_faddr = inp->inp_faddr.s_addr; ++ { ++ hashkey_faddr = inp->inp_faddr.s_addr; ++ connected = inp->inp_faddr.s_addr != INADDR_ANY; ++ } ++ ++ /* See the comment in in_pcbinshash(). */ ++ if (connected && (inp->inp_flags2 & INP_REUSEPORT_LB) != 0) ++ in_pcbremlbgrouphash(inp); + + head = &pcbinfo->ipi_hashbase[INP_PCBHASH(hashkey_faddr, + inp->inp_lport, inp->inp_fport, pcbinfo->ipi_hashmask)]; +--- tests/sys/netinet/so_reuseport_lb_test.c.orig ++++ tests/sys/netinet/so_reuseport_lb_test.c +@@ -29,6 +29,8 @@ + + #include <sys/cdefs.h> + #include <sys/param.h> ++#include <sys/filio.h> ++#include <sys/ioccom.h> + #include <sys/socket.h> + + #include <netinet/in.h> +@@ -236,10 +238,156 @@ + } + } + ++/* ++ * The kernel erroneously permits calling connect() on a UDP socket with ++ * SO_REUSEPORT_LB set. Verify that packets sent to the bound address are ++ * dropped unless they come from the connected address. ++ */ ++ATF_TC_WITHOUT_HEAD(connect_udp); ++ATF_TC_BODY(connect_udp, tc) ++{ ++ struct sockaddr_in sin = { ++ .sin_family = AF_INET, ++ .sin_len = sizeof(sin), ++ .sin_addr = { htonl(INADDR_LOOPBACK) }, ++ }; ++ ssize_t n; ++ int error, len, s1, s2, s3; ++ char ch; ++ ++ s1 = socket(PF_INET, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s1 >= 0); ++ s2 = socket(PF_INET, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s2 >= 0); ++ s3 = socket(PF_INET, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s3 >= 0); ++ ++ error = setsockopt(s1, SOL_SOCKET, SO_REUSEPORT_LB, (int[]){1}, ++ sizeof(int)); ++ ATF_REQUIRE_MSG(error == 0, ++ "setsockopt(SO_REUSEPORT_LB) failed: %s", strerror(errno)); ++ error = bind(s1, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s2, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s3, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ /* Connect to an address not owned by s2. */ ++ error = getsockname(s3, (struct sockaddr *)&sin, ++ (socklen_t[]){sizeof(sin)}); ++ ATF_REQUIRE(error == 0); ++ error = connect(s1, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "connect() failed: %s", strerror(errno)); ++ ++ /* Try to send a packet to s1 from s2. */ ++ error = getsockname(s1, (struct sockaddr *)&sin, ++ (socklen_t[]){sizeof(sin)}); ++ ATF_REQUIRE(error == 0); ++ ++ ch = 42; ++ n = sendto(s2, &ch, sizeof(ch), 0, (struct sockaddr *)&sin, ++ sizeof(sin)); ++ ATF_REQUIRE(n == 1); ++ ++ /* Give the packet some time to arrive. */ ++ usleep(100000); ++ ++ /* s1 is connected to s3 and shouldn't receive from s2. */ ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len == 0, "unexpected data available"); ++ ++ /* ... but s3 can of course send to s1. */ ++ n = sendto(s3, &ch, sizeof(ch), 0, (struct sockaddr *)&sin, ++ sizeof(sin)); ++ ATF_REQUIRE(n == 1); ++ usleep(100000); ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len >= 1, "expected data available"); ++} ++ ++/* ++ * The kernel erroneously permits calling connect() on a UDP socket with ++ * SO_REUSEPORT_LB set. Verify that packets sent to the bound address are ++ * dropped unless they come from the connected address. ++ */ ++ATF_TC_WITHOUT_HEAD(connect_udp6); ++ATF_TC_BODY(connect_udp6, tc) ++{ ++ struct sockaddr_in6 sin6 = { ++ .sin6_family = AF_INET6, ++ .sin6_len = sizeof(sin6), ++ .sin6_addr = IN6ADDR_LOOPBACK_INIT, ++ }; ++ ssize_t n; ++ int error, len, s1, s2, s3; ++ char ch; ++ ++ s1 = socket(PF_INET6, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s1 >= 0); ++ s2 = socket(PF_INET6, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s2 >= 0); ++ s3 = socket(PF_INET6, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s3 >= 0); ++ ++ error = setsockopt(s1, SOL_SOCKET, SO_REUSEPORT_LB, (int[]){1}, ++ sizeof(int)); ++ ATF_REQUIRE_MSG(error == 0, ++ "setsockopt(SO_REUSEPORT_LB) failed: %s", strerror(errno)); ++ error = bind(s1, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s2, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s3, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ /* Connect to an address not owned by s2. */ ++ error = getsockname(s3, (struct sockaddr *)&sin6, ++ (socklen_t[]){sizeof(sin6)}); ++ ATF_REQUIRE(error == 0); ++ error = connect(s1, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "connect() failed: %s", strerror(errno)); ++ ++ /* Try to send a packet to s1 from s2. */ ++ error = getsockname(s1, (struct sockaddr *)&sin6, ++ (socklen_t[]){sizeof(sin6)}); ++ ATF_REQUIRE(error == 0); ++ ++ ch = 42; ++ n = sendto(s2, &ch, sizeof(ch), 0, (struct sockaddr *)&sin6, ++ sizeof(sin6)); ++ ATF_REQUIRE(n == 1); ++ ++ /* Give the packet some time to arrive. */ ++ usleep(100000); ++ ++ /* s1 is connected to s3 and shouldn't receive from s2. */ ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len >= 0, "unexpected data available"); ++ ++ /* ... but s3 can of course send to s1. */ ++ n = sendto(s3, &ch, sizeof(ch), 0, (struct sockaddr *)&sin6, ++ sizeof(sin6)); ++ ATF_REQUIRE(n == 1); ++ usleep(100000); ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len >= 1, "expected data available"); ++} ++ + ATF_TP_ADD_TCS(tp) + { + ATF_TP_ADD_TC(tp, basic_ipv4); + ATF_TP_ADD_TC(tp, basic_ipv6); ++ ATF_TP_ADD_TC(tp, connect_udp); ++ ATF_TP_ADD_TC(tp, connect_udp6); + + return (atf_no_error()); + } diff --git a/website/static/security/patches/SA-25:09/netinet-13.patch.asc b/website/static/security/patches/SA-25:09/netinet-13.patch.asc new file mode 100644 index 0000000000..4767da0d8d --- /dev/null +++ b/website/static/security/patches/SA-25:09/netinet-13.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmj5CrcACgkQbljekB8A +Gu+Aqg/8CJPC1rYA+WwpTlAFbQ4HbNrWWptKQvnvvc9qZ6I74p4B4g5tXTsarJaw +Y5fEX4o+SU1aM2x3jLEEKXvjm+BHjeI8OFWDIXsSwg6SH9CkXiiqVeFsgYl7ld0R +W1YU+1QN8/4co/QLOgbRAPFcTm8z6FX6yzWcWRnwrHksT6lSu6q0FTTm//2T+upN +QdW8L19dV0zvL36aA47P7WR5aiaRuyDj9K8gpQnD/rlCPjMpwmuVXdlvQDs7m0uE +4fbrNULAk+2QXUMqWG8qUbpLgAK5oNrI5dGVXzWwJ98pOm5gO7rozWlAE4bn46nk +9/4cMWVZoYHp4Ui0iHqb9nvdJQq21jFS1408Bxsi4sT+nztRsbO8plD3ihSiG+XL +VVcauVUxxf8ezbJmTSji5HTnSIs16kHPiVGCgEuX0bBeItyqrT9p6v379Jw2pSgH +FQHNGoFYJQ0KDlEFxpxChpZyyH7DMKYF0ckwd9apsD8HCUvw1w6y89UjahPpb7Gj +2p3O8NvEFpy0ODL0/h5G7Wc6hzs++i/gaiXiRZXhMtXY0rlpcH6N5SrTso2jY2SA +yEOM1AZV9v9hzS6st4R+Tot/e3j4OlxMjhSKJu9F3VyGyNbIhXFW8pMvjTD06CWM +YSLX4qyBoHhkrMpsj53acGif0hlikN59tuAuVRjGeXRgrbQudkU= +=4UW4 +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-25:09/netinet-14.patch b/website/static/security/patches/SA-25:09/netinet-14.patch new file mode 100644 index 0000000000..0c022135e8 --- /dev/null +++ b/website/static/security/patches/SA-25:09/netinet-14.patch @@ -0,0 +1,198 @@ +--- sys/netinet/in_pcb.c.orig ++++ sys/netinet/in_pcb.c +@@ -2702,10 +2702,13 @@ + INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_porthashmask)]; + + /* +- * Add entry to load balance group. +- * Only do this if SO_REUSEPORT_LB is set. ++ * Ignore SO_REUSEPORT_LB if the socket is connected. Really this case ++ * should be an error, but for UDP sockets it is not, and some ++ * applications erroneously set it on connected UDP sockets, so we can't ++ * change this without breaking compatibility. + */ +- if ((inp->inp_socket->so_options & SO_REUSEPORT_LB) != 0) { ++ if (!connected && ++ (inp->inp_socket->so_options & SO_REUSEPORT_LB) != 0) { + int error = in_pcbinslbgrouphash(inp, M_NODOM); + if (error != 0) + return (error); +@@ -2836,6 +2839,10 @@ + connected = !in_nullhost(inp->inp_faddr); + } + ++ /* See the comment in in_pcbinshash(). */ ++ if (connected && (inp->inp_flags & INP_INLBGROUP) != 0) ++ in_pcbremlbgrouphash(inp); ++ + /* + * When rehashing, the caller must ensure that either the new or the old + * foreign address was unspecified. +--- tests/sys/netinet/so_reuseport_lb_test.c.orig ++++ tests/sys/netinet/so_reuseport_lb_test.c +@@ -29,6 +29,8 @@ + + #include <sys/cdefs.h> + #include <sys/param.h> ++#include <sys/filio.h> ++#include <sys/ioccom.h> + #include <sys/socket.h> + + #include <netinet/in.h> +@@ -236,10 +238,156 @@ + } + } + ++/* ++ * The kernel erroneously permits calling connect() on a UDP socket with ++ * SO_REUSEPORT_LB set. Verify that packets sent to the bound address are ++ * dropped unless they come from the connected address. ++ */ ++ATF_TC_WITHOUT_HEAD(connect_udp); ++ATF_TC_BODY(connect_udp, tc) ++{ ++ struct sockaddr_in sin = { ++ .sin_family = AF_INET, ++ .sin_len = sizeof(sin), ++ .sin_addr = { htonl(INADDR_LOOPBACK) }, ++ }; ++ ssize_t n; ++ int error, len, s1, s2, s3; ++ char ch; ++ ++ s1 = socket(PF_INET, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s1 >= 0); ++ s2 = socket(PF_INET, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s2 >= 0); ++ s3 = socket(PF_INET, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s3 >= 0); ++ ++ error = setsockopt(s1, SOL_SOCKET, SO_REUSEPORT_LB, (int[]){1}, ++ sizeof(int)); ++ ATF_REQUIRE_MSG(error == 0, ++ "setsockopt(SO_REUSEPORT_LB) failed: %s", strerror(errno)); ++ error = bind(s1, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s2, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s3, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ /* Connect to an address not owned by s2. */ ++ error = getsockname(s3, (struct sockaddr *)&sin, ++ (socklen_t[]){sizeof(sin)}); ++ ATF_REQUIRE(error == 0); ++ error = connect(s1, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "connect() failed: %s", strerror(errno)); ++ ++ /* Try to send a packet to s1 from s2. */ ++ error = getsockname(s1, (struct sockaddr *)&sin, ++ (socklen_t[]){sizeof(sin)}); ++ ATF_REQUIRE(error == 0); ++ ++ ch = 42; ++ n = sendto(s2, &ch, sizeof(ch), 0, (struct sockaddr *)&sin, ++ sizeof(sin)); ++ ATF_REQUIRE(n == 1); ++ ++ /* Give the packet some time to arrive. */ ++ usleep(100000); ++ ++ /* s1 is connected to s3 and shouldn't receive from s2. */ ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len == 0, "unexpected data available"); ++ ++ /* ... but s3 can of course send to s1. */ ++ n = sendto(s3, &ch, sizeof(ch), 0, (struct sockaddr *)&sin, ++ sizeof(sin)); ++ ATF_REQUIRE(n == 1); ++ usleep(100000); ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len == 1, "unexpected data available"); ++} ++ ++/* ++ * The kernel erroneously permits calling connect() on a UDP socket with ++ * SO_REUSEPORT_LB set. Verify that packets sent to the bound address are ++ * dropped unless they come from the connected address. ++ */ ++ATF_TC_WITHOUT_HEAD(connect_udp6); ++ATF_TC_BODY(connect_udp6, tc) ++{ ++ struct sockaddr_in6 sin6 = { ++ .sin6_family = AF_INET6, ++ .sin6_len = sizeof(sin6), ++ .sin6_addr = IN6ADDR_LOOPBACK_INIT, ++ }; ++ ssize_t n; ++ int error, len, s1, s2, s3; ++ char ch; ++ ++ s1 = socket(PF_INET6, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s1 >= 0); ++ s2 = socket(PF_INET6, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s2 >= 0); ++ s3 = socket(PF_INET6, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s3 >= 0); ++ ++ error = setsockopt(s1, SOL_SOCKET, SO_REUSEPORT_LB, (int[]){1}, ++ sizeof(int)); ++ ATF_REQUIRE_MSG(error == 0, ++ "setsockopt(SO_REUSEPORT_LB) failed: %s", strerror(errno)); ++ error = bind(s1, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s2, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s3, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ /* Connect to an address not owned by s2. */ ++ error = getsockname(s3, (struct sockaddr *)&sin6, ++ (socklen_t[]){sizeof(sin6)}); ++ ATF_REQUIRE(error == 0); ++ error = connect(s1, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "connect() failed: %s", strerror(errno)); ++ ++ /* Try to send a packet to s1 from s2. */ ++ error = getsockname(s1, (struct sockaddr *)&sin6, ++ (socklen_t[]){sizeof(sin6)}); ++ ATF_REQUIRE(error == 0); ++ ++ ch = 42; ++ n = sendto(s2, &ch, sizeof(ch), 0, (struct sockaddr *)&sin6, ++ sizeof(sin6)); ++ ATF_REQUIRE(n == 1); ++ ++ /* Give the packet some time to arrive. */ ++ usleep(100000); ++ ++ /* s1 is connected to s3 and shouldn't receive from s2. */ ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len == 0, "unexpected data available"); ++ ++ /* ... but s3 can of course send to s1. */ ++ n = sendto(s3, &ch, sizeof(ch), 0, (struct sockaddr *)&sin6, ++ sizeof(sin6)); ++ ATF_REQUIRE(n == 1); ++ usleep(100000); ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len == 1, "unexpected data available"); ++} ++ + ATF_TP_ADD_TCS(tp) + { + ATF_TP_ADD_TC(tp, basic_ipv4); + ATF_TP_ADD_TC(tp, basic_ipv6); ++ ATF_TP_ADD_TC(tp, connect_udp); ++ ATF_TP_ADD_TC(tp, connect_udp6); + + return (atf_no_error()); + } diff --git a/website/static/security/patches/SA-25:09/netinet-14.patch.asc b/website/static/security/patches/SA-25:09/netinet-14.patch.asc new file mode 100644 index 0000000000..b0c2e2429c --- /dev/null +++ b/website/static/security/patches/SA-25:09/netinet-14.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmj5CrgACgkQbljekB8A +Gu+IoRAAlJrsOBxL+/qrj25ehBLzbEmgD3t6xdbz3GboR1Nfwx1ragW11xHR0sCN +Mx73rW8Gvf9vOAThvSPs4ajMq4gEmu5tTz8LR5wZnsiGQJrxgz8OZLIvQPIfiF0X +deaXmWE/QK+7T3zqGM5uQIv2I8XIhx6cyvnm5sXFL/cpjiWwWwo3eMiB4k5ecW0w +HZqF/VclSAnB7VhkyvoVOU45+9DdgG6wVdGTBZbGOm6Y7JKkrrlIH84yb4onNanx +XjPOwD+TNXFGlz1rS3R5KuVsEUx1TR3NCYkrjBZcTVFul3YhnH+Cvn2LxUKv+Brf +1EVywW11lF2FMa+cukIaei6Dnka79UnHdarKaCyBseSFmzmcV+XSb0dsvDoEF4mx +XvaIn7BBoEfcBcH2HB46huUWeVWAVvjC4qpkoKGYbiYnS+iamA+uTrazeP5zkgnz +f1KRpgVvAzFNQqGhUI6AO9m+/DugShjtHN6oT8HmKTNfEo2/nbEWGh1+KNCTWMfr +CtVWBwSCV0UECH5DcKDcbjtgoqnJ2qNkooye2ruSjbLkOr6wyWMcNnhm/y9XlXJc +1meQGpMWTHhPYyi+VK4Z+/E5oj3fNv9ZFKDrEnAq5lzNEhkW+O0tYVTkfj/D2bNy +CR50qzAogqsn73XJJ++y2mGa18hs0BNhwAOV8jy4clR4HCRP65c= +=lJlP +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-25:09/netinet-15.patch b/website/static/security/patches/SA-25:09/netinet-15.patch new file mode 100644 index 0000000000..7083189c9a --- /dev/null +++ b/website/static/security/patches/SA-25:09/netinet-15.patch @@ -0,0 +1,201 @@ +--- sys/netinet/in_pcb.c.orig ++++ sys/netinet/in_pcb.c +@@ -2665,10 +2665,13 @@ + INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_porthashmask)]; + + /* +- * Add entry to load balance group. +- * Only do this if SO_REUSEPORT_LB is set. ++ * Ignore SO_REUSEPORT_LB if the socket is connected. Really this case ++ * should be an error, but for UDP sockets it is not, and some ++ * applications erroneously set it on connected UDP sockets, so we can't ++ * change this without breaking compatibility. + */ +- if ((inp->inp_socket->so_options & SO_REUSEPORT_LB) != 0) { ++ if (!connected && ++ (inp->inp_socket->so_options & SO_REUSEPORT_LB) != 0) { + int error = in_pcbinslbgrouphash(inp, M_NODOM); + if (error != 0) + return (error); +@@ -2770,6 +2773,10 @@ + connected = !in_nullhost(inp->inp_faddr); + } + ++ /* See the comment in in_pcbinshash(). */ ++ if (connected && (inp->inp_flags & INP_INLBGROUP) != 0) ++ in_pcbremlbgrouphash(inp); ++ + /* + * When rehashing, the caller must ensure that either the new or the old + * foreign address was unspecified. +--- tests/sys/netinet/so_reuseport_lb_test.c.orig ++++ tests/sys/netinet/so_reuseport_lb_test.c +@@ -29,6 +29,8 @@ + + #include <sys/param.h> + #include <sys/event.h> ++#include <sys/filio.h> ++#include <sys/ioccom.h> + #include <sys/socket.h> + + #include <netinet/in.h> +@@ -551,6 +553,150 @@ + close(s); + } + ++/* ++ * The kernel erroneously permits calling connect() on a UDP socket with ++ * SO_REUSEPORT_LB set. Verify that packets sent to the bound address are ++ * dropped unless they come from the connected address. ++ */ ++ATF_TC_WITHOUT_HEAD(connect_udp); ++ATF_TC_BODY(connect_udp, tc) ++{ ++ struct sockaddr_in sin = { ++ .sin_family = AF_INET, ++ .sin_len = sizeof(sin), ++ .sin_addr = { htonl(INADDR_LOOPBACK) }, ++ }; ++ ssize_t n; ++ int error, len, s1, s2, s3; ++ char ch; ++ ++ s1 = socket(PF_INET, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s1 >= 0); ++ s2 = socket(PF_INET, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s2 >= 0); ++ s3 = socket(PF_INET, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s3 >= 0); ++ ++ error = setsockopt(s1, SOL_SOCKET, SO_REUSEPORT_LB, (int[]){1}, ++ sizeof(int)); ++ ATF_REQUIRE_MSG(error == 0, ++ "setsockopt(SO_REUSEPORT_LB) failed: %s", strerror(errno)); ++ error = bind(s1, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s2, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s3, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ /* Connect to an address not owned by s2. */ ++ error = getsockname(s3, (struct sockaddr *)&sin, ++ (socklen_t[]){sizeof(sin)}); ++ ATF_REQUIRE(error == 0); ++ error = connect(s1, (struct sockaddr *)&sin, sizeof(sin)); ++ ATF_REQUIRE_MSG(error == 0, "connect() failed: %s", strerror(errno)); ++ ++ /* Try to send a packet to s1 from s2. */ ++ error = getsockname(s1, (struct sockaddr *)&sin, ++ (socklen_t[]){sizeof(sin)}); ++ ATF_REQUIRE(error == 0); ++ ++ ch = 42; ++ n = sendto(s2, &ch, sizeof(ch), 0, (struct sockaddr *)&sin, ++ sizeof(sin)); ++ ATF_REQUIRE(n == 1); ++ ++ /* Give the packet some time to arrive. */ ++ usleep(100000); ++ ++ /* s1 is connected to s3 and shouldn't receive from s2. */ ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len == 0, "unexpected data available"); ++ ++ /* ... but s3 can of course send to s1. */ ++ n = sendto(s3, &ch, sizeof(ch), 0, (struct sockaddr *)&sin, ++ sizeof(sin)); ++ ATF_REQUIRE(n == 1); ++ usleep(100000); ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len == 1, "unexpected data available"); ++} ++ ++/* ++ * The kernel erroneously permits calling connect() on a UDP socket with ++ * SO_REUSEPORT_LB set. Verify that packets sent to the bound address are ++ * dropped unless they come from the connected address. ++ */ ++ATF_TC_WITHOUT_HEAD(connect_udp6); ++ATF_TC_BODY(connect_udp6, tc) ++{ ++ struct sockaddr_in6 sin6 = { ++ .sin6_family = AF_INET6, ++ .sin6_len = sizeof(sin6), ++ .sin6_addr = IN6ADDR_LOOPBACK_INIT, ++ }; ++ ssize_t n; ++ int error, len, s1, s2, s3; ++ char ch; ++ ++ s1 = socket(PF_INET6, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s1 >= 0); ++ s2 = socket(PF_INET6, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s2 >= 0); ++ s3 = socket(PF_INET6, SOCK_DGRAM, 0); ++ ATF_REQUIRE(s3 >= 0); ++ ++ error = setsockopt(s1, SOL_SOCKET, SO_REUSEPORT_LB, (int[]){1}, ++ sizeof(int)); ++ ATF_REQUIRE_MSG(error == 0, ++ "setsockopt(SO_REUSEPORT_LB) failed: %s", strerror(errno)); ++ error = bind(s1, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s2, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ error = bind(s3, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "bind() failed: %s", strerror(errno)); ++ ++ /* Connect to an address not owned by s2. */ ++ error = getsockname(s3, (struct sockaddr *)&sin6, ++ (socklen_t[]){sizeof(sin6)}); ++ ATF_REQUIRE(error == 0); ++ error = connect(s1, (struct sockaddr *)&sin6, sizeof(sin6)); ++ ATF_REQUIRE_MSG(error == 0, "connect() failed: %s", strerror(errno)); ++ ++ /* Try to send a packet to s1 from s2. */ ++ error = getsockname(s1, (struct sockaddr *)&sin6, ++ (socklen_t[]){sizeof(sin6)}); ++ ATF_REQUIRE(error == 0); ++ ++ ch = 42; ++ n = sendto(s2, &ch, sizeof(ch), 0, (struct sockaddr *)&sin6, ++ sizeof(sin6)); ++ ATF_REQUIRE(n == 1); ++ ++ /* Give the packet some time to arrive. */ ++ usleep(100000); ++ ++ /* s1 is connected to s3 and shouldn't receive from s2. */ ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len == 0, "unexpected data available"); ++ ++ /* ... but s3 can of course send to s1. */ ++ n = sendto(s3, &ch, sizeof(ch), 0, (struct sockaddr *)&sin6, ++ sizeof(sin6)); ++ ATF_REQUIRE(n == 1); ++ usleep(100000); ++ error = ioctl(s1, FIONREAD, &len); ++ ATF_REQUIRE(error == 0); ++ ATF_REQUIRE_MSG(len == 1, "unexpected data available"); ++} ++ + ATF_TP_ADD_TCS(tp) + { + ATF_TP_ADD_TC(tp, basic_ipv4); +@@ -561,6 +707,8 @@ + ATF_TP_ADD_TC(tp, bind_without_listen); + ATF_TP_ADD_TC(tp, connect_not_bound); + ATF_TP_ADD_TC(tp, connect_bound); ++ ATF_TP_ADD_TC(tp, connect_udp); ++ ATF_TP_ADD_TC(tp, connect_udp6); + + return (atf_no_error()); + } diff --git a/website/static/security/patches/SA-25:09/netinet-15.patch.asc b/website/static/security/patches/SA-25:09/netinet-15.patch.asc new file mode 100644 index 0000000000..380b5aba55 --- /dev/null +++ b/website/static/security/patches/SA-25:09/netinet-15.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmj5CrkACgkQbljekB8A +Gu9urA//d3+X7bwSN9niBanoXBIRFsxr7+im0rHelA5UtPJ9OQ160IAbDdu2H9Cn +76HavCQ+bpytDZxVTWplm9lK9NskFq71ChMosgH7rqDPVcgqyNPqDuGWNbH28dBq +sBydMzY7ZkiDurLlUaesQCKopBES8I4s9DXmO9lWLXm0VI2CkiCYkf3HPZeyxJp5 +7NLXNZQWz+/Osnd1HYb/HlxEiX/DjDgnvbtD11ho2kzlO9wDy4jKwOwAgM49+UP9 +HapQh+1nrRPiX/dqZ5bAVLnztTjSVXq58V/kejpHHlbht8OxAqkGfSoeHB6emSyl +gH5fPSnBd9/IwpBUR79f0+BuHkkibhoVOrSqNl95C3VyuUNPhy/fhrChEQbET1vs +NfbsGO7pNaaTjg5zjEGXJK8x8q+S9R9Q31M1Lts5FMiKdjGIHNzWPu+ZLPMSXBdy +3iJ0OAaLLo5GJ6mefJWCTyUGbegaaxjBrJD+No12sjgXkcogvMm0VvmA7wNxnBXW +Fevs5++9hR8NU4eIhCx3mZQaQDwFOgoV6zKcPtir52jZd+txKnkw3fC01RKE86FW +opINfUTA/W4sZCG2DaSuU7USo2vMKG3m//HBvbO5eSBq+qnavFOWTvQUc16hfMxa +7+pd8VXtdEiZkwqR2Dj58Gt9D3xqoh4fbHQ+AbqvoN3lPJmnNsA= +=/zfq +-----END PGP SIGNATURE----- |