Re: syslogd: properly validate config

2014-11-27 Thread Tobias Stoeckmann
On Thu, Nov 27, 2014 at 09:52:29PM +0100, Tobias Stoeckmann wrote: > On Thu, Nov 27, 2014 at 01:29:48PM -0700, Todd C. Miller wrote: > > I think it would be better for decode() to just return -1 in this > > case. > > I think that is worth it: Not anymore. There is just one other decode user (it'

Re: syslogd: properly validate config

2014-11-27 Thread Todd C. Miller
On Thu, 27 Nov 2014 21:52:29 +0100, Tobias Stoeckmann wrote: > The validation looks a bit like a magic number there, but this could > prevent issues of other decode()-users, too... So yeah, I think that > is worth it: OK millert@ - todd

Re: syslogd: properly validate config

2014-11-27 Thread Tobias Stoeckmann
On Thu, Nov 27, 2014 at 01:29:48PM -0700, Todd C. Miller wrote: > I think it would be better for decode() to just return -1 in this > case. The validation looks a bit like a magic number there, but this could prevent issues of other decode()-users, too... So yeah, I think that is worth it: Index

Re: syslogd: properly validate config

2014-11-27 Thread Todd C. Miller
On Thu, 27 Nov 2014 20:42:55 +0100, Tobias Stoeckmann wrote: > the facility number is not properly validated while parsing the > configuration file -- it is possible to supply a number which is > larger than LOG_NFACILITIES, therefore accessing memory outside > of f_pmask's boundaries. I think it

syslogd: properly validate config

2014-11-27 Thread Tobias Stoeckmann
Hi, the facility number is not properly validated while parsing the configuration file -- it is possible to supply a number which is larger than LOG_NFACILITIES, therefore accessing memory outside of f_pmask's boundaries. # echo "10.debug;syslog,user.info /var/log/messages" > my.conf # syslog

Re: faq diff: kerberos

2014-11-27 Thread Nick Holland
On 11/25/14 18:45, J Sisson wrote: > Hi, > > kerberos was moved to ports, but the docs still link to kerberos(8): > > http://www.openbsd.org/faq/faq10.html#YP_secure > > Does the following diff make sense? (Apologies in advance if gmail > mangles the diff, or if the diff needs to be generated w

Re: libtls: Secure default cipher list and dtls support

2014-11-27 Thread Joel Sing
On Thu, 27 Nov 2014, Manuel Schoelling wrote: > Hi, > > I hope this is the right mailing list for discussing this issue. I could > not find any information about a mailing list on libressl.org. Here is fine. > It currently looks like the libtls version does not set a list of secure > ciphers by d

Re: tcpdump: Ethernet header is not dumped with -xX if IP header is unaligned

2014-11-27 Thread Mike Belopuhov
On 27 November 2014 at 03:12, Theo de Raadt wrote: >> On Tue, Nov 25, 2014 at 18:42 +0100, Mike Belopuhov wrote: >> > On Mon, Nov 24, 2014 at 19:04 +0100, Mike Belopuhov wrote: >> > > Hi, >> > > >> > > IP header is not always aligned since bpf copies out the mbuf >> > > chain into the contigous bu

patch: Intel CPU sensor readout correction

2014-11-27 Thread Mages, Simon
Hi there, the temperatures 'sysctl hw.sensors' displays for each CPU are wrong for the most modern Intel CPUs. OpenBSD uses only 100 or 85 degC as TJmax for Intel CPUs, but in reality the TJmax value is somewhere around those specified values. Intel defines a TJmax for every production batch indi

Re: operations on nd_prefix list must take rdomain into account

2014-11-27 Thread Mike Belopuhov
On 26 November 2014 at 18:24, Mike Belopuhov wrote: > More rdomain checks are needed to be able to use the same subnet > in a back to back connection between IPv6 rdomains as pointed out > by mpi@. > > OK? > I've been asked to provide a bit of clarification. nd_prefix list accumulates configured

Re: IFXF_NOINET doesn't make sense any more

2014-11-27 Thread Stefan Sperling
On Thu, Nov 27, 2014 at 12:21:13PM +0100, Stefan Sperling wrote: > Seems like rtsol and/or setting an IPv6 address doesn't activate AF_INET6 > even though it should. Perhaps my in6.c change broke it? > Index: sys/netinet6/in6.c > ===

Re: IFXF_NOINET doesn't make sense any more

2014-11-27 Thread Stefan Sperling
On Mon, Nov 24, 2014 at 02:43:39PM -0800, Chris Cappuccio wrote: > Henning Brauer [hb-openbsdt...@ml.bsws.de] wrote: > > now that we have an uncontaminated, err, inet6-free system by default, > > IFXF_NOINET6 just doesn't make sense any more. > > fully go for no inet6 by default, get rid of the IFX

small bwi(4) fixes from FreeBSD

2014-11-27 Thread Stefan Sperling
Taken from FreeBSD (r192306, r192042). r192306 | imp | 2009-05-18 17:31:26 +0200 (Mon, 18 May 2009) | 10 lines Fix a typo from the original driver. We need to write ctrl2 into RF register 0x52, not ctrl1. This appears to b

Re: Behavior of changing routes on OpenBSD 5.6

2014-11-27 Thread Florian Riehm
Hi Martin, thank you for clarification and thank you for your patch. Your patch looks reasonably to me. I forgot RTAX_IFP and RTAX_IFA in my patch. After a first trial, the fix works for me. Today I will start nightly regression tests with it. You will get the result tomorrow. Regards Florian

more kerberos cleanup

2014-11-27 Thread Jean-Philippe Ouellet
Found these lurking earlier. I looked for things depending on them and didn't find any, maybe they were just missed in the giant tedu? Index: libexec/login_passwd/common.h === RCS file: /cvs/src/libexec/login_passwd/common.h,v retri