diff options
| author | delphij <delphij@FreeBSD.org> | 2017-08-10 06:59:07 +0000 |
|---|---|---|
| committer | delphij <delphij@FreeBSD.org> | 2017-08-10 06:59:07 +0000 |
| commit | 91baad1bb58bfa59793d9421521a9faf7df0edca (patch) | |
| tree | 42938bf2e6e785a0b129322177b5ff0a1ddeeba9 | |
| parent | 2f4b735c66deb54490042a818e8fd26fa46818f1 (diff) | |
| download | FreeBSD-src-91baad1bb58bfa59793d9421521a9faf7df0edca.zip FreeBSD-src-91baad1bb58bfa59793d9421521a9faf7df0edca.tar.gz | |
Fix OpenSSH Denial of Service vulnerability. [SA-17:06]releng/11.1
Fix VNET kernel panic with asynchronous I/O. [EN-17:07]
Fix pf(4) housekeeping thread causes kernel panic. [EN-17:08]
Approved by: so
| -rw-r--r-- | UPDATING | 10 | ||||
| -rw-r--r-- | crypto/openssh/auth-passwd.c | 5 | ||||
| -rw-r--r-- | sys/conf/newvers.sh | 2 | ||||
| -rw-r--r-- | sys/kern/sys_socket.c | 2 | ||||
| -rw-r--r-- | sys/netpfil/pf/pf.c | 8 |
5 files changed, 26 insertions, 1 deletions
@@ -16,6 +16,16 @@ from older versions of FreeBSD, try WITHOUT_CLANG and WITH_GCC to bootstrap to the tip of head, and then rebuild without this option. The bootstrap process from older version of current across the gcc/clang cutover is a bit fragile. +20170810 p1 FreeBSD-SA-17:06.openssh + FreeBSD-EN-17:07.vnet + FreeBSD-EN-17:08.pf + + Fix OpenSSH Denial of Service vulnerability. [SA-17:06] + + Fix VNET kernel panic with asynchronous I/O. [EN-17:07] + + Fix pf(4) housekeeping thread causes kernel panic. [EN-17:08] + 20170725: 11.1-RELEASE. diff --git a/crypto/openssh/auth-passwd.c b/crypto/openssh/auth-passwd.c index 63ccf3c..f6825ec 100644 --- a/crypto/openssh/auth-passwd.c +++ b/crypto/openssh/auth-passwd.c @@ -66,6 +66,8 @@ extern login_cap_t *lc; #define DAY (24L * 60 * 60) /* 1 day in seconds */ #define TWO_WEEKS (2L * 7 * DAY) /* 2 weeks in seconds */ +#define MAX_PASSWORD_LEN 1024 + void disable_forwarding(void) { @@ -87,6 +89,9 @@ auth_password(Authctxt *authctxt, const char *password) static int expire_checked = 0; #endif + if (strlen(password) > MAX_PASSWORD_LEN) + return 0; + #ifndef HAVE_CYGWIN if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES) ok = 0; diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index ec9e129..5ba2ab2 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -44,7 +44,7 @@ TYPE="FreeBSD" REVISION="11.1" -BRANCH="RELEASE" +BRANCH="RELEASE-p1" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi diff --git a/sys/kern/sys_socket.c b/sys/kern/sys_socket.c index da5f8e8..edc64aa 100644 --- a/sys/kern/sys_socket.c +++ b/sys/kern/sys_socket.c @@ -675,6 +675,7 @@ soaio_process_sb(struct socket *so, struct sockbuf *sb) { struct kaiocb *job; + CURVNET_SET(so->so_vnet); SOCKBUF_LOCK(sb); while (!TAILQ_EMPTY(&sb->sb_aiojobq) && soaio_ready(so, sb)) { job = TAILQ_FIRST(&sb->sb_aiojobq); @@ -698,6 +699,7 @@ soaio_process_sb(struct socket *so, struct sockbuf *sb) ACCEPT_LOCK(); SOCK_LOCK(so); sorele(so); + CURVNET_RESTORE(); } void diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 8dc89a8..1fa0b7a 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -129,6 +129,8 @@ VNET_DEFINE(int, pf_tcp_secret_init); #define V_pf_tcp_secret_init VNET(pf_tcp_secret_init) VNET_DEFINE(int, pf_tcp_iss_off); #define V_pf_tcp_iss_off VNET(pf_tcp_iss_off) +VNET_DECLARE(int, pf_vnet_active); +#define V_pf_vnet_active VNET(pf_vnet_active) /* * Queue for pf_intr() sends. @@ -1441,6 +1443,12 @@ pf_purge_thread(void *unused __unused) kproc_exit(0); } + /* Wait while V_pf_default_rule.timeout is initialized. */ + if (V_pf_vnet_active == 0) { + CURVNET_RESTORE(); + continue; + } + /* Process 1/interval fraction of the state table every run. */ idx = pf_purge_expired_states(idx, pf_hashmask / (V_pf_default_rule.timeout[PFTM_INTERVAL] * 10)); |
