Module name: src
Changes by: doug@cvs.openbsd.org 2014/08/05 20:34:23

Modified files:
distrib/notes : INSTALL m4.common
distrib/notes/amd64: contents install xfer
distrib/notes/i386: contents install xfer

Log message:
Add signify instructions plus miniroot and install56.fs for amd64/i386

ok deraadt@

Module name: src
Changes by: guenther@cvs.openbsd.org 2014/08/05 22:28:21

Modified files:
lib/libssl/src/crypto/evp: evp_key.c

Log message:
Correct error checks in EVP_read_pw_string_min(): UI_add_input_string()
and UI_add_verify_string() return -1 (and maybe -2?) on failure and
>=0 on success, instead of always zero on success

problem reported by Mark Patruck (mark (at) wrapped.cx)
ok miod@

Module name: src
Changes by: jsg@cvs.openbsd.org 2014/08/05 22:39:50

Modified files:
usr.sbin/httpd : server.c

Log message:
add missing va_start/va_end calls
ok deraadt@ guenther@

Module name: www
Changes by: deraadt@cvs.openbsd.org 2014/08/05 23:26:43

Modified files:
. : events.html

Log message:
fix typo

Module name: src
Changes by: doug@cvs.openbsd.org 2014/08/05 23:47:40

Modified files:
usr.sbin/httpd : httpd.8

Log message:
Add an overview of the features for httpd in the description section.

"commit" deraadt@

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/06 03:34:21

Modified files:
usr.sbin/httpd : server_http.c

Log message:
Add braces. Style-only change.

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/06 03:36:31

Modified files:
usr.sbin/httpd : httpd.h server.c server_file.c

Log message:
Adjust the read/write watermarks according to the TCP send buffer.
This fixes sending of large files. Previously, httpd was reading the
input file too quickly and could run out of memory when filling the
input buffer.

Found by jsg@
OK florian@

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/06 03:40:04

Modified files:
usr.sbin/httpd : server.c

Log message:
Bring back the last read (done) / last write (done) messages instead of just
"done" to simplify connection debugging.

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/06 05:24:12

Modified files:
usr.sbin/httpd : server.c server_file.c

Log message:
The watermark exposed a bug in server_write that broke keep-alive
support. Instead of calling server_close from server_write, we have
to proceed to the next connection by calling the error handler.

OK jsg@

Module name: src
Changes by: jsg@cvs.openbsd.org 2014/08/06 06:29:43

Modified files:
usr.sbin/httpd : logger.c

Log message:
avoid displaying a NULL pointer
ok deraadt@ reyk@

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/06 06:56:58

Modified files:
usr.sbin/httpd : logger.c parse.y server.c

Log message:
spacing

Module name: src
Changes by: florian@cvs.openbsd.org 2014/08/06 07:40:18

Modified files:
usr.sbin/httpd : server_fcgi.c

Log message:
Content-Length and Content-Type are transmitted as CONTENT_LENGTH and
CONTENT_TYPE environment variables to cgi scripts, without the HTTP_
prefix.
OK reyk@

Module name: src
Changes by: florian@cvs.openbsd.org 2014/08/06 09:08:04

Modified files:
usr.sbin/httpd : httpd.h server.c server_fcgi.c server_http.c

Log message:
http POST support
with & OK reyk@

Module name: src
Changes by: jsg@cvs.openbsd.org 2014/08/06 09:15:16

Modified files:
sys/arch/alpha/mcbus: mcbus.c

Log message:
fix an off by one
ok deraadt@

Module name: src
Changes by: jsg@cvs.openbsd.org 2014/08/06 09:40:40

Modified files:
sys/arch/vax/if: if_qe.c sgec.c

Log message:
Correct some dma cleanup error paths.

While the index variables were correct the arrays of
dma handles they indexed were swapped for rx and tx.

As there are a mismatched number of rx and tx descriptors
we'd walk off the end of the rx handle array by 30 items.

ok deraadt@

Module name: src
Changes by: jsing@cvs.openbsd.org 2014/08/06 10:01:44

Modified files:
lib/libssl/src/crypto/evp: encode.c

Log message:
Allow B64_EOF to follow a base64 padding character. This restores previous
behaviour that allows a PEM block to be fed through the base64 decoder.

Reported by Dmitry Eremin-Solenikov on tech@

ok deraadt@ tedu@

Module name: src
Changes by: jsing@cvs.openbsd.org 2014/08/06 10:09:02

Modified files:
usr.sbin/httpd : httpd.h parse.y server.c

Log message:
Configure the default SSL ciphers as HIGH:!aNULL.

ok deraadt@ reyk@

Module name: src
Changes by: jsing@cvs.openbsd.org 2014/08/06 10:10:02

Modified files:
usr.sbin/httpd : server.c

Log message:
Also clean up the public key when it is no longer needed.

ok deraadt@ reyk@

Module name: src
Changes by: jsing@cvs.openbsd.org 2014/08/06 10:11:34

Modified files:
usr.sbin/httpd : parse.y

Log message:
Provide configuration options that allow the SSL certificate, key and
ciphers to be specified for each server.

ok deraadt@ reyk@

Module name: src
Changes by: ajacoutot@cvs.openbsd.org 2014/08/06 10:13:48

Modified files:
distrib/zaurus/ramdisk: install.md

Log message:
sysctl machdep.ztsscale has been unused for 7 years, so stop handling it.
s/TAB/SPACE for the wsconsctl.conf comment like we do with sysctl.conf
in MI.

"get this in fast" deraadt@
ok ratchov@ who will test it in the next few hours

Module name: src
Changes by: jsing@cvs.openbsd.org 2014/08/06 10:31:09

Modified files:
usr.sbin/httpd : httpd.conf.5

Log message:
Document the SSL configuration for httpd (partly based on relayd.conf(5)).

Module name: xenocara
Changes by: jsg@cvs.openbsd.org 2014/08/06 11:00:09

Modified files:
lib/libpciaccess/src: openbsd_pci.c

Log message:
calloc the pci_sys struct before probing for PCI.
As the functions check if the member pointers are NULL but not the
pointer to the struct itself.

Reworked version of a diff from ratchov@ who created it to prevent a
xserver crash on zaurus where there is no PCI.

'looks ok' matthieu@, ok deraadt@

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/06 12:21:14

Modified files:
usr.sbin/httpd : config.c httpd.conf.5 httpd.h parse.y
server_http.c

Log message:
Limit the body size in client requests (eg. POST data) to 1M by default;
add a configuration option to change the limit.

ok florian@

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/06 12:38:11

Modified files:
usr.sbin/httpd : server.c server_fcgi.c

Log message:
Use memset(buf instead of memset(&buf.

Pointed out by deraadt@

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/06 12:40:15

Modified files:
usr.sbin/httpd : server_fcgi.c

Log message:
Always zero-out the fcgi record header for STDIN data.

OK florian@

Module name: src
Changes by: guenther@cvs.openbsd.org 2014/08/06 13:31:30

Modified files:
sys/nfs : nfs_kq.c

Log message:
Support NOTE_EOF for kqueue EVFILT_READ filters on NFS files.

committing for jsg@, ok reyk@ tedu@ guenther@

Module name: src
Changes by: miod@cvs.openbsd.org 2014/08/06 14:11:09

Modified files:
lib/libssl/src/ssl: d1_srvr.c

Log message:
Prevent a possible use after free by mimicing the s3_srvr.c fixes contributed by
Adam Langley close to three years ago, which were commited in
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e7928282d0148af5f28fa3437a625a2006af0214" rel="nofollow">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e7928282d0148af5f28fa3437a625a2006af0214</a>

ok jsing@

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/06 14:29:54

Modified files:
etc/examples : httpd.conf
usr.sbin/httpd : httpd.conf.5 parse.y

Log message:
Change grammar to remove a shift/reduce conflict that was introduced
with the ssl options.
"listen on $ip port 443 ssl" turns into "listen on $ip ssl port 443".

ok florian@

Module name: src
Changes by: florian@cvs.openbsd.org 2014/08/06 14:56:23

Modified files:
usr.sbin/httpd : server_fcgi.c

Log message:
If the very first fcgi STDOUT record has length 0 the cgi script
didn't send anything back. This is an internal server error.
OK reyk@

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/06 15:08:47

Modified files:
usr.sbin/httpd : server_fcgi.c

Log message:
Write STDERR from the CGI to the web server error log as intended.

OK florian@

Module name: src
Changes by: doug@cvs.openbsd.org 2014/08/06 16:33:08

Modified files:
usr.sbin/httpd : httpd.8

Log message:
Mention how httpd responds to SIGHUP and SIGUSR1.

Description from reyk@

Module name: src
Changes by: deraadt@cvs.openbsd.org 2014/08/06 17:16:16

Modified files:
lib/libssl/src/ssl: t1_lib.c

Log message:
merge fix for CVE-2014-3510
basically a missing s-&gt;hit check
ok guenther

Module name: src
Changes by: deraadt@cvs.openbsd.org 2014/08/06 19:24:10

Modified files:
lib/libssl/src/ssl: s3_clnt.c

Log message:
merge CVE-2014-3510; Fix DTLS anonymous EC(DH) denial of service
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=17160033765480453be0a41335fa6b833691c049" rel="nofollow">https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=17160033765480453be0a41335fa6b833691c049</a>
ok bcook

Module name: www
Changes by: nick@cvs.openbsd.org 2014/08/06 19:51:34

Modified files:
faq : faq10.html faq14.html faq5.html faq6.html
faq8.html upgrade48.html upgrade55.html

Log message:
more -&gt; cvsweb.openbsd.org for, well, cvsweb.

Module name: src
Changes by: deraadt@cvs.openbsd.org 2014/08/06 22:49:53

Modified files:
lib/libssl/src/ssl: s23_srvr.c

Log message:
Fix CVE-2014-3511; TLS downgrade, verbatim diff
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=280b1f1ad12131defcd986676a8fc9717aaa601b" rel="nofollow">https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=280b1f1ad12131defcd986676a8fc9717aaa601b</a>
ok guenther miod

Module name: src
Changes by: deraadt@cvs.openbsd.org 2014/08/07 00:56:41

Modified files:
usr.sbin/httpd : httpd.8

Log message:
shorten signal text a bit

Module name: src
Changes by: florian@cvs.openbsd.org 2014/08/07 04:52:34

Modified files:
usr.sbin/httpd : server_fcgi.c

Log message:
Opportunistically try to parse "Status: $code" in the very first
response from the fcgi daemon and use that code as HTTP response
code. If it doesn't work out fall back to code 200.
This might fix naddy@'s issue with redirects in cvsweb.
To be revisited after unlock.
Discussed with &amp; grudgingly OK reyk@

Module name: src
Changes by: florian@cvs.openbsd.org 2014/08/07 06:43:22

Modified files:
usr.sbin/httpd : server_fcgi.c

Log message:
Don't try to ouput FCGI_STDERR into error.log if there is no data.
Problem noticed by naddy@, OK reyk@

Module name: www
Changes by: tedu@cvs.openbsd.org 2014/08/07 07:56:52

Modified files:
. : errata55.html

Log message:
leave a note reminding people to email tech and announce

Module name: src
Changes by: reyk@cvs.openbsd.org 2014/08/07 12:21:13

Modified files:
usr.sbin/httpd : httpd.8

Log message:
Fix and simplify the description of httpd(8)'s signal handling. httpd
does not re-executed itself on SIGHUP, it simply reload the
configuration and sends it to its child processes.

ok deraadt@

Module name: src
Changes by: lteo@cvs.openbsd.org 2014/08/07 13:03:38

Modified files:
usr.bin/signify: signify.1

Log message:
Bump example pubkey filenames to /etc/signify/openbsd-56-base.pub for
5.6.

ok deraadt@

Module name: src
Changes by: miod@cvs.openbsd.org 2014/08/07 13:46:31

Modified files:
lib/libssl/src/ssl: d1_both.c d1_clnt.c d1_pkt.c s23_srvr.c
s3_both.c s3_enc.c s3_lib.c t1_enc.c

Log message:
When you expect a function to return a particular value, don't put a comment
saying that you expect it to return that value and compare it against zero
because it is supposedly faster, for this leads to bugs (especially given the
high rate of sloppy cut'n'paste within ssl3 and dtls1 routines in this
library).

Instead, compare for the exact value it ought to return upon success.

ok deraadt@

Module name: src
Changes by: miod@cvs.openbsd.org 2014/08/07 14:02:23

Modified files:
lib/libssl/src/ssl: d1_both.c d1_clnt.c d1_pkt.c s3_both.c
s3_enc.c s3_lib.c t1_enc.c

Log message:
Oops, revert changes commited by mistake. The previous commit was supposed
to only apply to s23_srvr.c.

Module name: src
Changes by: guenther@cvs.openbsd.org 2014/08/07 14:24:12

Modified files:
lib/libssl/src/ssl: d1_both.c

Log message:
Fix CVE-2014-3506, DTLS handshake message size checks. From
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1250f12613b61758675848f6600ebd914ccd7636" rel="nofollow">https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1250f12613b61758675848f6600ebd914ccd7636</a>
with comment/whitespace style tweaks

ok bcook@ miod@

Module name: src
Changes by: guenther@cvs.openbsd.org 2014/08/07 16:27:28

Modified files:
lib/libssl/src/ssl: t1_lib.c

Log message:
Correct test reversed during merge of fix for CVE-2014-3509

pointed out by Watson Ladd (watson (at) matasano.com)
ok deraadt@

Module name: www
Changes by: lteo@cvs.openbsd.org 2014/08/07 21:05:50

Modified files:
. : 56.html

Log message:
Fix version numbers of Perl, Less, and NSD.

From Theo Buehler and Daniel Jakots, thank you!

Module name: src
Changes by: guenther@cvs.openbsd.org 2014/08/07 22:53:43

Modified files:
lib/libssl/src/crypto/asn1: a_object.c
lib/libssl/src/crypto/objects: obj_dat.c

Log message:
Fix CVE-2014-3508, pretty printing and OID validation:
- make sure the output buffer is always NUL terminated if buf_len
was initially greater than zero.
- reject OIDs that are too long, too short, or not in proper base-127

Based on
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=0042fb5fd1c9d257d713b15a1f45da05cf5c1c87" rel="nofollow">https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=0042fb5fd1c9d257d713b15a1f45da05cf5c1c87</a>

ok bcook@

Module name: src
Changes by: guenther@cvs.openbsd.org 2014/08/07 23:06:56

Modified files:
lib/libssl/src/ssl: d1_both.c

Log message:
Fix CVE-2014-3507, avoid allocating and then leaking a fresh fragment
structure when a zero-length fragment is received.

Based on
<a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d0a4b7d1a2948fce38515b8d862f43e7ba0ebf74" rel="nofollow">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d0a4b7d1a2948fce38515b8d862f43e7ba0ebf74</a>

diff by miod@, ok guenther@ bcook@ deraadt@

Module name: src
Changes by: jsg@cvs.openbsd.org 2014/08/08 06:40:26

Modified files:
libexec/tradcpp: files.c main.c output.c

Log message:
Add support for using - as shorthand for stdin/stdout in tradcpp.

When looking into switching the /usr/bin/cpp wrapper to
tradcpp I came across "| ${CPP} ${CPPFLAGS} -" in usr.bin/which.

gcc documents this behaviour for cpp here:
<a href="https://gcc.gnu.org/onlinedocs/cpp/Invocation.html" rel="nofollow">https://gcc.gnu.org/onlinedocs/cpp/Invocation.html</a>

Versions of the John F. Reiser derived cpp in 32V and CSRG SCCS
accept this usage as well, as does the cpp in PCC.

Module name: src
Changes by: mpi@cvs.openbsd.org 2014/08/08 08:16:43

Modified files:
sys/dev/usb : umass_scsi.c

Log message:
Fix debug printfs.