os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Add EN-20:03 through EN-20:06 and SA-20:04 through SA-20:09.

Browse source 
Approved by:	so
This commit is contained in:
Gordon Tetlow 2020-03-19 17:20:56 +00:00
parent ea82915183
commit bc912e3b54
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=53996
40 changed files with 120685 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
share/security/patches/EN-20:03/sshd.patch Normal file
View file

@ -0,0 +1,11 @@
--- crypto/openssh/monitor.c.orig
+++ crypto/openssh/monitor.c
@@ -193,7 +193,7 @@
#endif
{MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
#ifdef HAVE_LOGIN_CAP
- {MONITOR_REQ_GETPWCLASS, MON_AUTH, mm_answer_login_getpwclass},
+ {MONITOR_REQ_GETPWCLASS, MON_ISAUTH, mm_answer_login_getpwclass},
#endif
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
{MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},

18
share/security/patches/EN-20:03/sshd.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpotfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cIsbQ/9HDDvo7coVA4O70bhusaw40fVNZB8ZYvncW6CgP26TsXj4IGdhFNoQRaW
wfBOnADtv+0P0WvPkHe9+bNOXBD1KI1oejBnYFW9xjgPoilWtE5eoQzpbBGkar+/
WUTHpdqunAcnt2gYly+pKByn9yrbZDmtbR9Fu1lGSMxuiOWxc7U6pFRZrJ3b+IRm
eUSiLiwR1l1Xuju5FEe7yZVKEkNOFuZUCd9dN2Iw6NFpFONug4RAmSwzBBdmgbyH
54aPvkwMpPBGqQp0WATGWlWi/FHPLWzK8wEkz+Z2UtLR/khkCd+314MMCkZpGeGp
I2SU6vQA+zL2qy75dWI13tyAPZHkBcj9FsIVQ4z86w8a/kmwbQE5VXZhIyqPQ4XQ
SJ6RkOJ+ltAQt0YsptndbZ149qimNOxT2ly4sAysNCELla+AyQgEWHgD53jfOVN6
p4clsrRiAHXba/+4SZWqdrebck0VvqCpbp1o2TBJ3vPLGNql8ovfWrYL0KWZUndq
oqjwJtP4YTwsymX9AwNuOMwzYBUnTMPPhjwOlrWSMIQUsEva8rDI0yprdikwxUHt
3vddotFj/fcM5xJRMZykNbz7ORFVEYP2KJjTDBp/gu7nV9+UQtK9aquURgZ2bs0X
aKH2Y66XcYbUP3VgQxWapiFesFVjCFl+JtuD2Sm6aC6qibjXxLY=
=r0HP
-----END PGP SIGNATURE-----

155
share/security/patches/EN-20:04/pfctl.patch Normal file
View file

@ -0,0 +1,155 @@
--- sys/netpfil/pf/pf.c.orig
+++ sys/netpfil/pf/pf.c
@@ -363,11 +363,14 @@
u_long pf_srchashmask;
static u_long pf_hashsize;
static u_long pf_srchashsize;
+u_long pf_ioctl_maxcount = 65535;
SYSCTL_ULONG(_net_pf, OID_AUTO, states_hashsize, CTLFLAG_RDTUN,
&pf_hashsize, 0, "Size of pf(4) states hashtable");
SYSCTL_ULONG(_net_pf, OID_AUTO, source_nodes_hashsize, CTLFLAG_RDTUN,
&pf_srchashsize, 0, "Size of pf(4) source nodes hashtable");
+SYSCTL_ULONG(_net_pf, OID_AUTO, request_maxcount, CTLFLAG_RDTUN,
+ &pf_ioctl_maxcount, 0, "Maximum number of tables, addresses, ... in a single ioctl() call");
VNET_DEFINE(void *, pf_swi_cookie);
--- sys/netpfil/pf/pf_ioctl.c.orig
+++ sys/netpfil/pf/pf_ioctl.c
@@ -86,8 +86,6 @@
#include <net/altq/altq.h>
#endif
-#define PF_TABLES_MAX_REQUEST 65535 /* Maximum tables per request. */
-
static struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t,
u_int8_t, u_int8_t, u_int8_t);
@@ -215,6 +213,8 @@
/* pflog */
pflog_packet_t *pflog_packet_ptr = NULL;
+extern u_long pf_ioctl_maxcount;
+
static void
pfattach_vnet(void)
{
@@ -2528,7 +2528,8 @@
break;
}
- if (io->pfrio_size < 0 || io->pfrio_size > PF_TABLES_MAX_REQUEST) {
+ if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount ||
+ WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) {
error = ENOMEM;
break;
}
@@ -2559,7 +2560,8 @@
break;
}
- if (io->pfrio_size < 0 || io->pfrio_size > PF_TABLES_MAX_REQUEST) {
+ if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount ||
+ WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) {
error = ENOMEM;
break;
}
@@ -2732,6 +2734,7 @@
break;
}
if (io->pfrio_size < 0 ||
+ io->pfrio_size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
error = EINVAL;
break;
@@ -2769,6 +2772,7 @@
break;
}
if (io->pfrio_size < 0 ||
+ io->pfrio_size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
error = EINVAL;
break;
@@ -2810,7 +2814,8 @@
break;
}
count = max(io->pfrio_size, io->pfrio_size2);
- if (WOULD_OVERFLOW(count, sizeof(struct pfr_addr))) {
+ if (count > pf_ioctl_maxcount ||
+ WOULD_OVERFLOW(count, sizeof(struct pfr_addr))) {
error = EINVAL;
break;
}
@@ -2848,6 +2853,7 @@
break;
}
if (io->pfrio_size < 0 ||
+ io->pfrio_size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
error = EINVAL;
break;
@@ -2879,6 +2885,7 @@
break;
}
if (io->pfrio_size < 0 ||
+ io->pfrio_size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_astats))) {
error = EINVAL;
break;
@@ -2910,6 +2917,7 @@
break;
}
if (io->pfrio_size < 0 ||
+ io->pfrio_size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
error = EINVAL;
break;
@@ -2947,6 +2955,7 @@
break;
}
if (io->pfrio_size < 0 ||
+ io->pfrio_size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
error = EINVAL;
break;
@@ -2984,6 +2993,7 @@
break;
}
if (io->pfrio_size < 0 ||
+ io->pfrio_size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
error = EINVAL;
break;
@@ -3036,6 +3046,7 @@
break;
}
if (io->size < 0 ||
+ io->size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) {
error = EINVAL;
break;
@@ -3112,6 +3123,7 @@
break;
}
if (io->size < 0 ||
+ io->size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) {
error = EINVAL;
break;
@@ -3189,6 +3201,7 @@
}
if (io->size < 0 ||
+ io->size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) {
error = EINVAL;
break;
@@ -3407,6 +3420,7 @@
}
if (io->pfiio_size < 0 ||
+ io->pfiio_size > pf_ioctl_maxcount ||
WOULD_OVERFLOW(io->pfiio_size, sizeof(struct pfi_kif))) {
error = EINVAL;
break;

18
share/security/patches/EN-20:04/pfctl.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpotfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cI4mQ//S1DbTRLbm9xnXDA9XUKtC/2icqJ4B74oApa92Yn2y9Vu2Zz9x43HV/Hr
0+qqqZcw5kouz9SuP2JeTFBZqqDaSoR2Ee8TboM/MslIMYRkagJxxQUSZY/5U/3O
TihXbGgnVjyt+kAorH4+nJVbBtKnJhIvBmk+EGBIci5Pdlz8OVp2kuOk8jlN2zs3
WeRpwv+Wwv1BLaa86+4sbUMIm28v3jWrNlJgDnJ2On9Wu9iXCRgPUBm5jIztfkGA
d5XDCTISwM1o5lNmEg8rl2ZdO/3Q3hJRSjYETgMqnDXyWvNmxWUmDvQYmABYkfGq
PRnjVlUyOdK7uVPa6TAI+8MEv1akUKmhWCsjGoJqHTqbg6Q7rItD3z6G2etfPNi8
RL+DGW/ugJhwKjY8DLd3JH1GFyNpUxIcCF5wOaYvliY4Hvy0KC6BBVcNXuGxB9Nd
kVYt2Ki2J2pzLc5jkngfybuYjPnbp8uMOkO2BZtngmzGncuT/UMZyon6ONMB88yn
Yz3F4/IrKJ7guDnYZwOPyaNVHKcADB+tmmDQfSIok+3zuw2QJrCj9/jwI5urzBQu
xYab1xjAutPsWBPmDEMIdSt42aYjDV4tCWeFo0BKas2v391/8YdAu378+Xw/TLfp
mCr5c2g2zUyeKzvEQvv5hCPLRT2ViTcSp8roeBvoXq6FUwmlUso=
=HAnc
-----END PGP SIGNATURE-----

68
share/security/patches/EN-20:05/mlx5en.patch Normal file
View file

@ -0,0 +1,68 @@
--- sys/dev/mlx5/mlx5_en/mlx5_en_tx.c.orig
+++ sys/dev/mlx5/mlx5_en/mlx5_en_tx.c
@@ -609,7 +609,8 @@
struct mlx5e_sq *sq;
int ret;
- if (mb->m_pkthdr.snd_tag != NULL) {
+ if ((mb->m_pkthdr.csum_flags & CSUM_SND_TAG) != 0 &&
+ (mb->m_pkthdr.snd_tag != NULL)) {
sq = mlx5e_select_queue_by_send_tag(ifp, mb);
if (unlikely(sq == NULL)) {
/* Check for route change */
--- sys/netinet/ip_output.c.orig
+++ sys/netinet/ip_output.c
@@ -653,6 +653,7 @@
in_pcboutput_txrtlmt(inp, ifp, m);
/* stamp send tag on mbuf */
m->m_pkthdr.snd_tag = inp->inp_snd_tag;
+ m->m_pkthdr.csum_flags |= CSUM_SND_TAG;
} else {
m->m_pkthdr.snd_tag = NULL;
}
@@ -705,6 +706,7 @@
in_pcboutput_txrtlmt(inp, ifp, m);
/* stamp send tag on mbuf */
m->m_pkthdr.snd_tag = inp->inp_snd_tag;
+ m->m_pkthdr.csum_flags |= CSUM_SND_TAG;
} else {
m->m_pkthdr.snd_tag = NULL;
}
--- sys/netinet6/ip6_output.c.orig
+++ sys/netinet6/ip6_output.c
@@ -966,6 +966,7 @@
in_pcboutput_txrtlmt(inp, ifp, m);
/* stamp send tag on mbuf */
m->m_pkthdr.snd_tag = inp->inp_snd_tag;
+ m->m_pkthdr.csum_flags |= CSUM_SND_TAG;
} else {
m->m_pkthdr.snd_tag = NULL;
}
@@ -1081,6 +1082,7 @@
in_pcboutput_txrtlmt(inp, ifp, m);
/* stamp send tag on mbuf */
m->m_pkthdr.snd_tag = inp->inp_snd_tag;
+ m->m_pkthdr.csum_flags |= CSUM_SND_TAG;
} else {
m->m_pkthdr.snd_tag = NULL;
}
--- sys/sys/mbuf.h.orig
+++ sys/sys/mbuf.h
@@ -519,6 +519,8 @@
#define CSUM_L5_VALID 0x20000000 /* checksum is correct */
#define CSUM_COALESCED 0x40000000 /* contains merged segments */
+#define CSUM_SND_TAG 0x80000000 /* Packet header has send tag */
+
/*
* CSUM flag description for use with printf(9) %b identifier.
*/
@@ -528,7 +530,7 @@
"\12CSUM_IP6_UDP\13CSUM_IP6_TCP\14CSUM_IP6_SCTP\15CSUM_IP6_TSO" \
"\16CSUM_IP6_ISCSI" \
"\31CSUM_L3_CALC\32CSUM_L3_VALID\33CSUM_L4_CALC\34CSUM_L4_VALID" \
- "\35CSUM_L5_CALC\36CSUM_L5_VALID\37CSUM_COALESCED"
+ "\35CSUM_L5_CALC\36CSUM_L5_VALID\37CSUM_COALESCED\40CSUM_SND_TAG"
/* CSUM flags compatibility mappings. */
#define CSUM_IP_CHECKED CSUM_L3_CALC

18
share/security/patches/EN-20:05/mlx5en.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpotfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cJdIQ/+L5DjK4Dny1CiFCxHMU52Gli2cYq37RIRciPockVn8aV5BQ4spn8BHgVd
l4LOZu3Scp2Ooo7m34L65+EkTp9cXsG5Ins3Cxv2EHMApwQs8GFWPZGSwiaNUC6V
iAmCMux4unoCd4kpIXVJcFa0KLP4jH9rofFGbVpJSxvdkfLIxdxPDTQauDJUCI80
ZWmb78AZMX7xZXNduwEszSg4JRej46jHZhCxOQdJ3jaAbXgiTwMof61qVkcSbtmP
q4UOGuGbLp53hFjItc9LMAyn6GXzqO5KFrQbQUifqaeKbpYELKcSjARcHN0FFXzc
mba3CwDG/PPInCF49Mb4Q/VkJyPNaKdoUWRhCc05Xl5p0k4BJYy/lmlNqqg97tX1
gbWyGc6xa+8GmlNA7uj1C4wFlXCziTnNth6PNK+teyZh3YFJW7bXvTqNNwbp3qB0
qs113nT+FL7UEBTwVNdTaF9wAoVWb/bHg5hjw7Lg3cNx8WbpMKhOP9jhQcfd2QDO
uGjzLGkwb5Q9RMOogq8OD00FHr7Ok2x2YPrJFIBqV36bMEyjsvkjr2W1kIgodZkv
LSXHYmTKiUEOc1XgBZN+qrlTBjQ+MZLyoAdpb0dlH4gQyS/vikY5FwrJqUTfBf4n
06P8HJ5TW6d0KH6Vm+6V57KLzTAqdc0hK9hOb3L257Bs54EZWUg=
=0lYL
-----END PGP SIGNATURE-----

83
share/security/patches/EN-20:06/ipv6.patch Normal file
View file

@ -0,0 +1,83 @@
--- sys/netinet6/ip6_output.c.orig
+++ sys/netinet6/ip6_output.c
@@ -205,6 +205,36 @@
*(u_short *)mtodo(m, offset) = csum;
}
+static int
+ip6_output_delayed_csum(struct mbuf *m, struct ifnet *ifp, int csum_flags,
+ int plen, int optlen, bool frag __unused)
+{
+
+ KASSERT((plen >= optlen), ("%s:%d: plen %d < optlen %d, m %p, ifp %p "
+ "csum_flags %#x frag %d\n",
+ __func__, __LINE__, plen, optlen, m, ifp, csum_flags, frag));
+
+ if ((csum_flags & CSUM_DELAY_DATA_IPV6) ||
+#ifdef SCTP
+ (csum_flags & CSUM_SCTP_IPV6) ||
+#endif
+ false) {
+ if (csum_flags & CSUM_DELAY_DATA_IPV6) {
+ in6_delayed_cksum(m, plen - optlen,
+ sizeof(struct ip6_hdr) + optlen);
+ m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
+ }
+#ifdef SCTP
+ if (csum_flags & CSUM_SCTP_IPV6) {
+ sctp_delayed_cksum(m, sizeof(struct ip6_hdr) + optlen);
+ m->m_pkthdr.csum_flags &= ~CSUM_SCTP_IPV6;
+ }
+#endif
+ }
+
+ return (0);
+}
+
int
ip6_fragment(struct ifnet *ifp, struct mbuf *m0, int hlen, u_char nextproto,
int fraglen , uint32_t id)
@@ -908,17 +938,10 @@
* XXX-BZ Need a framework to know when the NIC can handle it, even
* with ext. hdrs.
*/
- if (sw_csum & CSUM_DELAY_DATA_IPV6) {
- sw_csum &= ~CSUM_DELAY_DATA_IPV6;
- in6_delayed_cksum(m, plen, sizeof(struct ip6_hdr));
- }
-#ifdef SCTP
- if (sw_csum & CSUM_SCTP_IPV6) {
- sw_csum &= ~CSUM_SCTP_IPV6;
- sctp_delayed_cksum(m, sizeof(struct ip6_hdr));
- }
-#endif
- m->m_pkthdr.csum_flags &= ifp->if_hwassist;
+ error = ip6_output_delayed_csum(m, ifp, sw_csum, plen, optlen, false);
+ if (error != 0)
+ goto bad;
+ /* XXX-BZ m->m_pkthdr.csum_flags &= ~ifp->if_hwassist; */
tlen = m->m_pkthdr.len;
if ((opt && (opt->ip6po_flags & IP6PO_DONTFRAG)) || tso)
@@ -1017,16 +1040,11 @@
* fragmented packets, then do it here.
* XXX-BZ handle the hw offloading case. Need flags.
*/
- if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6) {
- in6_delayed_cksum(m, plen, hlen);
- m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
- }
-#ifdef SCTP
- if (m->m_pkthdr.csum_flags & CSUM_SCTP_IPV6) {
- sctp_delayed_cksum(m, hlen);
- m->m_pkthdr.csum_flags &= ~CSUM_SCTP_IPV6;
- }
-#endif
+ error = ip6_output_delayed_csum(m, ifp, m->m_pkthdr.csum_flags,
+ plen, optlen, true);
+ if (error != 0)
+ goto bad;
+
/*
* Change the next header field of the last header in the
* unfragmentable part.

18
share/security/patches/EN-20:06/ipv6.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpotfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cIh8Q/9ETsrnu22hJARS6H5kO+HGOd3NhRamWpllytcM1Q2TLMYbHB6UunMao05
YxBp86u9NhWYgyQ+qJeOqXgQpo6/ReUmjfplersuraacGjVoDgxPRqCVibAX8Of7
3PhaVCH8vwC5bkZqMm3JpPS62eEF2WF/Mc2asao6z0pI16PCi01ZOEgLFC9CdqTr
IZpHN1QX3Jj1uinYoACkwTKoY/y5FdoSoXg0Z8cvuoZ94ruSg/bUmuZJD0Hrs20r
HGWmcUJx/qorozp0X006kbErZqQ8WIlk+BDLiGdG/XjDd+OWOmYclAcKvpbJb8IR
2ELeLbP+yhXgpayrbXKA/B4Dd0p4uzPe0KV9GjLb+6et7SFV5Aidxs+7PfNubzpi
JecV47YEvLDS6AhdiYmVD7ZF7PX6LEd3tFKgsH+yygYfPCWjZopeViqo2vAE4aBC
a1fIIPugZDsqQowhdo0IfEc/BBP5X8hRlQt1FwKoepZ++hcQzvSvOtZgQI/VTP4R
B+zPVSJKvb7lbPknSXHMnLEqhf4TtRWAEHQiz14YhVFdeCFxxJ+V6Rsm+6DnijLs
O69YmQ4eI59eY1rfADaDE+ej6OPHhQ46rJKmN7+JyzAM/NcW3ZRuUEItdlSrBt4M
4olOYvnF6OBl3Qnta85O/53fP1dEnclxv838uEtSXYesVZbyVeA=
=xBIY
-----END PGP SIGNATURE-----

12
share/security/patches/SA-20:04/tcp.patch Normal file
View file

@ -0,0 +1,12 @@
--- sys/netinet/tcp_syncache.c.orig
+++ sys/netinet/tcp_syncache.c
@@ -1728,7 +1728,8 @@
ip6->ip6_dst = sc->sc_inc.inc6_faddr;
ip6->ip6_plen = htons(tlen - hlen);
/* ip6_hlim is set after checksum */
- ip6->ip6_flow &= ~IPV6_FLOWLABEL_MASK;
+ /* Zero out traffic class and flow label. */
+ ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK;
ip6->ip6_flow |= sc->sc_flowlabel;
th = (struct tcphdr *)(ip6 + 1);

18
share/security/patches/SA-20:04/tcp.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpoxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cL73A//ccllY3bR2AqzjlfNp8I+w6dzZx8uS/waSLJL+zUeSI1TVrSu2+mjTbIK
s0JVqZ9XP+CPHE+37acn3YpXMsVRn1E4DBLzeaMLH255x+b5svWFZh+/rdgy0w+S
WSlTB5zu+77WaCr9XdBD5V0EkUBmUIOgkUc+LL9tM9s1x4+DUD+4KybLQHQo7zke
wbQ/mc0mpD7ugb4t5V7xPxvYOOxmCZEnZNIaNz991q/n48Kqi47GDPdnTidjUqdT
i6f2N0/eToGMmx+Dilbuyk2hCtOiSdydUVJAk+KA1RGSGKIGSQ7nUD5wmOLRmPO3
xQCEdG117Fpu1Y54zSLmU6O11S+FjOO9RyDPQkeQq+TD23rweTJG7kFgxIEZw3om
gMFaVW8BNmqR0ozTqryM6wpNqeI52HiWi9OKhp05jV1cV6z6o5kyfGGceI/HcAAa
Du/JAyvqNDSyrGJQZKSTkcr0/8YxtzM/QYXaSQoqrhYnyegGYTfkv2OgGgcypTdl
QxKd1F/wVhIac5FGDBmAst/nHMwlnyadugRe1FjCQLOdwIkuj5Ol/fRq670+eBQh
mLFQM3fGw2nW2ZuVj5ewqIbeLAzJ/cz3USdX+XT473i9u1/3O0OyN3tVY6HsSIP2
7SgjuAxAwsy5Gkg5pq42sYeENKJn0DTIks11llrfGNaivQHWmao=
=m2Ba
-----END PGP SIGNATURE-----

22
share/security/patches/SA-20:05/if_oce_ioctl.patch Normal file
View file

@ -0,0 +1,22 @@
--- sys/dev/oce/oce_if.c.orig
+++ sys/dev/oce/oce_if.c
@@ -616,6 +616,9 @@
break;
case SIOCGPRIVATE_0:
+ rc = priv_check(curthread, PRIV_DRIVER);
+ if (rc != 0)
+ break;
rc = oce_handle_passthrough(ifp, data);
break;
default:
--- sys/dev/oce/oce_if.h.orig
+++ sys/dev/oce/oce_if.h
@@ -46,6 +46,7 @@
#include <sys/kernel.h>
#include <sys/bus.h>
#include <sys/mbuf.h>
+#include <sys/priv.h>
#include <sys/rman.h>
#include <sys/socket.h>
#include <sys/sockio.h>

18
share/security/patches/SA-20:05/if_oce_ioctl.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpoxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cI3/hAAmEYQUOLoEEcfq7YAM+P+kowlu+atAw+istqcqMqs8KWlELcd5PG78R2v
EXdywpDDDnmbp/zTBTs1aaIShmKkV8e/+ow++n8eABDYp/ERdNFMhosCuNjvGjy8
u38hBUL5L7FC5CARndSp5teixEi9GnITg9CckHrOYfAje2WOJJjhd2VKTKsblEn6
1jrVdncK3HQQFmRS+A2l0Ot+WVF7zO7H5vZgkqDOgt9bNXc47eTX6GumZ0NgKnDG
Mth0PJvCVMBw2cQLmYF2/gkZPFIff9TucHvosESScjQkD1NPNQ+0sc73lEhQolmV
7KvmahlayMrMZp5t48iDSjhMug4uVrIv+hvM3VTE7VQKNV0gWfUAYKaXDiF/1Dq8
cDCPttm/Ohq1wbEWtidP/vfmQd5TowKofikHOS0y+65qCvg5CR3FTU2cC0vUkwxN
yE/XYz9lfNyuLyJOj/plr/1dQXZoOGjg/4iurttGDy+PTqazQQuGJigSDaYirj/J
CJyZPG3Y3QKYM0DACS9KJxoydv9L6prusS0PqW4YaCPRZ9zuV93J7GyIxzi/DCXB
go8pRDAvqgJ5O1eQUYOX3IKl9nCeuXvleHEL/jDBozrsvmvkdVDlcsYCGzOA7LUv
vEjoncew786D9bAc+SRWgsuebU40wgLV1mbjtjBaEX/QVWqsypc=
=en9g
-----END PGP SIGNATURE-----

48
share/security/patches/SA-20:06/if_ixl_ioctl.patch Normal file
View file

@ -0,0 +1,48 @@
--- sys/dev/ixl/if_ixl.c.orig
+++ sys/dev/ixl/if_ixl.c
@@ -1625,12 +1625,30 @@
struct ifdrv *ifd = (struct ifdrv *)data;
int error = 0;
- /* NVM update command */
- if (ifd->ifd_cmd == I40E_NVM_ACCESS)
- error = ixl_handle_nvmupd_cmd(pf, ifd);
- else
- error = EINVAL;
+ /*
+ * The iflib_if_ioctl forwards SIOCxDRVSPEC and SIOGPRIVATE_0 without
+ * performing privilege checks. It is important that this function
+ * perform the necessary checks for commands which should only be
+ * executed by privileged threads.
+ */
+ switch(command) {
+ case SIOCGDRVSPEC:
+ case SIOCSDRVSPEC:
+ /* NVM update command */
+ if (ifd->ifd_cmd == I40E_NVM_ACCESS) {
+ error = priv_check(curthread, PRIV_DRIVER);
+ if (error)
+ break;
+ error = ixl_handle_nvmupd_cmd(pf, ifd);
+ } else {
+ error = EINVAL;
+ }
+ break;
+ default:
+ error = EOPNOTSUPP;
+ }
+
return (error);
}
--- sys/dev/ixl/ixl.h.orig
+++ sys/dev/ixl/ixl.h
@@ -52,6 +52,7 @@
#include <sys/sockio.h>
#include <sys/eventhandler.h>
#include <sys/syslog.h>
+#include <sys/priv.h>
#include <net/if.h>
#include <net/if_var.h>

18
share/security/patches/SA-20:06/if_ixl_ioctl.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpoxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cJedxAAkRktJwXTYThJXPRmmF0iko2vuF6FBr/dtZO2elSStsXmDL5EeU6Qn8XY
kId640GOm8UmLctWspVL8R/Vo2CGMnZam2+Z5rPZ/UEXS2KyC4FTWMNR8nQtiNci
GVFJgUIyKTjuDAEGMI51cFZ72Hheh4vV3jtw8RmKnPjsHxwTJqEPt0povqvu/gym
3kBk1BXbLSKOw04AH/MiVw8t7mMRZWNrYE61zsG9LE9FprITtZcQZB6yNsZFICpd
ImfivrHm75X5Or1Q0T0+MeGvVe0hCjRa2O81wnGPoAYYKorhHSVhg0zQWOBzCqgi
B+8Az7eGuIRCGzh4ZDJwN6hI6vAb0lk2MSAvAvAkhrwzO5NAcMXg/PTej4Ph79U+
IYlfp+gA4vaBgChx/++n9TM7b/2etq1hB1aF8hcgvJOLdcXiVK9cl4ad97uAezz0
0ux71E/igUC/tub0TUL9Oe8VCoWrzZUF+UeWZadbalIALnFPaZJ+5ZQH/xvr+D7H
aQXwbUJqp0Qq3TS07Yk9wqq5UeyF+H15lgUAHJ3CWolUaiJJyjmNqj5ekijreP0P
7Lk8q4Ouxi5jz2S/ZbeHWnVLY+vDnrn7Ww+qWJh2T8+nHLRgw1vYeWQUO3FHUxH3
/lJy6n1ypS63tYfmN3vpmhKpgRfKbp5ovCAAONgSdqxSzBmhVd4=
=O27d
-----END PGP SIGNATURE-----

114
share/security/patches/SA-20:07/epair.11.patch Normal file
View file

@ -0,0 +1,114 @@
--- sys/net/if_clone.c.orig
+++ sys/net/if_clone.c
@@ -208,6 +208,17 @@
return (if_clone_createif(ifc, name, len, params));
}
+void
+if_clone_addif(struct if_clone *ifc, struct ifnet *ifp)
+{
+
+ if_addgroup(ifp, ifc->ifc_name);
+
+ IF_CLONE_LOCK(ifc);
+ IFC_IFLIST_INSERT(ifc, ifp);
+ IF_CLONE_UNLOCK(ifc);
+}
+
/*
* Create a clone network interface.
*/
@@ -230,11 +241,7 @@
if (ifp == NULL)
panic("%s: lookup failed for %s", __func__, name);
- if_addgroup(ifp, ifc->ifc_name);
-
- IF_CLONE_LOCK(ifc);
- IFC_IFLIST_INSERT(ifc, ifp);
- IF_CLONE_UNLOCK(ifc);
+ if_clone_addif(ifc, ifp);
}
return (err);
--- sys/net/if_clone.h.orig
+++ sys/net/if_clone.h
@@ -72,7 +72,8 @@
struct if_clone *if_clone_findifc(struct ifnet *);
void if_clone_addgroup(struct ifnet *, struct if_clone *);
-/* The below interface used only by epair(4). */
+/* The below interfaces are used only by epair(4). */
+void if_clone_addif(struct if_clone *, struct ifnet *);
int if_clone_destroyif(struct if_clone *, struct ifnet *);
#endif /* _KERNEL */
--- sys/net/if_epair.c.orig
+++ sys/net/if_epair.c
@@ -704,6 +704,23 @@
return (1);
}
+static void
+epair_clone_add(struct if_clone *ifc, struct epair_softc *scb)
+{
+ struct ifnet *ifp;
+ uint8_t eaddr[ETHER_ADDR_LEN]; /* 00:00:00:00:00:00 */
+
+ ifp = scb->ifp;
+ /* Assign a hopefully unique, locally administered etheraddr. */
+ eaddr[0] = 0x02;
+ eaddr[3] = (ifp->if_index >> 8) & 0xff;
+ eaddr[4] = ifp->if_index & 0xff;
+ eaddr[5] = 0x0b;
+ ether_ifattach(ifp, eaddr);
+
+ if_clone_addif(ifc, ifp);
+}
+
static int
epair_clone_create(struct if_clone *ifc, char *name, size_t len, caddr_t params)
{
@@ -713,26 +730,6 @@
int error, unit, wildcard;
uint8_t eaddr[ETHER_ADDR_LEN]; /* 00:00:00:00:00:00 */
- /*
- * We are abusing params to create our second interface.
- * Actually we already created it and called if_clone_create()
- * for it to do the official insertion procedure the moment we knew
- * it cannot fail anymore. So just do attach it here.
- */
- if (params) {
- scb = (struct epair_softc *)params;
- ifp = scb->ifp;
- /* Assign a hopefully unique, locally administered etheraddr. */
- eaddr[0] = 0x02;
- eaddr[3] = (ifp->if_index >> 8) & 0xff;
- eaddr[4] = ifp->if_index & 0xff;
- eaddr[5] = 0x0b;
- ether_ifattach(ifp, eaddr);
- /* Correctly set the name for the cloner list. */
- strlcpy(name, scb->ifp->if_xname, len);
- return (0);
- }
-
/* Try to see if a special unit was requested. */
error = ifc_name2unit(name, &unit);
if (error != 0)
@@ -860,10 +857,11 @@
ifp->if_snd.ifq_maxlen = ifqmaxlen;
/* We need to play some tricks here for the second interface. */
strlcpy(name, epairname, len);
- error = if_clone_create(name, len, (caddr_t)scb);
- if (error)
- panic("%s: if_clone_create() for our 2nd iface failed: %d",
- __func__, error);
+
+ /* Correctly set the name for the cloner list. */
+ strlcpy(name, scb->ifp->if_xname, len);
+ epair_clone_add(ifc, scb);
+
scb->if_qflush = ifp->if_qflush;
ifp->if_qflush = epair_qflush;
ifp->if_transmit = epair_transmit;

18
share/security/patches/SA-20:07/epair.11.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpoxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cIQtQ//UD8/0BDQYHiWjIfps4h6sPh0UQvXsCbE7uvLWpyA7H96Qi7EZhq17Yjr
IrF0iwkNtp4LInhbLEmAOuYwbkdhk4oqAZ30T7VbZQRuny/fDzMfM2M3mTW+2Ozr
SbIw3TlRd47p1NZQW5nhG7GFTVwlLQS0VxS1uHnNCXD9djW29tgeN9jI7pYe/ozq
VHIx5Dq9EphU5DvBrZNWQDIGS8Wq63DrRzHTJmm6+WpAFnHBETv3pplN9XRpjY24
RFPv94Xtj0fbn6D4b+rDQUCVZ1ukea6EcMCRZDL4RQrCgWXpNTqQr1Nsqf4QGdFS
dz0krA4IRdZnUQvqp8X0KkAb80rCEhXOzI8bmD9VSoTMJtn0NrYU0oh5O9quZVXh
OVisB5o+eBY+Ywgh6q1R6Arm5MOzSAuDgQ3J+M3sRmx4k6SIL5F72hUupIWEvesk
rqpashwDQM4luXMyEmucpbEvB/s7ELUjMp1BDnb2+xRyzAAPDPr/d8PPAP5lWa+k
YjCDRGObtnaX2A0uEXDt0JZ0UCrxDW4NRmdWzI8/PrT4IekW8NwvJX4ON6zAFudW
ENoOK3qmIIZkhIUbIHUrmJ/pl52vwY7ztiQ3cHvolZX4T7bHURScwnVPcwiaDyZ4
z4HeBdJafULZnZifVkWa3gTer804AMy3Ww8vSdkclIg+ADtUZg8=
=Fp6B
-----END PGP SIGNATURE-----

112
share/security/patches/SA-20:07/epair.12.patch Normal file
View file

@ -0,0 +1,112 @@
--- sys/net/if_clone.c.orig
+++ sys/net/if_clone.c
@@ -211,6 +211,18 @@
return (if_clone_createif(ifc, name, len, params));
}
+void
+if_clone_addif(struct if_clone *ifc, struct ifnet *ifp)
+{
+
+ if ((ifc->ifc_flags & IFC_NOGROUP) == 0)
+ if_addgroup(ifp, ifc->ifc_name);
+
+ IF_CLONE_LOCK(ifc);
+ IFC_IFLIST_INSERT(ifc, ifp);
+ IF_CLONE_UNLOCK(ifc);
+}
+
/*
* Create a clone network interface.
*/
@@ -233,12 +245,7 @@
if (ifp == NULL)
panic("%s: lookup failed for %s", __func__, name);
- if ((ifc->ifc_flags & IFC_NOGROUP) == 0)
- if_addgroup(ifp, ifc->ifc_name);
-
- IF_CLONE_LOCK(ifc);
- IFC_IFLIST_INSERT(ifc, ifp);
- IF_CLONE_UNLOCK(ifc);
+ if_clone_addif(ifc, ifp);
}
return (err);
--- sys/net/if_clone.h.orig
+++ sys/net/if_clone.h
@@ -79,7 +79,8 @@
struct if_clone *if_clone_findifc(struct ifnet *);
void if_clone_addgroup(struct ifnet *, struct if_clone *);
-/* The below interface used only by epair(4). */
+/* The below interfaces are used only by epair(4). */
+void if_clone_addif(struct if_clone *, struct ifnet *);
int if_clone_destroyif(struct if_clone *, struct ifnet *);
#endif /* _KERNEL */
--- sys/net/if_epair.c.orig
+++ sys/net/if_epair.c
@@ -711,6 +711,21 @@
return (1);
}
+static void
+epair_clone_add(struct if_clone *ifc, struct epair_softc *scb)
+{
+ struct ifnet *ifp;
+ uint8_t eaddr[ETHER_ADDR_LEN]; /* 00:00:00:00:00:00 */
+
+ ifp = scb->ifp;
+ /* Copy epairNa etheraddr and change the last byte. */
+ memcpy(eaddr, scb->oifp->if_hw_addr, ETHER_ADDR_LEN);
+ eaddr[5] = 0x0b;
+ ether_ifattach(ifp, eaddr);
+
+ if_clone_addif(ifc, ifp);
+}
+
static int
epair_clone_create(struct if_clone *ifc, char *name, size_t len, caddr_t params)
{
@@ -723,24 +738,6 @@
uint32_t hash;
uint8_t eaddr[ETHER_ADDR_LEN]; /* 00:00:00:00:00:00 */
- /*
- * We are abusing params to create our second interface.
- * Actually we already created it and called if_clone_create()
- * for it to do the official insertion procedure the moment we knew
- * it cannot fail anymore. So just do attach it here.
- */
- if (params) {
- scb = (struct epair_softc *)params;
- ifp = scb->ifp;
- /* Copy epairNa etheraddr and change the last byte. */
- memcpy(eaddr, scb->oifp->if_hw_addr, ETHER_ADDR_LEN);
- eaddr[5] = 0x0b;
- ether_ifattach(ifp, eaddr);
- /* Correctly set the name for the cloner list. */
- strlcpy(name, ifp->if_xname, len);
- return (0);
- }
-
/* Try to see if a special unit was requested. */
error = ifc_name2unit(name, &unit);
if (error != 0)
@@ -891,10 +888,11 @@
if_setsendqready(ifp);
/* We need to play some tricks here for the second interface. */
strlcpy(name, epairname, len);
- error = if_clone_create(name, len, (caddr_t)scb);
- if (error)
- panic("%s: if_clone_create() for our 2nd iface failed: %d",
- __func__, error);
+
+ /* Correctly set the name for the cloner list. */
+ strlcpy(name, scb->ifp->if_xname, len);
+ epair_clone_add(ifc, scb);
+
scb->if_qflush = ifp->if_qflush;
ifp->if_qflush = epair_qflush;
ifp->if_transmit = epair_transmit;

18
share/security/patches/SA-20:07/epair.12.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpoxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cLwgg/9G7rMa/od4rYSAnzkA0nPcsSQnZbpEnxUmDhEx9oaEOXOKvWEd8WCikei
YIZZ2UmHdtLs9nYhVuw7pM1DTzrxwO+9YJe5ywE6ZiuZ0oX8xvEU+OeeTaQbh8Ks
fHPybbZFyi7gxJpOgmka00qeV8O6Q8ixNqqOo/xsfFszbmgp/MQeFW3czmEKy53y
CxsDjpnjr4MdlGSKQ5v97TuCyeJs+jvxNigoEj8xog0xFqHAk9WhZjTOzaaQiiUS
owrUyavN97amH1ZOAKsi2m8uvRlNZxa8eDff12Fcrt3Qe+7JQr8oKhk9377RCw8G
z1O5lBXR2ga1O9q05S/17LF2tCs380UdBgaOGEa0cg2SvHPiPAGOUwvlDNMrQCkL
btGn2JMPRK2qISM1jjwM3Gfk2txCQsMYEwsF9YgGyOiXWu0Pq/uABAeEqgzdmhZp
0u7EqchQ9lyQR102i9446EMSfO4VmgFgszfzCdVVcuSRYekjqko0z0KLC7FtXl1Z
EtUPHOYWyeI/wF1wFj8BKXEEfp8PEccLYNVmSafMRfj/GxX6CMCMHoTHblVSwZ2v
tzaGwxHyqwCwE0Qqk6wMUtRyzQdRbUYSyUy41PrM41RZg+AOwvMZVYghUDfNbXJ1
PfdW/jWle2FukRhUK5upGuXc2atFBwY50wwJrL4zG0UoT6CSIM4=
=SiJG
-----END PGP SIGNATURE-----

30
share/security/patches/SA-20:08/kern_jail.patch Normal file
View file

@ -0,0 +1,30 @@
--- sys/kern/kern_jail.c.orig
+++ sys/kern/kern_jail.c
@@ -865,8 +865,12 @@
"osrelease cannot be changed after creation");
goto done_errmsg;
}
- if (len == 0 || len >= OSRELEASELEN) {
+ if (len == 0 || osrelstr[len - 1] != '\0') {
error = EINVAL;
+ goto done_free;
+ }
+ if (len >= OSRELEASELEN) {
+ error = ENAMETOOLONG;
vfs_opterror(opts,
"osrelease string must be 1-%d bytes long",
OSRELEASELEN - 1);
@@ -1241,9 +1245,11 @@
pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate;
if (osrelstr == NULL)
- strcpy(pr->pr_osrelease, ppr->pr_osrelease);
+ strlcpy(pr->pr_osrelease, ppr->pr_osrelease,
+ sizeof(pr->pr_osrelease));
else
- strcpy(pr->pr_osrelease, osrelstr);
+ strlcpy(pr->pr_osrelease, osrelstr,
+ sizeof(pr->pr_osrelease));
LIST_INIT(&pr->pr_children);
mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);

18
share/security/patches/SA-20:08/kern_jail.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpoxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cJybQ/+MODmoQrligHy7yuXlpo+mY4Ew3ALca4Q+F1+u1ZtwaPbyyiT2dZO5uhi
mIdUvq3okDeaJhU+JDJ9KmEtxAOTUE90AJTCsUISbHQ+RGtkYvuuJDDLw/7hZItC
yepdHa5Jcp6TIPa/JLC0TZJVWKBYr/JyiUk8svUzMJXB1b0BNxNJ0yOiiprEmiuI
drFgnzHIJRE8W9AxtyK1+ypLTGUuDpdvbVRlYnx5IBC7Jks/0U8jHWW9xsjOdA3/
RNz15yvX9dyc7DQBi6a3xr+TJUDnDRPRmzCUHvqVJp+cErLylfTS5sON3tY85TqU
C/kr27nHRqML05iaWyW5bE9S84I6uilh5/Cj51aHaKRqCO5yLpybNcB35GmgTLXG
Ojj5MCxbCexvlCiiy+I97cikl+kfmmk63zjRwNF5dgYU7CITARf1sLJLp4Ia3iux
MMvLgugvMPneF94u2zas2yNVO0JfndV6BEMEVt32aGc+eUBDKrnv/jSXshB/WGKf
PXO9K6x2lVOZfjIk0x/Ete/70nutn9GZ58ipHnQD968dmTR+6+wQdYkZxH1s+9p9
NRDwlz0K2f5+OvfFRlIqIZhDJP6ZwJ475M9oTZvxIzcmceVMdcOImWB1c4a4qcOV
cdVgf6v02+A+S7taomKPaNNSeyrJn/UOrO+ZNHqMcLRr7Ho8/G0=
=OlVb
-----END PGP SIGNATURE-----

29580
share/security/patches/SA-20:09/ntp.11.3.patch Normal file
View file

File diff suppressed because it is too large Load diff

18
share/security/patches/SA-20:09/ntp.11.3.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpoxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cLGmQ/+P9irP0D3tbkbMt5pUlII3N74BhzPRfHTP8Bu13e6qnoXTpRjk54Kh0eV
Eq1JrimJAFbcym4X9UG3ZHFUFf9oD2xPSLJ1VMoulS8pWxXVf9wycm/haBZNpHZz
RKGNiANhpWBZRz6G+I/9duTkYvWkB3drpL3RL9LFIsiq5mkmDSOVNRvcfGHqRn/P
+LLuwpz+q6GMR5EmX5qmh1BJQUz9v7lcL11kLB1iTi/epqfj6aVv3xQDzgwZH6S8
TuN/EBl6P56naH9t+99NIZMJ8iuphbYz6Wlu/6AofZ57z7hZKYk4LBi31HyllkDr
10P3QRSu6Ma32wVLvFvTLW7EsMRRe38vhEi/g+cwG5Xtfwpjr1g167mwOKye2l1q
EEiRgrNOqU1ISrRpQApXOs2r39ybOcOfYUgtKsjkRVRo56eCBmIHSrzdLkkW90Rm
xFB/Oq3K79XF/91iBco1iMfVlEHxLi7JfzuGGfrxtmZ9coDfLn2LBaECEHOE6mSL
uKxQ4EpnF7/6Fa/j2GjHit0l8HR+WkGtbPqtP3whM+BilvYxGV+LaNE8knWQZ0DF
mgt0mHLTcZVZ3wc028Eb56m93ZXv2CHEgZCRpfG98k+uYIzOU+oclue92iBun0ce
2Gl/v90id0HB3hzFA0K+8cMMDppVrbitR83RheFAPVqquw48WxY=
=4Nof
-----END PGP SIGNATURE-----

29580
share/security/patches/SA-20:09/ntp.11.patch Normal file
View file

File diff suppressed because it is too large Load diff

18
share/security/patches/SA-20:09/ntp.11.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpo1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cLhBBAAlKJopXbDl7MK38nmJDEmeIFAlaXN+Y8em60/682eJD9sT4qQ8WZOXiPG
pDuRHLfN+EkSrH9Iv7Yc0yaFn7HP7Yb895cLpu4QnelIZzpFZpaP7PKq1oU4XPzJ
A2luZgzxWqZAOWynPKQkpfidjDXx8lYb5lL8/fRTiw8cQyZJVcig8ENUFt7g5tcb
/Eo0QlWwFMTkUM7lz6HlmLoc4AHu+COnIBsPNQo6mafXuMrNMvyv4xnhlNnwlhO1
iu3Z9T868jat2jVQkU3eI/OUsA1ogEZDhgzH+4v5la+pRRZaD7s3tPVjJpXHCIu0
OlEJsk63D3wfIykgxugK4BEfHdHBrIzab/AjPzPf5u8cKmLcJDjC668a0O5fGrRG
mxyq7bvpWnDgxlWK2+YfMdO46Wz2laHF36ZSTpVswBZE8/QA4fuFNLDHAtXF2/2a
4x9RK3oTCC9wQ5wIGXBNMkrhwGLFrEeGbIEPGeOyOkbmiCt/5VOUWJhpft+IcQtA
SLhuU8b0/L4j236hNHaZt7kAEleWhxO939QPROu81j98cRMr8K+makngjHEOly7J
6fIuFvw78rDS1ZGgy69/OjgcJgxEnYzgFPiHwLONythG6yt/tMI123qJsUtdQ5mi
MPPGNqNrRigb5AV2siZd7Ae1i4t9bT+0SX/ZGwB2vvh8i4b5/G8=
=kNfC
-----END PGP SIGNATURE-----

29611
share/security/patches/SA-20:09/ntp.12.1.patch Normal file
View file

File diff suppressed because it is too large Load diff

18
share/security/patches/SA-20:09/ntp.12.1.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpo1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cIsxRAAgJGAocqd3QAuL/lnEPbDFzDDUn/XzyUpFYG7gXXih9cjzdzHTA0BxxYM
JaOeqdJnRL1j+clKCx01dUI0H05fRmklRpUxaK0CFyPHFuFaP+SIXLKE6/l6JN1Q
Xw2+VKHFRmZhxOeo12K9yxBJKhY7MgtHtOxT1TR08UwhkWhqofyjPjBZkJK9nSyT
zf0lzazOCeFzrm/J5C1R81wXSsNckdfwVJN4qjVNENb2TqIy9VDTTyMe9/uqNz2k
AoU2Llp3BuHD/xLbMrRU30KX9sDz8PdLo5n/7FyauTiXwrc4A4HXQBMur/MAYfxC
HIe9xMDfLDfhoEHQhiGh+KdgS+U7gSrGhW5EvPMf812lbuTkt+ST4qP0t4Qyz+vi
ZRYY1KX/tCzlH4blQlgdwLeiHK6sEFS+EZBEI57BhzYomT0cJIVYeLUMUlEJCKkY
my15XiOfVP/0CxD8uaSxWfZnf5xADiADTnKn7DiMYf7G16T3vHY0FdC+J9Kh6a3+
9R+lC2w6r8WoF0iWvOJFu0tUVYRVtVSaN2k1vXoOmRnzYu1LJZezfVAwuk/vFQqx
57e2bDIC8Tpp+UejHKoj9lvBbL7K6GFFU2cUVP9vIAlzWXm6k6vD6mkbEHkBPTkN
yTpb+IZdeDq51j0ar16JSztO9mAM7AgxrcmO8ED2dgb6PUwakAg=
=boWC
-----END PGP SIGNATURE-----

29594
share/security/patches/SA-20:09/ntp.12.patch Normal file
View file

File diff suppressed because it is too large Load diff

18
share/security/patches/SA-20:09/ntp.12.patch.asc Normal file
View file

@ -0,0 +1,18 @@
-----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl5zpo1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cIeSg//TDEvOMSDPQOblXISBwEKv6yGvkGGuxNVidmtoMFaDf96OIQv4U1L22dE
z1VD4gqXat3FWbP5SwNWk6uWWdYQQOMJPnVjLf54ketJ2UlMjYWsR9c9zvd6OsoU
7ed5KvQLWOYOF6bP7H4ArsDwRFaA50CsrYh0yqwUzZqGdwvJWw9U6kBRepxgyQEV
HA2HDtdgar+4hudn5ITXrpkYbCXOvkK9ePnR0RwLYasG2QwrKXQFlsnbsznd2oiq
ASC3yTdpIcSV2ThlM1tF3EVU3TL+pPrF48CJyZ7ZZ2zQfHG4nuAN01wD7j25+7/I
NfpI0J3/3O5JgSINAcjrb/085bGs6QbZswl97YGKtlRDQSP+z+R5TqmrL34hIslm
uCieT3up2l7XWAXPAWvqYXD0m+zmuLICAYch7PR78i4nP/IDM74eEUeZecbliaJa
DGXcqKUi67YSW0G2+dx1m2pNFCt5WkE07nIPRRsEWtzed04VIEaC3P3RQw73O7sN
YXqg3+Mj+cUtZYqh2m+NmgCUU58qRx/OdesLRj+vq/0GJPwdoSi8X2KE74Bpgk1D
tgGkh4+glyOgvxsMaDxNxRWFpl1/kt7fYzL1C9pzKKYoWOo861FK22mUh3b/MbPN
mBNgysCq4cvUnyNs2fzdaiRr53rL5UMFOcC0pLUZ7jAmztDss4s=
=/hXi
-----END PGP SIGNATURE-----