the pledge/unveil and related mtu change seem too complicated to handle in
patches
individual patches for the other things (tackling only one thing at a time
and waiting for it to either go in or get rejected) might make sense?
--
Sent from a phone, apologies for poor formatting.
On 17 October 2026 19:50:42 David Uhden Collado <[email protected]> wrote:
David Uhden Collado wrote:
Stuart Henderson wrote:
On 2026/10/16 22:01, David Uhden Collado wrote:
Please find attached a patch updating net/i2pd from 2.59.0 to
2.61.0, including fixes for regressions introduced by the upstream
pledge/unveil integration.
I've just committed my version (which disables pledge) as the change
in it to certs are packaged will avoid a lot of broken update diffs.
The OpenBSD-specific changes include:
- Move sandbox initialization until the effective configuration
paths and PID file are resolved, preserving custom paths and user
configurations.
- Restrict pledge/unveil permissions to those actually required,
checking errors instead of silently continuing.
- Restore SSU2 interface MTU detection using AF_LINK data from
getifaddrs(), avoiding SIOCGIFMTU, which is restricted by pledge.
- Handle SIGHUP synchronously through sigwait(), preventing unsafe
reload operations and thread self-join failures.
- Fix UDP cleanup timer ownership during tunnel reloads.
These more complicated changes should go upstream, it's too much for
patches in ports really, merging with any upstream changes in the
same area will be tricky, and this port seems to attract unskilled
update diffs so $deity knows how tgey'll get mangled.
https://github.com/PurpleI2P/i2pd/pull/2600
Tests are welcome...
Hello,
Please find attached a revised patch for net/i2pd 2.61.0, with
REVISION=0.
I reported the underlying problems upstream, but the proposed fixes
were dismissed as "neoroslop" rather than accepted. Since some of
these issues affect security and correctness, I would prefer to have
them reviewed on their technical merits instead of leaving them
unresolved in the OpenBSD package.
The revised patch includes:
- Correct pledge/unveil initialization, effective path handling and
privilege restrictions, without disabling either mechanism.
- Restore SSU2 MTU detection using AF_LINK instead of ioctls restricted
by pledge.
- Fix SIGHUP handling using sigwait(), avoiding asynchronous reload
operations and thread self-join failures.
- Fix UDP timer ownership during configuration reloads.
- Correct OpenSSL/LibreSSL feature detection and compatibility.
- Harden ML-KEM key management, memory cleanup, buffer validation and
error propagation in NTCP2, SSU2 and ECIES handshakes.
- Improve AEAD and signature error handling, including Ed25519ph.
The cryptographic changes are particularly relevant because i2pd
2.61.0 introduced post-quantum support with LibreSSL. Failed
cryptographic operations should not silently leave handshake state
inconsistent or allow uninitialized output to be used.
I would appreciate review, particularly of the LibreSSL and
pledge/unveil changes.
Thank you for your time and consideration.
Best regards,
David.
