silly me didn't collect the login.core file

2024-05-24 Thread Peter J. Philipp
Hi, Just a heads up I was working on UART console of a raspberry pi and needed to xmodem a file to it, something went wrong and it caused the session to log out. I had to relog on. Much later I saw a login.core file in /, meaning the compressed tarball, had some overflow on login(1) causing the

AES256^WAES128

2024-05-06 Thread Peter J. Philipp
Hi all, On around May first (International day of labour) I revisited some old code of mine and published it. I understand of the implications of a broken AES, but I'm an open person and I believe that we must pull out quantum resistant and classic resistant alternatives, because I have found

deassoc attack, or, trapped in S_RUN forever?

2024-04-22 Thread Peter J. Philipp
Hi, I have a shortage of RJ45 adapters so I had to expose one host on wifi, for this I set up an access point of type "AVM Fritz!Box 7390" with latest firmware from last year. Soon I started facing deauth attacks from someone within my wifi cell region. Since the deauthers were spoofing my

Small bug in /usr/src/distrib/riscv64/ramdisk/Makefile?

2024-02-16 Thread Peter J. Philipp
kn@: I will take a look at my earlier bug report with the RISCV disk encryption bug in the installer. Right now I have installed OpenBSD/riscv64 on my Mango Pi. Thank you very much OpenBSD! This is a great effort making this mango pi work! I found that I needed a new kernel to detect

Re: code reading, possible derefence on non-malloced data?

2024-02-10 Thread Peter J. Philipp
    sleep(10);     return 0; } OK please excuse the formatting of this mail, it's written with thunderbird and I'm not at home either. BTW I just did an if statement instead of the printf() and it cored again: spica$ ./buffer Segmentation fault (core dumped) Best regards, -peter On 2

not sure if this is a pf bug

2024-02-10 Thread Peter J. Philipp
Hi, I had an anchor rule and hashed everything in it out. So only the stub was remaining. As in: anchor "something" { } then I reloaded the entire pf rules. Whatever was in the anchor before was not removed. Best Regards, -peter

Re: code reading, possible derefence on non-malloced data?

2024-02-10 Thread Peter J. Philipp
On 2/10/24 08:38, Peter J. Philipp wrote: Hi, I'd like you to just quickly look at the following to files: /usr/src/lib/libradius/radius.c 61 for (; attr < end; ATTRS_ADVANCE(attr)) { 62 if (attr->length < 2) 63 r

code reading, possible derefence on non-malloced data?

2024-02-09 Thread Peter J. Philipp
Hi, I'd like you to just quickly look at the following to files: /usr/src/lib/libradius/radius.c 61 for (; attr < end; ATTRS_ADVANCE(attr)) { 62 if (attr->length < 2) 63 return (-1); and it's header file

Re: odd pf divert-packet problem

2024-02-08 Thread Peter J. Philipp
On 2/8/24 10:18, Stuart Henderson wrote: On 2024/02/08 09:19, Peter J. Philipp wrote: On 2/7/24 20:15, Janne Johansson wrote: pass in log quick on wg1 inet proto udp from 192.168.178.1 to any port = 5060 sc rub (reassemble tcp) divert-packet port 2 The mix of udp and tcp reassembly

Re: odd pf divert-packet problem

2024-02-08 Thread Peter J. Philipp
On 2/7/24 20:15, Janne Johansson wrote: pass in log quick on wg1 inet proto udp from 192.168.178.1 to any port = 5060 sc rub (reassemble tcp) divert-packet port 2 The mix of udp and tcp reassembly seems interesting there. Hi Janne, Yeah it does, but it is added on both stern (which

odd pf divert-packet problem

2024-02-07 Thread Peter J. Philipp
Hi, I have two hosts bounded by a wireguard: superpod(7.4/arm64) and stern (snapshot of today/riscv64). I have utilized a program that I rewrote yesterday and this morning that I call sipdiv, because it reads SIP signalling off a divert socket. The code is publically available since today:

Re: BOOTRISCV64.EFI and crypted passphrase

2024-02-04 Thread Peter J. Philipp
On 2/4/24 14:36, Klemens Nanni wrote: On Sun, Feb 04, 2024 at 01:58:17PM +0100, Peter J. Philipp wrote: Hi, I just reinstalled a host and noticed the following two conditions: 1. BOOTRISCV64.EFI does not get installed on the outer (non-sr0) partition i. in the installer. This means

BOOTRISCV64.EFI and crypted passphrase

2024-02-04 Thread Peter J. Philipp
Hi, I just reinstalled a host and noticed the following two conditions: 1. BOOTRISCV64.EFI does not get installed on the outer (non-sr0) partition i. in the installer. This means I cannot boot without booting from a different image and fixing it. It was a one time thing but it

routing (null) interface as dest / how to delete?

2024-01-14 Thread Peter J. Philipp
Hi, I messed something up playing with routes: superpod# netstat -nrfinet ... 192.168.178/24 link#20LS 0 25 - 8 (null) superpod# route delete -net 192.168.178/24 delete net 192.168.178/24: not in table Here is the series of commands from my history that

vmm question, bug?

2024-01-14 Thread Peter J. Philipp
Hi! Yesterday, I was for the last 6 hours or so, trying to get netbsd running in vmm. What I used was netbsd 10.0 RC2 and here is how I went about it: 1. upon vmm start press 2 at console this brings one into a boot config 2. enter "consdev com0,9600" to initialize com0 console 3. boot -cav

raspberry pi 4b with OpenBSD/arm64 needs workaround to boot

2023-12-28 Thread Peter J. Philipp
Hi, I have found that chmod'ing /sbin/savecore and /usr/sbin/acpidump to 0, is a workaround for making the following kernel boot which I sysupgraded earlier today. It took me a long time to fix it because I'm so out of practice on this stuff. Thank you! The symptoms are that it forever hangs

FS bit on sstatus csr set on riscv64

2023-09-21 Thread Peter J. Philipp
Hi, I don't know if it's the same on Sifive based CPU's but on the D1 (doesn't boot beyond main() yet) the FS bits are set. These are floating point indicators, and I thought these should be off? In my debugs I have found this: 10100111 p

Re: RISCV - physmem is an address not pages in locore.S

2023-09-20 Thread Peter J. Philipp
On Sun, Sep 17, 2023 at 04:51:11PM +0200, Peter J. Philipp wrote: > On Sun, Sep 17, 2023 at 04:22:14PM +0200, Mark Kettenis wrote: > > > Date: Sun, 17 Sep 2023 12:40:29 +0200 > > > From: "Peter J. Philipp" > > > > Sorry Peter, > > > > But

Re: RISCV - physmem is an address not pages in locore.S

2023-09-17 Thread Peter J. Philipp
On Sun, Sep 17, 2023 at 04:22:14PM +0200, Mark Kettenis wrote: > > Date: Sun, 17 Sep 2023 12:40:29 +0200 > > From: "Peter J. Philipp" > > Sorry Peter, > > But this doesn't make any sense to me. Your C code is just as > unreadable as the assembly code ;) &

Re: RISCV - physmem is an address not pages in locore.S

2023-09-17 Thread Peter J. Philipp
On Sun, Sep 17, 2023 at 04:51:11PM +0200, Peter J. Philipp wrote: > On Sun, Sep 17, 2023 at 04:22:14PM +0200, Mark Kettenis wrote: > > > Date: Sun, 17 Sep 2023 12:40:29 +0200 > > > From: "Peter J. Philipp" > > > > Sorry Peter, > > > > But

Re: RISCV - physmem is an address not pages in locore.S

2023-09-17 Thread Peter J. Philipp
On Sun, Sep 17, 2023 at 04:51:11PM +0200, Peter J. Philipp wrote: > If you do find that there is some truth to my translation from asm to C, > then the last 200 MiB is weird. Is that where the stack resides in the > boot btw? I dunno. Sorry this should say 2MiB, I have too many 0x200

Re: RISCV - physmem is an address not pages in locore.S

2023-09-17 Thread Peter J. Philipp
On Sun, Sep 17, 2023 at 04:22:14PM +0200, Mark Kettenis wrote: > > Date: Sun, 17 Sep 2023 12:40:29 +0200 > > From: "Peter J. Philipp" > > Sorry Peter, > > But this doesn't make any sense to me. Your C code is just as > unreadable as the assembly code ;) Ye

RISCV - physmem is an address not pages in locore.S

2023-09-17 Thread Peter J. Philipp
Hi OpenBSD/riscv64'ers! After a week of debugging a different issue I noticed this issue with the L2 cache in locore.S: The physical address of the base boot memory is held in register s9, and this is shifted by the L2 cache code by 21 to the right. In order to make 2 MiB offsets. However, I

Re: pf nat-to doesn't match a crafted packet

2023-09-02 Thread Peter J. Philipp
On Sun, Sep 03, 2023 at 04:12:35AM +0200, Alexandr Nedvedicky wrote: > Hello, > > so there is actually bug. I was able to reproduce it with very simple > rules on my router: > > set skip on em1 > block return all > pass out on em0 from 192.168.2.0/24 to any nat-to(em0) > > em1 is

Re: riscv64: Fatal page fault at [amap_wiperange_chunk?]

2023-08-31 Thread Peter J. Philipp
On Thu, Aug 31, 2023 at 10:28:45AM +0200, Jeremie Courreges-Anglas wrote: > > First kernel crash during this ports bulk build, I have rebooted the > machine. No idea whether this is the usual memory corruption I see on > this hardware. > > OpenBSD/riscv64 (riscv64-4.ports.openbsd.org) (console)

Re: pf nat-to doesn't match a crafted packet

2023-08-29 Thread Peter J. Philipp
On Tue, Aug 29, 2023 at 11:11:53AM +0200, Alexandr Nedvedicky wrote: > Hello, > > On Tue, Aug 29, 2023 at 09:48:21AM +0200, Peter J. Philipp wrote: > > On Tue, Aug 29, 2023 at 09:45:24AM +1000, David Gwynne wrote: > > > How are you injecting the crafted packet into the

Re: pf nat-to doesn't match a crafted packet

2023-08-29 Thread Peter J. Philipp
On Tue, Aug 29, 2023 at 12:35:47PM +0200, Claudio Jeker wrote: > On Tue, Aug 29, 2023 at 12:16:23PM +0200, Peter J. Philipp wrote: > > On Tue, Aug 29, 2023 at 11:11:53AM +0200, Alexandr Nedvedicky wrote: > > > Hello, > > > > > > On Tue, Aug 29, 2023 at 09:4

Re: pf nat-to doesn't match a crafted packet

2023-08-29 Thread Peter J. Philipp
On Tue, Aug 29, 2023 at 11:11:53AM +0200, Alexandr Nedvedicky wrote: > Hello, > > On Tue, Aug 29, 2023 at 09:48:21AM +0200, Peter J. Philipp wrote: > > On Tue, Aug 29, 2023 at 09:45:24AM +1000, David Gwynne wrote: > > > How are you injecting the crafted packet into the

Re: pf nat-to doesn't match a crafted packet

2023-08-29 Thread Peter J. Philipp
On Mon, Aug 28, 2023 at 07:13:29PM +0100, Stuart Henderson wrote: > On 2023/08/28 18:30, Peter J. Philipp wrote: > > Here is my icmp rulesets: > > > > root@stern# grep icmp /etc/pf.conf > > a partial pf.conf fragment is hardly ever enough to debug a ruleset > prob

Re: pf nat-to doesn't match a crafted packet

2023-08-29 Thread Peter J. Philipp
On Tue, Aug 29, 2023 at 09:45:24AM +1000, David Gwynne wrote: > How are you injecting the crafted packet into the stack? Via BPF. It is a spoofing program that I made 23 years ago. While that's not really a great achievement it found at least 5 or so panic conditions on OpenBSD throughout its

Re: pf nat-to doesn't match a crafted packet

2023-08-28 Thread Peter J. Philipp
On Mon, Aug 28, 2023 at 06:18:41PM +0200, Alexandr Nedvedicky wrote: > Hello, > > On Mon, Aug 28, 2023 at 05:13:29PM +0200, p...@delphinusdns.org wrote: > > >Synopsis: pf nat-to doesn't match a crafted packet > > >Category: system > > >Environment: > > System : OpenBSD 7.3 > >

/usr/src/usr.bin/ssh/hmac.c improvement / calloc_conceal()

2023-08-14 Thread Peter J. Philipp
Hi, I spent most of the evening reading and programming on ssh/hmac.c. While the stuff I tried to do didn't work, here is something I believe will make the security better in any possible corefiles. We conceal the contents of the secret hmac key from being dumped. Also an update on a comment

Re: no termination on buffer

2023-08-12 Thread Peter J. Philipp
seek YYY below for comments On Thu, Aug 10, 2023 at 08:31:55PM +0200, p...@delphinusdns.org wrote: > >Synopsis:no termination on buffer > >Category:library > >Environment: > System : OpenBSD 7.3 > Details : OpenBSD 7.3 (GENERIC.MP) #2080: Sat Mar 25 14:20:25 MDT >

Re: buffer overprint in riscv64/cpu.c

2023-08-04 Thread Peter J. Philipp
On Tue, Aug 01, 2023 at 01:43:36PM +0200, p...@delphinusdns.org wrote: > >Synopsis:non-terminated strings buffer in riscv64/cpu.c > >Category:kernel > >Environment: > System : OpenBSD 7.3 > Details : OpenBSD 7.3-current (GENERIC.MP) #376: Thu Jul 13 > 03:59:40 MDT

Re: code reading in progress, potential FPE soft spots [part 2]

2023-07-30 Thread Peter J. Philipp
On Sat, Jul 29, 2023 at 03:23:47PM +0200, Peter J. Philipp wrote: > Hi, > > For a few hours I went grepping for MOD FPE conditions in the source code. > I did this systematically examining them and here is my recommendations in > form of patches for these spots. It's half the

code reading in progress, potential FPE soft spots

2023-07-29 Thread Peter J. Philipp
Hi, For a few hours I went grepping for MOD FPE conditions in the source code. I did this systematically examining them and here is my recommendations in form of patches for these spots. It's half the effort but I'm really wasted right now, and can't go on. Perhaps another time I'll continue.

Re: Samsung NVMe M.2 SSD 970 EVO Plus fails to attach on VisionFive 2 (JH7110 SoC) board

2023-07-28 Thread Peter J. Philipp
[tying in misc@ for this resource] On Fri, Jul 28, 2023 at 03:26:54PM +0200, develo...@robert-palm.de wrote: > Many thanks! Please, will you commit it so I can test it with the next > snapshot version ? I have already contacted Robert (?) privately, here it is publically. I have exported my

Re: delaying ptrace(2)'ing a process about to change credentials

2023-07-22 Thread Peter J. Philipp
On Sat, Jul 22, 2023 at 12:40:46PM -0700, Philip Guenther wrote: > On Sat, 22 Jul 2023, p...@delphinusdns.org wrote: > > >Synopsis: delaying ptrace(2)'ing a process about to change credentials > > >Category: kernel > > >Environment: > > System : OpenBSD 7.3 > > Details : OpenBSD

could there be a breach of license in efiboot?

2023-07-09 Thread Peter J. Philipp
Hi, the license here from: https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/stand/efi/include/README?rev=1.1=text/plain > /* $FreeBSD: head/sys/boot/efi/include/README 139738 2005-01-05 22:16:58Z imp $ */ /*- Files in this directory and subdirectories are subject to the

Re: pardon me

2023-07-07 Thread Peter J. Philipp
On Fri, Jul 07, 2023 at 03:36:22PM +0200, Mark Kettenis wrote: > > Date: Fri, 7 Jul 2023 15:30:37 +0200 > > From: "Peter J. Philipp" > > > > I'm looking into considering adding pins for the mango pi SBC (riscv64) and > > noticed this little file that has n

pardon me

2023-07-07 Thread Peter J. Philipp
I'm looking into considering adding pins for the mango pi SBC (riscv64) and noticed this little file that has no license: ---> riscv64# head /sys/dev/fdt/sxipio_pins.h /* Public Domain */ const struct sxipio_pin sun4i_a10_pins[] = { { SXIPIO_PIN(A, 0), { { "gpio_in",

Re: kernel panic in syscall "poll"

2023-06-16 Thread Peter J. Philipp
People, programmers, I couldn't reproduce this panic I tried twice with all sorts of enabling the console keyboard, disabling it and pressing the button to turn on/off the sound card which is included in the KVM switch. Some people mentioned to me off-list that they never got the backtrace:

Re: kernel panic in syscall "poll"

2023-06-16 Thread Peter J. Philipp
On Fri, Jun 16, 2023 at 02:30:27PM +0300, Vitaliy Makkoveev wrote: > On Fri, Jun 16, 2023 at 10:53:33AM +0200, Peter J. Philipp wrote: > > On Fri, Jun 16, 2023 at 10:40:30AM +0200, Peter J. Philipp wrote: > > > Sorry for no formatting and the bad quality photo, the kernel pa

Re: kernel panic in syscall "poll"

2023-06-16 Thread Peter J. Philipp
On Fri, Jun 16, 2023 at 10:40:30AM +0200, Peter J. Philipp wrote: > Sorry for no formatting and the bad quality photo, the kernel paniced on me > on process Xorg, when I turned on the sound card. I use fluxbox windows > manager if it's worth any. Odd is that it paniced on poll(). I h

Re: acme-client: name resolution error when specifying a port in the api url

2023-06-04 Thread Peter J. Philipp
On Sun, Jun 04, 2023 at 10:48:07AM +0200, Ronald Heggenberger wrote: > Hi! > > (sorry for the second attempt of this message - our domain was not configured > properly for mailing lists (dmarc reject) and I think the first attempt > probably wasn't processed properly) > > I am using step-ca to

Re: System won't Mount Western Digital Mybook external HD (System 76)

2023-04-25 Thread Peter J. Philipp
On Tue, Apr 25, 2023 at 11:11:18AM -0500, David Rogers wrote: > >Synopsis:?? Beginning with 7.2, system won't mount Western Digital > Mybook external HD > >Category:?? system > >Environment: > ??System?? : OpenBSD 7.3 > ??Details : OpenBSD 7.3 (GENERIC.MP) #1125:

Re: Hetzner arm64 Cloud

2023-04-25 Thread Peter J. Philipp
On Sun, Apr 23, 2023 at 06:28:00AM +0200, Patrick Wildt wrote: > ftp http://cdn.openbsd.org/pub/OpenBSD/snapshots/arm64/bsd.rd > rdsetroot -x bsd.rd > mr.fs > vnconfig vnd0 mr.fs > mount /dev/vnd0a /mnt > vim /mnt/auto_install.conf > umount /mnt > vnconfig -u vnd0 > rdsetroot bsd.rd mr.fs > > ftp

Re: Hetzner arm64 Cloud

2023-04-18 Thread Peter J. Philipp
On Tue, Apr 18, 2023 at 04:25:25PM +0200, Patrick Wildt wrote: > On Sun, Apr 16, 2023 at 11:39:33PM +0200, Patrick Wildt wrote: > > You can also simply dd the image to /dev/sda and reboot, but that still > > doesn't solve the problem. The bootup is hard to debug because the > > console is KVM and

Re: unwind is too noisy on sendto failures

2023-04-14 Thread Peter J. Philipp
On Fri, Apr 14, 2023 at 10:20:39AM -0600, Theo de Raadt wrote: > Doctor! Doctor! It hurts when I stick a knife in here! > > When you do weird, harsh, or unrealistic packet filtering, application > software will occasionally log that you are losing packets which should > not be filtered, to alert

Re: unwind is too noisy on sendto failures

2023-04-14 Thread Peter J. Philipp
On Fri, Apr 14, 2023 at 05:18:33PM +0200, Florian Obser wrote: > Sorry, this doesn't make any sense. > > I could never reproduce the -1 or > 65535 case reliably, I see it once > in a while, but I can't trigger it. I also can't reproduce it with your > instructions. > > As far as I can work out

Re: unwind is too noisy on sendto failures

2023-04-13 Thread Peter J. Philipp
On Mon, Apr 10, 2023 at 10:17:08AM +0200, Peter J. Philipp wrote: > On Sat, Apr 08, 2023 at 08:28:05PM +0200, Peter J. Philipp wrote: > /cut > > Apr 6 14:43:05 polarstern unwind[97893]: bad packet: too large: 65552 - > > pool.ntp.org. IN > > Apr 6 14:46:25 polar

Hetzner arm64 Cloud

2023-04-13 Thread Peter J. Philipp
Hi, Yesterday hetzner.com came out with arm64 cloud instances, I tried one out. Here is what I found. The images they give you a choice of does not include OpenBSD, so I had to get a ubuntu OS. That's fine the EFI partition was already mounted. Through trialing this I found the best way of

Re: unwind is too noisy on sendto failures

2023-04-10 Thread Peter J. Philipp
On Sat, Apr 08, 2023 at 08:28:05PM +0200, Peter J. Philipp wrote: /cut > Apr 6 14:43:05 polarstern unwind[97893]: bad packet: too large: 65552 - > pool.ntp.org. IN > Apr 6 14:46:25 polarstern unwind[97893]: bad packet: too large: 65552 - > pool.ntp.org.mainrechner.de. IN

Re: unwind is too noisy on sendto failures

2023-04-08 Thread Peter J. Philipp
On Fri, Apr 07, 2023 at 05:50:57PM +0200, p...@delphinusdns.org wrote: > >Synopsis:unwind is too noisy on sendto failures / it's misleading /cut > This leaves just one syslog for this: > > Apr 7 17:45:43 stern unwind[28804]: check_resolver_done: bad packet: too > short: -1 > /cut I

Re: segmentation fault in opensmtpd mda

2023-03-18 Thread Peter J. Philipp
On Sat, Mar 18, 2023 at 01:10:49PM -0600, Todd C. Miller wrote: > Thanks, I was unable to get a backtrace so this really helped. I > think the safest thing to do is to just return an error if the > expanded string is NULL. I'm not sure if there are other expansions > that can also be NULL here.

Re: segmentation fault in opensmtpd mda

2023-03-18 Thread Peter J. Philipp
On Sat, Mar 18, 2023 at 03:06:43PM +0100, p...@delphinusdns.org wrote: > >Synopsis:segmentation fault in opensmtpd mda > >Category:system > >Environment: > System : OpenBSD 7.2 > Details : OpenBSD 7.2 (GENERIC.MP) #2: Thu Nov 24 23:53:03 MST 2022 >

manpage malloc.9 documentation bug

2023-03-17 Thread Peter J. Philipp
Sync manpage malloc.9 with reality (disregarding M_LAST). Notice it shows up in sysctl kern.malloc.kmemnames as "log". Best Regards, -peter Index: malloc.9 === RCS file: /cvs/src/share/man/man9/malloc.9,v retrieving revision 1.68

Re: resistance against single-even upsets

2023-03-14 Thread Peter J. Philipp
On Tue, Mar 14, 2023 at 10:34:48AM -0600, Theo de Raadt wrote: > Good god, imagine this bit flip happened *anywhere else*, like in the > page tables, or in the code or data or stack of chrome, or basically > *anywhere* > > Shall we change them all? The example I gave was the last resort other

Re: unsafe macro in tcpdump/print-ike.c and /etc/tcpdump.conf

2023-03-07 Thread Peter J. Philipp
On Tue, Mar 07, 2023 at 09:35:28AM +0100, p...@delphinusdns.org wrote: > >Synopsis:unsafe macro in tcpdump/print-ike.c and /etc/tcpdump.conf > >Category:user > >Environment: > System : OpenBSD 7.2 > Details : OpenBSD 7.2 (GENERIC.MP) #2: Thu Nov 24 23:53:03 MST 2022 >

Re: unsafe macro in tcpdump/print-ike.c and /etc/tcpdump.conf

2023-03-07 Thread Peter J. Philipp
On Tue, Mar 07, 2023 at 09:35:28AM +0100, p...@delphinusdns.org wrote: > >Synopsis:unsafe macro in tcpdump/print-ike.c and /etc/tcpdump.conf I hope I made some impact on this. Let me spice it up a little more with an updated /etc/tcpdump.conf file. I forgot to add ntp to the default so I

Re: possible segmentation violation in login_radius

2023-03-02 Thread Peter J. Philipp
On Thu, Mar 02, 2023 at 09:31:57AM -0700, Theo de Raadt wrote: > Using a global variable like that is poor style. OK, I'm gonna give it one more attempt: In RFC 2865 there is no auth code for discarding a message but there is a 255 reserved value which we may be able to use as a hack. Refer to

Re: possible segmentation violation in login_radius

2023-03-02 Thread Peter J. Philipp
On Thu, Mar 02, 2023 at 09:09:31AM -0700, Todd C. Miller wrote: > On Thu, 02 Mar 2023 09:07:38 -0700, "Theo de Raadt" wrote: > > > + if (auth.length > total_length) > > > > Isn't auth.length a network byte order value? > > Ah yes, good catch; it needs an ntohs(). > > - todd Hi, I just

Re: possible segmentation violation in login_radius

2023-03-02 Thread Peter J. Philipp
On Thu, Mar 02, 2023 at 08:56:10AM -0700, Todd C. Miller wrote: > The following patch should fix the problem, can you try it out? > > - todd Hi Todd, thanks for the quick patch that was really awesome! I modified it a little to use ntohs(auth.length) in the length check. Other than that it

Re: tcpdump/print-cdp.c

2023-03-01 Thread Peter J. Philipp
On Mon, Feb 27, 2023 at 11:09:29AM +0100, Peter J. Philipp wrote: > Please give this some scrutiny and commit it to util if you like it. Until > then I view this bug report as AWAITING RESPONSE :-). OK, 2 seconds after I sent this I found 3 things wrong with it, so here it is again and i

Re: tcpdump/print-cdp.c

2023-02-27 Thread Peter J. Philipp
On Sat, Feb 25, 2023 at 09:28:13AM -0300, Crystal Kolipe wrote: > On Sat, Feb 25, 2023 at 11:55:50AM +0100, Peter J. Philipp wrote: > > I have found this function in tcpdump/util.c called fn_printn() that escapes > > text. > > Why would we want to use this function in

Re: Possibly wrong information in tcpdump/print-domain.c

2023-02-26 Thread Peter J. Philipp
See below quoted text. On Sun, Feb 26, 2023 at 03:08:42PM +0100, p...@delphinusdns.org wrote: > >Synopsis:Possibly wrong information in tcpdump/print-domain.c > >Category:user > >Environment: > System : OpenBSD 7.2 > Details : OpenBSD 7.2 (GENERIC.MP) #2: Thu Nov 24

Re: possible underflow (wrap) in tcpdump/print-domain.c

2023-02-26 Thread Peter J. Philipp
> You also need to have a closer look. > Line 603 is in > if (DNS_QR(np)) { > Line 686 is in the corresponding else block. So there is no way to get > from 603 into 686 and 690. > > -- > :wq Claudio Arghh, you're right! I'm forever shamed :-(. Good call! Best Regards, -peter

Re: possible underflow (wrap) in tcpdump/print-domain.c

2023-02-26 Thread Peter J. Philipp
On Sun, Feb 26, 2023 at 10:17:53AM +0100, Claudio Jeker wrote: > On Sun, Feb 26, 2023 at 09:52:43AM +0100, p...@delphinusdns.org wrote: > > >Synopsis: possible underflow (wrap) in tcpdump/print-domain.c > > >Category: system > > >Environment: > > System : OpenBSD 7.2 > > Details

Re: tcpdump/print-cdp.c

2023-02-25 Thread Peter J. Philipp
On Sat, Feb 25, 2023 at 09:28:13AM -0300, Crystal Kolipe wrote: > On Sat, Feb 25, 2023 at 11:55:50AM +0100, Peter J. Philipp wrote: > > I have found this function in tcpdump/util.c called fn_printn() that escapes > > text. > > Why would we want to use this function in

Re: tcpdump/print-cdp.c

2023-02-25 Thread Peter J. Philipp
On Thu, Feb 23, 2023 at 11:00:12AM -0700, Theo de Raadt wrote: > It should use vis(3), similar to this: > > print-pfsync.c: cp = vis(cp, clr->ifname[i], VIS_WHITE, 0); [ see bottom of quoted message or search down to PJP ] > p...@delphinusdns.org wrote: > > > >Synopsis:

Re: tcpdump/print-cdp.c

2023-02-24 Thread Peter J. Philipp
On Thu, Feb 23, 2023 at 11:00:12AM -0700, Theo de Raadt wrote: > It should use vis(3), similar to this: > > print-pfsync.c: cp = vis(cp, clr->ifname[i], VIS_WHITE, 0); Looking at print-pfsync.c since you mentioned it... I think this function pfsync_print_clr() can be changed to

Re: possible underflow in tcpdump/print-gre.c

2023-02-22 Thread Peter J. Philipp
On Mon, Feb 20, 2023 at 02:39:45PM +0100, p...@delphinusdns.org wrote: > >Synopsis:possible underflow in tcpdump/print-gre.c > >Category:user > >Environment: > System : OpenBSD 7.2 > Details : OpenBSD 7.2 (GENERIC.MP) #2: Thu Nov 24 23:53:03 MST 2022 >

Re: possible underflow in tcpdump/print-gre.c

2023-02-20 Thread Peter J. Philipp
On Mon, Feb 20, 2023 at 04:39:57PM +0100, Peter J. Philipp wrote: > I checked for files with the copyright by jason and found another underflow, > in another file. It seems that this is an idiom of his. This seems > non-exploitable, but it allows one to underflow the length of a

Re: possible underflow in tcpdump/print-gre.c

2023-02-20 Thread Peter J. Philipp
I checked for files with the copyright by jason and found another underflow, in another file. It seems that this is an idiom of his. This seems non-exploitable, but it allows one to underflow the length of a STP frame to REALLY big. from tcpdump/print-stp.c: -> if (len < 3)

Re: Fwd: hvn0 inet6 duplicate storm

2022-12-05 Thread Peter J. Philipp
Inline below: On 11/14/22 15:36, Peter J. Philipp wrote: On 11/14/22 15:16, Klemens Nanni wrote: On Sun, Nov 13, 2022 at 12:46:26PM +0100, Peter J. Philipp wrote: appended are the screenshots of the Hyper-v, bug report follows in the forwarded message.  Please treat this as low priority, I

Re: Fwd: hvn0 inet6 duplicate storm

2022-11-14 Thread Peter J. Philipp
On 11/14/22 15:16, Klemens Nanni wrote: On Sun, Nov 13, 2022 at 12:46:26PM +0100, Peter J. Philipp wrote: appended are the screenshots of the Hyper-v, bug report follows in the forwarded message.  Please treat this as low priority, I can do work with IPv4 on this.  Also one thing I forgot

Re: Information leakage of IP-layer data on LAN

2022-08-22 Thread Peter J. Philipp
On Mon, Aug 22, 2022 at 08:15:13PM +0200, Alexander Bluhm wrote: > Do you have a "block return" in your pf.conf? Yes. > Does it work differently if you disable pf with pfctl -d? Yes it does. No return packet. > How does your pf.conf filter to such packets? I think it's the default pf.conf, I

Re: panic on a macbook pro

2021-12-17 Thread Peter J. Philipp
On Fri, Dec 17, 2021 at 06:44:57PM +0300, Vitaliy Makkoveev wrote: > > On 17 Dec 2021, at 18:37, Peter J. Philipp wrote: > > > > On Fri, Dec 17, 2021 at 06:06:51PM +0300, Vitaliy Makkoveev wrote: > >> Hi, > >> > >> According to your dmesg output

Re: panic on a macbook pro

2021-12-17 Thread Peter J. Philipp
On Fri, Dec 17, 2021 at 08:09:38AM -0700, Theo de Raadt wrote: > macppc snapshots take almost a week, and since this is a slower architecture, > are more likely to be interrupted/restarted because of trying to catch up to > later work. I dunno, I had no keyboard at the ddb prompt. Dunno why. It

Re: panic on a macbook pro

2021-12-17 Thread Peter J. Philipp
On Fri, Dec 17, 2021 at 06:06:51PM +0300, Vitaliy Makkoveev wrote: > Hi, > > According to your dmesg output this snapshot is form December 15 > > dmesg: > > OpenBSD 7.0-current (GENERIC.MP) #172: Wed Dec 15 15:35:28 MST 2021 > >

Re: pppoe(4) should use uptime not microtime() for tracking connection time

2021-11-23 Thread Peter J. Philipp
On Mon, Nov 22, 2021 at 01:40:34PM +, Klemens Nanni wrote: > On Mon, Nov 22, 2021 at 09:30:13AM +0100, Claudio Jeker wrote: > > > Index: sbin/ifconfig/ifconfig.c > > > === > > > RCS file: /cvs/src/sbin/ifconfig/ifconfig.c,v > > >

Re: pppoe(4) should use uptime not microtime() for tracking connection time

2021-11-21 Thread Peter J. Philipp
On Mon, Nov 22, 2021 at 12:30:19AM +, Klemens Nanni wrote: > On Sun, Nov 21, 2021 at 11:18:29AM +0100, p...@delphinusdns.org wrote: > > >Synopsis: session uptime is wrong > > >Category: system > > >Environment: > > System : OpenBSD 7.0 > > Details : OpenBSD 7.0 (GENERIC.MP)

Re: Opening and closing /dev/bpf rapidly freezes Raspberry Pi (bse0)

2021-10-23 Thread Peter J. Philipp
On Sat, Oct 23, 2021 at 03:36:53AM +, Visa Hankala wrote: (cut) > > >Fix: > > None provided. Unfortunately I don't have a DDB capable console. > > Thank you for the report. It looks that the bug is generic and not > specific to the machine. > > On amd64, the test program triggers the

Re: bus error on octeon

2021-09-16 Thread Peter J. Philipp
On Wed, Sep 15, 2021 at 01:04:07PM +, Visa Hankala wrote: [cut] > > No bus errors again, though I don't know if it's the right approach. The > > nonces in the tcpdump were sequential counting up from 1 as my wireguard > > hardware was rebooting. I think I control-c'ed by 218 nonce or so. >

Re: bus error on octeon

2021-09-14 Thread Peter J. Philipp
On Tue, Sep 14, 2021 at 10:48:44AM -0600, Theo de Raadt wrote: > Mark Kettenis wrote: > > > To be honest, I do think that adding __packed is a reasonable way to > > handle protocol structs like this where performance doesn't really > > matter. This translates into __attribute__((packed)) and

Re: bus error on octeon

2021-09-14 Thread Peter J. Philipp
On Tue, Sep 14, 2021 at 01:29:05PM +, Visa Hankala wrote: > On Tue, May 04, 2021 at 07:29:20AM +0200, Peter J. Philipp wrote: [some of my earlier mail cut] > data->nonce is the (most) offending variable because it needs 8-byte > alignment. > > An alternative to memcpy() i

Re: double fault while using IPSec/iked

2021-07-08 Thread Peter J. Philipp
Hi Alexander, https://marc.info/?l=openbsd-misc=162567717723373=2 Could this be related to my problem? I don't have a panic but it does hang up with a FIN sometime during the transfer. I noticed it outside of the IPSEC though which is not exactly the same thing though. For me to test I'd have

this bugpatch did not make it

2021-05-31 Thread Peter J. Philipp
Hi, Early this month I produced a patch, nothing since 6.9 was committed in print-wg.c, I just want to bring this to your attention: https://marc.info/?l=openbsd-bugs=162005952303873=2 Best Regards, -peter

Re: dc strips leading 0's in 2o output, is this wanted?

2021-05-16 Thread Peter J. Philipp
On Sun, May 16, 2021 at 02:54:39PM +0200, Otto Moerbeek wrote: [..] > > > >Fix: > > > Not provided, sorry, I did look at the source code but this seems > > > beyond me at first glance, and I'm not even sure if I'm using dc > > > right. > > > > > > > How can stripping leading zeros lead to

Re: bus error on octeon

2021-05-03 Thread Peter J. Philipp
> I produced a patch for you, but it's not complete but works around the SIGBUS: > > Index: print-wg.c > === > RCS file: /cvs/src/usr.sbin/tcpdump/print-wg.c,v > retrieving revision 1.6 > diff -u -p -u -r1.6 print-wg.c > ---

Re: bus error on octeon

2021-05-03 Thread Peter J. Philipp
printf("to 0x%08x nonce %llu", - letoh32(data->receiver), letoh64(data->nonce)); + letoh32(receiver), letoh64(nonce)); break; } return; There may be other variables that need the same treatment... if that l

Re: bus error on octeon

2021-05-03 Thread Peter J. Philipp
On Mon, May 03, 2021 at 08:27:57AM -0600, Theo de Raadt wrote: > Can you reproduce this, and capture core files? Yes after a reboot I could reproduce it, I didn't even have to cycle the interfaces. I got a coredump like you descriped for me. See below: > Since our tcpdump is a privsep program,

Re: bus error on octeon

2021-05-03 Thread Peter J. Philipp
Yup I'll try. Give me bit of time to find results. Best Regards, -peter On Mon, May 03, 2021 at 08:27:57AM -0600, Theo de Raadt wrote: > Can you reproduce this, and capture core files? > > Since our tcpdump is a privsep program, getting a core is a bit harder. > > mkdir /var/crash/tcpdump >

Re: getaddrinfo() is not thread-safe in 6.8

2020-12-23 Thread Peter J. Philipp
On Wed, Dec 23, 2020 at 11:58:30PM -0700, Theo de Raadt wrote: > Brad Smith wrote: > > > On 12/23/2020 10:35 PM, Alexey Sokolov wrote: > > >> Synopsis:getaddrinfo() is not thread-safe in 6.8 > > >> Category:system > > >> Environment: > > > System : OpenBSD 6.8 > > >

Re: endless loop in tcpdump

2020-10-26 Thread Peter J. Philipp
On Mon, Oct 26, 2020 at 08:23:15AM +0100, Peter J. Philipp wrote: > On the other screen then where I had a tcpdump on port (pretend it was > 53): ok sorry, that was a half-truth. I tried this out and it seems the DNS is printed over the 2123 port. However DNS on another port

Re: endless loop in tcpdump

2020-10-26 Thread Peter J. Philipp
On Sun, Oct 25, 2020 at 12:15:22AM +0200, Jeremie Courreges-Anglas wrote: > > dunno why the strange combination of To/Cc headers so I'll keep bugs@ in Cc: My answer is inline below: > On Sat, Oct 24 2020, p...@centroid.eu wrote: > >>Synopsis: a specially crafted packet can set tcpdump into an

kernel panic when invoking cu

2020-07-20 Thread Peter J. Philipp
Hi, I have a screenshot of a kernel panic when I typed cu in a snapshot that I just downloaded. The panic string is: panic: kernel diagnositc assertion "p->p_wchan == NULL" failed: file "/usr/src/sys/kern/kern_sched.c", line 353 Unfortunately I don't have very much time today so that's all

Re: Gif0 add to bridge

2020-01-22 Thread Peter J. Philipp
On Wed, Jan 22, 2020 at 03:32:19PM +0100, igor kos wrote: > Bsd 6.6, > > Ifconfig bridge0 add gif0 > Ifconfig: bridge0: gif0: invalid argument I do not think gif(4) is a ethernet device, which is what bridge(4) requires. Try doing this with a vxlan(4) device. man vxlan man bridge man gif

Re: Install on Power Mac G5 , PowerMac 7.2

2020-01-05 Thread Peter J. Philipp
On Sun, Jan 05, 2020 at 07:39:10AM +, Sid Holliday wrote: > After installing I went to the firmware and typed in 'boot hd:/ofwboot/bsd > then got this response: Not a ATA device can't open > here is a picture of my hard drive. > Any help would be greatly appreciated. Hi, In openfirmware it's

[p...@centroid.eu: December 26th snapshot bsd.rd is panic'ing]

2019-12-27 Thread Peter J. Philipp
Hi Bugs, Turns out it was the USB stick I left in the USB 3.0 hub. -> umass0 at uhub8 port 4 configuration 1 interface 0 "JetFlash Mass Storage Device" rev 3.20/11.00 addr 3 umass0: using SCSI over Bulk-Only scsibus2 at umass0: 2 targets, initiator 0 sd0 at scsibus2 targ 1 lun 0: removable

  1   2   >