Re: OpenSSH hole, April 9

2014-04-09 Thread Theo de Raadt
>Thanks for the clarification. > >I would also like to thank whomever for the extra descriptive text on >the openssl patch issued the other day. Having the clarification on >the (non)impact on OpenSSH right in the patch was good ... You are welcome. Stuart Henderson wrote the draft, but he forgo

Re: OpenSSH hole, April 9

2014-04-09 Thread STeve Andre'
On 04/09/14 16:49, Devin Reade wrote: Quoting Theo de Raadt : If tomorrow Damien or I had to announce a major OpenSSH hole, how screwed would the Internet be? Would you mind clarifying this a bit? Was the post strictly a (justified) comment about the lack of funding, or should we be anticipa

Re: OpenSSH hole, April 9

2014-04-09 Thread Devin Reade
Thanks for the clarification. I would also like to thank whomever for the extra descriptive text on the openssl patch issued the other day. Having the clarification on the (non)impact on OpenSSH right in the patch was good ... Devin

Re: OpenSSH hole, April 9

2014-04-09 Thread Bob Beck
On Wed, Apr 09, 2014 at 02:49:21PM -0600, Devin Reade wrote: > Quoting Theo de Raadt : > > >If tomorrow Damien or I had to announce a major OpenSSH hole, how > >screwed would the Internet be? > > Would you mind clarifying this a bit? Was the post strictly a > (justified) comment about the lack o

Re: OpenSSH hole, April 9

2014-04-09 Thread Devin Reade
Quoting Theo de Raadt : If tomorrow Damien or I had to announce a major OpenSSH hole, how screwed would the Internet be? Would you mind clarifying this a bit? Was the post strictly a (justified) comment about the lack of funding, or should we be anticipating another announcement in addition t

relayd SSL/TLS keep RSA private keys in separate process

2014-04-09 Thread Reyk Floeter
Hi, relayd uses privsep to mitigate the risk of potential attacks. OpenSSL's SSL code wasn't designed with privsep in mind. We already have a hack to load the keys and certificates in the parent process and to send them via imsg to the chroot'ed relays; OpenSSL normally wants to load them from fi

Re: p2p interfaces and route to loopback

2014-04-09 Thread Martin Pieuchot
On 09/04/14(Wed) 11:22, Martin Pieuchot wrote: > When an IPv6 address is configured on a point-to-point interface, it > is associated to nd6_rtrequest(). This is because nd6_request() > contains a hack to automatically create a route to loopback for p2p > interfaces. > > The resulting route looks

p2p interfaces and route to loopback

2014-04-09 Thread Martin Pieuchot
When an IPv6 address is configured on a point-to-point interface, it is associated to nd6_rtrequest(). This is because nd6_request() contains a hack to automatically create a route to loopback for p2p interfaces. The resulting route looks like this: fe80::300:245f:fedc:22f8%pppoe0link#12