openbsd/src/lib/libcrypto, branch libressl-v2.3.2 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v2.3.2 2016-01-04T02:04:56+00:00 Calling clone(2) with CLONE_NEWPID yields multiple processes with pid=1. 2016-01-04T02:04:56+00:00 bcook 2016-01-04T02:04:56+00:00 urn:sha1:0f894628446dec0db2f00dac168dac6bcb7dd705 Work around this particular case by reseeding whenever pid=1, but as guenther@ notes, directly calling clone(2), and then forking to match another pid, provides other ways to bypass new process detection on Linux. Hopefully at some point Linux implements something like MAP_INHERIT_ZERO, and does not invent a corresponding mechanism to subvert it. Noted by Sebastian Krahmer and the opmsg team. See http://stealth.openwall.net/crypto/randup.c for a test program. ok beck@ More adress -> address 2015-12-24T05:50:16+00:00 mmcc 2015-12-24T05:50:16+00:00 urn:sha1:c9941e688a2d017068fd83419a3e3346b270db54 remove NULL-checks before free() 2015-12-23T20:37:23+00:00 mmcc 2015-12-23T20:37:23+00:00 urn:sha1:0acfd6965d2e7de3e9d3fff1348f689e59164fb7 assign pointer NULL rather than 0 2015-12-23T01:50:26+00:00 mmcc 2015-12-23T01:50:26+00:00 urn:sha1:9aa6664d2b19fc6a669e2d548bbb7e3bec9e6012 assign pointer to NULL rather than 0 2015-12-23T01:46:33+00:00 mmcc 2015-12-23T01:46:33+00:00 urn:sha1:def92b9d687af788e21407f183715d0811b6fbf4 initialize a pointer to NULL rather than 0 2015-12-22T08:44:44+00:00 mmcc 2015-12-22T08:44:44+00:00 urn:sha1:76a9959cf18079f893f945dd59dde8adadd0d1d6 Remove "C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification 2015-12-15T20:23:51+00:00 sthen 2015-12-15T20:23:51+00:00 urn:sha1:5fb069e3ba55af146badaa0793c0d70bdde639ab Authority" (serial 3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:be) root certificate from cert.pem. ok rpe@ Symantec/VeriSign say "Browsers/root store operators are encouraged to remove/untrust this root from their root stores" and "hasn't been used to generate new certificates in several years, and will now be repurposed to provide transition support for some of our enterprise customers' legacy, non-public applications" (https://www.symantec.com/page.jsp?id=roots, http://www.scmagazine.com/google-will-remove-trust-of-symantecs-pca3-g1-certificate/article/459688/). Also see https://knowledge.symantec.com/support/ssl-certificates-support/index?page=content&id=ALERT1941 https://googleonlinesecurity.blogspot.co.uk/2015/12/proactive-measures-in-digital.html initialize ext_len to 0. 2015-12-14T03:39:14+00:00 beck 2015-12-14T03:39:14+00:00 urn:sha1:c5249151abeb246faa9d2abd4f8cce971592ac97 ok guenther@ initialize ok to 0 2015-12-14T03:38:13+00:00 beck 2015-12-14T03:38:13+00:00 urn:sha1:545369100a8463914bf7c95aeeca1f420d169b55 ok guenther@ initialize md_len to 0 for readability to quell warnings. 2015-12-14T03:37:27+00:00 beck 2015-12-14T03:37:27+00:00 urn:sha1:c1ec90cf2a4dbdfb4c30be01c8dac1134af28146 ok guenther@