Pullup previous changes on HEAD to pkgsrc-2010Q2 branch to fix branching
error, and to sync with reality.


(agc)

$NetBSD: patch-ac,v 1.14.4.2 2010/07/04 07:28:54 agc Exp $

Fix for CVE-2010-2074 taken from here:

http://www.openwall.com/lists/oss-security/2010/06/14/4

--- fm.h.orig	2007-05-30 05:47:24.000000000 +0100
+++ fm.h	2010-07-01 19:26:27.000000000 +0100
@@ -1119,7 +1119,7 @@
 #endif
 
 #if defined(USE_SSL) && defined(USE_SSL_VERIFY)
-global int ssl_verify_server init(FALSE);
+global int ssl_verify_server init(TRUE);
 global char *ssl_cert_file init(NULL);
 global char *ssl_key_file init(NULL);
 global char *ssl_ca_path init(NULL);
@@ -1128,7 +1128,7 @@
 #endif				/* defined(USE_SSL) &&
 				 * defined(USE_SSL_VERIFY) */
 #ifdef USE_SSL
-global char *ssl_forbid_method init(NULL);
+global char *ssl_forbid_method init("2");
 #endif
 
 global int is_redisplay init(FALSE);

$NetBSD: patch-ad,v 1.8.4.2 2010/07/04 07:28:54 agc Exp $

Fix for CVE-2010-2074 taken from here:

http://www.openwall.com/lists/oss-security/2010/06/14/4

--- istream.c.orig	2007-05-23 16:06:05.000000000 +0100
+++ istream.c	2010-07-01 19:31:00.000000000 +0100
@@ -447,8 +447,17 @@
 
 		    if (!seen_dnsname)
 			seen_dnsname = Strnew();
+		    /* replace \0 to make full string visible to user */
+		    if (sl != strlen(sn)) {
+			int i;
+			for (i = 0; i < sl; ++i) {
+			    if (!sn[i])
+				sn[i] = '!';
+			}
+		    }
 		    Strcat_m_charp(seen_dnsname, sn, " ", NULL);
-		    if (ssl_match_cert_ident(sn, sl, hostname))
+		    if (sl == strlen(sn) /* catch \0 in SAN */
+			&& ssl_match_cert_ident(sn, sl, hostname))
 			break;
 		}
 	    }
@@ -466,16 +475,27 @@
     if (match_ident == FALSE && ret == NULL) {
 	X509_NAME *xn;
 	char buf[2048];
+	int slen;
 
 	xn = X509_get_subject_name(x);
 
-	if (X509_NAME_get_text_by_NID(xn, NID_commonName,
-				      buf, sizeof(buf)) == -1)
+	slen = X509_NAME_get_text_by_NID(xn, NID_commonName, buf, sizeof(buf));
+	if ( slen == -1)
 	    /* FIXME: gettextize? */
 	    ret = Strnew_charp("Unable to get common name from peer cert");
-	else if (!ssl_match_cert_ident(buf, strlen(buf), hostname))
+	else if (slen != strlen(buf)
+		|| !ssl_match_cert_ident(buf, strlen(buf), hostname)) {
+	    /* replace \0 to make full string visible to user */
+	    if (slen != strlen(buf)) {
+		int i;
+		for (i = 0; i < slen; ++i) {
+		    if (!buf[i])
+			buf[i] = '!';
+		}
+	    }
 	    /* FIXME: gettextize? */
 	    ret = Sprintf("Bad cert ident %s from %s", buf, hostname);
+	}
 	else
 	    match_ident = TRUE;
     }

$NetBSD: patch-ad,v 1.5.2.2 2010/07/04 07:28:55 agc Exp $

--- Makefile.in.orig	2010-06-27 19:40:00.000000000 +0000
+++ Makefile.in
@@ -21,7 +21,7 @@ build:
 # handled via the dependency on the build target.
 #
 install: build
-	$(PYTHON) install.py -q install --skip-build --home "$(prefix)"
+	$(PYTHON) install.py -q install --skip-build --home ${DESTDIR}$(prefix)
 
 check test: build
 	$(PYTHON) test.py $(TESTOPTS)