svn commit: r468996 - in head/mail: opensmtpd opensmtpd-devel opensmtpd-devel/files opensmtpd/files

[Dima Panov]

Author: fluffy
Date: Thu May  3 23:17:24 2018
New Revision: 468996
URL: https://svnweb.freebsd.org/changeset/ports/468996

Log:
  - Prevent OpenSMTPD session hangs and retain a descriptor forever on empty body
      (i.e. when the dot appears on the line directly after the headers).
      This could be used by an attacker to exhaust resources.
  
  PR:		227899
  Submitted by:	grembo
  Obtained from:	OpenSMTPD git repo (backported)
  MFH:		2018Q2

Added:
  head/mail/opensmtpd-devel/files/patch-smtpd-rfc2822.c   (contents, props changed)
  head/mail/opensmtpd-devel/files/patch-smtpd-smtp_session.c   (contents, props changed)
  head/mail/opensmtpd/files/patch-smtpd-rfc2822.c   (contents, props changed)
  head/mail/opensmtpd/files/patch-smtpd-smtp_session.c   (contents, props changed)
Modified:
  head/mail/opensmtpd-devel/Makefile
  head/mail/opensmtpd/Makefile

Modified: head/mail/opensmtpd-devel/Makefile
==============================================================================
--- head/mail/opensmtpd-devel/Makefile	Thu May  3 23:10:11 2018	(r468995)
+++ head/mail/opensmtpd-devel/Makefile	Thu May  3 23:17:24 2018	(r468996)
@@ -4,7 +4,7 @@
 PORTNAME=	opensmtpd
 PORTVERSION=	201606220754
 DISTVERSIONSUFFIX=	p1
-PORTREVISION=	4
+PORTREVISION=	5
 PORTEPOCH=	1
 CATEGORIES=	mail
 MASTER_SITES=	http://www.opensmtpd.org/archives/ \

Added: head/mail/opensmtpd-devel/files/patch-smtpd-rfc2822.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/mail/opensmtpd-devel/files/patch-smtpd-rfc2822.c	Thu May  3 23:17:24 2018	(r468996)
@@ -0,0 +1,19 @@
+--- smtpd/rfc2822.c.orig	2018-05-01 13:33:10.000000000 +0000
++++ smtpd/rfc2822.c	2018-05-01 13:34:47.931554000 +0000
+@@ -53,4 +53,7 @@
+ 	struct rfc2822_hdr_miss_cb	*hdr_miss_cb;
++ 	
++ 	if (!rp->in_hdr)
++		goto end;
+ 
+ 	TAILQ_FOREACH(hdr_cb, &rp->hdr_cb, next)
+ 	    if (strcasecmp(hdr_cb->name, rp->header.name) == 0) {
+@@ -151,6 +152,8 @@
+ 		return;
+ 
+ 	header_callback(rp);
++
++	missing_headers_callback(rp);
+ }
+ 
+ void

Added: head/mail/opensmtpd-devel/files/patch-smtpd-smtp_session.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/mail/opensmtpd-devel/files/patch-smtpd-smtp_session.c	Thu May  3 23:17:24 2018	(r468996)
@@ -0,0 +1,11 @@
+--- smtpd/smtp_session.c.orig	2018-05-01 13:35:00.375262000 +0000
++++ smtpd/smtp_session.c	2018-05-01 13:37:22.637096000 +0000
+@@ -1345,6 +1345,8 @@
+ 			s->dataeom = 1;
+ 			if (iobuf_queued(&s->obuf) == 0)
+ 				smtp_data_io_done(s);
++			else
++				io_reload(&s->oev);
+ 			return;
+ 		}
+ 

Modified: head/mail/opensmtpd/Makefile
==============================================================================
--- head/mail/opensmtpd/Makefile	Thu May  3 23:10:11 2018	(r468995)
+++ head/mail/opensmtpd/Makefile	Thu May  3 23:17:24 2018	(r468996)
@@ -4,7 +4,7 @@
 PORTNAME=	opensmtpd
 PORTVERSION=	5.9.2p1
 PORTEPOCH=	1
-PORTREVISION=	5
+PORTREVISION=	6
 CATEGORIES=	mail
 MASTER_SITES=	http://www.opensmtpd.org/archives/ \
 		http://distfiles.pirateparty.in/ashish/

Added: head/mail/opensmtpd/files/patch-smtpd-rfc2822.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/mail/opensmtpd/files/patch-smtpd-rfc2822.c	Thu May  3 23:17:24 2018	(r468996)
@@ -0,0 +1,19 @@
+--- smtpd/rfc2822.c.orig	2018-05-01 13:33:10.000000000 +0000
++++ smtpd/rfc2822.c	2018-05-01 13:34:47.931554000 +0000
+@@ -53,4 +53,7 @@
+ 	struct rfc2822_hdr_miss_cb	*hdr_miss_cb;
++ 	
++ 	if (!rp->in_hdr)
++		goto end;
+ 
+ 	TAILQ_FOREACH(hdr_cb, &rp->hdr_cb, next)
+ 	    if (strcasecmp(hdr_cb->name, rp->header.name) == 0) {
+@@ -151,6 +152,8 @@
+ 		return;
+ 
+ 	header_callback(rp);
++
++	missing_headers_callback(rp);
+ }
+ 
+ void

Added: head/mail/opensmtpd/files/patch-smtpd-smtp_session.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/mail/opensmtpd/files/patch-smtpd-smtp_session.c	Thu May  3 23:17:24 2018	(r468996)
@@ -0,0 +1,11 @@
+--- smtpd/smtp_session.c.orig	2018-05-01 13:35:00.375262000 +0000
++++ smtpd/smtp_session.c	2018-05-01 13:37:22.637096000 +0000
+@@ -1345,6 +1345,8 @@
+ 			s->dataeom = 1;
+ 			if (iobuf_queued(&s->obuf) == 0)
+ 				smtp_data_io_done(s);
++			else
++				io_reload(&s->oev);
+ 			return;
+ 		}
+