emaste
27891556e1
portsnap: only move expected snapshot contents from snap/ to files/
...
Previously it was possible to smuggle in addional files that would
be used by later portsnap runs. Now we only move those files expected
to be in the snapshot into files/ and require that there are no
unexpected files.
This was used by portsnap attacks 2, 3, and 4 in the "non-cryptanalytic
attacks against FreeBSD update components" anonymous gist.
Reported by: anonymous gist
Reviewed by: allanjude, delphij
MFC after: ASAP
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D8052
2016-09-28 21:22:51 +00:00
..
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-06 10:13:49 +00:00
2016-05-27 06:22:24 +00:00
2016-09-14 01:47:01 +00:00
2016-08-09 19:46:05 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-14 11:20:58 +00:00
2016-09-21 13:02:43 +00:00
2016-05-27 06:22:24 +00:00
2016-06-26 14:44:01 +00:00
2016-05-27 06:22:24 +00:00
2016-06-03 19:25:30 +00:00
2016-06-03 19:25:30 +00:00
2016-08-29 19:40:46 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-06-16 21:14:25 +00:00
2016-09-05 08:42:36 +00:00
2016-09-24 15:11:27 +00:00
2016-05-27 06:22:24 +00:00
2016-07-20 15:00:05 +00:00
2016-08-25 19:36:58 +00:00
2016-05-27 06:22:24 +00:00
2016-07-23 05:49:18 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-06-16 12:08:25 +00:00
2016-07-20 18:41:47 +00:00
2016-09-02 03:15:54 +00:00
2016-09-01 23:21:08 +00:00
2016-08-25 05:22:53 +00:00
2016-08-25 05:22:53 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-08-29 22:48:36 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-22 07:55:07 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-08 15:53:49 +00:00
2016-09-21 10:58:58 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-14 16:34:52 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-18 14:48:28 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-06-23 23:13:14 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-21 11:22:19 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-08-25 05:22:53 +00:00
2016-07-14 20:15:55 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-30 20:41:55 +00:00
2016-05-27 06:22:24 +00:00
2016-08-02 21:48:26 +00:00
2016-08-23 13:43:43 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-07-19 18:40:54 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-07-12 19:47:01 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-26 22:07:45 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-09 07:10:50 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-08-24 02:41:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-08-25 19:36:58 +00:00
2016-08-05 23:23:48 +00:00
2016-05-27 06:22:24 +00:00
2016-07-30 01:10:05 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-08-31 19:30:59 +00:00
2016-05-27 06:22:24 +00:00
2016-09-28 21:22:51 +00:00
2016-05-27 06:22:24 +00:00
2016-07-04 21:18:57 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-13 02:18:29 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-06-13 11:19:06 +00:00
2016-05-29 04:18:47 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-06-16 15:25:37 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-06-26 00:53:31 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-07-30 01:10:05 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-11 18:58:44 +00:00
2016-06-13 10:35:11 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-06-08 22:30:21 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-06-01 15:39:11 +00:00
2016-07-30 20:39:39 +00:00
2016-09-19 16:07:32 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-04 12:17:57 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-09-02 20:41:43 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-06-03 19:25:30 +00:00
2016-05-27 06:22:24 +00:00
2016-09-27 18:08:38 +00:00
2016-08-19 21:14:27 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-08-19 22:27:14 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00
2016-05-27 06:22:24 +00:00