FreshPorts - VuXML

Mikhail Khachaiants reports:

socket: reject mismatched address family in get_addr_generic.

Add a family check to prevent copying address data of the wrong type, which could cause buffer over-read when parsing routes or endpoints.

< g20251117,1

Arne Schwabe reports:

Fix memcmp check for the hmac verification in the 3way handshake being inverted This is a stupid mistake but causes all hmac cookies to be accepted, thus breaking source IP address validation. As a consequence, TLS sessions can be openend and state can be consumed in the server from IP addresses that did not initiate an initial connection.

While at it, fix check to only allow [t-2;t] timeslots, disallowing HMACs coming in from a future timeslot.

< 2.6.16

< g20251117,1