[arch-commits] Commit in dnsmasq/repos (5 files)
Christian Hesse
eworm at gemini.archlinux.org
Wed Jun 8 06:59:11 UTC 2022
Date: Wednesday, June 8, 2022 @ 06:59:11
Author: eworm
Revision: 447745
archrelease: copy trunk to testing-x86_64
Added:
dnsmasq/repos/testing-x86_64/
dnsmasq/repos/testing-x86_64/0001-Fix-write-after-free-error-in-DHCPv6-code-CVE-2022-0934-refers.patch
(from rev 447744, dnsmasq/trunk/0001-Fix-write-after-free-error-in-DHCPv6-code-CVE-2022-0934-refers.patch)
dnsmasq/repos/testing-x86_64/PKGBUILD
(from rev 447744, dnsmasq/trunk/PKGBUILD)
dnsmasq/repos/testing-x86_64/dnsmasq-sysusers.conf
(from rev 447744, dnsmasq/trunk/dnsmasq-sysusers.conf)
dnsmasq/repos/testing-x86_64/dnsmasq.service
(from rev 447744, dnsmasq/trunk/dnsmasq.service)
---------------------------------------------------------------------------+
0001-Fix-write-after-free-error-in-DHCPv6-code-CVE-2022-0934-refers.patch | 183 ++++++++++
PKGBUILD | 79 ++++
dnsmasq-sysusers.conf | 1
dnsmasq.service | 19 +
4 files changed, 282 insertions(+)
Copied: dnsmasq/repos/testing-x86_64/0001-Fix-write-after-free-error-in-DHCPv6-code-CVE-2022-0934-refers.patch (from rev 447744, dnsmasq/trunk/0001-Fix-write-after-free-error-in-DHCPv6-code-CVE-2022-0934-refers.patch)
===================================================================
--- testing-x86_64/0001-Fix-write-after-free-error-in-DHCPv6-code-CVE-2022-0934-refers.patch (rev 0)
+++ testing-x86_64/0001-Fix-write-after-free-error-in-DHCPv6-code-CVE-2022-0934-refers.patch 2022-06-08 06:59:11 UTC (rev 447745)
@@ -0,0 +1,183 @@
+From 03345ecefeb0d82e3c3a4c28f27c3554f0611b39 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon at thekelleys.org.uk>
+Date: Thu, 31 Mar 2022 21:35:20 +0100
+Subject: Fix write-after-free error in DHCPv6 code. CVE-2022-0934 refers.
+
+---
+ CHANGELOG | 3 +++
+ src/rfc3315.c | 48 +++++++++++++++++++++++++++---------------------
+ 2 files changed, 30 insertions(+), 21 deletions(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 87d6c2b..4bc7fb1 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -55,6 +55,9 @@ version 2.87
+ doesn't require hard-coding addresses. Thanks to Sten Spans for
+ the idea.
+
++ Fix write-after-free error in DHCPv6 server code.
++ CVE-2022-0934 refers.
++
+
+ version 2.86
+ Handle DHCPREBIND requests in the DHCPv6 server code.
+diff --git a/src/rfc3315.c b/src/rfc3315.c
+index cee8382..e218d26 100644
+--- a/src/rfc3315.c
++++ b/src/rfc3315.c
+@@ -33,9 +33,9 @@ struct state {
+ unsigned int mac_len, mac_type;
+ };
+
+-static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
++static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
+ struct in6_addr *client_addr, int is_unicast, time_t now);
+-static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now);
++static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now);
+ static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts);
+ static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string);
+ static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string);
+@@ -104,12 +104,12 @@ unsigned short dhcp6_reply(struct dhcp_context *context, int interface, char *if
+ }
+
+ /* This cost me blood to write, it will probably cost you blood to understand - srk. */
+-static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
++static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
+ struct in6_addr *client_addr, int is_unicast, time_t now)
+ {
+ void *end = inbuff + sz;
+ void *opts = inbuff + 34;
+- int msg_type = *((unsigned char *)inbuff);
++ int msg_type = *inbuff;
+ unsigned char *outmsgtypep;
+ void *opt;
+ struct dhcp_vendor *vendor;
+@@ -259,15 +259,15 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
+ return 1;
+ }
+
+-static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now)
++static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now)
+ {
+ void *opt;
+- int i, o, o1, start_opts;
++ int i, o, o1, start_opts, start_msg;
+ struct dhcp_opt *opt_cfg;
+ struct dhcp_netid *tagif;
+ struct dhcp_config *config = NULL;
+ struct dhcp_netid known_id, iface_id, v6_id;
+- unsigned char *outmsgtypep;
++ unsigned char outmsgtype;
+ struct dhcp_vendor *vendor;
+ struct dhcp_context *context_tmp;
+ struct dhcp_mac *mac_opt;
+@@ -296,12 +296,13 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
+ v6_id.next = state->tags;
+ state->tags = &v6_id;
+
+- /* copy over transaction-id, and save pointer to message type */
+- if (!(outmsgtypep = put_opt6(inbuff, 4)))
++ start_msg = save_counter(-1);
++ /* copy over transaction-id */
++ if (!put_opt6(inbuff, 4))
+ return 0;
+ start_opts = save_counter(-1);
+- state->xid = outmsgtypep[3] | outmsgtypep[2] << 8 | outmsgtypep[1] << 16;
+-
++ state->xid = inbuff[3] | inbuff[2] << 8 | inbuff[1] << 16;
++
+ /* We're going to be linking tags from all context we use.
+ mark them as unused so we don't link one twice and break the list */
+ for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current)
+@@ -347,7 +348,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
+ (msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE))
+
+ {
+- *outmsgtypep = DHCP6REPLY;
++ outmsgtype = DHCP6REPLY;
+ o1 = new_opt6(OPTION6_STATUS_CODE);
+ put_opt6_short(DHCP6USEMULTI);
+ put_opt6_string("Use multicast");
+@@ -619,11 +620,11 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
+ struct dhcp_netid *solicit_tags;
+ struct dhcp_context *c;
+
+- *outmsgtypep = DHCP6ADVERTISE;
++ outmsgtype = DHCP6ADVERTISE;
+
+ if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0))
+ {
+- *outmsgtypep = DHCP6REPLY;
++ outmsgtype = DHCP6REPLY;
+ state->lease_allocate = 1;
+ o = new_opt6(OPTION6_RAPID_COMMIT);
+ end_opt6(o);
+@@ -809,7 +810,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
+ int start = save_counter(-1);
+
+ /* set reply message type */
+- *outmsgtypep = DHCP6REPLY;
++ outmsgtype = DHCP6REPLY;
+ state->lease_allocate = 1;
+
+ log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL);
+@@ -924,7 +925,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
+ int address_assigned = 0;
+
+ /* set reply message type */
+- *outmsgtypep = DHCP6REPLY;
++ outmsgtype = DHCP6REPLY;
+
+ log6_quiet(state, msg_type == DHCP6RENEW ? "DHCPRENEW" : "DHCPREBIND", NULL, NULL);
+
+@@ -1057,7 +1058,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
+ int good_addr = 0;
+
+ /* set reply message type */
+- *outmsgtypep = DHCP6REPLY;
++ outmsgtype = DHCP6REPLY;
+
+ log6_quiet(state, "DHCPCONFIRM", NULL, NULL);
+
+@@ -1121,7 +1122,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
+ log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname);
+ if (ignore)
+ return 0;
+- *outmsgtypep = DHCP6REPLY;
++ outmsgtype = DHCP6REPLY;
+ tagif = add_options(state, 1);
+ break;
+ }
+@@ -1130,7 +1131,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
+ case DHCP6RELEASE:
+ {
+ /* set reply message type */
+- *outmsgtypep = DHCP6REPLY;
++ outmsgtype = DHCP6REPLY;
+
+ log6_quiet(state, "DHCPRELEASE", NULL, NULL);
+
+@@ -1195,7 +1196,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
+ case DHCP6DECLINE:
+ {
+ /* set reply message type */
+- *outmsgtypep = DHCP6REPLY;
++ outmsgtype = DHCP6REPLY;
+
+ log6_quiet(state, "DHCPDECLINE", NULL, NULL);
+
+@@ -1275,7 +1276,12 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
+ }
+
+ }
+-
++
++ /* Fill in the message type. Note that we store the offset,
++ not a direct pointer, since the packet memory may have been
++ reallocated. */
++ ((unsigned char *)(daemon->outpacket.iov_base))[start_msg] = outmsgtype;
++
+ log_tags(tagif, state->xid);
+ log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1));
+
Copied: dnsmasq/repos/testing-x86_64/PKGBUILD (from rev 447744, dnsmasq/trunk/PKGBUILD)
===================================================================
--- testing-x86_64/PKGBUILD (rev 0)
+++ testing-x86_64/PKGBUILD 2022-06-08 06:59:11 UTC (rev 447745)
@@ -0,0 +1,79 @@
+# Maintainer: Christian Hesse <mail at eworm.de>
+# Maintainer: Dave Reisner <dreisner at archlinux.org>
+# Contributor: Paul Mattal <paul at archlinux.org>
+# Contributor: Tom Newsom <Jeepster at gmx.co.uk>
+
+pkgname=dnsmasq
+pkgver=2.86
+pkgrel=2
+pkgdesc='Lightweight, easy to configure DNS forwarder and DHCP server'
+url='http://www.thekelleys.org.uk/dnsmasq/doc.html'
+arch=('x86_64')
+license=('GPL')
+depends=('glibc' 'gmp' 'libidn2' 'libidn2.so' 'libdbus' 'libdbus-1.so'
+ 'libnetfilter_conntrack' 'nettle' 'libnettle.so' 'libhogweed.so')
+backup=('etc/dnsmasq.conf')
+validpgpkeys=('D6EACBD6EE46B834248D111215CDDA6AE19135A2') # Simon Kelley <simon at thekelleys.org.uk>
+source=("http://www.thekelleys.org.uk/$pkgname/$pkgname-$pkgver.tar.xz"{,.asc}
+ '0001-Fix-write-after-free-error-in-DHCPv6-code-CVE-2022-0934-refers.patch'
+ 'dnsmasq-sysusers.conf'
+ 'dnsmasq.service')
+sha256sums=('28d52cfc9e2004ac4f85274f52b32e1647b4dbc9761b82e7de1e41c49907eb08'
+ 'SKIP'
+ '1bc857bc2b77ab2d3ffa49e113f8401b085f54dee63fc2681978723539ba0c61'
+ '7f6ff6a709038ae580758f4b6a754451d7f7ce22957b88a36b97f7b643d3c2ab'
+ '297dbae8cfa3d353284820dd87cc65c37d1ef289cac3a5c3ede079413d31eeec')
+
+_build_copts='-DHAVE_DNSSEC -DHAVE_DBUS -DHAVE_LIBIDN2 -DHAVE_CONNTRACK'
+
+prepare() {
+ cd "$pkgname-$pkgver"
+
+ patch -Np1 < ../0001-Fix-write-after-free-error-in-DHCPv6-code-CVE-2022-0934-refers.patch
+}
+
+build() {
+ cd "$pkgname-$pkgver"
+
+ make \
+ CFLAGS="$CPPFLAGS $CFLAGS" \
+ LDFLAGS="$LDFLAGS" \
+ COPTS="$_build_copts" \
+ PREFIX=/usr \
+ BINDIR=/usr/bin \
+ all-i18n
+
+ cd "contrib/lease-tools"
+
+ make \
+ CFLAGS="$CPPFLAGS $CFLAGS" \
+ LDFLAGS="$LDFLAGS" \
+ COPTS="$_build_copts" \
+ all
+}
+
+package() {
+ cd "$pkgname-$pkgver"
+
+ # need to pass COPTS here to avoid rebuilding the binary.
+ make \
+ COPTS="$_build_copts" \
+ PREFIX=/usr \
+ BINDIR=/usr/bin \
+ DESTDIR="$pkgdir" \
+ install install-i18n
+
+ install -Dm0644 "dbus/dnsmasq.conf" "$pkgdir"/usr/share/dbus-1/system.d/dnsmasq.conf
+ install -Dm0644 "dnsmasq.conf.example" "$pkgdir"/etc/dnsmasq.conf
+ install -Dm0644 "$srcdir/dnsmasq.service" "$pkgdir"/usr/lib/systemd/system/dnsmasq.service
+ install -Dm0644 "$srcdir/dnsmasq-sysusers.conf" "$pkgdir"/usr/lib/sysusers.d/dnsmasq.conf
+
+ # DNSSEC setup
+ sed -i 's,%%PREFIX%%,/usr,' "$pkgdir"/etc/dnsmasq.conf
+ install -Dm0644 "trust-anchors.conf" "$pkgdir"/usr/share/dnsmasq/trust-anchors.conf
+
+ install -Dm0755 -t "$pkgdir"/usr/bin/ 'contrib/lease-tools/dhcp_'{release{,6},lease_time}
+ install -Dm0644 -t "$pkgdir"/usr/share/man/man1 'contrib/lease-tools/dhcp_'{release{,6},lease_time}.1
+}
+
+# vim: ts=2 sw=2 et ft=sh
Copied: dnsmasq/repos/testing-x86_64/dnsmasq-sysusers.conf (from rev 447744, dnsmasq/trunk/dnsmasq-sysusers.conf)
===================================================================
--- testing-x86_64/dnsmasq-sysusers.conf (rev 0)
+++ testing-x86_64/dnsmasq-sysusers.conf 2022-06-08 06:59:11 UTC (rev 447745)
@@ -0,0 +1 @@
+u dnsmasq - "dnsmasq daemon" /
Copied: dnsmasq/repos/testing-x86_64/dnsmasq.service (from rev 447744, dnsmasq/trunk/dnsmasq.service)
===================================================================
--- testing-x86_64/dnsmasq.service (rev 0)
+++ testing-x86_64/dnsmasq.service 2022-06-08 06:59:11 UTC (rev 447745)
@@ -0,0 +1,19 @@
+[Unit]
+Description=dnsmasq - A lightweight DHCP and caching DNS server
+Documentation=man:dnsmasq(8)
+After=network.target
+Before=network-online.target nss-lookup.target
+Wants=nss-lookup.target
+
+[Service]
+Type=dbus
+BusName=uk.org.thekelleys.dnsmasq
+ExecStartPre=/usr/bin/dnsmasq --test
+ExecStart=/usr/bin/dnsmasq -k --enable-dbus --user=dnsmasq --pid-file
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+PrivateDevices=true
+ProtectSystem=full
+
+[Install]
+WantedBy=multi-user.target
More information about the arch-commits
mailing list