Sync from SUSE:SLFO:Main avahi revision 7d2c82d27eb567658df76e75e27333f6
This commit is contained in:
parent
d435ac3534
commit
216b278e73
102
avahi-CVE-2024-52616.patch
Normal file
102
avahi-CVE-2024-52616.patch
Normal file
@ -0,0 +1,102 @@
|
||||
From f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Mon, 11 Nov 2024 00:56:09 +0100
|
||||
Subject: [PATCH] Properly randomize query id of DNS packets
|
||||
|
||||
---
|
||||
avahi-core/wide-area.c | 36 ++++++++++++++++++++++++++++--------
|
||||
configure.ac | 3 ++-
|
||||
2 files changed, 30 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/avahi-core/wide-area.c b/avahi-core/wide-area.c
|
||||
index 971f5e7..00a1505 100644
|
||||
--- a/avahi-core/wide-area.c
|
||||
+++ b/avahi-core/wide-area.c
|
||||
@@ -40,6 +40,13 @@
|
||||
#include "addr-util.h"
|
||||
#include "rr-util.h"
|
||||
|
||||
+#ifdef HAVE_SYS_RANDOM_H
|
||||
+#include <sys/random.h>
|
||||
+#endif
|
||||
+#ifndef HAVE_GETRANDOM
|
||||
+# define getrandom(d, len, flags) (-1)
|
||||
+#endif
|
||||
+
|
||||
#define CACHE_ENTRIES_MAX 500
|
||||
|
||||
typedef struct AvahiWideAreaCacheEntry AvahiWideAreaCacheEntry;
|
||||
@@ -84,8 +91,6 @@ struct AvahiWideAreaLookupEngine {
|
||||
int fd_ipv4, fd_ipv6;
|
||||
AvahiWatch *watch_ipv4, *watch_ipv6;
|
||||
|
||||
- uint16_t next_id;
|
||||
-
|
||||
/* Cache */
|
||||
AVAHI_LLIST_HEAD(AvahiWideAreaCacheEntry, cache);
|
||||
AvahiHashmap *cache_by_key;
|
||||
@@ -201,6 +206,26 @@ static void sender_timeout_callback(AvahiTimeEvent *e, void *userdata) {
|
||||
avahi_time_event_update(e, avahi_elapse_time(&tv, 1000, 0));
|
||||
}
|
||||
|
||||
+static uint16_t get_random_uint16(void) {
|
||||
+ uint16_t next_id;
|
||||
+
|
||||
+ if (getrandom(&next_id, sizeof(next_id), 0) == -1)
|
||||
+ next_id = (uint16_t) rand();
|
||||
+ return next_id;
|
||||
+}
|
||||
+
|
||||
+static uint16_t avahi_wide_area_next_id(AvahiWideAreaLookupEngine *e) {
|
||||
+ uint16_t next_id;
|
||||
+
|
||||
+ next_id = get_random_uint16();
|
||||
+ while (find_lookup(e, next_id)) {
|
||||
+ /* This ID is already used, get new. */
|
||||
+ next_id = get_random_uint16();
|
||||
+ }
|
||||
+ return next_id;
|
||||
+}
|
||||
+
|
||||
+
|
||||
AvahiWideAreaLookup *avahi_wide_area_lookup_new(
|
||||
AvahiWideAreaLookupEngine *e,
|
||||
AvahiKey *key,
|
||||
@@ -227,11 +252,7 @@ AvahiWideAreaLookup *avahi_wide_area_lookup_new(
|
||||
/* If more than 65K wide area quries are issued simultaneously,
|
||||
* this will break. This should be limited by some higher level */
|
||||
|
||||
- for (;; e->next_id++)
|
||||
- if (!find_lookup(e, e->next_id))
|
||||
- break; /* This ID is not yet used. */
|
||||
-
|
||||
- l->id = e->next_id++;
|
||||
+ l->id = avahi_wide_area_next_id(e);
|
||||
|
||||
/* We keep the packet around in case we need to repeat our query */
|
||||
l->packet = avahi_dns_packet_new(0);
|
||||
@@ -604,7 +625,6 @@ AvahiWideAreaLookupEngine *avahi_wide_area_engine_new(AvahiServer *s) {
|
||||
e->watch_ipv6 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv6, AVAHI_WATCH_IN, socket_event, e);
|
||||
|
||||
e->n_dns_servers = e->current_dns_server = 0;
|
||||
- e->next_id = (uint16_t) rand();
|
||||
|
||||
/* Initialize cache */
|
||||
AVAHI_LLIST_HEAD_INIT(AvahiWideAreaCacheEntry, e->cache);
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index a3211b8..31bce3d 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -367,7 +367,8 @@ AC_FUNC_SELECT_ARGTYPES
|
||||
# whether libc's malloc does too. (Same for realloc.)
|
||||
#AC_FUNC_MALLOC
|
||||
#AC_FUNC_REALLOC
|
||||
-AC_CHECK_FUNCS([gethostname memchr memmove memset mkdir select socket strchr strcspn strdup strerror strrchr strspn strstr uname setresuid setreuid setresgid setregid strcasecmp gettimeofday putenv strncasecmp strlcpy gethostbyname seteuid setegid setproctitle getprogname])
|
||||
+AC_CHECK_FUNCS([gethostname memchr memmove memset mkdir select socket strchr strcspn strdup strerror strrchr strspn strstr uname setresuid setreuid setresgid setregid strcasecmp gettimeofday putenv strncasecmp strlcpy gethostbyname seteuid setegid setproctitle getprogname getrandom])
|
||||
+AC_CHECK_HEADERS([sys/random.h])
|
||||
|
||||
AC_FUNC_CHOWN
|
||||
AC_FUNC_STAT
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,3 +1,16 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Nov 20 10:09:45 UTC 2024 - Cliff Zhao <qzhao@suse.com>
|
||||
|
||||
- Add avahi-CVE-2024-52616.patch:
|
||||
Backporting 1dade81c from upstream: Properly randomize query id
|
||||
of DNS packets.
|
||||
(CVE-2024-52616, bsc#1233420)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Oct 15 11:56:48 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
|
||||
|
||||
- Drop rcFOO symlinks (PED-266).
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jun 20 16:01:22 UTC 2024 - Michael Gorse <mgorse@suse.com>
|
||||
|
||||
|
||||
@ -115,6 +115,8 @@ Patch34: avahi-CVE-2023-38469.patch
|
||||
Patch35: avahi-CVE-2023-38471.patch
|
||||
# PATCH-FIX-UPSTREAM avahi-filter-bogus-services.patch bsc#1226586 mgorse@suse.com -- no longer supply bogus services to callbacks.
|
||||
Patch36: avahi-filter-bogus-services.patch
|
||||
# PATCH-FIX-UPSTREAM avahi-CVE-2024-52616.patch CVE-2024-52616 bsc#1233420 qzhao@suse.com -- Properly randomize query id of DNS packets.
|
||||
Patch37: avahi-CVE-2024-52616.patch
|
||||
BuildRequires: fdupes
|
||||
BuildRequires: gcc-c++
|
||||
BuildRequires: gdbm-devel
|
||||
@ -425,6 +427,7 @@ DNS specifications for Zeroconf Computing.
|
||||
|
||||
|
||||
# This is the avahi-discover command, only provided for the primary python3 flavor
|
||||
|
||||
%package -n python3-avahi-gtk
|
||||
Summary: A set of Avahi utilities written in Python Using python-gtk
|
||||
Group: Development/Languages/Python
|
||||
@ -628,9 +631,6 @@ ln -s avahi-compat-libdns_sd/dns_sd.h %{buildroot}/%{_includedir}/
|
||||
ln -s avahi-compat-howl.pc %{buildroot}/%{_libdir}/pkgconfig/howl.pc
|
||||
install -d %{buildroot}/%{_prefix}/lib/avahi
|
||||
install -d %{buildroot}/%{_localstatedir}/lib/avahi-autoipd
|
||||
mkdir -p %{buildroot}/%{_sbindir}
|
||||
ln -s %{_sbindir}/service %{buildroot}/%{_sbindir}/rcavahi-daemon
|
||||
ln -s %{_sbindir}/service %{buildroot}/%{_sbindir}/rcavahi-dnsconfd
|
||||
install -d %{buildroot}/%{_datadir}/pixmaps
|
||||
install -d %{buildroot}%{_fillupdir}
|
||||
install -m 644 sysconfig.avahi* %{buildroot}%{_fillupdir}/
|
||||
@ -768,8 +768,6 @@ fi
|
||||
%exclude %{_mandir}/man8/avahi-autoipd.8.*
|
||||
%{_sbindir}/avahi-*
|
||||
%exclude %{_sbindir}/avahi-autoipd
|
||||
%{_sbindir}/rcavahi-daemon
|
||||
%{_sbindir}/rcavahi-dnsconfd
|
||||
%dir %{_sysconfdir}/avahi
|
||||
%config %{_sysconfdir}/avahi/avahi-daemon.conf
|
||||
%{_sysconfdir}/avahi/avahi-dnsconfd.action
|
||||
|
||||
Loading…
Reference in New Issue
Block a user