From e2cca62cd51ee38ad9e8be6682b629c9883072d4cdc5de77dd0ef767a0ba0109 Mon Sep 17 00:00:00 2001 From: Marcus Schaefer Date: Thu, 8 Jul 2010 14:26:00 +0000 Subject: [PATCH 1/4] - security fix: replies by a malicious system can make ping run into an endless loop (bnc #620837) OBS-URL: https://build.opensuse.org/package/show/network:utilities/iputils?expand=0&rev=9 --- iputils-ss021109-ping-break.diff | 20 ++++++++++++++++++++ iputils.changes | 6 ++++++ iputils.spec | 2 ++ 3 files changed, 28 insertions(+) create mode 100644 iputils-ss021109-ping-break.diff diff --git a/iputils-ss021109-ping-break.diff b/iputils-ss021109-ping-break.diff new file mode 100644 index 0000000..ea9efe7 --- /dev/null +++ b/iputils-ss021109-ping-break.diff @@ -0,0 +1,20 @@ +--- ping.c 2010-07-08 14:19:50.000000000 +0000 ++++ ping.c 2010-07-08 14:20:43.000000000 +0000 +@@ -1019,7 +1019,7 @@ + i = j; + i -= IPOPT_MINOFF; + if (i <= 0) +- continue; ++ break; + if (i == old_rrlen + && !bcmp((char *)cp, old_rr, i) + && !(options & F_FLOOD)) { +@@ -1056,7 +1056,7 @@ + i = j; + i -= 5; + if (i <= 0) +- continue; ++ break; + flags = *++cp; + printf("\nTS: "); + cp++; diff --git a/iputils.changes b/iputils.changes index 790b71a..e691f2a 100644 --- a/iputils.changes +++ b/iputils.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Thu Jul 8 16:24:50 CEST 2010 - ms@suse.de + +- security fix: replies by a malicious system can + make ping run into an endless loop (bnc #620837) + ------------------------------------------------------------------- Fri Jun 4 09:22:08 CEST 2010 - ms@suse.de diff --git a/iputils.spec b/iputils.spec index 9930f03..825bd29 100644 --- a/iputils.spec +++ b/iputils.spec @@ -50,6 +50,7 @@ Patch16: %name-ss021109-traceroute6-ttab.diff Patch17: %name-%version-open_max.diff Patch18: %name-%version-ping-interrupt.diff Patch19: %name-%version-arping-infiniband.diff +Patch20: %name-%version-ping-break.diff Prefix: %_prefix BuildRoot: %{_tmppath}/%{name}-%{version}-build @@ -85,6 +86,7 @@ Authors: %patch17 -p1 %patch18 %patch19 +%patch20 mkdir linux touch linux/autoconf.h From 8730ec739f10219b1af169636c56300dd5167bb2a9f763c10fbe89532c7b5f0b Mon Sep 17 00:00:00 2001 From: Marcus Schaefer Date: Tue, 13 Jul 2010 15:06:03 +0000 Subject: [PATCH 2/4] - reverted arping-infiniband.diff, it breaks arping (bnc #614389) and (bnc #610839) OBS-URL: https://build.opensuse.org/package/show/network:utilities/iputils?expand=0&rev=10 --- iputils-ss021109-arping-infiniband.diff | 209 ------------------------ iputils.changes | 6 + iputils.spec | 4 +- 3 files changed, 7 insertions(+), 212 deletions(-) delete mode 100644 iputils-ss021109-arping-infiniband.diff diff --git a/iputils-ss021109-arping-infiniband.diff b/iputils-ss021109-arping-infiniband.diff deleted file mode 100644 index 14094e9..0000000 --- a/iputils-ss021109-arping-infiniband.diff +++ /dev/null @@ -1,209 +0,0 @@ ---- arping.c 2010-05-31 17:21:39.000000000 +0530 -+++ arping.c 2010-05-31 17:33:04.000000000 +0530 -@@ -32,6 +32,8 @@ - #include - #include - -+#include -+ - #include "SNAPSHOT.h" - - static void usage(void) __attribute__((noreturn)); -@@ -50,8 +52,8 @@ - int s; - int broadcast_only; - --struct sockaddr_ll me; --struct sockaddr_ll he; -+struct sockaddr_storage me; -+struct sockaddr_storage he; - - struct timeval start, last; - -@@ -61,6 +63,18 @@ - #define MS_TDIFF(tv1,tv2) ( ((tv1).tv_sec-(tv2).tv_sec)*1000 + \ - ((tv1).tv_usec-(tv2).tv_usec)/1000 ) - -+#define OFFSET_OF(name,ele) ((size_t)(((name *)0)->ele)) -+ -+static inline socklen_t sll_len(size_t halen) -+{ -+ socklen_t len = OFFSET_OF(struct sockaddr_ll, sll_addr) + halen; -+ if (len < sizeof(struct sockaddr_ll)) -+ len = sizeof(struct sockaddr_ll); -+ return len; -+} -+ -+#define SLL_LEN(hln) sll_len(hln) -+ - void usage(void) - { - fprintf(stderr, -@@ -124,7 +138,7 @@ - p+=4; - - gettimeofday(&now, NULL); -- err = sendto(s, buf, p-buf, 0, (struct sockaddr*)HE, sizeof(*HE)); -+ err = sendto(s, buf, p-buf, 0, (struct sockaddr*)HE, SLL_LEN(ah->ar_hln)); - if (err == p-buf) { - last = now; - sent++; -@@ -172,7 +186,8 @@ - finish(); - - if (last.tv_sec==0 || MS_TDIFF(tv,last) > 500) { -- send_pack(s, src, dst, &me, &he); -+ send_pack(s, src, dst, -+ (struct sockaddr_ll *)&me, (struct sockaddr_ll *)&he); - if (count == 0 && unsolicited) - finish(); - } -@@ -219,7 +234,7 @@ - return 0; - if (ah->ar_pln != 4) - return 0; -- if (ah->ar_hln != me.sll_halen) -+ if (ah->ar_hln != ((struct sockaddr_ll *)&me)->sll_halen) - return 0; - if (len < sizeof(*ah) + 2*(4 + ah->ar_hln)) - return 0; -@@ -230,7 +245,7 @@ - return 0; - if (src.s_addr != dst_ip.s_addr) - return 0; -- if (memcmp(p+ah->ar_hln+4, &me.sll_addr, ah->ar_hln)) -+ if (memcmp(p+ah->ar_hln+4, ((struct sockaddr_ll *)&me)->sll_addr, ah->ar_hln)) - return 0; - } else { - /* DAD packet was: -@@ -248,7 +263,7 @@ - */ - if (src_ip.s_addr != dst.s_addr) - return 0; -- if (memcmp(p, &me.sll_addr, me.sll_halen) == 0) -+ if (memcmp(p, ((struct sockaddr_ll *)&me)->sll_addr, ((struct sockaddr_ll *)&me)->sll_halen) == 0) - return 0; - if (src.s_addr && src.s_addr != dst_ip.s_addr) - return 0; -@@ -264,7 +279,7 @@ - printf("for %s ", inet_ntoa(dst_ip)); - s_printed = 1; - } -- if (memcmp(p+ah->ar_hln+4, me.sll_addr, ah->ar_hln)) { -+ if (memcmp(p+ah->ar_hln+4, ((struct sockaddr_ll *)&me)->sll_addr, ah->ar_hln)) { - if (!s_printed) - printf("for "); - printf("["); -@@ -290,12 +305,42 @@ - if (quit_on_reply) - finish(); - if(!broadcast_only) { -- memcpy(he.sll_addr, p, me.sll_halen); -+ memcpy(((struct sockaddr_ll *)&he)->sll_addr, p, ((struct sockaddr_ll *)&me)->sll_halen); - unicasting=1; - } - return 1; - } - -+void set_device_broadcast(char *device, unsigned char *ba, size_t balen) -+{ -+ struct sysfs_class_device *dev; -+ struct sysfs_attribute *brdcast; -+ unsigned char *p; -+ int ch; -+ -+ dev = sysfs_open_class_device("net", device); -+ if (!dev) { -+ perror("sysfs_open_class_device(net)"); -+ exit(2); -+ } -+ -+ brdcast = sysfs_get_classdev_attr(dev, "broadcast"); -+ if (!brdcast) { -+ perror("sysfs_get_classdev_attr(broadcast)"); -+ exit(2); -+ } -+ -+ if (sysfs_read_attribute(brdcast)) { -+ perror("sysfs_read_attribute"); -+ exit(2); -+ } -+ -+ for (p = ba, ch = 0; p < ba + balen; p++, ch += 3) -+ *p++ = strtoul(brdcast->value + ch * 3, NULL, 16); -+ -+ return; -+} -+ - int - main(int argc, char **argv) - { -@@ -456,9 +501,9 @@ - close(probe_fd); - }; - -- me.sll_family = AF_PACKET; -- me.sll_ifindex = ifindex; -- me.sll_protocol = htons(ETH_P_ARP); -+ ((struct sockaddr_ll *)&me)->sll_family = AF_PACKET; -+ ((struct sockaddr_ll *)&me)->sll_ifindex = ifindex; -+ ((struct sockaddr_ll *)&me)->sll_protocol = htons(ETH_P_ARP); - if (bind(s, (struct sockaddr*)&me, sizeof(me)) == -1) { - perror("bind"); - exit(2); -@@ -471,14 +516,20 @@ - exit(2); - } - } -- if (me.sll_halen == 0) { -+ if (((struct sockaddr_ll *)&me)->sll_halen == 0) { - if (!quiet) - printf("Interface \"%s\" is not ARPable (no ll address)\n", device); - exit(dad?0:2); - } - - he = me; -- memset(he.sll_addr, -1, he.sll_halen); -+ -+#if 1 -+ set_device_broadcast(device, ((struct sockaddr_ll *)&he)->sll_addr, -+ ((struct sockaddr_ll *)&he)->sll_halen); -+#else -+ memset(((struct sockaddr_ll *)&he)->sll_addr, -1, ((struct sockaddr_ll *)&he)->sll_halen); -+#endif - - if (!quiet) { - printf("ARPING %s ", inet_ntoa(dst)); -@@ -498,7 +549,7 @@ - while(1) { - sigset_t sset, osset; - char packet[4096]; -- struct sockaddr_ll from; -+ struct sockaddr_storage from; - int alen = sizeof(from); - int cc; - -@@ -507,11 +558,12 @@ - perror("arping: recvfrom"); - continue; - } -+ - sigemptyset(&sset); - sigaddset(&sset, SIGALRM); - sigaddset(&sset, SIGINT); - sigprocmask(SIG_BLOCK, &sset, &osset); -- recv_pack(packet, cc, &from); -+ recv_pack(packet, cc, (struct sockaddr_ll *)&from); - sigprocmask(SIG_SETMASK, &osset, NULL); - } - } ---- Makefile 2010-05-31 17:21:39.000000000 +0530 -+++ Makefile 2010-05-31 17:23:05.000000000 +0530 -@@ -41,6 +41,7 @@ - - - tftpd: tftpd.o tftpsubs.o -+arping: arping.o -lsysfs - ping: ping.o ping_common.o - ping6: ping6.o ping_common.o - ping.o ping6.o ping_common.o: ping_common.h diff --git a/iputils.changes b/iputils.changes index e691f2a..d80635d 100644 --- a/iputils.changes +++ b/iputils.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Tue Jul 13 17:03:24 CEST 2010 - ms@suse.de + +- reverted arping-infiniband.diff, it breaks arping + (bnc #614389) and (bnc #610839) + ------------------------------------------------------------------- Thu Jul 8 16:24:50 CEST 2010 - ms@suse.de diff --git a/iputils.spec b/iputils.spec index 825bd29..14e44f1 100644 --- a/iputils.spec +++ b/iputils.spec @@ -49,8 +49,7 @@ Patch15: %name-%version-ping_common.dif Patch16: %name-ss021109-traceroute6-ttab.diff Patch17: %name-%version-open_max.diff Patch18: %name-%version-ping-interrupt.diff -Patch19: %name-%version-arping-infiniband.diff -Patch20: %name-%version-ping-break.diff +Patch19: %name-%version-ping-break.diff Prefix: %_prefix BuildRoot: %{_tmppath}/%{name}-%{version}-build @@ -86,7 +85,6 @@ Authors: %patch17 -p1 %patch18 %patch19 -%patch20 mkdir linux touch linux/autoconf.h From a2f67ab311ec59c5a534964c607558be83b889183c0177199f47a22d85b062ea Mon Sep 17 00:00:00 2001 From: Marcus Schaefer Date: Wed, 14 Jul 2010 12:07:32 +0000 Subject: [PATCH 3/4] - fixed device broadcast setup (bnc #614389) - upstream maintainer has changed. new maintainer is YOSHIFUJI Hideaki. Along with this change the versioning of the package also changed. Current version is: s20100418 from 18-Apr-2010 - many patches upstream now, reduced patch set OBS-URL: https://build.opensuse.org/package/show/network:utilities/iputils?expand=0&rev=11 --- iputils-ADDLIB.diff | 12 +- iputils-HZ.patch | 11 -- iputils-arping-set_device_broadcast.diff | 16 ++ iputils-headers.patch | 41 ---- ...-ifenslave.patch => iputils-ifenslave.diff | 0 ...1.1.0.tar.bz2 => iputils-ifenslave.tar.bz2 | 0 ...ce.diff => iputils-pingnamelookuponce.diff | 8 +- iputils-ss021109-locallinksyntax.diff | 50 ----- iputils-ss021109-open_max.diff | 13 -- iputils-ss021109-ping-R-option-doc.diff | 22 --- iputils-ss021109-ping-break.diff | 20 -- iputils-ss021109-ping-interrupt.diff | 29 --- iputils-ss021109-ping6_getaddrinfo.patch | 76 -------- iputils-ss021109-ping6kernel261x.diff | 47 ----- iputils-ss021109-ping_common.dif | 16 -- iputils-ss021109-rdisc-server.patch | 44 ----- ...-ss021109-sec-ping-setuid-retvalcheck.diff | 15 -- ...ss021109-sec-ping6-setuid-retvalcheck.diff | 15 -- ...09-sec-traceroute6-setuid-retvalcheck.diff | 16 -- iputils-ss021109-traceroute6-ttab.diff | 11 -- iputils-ss021109-try.tar.bz2 | 3 - iputils-ss021109.diff | 184 ------------------ ...nt.diff => iputils-traceroute6-stdint.diff | 0 iputils.changes | 10 + iputils.spec | 65 ++----- iputils.tar.bz2 | 3 + 26 files changed, 58 insertions(+), 669 deletions(-) delete mode 100644 iputils-HZ.patch create mode 100644 iputils-arping-set_device_broadcast.diff delete mode 100644 iputils-headers.patch rename iputils-ifenslave.patch => iputils-ifenslave.diff (100%) rename iputils-ifenslave-1.1.0.tar.bz2 => iputils-ifenslave.tar.bz2 (100%) rename iputils-ss021109-pingnamelookuponce.diff => iputils-pingnamelookuponce.diff (85%) delete mode 100644 iputils-ss021109-locallinksyntax.diff delete mode 100644 iputils-ss021109-open_max.diff delete mode 100644 iputils-ss021109-ping-R-option-doc.diff delete mode 100644 iputils-ss021109-ping-break.diff delete mode 100644 iputils-ss021109-ping-interrupt.diff delete mode 100644 iputils-ss021109-ping6_getaddrinfo.patch delete mode 100644 iputils-ss021109-ping6kernel261x.diff delete mode 100644 iputils-ss021109-ping_common.dif delete mode 100644 iputils-ss021109-rdisc-server.patch delete mode 100644 iputils-ss021109-sec-ping-setuid-retvalcheck.diff delete mode 100644 iputils-ss021109-sec-ping6-setuid-retvalcheck.diff delete mode 100644 iputils-ss021109-sec-traceroute6-setuid-retvalcheck.diff delete mode 100644 iputils-ss021109-traceroute6-ttab.diff delete mode 100644 iputils-ss021109-try.tar.bz2 delete mode 100644 iputils-ss021109.diff rename iputils-ss021109-traceroute6-stdint.diff => iputils-traceroute6-stdint.diff (100%) create mode 100644 iputils.tar.bz2 diff --git a/iputils-ADDLIB.diff b/iputils-ADDLIB.diff index f56cf97..d203f7d 100644 --- a/iputils-ADDLIB.diff +++ b/iputils-ADDLIB.diff @@ -1,12 +1,12 @@ ---- Makefile -+++ Makefile -@@ -5,8 +5,8 @@ +--- Makefile 2010-07-14 13:38:32.257045463 +0200 ++++ Makefile 2010-07-14 13:39:00.482319644 +0200 +@@ -4,8 +4,8 @@ DEFINES= #options if you have a bind>=4.9.4 libresolv (or, maybe, glibc) --LDLIBS=-lresolv +-LDLIBS= ADDLIB= +LDLIBS=-lresolv $(ADDLIB) - ifeq ($(LIBC_INCLUDE)/socketbits.h,$(wildcard $(LIBC_INCLUDE)/socketbits.h)) - ifeq ($(LIBC_INCLUDE)/net/if_packet.h,$(wildcard $(LIBC_INCLUDE)/net/if_packet.h)) + #options if you compile with libc5, and without a bind>=4.9.4 libresolv + # NOT AVAILABLE. Please, use libresolv. diff --git a/iputils-HZ.patch b/iputils-HZ.patch deleted file mode 100644 index e0cca8b..0000000 --- a/iputils-HZ.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- ping_common.c -+++ ping_common.c -@@ -548,7 +548,7 @@ - - /* If we are here, recvmsg() is unable to wait for - * required timeout. */ -- if (1000*next <= 1000000/(int)HZ) { -+ if (1000*next <= 1000000/(int)sysconf(_SC_CLK_TCK)) { - /* Very short timeout... So, if we wait for - * something, we sleep for MININTERVAL. - * Otherwise, spin! */ diff --git a/iputils-arping-set_device_broadcast.diff b/iputils-arping-set_device_broadcast.diff new file mode 100644 index 0000000..2ee101d --- /dev/null +++ b/iputils-arping-set_device_broadcast.diff @@ -0,0 +1,16 @@ +--- arping.c ++++ arping.c +@@ -335,8 +335,8 @@ void set_device_broadcast(char *device, unsigned char *ba, size_t balen) + exit(2); + } + +- for (p = ba, ch = 0; p < ba + balen; p++, ch += 3) +- *p++ = strtoul(brdcast->value + ch * 3, NULL, 16); ++ for (p = ba, ch = 0; p < ba + balen; ch += 3) ++ *p++ = strtoul(brdcast->value + ch, NULL, 16); + + return; + } +-- +1.7.1 + diff --git a/iputils-headers.patch b/iputils-headers.patch deleted file mode 100644 index 1179fcd..0000000 --- a/iputils-headers.patch +++ /dev/null @@ -1,41 +0,0 @@ ---- arping.c -+++ arping.c -@@ -17,8 +17,10 @@ - #include - #include - #include --#include --#include -+#include -+#include -+#include -+#include - #include - - #include ---- rarpd.c -+++ rarpd.c -@@ -24,10 +24,11 @@ - #include - #include - #include --#include --#include -+#include -+#include - #include --#include -+#include -+#include - #include - - int do_reload = 1; -@@ -45,6 +46,8 @@ - extern int ether_ntohost(char *name, unsigned char *ea); - void usage(void) __attribute__((noreturn)); - -+#define ifaddr if_addr -+ - struct iflink - { - struct iflink *next; diff --git a/iputils-ifenslave.patch b/iputils-ifenslave.diff similarity index 100% rename from iputils-ifenslave.patch rename to iputils-ifenslave.diff diff --git a/iputils-ifenslave-1.1.0.tar.bz2 b/iputils-ifenslave.tar.bz2 similarity index 100% rename from iputils-ifenslave-1.1.0.tar.bz2 rename to iputils-ifenslave.tar.bz2 diff --git a/iputils-ss021109-pingnamelookuponce.diff b/iputils-pingnamelookuponce.diff similarity index 85% rename from iputils-ss021109-pingnamelookuponce.diff rename to iputils-pingnamelookuponce.diff index 3b3eb43..b743946 100644 --- a/iputils-ss021109-pingnamelookuponce.diff +++ b/iputils-pingnamelookuponce.diff @@ -1,6 +1,6 @@ diff -ur iputils/ping.c iputils.new/ping.c ---- iputils/ping.c 2004-03-17 12:36:43.000000000 +0100 -+++ iputils.new/ping.c 2004-03-17 12:35:49.000000000 +0100 +--- ping.c 2004-03-17 12:36:43.000000000 +0100 ++++ ping.c 2004-03-17 12:35:49.000000000 +0100 @@ -1141,15 +1141,24 @@ char * pr_addr(__u32 addr) @@ -32,8 +32,8 @@ diff -ur iputils/ping.c iputils.new/ping.c } diff -ur iputils/ping6.c iputils.new/ping6.c ---- iputils/ping6.c 2004-03-17 12:36:43.000000000 +0100 -+++ iputils.new/ping6.c 2004-03-17 12:36:29.000000000 +0100 +--- ping6.c 2004-03-17 12:36:43.000000000 +0100 ++++ ping6.c 2004-03-17 12:36:29.000000000 +0100 @@ -898,11 +898,22 @@ char * pr_addr(struct in6_addr *addr) { diff --git a/iputils-ss021109-locallinksyntax.diff b/iputils-ss021109-locallinksyntax.diff deleted file mode 100644 index 61305d4..0000000 --- a/iputils-ss021109-locallinksyntax.diff +++ /dev/null @@ -1,50 +0,0 @@ - -This patch for iputils allows to use the standard - -ping6 link-local-addr%interface - -syntax instead of ping6 -I interface link-local-addr. This matches -BSD ping. - -Please apply. - --Andi - - -diff -u iputils/ping6.c-o iputils/ping6.c ---- iputils/ping6.c-o 2005-07-08 02:21:34.000000000 +0200 -+++ iputils/ping6.c 2005-07-08 02:51:47.000000000 +0200 -@@ -268,6 +268,14 @@ - - target = *argv; - -+ if (!device) { -+ char *s = strchr(target, '%'); -+ if (s) { -+ device = s+1; -+ *s = 0; -+ } -+ } -+ - if (inet_pton(AF_INET6, target, &addr) <= 0) { - struct hostent *hp; - -@@ -296,6 +304,14 @@ - memset(&whereto, 0, sizeof(struct sockaddr_in6)); - whereto.sin6_family = AF_INET6; - whereto.sin6_port = htons(IPPROTO_ICMPV6); -+ -+ if (!device) { -+ char *s = strchr(target, '%'); -+ if (s) { -+ device = s+1; -+ *s = 0; -+ } -+ } - - if (inet_pton(AF_INET6, target, &whereto.sin6_addr) <= 0) { - struct hostent *hp; - - - --- diff --git a/iputils-ss021109-open_max.diff b/iputils-ss021109-open_max.diff deleted file mode 100644 index 00c7866..0000000 --- a/iputils-ss021109-open_max.diff +++ /dev/null @@ -1,13 +0,0 @@ -Index: iputils/rdisc.c -=================================================================== ---- iputils.orig/rdisc.c 2007-12-12 15:41:01.000000000 +0100 -+++ iputils/rdisc.c 2007-12-12 15:42:15.000000000 +0100 -@@ -246,7 +246,7 @@ void do_fork(void) - if ((pid=fork()) != 0) - exit(0); - -- for (t = 0; t < OPEN_MAX; t++) -+ for (t = 0; t < sysconf(_SC_OPEN_MAX); t++) - if (t != s) - close(t); - diff --git a/iputils-ss021109-ping-R-option-doc.diff b/iputils-ss021109-ping-R-option-doc.diff deleted file mode 100644 index 316a622..0000000 --- a/iputils-ss021109-ping-R-option-doc.diff +++ /dev/null @@ -1,22 +0,0 @@ ---- iputils/doc/ping.8 -+++ iputils/doc/ping.8 -@@ -118,7 +118,7 @@ - when finished. - .TP - \fB-R\fR --Record route. -+Record route. (IPv4 only) - Includes the RECORD_ROUTE option in the ECHO_REQUEST - packet and displays the route buffer on returned packets. - Note that the IP header is only large enough for nine such routes. ---- iputils/doc/ping.sgml -+++ iputils/doc/ping.sgml -@@ -200,7 +200,7 @@ - -