SHA256
1
0
forked from pool/dhcp

Accepting request 66216 from network:dhcp

Accepted submit request 66216 from user coolo

OBS-URL: https://build.opensuse.org/request/show/66216
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/dhcp?expand=0&rev=51
This commit is contained in:
Sascha Peilicke 2011-04-06 10:54:09 +00:00 committed by Git OBS Bridge
commit a0d774186d
12 changed files with 326 additions and 185 deletions

View File

@ -236,21 +236,26 @@ set_ipv6_routes()
}
set_hostname()
{
rx_host='^[[:alnum:]][[:alnum:]_-]{0,62}$'
if [ "$DHCLIENT_SET_HOSTNAME" = yes ] ; then
new_host_name="${new_host_name%%.*}"
[[ ${new_host_name} =~ ${rx_host} ]] || unset new_host_name
current_hostname=`hostname`
if [ "x${current_hostname%%.*}" = "x" ] || \
[ "x${current_hostname%%.*}" = "x(none)" ] || \
[ "x${current_hostname%%.*}" = "xlocalhost" ] || \
[ "x${current_hostname%%.*}" != "x${new_host_name%%.*}" ]; then
current_hostname="${current_hostname%%.*}"
[[ ${current_hostname} =~ ${rx_host} ]] || unset current_hostname
if [ "x${new_host_name%%.*}" != "x" ]; then
hostname "${new_host_name%%.*}"
if [ "x${current_hostname}" = "x" ] || \
[ "x${current_hostname}" = "xlocalhost" ] || \
[ "x${current_hostname}" != "x${new_host_name}" ]; then
if [ "x${new_host_name}" != "x" ]; then
hostname "${new_host_name}"
else
if [ -x /usr/bin/host ] ; then
if out=`host -W 2 "$new_ip_address" 2>/dev/null` ; then
_hostname="`echo "$out" | sed 's:^.* ::; s:\..*::'`"
_hostname="`echo "$out" | sed 's:^.* ::; s:\..*::; s:.*[)]::'`"
[[ ${_hostname} =~ ${rx_host} ]] || unset _hostname
if [ "x${_hostname}" != "x" -a \
"x${_hostname}" != "x${current_hostname%%.*}" ]; then
"x${_hostname}" != "x${current_hostname}" ]; then
hostname "${_hostname}"
fi
fi
@ -264,7 +269,9 @@ set_hostname()
# it changed, we've to handle it anyway...
local OLD_HOSTNAME=`read_cached_config_data hostname $interface`
local CUR_HOSTNAME=`hostname 2>/dev/null`
if test "x$OLD_HOSTNAME" != "x$CUR_HOSTNAME" ; then
CUR_HOSTNAME="${CUR_HOSTNAME%%.*}"
if [[ ${CUR_HOSTNAME} =~ ${rx_host} ]] && \
[ "x$OLD_HOSTNAME" != "x$CUR_HOSTNAME" ] ; then
write_cached_config_data hostname "$CUR_HOSTNAME" $interface
commit_cached_config_data $interface

View File

@ -1,46 +0,0 @@
From 912eb17103f764ef4486b30a4801af64321a23ed Mon Sep 17 00:00:00 2001
From: Marius Tomaschewski <mt@suse.de>
Date: Fri, 29 Oct 2010 18:51:02 +0200
Subject: [PATCH] dhcp-4.1.1-P1-optional-value-infinite-loop
Fixed dhcp server infinite loop while parsing options with optional
parts in the value such as in slp-service-scope option (bnc#643845,
[ISC-Bugs #22410]).
Signed-off-by: Marius Tomaschewski <mt@suse.de>
---
common/parse.c | 17 ++++++++++++++++-
1 files changed, 16 insertions(+), 1 deletions(-)
diff --git a/common/parse.c b/common/parse.c
index 34b909a..081dcc9 100644
--- a/common/parse.c
+++ b/common/parse.c
@@ -4931,8 +4931,23 @@ struct option *option;
do {
if ((*fmt == 'A') || (*fmt == 'a'))
break;
- if (*fmt == 'o')
+ if (*fmt == 'o') {
+ /* previous value were optional */
+ fmt++;
continue;
+ }
+ if (fmt[1] == 'o') {
+ /*
+ * value for current format code is optional
+ * check if the next token is a semicolon;
+ * it is expected to be read by our caller.
+ */
+ token = peek_token (&val, (unsigned *)0, cfile);
+ if (token == SEMI) {
+ fmt++;
+ continue;
+ }
+ }
tmp = *expr;
*expr = NULL;
--
1.7.1

View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:1e58b92113ba2502a7f3957065dac709d8d7e8fe3e23bc3e2543cec0a2c11450
size 9915

View File

@ -1,17 +0,0 @@
diff --git a/configure.ac b/configure.ac
index b880616..3e0d11b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -420,8 +420,12 @@ AC_TRY_LINK(
AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h)
# find an MD5 library
+saved_LIBS="$LIBS"
+LIBS=""
AC_SEARCH_LIBS(MD5_Init, [crypto])
AC_SEARCH_LIBS(MD5Init, [crypto])
+CRYPTO_LIBS="$LIBS"
+LIBS="$saved_LIBS"
# Solaris needs some libraries for functions
AC_SEARCH_LIBS(socket, [socket])

View File

@ -1,78 +0,0 @@
From ef8d97cd543d87135b3aae2d778a6f91cb800498 Mon Sep 17 00:00:00 2001
From: Marius Tomaschewski <mt@suse.de>
Date: Wed, 2 Feb 2011 09:18:39 +0100
Subject: [PATCH] Unexpected abort caused by a DHCPv6 decline
Security fix (CVE-2011-0413, VU#686084, bnc#667655) extracted from
dhcp-4.2.1b1 sources; description from dhcp-4.2.1b1/RELNOTES:
! When processing a request in the DHCPv6 server code that specifies
an address that is tagged as abandoned (meaning we received a
decline request for it previously) don't attempt to move it from
the inactive to active pool as doing so can result in the server
crshing on an assert failure. Also retag the lease as active
and reset it's timeout value.
[ISC-Bugs #21921]
Signed-off-by: Marius Tomaschewski <mt@suse.de>
---
server/mdb6.c | 19 ++++++++++++++++---
1 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/server/mdb6.c b/server/mdb6.c
index 87bd152..9d410f5 100644
--- a/server/mdb6.c
+++ b/server/mdb6.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2007-2010 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2011 by Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -1010,7 +1010,7 @@ move_lease_to_active(struct ipv6_pool *pool, struct iasubopt *lease) {
* Renew an lease in the pool.
*
* To do this, first set the new hard_lifetime_end_time for the resource,
- * and then invoke renew_lease() on it.
+ * and then invoke renew_lease6() on it.
*
* WARNING: lease times must only be extended, never reduced!!!
*/
@@ -1020,12 +1020,24 @@ renew_lease6(struct ipv6_pool *pool, struct iasubopt *lease) {
* If we're already active, then we can just move our expiration
* time down the heap.
*
+ * If we're abandoned then we are already on the active list
+ * but we need to retag the lease and move our expiration
+ * from infinite to the current value
+ *
* Otherwise, we have to move from the inactive heap to the
* active heap.
*/
if (lease->state == FTS_ACTIVE) {
isc_heap_decreased(pool->active_timeouts, lease->heap_index);
return ISC_R_SUCCESS;
+ } else if (lease->state == FTS_ABANDONED) {
+ char tmp_addr[INET6_ADDRSTRLEN];
+ lease->state = FTS_ACTIVE;
+ isc_heap_increased(pool->active_timeouts, lease->heap_index);
+ log_info("Reclaiming previously abandoned address %s",
+ inet_ntop(AF_INET6, &(lease->addr), tmp_addr,
+ sizeof(tmp_addr)));
+ return ISC_R_SUCCESS;
} else {
return move_lease_to_active(pool, lease);
}
@@ -1115,7 +1127,8 @@ isc_result_t
decline_lease6(struct ipv6_pool *pool, struct iasubopt *lease) {
isc_result_t result;
- if (lease->state != FTS_ACTIVE) {
+ if ((lease->state != FTS_ACTIVE) &&
+ (lease->state != FTS_ABANDONED)) {
result = move_lease_to_active(pool, lease);
if (result != ISC_R_SUCCESS) {
return result;
--
1.7.1

View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:1fb1e8f4f4bef848bc7c5cbac510c2d4091cf4a10ca831ab892512f48274983e
size 8432072

View File

@ -0,0 +1,248 @@
From 632c8ceeff26a7663f939895f77aecb8377773f2 Mon Sep 17 00:00:00 2001
From: Marius Tomaschewski <mt@suse.de>
Date: Sun, 27 Mar 2011 13:15:58 +0200
Subject: [PATCH] dhclient: discard incorrect string options
Discard string options such as host and domain names
containing disallowed characters or beeing too long.
This proctive patch limits root-path to the a-zA-Z0-9,
space and the #%+-_:.,@~/\[]= characters.
Signed-off-by: Marius Tomaschewski <mt@suse.de>
---
client/dhclient.c | 186 +++++++++++++++++++++++++++++++++++++++++++++++++----
common/options.c | 3 +-
2 files changed, 175 insertions(+), 14 deletions(-)
diff --git a/client/dhclient.c b/client/dhclient.c
index dc19e8b..5d96c72 100644
--- a/client/dhclient.c
+++ b/client/dhclient.c
@@ -91,6 +91,11 @@ static void usage(void);
static isc_result_t write_duid(struct data_string *duid);
+static int check_domain_name(const char *ptr, size_t len, int dots);
+static int check_domain_name_list(const char *ptr, size_t len, int dots);
+static int check_option_values(struct universe *universe, unsigned int opt,
+ const char *ptr, size_t len);
+
int
main(int argc, char **argv) {
int fd;
@@ -3034,13 +3039,23 @@ void client_option_envadd (struct option_cache *oc,
if (data.len) {
char name [256];
if (dhcp_option_ev_name (name, sizeof name,
- oc -> option)) {
- client_envadd (es -> client, es -> prefix,
- name, "%s",
- (pretty_print_option
- (oc -> option,
- data.data, data.len,
- 0, 0)));
+ oc->option)) {
+ const char *value;
+ value = pretty_print_option(oc->option,
+ data.data,
+ data.len, 0, 0);
+ size_t length = strlen(value);
+
+ if (check_option_values(oc->option->universe,
+ oc->option->code,
+ value, length) == 0) {
+ client_envadd(es->client, es->prefix,
+ name, "%s", value);
+ } else {
+ log_error("suspect value in %s "
+ "option - discarded",
+ name);
+ }
data_string_forget (&data, MDL);
}
}
@@ -3118,12 +3133,32 @@ void script_write_params (client, prefix, lease)
data_string_forget (&data, MDL);
}
- if (lease -> filename)
- client_envadd (client,
- prefix, "filename", "%s", lease -> filename);
- if (lease -> server_name)
- client_envadd (client, prefix, "server_name",
- "%s", lease -> server_name);
+ if (lease->filename) {
+ if (check_option_values(NULL, DHO_ROOT_PATH,
+ lease->filename,
+ strlen(lease->filename)) == 0) {
+ client_envadd(client, prefix, "filename",
+ "%s", lease->filename);
+ } else {
+ log_error("suspect value in %s "
+ "option - discarded",
+ "filename");
+ }
+ }
+
+ if (lease->server_name) {
+ if (check_option_values(NULL, DHO_HOST_NAME,
+ lease->server_name,
+ strlen(lease->server_name)) == 0 ) {
+ client_envadd (client, prefix, "server_name",
+ "%s", lease->server_name);
+ } else {
+ log_error("suspect value in %s "
+ "option - discarded",
+ "server_name");
+ }
+ }
+
for (i = 0; i < lease -> options -> universe_count; i++) {
option_space_foreach ((struct packet *)0, (struct lease *)0,
@@ -4026,3 +4061,128 @@ dhcpv4_client_assignments(void)
} else
remote_port = htons (ntohs (local_port) - 1); /* XXX */
}
+
+/*
+ * The following routines are used to check that certain
+ * strings are reasonable before we pass them to the scripts.
+ * This avoids some problems with scripts treating the strings
+ * as commands - see ticket 23722
+ * The domain checking code should be done as part of assembling
+ * the string but we are doing it here for now due to time
+ * constraints.
+ */
+
+static int check_domain_name(const char *ptr, size_t len, int dots)
+{
+ const char *p;
+
+ /* not empty or complete length not over 255 characters */
+ if ((len == 0) || (len >= 256))
+ return(-1);
+
+ /* consists of [[:alnum:]-]+ labels separated by [.] */
+ /* a [_] is against RFC but seems to be "widely used"... */
+ for (p=ptr; (*p != 0) && (len-- > 0); p++) {
+ if ((*p == '-') || (*p == '_')) {
+ /* not allowed at begin or end of a label */
+ if (((p - ptr) == 0) || (len == 0) || (p[1] == '.'))
+ return(-1);
+ } else if (*p == '.') {
+ /* each label has to be 1-63 characters;
+ we allow [.] at the end ('foo.bar.') */
+ size_t d = p - ptr;
+ if ((d <= 0) || (d >= 64))
+ return(-1);
+ ptr = p + 1; /* jump to the next label */
+ if ((dots > 0) && (len > 0))
+ dots--;
+ } else if (isalnum((unsigned char)*p) == 0) {
+ /* also numbers at the begin are fine */
+ return(-1);
+ }
+ }
+ return(dots ? -1 : 0);
+}
+
+static int check_domain_name_list(const char *ptr, size_t len, int dots)
+{
+ const char *p;
+ int ret = -1; /* at least one needed */
+
+ if ((ptr == NULL) || (len == 0))
+ return(-1);
+
+ for (p=ptr; (*p != 0) && (len > 0); p++, len--) {
+ if (*p != ' ')
+ continue;
+ if (p > ptr) {
+ if (check_domain_name(ptr, p - ptr, dots) != 0)
+ return(-1);
+ ret = 0;
+ }
+ ptr = p + 1;
+ }
+ if (p > ptr)
+ return(check_domain_name(ptr, p - ptr, dots));
+ else
+ return(ret);
+}
+
+static int check_option_values(struct universe *universe,
+ unsigned int opt,
+ const char *ptr,
+ size_t len)
+{
+ if (ptr == NULL)
+ return(-1);
+
+ /* just reject options we want to protect, will be escaped anyway */
+ if ((universe == NULL) || (universe == &dhcp_universe)) {
+ switch(opt) {
+ case DHO_HOST_NAME:
+ case DHO_DOMAIN_NAME:
+ case DHO_NIS_DOMAIN:
+ case DHO_NETBIOS_SCOPE:
+ return check_domain_name(ptr, len, 0);
+ break;
+ case DHO_DOMAIN_SEARCH:
+ return check_domain_name_list(ptr, len, 0);
+ break;
+ case DHO_ROOT_PATH:
+ if (len == 0)
+ return(-1);
+ for (; (*ptr != 0) && (len-- > 0); ptr++) {
+ if(!(isalnum((unsigned char)*ptr) ||
+ *ptr == '#' || *ptr == '%' ||
+ *ptr == '+' || *ptr == '-' ||
+ *ptr == '_' || *ptr == ':' ||
+ *ptr == '.' || *ptr == ',' ||
+ *ptr == '@' || *ptr == '~' ||
+ *ptr == '\\' || *ptr == '/' ||
+ *ptr == '[' || *ptr == ']' ||
+ *ptr == '=' || *ptr == ' '))
+ return(-1);
+ }
+ return(0);
+ break;
+ }
+ }
+
+#ifdef DHCPv6
+ if (universe == &dhcpv6_universe) {
+ switch(opt) {
+ case D6O_SIP_SERVERS_DNS:
+ case D6O_DOMAIN_SEARCH:
+ case D6O_NIS_DOMAIN_NAME:
+ case D6O_NISP_DOMAIN_NAME:
+ return check_domain_name_list(ptr, len, 0);
+ break;
+ }
+ }
+#endif
+
+ return(0);
+}
+
+
+
diff --git a/common/options.c b/common/options.c
index 28c36e6..3a6cb33 100644
--- a/common/options.c
+++ b/common/options.c
@@ -3915,7 +3915,8 @@ pretty_escape(char **dst, char *dend, const unsigned char **src,
count += 4;
}
} else if (**src == '"' || **src == '\'' || **src == '$' ||
- **src == '`' || **src == '\\') {
+ **src == '`' || **src == '\\' || **src == '|' ||
+ **src == '&' || **src == ';') {
if (*dst + 2 > dend)
return -1;
--
1.7.3.4

View File

@ -1,34 +1,34 @@
diff --git a/client/dhclient.8 b/client/dhclient.8
index b805528..d31fa8d 100644
index 7a3c154..e284210 100644
--- a/client/dhclient.8
+++ b/client/dhclient.8
@@ -60,6 +60,9 @@ dhclient - Dynamic Host Configuration Protocol Client
@@ -64,6 +64,10 @@ dhclient - Dynamic Host Configuration Protocol Client
.I port
]
[
+.B -H hostname
+.B -H
+.I hostname
+]
+[
.B -d
]
[
@@ -227,6 +230,11 @@ If a different port is specified for the client to listen on and
transmit on, the client will also use a different destination port -
@@ -305,6 +309,10 @@ If a different port is specified on which the client should listen and
transmit, the client will also use a different destination port -
one less than the specified port.
.PP
+The
+.B -H
+flag may be used to specify a client hostname that should be sent to
.TP
+.BI \-H \ hostname
+This flag may be used to specify a client hostname that should be sent to
+the DHCP server. Note, that this option is a SUSE/Novell extension.
+.PP
The DHCP client normally transmits any protocol messages it sends
before acquiring an IP address to, 255.255.255.255, the IP limited
broadcast address. For debugging purposes, it may be useful to have
+.TP
.BI \-s \ server
Specify the server IP address or fully qualified domain name to use as
a destination for DHCP protocol messages before
diff --git a/client/dhclient.c b/client/dhclient.c
index 15c31a5..65e9c23 100644
index dc19e8b..bd02cc9 100644
--- a/client/dhclient.c
+++ b/client/dhclient.c
@@ -108,6 +108,7 @@ main(int argc, char **argv) {
@@ -110,6 +110,7 @@ main(int argc, char **argv) {
int no_dhclient_db = 0;
int no_dhclient_pid = 0;
int no_dhclient_script = 0;
@ -36,7 +36,7 @@ index 15c31a5..65e9c23 100644
#ifdef DHCPv6
int local_family_set = 0;
#endif /* DHCPv6 */
@@ -212,6 +213,16 @@ main(int argc, char **argv) {
@@ -220,6 +221,16 @@ main(int argc, char **argv) {
if (++i == argc)
usage();
mockup_relay = argv[i];
@ -53,7 +53,7 @@ index 15c31a5..65e9c23 100644
} else if (!strcmp(argv[i], "-nw")) {
nowait = 1;
} else if (!strcmp(argv[i], "-n")) {
@@ -445,6 +456,32 @@ main(int argc, char **argv) {
@@ -468,6 +479,32 @@ main(int argc, char **argv) {
/* Parse the dhclient.conf file. */
read_client_conf();
@ -86,7 +86,7 @@ index 15c31a5..65e9c23 100644
/* Parse the lease database. */
read_client_leases();
@@ -674,12 +711,12 @@ static void usage()
@@ -676,12 +713,12 @@ static void usage()
log_error("Usage: dhclient %s %s",
#ifdef DHCPv6

View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:5d5a0f6d8570eda14268c48207f6df9c0360ddf2e91de50676e6e6d9a8df3d82
size 10234

3
dhcp-4.2.1.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:172851e0eedbbb009142b143a5f1ed9d6d370d909475a356ac9a753c15c354e9
size 8656089

View File

@ -1,3 +1,34 @@
-------------------------------------------------------------------
Thu Mar 31 09:56:02 UTC 2011 - mt@suse.de
- Discard string options such as host and domain names containing
disallowed characters or beeing too long. This proctive patch
limits root-path to a-zA-Z0-9, #%+-_:.,@~/\[]= and a space
(bnc#675052, CVE-2011-0997).
-------------------------------------------------------------------
Thu Mar 31 09:00:19 UTC 2011 - mt@suse.de
- Updated to ISC DHCP 4.2.1 release (bnc#680298), that provides
following fixes (digest):
* Several fixes to OMAPI, cleanup of dereferenced pointers in
the omapi handle, handling of pipe failures and status code
in omapi signal handler that may cause connect failure and
100% CPU use.
* Handle some DDNS corner cases better
* Several fixes to lease input and output
* Corrected side effect of printing all data strings as hex.
* Host record references leaks causing applying config to all
innocent clients.
* Memory leak when parsing a domain name
* Fixes to configuration parsing including infinite loop.
* Fixed for unexpected abort caused by a DHCPv6 decline.
For the complete list see the RELNOTES file, that is available
also online at http://ftp.isc.org/isc/dhcp/dhcp-4.2.1-RELNOTES.
- Removed obsolete optional-value-infinite-loop, no-libcrypto
and CVE-2011-0413.bnc667655 patches.
- Merged the dhclient-send-hostname and ldap patches.
-------------------------------------------------------------------
Mon Feb 21 14:51:43 UTC 2011 - mt@suse.de

View File

@ -17,7 +17,7 @@
# norootforbuild
%define isc_version 4.2.0-P2
%define isc_version 4.2.1
%define susefw2dir %{_sysconfdir}/sysconfig/SuSEfirewall2.d/services
%define omc_prefix /usr/share/omc
%define omc_svcdir %{omc_prefix}/svcinfo.d
@ -35,8 +35,8 @@ BuildRequires: dos2unix
License: BSD3c(or similar)
Group: Productivity/Networking/Boot/Servers
AutoReqProv: on
Version: 4.2.0.P2
Release: 8
Version: 4.2.1
Release: 0
Summary: Common Files Used by ISC DHCP Software
Url: http://www.isc.org/software/dhcp
Source0: dhcp-%{isc_version}.tar.bz2
@ -76,15 +76,13 @@ Patch13: dhcp-4.1.1-tmpfile.diff
Patch14: dhcp-4.1.1-in6_pktinfo-prototype.diff
Patch15: contrib-lease-path.diff
Patch20: dhcp-4.1.1-dhclient-exec-filedes.diff
Patch21: dhcp-4.2.0-P1-dhclient-send-hostname-rml.diff
Patch21: dhcp-4.2.1-dhclient-send-hostname-rml.diff
## patch lives here: http://www.suse.de/~mt/git/dhcp-ldap.git/
Patch30: dhcp-4.2.0-P1-ldap-patch-mt01.diff.bz2
Patch39: dhcp-4.2.0-P1-no-libcrypto.diff
Patch30: dhcp-4.2.1-ldap-patch-mt01.diff.bz2
Patch40: dhcp-4.1.1-P1-lpf-bind-msg-fix.diff
Patch41: dhcp-4.1.1-P1-relay-no-ip-on-interface.diff
Patch42: dhcp-4.1.1-P1-optional-value-infinite-loop.diff
Patch43: dhcp-4.2.0-P2-CVE-2011-0413.bnc667655.diff
Patch44: dhcp-4.2.0-xen-checksum.patch
Patch45: dhcp-4.2.1-dhclient-option-checks.bnc675052.diff
##
PreReq: /bin/touch /sbin/chkconfig sysconfig
BuildRoot: %{_tmppath}/%{name}-%{version}-build
@ -206,12 +204,10 @@ Authors:
%if 0%{?with_ldap}
%patch30 -p1
%endif
%patch39 -p1
%patch40 -p1
%patch41 -p1
%patch42 -p1
%patch43 -p1
%patch44 -p1
%patch45 -p1
##
find . -type f -name \*.cat\* -exec rm -f {} \;
dos2unix contrib/ms2isc/*