From f497e414345f853072cfebfd47a10b282378129f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 31 Mar 2021 09:49:03 +0200 Subject: [PATCH] Update to 2.85rc2 Fixes CVE-2021-3448 and few more regressions. --- .gitignore | 2 ++ dnsmasq-2.80-SIOCGSTAMP.patch | 59 --------------------------------- dnsmasq-2.81-rh1834454.patch | 62 ----------------------------------- dnsmasq.spec | 16 ++++----- sources | 4 +-- 5 files changed, 11 insertions(+), 132 deletions(-) delete mode 100644 dnsmasq-2.80-SIOCGSTAMP.patch delete mode 100644 dnsmasq-2.81-rh1834454.patch diff --git a/.gitignore b/.gitignore index 38f9c5c..0b98df3 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,5 @@ dnsmasq-2.52.tar.lzma /dnsmasq-2.83.tar.xz.asc /dnsmasq-2.84.tar.xz /dnsmasq-2.84.tar.xz.asc +/dnsmasq-2.85rc2.tar.xz +/dnsmasq-2.85rc2.tar.xz.asc diff --git a/dnsmasq-2.80-SIOCGSTAMP.patch b/dnsmasq-2.80-SIOCGSTAMP.patch deleted file mode 100644 index 4b08f5d..0000000 --- a/dnsmasq-2.80-SIOCGSTAMP.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 02b6209f8085cbe3443f8623ccdc31f020825507 Mon Sep 17 00:00:00 2001 -From: Petr Mensik -Date: Wed, 31 Jul 2019 20:35:35 +0200 -Subject: [PATCH] Recent kernel no longer supports SIOCGSTAMP - -Build without it defined by kernel headers. Do not try SO_TIMESTAMP -until fixed properly. ---- - src/dhcp.c | 30 +++++++++++++++++------------- - 1 file changed, 17 insertions(+), 13 deletions(-) - -diff --git a/src/dhcp.c b/src/dhcp.c -index bea4688..13373ae 100644 ---- a/src/dhcp.c -+++ b/src/dhcp.c -@@ -178,23 +178,27 @@ void dhcp_packet(time_t now, int pxe_fd) - (sz < (ssize_t)(sizeof(*mess) - sizeof(mess->options)))) - return; - -- #if defined (HAVE_LINUX_NETWORK) -+#if defined (HAVE_LINUX_NETWORK) -+#ifdef SIOCGSTAMP - if (ioctl(fd, SIOCGSTAMP, &tv) == 0) - recvtime = tv.tv_sec; -+#endif - - if (msg.msg_controllen >= sizeof(struct cmsghdr)) -- for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr)) -- if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO) -- { -- union { -- unsigned char *c; -- struct in_pktinfo *p; -- } p; -- p.c = CMSG_DATA(cmptr); -- iface_index = p.p->ipi_ifindex; -- if (p.p->ipi_addr.s_addr != INADDR_BROADCAST) -- unicast_dest = 1; -- } -+ { -+ for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr)) -+ if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO) -+ { -+ union { -+ unsigned char *c; -+ struct in_pktinfo *p; -+ } p; -+ p.c = CMSG_DATA(cmptr); -+ iface_index = p.p->ipi_ifindex; -+ if (p.p->ipi_addr.s_addr != INADDR_BROADCAST) -+ unicast_dest = 1; -+ } -+ } - - #elif defined(HAVE_BSD_NETWORK) - if (msg.msg_controllen >= sizeof(struct cmsghdr)) --- -2.26.2 - diff --git a/dnsmasq-2.81-rh1834454.patch b/dnsmasq-2.81-rh1834454.patch deleted file mode 100644 index f31b230..0000000 --- a/dnsmasq-2.81-rh1834454.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 3d113137fd64cd0723cbecab6a36a75d3ecfb0a6 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Harald=20Jens=C3=A5s?= -Date: Thu, 7 May 2020 00:33:54 +0200 -Subject: [PATCH 1/1] Fix regression in s_config_in_context() method - -Prior to commit 137286e9baecf6a3ba97722ef1b49c851b531810 -a config would not be considered in context if: -a) it has no address family flags set -b) it has the address family flag of current context set - -Since above commit config is considered in context if the -address family is the opposite of current context. - -The result is that a config with two dhcp-host records, -one for IPv6 and another for IPv4 no longer works, for -example with the below config the config with the IPv6 -address would be considered in context for a DHCP(v4) -request. - dhcp-host=52:54:00:bc:c3:fd,172.20.0.11,host2 - dhcp-host=52:54:00:bc:c3:fd,[fd12:3456:789a:1::aadd],host2 - -This commit restores the previous behavior. ---- - src/dhcp-common.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/src/dhcp-common.c b/src/dhcp-common.c -index eae9886..ffc78ca 100644 ---- a/src/dhcp-common.c -+++ b/src/dhcp-common.c -@@ -280,14 +280,18 @@ static int is_config_in_context(struct dhcp_context *context, struct dhcp_config - { - if (!context) /* called via find_config() from lease_update_from_configs() */ - return 1; -- -+ -+ /* No address present in config == in context */ -+ if (!(config->flags & (CONFIG_ADDR | CONFIG_ADDR6))) -+ return 1; -+ - #ifdef HAVE_DHCP6 - if (context->flags & CONTEXT_V6) - { - struct addrlist *addr_list; - - if (!(config->flags & CONFIG_ADDR6)) -- return 1; -+ return 0; - - for (; context; context = context->current) - for (addr_list = config->addr6; addr_list; addr_list = addr_list->next) -@@ -303,7 +307,7 @@ static int is_config_in_context(struct dhcp_context *context, struct dhcp_config - #endif - { - if (!(config->flags & CONFIG_ADDR)) -- return 1; -+ return 0; - - for (; context; context = context->current) - if ((config->flags & CONFIG_ADDR) && is_same_net(config->addr, context->start, context->netmask)) --- -2.25.4 diff --git a/dnsmasq.spec b/dnsmasq.spec index 592106f..008b841 100644 --- a/dnsmasq.spec +++ b/dnsmasq.spec @@ -1,5 +1,5 @@ %define testrelease 0 -%define releasecandidate 0 +%define releasecandidate 2 %if 0%{testrelease} %define extrapath test-releases/ %define extraversion test%{testrelease} @@ -19,8 +19,8 @@ %bcond_with sourcegit Name: dnsmasq -Version: 2.84 -Release: 2%{?extraversion:.%{extraversion}}%{?dist} +Version: 2.85 +Release: 1%{?extraversion:.%{extraversion}}%{?dist} Summary: A lightweight DHCP/caching DNS server License: GPLv2 or GPLv3 @@ -41,13 +41,8 @@ Patch1: dnsmasq-2.77-underflow.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1852373 Patch2: dnsmasq-2.81-configuration.patch Patch3: dnsmasq-2.78-fips.patch -Patch9: dnsmasq-2.80-SIOCGSTAMP.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1834454 -Patch17: dnsmasq-2.81-rh1834454.patch -# This is workaround to nettle bug #1549190 -# https://bugzilla.redhat.com/show_bug.cgi?id=1549190 -Requires: nettle >= 3.4 +Requires: nettle BuildRequires: dbus-devel BuildRequires: pkgconfig @@ -186,6 +181,9 @@ install -Dpm 644 %{SOURCE2} %{buildroot}%{_sysusersdir}/%{name}.conf %{_mandir}/man1/dhcp_* %changelog +* Wed Mar 31 2021 Petr Menšík - 2.85-1.rc2 +- Update to 2.85rc2 (CVE-2021-3448) + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.84-2 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. diff --git a/sources b/sources index 54bcc55..e9b68e6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (dnsmasq-2.84.tar.xz) = e84bdcdf3cf35f08e8492eb5aa89ee6543233bdb821d01f164783bd6d0913ec01c513e85e2109352c77e77142a1a94bedcd3361f37d7b2a9a5d35a02448e85c6 -SHA512 (dnsmasq-2.84.tar.xz.asc) = 097bc87a6aa9c5a01b3eefd4593b1de26c8565e2ad40bbf8627a0fa143101deeea313d0266eb068ab378996e0ac033f4a5b1890a823b69a9dc216049239e316a +SHA512 (dnsmasq-2.85rc2.tar.xz) = a27576702c7f162d84dafc0e1d5fb41c76647191eb687eab902b8d2f8e10cf4a901fc3273cae5f0c315c83d2987416c8d8da7eb35118294ffcc67a803c2c7f72 +SHA512 (dnsmasq-2.85rc2.tar.xz.asc) = 72bbe0c1602244af27172f4ae07c77e05095b747f0a353e8c883b6abcb2bba898fd83b85fa8631a62652ec784348481327b059e7ce8084613d6815a022e54d24