rpms/iscsi-initiator-utils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI iscsi-initiator-utils-6.2.1.11-1.git4b3e853.el9_8.2

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-11 16:29:05 -04:00
parent fcf11f7b79
commit 6e9e8a7e07
3 changed files with 289 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
SOURCES/0001-Fix-incorrect-parsing-of-node.discovery_type-static-.patch Normal file
View File

@ -0,0 +1,59 @@
From 290d16d6c6b6f4c78af119eb874484b2f995dc23 Mon Sep 17 00:00:00 2001
From: Mike Andrews <gubblebozer@gmail.com>
Date: Sun, 28 Dec 2025 19:19:39 -0500
Subject: [PATCH 1/1] Fix incorrect parsing of node.discovery_type "static" and
"fw" (#518)
Remove the unused DISCOVERY_TYPE_SLP enumeration value so that the strings
"static" and "fw" map to the correct enum values.
Previous versions supported an "slp" discovery_type. In d1d456cf28cd89, the
"slp" string was removed from the list of TYPE_INT_O string arguments when
processing DISC_TYPE and NODE_DISC_TYPE records in idbm_recinfo_discovery and
_idbm_node_rec_link. But, it was left in the discovery_type enum. The
resulting parsing logic would then map the string values "static" and "fw" to
the wrong enum values, and thus logic with unique action on
DISCOVERY_TYPE_STATIC and DISCOVERY_TYPE_FW did the wrong thing. Specifically,
- "static" mapped to DISCOVERY_TYPE_SLP, and
- "fw" mapped to DISCOVERY_TYPE_STATIC.
One manifestation of this bug is that you can no longer use iscsiadm to
manipulate or delete nodes with discovery_type = "static", as it falls through
to the default case in setup_disc_to_node_link.
Fixes #463.
---
libopeniscsiusr/idbm.h | 2 --
usr/config.h | 2 --
2 files changed, 4 deletions(-)
diff --git a/libopeniscsiusr/idbm.h b/libopeniscsiusr/idbm.h
index 0b201f4..512851d 100644
--- a/libopeniscsiusr/idbm.h
+++ b/libopeniscsiusr/idbm.h
@@ -78,8 +78,6 @@ enum discovery_type {
DISCOVERY_TYPE_SENDTARGETS,
DISCOVERY_TYPE_ISNS,
DISCOVERY_TYPE_OFFLOAD_SENDTARGETS,
- /* SLP is Not Used -- kept as place holder */
- DISCOVERY_TYPE_SLP_NOT_IMPLEMENTED,
DISCOVERY_TYPE_STATIC,
DISCOVERY_TYPE_FW,
};
diff --git a/usr/config.h b/usr/config.h
index a38a25d..94a8ad0 100644
--- a/usr/config.h
+++ b/usr/config.h
@@ -161,8 +161,6 @@ typedef enum discovery_type {
DISCOVERY_TYPE_SENDTARGETS,
DISCOVERY_TYPE_ISNS,
DISCOVERY_TYPE_OFFLOAD_SENDTARGETS,
- /* SLP is Not Used -- kept as place holder */
- DISCOVERY_TYPE_SLP_NOT_IMPLEMENTED,
DISCOVERY_TYPE_STATIC,
DISCOVERY_TYPE_FW,
} discovery_type_e;
--
2.54.0

209
SOURCES/iscsi-initiator-utils-6.2.1.11-RHEL-219481.patch Normal file
View File

@ -0,0 +1,209 @@
From 24f1c660510037dccb5ac7f81a9e9da4be455f77 Mon Sep 17 00:00:00 2001
From: Lee Duncan <lduncan@suse.com>
Date: Tue, 14 Jul 2026 12:16:58 -0700
Subject: [PATCH] Fix security issues recently discovered by Keith at Linneman
Labs (#535)
* Fix iscsiuio control-socket credential verification.
Prevent unprivilidged user from driving the isscsiuio control socket,
by validating connection against correct file descriptor.
Reference: CVE-2026-44944
Found-by: <keith@linnemanlabs.com>
* Improve iscsid discovery handling of IQN names.
Currently, IQN names received via discovery are assumed to be valid up
to the NULL character, i.e. the end of the supplied string. But this
may not be correct.
The ASCII characters allowed in an IQN are detailed in RFC 3722, section
6.2: "Currently Prohibited ASCII Characters".
Disallowing such characters should not break current usage, since the
disallowed characters should not be in an IQN anyway. For example, they
include characters like forward slashes, backward slashes, spaces,
control characters, etc..
Open-iscsi uses target names as directory names in the "database"
directory (typically /var/lib/iscsi), so fixing this eliminates discovery
target name containing sequences like "../../../*" from being allowed.
Reference: CVE-2026-44943
Found-by: <keith@linnemanlabs.com>
---
iscsiuio/src/unix/iscsid_ipc.c | 4 ++--
usr/discovery.c | 18 ++++++++++++++++++
usr/initiator.h | 3 +++
usr/initiator_common.c | 33 +++++++++++++++++++++++++++++++++
usr/iscsiadm.c | 4 ++++
usr/iscsistart.c | 5 ++++-
6 files changed, 64 insertions(+), 3 deletions(-)
diff --git a/iscsiuio/src/unix/iscsid_ipc.c b/iscsiuio/src/unix/iscsid_ipc.c
index bcd6437..c4740fa 100644
--- a/iscsiuio/src/unix/iscsid_ipc.c
+++ b/iscsiuio/src/unix/iscsid_ipc.c
@@ -1120,10 +1120,10 @@ static void *iscsid_loop(void *arg)
continue;
}
- if (!mgmt_peeruser(iscsid_opts.fd, user) || strncmp(user, "root", PEERUSER_MAX)) {
+ if (!mgmt_peeruser(s2, user) || strncmp(user, "root", PEERUSER_MAX)) {
close(s2);
ILOG_ERR(PFX "Access error: non-administrative connection rejected");
- break;
+ continue;
}
/* this closes the file descriptor s2 */
diff --git a/usr/discovery.c b/usr/discovery.c
index c163128..9317f39 100644
--- a/usr/discovery.c
+++ b/usr/discovery.c
@@ -138,7 +138,9 @@ int discovery_isns_query(struct discovery_rec *drec, const char *iname,
uint32_t status;
int rc;
+
isns_config.ic_security = 0;
+
source = isns_source_create_iscsi(iname);
if (!source)
return ISCSI_ERR_NOMEM;
@@ -216,6 +218,11 @@ int discovery_isns_query(struct discovery_rec *drec, const char *iname,
continue;
}
+ if (!iqn_name_valid(pg_tgt)) {
+ log_error("iSNS discovery Target Name invalid: ignoring it");
+ continue;
+ }
+
if (!isns_object_get_ipaddr(obj, ISNS_TAG_PG_PORTAL_IP_ADDR,
&in_addr)) {
log_debug(1, "Missing addr");
@@ -294,6 +301,11 @@ static int discovery_isns_reg_node(const char *iname, int op_reg)
log_debug(1, "trying to %s %s with iSNS server.",
op_reg ? "register" : "deregister", iname);
+ if (!iqn_name_valid(iname)) {
+ log_error("iSNS initiatorname invalid: ignoring it");
+ return ISCSI_ERR_INVAL;
+ }
+
source = isns_source_create_iscsi(iname);
if (!source)
return ISCSI_ERR_NOMEM;
@@ -613,6 +625,12 @@ add_target_record(char *name, char *end, discovery_rec_t *drec,
log_error("TargetName %s too long, ignoring", name);
return 0;
}
+
+ if (!iqn_name_valid(name)) {
+ log_error("Discovery TargetName invalid, ignoring");
+ return 0;
+ }
+
text = name + length;
/* skip NULs after the name */
diff --git a/usr/initiator.h b/usr/initiator.h
index b174168..6c56a9f 100644
--- a/usr/initiator.h
+++ b/usr/initiator.h
@@ -21,6 +21,7 @@
#define INITIATOR_H
#include <stdint.h>
+#include <stdbool.h>
#include <net/if.h>
#include <sys/time.h>
@@ -411,4 +412,6 @@ extern int iscsi_set_net_config(struct iscsi_transport *t,
extern void iscsi_session_init_params(struct iscsi_session *session);
extern int session_in_use(int sid);
+
+extern bool iqn_name_valid(const char *name);
#endif /* INITIATOR_H */
diff --git a/usr/initiator_common.c b/usr/initiator_common.c
index 80b7652..3d58023 100644
--- a/usr/initiator_common.c
+++ b/usr/initiator_common.c
@@ -24,6 +24,7 @@
#include <stdlib.h>
#include <errno.h>
#include <dirent.h>
+#include <stdbool.h>
#include <libmount/libmount.h>
#include "iface.h"
@@ -749,3 +750,35 @@ int iscsi_host_set_net_params(struct iface_rec *iface,
}
return 0;
}
+
+/**
+ * @brief iqn_name_valid -- return whether or not the supplied
+ * IQN name valid
+ *
+ * @details Checks for invalid characters, using RFC 3722,
+ * section 6.2, "Currently Prohibited ASCII Characters"
+ *
+ * @param name the IQN name we are checking
+ * @return true iff the whole name (string) has valid
+ * charaters
+ */
+bool
+iqn_name_valid(const char *name)
+{
+ unsigned char *cp;
+
+ /* ensure no invalid characters */
+ for (cp = name; *cp != '\0'; cp++)
+ if ((*cp <= '\x2c') ||
+ (*cp == '\x2f') ||
+ ((*cp >= '\x3b') && (*cp <= '\x40')) ||
+ ((*cp >= '\x5b') && (*cp <= '\x60')) ||
+ (*cp >= '\x7b')) {
+ log_debug(8, "IQN name is invalid: \"%s\" (char: '%#02x')",
+ name, *cp);
+ return false;
+ }
+
+ log_debug(8, "IQN name has all valid characters: \"%s\"", name);
+ return true;
+}
diff --git a/usr/iscsiadm.c b/usr/iscsiadm.c
index 340ac5a..d7b9234 100644
--- a/usr/iscsiadm.c
+++ b/usr/iscsiadm.c
@@ -1165,6 +1165,10 @@ exec_disc_op_on_recs(discovery_rec_t *drec, struct list_head *rec_list,
if (op & OP_NEW || op & OP_UPDATE) {
/* now add/update records */
list_for_each_entry(new_rec, rec_list, list) {
+ if (!iqn_name_valid(new_rec->name)) {
+ log_error("FW discovery Target Name invalid: ignoring it");
+ continue;
+ }
rc = idbm_add_node(new_rec, drec, op & OP_UPDATE);
if (rc)
log_error("Could not add/update "
diff --git a/usr/iscsistart.c b/usr/iscsistart.c
index df92d24..6f133d6 100644
--- a/usr/iscsistart.c
+++ b/usr/iscsistart.c
@@ -403,7 +403,10 @@ int main(int argc, char *argv[])
case 't':
check_str_param_len(optarg, TARGET_NAME_MAXLEN,
"targetname");
- strlcpy(config_rec.name, optarg, TARGET_NAME_MAXLEN);
+ if (!iqn_name_valid(optarg))
+ log_error("iscsistart Target Name invalid: ignoring");
+ else
+ strlcpy(config_rec.name, optarg, TARGET_NAME_MAXLEN);
break;
case 'g':
config_rec.tpgt = atoi(optarg);

23
SPECS/iscsi-initiator-utils.spec
View File

@ -10,14 +10,17 @@
Summary: iSCSI daemon and utility programs
Name: iscsi-initiator-utils
Version: 6.%{open_iscsi_version}.%{open_iscsi_build}
Release: 0.git%{shortcommit0}%{?dist}
Release: 1.git%{shortcommit0}%{?dist}.2
License: GPL-2.0-or-later
URL: https://github.com/open-iscsi/open-iscsi
Source0: https://github.com/open-iscsi/open-iscsi/archive/%{commit0}.tar.gz#/open-iscsi-%{shortcommit0}.tar.gz
Source4: 04-iscsi
Source5: iscsi-tmpfiles.conf
Patch01: 0001-meson-don-t-hide-things-with-Wno-all.patch
Patch00: 0001-meson-don-t-hide-things-with-Wno-all.patch
# https://github.com/open-iscsi/open-iscsi/commit/290d16d6c6b6f4c78af119eb874484b2f995dc23
Patch01: 0001-Fix-incorrect-parsing-of-node.discovery_type-static-.patch
# https://github.com/open-iscsi/open-iscsi/pull/394/
Patch02: 0002-Currently-when-iscsi.service-is-installed-it-creates.patch
@ -38,6 +41,11 @@ Patch102: 0102-libiscsi-introduce-sessions-API.patch
Patch103: 0103-fix-libiscsi-firmware-discovery-issue-with-NULL-drec.patch
Patch104: 0104-libiscsi-build-fixes.patch
# https://issues.redhat.com/browse/RHEL-219481
# https://issues.redhat.com/browse/RHEL-219469
# https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e
Patch105: iscsi-initiator-utils-6.2.1.11-RHEL-219481.patch
BuildRequires: meson git
BuildRequires: flex bison doxygen kmod-devel systemd-units
BuildRequires: autoconf automake libtool libmount-devel openssl-devel
@ -271,6 +279,17 @@ systemctl --no-reload preset iscsi.service iscsi-starter.service &>/dev/null ||
%endif
%changelog
* Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 6.2.1.11-1.git4b3e853.2
- fix CVE-2026-44943: path traversal via IQN names in discovery
- fix CVE-2026-44944: iscsiuio socket credential verification bypass
* Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 6.2.1.11-1.git4b3e853.1
- fix CVE-2026-44943: path traversal via IQN names in discovery
- fix CVE-2026-44944: iscsiuio socket credential verification bypass
* Thu Jun 25 2026 Chris Leech <cleech@redhat.com> - 6.2.1.11-1.git4b3e853
- fix regression in fw and static node records
* Wed May 07 2025 Chris Leech <cleech@redhat.com> - 6.2.1.11-0.git4b3e853
- Open-iSCSI upstream 2.1.11