Backport removal gethostbyname2 uses from the upstream
Also fix issues spotted by covscan Related: rhbz#1975812 Resolves: rhbz#1938784 Signed-off-by: Daiki Ueno <dueno@redhat.com>
This commit is contained in:
Daiki Ueno
parent
10cb60dea1
commit
e60042d1e1
101
libreswan-4.4-covscan.patch
Normal file
101
libreswan-4.4-covscan.patch
Normal file
@ -0,0 +1,101 @@
|
||||
From 835f711502fa07825b27201cb772e911c59d54b0 Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <dueno@redhat.com>
|
||||
Date: Wed, 21 Jul 2021 10:10:43 +0200
|
||||
Subject: [PATCH] ipsec barf: fix shell test expression
|
||||
|
||||
Spotted by shellcheck:
|
||||
|
||||
/usr/libexec/ipsec/barf:55:5: error[SC1073]: Couldn't parse this test expression. Fix to allow more checks.
|
||||
# 53| for f
|
||||
# 54| do
|
||||
# 55|-> if [ -s ${LOGS}/${f} -a \
|
||||
# 56| -f ${LOGS}/${f} -a \
|
||||
# 57| grep -E -q "${s}" ${LOGS}/${f} 2>/dev/null ]
|
||||
|
||||
Signed-off-by: Daiki Ueno <dueno@redhat.com>
|
||||
---
|
||||
programs/barf/barf.in | 16 ++++++++--------
|
||||
1 file changed, 8 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/programs/barf/barf.in b/programs/barf/barf.in
|
||||
index e76c62f338..499916da4b 100755
|
||||
--- a/programs/barf/barf.in
|
||||
+++ b/programs/barf/barf.in
|
||||
@@ -53,8 +53,8 @@ findlog() { # findlog string fallbackstring possiblefile ...
|
||||
for f
|
||||
do
|
||||
if [ -s ${LOGS}/${f} -a \
|
||||
- -f ${LOGS}/${f} -a \
|
||||
- grep -E -q "${s}" ${LOGS}/${f} 2>/dev/null ]
|
||||
+ -f ${LOGS}/${f} ] && \
|
||||
+ grep -E -q "${s}" ${LOGS}/${f} 2>/dev/null
|
||||
then
|
||||
# aha, this one has it
|
||||
findlog_file=${LOGS}/${f}
|
||||
@@ -66,8 +66,8 @@ findlog() { # findlog string fallbackstring possiblefile ...
|
||||
for f
|
||||
do
|
||||
if [ -s ${LOGS}/${f} -a \
|
||||
- -f ${LOGS}/${f} -a \
|
||||
- grep -E -q "${t}" ${LOGS}/${f} 2>/dev/null ]
|
||||
+ -f ${LOGS}/${f} ] && \
|
||||
+ grep -E -q "${t}" ${LOGS}/${f} 2>/dev/null
|
||||
then
|
||||
# aha, this one has it
|
||||
findlog_file=${LOGS}/${f}
|
||||
@@ -80,8 +80,8 @@ findlog() { # findlog string fallbackstring possiblefile ...
|
||||
for f in $(ls -t ${LOGS} | grep -E -v 'lastlog|tmp|^mail|\.(gz|Z)$')
|
||||
do
|
||||
if [ -f ${LOGS}/${f} -a \
|
||||
- ! -d ${LOGS}/${f} -a \
|
||||
- grep -E -q "${s}" ${LOGS}/${f} 2>/dev/null ]
|
||||
+ ! -d ${LOGS}/${f} ] && \
|
||||
+ grep -E -q "${s}" ${LOGS}/${f} 2>/dev/null
|
||||
then
|
||||
# found it
|
||||
findlog_file=${LOGS}/${f}
|
||||
@@ -93,8 +93,8 @@ findlog() { # findlog string fallbackstring possiblefile ...
|
||||
for f in $(ls -t ${LOGS} | grep -E -v 'lastlog|tmp|^mail|\.(gz|Z)$')
|
||||
do
|
||||
if [ -s ${LOGS}/${f} -a \
|
||||
- -f ${LOGS}/${f} -a \
|
||||
- grep -E -q "${t}" ${LOGS}/${f} 2>/dev/null ]
|
||||
+ -f ${LOGS}/${f} ] && \
|
||||
+ grep -E -q "${t}" ${LOGS}/${f} 2>/dev/null
|
||||
then
|
||||
# found it
|
||||
findlog_file=${LOGS}/${f}
|
||||
--
|
||||
2.31.1
|
||||
|
||||
From 00ee1189626db8dcce084cb481ad0c49b435f4ff Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <dueno@redhat.com>
|
||||
Date: Wed, 21 Jul 2021 10:54:58 +0200
|
||||
Subject: [PATCH] testing jambufcheck: add missing va_end calls in error path
|
||||
|
||||
Signed-off-by: Daiki Ueno <dueno@redhat.com>
|
||||
---
|
||||
testing/programs/jambufcheck/jambufcheck.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/testing/programs/jambufcheck/jambufcheck.c b/testing/programs/jambufcheck/jambufcheck.c
|
||||
index 72baaa5a1d..23a47b15f6 100644
|
||||
--- a/testing/programs/jambufcheck/jambufcheck.c
|
||||
+++ b/testing/programs/jambufcheck/jambufcheck.c
|
||||
@@ -104,11 +104,13 @@ static void check_jambuf(bool ok, const char *expect, ...)
|
||||
}
|
||||
break;
|
||||
default:
|
||||
+ va_end(ap);
|
||||
FAIL("bad case");
|
||||
return;
|
||||
}
|
||||
}
|
||||
if (ok && !jambuf_ok(&buf)) {
|
||||
+ va_end(ap);
|
||||
FAIL("unexpectedly failed writing '%s'",
|
||||
str == NULL ? "(null)" : str);
|
||||
return;
|
||||
--
|
||||
2.31.1
|
||||
|
||||
168
libreswan-4.4-getaddrinfo.patch
Normal file
168
libreswan-4.4-getaddrinfo.patch
Normal file
@ -0,0 +1,168 @@
|
||||
diff -up ./lib/libswan/ttoaddress.c.getaddrinfo ./lib/libswan/ttoaddress.c
|
||||
--- ./lib/libswan/ttoaddress.c.getaddrinfo 2021-04-22 17:24:33.000000000 +0200
|
||||
+++ ./lib/libswan/ttoaddress.c 2021-07-22 13:16:19.073745043 +0200
|
||||
@@ -20,6 +20,7 @@
|
||||
#include <netdb.h> /* for gethostbyname2() */
|
||||
|
||||
#include "ip_address.h"
|
||||
+#include "ip_sockaddr.h"
|
||||
#include "ip_info.h"
|
||||
#include "lswalloc.h" /* for alloc_things(), pfree() */
|
||||
#include "lswlog.h" /* for pexpect() */
|
||||
@@ -75,56 +76,6 @@ static err_t ttoaddr_base(shunk_t src,
|
||||
}
|
||||
|
||||
/*
|
||||
- * tryname - try it as a name
|
||||
- *
|
||||
- * Error return is intricate because we cannot compose a static string.
|
||||
- */
|
||||
-static err_t tryname(const char *p,
|
||||
- int af,
|
||||
- int suggested_af, /* kind(s) of numeric addressing tried */
|
||||
- ip_address *dst)
|
||||
-{
|
||||
- struct hostent *h = gethostbyname2(p, af);
|
||||
- if (h != NULL) {
|
||||
- if (h->h_addrtype != af) {
|
||||
- return "address-type mismatch from gethostbyname2!!!";
|
||||
- }
|
||||
-
|
||||
- return data_to_address(h->h_addr, h->h_length, aftoinfo(af), dst);
|
||||
- }
|
||||
-
|
||||
- if (af == AF_INET6) {
|
||||
- if (suggested_af == AF_INET6) {
|
||||
- return "not a numeric IPv6 address and name lookup failed (no validation performed)";
|
||||
- } else /* AF_UNSPEC */ {
|
||||
- return "not a numeric IPv4 or IPv6 address and name lookup failed (no validation performed)";
|
||||
- }
|
||||
- }
|
||||
-
|
||||
- pexpect(af == AF_INET);
|
||||
-
|
||||
- /* like, windows even has an /etc/networks? */
|
||||
- struct netent *ne = getnetbyname(p);
|
||||
- if (ne == NULL) {
|
||||
- /* intricate because we cannot compose a static string */
|
||||
- if (suggested_af == AF_INET) {
|
||||
- return "not a numeric IPv4 address and name lookup failed (no validation performed)";
|
||||
- } else {
|
||||
- return "not a numeric IPv4 or IPv6 address and name lookup failed (no validation performed)";
|
||||
- }
|
||||
- }
|
||||
-
|
||||
- if (ne->n_addrtype != af) {
|
||||
- return "address-type mismatch from getnetbyname!!!";
|
||||
- }
|
||||
-
|
||||
- /* apparently .n_net is in host order */
|
||||
- struct in_addr in = { htonl(ne->n_net), };
|
||||
- *dst = address_from_in_addr(&in);
|
||||
- return NULL;
|
||||
-}
|
||||
-
|
||||
-/*
|
||||
* tryhex - try conversion as an eight-digit hex number (AF_INET only)
|
||||
*/
|
||||
|
||||
@@ -401,57 +352,56 @@ err_t getpiece(const char **srcp, /* *sr
|
||||
|
||||
err_t ttoaddress_dns(shunk_t src, const struct ip_info *afi, ip_address *dst)
|
||||
{
|
||||
+ char *name = clone_hunk_as_string(src, "ttoaddress_dns"); /* must free */
|
||||
+ struct addrinfo *res = NULL;
|
||||
+ const struct addrinfo hints = (struct addrinfo) {
|
||||
+ .ai_family = afi == NULL ? AF_UNSPEC : afi->af,
|
||||
+ };
|
||||
*dst = unset_address;
|
||||
- if (src.len == 0) {
|
||||
- return "empty string";
|
||||
- }
|
||||
-
|
||||
- bool was_numeric = true;
|
||||
- err_t err = ttoaddr_base(src, afi, &was_numeric, dst);
|
||||
- if (was_numeric) {
|
||||
- /* no-point in continuing */
|
||||
- return err;
|
||||
- }
|
||||
|
||||
- /* err == non-numeric */
|
||||
+ int eai = getaddrinfo(name, NULL, &hints, &res);
|
||||
+ err_t err = NULL;
|
||||
|
||||
- for (const char *cp = src.ptr, *end = cp + src.len; cp < end; cp++) {
|
||||
+ if (eai != 0) {
|
||||
/*
|
||||
- * Legal ASCII characters in a domain name.
|
||||
- * Underscore technically is not, but is a common
|
||||
- * misunderstanding. Non-ASCII characters are simply
|
||||
- * exempted from checking at the moment, to allow for
|
||||
- * UTF-8 encoded stuff; the purpose of this check is
|
||||
- * merely to catch blatant errors.
|
||||
- *
|
||||
- * XXX: Suspect the ISASCII() check can be dropped -
|
||||
- * utf-8 isn't allowed in DNS names and without a
|
||||
- * utf-8 parser the check is flawed.
|
||||
+ * return system-supplied diagnostic
|
||||
+ * except where it is particularly confusing.
|
||||
+ * "Name or service not unknown." is terrible.
|
||||
*/
|
||||
- static const char namechars[] =
|
||||
- "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ-_.";
|
||||
-#define ISASCII(c) (((c) & 0x80) == 0)
|
||||
- if (ISASCII(*cp) && strchr(namechars, *cp) == NULL) {
|
||||
- return "illegal (non-DNS-name) character in name";
|
||||
+ err = eai == EAI_NONAME ? "NAME is unknown" : gai_strerror(eai);
|
||||
+ } else if (res == NULL) {
|
||||
+ err = "not a numeric IP address and name lookup failed (no validation performed)";
|
||||
+ } else {
|
||||
+ /* always choose IPv4 result if there is one */
|
||||
+ struct addrinfo *winner = res;
|
||||
+
|
||||
+ for (struct addrinfo *r = res; r!= NULL; r = r->ai_next) {
|
||||
+ if (r->ai_family == AF_INET) {
|
||||
+ winner = r;
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ ip_port mbz = { .hport = 0 };
|
||||
+ ip_sockaddr sa = {
|
||||
+ .len = winner->ai_addrlen,
|
||||
+ };
|
||||
+ passert(sizeof(sa.sa) >= winner->ai_addrlen);
|
||||
+ memcpy(&sa.sa, winner->ai_addr, winner->ai_addrlen);
|
||||
+ passert(sa.sa.sa.sa_family == winner->ai_family);
|
||||
+ /* boneheaded getaddrinfo(3) leaves port field uninitialized */
|
||||
+ if (winner->ai_family == AF_INET) {
|
||||
+ sa.sa.sin.sin_port = 0;
|
||||
+ } else if (winner->ai_family == AF_INET6) {
|
||||
+ sa.sa.sin6.sin6_port = 0;
|
||||
+ } else {
|
||||
+ bad_case(winner->ai_family);
|
||||
}
|
||||
+ err = sockaddr_to_address_port(sa, dst, &mbz);
|
||||
+ passert(hport(mbz) == 0);
|
||||
}
|
||||
|
||||
- /*
|
||||
- * need a guarenteed null terminated string
|
||||
- */
|
||||
- char *name = clone_hunk_as_string(src, "ttoaddress_dns"); /* must free */
|
||||
- int suggested_af = afi == NULL ? AF_UNSPEC : afi->af;
|
||||
- err_t v4err = NULL, v6err = NULL;
|
||||
- if (err && (suggested_af == AF_UNSPEC || suggested_af == AF_INET)) {
|
||||
- err = v4err = tryname(name, AF_INET, suggested_af, dst);
|
||||
- }
|
||||
- if (err && (suggested_af == AF_UNSPEC || suggested_af == AF_INET6)) {
|
||||
- err = v6err = tryname(name, AF_INET6, suggested_af, dst);
|
||||
- }
|
||||
- /* prefer the IPv4 error */
|
||||
- if (err != NULL && v4err != NULL) {
|
||||
- err = v4err;
|
||||
- }
|
||||
+ freeaddrinfo(res);
|
||||
pfree(name);
|
||||
return err;
|
||||
}
|
||||
@ -31,7 +31,7 @@ Name: libreswan
|
||||
Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
|
||||
# version is generated in the release script
|
||||
Version: 4.4
|
||||
Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}
|
||||
Release: %{?prever:0.}3%{?prever:.%{prever}}%{?dist}
|
||||
License: GPLv2
|
||||
Url: https://libreswan.org/
|
||||
Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
|
||||
@ -42,6 +42,9 @@ Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
|
||||
%endif
|
||||
Patch0: libreswan-4.2-openssl3.patch
|
||||
Patch1: libreswan-4.4-ipcheck.patch
|
||||
# Partially backported https://github.com/libreswan/libreswan/commit/4af9072e62237daad9fea9bb769f6dfbdf2e4ea1
|
||||
Patch2: libreswan-4.4-getaddrinfo.patch
|
||||
Patch3: libreswan-4.4-covscan.patch
|
||||
|
||||
BuildRequires: audit-libs-devel
|
||||
BuildRequires: bison
|
||||
@ -101,6 +104,8 @@ sed -i "s:#[ ]*include \(.*\)\(/crypto-policies/back-ends/libreswan.config\)$:in
|
||||
# disable some testing tools that throw warnings on arm
|
||||
%patch1 -p1
|
||||
sed -i "s/SUBDIRS += ipcheck/#SUBDIRS += ipchec/" testing/programs/Makefile
|
||||
%patch2 -p1 -b .getaddrinfo
|
||||
%patch3 -p1 -b .covscan
|
||||
|
||||
%build
|
||||
make %{?_smp_mflags} \
|
||||
@ -200,6 +205,10 @@ certutil -N -d sql:$tmpdir --empty-password
|
||||
%doc %{_mandir}/*/*
|
||||
|
||||
%changelog
|
||||
* Wed Jul 21 2021 Daiki Ueno <dueno@redhat.com> - 4.4-3
|
||||
- Backport removal gethostbyname2 uses from the upstream
|
||||
- Fix issues spotted by covscan (rhbz#1938784)
|
||||
|
||||
* Tue Jul 13 2021 Daiki Ueno <dueno@redhat.com> - 4.4-2
|
||||
- Rebuild with newer GCC to fix annocheck failures
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user