rpms/tcpdump
6
0
Fork 0
Code Issues Pull Requests Releases Activity

- update to 3.9.7

Browse Source 
- with -C option, drop root privileges before opening first savefile
    (#244860)
- update tcpslice to 1.2a3
- include time patch from Debian to fix tcpslice on 64-bit architectures
This commit is contained in:
Miroslav Lichvar 2007-07-24 16:09:10 +00:00
parent 68add83a26
commit a858a8720c
10 changed files with 145 additions and 194 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.cvsignore
View File

@ -1,2 +1,2 @@
tcpslice-CVS.20010207.tar.gz
tcpdump-3.9.5.tar.gz
tcpslice-1.2a3.tar.gz
tcpdump-3.9.7.tar.gz

4
sources
View File

@ -1,2 +1,2 @@
97cc59ddb3202f74d22261e49aa07115 tcpslice-CVS.20010207.tar.gz
2135e7b1f09af0eaf66d2af822bed44a tcpdump-3.9.5.tar.gz
e329cbeb7e589f132d92c3447c477190 tcpslice-1.2a3.tar.gz
2aacf4dc9a3bc500a8b4f3887a32cdd5 tcpdump-3.9.7.tar.gz

10
tcpdump-3.6.2-tcpslice-time.patch
View File

@ -1,10 +0,0 @@
--- tcpdump-3.6.2/tcpslice/tcpslice.c Tue Nov 14 21:10:22 2000
+++ tcpdump-3.6.2.new/tcpslice/tcpslice.c Sat Apr 14 19:14:13 2001
@@ -47,6 +47,7 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <time.h>
#include "gnuc.h"
#ifdef HAVE_OS_PROTO_H

106
tcpdump-3.9.4-ring-buffers.patch
View File

@ -1,106 +0,0 @@
--- tcpdump-3.9.4/tcpdump.c.ring 2005-08-23 12:29:41.000000000 +0200
+++ tcpdump-3.9.4/tcpdump.c 2005-12-20 13:32:45.000000000 +0100
@@ -109,7 +109,8 @@
static void ndo_default_print(netdissect_options *, const u_char *, u_int);
static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *);
static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
-static void droproot(const char *, const char *);
+static void droproot(const char *, const char *, int);
+static void setroot(void);
static void ndo_error(netdissect_options *ndo, const char *fmt, ...);
static void ndo_warning(netdissect_options *ndo, const char *fmt, ...);
@@ -295,6 +296,7 @@
char *WFileName;
pcap_t *pd;
pcap_dumper_t *p;
+ char *username;
};
static void
@@ -366,9 +368,10 @@
#ifndef WIN32
/* Drop root privileges and chroot if necessary */
static void
-droproot(const char *username, const char *chroot_dir)
+droproot(const char *username, const char *chroot_dir, int set_uid)
{
struct passwd *pw = NULL;
+ int res;
if (chroot_dir && !username) {
fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n");
@@ -384,8 +387,11 @@
exit(1);
}
}
- if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
- setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) {
+ res = (initgroups(pw->pw_name, pw->pw_gid) != 0) ||
+ (set_uid ? (setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) :
+ (setegid(pw->pw_gid) != 0 || seteuid(pw->pw_uid) != 0));
+
+ if (res) {
fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n",
username,
(unsigned long)pw->pw_uid,
@@ -400,6 +406,17 @@
exit(1);
}
}
+
+/* Set root privileges */
+static void
+setroot(void)
+{
+ if (setegid(0) != 0 || seteuid(0) != 0) {
+ fprintf(stderr, "tcpdump: Couldn't change to root uid=0 gid=0: %s\n",
+ pcap_strerror(errno));
+ exit(1);
+ }
+}
#endif /* WIN32 */
static int
@@ -463,6 +480,7 @@
int devnum;
#endif
int status;
+ int set_uid = 1;
#ifdef WIN32
u_int UserBufferSize = 1000000;
if(wsockinit() != 0) return 1;
@@ -972,7 +990,9 @@
dumpinfo.WFileName = WFileName;
dumpinfo.pd = pd;
dumpinfo.p = p;
+ dumpinfo.username = username;
pcap_userdata = (u_char *)&dumpinfo;
+ set_uid = 0;
} else {
callback = dump_packet;
pcap_userdata = (u_char *)p;
@@ -998,7 +1018,7 @@
*/
if (getuid() == 0 || geteuid() == 0) {
if (username || chroot_dir)
- droproot(username, chroot_dir);
+ droproot(username, chroot_dir, set_uid);
}
#endif /* WIN32 */
#ifdef SIGINFO
@@ -1181,7 +1201,14 @@
if (name == NULL)
error("dump_packet_and_trunc: malloc");
MakeFilename(name, dump_info->WFileName, Cflag_count, WflagChars);
+#ifndef WIN32
+ setroot();
+#endif /* WIN32 */
dump_info->p = pcap_dump_open(dump_info->pd, name);
+#ifndef WIN32
+ if (dump_info->username)
+ droproot(dump_info->username, NULL, 0);
+#endif /* WIN32 */
free(name);
if (dump_info->p == NULL)
error("%s", pcap_geterr(pd));

17
tcpdump-3.9.5-80211.patch
View File

@ -1,17 +0,0 @@
Index: tcpdump/print-802_11.c
===================================================================
RCS file: /tcpdump/master/tcpdump/print-802_11.c,v
retrieving revision 1.42
retrieving revision 1.43
diff -u -r1.42 -r1.43
--- tcpdump/print-802_11.c 13 Jun 2006 22:25:30 -0000 1.42
+++ tcpdump/print-802_11.c 1 Feb 2007 02:18:18 -0000 1.43
@@ -264,7 +264,7 @@
if (pbody->tim.length <= 3)
break;
- if (pbody->rates.length > sizeof pbody->tim.bitmap)
+ if (pbody->tim.length - 3 > sizeof pbody->tim.bitmap)
return;
if (!TTEST2(*(p + offset), pbody->tim.length - 3))
return;

22
tcpdump-3.9.5-man.patch
View File

@ -1,22 +0,0 @@
--- tcpdump-3.9.5/tcpslice/tcpslice.1.man 2001-02-07 16:11:32.000000000 +0100
+++ tcpdump-3.9.5/tcpslice/tcpslice.1 2006-11-28 17:37:00.000000000 +0100
@@ -19,7 +19,7 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
-.TH TCPSLICE 1 "21 December 1996"
+.TH TCPSLICE 8 "21 December 1996"
.SH NAME
tcpslice \- extract pieces of and/or glue together tcpdump files
.SH SYNOPSIS
--- tcpdump-3.9.5/tcpdump.1.man 2005-12-05 21:11:19.000000000 +0100
+++ tcpdump-3.9.5/tcpdump.1 2006-11-28 17:37:00.000000000 +0100
@@ -22,7 +22,7 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
-.TH TCPDUMP 1 "18 April 2005"
+.TH TCPDUMP 8 "18 April 2005"
.SH NAME
tcpdump \- dump traffic on a network
.SH SYNOPSIS

20
tcpdump-3.9.5-nolocalpcap.patch
View File

@ -1,20 +0,0 @@
--- tcpdump-3.9.5/configure.nolocalpcap 2005-11-08 04:00:53.000000000 +0100
+++ tcpdump-3.9.5/configure 2006-11-29 12:40:24.000000000 +0100
@@ -9086,6 +9086,7 @@
places=`ls $srcdir/.. | sed -e 's,/$,,' -e "s,^,$srcdir/../," | \
egrep '/libpcap-[0-9]*.[0-9]*(.[0-9]*)?([ab][0-9]*)?$'`
for dir in $places $srcdir/../libpcap $srcdir/libpcap ; do
+ break
basedir=`echo $dir | sed -e 's/[ab][0-9]*$//'`
if test $lastdir = $basedir ; then
continue;
--- tcpdump-3.9.5/tcpslice/configure.nolocalpcap 2000-11-14 20:10:42.000000000 +0100
+++ tcpdump-3.9.5/tcpslice/configure 2006-11-29 12:42:02.000000000 +0100
@@ -1870,6 +1870,7 @@
places=`ls .. | sed -e 's,/$,,' -e 's,^,../,' | \
egrep '/libpcap-[0-9]*\.[0-9]*(\.[0-9]*)?([ab][0-9]*)?$'`
for dir in $places ../libpcap libpcap ; do
+ break
basedir=`echo $dir | sed -e 's/[ab][0-9]*$//'`
if test $lastdir = $basedir ; then
continue;

46
tcpdump-3.9.7-droproot.patch Normal file
View File

@ -0,0 +1,46 @@
--- tcpdump-3.9.7/tcpdump.c.droproot 2006-09-19 21:07:57.000000000 +0200
+++ tcpdump-3.9.7/tcpdump.c 2007-07-24 16:15:54.000000000 +0200
@@ -958,6 +958,11 @@ main(int argc, char **argv)
(void)setsignal(SIGHUP, oldhandler);
#endif /* WIN32 */
+ if (Cflag != 0 && (getuid() == 0 || geteuid() == 0)) {
+ if (username || chroot_dir)
+ droproot(username, chroot_dir);
+ }
+
if (pcap_setfilter(pd, &fcode) < 0)
error("%s", pcap_geterr(pd));
if (WFileName) {
@@ -999,7 +1004,7 @@ main(int argc, char **argv)
* We cannot do this earlier, because we want to be able to open
* the file (if done) for writing before giving up permissions.
*/
- if (getuid() == 0 || geteuid() == 0) {
+ if (Cflag == 0 && (getuid() == 0 || geteuid() == 0)) {
if (username || chroot_dir)
droproot(username, chroot_dir);
}
--- tcpdump-3.9.7/tcpdump.1.droproot 2007-07-24 16:15:54.000000000 +0200
+++ tcpdump-3.9.7/tcpdump.1 2007-07-24 16:15:54.000000000 +0200
@@ -264,6 +264,9 @@ have the name specified with the
flag, with a number after it, starting at 1 and continuing upward.
The units of \fIfile_size\fP are millions of bytes (1,000,000 bytes,
not 1,048,576 bytes).
+
+Note that when used with \fB\-Z\fR option (enabled by default), privileges
+are dropped before opening first savefile.
.TP
.B \-d
Dump the compiled packet-matching code in a human readable form to
@@ -592,7 +595,9 @@ Drops privileges (if root) and changes u
and the group ID to the primary group of
.IR user .
.IP
-This behavior can also be enabled by default at compile time.
+This behavior is enabled by default (\fB\-Z pcap\fR), and can
+be disabled by \fB\-Z root\fR.
+
.IP "\fI expression\fP"
.RS
selects which packets will be dumped.

39
tcpdump.spec
View File

@ -1,8 +1,8 @@
Summary: A network traffic monitoring tool
Name: tcpdump
Epoch: 14
Version: 3.9.5
Release: 3%{?dist}
Version: 3.9.7
Release: 1%{?dist}
License: BSD
URL: http://www.tcpdump.org
Group: Applications/Internet
@ -11,16 +11,13 @@ BuildRequires: openssl-devel libpcap-devel
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
Source0: http://www.tcpdump.org/release/tcpdump-%{version}.tar.gz
Source1: tcpslice-CVS.20010207.tar.gz
Patch1: tcpdump-3.9.5-man.patch
Source1: ftp://ftp.ee.lbl.gov/tcpslice-1.2a3.tar.gz
Patch1: tcpdump-3.9.7-droproot.patch
Patch2: tcpdump-3.6.1-portnumbers.patch
Patch3: tcpdump-3.9.4-ring-buffers.patch
Patch4: tcpdump-3.9.5-nolocalpcap.patch
Patch5: tcpdump-3.6.2-tcpslice-time.patch
Patch5: tcpslice-1.2a3-time.patch
Patch6: tcpslice-CVS.20010207-bpf.patch
Patch7: tcpdump-3.9.5-80211.patch
%define tcpslice_dir tcpslice
%define tcpslice_dir tcpslice-1.2a3
%description
Tcpdump is a command-line tool for monitoring network traffic.
@ -33,17 +30,19 @@ Install tcpdump if you need a program to monitor network traffic.
%prep
%setup -q -a 1
%patch1 -p1 -b .man
%patch1 -p1 -b .droproot
%patch2 -p1 -b .portnumbers
%patch3 -p1 -b .ring
%patch4 -p1 -b .nolocalpcap
%patch5 -p1 -b .tcpslicetime
%patch6 -p0 -b .bpf
%patch7 -p1 -b .80211
pushd %{tcpslice_dir}
%patch5 -p1 -b .time
%patch6 -p1 -b .bpf
popd
find . -name '*.c' -o -name '*.h' | xargs chmod 644
%build
export CFLAGS="$RPM_OPT_FLAGS $(getconf LFS_CFLAGS)"
pushd %tcpslice_dir
%configure
make %{?_smp_mflags}
@ -66,6 +65,10 @@ popd
install -m755 tcpdump ${RPM_BUILD_ROOT}%{_sbindir}
install -m644 tcpdump.1 ${RPM_BUILD_ROOT}%{_mandir}/man8/tcpdump.8
# fix section numbers
sed -i 's/\(\.TH[a-zA-Z ]*\)[1-9]\(.*\)/\18\2/' \
${RPM_BUILD_ROOT}%{_mandir}/man8/*
%clean
rm -rf ${RPM_BUILD_ROOT}
@ -84,6 +87,12 @@ exit 0
%{_mandir}/man8/tcpdump.8*
%changelog
* Tue Jul 24 2007 Miroslav Lichvar <mlichvar@redhat.com> - 14:3.9.7-1
- update to 3.9.7
- with -C option, drop root privileges before opening first savefile (#244860)
- update tcpslice to 1.2a3
- include time patch from Debian to fix tcpslice on 64-bit architectures
* Thu Mar 15 2007 Miroslav Lichvar <mlichvar@redhat.com> - 14:3.9.5-3
- fix buffer overflow in 802.11 printer (#232349, CVE-2007-1218)
- spec cleanup (#226481)

71
tcpslice-1.2a3-time.patch Normal file
View File

@ -0,0 +1,71 @@
--- tcpslice-1.2a3.orig/search.c 2000-09-10 10:52:40.000000000 +0200
+++ tcpslice-1.2a3/search.c 2006-07-28 14:56:55.000000000 +0200
@@ -53,7 +53,7 @@
/* Size of a packet header in bytes; easier than typing the sizeof() all
* the time ...
*/
-#define PACKET_HDR_LEN (sizeof( struct pcap_pkthdr ))
+#define PACKET_HDR_LEN (sizeof( struct pcap_sf_pkthdr ))
extern int snaplen;
@@ -111,16 +111,24 @@
static void
extract_header( pcap_t *p, u_char *buf, struct pcap_pkthdr *hdr )
{
- memcpy((char *) hdr, (char *) buf, sizeof(struct pcap_pkthdr));
+ struct pcap_sf_pkthdr hdri;
+
+ memcpy((char *) &hdri, (char *) buf, sizeof(struct pcap_sf_pkthdr));
if ( pcap_is_swapped( p ) )
{
- hdr->ts.tv_sec = SWAPLONG(hdr->ts.tv_sec);
- hdr->ts.tv_usec = SWAPLONG(hdr->ts.tv_usec);
- hdr->len = SWAPLONG(hdr->len);
- hdr->caplen = SWAPLONG(hdr->caplen);
+ hdr->ts.tv_sec = SWAPLONG(hdri.ts.tv_sec);
+ hdr->ts.tv_usec = SWAPLONG(hdri.ts.tv_usec);
+ hdr->len = SWAPLONG(hdri.len);
+ hdr->caplen = SWAPLONG(hdri.caplen);
+ }
+ else
+ {
+ hdr->ts.tv_sec = hdri.ts.tv_sec;
+ hdr->ts.tv_usec = hdri.ts.tv_usec;
+ hdr->len = hdri.len;
+ hdr->caplen = hdri.caplen;
}
-
/*
* From bpf/libpcap/savefile.c:
*
--- tcpslice-1.2a3.orig/tcpslice.h 1995-11-02 00:40:53.000000000 +0100
+++ tcpslice-1.2a3/tcpslice.h 2006-07-28 14:56:55.000000000 +0200
@@ -20,6 +20,26 @@
*/
+#include <time.h>
+/* #include <net/bpf.h> */
+
+/*
+ * This is a timeval as stored in disk in a dumpfile.
+ * It has to use the same types everywhere, independent of the actual
+ * `struct timeval'
+ */
+
+struct pcap_timeval {
+ bpf_int32 tv_sec; /* seconds */
+ bpf_int32 tv_usec; /* microseconds */
+};
+
+struct pcap_sf_pkthdr {
+ struct pcap_timeval ts; /* time stamp */
+ bpf_u_int32 caplen; /* length of portion present */
+ bpf_u_int32 len; /* length this packet (off wire) */
+};
+
time_t gwtm2secs( struct tm *tm );
int sf_find_end( struct pcap *p, struct timeval *first_timestamp,