diff options
Diffstat (limited to 'package')
8 files changed, 18 insertions, 248 deletions
diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile index 1e1cc323d9..9a024ceadf 100644 --- a/package/network/services/dnsmasq/Makefile +++ b/package/network/services/dnsmasq/Makefile @@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=dnsmasq -PKG_VERSION:=2.77 -PKG_RELEASE:=13 +PKG_VERSION:=2.78 +PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq/ -PKG_HASH:=6eac3b1c50ae25170e3ff8c96ddb55236cf45007633fdb8a35b1f3e02f5f8b8a +PKG_HASH:=89949f438c74b0c7543f06689c319484bd126cc4b1f8c745c742ab397681252b PKG_LICENSE:=GPL-2.0 PKG_LICENSE_FILES:=COPYING diff --git a/package/network/services/dnsmasq/patches/010-Tweak-ICMP-ping-check-logic-for-DHCPv4.patch b/package/network/services/dnsmasq/patches/010-Tweak-ICMP-ping-check-logic-for-DHCPv4.patch deleted file mode 100644 index 571ff3683d..0000000000 --- a/package/network/services/dnsmasq/patches/010-Tweak-ICMP-ping-check-logic-for-DHCPv4.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 4bb68866a8aeb31db8100492bceae051e33be5d0 Mon Sep 17 00:00:00 2001 -From: Simon Kelley <simon@thekelleys.org.uk> -Date: Thu, 15 Jun 2017 23:18:44 +0100 -Subject: [PATCH] Tweak ICMP ping check logic for DHCPv4. - ---- - src/rfc2131.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/rfc2131.c b/src/rfc2131.c -index 1c850e5..75792da 100644 ---- a/src/rfc2131.c -+++ b/src/rfc2131.c -@@ -1040,7 +1040,7 @@ size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index, - else if (have_config(config, CONFIG_DECLINED) && - difftime(now, config->decline_time) < (float)DECLINE_BACKOFF) - my_syslog(MS_DHCP | LOG_WARNING, _("not using configured address %s because it was previously declined"), addrs); -- else if (!do_icmp_ping(now, config->addr, 0, loopback)) -+ else if ((!lease || lease->addr.s_addr != config->addr.s_addr) && !do_icmp_ping(now, config->addr, 0, loopback)) - my_syslog(MS_DHCP | LOG_WARNING, _("not using configured address %s because it is in use by another host"), addrs); - else - conf = config->addr; --- -1.9.1 - diff --git a/package/network/services/dnsmasq/patches/011-Remove-ping-check-of-configured-DHCP-address.patch b/package/network/services/dnsmasq/patches/011-Remove-ping-check-of-configured-DHCP-address.patch deleted file mode 100644 index 67f90e172d..0000000000 --- a/package/network/services/dnsmasq/patches/011-Remove-ping-check-of-configured-DHCP-address.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 1d224949cced9e82440d00b3dbaf32c262bac2ff Mon Sep 17 00:00:00 2001 -From: Simon Kelley <simon@thekelleys.org.uk> -Date: Sat, 8 Jul 2017 20:52:55 +0100 -Subject: [PATCH 1/2] Remove ping-check of configured DHCP address. - -This was added in 5ce3e76fbf89e942e8c54ef3e3389facf0d9067a but -it trips over too many buggy clients that leave an interface configured -even in DHCPDISCOVER case. ---- - src/rfc2131.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/src/rfc2131.c b/src/rfc2131.c -index 86230b4..785e15c 100644 ---- a/src/rfc2131.c -+++ b/src/rfc2131.c -@@ -1040,8 +1040,6 @@ size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index, - else if (have_config(config, CONFIG_DECLINED) && - difftime(now, config->decline_time) < (float)DECLINE_BACKOFF) - my_syslog(MS_DHCP | LOG_WARNING, _("not using configured address %s because it was previously declined"), addrs); -- else if ((!lease || lease->addr.s_addr != config->addr.s_addr) && !do_icmp_ping(now, config->addr, 0, loopback)) -- my_syslog(MS_DHCP | LOG_WARNING, _("not using configured address %s because it is in use by another host"), addrs); - else - conf = config->addr; - } --- -2.13.2 - diff --git a/package/network/services/dnsmasq/patches/020-Try-other-servers-if-first-returns-REFUSED-when-stri.patch b/package/network/services/dnsmasq/patches/020-Try-other-servers-if-first-returns-REFUSED-when-stri.patch deleted file mode 100644 index cdab607009..0000000000 --- a/package/network/services/dnsmasq/patches/020-Try-other-servers-if-first-returns-REFUSED-when-stri.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 9396752c115b3ab733fa476b30da73237e12e7ba Mon Sep 17 00:00:00 2001 -From: Hans Dedecker <dedeckeh@gmail.com> -Date: Tue, 27 Jun 2017 22:08:47 +0100 -Subject: [PATCH] Try other servers if first returns REFUSED when - --strict-order active. - -If a DNS server replies REFUSED for a given DNS query in strict order mode -no failover to the next DNS server is triggered as the failover logic only -covers non strict mode. -As a result the client will be returned the REFUSED reply without first -falling back to the secondary DNS server(s). - -Make failover support work as well for strict mode config in case REFUSED is -replied by deleting the strict order check and rely only on forwardall being -equal to 0 which is the case in non strict mode when a single server has been -contacted or when strict order mode has been configured. ---- - CHANGELOG | 4 ++++ - src/forward.c | 1 - - 2 files changed, 4 insertions(+), 1 deletion(-) - ---- a/src/forward.c -+++ b/src/forward.c -@@ -790,7 +790,6 @@ void reply_query(int fd, int family, tim - /* Note: if we send extra options in the EDNS0 header, we can't recreate - the query from the reply. */ - if (RCODE(header) == REFUSED && -- !option_bool(OPT_ORDER) && - forward->forwardall == 0 && - !(forward->flags & FREC_HAS_EXTRADATA)) - /* for broken servers, attempt to send to another one. */ diff --git a/package/network/services/dnsmasq/patches/025-backport-fix-CVE-2017-13704.patch b/package/network/services/dnsmasq/patches/025-backport-fix-CVE-2017-13704.patch deleted file mode 100644 index bba9a08060..0000000000 --- a/package/network/services/dnsmasq/patches/025-backport-fix-CVE-2017-13704.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 63437ffbb58837b214b4b92cb1c54bc5f3279928 Mon Sep 17 00:00:00 2001 -From: Simon Kelley <simon@thekelleys.org.uk> -Date: Wed, 6 Sep 2017 22:34:21 +0100 -Subject: [PATCH] Fix CVE-2017-13704, which resulted in a crash on a large DNS - query. - -A DNS query recieved by UDP which exceeds 512 bytes (or the EDNS0 packet size, -if different.) is enough to cause SIGSEGV. ---- - CHANGELOG | 7 +++++++ - src/auth.c | 5 ----- - src/forward.c | 8 ++++++++ - src/rfc1035.c | 5 ----- - 4 files changed, 15 insertions(+), 10 deletions(-) - -diff --git a/CHANGELOG b/CHANGELOG -index 3a640f3..7e65912 100644 ---- a/CHANGELOG -+++ b/CHANGELOG -@@ -17,6 +17,13 @@ version 2.78 - --strict-order active. Thanks to Hans Dedecker - for the patch - -+ Fix regression in 2.77, ironically added as a security -+ improvement, which resulted in a crash when a DNS -+ query exceeded 512 bytes (or the EDNS0 packet size, -+ if different.) Thanks to Christian Kujau, Arne Woerner -+ Juan Manuel Fernandez and Kevin Darbyshire-Bryant for -+ chasing this one down. CVE-2017-13704 applies. -+ - - version 2.77 - Generate an error when configured with a CNAME loop, -diff --git a/src/auth.c b/src/auth.c -index 2c24e16..7f95f98 100644 ---- a/src/auth.c -+++ b/src/auth.c -@@ -119,11 +119,6 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n - struct cname *a, *candidate; - unsigned int wclen; - -- /* Clear buffer beyond request to avoid risk of -- information disclosure. */ -- memset(((char *)header) + qlen, 0, -- (limit - ((char *)header)) - qlen); -- - if (ntohs(header->qdcount) == 0 || OPCODE(header) != QUERY ) - return 0; - -diff --git a/src/forward.c b/src/forward.c -index f22556a..e3fa94b 100644 ---- a/src/forward.c -+++ b/src/forward.c -@@ -1188,6 +1188,10 @@ void receive_query(struct listener *listen, time_t now) - (msg.msg_flags & MSG_TRUNC) || - (header->hb3 & HB3_QR)) - return; -+ -+ /* Clear buffer beyond request to avoid risk of -+ information disclosure. */ -+ memset(daemon->packet + n, 0, daemon->edns_pktsz - n); - - source_addr.sa.sa_family = listen->family; - -@@ -1688,6 +1692,10 @@ unsigned char *tcp_request(int confd, time_t now, - - if (size < (int)sizeof(struct dns_header)) - continue; -+ -+ /* Clear buffer beyond request to avoid risk of -+ information disclosure. */ -+ memset(payload + size, 0, 65536 - size); - - query_count++; - -diff --git a/src/rfc1035.c b/src/rfc1035.c -index 26f5301..af2fe46 100644 ---- a/src/rfc1035.c -+++ b/src/rfc1035.c -@@ -1223,11 +1223,6 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, - struct mx_srv_record *rec; - size_t len; - -- /* Clear buffer beyond request to avoid risk of -- information disclosure. */ -- memset(((char *)header) + qlen, 0, -- (limit - ((char *)header)) - qlen); -- - if (ntohs(header->ancount) != 0 || - ntohs(header->nscount) != 0 || - ntohs(header->qdcount) == 0 || --- -1.7.10.4 - diff --git a/package/network/services/dnsmasq/patches/030-fix-arcount-edns0-behaviour.patch b/package/network/services/dnsmasq/patches/030-fix-arcount-edns0-behaviour.patch deleted file mode 100644 index fffc8de6c4..0000000000 --- a/package/network/services/dnsmasq/patches/030-fix-arcount-edns0-behaviour.patch +++ /dev/null @@ -1,44 +0,0 @@ -From a3303e196e5d304ec955c4d63afb923ade66c6e8 Mon Sep 17 00:00:00 2001 -From: Simon Kelley <simon@thekelleys.org.uk> -Date: Thu, 7 Sep 2017 20:45:00 +0100 -Subject: [PATCH] Don't return arcount=1 if EDNS0 RR won't fit in the packet. - -Omitting the EDNS0 RR but setting arcount gives a malformed packet. -Also, don't accept UDP packet size less than 512 in recieved EDNS0. ---- - src/edns0.c | 5 ++++- - src/forward.c | 2 ++ - 2 files changed, 6 insertions(+), 1 deletion(-) - -diff --git a/src/edns0.c b/src/edns0.c -index 3fde17f..f5b798c 100644 ---- a/src/edns0.c -+++ b/src/edns0.c -@@ -208,7 +208,10 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l - free(buff); - p += rdlen; - } -- header->arcount = htons(ntohs(header->arcount) + 1); -+ -+ /* Only bump arcount if RR is going to fit */ -+ if (((ssize_t)optlen) <= (limit - (p + 4))) -+ header->arcount = htons(ntohs(header->arcount) + 1); - } - - if (((ssize_t)optlen) > (limit - (p + 4))) -diff --git a/src/forward.c b/src/forward.c -index e3fa94b..942b02d 100644 ---- a/src/forward.c -+++ b/src/forward.c -@@ -1412,6 +1412,8 @@ void receive_query(struct listener *listen, time_t now) - defaults to 512 */ - if (udp_size > daemon->edns_pktsz) - udp_size = daemon->edns_pktsz; -+ else if (udp_size < PACKETSZ) -+ udp_size = PACKETSZ; /* Sanity check - can't reduce below default. RFC 6891 6.2.3 */ - } - - #ifdef HAVE_AUTH --- -1.7.10.4 - diff --git a/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch b/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch index 19300f7d66..37b11abc1d 100644 --- a/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch +++ b/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch @@ -7,7 +7,7 @@ Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk> --- a/src/dnsmasq.h +++ b/src/dnsmasq.h -@@ -82,7 +82,7 @@ typedef unsigned long long u64; +@@ -88,7 +88,7 @@ typedef unsigned long long u64; #if defined(HAVE_SOLARIS_NETWORK) # include <sys/sockio.h> #endif diff --git a/package/network/services/dnsmasq/patches/240-ubus.patch b/package/network/services/dnsmasq/patches/240-ubus.patch index 41e2848594..2d37b5d2fd 100644 --- a/package/network/services/dnsmasq/patches/240-ubus.patch +++ b/package/network/services/dnsmasq/patches/240-ubus.patch @@ -1,16 +1,14 @@ -Index: dnsmasq-2.77/src/dnsmasq.c -=================================================================== ---- dnsmasq-2.77.orig/src/dnsmasq.c -+++ dnsmasq-2.77/src/dnsmasq.c -@@ -17,6 +17,8 @@ - /* Declare static char *compiler_opts in config.h */ - #define DNSMASQ_COMPILE_OPTS +--- a/src/dnsmasq.c ++++ b/src/dnsmasq.c +@@ -19,6 +19,8 @@ -+#include <libubus.h> -+ #include "dnsmasq.h" ++#include <libubus.h> ++ struct daemon *daemon; + + static volatile pid_t pid = 0; @@ -32,6 +34,62 @@ static void fatal_event(struct event_des static int read_event(int fd, struct event_desc *evp, char **msg); static void poll_resolv(int force, int do_reload, time_t now); @@ -91,10 +89,8 @@ Index: dnsmasq-2.77/src/dnsmasq.c check_dns_listeners(now); #ifdef HAVE_TFTP -Index: dnsmasq-2.77/Makefile -=================================================================== ---- dnsmasq-2.77.orig/Makefile -+++ dnsmasq-2.77/Makefile +--- a/Makefile ++++ b/Makefile @@ -85,7 +85,7 @@ all : $(BUILDDIR) @cd $(BUILDDIR) && $(MAKE) \ top="$(top)" \ @@ -104,11 +100,9 @@ Index: dnsmasq-2.77/Makefile -f $(top)/Makefile dnsmasq mostly_clean : -Index: dnsmasq-2.77/src/dnsmasq.h -=================================================================== ---- dnsmasq-2.77.orig/src/dnsmasq.h -+++ dnsmasq-2.77/src/dnsmasq.h -@@ -1389,6 +1389,8 @@ void emit_dbus_signal(int action, struct +--- a/src/dnsmasq.h ++++ b/src/dnsmasq.h +@@ -1397,6 +1397,8 @@ void emit_dbus_signal(int action, struct # endif #endif @@ -117,10 +111,8 @@ Index: dnsmasq-2.77/src/dnsmasq.h /* ipset.c */ #ifdef HAVE_IPSET void ipset_init(void); -Index: dnsmasq-2.77/src/rfc2131.c -=================================================================== ---- dnsmasq-2.77.orig/src/rfc2131.c -+++ dnsmasq-2.77/src/rfc2131.c +--- a/src/rfc2131.c ++++ b/src/rfc2131.c @@ -1621,6 +1621,10 @@ static void log_packet(char *type, void daemon->namebuff, string ? string : "", |