dnsmasq: bump to v2.78

Fixes CVE-2017-14491, CVE-2017-14492, CVE-2017-14493, CVE-2017-14494, 2017-CVE-14495, 2017-CVE-14496

Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>

8 files changed, 18 insertions, 248 deletions

diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile
index 1e1cc323d9..9a024ceadf 100644
--- a/package/network/services/dnsmasq/Makefile
+++ b/package/network/services/dnsmasq/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dnsmasq
-PKG_VERSION:=2.77
-PKG_RELEASE:=13
+PKG_VERSION:=2.78
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq/
-PKG_HASH:=6eac3b1c50ae25170e3ff8c96ddb55236cf45007633fdb8a35b1f3e02f5f8b8a
+PKG_HASH:=89949f438c74b0c7543f06689c319484bd126cc4b1f8c745c742ab397681252b
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING
diff --git a/package/network/services/dnsmasq/patches/010-Tweak-ICMP-ping-check-logic-for-DHCPv4.patch b/package/network/services/dnsmasq/patches/010-Tweak-ICMP-ping-check-logic-for-DHCPv4.patch
deleted file mode 100644
index 571ff3683d..0000000000
--- a/package/network/services/dnsmasq/patches/010-Tweak-ICMP-ping-check-logic-for-DHCPv4.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 4bb68866a8aeb31db8100492bceae051e33be5d0 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Thu, 15 Jun 2017 23:18:44 +0100
-Subject: [PATCH] Tweak ICMP ping check logic for DHCPv4.
-
----
- src/rfc2131.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/rfc2131.c b/src/rfc2131.c
-index 1c850e5..75792da 100644
---- a/src/rfc2131.c
-+++ b/src/rfc2131.c
-@@ -1040,7 +1040,7 @@ size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index,
- 		  else if (have_config(config, CONFIG_DECLINED) &&
- 			   difftime(now, config->decline_time) < (float)DECLINE_BACKOFF)
- 		    my_syslog(MS_DHCP | LOG_WARNING, _("not using configured address %s because it was previously declined"), addrs);
--		  else if (!do_icmp_ping(now, config->addr, 0, loopback))
-+		  else if ((!lease || lease->addr.s_addr != config->addr.s_addr) && !do_icmp_ping(now, config->addr, 0, loopback))
- 		    my_syslog(MS_DHCP | LOG_WARNING, _("not using configured address %s because it is in use by another host"), addrs);
- 		  else
- 		    conf = config->addr;
--- 
-1.9.1
-
diff --git a/package/network/services/dnsmasq/patches/011-Remove-ping-check-of-configured-DHCP-address.patch b/package/network/services/dnsmasq/patches/011-Remove-ping-check-of-configured-DHCP-address.patch
deleted file mode 100644
index 67f90e172d..0000000000
--- a/package/network/services/dnsmasq/patches/011-Remove-ping-check-of-configured-DHCP-address.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 1d224949cced9e82440d00b3dbaf32c262bac2ff Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Sat, 8 Jul 2017 20:52:55 +0100
-Subject: [PATCH 1/2] Remove ping-check of configured DHCP address.
-
-This was added in 5ce3e76fbf89e942e8c54ef3e3389facf0d9067a but
-it trips over too many buggy clients that leave an interface configured
-even in DHCPDISCOVER case.
----
- src/rfc2131.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/src/rfc2131.c b/src/rfc2131.c
-index 86230b4..785e15c 100644
---- a/src/rfc2131.c
-+++ b/src/rfc2131.c
-@@ -1040,8 +1040,6 @@ size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index,
- 		  else if (have_config(config, CONFIG_DECLINED) &&
- 			   difftime(now, config->decline_time) < (float)DECLINE_BACKOFF)
- 		    my_syslog(MS_DHCP | LOG_WARNING, _("not using configured address %s because it was previously declined"), addrs);
--		  else if ((!lease || lease->addr.s_addr != config->addr.s_addr) && !do_icmp_ping(now, config->addr, 0, loopback))
--		    my_syslog(MS_DHCP | LOG_WARNING, _("not using configured address %s because it is in use by another host"), addrs);
- 		  else
- 		    conf = config->addr;
- 		}
--- 
-2.13.2
-
diff --git a/package/network/services/dnsmasq/patches/020-Try-other-servers-if-first-returns-REFUSED-when-stri.patch b/package/network/services/dnsmasq/patches/020-Try-other-servers-if-first-returns-REFUSED-when-stri.patch
deleted file mode 100644
index cdab607009..0000000000
--- a/package/network/services/dnsmasq/patches/020-Try-other-servers-if-first-returns-REFUSED-when-stri.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 9396752c115b3ab733fa476b30da73237e12e7ba Mon Sep 17 00:00:00 2001
-From: Hans Dedecker <dedeckeh@gmail.com>
-Date: Tue, 27 Jun 2017 22:08:47 +0100
-Subject: [PATCH] Try other servers if first returns REFUSED when
- --strict-order active.
-
-If a DNS server replies REFUSED for a given DNS query in strict order mode
-no failover to the next DNS server is triggered as the failover logic only
-covers non strict mode.
-As a result the client will be returned the REFUSED reply without first
-falling back to the secondary DNS server(s).
-
-Make failover support work as well for strict mode config in case REFUSED is
-replied by deleting the strict order check and rely only on forwardall being
-equal to 0 which is the case in non strict mode when a single server has been
-contacted or when strict order mode has been configured.
----
- CHANGELOG     | 4 ++++
- src/forward.c | 1 -
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -790,7 +790,6 @@ void reply_query(int fd, int family, tim
-   /* Note: if we send extra options in the EDNS0 header, we can't recreate
-      the query from the reply. */
-   if (RCODE(header) == REFUSED &&
--      !option_bool(OPT_ORDER) &&
-       forward->forwardall == 0 &&
-       !(forward->flags & FREC_HAS_EXTRADATA))
-     /* for broken servers, attempt to send to another one. */
diff --git a/package/network/services/dnsmasq/patches/025-backport-fix-CVE-2017-13704.patch b/package/network/services/dnsmasq/patches/025-backport-fix-CVE-2017-13704.patch
deleted file mode 100644
index bba9a08060..0000000000
--- a/package/network/services/dnsmasq/patches/025-backport-fix-CVE-2017-13704.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 63437ffbb58837b214b4b92cb1c54bc5f3279928 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Wed, 6 Sep 2017 22:34:21 +0100
-Subject: [PATCH] Fix CVE-2017-13704, which resulted in a crash on a large DNS
- query.
-
-A DNS query recieved by UDP which exceeds 512 bytes (or the EDNS0 packet size,
-if different.) is enough to cause SIGSEGV.
----
- CHANGELOG     |    7 +++++++
- src/auth.c    |    5 -----
- src/forward.c |    8 ++++++++
- src/rfc1035.c |    5 -----
- 4 files changed, 15 insertions(+), 10 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 3a640f3..7e65912 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -17,6 +17,13 @@ version 2.78
- 	--strict-order active. Thanks to Hans Dedecker
- 	for the patch
- 
-+	Fix regression in 2.77, ironically added as a security
-+	improvement, which resulted in a crash when a DNS
-+	query exceeded 512 bytes (or the EDNS0 packet size,
-+	if different.) Thanks to Christian Kujau, Arne Woerner
-+	Juan Manuel Fernandez and Kevin Darbyshire-Bryant for
-+	chasing this one down.  CVE-2017-13704 applies.
-+
- 	
- version 2.77
- 	Generate an error when configured with a CNAME loop,
-diff --git a/src/auth.c b/src/auth.c
-index 2c24e16..7f95f98 100644
---- a/src/auth.c
-+++ b/src/auth.c
-@@ -119,11 +119,6 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n
-   struct cname *a, *candidate;
-   unsigned int wclen;
-   
--  /* Clear buffer beyond request to avoid risk of
--     information disclosure. */
--  memset(((char *)header) + qlen, 0, 
--	 (limit - ((char *)header)) - qlen);
--  
-   if (ntohs(header->qdcount) == 0 || OPCODE(header) != QUERY )
-     return 0;
- 
-diff --git a/src/forward.c b/src/forward.c
-index f22556a..e3fa94b 100644
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -1188,6 +1188,10 @@ void receive_query(struct listener *listen, time_t now)
-       (msg.msg_flags & MSG_TRUNC) ||
-       (header->hb3 & HB3_QR))
-     return;
-+
-+  /* Clear buffer beyond request to avoid risk of
-+     information disclosure. */
-+  memset(daemon->packet + n, 0, daemon->edns_pktsz - n);
-   
-   source_addr.sa.sa_family = listen->family;
-   
-@@ -1688,6 +1692,10 @@ unsigned char *tcp_request(int confd, time_t now,
-   
-       if (size < (int)sizeof(struct dns_header))
- 	continue;
-+
-+      /* Clear buffer beyond request to avoid risk of
-+	 information disclosure. */
-+      memset(payload + size, 0, 65536 - size);
-       
-       query_count++;
- 
-diff --git a/src/rfc1035.c b/src/rfc1035.c
-index 26f5301..af2fe46 100644
---- a/src/rfc1035.c
-+++ b/src/rfc1035.c
-@@ -1223,11 +1223,6 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
-   struct mx_srv_record *rec;
-   size_t len;
- 
--  /* Clear buffer beyond request to avoid risk of
--     information disclosure. */
--  memset(((char *)header) + qlen, 0, 
--	 (limit - ((char *)header)) - qlen);
--  
-   if (ntohs(header->ancount) != 0 ||
-       ntohs(header->nscount) != 0 ||
-       ntohs(header->qdcount) == 0 || 
--- 
-1.7.10.4
-
diff --git a/package/network/services/dnsmasq/patches/030-fix-arcount-edns0-behaviour.patch b/package/network/services/dnsmasq/patches/030-fix-arcount-edns0-behaviour.patch
deleted file mode 100644
index fffc8de6c4..0000000000
--- a/package/network/services/dnsmasq/patches/030-fix-arcount-edns0-behaviour.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From a3303e196e5d304ec955c4d63afb923ade66c6e8 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Thu, 7 Sep 2017 20:45:00 +0100
-Subject: [PATCH] Don't return arcount=1 if EDNS0 RR won't fit in the packet.
-
-Omitting the EDNS0 RR but setting arcount gives a malformed packet.
-Also, don't accept UDP packet size less than 512 in recieved EDNS0.
----
- src/edns0.c   |    5 ++++-
- src/forward.c |    2 ++
- 2 files changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/src/edns0.c b/src/edns0.c
-index 3fde17f..f5b798c 100644
---- a/src/edns0.c
-+++ b/src/edns0.c
-@@ -208,7 +208,10 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
- 	  free(buff);
- 	  p += rdlen;
- 	}
--      header->arcount = htons(ntohs(header->arcount) + 1);
-+      
-+      /* Only bump arcount if RR is going to fit */ 
-+      if (((ssize_t)optlen) <= (limit - (p + 4)))
-+	header->arcount = htons(ntohs(header->arcount) + 1);
-     }
-   
-   if (((ssize_t)optlen) > (limit - (p + 4)))
-diff --git a/src/forward.c b/src/forward.c
-index e3fa94b..942b02d 100644
---- a/src/forward.c
-+++ b/src/forward.c
-@@ -1412,6 +1412,8 @@ void receive_query(struct listener *listen, time_t now)
- 	 defaults to 512 */
-       if (udp_size > daemon->edns_pktsz)
- 	udp_size = daemon->edns_pktsz;
-+      else if (udp_size < PACKETSZ)
-+	udp_size = PACKETSZ; /* Sanity check - can't reduce below default. RFC 6891 6.2.3 */
-     }
- 
- #ifdef HAVE_AUTH
--- 
-1.7.10.4
-
diff --git a/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch b/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch
index 19300f7d66..37b11abc1d 100644
--- a/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch
+++ b/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch
@@ -7,7 +7,7 @@ Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
 
 --- a/src/dnsmasq.h
 +++ b/src/dnsmasq.h
-@@ -82,7 +82,7 @@ typedef unsigned long long u64;
+@@ -88,7 +88,7 @@ typedef unsigned long long u64;
  #if defined(HAVE_SOLARIS_NETWORK)
  #  include <sys/sockio.h>
  #endif
diff --git a/package/network/services/dnsmasq/patches/240-ubus.patch b/package/network/services/dnsmasq/patches/240-ubus.patch
index 41e2848594..2d37b5d2fd 100644
--- a/package/network/services/dnsmasq/patches/240-ubus.patch
+++ b/package/network/services/dnsmasq/patches/240-ubus.patch
@@ -1,16 +1,14 @@
-Index: dnsmasq-2.77/src/dnsmasq.c
-===================================================================
---- dnsmasq-2.77.orig/src/dnsmasq.c
-+++ dnsmasq-2.77/src/dnsmasq.c
-@@ -17,6 +17,8 @@
- /* Declare static char *compiler_opts  in config.h */
- #define DNSMASQ_COMPILE_OPTS
+--- a/src/dnsmasq.c
++++ b/src/dnsmasq.c
+@@ -19,6 +19,8 @@
  
-+#include <libubus.h>
-+
  #include "dnsmasq.h"
  
++#include <libubus.h>
++
  struct daemon *daemon;
+ 
+ static volatile pid_t pid = 0;
 @@ -32,6 +34,62 @@ static void fatal_event(struct event_des
  static int read_event(int fd, struct event_desc *evp, char **msg);
  static void poll_resolv(int force, int do_reload, time_t now);
@@ -91,10 +89,8 @@ Index: dnsmasq-2.77/src/dnsmasq.c
        check_dns_listeners(now);
  
  #ifdef HAVE_TFTP
-Index: dnsmasq-2.77/Makefile
-===================================================================
---- dnsmasq-2.77.orig/Makefile
-+++ dnsmasq-2.77/Makefile
+--- a/Makefile
++++ b/Makefile
 @@ -85,7 +85,7 @@ all : $(BUILDDIR)
  	@cd $(BUILDDIR) && $(MAKE) \
   top="$(top)" \
@@ -104,11 +100,9 @@ Index: dnsmasq-2.77/Makefile
   -f $(top)/Makefile dnsmasq 
  
  mostly_clean :
-Index: dnsmasq-2.77/src/dnsmasq.h
-===================================================================
---- dnsmasq-2.77.orig/src/dnsmasq.h
-+++ dnsmasq-2.77/src/dnsmasq.h
-@@ -1389,6 +1389,8 @@ void emit_dbus_signal(int action, struct
+--- a/src/dnsmasq.h
++++ b/src/dnsmasq.h
+@@ -1397,6 +1397,8 @@ void emit_dbus_signal(int action, struct
  #  endif
  #endif
  
@@ -117,10 +111,8 @@ Index: dnsmasq-2.77/src/dnsmasq.h
  /* ipset.c */
  #ifdef HAVE_IPSET
  void ipset_init(void);
-Index: dnsmasq-2.77/src/rfc2131.c
-===================================================================
---- dnsmasq-2.77.orig/src/rfc2131.c
-+++ dnsmasq-2.77/src/rfc2131.c
+--- a/src/rfc2131.c
++++ b/src/rfc2131.c
 @@ -1621,6 +1621,10 @@ static void log_packet(char *type, void
  	      daemon->namebuff,
  	      string ? string : "",