diff --git a/CVE-2021-25220.patch b/CVE-2021-25220.patch new file mode 100644 index 0000000000000000000000000000000000000000..acaef043a5611e96a3b268a0ce63d52e623097cb --- /dev/null +++ b/CVE-2021-25220.patch @@ -0,0 +1,200 @@ +diff --git a/bind/bind-9.11.36/lib/dns/resolver.c b/bind/bind-9.11.36/lib/dns/resolver.c +index b34cb12..8ae9a99 100644 +--- a/bind/bind-9.11.36/lib/dns/resolver.c ++++ b/bind/bind-9.11.36/lib/dns/resolver.c +@@ -63,6 +63,7 @@ + #include + #include + #include ++#include + + #ifdef WANT_QUERYTRACE + #define RTRACE(m) isc_log_write(dns_lctx, \ +@@ -311,6 +312,8 @@ struct fetchctx { + bool ns_ttl_ok; + uint32_t ns_ttl; + isc_counter_t * qc; ++ dns_fixedname_t fwdfname; ++ dns_name_t *fwdname; + + /*% + * The number of events we're waiting for. +@@ -3389,6 +3392,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) { + if (result == ISC_R_SUCCESS) { + fwd = ISC_LIST_HEAD(forwarders->fwdrs); + fctx->fwdpolicy = forwarders->fwdpolicy; ++ dns_name_copy(domain, fctx->fwdname, NULL); + if (fctx->fwdpolicy == dns_fwdpolicy_only && + isstrictsubdomain(domain, &fctx->domain)) { + fcount_decr(fctx); +@@ -4418,6 +4422,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, + fctx->restarts = 0; + fctx->querysent = 0; + fctx->referrals = 0; ++ ++ fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname); ++ + TIME_NOW(&fctx->start); + fctx->timeouts = 0; + fctx->lamecount = 0; +@@ -4476,8 +4483,10 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, + domain = dns_fixedname_initname(&fixed); + result = dns_fwdtable_find2(fctx->res->view->fwdtable, fwdname, + domain, &forwarders); +- if (result == ISC_R_SUCCESS) ++ if (result == ISC_R_SUCCESS) { + fctx->fwdpolicy = forwarders->fwdpolicy; ++ dns_name_copy(domain, fctx->fwdname, NULL); ++ } + + if (fctx->fwdpolicy != dns_fwdpolicy_only) { + /* +@@ -6226,6 +6235,112 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, + rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL; + } + ++/* ++ * Returns true if 'name' is external to the namespace for which ++ * the server being queried can answer, either because it's not a ++ * subdomain or because it's below a forward declaration or a ++ * locally served zone. ++ */ ++static inline bool ++name_external(dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) { ++ isc_result_t result; ++ dns_forwarders_t *forwarders = NULL; ++ dns_fixedname_t fixed, zfixed; ++ dns_name_t *fname = dns_fixedname_initname(&fixed); ++ dns_name_t *zfname = dns_fixedname_initname(&zfixed); ++ dns_name_t *apex = NULL; ++ dns_name_t suffix; ++ dns_zone_t *zone = NULL; ++ unsigned int labels; ++ dns_namereln_t rel; ++ /* ++ * The following two variables do not influence code flow; they are ++ * only necessary for calling dns_name_fullcompare(). ++ */ ++ int _orderp = 0; ++ unsigned int _nlabelsp = 0; ++ ++ apex = ISFORWARDER(fctx->addrinfo) ? fctx->fwdname : &fctx->domain; ++ ++ /* ++ * The name is outside the queried namespace. ++ */ ++ rel = dns_name_fullcompare(name, apex, &_orderp, &_nlabelsp); ++ if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) { ++ return (true); ++ } ++ ++ /* ++ * If the record lives in the parent zone, adjust the name so we ++ * look for the correct zone or forward clause. ++ */ ++ labels = dns_name_countlabels(name); ++ if (dns_rdatatype_atparent(type) && labels > 1U) { ++ dns_name_init(&suffix, NULL); ++ dns_name_getlabelsequence(name, 1, labels - 1, &suffix); ++ name = &suffix; ++ } else if (rel == dns_namereln_equal) { ++ /* If 'name' is 'apex', no further checking is needed. */ ++ return (false); ++ } ++ ++ /* ++ * If there is a locally served zone between 'apex' and 'name' ++ * then don't cache. ++ */ ++ LOCK(&fctx->res->view->lock); ++ if (fctx->res->view->zonetable != NULL) { ++ unsigned int options = DNS_ZTFIND_NOEXACT; ++ result = dns_zt_find(fctx->res->view->zonetable, name, options, ++ zfname, &zone); ++ if (zone != NULL) { ++ dns_zone_detach(&zone); ++ } ++ if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { ++ if (dns_name_fullcompare(zfname, apex, &_orderp, ++ &_nlabelsp) == ++ dns_namereln_subdomain) ++ { ++ UNLOCK(&fctx->res->view->lock); ++ return (true); ++ } ++ } ++ } ++ UNLOCK(&fctx->res->view->lock); ++ ++ /* ++ * Look for a forward declaration below 'name'. ++ */ ++ result = dns_fwdtable_find2(fctx->res->view->fwdtable, name, fname, ++ &forwarders); ++ ++ if (ISFORWARDER(fctx->addrinfo)) { ++ /* ++ * See if the forwarder declaration is better. ++ */ ++ if (result == ISC_R_SUCCESS) { ++ return (!dns_name_equal(fname, fctx->fwdname)); ++ } ++ ++ /* ++ * If the lookup failed, the configuration must have ++ * changed: play it safe and don't cache. ++ */ ++ return (true); ++ } else if (result == ISC_R_SUCCESS && ++ forwarders->fwdpolicy == dns_fwdpolicy_only && ++ !ISC_LIST_EMPTY(forwarders->fwdrs)) ++ { ++ /* ++ * If 'name' is covered by a 'forward only' clause then we ++ * can't cache this repsonse. ++ */ ++ return (true); ++ } ++ ++ return (false); ++} ++ + static isc_result_t + check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type, + dns_section_t section) +@@ -6254,7 +6369,7 @@ check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type, + result = dns_message_findname(rmessage, section, addname, + dns_rdatatype_any, 0, &name, NULL); + if (result == ISC_R_SUCCESS) { +- external = !dns_name_issubdomain(name, &fctx->domain); ++ external = name_external(name, type, fctx); + if (type == dns_rdatatype_a) { + for (rdataset = ISC_LIST_HEAD(name->list); + rdataset != NULL; +@@ -7136,6 +7251,13 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) { + break; + + case dns_namereln_subdomain: ++ /* ++ * Don't accept DNAME from parent namespace. ++ */ ++ if (name_external(name, dns_rdatatype_dname, fctx)) { ++ continue; ++ } ++ + /* + * In-scope DNAME records must have at least + * as many labels as the domain being queried. +@@ -7371,11 +7493,9 @@ answer_response(fetchctx_t *fctx, dns_message_t *message) { + */ + result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); + while (!done && result == ISC_R_SUCCESS) { +- bool external; + name = NULL; + dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name); +- external = !dns_name_issubdomain(name, &fctx->domain); +- if (!external) { ++ if (!name_external(name, dns_rdatatype_ns, fctx)) { + /* + * We expect to find NS or SIG NS rdatasets, and + * nothing else. diff --git a/dhcp-4.4.3-P1.tar.gz b/dhcp-4.4.3-P1.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..f681d1f55a08f70c88e473415a2366cafaf99947 Binary files /dev/null and b/dhcp-4.4.3-P1.tar.gz differ diff --git a/dhcp-4.4.3-P1.tar.gz.asc b/dhcp-4.4.3-P1.tar.gz.asc new file mode 100644 index 0000000000000000000000000000000000000000..4e369ecdc31dd333214170bd8ee8619c2580193b --- /dev/null +++ b/dhcp-4.4.3-P1.tar.gz.asc @@ -0,0 +1,17 @@ +-----BEGIN PGP SIGNATURE----- +Comment: GPGTools - https://gpgtools.org + +iQIzBAABAgAdFiEEqtu6UHTxQC97adVrxbTukxqfnf0FAmM0jbcACgkQxbTukxqf +nf1YFxAAs4mi2w0JOpfcwFYkjtFSSnm0xKqfPYooTZeLBgUTfc7gqa4YilMGPdq8 +4tpVhXk0c6DDzCfTwnC0Z0Y2xL4ZNtUZg5My4sI1CZP8YMvgD9BtfFuyzFT9VGxb ++7vHluQjoHTkjPmvQqywxXOgvkdlh7TVzk5MXcHVU92/+N0sGtHmy/2R0rO7zxm8 +PhJ11TpEDD4GfYGsrgRJQ/o4buDp9nBQBI5ex6QfZ2BTX2zBU5rugKqHwT146sC/ +MbgNnVMR3CTRiUYW6G+EfnnFdpQ52eBtBFj6v3pnvMu8hPy8J/nj0JSXfSSx88qi +ym+PB2CVIupzUFEkZBxK/jLX3101AZwnzwMpmOMa2eSYHbB1qAohV6TYtP14ia0f +39K/yO9aH+/x16NFdMkqSmDXD79JFFqk3HWuhooX6Kqbyuy67Dj3uT6ZQRTF+PVR +D+BAE4LzMtQlG4UdRJlEclYcRv6CWwYB1hx5utz0BevL2y0ZenWgpQxHsW8jNzrF +fl8SmGbkTDtumH102U5NdapEQH2va9fMT1kywgtlrv0ByngEjg7Q1iSVJfu2mwJ5 +7lN4O8/+B5+tJYtckBvSHaOSuB5VLlSYzy5OlShzxRroczbqBanWnVVlRZDbSs4R +fHQ3f1QaPhXaW0LHHHId26hig2RC2VGASlo/aWDUOZL5OgMWZIM= +=rSfj +-----END PGP SIGNATURE----- diff --git a/dhcp.spec b/dhcp.spec index cf8b516e931804fcfc0712f5a4df58728bb34328..ff070f6c3a719391708aaf390457ad0f0d42b6cb 100644 --- a/dhcp.spec +++ b/dhcp.spec @@ -1,15 +1,16 @@ -%define anolis_release 2 +%define anolis_release 3 # disable systemtap %{!?sdt:%global sdt 0} %global _hardened_build 1 %global dhcpconfdir %{_sysconfdir}/dhcp -%global DHCPVERSION %{version} +%global subrelease P1 +%global DHCPVERSION %{version}-%{subrelease} Summary: Dynamic host configuration protocol software Name: dhcp Version: 4.4.3 -Release: %{anolis_release}%{?dist} +Release: %{anolis_release}.%{subrelease}%{?dist} # NEVER CHANGE THE EPOCH on this package. The previous maintainer (prior to # dcantrell maintaining the package) made incorrect use of the epoch and @@ -28,6 +29,7 @@ Source5: 56dhclient Source6: dhcpd.service Source7: dhcpd6.service Source8: dhcrelay.service +Source11: dhcp.sysusers # backend compat and borrowed from rhel Patch1 : 0001-change-bug-url.patch @@ -56,8 +58,9 @@ Patch23 : 0023-option-97-pxe-client-id.patch Patch24 : 0024-Detect-system-time-changes.patch Patch25 : 0025-bind-Detect-system-time-changes.patch Patch26 : 0026-Add-dhclient-5-B-option-description.patch -Patch27: 0027-Add-missed-sd-notify-patch-to-manage-dhcpd-with-syst.patch -Patch28: 0028-Use-system-getaddrinfo-for-dhcp.patch +Patch27 : 0027-Add-missed-sd-notify-patch-to-manage-dhcpd-with-syst.patch +Patch28 : 0028-Use-system-getaddrinfo-for-dhcp.patch +Patch29 : CVE-2021-25220.patch BuildRequires: autoconf BuildRequires: automake @@ -88,11 +91,9 @@ DHCP (Dynamic Host Configuration Protocol) Summary: Provides the ISC DHCP server Requires: %{name}-common = %{epoch}:%{version}-%{release} Obsoletes: %{name}-compat < 12:4.4.2-12.b1 -Requires(pre): shadow-utils Requires(post): coreutils grep sed -Requires(post): systemd -Requires(preun): systemd -Requires(postun): systemd +%{?sysusers_requires_compat} +%{?systemd_requires} %description server DHCP (Dynamic Host Configuration Protocol) is a protocol which allows @@ -121,7 +122,6 @@ easier to administer a large network. This package provides the ISC DHCP relay agent. - %package client Summary: Provides the ISC DHCP client daemon and dhclient-script Provides: dhclient = %{epoch}:%{version}-%{release} @@ -146,8 +146,6 @@ Summary: Common files used by ISC dhcp client, server and relay agent BuildArch: noarch Obsoletes: dhcp-libs < %{epoch}:%{version} - - %description common DHCP (Dynamic Host Configuration Protocol) is a protocol which allows individual devices on an IP network to get their own network @@ -167,7 +165,6 @@ Provides: bundled(bind) %description libs-static This package contains shared libraries used by ISC dhcp client and server - %package devel Summary: Development headers and libraries for interfacing to the DHCP server Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -276,6 +273,9 @@ install -m 644 %{SOURCE6} %{buildroot}%{_unitdir} install -m 644 %{SOURCE7} %{buildroot}%{_unitdir} install -m 644 %{SOURCE8} %{buildroot}%{_unitdir} +# systemd-sysusers +install -p -D -m 0644 %{SOURCE11} %{buildroot}%{_sysusersdir}/dhcp.conf + # Start empty lease databases mkdir -p %{buildroot}%{_localstatedir}/lib/dhcpd/ touch %{buildroot}%{_localstatedir}/lib/dhcpd/dhcpd.leases @@ -354,17 +354,7 @@ find %{buildroot} -type f -name "*.la" -delete -print %generate_compatibility_deps %pre server -# /usr/share/doc/setup/uidgid -%global gid_uid 177 -getent group dhcpd >/dev/null || groupadd --force --gid %{gid_uid} --system dhcpd -if ! getent passwd dhcpd >/dev/null ; then - if ! getent passwd %{gid_uid} >/dev/null ; then - useradd --system --uid %{gid_uid} --gid dhcpd --home / --shell /sbin/nologin --comment "DHCP server" dhcpd - else - useradd --system --gid dhcpd --home / --shell /sbin/nologin --comment "DHCP server" dhcpd - fi -fi -exit 0 +%sysusers_create_compat %{SOURCE11} %post server # Initial installation @@ -401,7 +391,6 @@ exit 0 # Package removal, not upgrade %systemd_preun dhcrelay.service - %postun server # Package upgrade, not uninstall %systemd_postun_with_restart dhcpd.service dhcpd6.service @@ -410,7 +399,6 @@ exit 0 # Package upgrade, not uninstall %systemd_postun_with_restart dhcrelay.service - %triggerun -- dhcp # convert DHC*ARGS from /etc/sysconfig/dhc* to /etc/systemd/system/dhc*.service for servicename in dhcpd dhcpd6 dhcrelay; do @@ -449,13 +437,14 @@ done %config(noreplace) %{_sysconfdir}/openldap/schema/dhcp.schema %attr(0644,root,root) %{_unitdir}/dhcpd.service %attr(0644,root,root) %{_unitdir}/dhcpd6.service +%{_sysusersdir}/dhcp.conf %{_sbindir}/dhcpd %{abidir}/dhcpd-option.list %{_bindir}/omshell -%attr(0644,root,root) %{_mandir}/man1/omshell.1.gz -%attr(0644,root,root) %{_mandir}/man5/dhcpd.conf.5.gz -%attr(0644,root,root) %{_mandir}/man5/dhcpd.leases.5.gz -%attr(0644,root,root) %{_mandir}/man8/dhcpd.8.gz +%attr(0644,root,root) %{_mandir}/man1/omshell.1.* +%attr(0644,root,root) %{_mandir}/man5/dhcpd.conf.5.* +%attr(0644,root,root) %{_mandir}/man5/dhcpd.leases.5.* +%attr(0644,root,root) %{_mandir}/man8/dhcpd.8.* %if %{sdt} %{tapsetdir}/*.stp %endif @@ -464,7 +453,7 @@ done %{_sbindir}/dhcrelay %{abidir}/dhcrelay-option.list %attr(0644,root,root) %{_unitdir}/dhcrelay.service -%attr(0644,root,root) %{_mandir}/man8/dhcrelay.8.gz +%attr(0644,root,root) %{_mandir}/man8/dhcrelay.8.* %files client %doc README.dhclient.d @@ -479,17 +468,17 @@ done %{abidir}/dhclient-option.list %{_sbindir}/dhclient-script %attr(0755,root,root) %{_libdir}/pm-utils/sleep.d/56dhclient -%attr(0644,root,root) %{_mandir}/man5/dhclient.conf.5.gz -%attr(0644,root,root) %{_mandir}/man5/dhclient.leases.5.gz -%attr(0644,root,root) %{_mandir}/man8/dhclient.8.gz -%attr(0644,root,root) %{_mandir}/man8/dhclient-script.8.gz +%attr(0644,root,root) %{_mandir}/man5/dhclient.conf.5.* +%attr(0644,root,root) %{_mandir}/man5/dhclient.leases.5.* +%attr(0644,root,root) %{_mandir}/man8/dhclient.8.* +%attr(0644,root,root) %{_mandir}/man8/dhclient-script.8.* %files common %{!?_licensedir:%global license %%doc} %{license} LICENSE %doc README RELNOTES doc/References.txt -%attr(0644,root,root) %{_mandir}/man5/dhcp-options.5.gz -%attr(0644,root,root) %{_mandir}/man5/dhcp-eval.5.gz +%attr(0644,root,root) %{_mandir}/man5/dhcp-options.5.* +%attr(0644,root,root) %{_mandir}/man5/dhcp-eval.5.* %files libs-static %{_libdir}/libdhcp*.a @@ -499,13 +488,16 @@ done %doc doc/IANA-arp-parameters doc/api+protocol %{_includedir}/dhcpctl %{_includedir}/omapip -%attr(0644,root,root) %{_mandir}/man3/dhcpctl.3.gz -%attr(0644,root,root) %{_mandir}/man3/omapi.3.gz +%attr(0644,root,root) %{_mandir}/man3/dhcpctl.3.* +%attr(0644,root,root) %{_mandir}/man3/omapi.3.* %files devel-doc %doc doc/html/ %changelog +* Mon Jan 9 2023 Heng Qi - 12:4.4.3-P1-3 +- update to 4.4.3-P1 + * Tue Nov 1 2022 mgb01105731 - 12:4.4.3-2 - optimise spec file diff --git a/dhcp.sysusers b/dhcp.sysusers new file mode 100644 index 0000000000000000000000000000000000000000..3d59bf3af818caddc0bf9ff27ac4e21031736dbe --- /dev/null +++ b/dhcp.sysusers @@ -0,0 +1,3 @@ +#Type Name ID GECOS Home directory Shell +u dhcpd 177 "DHCP server" / /sbin/nologin +g dhcpd 177