From cea59c3fd30271a5a2c159d795dfd835c83278a7 Mon Sep 17 00:00:00 2001 From: Lubomir Rintel Date: Fri, 3 Nov 2017 10:47:40 +0100 Subject: [PATCH 1/8] systemd: drop xlocale.h include It is not needed and doesn't exist in glibc 2.26 or other libcs. systemd removed it in commit 284d1cd0a1 too. (cherry picked from commit a5d7cf5c4b4110175c98da6bed4eaaed5ba35b78) (cherry picked from commit 3b207f9e58ac06ab0c279e0202d3cca8bbdd2427) --- src/systemd/src/basic/parse-util.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/systemd/src/basic/parse-util.c b/src/systemd/src/basic/parse-util.c index eb53c42d75..52695c1955 100644 --- a/src/systemd/src/basic/parse-util.c +++ b/src/systemd/src/basic/parse-util.c @@ -25,7 +25,6 @@ #include #include #include -#include #include "alloc-util.h" #if 0 /* NM_IGNORED */ From 18ee4a9191327d349e6e11db80c22bc2f2104c07 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Tue, 24 Jan 2017 05:11:59 +0300 Subject: [PATCH 2/8] sd-network: fix memleak in dhcp6_option_parse_domainname (#5114) The simplest way to reproduce: ```diff diff --git a/src/libsystemd-network/test-dhcp6-client.c b/src/libsystemd-network/test-dhcp6-client.c index bd289fa..7b0a5ef 100644 --- a/src/libsystemd-network/test-dhcp6-client.c +++ b/src/libsystemd-network/test-dhcp6-client.c @@ -168,7 +168,7 @@ static uint8_t msg_advertise[198] = { 0x00, 0x17, 0x00, 0x10, 0x20, 0x01, 0x0d, 0xb8, 0xde, 0xad, 0xbe, 0xef, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x18, 0x00, 0x0b, - 0x03, 0x6c, 0x61, 0x62, 0x05, 0x69, 0x6e, 0x74, + 0x01, 0x6c, 0x01, 0x62, 0x00, 0x0a, 0x6e, 0x74, 0x72, 0x61, 0x00, 0x00, 0x1f, 0x00, 0x10, 0x20, 0x01, 0x0d, 0xb8, 0xde, 0xad, 0xbe, 0xef, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, @@ -338,9 +338,7 @@ static int test_advertise_option(sd_event *e) { assert_se(!memcmp(addrs, &msg_advertise[124], r * 16)); r = sd_dhcp6_lease_get_domains(lease, &domains); - assert_se(r == 1); - assert_se(!strcmp("lab.intra", domains[0])); - assert_se(domains[1] == NULL); + assert_se(r == -ENOENT); r = sd_dhcp6_lease_get_ntp_addrs(lease, &addrs); assert_se(r == 1); ``` Fixes: ``` ================================================================= ==15043==ERROR: LeakSanitizer: detected memory leaks Direct leak of 4 byte(s) in 1 object(s) allocated from: #0 0x7f13c8564160 in strdup (/lib64/libasan.so.3+0x5a160) #1 0x7f13c7caaf69 in strv_extend src/basic/strv.c:552 #2 0x55f775787230 in dhcp6_option_parse_domainname src/libsystemd-network/dhcp6-option.c:399 #3 0x55f775788b96 in dhcp6_lease_set_domains src/libsystemd-network/sd-dhcp6-lease.c:225 #4 0x55f775774b95 in test_advertise_option src/libsystemd-network/test-dhcp6-client.c:287 #5 0x55f77577883e in main src/libsystemd-network/test-dhcp6-client.c:759 #6 0x7f13c7589400 in __libc_start_main (/lib64/libc.so.6+0x20400) Direct leak of 4 byte(s) in 1 object(s) allocated from: #0 0x7f13c8564160 in strdup (/lib64/libasan.so.3+0x5a160) #1 0x7f13c7caaf69 in strv_extend src/basic/strv.c:552 #2 0x55f775787230 in dhcp6_option_parse_domainname src/libsystemd-network/dhcp6-option.c:399 #3 0x55f775788b96 in dhcp6_lease_set_domains src/libsystemd-network/sd-dhcp6-lease.c:225 #4 0x55f775781348 in client_parse_message src/libsystemd-network/sd-dhcp6-client.c:807 #5 0x55f775781ba2 in client_receive_advertise src/libsystemd-network/sd-dhcp6-client.c:895 #6 0x55f775782453 in client_receive_message src/libsystemd-network/sd-dhcp6-client.c:994 #7 0x7f13c7e447f4 in source_dispatch src/libsystemd/sd-event/sd-event.c:2268 #8 0x7f13c7e471b0 in sd_event_dispatch src/libsystemd/sd-event/sd-event.c:2627 #9 0x7f13c7e47ab3 in sd_event_run src/libsystemd/sd-event/sd-event.c:2686 #10 0x7f13c7e47c21 in sd_event_loop src/libsystemd/sd-event/sd-event.c:2706 #11 0x55f77577863c in test_client_solicit src/libsystemd-network/test-dhcp6-client.c:737 #12 0x55f77577884b in main src/libsystemd-network/test-dhcp6-client.c:760 #13 0x7f13c7589400 in __libc_start_main (/lib64/libc.so.6+0x20400) SUMMARY: AddressSanitizer: 8 byte(s) leaked in 2 allocation(s). ``` (cherry picked from commit 419eaa8f8d2025bae98c23bdedb434d6dbb025b8) --- src/systemd/src/libsystemd-network/dhcp6-option.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c index ee63142cfa..3a77e34d57 100644 --- a/src/systemd/src/libsystemd-network/dhcp6-option.c +++ b/src/systemd/src/libsystemd-network/dhcp6-option.c @@ -341,7 +341,7 @@ int dhcp6_option_parse_ip6addrs(uint8_t *optval, uint16_t optlen, int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char ***str_arr) { size_t pos = 0, idx = 0; - _cleanup_free_ char **names = NULL; + _cleanup_strv_free_ char **names = NULL; int r; assert_return(optlen > 1, -ENODATA); From 4098b7d334b069520b332357009042da9b171962 Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Mon, 10 Sep 2018 15:22:28 +0200 Subject: [PATCH 3/8] systemd/dhcp: fix assertion starting DHCP client without MAC address An assertion in dhcp_network_bind_raw_socket() is triggered when starting an sd_dhcp_client without setting setting a MAC address first. - sd_dhcp_client_start() - client_start() - client_start_delayed() - dhcp_network_bind_raw_socket() In that case, the arp-type and MAC address is still unset. Note that dhcp_network_bind_raw_socket() already checks for a valid arp-type and MAC address below, so we should just gracefully return -EINVAL. Maybe sd_dhcp_client_start() should fail earlier when starting without MAC address. But the failure here will be correctly propagated and the start aborted. See-also: https://github.com/systemd/systemd/pull/10054 (cherry picked from commit 34af574d5810ab2b0d6d354cbc28135cde4a55b1) (cherry picked from commit 0a797bdc2a592385a21e7ed918c08ef54a346d99) (cherry picked from commit f37ed84ca495ee212b1e82b9c5a5682c4acfebcd) (cherry picked from commit 1031b2bb5c97bd48ff93f85537b3f5ce0f6f64bf) (cherry picked from commit 4ca49f52fae5c7841f873bc0a01d654dc19c2152) (cherry picked from commit 59941b21247c53091f303b58106f9b7a446835f1) (cherry picked from commit d8f9054e9b9e677519e5c40ce1c6e4f7a9ae4db8) --- src/systemd/src/libsystemd-network/dhcp-network.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/systemd/src/libsystemd-network/dhcp-network.c b/src/systemd/src/libsystemd-network/dhcp-network.c index 15a0bb7b8b..7dd65d6e6c 100644 --- a/src/systemd/src/libsystemd-network/dhcp-network.c +++ b/src/systemd/src/libsystemd-network/dhcp-network.c @@ -139,8 +139,6 @@ int dhcp_network_bind_raw_socket(int ifindex, union sockaddr_union *link, const uint8_t *bcast_addr = NULL; uint8_t dhcp_hlen = 0; - assert_return(mac_addr_len > 0, -EINVAL); - if (arp_type == ARPHRD_ETHER) { assert_return(mac_addr_len == ETH_ALEN, -EINVAL); memcpy(ð_mac, mac_addr, ETH_ALEN); From 42d0012d74a9ed084859360a9f243c5f9973d412 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Sat, 29 Sep 2018 03:06:10 +0000 Subject: [PATCH 4/8] dhcp6: fix an off-by-one error in dhcp6_option_parse_domainname ==14==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200055fa9c at pc 0x0000005458f1 bp 0x7ffc78940d90 sp 0x7ffc78940d88 READ of size 1 at 0x60200055fa9c thread T0 #0 0x5458f0 in dhcp6_option_parse_domainname /work/build/../../src/systemd/src/libsystemd-network/dhcp6-option.c:555:29 #1 0x54706e in dhcp6_lease_set_domains /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-lease.c:242:13 #2 0x53fce0 in client_parse_message /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-client.c:984:29 #3 0x53f3bc in client_receive_advertise /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-client.c:1083:13 #4 0x53d57f in client_receive_message /work/build/../../src/systemd/src/libsystemd-network/sd-dhcp6-client.c:1182:21 #5 0x7f0f7159deee in source_dispatch /work/build/../../src/systemd/src/libsystemd/sd-event/sd-event.c:3042:21 #6 0x7f0f7159d431 in sd_event_dispatch /work/build/../../src/systemd/src/libsystemd/sd-event/sd-event.c:3455:21 #7 0x7f0f7159ea8d in sd_event_run /work/build/../../src/systemd/src/libsystemd/sd-event/sd-event.c:3512:21 #8 0x531f2b in fuzz_client /work/build/../../src/systemd/src/fuzz/fuzz-dhcp6-client.c:44:9 #9 0x531bc1 in LLVMFuzzerTestOneInput /work/build/../../src/systemd/src/fuzz/fuzz-dhcp6-client.c:53:9 #10 0x57bec8 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:570:15 #11 0x579d67 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/libfuzzer/FuzzerLoop.cpp:479:3 #12 0x57dc92 in fuzzer::Fuzzer::MutateAndTestOne() /src/libfuzzer/FuzzerLoop.cpp:707:19 #13 0x580ca6 in fuzzer::Fuzzer::Loop(std::__1::vector, std::__1::allocator >, fuzzer::fuzzer_allocator, std::__1::allocator > > > const&) /src/libfuzzer/FuzzerLoop.cpp:838:5 #14 0x55e968 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:764:6 #15 0x551a1c in main /src/libfuzzer/FuzzerMain.cpp:20:10 #16 0x7f0f701a082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #17 0x41e928 in _start (/out/fuzz-dhcp6-client+0x41e928) https://github.com/systemd/systemd/pull/10200 https://github.com/systemd/systemd/commit/b387d3c1327a3ad2a2509bd3d3491e674392ff21 (cherry picked from commit 7cb7cffc4962245a32e87017bcf264005c043250) (cherry picked from commit cd3aacefdd0b91741b7b2e7b5ee5baab210addd9) (cherry picked from commit 5b140a77bc7b01dc002dbf28a7a2507a27a63d7c) (cherry picked from commit 0f25f47767794fb179edb9916566a208fbcfcb8f) (cherry picked from commit c13e43979e10e636e3787bf85a4d56fa5187e70d) (cherry picked from commit b7b2c8ad3829528eb24dacd91fac9056d731933a) (cherry picked from commit 86391f2741498c1d5bad8bfff89f85dcf43a1dc1) --- src/systemd/src/libsystemd-network/dhcp6-option.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c index 3a77e34d57..d8812c36fd 100644 --- a/src/systemd/src/libsystemd-network/dhcp6-option.c +++ b/src/systemd/src/libsystemd-network/dhcp6-option.c @@ -366,7 +366,7 @@ int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char * /* Literal label */ label = (const char *)&optval[pos]; pos += c; - if (pos > optlen) + if (pos >= optlen) return -EMSGSIZE; if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX)) { From 71c66cd2918998126b495489fa39bfe172ad6eb9 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Thu, 27 Sep 2018 18:04:59 +0900 Subject: [PATCH 5/8] sd-dhcp-lease: fix memleaks (cherry picked from commit e2975f854831d08a25b4f5eb329b6d04102e115f) (cherry picked from commit 157094abd83f933fad142758a7d177cfa1a347f7) (cherry picked from commit 3fd9d11619a5e60d375076fbe13851dd1d3a4a63) (cherry picked from commit 4439f07841bdddc6878132a993c229df032e8e85) (cherry picked from commit cbd0609cc482168912c747bad883ba6d434c2a11) (cherry picked from commit 3a070225b54692da89c801a1dc3df42a11d209a1) (cherry picked from commit 77d882583d975a1a671ddc9fb91d13255331ce10) --- src/systemd/src/libsystemd-network/sd-dhcp-lease.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/systemd/src/libsystemd-network/sd-dhcp-lease.c b/src/systemd/src/libsystemd-network/sd-dhcp-lease.c index b0f0a84457..8f066b900b 100644 --- a/src/systemd/src/libsystemd-network/sd-dhcp-lease.c +++ b/src/systemd/src/libsystemd-network/sd-dhcp-lease.c @@ -277,6 +277,8 @@ sd_dhcp_lease *sd_dhcp_lease_unref(sd_dhcp_lease *lease) { free(option); } + free(lease->root_path); + free(lease->timezone); free(lease->hostname); free(lease->domainname); free(lease->dns); From 1dc1bfffa58f8ce26d8ac52412cd1360e1401e57 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 19 Oct 2018 03:42:10 +0900 Subject: [PATCH 6/8] sd-dhcp6: make dhcp6_option_parse_domainname() not store empty domain This improves performance of fuzzer. C.f. oss-fuzz#11019. (cherry picked from commit 3c72b6ed4252e7ff5f7704bfe44557ec197b47fa) (cherry picked from commit 50403cccee28c7dcd54b138a0d3b3f69ea0204fe) (cherry picked from commit f11f5abb1a8b96b553d2d156f8b5cf440695c04d) (cherry picked from commit c836279fca80fb22ca7ef02acaa5b987fee61123) (cherry picked from commit 4ca0e57c46cf6861ec6f6b6c8e0d430edb3fa5b1) (cherry picked from commit 32e71d5bc09494736866fd78606994f8bf93b31d) (cherry picked from commit 331e81621e2ce822fa1c7658393c2daf7b910db8) (cherry picked from commit d589df063996f05b22ef30773fb85efde4531489) --- .../src/libsystemd-network/dhcp6-option.c | 56 ++++++++----------- 1 file changed, 24 insertions(+), 32 deletions(-) diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c index d8812c36fd..d496244370 100644 --- a/src/systemd/src/libsystemd-network/dhcp6-option.c +++ b/src/systemd/src/libsystemd-network/dhcp6-option.c @@ -353,6 +353,7 @@ int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char * bool first = true; for (;;) { + const char *label; uint8_t c; c = optval[pos++]; @@ -360,47 +361,41 @@ int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char * if (c == 0) /* End of name */ break; - else if (c <= 63) { - const char *label; + if (c > 63) + return -EBADMSG; - /* Literal label */ - label = (const char *)&optval[pos]; - pos += c; - if (pos >= optlen) - return -EMSGSIZE; + /* Literal label */ + label = (const char *)&optval[pos]; + pos += c; + if (pos >= optlen) + return -EMSGSIZE; - if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX)) { - r = -ENOMEM; - goto fail; - } + if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX)) + return -ENOMEM; - if (first) - first = false; - else - ret[n++] = '.'; + if (first) + first = false; + else + ret[n++] = '.'; - r = dns_label_escape(label, c, ret + n, DNS_LABEL_ESCAPED_MAX); - if (r < 0) - goto fail; + r = dns_label_escape(label, c, ret + n, DNS_LABEL_ESCAPED_MAX); + if (r < 0) + return r; - n += r; - continue; - } else { - r = -EBADMSG; - goto fail; - } + n += r; } - if (!GREEDY_REALLOC(ret, allocated, n + 1)) { - r = -ENOMEM; - goto fail; - } + if (n == 0) + continue; + + if (!GREEDY_REALLOC(ret, allocated, n + 1)) + return -ENOMEM; ret[n] = 0; r = strv_extend(&names, ret); if (r < 0) - goto fail; + return r; idx++; } @@ -409,7 +404,4 @@ int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char * names = NULL; return idx; - -fail: - return r; } From 694cdacfc6f38b4ecdd9c5b0817cf94754261ebd Mon Sep 17 00:00:00 2001 From: Li Song Date: Fri, 19 Oct 2018 13:41:51 -0400 Subject: [PATCH 7/8] sd-dhcp: remove unreachable route after rebinding return NAK (cherry picked from commit cc3981b1272b9ce37e7d734a7b2f42e84acac535) (cherry picked from commit 915c2f675a23b2ae16d292d1ac570706f76b384d) (cherry picked from commit cb77290a696dce924e2a993690634986ac035490) (cherry picked from commit f211b140a5861ddedc2424946e3ab07d3b642b5f) (cherry picked from commit 1cfefbb99ff3c2ab7a0f54829c6f3f787d9e6d77) (cherry picked from commit f3f5441820d0ecd0ff6861480ace696a6bf34fbd) (cherry picked from commit 7337cd21dd1e4a285ff1ae9463b42460a64c3107) (cherry picked from commit 8a6f6cab220faefe363cdaf7d92923e2fd624dfb) --- src/systemd/src/libsystemd-network/sd-dhcp-client.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/systemd/src/libsystemd-network/sd-dhcp-client.c b/src/systemd/src/libsystemd-network/sd-dhcp-client.c index 758dba4b66..ffcd5c72df 100644 --- a/src/systemd/src/libsystemd-network/sd-dhcp-client.c +++ b/src/systemd/src/libsystemd-network/sd-dhcp-client.c @@ -1521,6 +1521,8 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, client->timeout_resend = sd_event_source_unref(client->timeout_resend); + client_notify(client, SD_DHCP_CLIENT_EVENT_EXPIRED); + r = client_initialize(client); if (r < 0) goto error; From 6e56de0d87aa7891290ce907ecd7b725e73e3bc3 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 19 Oct 2018 12:12:33 +0200 Subject: [PATCH 8/8] dhcp6: make sure we have enough space for the DHCP6 option header Fixes a vulnerability originally discovered by Felix Wilhelm from Google. CVE-2018-15688 LP: #1795921 https://bugzilla.redhat.com/show_bug.cgi?id=1639067 (cherry picked from commit 4dac5eaba4e419b29c97da38a8b1f82336c2c892) (cherry picked from commit 01ca2053bbea09f35b958c8cc7631e15469acb79) (cherry picked from commit fc230dca139142f409d7bac99dbfabe9b004e2fb) (cherry picked from commit cc1e5a7f5731f223d1eb8473fa0eecbedfc0ae5f) (cherry picked from commit c3221cb0c5b4a2936c198e33b6f7853141991277) (cherry picked from commit f4f765534191ed3c5d8e78b97333f3fd978a2b63) (cherry picked from commit 2a25872910606d83f0532d668e73ab4809ee7f90) (cherry picked from commit ec471872e47f389d88a0dc6a12164feed378de39) --- src/systemd/src/libsystemd-network/dhcp6-option.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c index d496244370..7615cb80e0 100644 --- a/src/systemd/src/libsystemd-network/dhcp6-option.c +++ b/src/systemd/src/libsystemd-network/dhcp6-option.c @@ -103,7 +103,7 @@ int dhcp6_option_append_ia(uint8_t **buf, size_t *buflen, DHCP6IA *ia) { return -EINVAL; } - if (*buflen < len) + if (*buflen < offsetof(DHCP6Option, data) + len) return -ENOBUFS; ia_hdr = *buf;