Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=6bc9853f93cbcc1ec24c0b720772b0c0d2d8a6b8
commit 6bc9853f93cbcc1ec24c0b720772b0c0d2d8a6b8 Author: kikadf <[email protected]> Date: Mon Nov 24 09:15:59 2014 +0100 tcpdump-4.5.1-2-x86_64 * Fix CVE-2014-8767, CVE-2014-8768, CVE-2014-8769 diff --git a/source/network-extra/tcpdump/CVE-2014-8767.patch b/source/network-extra/tcpdump/CVE-2014-8767.patch new file mode 100644 index 0000000..e0eab74 --- /dev/null +++ b/source/network-extra/tcpdump/CVE-2014-8767.patch @@ -0,0 +1,178 @@ +From d8b4852e45a94fcde141ae28a2d5e36368ca92ae Mon Sep 17 00:00:00 2001 +From: Michal Sekletar <[email protected]> +Date: Thu, 20 Nov 2014 11:38:46 +0100 +Subject: [PATCH] Do more bounds checking and length checking. + +Don't run past the end of the captured data, and don't run past the end +of the packet (i.e., don't make the length variable go negative). + +Also, stop dissecting if the message length isn't valid. + +(cherry picked from commit 4038f83ebf654804829b258dde5e0a508c1c2003) +--- + print-olsr.c | 56 +++++++++++++++++++++++++++++++++++++++++++------------- + 1 file changed, 43 insertions(+), 13 deletions(-) + +diff --git a/print-olsr.c b/print-olsr.c +index d8619d4..f586d80 100644 +--- a/print-olsr.c ++++ b/print-olsr.c +@@ -181,7 +181,7 @@ struct olsr_lq_neighbor6 { + /* + * print a neighbor list with LQ extensions. + */ +-static void ++static int + olsr_print_lq_neighbor4 (const u_char *msg_data, u_int hello_len) + { + struct olsr_lq_neighbor4 *lq_neighbor; +@@ -189,6 +189,8 @@ olsr_print_lq_neighbor4 (const u_char *msg_data, u_int hello_len) + while (hello_len >= sizeof(struct olsr_lq_neighbor4)) { + + lq_neighbor = (struct olsr_lq_neighbor4 *)msg_data; ++ if (!TTEST(*lq_neighbor)) ++ return (-1); + + printf("\n\t neighbor %s, link-quality %.2lf%%" + ", neighbor-link-quality %.2lf%%", +@@ -199,10 +201,11 @@ olsr_print_lq_neighbor4 (const u_char *msg_data, u_int hello_len) + msg_data += sizeof(struct olsr_lq_neighbor4); + hello_len -= sizeof(struct olsr_lq_neighbor4); + } ++ return (0); + } + + #if INET6 +-static void ++static int + olsr_print_lq_neighbor6 (const u_char *msg_data, u_int hello_len) + { + struct olsr_lq_neighbor6 *lq_neighbor; +@@ -210,6 +213,8 @@ olsr_print_lq_neighbor6 (const u_char *msg_data, u_int hello_len) + while (hello_len >= sizeof(struct olsr_lq_neighbor6)) { + + lq_neighbor = (struct olsr_lq_neighbor6 *)msg_data; ++ if (!TTEST(*lq_neighbor)) ++ return (-1); + + printf("\n\t neighbor %s, link-quality %.2lf%%" + ", neighbor-link-quality %.2lf%%", +@@ -220,13 +225,14 @@ olsr_print_lq_neighbor6 (const u_char *msg_data, u_int hello_len) + msg_data += sizeof(struct olsr_lq_neighbor6); + hello_len -= sizeof(struct olsr_lq_neighbor6); + } ++ return (0); + } + #endif /* INET6 */ + + /* + * print a neighbor list. + */ +-static void ++static int + olsr_print_neighbor (const u_char *msg_data, u_int hello_len) + { + int neighbor; +@@ -236,6 +242,9 @@ olsr_print_neighbor (const u_char *msg_data, u_int hello_len) + + while (hello_len >= sizeof(struct in_addr)) { + ++ if (!TTEST2(*msg_data, sizeof(struct in_addr))) ++ return (-1); ++ + /* print 4 neighbors per line */ + + printf("%s%s", ipaddr_string(msg_data), +@@ -329,6 +338,9 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) + ME_TO_DOUBLE(msgptr.v6->vtime), + EXTRACT_16BITS(msgptr.v6->msg_seq), + msg_len, (msg_len_valid == 0) ? " (invalid)" : ""); ++ if (!msg_len_valid) { ++ return; ++ } + + msg_tlen = msg_len - sizeof(struct olsr_msg6); + msg_data = tptr + sizeof(struct olsr_msg6); +@@ -357,6 +369,9 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) + ME_TO_DOUBLE(msgptr.v4->vtime), + EXTRACT_16BITS(msgptr.v4->msg_seq), + msg_len, (msg_len_valid == 0) ? " (invalid)" : ""); ++ if (!msg_len_valid) { ++ return; ++ } + + msg_tlen = msg_len - sizeof(struct olsr_msg4); + msg_data = tptr + sizeof(struct olsr_msg4); +@@ -365,6 +380,8 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) + switch (msg_type) { + case OLSR_HELLO_MSG: + case OLSR_HELLO_LQ_MSG: ++ if (msg_tlen < sizeof(struct olsr_hello)) ++ goto trunc; + if (!TTEST2(*msg_data, sizeof(struct olsr_hello))) + goto trunc; + +@@ -406,15 +423,21 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) + msg_tlen -= sizeof(struct olsr_hello_link); + hello_len -= sizeof(struct olsr_hello_link); + ++ TCHECK2(*msg_data, hello_len); + if (msg_type == OLSR_HELLO_MSG) { +- olsr_print_neighbor(msg_data, hello_len); ++ if (olsr_print_neighbor(msg_data, hello_len) == -1) ++ goto trunc; + } else { + #if INET6 +- if (is_ipv6) +- olsr_print_lq_neighbor6(msg_data, hello_len); +- else ++ if (is_ipv6) { ++ if (olsr_print_lq_neighbor6(msg_data, hello_len) == -1) ++ goto trunc; ++ } else + #endif +- olsr_print_lq_neighbor4(msg_data, hello_len); ++ { ++ if (olsr_print_lq_neighbor4(msg_data, hello_len) == -1) ++ goto trunc; ++ } + } + + msg_data += hello_len; +@@ -424,6 +447,8 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) + + case OLSR_TC_MSG: + case OLSR_TC_LQ_MSG: ++ if (msg_tlen < sizeof(struct olsr_tc)) ++ goto trunc; + if (!TTEST2(*msg_data, sizeof(struct olsr_tc))) + goto trunc; + +@@ -434,14 +459,19 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) + msg_tlen -= sizeof(struct olsr_tc); + + if (msg_type == OLSR_TC_MSG) { +- olsr_print_neighbor(msg_data, msg_tlen); ++ if (olsr_print_neighbor(msg_data, msg_tlen) == -1) ++ goto trunc; + } else { + #if INET6 +- if (is_ipv6) +- olsr_print_lq_neighbor6(msg_data, msg_tlen); +- else ++ if (is_ipv6) { ++ if (olsr_print_lq_neighbor6(msg_data, msg_tlen) == -1) ++ goto trunc; ++ } else + #endif +- olsr_print_lq_neighbor4(msg_data, msg_tlen); ++ { ++ if (olsr_print_lq_neighbor4(msg_data, msg_tlen) == -1) ++ goto trunc; ++ } + } + break; + +-- +1.8.3.1 + diff --git a/source/network-extra/tcpdump/CVE-2014-8768.patch b/source/network-extra/tcpdump/CVE-2014-8768.patch new file mode 100644 index 0000000..02ddd99 --- /dev/null +++ b/source/network-extra/tcpdump/CVE-2014-8768.patch @@ -0,0 +1,335 @@ +diff -up tcpdump-4.5.1/print-geonet.c.cve-2014-8768 tcpdump-4.5.1/print-geonet.c +--- tcpdump-4.5.1/print-geonet.c.cve-2014-8768 2014-11-20 15:38:53.183794306 +0100 ++++ tcpdump-4.5.1/print-geonet.c 2014-11-20 15:59:06.832860093 +0100 +@@ -56,16 +56,12 @@ static const struct tok msg_type_values[ + }; + + static void +-print_btp_body(const u_char *bp, u_int length) ++print_btp_body(const u_char *bp) + { + int version; + int msg_type; + const char *msg_type_str; + +- if (length <= 2) { +- return; +- } +- + /* Assuming ItsDpuHeader */ + version = bp[0]; + msg_type = bp[1]; +@@ -82,7 +78,7 @@ print_btp(const u_char *bp) + printf("; BTP Dst:%u Src:%u", dest, src); + } + +-static void ++static int + print_long_pos_vector(const u_char *bp) + { + int i; +@@ -95,10 +91,14 @@ print_long_pos_vector(const u_char *bp) + } + printf(" "); + ++ if (!TTEST2(*(bp+12), 8)) ++ return (-1); ++ + lat = EXTRACT_32BITS(bp+12); + printf("lat:%d ", lat); + lon = EXTRACT_32BITS(bp+16); + printf("lon:%d", lon); ++ return (0); + } + + +@@ -109,140 +109,159 @@ print_long_pos_vector(const u_char *bp) + void + geonet_print(netdissect_options *ndo, const u_char *eth, const u_char *bp, u_int length) + { +- printf("GeoNet src:%s; ", etheraddr_string(eth+6)); ++ int version; ++ int next_hdr; ++ int hdr_type; ++ int hdr_subtype; ++ uint16_t payload_length; ++ int hop_limit; ++ const char *next_hdr_txt = "Unknown"; ++ const char *hdr_type_txt = "Unknown"; ++ int hdr_size = -1; + +- if (length >= 36) { +- /* Process Common Header */ +- int version = bp[0] >> 4; +- int next_hdr = bp[0] & 0x0f; +- int hdr_type = bp[1] >> 4; +- int hdr_subtype = bp[1] & 0x0f; +- u_int16_t payload_length = EXTRACT_16BITS(bp+4); +- int hop_limit = bp[7]; +- const char *next_hdr_txt = "Unknown"; +- const char *hdr_type_txt = "Unknown"; +- int hdr_size = -1; +- +- switch (next_hdr) { +- case 0: next_hdr_txt = "Any"; break; +- case 1: next_hdr_txt = "BTP-A"; break; +- case 2: next_hdr_txt = "BTP-B"; break; +- case 3: next_hdr_txt = "IPv6"; break; +- } +- +- switch (hdr_type) { +- case 0: hdr_type_txt = "Any"; break; +- case 1: hdr_type_txt = "Beacon"; break; +- case 2: hdr_type_txt = "GeoUnicast"; break; +- case 3: switch (hdr_subtype) { +- case 0: hdr_type_txt = "GeoAnycastCircle"; break; +- case 1: hdr_type_txt = "GeoAnycastRect"; break; +- case 2: hdr_type_txt = "GeoAnycastElipse"; break; +- } +- break; +- case 4: switch (hdr_subtype) { +- case 0: hdr_type_txt = "GeoBroadcastCircle"; break; +- case 1: hdr_type_txt = "GeoBroadcastRect"; break; +- case 2: hdr_type_txt = "GeoBroadcastElipse"; break; +- } +- break; +- case 5: switch (hdr_subtype) { +- case 0: hdr_type_txt = "TopoScopeBcast-SH"; break; +- case 1: hdr_type_txt = "TopoScopeBcast-MH"; break; +- } +- break; +- case 6: switch (hdr_subtype) { +- case 0: hdr_type_txt = "LocService-Request"; break; +- case 1: hdr_type_txt = "LocService-Reply"; break; +- } +- break; +- } +- +- printf("v:%d ", version); +- printf("NH:%d-%s ", next_hdr, next_hdr_txt); +- printf("HT:%d-%d-%s ", hdr_type, hdr_subtype, hdr_type_txt); +- printf("HopLim:%d ", hop_limit); +- printf("Payload:%d ", payload_length); +- print_long_pos_vector(bp + 8); +- +- /* Skip Common Header */ +- length -= 36; +- bp += 36; +- +- /* Process Extended Headers */ +- switch (hdr_type) { +- case 0: /* Any */ +- hdr_size = 0; +- break; +- case 1: /* Beacon */ +- hdr_size = 0; +- break; +- case 2: /* GeoUnicast */ +- break; +- case 3: switch (hdr_subtype) { +- case 0: /* GeoAnycastCircle */ +- break; +- case 1: /* GeoAnycastRect */ +- break; +- case 2: /* GeoAnycastElipse */ +- break; +- } +- break; +- case 4: switch (hdr_subtype) { +- case 0: /* GeoBroadcastCircle */ +- break; +- case 1: /* GeoBroadcastRect */ +- break; +- case 2: /* GeoBroadcastElipse */ +- break; +- } +- break; +- case 5: switch (hdr_subtype) { +- case 0: /* TopoScopeBcast-SH */ +- hdr_size = 0; +- break; +- case 1: /* TopoScopeBcast-MH */ +- hdr_size = 68 - 36; +- break; +- } +- break; +- case 6: switch (hdr_subtype) { +- case 0: /* LocService-Request */ +- break; +- case 1: /* LocService-Reply */ +- break; +- } +- break; +- } +- +- /* Skip Extended headers */ +- if (hdr_size >= 0) { +- length -= hdr_size; +- bp += hdr_size; +- switch (next_hdr) { +- case 0: /* Any */ +- break; +- case 1: +- case 2: /* BTP A/B */ +- print_btp(bp); +- length -= 4; +- bp += 4; +- print_btp_body(bp, length); +- break; +- case 3: /* IPv6 */ +- break; +- } +- } +- } else { +- printf("Malformed (small) "); +- } ++ printf("GeoNet src:%s; ", etheraddr_string(eth+6)); + +- /* Print user data part */ +- if (ndo->ndo_vflag) +- default_print(bp, length); +-} ++ /* Process Common Header */ ++ if (length < 36) ++ goto malformed; ++ ++ ND_TCHECK2(*bp, 7); ++ version = bp[0] >> 4; ++ next_hdr = bp[0] & 0x0f; ++ hdr_type = bp[1] >> 4; ++ hdr_subtype = bp[1] & 0x0f; ++ payload_length = EXTRACT_16BITS(bp+4); ++ hop_limit = bp[7]; ++ ++ switch (next_hdr) { ++ case 0: next_hdr_txt = "Any"; break; ++ case 1: next_hdr_txt = "BTP-A"; break; ++ case 2: next_hdr_txt = "BTP-B"; break; ++ case 3: next_hdr_txt = "IPv6"; break; ++ } ++ ++ switch (hdr_type) { ++ case 0: hdr_type_txt = "Any"; break; ++ case 1: hdr_type_txt = "Beacon"; break; ++ case 2: hdr_type_txt = "GeoUnicast"; break; ++ case 3: switch (hdr_subtype) { ++ case 0: hdr_type_txt = "GeoAnycastCircle"; break; ++ case 1: hdr_type_txt = "GeoAnycastRect"; break; ++ case 2: hdr_type_txt = "GeoAnycastElipse"; break; ++ } ++ break; ++ case 4: switch (hdr_subtype) { ++ case 0: hdr_type_txt = "GeoBroadcastCircle"; break; ++ case 1: hdr_type_txt = "GeoBroadcastRect"; break; ++ case 2: hdr_type_txt = "GeoBroadcastElipse"; break; ++ } ++ break; ++ case 5: switch (hdr_subtype) { ++ case 0: hdr_type_txt = "TopoScopeBcast-SH"; break; ++ case 1: hdr_type_txt = "TopoScopeBcast-MH"; break; ++ } ++ break; ++ case 6: switch (hdr_subtype) { ++ case 0: hdr_type_txt = "LocService-Request"; break; ++ case 1: hdr_type_txt = "LocService-Reply"; break; ++ } ++ break; ++ } ++ ++ printf("v:%d ", version); ++ printf("NH:%d-%s ", next_hdr, next_hdr_txt); ++ printf("HT:%d-%d-%s ", hdr_type, hdr_subtype, hdr_type_txt); ++ printf("HopLim:%d ", hop_limit); ++ printf("Payload:%d ", payload_length); ++ print_long_pos_vector(bp + 8); ++ ++ /* Skip Common Header */ ++ length -= 36; ++ bp += 36; ++ ++ /* Process Extended Headers */ ++ switch (hdr_type) { ++ case 0: /* Any */ ++ hdr_size = 0; ++ break; ++ case 1: /* Beacon */ ++ hdr_size = 0; ++ break; ++ case 2: /* GeoUnicast */ ++ break; ++ case 3: switch (hdr_subtype) { ++ case 0: /* GeoAnycastCircle */ ++ break; ++ case 1: /* GeoAnycastRect */ ++ break; ++ case 2: /* GeoAnycastElipse */ ++ break; ++ } ++ break; ++ case 4: switch (hdr_subtype) { ++ case 0: /* GeoBroadcastCircle */ ++ break; ++ case 1: /* GeoBroadcastRect */ ++ break; ++ case 2: /* GeoBroadcastElipse */ ++ break; ++ } ++ break; ++ case 5: switch (hdr_subtype) { ++ case 0: /* TopoScopeBcast-SH */ ++ hdr_size = 0; ++ break; ++ case 1: /* TopoScopeBcast-MH */ ++ hdr_size = 68 - 36; ++ break; ++ } ++ break; ++ case 6: switch (hdr_subtype) { ++ case 0: /* LocService-Request */ ++ break; ++ case 1: /* LocService-Reply */ ++ break; ++ } ++ break; ++ } ++ ++ /* Skip Extended headers */ ++ if (hdr_size >= 0) { ++ if (length < (u_int)hdr_size) ++ goto malformed; ++ ND_TCHECK2(*bp, hdr_size); ++ ++ length -= hdr_size; ++ bp += hdr_size; ++ switch (next_hdr) { ++ case 0: /* Any */ ++ break; ++ case 1: ++ case 2: /* BTP A/B */ ++ print_btp(bp); ++ length -= 4; ++ bp += 4; ++ print_btp_body(bp); ++ break; ++ case 3: /* IPv6 */ ++ break; ++ } ++ } ++ ++ /* Print user data part */ ++ if (ndo->ndo_vflag) ++ default_print(bp, length); ++ return; ++ ++malformed: ++ ND_PRINT((ndo, " Malformed (small) ")); ++ /* XXX - print the remaining data as hex? */ ++ return; + ++trunc: ++ ND_PRINT((ndo, "[|geonet]")); + ++} + /* + * Local Variables: + * c-style: whitesmith diff --git a/source/network-extra/tcpdump/CVE-2014-8769.patch b/source/network-extra/tcpdump/CVE-2014-8769.patch new file mode 100644 index 0000000..30d694a --- /dev/null +++ b/source/network-extra/tcpdump/CVE-2014-8769.patch @@ -0,0 +1,581 @@ +From 357525b6942eef3ef9696f1fe92ba7fe2ed68ac2 Mon Sep 17 00:00:00 2001 +From: Michal Sekletar <[email protected]> +Date: Fri, 21 Nov 2014 12:19:32 +0100 +Subject: [PATCH] Fix for CVE-2014-8769 + +(cherry picked from ab4e52b94aac6cb729a5a695aa612d5ebda2ec3a + 3e8a443c3671baa37ae7870f08fb9b4bf386fd24) +--- + aodv.h | 20 ---- + print-aodv.c | 315 +++++++++++++++++++++++++++++++---------------------------- + 2 files changed, 168 insertions(+), 167 deletions(-) + +diff --git a/aodv.h b/aodv.h +index 456ec8b..18467d5 100644 +--- a/aodv.h ++++ b/aodv.h +@@ -134,13 +134,6 @@ struct aodv_rerr { + u_int8_t rerr_flags; /* various flags */ + u_int8_t rerr_zero0; /* reserved, set to zero */ + u_int8_t rerr_dc; /* destination count */ +- union { +- struct rerr_unreach dest[1]; +-#ifdef INET6 +- struct rerr_unreach6 dest6[1]; +- struct rerr_unreach6_draft_01 dest6_draft_01[1]; +-#endif +- } r; + }; + + #define RERR_NODELETE 0x80 /* don't delete the link */ +@@ -151,19 +144,6 @@ struct aodv_rrep_ack { + u_int8_t ra_zero0; + }; + +-union aodv { +- struct aodv_rreq rreq; +- struct aodv_rrep rrep; +- struct aodv_rerr rerr; +- struct aodv_rrep_ack rrep_ack; +-#ifdef INET6 +- struct aodv_rreq6 rreq6; +- struct aodv_rreq6_draft_01 rreq6_draft_01; +- struct aodv_rrep6 rrep6; +- struct aodv_rrep6_draft_01 rrep6_draft_01; +-#endif +-}; +- + #define AODV_RREQ 1 /* route request */ + #define AODV_RREP 2 /* route response */ + #define AODV_RERR 3 /* error report */ +diff --git a/print-aodv.c b/print-aodv.c +index c5f6622..b4f7989 100644 +--- a/print-aodv.c ++++ b/print-aodv.c +@@ -82,7 +82,7 @@ aodv_extension(const struct aodv_ext *ep, u_int length) + } + + static void +-aodv_rreq(const union aodv *ap, const u_char *dat, u_int length) ++aodv_rreq(const struct aodv_rreq *ap, const u_char *dat, u_int length) + { + u_int i; + +@@ -91,30 +91,31 @@ aodv_rreq(const union aodv *ap, const u_char *dat, u_int length) + return; + } + i = min(length, (u_int)(snapend - dat)); +- if (i < sizeof(ap->rreq)) { ++ if (i < sizeof(*ap)) { + printf(" [|rreq]"); + return; + } +- i -= sizeof(ap->rreq); ++ i -= sizeof(*ap); + printf(" rreq %u %s%s%s%s%shops %u id 0x%08lx\n" + "\tdst %s seq %lu src %s seq %lu", length, +- ap->rreq.rreq_type & RREQ_JOIN ? "[J]" : "", +- ap->rreq.rreq_type & RREQ_REPAIR ? "[R]" : "", +- ap->rreq.rreq_type & RREQ_GRAT ? "[G]" : "", +- ap->rreq.rreq_type & RREQ_DEST ? "[D]" : "", +- ap->rreq.rreq_type & RREQ_UNKNOWN ? "[U] " : " ", +- ap->rreq.rreq_hops, +- (unsigned long)EXTRACT_32BITS(&ap->rreq.rreq_id), +- ipaddr_string(&ap->rreq.rreq_da), +- (unsigned long)EXTRACT_32BITS(&ap->rreq.rreq_ds), +- ipaddr_string(&ap->rreq.rreq_oa), +- (unsigned long)EXTRACT_32BITS(&ap->rreq.rreq_os)); ++ ap->rreq_type & RREQ_JOIN ? "[J]" : "", ++ ap->rreq_type & RREQ_REPAIR ? "[R]" : "", ++ ap->rreq_type & RREQ_GRAT ? "[G]" : "", ++ ap->rreq_type & RREQ_DEST ? "[D]" : "", ++ ap->rreq_type & RREQ_UNKNOWN ? "[U] " : " ", ++ ap->rreq_hops, ++ (unsigned long)EXTRACT_32BITS(&ap->rreq_id), ++ ipaddr_string(&ap->rreq_da), ++ (unsigned long)EXTRACT_32BITS(&ap->rreq_ds), ++ ipaddr_string(&ap->rreq_oa), ++ (unsigned long)EXTRACT_32BITS(&ap->rreq_os)); ++ + if (i >= sizeof(struct aodv_ext)) +- aodv_extension((void *)(&ap->rreq + 1), i); ++ aodv_extension((void *)(ap + 1), i); + } + + static void +-aodv_rrep(const union aodv *ap, const u_char *dat, u_int length) ++aodv_rrep(const struct aodv_rrep *ap, const u_char *dat, u_int length) + { + u_int i; + +@@ -123,62 +124,60 @@ aodv_rrep(const union aodv *ap, const u_char *dat, u_int length) + return; + } + i = min(length, (u_int)(snapend - dat)); +- if (i < sizeof(ap->rrep)) { ++ if (i < sizeof(*ap)) { + printf(" [|rrep]"); + return; + } +- i -= sizeof(ap->rrep); ++ i -= sizeof(*ap); + printf(" rrep %u %s%sprefix %u hops %u\n" + "\tdst %s dseq %lu src %s %lu ms", length, +- ap->rrep.rrep_type & RREP_REPAIR ? "[R]" : "", +- ap->rrep.rrep_type & RREP_ACK ? "[A] " : " ", +- ap->rrep.rrep_ps & RREP_PREFIX_MASK, +- ap->rrep.rrep_hops, +- ipaddr_string(&ap->rrep.rrep_da), +- (unsigned long)EXTRACT_32BITS(&ap->rrep.rrep_ds), +- ipaddr_string(&ap->rrep.rrep_oa), +- (unsigned long)EXTRACT_32BITS(&ap->rrep.rrep_life)); +- if (i >= sizeof(struct aodv_ext)) +- aodv_extension((void *)(&ap->rrep + 1), i); ++ ap->rrep_type & RREP_REPAIR ? "[R]" : "", ++ ap->rrep_type & RREP_ACK ? "[A] " : " ", ++ ap->rrep_ps & RREP_PREFIX_MASK, ++ ap->rrep_hops, ++ ipaddr_string(&ap->rrep_da), ++ (unsigned long)EXTRACT_32BITS(&ap->rrep_ds), ++ ipaddr_string(&ap->rrep_oa), ++ (unsigned long)EXTRACT_32BITS(&ap->rrep_life)); ++ ++ if (i >= sizeof(struct aodv_ext)) ++ aodv_extension((void *)(ap + 1), i); + } + + static void +-aodv_rerr(const union aodv *ap, const u_char *dat, u_int length) ++aodv_rerr(const struct aodv_rerr *ap, const u_char *dat, u_int length) + { +- u_int i; +- const struct rerr_unreach *dp = NULL; +- int n, trunc; ++ u_int i, dc; ++ const struct rerr_unreach *dp; + + if (snapend < dat) { + printf(" [|aodv]"); + return; + } + i = min(length, (u_int)(snapend - dat)); +- if (i < offsetof(struct aodv_rerr, r)) { ++ if (i < sizeof(*ap)) { + printf(" [|rerr]"); + return; + } +- i -= offsetof(struct aodv_rerr, r); +- dp = &ap->rerr.r.dest[0]; +- n = ap->rerr.rerr_dc * sizeof(ap->rerr.r.dest[0]); ++ i -= sizeof(*ap); + printf(" rerr %s [items %u] [%u]:", +- ap->rerr.rerr_flags & RERR_NODELETE ? "[D]" : "", +- ap->rerr.rerr_dc, length); +- trunc = n - (i/sizeof(ap->rerr.r.dest[0])); +- for (; i >= sizeof(ap->rerr.r.dest[0]); +- ++dp, i -= sizeof(ap->rerr.r.dest[0])) { ++ ap->rerr_flags & RERR_NODELETE ? "[D]" : "", ++ ap->rerr_dc, length); ++ dp = (struct rerr_unreach *)(void *)(ap + 1); ++ for (dc = ap->rerr_dc; dc != 0 && i >= sizeof(*dp); ++ ++dp, --dc, i -= sizeof(*dp)) { + printf(" {%s}(%ld)", ipaddr_string(&dp->u_da), + (unsigned long)EXTRACT_32BITS(&dp->u_ds)); + } +- if (trunc) ++ if ((i % sizeof(*dp)) != 0) + printf("[|rerr]"); + } + + static void + #ifdef INET6 +-aodv_v6_rreq(const union aodv *ap, const u_char *dat, u_int length) ++aodv_v6_rreq(const struct aodv_rreq6 *ap, const u_char *dat, u_int length) + #else +-aodv_v6_rreq(const union aodv *ap _U_, const u_char *dat _U_, u_int length) ++aodv_v6_rreq(const struct aodv_rreq6 *ap _U_, const u_char *dat _U_, u_int length) + #endif + { + #ifdef INET6 +@@ -189,26 +188,27 @@ aodv_v6_rreq(const union aodv *ap _U_, const u_char *dat _U_, u_int length) + return; + } + i = min(length, (u_int)(snapend - dat)); +- if (i < sizeof(ap->rreq6)) { ++ if (i < sizeof(*ap)) { + printf(" [|rreq6]"); + return; + } +- i -= sizeof(ap->rreq6); ++ i -= sizeof(*ap); + printf(" v6 rreq %u %s%s%s%s%shops %u id 0x%08lx\n" + "\tdst %s seq %lu src %s seq %lu", length, +- ap->rreq6.rreq_type & RREQ_JOIN ? "[J]" : "", +- ap->rreq6.rreq_type & RREQ_REPAIR ? "[R]" : "", +- ap->rreq6.rreq_type & RREQ_GRAT ? "[G]" : "", +- ap->rreq6.rreq_type & RREQ_DEST ? "[D]" : "", +- ap->rreq6.rreq_type & RREQ_UNKNOWN ? "[U] " : " ", +- ap->rreq6.rreq_hops, +- (unsigned long)EXTRACT_32BITS(&ap->rreq6.rreq_id), +- ip6addr_string(&ap->rreq6.rreq_da), +- (unsigned long)EXTRACT_32BITS(&ap->rreq6.rreq_ds), +- ip6addr_string(&ap->rreq6.rreq_oa), +- (unsigned long)EXTRACT_32BITS(&ap->rreq6.rreq_os)); ++ ap->rreq_type & RREQ_JOIN ? "[J]" : "", ++ ap->rreq_type & RREQ_REPAIR ? "[R]" : "", ++ ap->rreq_type & RREQ_GRAT ? "[G]" : "", ++ ap->rreq_type & RREQ_DEST ? "[D]" : "", ++ ap->rreq_type & RREQ_UNKNOWN ? "[U] " : " ", ++ ap->rreq_hops, ++ (unsigned long)EXTRACT_32BITS(&ap->rreq_id), ++ ip6addr_string(&ap->rreq_da), ++ (unsigned long)EXTRACT_32BITS(&ap->rreq_ds), ++ ip6addr_string(&ap->rreq_oa), ++ (unsigned long)EXTRACT_32BITS(&ap->rreq_os)); ++ + if (i >= sizeof(struct aodv_ext)) +- aodv_extension((void *)(&ap->rreq6 + 1), i); ++ aodv_extension((void *)(ap + 1), i); + #else + printf(" v6 rreq %u", length); + #endif +@@ -216,9 +216,9 @@ aodv_v6_rreq(const union aodv *ap _U_, const u_char *dat _U_, u_int length) + + static void + #ifdef INET6 +-aodv_v6_rrep(const union aodv *ap, const u_char *dat, u_int length) ++aodv_v6_rrep(const struct aodv_rrep6 *ap, const u_char *dat, u_int length) + #else +-aodv_v6_rrep(const union aodv *ap _U_, const u_char *dat _U_, u_int length) ++aodv_v6_rrep(const struct aodv_rrep6 *ap _U_, const u_char *dat _U_, u_int length) + #endif + { + #ifdef INET6 +@@ -229,23 +229,24 @@ aodv_v6_rrep(const union aodv *ap _U_, const u_char *dat _U_, u_int length) + return; + } + i = min(length, (u_int)(snapend - dat)); +- if (i < sizeof(ap->rrep6)) { ++ if (i < sizeof(*ap)) { + printf(" [|rrep6]"); + return; + } +- i -= sizeof(ap->rrep6); ++ i -= sizeof(*ap); + printf(" rrep %u %s%sprefix %u hops %u\n" + "\tdst %s dseq %lu src %s %lu ms", length, +- ap->rrep6.rrep_type & RREP_REPAIR ? "[R]" : "", +- ap->rrep6.rrep_type & RREP_ACK ? "[A] " : " ", +- ap->rrep6.rrep_ps & RREP_PREFIX_MASK, +- ap->rrep6.rrep_hops, +- ip6addr_string(&ap->rrep6.rrep_da), +- (unsigned long)EXTRACT_32BITS(&ap->rrep6.rrep_ds), +- ip6addr_string(&ap->rrep6.rrep_oa), +- (unsigned long)EXTRACT_32BITS(&ap->rrep6.rrep_life)); ++ ap->rrep_type & RREP_REPAIR ? "[R]" : "", ++ ap->rrep_type & RREP_ACK ? "[A] " : " ", ++ ap->rrep_ps & RREP_PREFIX_MASK, ++ ap->rrep_hops, ++ ip6addr_string(&ap->rrep_da), ++ (unsigned long)EXTRACT_32BITS(&ap->rrep_ds), ++ ip6addr_string(&ap->rrep_oa), ++ (unsigned long)EXTRACT_32BITS(&ap->rrep_life)); ++ + if (i >= sizeof(struct aodv_ext)) +- aodv_extension((void *)(&ap->rrep6 + 1), i); ++ aodv_extension((void *)(ap + 1), i); + #else + printf(" rrep %u", length); + #endif +@@ -253,28 +254,36 @@ aodv_v6_rrep(const union aodv *ap _U_, const u_char *dat _U_, u_int length) + + static void + #ifdef INET6 +-aodv_v6_rerr(const union aodv *ap, u_int length) ++aodv_v6_rerr(const struct aodv_rerr *ap, const u_char *dat, u_int length) + #else +-aodv_v6_rerr(const union aodv *ap _U_, u_int length) ++aodv_v6_rerr(const struct aodv_rerr *ap _U_, const u_char *dat, u_int length) + #endif + { + #ifdef INET6 +- const struct rerr_unreach6 *dp6 = NULL; +- int i, j, n, trunc; ++ u_int i, dc; ++ const struct rerr_unreach6 *dp6; ++ ++ if (snapend < dat) { ++ printf(" [|aodv]"); ++ return; ++ } ++ i = min(length, (u_int)(snapend - dat)); ++ if (i < sizeof(*ap)) { ++ printf(" [|rerr]"); ++ return; ++ } ++ i -= sizeof(*ap); + +- i = length - offsetof(struct aodv_rerr, r); +- j = sizeof(ap->rerr.r.dest6[0]); +- dp6 = &ap->rerr.r.dest6[0]; +- n = ap->rerr.rerr_dc * j; + printf(" rerr %s [items %u] [%u]:", +- ap->rerr.rerr_flags & RERR_NODELETE ? "[D]" : "", +- ap->rerr.rerr_dc, length); +- trunc = n - (i/j); +- for (; i -= j >= 0; ++dp6) { ++ ap->rerr_flags & RERR_NODELETE ? "[D]" : "", ++ ap->rerr_dc, length); ++ dp6 = (struct rerr_unreach6 *)(void *)(ap + 1); ++ for (dc = ap->rerr_dc; dc != 0 && i >= sizeof(*dp6); ++ ++dp6, --dc, i -= sizeof(*dp6)) { + printf(" {%s}(%ld)", ip6addr_string(&dp6->u_da), + (unsigned long)EXTRACT_32BITS(&dp6->u_ds)); + } +- if (trunc) ++ if ((i % sizeof(*dp6)) != 0) + printf("[|rerr]"); + #else + printf(" rerr %u", length); +@@ -283,9 +292,9 @@ aodv_v6_rerr(const union aodv *ap _U_, u_int length) + + static void + #ifdef INET6 +-aodv_v6_draft_01_rreq(const union aodv *ap, const u_char *dat, u_int length) ++aodv_v6_draft_01_rreq(const struct aodv_rreq6_draft_01 *ap, const u_char *dat, u_int length) + #else +-aodv_v6_draft_01_rreq(const union aodv *ap _U_, const u_char *dat _U_, ++aodv_v6_draft_01_rreq(const struct aodv_rreq6_draft_01 *ap _U_, const u_char *dat _U_, + u_int length) + #endif + { +@@ -297,26 +306,27 @@ aodv_v6_draft_01_rreq(const union aodv *ap _U_, const u_char *dat _U_, + return; + } + i = min(length, (u_int)(snapend - dat)); +- if (i < sizeof(ap->rreq6_draft_01)) { ++ if (i < sizeof(*ap)) { + printf(" [|rreq6]"); + return; + } +- i -= sizeof(ap->rreq6_draft_01); ++ i -= sizeof(*ap); + printf(" rreq %u %s%s%s%s%shops %u id 0x%08lx\n" + "\tdst %s seq %lu src %s seq %lu", length, +- ap->rreq6_draft_01.rreq_type & RREQ_JOIN ? "[J]" : "", +- ap->rreq6_draft_01.rreq_type & RREQ_REPAIR ? "[R]" : "", +- ap->rreq6_draft_01.rreq_type & RREQ_GRAT ? "[G]" : "", +- ap->rreq6_draft_01.rreq_type & RREQ_DEST ? "[D]" : "", +- ap->rreq6_draft_01.rreq_type & RREQ_UNKNOWN ? "[U] " : " ", +- ap->rreq6_draft_01.rreq_hops, +- (unsigned long)EXTRACT_32BITS(&ap->rreq6_draft_01.rreq_id), +- ip6addr_string(&ap->rreq6_draft_01.rreq_da), +- (unsigned long)EXTRACT_32BITS(&ap->rreq6_draft_01.rreq_ds), +- ip6addr_string(&ap->rreq6_draft_01.rreq_oa), +- (unsigned long)EXTRACT_32BITS(&ap->rreq6_draft_01.rreq_os)); ++ ap->rreq_type & RREQ_JOIN ? "[J]" : "", ++ ap->rreq_type & RREQ_REPAIR ? "[R]" : "", ++ ap->rreq_type & RREQ_GRAT ? "[G]" : "", ++ ap->rreq_type & RREQ_DEST ? "[D]" : "", ++ ap->rreq_type & RREQ_UNKNOWN ? "[U] " : " ", ++ ap->rreq_hops, ++ (unsigned long)EXTRACT_32BITS(&ap->rreq_id), ++ ip6addr_string(&ap->rreq_da), ++ (unsigned long)EXTRACT_32BITS(&ap->rreq_ds), ++ ip6addr_string(&ap->rreq_oa), ++ (unsigned long)EXTRACT_32BITS(&ap->rreq_os)); ++ + if (i >= sizeof(struct aodv_ext)) +- aodv_extension((void *)(&ap->rreq6_draft_01 + 1), i); ++ aodv_extension((void *)(ap + 1), i); + #else + printf(" rreq %u", length); + #endif +@@ -324,9 +334,9 @@ aodv_v6_draft_01_rreq(const union aodv *ap _U_, const u_char *dat _U_, + + static void + #ifdef INET6 +-aodv_v6_draft_01_rrep(const union aodv *ap, const u_char *dat, u_int length) ++aodv_v6_draft_01_rrep(const struct aodv_rrep6_draft_01 *ap, const u_char *dat, u_int length) + #else +-aodv_v6_draft_01_rrep(const union aodv *ap _U_, const u_char *dat _U_, ++aodv_v6_draft_01_rrep(const struct aodv_rrep6_draft_01 *ap _U_, const u_char *dat _U_, + u_int length) + #endif + { +@@ -338,23 +348,24 @@ aodv_v6_draft_01_rrep(const union aodv *ap _U_, const u_char *dat _U_, + return; + } + i = min(length, (u_int)(snapend - dat)); +- if (i < sizeof(ap->rrep6_draft_01)) { ++ if (i < sizeof(*ap)) { + printf(" [|rrep6]"); + return; + } +- i -= sizeof(ap->rrep6_draft_01); ++ i -= sizeof(*ap); + printf(" rrep %u %s%sprefix %u hops %u\n" + "\tdst %s dseq %lu src %s %lu ms", length, +- ap->rrep6_draft_01.rrep_type & RREP_REPAIR ? "[R]" : "", +- ap->rrep6_draft_01.rrep_type & RREP_ACK ? "[A] " : " ", +- ap->rrep6_draft_01.rrep_ps & RREP_PREFIX_MASK, +- ap->rrep6_draft_01.rrep_hops, +- ip6addr_string(&ap->rrep6_draft_01.rrep_da), +- (unsigned long)EXTRACT_32BITS(&ap->rrep6_draft_01.rrep_ds), +- ip6addr_string(&ap->rrep6_draft_01.rrep_oa), +- (unsigned long)EXTRACT_32BITS(&ap->rrep6_draft_01.rrep_life)); ++ ap->rrep_type & RREP_REPAIR ? "[R]" : "", ++ ap->rrep_type & RREP_ACK ? "[A] " : " ", ++ ap->rrep_ps & RREP_PREFIX_MASK, ++ ap->rrep_hops, ++ ip6addr_string(&ap->rrep_da), ++ (unsigned long)EXTRACT_32BITS(&ap->rrep_ds), ++ ip6addr_string(&ap->rrep_oa), ++ (unsigned long)EXTRACT_32BITS(&ap->rrep_life)); ++ + if (i >= sizeof(struct aodv_ext)) +- aodv_extension((void *)(&ap->rrep6_draft_01 + 1), i); ++ aodv_extension((void *)(ap + 1), i); + #else + printf(" rrep %u", length); + #endif +@@ -362,28 +373,36 @@ aodv_v6_draft_01_rrep(const union aodv *ap _U_, const u_char *dat _U_, + + static void + #ifdef INET6 +-aodv_v6_draft_01_rerr(const union aodv *ap, u_int length) ++aodv_v6_draft_01_rerr(const struct aodv_rerr *ap, const u_char *dat, u_int length) + #else +-aodv_v6_draft_01_rerr(const union aodv *ap _U_, u_int length) ++aodv_v6_draft_01_rerr(const struct aodv_rerr *ap _U_, const u_char *dat, u_int length) + #endif + { + #ifdef INET6 +- const struct rerr_unreach6_draft_01 *dp6 = NULL; +- int i, j, n, trunc; ++ u_int i, dc; ++ const struct rerr_unreach6_draft_01 *dp6; ++ ++ if (snapend < dat) { ++ printf(" [|aodv]"); ++ return; ++ } ++ i = min(length, (u_int)(snapend - dat)); ++ if (i < sizeof(*ap)) { ++ printf(" [|rerr]"); ++ return; ++ } ++ i -= sizeof(*ap); + +- i = length - offsetof(struct aodv_rerr, r); +- j = sizeof(ap->rerr.r.dest6_draft_01[0]); +- dp6 = &ap->rerr.r.dest6_draft_01[0]; +- n = ap->rerr.rerr_dc * j; + printf(" rerr %s [items %u] [%u]:", +- ap->rerr.rerr_flags & RERR_NODELETE ? "[D]" : "", +- ap->rerr.rerr_dc, length); +- trunc = n - (i/j); +- for (; i -= j >= 0; ++dp6) { ++ ap->rerr_flags & RERR_NODELETE ? "[D]" : "", ++ ap->rerr_dc, length); ++ dp6 = (struct rerr_unreach6_draft_01 *)(void *)(ap + 1); ++ for (dc = ap->rerr_dc; dc != 0 && i >= sizeof(*dp6); ++ ++dp6, --dc, i -= sizeof(*dp6)) { + printf(" {%s}(%ld)", ip6addr_string(&dp6->u_da), + (unsigned long)EXTRACT_32BITS(&dp6->u_ds)); + } +- if (trunc) ++ if ((i % sizeof(*dp6)) != 0) + printf("[|rerr]"); + #else + printf(" rerr %u", length); +@@ -393,40 +412,38 @@ aodv_v6_draft_01_rerr(const union aodv *ap _U_, u_int length) + void + aodv_print(const u_char *dat, u_int length, int is_ip6) + { +- const union aodv *ap; ++ uint8_t msg_type; ++ ++ /* ++ * The message type is the first byte; make sure we have it ++ * and then fetch it. ++ */ ++ TCHECK(*dat); ++ msg_type = *dat; + +- ap = (union aodv *)dat; +- if (snapend < dat) { +- printf(" [|aodv]"); +- return; +- } +- if (min(length, (u_int)(snapend - dat)) < sizeof(ap->rrep_ack)) { +- printf(" [|aodv]"); +- return; +- } + printf(" aodv"); + +- switch (ap->rerr.rerr_type) { ++ switch (msg_type) { + + case AODV_RREQ: + if (is_ip6) +- aodv_v6_rreq(ap, dat, length); ++ aodv_v6_rreq((const struct aodv_rreq6 *) dat, dat, length); + else +- aodv_rreq(ap, dat, length); ++ aodv_rreq((const struct aodv_rreq *) dat, dat, length); + break; + + case AODV_RREP: + if (is_ip6) +- aodv_v6_rrep(ap, dat, length); ++ aodv_v6_rrep((const struct aodv_rrep6 *) dat, dat, length); + else +- aodv_rrep(ap, dat, length); ++ aodv_rrep((const struct aodv_rrep *) dat, dat, length); + break; + + case AODV_RERR: + if (is_ip6) +- aodv_v6_rerr(ap, length); ++ aodv_v6_rerr((const struct aodv_rerr *) dat, dat, length); + else +- aodv_rerr(ap, dat, length); ++ aodv_rerr((const struct aodv_rerr *) dat, dat, length); + break; + + case AODV_RREP_ACK: +@@ -434,15 +451,15 @@ aodv_print(const u_char *dat, u_int length, int is_ip6) + break; + + case AODV_V6_DRAFT_01_RREQ: +- aodv_v6_draft_01_rreq(ap, dat, length); ++ aodv_v6_draft_01_rreq((const struct aodv_rreq6_draft_01 *) dat, dat, length); + break; + + case AODV_V6_DRAFT_01_RREP: +- aodv_v6_draft_01_rrep(ap, dat, length); ++ aodv_v6_draft_01_rrep((const struct aodv_rrep6_draft_01 *) dat, dat, length); + break; + + case AODV_V6_DRAFT_01_RERR: +- aodv_v6_draft_01_rerr(ap, length); ++ aodv_v6_draft_01_rerr((const struct aodv_rerr *) dat, dat, length); + break; + + case AODV_V6_DRAFT_01_RREP_ACK: +@@ -450,6 +467,10 @@ aodv_print(const u_char *dat, u_int length, int is_ip6) + break; + + default: +- printf(" %u %u", ap->rreq.rreq_type, length); ++ printf(" %u %u", msg_type, length); + } ++ return; ++ ++trunc: ++ printf(" [|aodv]"); + } +-- +1.8.3.1 + diff --git a/source/network-extra/tcpdump/FrugalBuild b/source/network-extra/tcpdump/FrugalBuild index 1257aee..38db564 100644 --- a/source/network-extra/tcpdump/FrugalBuild +++ b/source/network-extra/tcpdump/FrugalBuild @@ -6,7 +6,7 @@ options+=('asneeded') pkgname=tcpdump pkgver=4.5.1 -pkgrel=1 +pkgrel=2 pkgdesc="Tcpdump is for dumping traffic on a network" url="http://www.tcpdump.org"; depends=('openssl' 'libpcap>=1.2.0') @@ -16,4 +16,12 @@ source=($url/release/$pkgname-$pkgver.tar.gz) up2date="lynx -dump $url/release/|grep 'tcpdump-\(.*\).tar.gz'|Flasttar" Fconfopts+=" --enable-ipv6" sha1sums=('46d5ec107c6a1b262ad8da799f74c5d01cce8815') + +# FSA fix *** +source=(${source[@]} CVE-2014-8767.patch CVE-2014-8768.patch CVE-2014-8769.patch) +sha1sums=(${sha1sums[@]} '30dd3775306db5c2c6aca958997e37ec002cfe32' \ + 'cc27d8dc1967013ed33cd49e6a83da2cc0f9b6d1' \ + 'c0ce0f81c300fd3f94f014d9eb9b52528d374e67') +# *********** + # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
