Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=59b0af836554bd61dff03cc407f58eff0e8d0cc5
commit 59b0af836554bd61dff03cc407f58eff0e8d0cc5 Author: Baste <[email protected]> Date: Wed Oct 7 09:01:54 2015 +0200 tcpdump-4.7.4-1-x86_64 - 4.5.1 -> 4.7.4 diff --git a/source/network-extra/tcpdump/CVE-2014-8767.patch b/source/network-extra/tcpdump/CVE-2014-8767.patch deleted file mode 100644 index e0eab74..0000000 --- a/source/network-extra/tcpdump/CVE-2014-8767.patch +++ /dev/null @@ -1,178 +0,0 @@ -From d8b4852e45a94fcde141ae28a2d5e36368ca92ae Mon Sep 17 00:00:00 2001 -From: Michal Sekletar <[email protected]> -Date: Thu, 20 Nov 2014 11:38:46 +0100 -Subject: [PATCH] Do more bounds checking and length checking. - -Don't run past the end of the captured data, and don't run past the end -of the packet (i.e., don't make the length variable go negative). - -Also, stop dissecting if the message length isn't valid. - -(cherry picked from commit 4038f83ebf654804829b258dde5e0a508c1c2003) ---- - print-olsr.c | 56 +++++++++++++++++++++++++++++++++++++++++++------------- - 1 file changed, 43 insertions(+), 13 deletions(-) - -diff --git a/print-olsr.c b/print-olsr.c -index d8619d4..f586d80 100644 ---- a/print-olsr.c -+++ b/print-olsr.c -@@ -181,7 +181,7 @@ struct olsr_lq_neighbor6 { - /* - * print a neighbor list with LQ extensions. - */ --static void -+static int - olsr_print_lq_neighbor4 (const u_char *msg_data, u_int hello_len) - { - struct olsr_lq_neighbor4 *lq_neighbor; -@@ -189,6 +189,8 @@ olsr_print_lq_neighbor4 (const u_char *msg_data, u_int hello_len) - while (hello_len >= sizeof(struct olsr_lq_neighbor4)) { - - lq_neighbor = (struct olsr_lq_neighbor4 *)msg_data; -+ if (!TTEST(*lq_neighbor)) -+ return (-1); - - printf("\n\t neighbor %s, link-quality %.2lf%%" - ", neighbor-link-quality %.2lf%%", -@@ -199,10 +201,11 @@ olsr_print_lq_neighbor4 (const u_char *msg_data, u_int hello_len) - msg_data += sizeof(struct olsr_lq_neighbor4); - hello_len -= sizeof(struct olsr_lq_neighbor4); - } -+ return (0); - } - - #if INET6 --static void -+static int - olsr_print_lq_neighbor6 (const u_char *msg_data, u_int hello_len) - { - struct olsr_lq_neighbor6 *lq_neighbor; -@@ -210,6 +213,8 @@ olsr_print_lq_neighbor6 (const u_char *msg_data, u_int hello_len) - while (hello_len >= sizeof(struct olsr_lq_neighbor6)) { - - lq_neighbor = (struct olsr_lq_neighbor6 *)msg_data; -+ if (!TTEST(*lq_neighbor)) -+ return (-1); - - printf("\n\t neighbor %s, link-quality %.2lf%%" - ", neighbor-link-quality %.2lf%%", -@@ -220,13 +225,14 @@ olsr_print_lq_neighbor6 (const u_char *msg_data, u_int hello_len) - msg_data += sizeof(struct olsr_lq_neighbor6); - hello_len -= sizeof(struct olsr_lq_neighbor6); - } -+ return (0); - } - #endif /* INET6 */ - - /* - * print a neighbor list. - */ --static void -+static int - olsr_print_neighbor (const u_char *msg_data, u_int hello_len) - { - int neighbor; -@@ -236,6 +242,9 @@ olsr_print_neighbor (const u_char *msg_data, u_int hello_len) - - while (hello_len >= sizeof(struct in_addr)) { - -+ if (!TTEST2(*msg_data, sizeof(struct in_addr))) -+ return (-1); -+ - /* print 4 neighbors per line */ - - printf("%s%s", ipaddr_string(msg_data), -@@ -329,6 +338,9 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) - ME_TO_DOUBLE(msgptr.v6->vtime), - EXTRACT_16BITS(msgptr.v6->msg_seq), - msg_len, (msg_len_valid == 0) ? " (invalid)" : ""); -+ if (!msg_len_valid) { -+ return; -+ } - - msg_tlen = msg_len - sizeof(struct olsr_msg6); - msg_data = tptr + sizeof(struct olsr_msg6); -@@ -357,6 +369,9 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) - ME_TO_DOUBLE(msgptr.v4->vtime), - EXTRACT_16BITS(msgptr.v4->msg_seq), - msg_len, (msg_len_valid == 0) ? " (invalid)" : ""); -+ if (!msg_len_valid) { -+ return; -+ } - - msg_tlen = msg_len - sizeof(struct olsr_msg4); - msg_data = tptr + sizeof(struct olsr_msg4); -@@ -365,6 +380,8 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) - switch (msg_type) { - case OLSR_HELLO_MSG: - case OLSR_HELLO_LQ_MSG: -+ if (msg_tlen < sizeof(struct olsr_hello)) -+ goto trunc; - if (!TTEST2(*msg_data, sizeof(struct olsr_hello))) - goto trunc; - -@@ -406,15 +423,21 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) - msg_tlen -= sizeof(struct olsr_hello_link); - hello_len -= sizeof(struct olsr_hello_link); - -+ TCHECK2(*msg_data, hello_len); - if (msg_type == OLSR_HELLO_MSG) { -- olsr_print_neighbor(msg_data, hello_len); -+ if (olsr_print_neighbor(msg_data, hello_len) == -1) -+ goto trunc; - } else { - #if INET6 -- if (is_ipv6) -- olsr_print_lq_neighbor6(msg_data, hello_len); -- else -+ if (is_ipv6) { -+ if (olsr_print_lq_neighbor6(msg_data, hello_len) == -1) -+ goto trunc; -+ } else - #endif -- olsr_print_lq_neighbor4(msg_data, hello_len); -+ { -+ if (olsr_print_lq_neighbor4(msg_data, hello_len) == -1) -+ goto trunc; -+ } - } - - msg_data += hello_len; -@@ -424,6 +447,8 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) - - case OLSR_TC_MSG: - case OLSR_TC_LQ_MSG: -+ if (msg_tlen < sizeof(struct olsr_tc)) -+ goto trunc; - if (!TTEST2(*msg_data, sizeof(struct olsr_tc))) - goto trunc; - -@@ -434,14 +459,19 @@ olsr_print (const u_char *pptr, u_int length, int is_ipv6) - msg_tlen -= sizeof(struct olsr_tc); - - if (msg_type == OLSR_TC_MSG) { -- olsr_print_neighbor(msg_data, msg_tlen); -+ if (olsr_print_neighbor(msg_data, msg_tlen) == -1) -+ goto trunc; - } else { - #if INET6 -- if (is_ipv6) -- olsr_print_lq_neighbor6(msg_data, msg_tlen); -- else -+ if (is_ipv6) { -+ if (olsr_print_lq_neighbor6(msg_data, msg_tlen) == -1) -+ goto trunc; -+ } else - #endif -- olsr_print_lq_neighbor4(msg_data, msg_tlen); -+ { -+ if (olsr_print_lq_neighbor4(msg_data, msg_tlen) == -1) -+ goto trunc; -+ } - } - break; - --- -1.8.3.1 - diff --git a/source/network-extra/tcpdump/CVE-2014-8768.patch b/source/network-extra/tcpdump/CVE-2014-8768.patch deleted file mode 100644 index 02ddd99..0000000 --- a/source/network-extra/tcpdump/CVE-2014-8768.patch +++ /dev/null @@ -1,335 +0,0 @@ -diff -up tcpdump-4.5.1/print-geonet.c.cve-2014-8768 tcpdump-4.5.1/print-geonet.c ---- tcpdump-4.5.1/print-geonet.c.cve-2014-8768 2014-11-20 15:38:53.183794306 +0100 -+++ tcpdump-4.5.1/print-geonet.c 2014-11-20 15:59:06.832860093 +0100 -@@ -56,16 +56,12 @@ static const struct tok msg_type_values[ - }; - - static void --print_btp_body(const u_char *bp, u_int length) -+print_btp_body(const u_char *bp) - { - int version; - int msg_type; - const char *msg_type_str; - -- if (length <= 2) { -- return; -- } -- - /* Assuming ItsDpuHeader */ - version = bp[0]; - msg_type = bp[1]; -@@ -82,7 +78,7 @@ print_btp(const u_char *bp) - printf("; BTP Dst:%u Src:%u", dest, src); - } - --static void -+static int - print_long_pos_vector(const u_char *bp) - { - int i; -@@ -95,10 +91,14 @@ print_long_pos_vector(const u_char *bp) - } - printf(" "); - -+ if (!TTEST2(*(bp+12), 8)) -+ return (-1); -+ - lat = EXTRACT_32BITS(bp+12); - printf("lat:%d ", lat); - lon = EXTRACT_32BITS(bp+16); - printf("lon:%d", lon); -+ return (0); - } - - -@@ -109,140 +109,159 @@ print_long_pos_vector(const u_char *bp) - void - geonet_print(netdissect_options *ndo, const u_char *eth, const u_char *bp, u_int length) - { -- printf("GeoNet src:%s; ", etheraddr_string(eth+6)); -+ int version; -+ int next_hdr; -+ int hdr_type; -+ int hdr_subtype; -+ uint16_t payload_length; -+ int hop_limit; -+ const char *next_hdr_txt = "Unknown"; -+ const char *hdr_type_txt = "Unknown"; -+ int hdr_size = -1; - -- if (length >= 36) { -- /* Process Common Header */ -- int version = bp[0] >> 4; -- int next_hdr = bp[0] & 0x0f; -- int hdr_type = bp[1] >> 4; -- int hdr_subtype = bp[1] & 0x0f; -- u_int16_t payload_length = EXTRACT_16BITS(bp+4); -- int hop_limit = bp[7]; -- const char *next_hdr_txt = "Unknown"; -- const char *hdr_type_txt = "Unknown"; -- int hdr_size = -1; -- -- switch (next_hdr) { -- case 0: next_hdr_txt = "Any"; break; -- case 1: next_hdr_txt = "BTP-A"; break; -- case 2: next_hdr_txt = "BTP-B"; break; -- case 3: next_hdr_txt = "IPv6"; break; -- } -- -- switch (hdr_type) { -- case 0: hdr_type_txt = "Any"; break; -- case 1: hdr_type_txt = "Beacon"; break; -- case 2: hdr_type_txt = "GeoUnicast"; break; -- case 3: switch (hdr_subtype) { -- case 0: hdr_type_txt = "GeoAnycastCircle"; break; -- case 1: hdr_type_txt = "GeoAnycastRect"; break; -- case 2: hdr_type_txt = "GeoAnycastElipse"; break; -- } -- break; -- case 4: switch (hdr_subtype) { -- case 0: hdr_type_txt = "GeoBroadcastCircle"; break; -- case 1: hdr_type_txt = "GeoBroadcastRect"; break; -- case 2: hdr_type_txt = "GeoBroadcastElipse"; break; -- } -- break; -- case 5: switch (hdr_subtype) { -- case 0: hdr_type_txt = "TopoScopeBcast-SH"; break; -- case 1: hdr_type_txt = "TopoScopeBcast-MH"; break; -- } -- break; -- case 6: switch (hdr_subtype) { -- case 0: hdr_type_txt = "LocService-Request"; break; -- case 1: hdr_type_txt = "LocService-Reply"; break; -- } -- break; -- } -- -- printf("v:%d ", version); -- printf("NH:%d-%s ", next_hdr, next_hdr_txt); -- printf("HT:%d-%d-%s ", hdr_type, hdr_subtype, hdr_type_txt); -- printf("HopLim:%d ", hop_limit); -- printf("Payload:%d ", payload_length); -- print_long_pos_vector(bp + 8); -- -- /* Skip Common Header */ -- length -= 36; -- bp += 36; -- -- /* Process Extended Headers */ -- switch (hdr_type) { -- case 0: /* Any */ -- hdr_size = 0; -- break; -- case 1: /* Beacon */ -- hdr_size = 0; -- break; -- case 2: /* GeoUnicast */ -- break; -- case 3: switch (hdr_subtype) { -- case 0: /* GeoAnycastCircle */ -- break; -- case 1: /* GeoAnycastRect */ -- break; -- case 2: /* GeoAnycastElipse */ -- break; -- } -- break; -- case 4: switch (hdr_subtype) { -- case 0: /* GeoBroadcastCircle */ -- break; -- case 1: /* GeoBroadcastRect */ -- break; -- case 2: /* GeoBroadcastElipse */ -- break; -- } -- break; -- case 5: switch (hdr_subtype) { -- case 0: /* TopoScopeBcast-SH */ -- hdr_size = 0; -- break; -- case 1: /* TopoScopeBcast-MH */ -- hdr_size = 68 - 36; -- break; -- } -- break; -- case 6: switch (hdr_subtype) { -- case 0: /* LocService-Request */ -- break; -- case 1: /* LocService-Reply */ -- break; -- } -- break; -- } -- -- /* Skip Extended headers */ -- if (hdr_size >= 0) { -- length -= hdr_size; -- bp += hdr_size; -- switch (next_hdr) { -- case 0: /* Any */ -- break; -- case 1: -- case 2: /* BTP A/B */ -- print_btp(bp); -- length -= 4; -- bp += 4; -- print_btp_body(bp, length); -- break; -- case 3: /* IPv6 */ -- break; -- } -- } -- } else { -- printf("Malformed (small) "); -- } -+ printf("GeoNet src:%s; ", etheraddr_string(eth+6)); - -- /* Print user data part */ -- if (ndo->ndo_vflag) -- default_print(bp, length); --} -+ /* Process Common Header */ -+ if (length < 36) -+ goto malformed; -+ -+ ND_TCHECK2(*bp, 7); -+ version = bp[0] >> 4; -+ next_hdr = bp[0] & 0x0f; -+ hdr_type = bp[1] >> 4; -+ hdr_subtype = bp[1] & 0x0f; -+ payload_length = EXTRACT_16BITS(bp+4); -+ hop_limit = bp[7]; -+ -+ switch (next_hdr) { -+ case 0: next_hdr_txt = "Any"; break; -+ case 1: next_hdr_txt = "BTP-A"; break; -+ case 2: next_hdr_txt = "BTP-B"; break; -+ case 3: next_hdr_txt = "IPv6"; break; -+ } -+ -+ switch (hdr_type) { -+ case 0: hdr_type_txt = "Any"; break; -+ case 1: hdr_type_txt = "Beacon"; break; -+ case 2: hdr_type_txt = "GeoUnicast"; break; -+ case 3: switch (hdr_subtype) { -+ case 0: hdr_type_txt = "GeoAnycastCircle"; break; -+ case 1: hdr_type_txt = "GeoAnycastRect"; break; -+ case 2: hdr_type_txt = "GeoAnycastElipse"; break; -+ } -+ break; -+ case 4: switch (hdr_subtype) { -+ case 0: hdr_type_txt = "GeoBroadcastCircle"; break; -+ case 1: hdr_type_txt = "GeoBroadcastRect"; break; -+ case 2: hdr_type_txt = "GeoBroadcastElipse"; break; -+ } -+ break; -+ case 5: switch (hdr_subtype) { -+ case 0: hdr_type_txt = "TopoScopeBcast-SH"; break; -+ case 1: hdr_type_txt = "TopoScopeBcast-MH"; break; -+ } -+ break; -+ case 6: switch (hdr_subtype) { -+ case 0: hdr_type_txt = "LocService-Request"; break; -+ case 1: hdr_type_txt = "LocService-Reply"; break; -+ } -+ break; -+ } -+ -+ printf("v:%d ", version); -+ printf("NH:%d-%s ", next_hdr, next_hdr_txt); -+ printf("HT:%d-%d-%s ", hdr_type, hdr_subtype, hdr_type_txt); -+ printf("HopLim:%d ", hop_limit); -+ printf("Payload:%d ", payload_length); -+ print_long_pos_vector(bp + 8); -+ -+ /* Skip Common Header */ -+ length -= 36; -+ bp += 36; -+ -+ /* Process Extended Headers */ -+ switch (hdr_type) { -+ case 0: /* Any */ -+ hdr_size = 0; -+ break; -+ case 1: /* Beacon */ -+ hdr_size = 0; -+ break; -+ case 2: /* GeoUnicast */ -+ break; -+ case 3: switch (hdr_subtype) { -+ case 0: /* GeoAnycastCircle */ -+ break; -+ case 1: /* GeoAnycastRect */ -+ break; -+ case 2: /* GeoAnycastElipse */ -+ break; -+ } -+ break; -+ case 4: switch (hdr_subtype) { -+ case 0: /* GeoBroadcastCircle */ -+ break; -+ case 1: /* GeoBroadcastRect */ -+ break; -+ case 2: /* GeoBroadcastElipse */ -+ break; -+ } -+ break; -+ case 5: switch (hdr_subtype) { -+ case 0: /* TopoScopeBcast-SH */ -+ hdr_size = 0; -+ break; -+ case 1: /* TopoScopeBcast-MH */ -+ hdr_size = 68 - 36; -+ break; -+ } -+ break; -+ case 6: switch (hdr_subtype) { -+ case 0: /* LocService-Request */ -+ break; -+ case 1: /* LocService-Reply */ -+ break; -+ } -+ break; -+ } -+ -+ /* Skip Extended headers */ -+ if (hdr_size >= 0) { -+ if (length < (u_int)hdr_size) -+ goto malformed; -+ ND_TCHECK2(*bp, hdr_size); -+ -+ length -= hdr_size; -+ bp += hdr_size; -+ switch (next_hdr) { -+ case 0: /* Any */ -+ break; -+ case 1: -+ case 2: /* BTP A/B */ -+ print_btp(bp); -+ length -= 4; -+ bp += 4; -+ print_btp_body(bp); -+ break; -+ case 3: /* IPv6 */ -+ break; -+ } -+ } -+ -+ /* Print user data part */ -+ if (ndo->ndo_vflag) -+ default_print(bp, length); -+ return; -+ -+malformed: -+ ND_PRINT((ndo, " Malformed (small) ")); -+ /* XXX - print the remaining data as hex? */ -+ return; - -+trunc: -+ ND_PRINT((ndo, "[|geonet]")); - -+} - /* - * Local Variables: - * c-style: whitesmith diff --git a/source/network-extra/tcpdump/CVE-2014-8769.patch b/source/network-extra/tcpdump/CVE-2014-8769.patch deleted file mode 100644 index 30d694a..0000000 --- a/source/network-extra/tcpdump/CVE-2014-8769.patch +++ /dev/null @@ -1,581 +0,0 @@ -From 357525b6942eef3ef9696f1fe92ba7fe2ed68ac2 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar <[email protected]> -Date: Fri, 21 Nov 2014 12:19:32 +0100 -Subject: [PATCH] Fix for CVE-2014-8769 - -(cherry picked from ab4e52b94aac6cb729a5a695aa612d5ebda2ec3a - 3e8a443c3671baa37ae7870f08fb9b4bf386fd24) ---- - aodv.h | 20 ---- - print-aodv.c | 315 +++++++++++++++++++++++++++++++---------------------------- - 2 files changed, 168 insertions(+), 167 deletions(-) - -diff --git a/aodv.h b/aodv.h -index 456ec8b..18467d5 100644 ---- a/aodv.h -+++ b/aodv.h -@@ -134,13 +134,6 @@ struct aodv_rerr { - u_int8_t rerr_flags; /* various flags */ - u_int8_t rerr_zero0; /* reserved, set to zero */ - u_int8_t rerr_dc; /* destination count */ -- union { -- struct rerr_unreach dest[1]; --#ifdef INET6 -- struct rerr_unreach6 dest6[1]; -- struct rerr_unreach6_draft_01 dest6_draft_01[1]; --#endif -- } r; - }; - - #define RERR_NODELETE 0x80 /* don't delete the link */ -@@ -151,19 +144,6 @@ struct aodv_rrep_ack { - u_int8_t ra_zero0; - }; - --union aodv { -- struct aodv_rreq rreq; -- struct aodv_rrep rrep; -- struct aodv_rerr rerr; -- struct aodv_rrep_ack rrep_ack; --#ifdef INET6 -- struct aodv_rreq6 rreq6; -- struct aodv_rreq6_draft_01 rreq6_draft_01; -- struct aodv_rrep6 rrep6; -- struct aodv_rrep6_draft_01 rrep6_draft_01; --#endif --}; -- - #define AODV_RREQ 1 /* route request */ - #define AODV_RREP 2 /* route response */ - #define AODV_RERR 3 /* error report */ -diff --git a/print-aodv.c b/print-aodv.c -index c5f6622..b4f7989 100644 ---- a/print-aodv.c -+++ b/print-aodv.c -@@ -82,7 +82,7 @@ aodv_extension(const struct aodv_ext *ep, u_int length) - } - - static void --aodv_rreq(const union aodv *ap, const u_char *dat, u_int length) -+aodv_rreq(const struct aodv_rreq *ap, const u_char *dat, u_int length) - { - u_int i; - -@@ -91,30 +91,31 @@ aodv_rreq(const union aodv *ap, const u_char *dat, u_int length) - return; - } - i = min(length, (u_int)(snapend - dat)); -- if (i < sizeof(ap->rreq)) { -+ if (i < sizeof(*ap)) { - printf(" [|rreq]"); - return; - } -- i -= sizeof(ap->rreq); -+ i -= sizeof(*ap); - printf(" rreq %u %s%s%s%s%shops %u id 0x%08lx\n" - "\tdst %s seq %lu src %s seq %lu", length, -- ap->rreq.rreq_type & RREQ_JOIN ? "[J]" : "", -- ap->rreq.rreq_type & RREQ_REPAIR ? "[R]" : "", -- ap->rreq.rreq_type & RREQ_GRAT ? "[G]" : "", -- ap->rreq.rreq_type & RREQ_DEST ? "[D]" : "", -- ap->rreq.rreq_type & RREQ_UNKNOWN ? "[U] " : " ", -- ap->rreq.rreq_hops, -- (unsigned long)EXTRACT_32BITS(&ap->rreq.rreq_id), -- ipaddr_string(&ap->rreq.rreq_da), -- (unsigned long)EXTRACT_32BITS(&ap->rreq.rreq_ds), -- ipaddr_string(&ap->rreq.rreq_oa), -- (unsigned long)EXTRACT_32BITS(&ap->rreq.rreq_os)); -+ ap->rreq_type & RREQ_JOIN ? "[J]" : "", -+ ap->rreq_type & RREQ_REPAIR ? "[R]" : "", -+ ap->rreq_type & RREQ_GRAT ? "[G]" : "", -+ ap->rreq_type & RREQ_DEST ? "[D]" : "", -+ ap->rreq_type & RREQ_UNKNOWN ? "[U] " : " ", -+ ap->rreq_hops, -+ (unsigned long)EXTRACT_32BITS(&ap->rreq_id), -+ ipaddr_string(&ap->rreq_da), -+ (unsigned long)EXTRACT_32BITS(&ap->rreq_ds), -+ ipaddr_string(&ap->rreq_oa), -+ (unsigned long)EXTRACT_32BITS(&ap->rreq_os)); -+ - if (i >= sizeof(struct aodv_ext)) -- aodv_extension((void *)(&ap->rreq + 1), i); -+ aodv_extension((void *)(ap + 1), i); - } - - static void --aodv_rrep(const union aodv *ap, const u_char *dat, u_int length) -+aodv_rrep(const struct aodv_rrep *ap, const u_char *dat, u_int length) - { - u_int i; - -@@ -123,62 +124,60 @@ aodv_rrep(const union aodv *ap, const u_char *dat, u_int length) - return; - } - i = min(length, (u_int)(snapend - dat)); -- if (i < sizeof(ap->rrep)) { -+ if (i < sizeof(*ap)) { - printf(" [|rrep]"); - return; - } -- i -= sizeof(ap->rrep); -+ i -= sizeof(*ap); - printf(" rrep %u %s%sprefix %u hops %u\n" - "\tdst %s dseq %lu src %s %lu ms", length, -- ap->rrep.rrep_type & RREP_REPAIR ? "[R]" : "", -- ap->rrep.rrep_type & RREP_ACK ? "[A] " : " ", -- ap->rrep.rrep_ps & RREP_PREFIX_MASK, -- ap->rrep.rrep_hops, -- ipaddr_string(&ap->rrep.rrep_da), -- (unsigned long)EXTRACT_32BITS(&ap->rrep.rrep_ds), -- ipaddr_string(&ap->rrep.rrep_oa), -- (unsigned long)EXTRACT_32BITS(&ap->rrep.rrep_life)); -- if (i >= sizeof(struct aodv_ext)) -- aodv_extension((void *)(&ap->rrep + 1), i); -+ ap->rrep_type & RREP_REPAIR ? "[R]" : "", -+ ap->rrep_type & RREP_ACK ? "[A] " : " ", -+ ap->rrep_ps & RREP_PREFIX_MASK, -+ ap->rrep_hops, -+ ipaddr_string(&ap->rrep_da), -+ (unsigned long)EXTRACT_32BITS(&ap->rrep_ds), -+ ipaddr_string(&ap->rrep_oa), -+ (unsigned long)EXTRACT_32BITS(&ap->rrep_life)); -+ -+ if (i >= sizeof(struct aodv_ext)) -+ aodv_extension((void *)(ap + 1), i); - } - - static void --aodv_rerr(const union aodv *ap, const u_char *dat, u_int length) -+aodv_rerr(const struct aodv_rerr *ap, const u_char *dat, u_int length) - { -- u_int i; -- const struct rerr_unreach *dp = NULL; -- int n, trunc; -+ u_int i, dc; -+ const struct rerr_unreach *dp; - - if (snapend < dat) { - printf(" [|aodv]"); - return; - } - i = min(length, (u_int)(snapend - dat)); -- if (i < offsetof(struct aodv_rerr, r)) { -+ if (i < sizeof(*ap)) { - printf(" [|rerr]"); - return; - } -- i -= offsetof(struct aodv_rerr, r); -- dp = &ap->rerr.r.dest[0]; -- n = ap->rerr.rerr_dc * sizeof(ap->rerr.r.dest[0]); -+ i -= sizeof(*ap); - printf(" rerr %s [items %u] [%u]:", -- ap->rerr.rerr_flags & RERR_NODELETE ? "[D]" : "", -- ap->rerr.rerr_dc, length); -- trunc = n - (i/sizeof(ap->rerr.r.dest[0])); -- for (; i >= sizeof(ap->rerr.r.dest[0]); -- ++dp, i -= sizeof(ap->rerr.r.dest[0])) { -+ ap->rerr_flags & RERR_NODELETE ? "[D]" : "", -+ ap->rerr_dc, length); -+ dp = (struct rerr_unreach *)(void *)(ap + 1); -+ for (dc = ap->rerr_dc; dc != 0 && i >= sizeof(*dp); -+ ++dp, --dc, i -= sizeof(*dp)) { - printf(" {%s}(%ld)", ipaddr_string(&dp->u_da), - (unsigned long)EXTRACT_32BITS(&dp->u_ds)); - } -- if (trunc) -+ if ((i % sizeof(*dp)) != 0) - printf("[|rerr]"); - } - - static void - #ifdef INET6 --aodv_v6_rreq(const union aodv *ap, const u_char *dat, u_int length) -+aodv_v6_rreq(const struct aodv_rreq6 *ap, const u_char *dat, u_int length) - #else --aodv_v6_rreq(const union aodv *ap _U_, const u_char *dat _U_, u_int length) -+aodv_v6_rreq(const struct aodv_rreq6 *ap _U_, const u_char *dat _U_, u_int length) - #endif - { - #ifdef INET6 -@@ -189,26 +188,27 @@ aodv_v6_rreq(const union aodv *ap _U_, const u_char *dat _U_, u_int length) - return; - } - i = min(length, (u_int)(snapend - dat)); -- if (i < sizeof(ap->rreq6)) { -+ if (i < sizeof(*ap)) { - printf(" [|rreq6]"); - return; - } -- i -= sizeof(ap->rreq6); -+ i -= sizeof(*ap); - printf(" v6 rreq %u %s%s%s%s%shops %u id 0x%08lx\n" - "\tdst %s seq %lu src %s seq %lu", length, -- ap->rreq6.rreq_type & RREQ_JOIN ? "[J]" : "", -- ap->rreq6.rreq_type & RREQ_REPAIR ? "[R]" : "", -- ap->rreq6.rreq_type & RREQ_GRAT ? "[G]" : "", -- ap->rreq6.rreq_type & RREQ_DEST ? "[D]" : "", -- ap->rreq6.rreq_type & RREQ_UNKNOWN ? "[U] " : " ", -- ap->rreq6.rreq_hops, -- (unsigned long)EXTRACT_32BITS(&ap->rreq6.rreq_id), -- ip6addr_string(&ap->rreq6.rreq_da), -- (unsigned long)EXTRACT_32BITS(&ap->rreq6.rreq_ds), -- ip6addr_string(&ap->rreq6.rreq_oa), -- (unsigned long)EXTRACT_32BITS(&ap->rreq6.rreq_os)); -+ ap->rreq_type & RREQ_JOIN ? "[J]" : "", -+ ap->rreq_type & RREQ_REPAIR ? "[R]" : "", -+ ap->rreq_type & RREQ_GRAT ? "[G]" : "", -+ ap->rreq_type & RREQ_DEST ? "[D]" : "", -+ ap->rreq_type & RREQ_UNKNOWN ? "[U] " : " ", -+ ap->rreq_hops, -+ (unsigned long)EXTRACT_32BITS(&ap->rreq_id), -+ ip6addr_string(&ap->rreq_da), -+ (unsigned long)EXTRACT_32BITS(&ap->rreq_ds), -+ ip6addr_string(&ap->rreq_oa), -+ (unsigned long)EXTRACT_32BITS(&ap->rreq_os)); -+ - if (i >= sizeof(struct aodv_ext)) -- aodv_extension((void *)(&ap->rreq6 + 1), i); -+ aodv_extension((void *)(ap + 1), i); - #else - printf(" v6 rreq %u", length); - #endif -@@ -216,9 +216,9 @@ aodv_v6_rreq(const union aodv *ap _U_, const u_char *dat _U_, u_int length) - - static void - #ifdef INET6 --aodv_v6_rrep(const union aodv *ap, const u_char *dat, u_int length) -+aodv_v6_rrep(const struct aodv_rrep6 *ap, const u_char *dat, u_int length) - #else --aodv_v6_rrep(const union aodv *ap _U_, const u_char *dat _U_, u_int length) -+aodv_v6_rrep(const struct aodv_rrep6 *ap _U_, const u_char *dat _U_, u_int length) - #endif - { - #ifdef INET6 -@@ -229,23 +229,24 @@ aodv_v6_rrep(const union aodv *ap _U_, const u_char *dat _U_, u_int length) - return; - } - i = min(length, (u_int)(snapend - dat)); -- if (i < sizeof(ap->rrep6)) { -+ if (i < sizeof(*ap)) { - printf(" [|rrep6]"); - return; - } -- i -= sizeof(ap->rrep6); -+ i -= sizeof(*ap); - printf(" rrep %u %s%sprefix %u hops %u\n" - "\tdst %s dseq %lu src %s %lu ms", length, -- ap->rrep6.rrep_type & RREP_REPAIR ? "[R]" : "", -- ap->rrep6.rrep_type & RREP_ACK ? "[A] " : " ", -- ap->rrep6.rrep_ps & RREP_PREFIX_MASK, -- ap->rrep6.rrep_hops, -- ip6addr_string(&ap->rrep6.rrep_da), -- (unsigned long)EXTRACT_32BITS(&ap->rrep6.rrep_ds), -- ip6addr_string(&ap->rrep6.rrep_oa), -- (unsigned long)EXTRACT_32BITS(&ap->rrep6.rrep_life)); -+ ap->rrep_type & RREP_REPAIR ? "[R]" : "", -+ ap->rrep_type & RREP_ACK ? "[A] " : " ", -+ ap->rrep_ps & RREP_PREFIX_MASK, -+ ap->rrep_hops, -+ ip6addr_string(&ap->rrep_da), -+ (unsigned long)EXTRACT_32BITS(&ap->rrep_ds), -+ ip6addr_string(&ap->rrep_oa), -+ (unsigned long)EXTRACT_32BITS(&ap->rrep_life)); -+ - if (i >= sizeof(struct aodv_ext)) -- aodv_extension((void *)(&ap->rrep6 + 1), i); -+ aodv_extension((void *)(ap + 1), i); - #else - printf(" rrep %u", length); - #endif -@@ -253,28 +254,36 @@ aodv_v6_rrep(const union aodv *ap _U_, const u_char *dat _U_, u_int length) - - static void - #ifdef INET6 --aodv_v6_rerr(const union aodv *ap, u_int length) -+aodv_v6_rerr(const struct aodv_rerr *ap, const u_char *dat, u_int length) - #else --aodv_v6_rerr(const union aodv *ap _U_, u_int length) -+aodv_v6_rerr(const struct aodv_rerr *ap _U_, const u_char *dat, u_int length) - #endif - { - #ifdef INET6 -- const struct rerr_unreach6 *dp6 = NULL; -- int i, j, n, trunc; -+ u_int i, dc; -+ const struct rerr_unreach6 *dp6; -+ -+ if (snapend < dat) { -+ printf(" [|aodv]"); -+ return; -+ } -+ i = min(length, (u_int)(snapend - dat)); -+ if (i < sizeof(*ap)) { -+ printf(" [|rerr]"); -+ return; -+ } -+ i -= sizeof(*ap); - -- i = length - offsetof(struct aodv_rerr, r); -- j = sizeof(ap->rerr.r.dest6[0]); -- dp6 = &ap->rerr.r.dest6[0]; -- n = ap->rerr.rerr_dc * j; - printf(" rerr %s [items %u] [%u]:", -- ap->rerr.rerr_flags & RERR_NODELETE ? "[D]" : "", -- ap->rerr.rerr_dc, length); -- trunc = n - (i/j); -- for (; i -= j >= 0; ++dp6) { -+ ap->rerr_flags & RERR_NODELETE ? "[D]" : "", -+ ap->rerr_dc, length); -+ dp6 = (struct rerr_unreach6 *)(void *)(ap + 1); -+ for (dc = ap->rerr_dc; dc != 0 && i >= sizeof(*dp6); -+ ++dp6, --dc, i -= sizeof(*dp6)) { - printf(" {%s}(%ld)", ip6addr_string(&dp6->u_da), - (unsigned long)EXTRACT_32BITS(&dp6->u_ds)); - } -- if (trunc) -+ if ((i % sizeof(*dp6)) != 0) - printf("[|rerr]"); - #else - printf(" rerr %u", length); -@@ -283,9 +292,9 @@ aodv_v6_rerr(const union aodv *ap _U_, u_int length) - - static void - #ifdef INET6 --aodv_v6_draft_01_rreq(const union aodv *ap, const u_char *dat, u_int length) -+aodv_v6_draft_01_rreq(const struct aodv_rreq6_draft_01 *ap, const u_char *dat, u_int length) - #else --aodv_v6_draft_01_rreq(const union aodv *ap _U_, const u_char *dat _U_, -+aodv_v6_draft_01_rreq(const struct aodv_rreq6_draft_01 *ap _U_, const u_char *dat _U_, - u_int length) - #endif - { -@@ -297,26 +306,27 @@ aodv_v6_draft_01_rreq(const union aodv *ap _U_, const u_char *dat _U_, - return; - } - i = min(length, (u_int)(snapend - dat)); -- if (i < sizeof(ap->rreq6_draft_01)) { -+ if (i < sizeof(*ap)) { - printf(" [|rreq6]"); - return; - } -- i -= sizeof(ap->rreq6_draft_01); -+ i -= sizeof(*ap); - printf(" rreq %u %s%s%s%s%shops %u id 0x%08lx\n" - "\tdst %s seq %lu src %s seq %lu", length, -- ap->rreq6_draft_01.rreq_type & RREQ_JOIN ? "[J]" : "", -- ap->rreq6_draft_01.rreq_type & RREQ_REPAIR ? "[R]" : "", -- ap->rreq6_draft_01.rreq_type & RREQ_GRAT ? "[G]" : "", -- ap->rreq6_draft_01.rreq_type & RREQ_DEST ? "[D]" : "", -- ap->rreq6_draft_01.rreq_type & RREQ_UNKNOWN ? "[U] " : " ", -- ap->rreq6_draft_01.rreq_hops, -- (unsigned long)EXTRACT_32BITS(&ap->rreq6_draft_01.rreq_id), -- ip6addr_string(&ap->rreq6_draft_01.rreq_da), -- (unsigned long)EXTRACT_32BITS(&ap->rreq6_draft_01.rreq_ds), -- ip6addr_string(&ap->rreq6_draft_01.rreq_oa), -- (unsigned long)EXTRACT_32BITS(&ap->rreq6_draft_01.rreq_os)); -+ ap->rreq_type & RREQ_JOIN ? "[J]" : "", -+ ap->rreq_type & RREQ_REPAIR ? "[R]" : "", -+ ap->rreq_type & RREQ_GRAT ? "[G]" : "", -+ ap->rreq_type & RREQ_DEST ? "[D]" : "", -+ ap->rreq_type & RREQ_UNKNOWN ? "[U] " : " ", -+ ap->rreq_hops, -+ (unsigned long)EXTRACT_32BITS(&ap->rreq_id), -+ ip6addr_string(&ap->rreq_da), -+ (unsigned long)EXTRACT_32BITS(&ap->rreq_ds), -+ ip6addr_string(&ap->rreq_oa), -+ (unsigned long)EXTRACT_32BITS(&ap->rreq_os)); -+ - if (i >= sizeof(struct aodv_ext)) -- aodv_extension((void *)(&ap->rreq6_draft_01 + 1), i); -+ aodv_extension((void *)(ap + 1), i); - #else - printf(" rreq %u", length); - #endif -@@ -324,9 +334,9 @@ aodv_v6_draft_01_rreq(const union aodv *ap _U_, const u_char *dat _U_, - - static void - #ifdef INET6 --aodv_v6_draft_01_rrep(const union aodv *ap, const u_char *dat, u_int length) -+aodv_v6_draft_01_rrep(const struct aodv_rrep6_draft_01 *ap, const u_char *dat, u_int length) - #else --aodv_v6_draft_01_rrep(const union aodv *ap _U_, const u_char *dat _U_, -+aodv_v6_draft_01_rrep(const struct aodv_rrep6_draft_01 *ap _U_, const u_char *dat _U_, - u_int length) - #endif - { -@@ -338,23 +348,24 @@ aodv_v6_draft_01_rrep(const union aodv *ap _U_, const u_char *dat _U_, - return; - } - i = min(length, (u_int)(snapend - dat)); -- if (i < sizeof(ap->rrep6_draft_01)) { -+ if (i < sizeof(*ap)) { - printf(" [|rrep6]"); - return; - } -- i -= sizeof(ap->rrep6_draft_01); -+ i -= sizeof(*ap); - printf(" rrep %u %s%sprefix %u hops %u\n" - "\tdst %s dseq %lu src %s %lu ms", length, -- ap->rrep6_draft_01.rrep_type & RREP_REPAIR ? "[R]" : "", -- ap->rrep6_draft_01.rrep_type & RREP_ACK ? "[A] " : " ", -- ap->rrep6_draft_01.rrep_ps & RREP_PREFIX_MASK, -- ap->rrep6_draft_01.rrep_hops, -- ip6addr_string(&ap->rrep6_draft_01.rrep_da), -- (unsigned long)EXTRACT_32BITS(&ap->rrep6_draft_01.rrep_ds), -- ip6addr_string(&ap->rrep6_draft_01.rrep_oa), -- (unsigned long)EXTRACT_32BITS(&ap->rrep6_draft_01.rrep_life)); -+ ap->rrep_type & RREP_REPAIR ? "[R]" : "", -+ ap->rrep_type & RREP_ACK ? "[A] " : " ", -+ ap->rrep_ps & RREP_PREFIX_MASK, -+ ap->rrep_hops, -+ ip6addr_string(&ap->rrep_da), -+ (unsigned long)EXTRACT_32BITS(&ap->rrep_ds), -+ ip6addr_string(&ap->rrep_oa), -+ (unsigned long)EXTRACT_32BITS(&ap->rrep_life)); -+ - if (i >= sizeof(struct aodv_ext)) -- aodv_extension((void *)(&ap->rrep6_draft_01 + 1), i); -+ aodv_extension((void *)(ap + 1), i); - #else - printf(" rrep %u", length); - #endif -@@ -362,28 +373,36 @@ aodv_v6_draft_01_rrep(const union aodv *ap _U_, const u_char *dat _U_, - - static void - #ifdef INET6 --aodv_v6_draft_01_rerr(const union aodv *ap, u_int length) -+aodv_v6_draft_01_rerr(const struct aodv_rerr *ap, const u_char *dat, u_int length) - #else --aodv_v6_draft_01_rerr(const union aodv *ap _U_, u_int length) -+aodv_v6_draft_01_rerr(const struct aodv_rerr *ap _U_, const u_char *dat, u_int length) - #endif - { - #ifdef INET6 -- const struct rerr_unreach6_draft_01 *dp6 = NULL; -- int i, j, n, trunc; -+ u_int i, dc; -+ const struct rerr_unreach6_draft_01 *dp6; -+ -+ if (snapend < dat) { -+ printf(" [|aodv]"); -+ return; -+ } -+ i = min(length, (u_int)(snapend - dat)); -+ if (i < sizeof(*ap)) { -+ printf(" [|rerr]"); -+ return; -+ } -+ i -= sizeof(*ap); - -- i = length - offsetof(struct aodv_rerr, r); -- j = sizeof(ap->rerr.r.dest6_draft_01[0]); -- dp6 = &ap->rerr.r.dest6_draft_01[0]; -- n = ap->rerr.rerr_dc * j; - printf(" rerr %s [items %u] [%u]:", -- ap->rerr.rerr_flags & RERR_NODELETE ? "[D]" : "", -- ap->rerr.rerr_dc, length); -- trunc = n - (i/j); -- for (; i -= j >= 0; ++dp6) { -+ ap->rerr_flags & RERR_NODELETE ? "[D]" : "", -+ ap->rerr_dc, length); -+ dp6 = (struct rerr_unreach6_draft_01 *)(void *)(ap + 1); -+ for (dc = ap->rerr_dc; dc != 0 && i >= sizeof(*dp6); -+ ++dp6, --dc, i -= sizeof(*dp6)) { - printf(" {%s}(%ld)", ip6addr_string(&dp6->u_da), - (unsigned long)EXTRACT_32BITS(&dp6->u_ds)); - } -- if (trunc) -+ if ((i % sizeof(*dp6)) != 0) - printf("[|rerr]"); - #else - printf(" rerr %u", length); -@@ -393,40 +412,38 @@ aodv_v6_draft_01_rerr(const union aodv *ap _U_, u_int length) - void - aodv_print(const u_char *dat, u_int length, int is_ip6) - { -- const union aodv *ap; -+ uint8_t msg_type; -+ -+ /* -+ * The message type is the first byte; make sure we have it -+ * and then fetch it. -+ */ -+ TCHECK(*dat); -+ msg_type = *dat; - -- ap = (union aodv *)dat; -- if (snapend < dat) { -- printf(" [|aodv]"); -- return; -- } -- if (min(length, (u_int)(snapend - dat)) < sizeof(ap->rrep_ack)) { -- printf(" [|aodv]"); -- return; -- } - printf(" aodv"); - -- switch (ap->rerr.rerr_type) { -+ switch (msg_type) { - - case AODV_RREQ: - if (is_ip6) -- aodv_v6_rreq(ap, dat, length); -+ aodv_v6_rreq((const struct aodv_rreq6 *) dat, dat, length); - else -- aodv_rreq(ap, dat, length); -+ aodv_rreq((const struct aodv_rreq *) dat, dat, length); - break; - - case AODV_RREP: - if (is_ip6) -- aodv_v6_rrep(ap, dat, length); -+ aodv_v6_rrep((const struct aodv_rrep6 *) dat, dat, length); - else -- aodv_rrep(ap, dat, length); -+ aodv_rrep((const struct aodv_rrep *) dat, dat, length); - break; - - case AODV_RERR: - if (is_ip6) -- aodv_v6_rerr(ap, length); -+ aodv_v6_rerr((const struct aodv_rerr *) dat, dat, length); - else -- aodv_rerr(ap, dat, length); -+ aodv_rerr((const struct aodv_rerr *) dat, dat, length); - break; - - case AODV_RREP_ACK: -@@ -434,15 +451,15 @@ aodv_print(const u_char *dat, u_int length, int is_ip6) - break; - - case AODV_V6_DRAFT_01_RREQ: -- aodv_v6_draft_01_rreq(ap, dat, length); -+ aodv_v6_draft_01_rreq((const struct aodv_rreq6_draft_01 *) dat, dat, length); - break; - - case AODV_V6_DRAFT_01_RREP: -- aodv_v6_draft_01_rrep(ap, dat, length); -+ aodv_v6_draft_01_rrep((const struct aodv_rrep6_draft_01 *) dat, dat, length); - break; - - case AODV_V6_DRAFT_01_RERR: -- aodv_v6_draft_01_rerr(ap, length); -+ aodv_v6_draft_01_rerr((const struct aodv_rerr *) dat, dat, length); - break; - - case AODV_V6_DRAFT_01_RREP_ACK: -@@ -450,6 +467,10 @@ aodv_print(const u_char *dat, u_int length, int is_ip6) - break; - - default: -- printf(" %u %u", ap->rreq.rreq_type, length); -+ printf(" %u %u", msg_type, length); - } -+ return; -+ -+trunc: -+ printf(" [|aodv]"); - } --- -1.8.3.1 - diff --git a/source/network-extra/tcpdump/CVE-2014-9140.patch b/source/network-extra/tcpdump/CVE-2014-9140.patch deleted file mode 100644 index e32e34b..0000000 --- a/source/network-extra/tcpdump/CVE-2014-9140.patch +++ /dev/null @@ -1,40 +0,0 @@ ---- a/print-ppp.c -+++ b/print-ppp.c -@@ -1266,11 +1266,15 @@ trunc: - static void - ppp_hdlc(const u_char *p, int length) - { -- u_char *b, *s, *t, c; -+ u_char *b, *t, c; -+ const u_char *s; - int i, proto; - const void *se; - -- b = (u_int8_t *)malloc(length); -+ if (length <= 0) -+ return; -+ -+ b = (u_char *)malloc(length); - if (b == NULL) - return; - -@@ -1279,14 +1283,13 @@ ppp_hdlc(const u_char *p, int length) - * Do this so that we dont overwrite the original packet - * contents. - */ -- for (s = (u_char *)p, t = b, i = length; i > 0; i--) { -+ for (s = p, t = b, i = length; i > 0 && TTEST(*s); i--) { - c = *s++; - if (c == 0x7d) { -- if (i > 1) { -- i--; -- c = *s++ ^ 0x20; -- } else -- continue; -+ if (i <= 1 || !TTEST(*s)) -+ break; -+ i--; -+ c = *s++ ^ 0x20; - } - *t++ = c; - } diff --git a/source/network-extra/tcpdump/FrugalBuild b/source/network-extra/tcpdump/FrugalBuild index e419171..f61c746 100644 --- a/source/network-extra/tcpdump/FrugalBuild +++ b/source/network-extra/tcpdump/FrugalBuild @@ -5,8 +5,8 @@ options+=('asneeded') pkgname=tcpdump -pkgver=4.5.1 -pkgrel=3 +pkgver=4.7.4 +pkgrel=1 pkgdesc="Tcpdump is for dumping traffic on a network" url="http://www.tcpdump.org"; depends=('openssl' 'libpcap>=1.2.0') @@ -15,15 +15,6 @@ archs=('i686' 'x86_64') source=($url/release/$pkgname-$pkgver.tar.gz) up2date="lynx -dump $url/release/|grep 'tcpdump-\(.*\).tar.gz'|Flasttar" Fconfopts+=" --enable-ipv6" -sha1sums=('46d5ec107c6a1b262ad8da799f74c5d01cce8815') - -# FSA fix *** -source=(${source[@]} CVE-2014-8767.patch CVE-2014-8768.patch CVE-2014-8769.patch - CVE-2014-9140.patch) -sha1sums=(${sha1sums[@]} '30dd3775306db5c2c6aca958997e37ec002cfe32' \ - 'cc27d8dc1967013ed33cd49e6a83da2cc0f9b6d1' \ - 'c0ce0f81c300fd3f94f014d9eb9b52528d374e67' \ - 'a3e69e24164c1f53704ccc2b70e417a7cc089628') -# *********** +sha1sums=('a18c9dbc4b5c4983af9cb52d8e473f5504546f4a') # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
