Module Name: src
Committed By: bouyer
Date: Thu May 19 19:51:01 UTC 2011
Modified Files:
src/external/bsd/dhcpcd/dist [netbsd-5-1]: dhcp.c dhcpcd-run-hooks.8.in
dhcpcd-run-hooks.in
src/external/bsd/dhcpcd/dist/dhcpcd-hooks [netbsd-5-1]: 20-resolv.conf
30-hostname
Log Message:
Pull up following revision(s) (requested by spz in ticket #1603):
external/bsd/dhcpcd/dist/dhcp.c patch
external/bsd/dhcpcd/dist/dhcpcd-run-hooks.8.in patch
external/bsd/dhcpcd/dist/dhcpcd-run-hooks.in patch
external/bsd/dhcpcd/dist/dhcpcd-hooks/20-resolv.conf patch
external/bsd/dhcpcd/dist/dhcpcd-hooks/30-hostname patch
Escape | and & characters before passing the value to the shell
Ensure we set a valid hostname, DNS domain and NIS domain.
Document the need for input validation in dhcpcd-run-hooks(8).
Fixes CVE-2011-996
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.2.6.4 -r1.1.1.2.6.4.2.1 \
src/external/bsd/dhcpcd/dist/dhcp.c
cvs rdiff -u -r1.1.1.2.6.3 -r1.1.1.2.6.3.2.1 \
src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.8.in \
src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.in
cvs rdiff -u -r1.1.1.2.6.2 -r1.1.1.2.6.2.2.1 \
src/external/bsd/dhcpcd/dist/dhcpcd-hooks/20-resolv.conf \
src/external/bsd/dhcpcd/dist/dhcpcd-hooks/30-hostname
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/external/bsd/dhcpcd/dist/dhcp.c
diff -u src/external/bsd/dhcpcd/dist/dhcp.c:1.1.1.2.6.4 src/external/bsd/dhcpcd/dist/dhcp.c:1.1.1.2.6.4.2.1
--- src/external/bsd/dhcpcd/dist/dhcp.c:1.1.1.2.6.4 Mon Nov 23 03:13:28 2009
+++ src/external/bsd/dhcpcd/dist/dhcp.c Thu May 19 19:51:00 2011
@@ -1138,6 +1138,8 @@
case '$': /* FALLTHROUGH */
case '`': /* FALLTHROUGH */
case '\\': /* FALLTHROUGH */
+ case '|': /* FALLTHROUGH */
+ case '&':
if (s) {
if (len < 3) {
errno = ENOBUFS;
Index: src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.8.in
diff -u src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.8.in:1.1.1.2.6.3 src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.8.in:1.1.1.2.6.3.2.1
--- src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.8.in:1.1.1.2.6.3 Mon Nov 23 03:13:28 2009
+++ src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.8.in Thu May 19 19:51:00 2011
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2006-2009 Roy Marples
+.\" Copyright (c) 2006-2011 Roy Marples
.\" All rights reserved
.\"
.\" Redistribution and use in source and binary forms, with or without
@@ -22,7 +22,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd March 23, 2009
+.Dd March 23, 2011
.Dt DHCPCD-RUN-HOOKS 8 SMM
.Os
.Sh NAME
@@ -131,3 +131,11 @@
.An Roy Marples Aq [email protected]
.Sh BUGS
Please report them to http://roy.marples.name/projects/dhcpcd
+.Sh SECURITY CONSIDERATIONS
+Little validation of DHCP options is done in dhcpcd itself.
+Instead, it is up to the hooks to handle any validation needed.
+To this end, some helper functions are provided, such as valid_domainname as
+used by the
+.Pa 20-resolv.conf
+hook to ensure that the hostname is not set to an invalid value.
+valid_path is also provided, but is currently unused by a stock hook script.
Index: src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.in
diff -u src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.in:1.1.1.2.6.3 src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.in:1.1.1.2.6.3.2.1
--- src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.in:1.1.1.2.6.3 Mon Nov 23 03:13:28 2009
+++ src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.in Thu May 19 19:51:00 2011
@@ -138,6 +138,46 @@
fi
}
+# Check for a valid domain name as per RFC1123 with the exception of
+# allowing - and _ as they seem to be widely used.
+valid_domainname()
+{
+ local name="$1" label
+
+ [ -z "$name" -o ${#name} -gt 255 ] && return 1
+
+ while [ -n "$name" ]; do
+ label="${name%%.*}"
+ [ -z "$label" -o ${#label} -gt 63 ] && return 1
+ case "$label" in
+ -*|_*|*-|*_) return 1;;
+ *[![:alnum:]-_]*) return 1;;
+ esac
+ [ "$name" = "${name#*.}" ] && break
+ name="${name#*.}"
+ done
+ return 0
+}
+
+valid_domainname_list()
+{
+ local name
+
+ for name in $@; do
+ valid_domainname "$name" || return $?
+ done
+ return 0
+}
+
+# Check for a valid path
+valid_path()
+{
+ case "$@" in
+ *[![:alnum:]#%+-_:\.,@~\\/\[\]=\ ]*) return 1;;
+ esac
+ return 0
+}
+
# We source each script into this one so that scripts run earlier can
# remove variables from the environment so later scripts don't see them.
Index: src/external/bsd/dhcpcd/dist/dhcpcd-hooks/20-resolv.conf
diff -u src/external/bsd/dhcpcd/dist/dhcpcd-hooks/20-resolv.conf:1.1.1.2.6.2 src/external/bsd/dhcpcd/dist/dhcpcd-hooks/20-resolv.conf:1.1.1.2.6.2.2.1
--- src/external/bsd/dhcpcd/dist/dhcpcd-hooks/20-resolv.conf:1.1.1.2.6.2 Mon May 18 21:23:34 2009
+++ src/external/bsd/dhcpcd/dist/dhcpcd-hooks/20-resolv.conf Thu May 19 19:51:01 2011
@@ -81,14 +81,22 @@
if [ -n "$new_domain_name" ]; then
set -- $new_domain_name
new_domain_name="$1"
- conf="${conf}domain $new_domain_name\n"
+ if valid_domainname "$new_domain_name"; then
+ conf="${conf}domain $new_domain_name\n"
+ else
+ syslog err "Invalid domain name: $new_domain_name"
+ fi
# Support RFC violating search in domain
if [ -z "$new_domain_search" -a -n "$2" ]; then
new_domain_search="$@"
fi
fi
if [ -n "$new_domain_search" ]; then
- conf="${conf}search $new_domain_search\n"
+ if valid_domainname_list; then
+ conf="${conf}search $new_domain_search\n"
+ else
+ syslog err "Invalid domain name in list: $new_domain_search"
+ fi
fi
for x in ${new_domain_name_servers}; do
conf="${conf}nameserver $x\n"
Index: src/external/bsd/dhcpcd/dist/dhcpcd-hooks/30-hostname
diff -u src/external/bsd/dhcpcd/dist/dhcpcd-hooks/30-hostname:1.1.1.2.6.2 src/external/bsd/dhcpcd/dist/dhcpcd-hooks/30-hostname:1.1.1.2.6.2.2.1
--- src/external/bsd/dhcpcd/dist/dhcpcd-hooks/30-hostname:1.1.1.2.6.2 Mon Nov 23 03:13:29 2009
+++ src/external/bsd/dhcpcd/dist/dhcpcd-hooks/30-hostname Thu May 19 19:51:01 2011
@@ -18,13 +18,22 @@
esac
}
+try_hostname()
+{
+ if valid_domainname "$1"; then
+ hostname "$1"
+ else
+ syslog err "Invalid hostname: $1"
+ fi
+}
+
set_hostname()
{
if need_hostname; then
if [ -n "$new_host_name" ]; then
- hostname "$new_host_name"
+ try_hostname "$new_host_name"
elif [ -n "$new_fqdn_name" ]; then
- hostname "$new_fqdn_name"
+ try_hostname "$new_fqdn_name"
fi
fi
}
