forked from rosa/hakurei
internal/rosa/package: net-tools
These are nice to have, but will not be included in the base system. Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
@@ -27,16 +27,9 @@ package hakurei {
|
|||||||
"CC=clang -O3 -Werror",
|
"CC=clang -O3 -Werror",
|
||||||
];
|
];
|
||||||
|
|
||||||
files = {
|
|
||||||
"hostname/main.go": "hostname";
|
|
||||||
};
|
|
||||||
|
|
||||||
exec = generic {
|
exec = generic {
|
||||||
chdir = false;
|
chdir = false;
|
||||||
build = `
|
build = `
|
||||||
echo 'Building test helper (hostname).'
|
|
||||||
go build -o /bin/hostname /usr/src/hostname/main.go
|
|
||||||
|
|
||||||
mkdir -p /work/system/libexec/hakurei/
|
mkdir -p /work/system/libexec/hakurei/
|
||||||
|
|
||||||
echo "Building hakurei for $(go env GOOS)/$(go env GOARCH)."
|
echo "Building hakurei for $(go env GOOS)/$(go env GOARCH)."
|
||||||
@@ -72,6 +65,7 @@ mkdir -p /work/system/bin/
|
|||||||
inputs = [
|
inputs = [
|
||||||
go,
|
go,
|
||||||
pkgconf,
|
pkgconf,
|
||||||
|
net-tools,
|
||||||
|
|
||||||
libseccomp,
|
libseccomp,
|
||||||
acl,
|
acl,
|
||||||
@@ -98,16 +92,9 @@ package hakurei-dist {
|
|||||||
"CC=clang -O3 -Werror",
|
"CC=clang -O3 -Werror",
|
||||||
];
|
];
|
||||||
|
|
||||||
files = {
|
|
||||||
"hostname/main.go": "hostname";
|
|
||||||
};
|
|
||||||
|
|
||||||
exec = generic {
|
exec = generic {
|
||||||
chdir = false;
|
chdir = false;
|
||||||
build = `
|
build = `
|
||||||
echo 'Building test helper (hostname).'
|
|
||||||
go build -o /bin/hostname /usr/src/hostname/main.go
|
|
||||||
|
|
||||||
NAME=make`;
|
NAME=make`;
|
||||||
check = `
|
check = `
|
||||||
NAME=all`;
|
NAME=all`;
|
||||||
@@ -119,6 +106,7 @@ DESTDIR=/work "./${NAME}.sh"
|
|||||||
inputs = [
|
inputs = [
|
||||||
go,
|
go,
|
||||||
pkgconf,
|
pkgconf,
|
||||||
|
net-tools,
|
||||||
|
|
||||||
libseccomp,
|
libseccomp,
|
||||||
acl,
|
acl,
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
package main
|
|
||||||
|
|
||||||
import "os"
|
|
||||||
|
|
||||||
func main() {
|
|
||||||
if name, err := os.Hostname(); err != nil {
|
|
||||||
panic(err)
|
|
||||||
} else {
|
|
||||||
os.Stdout.WriteString(name)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -0,0 +1,115 @@
|
|||||||
|
From 7a8f42fb20013a1493d8cae1c43436f85e656f2d Mon Sep 17 00:00:00 2001
|
||||||
|
From: Zephkeks <zephyrofficialdiscord@gmail.com>
|
||||||
|
Date: Tue, 13 May 2025 11:04:17 +0200
|
||||||
|
Subject: [PATCH] CVE-2025-46836: interface.c: Stack-based Buffer Overflow in
|
||||||
|
get_name()
|
||||||
|
|
||||||
|
Coordinated as GHSA-pfwf-h6m3-63wf
|
||||||
|
---
|
||||||
|
lib/interface.c | 63 ++++++++++++++++++++++++++++++-------------------
|
||||||
|
1 file changed, 39 insertions(+), 24 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/interface.c b/lib/interface.c
|
||||||
|
index 71d4163..a054f12 100644
|
||||||
|
--- a/lib/interface.c
|
||||||
|
+++ b/lib/interface.c
|
||||||
|
@@ -211,32 +211,47 @@ static int if_readconf(void)
|
||||||
|
}
|
||||||
|
|
||||||
|
static const char *get_name(char *name, const char *p)
|
||||||
|
+/* Safe version — guarantees at most IFNAMSIZ‑1 bytes are copied
|
||||||
|
+ and the destination buffer is always NUL‑terminated. */
|
||||||
|
{
|
||||||
|
- while (isspace(*p))
|
||||||
|
- p++;
|
||||||
|
- while (*p) {
|
||||||
|
- if (isspace(*p))
|
||||||
|
- break;
|
||||||
|
- if (*p == ':') { /* could be an alias */
|
||||||
|
- const char *dot = p++;
|
||||||
|
- while (*p && isdigit(*p)) p++;
|
||||||
|
- if (*p == ':') {
|
||||||
|
- /* Yes it is, backup and copy it. */
|
||||||
|
- p = dot;
|
||||||
|
- *name++ = *p++;
|
||||||
|
- while (*p && isdigit(*p)) {
|
||||||
|
- *name++ = *p++;
|
||||||
|
- }
|
||||||
|
- } else {
|
||||||
|
- /* No, it isn't */
|
||||||
|
- p = dot;
|
||||||
|
- }
|
||||||
|
- p++;
|
||||||
|
- break;
|
||||||
|
- }
|
||||||
|
- *name++ = *p++;
|
||||||
|
+ char *dst = name; /* current write ptr */
|
||||||
|
+ const char *end = name + IFNAMSIZ - 1; /* last byte we may write */
|
||||||
|
+
|
||||||
|
+ /* Skip leading white‑space. */
|
||||||
|
+ while (isspace((unsigned char)*p))
|
||||||
|
+ ++p;
|
||||||
|
+
|
||||||
|
+ /* Copy until white‑space, end of string, or buffer full. */
|
||||||
|
+ while (*p && !isspace((unsigned char)*p) && dst < end) {
|
||||||
|
+ if (*p == ':') { /* possible alias veth0:123: */
|
||||||
|
+ const char *dot = p; /* remember the colon */
|
||||||
|
+ ++p;
|
||||||
|
+ while (*p && isdigit((unsigned char)*p))
|
||||||
|
+ ++p;
|
||||||
|
+
|
||||||
|
+ if (*p == ':') { /* confirmed alias */
|
||||||
|
+ p = dot; /* rewind and copy it all */
|
||||||
|
+
|
||||||
|
+ /* copy the colon */
|
||||||
|
+ if (dst < end)
|
||||||
|
+ *dst++ = *p++;
|
||||||
|
+
|
||||||
|
+ /* copy the digits */
|
||||||
|
+ while (*p && isdigit((unsigned char)*p) && dst < end)
|
||||||
|
+ *dst++ = *p++;
|
||||||
|
+
|
||||||
|
+ if (*p == ':') /* consume trailing colon */
|
||||||
|
+ ++p;
|
||||||
|
+ } else { /* if so treat as normal */
|
||||||
|
+ p = dot;
|
||||||
|
+ }
|
||||||
|
+ break; /* interface name ends here */
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ *dst++ = *p++; /* ordinary character copy */
|
||||||
|
}
|
||||||
|
- *name++ = '\0';
|
||||||
|
+
|
||||||
|
+ *dst = '\0'; /* always NUL‑terminate */
|
||||||
|
return p;
|
||||||
|
}
|
||||||
|
|
||||||
|
From ddb0e375fb9ca95bb69335540b85bbdaa2714348 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Bernd Eckenfels <net-tools@lina.inka.de>
|
||||||
|
Date: Sat, 17 May 2025 21:53:23 +0200
|
||||||
|
Subject: [PATCH] Interface statistic regression after 7a8f42fb2
|
||||||
|
|
||||||
|
---
|
||||||
|
lib/interface.c | 5 ++---
|
||||||
|
1 file changed, 2 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/interface.c b/lib/interface.c
|
||||||
|
index a054f12..ca4adf1 100644
|
||||||
|
--- a/lib/interface.c
|
||||||
|
+++ b/lib/interface.c
|
||||||
|
@@ -239,12 +239,11 @@ static const char *get_name(char *name, const char *p)
|
||||||
|
/* copy the digits */
|
||||||
|
while (*p && isdigit((unsigned char)*p) && dst < end)
|
||||||
|
*dst++ = *p++;
|
||||||
|
-
|
||||||
|
- if (*p == ':') /* consume trailing colon */
|
||||||
|
- ++p;
|
||||||
|
} else { /* if so treat as normal */
|
||||||
|
p = dot;
|
||||||
|
}
|
||||||
|
+ if (*p == ':') /* consume trailing colon */
|
||||||
|
+ ++p;
|
||||||
|
break; /* interface name ends here */
|
||||||
|
}
|
||||||
|
|
||||||
@@ -0,0 +1,53 @@
|
|||||||
|
From a7926399a04ee8e629a02a2aeb6de1952d42d559 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Bernd Eckenfels <net-tools@lina.inka.de>
|
||||||
|
Date: Sat, 17 May 2025 21:11:07 +0200
|
||||||
|
Subject: [PATCH] ipmaddr.c: Stack-based buffer Overflow in parse_hex()
|
||||||
|
|
||||||
|
Coordinated as GHSA-h667-qrp8-gj58.
|
||||||
|
---
|
||||||
|
ipmaddr.c | 10 +++++-----
|
||||||
|
1 file changed, 5 insertions(+), 5 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/ipmaddr.c b/ipmaddr.c
|
||||||
|
index 64b7564..623fadd 100644
|
||||||
|
--- a/ipmaddr.c
|
||||||
|
+++ b/ipmaddr.c
|
||||||
|
@@ -91,17 +91,17 @@ static int parse_lla(char *str, char *addr)
|
||||||
|
return len;
|
||||||
|
}
|
||||||
|
|
||||||
|
-static int parse_hex(char *str, unsigned char *addr)
|
||||||
|
+static int parse_hex(char *str, unsigned char *dst, size_t dstlen)
|
||||||
|
{
|
||||||
|
int len=0;
|
||||||
|
|
||||||
|
- while (*str) {
|
||||||
|
+ while (len < dstlen && *str) {
|
||||||
|
int tmp;
|
||||||
|
if (str[1] == 0)
|
||||||
|
return -1;
|
||||||
|
if (sscanf(str, "%02x", &tmp) != 1)
|
||||||
|
return -1;
|
||||||
|
- addr[len] = tmp;
|
||||||
|
+ dst[len] = tmp;
|
||||||
|
len++;
|
||||||
|
str += 2;
|
||||||
|
}
|
||||||
|
@@ -152,7 +152,7 @@ void read_dev_mcast(struct ma_info **result_p)
|
||||||
|
|
||||||
|
m.addr.family = AF_PACKET;
|
||||||
|
|
||||||
|
- len = parse_hex(hexa, (unsigned char*)&m.addr.data);
|
||||||
|
+ len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof(m.addr.data));
|
||||||
|
if (len >= 0) {
|
||||||
|
struct ma_info *ma = xmalloc(sizeof(m));
|
||||||
|
memcpy(ma, &m, sizeof(m));
|
||||||
|
@@ -222,7 +222,7 @@ void read_igmp6(struct ma_info **result_p)
|
||||||
|
|
||||||
|
m.addr.family = AF_INET6;
|
||||||
|
|
||||||
|
- len = parse_hex(hexa, (unsigned char*)&m.addr.data);
|
||||||
|
+ len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof(m.addr.data));
|
||||||
|
if (len >= 0) {
|
||||||
|
struct ma_info *ma = xmalloc(sizeof(m));
|
||||||
|
memcpy(ma, &m, sizeof(m));
|
||||||
@@ -0,0 +1,71 @@
|
|||||||
|
From 84041080a5d4794045b098ced90e0309bcbcff44 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Zephkeks <zephyrofficialdiscord@gmail.com>
|
||||||
|
Date: Sat, 17 May 2025 22:11:37 +0200
|
||||||
|
Subject: [PATCH] proc.c: Stack-based Buffer Overflow in net-tools
|
||||||
|
(proc_gen_fmt)
|
||||||
|
|
||||||
|
Coordinated as GHSA-w7jq-cmw2-cq59.
|
||||||
|
---
|
||||||
|
lib/proc.c | 37 ++++++++++++++++++++++++++++++++++---
|
||||||
|
1 file changed, 34 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/proc.c b/lib/proc.c
|
||||||
|
index d51d09f..02aae49 100644
|
||||||
|
--- a/lib/proc.c
|
||||||
|
+++ b/lib/proc.c
|
||||||
|
@@ -17,6 +17,8 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...)
|
||||||
|
char buf[512], format[512] = "";
|
||||||
|
char *title, *head, *hdr;
|
||||||
|
va_list ap;
|
||||||
|
+ size_t format_len = 0;
|
||||||
|
+ size_t format_size = sizeof(format);
|
||||||
|
|
||||||
|
if (!fgets(buf, (sizeof buf) - 1, fh))
|
||||||
|
return NULL;
|
||||||
|
@@ -33,14 +35,43 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...)
|
||||||
|
*hdr++ = 0;
|
||||||
|
|
||||||
|
if (!strcmp(title, head)) {
|
||||||
|
- strcat(format, va_arg(ap, char *));
|
||||||
|
+ const char *arg = va_arg(ap, char *);
|
||||||
|
+ size_t arg_len = strlen(arg);
|
||||||
|
+
|
||||||
|
+ /* Check if we have enough space for format specifier + space */
|
||||||
|
+ if (format_len + arg_len + 1 >= format_size) {
|
||||||
|
+ fprintf(stderr, "warning: format buffer overflow in %s\n", name);
|
||||||
|
+ va_end(ap);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ strcpy(format + format_len, arg);
|
||||||
|
+ format_len += arg_len;
|
||||||
|
+
|
||||||
|
title = va_arg(ap, char *);
|
||||||
|
if (!title)
|
||||||
|
break;
|
||||||
|
} else {
|
||||||
|
- strcat(format, "%*s"); /* XXX */
|
||||||
|
+ /* Check if we have enough space for "%*s" */
|
||||||
|
+ if (format_len + 3 >= format_size) {
|
||||||
|
+ fprintf(stderr, "warning: format buffer overflow in %s\n", name);
|
||||||
|
+ va_end(ap);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ strcpy(format + format_len, "%*s");
|
||||||
|
+ format_len += 3;
|
||||||
|
}
|
||||||
|
- strcat(format, " ");
|
||||||
|
+
|
||||||
|
+ /* Check if we have space for the trailing space */
|
||||||
|
+ if (format_len + 1 >= format_size) {
|
||||||
|
+ fprintf(stderr, "warning: format buffer overflow in %s\n", name);
|
||||||
|
+ va_end(ap);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ format[format_len++] = ' ';
|
||||||
|
+ format[format_len] = '\0';
|
||||||
|
}
|
||||||
|
va_end(ap);
|
||||||
|
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
From f84cd22a921c25c56a6c194d4825dbd9ceea0e5f Mon Sep 17 00:00:00 2001
|
||||||
|
From: Bernd <bernd@eckenfels.net>
|
||||||
|
Date: Sat, 22 Mar 2025 00:17:10 +0100
|
||||||
|
Subject: [PATCH] Update proc.c; remove redundant null check (CodeQL #3) (#44)
|
||||||
|
|
||||||
|
---
|
||||||
|
lib/proc.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/lib/proc.c b/lib/proc.c
|
||||||
|
index ce85fd1..d51d09f 100644
|
||||||
|
--- a/lib/proc.c
|
||||||
|
+++ b/lib/proc.c
|
||||||
|
@@ -35,7 +35,7 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...)
|
||||||
|
if (!strcmp(title, head)) {
|
||||||
|
strcat(format, va_arg(ap, char *));
|
||||||
|
title = va_arg(ap, char *);
|
||||||
|
- if (!title || !head)
|
||||||
|
+ if (!title)
|
||||||
|
break;
|
||||||
|
} else {
|
||||||
|
strcat(format, "%*s"); /* XXX */
|
||||||
@@ -0,0 +1,33 @@
|
|||||||
|
package net-tools {
|
||||||
|
description = "the collection of base networking utilities for Linux";
|
||||||
|
anitya = 10231;
|
||||||
|
|
||||||
|
version# = "2.10";
|
||||||
|
source = remoteTar {
|
||||||
|
url = "https://downloads.sourceforge.net/project/net-tools/"+
|
||||||
|
"net-tools-"+version+".tar.xz";
|
||||||
|
compress = xz;
|
||||||
|
checksum = "YLmSUeHOYnhYhjvnisX6MQNkPJRzOIgSZBHRiWmBdzzziWYJVY6hOpM8eWnAZ11N";
|
||||||
|
};
|
||||||
|
patches = [
|
||||||
|
"CVE-2025-46836.patch",
|
||||||
|
"GHSA-h667-qrp8-gj58.patch",
|
||||||
|
"f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch",
|
||||||
|
"GHSA-w7jq-cmw2-cq59.patch",
|
||||||
|
];
|
||||||
|
|
||||||
|
enterSource = true;
|
||||||
|
writable = true;
|
||||||
|
|
||||||
|
exec = make {
|
||||||
|
chdir = false;
|
||||||
|
configureName = "(set +o pipefail && yes '' | make config)";
|
||||||
|
check = nil;
|
||||||
|
};
|
||||||
|
|
||||||
|
inputs = [
|
||||||
|
bash,
|
||||||
|
|
||||||
|
kernel-headers,
|
||||||
|
];
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user