diff --git a/gnu/local.mk b/gnu/local.mk index daacd786a7..f8cc9e1a59 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1032,9 +1032,7 @@ dist_patch_DATA = \ %D%/packages/patches/collectd-5.11.0-noinstallvar.patch \ %D%/packages/patches/combinatorial-blas-awpm.patch \ %D%/packages/patches/combinatorial-blas-io-fix.patch \ - %D%/packages/patches/connman-CVE-2022-32292.patch \ - %D%/packages/patches/connman-CVE-2022-32293-pt1.patch \ - %D%/packages/patches/connman-CVE-2022-32293-pt2.patch \ + %D%/packages/patches/connman-add-missing-libppp-compat.h.patch \ %D%/packages/patches/containerd-create-pid-file.patch \ %D%/packages/patches/converseen-hide-updates-checks.patch \ %D%/packages/patches/converseen-hide-non-free-pointers.patch \ diff --git a/gnu/packages/connman.scm b/gnu/packages/connman.scm index 80869f890e..2696e4c751 100644 --- a/gnu/packages/connman.scm +++ b/gnu/packages/connman.scm @@ -46,17 +46,16 @@ (define-module (gnu packages connman) (define-public connman (package (name "connman") - (version "1.41") + (version "1.42") (source (origin (method url-fetch) (uri (string-append "mirror://kernel.org/linux/network/connman/" "connman-" version ".tar.xz")) (sha256 - (base32 "12g5ilcnymx6i45z3359yds3cgd2dfqjyncfm92hqlymzps41yvr")) - (patches (search-patches "connman-CVE-2022-32292.patch" - "connman-CVE-2022-32293-pt1.patch" - "connman-CVE-2022-32293-pt2.patch")))) + (base32 "1an24caah35chc1c48p67ln8kpj9fr7slg5fklpfz0f0dzjbmrm3")) + (patches + (search-patches "connman-add-missing-libppp-compat.h.patch")))) (build-system gnu-build-system) (arguments (list #:configure-flags diff --git a/gnu/packages/patches/connman-CVE-2022-32292.patch b/gnu/packages/patches/connman-CVE-2022-32292.patch deleted file mode 100644 index cbe30742e1..0000000000 --- a/gnu/packages/patches/connman-CVE-2022-32292.patch +++ /dev/null @@ -1,34 +0,0 @@ -https://git.kernel.org/pub/scm/network/connman/connman.git/patch/?id=d1a5ede5d255bde8ef707f8441b997563b9312bd - -From d1a5ede5d255bde8ef707f8441b997563b9312bd Mon Sep 17 00:00:00 2001 -From: Nathan Crandall -Date: Tue, 12 Jul 2022 08:56:34 +0200 -Subject: gweb: Fix OOB write in received_data() - -There is a mismatch of handling binary vs. C-string data with memchr -and strlen, resulting in pos, count, and bytes_read to become out of -sync and result in a heap overflow. Instead, do not treat the buffer -as an ASCII C-string. We calculate the count based on the return value -of memchr, instead of strlen. - -Fixes: CVE-2022-32292 ---- - gweb/gweb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/gweb/gweb.c b/gweb/gweb.c -index 12fcb1d8..13c6c5f2 100644 ---- a/gweb/gweb.c -+++ b/gweb/gweb.c -@@ -918,7 +918,7 @@ static gboolean received_data(GIOChannel *channel, GIOCondition cond, - } - - *pos = '\0'; -- count = strlen((char *) ptr); -+ count = pos - ptr; - if (count > 0 && ptr[count - 1] == '\r') { - ptr[--count] = '\0'; - bytes_read--; --- -cgit - diff --git a/gnu/packages/patches/connman-CVE-2022-32293-pt1.patch b/gnu/packages/patches/connman-CVE-2022-32293-pt1.patch deleted file mode 100644 index c4d1aec31b..0000000000 --- a/gnu/packages/patches/connman-CVE-2022-32293-pt1.patch +++ /dev/null @@ -1,140 +0,0 @@ -https://git.kernel.org/pub/scm/network/connman/connman.git/patch/?id=72343929836de80727a27d6744c869dff045757c - -From 72343929836de80727a27d6744c869dff045757c Mon Sep 17 00:00:00 2001 -From: Daniel Wagner -Date: Tue, 5 Jul 2022 08:32:12 +0200 -Subject: wispr: Add reference counter to portal context - -Track the connman_wispr_portal_context live time via a -refcounter. This only adds the infrastructure to do proper reference -counting. - -Fixes: CVE-2022-32293 ---- - src/wispr.c | 52 ++++++++++++++++++++++++++++++++++++++++++---------- - 1 file changed, 42 insertions(+), 10 deletions(-) - -diff --git a/src/wispr.c b/src/wispr.c -index a07896ca..bde7e63b 100644 ---- a/src/wispr.c -+++ b/src/wispr.c -@@ -56,6 +56,7 @@ struct wispr_route { - }; - - struct connman_wispr_portal_context { -+ int refcount; - struct connman_service *service; - enum connman_ipconfig_type type; - struct connman_wispr_portal *wispr_portal; -@@ -97,6 +98,11 @@ static char *online_check_ipv4_url = NULL; - static char *online_check_ipv6_url = NULL; - static bool enable_online_to_ready_transition = false; - -+#define wispr_portal_context_ref(wp_context) \ -+ wispr_portal_context_ref_debug(wp_context, __FILE__, __LINE__, __func__) -+#define wispr_portal_context_unref(wp_context) \ -+ wispr_portal_context_unref_debug(wp_context, __FILE__, __LINE__, __func__) -+ - static void connman_wispr_message_init(struct connman_wispr_message *msg) - { - DBG(""); -@@ -162,9 +168,6 @@ static void free_connman_wispr_portal_context( - { - DBG("context %p", wp_context); - -- if (!wp_context) -- return; -- - if (wp_context->wispr_portal) { - if (wp_context->wispr_portal->ipv4_context == wp_context) - wp_context->wispr_portal->ipv4_context = NULL; -@@ -201,9 +204,38 @@ static void free_connman_wispr_portal_context( - g_free(wp_context); - } - -+static struct connman_wispr_portal_context * -+wispr_portal_context_ref_debug(struct connman_wispr_portal_context *wp_context, -+ const char *file, int line, const char *caller) -+{ -+ DBG("%p ref %d by %s:%d:%s()", wp_context, -+ wp_context->refcount + 1, file, line, caller); -+ -+ __sync_fetch_and_add(&wp_context->refcount, 1); -+ -+ return wp_context; -+} -+ -+static void wispr_portal_context_unref_debug( -+ struct connman_wispr_portal_context *wp_context, -+ const char *file, int line, const char *caller) -+{ -+ if (!wp_context) -+ return; -+ -+ DBG("%p ref %d by %s:%d:%s()", wp_context, -+ wp_context->refcount - 1, file, line, caller); -+ -+ if (__sync_fetch_and_sub(&wp_context->refcount, 1) != 1) -+ return; -+ -+ free_connman_wispr_portal_context(wp_context); -+} -+ - static struct connman_wispr_portal_context *create_wispr_portal_context(void) - { -- return g_try_new0(struct connman_wispr_portal_context, 1); -+ return wispr_portal_context_ref( -+ g_new0(struct connman_wispr_portal_context, 1)); - } - - static void free_connman_wispr_portal(gpointer data) -@@ -215,8 +247,8 @@ static void free_connman_wispr_portal(gpointer data) - if (!wispr_portal) - return; - -- free_connman_wispr_portal_context(wispr_portal->ipv4_context); -- free_connman_wispr_portal_context(wispr_portal->ipv6_context); -+ wispr_portal_context_unref(wispr_portal->ipv4_context); -+ wispr_portal_context_unref(wispr_portal->ipv6_context); - - g_free(wispr_portal); - } -@@ -452,7 +484,7 @@ static void portal_manage_status(GWebResult *result, - connman_info("Client-Timezone: %s", str); - - if (!enable_online_to_ready_transition) -- free_connman_wispr_portal_context(wp_context); -+ wispr_portal_context_unref(wp_context); - - __connman_service_ipconfig_indicate_state(service, - CONNMAN_SERVICE_STATE_ONLINE, type); -@@ -616,7 +648,7 @@ static void wispr_portal_request_wispr_login(struct connman_service *service, - return; - } - -- free_connman_wispr_portal_context(wp_context); -+ wispr_portal_context_unref(wp_context); - return; - } - -@@ -952,7 +984,7 @@ static int wispr_portal_detect(struct connman_wispr_portal_context *wp_context) - - if (wp_context->token == 0) { - err = -EINVAL; -- free_connman_wispr_portal_context(wp_context); -+ wispr_portal_context_unref(wp_context); - } - } else if (wp_context->timeout == 0) { - wp_context->timeout = g_idle_add(no_proxy_callback, wp_context); -@@ -1001,7 +1033,7 @@ int __connman_wispr_start(struct connman_service *service, - - /* If there is already an existing context, we wipe it */ - if (wp_context) -- free_connman_wispr_portal_context(wp_context); -+ wispr_portal_context_unref(wp_context); - - wp_context = create_wispr_portal_context(); - if (!wp_context) --- -cgit - diff --git a/gnu/packages/patches/connman-CVE-2022-32293-pt2.patch b/gnu/packages/patches/connman-CVE-2022-32293-pt2.patch deleted file mode 100644 index 556e69e397..0000000000 --- a/gnu/packages/patches/connman-CVE-2022-32293-pt2.patch +++ /dev/null @@ -1,173 +0,0 @@ -https://git.kernel.org/pub/scm/network/connman/connman.git/patch/?id=416bfaff988882c553c672e5bfc2d4f648d29e8a - -From 416bfaff988882c553c672e5bfc2d4f648d29e8a Mon Sep 17 00:00:00 2001 -From: Daniel Wagner -Date: Tue, 5 Jul 2022 09:11:09 +0200 -Subject: wispr: Update portal context references - -Maintain proper portal context references to avoid UAF. - -Fixes: CVE-2022-32293 ---- - src/wispr.c | 34 ++++++++++++++++++++++------------ - 1 file changed, 22 insertions(+), 12 deletions(-) - -diff --git a/src/wispr.c b/src/wispr.c -index bde7e63b..84bed33f 100644 ---- a/src/wispr.c -+++ b/src/wispr.c -@@ -105,8 +105,6 @@ static bool enable_online_to_ready_transition = false; - - static void connman_wispr_message_init(struct connman_wispr_message *msg) - { -- DBG(""); -- - msg->has_error = false; - msg->current_element = NULL; - -@@ -166,8 +164,6 @@ static void free_wispr_routes(struct connman_wispr_portal_context *wp_context) - static void free_connman_wispr_portal_context( - struct connman_wispr_portal_context *wp_context) - { -- DBG("context %p", wp_context); -- - if (wp_context->wispr_portal) { - if (wp_context->wispr_portal->ipv4_context == wp_context) - wp_context->wispr_portal->ipv4_context = NULL; -@@ -483,9 +479,6 @@ static void portal_manage_status(GWebResult *result, - &str)) - connman_info("Client-Timezone: %s", str); - -- if (!enable_online_to_ready_transition) -- wispr_portal_context_unref(wp_context); -- - __connman_service_ipconfig_indicate_state(service, - CONNMAN_SERVICE_STATE_ONLINE, type); - -@@ -546,14 +539,17 @@ static void wispr_portal_request_portal( - { - DBG(""); - -+ wispr_portal_context_ref(wp_context); - wp_context->request_id = g_web_request_get(wp_context->web, - wp_context->status_url, - wispr_portal_web_result, - wispr_route_request, - wp_context); - -- if (wp_context->request_id == 0) -+ if (wp_context->request_id == 0) { - wispr_portal_error(wp_context); -+ wispr_portal_context_unref(wp_context); -+ } - } - - static bool wispr_input(const guint8 **data, gsize *length, -@@ -618,13 +614,15 @@ static void wispr_portal_browser_reply_cb(struct connman_service *service, - return; - - if (!authentication_done) { -- wispr_portal_error(wp_context); - free_wispr_routes(wp_context); -+ wispr_portal_error(wp_context); -+ wispr_portal_context_unref(wp_context); - return; - } - - /* Restarting the test */ - __connman_service_wispr_start(service, wp_context->type); -+ wispr_portal_context_unref(wp_context); - } - - static void wispr_portal_request_wispr_login(struct connman_service *service, -@@ -700,11 +698,13 @@ static bool wispr_manage_message(GWebResult *result, - - wp_context->wispr_result = CONNMAN_WISPR_RESULT_LOGIN; - -+ wispr_portal_context_ref(wp_context); - if (__connman_agent_request_login_input(wp_context->service, - wispr_portal_request_wispr_login, -- wp_context) != -EINPROGRESS) -+ wp_context) != -EINPROGRESS) { - wispr_portal_error(wp_context); -- else -+ wispr_portal_context_unref(wp_context); -+ } else - return true; - - break; -@@ -753,6 +753,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) - if (length > 0) { - g_web_parser_feed_data(wp_context->wispr_parser, - chunk, length); -+ wispr_portal_context_unref(wp_context); - return true; - } - -@@ -770,6 +771,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) - - switch (status) { - case 000: -+ wispr_portal_context_ref(wp_context); - __connman_agent_request_browser(wp_context->service, - wispr_portal_browser_reply_cb, - wp_context->status_url, wp_context); -@@ -781,11 +783,14 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) - if (g_web_result_get_header(result, "X-ConnMan-Status", - &str)) { - portal_manage_status(result, wp_context); -+ wispr_portal_context_unref(wp_context); - return false; -- } else -+ } else { -+ wispr_portal_context_ref(wp_context); - __connman_agent_request_browser(wp_context->service, - wispr_portal_browser_reply_cb, - wp_context->redirect_url, wp_context); -+ } - - break; - case 300: -@@ -798,6 +803,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) - !g_web_result_get_header(result, "Location", - &redirect)) { - -+ wispr_portal_context_ref(wp_context); - __connman_agent_request_browser(wp_context->service, - wispr_portal_browser_reply_cb, - wp_context->status_url, wp_context); -@@ -808,6 +814,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) - - wp_context->redirect_url = g_strdup(redirect); - -+ wispr_portal_context_ref(wp_context); - wp_context->request_id = g_web_request_get(wp_context->web, - redirect, wispr_portal_web_result, - wispr_route_request, wp_context); -@@ -820,6 +827,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) - - break; - case 505: -+ wispr_portal_context_ref(wp_context); - __connman_agent_request_browser(wp_context->service, - wispr_portal_browser_reply_cb, - wp_context->status_url, wp_context); -@@ -832,6 +840,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data) - wp_context->request_id = 0; - done: - wp_context->wispr_msg.message_type = -1; -+ wispr_portal_context_unref(wp_context); - return false; - } - -@@ -890,6 +899,7 @@ static void proxy_callback(const char *proxy, void *user_data) - xml_wispr_parser_callback, wp_context); - - wispr_portal_request_portal(wp_context); -+ wispr_portal_context_unref(wp_context); - } - - static gboolean no_proxy_callback(gpointer user_data) --- -cgit - diff --git a/gnu/packages/patches/connman-add-missing-libppp-compat.h.patch b/gnu/packages/patches/connman-add-missing-libppp-compat.h.patch new file mode 100644 index 0000000000..4432c161fd --- /dev/null +++ b/gnu/packages/patches/connman-add-missing-libppp-compat.h.patch @@ -0,0 +1,140 @@ +From: Tobias Geerinckx-Rice +Date: Sun Sep 24 02:00:00 2023 +0200 +Subject: connman: Add missing libppp-compat.h. + +This file was taken verbatim from upstream commit +a48864a2e5d2a725dfc6eef567108bc13b43857f. Its absence was since +fixed in upstream commit 09c1bbfd55647b18b5bbbb99ef2b6d902465ca16. + +--- +diff -Naur a/scripts/libppp-compat.h b/scripts/libppp-compat.h +--- a/scripts/libppp-compat.h 1970-01-01 01:00:00.000000000 +0100 ++++ b/scripts/libppp-compat.h 2023-09-29 00:45:18.726709659 +0200 +@@ -0,0 +1,127 @@ ++/* Copyright (C) Eivind Naess, eivnaes@yahoo.com */ ++/* SPDX-License-Identifier: GPL-2.0-or-later */ ++ ++#ifndef __LIBPPP_COMPAT_H__ ++#define __LIBPPP_COMPAT_H__ ++ ++/* Define USE_EAPTLS compile with EAP TLS support against older pppd headers, ++ * pppd >= 2.5.0 use PPP_WITH_EAPTLS and is defined in pppdconf.h */ ++#define USE_EAPTLS 1 ++ ++/* Define INET6 to compile with IPv6 support against older pppd headers, ++ * pppd >= 2.5.0 use PPP_WITH_IPV6CP and is defined in pppdconf.h */ ++#define INET6 1 ++ ++/* PPP < 2.5.0 defines and exports VERSION which overlaps with current package VERSION define. ++ * this silly macro magic is to work around that. */ ++#undef VERSION ++#include ++ ++#ifndef PPPD_VERSION ++#define PPPD_VERSION VERSION ++#endif ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#ifdef HAVE_PPPD_CHAP_H ++#include ++#endif ++ ++#ifdef HAVE_PPPD_CHAP_NEW_H ++#include ++#endif ++ ++#ifdef HAVE_PPPD_CHAP_MS_H ++#include ++#endif ++ ++#ifndef PPP_PROTO_CHAP ++#define PPP_PROTO_CHAP 0xc223 ++#endif ++ ++#ifndef PPP_PROTO_EAP ++#define PPP_PROTO_EAP 0xc227 ++#endif ++ ++ ++#if WITH_PPP_VERSION < PPP_VERSION(2,5,0) ++ ++static inline bool ++debug_on (void) ++{ ++ return debug; ++} ++ ++static inline const char ++*ppp_ipparam (void) ++{ ++ return ipparam; ++} ++ ++static inline int ++ppp_ifunit (void) ++{ ++ return ifunit; ++} ++ ++static inline const char * ++ppp_ifname (void) ++{ ++ return ifname; ++} ++ ++static inline int ++ppp_get_mtu (int idx) ++{ ++ return netif_get_mtu(idx); ++} ++ ++typedef enum ppp_notify ++{ ++ NF_PID_CHANGE, ++ NF_PHASE_CHANGE, ++ NF_EXIT, ++ NF_SIGNALED, ++ NF_IP_UP, ++ NF_IP_DOWN, ++ NF_IPV6_UP, ++ NF_IPV6_DOWN, ++ NF_AUTH_UP, ++ NF_LINK_DOWN, ++ NF_FORK, ++ NF_MAX_NOTIFY ++} ppp_notify_t; ++ ++typedef void (ppp_notify_fn) (void *ctx, int arg); ++ ++static inline void ++ppp_add_notify (ppp_notify_t type, ppp_notify_fn *func, void *ctx) ++{ ++ struct notifier **list[NF_MAX_NOTIFY] = { ++ [NF_PID_CHANGE ] = &pidchange, ++ [NF_PHASE_CHANGE] = &phasechange, ++ [NF_EXIT ] = &exitnotify, ++ [NF_SIGNALED ] = &sigreceived, ++ [NF_IP_UP ] = &ip_up_notifier, ++ [NF_IP_DOWN ] = &ip_down_notifier, ++ [NF_IPV6_UP ] = &ipv6_up_notifier, ++ [NF_IPV6_DOWN ] = &ipv6_down_notifier, ++ [NF_AUTH_UP ] = &auth_up_notifier, ++ [NF_LINK_DOWN ] = &link_down_notifier, ++ [NF_FORK ] = &fork_notifier, ++ }; ++ ++ struct notifier **notify = list[type]; ++ if (notify) { ++ add_notifier(notify, func, ctx); ++ } ++} ++ ++#endif /* #if WITH_PPP_VERSION < PPP_VERSION(2,5,0) */ ++#endif /* #if__LIBPPP_COMPAT_H__ */