From 3980daffa4e284377cd1ae803fba78331c1fc40b Mon Sep 17 00:00:00 2001 From: Alan Swanson Date: Tue, 27 Apr 2021 16:24:05 +0100 Subject: [PATCH] dnsmasq: Update to version 2.85 Fixes issue with merged DNS requests in 2.83/2.84 not being retried on the firsts failed request causing lookup failures. Also fixes the following security problem in dnsmasq: * CVE-2021-3448: If specifiying the source address or interface to be used when contacting upstream name servers such as: server=8.8.8.8@1.2.3.4, server=8.8.8.8@1.2.3.4#66 and server=8.8.8.8@eth0 then all would use the same socket bound to the explicitly configured port. Now only server=8.8.8.8@1.2.3.4#66 will use the explicitly configured port and the others random source ports. Remove upstreamed patches and update remaining patch. Signed-off-by: Alan Swanson [refreshed old runtime support patch] Signed-off-by: Kevin Darbyshire-Bryant --- package/network/services/dnsmasq/Makefile | 4 +- ...ak-sort-order-of-tags-in-get-version.patch | 45 ------------------- ...4a875e0f16fd645df965db346fc56d2ab1dd.patch | 28 ------------ ...00-remove-old-runtime-kernel-support.patch | 21 ++------- 4 files changed, 6 insertions(+), 92 deletions(-) delete mode 100644 package/network/services/dnsmasq/patches/0001-Tweak-sort-order-of-tags-in-get-version.patch delete mode 100644 package/network/services/dnsmasq/patches/0002-Tweak-f1204a875e0f16fd645df965db346fc56d2ab1dd.patch diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile index bc70931400..90a81b5f65 100644 --- a/package/network/services/dnsmasq/Makefile +++ b/package/network/services/dnsmasq/Makefile @@ -8,13 +8,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=dnsmasq -PKG_UPSTREAM_VERSION:=2.84 +PKG_UPSTREAM_VERSION:=2.85 PKG_VERSION:=$(subst test,~~test,$(subst rc,~rc,$(PKG_UPSTREAM_VERSION))) PKG_RELEASE:=$(AUTORELEASE) PKG_SOURCE:=$(PKG_NAME)-$(PKG_UPSTREAM_VERSION).tar.xz PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq -PKG_HASH:=603195c64b73137609b07e1024ae0b37f652b2f5fe467dce66985b3d1850050c +PKG_HASH:=ad98d3803df687e5b938080f3d25c628fe41c878752d03fbc6199787fee312fa PKG_LICENSE:=GPL-2.0 PKG_LICENSE_FILES:=COPYING diff --git a/package/network/services/dnsmasq/patches/0001-Tweak-sort-order-of-tags-in-get-version.patch b/package/network/services/dnsmasq/patches/0001-Tweak-sort-order-of-tags-in-get-version.patch deleted file mode 100644 index d7659ea037..0000000000 --- a/package/network/services/dnsmasq/patches/0001-Tweak-sort-order-of-tags-in-get-version.patch +++ /dev/null @@ -1,45 +0,0 @@ -From f1204a875e0f16fd645df965db346fc56d2ab1dd Mon Sep 17 00:00:00 2001 -From: Simon Kelley -Date: Fri, 29 Jan 2021 23:20:06 +0000 -Subject: [PATCH 1/2] Tweak sort order of tags in get-version. - -We want to sort such that the most recent/relevant tag is first -and gets used to set the compiled-in version. - -The solution is far from general, but works for the tag formats -used by dnsmasq. v2.84 sorts before v2.83, but v2.83 sorts -before v2.83rc1 and 2.83rc1 sorts before v2.83test1 - -Signed-off-by: Kevin Darbyshire-Bryant ---- - bld/get-version | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/bld/get-version b/bld/get-version -index e472aab..1d7e7f0 100755 ---- a/bld/get-version -+++ b/bld/get-version -@@ -9,7 +9,10 @@ - # If we can find one which matches $v[0-9].* then we assume it's - # a version-number tag, else we just use the whole string. - # If there is more than one v[0-9].* tag, sort them and use the --# first. This favours, eg v2.63 over 2.63rc6. -+# first. The insane arguments to the sort command are to ensure -+# that, eg v2.64 comes before v2.63, but v2.63 comes before v2.63rc1 -+# and v2.63rc1 comes before v2.63test1 -+ - - # Change directory to the toplevel source directory. - if test -z "$1" || ! test -d "$1" || ! cd "$1"; then -@@ -28,7 +31,7 @@ else - vers=`cat $1/VERSION | sed 's/[(), ]/,/ g' | tr ',' '\n' | grep ^v[0-9]` - - if [ $? -eq 0 ]; then -- echo "${vers}" | sort -r | head -n 1 | sed 's/^v//' -+ echo "${vers}" | sort -k1.2,1.5r -k 1.6,1.6 -k1.8,1.9r -k1.10,1.11r | head -n 1 | sed 's/^v//' - else - cat $1/VERSION - fi --- -2.24.3 (Apple Git-128) - diff --git a/package/network/services/dnsmasq/patches/0002-Tweak-f1204a875e0f16fd645df965db346fc56d2ab1dd.patch b/package/network/services/dnsmasq/patches/0002-Tweak-f1204a875e0f16fd645df965db346fc56d2ab1dd.patch deleted file mode 100644 index 255507ced9..0000000000 --- a/package/network/services/dnsmasq/patches/0002-Tweak-f1204a875e0f16fd645df965db346fc56d2ab1dd.patch +++ /dev/null @@ -1,28 +0,0 @@ -From cfcafdd27c74dc187fe96a9cfa88b1aef53540a0 Mon Sep 17 00:00:00 2001 -From: Simon Kelley -Date: Mon, 1 Feb 2021 23:46:43 +0000 -Subject: [PATCH 2/2] Tweak f1204a875e0f16fd645df965db346fc56d2ab1dd - -This gets, eg, v2.65test1 and v2.65test11 in the correct order. - -Signed-off-by: Kevin Darbyshire-Bryant ---- - bld/get-version | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/bld/get-version b/bld/get-version -index 1d7e7f0..1f51768 100755 ---- a/bld/get-version -+++ b/bld/get-version -@@ -31,7 +31,7 @@ else - vers=`cat $1/VERSION | sed 's/[(), ]/,/ g' | tr ',' '\n' | grep ^v[0-9]` - - if [ $? -eq 0 ]; then -- echo "${vers}" | sort -k1.2,1.5r -k 1.6,1.6 -k1.8,1.9r -k1.10,1.11r | head -n 1 | sed 's/^v//' -+ echo "${vers}" | sort -k1.2,1.5Vr -k1.6,1.6 -k1.8,1.9Vr -k1.10,1.11Vr | head -n 1 | sed 's/^v//' - else - cat $1/VERSION - fi --- -2.24.3 (Apple Git-128) - diff --git a/package/network/services/dnsmasq/patches/100-remove-old-runtime-kernel-support.patch b/package/network/services/dnsmasq/patches/100-remove-old-runtime-kernel-support.patch index bd11806ae0..b601bce1a9 100644 --- a/package/network/services/dnsmasq/patches/100-remove-old-runtime-kernel-support.patch +++ b/package/network/services/dnsmasq/patches/100-remove-old-runtime-kernel-support.patch @@ -1,4 +1,4 @@ -From 7df4c681678612d196b4e1eec24963d181fdb28a Mon Sep 17 00:00:00 2001 +From 02fbe60e1c7e74d2ba57109575e7bfc238b1b5d4 Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Sun, 5 Apr 2020 17:18:23 +0100 Subject: [PATCH] drop runtime old kernel support @@ -8,9 +8,8 @@ Signed-off-by: Kevin Darbyshire-Bryant src/dnsmasq.c | 4 ---- src/dnsmasq.h | 5 +--- src/ipset.c | 64 ++++----------------------------------------------- - src/netlink.c | 3 +-- src/util.c | 19 --------------- - 5 files changed, 6 insertions(+), 89 deletions(-) + 4 files changed, 5 insertions(+), 87 deletions(-) --- a/src/dnsmasq.c +++ b/src/dnsmasq.c @@ -27,7 +26,7 @@ Signed-off-by: Kevin Darbyshire-Bryant --- a/src/dnsmasq.h +++ b/src/dnsmasq.h -@@ -1125,7 +1125,7 @@ extern struct daemon { +@@ -1144,7 +1144,7 @@ extern struct daemon { int inotifyfd; #endif #if defined(HAVE_LINUX_NETWORK) @@ -36,7 +35,7 @@ Signed-off-by: Kevin Darbyshire-Bryant #elif defined(HAVE_BSD_NETWORK) int dhcp_raw_fd, dhcp_icmp_fd, routefd; #endif -@@ -1306,9 +1306,6 @@ int read_write(int fd, unsigned char *pa +@@ -1326,9 +1326,6 @@ int read_write(int fd, unsigned char *pa void close_fds(long max_fd, int spare1, int spare2, int spare3); int wildcard_match(const char* wildcard, const char* match); int wildcard_matchn(const char* wildcard, const char* match, int num); @@ -139,18 +138,6 @@ Signed-off-by: Kevin Darbyshire-Bryant if (ret == -1) my_syslog(LOG_ERR, _("failed to update ipset %s: %s"), setname, strerror(errno)); ---- a/src/netlink.c -+++ b/src/netlink.c -@@ -92,8 +92,7 @@ char *netlink_init(void) - iov.iov_len = 100; - iov.iov_base = safe_malloc(iov.iov_len); - -- if (daemon->kernel_version >= KERNEL_VERSION(2,6,30) && -- setsockopt(daemon->netlinkfd, SOL_NETLINK, NETLINK_NO_ENOBUFS, &opt, sizeof(opt)) == -1) -+ if (setsockopt(daemon->netlinkfd, SOL_NETLINK, NETLINK_NO_ENOBUFS, &opt, sizeof(opt)) == -1) - return _("warning: failed to set NETLINK_NO_ENOBUFS on netlink socket"); - - return NULL; --- a/src/util.c +++ b/src/util.c @@ -786,22 +786,3 @@ int wildcard_matchn(const char* wildcard -- 2.30.2