Bug 675052 - (CVE-2011-0997) VUL-0: CVE-2011-0997: dhcp-client / dhcpcd: remote/local root hole via rogue hostname
(CVE-2011-0997)
VUL-0: CVE-2011-0997: dhcp-client / dhcpcd: remote/local root hole via rogue ...
Status: RESOLVED FIXED
: 689182 (view as bug list)
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: General
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Marius Tomaschewski
Security Team bot
maint:released:sle10-sp3:39778 maint:...
:
Depends on: 674733
Blocks: 689182
  Show dependency treegraph
 
Reported: 2011-02-25 13:12 UTC by Marcus Meissner
Modified: 2019-01-02 17:33 UTC (History)
14 users (show)

See Also:
Found By: Development
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
First patch idea for dhcpcd (SLE-11) (5.25 KB, patch)
2011-03-01 16:18 UTC, Marius Tomaschewski
Details | Diff
First patch idea for ISC dhcp client (3.x as on SLE-11) (2.09 KB, patch)
2011-03-02 15:40 UTC, Marius Tomaschewski
Details | Diff
Patch for dhcpv6 (SLE11) (1.33 KB, patch)
2011-03-02 16:57 UTC, Marius Tomaschewski
Details | Diff
v2 -- Patch for dhcpcd (3.2.3, SLE-11 +) (5.41 KB, patch)
2011-03-07 16:14 UTC, Marius Tomaschewski
Details | Diff
v2 -- Patch for ISC dhclient (3.x as on SLE-11) (2.19 KB, patch)
2011-03-07 16:22 UTC, Marius Tomaschewski
Details | Diff
v2 -- Patch for ISC dhclient (3.x as on SLE-11) - PTR lookup in dhclient-script (727 bytes, patch)
2011-03-07 16:23 UTC, Marius Tomaschewski
Details | Diff
v3 -- Patch for dhcpcd 3.2.3 (SLE-11 .. 11.4) (8.51 KB, patch)
2011-03-10 12:39 UTC, Marius Tomaschewski
Details | Diff
Test tool using the functions to check hostname / domain lists. (1.88 KB, text/x-csrc)
2011-03-10 12:51 UTC, Marius Tomaschewski
Details
v4 -- Patch for dhcpcd 3.2.3 (SLE-11 .. 11.4) (8.56 KB, patch)
2011-03-10 13:40 UTC, Marius Tomaschewski
Details | Diff
v4 -- Patch for ISC dhclient (3.x as on SLE-11) (4.38 KB, patch)
2011-03-10 16:33 UTC, Marius Tomaschewski
Details | Diff
v4 -- Patch for ISC dhclient (3.x as on SLE-11) - PTR lookup in dhclient-script (1.59 KB, patch)
2011-03-10 16:34 UTC, Marius Tomaschewski
Details | Diff
v5 -- Patch for dhcpcd 3.2.3 (SLE-11 .. 11.4) (8.60 KB, patch)
2011-03-16 08:34 UTC, Marius Tomaschewski
Details | Diff
test case for dhcpcd in a 11.4 xen domU and server in xen dom0 (6.72 KB, text/plain)
2011-03-16 14:02 UTC, Marius Tomaschewski
Details
v6 -- Patch for dhcpcd 3.2.3 (SLE-11 .. 11.4) (9.10 KB, patch)
2011-03-16 17:08 UTC, Marius Tomaschewski
Details | Diff
v7 -- Patch for dhcpcd 3.2.3 (SLE-11 .. 11.4) (9.31 KB, patch)
2011-03-22 16:35 UTC, Marius Tomaschewski
Details | Diff
Patch for dhcpcd 1.3.x (SLE-10) (7.16 KB, patch)
2011-03-28 15:44 UTC, Marius Tomaschewski
Details | Diff
Patch for dhcp6 (SLE-10) (1.86 KB, patch)
2011-03-29 19:35 UTC, Marius Tomaschewski
Details | Diff
Patch for ISC dhcp-3.0.7 (SLE-10) (7.68 KB, patch)
2011-03-29 19:38 UTC, Marius Tomaschewski
Details | Diff
DHCP fix submit overview (2.90 KB, text/plain)
2011-03-31 12:50 UTC, Marius Tomaschewski
Details
DHCP fix submit request overview (3.73 KB, text/plain)
2011-03-31 16:17 UTC, Marius Tomaschewski
Details
Patch for dhcpcd 3.2.3 (SLE-11, 11.2 .. 11.4) (9.31 KB, patch)
2011-04-06 10:21 UTC, Marius Tomaschewski
Details | Diff
Patch for ISC dhclient (3.1-ESV on SLE-11) (7.73 KB, patch)
2011-04-06 10:23 UTC, Marius Tomaschewski
Details | Diff
domain-name regression mail sent upstream (4.55 KB, text/plain)
2011-04-06 14:45 UTC, Marius Tomaschewski
Details
Patch for ISC dhcp-4.2.x to accept a list in domain-name option (571 bytes, patch)
2011-04-06 14:49 UTC, Marius Tomaschewski
Details | Diff
affected /etc/resolv.conf (1.25 KB, text/plain)
2011-04-06 15:51 UTC, Heiko Rommel
Details
network capture obtained with ethereal (2.10 KB, application/octet-stream)
2011-04-11 13:03 UTC, Heiko Rommel
Details
dhcp6c client config (84 bytes, text/plain)
2011-04-11 13:04 UTC, Heiko Rommel
Details
dhcp6s server config (399 bytes, text/plain)
2011-04-11 13:05 UTC, Heiko Rommel
Details
fix for regression (882 bytes, patch)
2011-04-15 12:29 UTC, Anders Johansson
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2011-02-25 13:12:23 UTC
The issue is not public, keep inside SUSE.

The main issue here is that a rogue DHCP Server
can inject hostnames into the system with any character.

$(id>>/tmp/foo) as hostname was possible in Sebastians tests.

The characterset passed from the DHCP client to "hostname" should already be
filtered for the valid characters. 

It is not clear which chars are valid. Wikipedia suggests [a-z0-9A-Z-] and perhaps _

-> Marius for DHCP
Comment 1 Marius Tomaschewski 2011-02-25 14:21:10 UTC
Yes,
RFC conforming hostname (FQDN) is AFAIK "^[[:alnum:]]+([\\.-][[:alnum:]]+)*$"
(plus length constrains). The "_" character is AFAIR not RFC conform, but we
may add it to the set because some people try to use it...

So this regex should be IMO OK: "^[[:alnum:]]+([\\.-_][[:alnum:]]+)*$"

OK, to use it (check using a regex)?

Added Peter as maintainer of dhcpcd.
Comment 2 Sebastian Krahmer 2011-02-28 09:28:00 UTC
After an update of dhcp client on 11.3, dhclient also
accepts the hostname option. It escapes some characters
but forgets |.

On a SLE11-SP1 dhcpcd is accepting anything and somewhere in
the boot scripts it already executes the commands, it
is not necessary to login.

On 11.3 dhcpcd also accepts anything.

At best there is some whitelisting. We also need to check
ip6, I dont know whether similar options exist there,
but I think so.
Comment 3 Marius Tomaschewski 2011-03-01 16:18:50 UTC
Created attachment 416835 [details]
First patch idea for dhcpcd (SLE-11)

Until now ... it compiles, but I didn't tested yet if it already works :-)

When you have some ideas how to make it better, please let me know.
Comment 4 Marius Tomaschewski 2011-03-01 16:21:26 UTC
Work in progress is in $IBS/home:mtomaschewski:branches:SUSE:SLE-11-SP1:Update:Test/dhcpcd
Comment 5 Matthias Hopf 2011-03-01 17:13:50 UTC
For the record: Adam Jackson told me that on REL dhcp clients are patched for quite some time now.
Comment 6 Marius Tomaschewski 2011-03-02 15:29:07 UTC
(In reply to comment #5)
> For the record: Adam Jackson told me that on REL dhcp clients are patched for
> quite some time now.

AFAIS they aren't -- at least not ISC dhcp. But ISC dhcp client escapes the
shell meta chars (except of '|' as noted in comment 2).
Comment 7 Marius Tomaschewski 2011-03-02 15:40:46 UTC
Created attachment 417094 [details]
First patch idea for ISC dhcp client (3.x as on SLE-11)

Because ISC dhcp escapes shell meta characters already, I've just added
to escape '|' character as well.

Further, because I don't check all strings as in the dhcpcd patch, but
only the strings we want to reject (hostname & Co) - we may add more
options to this list (and verify to not discard too much in dhcpcd too).

Other options will be escaped: The dhclient also allows to declare own
options in the config, ... and in case of many it is difficult to know
what the user exactly needs (e.g. in some file names).

This patch is not complete yet -- it contains the dhclient changes only:
I'll add also a check of the hostname in the DNS PTR lookup done in in
dhclient-script...

Please take a look and comment.
Comment 8 Marius Tomaschewski 2011-03-02 16:57:28 UTC
Created attachment 417112 [details]
Patch for dhcpv6 (SLE11)

The dhcpv6 client does not support anything else except of a domain search
list. This patch should cause to ignore domains with suspect characters...
Comment 9 Sebastian Krahmer 2011-03-07 15:01:18 UTC
The v4 patch looks ok sofar, IMHO. But the DNS thingie is still needed.
Will dhcpcd also set the hostname via DNS PTR if
"require hostname" is not set in the config?
Comment 10 Marius Tomaschewski 2011-03-07 16:14:10 UTC
Created attachment 417876 [details]
v2 -- Patch for dhcpcd (3.2.3, SLE-11 +)

I've fixed to handle DHCP_NETBIOSNODETYPE values correctly and the
DHCP_ROOTPATH to just check via isprint, because it is allowed to
contain "every crap" by RFC. The ROOTPATH is written single quoted
to the /var/lib/dhcpcd/*.info file. Making it too tight will break
booting for many customers, so we should take care a lot here.
Comment 11 Marius Tomaschewski 2011-03-07 16:17:36 UTC
Comment on attachment 417112 [details]
Patch for dhcpv6 (SLE11)

This can be as it were.
It does not support any other options except of domain search and server list.
Comment 12 Marius Tomaschewski 2011-03-07 16:22:28 UTC
Created attachment 417877 [details]
v2 -- Patch for ISC dhclient (3.x as on SLE-11)

Checks & rejects host- & domain names, anything else gets escaped anyway
(now inclusive of the | character). Basically as in dhcpcd. All variables
are passed via env to the dhclient-script.
Comment 13 Marius Tomaschewski 2011-03-07 16:23:50 UTC
Created attachment 417879 [details]
v2 -- Patch for ISC dhclient (3.x as on SLE-11) - PTR lookup in dhclient-script
Comment 14 Marius Tomaschewski 2011-03-07 16:40:54 UTC
(In reply to comment #9)
> The v4 patch looks ok sofar, IMHO. But the DNS thingie is still needed.

Yes, now in dhclient-script patch in attachment 417879 [details].

> Will dhcpcd also set the hostname via DNS PTR if
> "require hostname" is not set in the config?

AFAIK it always requests the hostname (almost all options) and it can
happen it will set it when the hostname is not set or set to "localhost"
or "(none)":

        gethostname (curhostname, MAXHOSTNAMELEN);
        if (options->dohostname ||
            strlen (curhostname) == 0 ||
            strcmp (curhostname, "(none)") == 0 ||
            strcmp (curhostname, "localhost") == 0)
        {
...
                if (! *newhostname || options->dohostname > 3)
                        lookuphostname (newhostname, dhcp, options);
...
                if (*newhostname) {
...
                        sethostname (newhostname, (int) strlen (newhostname));

In all above cases, when the dhcp server did not provide any, dhcpcd
will make a DNS PTR lookup [the patch checks the result].
Comment 15 Marius Tomaschewski 2011-03-09 09:30:58 UTC
BTW: There is a bug with gethostname use:

configure.c:
        curhostname = xmalloc (sizeof (char) * MAXHOSTNAMELEN);
        *curhostname = '\0';

        gethostname (curhostname, MAXHOSTNAMELEN);

dhcpcd.c:
        gethostname (options->hostname, sizeof (options->hostname));

gethostname does not terminate (allowed by POSIX), when the
hostname ist longer than the 2nd arg:

        size_t i;
        char curhostname[15] = {'X','X','X','X','X','X','X','X','X','X','\0'};
        gethostname(curhostname, 5);

        for(i=0;i<sizeof(curhostname); i++)
                printf("%02x ", curhostname[i]);
        printf("\n");
        for(i=0;i<sizeof(curhostname) && curhostname[i]; i++)
                printf("%c  ", curhostname[i]);
        printf("\n");

On my "xanthos" machine I get:

       78 61 6e 74 68 58 58 58 58 58 00 00 00 00 00 
       x  a  n  t  h  X  X  X  X  X
Comment 16 Marius Tomaschewski 2011-03-10 12:39:18 UTC
Created attachment 418575 [details]
v3 -- Patch for dhcpcd 3.2.3 (SLE-11 .. 11.4)

The version of the dhcpcd-3.x patch is the final one -- as I hope.

It makes following changes:

- Implemented length and character constrains for all strings, especially
  host and domain names (lists) inclusive of getaddrinfo (PTR lookup),
  gethostname results, the server name and for the root-path option.

  - hostname as list of [[:alnum:]_-] labels with 1..63 length separated
    by a [.] character with a total length of 1..255. The [-] and [-] are
    not allowed at the begin or end of a label. A final [.] is allowed.
    That is: "a" "a.b" "a.b." "a-_-b.c." are fine, "-a" or "a-.b" is not.

  - Limitted root-path to a [[:alnum:] ]+ string (with space) of any length
    and the following additional chars (inclusive backslash): #%+,-/.:@\_~
    This disallows !"$&'()*;<=>?[]^`{|}) from the [:print:] class.
    This string is stored single quoted in the info file.

    => Please review these checks or we break e.g. iSCSI root systems !!

  Only hostname option is set directly via sethostname. All options are
  stored single quoted in the info file.
  The bootfile from dhcp message is ignored / never used anyway.

- Forced \0 termination of hostname returned by gethostname as POSIX
  allows to not truncate it, when the name is longer than the buffer.

Please review the and let me know if this is ok or not. I'm going to
apply to internal build system:
  home:mtomaschewski:branches:openSUSE:11.2:Update:Test/dhcpcd
  home:mtomaschewski:branches:openSUSE:11.3:Update:Test/dhcpcd
  home:mtomaschewski:branches:openSUSE:11.4:Update:Test/dhcpcd
  home:mtomaschewski:branches:SUSE:SLE-11-SP1:Update:Test/dhcpcd

and to port it for dhcpcd-1.x on SLE-10 and the other dhcp clients.
Comment 17 Marius Tomaschewski 2011-03-10 12:44:26 UTC
Hannes, Marcus,
would you take a look please at the root-path checks described above?
Do we need to allow/disallow another characters here?
Comment 18 Marius Tomaschewski 2011-03-10 12:51:36 UTC
Created attachment 418582 [details]
Test tool using the functions to check hostname / domain lists.
Comment 19 Marius Tomaschewski 2011-03-10 13:16:50 UTC
See comment 17.
Comment 20 Marcus Schaefer 2011-03-10 13:20:10 UTC
the root-path limitations doesn't cause a problem on my system
so to me it looks rock solid now :-)
Comment 21 Marius Tomaschewski 2011-03-10 13:40:48 UTC
Created attachment 418601 [details]
v4 -- Patch for dhcpcd 3.2.3 (SLE-11 .. 11.4)

Fixed a typo and missed stddef include
Comment 22 Marius Tomaschewski 2011-03-10 16:33:17 UTC
Created attachment 418637 [details]
v4 -- Patch for ISC dhclient (3.x as on SLE-11)
Comment 23 Marius Tomaschewski 2011-03-10 16:34:00 UTC
Created attachment 418638 [details]
v4 -- Patch for ISC dhclient (3.x as on SLE-11) - PTR lookup in dhclient-script
Comment 24 Marius Tomaschewski 2011-03-16 08:34:32 UTC
Created attachment 419598 [details]
v5 -- Patch for dhcpcd 3.2.3 (SLE-11 .. 11.4)

fixed to allow empty servername
Comment 25 Sebastian Krahmer 2011-03-16 08:43:20 UTC
CVE-2011-0997
Comment 26 Sebastian Krahmer 2011-03-16 08:49:30 UTC
MaintenanceTracker-39410
Comment 27 Marius Tomaschewski 2011-03-16 14:02:26 UTC
Created attachment 419688 [details]
test case for dhcpcd in a 11.4 xen domU and server in xen dom0
Comment 28 Marius Tomaschewski 2011-03-16 15:24:23 UTC
The dhcpcd package in
  IBS/home:mtomaschewski:branches:openSUSE:11.4:Update:Test/dhcpcd
passed all the my/above tests. It contains the following fixes:

- bnc#675052 - discard string options such as host and domain names
  containing disallowed characters or beeing too long. This proctive
  patch limits root-path to a-zA-Z0-9, #%+,-/.:@\_~ and space.
- bnc#668194 - handle packets with xen partial UDP checksums
- bnc#657402 - send renew messages as unicast directly to the server

Peter, please let us know when it did not passed your tests.


Maintenance & Security Team:
 Patch for bnc#657402 should IMO go to any dist with dhcpcd-3 [>sle10],
 patch for bnc#668194 needs a kernel marking partial checksum packages.
 Currently only the 11.4 kernel marks them correctly.

 OK so far?

I'm going to finish (dhcpv6 in dhcp-4.x on >=11.3) & retest ISC dhclient
tomorrow, then the dhcpcd option checks for dhcp6/dhcpcd-1.x on sles10.
Comment 29 Marius Tomaschewski 2011-03-16 15:40:21 UTC
Updated
  IBS/home:mtomaschewski:branches:SUSE:SLE-11-SP1:Update:Test/dhcpcd
note: bnc#672038 [L3 on sles11] == bnc#657402 [11.4]
Comment 30 Marius Tomaschewski 2011-03-16 16:37:36 UTC
We've were speaking about this issue with Ludwig and he pointed me to one
issue that is not yet addressed:

When the client sends a hostname to the dhcp server, the server may write
it to DNS...
It seems, we have to check also the hostname option, that the user passes
to dhcp clients at start...
It would IMO also make sense to reject crap in e.g. dhcp server and bind.
Comment 31 Marius Tomaschewski 2011-03-16 17:08:45 UTC
Created attachment 419743 [details]
v6 -- Patch for dhcpcd 3.2.3 (SLE-11 .. 11.4)

This patch addresses above issue disallowing invalid hostnames for -h
argument (& gethostname as fallback) in dhcpcd.

Updated:
  $IBS/home:mtomaschewski:branches:SUSE:SLE-11-SP1:Update:Test/dhcpcd
  $IBS/home:mtomaschewski:branches:openSUSE:11.4:Update:Test/dhcpcd
Comment 32 Christian Dengler 2011-03-16 18:01:40 UTC
handle over to security team
Comment 33 Sebastian Krahmer 2011-03-22 16:19:54 UTC
We propose a CRD of 5th April.
Comment 34 Marius Tomaschewski 2011-03-22 16:35:51 UTC
Created attachment 420735 [details]
v7 -- Patch for dhcpcd 3.2.3 (SLE-11 .. 11.4)

fixed isalnum use in the patch as pointed out by Joerg Sonnenberger

updated in
   IBS/home:mtomaschewski:branches:openSUSE:11.4:Update:Test/dhcpcd
   IBS/home:mtomaschewski:branches:SUSE:SLE-11-SP1:Update:Test/dhcpcd
Comment 35 Marius Tomaschewski 2011-03-28 15:44:24 UTC
Created attachment 421714 [details]
Patch for dhcpcd 1.3.x (SLE-10)
Comment 36 Marius Tomaschewski 2011-03-29 19:30:57 UTC
AFAIS, bnc#627617 is on the planned list for SP3 (see also bug 627617
comment 23 and 24), so I've applied it:

+Wed Nov 17 17:32:39 UTC 2010 - mt@suse.de
+
+- Implemented optional ldap connect retry loop during the initial
+  startup of the dhcp server in cases where the ldap server is not
+  yet started. Set the ldap-init-retry <secs> option in dhcpd.conf
+  to enable it (bnc#627617). 

request from -> to    [bnc#675052 + bnc#627617]
 11335  home:mtomaschewski:branches:SUSE:SLE-10-SP3:Update:Test/dhcp
        ->  SUSE:SLE-10-SP3:Update:Test   

There is no difference between the dhcp6 and dhcpcd packages on SP3
and SP4, so I've submitted them twice:

request from -> to    [bnc#675052]
 11332  home:mtomaschewski:branches:SUSE:SLE-10-SP4:Update:Test/dhcp
        ->  SUSE:SLE-10-SP4:Update:Test   
 11334  home:mtomaschewski:branches:SUSE:SLE-10-SP4:Update:Test/dhcp6
        ->  SUSE:SLE-10-SP3:Update:Test   
 11333  home:mtomaschewski:branches:SUSE:SLE-10-SP4:Update:Test/dhcp6
        ->  SUSE:SLE-10-SP4:Update:Test
 11316  home:mtomaschewski:branches:SUSE:SLE-10-SP4:Update:Test/dhcpcd
        ->  SUSE:SLE-10-SP4:Update:Test   
 11315  home:mtomaschewski:branches:SUSE:SLE-10-SP4:Update:Test/dhcpcd
        ->  SUSE:SLE-10-SP3:Update:Test   

This should be OK, isn't it?
Comment 37 Marius Tomaschewski 2011-03-29 19:35:26 UTC
Created attachment 421996 [details]
Patch for dhcp6 (SLE-10)
Comment 38 Marius Tomaschewski 2011-03-29 19:38:07 UTC
Created attachment 421999 [details]
Patch for ISC dhcp-3.0.7 (SLE-10)
Comment 39 Sebastian Krahmer 2011-03-30 07:12:20 UTC
If there is no difference then it should be OK, from my perspective.
(if the .changelog etc is also SLE-version agnostic)

So we need SLE11 (SLES9 probably?) and boxes.
Comment 40 Marius Tomaschewski 2011-03-30 08:52:39 UTC
SLES-9: I didn't looked yet. Hope, the SLE-10 patches apply here.

SLE-10: done & submitted

SLE-11: [ISC dhcp & dhcpcd] there is an open question in:
  https://bugzilla.novell.com/show_bug.cgi?id=668194#c37

11.4:   [ISC dhcp] there is an still unfixed 100% CPU bug:
  https://bugzilla.novell.com/show_bug.cgi?id=680298

I'm committing & submitting dhcpv6 packages currently.
Comment 41 Marius Tomaschewski 2011-03-31 12:50:21 UTC
Created attachment 422465 [details]
DHCP fix submit overview
Comment 42 Marius Tomaschewski 2011-03-31 16:17:27 UTC
Created attachment 422537 [details]
DHCP fix submit request overview
Comment 43 Marius Tomaschewski 2011-03-31 16:19:36 UTC
All sles packages are IMO submitted (see comment 42), box is in:

home:mtomaschewski:branches:openSUSE:11.2:Update:Test/dhcpv6
home:mtomaschewski:branches:openSUSE:11.2:Update:Test/dhcpcd
home:mtomaschewski:branches:openSUSE:11.2:Update:Test/dhcp

home:mtomaschewski:branches:openSUSE:11.3:Update:Test/dhcpv6
home:mtomaschewski:branches:openSUSE:11.3:Update:Test/dhcpcd
home:mtomaschewski:branches:openSUSE:11.3:Update:Test/dhcp

home:mtomaschewski:branches:openSUSE:11.4:Update:Test/dhcpv6
home:mtomaschewski:branches:openSUSE:11.4:Update:Test/dhcpcd
home:mtomaschewski:branches:openSUSE:11.4:Update:Test/dhcp

Peter merges 11.2 dhcpcd...
Comment 44 Marius Tomaschewski 2011-03-31 16:20:06 UTC
In _IBS_ of course...
Comment 45 Marius Tomaschewski 2011-04-05 19:13:48 UTC
ISC has released 4.2.1-P1 addressing CVE-2011-0997 (bnc#675052), see 

http://ftp.isc.org/isc/dhcp/dhcp-4.2.1-P1-RELNOTES
[...]
			Changes since 4.2.1

! In dhclient check the data for some string options for
  reasonableness before passing it along to the script that
  interfaces with the OS.
  [ISC-Bugs #23722]
  CVE: CVE-2011-0997

[...]
Comment 47 Marius Tomaschewski 2011-04-06 10:21:42 UTC
Created attachment 423400 [details]
Patch for dhcpcd 3.2.3 (SLE-11, 11.2 .. 11.4)
Comment 48 Marius Tomaschewski 2011-04-06 10:23:56 UTC
Created attachment 423401 [details]
Patch for ISC dhclient (3.1-ESV on SLE-11)
Comment 49 Swamp Workflow Management 2011-04-06 11:54:52 UTC
Update released for: dhcpcd, dhcpcd-debuginfo
Products:
SLE-DESKTOP 10-SP3 (i386, x86_64)
SLE-SAP-APL 10-SP3 (x86_64)
SLE-SERVER 10-SP3 (i386, ia64, ppc, s390x, x86_64)
Comment 50 Swamp Workflow Management 2011-04-06 12:03:59 UTC
Update released for: dhcpcd, dhcpcd-debuginfo
Products:
SLE-DESKTOP 10-SP4 (i386, x86_64)
SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Comment 51 Heiko Rommel 2011-04-06 12:40:07 UTC
We might have a regression in parsing the DNSDOMAIN answer from dhcp servers.
We see this in all related maintenance updates under swamp (39410) from SLES9 to SLE11SP1:

before:

riker:~ # dhcpcd-test eth0 | grep DOMAIN
DNSDOMAIN='suse.de arch.suse.de nue.novell.com'
NISDOMAIN='suse.de'

after:

riker:~ # dhcpcd-test eth0 | grep DOMAIN
NISDOMAIN='suse.de'

/var/log/messages:
Apr  6 14:33:13 riker dhcpcd[26124]: suspect value in option DNSDOMAIN - discarded
Comment 52 Marcus Meissner 2011-04-06 13:36:47 UTC
summary.

Having a list in dnsdomain is not standard, but was used to get a list of domains in the search list of resolv.conf. older distros might not evaluate the SEARCH record yet.

We will be contacting ISC to report this and also likely respin all dhcp patches (pending ISC review) to allow DNSDOMAIN record be a list for now. :/
Comment 53 Marius Tomaschewski 2011-04-06 14:45:40 UTC
Created attachment 423457 [details]
domain-name regression mail sent upstream
Comment 54 Marius Tomaschewski 2011-04-06 14:49:40 UTC
Created attachment 423458 [details]
Patch for ISC dhcp-4.2.x to accept a list in domain-name option

The verbose variant does this:

+                     case DHO_DOMAIN_NAME: /* accept a list for compatibiliy */
+                       if( check_domain_name_list(ptr, len, 0) == 0) {
+                               if(strchr(ptr, ' ') != NULL) {
+                                       log_debug("domain-name provides a domain list; "
+                                                 "update server to use domain-search");
+                               }
+                               return(0);
+                       }
+                       return(-1);
+                       break;

but may effectively cause many log lines... I think it is better
to document it only, isn't it?
Comment 55 Swamp Workflow Management 2011-04-06 15:23:28 UTC
Update released for: dhcp, dhcp-client, dhcp-debuginfo, dhcp-devel, dhcp-relay, dhcp-server
Products:
SLE-DESKTOP 10-SP4 (i386, x86_64)
SLE-SDK 10-SP4 (i386, ia64, ppc, s390x, x86_64)
SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Comment 56 Heiko Rommel 2011-04-06 15:50:47 UTC
While testing the maintenance update

Products: SUSE-CORE 9 (i386, ia64, ppc, s390, s390x, x86_64), Novell-Linux-POS 9 (i386), Open-Enterprise-Server 9 (i386)
Category: security
YOU Patch No: 12696
MD5 sum: ad848aa99325481552899b84d0f82433
SUBSWAMPID: 39923
Packager: mt@novell.com
Packages: dhcpcd >= 1.3.22pl4-193.17

I noticed a critical side effect of what I described in comment 51:

The resolv.conf written by /sbin/modify_resolvconf (I guess it takes it input from the dhcp client) has some non-ascii characters in the search list like

search �@�@
Comment 57 Heiko Rommel 2011-04-06 15:51:45 UTC
Created attachment 423470 [details]
affected /etc/resolv.conf
Comment 61 Marius Tomaschewski 2011-04-06 18:38:22 UTC
(In reply to comment #56)

Seems to be this bug, that is independend of the check:

           if ( DhcpOptions.len[domainName] )
 	    NewSearchlist = malloc(strlen(OldSearchlist) + 2 + strlen((char *)DhcpOptions.val[domainName]) );
 	  else
 	    NewSearchlist = malloc(strlen(OldSearchlist) + 2);
+	  NewSearchlist[0] = 0;

but I have to verify it...
When there (is no resolv.conf and also) no DOMAIN from dhcp -> #c56.
Comment 62 Marius Tomaschewski 2011-04-06 19:15:54 UTC
OK, now in IBS sr 11443. SLE-10 does not have this problem. Please test.
Comment 64 Ludwig Nussel 2011-04-08 11:24:45 UTC
ping! updated dhcpcd for openSUSE still missing!
Comment 65 Swamp Workflow Management 2011-04-08 13:26:34 UTC
Update released for: dhcp, dhcp-client, dhcp-client-debuginfo, dhcp-debuginfo, dhcp-debugsource, dhcp-devel, dhcp-doc, dhcp-relay, dhcp-relay-debuginfo, dhcp-server, dhcp-server-debuginfo
Products:
openSUSE 11.4 (debug, i586, x86_64)
Comment 66 Swamp Workflow Management 2011-04-08 13:27:07 UTC
Update released for: dhcp, dhcp-client, dhcp-client-debuginfo, dhcp-debuginfo, dhcp-debugsource, dhcp-devel, dhcp-doc, dhcp-relay, dhcp-relay-debuginfo, dhcp-server, dhcp-server-debuginfo
Products:
openSUSE 11.2 (debug, i586, x86_64)
openSUSE 11.3 (debug, i586, x86_64)
Comment 67 Swamp Workflow Management 2011-04-08 14:03:07 UTC
Update released for: dhcpcd
Products:
Novell-Linux-POS 9 (i386)
Open-Enterprise-Server 9 (i386)
SUSE-CORE 9 (i386, ia64, ppc, s390, s390x, x86_64)
Comment 68 Swamp Workflow Management 2011-04-08 17:06:11 UTC
Update released for: dhcp, dhcp-client, dhcp-debuginfo, dhcp-debugsource, dhcp-devel, dhcp-relay, dhcp-server
Products:
SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP1 (i386, x86_64)
SLE-SDK 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP1 (i386, x86_64)
Comment 69 Swamp Workflow Management 2011-04-08 17:22:09 UTC
Update released for: dhcp, dhcp-client, dhcp-devel, dhcp-relay, dhcp-server
Products:
Novell-Linux-POS 9 (i386)
Open-Enterprise-Server 9 (i386)
SUSE-CORE 9 (i386, ia64, ppc, s390, s390x, x86_64)
Comment 70 Swamp Workflow Management 2011-04-08 17:34:33 UTC
Update released for: dhcpcd
Products:
Novell-Linux-POS 9 (i386)
Open-Enterprise-Server 9 (i386)
SUSE-CORE 9 (i386, ia64, ppc, s390, s390x, x86_64)
Comment 71 Swamp Workflow Management 2011-04-08 17:43:48 UTC
Update released for: dhcpcd, dhcpcd-debuginfo
Products:
SLE-DESKTOP 10-SP3 (i386, x86_64)
SLE-SAP-APL 10-SP3 (x86_64)
SLE-SERVER 10-SP3 (i386, ia64, ppc, s390x, x86_64)
Comment 72 Swamp Workflow Management 2011-04-08 17:56:09 UTC
Update released for: dhcpcd, dhcpcd-debuginfo, dhcpcd-debugsource
Products:
SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP1 (i386, x86_64)
SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP1 (i386, x86_64)
Comment 73 Peter Varkoly 2011-04-10 06:48:42 UTC
(In reply to comment #64)
> ping! updated dhcpcd for openSUSE still missing!
Allready done:
SR 66414 & 66233
And now I've created 66606
Comment 74 Ludwig Nussel 2011-04-11 06:58:07 UTC
11.3 doesn't use the updated patch to allow spaces in DHCP_DNSDOMAIN.
Comment 75 Peter Varkoly 2011-04-11 09:49:43 UTC
created request id 66795
Comment 84 Swamp Workflow Management 2011-04-12 12:49:57 UTC
Update released for: dhcpv6, dhcpv6-debuginfo, dhcpv6-debugsource, libdhcp6client-1_0-2, libdhcp6client-devel
Products:
SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP1 (i386, x86_64)
SLE-SDK 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP1 (i386, x86_64)
Comment 85 Swamp Workflow Management 2011-04-12 13:34:33 UTC
Update released for: dhcpcd, dhcpcd-debuginfo
Products:
SLE-DESKTOP 10-SP4 (i386, x86_64)
SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Comment 86 Swamp Workflow Management 2011-04-12 15:47:43 UTC
Update released for: dhcp, dhcp-client, dhcp-debuginfo, dhcp-devel, dhcp-relay, dhcp-server
Products:
SLE-DESKTOP 10-SP4 (i386, x86_64)
SLE-SDK 10-SP4 (i386, ia64, ppc, s390x, x86_64)
SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Comment 87 Swamp Workflow Management 2011-04-12 16:18:34 UTC
Update released for: dhcp, dhcp-client, dhcp-debuginfo, dhcp-devel, dhcp-relay, dhcp-server
Products:
SLE-DEBUGINFO 10-SP3 (i386, ia64, ppc, s390x, x86_64)
SLE-DESKTOP 10-SP3 (i386, x86_64)
SLE-SAP-APL 10-SP3 (x86_64)
SLE-SDK 10-SP3 (i386, ia64, ppc, s390x, x86_64)
SLE-SERVER 10-SP3 (i386, ia64, ppc, s390x, x86_64)
Comment 88 Swamp Workflow Management 2011-04-13 13:34:27 UTC
Update released for: dhcpcd, dhcpcd-debuginfo, dhcpcd-debugsource
Products:
openSUSE 11.3 (debug, i586, x86_64)
Comment 89 Swamp Workflow Management 2011-04-13 13:34:35 UTC
Update released for: dhcpcd, dhcpcd-debuginfo, dhcpcd-debugsource
Products:
openSUSE 11.4 (debug, i586, x86_64)
Comment 90 Swamp Workflow Management 2011-04-13 13:34:48 UTC
Update released for: dhcpcd, dhcpcd-debuginfo, dhcpcd-debugsource
Products:
openSUSE 11.2 (debug, i586, x86_64)
Comment 91 Swamp Workflow Management 2011-04-13 15:58:40 UTC
Update released for: dhcp6, dhcp6-debuginfo
Products:
SLE-SDK 10-SP4 (i386, ia64, ppc, s390x, x86_64)
SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Comment 92 Anders Johansson 2011-04-15 12:29:09 UTC
Created attachment 425175 [details]
fix for regression

A regression in the latest maintenance update - the sip value may be NULL and shouldn't be blindly passed to strlen()
Comment 93 Marius Tomaschewski 2011-04-15 14:11:56 UTC
 11569  State:new     By:mtomaschewski When:2011-04-15T16:10:20
        submit:       home:mtomaschewski:branches:SUSE:SLE-11-SP1:Update:Test/dhcpcd  ->  SUSE:SLE-11-SP1:Update:Test   
        Descr: bug#687850: sip check regression for bnc#675052
Comment 94 Ludwig Nussel 2011-04-15 14:41:46 UTC
wow, that was a mean one. Did you check whether the other places could crash in a similar way?
Comment 95 Anders Johansson 2011-04-15 15:08:46 UTC
I didn't look very closely, but the things I looked at seemed to test for NULL correctly, so I think this was the only one. At least in that patch
Comment 96 Marius Tomaschewski 2011-04-19 08:04:50 UTC
I've submitted dhcpcd with the sip option fix for 11.2 .. 11.4 as well:
request ids 67845,67846,67847.
Comment 97 Marcus Meissner 2011-04-19 09:58:08 UTC
Marius,

this issue also qualifies for an LTSS updates due to its severity.

can you submit:
- dhcp, dhcp6, dhcpcd  

also against 
/work/SRC/old-versions/10.1/SLE-SP2/all

for sles10 sp2 ltss?
Comment 98 Marius Tomaschewski 2011-04-19 12:29:53 UTC
As it is just a difference this fix, done for:

- Request #11745:
  SUSE:SLE-10-SP4:Update:Test/dhcp6 -> SUSE:SLE-10-SP2:Update:Test/dhcp6

- Request #11746:
  SUSE:SLE-10-SP4:Update:Test/dhcpcd -> SUSE:SLE-10-SP2:Update:Test/dhcpcd

[ISC] dhcp needs a closer look / merges.
Comment 101 Swamp Workflow Management 2011-04-19 16:21:00 UTC
Update released for: dhcpcd, dhcpcd-debuginfo, dhcpcd-debugsource
Products:
SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP1 (i386, x86_64)
SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP1 (i386, x86_64)
Comment 102 Swamp Workflow Management 2011-04-19 17:15:39 UTC
Update released for: dhcp6, dhcp6-debuginfo
Products:
SLE-DEBUGINFO 10-SP3 (i386, ia64, ppc, s390x, x86_64)
SLE-SAP-APL 10-SP3 (x86_64)
SLE-SDK 10-SP3 (i386, ia64, ppc, s390x, x86_64)
SLE-SERVER 10-SP3 (i386, ia64, ppc, s390x, x86_64)
SLE-SERVER 10-SP3-TERADATA (x86_64)
Comment 106 Swamp Workflow Management 2011-04-21 10:00:14 UTC
Update released for: dhcpcd, dhcpcd-debuginfo, dhcpcd-debugsource
Products:
openSUSE 11.2 (debug, i586, x86_64)
Comment 107 Swamp Workflow Management 2011-04-21 10:00:48 UTC
Update released for: dhcpcd, dhcpcd-debuginfo, dhcpcd-debugsource
Products:
openSUSE 11.3 (debug, i586, x86_64)
Comment 108 Swamp Workflow Management 2011-04-21 10:01:23 UTC
Update released for: dhcpcd, dhcpcd-debuginfo, dhcpcd-debugsource
Products:
openSUSE 11.4 (debug, i586, x86_64)
Comment 109 Marcus Meissner 2011-04-26 14:32:12 UTC
The sles9 ia64 crash from #c76 is likely caused by someone else writing resolv.conf while dhcp6c is trying to read it. the changing size confuses glibc and gives that crash / backtrace.

As i checked sinope, both dhcp-client and dhcpcd were running, which makes this likely.

Try retest without any other dhcp client running.
Comment 113 Swamp Workflow Management 2011-05-02 14:05:39 UTC
Update released for: dhcp6, dhcpcd
Products:
SLE-SERVER 10-SP2-LTSS (i386, s390x, x86_64)
Comment 114 Swamp Workflow Management 2011-05-03 12:55:57 UTC
Update released for: dhcp6
Products:
Novell-Linux-POS 9 (i386)
Open-Enterprise-Server 9 (i386)
SUSE-CORE 9 (i386, ia64, ppc, s390, s390x, x86_64)
Comment 115 Marcus Meissner 2011-05-03 12:59:48 UTC
nearly all done (but sle10 sp2 ltss dhcp)
Comment 116 Leonardo Chiquitto 2011-05-05 02:50:15 UTC
*** Bug 689182 has been marked as a duplicate of this bug. ***
Comment 117 Swamp Workflow Management 2011-05-05 16:18:59 UTC
Update released for: dhcp, dhcp-client, dhcp-devel, dhcp-relay, dhcp-server
Products:
SLE-SERVER 10-SP2-LTSS (i386, s390x, x86_64)