commit f1f6db5ddb9a320ad33f5c9add6b6b34a91a5f48 Author: MSVSphere Packaging Team Date: Fri Oct 25 19:32:45 2024 +0300 import tcpdump-4.99.4-9.el10 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..714f48f --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +SOURCES/tcpdump-4.99.4.tar.gz +SOURCES/tcpdump-4.99.4.tar.gz.sig +SOURCES/tcpslice-1.7.tar.gz diff --git a/.tcpdump.metadata b/.tcpdump.metadata new file mode 100644 index 0000000..3d0d162 --- /dev/null +++ b/.tcpdump.metadata @@ -0,0 +1,3 @@ +cc005539296900ce6a90c61f4099bd0f3ef3dd26 SOURCES/tcpdump-4.99.4.tar.gz +cddad6f90391208fadc513aac9a90b622411ef00 SOURCES/tcpdump-4.99.4.tar.gz.sig +8fb66de200a35b1b228e9cc3b13e59c648e48fee SOURCES/tcpslice-1.7.tar.gz diff --git a/SOURCES/0002-Use-getnameinfo-instead-of-gethostbyaddr.patch b/SOURCES/0002-Use-getnameinfo-instead-of-gethostbyaddr.patch new file mode 100644 index 0000000..6aebd98 --- /dev/null +++ b/SOURCES/0002-Use-getnameinfo-instead-of-gethostbyaddr.patch @@ -0,0 +1,110 @@ +diff --git a/addrtoname.c b/addrtoname.c +index 33b9378..426839c 100644 +--- a/addrtoname.c ++++ b/addrtoname.c +@@ -277,7 +277,6 @@ extern cap_channel_t *capdns; + const char * + ipaddr_string(netdissect_options *ndo, const u_char *ap) + { +- struct hostent *hp; + uint32_t addr; + struct hnamemem *p; + +@@ -299,13 +298,29 @@ ipaddr_string(netdissect_options *ndo, const u_char *ap) + */ + if (!ndo->ndo_nflag && + (addr & f_netmask) == f_localnet) { +-#ifdef HAVE_CASPER +- if (capdns != NULL) { +- hp = cap_gethostbyaddr(capdns, (char *)&addr, 4, +- AF_INET); +- } else +-#endif +- hp = gethostbyaddr((char *)&addr, 4, AF_INET); ++#ifdef HAVE_GETNAMEINFO ++ struct sockaddr_in sa; ++ char hbuf[NI_MAXHOST]; ++ ++ memset(&sa, 0, sizeof (sa)); ++ sa.sin_family = AF_INET; ++ sa.sin_addr.s_addr = addr; ++ if (!getnameinfo((struct sockaddr *)&sa, sizeof (sa), ++ hbuf, sizeof (hbuf), NULL, 0, 0)) { ++ if (ndo->ndo_Nflag) { ++ char *dotp; ++ ++ /* Remove domain qualifications */ ++ dotp = strchr(hbuf, '.'); ++ if (dotp) ++ *dotp = '\0'; ++ } ++ p->name = strdup(hbuf); ++ return p->name; ++ } ++#else ++ struct hostent *hp; ++ hp = gethostbyaddr((char *)&addr, 4, AF_INET); + if (hp) { + char *dotp; + +@@ -321,6 +336,7 @@ ipaddr_string(netdissect_options *ndo, const u_char *ap) + } + return (p->name); + } ++#endif + } + p->name = strdup(intoa(addr)); + if (p->name == NULL) +@@ -336,7 +352,6 @@ ipaddr_string(netdissect_options *ndo, const u_char *ap) + const char * + ip6addr_string(netdissect_options *ndo, const u_char *ap) + { +- struct hostent *hp; + union { + nd_ipv6 addr; + struct for_hash_addr { +@@ -361,13 +376,29 @@ ip6addr_string(netdissect_options *ndo, const u_char *ap) + * Do not print names if -n was given. + */ + if (!ndo->ndo_nflag) { +-#ifdef HAVE_CASPER +- if (capdns != NULL) { +- hp = cap_gethostbyaddr(capdns, (char *)&addr, +- sizeof(addr), AF_INET6); +- } else +-#endif +- hp = gethostbyaddr((char *)&addr, sizeof(addr), ++#ifdef HAVE_GETNAMEINFO ++ struct sockaddr_in6 sa; ++ char hbuf[NI_MAXHOST]; ++ ++ memset(&sa, 0, sizeof (sa)); ++ sa.sin6_family = AF_INET6; ++ sa.sin6_addr = addr.addr; ++ if (!getnameinfo((struct sockaddr *)&sa, sizeof (sa), ++ hbuf, sizeof (hbuf), NULL, 0, 0)) { ++ if (ndo->ndo_Nflag) { ++ char *dotp; ++ ++ /* Remove domain qualifications */ ++ dotp = strchr(hbuf, '.'); ++ if (dotp) ++ *dotp = '\0'; ++ } ++ p->name = strdup(hbuf); ++ return p->name; ++ } ++#else ++ struct hostent *hp; ++ hp = gethostbyaddr((char *)&addr, sizeof(addr), + AF_INET6); + if (hp) { + char *dotp; +@@ -384,6 +415,7 @@ ip6addr_string(netdissect_options *ndo, const u_char *ap) + } + return (p->name); + } ++#endif + } + cp = addrtostr6(ap, ntop_buf, sizeof(ntop_buf)); + p->name = strdup(cp); diff --git a/SOURCES/0003-Drop-root-priviledges-before-opening-first-savefile-.patch b/SOURCES/0003-Drop-root-priviledges-before-opening-first-savefile-.patch new file mode 100644 index 0000000..685a86d --- /dev/null +++ b/SOURCES/0003-Drop-root-priviledges-before-opening-first-savefile-.patch @@ -0,0 +1,104 @@ +From 9bee0dffaebbc53b9762df7a6d84a553969e7b00 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Fri, 3 Feb 2017 09:36:26 +0100 +Subject: [PATCH 3/8] Drop root priviledges before opening first savefile if + running with -Z root + +--- + tcpdump.1.in | 7 ++++++- + tcpdump.c | 30 ++++++++++++++++++++++++++++++ + 2 files changed, 36 insertions(+), 1 deletion(-) + +diff --git a/tcpdump.1.in b/tcpdump.1.in +index f04a579..ca5cff2 100644 +--- a/tcpdump.1.in ++++ b/tcpdump.1.in +@@ -249,6 +249,9 @@ have the name specified with the + flag, with a number after it, starting at 1 and continuing upward. + The units of \fIfile_size\fP are millions of bytes (1,000,000 bytes, + not 1,048,576 bytes). ++ ++Note that when used with \fB\-Z\fR option (enabled by default), privileges ++are dropped before opening the first savefile. + .TP + .B \-d + Dump the compiled packet-matching code in a human readable form to +@@ -860,7 +863,9 @@ but before opening any savefiles for output, change the user ID to + and the group ID to the primary group of + .IR user . + .IP +-This behavior can also be enabled by default at compile time. ++This behavior is enabled by default (\fB\-Z tcpdump\fR), and can ++be disabled by \fB\-Z root\fR. ++ + .IP "\fI expression\fP" + .RS + selects which packets will be dumped. +@@ -366,6 +366,10 @@ If no time format is specified, each new file will overwrite the previous. + If used in conjunction with the + .B \-C + option, filenames will take the form of `\fIfile\fP'. ++.IP ++Note that when used with ++.B \-Z ++option (enabled by default), privileges are dropped before opening the first savefile. + .TP + .B \-h + .PD 0 +diff --git a/tcpdump.c b/tcpdump.c +index 73bf138..29f7f87 100644 +--- a/tcpdump.c ++++ b/tcpdump.c +@@ -1133,6 +1133,7 @@ main(int argc, char **argv) + cap_rights_t rights; + int cansandbox; + #endif /* HAVE_CAPSICUM */ ++ int chown_flag = 0; + int Oflag = 1; /* run filter code optimizer */ + int yflag_dlt = -1; + const char *yflag_dlt_name = NULL; +@@ -1843,6 +1844,19 @@ main(int argc, char **argv) + } + capng_apply(CAPNG_SELECT_BOTH); + #endif /* HAVE_LIBCAP_NG */ ++ /* If user is running tcpdump as root and wants to write to the savefile, ++ * we will check if -C is set and if it is, we will drop root ++ * privileges right away and consequent call to>pcap_dump_open() ++ * will most likely fail for the first file. If -C flag is not set we ++ * will create file as root then change ownership of file to proper ++ * user(default tcpdump) and drop root privileges. ++ */ ++ if (WFileName) ++ if ((Cflag || Gflag) && (username || chroot_dir)) ++ droproot(username, chroot_dir); ++ else ++ chown_flag = 1; ++ else + if (username || chroot_dir) + droproot(username, chroot_dir); + +@@ -1881,6 +1895,22 @@ main(int argc, char **argv) + MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); + + pdd = pcap_dump_open(pd, dumpinfo.CurrentFileName); ++ ++ /* Change ownership of file and drop root privileges */ ++ if (chown_flag) { ++ struct passwd *pwd; ++ ++ pwd = getpwnam(username); ++ if (!pwd) ++ error("Couldn't find user '%s'", username); ++ ++ if (strcmp(WFileName, "-") && chown(dumpinfo.CurrentFileName, pwd->pw_uid, pwd->pw_gid) < 0) ++ error("Couldn't change ownership of savefile"); ++ ++ if (username || chroot_dir) ++ droproot(username, chroot_dir); ++ } ++ + #ifdef HAVE_LIBCAP_NG + /* Give up CAP_DAC_OVERRIDE capability. + * Only allow it to be restored if the -C or -G flag have been +-- +2.9.3 diff --git a/SOURCES/0007-Introduce-nn-option.patch b/SOURCES/0007-Introduce-nn-option.patch new file mode 100644 index 0000000..1e64d8b --- /dev/null +++ b/SOURCES/0007-Introduce-nn-option.patch @@ -0,0 +1,55 @@ +From 9ea43c6c97d3653cb58c1934f8770b951917bf9a Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Mon, 20 Oct 2014 13:26:38 +0200 +Subject: [PATCH 7/8] Introduce -nn option + +This changes the semantics on -n option so only namelookups are skipped. Port +numbers *are* translated to their string representations. Option -nn then has +the same semantics as -n had originally. +--- + addrtoname.c | 4 ++-- + tcpdump.1.in | 6 +++++- + 2 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/addrtoname.c b/addrtoname.c +index 949acb7..9dd78d8 100644 +--- a/addrtoname.c ++++ b/addrtoname.c +@@ -810,7 +810,7 @@ init_servarray(netdissect_options *ndo) + + while (table->name) + table = table->nxt; +- if (ndo->ndo_nflag) { ++ if (ndo->ndo_nflag > 1) { + (void)snprintf(buf, sizeof(buf), "%d", port); + table->name = strdup(buf); + } else +@@ -1233,7 +1233,7 @@ init_addrtoname(netdissect_options *ndo, uint32_t localnet, uint32_t mask) + f_localnet = localnet; + f_netmask = mask; + } +- if (ndo->ndo_nflag) ++ if (ndo->ndo_nflag > 1) + /* + * Simplest way to suppress names. + */ +diff --git a/tcpdump.1.in b/tcpdump.1.in +index ca5cff2..c711a24 100644 +--- a/tcpdump.1.in ++++ b/tcpdump.1.in +@@ -547,7 +547,11 @@ Use \fIsecret\fP as a shared secret for validating the digests found in + TCP segments with the TCP-MD5 option (RFC 2385), if present. + .TP + .B \-n +-Don't convert addresses (i.e., host addresses, port numbers, etc.) to names. ++Don't convert host addresses to names. This can be used to avoid ++DNS lookups. ++.TP ++.B \-nn ++Don't convert protocol and port numbers etc. to names either. + .TP + .B \-N + Don't print domain name qualification of host names. +-- +2.9.3 + diff --git a/SOURCES/0009-Change-n-flag-to-nn-in-TESTonce.patch b/SOURCES/0009-Change-n-flag-to-nn-in-TESTonce.patch new file mode 100644 index 0000000..659b7d1 --- /dev/null +++ b/SOURCES/0009-Change-n-flag-to-nn-in-TESTonce.patch @@ -0,0 +1,13 @@ +diff --git a/tests/TESTrun b/tests/TESTrun +index b423627..aa3c97d 100755 +--- a/tests/TESTrun ++++ b/tests/TESTrun +@@ -102,7 +102,7 @@ sub runtest { + # + # Furthermore, on Windows, fc can't read the standard input, so we + # can't do it as a pipeline in any case. +- $r = system "$TCPDUMP -# -n -r $input $options >tests/NEW/${outputbase} 2>${rawstderrlog}"; ++ $r = system "$TCPDUMP -# -nn -r $input $options >tests/NEW/${outputbase} 2>${rawstderrlog}"; + if($r != 0) { + # + # Something other than "tcpdump opened the file, read it, and diff --git a/SOURCES/0010-pgm-fix-the-way-we-step-through-the-packet.patch b/SOURCES/0010-pgm-fix-the-way-we-step-through-the-packet.patch new file mode 100644 index 0000000..58584b0 --- /dev/null +++ b/SOURCES/0010-pgm-fix-the-way-we-step-through-the-packet.patch @@ -0,0 +1,154 @@ +From 9ce43fa1e06b1ac2ddf1630a0e90337136ea27c5 Mon Sep 17 00:00:00 2001 +From: Guy Harris +Date: Mon, 21 Aug 2023 23:15:14 -0700 +Subject: [PATCH] pgm: fix the way we step through the packet. + +Step past the PGM header after we finish processing it and before we +process the message-type-specific header. + +Step past the message-type-specific fixed-length header before we +process the stuff after that header. + +This makes the code a bit clearer (by explicitly advancing bp by the +size of the stuff we just processed, rather than doing so by trickery +involving adding 1 to a pointer to a structure), and fixes the +processing of message types that don't have a message-type-specific +header (where we weren't stepping past the PGM header). It also affects +the way we handle messages of an unknown type. + +(cherry picked from commit 9a3eebde95cf1032ac68ae4312e2db14bb1fe58d) +--- + print-pgm.c | 29 +++++++++++++++-------------- + tests/pgm_opts_asan.out | 2 +- + tests/pgm_opts_asan_2.out | 2 +- + tests/pgm_opts_asan_3.out | 2 +- + 4 files changed, 18 insertions(+), 17 deletions(-) + +diff --git a/print-pgm.c b/print-pgm.c +index ccb0b46a..8a7e215b 100644 +--- a/print-pgm.c ++++ b/print-pgm.c +@@ -220,13 +220,14 @@ pgm_print(netdissect_options *ndo, + pgm->pgm_gsid[3], + pgm->pgm_gsid[4], + pgm->pgm_gsid[5]); ++ bp += sizeof(struct pgm_header); + switch (pgm_type_val) { + case PGM_SPM: { + const struct pgm_spm *spm; + +- spm = (const struct pgm_spm *)(pgm + 1); ++ spm = (const struct pgm_spm *)bp; + ND_TCHECK_SIZE(spm); +- bp = (const u_char *) (spm + 1); ++ bp += sizeof(struct pgm_spm); + + switch (GET_BE_U_2(spm->pgms_nla_afi)) { + case AFNUM_INET: +@@ -256,9 +257,9 @@ pgm_print(netdissect_options *ndo, + const struct pgm_poll *pgm_poll; + uint32_t ivl, rnd, mask; + +- pgm_poll = (const struct pgm_poll *)(pgm + 1); ++ pgm_poll = (const struct pgm_poll *)bp; + ND_TCHECK_SIZE(pgm_poll); +- bp = (const u_char *) (pgm_poll + 1); ++ bp += sizeof(struct pgm_poll); + + switch (GET_BE_U_2(pgm_poll->pgmp_nla_afi)) { + case AFNUM_INET: +@@ -294,35 +295,35 @@ pgm_print(netdissect_options *ndo, + case PGM_POLR: { + const struct pgm_polr *polr_msg; + +- polr_msg = (const struct pgm_polr *)(pgm + 1); ++ polr_msg = (const struct pgm_polr *)bp; + ND_TCHECK_SIZE(polr_msg); + ND_PRINT("POLR seq %u round %u", + GET_BE_U_4(polr_msg->pgmp_seq), + GET_BE_U_2(polr_msg->pgmp_round)); +- bp = (const u_char *) (polr_msg + 1); ++ bp += sizeof(struct pgm_polr); + break; + } + case PGM_ODATA: { + const struct pgm_data *odata; + +- odata = (const struct pgm_data *)(pgm + 1); ++ odata = (const struct pgm_data *)bp; + ND_TCHECK_SIZE(odata); + ND_PRINT("ODATA trail %u seq %u", + GET_BE_U_4(odata->pgmd_trailseq), + GET_BE_U_4(odata->pgmd_seq)); +- bp = (const u_char *) (odata + 1); ++ bp += sizeof(struct pgm_data); + break; + } + + case PGM_RDATA: { + const struct pgm_data *rdata; + +- rdata = (const struct pgm_data *)(pgm + 1); ++ rdata = (const struct pgm_data *)bp; + ND_TCHECK_SIZE(rdata); + ND_PRINT("RDATA trail %u seq %u", + GET_BE_U_4(rdata->pgmd_trailseq), + GET_BE_U_4(rdata->pgmd_seq)); +- bp = (const u_char *) (rdata + 1); ++ bp += sizeof(struct pgm_data); + break; + } + +@@ -332,9 +333,9 @@ pgm_print(netdissect_options *ndo, + const struct pgm_nak *nak; + char source_buf[INET6_ADDRSTRLEN], group_buf[INET6_ADDRSTRLEN]; + +- nak = (const struct pgm_nak *)(pgm + 1); ++ nak = (const struct pgm_nak *)bp; + ND_TCHECK_SIZE(nak); +- bp = (const u_char *) (nak + 1); ++ bp += sizeof(struct pgm_nak); + + /* + * Skip past the source, saving info along the way +@@ -401,11 +402,11 @@ pgm_print(netdissect_options *ndo, + case PGM_ACK: { + const struct pgm_ack *ack; + +- ack = (const struct pgm_ack *)(pgm + 1); ++ ack = (const struct pgm_ack *)bp; + ND_TCHECK_SIZE(ack); + ND_PRINT("ACK seq %u", + GET_BE_U_4(ack->pgma_rx_max_seq)); +- bp = (const u_char *) (ack + 1); ++ bp += sizeof(struct pgm_ack); + break; + } + +diff --git a/tests/pgm_opts_asan.out b/tests/pgm_opts_asan.out +index 6cc9b065..7527bda3 100644 +--- a/tests/pgm_opts_asan.out ++++ b/tests/pgm_opts_asan.out +@@ -1,2 +1,2 @@ + 1 00:04:16.587271427 IP (tos 0x41,ECT(1), id 0, offset 0, flags [none], proto PGM (113), length 32639, options (unknown 89 [bad length 232]), bad cksum 5959 (->9eb9)!) +- 128.121.89.107 > 89.89.16.63: 128.121.89.107.4 > 89.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f OPTS LEN 225 OPT_1F [13] OPT_06 [26] PATH_NLA [4] [|pgm] ++ 128.121.89.107 > 89.89.16.63: 128.121.89.107.4 > 89.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f[Bad OPT_LENGTH option, length 0 != 4] +diff --git a/tests/pgm_opts_asan_2.out b/tests/pgm_opts_asan_2.out +index 1785a571..53830c85 100644 +--- a/tests/pgm_opts_asan_2.out ++++ b/tests/pgm_opts_asan_2.out +@@ -1,2 +1,2 @@ + 1 00:04:16.587271427 IP (tos 0x41,ECT(1), id 0, offset 0, flags [none], proto PGM (113), length 32639, options (unknown 89 [bad length 232]), bad cksum 5959 (->96b9)!) +- 128.121.89.107 > 89.89.16.63: 128.121.89.107.4 > 89.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f OPTS LEN 225 OPT_1F [13] OPT_06 [26] [Bad OPT_PGMCC_DATA option, length 4 < 12] ++ 128.121.89.107 > 89.89.16.63: 128.121.89.107.4 > 89.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f[Bad OPT_LENGTH option, length 0 != 4] +diff --git a/tests/pgm_opts_asan_3.out b/tests/pgm_opts_asan_3.out +index 2e35f2fa..b8864e29 100644 +--- a/tests/pgm_opts_asan_3.out ++++ b/tests/pgm_opts_asan_3.out +@@ -1,2 +1,2 @@ + 1 00:04:16.587271427 IP (tos 0x41,ECT(1), id 0, offset 0, flags [none], proto PGM (113), length 32639, options (unknown 89 [bad length 232]), bad cksum 5959 (->f814)!) +- 128.121.89.16 > 0.89.16.63: 128.121.89.16.4 > 0.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f OPTS LEN 225 OPT_1F [13] OPT_06 [26] [Bad OPT_REDIRECT option, length 4 < 8] ++ 128.121.89.16 > 0.89.16.63: 128.121.89.16.4 > 0.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f[Bad OPT_LENGTH option, length 0 != 4] +-- +2.41.0 + diff --git a/SOURCES/0011-pgm-don-t-advance-bp-by-the-option-haeder-length-twi.patch b/SOURCES/0011-pgm-don-t-advance-bp-by-the-option-haeder-length-twi.patch new file mode 100644 index 0000000..a0e379b --- /dev/null +++ b/SOURCES/0011-pgm-don-t-advance-bp-by-the-option-haeder-length-twi.patch @@ -0,0 +1,48 @@ +From 627a1b7fdceaad8745c438bb0037e59689a1f0df Mon Sep 17 00:00:00 2001 +From: Guy Harris +Date: Tue, 22 Aug 2023 12:23:20 -0700 +Subject: [PATCH] pgm: don't advance bp by the option haeder length twice. + +At those points, we've already advanced it by the option header length, +and opt_len includes that length, so advance bp by opt_len minus the +option header length. + +(cherry picked from commit 09b0447fad52298440e05e7368f9d24492d0b0fe) +--- + print-pgm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/print-pgm.c b/print-pgm.c +index 8a7e215b..1e67db77 100644 +--- a/print-pgm.c ++++ b/print-pgm.c +@@ -661,7 +661,7 @@ pgm_print(netdissect_options *ndo, + + case PGM_OPT_PATH_NLA: + ND_PRINT(" PATH_NLA [%u]", opt_len); +- bp += opt_len; ++ bp += opt_len - 2; + opts_len -= opt_len; + break; + +@@ -703,7 +703,7 @@ pgm_print(netdissect_options *ndo, + + case PGM_OPT_CR: + ND_PRINT(" CR"); +- bp += opt_len; ++ bp += opt_len - 2; + opts_len -= opt_len; + break; + +@@ -807,7 +807,7 @@ pgm_print(netdissect_options *ndo, + + default: + ND_PRINT(" OPT_%02X [%u] ", opt_type, opt_len); +- bp += opt_len; ++ bp += opt_len - 2; + opts_len -= opt_len; + break; + } +-- +2.41.0 + diff --git a/SOURCES/0012-CVE-2024-2397.patch b/SOURCES/0012-CVE-2024-2397.patch new file mode 100644 index 0000000..437cae5 --- /dev/null +++ b/SOURCES/0012-CVE-2024-2397.patch @@ -0,0 +1,122 @@ +From b9811ef5bb1b7d45a90e042f81f3aaf233c8bcb2 Mon Sep 17 00:00:00 2001 +From: Guy Harris +Date: Tue, 12 Mar 2024 00:37:23 -0700 +Subject: [PATCH] ppp: use the buffer stack for the de-escaping buffer. + +This both saves the buffer for freeing later and saves the packet +pointer and snapend to be restored when packet processing is complete, +even if an exception is thrown with longjmp. + +This means that the hex/ASCII printing in pretty_print_packet() +processes the packet data as captured or read from the savefile, rather +than as modified by the PPP printer, so that the bounds checking is +correct. + +That fixes CVE-2024-2397, which was caused by an exception being thrown +by the hex/ASCII printer (which should only happen if those routines are +called by a packet printer, not if they're called for the -X/-x/-A +flag), which jumps back to the setjmp() that surrounds the packet +printer. Hilarity^Winfinite looping ensues. + +Also, restore ndo->ndo_packetp before calling the hex/ASCII printing +routine, in case nd_pop_all_packet_info() didn't restore it. +--- + print-ppp.c | 31 +++++++++++++++++-------------- + print.c | 8 ++++++-- + 2 files changed, 23 insertions(+), 16 deletions(-) + +diff --git a/print-ppp.c b/print-ppp.c +index 2cf06c363..9aed23eb9 100644 +--- a/print-ppp.c ++++ b/print-ppp.c +@@ -37,6 +37,8 @@ + + #include "netdissect-stdinc.h" + ++#include ++ + #ifdef __bsdi__ + #include + #include +@@ -1358,7 +1360,6 @@ ppp_hdlc(netdissect_options *ndo, + u_char *b, *t, c; + const u_char *s; + u_int i, proto; +- const void *sb, *se; + + if (caplen == 0) + return; +@@ -1366,9 +1367,11 @@ ppp_hdlc(netdissect_options *ndo, + if (length == 0) + return; + +- b = (u_char *)nd_malloc(ndo, caplen); +- if (b == NULL) +- return; ++ b = (u_char *)malloc(caplen); ++ if (b == NULL) { ++ (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, ++ "%s: malloc", __func__); ++ } + + /* + * Unescape all the data into a temporary, private, buffer. +@@ -1389,13 +1392,15 @@ ppp_hdlc(netdissect_options *ndo, + } + + /* +- * Change the end pointer, so bounds checks work. +- * Change the pointer to packet data to help debugging. ++ * Switch to the output buffer for dissection, and save it ++ * on the buffer stack so it can be freed; our caller must ++ * pop it when done. + */ +- sb = ndo->ndo_packetp; +- se = ndo->ndo_snapend; +- ndo->ndo_packetp = b; +- ndo->ndo_snapend = t; ++ if (!nd_push_buffer(ndo, b, b, (u_int)(t - b))) { ++ free(b); ++ (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, ++ "%s: can't push buffer on buffer stack", __func__); ++ } + length = ND_BYTES_AVAILABLE_AFTER(b); + + /* now lets guess about the payload codepoint format */ +@@ -1437,13 +1442,11 @@ ppp_hdlc(netdissect_options *ndo, + } + + cleanup: +- ndo->ndo_packetp = sb; +- ndo->ndo_snapend = se; ++ nd_pop_packet_info(ndo); + return; + + trunc: +- ndo->ndo_packetp = sb; +- ndo->ndo_snapend = se; ++ nd_pop_packet_info(ndo); + nd_print_trunc(ndo); + } + +diff --git a/print.c b/print.c +index b9ba5997d..f20633388 100644 +--- a/print.c ++++ b/print.c +@@ -431,10 +431,14 @@ pretty_print_packet(netdissect_options *ndo, const struct pcap_pkthdr *h, + nd_pop_all_packet_info(ndo); + + /* +- * Restore the original snapend, as a printer might have +- * changed it. ++ * Restore the originals snapend and packetp, as a printer ++ * might have changed them. ++ * ++ * XXX - nd_pop_all_packet_info() should have restored the ++ * original values, but, just in case.... + */ + ndo->ndo_snapend = sp + h->caplen; ++ ndo->ndo_packetp = sp; + if (ndo->ndo_Xflag) { + /* + * Print the raw packet data in hex and ASCII. diff --git a/SOURCES/tcpdump-sysusers.conf b/SOURCES/tcpdump-sysusers.conf new file mode 100644 index 0000000..a8018e1 --- /dev/null +++ b/SOURCES/tcpdump-sysusers.conf @@ -0,0 +1,2 @@ +#Type Name ID GECOS Home directory Shell +u tcpdump 72 "tcpdump" - - diff --git a/SPECS/tcpdump.spec b/SPECS/tcpdump.spec new file mode 100644 index 0000000..84949ba --- /dev/null +++ b/SPECS/tcpdump.spec @@ -0,0 +1,800 @@ +%define tcpslice_dir tcpslice-1.7 + +Summary: A network traffic monitoring tool +Name: tcpdump +Epoch: 14 +Version: 4.99.4 +Release: 9%{?dist} +License: BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND BSD-4-Clause-UC AND ISC AND NTP +URL: http://www.tcpdump.org +Requires(pre): shadow-utils +BuildRequires: make +BuildRequires: automake openssl-devel libpcap-devel git-core gcc +BuildRequires: systemd-rpm-macros + +Source0: http://www.tcpdump.org/release/tcpdump-%{version}.tar.gz +Source1: ftp://ftp.ee.lbl.gov/%{tcpslice_dir}.tar.gz +Source2: http://www.tcpdump.org/release/tcpdump-%{version}.tar.gz.sig +Source3: tcpdump-sysusers.conf + +Patch0002: 0002-Use-getnameinfo-instead-of-gethostbyaddr.patch +Patch0003: 0003-Drop-root-priviledges-before-opening-first-savefile-.patch +Patch0007: 0007-Introduce-nn-option.patch +Patch0009: 0009-Change-n-flag-to-nn-in-TESTonce.patch +Patch0010: 0010-pgm-fix-the-way-we-step-through-the-packet.patch +Patch0011: 0011-pgm-don-t-advance-bp-by-the-option-haeder-length-twi.patch +Patch0012: 0012-CVE-2024-2397.patch + +%description +Tcpdump is a command-line tool for monitoring network traffic. +Tcpdump can capture and display the packet headers on a particular +network interface or on all interfaces. Tcpdump can display all of +the packet headers, or just the ones that match particular criteria. + +Install tcpdump if you need a program to monitor network traffic. + +%prep +%autosetup -a 1 -S git + +%build +export CFLAGS="$RPM_OPT_FLAGS $(getconf LFS_CFLAGS) -fno-strict-aliasing -DGUESS_TSO" + +pushd %{tcpslice_dir} +# update config.{guess,sub} +automake -a -f 2> /dev/null || : +./autogen.sh +%configure +%{make_build} +popd + +%configure --with-crypto --with-user=tcpdump --without-smi +%{make_build} + +%check +make check + +%install +mkdir -p ${RPM_BUILD_ROOT}%{_libdir} +mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/man8 +mkdir -p ${RPM_BUILD_ROOT}%{_sbindir} + +pushd %{tcpslice_dir} +install -m755 tcpslice ${RPM_BUILD_ROOT}%{_sbindir} +install -m644 tcpslice.1 ${RPM_BUILD_ROOT}%{_mandir}/man8/tcpslice.8 +popd + +install -m755 tcpdump ${RPM_BUILD_ROOT}%{_sbindir} +install -m644 tcpdump.1 ${RPM_BUILD_ROOT}%{_mandir}/man8/tcpdump.8 + +install -p -D -m 0644 %{SOURCE3} ${RPM_BUILD_ROOT}%{_sysusersdir}/tcpdump.conf + +# fix section numbers +sed -i 's/\(\.TH[a-zA-Z ]*\)[1-9]\(.*\)/\18\2/' \ + ${RPM_BUILD_ROOT}%{_mandir}/man8/* + +%pre +%sysusers_create_compat %{SOURCE3} +exit 0 + +%files +%license LICENSE +%doc README.md CHANGES CREDITS +%{_sbindir}/tcpdump +%{_sbindir}/tcpslice +%{_sysusersdir}/tcpdump.conf +%{_mandir}/man8/tcpslice.8* +%{_mandir}/man8/tcpdump.8* + +%changelog +* Mon Jun 24 2024 Troy Dawson - 14:4.99.4-9 +- Bump release for June 2024 mass rebuild + +* Tue Apr 16 2024 Michal Ruprich - 14:4.99.4-8 +- Fixing gating.yaml for RHEL10 +- Adding rpminspect.yaml + +* Mon Apr 15 2024 Michal Ruprich - 14:4.99.4-7 +- Resolves: RHEL-32708 - Crafted .pcap file may lead to Denial of Service + +* Mon Feb 12 2024 Michal Ruprich - 14:4.99.4-6 +- New version of tcpslice, 1.7 (rhbz #2263644) + +* Sat Jan 27 2024 Fedora Release Engineering - 14:4.99.4-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Nov 02 2023 Pavol Žáčik - 14:4.99.4-4 +- Fix PGM option printing + +* Mon Aug 21 2023 Michal Ruprich - 14:4.99.4-3 +- Enabling BIG TCP packets in tcpdump + +* Sat Jul 22 2023 Fedora Release Engineering - 14:4.99.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed Apr 12 2023 Michal Ruprich - 14:4.99.4-1 +- New version 4.99.4 + +* Wed Mar 22 2023 Michal Ruprich - 14:4.99.3-3 +- SPDX migration + +* Sat Jan 21 2023 Fedora Release Engineering - 14:4.99.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Wed Jan 18 2023 Michal Ruprich - 14:4.99.3-1 +- New version 4.99.3 + +* Tue Jan 03 2023 Michal Ruprich - 14:4.99.2-1 +- New version 4.99.2 + +* Wed Aug 03 2022 Luca BRUNO - 14:4.99.1-8 +- Simplify sysusers.d configuration fragment + +* Sat Jul 23 2022 Fedora Release Engineering - 14:4.99.1-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Tue Jun 14 2022 Michal Ruprich - 14:4.99.1-6 +- Using systemd-sysusers + +* Sat Jan 22 2022 Fedora Release Engineering - 14:4.99.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Jan 12 2022 Michal Ruprich - 14:4.99.1-4 +- New version of tcpslice-1.5 + +* Tue Sep 14 2021 Sahana Prasad - 14:4.99.1-3 +- Rebuilt with OpenSSL 3.0.0 + +* Fri Jul 23 2021 Fedora Release Engineering - 14:4.99.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Tue Jun 15 2021 Michal Ruprich - 14:4.99.1-1 +- New versiom 4.99.1 + +* Mon Mar 15 2021 Michal Ruprich - 14:4.99.0-3 +- Testing gating + +* Fri Mar 12 2021 Michal Ruprich - 14:4.99.0-2 +- New version of tcpslice-1.3 + +* Thu Feb 11 2021 Michal Ruprich - 14:4.99.0-1 +- New version 4.99.0 + +* Wed Jan 27 2021 Fedora Release Engineering - 14:4.9.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Thu Nov 26 2020 Michal Ruprich - 14:4.9.3-6 +- Fix for CVE-2020-8037 + +* Thu Nov 19 2020 Michal Ruprich - 14:4.9.3-5 +- Use make macros +- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + +* Wed Jul 29 2020 Fedora Release Engineering - 14:4.9.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Thu Jul 16 2020 Michal Ruprich - 14:4.9.3-3 +- Fixing a -G option bug in one of our patches + +* Fri Jan 31 2020 Fedora Release Engineering - 14:4.9.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Tue Oct 15 2019 Michal Ruprich - 14:4.9.3-1 +- New version 4.9.3 +- Fixes CVE-2017-16808, CVE-2018-14468, CVE-2018-14469, CVE-2018-14470, CVE-2018-14466, CVE-2018-14461, CVE-2018-14462, CVE-2018-14465, CVE-2018-14881, CVE-2018-14464, CVE-2018-14463, CVE-2018-14467, CVE-2018-10103, CVE-2018-10105, CVE-2018-14880, CVE-2018-16451, CVE-2018-14882, CVE-2018-16227, CVE-2018-16229, CVE-2018-16301, CVE-2018-16230, CVE-2018-16452, CVE-2018-16300, CVE-2018-16228, CVE-2019-15166, CVE-2019-15167 + +* Mon Sep 16 2019 Michal Ruprich - 14:4.9.2-9 +- Adding getent to pre scriptlet to avoid audit messages (rhbz#1715420) + +* Sat Jul 27 2019 Fedora Release Engineering - 14:4.9.2-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Sun Feb 03 2019 Fedora Release Engineering - 14:4.9.2-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Sat Jul 14 2018 Fedora Release Engineering - 14:4.9.2-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Thu Jun 21 2018 Michal Ruprich - 14:4.9.2-5 +- Removing sharutils from build-time dependencies +- Changing git dependency to smaller git-core + +* Thu May 10 2018 Michal Ruprich - 14:4.9.2-4 +- Enabling upstream tests +- Adding VSOCK support + +* Tue Feb 20 2018 Martin Sehnoutka - 14:4.9.2-3 +- Add gcc to BuildRequires + +* Fri Feb 09 2018 Fedora Release Engineering - 14:4.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Tue Sep 05 2017 Martin Sehnoutka - 14:4.9.2-1 +- New upstream release 4.9.2 + +* Thu Aug 03 2017 Fedora Release Engineering - 14:4.9.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Mon Jul 31 2017 Florian Weimer - 14:4.9.1-2 +- Rebuild with binutils fix for ppc64le (#1475636) + +* Wed Jul 26 2017 Martin Sehnoutka - 14:4.9.1-1 +- New upstream release 4.9.1 + +* Sat Feb 11 2017 Fedora Release Engineering - 14:4.9.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Fri Feb 03 2017 Martin Sehnoutka - 14:4.9.0-1 +- New upstream version 4.9.0 + +* Mon Oct 31 2016 Luboš Uhliarik - 14:4.8.1-1 +- new version 4.8.1 + +* Tue Aug 09 2016 Luboš Uhliarik - 14:4.8.0-1 +- new version 4.8.0 + +* Fri Feb 05 2016 Fedora Release Engineering - 14:4.7.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Mon Jun 29 2015 Michal Sekletar - 14:4.7.4-3 +- prevent sefaulting by properly initializing chown_flag variable (#1223329) + +* Fri Jun 19 2015 Fedora Release Engineering - 14:4.7.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Tue May 5 2015 Michal Sekletar - 14:4.7.4-1 +- rebase to 4.7.4 (#1214753) + +* Wed Mar 25 2015 Michal Sekletar - 14:4.7.3-1 +- rebase to 4.7.3 (#1201573) +- contains fixes for CVE-2015-0261 CVE-2015-2154 CVE-2015-2153 CVE-2015-2155 (#1201799,#1201792,#1201795,#1201797) + +* Wed Dec 03 2014 Michal Sekletar - 14:4.6.2-3 +- fix for CVE-2014-9140 + +* Thu Nov 20 2014 Michal Sekletar - 14:4.6.2-2 +- fix for CVE-2014-8767 (#1165160) +- fix for CVE-2014-8768 (#1165161) +- fix for CVE-2014-8769 (#1165162) + +* Mon Oct 20 2014 Michal Sekletar - 14:4.6.2-1 +- update to 4.6.2 (#1124289) + +* Mon Aug 18 2014 Fedora Release Engineering - 14:4.5.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Sun Jun 08 2014 Fedora Release Engineering - 14:4.5.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Thu Nov 28 2013 Michal Sekletar - 14:4.5.1-1 +- update to 4.5.1 + +* Fri Nov 08 2013 Michal Sekletar - 14:4.5.0-1.20131108gitb07944a +- update to snaphot gitb07944a + +* Mon Oct 7 2013 Michal Sekletar - 14:4.4.0-3 +- don't try to change ownership of stdout (#1015767) + +* Sun Aug 04 2013 Fedora Release Engineering - 14:4.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Thu Jun 06 2013 Michal Sekletar - 14:4.4.0-1 +- update to 4.4.0 + +* Fri Feb 15 2013 Fedora Release Engineering - 14:4.3.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Sat Jul 21 2012 Fedora Release Engineering - 14:4.3.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Wed Jun 13 2012 Michal Sekletar - 14:4.3.0-1 +- Update to 4.3.0 + +* Wed May 16 2012 Michal Sekletar +- Resolves: #809638 +- created savefile has proper owner + +* Sat Jan 14 2012 Fedora Release Engineering - 14:4.2.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Tue Jan 03 2012 Jan Synáček - 14:4.2.1-1 +- Update to 4.2.1 +- Remove ppi.h from sources (readded again in upstream tarball) + +* Fri Dec 02 2011 Michal Sekletar - 14:4.2.0-1 +- updated to 4.2.0 +- added new source file ppi.h, missing in upstream tarball +- disabled make check because of missing .pcap files in testsuite +- dropped unnecessary patches + +* Wed Aug 24 2011 Michal Sekletar - 14:4.1.1-3 +- Fix manpage (#663739) +- Fix improper handling of bad date format in tcpslice (#684005) +- Spec file clean up + +* Wed Feb 09 2011 Fedora Release Engineering - 14:4.1.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Tue Apr 06 2010 Miroslav Lichvar - 14:4.1.1-1 +- update to 4.1.1 +- add %%check + +* Wed Sep 23 2009 Miroslav Lichvar - 14:4.0.0-3.20090921gitdf3cb4 +- update to snapshot 20090921gitdf3cb4 + +* Fri Aug 21 2009 Tomas Mraz - 14:4.0.0-2.20090818git832d2c +- rebuilt with new openssl + +* Thu Aug 20 2009 Miroslav Lichvar - 14:4.0.0-1.20090818git832d2c +- update to post 4.0.0 git snapshot 20090818git832d2c +- print retrans and reachable times in ICMPv6 as milliseconds (#474264) + +* Sun Jul 26 2009 Fedora Release Engineering - 14:3.9.8-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Wed Feb 25 2009 Fedora Release Engineering - 14:3.9.8-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Tue Jan 20 2009 Miroslav Lichvar - 14:3.9.8-7 +- rebuild for new openssl +- convert CREDITS to UTF-8 (#226481) + +* Fri Aug 29 2008 Miroslav Lichvar - 14:3.9.8-6 +- rediff patches with fuzz +- add -fno-strict-aliasing to CFLAGS + +* Mon Jun 02 2008 Miroslav Lichvar - 14:3.9.8-5 +- update config.{guess,sub} when building tcpslice +- remove -D_GNU_SOURCE from CFLAGS +- disable libsmi check in configure + +* Wed Feb 13 2008 Miroslav Lichvar - 14:3.9.8-4 +- fix building with new glibc headers + +* Thu Dec 06 2007 Miroslav Lichvar - 14:3.9.8-3 +- update IKEv2 support + +* Thu Dec 6 2007 Jeremy Katz - 14:3.9.8-2 +- rebuild for new openssl + +* Wed Oct 24 2007 Miroslav Lichvar - 14:3.9.8-1 +- update to 3.9.8 +- don't use gethostbyaddr +- fix default user in man page + +* Tue Sep 18 2007 Miroslav Lichvar - 14:3.9.7-5 +- support decoding IKEv2 packets + +* Wed Aug 22 2007 Miroslav Lichvar - 14:3.9.7-4 +- rebuild + +* Thu Aug 09 2007 Miroslav Lichvar - 14:3.9.7-3 +- enable crypto support on 64-bit architectures +- update license tag + +* Wed Jul 25 2007 Jeremy Katz - 14:3.9.7-2 +- rebuild for toolchain bug + +* Tue Jul 24 2007 Miroslav Lichvar - 14:3.9.7-1 +- update to 3.9.7 +- with -C option, drop root privileges before opening first savefile (#244860) +- update tcpslice to 1.2a3 +- include time patch from Debian to fix tcpslice on 64-bit architectures + +* Thu Mar 15 2007 Miroslav Lichvar - 14:3.9.5-3 +- fix buffer overflow in 802.11 printer (#232349, CVE-2007-1218) +- spec cleanup (#226481) + +* Tue Dec 12 2006 Miroslav Lichvar - 14:3.9.5-2 +- use tcpdump user, fix scriptlet (#219268) + +* Wed Nov 29 2006 Miroslav Lichvar - 14:3.9.5-1 +- split off libpcap and arpwatch (#193657) +- update to 3.9.5 +- force linking with system libpcap + +* Fri Nov 17 2006 Miroslav Lichvar - 14:3.9.4-9 +- fix processing of Prism and AVS headers (#206686) +- fix arp2ethers script +- update ethercodes.dat +- move pcap man page to devel package + +* Wed Jul 12 2006 Jesse Keating - 14:3.9.4-8.1 +- rebuild + +* Thu Jun 22 2006 Martin Stransky - 14:3.9.4-8 +- more ipv6 flags + +* Sun Jun 4 2006 Jeremy Katz - 14:3.9.4-7 +- fix libpcap-devel inclusion of .so and its deps (#193189) + +* Thu Jun 1 2006 Martin Stransky - 14:3.9.4-6 +- added release to arpwatch package name + +* Wed May 31 2006 Martin Stransky - 14:3.9.4-5 +- removed libpcap-devel dependency from libpcap + +* Mon May 29 2006 Martin Stransky - 14:3.9.4-4 +- added libpcap-devel package (#193189) + +* Tue Mar 28 2006 Martin Stransky - 14:3.9.4-3 +- updated ethernet codes (#186633) + +* Fri Feb 10 2006 Jesse Keating - 14:3.9.4-2.2 +- bump again for double-long bug on ppc(64) + +* Tue Feb 07 2006 Jesse Keating - 14:3.9.4-2.1 +- rebuilt for new gcc4.1 snapshot and glibc changes + +* Tue Dec 20 2005 Martin Stransky - 14:3.9.4-2 +- fix for #176010 - file owner problem when using 'ring buffer + +* Fri Dec 09 2005 Jesse Keating +- rebuilt + +* Thu Nov 10 2005 Martin Stransky - 14:3.9.4-1 +- new upstream + +* Thu Nov 10 2005 Tomas Mraz - 14:3.9.3-5 +- rebuilt against new openssl + +* Wed Nov 9 2005 Martin Stransky - 14:3.9.3-4 +- rebuilt + +* Tue Aug 9 2005 Jeremy Katz - 14:3.9.3-3 +- remove explicit kernel dep for libpcap too + +* Tue Jul 26 2005 Martin Stransky - 14:3.9.3-2 +- fixed typo in last patch + +* Tue Jul 26 2005 Martin Stransky - 14:3.9.3-1 +- New upstream version - 3.9.3 +- fix for #164227 (buffer overflow) +- fix for #164230 (missing debug info) + +* Thu Jul 14 2005 Martin Stransky - 14:3.9.1-1 +- New upstream version + +* Tue Jun 21 2005 Martin Stransky - 14:3.8.2-14 +- add shadow-utils to Prereq (#160643) + +* Tue Jun 7 2005 Martin Stransky - 14:3.8.2-13 +- fix for CAN-2005-1267 - BGP DoS, #159209 + +* Thu Apr 28 2005 Martin Stransky - 14:3.8.2-12 +- fix for CAN-2005-1280 Multiple DoS issues in tcpdump + (CAN-2005-1279 CAN-2005-1278), #156041 + +* Mon Mar 7 2005 Martin Stransky +- rebuilt + +* Mon Feb 14 2005 Martin Stransky - 14:3.8.2-10 +- remove explicit kernel dependecy (#146165) +- support for files larger than 2GB (#147840) + +* Fri Feb 11 2005 Ivana Varekova - 14:3.8.2-9 +- added arpsnmp options to specify sender and recipient + and corrected arpwatch and arpsnmp man pages (#70386) + +* Thu Feb 10 2005 Ivana Varekova - 14:3.8.2-8 +- rebuilt + +* Tue Oct 12 2004 Harald Hoyer - 14:3.8.2-7 +- fixed nfs protocol parsing for 64 bit architectures (bug 132781) + +* Wed Sep 15 2004 Harald Hoyer - 14:3.8.2-6 +- added libpcap-0.8.3-ppp.patch for ppp (bug 128053) + +* Wed Jun 23 2004 Elliot Lee +- added flex to BuildRequires + +* Tue Jun 15 2004 Elliot Lee +- rebuilt + +* Sun May 30 2004 Florian La Roche +- simplify rpm scripts + +* Tue Apr 6 2004 Harald Hoyer - 14:3.8.2-3 +- added LICENSE files + +* Wed Mar 31 2004 Harald Hoyer - 14:3.8.2-2 +- update to libpcap-0.8.3 (tcpdump-3.8.3 seems to be older that 3.8.2!!) + +* Tue Mar 30 2004 Harald Hoyer - 14:3.8.2-1 +- update to tcpdump-3.8.2, libpcap-0.8.2, arpwatch-2.1a13 +- patched tcpdump configure for gcc34 optimizations +- removed obsolete patches + +* Tue Mar 02 2004 Elliot Lee +- rebuilt + +* Fri Feb 13 2004 Elliot Lee +- rebuilt + +* Fri Jan 23 2004 Harald Hoyer 14:3.8.1-4/17 +- fixed arpwatch version +- fixed libpcap library version +- fixed tcpdump droproot + +* Tue Jan 20 2004 Harald Hoyer 14:3.8.1-3 +- corrected tcpslice (bpf.h issue) + +* Tue Jan 13 2004 Harald Hoyer 14:3.8.1-2 +- more security issues (patch 18) + +* Fri Jan 09 2004 Phil Knirsch 14:3.8.1-1 +- Updated to latest version because of security issue + +* Fri Aug 29 2003 Harald Hoyer 14:3.7.2-7 +- build libpcap shared library with gcc and not ld + +* Tue Jul 22 2003 Phil Knirsch 14:3.7.2-6.1 +- rebuilt + +* Mon Jul 21 2003 Phil Knirsch 14:3.7.2-6 +- rebuilt + +* Wed Jun 04 2003 Elliot Lee +- rebuilt + +* Wed May 21 2003 Harald Hoyer 14:3.7.2-5 +- add proper attributes for arp.dat, ethercodes + +* Tue May 20 2003 Harald Hoyer 14:3.7.2-4 +- take ethercodes.dat from the arpwatch package now + +* Tue May 6 2003 Harald Hoyer 14:3.7.2-3 +- compile tcpdump with autoheader #90208 + +* Thu May 1 2003 Elliot Lee 14:3.7.2-2 +- Add sctpdef patch to fix ppc64 builds + +* Thu Feb 27 2003 Phil Knirsch 14:3.7.2-1 +- Update to upstream version 3.7.2 + +* Sat Feb 01 2003 Florian La Roche +- sanitized rpm scripts + +* Wed Jan 22 2003 Tim Powers 12:3.6.3-20 +- rebuilt + +* Tue Jan 7 2003 Nalin Dahyabhai 12:3.6.3-19/0.6.2-19/2.1a11-19 +- rebuild + +* Sat Jan 4 2003 Jeff Johnson 12:3.6.3-18/0.6.2-18/2.1a11-18 +- set execute bits on library so that requires are generated. + +* Wed Dec 11 2002 Harald Hoyer 12:3.6.3-17/0.6.2-17/2.1a11-17 +- common release no. across all subpackages + +* Wed Dec 11 2002 Harald Hoyer 12:3.6.3-5/0.6.2-16/2.1a11-16 +- print_bgp security fix + +* Mon Nov 18 2002 Tim Powers +- rebuild on all arches + +* Fri Aug 2 2002 Harald Hoyer 12:3.6.3-3/0.6.2-16/2.1a11-16 +- added man page descriptions for the new parameters + +* Thu Aug 1 2002 Harald Hoyer 12:3.6.3-2 +- added arpwatch options to specify sender and recipient (#70386) + +* Tue Jul 23 2002 Harald Hoyer 12:3.6.3-1 +- removed prestripping + +* Thu May 16 2002 Harald Hoyer 12:3.6.2-13 +- added official 3.6.3 fix +- fixed 6.2 compat #63113 + +* Wed Jan 23 2002 Harald Hoyer 12:3.6.2-12 +- tcpdump-3.6.2-snaplen.patch added to fix #55145 + +* Tue Dec 18 2001 Harald Hoyer 12:3.6.2-10 +- took old purge patch for filters +- fixed #54225,#58346 +- drop root by default #49635 +- fixed #54593 +- fixed #57711 + +* Fri Aug 31 2001 Harald Hoyer 12:3.6.2-9 +- took better fix for #52654 from tcpdump cvs + +* Thu Aug 30 2001 Harald Hoyer 11:3.6.2-8 +- fixed #52654 + +* Thu Jul 19 2001 Harald Hoyer 10:3.6.2-7 +- added shared library to libpcap (#47174) +- afs printing security patch (#49294) + +* Wed Jun 20 2001 Harald Hoyer +- use initgroups, instead of setgroups + +* Mon Jun 18 2001 Harald Hoyer +- added dropgroup patches (#44563) + +* Mon May 07 2001 Harald Hoyer +- switched to Pekka's tcpdump-3.6.2 package +- incremented epoch + +* Sat Apr 14 2001 Pekka Savola +- fix building of tcpslice on glibc 2.2.2 (time.h) +- disable /etc/init.d requirement and fix %%post scripts in arpwatch + +* Wed Feb 14 2001 Harald Hoyer +- glibc sys/time -> time include patch + +* Wed Feb 7 2001 Trond Eivind Glomsrød +- Add space to this check + +* Wed Feb 07 2001 Harald Hoyer +- added check for presence of /etc/sysconfig/arpwatch (#23172) + +* Wed Feb 7 2001 Pekka Savola +- update to 3.6.2, 0.6.2 and new CVS of tcpslice. +- i18n'ize arpwatch init script + +* Fri Feb 2 2001 Trond Eivind Glomsrød +- i18nize initscript + +* Mon Jan 29 2001 Harald Hoyer +- fixed EINTR stopping for e.g. SIGSTOP. (#22008) +- added -u option for tcpdump (#20231) +- new arpwatch version (#23172) +- added "all" and "one" interface for -i (#20907) +- added arpwatch sysconfig (#23172) + +* Mon Jan 22 2001 Harald Hoyer +- more (potential) overflows in libpcap. #21373 +- documentation fix for #20906 + +* Sun Jan 14 2001 Pekka Savola +- use --enable-ipv6 +- Add two patches from CVS to enhance 802.2 printing, and more importantly, + to be able to specify 'no stp' + +* Sat Jan 13 2001 Pekka Savola +- Make SMB printing output a lot more quiet unless in verbose mode. +- Make -n resolve port/protocol numbers but not hostnames, -nn for no + resolving at all +- Separate droproot patch from a more generic man/usage fix one +- Add non-promiscuous mode -by default patch, but don't apply it by default + +* Thu Jan 11 2001 Pekka Savola +- Update to tcpdump 3.6.1 and libpcap 0.6.1 releases. + +* Mon Jan 8 2001 Pekka Savola +- Update to 20010108 CVS, disable some upstreamed patches. +- Change some additional .1 pages to .8. +- Add droproot patch, some --usage and man page fixes. + +* Mon Jan 1 2001 Pekka Savola +- Initial packaging with latest tcpdump.org CVS tcpdump-3.6 and libpcap-0.6. +- add earlier print-domain.c, the latest is segfaulting +- don't unnecesessarily include snprintf.o, it didn't compile with gcc 2.96 anyway +- don't use savestr, require openssl, tweak tweak tweak +- add tcpslice, patch it a bit for egcs detection + +* Sun Dec 31 2000 Pekka Savola +- tcpdump: spice up the manpage about interfaces +- tcpdump: add 'all' and 'any' keywords to -i, saner default behaviour. +- upgrade arpwatch to 2.1a10 + +* Sun Nov 26 2000 Jeff Johnson +- more (potential) overflows in libpcap. + +* Sun Nov 12 2000 Jeff Johnson +- eliminate still more buffer overflows (from FreeBSD) (#20069). + +* Thu Nov 2 2000 Jeff Johnson +- eliminate more buffer overflows (from FreeBSD) (#20069). +- 802.1q ether type incorrect (#19850). +- add -u flag to drop arpwatch privs (#19696). + +* Sun Oct 15 2000 Jeff Johnson +- updated ethercodes.dat + +* Thu Oct 12 2000 Jeff Johnson +- fix arpwatch tmp race (#18943). + +* Fri Aug 11 2000 Bill Nottingham +- fix condrestart + +* Fri Aug 11 2000 Jeff Johnson +- correct arpsnmp man pages (#15442). +- don't print harmless ENOPROTOOPT message (#13518). + +* Fri Aug 4 2000 Jeff Johnson +- rebuild with final kernel headers (#13518). + +* Sat Jul 22 2000 Jeff Johnson +- add STP patch (#14112). + +* Fri Jul 14 2000 Matt Wilson +- source /etc/init.d/functions +- back out /etc/init.d/arpwatch, place file in /etc/rc.d +- move initscript to /etc/init.d +- changed initscript to use start() and stop() functions +- added condrestart to init script +- added %%post %%preun %%postun scripts to register arpwatch script +- added Prereq: for all things needed in post/preun/postun + +* Wed Jul 12 2000 Prospector +- automatic rebuild + +* Tue Jul 11 2000 Jeff Johnson +- updated man page and help (pekkas@netcore.fi) (#10739 et al). + +* Sun Jun 18 2000 Jeff Johnson +- FHS packaging. + +* Tue May 9 2000 Bill Nottingham +- minor tweaks for ia64 (prototypes) + +* Thu Feb 17 2000 Bernhard Rosenkraenzer +- Compile shared libpcap with -fPIC (Bug #6342) + +* Wed Feb 02 2000 Cristian Gafton +- fix descriptions +- man pages are compressed + +* Wed Dec 22 1999 Jeff Johnson +- remove sparc64 SIOCGIFNAME hack, not needed with (at least) kernel 2.2.12-40. +- upgrade to ANK ss991030 snapshot with pcap magic fix (#6773). +- add getprotobyname lookup (#6725). +- getservbyname port lookup appears functional (#7569). +- remove uid 2090 backdoor (sorry Dave) (#7116). + +* Thu Sep 09 1999 Cristian Gafton +- fox the pcap.h header + +* Fri Aug 20 1999 Jeff Johnson +- prevent segfault on obscure spoofed ip header (#4634). + +* Wed Aug 18 1999 Jeff Johnson +- add defattr to arpwatch (#4591). + +* Mon Aug 16 1999 Bill Nottingham +- initscript munging + +* Sun Aug 8 1999 Jeff Johnson +- add -DWORDS_BIGINDIAN to tcpdump compile on sparc sparc61. + +* Tue Aug 3 1999 Jeff Johnson +- include A. Kuznetsov's patches to libpcap/tcpdump. +- added arpsnmp to package (#3258). +- arp2ethers written for different of awk (#4326). + +* Sun Mar 21 1999 Cristian Gafton +- auto rebuild in the new build environment (release 10) + +* Fri Mar 19 1999 Jeff Johnson +- strip binaries. + +* Wed Jan 13 1999 Bill Nottingham +- autoconf fixes for arm + +* Tue Sep 29 1998 Jeff Johnson +- libpcap description typo. + +* Sat Sep 19 1998 Jeff Johnson +- fix arpwatch summary line. + +* Mon Aug 17 1998 Jeff Johnson +- enable arpwatch + +* Mon Aug 3 1998 Jeff Johnson +- separate package for libpcap. +- update tcpdump to 3.4, libpcap to 0.4. +- added arpwatch (but disabled for now) + +* Thu May 07 1998 Prospector System +- translations modified for de, fr, tr + +* Sat May 2 1998 Alan Cox +- Added the SACK printing fix so you can dump Linux 2.1+. + +* Tue Oct 21 1997 Erik Troan +- updated to release 3.4a5 +- uses a buildroot and %%attr + +* Thu Jul 17 1997 Erik Troan +- built against glibc