rpms
/
zeromq
21
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

update to 4.1.2 with a upstream patch to fix a problem with ipv6

Browse Source
epel9
Thomas Spura 10 years ago
parent d9734a9779
commit d930586b91
5 changed files with 54 additions and 440 deletions
Show Stats Download Patch File Download Diff File

1
.gitignore vendored
Unescape View File

@ -7,3 +7,4 @@ zeromq-2.0.7.tar.gz
/zeromq-2.1.11.tar.gz
/zeromq-2.2.0.tar.gz
/zeromq-4.0.5.tar.gz
/zeromq-4.1.2.tar.gz

2
sources
Unescape View File

@ -1 +1 @@
73c39f5eb01b9d7eaf74a5d899f1d03d zeromq-4.0.5.tar.gz
159c0c56a895472f02668e692d122685 zeromq-4.1.2.tar.gz

430
zeromq-4.0.5-downgrade-attack.patch
Unescape View File

@ -1,430 +0,0 @@
From 77ef79e3b565f120172c6d1c30fabec6185553da Mon Sep 17 00:00:00 2001
From: Pieter Hintjens <ph@imatix.com>
Date: Fri, 5 Dec 2014 09:07:37 +0100
Subject: [PATCH] Problem: issue #1273, protocol downgrade attack
Solution: backport fix from libzmq master. Also backported test
cases.
---
NEWS | 4 +-
src/session_base.cpp | 8 +++
src/session_base.hpp | 3 +-
src/stream_engine.cpp | 15 ++++++
tests/test_security_curve.cpp | 66 ++++++++++++++++++++---
tests/test_security_null.cpp | 121 ++++++++++++++++++++++++++----------------
tests/test_security_plain.cpp | 37 ++++++++++++-
7 files changed, 197 insertions(+), 57 deletions(-)
diff --git a/src/session_base.cpp b/src/session_base.cpp
index 537dcb3..0b58436 100644
--- a/src/session_base.cpp
+++ b/src/session_base.cpp
@@ -323,6 +323,14 @@ int zmq::session_base_t::zap_connect ()
return 0;
}
+bool zmq::session_base_t::zap_enabled ()
+{
+ return (
+ options.mechanism != ZMQ_NULL ||
+ (options.mechanism == ZMQ_NULL && options.zap_domain.length() > 0)
+ );
+}
+
void zmq::session_base_t::process_attach (i_engine *engine_)
{
zmq_assert (engine_ != NULL);
diff --git a/src/session_base.hpp b/src/session_base.hpp
index 2ef7dc5..63e16bd 100644
--- a/src/session_base.hpp
+++ b/src/session_base.hpp
@@ -68,7 +68,8 @@ namespace zmq
int push_msg (msg_t *msg_);
int zap_connect ();
-
+ bool zap_enabled ();
+
// Fetches a message. Returns 0 if successful; -1 otherwise.
// The caller is responsible for freeing the message when no
// longer used.
diff --git a/src/stream_engine.cpp b/src/stream_engine.cpp
index 4d252d8..3d84d8f 100644
--- a/src/stream_engine.cpp
+++ b/src/stream_engine.cpp
@@ -464,6 +464,11 @@ bool zmq::stream_engine_t::handshake ()
// Is the peer using ZMTP/1.0 with no revision number?
// If so, we send and receive rest of identity message
if (greeting_recv [0] != 0xff || !(greeting_recv [9] & 0x01)) {
+ if (session->zap_enabled ()) {
+ // Reject ZMTP 1.0 connections if ZAP is enabled
+ error ();
+ return false;
+ }
encoder = new (std::nothrow) v1_encoder_t (out_batch_size);
alloc_assert (encoder);
@@ -505,6 +510,11 @@ bool zmq::stream_engine_t::handshake ()
}
else
if (greeting_recv [revision_pos] == ZMTP_1_0) {
+ if (session->zap_enabled ()) {
+ // Reject ZMTP 1.0 connections if ZAP is enabled
+ error ();
+ return false;
+ }
encoder = new (std::nothrow) v1_encoder_t (
out_batch_size);
alloc_assert (encoder);
@@ -515,6 +525,11 @@ bool zmq::stream_engine_t::handshake ()
}
else
if (greeting_recv [revision_pos] == ZMTP_2_0) {
+ if (session->zap_enabled ()) {
+ // Reject ZMTP 1.0 connections if ZAP is enabled
+ error ();
+ return false;
+ }
encoder = new (std::nothrow) v2_encoder_t (out_batch_size);
alloc_assert (encoder);
diff --git a/tests/test_security_curve.cpp b/tests/test_security_curve.cpp
index a24466f..e99a4b3 100644
--- a/tests/test_security_curve.cpp
+++ b/tests/test_security_curve.cpp
@@ -18,12 +18,23 @@
*/
#include "testutil.hpp"
+#if defined (ZMQ_HAVE_WINDOWS)
+# include <winsock2.h>
+# include <ws2tcpip.h>
+# include <stdexcept>
+# define close closesocket
+#else
+# include <sys/socket.h>
+# include <netinet/in.h>
+# include <arpa/inet.h>
+# include <unistd.h>
+#endif
// We'll generate random test keys at startup
-static char client_public [40];
-static char client_secret [40];
-static char server_public [40];
-static char server_secret [40];
+static char client_public [41];
+static char client_secret [41];
+static char server_public [41];
+static char server_secret [41];
// --------------------------------------------------------------------------
// This methods receives and validates ZAP requestes (allowing or denying
@@ -46,7 +57,7 @@ static void zap_handler (void *handler)
int size = zmq_recv (handler, client_key, 32, 0);
assert (size == 32);
- char client_key_text [40];
+ char client_key_text [41];
zmq_z85_encode (client_key_text, client_key, 32);
assert (streq (version, "1.0"));
@@ -181,8 +192,8 @@ int main (void)
// Check CURVE security with bogus client credentials
// This must be caught by the ZAP handler
- char bogus_public [40];
- char bogus_secret [40];
+ char bogus_public [41];
+ char bogus_secret [41];
zmq_curve_keypair (bogus_public, bogus_secret);
client = zmq_socket (ctx, ZMQ_DEALER);
@@ -217,7 +228,46 @@ int main (void)
assert (rc == 0);
expect_bounce_fail (server, client);
close_zero_linger (client);
-
+
+ // Unauthenticated messages from a vanilla socket shouldn't be received
+ struct sockaddr_in ip4addr;
+ int s;
+
+ ip4addr.sin_family = AF_INET;
+ ip4addr.sin_port = htons (9998);
+ inet_pton (AF_INET, "127.0.0.1", &ip4addr.sin_addr);
+
+ s = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
+ rc = connect (s, (struct sockaddr*) &ip4addr, sizeof (ip4addr));
+ assert (rc > -1);
+ // send anonymous ZMTP/1.0 greeting
+ send (s, "\x01\x00", 2, 0);
+ // send sneaky message that shouldn't be received
+ send (s, "\x08\x00sneaky\0", 9, 0);
+ int timeout = 150;
+ zmq_setsockopt (server, ZMQ_RCVTIMEO, &timeout, sizeof (timeout));
+ char *buf = s_recv (server);
+ if (buf != NULL) {
+ printf ("Received unauthenticated message: %s\n", buf);
+ assert (buf == NULL);
+ }
+ close (s);
+
+ // Check return codes for invalid buffer sizes
+ client = zmq_socket (ctx, ZMQ_DEALER);
+ assert (client);
+ errno = 0;
+ rc = zmq_setsockopt (client, ZMQ_CURVE_SERVERKEY, server_public, 123);
+ assert (rc == -1 && errno == EINVAL);
+ errno = 0;
+ rc = zmq_setsockopt (client, ZMQ_CURVE_PUBLICKEY, client_public, 123);
+ assert (rc == -1 && errno == EINVAL);
+ errno = 0;
+ rc = zmq_setsockopt (client, ZMQ_CURVE_SECRETKEY, client_secret, 123);
+ assert (rc == -1 && errno == EINVAL);
+ rc = zmq_close (client);
+ assert (rc == 0);
+
// Shutdown
rc = zmq_close (server);
assert (rc == 0);
diff --git a/tests/test_security_null.cpp b/tests/test_security_null.cpp
index 8a55632..6b74e8c 100644
--- a/tests/test_security_null.cpp
+++ b/tests/test_security_null.cpp
@@ -1,5 +1,5 @@
/*
- Copyright (c) 2007-2013 Contributors as noted in the AUTHORS file
+ Copyright (c) 2007-2014 Contributors as noted in the AUTHORS file
This file is part of 0MQ.
@@ -18,6 +18,17 @@
*/
#include "testutil.hpp"
+#if defined (ZMQ_HAVE_WINDOWS)
+# include <winsock2.h>
+# include <ws2tcpip.h>
+# include <stdexcept>
+# define close closesocket
+#else
+# include <sys/socket.h>
+# include <netinet/in.h>
+# include <arpa/inet.h>
+# include <unistd.h>
+#endif
static void
zap_handler (void *handler)
@@ -27,6 +38,7 @@ zap_handler (void *handler)
char *version = s_recv (handler);
if (!version)
break; // Terminating
+
char *sequence = s_recv (handler);
char *domain = s_recv (handler);
char *address = s_recv (handler);
@@ -57,7 +69,7 @@ zap_handler (void *handler)
free (identity);
free (mechanism);
}
- zmq_close (handler);
+ close_zero_linger (handler);
}
int main (void)
@@ -76,72 +88,89 @@ int main (void)
void *zap_thread = zmq_threadstart (&zap_handler, handler);
// We bounce between a binding server and a connecting client
+
+ // We first test client/server with no ZAP domain
+ // Libzmq does not call our ZAP handler, the connect must succeed
void *server = zmq_socket (ctx, ZMQ_DEALER);
assert (server);
void *client = zmq_socket (ctx, ZMQ_DEALER);
assert (client);
-
- // We first test client/server with no ZAP domain
- // Libzmq does not call our ZAP handler, the connect must succeed
rc = zmq_bind (server, "tcp://127.0.0.1:9000");
assert (rc == 0);
- rc = zmq_connect (client, "tcp://localhost:9000");
+ rc = zmq_connect (client, "tcp://127.0.0.1:9000");
assert (rc == 0);
bounce (server, client);
- zmq_unbind (server, "tcp://127.0.0.1:9000");
- zmq_disconnect (client, "tcp://localhost:9000");
-
+ close_zero_linger (client);
+ close_zero_linger (server);
+
// Now define a ZAP domain for the server; this enables
// authentication. We're using the wrong domain so this test
// must fail.
- // **************************************************************
- // PH: the following causes libzmq to get confused, so that the
- // next step fails. To reproduce, uncomment this block. Note that
- // even creating a new client/server socket pair, the behaviour
- // does not change.
- // **************************************************************
- // Destroying the old sockets and creating new ones isn't needed,
- // but it shows that the problem isn't related to specific sockets.
- //close_zero_linger (client);
- //close_zero_linger (server);
- //server = zmq_socket (ctx, ZMQ_DEALER);
- //assert (server);
- //client = zmq_socket (ctx, ZMQ_DEALER);
- //assert (client);
- //// The above code should not be required
- //rc = zmq_setsockopt (server, ZMQ_ZAP_DOMAIN, "WRONG", 5);
- //assert (rc == 0);
- //rc = zmq_bind (server, "tcp://127.0.0.1:9001");
- //assert (rc == 0);
- //rc = zmq_connect (client, "tcp://localhost:9001");
- //assert (rc == 0);
- //expect_bounce_fail (server, client);
- //zmq_unbind (server, "tcp://127.0.0.1:9001");
- //zmq_disconnect (client, "tcp://localhost:9001");
-
+ server = zmq_socket (ctx, ZMQ_DEALER);
+ assert (server);
+ client = zmq_socket (ctx, ZMQ_DEALER);
+ assert (client);
+ rc = zmq_setsockopt (server, ZMQ_ZAP_DOMAIN, "WRONG", 5);
+ assert (rc == 0);
+ rc = zmq_bind (server, "tcp://127.0.0.1:9001");
+ assert (rc == 0);
+ rc = zmq_connect (client, "tcp://127.0.0.1:9001");
+ assert (rc == 0);
+ expect_bounce_fail (server, client);
+ close_zero_linger (client);
+ close_zero_linger (server);
+
// Now use the right domain, the test must pass
+ server = zmq_socket (ctx, ZMQ_DEALER);
+ assert (server);
+ client = zmq_socket (ctx, ZMQ_DEALER);
+ assert (client);
rc = zmq_setsockopt (server, ZMQ_ZAP_DOMAIN, "TEST", 4);
assert (rc == 0);
rc = zmq_bind (server, "tcp://127.0.0.1:9002");
assert (rc == 0);
- rc = zmq_connect (client, "tcp://localhost:9002");
+ rc = zmq_connect (client, "tcp://127.0.0.1:9002");
assert (rc == 0);
- // **************************************************************
- // PH: it fails here; though the ZAP reply is 200 OK, and
- // null_mechanism.cpp correctly parses that, the connection
- // never succeeds and the test hangs.
- // **************************************************************
bounce (server, client);
- zmq_unbind (server, "tcp://127.0.0.1:9002");
- zmq_disconnect (client, "tcp://localhost:9002");
-
- // Shutdown
close_zero_linger (client);
close_zero_linger (server);
- rc = zmq_ctx_term (ctx);
+
+ // Unauthenticated messages from a vanilla socket shouldn't be received
+ server = zmq_socket (ctx, ZMQ_DEALER);
+ assert (server);
+ rc = zmq_setsockopt (server, ZMQ_ZAP_DOMAIN, "WRONG", 5);
assert (rc == 0);
+ rc = zmq_bind (server, "tcp://127.0.0.1:9003");
+ assert (rc == 0);
+
+ struct sockaddr_in ip4addr;
+ int s;
+
+ ip4addr.sin_family = AF_INET;
+ ip4addr.sin_port = htons(9003);
+ inet_pton(AF_INET, "127.0.0.1", &ip4addr.sin_addr);
- // Wait until ZAP handler terminates.
+ s = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
+ rc = connect (s, (struct sockaddr*) &ip4addr, sizeof ip4addr);
+ assert (rc > -1);
+ // send anonymous ZMTP/1.0 greeting
+ send (s, "\x01\x00", 2, 0);
+ // send sneaky message that shouldn't be received
+ send (s, "\x08\x00sneaky\0", 9, 0);
+ int timeout = 150;
+ zmq_setsockopt (server, ZMQ_RCVTIMEO, &timeout, sizeof (timeout));
+ char *buf = s_recv (server);
+ if (buf != NULL) {
+ printf ("Received unauthenticated message: %s\n", buf);
+ assert (buf == NULL);
+ }
+ close (s);
+ close_zero_linger (server);
+
+ // Shutdown
+ rc = zmq_ctx_term (ctx);
+ assert (rc == 0);
+ // Wait until ZAP handler terminates
zmq_threadclose (zap_thread);
return 0;
diff --git a/tests/test_security_plain.cpp b/tests/test_security_plain.cpp
index 74973fd..c257840 100644
--- a/tests/test_security_plain.cpp
+++ b/tests/test_security_plain.cpp
@@ -1,5 +1,5 @@
/*
- Copyright (c) 2007-2013 Contributors as noted in the AUTHORS file
+ Copyright (c) 2007-2014 Contributors as noted in the AUTHORS file
This file is part of 0MQ.
@@ -18,6 +18,17 @@
*/
#include "testutil.hpp"
+#if defined (ZMQ_HAVE_WINDOWS)
+# include <winsock2.h>
+# include <ws2tcpip.h>
+# include <stdexcept>
+# define close closesocket
+#else
+# include <sys/socket.h>
+# include <netinet/in.h>
+# include <arpa/inet.h>
+# include <unistd.h>
+#endif
static void
zap_handler (void *ctx)
@@ -137,6 +148,30 @@ int main (void)
expect_bounce_fail (server, client);
close_zero_linger (client);
+ // Unauthenticated messages from a vanilla socket shouldn't be received
+ struct sockaddr_in ip4addr;
+ int s;
+
+ ip4addr.sin_family = AF_INET;
+ ip4addr.sin_port = htons (9998);
+ inet_pton (AF_INET, "127.0.0.1", &ip4addr.sin_addr);
+
+ s = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
+ rc = connect (s, (struct sockaddr*) &ip4addr, sizeof (ip4addr));
+ assert (rc > -1);
+ // send anonymous ZMTP/1.0 greeting
+ send (s, "\x01\x00", 2, 0);
+ // send sneaky message that shouldn't be received
+ send (s, "\x08\x00sneaky\0", 9, 0);
+ int timeout = 150;
+ zmq_setsockopt (server, ZMQ_RCVTIMEO, &timeout, sizeof (timeout));
+ char *buf = s_recv (server);
+ if (buf != NULL) {
+ printf ("Received unauthenticated message: %s\n", buf);
+ assert (buf == NULL);
+ }
+ close (s);
+
// Shutdown
rc = zmq_close (server);
assert (rc == 0);

43
zeromq-4.1.2-ipv6.patch
Unescape View File

@ -0,0 +1,43 @@
From 81464652d2453c608bbbb52fd59e9e9f20857178 Mon Sep 17 00:00:00 2001
From: Constantin Rack <constantin@rack.li>
Date: Tue, 23 Jun 2015 08:29:36 +0200
Subject: [PATCH] Solution: allow brackets in tcp address. Fixes #43
---
src/socket_base.cpp | 5 +++--
tests/test_connect_resolve.cpp | 3 +++
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/src/socket_base.cpp b/src/socket_base.cpp
index bff7068..f79af6f 100644
--- a/src/socket_base.cpp
+++ b/src/socket_base.cpp
@@ -603,11 +603,12 @@ int zmq::socket_base_t::connect (const char *addr_)
// Following code is quick and dirty check to catch obvious errors,
// without trying to be fully accurate.
const char *check = address.c_str ();
- if (isalnum (*check) || isxdigit (*check)) {
+ if (isalnum (*check) || isxdigit (*check) || *check == '[') {
check++;
while (isalnum (*check)
|| isxdigit (*check)
- || *check == '.' || *check == '-' || *check == ':'|| *check == ';')
+ || *check == '.' || *check == '-' || *check == ':'|| *check == ';'
+ || *check == ']')
check++;
}
// Assume the worst, now look for success
diff --git a/tests/test_connect_resolve.cpp b/tests/test_connect_resolve.cpp
index f9a7b9d..cb5353f 100644
--- a/tests/test_connect_resolve.cpp
+++ b/tests/test_connect_resolve.cpp
@@ -41,6 +41,9 @@ int main (void)
int rc = zmq_connect (sock, "tcp://localhost:1234");
assert (rc == 0);
+ rc = zmq_connect (sock, "tcp://[::1]:4506");
+ assert (rc == 0);
+
rc = zmq_connect (sock, "tcp://localhost:invalid");
assert (rc == -1);

18
zeromq.spec
Unescape View File

@ -1,8 +1,8 @@
%bcond_without pgm
Name: zeromq
Version: 4.0.5
Release: 5%{?dist}
Version: 4.1.2
Release: 1%{?dist}
Summary: Software library for fast, message-based applications
Group: System Environment/Libraries
@ -10,7 +10,7 @@ License: LGPLv3+
URL: http://www.zeromq.org
# VCS: git:http://github.com/zeromq/zeromq2.git
Source0: http://download.zeromq.org/zeromq-%{version}.tar.gz
Patch0: zeromq-4.0.5-downgrade-attack.patch
Patch0: zeromq-4.1.2-ipv6.patch
Source1: https://raw.githubusercontent.com/zeromq/cppzmq/master/zmq.hpp
Source2: https://raw.githubusercontent.com/zeromq/cppzmq/master/LICENSE
@ -81,10 +81,6 @@ sed -i "s/openpgm-[0-9].[0-9]/%{openpgm_pc}/g" \
configure*
# remove all files in foreign except Makefiles
rm -v $(find foreign -type f | grep -v Makefile)
%build
autoreconf -fi
%configure \
@ -105,7 +101,7 @@ rm %{buildroot}%{_libdir}/libzmq.la
%check
make check
make check V=1
%post -p /sbin/ldconfig
@ -115,7 +111,7 @@ make check
%files
%doc AUTHORS ChangeLog NEWS README.md
%doc AUTHORS ChangeLog MAINTAINERS NEWS
%license COPYING COPYING.LESSER
%{_bindir}/curve_keygen
%{_libdir}/libzmq.so.*
@ -133,6 +129,10 @@ make check
%changelog
* Tue Jun 23 2015 Thomas Spura <tomspur@fedoraproject.org> - 4.1.2-1
- update to 4.1.2
- add upstream patch to fix problem with ipv6
* Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 4.0.5-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

Write Preview
Loading…
Cancel
Save