From b8126de23e957978b4d0403097cd8402f0c1d82a Mon Sep 17 00:00:00 2001 From: delphij Date: Wed, 12 Apr 2017 06:24:35 +0000 Subject: Fix multiple vulnerabilities of ntp. [SA-17:03] Xen migration enhancements. [EN-17:05] Approved by: so --- contrib/ntp/include/Makefile.in | 10 +++++----- contrib/ntp/include/isc/Makefile.in | 10 +++++----- contrib/ntp/include/libssl_compat.h | 19 +++++++++++++++++++ contrib/ntp/include/ntp_crypto.h | 1 + contrib/ntp/include/ntp_fp.h | 2 +- contrib/ntp/include/ntp_md5.h | 4 ++++ contrib/ntp/include/ntp_stdlib.h | 20 +++++++++++++------- contrib/ntp/include/ntpd.h | 5 ++++- contrib/ntp/include/ssl_applink.c | 30 ++++++++++++++++++++++++++---- 9 files changed, 78 insertions(+), 23 deletions(-) (limited to 'contrib/ntp/include') diff --git a/contrib/ntp/include/Makefile.in b/contrib/ntp/include/Makefile.in index acd3bb5..ebab2b5 100644 --- a/contrib/ntp/include/Makefile.in +++ b/contrib/ntp/include/Makefile.in @@ -108,6 +108,7 @@ am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \ $(top_srcdir)/sntp/m4/ntp_dir_sep.m4 \ $(top_srcdir)/sntp/m4/ntp_facilitynames.m4 \ $(top_srcdir)/sntp/m4/ntp_googletest.m4 \ + $(top_srcdir)/sntp/m4/ntp_harden.m4 \ $(top_srcdir)/sntp/m4/ntp_ipv6.m4 \ $(top_srcdir)/sntp/m4/ntp_lib_m.m4 \ $(top_srcdir)/sntp/m4/ntp_libevent.m4 \ @@ -245,10 +246,6 @@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CPPFLAGS_LIBEVENT = @CPPFLAGS_LIBEVENT@ CPPFLAGS_NTP = @CPPFLAGS_NTP@ -CXX = @CXX@ -CXXCPP = @CXXCPP@ -CXXDEPMODE = @CXXDEPMODE@ -CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DCFD = @DCFD@ DEFS = @DEFS@ @@ -301,6 +298,7 @@ LN_S = @LN_S@ LSCF = @LSCF@ LTHREAD_LIBS = @LTHREAD_LIBS@ LTLIBOBJS = @LTLIBOBJS@ +LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ MAKEINFO = @MAKEINFO@ MAKE_ADJTIMED = @MAKE_ADJTIMED@ MAKE_CHECK_LAYOUT = @MAKE_CHECK_LAYOUT@ @@ -364,6 +362,9 @@ NTPTRACE_DL = @NTPTRACE_DL@ NTPTRACE_DS = @NTPTRACE_DS@ NTPTRACE_MS = @NTPTRACE_MS@ NTPTRACE_NI = @NTPTRACE_NI@ +NTP_HARD_CFLAGS = @NTP_HARD_CFLAGS@ +NTP_HARD_CPPFLAGS = @NTP_HARD_CPPFLAGS@ +NTP_HARD_LDFLAGS = @NTP_HARD_LDFLAGS@ NTP_KEYGEN_DB = @NTP_KEYGEN_DB@ NTP_KEYGEN_DL = @NTP_KEYGEN_DL@ NTP_KEYGEN_DS = @NTP_KEYGEN_DS@ @@ -437,7 +438,6 @@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ -ac_ct_CXX = @ac_ct_CXX@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ diff --git a/contrib/ntp/include/isc/Makefile.in b/contrib/ntp/include/isc/Makefile.in index 5bd25d6..e3bee1e 100644 --- a/contrib/ntp/include/isc/Makefile.in +++ b/contrib/ntp/include/isc/Makefile.in @@ -108,6 +108,7 @@ am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \ $(top_srcdir)/sntp/m4/ntp_dir_sep.m4 \ $(top_srcdir)/sntp/m4/ntp_facilitynames.m4 \ $(top_srcdir)/sntp/m4/ntp_googletest.m4 \ + $(top_srcdir)/sntp/m4/ntp_harden.m4 \ $(top_srcdir)/sntp/m4/ntp_ipv6.m4 \ $(top_srcdir)/sntp/m4/ntp_lib_m.m4 \ $(top_srcdir)/sntp/m4/ntp_libevent.m4 \ @@ -203,10 +204,6 @@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CPPFLAGS_LIBEVENT = @CPPFLAGS_LIBEVENT@ CPPFLAGS_NTP = @CPPFLAGS_NTP@ -CXX = @CXX@ -CXXCPP = @CXXCPP@ -CXXDEPMODE = @CXXDEPMODE@ -CXXFLAGS = @CXXFLAGS@ CYGPATH_W = @CYGPATH_W@ DCFD = @DCFD@ DEFS = @DEFS@ @@ -259,6 +256,7 @@ LN_S = @LN_S@ LSCF = @LSCF@ LTHREAD_LIBS = @LTHREAD_LIBS@ LTLIBOBJS = @LTLIBOBJS@ +LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@ MAKEINFO = @MAKEINFO@ MAKE_ADJTIMED = @MAKE_ADJTIMED@ MAKE_CHECK_LAYOUT = @MAKE_CHECK_LAYOUT@ @@ -322,6 +320,9 @@ NTPTRACE_DL = @NTPTRACE_DL@ NTPTRACE_DS = @NTPTRACE_DS@ NTPTRACE_MS = @NTPTRACE_MS@ NTPTRACE_NI = @NTPTRACE_NI@ +NTP_HARD_CFLAGS = @NTP_HARD_CFLAGS@ +NTP_HARD_CPPFLAGS = @NTP_HARD_CPPFLAGS@ +NTP_HARD_LDFLAGS = @NTP_HARD_LDFLAGS@ NTP_KEYGEN_DB = @NTP_KEYGEN_DB@ NTP_KEYGEN_DL = @NTP_KEYGEN_DL@ NTP_KEYGEN_DS = @NTP_KEYGEN_DS@ @@ -395,7 +396,6 @@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ -ac_ct_CXX = @ac_ct_CXX@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ diff --git a/contrib/ntp/include/libssl_compat.h b/contrib/ntp/include/libssl_compat.h index a8938a1..2a3697c 100644 --- a/contrib/ntp/include/libssl_compat.h +++ b/contrib/ntp/include/libssl_compat.h @@ -24,6 +24,18 @@ #include "openssl/dsa.h" #include "openssl/rsa.h" +#ifndef OPENSSL_VERSION_NUMBER +#define OPENSSL_VERSION_NUMBER SSLEAY_VERSION_NUMBER +#endif + +#ifndef OPENSSL_VERSION_TEXT +#define OPENSSL_VERSION_TEXT SSLEAY_VERSION_TEXT +#endif + +#ifndef OPENSSL_VERSION +#define OPENSSL_VERSION SSLEAY_VERSION +#endif + /* ----------------------------------------------------------------- */ #if OPENSSL_VERSION_NUMBER < 0x10100000L /* ----------------------------------------------------------------- */ @@ -93,6 +105,13 @@ extern int sslshim_X509_get_signature_nid(const X509 *x); #define X509_get_signature_nid sslshim_X509_get_signature_nid +#define OpenSSL_version_num SSLeay +#define OpenSSL_version SSLeay_version +#define X509_get0_notBefore X509_get_notBefore +#define X509_getm_notBefore X509_get_notBefore +#define X509_get0_notAfter X509_get_notAfter +#define X509_getm_notAfter X509_get_notAfter + /* ----------------------------------------------------------------- */ #endif /* OPENSSL_VERSION_NUMBER < v1.1.0 */ /* ----------------------------------------------------------------- */ diff --git a/contrib/ntp/include/ntp_crypto.h b/contrib/ntp/include/ntp_crypto.h index b801006..32134a8 100644 --- a/contrib/ntp/include/ntp_crypto.h +++ b/contrib/ntp/include/ntp_crypto.h @@ -24,6 +24,7 @@ invalidsyntax: AUTOKEY should be defined only if OPENSSL is. #endif +#include "openssl/bn.h" #include "openssl/evp.h" #include "ntp_calendar.h" /* for fields in the cert_info structure */ diff --git a/contrib/ntp/include/ntp_fp.h b/contrib/ntp/include/ntp_fp.h index 7806932..b5d2820 100644 --- a/contrib/ntp/include/ntp_fp.h +++ b/contrib/ntp/include/ntp_fp.h @@ -352,7 +352,7 @@ extern int buftvtots (const char *, l_fp *); extern char * fptoa (s_fp, short); extern char * fptoms (s_fp, short); extern int hextolfp (const char *, l_fp *); -extern void gpstolfp (int, int, unsigned long, l_fp *); +extern void gpstolfp (u_int, u_int, unsigned long, l_fp *); extern int mstolfp (const char *, l_fp *); extern char * prettydate (l_fp *); extern char * gmprettydate (l_fp *); diff --git a/contrib/ntp/include/ntp_md5.h b/contrib/ntp/include/ntp_md5.h index 2306b9a..01b417a 100644 --- a/contrib/ntp/include/ntp_md5.h +++ b/contrib/ntp/include/ntp_md5.h @@ -8,6 +8,7 @@ #ifdef OPENSSL # include "openssl/evp.h" +# include "libssl_compat.h" #else /* !OPENSSL follows */ /* * Provide OpenSSL-alike MD5 API if we're not using OpenSSL @@ -23,6 +24,9 @@ # endif typedef MD5_CTX EVP_MD_CTX; + +# define EVP_MD_CTX_free(c) free(c) +# define EVP_MD_CTX_new() calloc(1, sizeof(MD5_CTX)) # define EVP_get_digestbynid(t) NULL # define EVP_md5() NULL # define EVP_MD_CTX_init(c) diff --git a/contrib/ntp/include/ntp_stdlib.h b/contrib/ntp/include/ntp_stdlib.h index 5a20a83..a4e8574 100644 --- a/contrib/ntp/include/ntp_stdlib.h +++ b/contrib/ntp/include/ntp_stdlib.h @@ -105,21 +105,23 @@ extern u_int32 addr2refid (sockaddr_u *); /* emalloc.c */ #ifndef EREALLOC_CALLSITE /* ntp_malloc.h defines */ extern void * ereallocz (void *, size_t, size_t, int); -extern void * oreallocarray (void *optr, size_t nmemb, size_t size); +extern void * oreallocarrayxz (void *optr, size_t nmemb, size_t size, size_t extra); #define erealloczsite(p, n, o, z, f, l) ereallocz((p), (n), (o), (z)) #define emalloc(n) ereallocz(NULL, (n), 0, FALSE) #define emalloc_zero(c) ereallocz(NULL, (c), 0, TRUE) #define erealloc(p, c) ereallocz((p), (c), 0, FALSE) #define erealloc_zero(p, n, o) ereallocz((p), (n), (o), TRUE) -#define ereallocarray(p, n, s) oreallocarray((p), (n), (s)) -#define eallocarray(n, s) oreallocarray(NULL, (n), (s)) +#define ereallocarray(p, n, s) oreallocarrayxz((p), (n), (s), 0) +#define eallocarray(n, s) oreallocarrayxz(NULL, (n), (s), 0) +#define ereallocarrayxz(p, n, s, x) oreallocarrayxz((p), (n), (s), (x)) +#define eallocarrayxz(n, s, x) oreallocarrayxz(NULL, (n), (s), (x)) extern char * estrdup_impl(const char *); #define estrdup(s) estrdup_impl(s) #else extern void * ereallocz (void *, size_t, size_t, int, const char *, int); -extern void * oreallocarray (void *optr, size_t nmemb, size_t size, - const char *, int); +extern void * oreallocarrayxz (void *optr, size_t nmemb, size_t size, + size_t extra, const char *, int); #define erealloczsite ereallocz #define emalloc(c) ereallocz(NULL, (c), 0, FALSE, \ __FILE__, __LINE__) @@ -129,9 +131,13 @@ extern void * oreallocarray (void *optr, size_t nmemb, size_t size, __FILE__, __LINE__) #define erealloc_zero(p, n, o) ereallocz((p), (n), (o), TRUE, \ __FILE__, __LINE__) -#define ereallocarray(p, n, s) oreallocarray((p), (n), (s), \ +#define ereallocarray(p, n, s) oreallocarrayxz((p), (n), (s), 0, \ + __FILE__, __LINE__) +#define eallocarray(n, s) oreallocarrayxz(NULL, (n), (s), 0, \ + __FILE__, __LINE__) +#define ereallocarrayxz(p, n, s, x) oreallocarrayxz((p), (n), (s), (x), \ __FILE__, __LINE__) -#define eallocarray(n, s) oreallocarray(NULL, (n), (s), \ +#define eallocarrayxz(n, s, x) oreallocarrayxz(NULL, (n), (s), (x), \ __FILE__, __LINE__) extern char * estrdup_impl(const char *, const char *, int); #define estrdup(s) estrdup_impl((s), __FILE__, __LINE__) diff --git a/contrib/ntp/include/ntpd.h b/contrib/ntp/include/ntpd.h index 1f33bf4..f944235 100644 --- a/contrib/ntp/include/ntpd.h +++ b/contrib/ntp/include/ntpd.h @@ -321,6 +321,8 @@ extern void parse_cmdline_opts(int *, char ***); /* ntp_config.c */ extern char const * progname; +extern int saved_argc; +extern char **saved_argv; extern char *sys_phone[]; /* ACTS phone numbers */ #if defined(HAVE_SCHED_SETSCHEDULER) extern int config_priority_override; @@ -487,12 +489,13 @@ extern u_char sys_bcpollbstep; /* broadcast poll backstep gate */ extern u_long sys_epoch; /* last clock update time */ extern keyid_t sys_private; /* private value for session seed */ extern int sys_manycastserver; /* respond to manycast client pkts */ +extern int sys_maxclock; /* maximum survivors */ extern int sys_minclock; /* minimum survivors */ extern int sys_minsane; /* minimum candidates */ extern int sys_floor; /* cluster stratum floor */ extern int sys_ceiling; /* cluster stratum ceiling */ extern u_char sys_ttl[MAX_TTL]; /* ttl mapping vector */ -extern int sys_ttlmax; /* max ttl mapping vector index */ +extern u_int sys_ttlmax; /* max ttl mapping vector index */ /* * Statistics counters diff --git a/contrib/ntp/include/ssl_applink.c b/contrib/ntp/include/ssl_applink.c index ba1f4a8..e57cabd 100644 --- a/contrib/ntp/include/ssl_applink.c +++ b/contrib/ntp/include/ssl_applink.c @@ -10,8 +10,13 @@ # ifdef _MSC_VER # pragma warning(push) # pragma warning(disable: 4152) +# ifndef OPENSSL_NO_AUTOLINK +# include "msvc_ssl_autolib.h" +# endif +# endif +# if OPENSSL_VERSION_NUMBER < 0x10100000L +# include # endif -# include # ifdef _MSC_VER # pragma warning(pop) # endif @@ -25,20 +30,30 @@ void *wrap_dbg_malloc(size_t s, const char *f, int l); void *wrap_dbg_realloc(void *p, size_t s, const char *f, int l); void wrap_dbg_free(void *p); +void wrap_dbg_free_ex(void *p, const char *f, int l); #endif #if defined(OPENSSL) && defined(SYS_WINNT) + void ssl_applink(void); void ssl_applink(void) { -#ifdef WRAP_DBG_MALLOC - CRYPTO_set_mem_ex_functions(wrap_dbg_malloc, wrap_dbg_realloc, wrap_dbg_free); +#if OPENSSL_VERSION_NUMBER >= 0x10100000L +# ifdef WRAP_DBG_MALLOC + CRYPTO_set_mem_functions(wrap_dbg_malloc, wrap_dbg_realloc, wrap_dbg_free_ex); +# else + OPENSSL_malloc_init(); +# endif #else +# ifdef WRAP_DBG_MALLOC + CRYPTO_set_mem_ex_functions(wrap_dbg_malloc, wrap_dbg_realloc, wrap_dbg_free); +# else CRYPTO_malloc_init(); -#endif +# endif +#endif /* OpenSSL version cascade */ } #else /* !OPENSSL || !SYS_WINNT */ #define ssl_applink() do {} while (0) @@ -71,4 +86,11 @@ void wrap_dbg_free(void *p) { _free_dbg(p, _NORMAL_BLOCK); } + +void wrap_dbg_free_ex(void *p, const char *f, int l) +{ + (void)f; + (void)l; + _free_dbg(p, _NORMAL_BLOCK); +} #endif /* WRAP_DBG_MALLOC */ -- cgit v1.1