Re: Backporting CVE-2016-10739

[Carlos O'Donell <carlos@redhat.com>]

On 2/4/19 10:26 AM, Florian Weimer wrote:
> That didn't work due to linking failures in the test suite.
> 
> Here's something less ambitious.  It retains the ABI for testing, but
> patches nscd to use its own private copy.
> 
> (I have not put this on the branch due to Bugzilla spam this would
> cause.)

This was a non-causal v2 of your first patch.

It arrived while I was reviewing the first one, and I like this one
much more.

> Thanks,
> Florian
> 
> nscd: Do not use __inet_aton_exact@GLIBC_PRIVATE [BZ #20018]

OK.

> 
> This commit avoids referencing the __inet_aton_exact@GLIBC_PRIVATE
> symbol from nscd.  In master, the separately-compiled getaddrinfo
> implementation in nscd needs it, however such an internal ABI change
> is not desirable on a release branch if it can be avoided easily.

OK. Good note.

> 2019-02-04  Florian Weimer  <fweimer@redhat.com>
> 
> 	[BZ #20018]
> 	nscd: Do not rely on new GLIBC_PRIVATE ABI after CVE-2016-10739 fix.
> 	* nscd/nscd-inet_addr.c: New file.  Build resolv/inet_addr.c for
> 	nscd, without public symbols.
> 	* nscd/Makefile (nscd-modules): Add it.
> 
> diff --git a/nscd/Makefile b/nscd/Makefile
> index b713a84c49..eb23c01a39 100644
> --- a/nscd/Makefile
> +++ b/nscd/Makefile
> @@ -36,7 +36,7 @@ nscd-modules := nscd connections pwdcache getpwnam_r getpwuid_r grpcache \
>  		getsrvbynm_r getsrvbypt_r servicescache \
>  		dbg_log nscd_conf nscd_stat cache mem nscd_setup_thread \
>  		xmalloc xstrdup aicache initgrcache gai res_hconf \
> -		netgroupcache
> +		netgroupcache nscd-inet_addr

OK. Add a new object to nscd.

>  
>  ifeq ($(build-nscd)$(have-thread-library),yesyes)
>  
> diff --git a/nscd/nscd-inet_addr.c b/nscd/nscd-inet_addr.c
> new file mode 100644
> index 0000000000..ce42ba3ea8
> --- /dev/null
> +++ b/nscd/nscd-inet_addr.c
> @@ -0,0 +1,30 @@
> +/* Legacy IPv4 text-to-address functions.  Version for nscd.
> +   Copyright (C) 2019 Free Software Foundation, Inc.
> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Lesser General Public
> +   License as published by the Free Software Foundation; either
> +   version 2.1 of the License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Lesser General Public License for more details.
> +
> +   You should have received a copy of the GNU Lesser General Public
> +   License along with the GNU C Library; if not, see
> +   <http://www.gnu.org/licenses/>.  */
> +
> +#include <arpa/inet.h>
> +

Please add a comment explaining why this is here.


> +/* Declare __inet_aton_exact as hidden, so that it does not get
> +   exported from nscd.  */
> +__typeof__ (__inet_aton_exact) __inet_aton_exact attribute_hidden;
> +
> +/* Do not provide definitions of the public symbols exported from
> +   libc.  */
> +#undef weak_alias
> +#define weak_alias(from, to)
> +
> +#include <resolv/inet_addr.c>
> 

Can we kill the prototype from the public header and use an internal
header? It seems messy to leave that prototype for the GLIBC_PRIVATE
symbol in the public header. It might tempt people to workaround the
linkage protection.

-- 
Cheers,
Carlos.