Received: by mail.netbsd.org (Postfix, from userid 605) id 129E584D6A; Fri, 5 Feb 2021 20:04:45 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 4C6C784D58 for ; Fri, 5 Feb 2021 20:04:44 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id V9gUKN-YJPa6 for ; Fri, 5 Feb 2021 20:04:43 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.netbsd.org [199.233.217.197]) by mail.netbsd.org (Postfix) with ESMTP id 5740984C86 for ; Fri, 5 Feb 2021 20:04:43 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 50E7FFA95; Fri, 5 Feb 2021 20:04:43 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1612555483114300" MIME-Version: 1.0 Date: Fri, 5 Feb 2021 20:04:43 +0000 From: "Adam Ciarcinski" Subject: CVS commit: pkgsrc/net/dnsmasq To: pkgsrc-changes@NetBSD.org Reply-To: adam@netbsd.org X-Mailer: log_accum Message-Id: <20210205200443.50E7FFA95@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1612555483114300 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: adam Date: Fri Feb 5 20:04:43 UTC 2021 Modified Files: pkgsrc/net/dnsmasq: Makefile distinfo Log Message: dnsmasq: updated to 2.84 version 2.84 Unknown changes version 2.83 Use the values of --min-port and --max-port in outgoing TCP connections to upstream DNS servers. Fix a remote buffer overflow problem in the DNSSEC code. Any dnsmasq with DNSSEC compiled in and enabled is vulnerable to this, referenced by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683 CVE-2020-25687. Be sure to only accept UDP DNS query replies at the address from which the query was originated. This keeps as much entropy in the {query-ID, random-port} tuple as possible, to help defeat cache poisoning attacks. Refer: CVE-2020-25684. Use the SHA-256 hash function to verify that DNS answers received are for the questions originally asked. This replaces the slightly insecure SHA-1 (when compiled with DNSSEC) or the very insecure CRC32 (otherwise). Refer: CVE-2020-25685. Handle multiple identical near simultaneous DNS queries better. Previously, such queries would all be forwarded independently. This is, in theory, inefficent but in practise not a problem, _except_ that is means that an answer for any of the forwarded queries will be accepted and cached. An attacker can send a query multiple times, and for each repeat, another {port, ID} becomes capable of accepting the answer he is sending in the blind, to random IDs and ports. The chance of a succesful attack is therefore multiplied by the number of repeats of the query. The new behaviour detects repeated queries and merely stores the clients sending repeats so that when the first query completes, the answer can be sent to all the clients who asked. Refer: CVE-2020-25686. To generate a diff of this commit: cvs rdiff -u -r1.43 -r1.44 pkgsrc/net/dnsmasq/Makefile cvs rdiff -u -r1.39 -r1.40 pkgsrc/net/dnsmasq/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1612555483114300 Content-Disposition: inline Content-Length: 1715 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/net/dnsmasq/Makefile diff -u pkgsrc/net/dnsmasq/Makefile:1.43 pkgsrc/net/dnsmasq/Makefile:1.44 --- pkgsrc/net/dnsmasq/Makefile:1.43 Mon Jul 27 16:41:11 2020 +++ pkgsrc/net/dnsmasq/Makefile Fri Feb 5 20:04:43 2021 @@ -1,6 +1,6 @@ -# $NetBSD: Makefile,v 1.43 2020/07/27 16:41:11 adam Exp $ +# $NetBSD: Makefile,v 1.44 2021/02/05 20:04:43 adam Exp $ -DISTNAME= dnsmasq-2.82 +DISTNAME= dnsmasq-2.84 CATEGORIES= net MASTER_SITES= http://www.thekelleys.org.uk/dnsmasq/ EXTRACT_SUFX= .tar.xz Index: pkgsrc/net/dnsmasq/distinfo diff -u pkgsrc/net/dnsmasq/distinfo:1.39 pkgsrc/net/dnsmasq/distinfo:1.40 --- pkgsrc/net/dnsmasq/distinfo:1.39 Mon Jul 27 16:41:11 2020 +++ pkgsrc/net/dnsmasq/distinfo Fri Feb 5 20:04:43 2021 @@ -1,8 +1,8 @@ -$NetBSD: distinfo,v 1.39 2020/07/27 16:41:11 adam Exp $ +$NetBSD: distinfo,v 1.40 2021/02/05 20:04:43 adam Exp $ -SHA1 (dnsmasq-2.82.tar.xz) = 4eb84825d5a3b7e4d7de1fc58c56dd4eb8cace71 -RMD160 (dnsmasq-2.82.tar.xz) = 7583a0a0fa85aa400069e74899ec9e2aaa40c9d1 -SHA512 (dnsmasq-2.82.tar.xz) = faf36efdaa3abe84994e46aea018b0a324218d42814baac056ca635f6d03f1301e7b4d958f92b272a8e3a7ac358f3a4e2606129a217587b471aedb3ce23e903b -Size (dnsmasq-2.82.tar.xz) = 509904 bytes +SHA1 (dnsmasq-2.84.tar.xz) = 60f6b8a6a86987613247c8dc32f61e28599ae285 +RMD160 (dnsmasq-2.84.tar.xz) = 51342173c980d756a99a0d8fb6ba9ab0f786b939 +SHA512 (dnsmasq-2.84.tar.xz) = e84bdcdf3cf35f08e8492eb5aa89ee6543233bdb821d01f164783bd6d0913ec01c513e85e2109352c77e77142a1a94bedcd3361f37d7b2a9a5d35a02448e85c6 +Size (dnsmasq-2.84.tar.xz) = 514216 bytes SHA1 (patch-src_bpf.c) = 4115a5391f57564663bbfc448fbb865c370318a6 SHA1 (patch-src_dump.c) = 3e7553e8ed2444536ba94187f7a100a9abdbb353 --_----------=_1612555483114300--