Minor code fixes

 [ISC-Bugs #19566] When trying to find the zone for a name for ddns allow
 the name to be at the apex of the zone.
 [ISC-Bugs #19617] Restrict length of interface name read from command line
 in dhcpd - based on a patch from David Cantrell at Red Hat.
 [ISC-Bugs #20039] Correct some error messages in dhcpd.c
 [ISC-Bugs #20070] Better range check on values when creating a DHCID.
 [ISC-Bugs #20198] Avoid writing past the end of the field when adding
 overly long file or server names to a packet and add a log message
 if the configuration supplied overly long names for these fields.
 [ISC-Bugs #21497] Add a little more randomness to rng seed in client

diff --git a/RELNOTES b/RELNOTES
index 62b296d0f461c223654d84633d24082c4dde3edc..bc6b009637b33e821c8f0c5a131856bd58fb599c 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -71,6 +71,20 @@ work on other platforms. Please report any problems and suggested fixes to
   causing the server to apply configuration intended for one host to any
   other innocent clients that come along later.  [ISC-Bugs #22018]
 
+- Minor code fixes
+  [ISC-Bugs #19566] When trying to find the zone for a name for ddns allow
+  the name to be at the apex of the zone.
+  [ISC-Bugs #19617] Restrict length of interface name read from command line
+  in dhcpd - based on a patch from David Cantrell at Red Hat.
+  [ISC-Bugs #20039] Correct some error messages in dhcpd.c
+  [ISC-Bugs #20070] Better range check on values when creating a DHCID.
+  [ISC-Bugs #20198] Avoid writing past the end of the field when adding 
+  overly long file or server names to a packet and add a log message
+  if the configuration supplied overly long names for these fields.
+  Thanks to Martin Pala.
+  [ISC-Bugs #21497] Add a little more randomness to rng seed in client
+  thanks to a patch from Jeremiah Jinno.
+
                        Changes since 4.2.0b2
 
 - Add declaration for variable in debug code in alloc.c.  [ISC-Bugs #21472]

diff --git a/client/dhclient.c b/client/dhclient.c
index 640530a8e9878bd78eb7561e6650db70ffae6aee..69d6a05e66e465cdba599636d1d8dbf596a4f087 100644 (file)
--- a/client/dhclient.c
+++ b/client/dhclient.c
@@ -3,7 +3,7 @@
    DHCP Client. */
 
 /*
- * Copyright (c) 2004-2009 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2004-2010 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 1995-2003 by Internet Software Consortium
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -543,7 +543,7 @@ main(int argc, char **argv) {
                                            sizeof seed], sizeof seed);
                seed += junk;
        }
-       srandom(seed + cur_time);
+       srandom(seed + cur_time + (unsigned)getpid());
 
        /* Start a configuration state machine for each interface. */
 #ifdef DHCPv6

diff --git a/common/dns.c b/common/dns.c
index b9d6d2ac636b58e1b3da64d6940ad8931600c13e..8f1db46b77ab68bcacf2e77cb96e0625ee4762bd 100644 (file)
--- a/common/dns.c
+++ b/common/dns.c
@@ -658,13 +658,16 @@ find_cached_zone(dhcp_ddns_cb_t *ddns_cb, int direction)
 
        /*
         * For each subzone, try to find a cached zone.
-        * Skip the first zone as that shouldn't work.
         */
-       for (np = strchr(np, '.'); np != NULL; np = strchr(np, '.')) {
-               np++;
+       for (;;) {
                status = dns_zone_lookup (&zone, np);
                if (status == ISC_R_SUCCESS)
                        break;
+
+               np = strchr(np, '.');
+               if (np == NULL)
+                       break;
+               np++;
        }
 
        if (status != ISC_R_SUCCESS)
@@ -805,7 +808,11 @@ int get_dhcid (struct data_string *id,
        id->buffer->data[0] = ISC_MD5_DIGESTLENGTH * 2 + 2;
 
        /* Put the type in the next two bytes. */
-       id->buffer->data[1] = "0123456789abcdef"[type >> 4];
+       id->buffer->data[1] = "0123456789abcdef"[(type >> 4) & 0xf];
+       /* This should have been [type & 0xf] but now that
+        * it is in use we need to leave it this way in order
+        * to avoid disturbing customer's lease files
+        */
        id->buffer->data[2] = "0123456789abcdef"[type % 15];
   
        /* Mash together an MD5 hash of the identifier. */

diff --git a/server/dhcp.c b/server/dhcp.c
index 8fbd7337f5cbdaacbe60579c3b77d77206c7dbc6..374671c13145cf5a4d889e10268a687c98139ac4 100644 (file)
--- a/server/dhcp.c
+++ b/server/dhcp.c
@@ -1084,10 +1084,13 @@ void dhcpinform (packet, ms_nulltp)
                                   packet -> options, (struct option_state *)0,
                                   &global_scope, oc, MDL)) {
                i = d1.len;
-               if (i > sizeof raw.file)
-                       i = sizeof raw.file;
-               else
-                       raw.file [i] = 0;
+               if (i >= sizeof(raw.file)) {
+                       log_info("file name longer than packet field "
+                                "truncated - field: %d name: %d %.*s", 
+                                sizeof(raw.file), i, i, d1.data);
+                       i = sizeof(raw.file);
+               } else
+                       raw.file[i] = 0;
                memcpy (raw.file, d1.data, i);
                data_string_forget (&d1, MDL);
        }
@@ -1100,10 +1103,13 @@ void dhcpinform (packet, ms_nulltp)
                                   packet -> options, (struct option_state *)0,
                                   &global_scope, oc, MDL)) {
                i = d1.len;
-               if (i > sizeof raw.sname)
-                       i = sizeof raw.sname;
-               else
-                       raw.sname [i] = 0;
+               if (i >= sizeof(raw.sname)) {
+                       log_info("server name longer than packet field "
+                                "truncated - field: %d name: %d %.*s", 
+                                sizeof(raw.sname), i, i, d1.data);
+                       i = sizeof(raw.sname);
+               } else
+                       raw.sname[i] = 0;
                memcpy (raw.sname, d1.data, i);
                data_string_forget (&d1, MDL);
        }
@@ -3010,6 +3016,11 @@ void dhcp_reply (lease)
                if (sizeof raw.file > state -> filename.len)
                        memset (&raw.file [state -> filename.len], 0,
                                (sizeof raw.file) - state -> filename.len);
+               else 
+                       log_info("file name longer than packet field "
+                                "truncated - field: %d name: %d %.*s", 
+                                sizeof(raw.file), state->filename.len,
+                                state->filename.len, state->filename.data);
        } else
                bufs |= 1;
 
@@ -3023,6 +3034,12 @@ void dhcp_reply (lease)
                if (sizeof raw.sname > state -> server_name.len)
                        memset (&raw.sname [state -> server_name.len], 0,
                                (sizeof raw.sname) - state -> server_name.len);
+               else 
+                       log_info("server name longer than packet field "
+                                "truncated - field: %d name: %d %.*s", 
+                                sizeof(raw.sname), state->server_name.len,
+                                state->server_name.len,
+                                state->server_name.data);
        } else
                bufs |= 2; /* XXX */
 

diff --git a/server/dhcpd.c b/server/dhcpd.c
index 43d9efaab757cdaa2c0220265154418bd9aaf2d0..1cac5397f1351c505fbbc51bb60a8ed89ebef3dd 100644 (file)
--- a/server/dhcpd.c
+++ b/server/dhcpd.c
@@ -404,6 +404,10 @@ main(int argc, char **argv) {
                } else {
                        struct interface_info *tmp =
                                (struct interface_info *)0;
+                       if (strlen(argv[i]) >= sizeof(tmp->name))
+                               log_fatal("%s: interface name too long "
+                                         "(is %ld)",
+                                         argv[i], (long)strlen(argv[i]));
                        result = interface_allocate (&tmp, MDL);
                        if (result != ISC_R_SUCCESS)
                                log_fatal ("Insufficient memory to %s %s: %s",
@@ -1014,7 +1018,7 @@ void postconf_initialization (int quiet)
                if (db.len == 4) {
                        memcpy (&limited_broadcast, db.data, 4);
                } else
-                       log_fatal ("invalid remote port data length");
+                       log_fatal ("invalid broadcast address data length");
                data_string_forget (&db, MDL);
        }
 
@@ -1028,7 +1032,7 @@ void postconf_initialization (int quiet)
                if (db.len == 4) {
                        memcpy (&local_address, db.data, 4);
                } else
-                       log_fatal ("invalid remote port data length");
+                       log_fatal ("invalid local address data length");
                data_string_forget (&db, MDL);
        }