Skip to content

Commit df1f8b0

Browse files
CBL-Mariner-Botharshitgupta1337
CBL-Mariner-Bot
and
harshitgupta1337
authored
[AUTO-CHERRYPICK] Upgraded keepalived to 2.3.1 and patched CVE-2024-41184. - branch main (#10458)
Co-authored-by: Harshit Gupta <harshitgupta1337@gmail.com>
1 parent 9e01ea9 commit df1f8b0

4 files changed

Lines changed: 390 additions & 6 deletions

File tree

‎SPECS/keepalived/CVE-2024-41184.patch‎

Lines changed: 379 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,379 @@
1+
From f3a32e3557520dccb298b36b4952eff3e236fb86 Mon Sep 17 00:00:00 2001
2+
From: Quentin Armitage <quentin@armitage.org.uk>
3+
Date: Fri, 12 Jul 2024 15:11:13 +0100
4+
Subject: [PATCH 1/5] lib: don't return subtracted addresses for rb_find()
5+
compare function
6+
7+
If sizeof(int) < sizeof(void *) returning the difference between two
8+
addresses in an int can cause an overflow.
9+
10+
Use less_equal_greater_than() for comparing addresses.
11+
12+
Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
13+
---
14+
lib/memory.c | 2 +-
15+
1 file changed, 1 insertion(+), 1 deletion(-)
16+
17+
diff --git a/lib/memory.c b/lib/memory.c
18+
index c7217fdd..4b250ac9 100644
19+
--- a/lib/memory.c
20+
+++ b/lib/memory.c
21+
@@ -200,7 +200,7 @@ static unsigned free_list_size;
22+
static inline int
23+
memcheck_ptr_cmp(const void *key, const struct rb_node *a)
24+
{
25+
- return (const char *)key - (char *)rb_entry_const(a, MEMCHECK, t)->ptr;
26+
+ return less_equal_greater_than((const char *)key, (char *)rb_entry_const(a, MEMCHECK, t)->ptr);
27+
}
28+
29+
static inline bool
30+
--
31+
2.34.1
32+
33+
34+
From e78513fe0ce5d83c226ea2c0bd222f375c2438e7 Mon Sep 17 00:00:00 2001
35+
From: Quentin Armitage <quentin@armitage.org.uk>
36+
Date: Fri, 12 Jul 2024 15:16:47 +0100
37+
Subject: [PATCH 2/5] vrrp: Handle empty ipset names with vrrp_ipsets keyword
38+
39+
We now handle empty ipset names and return a config error.
40+
41+
Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
42+
---
43+
keepalived/core/global_parser.c | 40 ++++++++++++++++++---------------
44+
1 file changed, 22 insertions(+), 18 deletions(-)
45+
46+
diff --git a/keepalived/core/global_parser.c b/keepalived/core/global_parser.c
47+
index ed76b5cb..8935e502 100644
48+
--- a/keepalived/core/global_parser.c
49+
+++ b/keepalived/core/global_parser.c
50+
@@ -1099,6 +1099,22 @@ vrrp_iptables_handler(const vector_t *strvec)
51+
}
52+
}
53+
#ifdef _HAVE_LIBIPSET_
54+
+static bool
55+
+check_valid_ipset_name(const vector_t *strvec, unsigned entry, const char *log_name)
56+
+{
57+
+ if (strlen(strvec_slot(strvec, entry)) >= IPSET_MAXNAMELEN - 1) {
58+
+ report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset %s name too long - ignored", log_name);
59+
+ return false;
60+
+ }
61+
+
62+
+ if (strlen(strvec_slot(strvec, entry)) == 0) {
63+
+ report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset %s name empty - ignored", log_name);
64+
+ return false;
65+
+ }
66+
+
67+
+ return true;
68+
+}
69+
+
70+
static void
71+
vrrp_ipsets_handler(const vector_t *strvec)
72+
{
73+
@@ -1119,17 +1135,13 @@ vrrp_ipsets_handler(const vector_t *strvec)
74+
return;
75+
}
76+
77+
- if (strlen(strvec_slot(strvec,1)) >= IPSET_MAXNAMELEN - 1) {
78+
- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset address name too long - ignored");
79+
+ if (!check_valid_ipset_name(strvec, 1, "address"))
80+
return;
81+
- }
82+
global_data->vrrp_ipset_address = STRDUP(strvec_slot(strvec,1));
83+
84+
if (vector_size(strvec) >= 3) {
85+
- if (strlen(strvec_slot(strvec,2)) >= IPSET_MAXNAMELEN - 1) {
86+
- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset IPv6 address name too long - ignored");
87+
+ if (!check_valid_ipset_name(strvec, 2, "IPv6 address"))
88+
return;
89+
- }
90+
global_data->vrrp_ipset_address6 = STRDUP(strvec_slot(strvec,2));
91+
} else {
92+
/* No second set specified, copy first name and add "6" */
93+
@@ -1140,10 +1152,8 @@ vrrp_ipsets_handler(const vector_t *strvec)
94+
}
95+
96+
if (vector_size(strvec) >= 4) {
97+
- if (strlen(strvec_slot(strvec,3)) >= IPSET_MAXNAMELEN - 1) {
98+
- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset IPv6 address_iface name too long - ignored");
99+
+ if (!check_valid_ipset_name(strvec, 3, "IPv6 address_iface"))
100+
return;
101+
- }
102+
global_data->vrrp_ipset_address_iface6 = STRDUP(strvec_slot(strvec,3));
103+
} else {
104+
/* No third set specified, copy second name and add "_if6" */
105+
@@ -1157,10 +1167,8 @@ vrrp_ipsets_handler(const vector_t *strvec)
106+
}
107+
108+
if (vector_size(strvec) >= 5) {
109+
- if (strlen(strvec_slot(strvec,4)) >= IPSET_MAXNAMELEN - 1) {
110+
- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset IGMP name too long - ignored");
111+
+ if (!check_valid_ipset_name(strvec, 4, "IGMP"))
112+
return;
113+
- }
114+
global_data->vrrp_ipset_igmp = STRDUP(strvec_slot(strvec,4));
115+
} else {
116+
/* No second set specified, copy first name and add "_igmp" */
117+
@@ -1171,10 +1179,8 @@ vrrp_ipsets_handler(const vector_t *strvec)
118+
}
119+
120+
if (vector_size(strvec) >= 6) {
121+
- if (strlen(strvec_slot(strvec,5)) >= IPSET_MAXNAMELEN - 1) {
122+
- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset MLD name too long - ignored");
123+
+ if (!check_valid_ipset_name(strvec, 5, "MLD"))
124+
return;
125+
- }
126+
global_data->vrrp_ipset_mld = STRDUP(strvec_slot(strvec,5));
127+
} else {
128+
/* No second set specified, copy first name and add "_mld" */
129+
@@ -1186,10 +1192,8 @@ vrrp_ipsets_handler(const vector_t *strvec)
130+
131+
#ifdef _HAVE_VRRP_VMAC_
132+
if (vector_size(strvec) >= 7) {
133+
- if (strlen(strvec_slot(strvec,6)) >= IPSET_MAXNAMELEN - 1) {
134+
- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset ND name too long - ignored");
135+
+ if (!check_valid_ipset_name(strvec, 6, "ND"))
136+
return;
137+
- }
138+
global_data->vrrp_ipset_vmac_nd = STRDUP(strvec_slot(strvec,6));
139+
} else {
140+
/* No second set specified, copy first name and add "_nd" */
141+
--
142+
2.34.1
143+
144+
145+
From 281de3aa8a0990fa3cd694a9addc0bf28953da0b Mon Sep 17 00:00:00 2001
146+
From: Quentin Armitage <quentin@armitage.org.uk>
147+
Date: Fri, 12 Jul 2024 15:18:20 +0100
148+
Subject: [PATCH 3/5] vrrp: handle empty iptables chain names - vrrp_iptables
149+
keyword
150+
151+
We now return an error if a chain name is empty.
152+
153+
Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
154+
---
155+
keepalived/core/global_parser.c | 42 ++++++++++++++++++++-------------
156+
1 file changed, 25 insertions(+), 17 deletions(-)
157+
158+
diff --git a/keepalived/core/global_parser.c b/keepalived/core/global_parser.c
159+
index 8935e502..3d436e49 100644
160+
--- a/keepalived/core/global_parser.c
161+
+++ b/keepalived/core/global_parser.c
162+
@@ -1072,6 +1072,28 @@ vrrp_higher_prio_send_advert_handler(const vector_t *strvec)
163+
global_data->vrrp_higher_prio_send_advert = true;
164+
}
165+
#ifdef _WITH_IPTABLES_
166+
+static bool
167+
+check_valid_iptables_ipset_name(const vector_t *strvec, unsigned entry, unsigned max_len, const char *type_name, const char *log_name)
168+
+{
169+
+ if (strlen(strvec_slot(strvec, entry)) >= max_len - 1) {
170+
+ report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : %s %s name too long - ignored", type_name, log_name);
171+
+ return false;
172+
+ }
173+
+
174+
+ if (strlen(strvec_slot(strvec, entry)) == 0) {
175+
+ report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : %s %s name empty - ignored", type_name, log_name);
176+
+ return false;
177+
+ }
178+
+
179+
+ return true;
180+
+}
181+
+
182+
+static bool
183+
+check_valid_iptables_chain_name(const vector_t *strvec, unsigned entry, const char *log_name)
184+
+{
185+
+ return check_valid_iptables_ipset_name(strvec, entry, XT_EXTENSION_MAXNAMELEN, "iptables", log_name);
186+
+}
187+
+
188+
static void
189+
vrrp_iptables_handler(const vector_t *strvec)
190+
{
191+
@@ -1081,16 +1103,12 @@ vrrp_iptables_handler(const vector_t *strvec)
192+
}
193+
194+
if (vector_size(strvec) >= 2) {
195+
- if (strlen(strvec_slot(strvec,1)) >= XT_EXTENSION_MAXNAMELEN - 1) {
196+
- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : iptables in chain name too long - ignored");
197+
+ if (!check_valid_iptables_chain_name(strvec, 1, "in chain"))
198+
return;
199+
- }
200+
global_data->vrrp_iptables_inchain = STRDUP(strvec_slot(strvec,1));
201+
if (vector_size(strvec) >= 3) {
202+
- if (strlen(strvec_slot(strvec,2)) >= XT_EXTENSION_MAXNAMELEN - 1) {
203+
- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : iptables out chain name too long - ignored");
204+
+ if (!check_valid_iptables_chain_name(strvec, 2, "out chain"))
205+
return;
206+
- }
207+
global_data->vrrp_iptables_outchain = STRDUP(strvec_slot(strvec,2));
208+
}
209+
} else {
210+
@@ -1102,17 +1120,7 @@ vrrp_iptables_handler(const vector_t *strvec)
211+
static bool
212+
check_valid_ipset_name(const vector_t *strvec, unsigned entry, const char *log_name)
213+
{
214+
- if (strlen(strvec_slot(strvec, entry)) >= IPSET_MAXNAMELEN - 1) {
215+
- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset %s name too long - ignored", log_name);
216+
- return false;
217+
- }
218+
-
219+
- if (strlen(strvec_slot(strvec, entry)) == 0) {
220+
- report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : ipset %s name empty - ignored", log_name);
221+
- return false;
222+
- }
223+
-
224+
- return true;
225+
+ return check_valid_iptables_ipset_name(strvec, entry, IPSET_MAXNAMELEN, "ipset", log_name);
226+
}
227+
228+
static void
229+
--
230+
2.34.1
231+
232+
233+
From 1e5902c4793ac01b810f0faa3b5cf47b41ae95c1 Mon Sep 17 00:00:00 2001
234+
From: Quentin Armitage <quentin@armitage.org.uk>
235+
Date: Fri, 12 Jul 2024 15:32:35 +0100
236+
Subject: [PATCH 4/5] vrrp and ipvs: handle empty nftables chain names
237+
238+
We now return an error if a chain name is empty.
239+
240+
Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
241+
---
242+
keepalived/core/global_parser.c | 25 +++++++++++++++----------
243+
1 file changed, 15 insertions(+), 10 deletions(-)
244+
245+
diff --git a/keepalived/core/global_parser.c b/keepalived/core/global_parser.c
246+
index 3d436e49..0a8f53ac 100644
247+
--- a/keepalived/core/global_parser.c
248+
+++ b/keepalived/core/global_parser.c
249+
@@ -1071,9 +1071,10 @@ vrrp_higher_prio_send_advert_handler(const vector_t *strvec)
250+
else
251+
global_data->vrrp_higher_prio_send_advert = true;
252+
}
253+
-#ifdef _WITH_IPTABLES_
254+
+
255+
+#if defined _WITH_IPTABLES_ || defined _WITH_NFTABLES_
256+
static bool
257+
-check_valid_iptables_ipset_name(const vector_t *strvec, unsigned entry, unsigned max_len, const char *type_name, const char *log_name)
258+
+check_valid_iptables_ipset_nftables_name(const vector_t *strvec, unsigned entry, unsigned max_len, const char *type_name, const char *log_name)
259+
{
260+
if (strlen(strvec_slot(strvec, entry)) >= max_len - 1) {
261+
report_config_error(CONFIG_GENERAL_ERROR, "VRRP Error : %s %s name too long - ignored", type_name, log_name);
262+
@@ -1087,11 +1088,13 @@ check_valid_iptables_ipset_name(const vector_t *strvec, unsigned entry, unsigned
263+
264+
return true;
265+
}
266+
+#endif
267+
268+
+#ifdef _WITH_IPTABLES_
269+
static bool
270+
check_valid_iptables_chain_name(const vector_t *strvec, unsigned entry, const char *log_name)
271+
{
272+
- return check_valid_iptables_ipset_name(strvec, entry, XT_EXTENSION_MAXNAMELEN, "iptables", log_name);
273+
+ return check_valid_iptables_ipset_nftables_name(strvec, entry, XT_EXTENSION_MAXNAMELEN, "iptables", log_name);
274+
}
275+
276+
static void
277+
@@ -1120,7 +1123,7 @@ vrrp_iptables_handler(const vector_t *strvec)
278+
static bool
279+
check_valid_ipset_name(const vector_t *strvec, unsigned entry, const char *log_name)
280+
{
281+
- return check_valid_iptables_ipset_name(strvec, entry, IPSET_MAXNAMELEN, "ipset", log_name);
282+
+ return check_valid_iptables_ipset_nftables_name(strvec, entry, IPSET_MAXNAMELEN, "ipset", log_name);
283+
}
284+
285+
static void
286+
@@ -1229,6 +1232,12 @@ vrrp_iptables_handler(__attribute__((unused)) const vector_t *strvec)
287+
288+
#ifdef _WITH_NFTABLES_
289+
#ifdef _WITH_VRRP_
290+
+static bool
291+
+check_valid_nftables_chain_name(const vector_t *strvec, unsigned entry, const char *log_name)
292+
+{
293+
+ return check_valid_iptables_ipset_nftables_name(strvec, entry, NFT_TABLE_MAXNAMELEN, "nftables", log_name);
294+
+}
295+
+
296+
static void
297+
vrrp_nftables_handler(__attribute__((unused)) const vector_t *strvec)
298+
{
299+
@@ -1240,10 +1249,8 @@ vrrp_nftables_handler(__attribute__((unused)) const vector_t *strvec)
300+
}
301+
302+
if (vector_size(strvec) >= 2) {
303+
- if (strlen(strvec_slot(strvec, 1)) >= NFT_TABLE_MAXNAMELEN) {
304+
- report_config_error(CONFIG_GENERAL_ERROR, "nftables table name too long - ignoring");
305+
+ if (!check_valid_nftables_chain_name(strvec, 1, "chain"))
306+
return;
307+
- }
308+
name = strvec_slot(strvec, 1);
309+
}
310+
else {
311+
@@ -1283,10 +1290,8 @@ ipvs_nftables_handler(__attribute__((unused)) const vector_t *strvec)
312+
}
313+
314+
if (vector_size(strvec) >= 2) {
315+
- if (strlen(strvec_slot(strvec, 1)) >= NFT_TABLE_MAXNAMELEN) {
316+
- report_config_error(CONFIG_GENERAL_ERROR, "ipvs nftables table name too long - ignoring");
317+
+ if (!check_valid_nftables_chain_name(strvec, 1, "ipvs chain"))
318+
return;
319+
- }
320+
name = strvec_slot(strvec, 1);
321+
}
322+
else {
323+
--
324+
2.34.1
325+
326+
327+
From 7e2cabdb1391f9378fbb76513c2ee9c88b15dba8 Mon Sep 17 00:00:00 2001
328+
From: Quentin Armitage <quentin@armitage.org.uk>
329+
Date: Fri, 12 Jul 2024 15:34:54 +0100
330+
Subject: [PATCH 5/5] configure: add --enable-sanitize-address option
331+
332+
Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
333+
---
334+
configure.ac | 15 +++++++++++++++
335+
1 file changed, 15 insertions(+)
336+
337+
diff --git a/configure.ac b/configure.ac
338+
index 180beb6f..1ba691b6 100644
339+
--- a/configure.ac
340+
+++ b/configure.ac
341+
@@ -263,6 +263,8 @@ AC_ARG_ENABLE(stacktrace,
342+
[AS_HELP_STRING([--enable-stacktrace], [compile with stacktrace support])])
343+
AC_ARG_ENABLE(perf,
344+
[AS_HELP_STRING([--enable-perf], [compile with perf performance data recording support for vrrp process])])
345+
+AC_ARG_ENABLE(sanitize-address,
346+
+ [AS_HELP_STRING([--enable-sanitize-address], [compile with sanitize=address (ASAN) support])])
347+
AC_ARG_ENABLE(log-file,
348+
[AS_HELP_STRING([--enable-log-file], [enable logging to file (-g)])])
349+
AC_ARG_ENABLE(dump-threads,
350+
@@ -2848,6 +2850,16 @@ else
351+
ENABLE_PERF=No
352+
fi
353+
354+
+dnl ----[ sanitize=address testing or not? ]----
355+
+if test "${enable_sanitize_address}" = yes; then
356+
+# AC_DEFINE([_WITH_SANITIZE_ADDRESS_], [ 1 ], [Define to 1 to build with sanitize=address support])
357+
+ ENABLE_SANITIZE_ADDRESS=Yes
358+
+ add_config_opt([SANITIZE_ADDRESS])
359+
+ add_to_var([KA_CFLAGS], [-fsanitize=address -g])
360+
+else
361+
+ ENABLE_SANITIZE_ADDRESS=No
362+
+fi
363+
+
364+
if test "${enable_log_file}" = yes; then
365+
AC_DEFINE([ENABLE_LOG_TO_FILE], [ 1 ], [Define if enabling logging to files])
366+
ENABLE_LOG_FILE_APPEND=Yes
367+
@@ -3271,6 +3283,9 @@ fi
368+
if test ${ENABLE_PERF} = Yes; then
369+
echo "Perf support : Yes"
370+
fi
371+
+if test ${ENABLE_SANITIZE_ADDRESS} = Yes; then
372+
+ echo "sanitize=address testing : Yes"
373+
+fi
374+
if test ${MEM_CHECK} = Yes; then
375+
echo "Memory alloc check : Yes"
376+
echo "Memory alloc check log : ${MEM_CHECK_LOG}"
377+
--
378+
2.34.1
379+

‎SPECS/keepalived/keepalived.signatures.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"Signatures": {
3-
"keepalived-2.2.7.tar.gz": "c61940d874154a560a54627ecf7ef47adebdf832164368d10bf242a4d9b7d49d",
3+
"keepalived-2.3.1.tar.gz": "92f4b69bfd998e2306d1995ad16fdad1b59e70be694c883385c5f55e02c62aa3",
44
"keepalived.service": "533fac0ed629192f87b42f5fa2ba4443bccc3ac383e9495be97369616b95d6bd"
55
}
6-
}
6+
}

0 commit comments

Comments
 (0)