Add patch from OWL for non-root/set*id/cap ping support.

Package-Manager: portage-2.2.0_alpha72/cvs/Linux x86_64

5 files changed, 334 insertions, 9 deletions

diff --git a/net-misc/iputils/ChangeLog b/net-misc/iputils/ChangeLog
index 2457ce1924bd..c65d7301c4ff 100644
--- a/net-misc/iputils/ChangeLog
+++ b/net-misc/iputils/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for net-misc/iputils
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/iputils/ChangeLog,v 1.98 2011/09/21 09:01:28 mgorny Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-misc/iputils/ChangeLog,v 1.99 2011/11/09 22:34:11 vapier Exp $
+
+*iputils-20101006-r2 (09 Nov 2011)
+
+  09 Nov 2011; Mike Frysinger <vapier@gentoo.org> +iputils-20101006-r2.ebuild,
+  +files/iputils-20101006-owl-pingsock.diff, iputils-99999999.ebuild:
+  Add patch from OWL for non-root/set*id/cap ping support.
 
   21 Sep 2011; Michał Górny <mgorny@gentoo.org> iputils-99999999.ebuild:
   Migrate to git-2.
diff --git a/net-misc/iputils/Manifest b/net-misc/iputils/Manifest
index 2b278c53f3de..547cbb95d710 100644
--- a/net-misc/iputils/Manifest
+++ b/net-misc/iputils/Manifest
@@ -15,6 +15,7 @@ AUX iputils-20100418-ping-CVE-2010-2529.patch 513 RMD160 a7de880c7033a19c889e57a
 AUX iputils-20100418-printf-size.patch 1658 RMD160 5ddc3104d1819d009a5cc0280a9d5450a4210d6e SHA1 47d280f6ce48086ec256ef1680db9de712d49e7f SHA256 95ce6cdf73cd5dbfbd962131fc1f6513713d4874ca161f5b24eaed21d58a1cfc
 AUX iputils-20100418-proper-libs.patch 427 RMD160 193c37ccd98bb9cb5ed1d98e067386768cca607e SHA1 695c795567e1914c83f346b629028484140811ba SHA256 6566f7dd311df08ed51a03758ef3137a24b1883452f86df1821bc266c6d1616f
 AUX iputils-20100418-so_mark.patch 597 RMD160 2387e035471e05d5cd5d923d312e213ee091f9b4 SHA1 391fc82a6868dea79f599befeb2c5e6000e5db27 SHA256 3c0c3e93d3b458a02f856be3681c2dd5bfb18933e4752e90dc277cdd353b3576
+AUX iputils-20101006-owl-pingsock.diff 6390 RMD160 2c89b1a7d8098b78bd6862b6bf69b9c0f2450f95 SHA1 2ebf2b10a963acc055630cd3402aae3c569273bb SHA256 1425efd6d30e6c9682569ff1de731922351048f81df44a2ebad30cca85fc51c9
 AUX iputils-20101006-tracepath-error-typo.patch 805 RMD160 869b3f47a6f0dce5a21fbcb46987bcc15c5b5f62 SHA1 9d3c07da36c0373b578e3d84ed9e5be0ae3a402a SHA256 176fbbbb9a07e821ba8ef619c59a6138ea8e85480962d9f937f9363644a372b7
 DIST iputils-s20100418-manpages.tar.bz2 21613 RMD160 cc42f88053c120f875b33c4f1567931b307aff85 SHA1 6522c2ccf713143de0fbc4e9d39497a2143a1713 SHA256 db42afbd393260cc72b53532b5812b35e377a38714e253fdcd7e2a6637b6a948
 DIST iputils-s20100418.tar.bz2 94237 RMD160 64ea24bb57ae2b8d666b4bf5d35c2d37236882d5 SHA1 eb787a65341d7bced3458766f7094b08f02b712f SHA256 d0e8cbe6ce6a484ffb81697425b3b933746882f6f1521ac71c5c88971cee7684
@@ -22,16 +23,15 @@ DIST iputils-s20101006-manpages.tar.bz2 21638 RMD160 3568e7b294cd6dbe167745573b8
 DIST iputils-s20101006.tar.bz2 94386 RMD160 d97c5c51f88db6e39d79812dfbc88efdc329305f SHA1 a08cc5423a7bf940205f2353fe3d129cd39ff242 SHA256 fd3af46c80ebb99607c2ca1f2a3608b6fe828e25bbec6e54f2afd25f6ddb6ee7
 EBUILD iputils-20100418-r1.ebuild 2446 RMD160 a0e6a5e1cc293d18a21461f43d50e7a7164efa21 SHA1 f83389a256745b7cb38b0c7c70728f386e7aa61a SHA256 be5ba47a48829aba8776fb0069f28c5b21e308bf43161f09912adc997e0004a1
 EBUILD iputils-20101006-r1.ebuild 2819 RMD160 04836e2c79d036b61801a1ac2dfd6ad4f0c22b3f SHA1 1e7a72b14382305409a750191df1cfbab710242e SHA256 5d6bf64ed3e3847abb8bfa828bfa7be616748752ad3dd8c23b2573b730ea61b9
+EBUILD iputils-20101006-r2.ebuild 2873 RMD160 ace9af76d67093cc9ddad221fd0cb4030b86c1a3 SHA1 68f220374431f7f9574fb890da242d3fb682fb8c SHA256 694d8069b94ce7188a3e52534979fa11045cec87a0f30ec881af73aa4b3c68bc
 EBUILD iputils-20101006.ebuild 2835 RMD160 7ce7328b02e13bea6229d5932d44562eeaaca313 SHA1 d05172502a4a848cea6b3b99d327ebcd0baba387 SHA256 c7c8db63108aab90a72d221c35962dd6ef1d02a6d8618df522c70ed9672a060b
-EBUILD iputils-99999999.ebuild 2815 RMD160 46eb179cb7a78f01b4a3e10aaf96b4acae464b59 SHA1 ee05ecbc99656b73dd218f908609ac6f9b8d510f SHA256 8ac5612b89096148ae7da6475bd2af4503fdfd7188703f38351343a10c213d6f
-MISC ChangeLog 14519 RMD160 22d8455bb2bb6b9eec811b43024985ea9f820c90 SHA1 b89bb0db6a8c31131d8b740b1da0bd34d7b8038a SHA256 ecdc7140d56eaeb5f362d63096886bffd0788152564174bee6b6a958d9e6fb0b
+EBUILD iputils-99999999.ebuild 2870 RMD160 7918d96160b046b0630a1bdde62b92fca8182f25 SHA1 477a272576ab7ed29be0660851316501e1b261f7 SHA256 b83275beed085923f5ad727395f3c55d67b4341a163c40e3a3a6552ca050d8af
+MISC ChangeLog 14764 RMD160 51c81026d1bc513b0ae9c9019d03874d596bd679 SHA1 9c5475c89c396a1f5c35a0628410552a406ee8d0 SHA256 38173f4bf25160df1af61f8f128f13f4803fe5afa096965d48859830e118f9ca
 MISC metadata.xml 299 RMD160 44839875595bd58f9d7f5245d366eb3d0e1ffb1f SHA1 224a2c26c04621e6277b1d887902911e4a9bc2eb SHA256 d028d4ba25f3ed29afbbf77abd924a617098bff71e6a0c37b7d6c0a24cd65a78
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.18 (GNU/Linux)
 
-iJwEAQEIAAYFAk55qHIACgkQfXuS5UK5QB1LVwP/ZnxNpz4JQmFrUDXJvFZwlr6q
-ayl/6KzW9sVlYU8Cn5T2d14MWiBEqmZwTGSHlHTckU//76gtBaTd6PQebzXq/GFt
-4zjbM9FOarFhMtJpsbWUPBo30ajvnTozatXfnDMBiY+zaybHlRzHW/AUoEEoU4eP
-3rn1n2t5qiTwqXiHiHk=
-=rnQZ
+iF4EAREIAAYFAk66/+oACgkQaC/OocHi7Jbo4wD/XMMdCW3I930GwuaY6FefstpW
+EO5VxFBQUo4uXUMyrw4A/3aC4iaWUYGW6ti8tgXc4SEXt2oQpGXmxvy+2A4ruF35
+=VgPS
 -----END PGP SIGNATURE-----
diff --git a/net-misc/iputils/files/iputils-20101006-owl-pingsock.diff b/net-misc/iputils/files/iputils-20101006-owl-pingsock.diff
new file mode 100644
index 000000000000..86c85bcaa27c
--- /dev/null
+++ b/net-misc/iputils/files/iputils-20101006-owl-pingsock.diff
@@ -0,0 +1,224 @@
+http://openwall.info/wiki/people/segoon/ping
+
+--- iputils-s20101006/ping.c
++++ iputils-s20101006/ping.c
+@@ -88,6 +88,7 @@ struct sockaddr_in whereto;	/* who to pi
+ int optlen = 0;
+ int settos = 0;			/* Set TOS, Precendence or other QOS options */
+ int icmp_sock;			/* socket file descriptor */
++int using_ping_socket = 0;
+ u_char outpack[0x10000];
+ int maxpacket = sizeof(outpack);
+ 
+@@ -123,7 +124,11 @@ main(int argc, char **argv)
+ 	char *target, hnamebuf[MAX_HOSTNAMELEN];
+ 	char rspace[3 + 4 * NROUTES + 1];	/* record route space */
+ 
+-	icmp_sock = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
++	icmp_sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
++	if (icmp_sock != -1)
++		using_ping_socket = 1;
++	else
++		icmp_sock = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
+ 	socket_errno = errno;
+ 
+ 	uid = getuid();
+@@ -377,13 +382,35 @@ main(int argc, char **argv)
+ 		}
+ 	}
+ 
+-	if ((options&F_STRICTSOURCE) &&
+-	    bind(icmp_sock, (struct sockaddr*)&source, sizeof(source)) == -1) {
+-		perror("bind");
+-		exit(2);
++	if (!using_ping_socket) {
++		if ((options&F_STRICTSOURCE) &&
++		    bind(icmp_sock, (struct sockaddr*)&source, sizeof(source)) == -1) {
++			perror("bind");
++			exit(2);
++		}
++	} else {
++		struct sockaddr_in sa;
++		socklen_t sl;
++
++		sa.sin_family = AF_INET;
++		sa.sin_port = 0;
++		sa.sin_addr.s_addr = (options&F_STRICTSOURCE) ?
++			source.sin_addr.s_addr : 0;
++		sl = sizeof(sa);
++
++		if (bind(icmp_sock, (struct sockaddr *) &sa, sl) == -1) {
++			perror("bind");
++			exit(2);
++		}
++
++		if (getsockname(icmp_sock, (struct sockaddr *) &sa, &sl) == -1) {
++			perror("getsockname");
++			exit(2);
++		}
++		ident = sa.sin_port;
+ 	}
+ 
+-	if (1) {
++	if (!using_ping_socket) {
+ 		struct icmp_filter filt;
+ 		filt.data = ~((1<<ICMP_SOURCE_QUENCH)|
+ 			      (1<<ICMP_DEST_UNREACH)|
+@@ -398,6 +425,12 @@ main(int argc, char **argv)
+ 	hold = 1;
+ 	if (setsockopt(icmp_sock, SOL_IP, IP_RECVERR, (char *)&hold, sizeof(hold)))
+ 		fprintf(stderr, "WARNING: your kernel is veeery old. No problems.\n");
++	if (using_ping_socket) {
++		if (setsockopt(icmp_sock, SOL_IP, IP_RECVTTL, (char *)&hold, sizeof(hold)))
++			perror("WARNING: setsockopt(IP_RECVTTL)");
++		if (setsockopt(icmp_sock, SOL_IP, IP_RETOPTS, (char *)&hold, sizeof(hold)))
++			perror("WARNING: setsockopt(IP_RETOPTS)");
++	}
+ 
+ 	/* record route option */
+ 	if (options & F_RROUTE) {
+@@ -566,6 +599,7 @@ int receive_error_msg()
+ 		nerrors++;
+ 	} else if (e->ee_origin == SO_EE_ORIGIN_ICMP) {
+ 		struct sockaddr_in *sin = (struct sockaddr_in*)(e+1);
++		int error_pkt;
+ 
+ 		if (res < sizeof(icmph) ||
+ 		    target.sin_addr.s_addr != whereto.sin_addr.s_addr ||
+@@ -576,9 +610,18 @@ int receive_error_msg()
+ 			goto out;
+ 		}
+ 
+-		acknowledge(ntohs(icmph.un.echo.sequence));
++		error_pkt = (e->ee_type != ICMP_REDIRECT &&
++			     e->ee_type != ICMP_SOURCE_QUENCH);
++		if (error_pkt) {
++			acknowledge(ntohs(icmph.un.echo.sequence));
++			net_errors++;
++			nerrors++;
++		}
++		else {
++			saved_errno = 0;
++		}
+ 
+-		if (!working_recverr) {
++		if (!using_ping_socket && !working_recverr) {
+ 			struct icmp_filter filt;
+ 			working_recverr = 1;
+ 			/* OK, it works. Add stronger filter. */
+@@ -589,15 +632,14 @@ int receive_error_msg()
+ 				perror("\rWARNING: setsockopt(ICMP_FILTER)");
+ 		}
+ 
+-		net_errors++;
+-		nerrors++;
+ 		if (options & F_QUIET)
+ 			goto out;
+ 		if (options & F_FLOOD) {
+-			write(STDOUT_FILENO, "\bE", 2);
++			if (error_pkt)
++				write(STDOUT_FILENO, "\bE", 2);
+ 		} else {
+ 			print_timestamp();
+-			printf("From %s icmp_seq=%u ", pr_addr(sin->sin_addr.s_addr), ntohs(icmph.un.echo.sequence));
++			printf("From %s: icmp_seq=%u ", pr_addr(sin->sin_addr.s_addr), ntohs(icmph.un.echo.sequence));
+ 			pr_icmph(e->ee_type, e->ee_code, e->ee_info, NULL);
+ 			fflush(stdout);
+ 		}
+@@ -695,15 +737,41 @@ parse_reply(struct msghdr *msg, int cc, 
+ 	struct iphdr *ip;
+ 	int hlen;
+ 	int csfailed;
++	struct cmsghdr *cmsg;
++	int ttl;
++	__u8 *opts;
++	int optlen;
+ 
+ 	/* Check the IP header */
+ 	ip = (struct iphdr *)buf;
+-	hlen = ip->ihl*4;
+-	if (cc < hlen + 8 || ip->ihl < 5) {
+-		if (options & F_VERBOSE)
+-			fprintf(stderr, "ping: packet too short (%d bytes) from %s\n", cc,
+-				pr_addr(from->sin_addr.s_addr));
+-		return 1;
++	if (!using_ping_socket) {
++		hlen = ip->ihl*4;
++		if (cc < hlen + 8 || ip->ihl < 5) {
++			if (options & F_VERBOSE)
++				fprintf(stderr, "ping: packet too short (%d bytes) from %s\n", cc,
++					pr_addr(from->sin_addr.s_addr));
++			return 1;
++		}
++		ttl = ip->ttl;
++		opts = buf + sizeof(struct iphdr);
++		optlen = hlen - sizeof(struct iphdr);
++	} else {
++		hlen = 0;
++		ttl = 0;
++		opts = buf;
++		optlen = 0;
++		for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
++			if (cmsg->cmsg_level != SOL_IP)
++				continue;
++			if (cmsg->cmsg_type == IP_TTL) {
++				if (cmsg->cmsg_len < sizeof(int))
++					continue;
++				ttl = *(int *) CMSG_DATA(cmsg);
++			} else if (cmsg->cmsg_type == IP_RETOPTS) {
++				opts = (__u8 *) CMSG_DATA(cmsg);
++				optlen = cmsg->cmsg_len;
++			}
++		}
+ 	}
+ 
+ 	/* Now the ICMP part */
+@@ -716,7 +784,7 @@ parse_reply(struct msghdr *msg, int cc, 
+ 			return 1;			/* 'Twas not our ECHO */
+ 		if (gather_statistics((__u8*)icp, sizeof(*icp), cc,
+ 				      ntohs(icp->un.echo.sequence),
+-				      ip->ttl, 0, tv, pr_addr(from->sin_addr.s_addr),
++				      ttl, 0, tv, pr_addr(from->sin_addr.s_addr),
+ 				      pr_echo_reply))
+ 			return 0;
+ 	} else {
+@@ -807,7 +875,7 @@ parse_reply(struct msghdr *msg, int cc, 
+ 	}
+ 
+ 	if (!(options & F_FLOOD)) {
+-		pr_options(buf + sizeof(struct iphdr), hlen);
++		pr_options(opts, optlen + sizeof(struct iphdr));
+ 
+ 		if (options & F_AUDIBLE)
+ 			putchar('\a');
+@@ -916,8 +984,7 @@ void pr_icmph(__u8 type, __u8 code, __u3
+ 			printf("Redirect, Bad Code: %d", code);
+ 			break;
+ 		}
+-		if (icp)
+-			printf("(New nexthop: %s)\n", pr_addr(icp->un.gateway));
++		printf("(New nexthop: %s)\n", pr_addr(icp ? icp->un.gateway : info));
+ 		if (icp && (options & F_VERBOSE))
+ 			pr_iph((struct iphdr*)(icp + 1));
+ 		break;
+@@ -1217,7 +1284,7 @@ void install_filter(void)
+ 		insns
+ 	};
+ 
+-	if (once)
++	if (once || using_ping_socket)
+ 		return;
+ 	once = 1;
+ 
+--- iputils-s20101006/ping_common.c
++++ iputils-s20101006/ping_common.c
+@@ -515,7 +515,8 @@ void setup(int icmp_sock)
+ 			*p++ = i;
+ 	}
+ 
+-	ident = htons(getpid() & 0xFFFF);
++	if (!ident)
++		ident = htons(getpid() & 0xFFFF);
+ 
+ 	set_signal(SIGINT, sigexit);
+ 	set_signal(SIGALRM, sigexit);
diff --git a/net-misc/iputils/iputils-20101006-r2.ebuild b/net-misc/iputils/iputils-20101006-r2.ebuild
new file mode 100644
index 000000000000..ace5a8c68d57
--- /dev/null
+++ b/net-misc/iputils/iputils-20101006-r2.ebuild
@@ -0,0 +1,94 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-misc/iputils/iputils-20101006-r2.ebuild,v 1.1 2011/11/09 22:34:11 vapier Exp $
+
+# For released versions, we precompile the man/html pages and store
+# them in a tarball on our mirrors.  This avoids ugly issues while
+# building stages, and when the jade/sgml packages are broken (which
+# seems to be more common than would be nice).
+
+EAPI="2"
+
+inherit flag-o-matic eutils toolchain-funcs
+if [[ ${PV} == "99999999" ]] ; then
+	EGIT_REPO_URI="git://www.linux-ipv6.org/gitroot/iputils"
+	inherit git-2
+else
+	SRC_URI="http://www.skbuff.net/iputils/iputils-s${PV}.tar.bz2
+		mirror://gentoo/iputils-s${PV}-manpages.tar.bz2"
+	KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-linux ~x86-linux"
+fi
+
+DESCRIPTION="Network monitoring tools including ping and ping6"
+HOMEPAGE="http://www.linux-foundation.org/en/Net:Iputils"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="doc idn ipv6 SECURITY_HAZARD ssl static"
+
+RDEPEND="!net-misc/rarpd
+	ssl? ( dev-libs/openssl )
+	idn? ( net-dns/libidn )"
+DEPEND="${RDEPEND}
+	virtual/os-headers"
+if [[ ${PV} == "99999999" ]] ; then
+	DEPEND+="
+		app-text/openjade
+		dev-perl/SGMLSpm
+		app-text/docbook-sgml-dtd
+		app-text/docbook-sgml-utils
+	"
+fi
+
+S=${WORKDIR}/${PN}-s${PV}
+
+src_prepare() {
+	epatch "${FILESDIR}"/021109-uclibc-no-ether_ntohost.patch
+	epatch "${FILESDIR}"/${PN}-20100418-openssl.patch #335436
+	epatch "${FILESDIR}"/${PN}-20100418-so_mark.patch #335347
+	epatch "${FILESDIR}"/${PN}-20100418-makefile.patch
+	epatch "${FILESDIR}"/${PN}-20100418-proper-libs.patch #332703
+	epatch "${FILESDIR}"/${PN}-20100418-printf-size.patch
+	epatch "${FILESDIR}"/${PN}-20100418-aliasing.patch
+	epatch "${FILESDIR}"/${PN}-20071127-kernel-ifaddr.patch
+	epatch "${FILESDIR}"/${PN}-20070202-idn.patch #218638
+	epatch "${FILESDIR}"/${PN}-20071127-infiniband.patch #377687
+	epatch "${FILESDIR}"/${PN}-20101006-owl-pingsock.diff
+	use SECURITY_HAZARD && epatch "${FILESDIR}"/${PN}-20071127-nonroot-floodping.patch
+	use static && append-ldflags -static
+	use ssl && append-cppflags -DHAVE_OPENSSL
+	use ipv6 || sed -i -e 's:IPV6_TARGETS=:#IPV6_TARGETS=:' Makefile
+	export IDN=$(use idn && echo yes)
+}
+
+src_compile() {
+	tc-export CC
+	emake || die
+
+	if [[ ${PV} == "99999999" ]] ; then
+		emake -j1 html man || die
+	fi
+}
+
+src_install() {
+	into /
+	dobin ping || die
+	use ipv6 && dobin ping6
+	dosbin arping || die
+	into /usr
+	dosbin tracepath || die
+	use ipv6 && dosbin trace{path,route}6
+	dosbin clockdiff rarpd rdisc ipg tftpd || die
+
+	fperms 4711 /bin/ping
+	use ipv6 && fperms 4711 /bin/ping6 /usr/sbin/traceroute6
+
+	dodoc INSTALL RELNOTES
+	use ipv6 \
+		&& dosym ping.8 /usr/share/man/man8/ping6.8 \
+		|| rm -f doc/*6.8
+	rm -f doc/setkey.8
+	doman doc/*.8
+
+	use doc && dohtml doc/*.html
+}
diff --git a/net-misc/iputils/iputils-99999999.ebuild b/net-misc/iputils/iputils-99999999.ebuild
index 44546cfe1ed8..5207736b8d17 100644
--- a/net-misc/iputils/iputils-99999999.ebuild
+++ b/net-misc/iputils/iputils-99999999.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2011 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/iputils/iputils-99999999.ebuild,v 1.5 2011/09/21 09:01:28 mgorny Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-misc/iputils/iputils-99999999.ebuild,v 1.6 2011/11/09 22:34:11 vapier Exp $
 
 # For released versions, we precompile the man/html pages and store
 # them in a tarball on our mirrors.  This avoids ugly issues while
@@ -53,6 +53,7 @@ src_prepare() {
 	epatch "${FILESDIR}"/${PN}-20071127-kernel-ifaddr.patch
 	epatch "${FILESDIR}"/${PN}-20070202-idn.patch #218638
 	epatch "${FILESDIR}"/${PN}-20071127-infiniband.patch #377687
+	epatch "${FILESDIR}"/${PN}-20101006-owl-pingsock.diff
 	use SECURITY_HAZARD && epatch "${FILESDIR}"/${PN}-20071127-nonroot-floodping.patch
 	use static && append-ldflags -static
 	use ssl && append-cppflags -DHAVE_OPENSSL