CVS commit: pkgsrc/net/dnsmasq

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Feb  5 20:04:43 UTC 2021

Modified Files:
        pkgsrc/net/dnsmasq: Makefile distinfo

Log Message:
dnsmasq: updated to 2.84

version 2.84
Unknown changes

version 2.83
Use the values of --min-port and --max-port in outgoing
TCP connections to upstream DNS servers.

Fix a remote buffer overflow problem in the DNSSEC code. Any
dnsmasq with DNSSEC compiled in and enabled is vulnerable to this,
referenced by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683
CVE-2020-25687.

Be sure to only accept UDP DNS query replies at the address
from which the query was originated. This keeps as much entropy
in the {query-ID, random-port} tuple as possible, to help defeat
cache poisoning attacks. Refer: CVE-2020-25684.

Use the SHA-256 hash function to verify that DNS answers
received are for the questions originally asked. This replaces
the slightly insecure SHA-1 (when compiled with DNSSEC) or
the very insecure CRC32 (otherwise). Refer: CVE-2020-25685.

Handle multiple identical near simultaneous DNS queries better.
Previously, such queries would all be forwarded
independently. This is, in theory, inefficent but in practise
not a problem, _except_ that is means that an answer for any
of the forwarded queries will be accepted and cached.
An attacker can send a query multiple times, and for each repeat,
another {port, ID} becomes capable of accepting the answer he is
sending in the blind, to random IDs and ports. The chance of a
succesful attack is therefore multiplied by the number of repeats
of the query. The new behaviour detects repeated queries and
merely stores the clients sending repeats so that when the
first query completes, the answer can be sent to all the
clients who asked. Refer: CVE-2020-25686.


To generate a diff of this commit:
cvs rdiff -u -r1.43 -r1.44 pkgsrc/net/dnsmasq/Makefile
cvs rdiff -u -r1.39 -r1.40 pkgsrc/net/dnsmasq/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/dnsmasq/Makefile
diff -u pkgsrc/net/dnsmasq/Makefile:1.43 pkgsrc/net/dnsmasq/Makefile:1.44
--- pkgsrc/net/dnsmasq/Makefile:1.43    Mon Jul 27 16:41:11 2020
+++ pkgsrc/net/dnsmasq/Makefile Fri Feb  5 20:04:43 2021
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.43 2020/07/27 16:41:11 adam Exp $
+# $NetBSD: Makefile,v 1.44 2021/02/05 20:04:43 adam Exp $
 
-DISTNAME=      dnsmasq-2.82
+DISTNAME=      dnsmasq-2.84
 CATEGORIES=    net
 MASTER_SITES=  http://www.thekelleys.org.uk/dnsmasq/
 EXTRACT_SUFX=  .tar.xz

Index: pkgsrc/net/dnsmasq/distinfo
diff -u pkgsrc/net/dnsmasq/distinfo:1.39 pkgsrc/net/dnsmasq/distinfo:1.40
--- pkgsrc/net/dnsmasq/distinfo:1.39    Mon Jul 27 16:41:11 2020
+++ pkgsrc/net/dnsmasq/distinfo Fri Feb  5 20:04:43 2021
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.39 2020/07/27 16:41:11 adam Exp $
+$NetBSD: distinfo,v 1.40 2021/02/05 20:04:43 adam Exp $
 
-SHA1 (dnsmasq-2.82.tar.xz) = 4eb84825d5a3b7e4d7de1fc58c56dd4eb8cace71
-RMD160 (dnsmasq-2.82.tar.xz) = 7583a0a0fa85aa400069e74899ec9e2aaa40c9d1
-SHA512 (dnsmasq-2.82.tar.xz) = faf36efdaa3abe84994e46aea018b0a324218d42814baac056ca635f6d03f1301e7b4d958f92b272a8e3a7ac358f3a4e2606129a217587b471aedb3ce23e903b
-Size (dnsmasq-2.82.tar.xz) = 509904 bytes
+SHA1 (dnsmasq-2.84.tar.xz) = 60f6b8a6a86987613247c8dc32f61e28599ae285
+RMD160 (dnsmasq-2.84.tar.xz) = 51342173c980d756a99a0d8fb6ba9ab0f786b939
+SHA512 (dnsmasq-2.84.tar.xz) = e84bdcdf3cf35f08e8492eb5aa89ee6543233bdb821d01f164783bd6d0913ec01c513e85e2109352c77e77142a1a94bedcd3361f37d7b2a9a5d35a02448e85c6
+Size (dnsmasq-2.84.tar.xz) = 514216 bytes
 SHA1 (patch-src_bpf.c) = 4115a5391f57564663bbfc448fbb865c370318a6
 SHA1 (patch-src_dump.c) = 3e7553e8ed2444536ba94187f7a100a9abdbb353