From e58b6eb17110e266be07db10d2af212b58cc8f0f Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sat, 15 Aug 2026 16:18:44 +0900 Subject: internal/rosa/package: net-tools These are nice to have, but will not be included in the base system. Signed-off-by: Ophestra --- internal/rosa/package/hakurei.az | 150 +++++++++++++++++++ internal/rosa/package/hakurei/hostname | 11 -- internal/rosa/package/hakurei/package.az | 162 --------------------- .../rosa/package/net-tools/CVE-2025-46836.patch | 115 +++++++++++++++ .../package/net-tools/GHSA-h667-qrp8-gj58.patch | 53 +++++++ .../package/net-tools/GHSA-w7jq-cmw2-cq59.patch | 71 +++++++++ .../f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch | 22 +++ internal/rosa/package/net-tools/package.az | 33 +++++ 8 files changed, 444 insertions(+), 173 deletions(-) create mode 100644 internal/rosa/package/hakurei.az delete mode 100644 internal/rosa/package/hakurei/hostname delete mode 100644 internal/rosa/package/hakurei/package.az create mode 100644 internal/rosa/package/net-tools/CVE-2025-46836.patch create mode 100644 internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch create mode 100644 internal/rosa/package/net-tools/GHSA-w7jq-cmw2-cq59.patch create mode 100644 internal/rosa/package/net-tools/f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch create mode 100644 internal/rosa/package/net-tools/package.az diff --git a/internal/rosa/package/hakurei.az b/internal/rosa/package/hakurei.az new file mode 100644 index 00000000..229af5fc --- /dev/null +++ b/internal/rosa/package/hakurei.az @@ -0,0 +1,150 @@ +package hakurei-source { + description = "hakurei source tree"; + exclude = true; + + version# = "0.4.6"; + output = remoteTar { + url = "https://git.gensokyo.uk/rosa/hakurei/archive/"+ + "v"+version+".tar.gz"; + checksum = "2HxvdykuSSymAu-c1WIwQAy3qT4dDm8B--93iL4uomBlBC8wfSWldbvPF1noNkUC"; + compress = gzip; + }; +} + +package hakurei { + description = "low-level userspace tooling for Rosa OS"; + website = "https://hakurei.app"; + anitya = 388834; + + source = hakurei-source; + enterSource = true; + writable = true; + chmod = true; + + env = [ + "CGO_ENABLED=1", + "GOCACHE=/tmp/gocache", + "CC=clang -O3 -Werror", + ]; + + exec = generic { + chdir = false; + build = ` +mkdir -p /work/system/libexec/hakurei/ + +echo "Building hakurei for $(go env GOOS)/$(go env GOARCH)." +go generate ./... +go build -trimpath -tags=rosa -o /work/system/libexec/hakurei -ldflags="-s -w + -buildid= + -linkmode external + -extldflags=-static + -X hakurei.app/internal/info.buildVersion=$(cat cmd/dist/VERSION) + -X hakurei.app/internal/info.hakureiPath=/system/bin/hakurei + -X hakurei.app/internal/info.hsuPath=/system/bin/hsu +" ./cmd/hakurei ./cmd/sharefs + +echo "Building hsu for $(go env GOOS)/$(go env GOARCH)." +CGO_ENABLED=0 go build -trimpath -tags=rosa -o /work/system/libexec/hakurei -ldflags="-s -w + -buildid= + -X main.hakureiPath=/system/bin/hakurei +" ./cmd/hsu +echo`; + check = ` +echo '##### Testing hakurei.' +go test -ldflags='-buildid= -linkmode external -extldflags=-static' ./... +echo`; + install = ` +mkdir -p /work/system/bin/ +(cd /work/system/libexec/hakurei && mv \ + hakurei \ + sharefs \ + ../../bin/) +`; + }; + + inputs = [ + go, + pkgconf, + net-tools, + + libseccomp, + acl, + fuse, + xcb, + wayland, + wayland-protocols, + kernel-headers, + ]; +} + +package hakurei-dist { + description = "low-level userspace tooling for Rosa OS (distribution tarball)"; + website = "https://hakurei.app"; + + source = hakurei-source; + enterSource = true; + writable = true; + chmod = true; + + env = [ + "CGO_ENABLED=1", + "GOCACHE=/tmp/gocache", + "CC=clang -O3 -Werror", + ]; + + exec = generic { + chdir = false; + build = ` +NAME=make`; + check = ` +NAME=all`; + install = ` +DESTDIR=/work "./${NAME}.sh" +`; + }; + + inputs = [ + go, + pkgconf, + net-tools, + + libseccomp, + acl, + fuse, + xcb, + wayland, + wayland-protocols, + kernel-headers, + ]; +} + +package earlyinit { + description = "Rosa OS initramfs init program"; + exclude = true; + + source = hakurei-source; + enterSource = true; + writable = true; + chmod = true; + + env = [ + "CGO_ENABLED=1", + "GOCACHE=/tmp/gocache", + "CC=clang -O3 -Werror", + ]; + + exec = generic { + chdir = false; + build = ` +echo '# Building earlyinit.' +go build -trimpath -v -o /work/ -ldflags="-s -w + -buildid= + -linkmode external + -extldflags=-static + -X hakurei.app/internal/info.buildVersion=$(cat cmd/dist/VERSION) +" ./cmd/earlyinit +echo`; + }; + + inputs = [ go ]; +} diff --git a/internal/rosa/package/hakurei/hostname b/internal/rosa/package/hakurei/hostname deleted file mode 100644 index de72c9d1..00000000 --- a/internal/rosa/package/hakurei/hostname +++ /dev/null @@ -1,11 +0,0 @@ -package main - -import "os" - -func main() { - if name, err := os.Hostname(); err != nil { - panic(err) - } else { - os.Stdout.WriteString(name) - } -} diff --git a/internal/rosa/package/hakurei/package.az b/internal/rosa/package/hakurei/package.az deleted file mode 100644 index a918a872..00000000 --- a/internal/rosa/package/hakurei/package.az +++ /dev/null @@ -1,162 +0,0 @@ -package hakurei-source { - description = "hakurei source tree"; - exclude = true; - - version# = "0.4.6"; - output = remoteTar { - url = "https://git.gensokyo.uk/rosa/hakurei/archive/"+ - "v"+version+".tar.gz"; - checksum = "2HxvdykuSSymAu-c1WIwQAy3qT4dDm8B--93iL4uomBlBC8wfSWldbvPF1noNkUC"; - compress = gzip; - }; -} - -package hakurei { - description = "low-level userspace tooling for Rosa OS"; - website = "https://hakurei.app"; - anitya = 388834; - - source = hakurei-source; - enterSource = true; - writable = true; - chmod = true; - - env = [ - "CGO_ENABLED=1", - "GOCACHE=/tmp/gocache", - "CC=clang -O3 -Werror", - ]; - - files = { - "hostname/main.go": "hostname"; - }; - - exec = generic { - chdir = false; - build = ` -echo 'Building test helper (hostname).' -go build -o /bin/hostname /usr/src/hostname/main.go - -mkdir -p /work/system/libexec/hakurei/ - -echo "Building hakurei for $(go env GOOS)/$(go env GOARCH)." -go generate ./... -go build -trimpath -tags=rosa -o /work/system/libexec/hakurei -ldflags="-s -w - -buildid= - -linkmode external - -extldflags=-static - -X hakurei.app/internal/info.buildVersion=$(cat cmd/dist/VERSION) - -X hakurei.app/internal/info.hakureiPath=/system/bin/hakurei - -X hakurei.app/internal/info.hsuPath=/system/bin/hsu -" ./cmd/hakurei ./cmd/sharefs - -echo "Building hsu for $(go env GOOS)/$(go env GOARCH)." -CGO_ENABLED=0 go build -trimpath -tags=rosa -o /work/system/libexec/hakurei -ldflags="-s -w - -buildid= - -X main.hakureiPath=/system/bin/hakurei -" ./cmd/hsu -echo`; - check = ` -echo '##### Testing hakurei.' -go test -ldflags='-buildid= -linkmode external -extldflags=-static' ./... -echo`; - install = ` -mkdir -p /work/system/bin/ -(cd /work/system/libexec/hakurei && mv \ - hakurei \ - sharefs \ - ../../bin/) -`; - }; - - inputs = [ - go, - pkgconf, - - libseccomp, - acl, - fuse, - xcb, - wayland, - wayland-protocols, - kernel-headers, - ]; -} - -package hakurei-dist { - description = "low-level userspace tooling for Rosa OS (distribution tarball)"; - website = "https://hakurei.app"; - - source = hakurei-source; - enterSource = true; - writable = true; - chmod = true; - - env = [ - "CGO_ENABLED=1", - "GOCACHE=/tmp/gocache", - "CC=clang -O3 -Werror", - ]; - - files = { - "hostname/main.go": "hostname"; - }; - - exec = generic { - chdir = false; - build = ` -echo 'Building test helper (hostname).' -go build -o /bin/hostname /usr/src/hostname/main.go - -NAME=make`; - check = ` -NAME=all`; - install = ` -DESTDIR=/work "./${NAME}.sh" -`; - }; - - inputs = [ - go, - pkgconf, - - libseccomp, - acl, - fuse, - xcb, - wayland, - wayland-protocols, - kernel-headers, - ]; -} - -package earlyinit { - description = "Rosa OS initramfs init program"; - exclude = true; - - source = hakurei-source; - enterSource = true; - writable = true; - chmod = true; - - env = [ - "CGO_ENABLED=1", - "GOCACHE=/tmp/gocache", - "CC=clang -O3 -Werror", - ]; - - exec = generic { - chdir = false; - build = ` -echo '# Building earlyinit.' -go build -trimpath -v -o /work/ -ldflags="-s -w - -buildid= - -linkmode external - -extldflags=-static - -X hakurei.app/internal/info.buildVersion=$(cat cmd/dist/VERSION) -" ./cmd/earlyinit -echo`; - }; - - inputs = [ go ]; -} diff --git a/internal/rosa/package/net-tools/CVE-2025-46836.patch b/internal/rosa/package/net-tools/CVE-2025-46836.patch new file mode 100644 index 00000000..dadff1ad --- /dev/null +++ b/internal/rosa/package/net-tools/CVE-2025-46836.patch @@ -0,0 +1,115 @@ +From 7a8f42fb20013a1493d8cae1c43436f85e656f2d Mon Sep 17 00:00:00 2001 +From: Zephkeks +Date: Tue, 13 May 2025 11:04:17 +0200 +Subject: [PATCH] CVE-2025-46836: interface.c: Stack-based Buffer Overflow in + get_name() + +Coordinated as GHSA-pfwf-h6m3-63wf +--- + lib/interface.c | 63 ++++++++++++++++++++++++++++++------------------- + 1 file changed, 39 insertions(+), 24 deletions(-) + +diff --git a/lib/interface.c b/lib/interface.c +index 71d4163..a054f12 100644 +--- a/lib/interface.c ++++ b/lib/interface.c +@@ -211,32 +211,47 @@ static int if_readconf(void) + } + + static const char *get_name(char *name, const char *p) ++/* Safe version — guarantees at most IFNAMSIZ‑1 bytes are copied ++ and the destination buffer is always NUL‑terminated. */ + { +- while (isspace(*p)) +- p++; +- while (*p) { +- if (isspace(*p)) +- break; +- if (*p == ':') { /* could be an alias */ +- const char *dot = p++; +- while (*p && isdigit(*p)) p++; +- if (*p == ':') { +- /* Yes it is, backup and copy it. */ +- p = dot; +- *name++ = *p++; +- while (*p && isdigit(*p)) { +- *name++ = *p++; +- } +- } else { +- /* No, it isn't */ +- p = dot; +- } +- p++; +- break; +- } +- *name++ = *p++; ++ char *dst = name; /* current write ptr */ ++ const char *end = name + IFNAMSIZ - 1; /* last byte we may write */ ++ ++ /* Skip leading white‑space. */ ++ while (isspace((unsigned char)*p)) ++ ++p; ++ ++ /* Copy until white‑space, end of string, or buffer full. */ ++ while (*p && !isspace((unsigned char)*p) && dst < end) { ++ if (*p == ':') { /* possible alias veth0:123: */ ++ const char *dot = p; /* remember the colon */ ++ ++p; ++ while (*p && isdigit((unsigned char)*p)) ++ ++p; ++ ++ if (*p == ':') { /* confirmed alias */ ++ p = dot; /* rewind and copy it all */ ++ ++ /* copy the colon */ ++ if (dst < end) ++ *dst++ = *p++; ++ ++ /* copy the digits */ ++ while (*p && isdigit((unsigned char)*p) && dst < end) ++ *dst++ = *p++; ++ ++ if (*p == ':') /* consume trailing colon */ ++ ++p; ++ } else { /* if so treat as normal */ ++ p = dot; ++ } ++ break; /* interface name ends here */ ++ } ++ ++ *dst++ = *p++; /* ordinary character copy */ + } +- *name++ = '\0'; ++ ++ *dst = '\0'; /* always NUL‑terminate */ + return p; + } + +From ddb0e375fb9ca95bb69335540b85bbdaa2714348 Mon Sep 17 00:00:00 2001 +From: Bernd Eckenfels +Date: Sat, 17 May 2025 21:53:23 +0200 +Subject: [PATCH] Interface statistic regression after 7a8f42fb2 + +--- + lib/interface.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/lib/interface.c b/lib/interface.c +index a054f12..ca4adf1 100644 +--- a/lib/interface.c ++++ b/lib/interface.c +@@ -239,12 +239,11 @@ static const char *get_name(char *name, const char *p) + /* copy the digits */ + while (*p && isdigit((unsigned char)*p) && dst < end) + *dst++ = *p++; +- +- if (*p == ':') /* consume trailing colon */ +- ++p; + } else { /* if so treat as normal */ + p = dot; + } ++ if (*p == ':') /* consume trailing colon */ ++ ++p; + break; /* interface name ends here */ + } + diff --git a/internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch b/internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch new file mode 100644 index 00000000..c000a826 --- /dev/null +++ b/internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch @@ -0,0 +1,53 @@ +From a7926399a04ee8e629a02a2aeb6de1952d42d559 Mon Sep 17 00:00:00 2001 +From: Bernd Eckenfels +Date: Sat, 17 May 2025 21:11:07 +0200 +Subject: [PATCH] ipmaddr.c: Stack-based buffer Overflow in parse_hex() + +Coordinated as GHSA-h667-qrp8-gj58. +--- + ipmaddr.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/ipmaddr.c b/ipmaddr.c +index 64b7564..623fadd 100644 +--- a/ipmaddr.c ++++ b/ipmaddr.c +@@ -91,17 +91,17 @@ static int parse_lla(char *str, char *addr) + return len; + } + +-static int parse_hex(char *str, unsigned char *addr) ++static int parse_hex(char *str, unsigned char *dst, size_t dstlen) + { + int len=0; + +- while (*str) { ++ while (len < dstlen && *str) { + int tmp; + if (str[1] == 0) + return -1; + if (sscanf(str, "%02x", &tmp) != 1) + return -1; +- addr[len] = tmp; ++ dst[len] = tmp; + len++; + str += 2; + } +@@ -152,7 +152,7 @@ void read_dev_mcast(struct ma_info **result_p) + + m.addr.family = AF_PACKET; + +- len = parse_hex(hexa, (unsigned char*)&m.addr.data); ++ len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof(m.addr.data)); + if (len >= 0) { + struct ma_info *ma = xmalloc(sizeof(m)); + memcpy(ma, &m, sizeof(m)); +@@ -222,7 +222,7 @@ void read_igmp6(struct ma_info **result_p) + + m.addr.family = AF_INET6; + +- len = parse_hex(hexa, (unsigned char*)&m.addr.data); ++ len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof(m.addr.data)); + if (len >= 0) { + struct ma_info *ma = xmalloc(sizeof(m)); + memcpy(ma, &m, sizeof(m)); diff --git a/internal/rosa/package/net-tools/GHSA-w7jq-cmw2-cq59.patch b/internal/rosa/package/net-tools/GHSA-w7jq-cmw2-cq59.patch new file mode 100644 index 00000000..768814d5 --- /dev/null +++ b/internal/rosa/package/net-tools/GHSA-w7jq-cmw2-cq59.patch @@ -0,0 +1,71 @@ +From 84041080a5d4794045b098ced90e0309bcbcff44 Mon Sep 17 00:00:00 2001 +From: Zephkeks +Date: Sat, 17 May 2025 22:11:37 +0200 +Subject: [PATCH] proc.c: Stack-based Buffer Overflow in net-tools + (proc_gen_fmt) + +Coordinated as GHSA-w7jq-cmw2-cq59. +--- + lib/proc.c | 37 ++++++++++++++++++++++++++++++++++--- + 1 file changed, 34 insertions(+), 3 deletions(-) + +diff --git a/lib/proc.c b/lib/proc.c +index d51d09f..02aae49 100644 +--- a/lib/proc.c ++++ b/lib/proc.c +@@ -17,6 +17,8 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...) + char buf[512], format[512] = ""; + char *title, *head, *hdr; + va_list ap; ++ size_t format_len = 0; ++ size_t format_size = sizeof(format); + + if (!fgets(buf, (sizeof buf) - 1, fh)) + return NULL; +@@ -33,14 +35,43 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...) + *hdr++ = 0; + + if (!strcmp(title, head)) { +- strcat(format, va_arg(ap, char *)); ++ const char *arg = va_arg(ap, char *); ++ size_t arg_len = strlen(arg); ++ ++ /* Check if we have enough space for format specifier + space */ ++ if (format_len + arg_len + 1 >= format_size) { ++ fprintf(stderr, "warning: format buffer overflow in %s\n", name); ++ va_end(ap); ++ return NULL; ++ } ++ ++ strcpy(format + format_len, arg); ++ format_len += arg_len; ++ + title = va_arg(ap, char *); + if (!title) + break; + } else { +- strcat(format, "%*s"); /* XXX */ ++ /* Check if we have enough space for "%*s" */ ++ if (format_len + 3 >= format_size) { ++ fprintf(stderr, "warning: format buffer overflow in %s\n", name); ++ va_end(ap); ++ return NULL; ++ } ++ ++ strcpy(format + format_len, "%*s"); ++ format_len += 3; + } +- strcat(format, " "); ++ ++ /* Check if we have space for the trailing space */ ++ if (format_len + 1 >= format_size) { ++ fprintf(stderr, "warning: format buffer overflow in %s\n", name); ++ va_end(ap); ++ return NULL; ++ } ++ ++ format[format_len++] = ' '; ++ format[format_len] = '\0'; + } + va_end(ap); + diff --git a/internal/rosa/package/net-tools/f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch b/internal/rosa/package/net-tools/f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch new file mode 100644 index 00000000..6ba420f3 --- /dev/null +++ b/internal/rosa/package/net-tools/f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch @@ -0,0 +1,22 @@ +From f84cd22a921c25c56a6c194d4825dbd9ceea0e5f Mon Sep 17 00:00:00 2001 +From: Bernd +Date: Sat, 22 Mar 2025 00:17:10 +0100 +Subject: [PATCH] Update proc.c; remove redundant null check (CodeQL #3) (#44) + +--- + lib/proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/proc.c b/lib/proc.c +index ce85fd1..d51d09f 100644 +--- a/lib/proc.c ++++ b/lib/proc.c +@@ -35,7 +35,7 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...) + if (!strcmp(title, head)) { + strcat(format, va_arg(ap, char *)); + title = va_arg(ap, char *); +- if (!title || !head) ++ if (!title) + break; + } else { + strcat(format, "%*s"); /* XXX */ diff --git a/internal/rosa/package/net-tools/package.az b/internal/rosa/package/net-tools/package.az new file mode 100644 index 00000000..62a50289 --- /dev/null +++ b/internal/rosa/package/net-tools/package.az @@ -0,0 +1,33 @@ +package net-tools { + description = "the collection of base networking utilities for Linux"; + anitya = 10231; + + version# = "2.10"; + source = remoteTar { + url = "https://downloads.sourceforge.net/project/net-tools/"+ + "net-tools-"+version+".tar.xz"; + compress = xz; + checksum = "YLmSUeHOYnhYhjvnisX6MQNkPJRzOIgSZBHRiWmBdzzziWYJVY6hOpM8eWnAZ11N"; + }; + patches = [ + "CVE-2025-46836.patch", + "GHSA-h667-qrp8-gj58.patch", + "f84cd22a921c25c56a6c194d4825dbd9ceea0e5f.patch", + "GHSA-w7jq-cmw2-cq59.patch", + ]; + + enterSource = true; + writable = true; + + exec = make { + chdir = false; + configureName = "(set +o pipefail && yes '' | make config)"; + check = nil; + }; + + inputs = [ + bash, + + kernel-headers, + ]; +} -- cgit v1.3.1