Your message dated Sat, 05 Mar 2016 22:32:11 +0000
with message-id <e1ackk7-0000fj...@franck.debian.org>
and subject line Bug#813406: fixed in ctdb 2.5.4+debian0-4+deb8u1
has caused the Debian Bug report #813406,
regarding ctdb, raw sockets and CVE-2015-8543
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
813406: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813406
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: ctdb
Severity: grave
Tags: patch,upstream
Hi!
The kernel upgrade for CVE-2015-8543 showed a bug in CTDB that leads to a
broken cluster:
| s = socket(AF_INET, SOCK_RAW, htons(IPPROTO_RAW));
htons(IPPROTO_RAW) leads to 0xff00 which causes "-1 EINVAL (Invalid
argument)" because of CVE-2015-8543.
The fix for the issue is quite simple: remove IPPROTO_RAW; to make the fix
more consistent with what was used before, use IPPROTO_IP (which is 0).
Error messages related to this bug are:
| We are still serving a public IP 'x.x.x.x' that we should not be serving.
Removing it
| common/system_common.c:89 failed to open raw socket (Invalid argument)
| Could not find which interface the ip address is hosted on. can not release
it
and
| common/system_linux.c:344 failed to open raw socket (Invalid argument)
As a result, IP addresses cannot be released and multiple nodes in the
cluster serve the same address, which obviously does not work.
Upstream bug: https://bugzilla.samba.org/show_bug.cgi?id=11705 and mailing
list conversation:
https://lists.samba.org/archive/samba/2016-January/197389.html
-- Adi
--- a/common/system_common.c 2016-01-19 15:20:37.437683526 +0100
+++ b/common/system_common.c 2016-01-19 15:20:50.417683526 +0100
@@ -83,7 +83,7 @@
struct ifconf ifc;
char *ptr;
- s = socket(AF_INET, SOCK_RAW, htons(IPPROTO_RAW));
+ s = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
if (s == -1) {
DEBUG(DEBUG_CRIT,(__location__ " failed to open raw socket (%s)\n",
strerror(errno)));
--- a/common/system_linux.c 2016-01-19 16:06:53.021491231 +0100
+++ b/common/system_linux.c 2016-01-19 16:07:05.817491231 +0100
@@ -338,7 +338,7 @@
ip4pkt.tcp.check = tcp_checksum((uint16_t *)&ip4pkt.tcp, sizeof(ip4pkt.tcp), &ip4pkt.ip);
/* open a raw socket to send this segment from */
- s = socket(AF_INET, SOCK_RAW, htons(IPPROTO_RAW));
+ s = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
if (s == -1) {
DEBUG(DEBUG_CRIT,(__location__ " failed to open raw socket (%s)\n",
strerror(errno)));
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---
Source: ctdb
Source-Version: 2.5.4+debian0-4+deb8u1
We believe that the bug you reported is fixed in the latest version of
ctdb, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 813...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mathieu Parent <sath...@debian.org> (supplier of updated ctdb package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Fri, 26 Feb 2016 23:08:13 +0100
Source: ctdb
Binary: ctdb libctdb-dev ctdb-dbg ctdb-pcp-pmda
Architecture: source amd64
Version: 2.5.4+debian0-4+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Debian Samba Maintainers <pkg-samba-ma...@lists.alioth.debian.org>
Changed-By: Mathieu Parent <sath...@debian.org>
Description:
ctdb - clustered database to store temporary data
ctdb-dbg - clustered database to store temporary data -- debugging symbols a
ctdb-pcp-pmda - clustered database to store temporary data -- PDM PMDA
libctdb-dev - clustered database to store temporary data -- development files
Closes: 813406
Changes:
ctdb (2.5.4+debian0-4+deb8u1) jessie-security; urgency=high
.
* Fix CTDB behavior since CVE-2015-8543 (Closes: #813406)
Checksums-Sha1:
98ec3505c27ec5dbe9301a14bd2171f4752160d9 2292 ctdb_2.5.4+debian0-4+deb8u1.dsc
537288c91028d511c2051835fee8ed7708dd415e 968858 ctdb_2.5.4+debian0.orig.tar.gz
1a33b134149766809f9d2418d5c1b241dd054634 12600
ctdb_2.5.4+debian0-4+deb8u1.debian.tar.xz
f68e3fb75e078d290d1be82dd31ff5e58fcdbcfe 400478
ctdb_2.5.4+debian0-4+deb8u1_amd64.deb
fb8aa4ca5eb5c463fa3259c132927ceedb09c405 35206
libctdb-dev_2.5.4+debian0-4+deb8u1_amd64.deb
d4d1a570b5beb5f90e41d863318687b555cd2e7c 2674258
ctdb-dbg_2.5.4+debian0-4+deb8u1_amd64.deb
f97715ba590ae8afe6944b1a06de3ebe9f2724e5 70270
ctdb-pcp-pmda_2.5.4+debian0-4+deb8u1_amd64.deb
Checksums-Sha256:
904d4004f8af5e0424d97c62d634440cd484b93283399a4496f0dbdb4136f0a9 2292
ctdb_2.5.4+debian0-4+deb8u1.dsc
04d7701b9383f59556467881d1c33a57ff59aec2d735b08172bf3018ca286596 968858
ctdb_2.5.4+debian0.orig.tar.gz
7355ec5e52d72ee9df87a0c8be40bf6019f0ccb84577e3e9cb03111a53e4881c 12600
ctdb_2.5.4+debian0-4+deb8u1.debian.tar.xz
dd454b9b5d5c80a6ccb3718bc467d123205b10eae7ee26d34b8b1ff6f34ff7ce 400478
ctdb_2.5.4+debian0-4+deb8u1_amd64.deb
6a9aa0b7072a2083cc1c2093616e9038ff757d83aaaa4e5b4f7166652e2dbdb9 35206
libctdb-dev_2.5.4+debian0-4+deb8u1_amd64.deb
5459d80742b763f63cd3f346183690325a691bf1dfabdbd768f546e090f9d6c1 2674258
ctdb-dbg_2.5.4+debian0-4+deb8u1_amd64.deb
b7fb1807ec11ff1edcd9772a92b4369b759f9e09a1f2effa6d83ec41c1d82cad 70270
ctdb-pcp-pmda_2.5.4+debian0-4+deb8u1_amd64.deb
Files:
f73515a97f16be37f4b7dbfbaa41fa59 2292 net extra ctdb_2.5.4+debian0-4+deb8u1.dsc
3c41f3bf326117de15fcdbaf3499ce8a 968858 net extra
ctdb_2.5.4+debian0.orig.tar.gz
7822f27156dee183e38b0b08261cfc8e 12600 net extra
ctdb_2.5.4+debian0-4+deb8u1.debian.tar.xz
89b899545982b5a58db671dd382490ee 400478 net extra
ctdb_2.5.4+debian0-4+deb8u1_amd64.deb
103f4d9587f640142fb72407b9319b70 35206 libdevel extra
libctdb-dev_2.5.4+debian0-4+deb8u1_amd64.deb
39c35e4d947a533b8062fabe899441e3 2674258 debug extra
ctdb-dbg_2.5.4+debian0-4+deb8u1_amd64.deb
036517d66c3d6dfeaf595474a21202cf 70270 net extra
ctdb-pcp-pmda_2.5.4+debian0-4+deb8u1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJW0NMVAAoJEK4DmARmaB+l4SgP/jqSlWDfH08BDf1SPyndb5U2
BsPrLxJvH0L0AwEEx0r5aiE2A2V3GWHXmI6qoVhnJcGp6AImmcuROl2k92qTdW31
BSeEtLxCVwXduQkGHBE6joXm+zMCLugvZw7/g2EYWgl18RYM4/1riuVbRAARMp34
n9CDSM7hrVGVMk3PCkFrOcuLV5J5sxawe2w7b4nT0co901Y5+7X84h/eRsK2zT35
pjLV2FdmUVweOfVqmSGbvYOYk2U/PhDHkDb/UIzrSLQZPMpw+56qh8TEnDbcMd3d
0b4xKBBgZcUjkbjikFPfY4iEZOctr6kW/oZLuzaOYSjUDZoeOxFVm6PKuq2CHU4B
4YXH8cE6fAH8unq4f1qx4NwMgl3VIBJ/4dT92dO5h7Fup75pYWmv2pFGwb/28/Yj
6fAXMApGbBfDHd021kBs/K6wW+y9m+tgWk23upo76hlclPgnp2canwJGuF8k5qqE
nchznU5nXNHuzjetWT1Xp28rIgsx8kcqJtGzhjkzZV0hPVXg5YelxgUxc/5+jLsR
PGHJSmANEaDDs4HabwFziswFe6mWJNYOEVG+v2P3YFzzjZ8gl/4iflLyGTYvSxDf
GjsqRcSmbOf05mVuvuT4b8nHQ6QcsuXhFfHfx/rqi6NEvE0zJZEOxT2i/76fC9cm
GxXSfPMVK5VabZFtZ5hq
=s6Ff
-----END PGP SIGNATURE-----
--- End Message ---
