Patch improper sanitization of shell escapes (CVE-2018-10932)

Signed-off-by: Petr Machata <pmachata@gmail.com>

lldpad.spec

@@ -7,7 +7,7 @@
 
 Name:               lldpad
 Version:            1.0.1
-Release:            9.git%{checkout}%{?dist}
+Release:            10.git%{checkout}%{?dist}
 Summary:            Intel LLDP Agent
 Group:              System Environment/Daemons
 License:            GPLv2
@@ -41,6 +41,15 @@ Patch25:	open-lldp-v1.0.1-25-l2_linux_packet-correctly-process-return-value-of-g
 Patch26:	open-lldp-v1.0.1-26-lldpad-system-capability-incorrect-advertised-as-sta.patch
 Patch27:	open-lldp-v1.0.1-27-fix-build-warnings.patch
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=1618377
+# https://github.com/intel/openlldp/pull/9
+Patch28:	open-lldp-v1.0.1-28-support-DSCP-selectors.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1614932
+# https://bugzilla.redhat.com/show_bug.cgi?id=1614896 (CVE-2018-10932)
+# https://github.com/intel/openlldp/pull/7
+Patch29:	open-lldp-v1.0.1-29-basman_clif-print-the-OID-properly.patch
+
 BuildRequires:      automake autoconf libtool
 BuildRequires:      flex >= 2.5.33
 BuildRequires:      kernel-headers >= 2.6.32
@@ -113,6 +122,11 @@ rm -f %{buildroot}%{_libdir}/liblldp_clif.la
 %{_libdir}/liblldp_clif.so
 
 %changelog
+* Tue Oct 23 2018 Petr Machata <pmachata@gmail.com> - 1.0.1-10.git036e314
+- Add open-lldp-v1.0.1-29-basman_clif-print-the-OID-properly.patch (BZ 1614932,
+  1614896 (CVE-2018-10932)
+- Add open-lldp-v1.0.1-28-support-DSCP-selectors.patch (BZ 1618377)
+
 * Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.1-9.git036e314
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 

open-lldp-v1.0.1-28-support-DSCP-selectors.patch

@@ -0,0 +1,39 @@
+From c8e438d610bc8af109c19479ee0f568b271d4030 Mon Sep 17 00:00:00 2001
+From: Petr Machata <petrm@mellanox.com>
+Date: Mon, 9 Jul 2018 21:43:41 +0300
+Subject: [PATCH] lldpad: Support DSCP selectors in APP TLV's
+
+The P802.1Qcd/D2.1 standard draft introduces a new APP TLV: DSCP, with
+selector value of 5. Don't reject APP TLV's with selector 5, and
+sanitize the PID value to not be out of bounds for DSCP.
+
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+---
+ lldp_8021qaz_cmds.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lldp_8021qaz_cmds.c b/lldp_8021qaz_cmds.c
+index 8cb225e..e017e2a 100644
+--- a/lldp_8021qaz_cmds.c
++++ b/lldp_8021qaz_cmds.c
+@@ -1290,7 +1290,7 @@ static int _set_arg_app(struct cmd *cmd, char *args, char *arg_value,
+ 			obuf_len - strlen(obuf) - 2);
+ 		goto err;
+ 	}
+-	if (sel < 1 || sel > 4) {
++	if (sel < 1 || sel > 5) {
+ 		strncat(obuf, ": selector out of range",
+ 			obuf_len - strlen(obuf) - 2);
+ 		goto err;
+@@ -1305,6 +1305,11 @@ static int _set_arg_app(struct cmd *cmd, char *args, char *arg_value,
+ 			obuf_len - strlen(obuf) - 2);
+ 		goto err;
+ 	}
++	if (sel == 5 && pid > 63) {
++		strncat(obuf, ": DSCP > 63",
++			obuf_len - strlen(obuf) - 2);
++		goto err;
++	}
+ 
+ 	free(parse);
+ 

open-lldp-v1.0.1-29-basman_clif-print-the-OID-properly.patch

@@ -0,0 +1,49 @@
+From cf3f54d1883e5bc23e4c4006a63e1dde88684013 Mon Sep 17 00:00:00 2001
+From: Aaron Conole <aconole@redhat.com>
+Date: Thu, 21 Jun 2018 13:28:48 -0400
+Subject: [PATCH] basman_clif: print the OID properly
+
+When invoking the lldp tool to view the management information, the display
+for the OID is printed as the actual binary bits, rather than the
+OID dotted-notation form.
+
+This change will display the OID as expected.
+
+Signed-off-by: Aaron Conole <aconole@redhat.com>
+---
+ lldp_basman_clif.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/lldp_basman_clif.c b/lldp_basman_clif.c
+index 7dba9d2..abd152d 100644
+--- a/lldp_basman_clif.c
++++ b/lldp_basman_clif.c
+@@ -272,8 +272,15 @@ void print_mng_addr(u16 len, char *info)
+ 		memset(buf, 0, sizeof(buf));
+ 		if (hexstr2bin(info+offset, (u8 *)&buf, oidlen))
+ 			printf("\tOID: Error parsing OID\n");
+-		else
+-			printf("\tOID: %s\n", buf);
++		else {
++			printf("\tOID: 0.");
++			for (i = 0; i < oidlen; ++i) {
++				printf("%d", buf[i]);
++				if (i != (oidlen - 1))
++					printf(".");
++			}
++			printf("\n");
++		}
+ 	} else if (oidlen > 128) {
+ 		printf("\tOID: Invalid length = %d\n", oidlen);
+ 	}
+@@ -310,3 +317,10 @@ u32 basman_lookup_tlv_name(char *tlvid_str)
+ 	}
+ 	return INVALID_TLVID;
+ }
++
++/* Local Variables:    */
++/* c-indent-level: 8   */
++/* c-basic-offset: 8   */
++/* tab-width: 8        */
++/* indent-tabs-mode: t */
++/* End:                */