New version 3.4.4

Fix for CVE-2021-22191

sources

@@ -1,2 +1,2 @@
-SHA512 (wireshark-3.2.3.tar.xz) = 6e13f5aba9c3f531fab94c9f19e85856278ff534d02e406143c0c134c9b37a76d372105b43f51e95f319e31d742fc17c2812defe377886bd8f7ed03f743f9e9a
-SHA512 (SIGNATURES-3.2.3.txt) = adab805747e433387c4b99bdeb839b36669d00637b523bcb5ae02bfa71571239ac085934793f358a017e476c383f2810a9afa7282d46295a9426c4a340fe485a
+SHA512 (wireshark-3.4.4.tar.xz) = 388b5634894f08bb1a0052f989133c2a8457fbf6525d1bb557f3ffce73da8063fd9fe82b50b5ababc30fa36ce154bf9d2a3d91d76e03913d6516ca61b4b6b172
+SHA512 (SIGNATURES-3.4.4.txt) = f8e270388fdf7c5bc3b502c7f1df5823b9cb5f17ec522bd57d6a7df6a8389714e92dca469364670f0437ae3e0ef70bcc1b0254b070e6d230cada3b2eee29eebc

wireshark-0006-Move-tmp-to-var-tmp.patch

@@ -111,43 +111,50 @@ index fde66c8..b9531d2 100644
      tempfile_->open();
  
 diff --git a/wsutil/tempfile.c b/wsutil/tempfile.c
-index 8e1f8dc..dcf2f78 100644
+index 5082452..f751a7c 100644
 --- a/wsutil/tempfile.c
 +++ b/wsutil/tempfile.c
-@@ -36,6 +36,7 @@
- 
+@@ -12,10 +12,12 @@
+
+ #include <glib.h>
  #include "tempfile.h"
- #include <wsutil/file_util.h>
++#include <wsutil/file_util.h>
 +#include <wsutil/wstmpdir.h> /* for get_tmp_dir() */
- 
- #ifndef __set_errno
- #define __set_errno(x) errno=(x)
-@@ -83,13 +83,14 @@ mkstemps(char *path_template, int suffixlen)
-  */
- char *get_tempfile_path(const char *filename)
- {
--  return g_strdup_printf("%s" G_DIR_SEPARATOR_S "%s", g_get_tmp_dir(), filename);
-+  return g_strdup_printf("%s" G_DIR_SEPARATOR_S "%s", get_tmp_dir(), filename);
- }
- 
- #define MAX_TEMPFILES   3
- 
- /**
-- * Create a tempfile with the given prefix (e.g. "wireshark").
-+ * Create a tempfile with the given prefix (e.g. "wireshark"). The path
-+ * is created using get_tmp_dir and mkdtemp
+
+  /**
+  * Create a tempfile with the given prefix (e.g. "wireshark"). The path
+- * is created using g_file_open_tmp.
++ * is created using get_tmp_dir.
   *
-  * @param namebuf If not NULL, receives the full path of the temp file.
-  *                Should NOT be freed.
-@@ -199,7 +200,7 @@ create_tempfile(char **namebuf, const char *pfx, const char *sfx)
-     tf[idx].path = (char *)g_malloc(tf[idx].len);
-   }
- 
--  tmp_dir = g_get_tmp_dir();
+  * @param namebuf [in,out] If not NULL, receives the full path of the temp file.
+  *                Must be freed.
+@@ -30,6 +31,9 @@ create_tempfile(gchar **namebuf, const char *pfx, const char *sfx, GError **err)
+ {
+   int fd;
+   gchar *safe_pfx = NULL;
++  gchar *tmp_file;
++  const char *tmp_dir;
++  int old_mask;
+
+   if (pfx) {
+     /* The characters in "delimiters" come from:
+@@ -49,7 +53,15 @@ create_tempfile(gchar **namebuf, const char *pfx, const char *sfx, GError **err)
+   gchar* filetmpl = g_strdup_printf("%sXXXXXX%s", safe_pfx ? safe_pfx : "", sfx ? sfx : "");
+   g_free(safe_pfx);
+
+-  fd = g_file_open_tmp(filetmpl, namebuf, err);
 +  tmp_dir = get_tmp_dir();
- 
- #ifdef _WIN32
-   _tzset();
++  tmp_file = g_strconcat(tmp_dir, "/", filetmpl, NULL);
++
++  if (namebuf)
++    *namebuf = tmp_file;
++
++  old_mask = ws_umask(0077);
++  fd = mkstemps(tmp_file, sfx ? (int) strlen(sfx) : 0);
++  ws_umask(old_mask);
+
+   g_free(filetmpl);
+   return fd;
 diff --git a/wsutil/tempfile.h b/wsutil/tempfile.h
 index 1dca2df..bb3160c 100644
 --- a/wsutil/tempfile.h
@@ -156,17 +163,17 @@ index 1dca2df..bb3160c 100644
  
  /**
   * Create a tempfile with the given prefix (e.g. "wireshark"). The path
-- * is created using g_get_tmp_dir and mkstemp.
+- * is created using g_file_open_tmp.
 + * is created using get_tmp_dir and mkstemp.
   *
   * @param namebuf [in,out] If not NULL, receives the full path of the temp file.
-  *                Must NOT be freed.
+  *                Must be freed.
 diff --git a/wsutil/wstmpdir.c b/wsutil/wstmpdir.c
 new file mode 100644
 index 0000000..d8b733b
 --- /dev/null
 +++ b/wsutil/wstmpdir.c
-@@ -0,0 +1,70 @@
+@@ -0,0 +1,71 @@
 +/* wstmpdir.c
 + *
 + * Copyright (C) 2013 Red Hat, Inc. All right reserved.
@@ -224,6 +231,7 @@ index 0000000..d8b733b
 +            k = strlen(tmp);
 +            if (k > 1 && G_IS_DIR_SEPARATOR(tmp[k - 1]))
 +                tmp[k - 1] = '\0';
++            fprintf(stderr, "Using P_tmpdir: %s\n", P_tmpdir);
 +        }
 +#endif /* P_tmpdir */
 +

wireshark.spec

@@ -1,10 +1,10 @@
 %global with_lua 1
 %global with_maxminddb 1
-%global plugins_version 3.2
+%global plugins_version 3.4
 
 Summary:	Network traffic analyzer
 Name:		wireshark
-Version:	3.2.3
+Version:	3.4.4
 Release:	1%{?dist}
 Epoch:		1
 License:	GPL+
@@ -57,7 +57,8 @@ BuildRequires:	flex
 BuildRequires:	pcre-devel
 BuildRequires:	perl(Pod::Html)
 BuildRequires:	perl(Pod::Man)
-Buildrequires:  libssh-devel
+BuildRequires:	perl(open)
+Buildrequires:	libssh-devel
 BuildRequires:	qt5-linguist
 BuildRequires:	qt5-qtbase-devel
 BuildRequires:	qt5-qtmultimedia-devel
@@ -128,7 +129,7 @@ and plugins.
   -DBUILD_mmdbresolve=OFF \
 %endif
   -DBUILD_randpktdump=OFF \
-  -DBUILD_androiddump=OFF \
+  -DBUILD_androiddump=ON \
   -DENABLE_SMI=ON \
   -DENABLE_PLUGINS=ON \
   -DENABLE_NETLINK=ON \
@@ -180,7 +181,11 @@ getent group usbmon >/dev/null || groupadd -r usbmon
 
 %post cli
 %{?ldconfig}
-/usr/bin/udevadm trigger --subsystem-match=usbmon
+# skip triggering if udevd isn't even accessible, e.g. containers or
+# rpm-ostree-based systems
+if [ -S /run/udev/control ]; then
+	/usr/bin/udevadm trigger --subsystem-match=usbmon
+fi
 
 %ldconfig_postun cli
 
@@ -220,8 +225,14 @@ getent group usbmon >/dev/null || groupadd -r usbmon
 %{_libdir}/wireshark/extcap/sshdump
 %{_libdir}/wireshark/extcap/sdjournal
 %{_libdir}/wireshark/extcap/dpauxmon
+%{_libdir}/wireshark/extcap/androiddump
+%dir %{_libdir}/wireshark/cmake
 %{_libdir}/wireshark/cmake/*.cmake
 #the version wireshark uses to store plugins is only x.y, not .z
+%dir %{_libdir}/wireshark/plugins/%{plugins_version}
+%dir %{_libdir}/wireshark/plugins/%{plugins_version}/epan
+%dir %{_libdir}/wireshark/plugins/%{plugins_version}/wiretap
+%dir %{_libdir}/wireshark/plugins/%{plugins_version}/codecs
 %{_libdir}/wireshark/plugins/%{plugins_version}/epan/*.so
 %{_libdir}/wireshark/plugins/%{plugins_version}/wiretap/*.so
 %{_libdir}/wireshark/plugins/%{plugins_version}/codecs/*.so
@@ -259,10 +270,44 @@ getent group usbmon >/dev/null || groupadd -r usbmon
 %{_libdir}/pkgconfig/%{name}.pc
 
 %changelog
+* Tue Mar 16 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.4-1
+- New version 3.4.4
+- Fix for CVE-2021-22191
+
+* Tue Feb 16 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.3-1
+- New version 3.4.3
+- Fix for CVE-2021-22173, CVE-2021-22174
+
+* Fri Jan 29 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.2-1
+- New version 3.4.2
+- Fix for CVE-2020-26418, CVE-2020-26419, CVE-2020-26420, CVE-2020-26421
+
+* Thu Dec 03 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.4.0-1
+- New version 3.4.0
+- Fix for CVE-2020-26575, CVE-2020-28030
+
+* Fri Oct 09 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.7-1
+- New version 3.2.7
+- Fix for CVE-2020-25862, CVE-2020-25863, CVE-2020-25866
+
+* Wed Aug 19 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.6-1
+- New version 3.2.6
+- Fix for CVE-2020-17498
+
+* Thu Jul 30 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.5-2
+- Adding ownership for dirs created by wireshark (rhbz#1860650)
+
+* Thu Jul 02 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.5-1
+- New version 3.2.5
+
+* Fri May 22 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.4-1
+- New version 3.2.4
+- Enabling build with androiddump (rhbz#1834367)
+
 * Mon Apr 13 2020 Gwyn Ciesla <gwync@protonmail.com> - 1:3.2.3-1
 - 3.2.3
 
-* Fri Apr 03 2020 Michal Ruprich <michalruprich@gmail.com> - 1:3.2.2-1
+* Fri Apr 03 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.2-1
 - New version 3.2.2
 
 * Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1:3.2.0-2