Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ser2net for openSUSE:Factory checked in at 2026-08-04 21:37:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ser2net (Old) and /work/SRC/openSUSE:Factory/.ser2net.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ser2net" Tue Aug 4 21:37:47 2026 rev:28 rq:1369427 version:4.6.8 Changes: -------- --- /work/SRC/openSUSE:Factory/ser2net/ser2net.changes 2026-04-13 23:22:34.109240237 +0200 +++ /work/SRC/openSUSE:Factory/.ser2net.new.16738/ser2net.changes 2026-08-04 21:39:51.431585725 +0200 @@ -1,0 +2,13 @@ +Tue Aug 4 08:22:27 UTC 2026 - Martin Hauke <[email protected]> + +- Update to version 4.6.8 + This release fixes some security issues. + * A path traversal bug could let an adversary be authenticated + without proper credentials. It's a semi-local exploit and hard + to do, but it's an issue. I should get a CVE for this at some + point, but github is taking forever. + * Passwords are now expected to be in a different filename and + hashed. There is an option to allow older plain text passwords, + but I should have never done plain text passwords. + +------------------------------------------------------------------- Old: ---- ser2net-4.6.7.tar.gz New: ---- ser2net-4.6.8.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ser2net.spec ++++++ --- /var/tmp/diff_new_pack.Id0W46/_old 2026-08-04 21:39:52.019606327 +0200 +++ /var/tmp/diff_new_pack.Id0W46/_new 2026-08-04 21:39:52.023606467 +0200 @@ -17,7 +17,7 @@ Name: ser2net -Version: 4.6.7 +Version: 4.6.8 Release: 0 Summary: Serial port to network proxy License: GPL-2.0-or-later ++++++ ser2net-4.6.7.tar.gz -> ser2net-4.6.8.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/auth.c new/ser2net-4.6.8/auth.c --- old/ser2net-4.6.7/auth.c 2023-08-27 04:33:34.000000000 +0200 +++ new/ser2net-4.6.8/auth.c 2026-07-28 03:28:27.000000000 +0200 @@ -28,6 +28,7 @@ #include <limits.h> #include <stdlib.h> #include <dirent.h> +#include <crypt.h> #include <gensio/gensio.h> #include <gensio/gensio_list.h> #include "ser2net.h" @@ -186,6 +187,40 @@ return GE_NOTSUP; } +/* + * Construct a secure authorization path. + * + * filename must be at least MAX_PATH. + * + * "username" is untrusted, the rest of the data is trusted. + */ +static bool +construct_auth_path(char *filename, const char *authdir, const char *username, + const char *format, ...) +{ + size_t baselen; + va_list ap; + + /* + * '/', '.', and '\' are all parts of things that can modify the base + * path. Don't allow them in usernames. + */ + if (strchr(username, '.') || strchr(username, '/') + || strchr(username, '\\')) + return false; + + /* Get a good base path ending in DIRSEP. */ + baselen = snprintf(filename, PATH_MAX, "%s%c%s%c", + authdir, DIRSEP, username, DIRSEP); + + /* Now append the rest of the path. */ + va_start(ap, format); + vsnprintf(filename + baselen, PATH_MAX - baselen, format, ap); + va_end(ap); + + return true; +} + static int handle_precert(struct gensio *net, const char *authdir) { @@ -231,8 +266,8 @@ } } - snprintf(filename, sizeof(filename), "%s%c%s%callowed_certs%c", - authdir, DIRSEP, s, DIRSEP, DIRSEP); + if (!construct_auth_path(filename, authdir, s, "allowed_certs%c", DIRSEP)) + return GE_AUTHREJECT; err = gensio_control(net, 0, false, GENSIO_CONTROL_CERT_AUTH, filename, &len); if (err && err != GE_CERTNOTFOUND) { @@ -250,8 +285,11 @@ char username[100]; char filename[PATH_MAX]; FILE *pwfile; - char readpw[100], *s; + char readpw[256], *s; int err; + bool hashed = true; + struct crypt_data cdata; + char *newhash; len = sizeof(username); err = gensio_control(net, 0, true, GENSIO_CONTROL_USERNAME, username, @@ -262,9 +300,18 @@ return GE_AUTHREJECT; } - snprintf(filename, sizeof(filename), "%s/%s/password", - authdir, username); + if (!construct_auth_path(filename, authdir, username, "hpassword")) + return GE_AUTHREJECT; pwfile = fopen(filename, "r"); + if (!pwfile && allow_unhashed_passwords) { + seout.out(&seout, + "Can't open password file %s, falling back to unhashed", + filename); + if (!construct_auth_path(filename, authdir, username, "password")) + return GE_AUTHREJECT; + pwfile = fopen(filename, "r"); + hashed = false; + } if (!pwfile) { seout.out(&seout, "Can't open password file %s", filename); return GE_AUTHREJECT; @@ -278,9 +325,30 @@ s = strchr(readpw, '\n'); if (s) *s = '\0'; - if (strcmp(readpw, password) == 0) - return 0; - return GE_NOTSUP; + if (!hashed) { + if (strcmp(readpw, password) == 0) + return 0; + return GE_NOTSUP; + } + + /* Supported hash algorithms. */ + if (!(strncmp(readpw, "$y$", 3) == 0 /* yescrypt */ + || strncmp(readpw, "$7$", 3) == 0 /* scrypt */ + || strncmp(readpw, "$2b$", 4) == 0 /* bcrypt */ + || strncmp(readpw, "$6$", 3) == 0 /* sha512crypt */ + || strncmp(readpw, "$5$", 3) == 0)) { /* sha256crypt */ + seout.out(&seout, "Password file %s has an invalid hash", filename); + return GE_NOTSUP; + } + + newhash = crypt_r(password, readpw, &cdata); + if (!newhash) + return GE_NOTSUP; + + if (strcmp(newhash, readpw) != 0) + return GE_NOTSUP; + + return 0; } #if defined(USE_PAM) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/configure new/ser2net-4.6.8/configure --- old/ser2net-4.6.7/configure 2026-02-06 20:45:20.000000000 +0100 +++ new/ser2net-4.6.8/configure 2026-08-03 15:10:34.000000000 +0200 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.71 for ser2net 4.6.7. +# Generated by GNU Autoconf 2.71 for ser2net 4.6.8. # # Report bugs to <[email protected]>. # @@ -621,8 +621,8 @@ # Identity of this package. PACKAGE_NAME='ser2net' PACKAGE_TARNAME='ser2net' -PACKAGE_VERSION='4.6.7' -PACKAGE_STRING='ser2net 4.6.7' +PACKAGE_VERSION='4.6.8' +PACKAGE_STRING='ser2net 4.6.8' PACKAGE_BUGREPORT='[email protected]' PACKAGE_URL='' @@ -1353,7 +1353,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures ser2net 4.6.7 to adapt to many kinds of systems. +\`configure' configures ser2net 4.6.8 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1424,7 +1424,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of ser2net 4.6.7:";; + short | recursive ) echo "Configuration of ser2net 4.6.8:";; esac cat <<\_ACEOF @@ -1537,7 +1537,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -ser2net configure 4.6.7 +ser2net configure 4.6.8 generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. @@ -1755,7 +1755,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by ser2net $as_me 4.6.7, which was +It was created by ser2net $as_me 4.6.8, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw @@ -3024,7 +3024,7 @@ # Define the identity of the package. PACKAGE='ser2net' - VERSION='4.6.7' + VERSION='4.6.8' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -12846,6 +12846,52 @@ fi +have_crypt_r=no +{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for crypt_r in -lcrypt" >&5 +printf %s "checking for crypt_r in -lcrypt... " >&6; } +if test ${ac_cv_lib_crypt_crypt_r+y} +then : + printf %s "(cached) " >&6 +else $as_nop + ac_check_lib_save_LIBS=$LIBS +LIBS="-lcrypt $LIBS" +cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +/* Override any GCC internal prototype to avoid an error. + Use char because int might match the return type of a GCC + builtin and then its argument prototype would still apply. */ +char crypt_r (); +int +main (void) +{ +return crypt_r (); + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO" +then : + ac_cv_lib_crypt_crypt_r=yes +else $as_nop + ac_cv_lib_crypt_crypt_r=no +fi +rm -f core conftest.err conftest.$ac_objext conftest.beam \ + conftest$ac_exeext conftest.$ac_ext +LIBS=$ac_check_lib_save_LIBS +fi +{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypt_crypt_r" >&5 +printf "%s\n" "$ac_cv_lib_crypt_crypt_r" >&6; } +if test "x$ac_cv_lib_crypt_crypt_r" = xyes +then : + have_crypt_r=yes +fi + +if test $have_crypt_r != "yes"; then + as_fn_error $? "No libcrypt with crypt_r()" "$LINENO" 5 +fi +LIBS="$LIBS -lcrypt" + # Check whether --with-sysfs-led-support was given. if test ${with_sysfs_led_support+y} @@ -13815,7 +13861,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by ser2net $as_me 4.6.7, which was +This file was extended by ser2net $as_me 4.6.8, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -13874,7 +13920,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -ser2net config.status 4.6.7 +ser2net config.status 4.6.8 configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/configure.ac new/ser2net-4.6.8/configure.ac --- old/ser2net-4.6.7/configure.ac 2026-02-06 20:26:22.000000000 +0100 +++ new/ser2net-4.6.8/configure.ac 2026-07-30 13:50:11.000000000 +0200 @@ -1,4 +1,4 @@ -AC_INIT([ser2net],[4.6.7],[[email protected]]) +AC_INIT([ser2net],[4.6.8],[[email protected]]) AM_INIT_AUTOMAKE([-Wall]) AC_PROG_CC AM_PROG_AR @@ -39,6 +39,13 @@ AC_DEFINE([USE_PAM], [], [Enable PAM support]) fi +have_crypt_r=no +AC_CHECK_LIB(crypt, crypt_r, [have_crypt_r=yes], []) +if test $have_crypt_r != "yes"; then + AC_MSG_ERROR([No libcrypt with crypt_r()]) +fi +LIBS="$LIBS -lcrypt" + AC_ARG_WITH(sysfs-led-support, [ --with-sysfs-led-support Enable LED support (Linux only)], sysfs_led_support_flag="$withval", diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/fileio.c new/ser2net-4.6.8/fileio.c --- old/ser2net-4.6.7/fileio.c 2023-07-09 16:54:39.000000000 +0200 +++ new/ser2net-4.6.8/fileio.c 2026-07-30 13:50:11.000000000 +0200 @@ -110,6 +110,8 @@ if (rv) { if (f->rbuf) free(f->rbuf); + if (f->f) + fclose(f->f); free(f); } else { *rf = f; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/led_sysfs.c new/ser2net-4.6.8/led_sysfs.c --- old/ser2net-4.6.7/led_sysfs.c 2025-04-19 01:47:34.000000000 +0200 +++ new/ser2net-4.6.8/led_sysfs.c 2026-07-30 13:50:11.000000000 +0200 @@ -258,8 +258,6 @@ eout->out(eout, "LED '%s': parameter 'device' required, but missing on line %d.", led->name, lineno); - if (drv_data->device) - free(drv_data->device); goto out_err; } @@ -297,6 +295,8 @@ return 0; out_err: + if (drv_data->device) + free(drv_data->device); free(drv_data); return -1; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/ser2net.8 new/ser2net-4.6.8/ser2net.8 --- old/ser2net-4.6.7/ser2net.8 2024-02-02 14:34:05.000000000 +0100 +++ new/ser2net-4.6.8/ser2net.8 2026-07-28 03:28:27.000000000 +0200 @@ -5,7 +5,7 @@ .SH SYNOPSIS .B ser2net -[\-c configfile] [\-C sysconfdir] [\-Y configline] [\-p controlport] +[\-c configfile] [\-C sysconfdir] [\-Y configline] [\-p admin-accepter] [\-n] [\-d] [\-b] [\-v] [-P pidfile] .SH DESCRIPTION @@ -98,6 +98,10 @@ .I \-v Prints the version of the program and exits. .TP +.I \-w +Allow unhashed passwords. Normally only hashed passwords are allowed, +this is for backwards compatibility. +.TP .I \-t <num threads> Spawn the given number of threads for ser2net to use. The default is 1. Only valid if pthreads is enabled at build time. @@ -158,36 +162,6 @@ Set the amount of time in seconds before the port connection will be shut down if no activity has been seen on the port. .TP -.B setportconfig <network port> <config> -Set the port configuration as in the device configuration in the -.BR /etc/ser2net/ser2net.yaml -file. If conflicting options are specified, the last option will -be the one used. Note that these will not change until the port -is disconnected and connected again. Options -.I 300, 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200 -set the various baud rates. The following speed may be available -if your system has the values defined and your hardware supports -it: 230400, 460800, 500000, 576000, 921600, 1000000, 1152000, 1500000, -2000000, 2500000, 3000000, 3500000, 4000000. -Parity, databits, and stopbits may be specified -in the classical manner after the speed, as in 9600N81. -This has the following format: -.B <speed>[N|E|O|M|S[5|6|7|8[1|2]]]. -Setting serial options this way does not work on SOL, SOL has fixed -N81 serial options. -.I EVEN, ODD, NONE (MARK and SPACE if supported) -set the parity. -.I 1STOPBIT, 2STOPBITS -set the number of stop bits. -.I 7DATABITS, 8DATABITS -set the number of data bits. -.I [-]XONXOFF -turns on (- off) XON/XOFF support. -.I [-]RTSCTS -turns on (- off) hardware flow control. -.I [-]LOCAL -ignores (- checks) the modem control lines (DCD, DTR, etc.) -.TP .B setportcontrol <network port> <controls> Modify dynamic port controls. These do not stay between connections. Controls are: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/ser2net.c new/ser2net-4.6.8/ser2net.c --- old/ser2net-4.6.7/ser2net.c 2025-05-06 21:55:18.000000000 +0200 +++ new/ser2net-4.6.8/ser2net.c 2026-07-28 03:28:27.000000000 +0200 @@ -227,6 +227,7 @@ struct gensio_os_proc_data *procdata; struct gensio_os_funcs *so; char *rfc2217_signature = "ser2net"; +bool allow_unhashed_passwords; static char *help_string = "%s: Valid parameters are:\n" @@ -235,7 +236,8 @@ " ssl keys are stored. This is generally /etc/ser2net on Unix-type\n" " systems, on Windows it is ../etc/ser2net from the executable's\n" " location by default.\n" -" -p <controller port> - Start a controller session on the given TCP port\n" +" -p <controller port> - Start a controller session on the given accepter<\n" +" like tcp,2001 and this overrides the one in the config file.\n" " -P <file> - set location of pid file\n" " -n - Don't detach from the controlling terminal\n" " -d - Don't detach and send debug I/O to standard output\n" @@ -244,6 +246,7 @@ " -t <num threads> - Use the given number of threads, default 1\n" " -b - unused (was Do CISCO IOS baud-rate negotiation, instead of RFC2217)\n" " -v - print the program's version and exit\n" +" -w - Allow unhashed passwords\n" " -s - specify a default signature for RFC2217 protocol\n" " -Y - Handle a yaml configuration string. This may be specified multiple\n" " times; these strings are strung together as if they were one input\n" @@ -922,6 +925,10 @@ printf("%s version %s\n", argv[0], VERSION); return 0; + case 'w': + allow_unhashed_passwords = true; + break; + case 's': i++; if (i == argc) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/ser2net.h new/ser2net-4.6.8/ser2net.h --- old/ser2net-4.6.7/ser2net.h 2025-05-06 21:54:57.000000000 +0200 +++ new/ser2net-4.6.8/ser2net.h 2026-07-28 03:28:27.000000000 +0200 @@ -42,6 +42,8 @@ extern int ser2net_wake_sig; +extern bool allow_unhashed_passwords; + #if (defined(gensio_version_major) && (gensio_version_major > 2 || \ (gensio_version_major == 2 && gensio_version_minor >= 2))) #define DO_MDNS diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/ser2net.yaml new/ser2net-4.6.8/ser2net.yaml --- old/ser2net-4.6.7/ser2net.yaml 2025-05-08 22:55:04.000000000 +0200 +++ new/ser2net-4.6.8/ser2net.yaml 2026-07-28 03:28:27.000000000 +0200 @@ -183,16 +183,33 @@ # # ser2net.yaml(5). It's fairly inconvenient. # # Now do an authenticated connection with certauth. You need a host -# # key/certificate pair as in the ssl-only example above. Then you -# # need to create /usr/share/ser2net/auth/<user>. You can create a -# # file named "password" in that directory and put a password there. -# # Make sure it's only readable by ser2net! Or you can create a +# # key/certificate pair as in the ssl-only example above. + +# # For password-authenticated logins, you need to create +# # /usr/share/ser2net/auth/<user>. You can create a file named +# # "hpassword" in that directory and put a hashed password there. +# # Supported hash algorithms are: yescrypt scrypt bcrypt sha512crypt +# # sha256crypt, see "man 5 crypt" for details on these. The mkpasswd +# # utility can generate all of these. Or you can use openssl to +# # generate a sha512crypt password with: +# # openssl passwd -6 >hpassword + +# # ser2net, for a little while, supports unhashed passwords with the +# # -w option to the main program. This is obviously discouraged and +# # deprecated and may go away. But you can create a file named +# # "password" in the same directory and put a password there. Make +# # sure it's only readable by ser2net! + +# # The best, though, is to use certificates. Create a # # directory named /usr/share/ser2net/auth/<user>/allowed_certs, # # put the user's gtlssh certificate there, and run # # gtlssh-keygen rehash /usr/share/ser2net/auth/<user>/allowed_certs # # Then you can do: # # gtlssh --telnet -p 2005 <user>@<hostname> # # and do a normal gtlssh authentication. See gtlssh(1) for details. + +# # An authenticated connection. Only put enable-password if you want +# # password support. # connection: &con4 # accepter: telnet,mux,certauth(enable-password),ssl,sctp,2005 # connector: echo diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/ser2net.yaml.5 new/ser2net-4.6.8/ser2net.yaml.5 --- old/ser2net-4.6.7/ser2net.yaml.5 2025-05-15 14:49:55.000000000 +0200 +++ new/ser2net-4.6.8/ser2net.yaml.5 2026-06-16 15:25:04.000000000 +0200 @@ -541,7 +541,14 @@ address, generally in the form <ip address>,<port>. Multiple addresses can be separated by semicolons, and you can specify remaddr more than once. -.TP + +If your version of gensio is 3.0.3 or later, you can use subnet masks +with remaddr, like: +.EX +.I remaddr: 192.168.33.0/24,0;1234:5678:9abc:21::/64,0 +.EE +and it will allow connections for those entire subnets. + If you set the port for an address to zero, ser2net will accept a connection from any port from the given network host. .TP diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ser2net-4.6.7/yamlconf.c new/ser2net-4.6.8/yamlconf.c --- old/ser2net-4.6.7/yamlconf.c 2024-02-02 14:34:05.000000000 +0100 +++ new/ser2net-4.6.8/yamlconf.c 2026-06-01 03:12:15.000000000 +0200 @@ -286,8 +286,8 @@ vsnprintf(buf, sizeof(buf), str, ap); d->errout->out(d->errout, "%s:%lu(column %lu): %s", f->filename, - (unsigned long) f->e.start_mark.line, - (unsigned long) f->e.start_mark.column, + (unsigned long) f->parser.problem_mark.line, + (unsigned long) f->parser.problem_mark.column, buf); return 0; }
