Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libspf2 for openSUSE:Factory checked in at 2021-08-16 10:11:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libspf2 (Old) and /work/SRC/openSUSE:Factory/.libspf2.new.1899 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libspf2" Mon Aug 16 10:11:27 2021 rev:4 rq:911940 version:unknown Changes: -------- --- /work/SRC/openSUSE:Factory/libspf2/libspf2.changes 2015-06-23 11:59:09.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.libspf2.new.1899/libspf2.changes 2021-08-16 10:17:34.494659877 +0200 @@ -1,0 +2,13 @@ +Fri Aug 13 08:27:13 UTC 2021 - Marcus Meissner <meiss...@suse.com> + +- 0001-spf_compile.c-Correct-size-of-ds_avail.patch: Fixed a remote stack + overflow (CVE-2021-20314 bsc#1189104) + +------------------------------------------------------------------- +Sat Apr 16 20:18:36 UTC 2016 - opens...@dstoecker.de + +- reworked version for openSUSE, based on Fedora version + * libspf2-1.2.10-format.patch + * libspf2-1.2.10-libreplace.patch + +------------------------------------------------------------------- @@ -39 +51,0 @@ - New: ---- 0001-spf_compile.c-Correct-size-of-ds_avail.patch libspf2-1.2.10-format.patch libspf2-1.2.10-libreplace.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libspf2.spec ++++++ --- /var/tmp/diff_new_pack.gz0iBR/_old 2021-08-16 10:17:34.906659382 +0200 +++ /var/tmp/diff_new_pack.gz0iBR/_new 2021-08-16 10:17:34.910659377 +0200 @@ -1,7 +1,7 @@ # # spec file for package libspf2 # -# Copyright (c) 2015 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2021 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -12,7 +12,7 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# Please submit bugfixes or comments via https://bugs.opensuse.org/ # @@ -21,90 +21,187 @@ Version: 1.2.10 Release: 0 Summary: Implementation of the Sender Policy Framework -License: LGPL-2.1+ +License: BSD-2-Clause OR LGPL-2.1-or-later Group: Development/Libraries/C and C++ -Url: http://www.libspf2.org/ -Source: http://www.libspf2.org/spf/%name-%version.tar.gz +URL: http://www.libspf2.org/ +Source0: http://www.libspf2.org/spf/%{name}-%{version}.tar.gz +Patch0: libspf2-1.2.10-format.patch +Patch1: libspf2-1.2.10-libreplace.patch +#PATCH-FIX-UPSTREAM: from upstream, will be in 1.2.11 +Patch2: 0001-spf_compile.c-Correct-size-of-ds_avail.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build +# For API docs +BuildRequires: doxygen +BuildRequires: fdupes +BuildRequires: ghostscript-fonts-std +BuildRequires: graphviz-gd +# For perl bindings (Makefile.PL claims Mail::SPF is needed, but it isn't) +BuildRequires: perl +BuildRequires: perl(DynaLoader) +BuildRequires: perl(Exporter) +BuildRequires: perl(ExtUtils::MakeMaker) +BuildRequires: perl(strict) +BuildRequires: perl(vars) +BuildRequires: perl(warnings) +# For perl test suite +BuildRequires: perl(String::Escape) +BuildRequires: perl(Test::Pod) +# POD Coverage is non-existent, causes test suite to fail +BuildConflicts: perl(Test::Pod::Coverage) +# Perl module fails the standard test suite +BuildConflicts: perl(Mail::SPF::Test) %description Implementation of the Sender Policy Framework, a part of the SPF/SRS protocol pair. -%package -n %lname -Summary: Development Package for libspf2 +%package -n %{lname} +Summary: An implementation of the SPF specification +License: BSD-2-Clause OR LGPL-2.1-or-later Group: System/Libraries -%description -n %lname -Implementation of the Sender Policy Framework, a part of the SPF/SRS protocol -pair. libspf2 is a library which allows email systems such as Sendmail, -Postfix, Exim, Zmailer and MS Exchange to check SPF records and make sure that -the email is authorized by the domain name that it is coming from. This -prevents email forgery, commonly used by spammers, scammers and email -viruses/worms. +%description -n %{lname} +libspf2 is an implementation of the SPF (Sender Policy Framework) +specification as found at: +http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt +SPF allows email systems to check SPF DNS records and make sure that +an email is authorized by the administrator of the domain name that +it is coming from. This prevents email forgery, commonly used by +spammers, scammers, and email viruses/worms. + +A lot of effort has been put into making it secure by design, and a +great deal of effort has been put into the regression tests. %package devel Summary: Development files for libspf +License: BSD-2-Clause OR LGPL-2.1-or-later Group: Development/Libraries/C and C++ -Requires: %lname = %version +Requires: %{lname} = %{version} %description devel -Implementation of the Sender Policy Framework, a part of the SPF/SRS protocol -pair. libspf2 is a library which allows email systems such as Sendmail, -Postfix, Exim, Zmailer and MS Exchange to check SPF records and make sure that -the email is authorized by the domain name that it is coming from. This -prevents email forgery, commonly used by spammers, scammers and email -viruses/worms. - -This is the development package. +The libspf2-devel package contains the header files and static +libraries necessary for developing programs using the libspf2 (Sender +Policy Framework) library. + +If you want to develop programs that will look up and process SPF records, +you should install libspf2-devel. + +API documentation is in the separate libspf2-apidocs package. + +%package apidocs +Summary: API documentation for the libspf2 library +License: BSD-2-Clause OR LGPL-2.1-or-later +Group: Documentation +BuildArch: noarch + +%description apidocs +The libspf2-apidocs package contains the API documentation for creating +applications that use the libspf2 (Sender Policy Framework) library. %package tools -Summary: Tools to work with libspf2 +Summary: Programs for making SPF queries using libspf2 +License: BSD-2-Clause OR LGPL-2.1-or-later Group: Applications/System Obsoletes: spf2 < %version-%release Provides: spf2 = %version-%release %description tools -Implementation of the Sender Policy Framework, a part of the SPF/SRS protocol -pair. libspf2 is a library which allows email systems such as Sendmail, -Postfix, Exim, Zmailer and MS Exchange to check SPF records and make sure that -the email is authorized by the domain name that it is coming from. This -prevents email forgery, commonly used by spammers, scammers and email -viruses/worms. +Programs for making SPF queries and checking their results using libspf2. -This is the package with the binaries. +%package -n perl-Mail-SPF_XS +Summary: An XS implementation of Mail::SPF +License: GPL-1.0-or-later OR Artistic-1.0 +Group: Development/Libraries +Version: 0.01 +Release: 0 +Requires: perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version)) +%description -n perl-Mail-SPF_XS +This is an interface to the C library libspf2 for the purpose of +testing. While it can be used as an SPF implementation, you can also +use Mail::SPF, which is a little more perlish. %prep -%setup -q +%setup + +# SPF_debugf macro should always have at least two parameters +%patch0 + +# libreplace is not needed on modern Linux +rm -rf src/libreplace +%patch1 +%patch2 -p1 +find . -name Makefile.am -print | xargs touch +find . -name Makefile.in -print | xargs touch %build -export CFLAGS="%optflags -std=gnu89" -%configure -make %{?_smp_mflags} +%configure --enable-perl --disable-dependency-tracking +# using --disable-static does not build + +# Kill bogus RPATHs +sed -i 's|^sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/%{_lib} %{_libdir}|' libtool + +make %{?_smp_mflags} CFLAGS="%{optflags} -fno-strict-aliasing" + +# Generate API docs +sed -i -e 's/\(SHORT_NAMES[[:space:]]*=[[:space:]]*\)NO/\1YES/' Doxyfile +doxygen +rm -f doxygen/html/*.map +rm -f doxygen/html/*.md5 %install -make DESTDIR=%{buildroot} install %{?_smp_mflags} -rm %{buildroot}%{_libdir}/*.{a,la} -rm %{buildroot}%{_bindir}/*_static +rm -rf %{buildroot} +make \ + DESTDIR=%{buildroot} \ + PERL_INSTALL_ROOT=$(grep DESTDIR perl/Makefile &> /dev/null && echo "" || echo %{buildroot}) \ + INSTALLDIRS=vendor \ + INSTALL="install -p" \ + install + +# Clean up after impure perl installation +find %{buildroot} \( -name perllocal.pod -o -name .packlist \) -exec rm {} ';' +find %{buildroot} -type f -name '*.bs' -a -size 0 -exec rm -f {} ';' +%{_fixperms} %{buildroot} + +# Don't want statically-linked binaries +rm -f %{buildroot}%{_bindir}/spf*_static + mv %{buildroot}%{_bindir}/spfquery %{buildroot}%{_bindir}/spf_query -%post -n %lname -p /sbin/ldconfig -%postun -n %lname -p /sbin/ldconfig +mkdir -p %{buildroot}%{_docdir}/spf2-apidocs/ +cp -r doxygen/html %{buildroot}%{_docdir}/spf2-apidocs/html +%fdupes %{buildroot}%{_docdir}/spf2-apidocs/ -%files -n %lname -%defattr(-,root,root) -%doc LICENSES -%{_libdir}/lib*.so.* +%check +LD_PRELOAD=$(pwd)/src/libspf2/.libs/libspf2.so make -C perl test + +%post -n %{lname} -p /sbin/ldconfig + +%postun -n %{lname} -p /sbin/ldconfig + +%files -n %{lname} +%doc LICENSES README TODO +%{_libdir}/libspf2.so.* %files devel -%defattr(-,root,root) -%{_libdir}/*.so -%{_includedir}/* +%dir %{_includedir}/spf2 +%{_includedir}/spf2/spf*.h +%{_libdir}/libspf2.so +%exclude %{_libdir}/libspf2.a +%exclude %{_libdir}/libspf2.la + +%files apidocs +%doc %{_docdir}/spf2-apidocs %files tools -%defattr(-,root,root) -%doc README -%{_bindir}/* +%{_bindir}/spfd +%{_bindir}/spf_query +%{_bindir}/spftest +%{_bindir}/spf_example + +%files -n perl-Mail-SPF_XS +%{perl_vendorarch}/Mail/ +%{perl_vendorarch}/auto/Mail/ +%{_mandir}/man3/Mail::SPF_XS.3* %changelog ++++++ 0001-spf_compile.c-Correct-size-of-ds_avail.patch ++++++ >From c37b7c13c30e225183899364b9f2efdfa85552ef Mon Sep 17 00:00:00 2001 From: Shevek <she...@anarres.org> Date: Sat, 5 Jun 2021 21:39:04 -0700 Subject: [PATCH] spf_compile.c: Correct size of ds_avail. --- src/libspf2/spf_compile.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libspf2/spf_compile.c b/src/libspf2/spf_compile.c index ff02f87..b08ffe2 100644 --- a/src/libspf2/spf_compile.c +++ b/src/libspf2/spf_compile.c @@ -455,7 +455,7 @@ SPF_c_parse_var(SPF_response_t *spf_response, SPF_data_var_t *data, /* Magic numbers for x/Nc in gdb. */ \ data->ds.__unused0 = 0xba; data->ds.__unused1 = 0xbe; \ dst = SPF_data_str( data ); \ - ds_avail = _avail; \ + ds_avail = _avail - sizeof(SPF_data_t); \ ds_len = 0; \ } while(0) -- 2.26.2 ++++++ libspf2-1.2.10-format.patch ++++++ --- src/libspf2/spf_compile.c +++ src/libspf2/spf_compile.c @@ -577,7 +577,7 @@ SPF_c_parse_macro(SPF_server_t *spf_serv switch (src[idx]) { case '%': if (spf_server->debug > 3) - SPF_debugf("Adding literal %%"); + SPF_debugf("%s", "Adding literal %%"); SPF_ENSURE_STRING_AVAIL(1); *dst++ = '%'; ds_len++; @@ -586,7 +586,7 @@ SPF_c_parse_macro(SPF_server_t *spf_serv case '_': if (spf_server->debug > 3) - SPF_debugf("Adding literal space"); + SPF_debugf("%s", "Adding literal space"); SPF_ENSURE_STRING_AVAIL(1); *dst++ = ' '; ds_len++; @@ -595,7 +595,7 @@ SPF_c_parse_macro(SPF_server_t *spf_serv case '-': if (spf_server->debug > 3) - SPF_debugf("Adding escaped space"); + SPF_debugf("%s", "Adding escaped space"); SPF_ENSURE_STRING_AVAIL(3); *dst++ = '%'; *dst++ = '2'; *dst++ = '0'; ds_len += 3; --- src/libspf2/spf_dns.c +++ src/libspf2/spf_dns.c @@ -105,7 +105,7 @@ SPF_dns_debug_post(SPF_dns_server_t *spf break; default: - SPF_debugf(" - Unknown RR type"); + SPF_debugf("%s", " - Unknown RR type"); break; } } --- src/libspf2/spf_dns_zone.c +++ src/libspf2/spf_dns_zone.c @@ -114,7 +114,7 @@ SPF_dns_zone_find(SPF_dns_server_t *spf_ return spfhook->zone[i]; } if (spf_dns_server->debug) - SPF_debugf("zone: Exact not found"); + SPF_debugf("%s", "zone: Exact not found"); } else { /* We are looking up a record, so lookup-matching semantics apply. */ @@ -152,7 +152,7 @@ SPF_dns_zone_find(SPF_dns_server_t *spf_ } } if (spf_dns_server->debug) - SPF_debugf("zone: Non-exact not found"); + SPF_debugf("%s", "zone: Non-exact not found"); } return NULL; --- src/libspf2/spf_id2str.c +++ src/libspf2/spf_id2str.c @@ -52,7 +52,7 @@ SPF_record_stringify_data(SPF_data_t *da SPF_data_t *cidr_data; if (debug) - SPF_debugf(" string data: Building"); + SPF_debugf("%s", " string data: Building"); if (p_end - p <= 0) return SPF_E_INTERNAL_ERROR; ++++++ libspf2-1.2.10-libreplace.patch ++++++ libreplace is not needed on Linux --- configure.ac +++ configure.ac @@ -273,8 +273,6 @@ AC_CHECK_FUNCS([strchr strcspn strdup st AC_CHECK_FUNCS([strcasecmp strncasecmp strspn strtoul]) AC_CHECK_FUNCS([gethostbyname inet_ntoa select strrchr strstr strtol]) -AC_REPLACE_FUNCS([getopt_long_only strncasecmp]) -AC_REPLACE_FUNCS([__ns_initparse __ns_name_uncompress __ns_msg_getflag]) dnl Magnus Holmgren says this avoids linking a private function AC_LIBOBJ([__ns_get16]) @@ -282,7 +280,6 @@ AC_CONFIG_FILES([Makefile Doxyfile src/Makefile src/include/Makefile - src/libreplace/Makefile src/libspf2/Makefile src/spfquery/Makefile src/spftest/Makefile --- src/libspf2/Makefile.am +++ src/libspf2/Makefile.am @@ -34,10 +34,6 @@ libspf2_la_SOURCES = \ spf_utils.c \ spf_win32.c -libspf2_la_LIBADD = $(top_builddir)/src/libreplace/libreplace.la - - - libspf2_la_LDFLAGS = -version-info 3:0:1 # Copied from the libtool info file: --- src/Makefile.am +++ src/Makefile.am @@ -4,5 +4,5 @@ AUTOMAKE_OPTIONS = foreign # Attempt to disable parallel processing. .NOTPARALLEL: .NO_PARALLEL: -SUBDIRS = include libreplace libspf2 spfquery spftest spfd spf_example +SUBDIRS = include libspf2 spfquery spftest spfd spf_example TARGETS = --- aclocal.m4 +++ aclocal.m4 @@ -1,4 +1,5 @@ # generated automatically by aclocal 1.11.1 -*- Autoconf -*- +# and touched to get build order right # Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, # 2005, 2006, 2007, 2008, 2009 Free Software Foundation, Inc. --- configure +++ configure @@ -13602,73 +13602,6 @@ fi done -ac_fn_c_check_func "$LINENO" "getopt_long_only" "ac_cv_func_getopt_long_only" -if test "x$ac_cv_func_getopt_long_only" = xyes; then : - $as_echo "#define HAVE_GETOPT_LONG_ONLY 1" >>confdefs.h - -else - case " $LIBOBJS " in - *" getopt_long_only.$ac_objext "* ) ;; - *) LIBOBJS="$LIBOBJS getopt_long_only.$ac_objext" - ;; -esac - -fi - -ac_fn_c_check_func "$LINENO" "strncasecmp" "ac_cv_func_strncasecmp" -if test "x$ac_cv_func_strncasecmp" = xyes; then : - $as_echo "#define HAVE_STRNCASECMP 1" >>confdefs.h - -else - case " $LIBOBJS " in - *" strncasecmp.$ac_objext "* ) ;; - *) LIBOBJS="$LIBOBJS strncasecmp.$ac_objext" - ;; -esac - -fi - - -ac_fn_c_check_func "$LINENO" "__ns_initparse" "ac_cv_func___ns_initparse" -if test "x$ac_cv_func___ns_initparse" = xyes; then : - $as_echo "#define HAVE___NS_INITPARSE 1" >>confdefs.h - -else - case " $LIBOBJS " in - *" __ns_initparse.$ac_objext "* ) ;; - *) LIBOBJS="$LIBOBJS __ns_initparse.$ac_objext" - ;; -esac - -fi - -ac_fn_c_check_func "$LINENO" "__ns_name_uncompress" "ac_cv_func___ns_name_uncompress" -if test "x$ac_cv_func___ns_name_uncompress" = xyes; then : - $as_echo "#define HAVE___NS_NAME_UNCOMPRESS 1" >>confdefs.h - -else - case " $LIBOBJS " in - *" __ns_name_uncompress.$ac_objext "* ) ;; - *) LIBOBJS="$LIBOBJS __ns_name_uncompress.$ac_objext" - ;; -esac - -fi - -ac_fn_c_check_func "$LINENO" "__ns_msg_getflag" "ac_cv_func___ns_msg_getflag" -if test "x$ac_cv_func___ns_msg_getflag" = xyes; then : - $as_echo "#define HAVE___NS_MSG_GETFLAG 1" >>confdefs.h - -else - case " $LIBOBJS " in - *" __ns_msg_getflag.$ac_objext "* ) ;; - *) LIBOBJS="$LIBOBJS __ns_msg_getflag.$ac_objext" - ;; -esac - -fi - - case " $LIBOBJS " in *" __ns_get16.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS __ns_get16.$ac_objext" @@ -13676,7 +13609,7 @@ case " $LIBOBJS " in esac -ac_config_files="$ac_config_files Makefile Doxyfile src/Makefile src/include/Makefile src/libreplace/Makefile src/libspf2/Makefile src/spfquery/Makefile src/spftest/Makefile src/spfd/Makefile src/spf_example/Makefile" +ac_config_files="$ac_config_files Makefile Doxyfile src/Makefile src/include/Makefile src/libspf2/Makefile src/spfquery/Makefile src/spftest/Makefile src/spfd/Makefile src/spf_example/Makefile" cat >confcache <<\_ACEOF # This file is a shell script that caches the results of configure @@ -14693,7 +14626,6 @@ do "Doxyfile") CONFIG_FILES="$CONFIG_FILES Doxyfile" ;; "src/Makefile") CONFIG_FILES="$CONFIG_FILES src/Makefile" ;; "src/include/Makefile") CONFIG_FILES="$CONFIG_FILES src/include/Makefile" ;; - "src/libreplace/Makefile") CONFIG_FILES="$CONFIG_FILES src/libreplace/Makefile" ;; "src/libspf2/Makefile") CONFIG_FILES="$CONFIG_FILES src/libspf2/Makefile" ;; "src/spfquery/Makefile") CONFIG_FILES="$CONFIG_FILES src/spfquery/Makefile" ;; "src/spftest/Makefile") CONFIG_FILES="$CONFIG_FILES src/spftest/Makefile" ;; --- config.h.in +++ config.h.in @@ -49,9 +49,6 @@ /* Define to 1 if you have the <getopt.h> header file. */ #undef HAVE_GETOPT_H -/* Define to 1 if you have the `getopt_long_only' function. */ -#undef HAVE_GETOPT_LONG_ONLY - /* Define to 1 if you have the <grp.h> header file. */ #undef HAVE_GRP_H --- src/libspf2/Makefile.in +++ src/libspf2/Makefile.in @@ -69,8 +69,7 @@ am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' am__installdirs = "$(DESTDIR)$(libdir)" LTLIBRARIES = $(lib_LTLIBRARIES) -libspf2_la_DEPENDENCIES = \ - $(top_builddir)/src/libreplace/libreplace.la +libspf2_la_LIBADD = am_libspf2_la_OBJECTS = spf_compile.lo spf_dns.lo spf_dns_cache.lo \ spf_dns_null.lo spf_dns_resolv.lo spf_dns_rr.lo \ spf_dns_test.lo spf_dns_windns.lo spf_dns_zone.lo \ @@ -289,7 +288,6 @@ libspf2_la_SOURCES = \ spf_utils.c \ spf_win32.c -libspf2_la_LIBADD = $(top_builddir)/src/libreplace/libreplace.la libspf2_la_LDFLAGS = -version-info 3:0:1 all: all-recursive --- src/Makefile.in +++ src/Makefile.in @@ -151,7 +151,7 @@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ STRIP = @STRIP@ -SUBDIRS = include libreplace libspf2 spfquery spftest spfd spf_example +SUBDIRS = include libspf2 spfquery spftest spfd spf_example VERSION = @VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ --- src/spfd/spfd.c +++ src/spfd/spfd.c @@ -88,12 +88,8 @@ #include <grp.h> #endif -#ifdef HAVE_GETOPT_LONG_ONLY #define _GNU_SOURCE #include <getopt.h> -#else -#include "libreplace/getopt.h" -#endif #include <unistd.h> #include <netdb.h> --- src/spfquery/spfquery.c +++ src/spfquery/spfquery.c @@ -46,8 +46,6 @@ #define SPF_TEST_VERSION "3.0" -#include "libreplace/win32_config.h" - #ifdef HAVE_CONFIG_H # include "config.h" #endif @@ -88,12 +86,8 @@ # include <arpa/inet.h> /* in_addr struct */ #endif -#ifdef HAVE_GETOPT_LONG_ONLY #define _GNU_SOURCE #include <getopt.h> -#else -#include "libreplace/getopt.h" -#endif #ifdef _WIN32 #include "spf_win32.h"
