backport-CVE-2024-45751.patch

@@ -1,64 +0,0 @@
-From abd8e0d987ab56013d360077202bf2aca20a42dd Mon Sep 17 00:00:00 2001
-From: Richard Weinberger <richard@nod.at>
-Date: Tue, 3 Sep 2024 16:14:58 +0200
-Subject: [PATCH] chap: Use proper entropy source
-
-The challenge sent to the initiator is based on a poor
-source of randomness, it uses rand() without seeding it by srand().
-So the glibc PRNG is always seeded with 1 and as a consequence the
-sequence of challenges is always the same.
-
-An attacker which is able to monitor network traffic can apply a replay
-attack to bypass the CHAP authentication.  All the attacker has to do
-is waiting for the server or the service to restart and replay with a
-previously record CHAP session which fits into the sequence.
-
-To overcome the issue, use getrandom() to query the kernel random
-number generator.
-Also always send a challenge of length CHAP_CHALLENGE_MAX, there is no
-benefit in sending a variable length challenge.
-
-Signed-off-by: Richard Weinberger <richard@nod.at>
----
- usr/iscsi/chap.c | 12 +++++-------
- 1 file changed, 5 insertions(+), 7 deletions(-)
-
-diff --git a/usr/iscsi/chap.c b/usr/iscsi/chap.c
-index aa0fc671..b89ecabd 100644
---- a/usr/iscsi/chap.c
-+++ b/usr/iscsi/chap.c
-@@ -28,6 +28,7 @@
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
-+#include <sys/random.h>
- 
- #include "iscsid.h"
- #include "tgtd.h"
-@@ -359,22 +360,19 @@ static int chap_initiator_auth_create_challenge(struct iscsi_connection *conn)
- 	sprintf(text, "%u", (unsigned char)conn->auth.chap.id);
- 	text_key_add(conn, "CHAP_I", text);
- 
--	/*
--	 * FIXME: does a random challenge length provide any benefits security-
--	 * wise, or should we rather always use the max. allowed length of
--	 * 1024 for the (unencoded) challenge?
--	 */
--	conn->auth.chap.challenge_size = (rand() % (CHAP_CHALLENGE_MAX / 2)) + CHAP_CHALLENGE_MAX / 2;
-+	conn->auth.chap.challenge_size = CHAP_CHALLENGE_MAX;
- 
- 	conn->auth.chap.challenge = malloc(conn->auth.chap.challenge_size);
- 	if (!conn->auth.chap.challenge)
- 		return CHAP_TARGET_ERROR;
- 
-+	if (getrandom(conn->auth.chap.challenge, conn->auth.chap.challenge_size, 0) != conn->auth.chap.challenge_size)
-+		return CHAP_TARGET_ERROR;
-+
- 	p = text;
- 	strcpy(p, "0x");
- 	p += 2;
- 	for (i = 0; i < conn->auth.chap.challenge_size; i++) {
--		conn->auth.chap.challenge[i] = rand();
- 		sprintf(p, "%.2hhx", conn->auth.chap.challenge[i]);
- 		p += 2;
- 	}

scsi-target-utils.spec

@@ -5,7 +5,7 @@
 
 Summary:        The SCSI target daemon and utility programs
 Name:           scsi-target-utils
-Version:        1.0.91
+Version:        1.0.79
 Release:        2
 License:        GPLv2
 URL:            http://stgt.sourceforge.net/
@@ -18,11 +18,8 @@ Source5:        tgtd.conf
 Patch1:         0002-remove-check-for-xsltproc.patch
 Patch2:         0003-default-config.patch
 Patch3:         tgt-1.0.79-Adapt-to-glusterfs-api-7.6.3.patch
-Patch4:         backport-CVE-2024-45751.patch
 
 BuildRequires:  docbook-style-xsl gcc libaio-devel libxslt perl-generators pkgconfig systemd-devel systemd-units
-BuildRequires:  libgfapi0
-BuildRequires:  chrpath
 %if 0%{?with_rdma}
 BuildRequires:  libibverbs-devel librdmacm-devel
 Requires:       libibverbs librdmacm
@@ -78,22 +75,18 @@ install -p -m 0600 %{SOURCE5} %{buildroot}%{_sysconfdir}/tgt/tgtd.conf
 
 pushd usr
 %{__make} install %{?with_rdma:ISCSI_RDMA=1} %{?with_rbd:CEPH_RBD=1} %{?with_glfs:GLFS_BD=1} SD_NOTIFY=1 DESTDIR=%{buildroot} sbindir=%{_sbindir} libdir=%{_libdir}/tgt
-chrpath -d %{buildroot}/%{_sbindir}/tgtd
-mkdir -p %{buildroot}/etc/ld.so.conf.d
-echo "%{_sbindir}/tgtd" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.conf
 
 %post
 %systemd_post tgtd.service
-/sbin/ldconfig
 
 %preun
 %systemd_preun tgtd.service
 
 %postun
 %systemd_postun tgtd.service
-/sbin/ldconfig
+
 %files
-%doc README.md doc/README.iscsi doc/README.iser doc/README.lu_configuration doc/README.mmc doc/README.ssc
+%doc README doc/README.iscsi doc/README.iser doc/README.lu_configuration doc/README.mmc doc/README.ssc
 %{_sbindir}/tgtd
 %{_sbindir}/tgtadm
 %{_sbindir}/tgt-setup-lun
@@ -102,7 +95,6 @@ echo "%{_sbindir}/tgtd" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.conf
 %{_unitdir}/tgtd.service
 %{_sysconfdir}/tgt
 %{_sysconfdir}/tgt/conf.d
-%config /etc/ld.so.conf.d/*
 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/tgtd
 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/tgt/targets.conf
 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/tgt/tgtd.conf
@@ -125,21 +117,6 @@ echo "%{_sbindir}/tgtd" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.conf
 %{_mandir}/man8/*
 
 %changelog
-* Mon Sep 09 2024 yaoxin <yao_xin001@hoperun.com> - 1.0.91-2
-- Fix CVE-2024-45751
-
-* Mon Mar 04 2024 xu_ping <707078654@qq.com> - 1.0.91-1
-- Update to 1.0.91
-
-* Tue Oct 17 2023 wulei <wu_lei@hoperun.com> - 1.0.88-1
-- Update to 1.0.88
-
-* Fri Mar 4 2022 xigaoxinyan <xigaoxinyan@huawei.com> - 1.0.79-4
-- Remove rpath
-
-* Mon Jan 24 2022 xu_ping <xuping33@huawei.com> - 1.0.79-3
-- Add BuildRequires libgfapi0 to fix /usr/bin/ld: cannot find -lgfapi
-
 * Mon Jul 05 2021 wulei <wulei80@huawei.com> - 1.0.79-2
 - Remove redundant dependencies, Git is only for patching, user patcher instead.