commit: b67d6ae849572e4def3456b5b847ab11471b9512
Author: Andrew Savchenko <bircoph <AT> gentoo <DOT> org>
AuthorDate: Sun Jul 12 14:04:19 2020 +0000
Commit: Andrew Savchenko <bircoph <AT> gentoo <DOT> org>
CommitDate: Sun Jul 12 14:15:10 2020 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b67d6ae8
net-dialup/openl2tp: fix insecure string operations
Fix possible string overflows found by gcc.
The main problem is that strncpy does not always NULL-terminate string.
Package-Manager: Portage-2.3.99, Repoman-2.3.22
Signed-off-by: Andrew Savchenko <bircoph <AT> gentoo.org>
.../openl2tp/files/openl2tp-1.8-strings.patch | 114 ++++++++++++++++++
net-dialup/openl2tp/openl2tp-1.8-r2.ebuild | 129 +++++++++++++++++++++
2 files changed, 243 insertions(+)
diff --git a/net-dialup/openl2tp/files/openl2tp-1.8-strings.patch
b/net-dialup/openl2tp/files/openl2tp-1.8-strings.patch
new file mode 100644
index 00000000000..16b7beffb21
--- /dev/null
+++ b/net-dialup/openl2tp/files/openl2tp-1.8-strings.patch
@@ -0,0 +1,114 @@
+diff '--color=auto' -Naurd openl2tp-1.8.orig/l2tp_plugin.c
openl2tp-1.8/l2tp_plugin.c
+--- openl2tp-1.8.orig/l2tp_plugin.c 2008-09-25 19:00:55.000000000 +0400
++++ openl2tp-1.8/l2tp_plugin.c 2020-07-12 11:55:23.292225206 +0300
+@@ -85,16 +85,20 @@
+
+ if (strchr(name, '/') == 0) {
+ const char *base = L2TP_PLUGIN_DIR;
+- int len = strlen(base) + strlen(name) + 2;
++ size_t len_base, len_name, len;
++ len_base = strlen(base);
++ len_name = strlen(name);
++ len = len_base + len_name + 2;
+ path = malloc(len);
+ if (path == NULL) {
+ l2tp_log(LOG_ERR, "OOM: plugin file path");
+ return -ENOMEM;
+ }
+
+- strncpy(path, base, len);
+- strncat(path, "/", len);
+- strncat(path, name, len);
++ memcpy(path, base, len_base);
++ path[len_base] = '/';
++ memcpy(path + len_base + 1, name, len_name);
++ path[len - 1] = '\0';
+ } else {
+ path = strdup(name);
+ if (path == NULL) {
+diff '--color=auto' -Naurd openl2tp-1.8.orig/plugins/ppp_unix.c
openl2tp-1.8/plugins/ppp_unix.c
+--- openl2tp-1.8.orig/plugins/ppp_unix.c 2020-07-12 11:37:06.287914337
+0300
++++ openl2tp-1.8/plugins/ppp_unix.c 2020-07-12 12:31:26.042810957 +0300
+@@ -811,7 +811,7 @@
+ {
+ pid_t pid;
+ int result = 0;
+- char str[10];
++ char str[11];
+ struct l2tp_session_config const *scfg;
+
+ pid = usl_pid_safe_fork();
+@@ -1362,7 +1362,8 @@
+ tmp_fd = socket(AF_INET, SOCK_DGRAM, 0);
+ if (tmp_fd >= 0) {
+ memset (&ifr, '\0', sizeof (ifr));
+- strncpy(ifr.ifr_name, ppp->interface_name, sizeof
(ifr.ifr_name));
++ strncpy(ifr.ifr_name, ppp->interface_name, sizeof
(ifr.ifr_name) - 1);
++ ifr.ifr_name[sizeof(ifr.ifr_name)-1] = '\0';
+ ifr.ifr_mtu = mtu;
+
+ result = ioctl(tmp_fd, SIOCSIFMTU, (caddr_t) &ifr);
+diff '--color=auto' -Naurd openl2tp-1.8.orig/l2tp_statusfile.c
openl2tp-1.8/l2tp_statusfile.c
+--- openl2tp-1.8.orig/l2tp_statusfile.c 2020-07-12 15:58:52.279211936
+0300
++++ openl2tp-1.8/l2tp_statusfile.c 2020-07-12 15:59:07.949273953 +0300
+@@ -48,7 +48,7 @@
+
+ static FILE *l2tp_statusfile_file_create(const char *parent, const char *name)
+ {
+- char filename[256];
++ char filename[257];
+ FILE *file;
+
+ if (name != NULL) {
+@@ -66,7 +66,7 @@
+ static int l2tp_statusfile_file_delete(const char *root, const char *parent,
const char *name)
+ {
+ int result;
+- char filename[256];
++ char filename[257];
+
+ if (root == NULL) {
+ if (name != NULL) {
+@@ -102,7 +102,7 @@
+ static int l2tp_statusfile_dir_create(const char *parent, const char *name)
+ {
+ int result;
+- char dirname[256];
++ char dirname[257];
+
+ if (name != NULL) {
+ sprintf(dirname, L2TP_STATUSFILE_DIR "/%s/%s", parent, name);
+@@ -127,8 +127,8 @@
+ static int l2tp_statusfile_dir_delete(const char *root, const char *parent,
const char *name, int recursive)
+ {
+ int result;
+- char dirname[256];
+- char filename[256];
++ char dirname[257];
++ char filename[257];
+ DIR *dir;
+ struct dirent *entry;
+ struct stat statbuf;
+diff '--color=auto' -Naurd openl2tp-1.8.orig/l2tp_config.c
openl2tp-1.8/l2tp_config.c
+--- openl2tp-1.8.orig/l2tp_config.c 2020-07-12 16:03:00.062192426 +0300
++++ openl2tp-1.8/l2tp_config.c 2020-07-12 16:07:00.035142012 +0300
+@@ -135,7 +135,8 @@
+ goto out;
+ }
+ if (strcmp(server_name, &server[0])) {
+- strncpy(&server[0], server_name, sizeof(server));
++ strncpy(&server[0], server_name, sizeof(server) - 1);
++ server[sizeof(server) - 1] = '\0';
+
+ clnt_destroy(cl);
+ cl = clnt_create(server, L2TP_PROG, L2TP_VERSION,
opt_rpc_protocol);
+@@ -6629,7 +6630,8 @@
+ arg++;
+ break;
+ case 'R':
+- strncpy(server, optarg, sizeof(server));
++ strncpy(server, optarg, sizeof(server) - 1);
++ server[sizeof(server) - 1] = '\0';
+ arg += 2;
+ l2tp_set_prompt(server);
+ break;
diff --git a/net-dialup/openl2tp/openl2tp-1.8-r2.ebuild
b/net-dialup/openl2tp/openl2tp-1.8-r2.ebuild
new file mode 100644
index 00000000000..31d207b4552
--- /dev/null
+++ b/net-dialup/openl2tp/openl2tp-1.8-r2.ebuild
@@ -0,0 +1,129 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit linux-info
+
+DESCRIPTION="Userspace tools for kernel L2TP implementation"
+HOMEPAGE="https://sourceforge.net/projects/openl2tp/";
+SRC_URI="mirror://sourceforge/openl2tp/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="+client debug dmalloc doc +examples rpc server stats"
+
+REQUIRED_USE="|| ( client server )"
+
+BDEPEND="
+ >=net-libs/rpcsvc-proto-1.3.1-r1
+ sys-devel/bison
+ sys-devel/flex
+"
+DEPEND="
+ >=net-dialup/ppp-2.4.5
+ >=net-libs/libtirpc-1.0.3
+ sys-libs/readline:=
+ dmalloc? ( dev-libs/dmalloc )
+"
+RDEPEND="${DEPEND}
+ rpc? ( net-nds/rpcbind )
+"
+
+CONFIG_CHECK="~PPPOL2TP"
+
+PATCHES=(
+ "${FILESDIR}/${P}-werror.patch"
+ "${FILESDIR}/${P}-ldflags.patch"
+ "${FILESDIR}/${P}-pppd-2.patch"
+ "${FILESDIR}/${P}-man.patch"
+ "${FILESDIR}/${P}-l2tpconfig.patch"
+ "${FILESDIR}/${P}-parallelbuild.patch"
+ "${FILESDIR}/${P}-optionsfile.patch"
+ "${FILESDIR}/${P}-clientip_as_ipparam.patch"
+ "${FILESDIR}/${P}-setkey.patch"
+ "${FILESDIR}/${P}-unused-var.patch"
+ "${FILESDIR}/${P}-configure-Makefile.patch"
+ "${FILESDIR}/${P}-cflags.patch"
+ "${FILESDIR}/${P}-tirpc.patch"
+ "${FILESDIR}/${P}-native-tc.patch"
+ "${FILESDIR}/${P}-musl.patch"
+ "${FILESDIR}/${P}-strings.patch"
+)
+
+src_prepare() {
+ default
+ sed -i 's/CFLAGS.optimize/CFLAGS_optimize/g' Makefile */Makefile || die
"Makefile sed failed"
+}
+
+src_configure() {
+ myconf=
+
+ use client || myconf+=" L2TP_FEATURE_LAC_SUPPORT=n
+
L2TP_FEATURE_LAIC_SUPPORT=n
+
L2TP_FEATURE_LAOC_SUPPORT=n "
+
+ use server || myconf+=" L2TP_FEATURE_LNS_SUPPORT=n
+
L2TP_FEATURE_LNIC_SUPPORT=n
+
L2TP_FEATURE_LNOC_SUPPORT=n "
+
+ use rpc || myconf+=" L2TP_FEATURE_RPC_MANAGEMENT=n "
+
+ use stats && myconf+=" L2TP_FEATURE_LOCAL_STAT_FILE=y "
+ use debug && myconf+=" L2TP_DEBUG=y "
+ use dmalloc && myconf+=" USE_DMALLOC=y "
+
+ echo ${myconf} > "${T}/myconf"
+}
+
+src_compile() {
+ emake $(cat "${T}/myconf")
+}
+
+src_install() {
+ emake $(cat "${T}/myconf") DESTDIR="${D}" install
+
+ if use examples; then
+ docinto event_socket
+ dodoc doc/{event_sock_example.c,README.event_sock}
+ docinto
+ dodoc -r "${FILESDIR}"/examples
+ fi
+
+ if use doc; then
+ dodoc doc/*.txt
+ newdoc plugins/README README.plugins
+ dodoc -r ipsec
+ fi
+
+ newinitd "${FILESDIR}"/openl2tpd.initd openl2tpd
+ # init.d script is quite different for RPC and non-RPC versions.
+ use rpc || sed -i s/userpc=\"yes\"/userpc=\"no\"/
"${D}/etc/init.d/openl2tpd" || die "sed failed"
+ newconfd "${FILESDIR}"/openl2tpd.confd openl2tpd
+}
+
+pkg_postinst() {
+ if use rpc; then
+ ewarn
+ ewarn "RPC control does not provide any auth checks for control
connection."
+ ewarn "Unless you need this you should disable it, for
reference:"
+ ewarn "http://forums.openl2tp.org/viewtopic.php?f=4&t=41";
+ ewarn
+ ewarn "Therefore DO NOT USE RPC IN INSECURE ENVIRONMENTS!"
+ else
+ ewarn
+ ewarn "Without RPC support you won't be able to use l2tpconfig."
+ ewarn "Please read
http://forums.openl2tp.org/viewtopic.php?f=4&t=41";
+ ewarn "for more information about the security risk before
enabling."
+ ewarn
+ ewarn "If you are using numerical strings (e.g. login name
containing only"
+ ewarn "digits) or special characters in password, please use
double quotes"
+ ewarn "to enclose them."
+ fi
+ if use stats; then
+ ewarn
+ ewarn "To enable status files openl2tpd must be started with -S
option."
+ ewarn "Upstream warns about runtime overhead with status files
enabled."
+ fi
+}
