Add patches to: fix buffer overflow (bring plugins/digestmda5.c to cvs version 1.172) and fix SASL_PATH vulnerability - marked unstable on all archs

6 files changed, 387 insertions, 15 deletions

diff --git a/dev-libs/cyrus-sasl/ChangeLog b/dev-libs/cyrus-sasl/ChangeLog
index a6102177093f..20f83923d3d2 100644
--- a/dev-libs/cyrus-sasl/ChangeLog
+++ b/dev-libs/cyrus-sasl/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for dev-libs/cyrus-sasl
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/cyrus-sasl/ChangeLog,v 1.76 2004/07/02 10:03:53 mr_bones_ Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/cyrus-sasl/ChangeLog,v 1.77 2004/07/07 02:59:32 merlin Exp $
+
+*cyrus-sasl-2.1.18-r1 (06 Jul 2004)
+
+  06 Jul 2004; Cory Visi <merlin@gentoo.org> cyrus-sasl-2.1.18-r1.ebuild,
+  files/cyrus-sasl-2.1.18-cvs-1.172.patch,
+  files/cyrus-sasl-2.1.18-sasl-path-fix.patch:
+  Add patches to: fix buffer overflow (bring plugins/digestmda5.c to cvs version
+  1.172) and fix SASL_PATH vulnerability - marked unstable on all archs
 
 *cyrus-sasl-2.1.17 (02 Jul 2004)
 
diff --git a/dev-libs/cyrus-sasl/Manifest b/dev-libs/cyrus-sasl/Manifest
index 10e4eda6a9e4..3c09e3025801 100644
--- a/dev-libs/cyrus-sasl/Manifest
+++ b/dev-libs/cyrus-sasl/Manifest
@@ -1,34 +1,38 @@
-MD5 76554c4ffb4bb8dd8a761fc763d6770d ChangeLog 14645
+MD5 2e473cb5921ee91aad15a5e5cdc0b079 ChangeLog 14997
 MD5 3197fe37928e71d1072a187d59c7420f cyrus-sasl-1.5.27-r5.ebuild 2692
 MD5 371deb1330411da2c73d84bf46ee190e cyrus-sasl-1.5.27-r6.ebuild 2765
 MD5 0364033278f9f21b78e0a6cb0025db6b cyrus-sasl-2.1.14.ebuild 3917
 MD5 9bec5bcd49985c0721eec238b54ccc3d cyrus-sasl-2.1.15.ebuild 3747
 MD5 a1468600bebea36437d458d047b417e7 cyrus-sasl-2.1.18.ebuild 4266
-MD5 6277febc050092fe764fe9c445a66570 cyrus-sasl-2.1.17.ebuild 4249
 MD5 5721b86fd871bdfab77231abc6e02f68 metadata.xml 161
+MD5 6277febc050092fe764fe9c445a66570 cyrus-sasl-2.1.17.ebuild 4249
+MD5 ab1cbd5aa6c7d7a40f426b0f332fe4f2 cyrus-sasl-2.1.18-r1.ebuild 4498
 MD5 b398dd3696347604a52a40bf1a77291b files/2.1.14-db4.patch 2032
 MD5 a445d25ebbdf18b372340d4643736941 files/2.1.14-kerberos.patch 1148
 MD5 72c9252fd0ccb3fc369c60ec233f4218 files/2.1.14-mysql.patch 730
+MD5 4c6ffed2ba584f75a0c948250f7a11b7 files/cyrus-sasl-1.5.21-des.patch 242
+MD5 5d8f83e453b4f7dff5eeee74335de870 files/cyrus-sasl-1.5.24-rpath.patch 448
+MD5 5f96ab675ae2ff1da8e0ee4503340df5 files/cyrus-sasl-1.5.27-scram.patch 480
 MD5 397ec1b24d4efe6efafa4782ba0f3493 files/cyrus-sasl-2.1.17-configdir.patch 8095
+MD5 b9ab0670db5b9b5a74de379c18e5370d files/cyrus-sasl-2.1.17-pgsql-include.patch 617
 MD5 13c15e58d2fa734adeb718e4e3dea757 files/cyrus-sasl-2.1.18-db4.patch 1604
-MD5 fcf540108971d5aaa0bbfba381971ca7 files/digest-cyrus-sasl-2.1.18 70
-MD5 8a11a6b269e544ee863f098f5fab601d files/saslauthd.conf 897
-MD5 7b24e99c21a5924543fe82cd82a1d741 files/saslauthd.pam 223
-MD5 81cec2fe43610499ef4372d0dff44292 files/saslauthd2.conf 745
-MD5 960ffd4d83e165ccaa68cf43937ff63d files/digest-cyrus-sasl-2.1.17 70
-MD5 4c6ffed2ba584f75a0c948250f7a11b7 files/cyrus-sasl-1.5.21-des.patch 242
 MD5 75aaabf38cf470bae9a928a334c3cb59 files/cyrus-sasl-configdir.patch 8510
 MD5 228579b200f0a570f9c02d222f400672 files/cyrus-sasl-gcc32.patch 426
 MD5 692a355142b7cfb937cd8a3a655c0310 files/cyrus-sasl-heimdal-deps.patch 624
 MD5 9a317f7aa562936a829574f63aefce15 files/cyrus-sasl-saslauthd.patch 4938
-MD5 5d8f83e453b4f7dff5eeee74335de870 files/cyrus-sasl-1.5.24-rpath.patch 448
 MD5 6690c1dc7a0e2c6219719eea1b367ab5 files/digest-cyrus-sasl-1.5.27-r5 69
 MD5 6690c1dc7a0e2c6219719eea1b367ab5 files/digest-cyrus-sasl-1.5.27-r6 69
 MD5 6ba386a4eb5f9addf367d41093ba369e files/digest-cyrus-sasl-2.1.14 70
 MD5 6109117a3ea3c1141364d60d212f48d9 files/digest-cyrus-sasl-2.1.15 70
-MD5 b9ab0670db5b9b5a74de379c18e5370d files/cyrus-sasl-2.1.17-pgsql-include.patch 617
-MD5 346ac637058b838ef7a2e0df3e2a6e62 files/pwcheck.rc6 547
-MD5 5f96ab675ae2ff1da8e0ee4503340df5 files/cyrus-sasl-1.5.27-scram.patch 480
-MD5 d34cf414f5afcb61a8ebaa2295b16934 files/saslauthd.rc6 532
-MD5 b3e4b485d66d1b6c6cc5bb726f065492 files/saslauthd2.rc6 534
+MD5 fcf540108971d5aaa0bbfba381971ca7 files/digest-cyrus-sasl-2.1.18 70
+MD5 a21930769b34c30d8166dc1d65482c26 files/pwcheck.rc6 546
+MD5 d1672e7dfaaa66893c8eefe0712b7e36 files/saslauthd.conf 896
+MD5 7b24e99c21a5924543fe82cd82a1d741 files/saslauthd.pam 223
+MD5 65e5efdf063dbf2d5427b421343c9ff2 files/saslauthd.rc6 531
+MD5 1b1b242c70955511bc086ba8008d3536 files/saslauthd2.conf 744
+MD5 8d0729dbeb7685b261231cd0ddef4dfb files/saslauthd2.rc6 533
 MD5 cb4a5c5160219818e04196847ba9f7a1 files/cyrus-sasl-2.1.17-db4.patch 1451
+MD5 960ffd4d83e165ccaa68cf43937ff63d files/digest-cyrus-sasl-2.1.17 70
+MD5 e8b9357dba2bde4dac0b1cf38d5942eb files/cyrus-sasl-2.1.18-cvs-1.172.patch 5056
+MD5 428652e3c78cc4da4e8b4b129875d9d1 files/cyrus-sasl-2.1.18-sasl-path-fix.patch 537
+MD5 fcf540108971d5aaa0bbfba381971ca7 files/digest-cyrus-sasl-2.1.18-r1 70
diff --git a/dev-libs/cyrus-sasl/cyrus-sasl-2.1.18-r1.ebuild b/dev-libs/cyrus-sasl/cyrus-sasl-2.1.18-r1.ebuild
new file mode 100644
index 000000000000..f763d3d3aa97
--- /dev/null
+++ b/dev-libs/cyrus-sasl/cyrus-sasl-2.1.18-r1.ebuild
@@ -0,0 +1,147 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/cyrus-sasl/cyrus-sasl-2.1.18-r1.ebuild,v 1.1 2004/07/07 02:59:32 merlin Exp $
+
+inherit eutils flag-o-matic gnuconfig
+
+DESCRIPTION="The Cyrus SASL (Simple Authentication and Security Layer)"
+HOMEPAGE="http://asg.web.cmu.edu/sasl/"
+SRC_URI="ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/${P}.tar.gz"
+
+LICENSE="as-is"
+SLOT="2"
+KEYWORDS="~x86 ~ppc ~sparc ~mips ~alpha ~arm ~hppa ~amd64 ~ia64 ~s390 ~ppc64"
+IUSE="gdbm ldap mysql postgres kerberos static ssl java pam"
+
+RDEPEND="virtual/libc
+	>=sys-libs/db-3.2
+	gdbm? ( >=sys-libs/gdbm-1.8.0 )
+	ldap? ( >=net-nds/openldap-2.0.25 )
+	mysql? ( >=dev-db/mysql-3.23.51 )
+	postgres? ( >=dev-db/postgresql-7.2 )
+	pam? ( >=sys-libs/pam-0.75 )
+	ssl? ( >=dev-libs/openssl-0.9.6d )
+	kerberos? ( virtual/krb5 )
+	java? ( virtual/jdk )"
+DEPEND="${RDEPEND}
+	>=sys-apps/sed-4
+	>=sys-devel/autoconf-2.58
+	sys-devel/automake
+	sys-devel/libtool"
+
+src_unpack() {
+	unpack ${A} && cd "${S}"
+
+	# Fix broken include.
+	sed -e 's:sasl/sasl.h:sasl.h:' \
+		-i saslauthd/lak.c || die "sed failed"
+
+	# Fix default port name for rimap auth mechanism.
+	sed -e '/define DEFAULT_REMOTE_SERVICE/s:imap:imap2:' \
+		-i saslauthd/auth_rimap.c || die "sed failed"
+
+	# DB4 detection and versioned symbols.
+	epatch "${FILESDIR}/cyrus-sasl-2.1.18-db4.patch"
+
+	# Add configdir support.
+	epatch "${FILESDIR}/cyrus-sasl-2.1.17-configdir.patch"
+
+	# Fix include path for newer PostgreSQL versions.
+	epatch "${FILESDIR}/cyrus-sasl-2.1.17-pgsql-include.patch"
+
+	# Bring plugins/digestmd5.c up to cvs 1.172 to fix buffer overflow
+	epatch "${FILESDIR}/cyrus-sasl-2.1.18-cvs-1.172.patch"
+
+	# Add setuid/setgid check for SASL_PATH
+	epatch "${FILESDIR}/cyrus-sasl-2.1.18-sasl-path-fix.patch"
+
+	# Recreate configure.
+	export WANT_AUTOCONF="2.5"
+	rm -f configure config.h.in saslauthd/configure
+	ebegin "Recreating configure"
+	aclocal -I cmulocal -I config && autoheader && autoconf || \
+		die "recreate configure failed"
+	eend $?
+
+	cd "${S}/saslauthd"
+	ebegin "Recreating saslauthd/configure"
+	aclocal -I ../cmulocal -I ../config && autoheader && autoconf || \
+		die "recreate configure failed"
+	eend $?
+}
+
+src_compile() {
+	local myconf="--enable-login --enable-ntlm --disable-krb4 --disable-otp"
+	myconf="${myconf} `use_enable static`"
+	myconf="${myconf} `use_with ssl openssl`"
+	myconf="${myconf} `use_with pam`"
+	myconf="${myconf} `use_with ldap`"
+	myconf="${myconf} `use_enable kerberos gssapi`"
+	myconf="${myconf} `use_with mysql` `use_enable mysql sql`"
+	myconf="${myconf} `use_with postgres pgsql` `use_enable postgres sql`"
+	myconf="${myconf} `use_enable java` `use_with java javahome ${JAVA_HOME}`"
+
+	if use mysql || use postgres ; then
+		myconf="${myconf} --enable-sql"
+	else
+		myconf="${myconf} --disable-sql"
+	fi
+	if use gdbm ; then
+		myconf="${myconf} --with-dblib=gdbm"
+	else
+		myconf="${myconf} --with-dblib=berkeley"
+	fi
+
+	# Compaq-sdk checks for -D_REENTRANT and -pthread takes care the cpp stuff.
+	use alpha && append-flags -D_REENTRANT -pthread
+
+	# Detect mips systems properly.
+	use mips && gnuconfig_update
+	use ppc64 && gnuconfig_update
+
+	econf \
+		--with-saslauthd=/var/lib/sasl2 \
+		--with-pwcheck=/var/lib/sasl2 \
+		--with-configdir=/etc/sasl2 \
+		--with-plugindir=/usr/lib/sasl2 \
+		--with-dbpath=/etc/sasl2/sasldb2 \
+		${myconf} || die "econf failed"
+
+	# Parallel build doesn't work.
+	emake -j1 || die "compile problem"
+}
+
+src_install () {
+	einstall
+	keepdir /var/lib/sasl2 /etc/sasl2
+
+	# Generate an empty sasldb2 with correct permissions.
+	LD_OLD="${LD_LIBRARY_PATH}"
+	export LD_LIBRARY_PATH="${D}/usr/lib" SASL_PATH="${D}/usr/lib/sasl2"
+	echo "p" | "${D}/usr/sbin/saslpasswd2" -f "${D}/etc/sasl2/sasldb2" -p login
+	"${D}/usr/sbin/saslpasswd2" -f "${D}/etc/sasl2/sasldb2" -d login
+	export LD_LIBRARY_PATH="${LD_OLD}"
+	chown root:mail "${D}/etc/sasl2/sasldb2"
+	chmod 0640 "${D}/etc/sasl2/sasldb2"
+
+	dodoc AUTHORS COPYING ChangeLog NEWS README doc/TODO doc/*.txt
+	newdoc pwcheck/README README.pwcheck
+	dohtml doc/*.html
+
+	docinto examples
+	dodoc sample/{*.[ch],Makefile}
+
+	docinto saslauthd
+	dodoc saslauthd/{AUTHORS,COPYING,ChangeLog,LDAP_SASLAUTHD,NEWS,README}
+
+	if use pam ; then
+		insinto /etc/pam.d
+		newins "${FILESDIR}/saslauthd.pam" saslauthd
+	fi
+
+	exeinto /etc/init.d
+	newexe "${FILESDIR}/pwcheck.rc6" pwcheck
+	newexe "${FILESDIR}/saslauthd2.rc6" saslauthd
+	insinto /etc/conf.d
+	newins "${FILESDIR}/saslauthd2.conf" saslauthd
+}
diff --git a/dev-libs/cyrus-sasl/files/cyrus-sasl-2.1.18-cvs-1.172.patch b/dev-libs/cyrus-sasl/files/cyrus-sasl-2.1.18-cvs-1.172.patch
new file mode 100644
index 000000000000..77547e37e88c
--- /dev/null
+++ b/dev-libs/cyrus-sasl/files/cyrus-sasl-2.1.18-cvs-1.172.patch
@@ -0,0 +1,194 @@
+diff -Naur cyrus-sasl-2.1.18-orig/plugins/digestmd5.c cyrus-sasl-2.1.18/plugins/digestmd5.c
+--- cyrus-sasl-2.1.18-orig/plugins/digestmd5.c	2004-02-23 17:03:09.000000000 -0500
++++ cyrus-sasl-2.1.18/plugins/digestmd5.c	2004-07-06 22:08:23.159206640 -0400
+@@ -151,6 +151,10 @@
+ #define SP	(32)
+ #define DEL	(127)
+ 
++#define NEED_ESCAPING	"\"\\"	
++
++static char *quote (char *str);
++
+ struct context;
+ 
+ /* function definitions for cipher encode/decode */
+@@ -498,21 +502,42 @@
+     ret = _plug_buf_alloc(utils, str, buflen,
+ 			  *curlen + 1 + namesize + 2 + valuesize + 2);
+     if(ret != SASL_OK) return ret;
+-    
+-    *curlen = *curlen + 1 + namesize + 2 + valuesize + 2;
+-    
++
++	if (*curlen > 0) {
+     strcat(*str, ",");
+     strcat(*str, name);
+-    
++	} else {
++	strcpy(*str, name);
++	}
++
+     if (need_quotes) {
+-	strcat(*str, "=\"");
+-	strcat(*str, (char *) value);	/* XXX. What about quoting??? */
+-	strcat(*str, "\"");
+-    } else {
+-	strcat(*str, "=");
+-	strcat(*str, (char *) value);
+-    }
+-    
++		strcat(*str, "=\"");
++
++		/* Check if the value needs quoting */
++		if (strpbrk ((char *)value, NEED_ESCAPING) != NULL) {
++			char * quoted = quote ((char *) value);
++			valuesize = strlen(quoted);
++			/* As the quoted string is bigger, make sure we have enough
++			   space now */
++			ret = _plug_buf_alloc(utils, str, buflen,
++				*curlen + 1 + namesize + 2 + valuesize + 2);
++			if (ret == SASL_OK) {
++				strcat(*str, quoted);
++				free (quoted);
++			} else {
++				free (quoted);
++				return ret;
++			}
++		} else {
++			strcat(*str, (char *) value);
++		}
++		strcat(*str, "\"");
++	} else {
++		strcat(*str, "=");
++		strcat(*str, (char *) value);
++	}
++
++	*curlen = *curlen + 1 + namesize + 2 + valuesize + 2;  
+     return SASL_OK;
+ }
+ 
+@@ -622,7 +647,8 @@
+ }
+ 
+ /* NULL - error (unbalanced quotes), 
+-   otherwise pointer to the first character after value */
++   otherwise pointer to the first character after value
++   The function performs work in place. */
+ static char *unquote (char *qstr)
+ {
+     char *endvalue;
+@@ -663,12 +689,49 @@
+ 	endvalue++;
+     }
+     else { /* not qouted value (token) */
++	/* qstr already contains output */
+ 	endvalue = skip_token(qstr,0);
+     };
+     
+     return endvalue;  
+ } 
+ 
++/* Unlike unquote, this function returns an allocated quoted copy */
++static char *quote (char *str)
++{
++	char *p;
++	char *outp;
++	char *result;
++	int num_to_escape;		/* How many characters need escaping */
++
++	if (!str) return NULL;
++
++	num_to_escape = 0;
++	p = strpbrk (str, NEED_ESCAPING);
++	while (p != NULL) {
++		num_to_escape++;
++		p = strpbrk (p + 1, NEED_ESCAPING);
++	}
++
++	if (num_to_escape == 0) {
++		return (strdup (str));
++	}
++
++	result = malloc (strlen(str) + num_to_escape + 1);
++	for (p = str, outp = result; *p; p++) {
++		if (*p == '"' || *p == '\\') {
++			*outp = '\\';
++			outp++;
++		}
++		*outp = *p;
++		outp++;
++	}
++
++	*outp = '\0';
++
++	return (result);
++}
++
+ static void get_pair(char **in, char **name, char **value)
+ {
+     char  *endpair;
+@@ -1791,12 +1854,16 @@
+ 	return SASL_FAIL;
+     }
+     
+-    resplen = strlen(nonce) + strlen("nonce") + 5;
+-    result = _plug_buf_alloc(sparams->utils, &(text->out_buf),
+-			     &(text->out_buf_len), resplen);
+-    if(result != SASL_OK) return result;
+-    
+-    sprintf(text->out_buf, "nonce=\"%s\"", nonce);
++	resplen = 0;
++	text->out_buf = NULL;
++	text->out_buf_len = 0;
++	if (add_to_challenge(sparams->utils,
++						&text->out_buf, &text->out_buf_len, &resplen,
++						"nonce", (unsigned char *) nonce,
++						TRUE) != SASL_OK) {
++		SETERROR(sparams->utils, "internal error: add_to_challenge failed");
++		return SASL_FAIL;
++	}
+     
+     /* add to challenge; if we chose not to specify a realm, we won't
+      * send one to the client */
+@@ -2830,7 +2897,7 @@
+     char           maxbufstr[64];
+     char           *response = NULL;
+     unsigned        resplen = 0;
+-    int result;
++    int result = SASL_OK;
+ 
+     switch (ctext->protection) {
+     case DIGEST_PRIVACY:
+@@ -2892,13 +2959,16 @@
+ 			   &text->response_value);
+     
+     
+-    resplen = strlen(oparams->authid) + strlen("username") + 5;
+-    result =_plug_buf_alloc(params->utils, &(text->out_buf),
+-			    &(text->out_buf_len),
+-			    resplen);
+-    if (result != SASL_OK) goto FreeAllocatedMem;
+-    
+-    sprintf(text->out_buf, "username=\"%s\"", oparams->authid);
++	resplen = 0;
++	text->out_buf = NULL;
++	text->out_buf_len = 0;
++	if (add_to_challenge(params->utils,
++					&text->out_buf, &text->out_buf_len, &resplen,
++					"username", (unsigned char *) oparams->authid,
++					TRUE) != SASL_OK) {
++		result = SASL_FAIL;
++		goto FreeAllocatedMem;
++	}
+     
+     if (add_to_challenge(params->utils,
+ 			 &text->out_buf, &text->out_buf_len, &resplen,
+@@ -3733,7 +3803,7 @@
+ 	    if (strcmp(text->response_value, value) != 0) {
+ 		params->utils->seterror(params->utils->conn, 0,
+ 					"DIGEST-MD5: This server wants us to believe that he knows shared secret");
+-		result = SASL_FAIL;
++		result = SASL_BADSERV;
+ 	    } else {
+ 		oparams->doneflag = 1;
+ 		oparams->param_version = 0;
diff --git a/dev-libs/cyrus-sasl/files/cyrus-sasl-2.1.18-sasl-path-fix.patch b/dev-libs/cyrus-sasl/files/cyrus-sasl-2.1.18-sasl-path-fix.patch
new file mode 100644
index 000000000000..125068083f57
--- /dev/null
+++ b/dev-libs/cyrus-sasl/files/cyrus-sasl-2.1.18-sasl-path-fix.patch
@@ -0,0 +1,18 @@
+diff -Naur cyrus-sasl-2.1.18-orig/lib/common.c cyrus-sasl-2.1.18/lib/common.c
+--- cyrus-sasl-2.1.18-orig/lib/common.c	2004-03-10 10:51:35.000000000 -0500
++++ cyrus-sasl-2.1.18/lib/common.c	2004-07-06 22:34:22.335040502 -0400
+@@ -1794,9 +1794,11 @@
+   if (! path)
+     return SASL_BADPARAM;
+ 
+-  *path = getenv(SASL_PATH_ENV_VAR);
+-  if (! *path)
+-    *path = PLUGINDIR;
++  if (getuid() != geteuid() || getgid() != getegid()) {
++	  *path = getenv(SASL_PATH_ENV_VAR);
++	  if (! *path)
++	    *path = PLUGINDIR;
++  }
+ 
+   return SASL_OK;
+ }
diff --git a/dev-libs/cyrus-sasl/files/digest-cyrus-sasl-2.1.18-r1 b/dev-libs/cyrus-sasl/files/digest-cyrus-sasl-2.1.18-r1
new file mode 100644
index 000000000000..2993b6dbb3ed
--- /dev/null
+++ b/dev-libs/cyrus-sasl/files/digest-cyrus-sasl-2.1.18-r1
@@ -0,0 +1 @@
+MD5 1eafae95f0289c10f187d8b2bc4032cf cyrus-sasl-2.1.18.tar.gz 1522578