Fix for security bug #161632 and bug #161750

(Portage version: 2.1.2_rc4-r8)

4 files changed, 254 insertions, 2 deletions

diff --git a/net-analyzer/snort/ChangeLog b/net-analyzer/snort/ChangeLog
index 9ae8abbc7fd3..9cf4cfc83993 100644
--- a/net-analyzer/snort/ChangeLog
+++ b/net-analyzer/snort/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for net-analyzer/snort
-# Copyright 2002-2006 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/ChangeLog,v 1.111 2006/11/25 18:18:20 cedk Exp $
+# Copyright 2002-2007 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/ChangeLog,v 1.112 2007/01/17 01:40:46 jokey Exp $
+
+*snort-2.6.1.2 (17 Jan 2007)
+
+  17 Jan 2007; Markus Ullmann <jokey@gentoo.org>
+  +files/snort-2.6.1.1-gre.patch, -snort-2.6.0.ebuild,
+  -snort-2.6.1.1.ebuild, +snort-2.6.1.2.ebuild:
+  Fix for security bug #161632 and bug #161750
 
   25 Nov 2006; Cedric Krier <cedk@gentoo.org> snort-2.4.5.ebuild:
   Fix bug #149496
diff --git a/net-analyzer/snort/files/digest-snort-2.6.1.2 b/net-analyzer/snort/files/digest-snort-2.6.1.2
new file mode 100644
index 000000000000..1ab41e7196dd
--- /dev/null
+++ b/net-analyzer/snort/files/digest-snort-2.6.1.2
@@ -0,0 +1,12 @@
+MD5 52c0c6bc60d7123cb048e562d25bc34a Community-Rules-2.4.tar.gz 110044
+RMD160 ecfb4444cb0152545d823692eb6e5e2347151b54 Community-Rules-2.4.tar.gz 110044
+SHA256 4c82f90c960626aae5804c2375540f2d7241524c31ae3c7ab69df6c46e295c4c Community-Rules-2.4.tar.gz 110044
+MD5 22c448e25538cdf74c62abe586aeac0a snort-2.6.1.2.tar.gz 3511538
+RMD160 bd0ce3a4629a6e594a5f24723254e85d36597d04 snort-2.6.1.2.tar.gz 3511538
+SHA256 ca8bf1b1aa2fe23c9e8f8cb23482da123aac4b5842950b3cc2a40ba13da96b51 snort-2.6.1.2.tar.gz 3511538
+MD5 35d9a2486f8c0280bb493aa03c011927 snortrules-pr-2.4.tar.gz 789097
+RMD160 dd2179b3ce8a55699d2e1b857426e5489191a121 snortrules-pr-2.4.tar.gz 789097
+SHA256 19d2545a2a150dff8b4dbcbd0def389b6865c4c70f5084172d08a7b151e1a504 snortrules-pr-2.4.tar.gz 789097
+MD5 2eeef1a7a040d67c3afaf9d749905e47 snortsam-20050110.tar.gz 29395
+RMD160 ec80ce024ed7a013da35444ef1098ba3faa6cfc3 snortsam-20050110.tar.gz 29395
+SHA256 dc428458f3c47684aabb89036ca7e601a6aa92864dbf23b31f33732b76c2a01e snortsam-20050110.tar.gz 29395
diff --git a/net-analyzer/snort/files/snort-2.6.1.1-gre.patch b/net-analyzer/snort/files/snort-2.6.1.1-gre.patch
new file mode 100644
index 000000000000..cc1f7a239e7e
--- /dev/null
+++ b/net-analyzer/snort/files/snort-2.6.1.1-gre.patch
@@ -0,0 +1,46 @@
+diff -uNr -r 2.6.1.1-orig/src/decode.c 2.6.1.1/src/decode.c
+--- 2.6.1.1-orig/src/decode.c	2006-10-13 19:40:41.000000000 +0200
++++ 2.6.1.1/src/decode.c	2007-01-14 00:35:03.000000000 +0100
+@@ -2346,7 +2346,13 @@
+      * since p->iph will be pointing to this inner IP
+      */
+     if (p->greh != NULL)
++    {
+         p->ip_options_data = NULL;
++        p->ip_options_len = 0;
++        memset(&(p->ip_options[0]), 0, sizeof(p->ip_options));
++        p->ip_lastopt_bad = 0;
++    }
++
+ #endif
+ 
+         p->ip_option_count = 0;
+@@ -2642,7 +2648,7 @@
+     u_int16_t uhlen;
+     struct pseudoheader ph;
+ 
+-    if(len < sizeof(UDPHdr))
++    if(len < GRE_HEADER_LEN)
+     {
+         if(pv.verbose_flag)
+         {
+@@ -3566,9 +3572,7 @@
+         }
+     }
+ 
+-    payload_len = len - hlen;
+-
+-    if (payload_len < 0)
++    if (hlen > len)
+     {
+         if(pv.verbose_flag)
+             ErrorMessage("GRE header length > rest of packet length");
+@@ -3589,6 +3593,8 @@
+         return;
+     }
+ 
++    payload_len = len - hlen;
++
+     /* send to next protocol decoder */
+     /* As described in RFC 2784 the possible protocols are listed in
+      * RFC 1700 under "ETHER TYPES"
diff --git a/net-analyzer/snort/snort-2.6.1.2.ebuild b/net-analyzer/snort/snort-2.6.1.2.ebuild
new file mode 100644
index 000000000000..28651559a441
--- /dev/null
+++ b/net-analyzer/snort/snort-2.6.1.2.ebuild
@@ -0,0 +1,187 @@
+# Copyright 1999-2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/snort-2.6.1.2.ebuild,v 1.1 2007/01/17 01:40:46 jokey Exp $
+
+WANT_AUTOCONF="latest"
+WANT_AUTOMAKE="latest"
+inherit eutils autotools
+
+DESCRIPTION="Libpcap-based packet sniffer/logger/lightweight IDS"
+HOMEPAGE="http://www.snort.org/"
+SRC_URI="http://www.snort.org/dl/current/${P}.tar.gz
+	http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-2.4.tar.gz
+	http://www.snort.org/pub-bin/downloads.cgi/Download/vrt_pr/snortrules-pr-2.4.tar.gz
+	snortsam? ( mirror://gentoo/snortsam-20050110.tar.gz )"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~ppc ~ppc64 -sparc ~x86"
+IUSE="postgres mysql flexresp selinux snortsam odbc prelude inline dynamicplugin
+timestats perfprofiling linux-smp-stats flexresp2 react sguil gre"
+
+DEPEND="virtual/libc
+	>=dev-libs/libpcre-4.2-r1
+	virtual/libpcap
+	flexresp? ( ~net-libs/libnet-1.0.2a )
+	flexresp2? ( dev-libs/libdnet )
+	react? ( ~net-libs/libnet-1.0.2a )
+	postgres? ( || ( dev-db/postgresql dev-db/libpq ) )
+	mysql? ( virtual/mysql )
+	prelude? ( >=dev-libs/libprelude-0.9.0 )
+	odbc? ( dev-db/unixODBC )
+	>=sys-devel/libtool-1.4
+	inline? (
+		~net-libs/libnet-1.0.2a
+		net-firewall/iptables
+		)"
+
+RDEPEND="${DEPEND}
+	dev-lang/perl
+	selinux? ( sec-policy/selinux-snort )
+	snortsam? ( net-analyzer/snortsam )"
+
+pkg_setup() {
+	enewgroup snort
+	enewuser snort -1 -1 /dev/null snort
+
+	if use flexresp && use flexresp2 ; then
+		ewarn
+		ewarn "You have both the 'flexresp' and 'flexresp2' USE"
+		ewarn "flags set. You can use 'flexresp' or 'flexresp2'"
+		ewarn "but not both."
+		ewarn
+		ewarn "Defaulting to flexresp2..."
+	fi
+}
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+
+	epatch "${FILESDIR}/${PN}-2.6.1.1-libnet.patch"
+	use gre && epatch "${FILESDIR}/${PN}-2.6.1.1-gre.patch"
+
+	sed -i "s:var RULE_PATH ../rules:var RULE_PATH /etc/snort/rules:" \
+		etc/snort.conf
+
+	if use prelude ; then
+		sed -i -e "s:AC_PROG_RANLIB:AC_PROG_LIBTOOL:" configure.in
+	fi
+
+	if use snortsam ; then
+		cd ..
+		einfo "Applying snortsam patch"
+		sed -i "s/PLUGIN_FWSAM/PLUGIN_FWSAM,/" snortpatch9 || die "sed failed"
+		./patchsnort.sh "${S}" || die "snortsam patch failed"
+		cd "${S}"
+	fi
+
+	einfo "Regenerating autoconf/automake files"
+	AT_M4DIR=m4 eautoreconf
+}
+
+src_compile() {
+	local myconf
+
+	if use flexresp2; then
+		myconf="${myconf} --enable-flexresp2"
+	elif use flexresp; then
+		myconf="${myconf} --enable-flexresp"
+	fi
+
+	if use react && ! use flexresp; then
+		myconf="${myconf} --enable-react"
+	fi
+
+	use gre && --enable-gre
+
+	myconf="${myconf} --with-libipq-includes=/usr/include/libipq"
+
+	econf \
+		--without-oracle \
+		$(use_with postgres postgresql) \
+		$(use_with mysql) \
+		$(use_with odbc) \
+		$(use_enable prelude) \
+		$(use_enable inline) \
+		$(use_enable dynamicplugin) \
+		$(use_enable timestats) \
+		$(use_enable perfprofiling) \
+		$(use_enable linux-smp-stats) \
+		${myconf} || die "econf failed"
+
+	# limit to single as reported by jforman on irc
+	emake -j1 || die "emake failed"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die "make install failed"
+
+	keepdir /var/log/snort/
+
+	dodoc doc/*
+	dodoc ./RELEASE.NOTES
+	docinto schemas ; dodoc schemas/*
+
+	insinto /etc/snort
+	doins etc/reference.config etc/classification.config \
+		etc/*.map etc/threshold.conf
+	newins etc/snort.conf snort.conf
+
+	newinitd "${FILESDIR}/snort.rc8" snort
+	newconfd "${FILESDIR}/snort.confd" snort
+
+	fowners snort:snort /var/log/snort
+	fperms 0770 /var/log/snort
+
+	# install rules
+	insinto /etc/snort/rules
+	doins -r "${WORKDIR}"/rules/*
+}
+
+pkg_postinst() {
+	ewarn
+	ewarn "Users upgrading from snort 2.4.x should take care when updating"
+	ewarn "their snort.conf. A number of significant changes have been"
+	ewarn "have been added to snort 2.6 including the addition of"
+	ewarn "dynamically loadable preprocessors, detection engine and rules."
+	ewarn "Snort 2.6 also includes the addition of performance profiling"
+	ewarn "for rules & preprocessors and uses a new default pattern matcher"
+	ewarn "which provides faster matching at the expense of being very"
+	ewarn "memory intensive."
+	ewarn
+	ewarn "If you find that snort is using too much memory, your system"
+	ewarn "freezes, or snort crashes after a few minutes try adding the"
+	ewarn "following to your snort.conf..."
+	ewarn
+	ewarn "'config detection: search-method ac-sparsebands'"
+	ewarn
+	ewarn "This will provide high pattern matching performance at a much"
+	ewarn "lower cost to memory. For more information on the new features"
+	ewarn "in snort 2.6, please take a look at the release notes located in..."
+	ewarn
+	ewarn "  /usr/share/doc/${PF}/RELEASE.NOTES.gz"
+	ewarn
+	einfo "To use a database as a backend for snort you will have to"
+	einfo "import the correct tables to the database."
+	einfo "You will have to setup a database called snort before doing the"
+	einfo "following..."
+	einfo
+	einfo "  MySQL: zcat /usr/share/doc/${PF}/schemas/create_mysql.gz | mysql -p snort"
+	einfo
+	einfo "  PostgreSQL: import /usr/share/doc/${PF}/schemas/create_postgresql.gz"
+	einfo
+	einfo "  ODBC: look at /usr/share/doc/${PF}/schemas/"
+	einfo
+	einfo "Users using the unified output plugin and barnyard do not need to"
+	einfo "compile database support into snort, but still need to set up their"
+	einfo "database as shown above."
+	einfo
+	ewarn "Only a basic set of rules was installed."
+	ewarn "Please add your other sets of rules to /etc/snort/rules."
+	ewarn "For more information on rules, visit ${HOMEPAGE}."
+	if use sguil ; then
+		elog "SGUIL needs to catch up with snort 2.6.x. If you plan on using SGUIL"
+		elog "you should unmerge ${P} and emerge snort-2.4.x"
+	fi
+}