From da3d2226b0e1dd84f4257307889a45b60d029b8a Mon Sep 17 00:00:00 2001 From: Markus Ullmann Date: Wed, 17 Jan 2007 01:40:46 +0000 Subject: Fix for security bug #161632 and bug #161750 (Portage version: 2.1.2_rc4-r8) --- net-analyzer/snort/ChangeLog | 11 +- net-analyzer/snort/files/digest-snort-2.6.1.2 | 12 ++ net-analyzer/snort/files/snort-2.6.1.1-gre.patch | 46 ++++++ net-analyzer/snort/snort-2.6.1.2.ebuild | 187 +++++++++++++++++++++++ 4 files changed, 254 insertions(+), 2 deletions(-) create mode 100644 net-analyzer/snort/files/digest-snort-2.6.1.2 create mode 100644 net-analyzer/snort/files/snort-2.6.1.1-gre.patch create mode 100644 net-analyzer/snort/snort-2.6.1.2.ebuild (limited to 'net-analyzer') diff --git a/net-analyzer/snort/ChangeLog b/net-analyzer/snort/ChangeLog index 9ae8abbc7fd3..9cf4cfc83993 100644 --- a/net-analyzer/snort/ChangeLog +++ b/net-analyzer/snort/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for net-analyzer/snort -# Copyright 2002-2006 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/ChangeLog,v 1.111 2006/11/25 18:18:20 cedk Exp $ +# Copyright 2002-2007 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/ChangeLog,v 1.112 2007/01/17 01:40:46 jokey Exp $ + +*snort-2.6.1.2 (17 Jan 2007) + + 17 Jan 2007; Markus Ullmann + +files/snort-2.6.1.1-gre.patch, -snort-2.6.0.ebuild, + -snort-2.6.1.1.ebuild, +snort-2.6.1.2.ebuild: + Fix for security bug #161632 and bug #161750 25 Nov 2006; Cedric Krier snort-2.4.5.ebuild: Fix bug #149496 diff --git a/net-analyzer/snort/files/digest-snort-2.6.1.2 b/net-analyzer/snort/files/digest-snort-2.6.1.2 new file mode 100644 index 000000000000..1ab41e7196dd --- /dev/null +++ b/net-analyzer/snort/files/digest-snort-2.6.1.2 @@ -0,0 +1,12 @@ +MD5 52c0c6bc60d7123cb048e562d25bc34a Community-Rules-2.4.tar.gz 110044 +RMD160 ecfb4444cb0152545d823692eb6e5e2347151b54 Community-Rules-2.4.tar.gz 110044 +SHA256 4c82f90c960626aae5804c2375540f2d7241524c31ae3c7ab69df6c46e295c4c Community-Rules-2.4.tar.gz 110044 +MD5 22c448e25538cdf74c62abe586aeac0a snort-2.6.1.2.tar.gz 3511538 +RMD160 bd0ce3a4629a6e594a5f24723254e85d36597d04 snort-2.6.1.2.tar.gz 3511538 +SHA256 ca8bf1b1aa2fe23c9e8f8cb23482da123aac4b5842950b3cc2a40ba13da96b51 snort-2.6.1.2.tar.gz 3511538 +MD5 35d9a2486f8c0280bb493aa03c011927 snortrules-pr-2.4.tar.gz 789097 +RMD160 dd2179b3ce8a55699d2e1b857426e5489191a121 snortrules-pr-2.4.tar.gz 789097 +SHA256 19d2545a2a150dff8b4dbcbd0def389b6865c4c70f5084172d08a7b151e1a504 snortrules-pr-2.4.tar.gz 789097 +MD5 2eeef1a7a040d67c3afaf9d749905e47 snortsam-20050110.tar.gz 29395 +RMD160 ec80ce024ed7a013da35444ef1098ba3faa6cfc3 snortsam-20050110.tar.gz 29395 +SHA256 dc428458f3c47684aabb89036ca7e601a6aa92864dbf23b31f33732b76c2a01e snortsam-20050110.tar.gz 29395 diff --git a/net-analyzer/snort/files/snort-2.6.1.1-gre.patch b/net-analyzer/snort/files/snort-2.6.1.1-gre.patch new file mode 100644 index 000000000000..cc1f7a239e7e --- /dev/null +++ b/net-analyzer/snort/files/snort-2.6.1.1-gre.patch @@ -0,0 +1,46 @@ +diff -uNr -r 2.6.1.1-orig/src/decode.c 2.6.1.1/src/decode.c +--- 2.6.1.1-orig/src/decode.c 2006-10-13 19:40:41.000000000 +0200 ++++ 2.6.1.1/src/decode.c 2007-01-14 00:35:03.000000000 +0100 +@@ -2346,7 +2346,13 @@ + * since p->iph will be pointing to this inner IP + */ + if (p->greh != NULL) ++ { + p->ip_options_data = NULL; ++ p->ip_options_len = 0; ++ memset(&(p->ip_options[0]), 0, sizeof(p->ip_options)); ++ p->ip_lastopt_bad = 0; ++ } ++ + #endif + + p->ip_option_count = 0; +@@ -2642,7 +2648,7 @@ + u_int16_t uhlen; + struct pseudoheader ph; + +- if(len < sizeof(UDPHdr)) ++ if(len < GRE_HEADER_LEN) + { + if(pv.verbose_flag) + { +@@ -3566,9 +3572,7 @@ + } + } + +- payload_len = len - hlen; +- +- if (payload_len < 0) ++ if (hlen > len) + { + if(pv.verbose_flag) + ErrorMessage("GRE header length > rest of packet length"); +@@ -3589,6 +3593,8 @@ + return; + } + ++ payload_len = len - hlen; ++ + /* send to next protocol decoder */ + /* As described in RFC 2784 the possible protocols are listed in + * RFC 1700 under "ETHER TYPES" diff --git a/net-analyzer/snort/snort-2.6.1.2.ebuild b/net-analyzer/snort/snort-2.6.1.2.ebuild new file mode 100644 index 000000000000..28651559a441 --- /dev/null +++ b/net-analyzer/snort/snort-2.6.1.2.ebuild @@ -0,0 +1,187 @@ +# Copyright 1999-2007 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/snort-2.6.1.2.ebuild,v 1.1 2007/01/17 01:40:46 jokey Exp $ + +WANT_AUTOCONF="latest" +WANT_AUTOMAKE="latest" +inherit eutils autotools + +DESCRIPTION="Libpcap-based packet sniffer/logger/lightweight IDS" +HOMEPAGE="http://www.snort.org/" +SRC_URI="http://www.snort.org/dl/current/${P}.tar.gz + http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-2.4.tar.gz + http://www.snort.org/pub-bin/downloads.cgi/Download/vrt_pr/snortrules-pr-2.4.tar.gz + snortsam? ( mirror://gentoo/snortsam-20050110.tar.gz )" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~ppc ~ppc64 -sparc ~x86" +IUSE="postgres mysql flexresp selinux snortsam odbc prelude inline dynamicplugin +timestats perfprofiling linux-smp-stats flexresp2 react sguil gre" + +DEPEND="virtual/libc + >=dev-libs/libpcre-4.2-r1 + virtual/libpcap + flexresp? ( ~net-libs/libnet-1.0.2a ) + flexresp2? ( dev-libs/libdnet ) + react? ( ~net-libs/libnet-1.0.2a ) + postgres? ( || ( dev-db/postgresql dev-db/libpq ) ) + mysql? ( virtual/mysql ) + prelude? ( >=dev-libs/libprelude-0.9.0 ) + odbc? ( dev-db/unixODBC ) + >=sys-devel/libtool-1.4 + inline? ( + ~net-libs/libnet-1.0.2a + net-firewall/iptables + )" + +RDEPEND="${DEPEND} + dev-lang/perl + selinux? ( sec-policy/selinux-snort ) + snortsam? ( net-analyzer/snortsam )" + +pkg_setup() { + enewgroup snort + enewuser snort -1 -1 /dev/null snort + + if use flexresp && use flexresp2 ; then + ewarn + ewarn "You have both the 'flexresp' and 'flexresp2' USE" + ewarn "flags set. You can use 'flexresp' or 'flexresp2'" + ewarn "but not both." + ewarn + ewarn "Defaulting to flexresp2..." + fi +} + +src_unpack() { + unpack ${A} + cd "${S}" + + epatch "${FILESDIR}/${PN}-2.6.1.1-libnet.patch" + use gre && epatch "${FILESDIR}/${PN}-2.6.1.1-gre.patch" + + sed -i "s:var RULE_PATH ../rules:var RULE_PATH /etc/snort/rules:" \ + etc/snort.conf + + if use prelude ; then + sed -i -e "s:AC_PROG_RANLIB:AC_PROG_LIBTOOL:" configure.in + fi + + if use snortsam ; then + cd .. + einfo "Applying snortsam patch" + sed -i "s/PLUGIN_FWSAM/PLUGIN_FWSAM,/" snortpatch9 || die "sed failed" + ./patchsnort.sh "${S}" || die "snortsam patch failed" + cd "${S}" + fi + + einfo "Regenerating autoconf/automake files" + AT_M4DIR=m4 eautoreconf +} + +src_compile() { + local myconf + + if use flexresp2; then + myconf="${myconf} --enable-flexresp2" + elif use flexresp; then + myconf="${myconf} --enable-flexresp" + fi + + if use react && ! use flexresp; then + myconf="${myconf} --enable-react" + fi + + use gre && --enable-gre + + myconf="${myconf} --with-libipq-includes=/usr/include/libipq" + + econf \ + --without-oracle \ + $(use_with postgres postgresql) \ + $(use_with mysql) \ + $(use_with odbc) \ + $(use_enable prelude) \ + $(use_enable inline) \ + $(use_enable dynamicplugin) \ + $(use_enable timestats) \ + $(use_enable perfprofiling) \ + $(use_enable linux-smp-stats) \ + ${myconf} || die "econf failed" + + # limit to single as reported by jforman on irc + emake -j1 || die "emake failed" +} + +src_install() { + emake DESTDIR="${D}" install || die "make install failed" + + keepdir /var/log/snort/ + + dodoc doc/* + dodoc ./RELEASE.NOTES + docinto schemas ; dodoc schemas/* + + insinto /etc/snort + doins etc/reference.config etc/classification.config \ + etc/*.map etc/threshold.conf + newins etc/snort.conf snort.conf + + newinitd "${FILESDIR}/snort.rc8" snort + newconfd "${FILESDIR}/snort.confd" snort + + fowners snort:snort /var/log/snort + fperms 0770 /var/log/snort + + # install rules + insinto /etc/snort/rules + doins -r "${WORKDIR}"/rules/* +} + +pkg_postinst() { + ewarn + ewarn "Users upgrading from snort 2.4.x should take care when updating" + ewarn "their snort.conf. A number of significant changes have been" + ewarn "have been added to snort 2.6 including the addition of" + ewarn "dynamically loadable preprocessors, detection engine and rules." + ewarn "Snort 2.6 also includes the addition of performance profiling" + ewarn "for rules & preprocessors and uses a new default pattern matcher" + ewarn "which provides faster matching at the expense of being very" + ewarn "memory intensive." + ewarn + ewarn "If you find that snort is using too much memory, your system" + ewarn "freezes, or snort crashes after a few minutes try adding the" + ewarn "following to your snort.conf..." + ewarn + ewarn "'config detection: search-method ac-sparsebands'" + ewarn + ewarn "This will provide high pattern matching performance at a much" + ewarn "lower cost to memory. For more information on the new features" + ewarn "in snort 2.6, please take a look at the release notes located in..." + ewarn + ewarn " /usr/share/doc/${PF}/RELEASE.NOTES.gz" + ewarn + einfo "To use a database as a backend for snort you will have to" + einfo "import the correct tables to the database." + einfo "You will have to setup a database called snort before doing the" + einfo "following..." + einfo + einfo " MySQL: zcat /usr/share/doc/${PF}/schemas/create_mysql.gz | mysql -p snort" + einfo + einfo " PostgreSQL: import /usr/share/doc/${PF}/schemas/create_postgresql.gz" + einfo + einfo " ODBC: look at /usr/share/doc/${PF}/schemas/" + einfo + einfo "Users using the unified output plugin and barnyard do not need to" + einfo "compile database support into snort, but still need to set up their" + einfo "database as shown above." + einfo + ewarn "Only a basic set of rules was installed." + ewarn "Please add your other sets of rules to /etc/snort/rules." + ewarn "For more information on rules, visit ${HOMEPAGE}." + if use sguil ; then + elog "SGUIL needs to catch up with snort 2.6.x. If you plan on using SGUIL" + elog "you should unmerge ${P} and emerge snort-2.4.x" + fi +} -- cgit v1.2.3-65-gdbad