Revision bump, security bug #355583.

(Portage version: 2.2.0_alpha25/cvs/Linux x86_64)

3 files changed, 276 insertions, 1 deletions

diff --git a/net-dns/avahi/ChangeLog b/net-dns/avahi/ChangeLog
index c278e92fb952..ecc404b1c04b 100644
--- a/net-dns/avahi/ChangeLog
+++ b/net-dns/avahi/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for net-dns/avahi
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-dns/avahi/ChangeLog,v 1.192 2011/01/23 20:24:45 swegener Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-dns/avahi/ChangeLog,v 1.193 2011/02/27 01:24:33 swegener Exp $
+
+*avahi-0.6.28-r1 (27 Feb 2011)
+
+  27 Feb 2011; Sven Wegener <swegener@gentoo.org> +avahi-0.6.28-r1.ebuild,
+  +files/avahi-0.6.28-CVE-2011-1002.patch:
+  Revision bump, security bug #355583.
 
   23 Jan 2011; Sven Wegener <swegener@gentoo.org> avahi-0.6.28.ebuild,
   +files/netlink-request-all-matches-when-requesting-interface.patch:
diff --git a/net-dns/avahi/avahi-0.6.28-r1.ebuild b/net-dns/avahi/avahi-0.6.28-r1.ebuild
new file mode 100644
index 000000000000..6d8ec3b4e6f5
--- /dev/null
+++ b/net-dns/avahi/avahi-0.6.28-r1.ebuild
@@ -0,0 +1,201 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-dns/avahi/avahi-0.6.28-r1.ebuild,v 1.1 2011/02/27 01:24:33 swegener Exp $
+
+EAPI="3"
+
+PYTHON_DEPEND="python? 2"
+PYTHON_USE_WITH="gdbm"
+PYTHON_USE_WITH_OPT="python"
+
+inherit eutils mono python multilib flag-o-matic
+
+DESCRIPTION="System which facilitates service discovery on a local network"
+HOMEPAGE="http://avahi.org/"
+SRC_URI="http://avahi.org/download/${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd"
+IUSE="autoipd bookmarks dbus doc gdbm gtk howl-compat ipv6 kernel_linux mdnsresponder-compat mono python qt4 test "
+
+DBUS_DEPEND=">=sys-apps/dbus-0.30"
+RDEPEND=">=dev-libs/libdaemon-0.14
+	dev-libs/expat
+	>=dev-libs/glib-2
+	gdbm? ( sys-libs/gdbm )
+	qt4? ( x11-libs/qt-core:4 )
+	gtk? (
+		>=x11-libs/gtk+-2.14.0:2
+	)
+	dbus? (
+		${DBUS_DEPEND}
+		python? ( dev-python/dbus-python )
+	)
+	mono? (
+		>=dev-lang/mono-1.1.10
+		gtk? ( >=dev-dotnet/gtk-sharp-2 )
+	)
+	howl-compat? (
+		!net-misc/howl
+		${DBUS_DEPEND}
+	)
+	mdnsresponder-compat? (
+		!net-misc/mDNSResponder
+		${DBUS_DEPEND}
+	)
+	python? (
+		gtk? ( >=dev-python/pygtk-2 )
+	)
+	bookmarks? (
+		dev-python/twisted
+		dev-python/twisted-web
+	)
+	kernel_linux? ( sys-libs/libcap )"
+DEPEND="${RDEPEND}
+	>=dev-util/intltool-0.40.5
+	>=dev-util/pkgconfig-0.9.0
+	doc? (
+		app-doc/doxygen
+		mono? ( >=virtual/monodoc-1.1.8 )
+	)"
+
+pkg_setup() {
+	if use python; then
+		python_set_active_version 2
+		python_pkg_setup
+	fi
+
+	if use python && ! use dbus && ! use gtk; then
+		ewarn "For proper python support you should also enable the dbus and gtk USE flags!"
+	fi
+}
+
+pkg_preinst() {
+	enewgroup netdev
+	enewgroup avahi
+	enewuser avahi -1 -1 -1 avahi
+
+	if use autoipd; then
+		enewgroup avahi-autoipd
+		enewuser avahi-autoipd -1 -1 -1 avahi-autoipd
+	fi
+}
+
+src_prepare() {
+	if use ipv6; then
+		sed -i \
+			-e s/use-ipv6=no/use-ipv6=yes/ \
+			avahi-daemon/avahi-daemon.conf || die
+	fi
+
+	sed -i\
+		-e "s:\\.\\./\\.\\./\\.\\./doc/avahi-docs/html/:../../../doc/${PF}/html/:" \
+		doxygen_to_devhelp.xsl || die
+
+	epatch "${FILESDIR}"/netlink-request-all-matches-when-requesting-interface.patch
+	epatch "${FILESDIR}"/${P}-CVE-2011-1002.patch
+}
+
+src_configure() {
+	use sh && replace-flags -O? -O0
+
+	local myconf=""
+
+	if use python; then
+		myconf+="
+			$(use_enable dbus python-dbus)
+			$(use_enable gtk pygtk)
+		"
+	fi
+
+	if use mono; then
+		myconf+=" $(use_enable doc monodoc)"
+	fi
+
+	# these require dbus enabled
+	if use mdnsresponder-compat || use howl-compat || use mono; then
+		myconf+=" --enable-dbus"
+	fi
+
+	# We need to unset DISPLAY, else the configure script might have problems detecting the pygtk module
+	unset DISPLAY
+
+	# Upstream ships a gir file (AvahiCore.gir) which does not work with
+	# >=gobject-introspection-0.9, so we disable introspection for now.
+	# http://avahi.org/ticket/318
+	econf \
+		--localstatedir=/var \
+		--with-distro=gentoo \
+		--disable-python-dbus \
+		--disable-pygtk \
+		--disable-xmltoman \
+		--disable-monodoc \
+		--disable-introspection \
+		--enable-glib \
+		$(use_enable test tests) \
+		$(use_enable autoipd) \
+		$(use_enable mdnsresponder-compat compat-libdns_sd) \
+		$(use_enable howl-compat compat-howl) \
+		$(use_enable doc doxygen-doc) \
+		$(use_enable mono) \
+		$(use_enable dbus) \
+		$(use_enable python) \
+		--disable-gtk3 \
+		$(use_enable gtk) \
+		--disable-qt3 \
+		$(use_enable qt4) \
+		$(use_enable gdbm) \
+		${myconf}
+}
+
+src_compile() {
+	emake || die "emake failed"
+
+	use doc && { emake avahi.devhelp || die ; }
+}
+
+src_install() {
+	emake install py_compile=true DESTDIR="${D}" || die "make install failed"
+	use bookmarks && use python && use dbus && use gtk || \
+		rm -f "${D}"/usr/bin/avahi-bookmarks
+
+	use howl-compat && ln -s avahi-compat-howl.pc "${D}"/usr/$(get_libdir)/pkgconfig/howl.pc
+	use mdnsresponder-compat && ln -s avahi-compat-libdns_sd/dns_sd.h "${D}"/usr/include/dns_sd.h
+
+	if use autoipd; then
+		insinto /$(get_libdir)/rcscripts/net
+		doins "${FILESDIR}"/autoipd.sh || die
+
+		insinto /$(get_libdir)/rc/net
+		newins "${FILESDIR}"/autoipd-openrc.sh autoipd.sh || die
+	fi
+
+	dodoc docs/{AUTHORS,NEWS,README,TODO} || die
+
+	if use doc; then
+		dohtml -r doxygen/html/. || die
+		insinto /usr/share/devhelp/books/avahi
+		doins avahi.devhelp || die
+	fi
+}
+
+pkg_postrm() {
+	use python && python_mod_cleanup avahi avahi_discover
+}
+
+pkg_postinst() {
+	use python && python_mod_optimize avahi avahi_discover
+
+	if use autoipd; then
+		echo
+		elog "To use avahi-autoipd to configure your interfaces with IPv4LL (RFC3927)"
+		elog "addresses, just set config_<interface>=( autoipd ) in /etc/conf.d/net!"
+	fi
+
+	if use dbus; then
+		echo
+		elog "If this is your first install of avahi please reload your dbus config"
+		elog "with /etc/init.d/dbus reload before starting avahi-daemon!"
+	fi
+}
diff --git a/net-dns/avahi/files/avahi-0.6.28-CVE-2011-1002.patch b/net-dns/avahi/files/avahi-0.6.28-CVE-2011-1002.patch
new file mode 100644
index 000000000000..9d80477c2af1
--- /dev/null
+++ b/net-dns/avahi/files/avahi-0.6.28-CVE-2011-1002.patch
@@ -0,0 +1,68 @@
+From: Vincent Untz <vuntz@opensuse.org>
+Date: Fri, 18 Feb 2011 22:37:00 +0000 (+0100)
+Subject: socket: Still read corrupt packets from the sockets
+X-Git-Url: http://git.0pointer.de/?p=avahi.git;a=commitdiff_plain;h=46109dfec75534fe270c0ab902576f685d5ab3a6
+
+socket: Still read corrupt packets from the sockets
+
+Else, we end up with an infinite loop with 100% CPU.
+
+http://www.avahi.org/ticket/325
+https://bugzilla.redhat.com/show_bug.cgi?id=667187
+---
+
+diff --git a/avahi-core/socket.c b/avahi-core/socket.c
+index be62105..e69ec7d 100644
+--- a/avahi-core/socket.c
++++ b/avahi-core/socket.c
+@@ -653,10 +653,6 @@ AvahiDnsPacket *avahi_recv_dns_packet_ipv4(
+         goto fail;
+     }
+ 
+-    /* For corrupt packets FIONREAD returns zero size (See rhbz #607297) */
+-    if (!ms)
+-        goto fail;
+-
+     p = avahi_dns_packet_new(ms + AVAHI_DNS_PACKET_EXTRA_SIZE);
+ 
+     io.iov_base = AVAHI_DNS_PACKET_DATA(p);
+@@ -683,10 +679,14 @@ AvahiDnsPacket *avahi_recv_dns_packet_ipv4(
+         goto fail;
+     }
+ 
+-    if (sa.sin_addr.s_addr == INADDR_ANY) {
++    /* For corrupt packets FIONREAD returns zero size (See rhbz #607297). So
++     * fail after having read them. */
++    if (!ms)
++        goto fail;
++
++    if (sa.sin_addr.s_addr == INADDR_ANY)
+         /* Linux 2.4 behaves very strangely sometimes! */
+         goto fail;
+-    }
+ 
+     assert(!(msg.msg_flags & MSG_CTRUNC));
+     assert(!(msg.msg_flags & MSG_TRUNC));
+@@ -810,10 +810,6 @@ AvahiDnsPacket *avahi_recv_dns_packet_ipv6(
+         goto fail;
+     }
+ 
+-    /* For corrupt packets FIONREAD returns zero size (See rhbz #607297) */
+-    if (!ms)
+-        goto fail;
+-
+     p = avahi_dns_packet_new(ms + AVAHI_DNS_PACKET_EXTRA_SIZE);
+ 
+     io.iov_base = AVAHI_DNS_PACKET_DATA(p);
+@@ -841,6 +837,11 @@ AvahiDnsPacket *avahi_recv_dns_packet_ipv6(
+         goto fail;
+     }
+ 
++    /* For corrupt packets FIONREAD returns zero size (See rhbz #607297). So
++     * fail after having read them. */
++    if (!ms)
++        goto fail;
++
+     assert(!(msg.msg_flags & MSG_CTRUNC));
+     assert(!(msg.msg_flags & MSG_TRUNC));
+