net-dialup/openl2tp: fix insecure string operations

Fix possible string overflows found by gcc.
The main problem is that strncpy does not always NULL-terminate string.

Package-Manager: Portage-2.3.99, Repoman-2.3.22
Signed-off-by: Andrew Savchenko <bircoph@gentoo.org>

2 files changed, 243 insertions, 0 deletions

diff --git a/net-dialup/openl2tp/files/openl2tp-1.8-strings.patch b/net-dialup/openl2tp/files/openl2tp-1.8-strings.patch
new file mode 100644
index 000000000000..16b7beffb212
--- /dev/null
+++ b/net-dialup/openl2tp/files/openl2tp-1.8-strings.patch
@@ -0,0 +1,114 @@
+diff '--color=auto' -Naurd openl2tp-1.8.orig/l2tp_plugin.c openl2tp-1.8/l2tp_plugin.c
+--- openl2tp-1.8.orig/l2tp_plugin.c	2008-09-25 19:00:55.000000000 +0400
++++ openl2tp-1.8/l2tp_plugin.c	2020-07-12 11:55:23.292225206 +0300
+@@ -85,16 +85,20 @@
+ 
+ 	if (strchr(name, '/') == 0) {
+ 		const char *base = L2TP_PLUGIN_DIR;
+-		int len = strlen(base) + strlen(name) + 2;
++		size_t len_base, len_name, len;
++		len_base = strlen(base);
++		len_name = strlen(name);
++		len = len_base + len_name + 2;
+ 		path = malloc(len);
+ 		if (path == NULL) {
+ 			l2tp_log(LOG_ERR, "OOM: plugin file path");
+ 			return -ENOMEM;
+ 		}
+ 
+-		strncpy(path, base, len);
+-		strncat(path, "/", len);
+-		strncat(path, name, len);
++		memcpy(path, base, len_base);
++		path[len_base] = '/';
++		memcpy(path + len_base + 1, name, len_name);
++		path[len - 1] = '\0';
+ 	} else {
+ 		path = strdup(name);
+ 		if (path == NULL) {
+diff '--color=auto' -Naurd openl2tp-1.8.orig/plugins/ppp_unix.c openl2tp-1.8/plugins/ppp_unix.c
+--- openl2tp-1.8.orig/plugins/ppp_unix.c	2020-07-12 11:37:06.287914337 +0300
++++ openl2tp-1.8/plugins/ppp_unix.c	2020-07-12 12:31:26.042810957 +0300
+@@ -811,7 +811,7 @@
+ {
+ 	pid_t pid;
+ 	int result = 0;
+-	char str[10];
++	char str[11];
+ 	struct l2tp_session_config const *scfg;
+ 
+ 	pid = usl_pid_safe_fork();
+@@ -1362,7 +1362,8 @@
+ 		tmp_fd = socket(AF_INET, SOCK_DGRAM, 0);
+ 		if (tmp_fd >= 0) {
+ 			memset (&ifr, '\0', sizeof (ifr));
+-			strncpy(ifr.ifr_name, ppp->interface_name, sizeof (ifr.ifr_name));
++			strncpy(ifr.ifr_name, ppp->interface_name, sizeof (ifr.ifr_name) - 1);
++			ifr.ifr_name[sizeof(ifr.ifr_name)-1] = '\0';
+ 			ifr.ifr_mtu = mtu;
+ 
+ 			result = ioctl(tmp_fd, SIOCSIFMTU, (caddr_t) &ifr);
+diff '--color=auto' -Naurd openl2tp-1.8.orig/l2tp_statusfile.c openl2tp-1.8/l2tp_statusfile.c
+--- openl2tp-1.8.orig/l2tp_statusfile.c	2020-07-12 15:58:52.279211936 +0300
++++ openl2tp-1.8/l2tp_statusfile.c	2020-07-12 15:59:07.949273953 +0300
+@@ -48,7 +48,7 @@
+ 
+ static FILE *l2tp_statusfile_file_create(const char *parent, const char *name)
+ {
+-	char filename[256];
++	char filename[257];
+ 	FILE *file;
+ 
+ 	if (name != NULL) {
+@@ -66,7 +66,7 @@
+ static int l2tp_statusfile_file_delete(const char *root, const char *parent, const char *name)
+ {
+ 	int result;
+-	char filename[256];
++	char filename[257];
+ 
+ 	if (root == NULL) {
+ 		if (name != NULL) {
+@@ -102,7 +102,7 @@
+ static int l2tp_statusfile_dir_create(const char *parent, const char *name)
+ {
+ 	int result;
+-	char dirname[256];
++	char dirname[257];
+ 
+ 	if (name != NULL) {
+ 		sprintf(dirname, L2TP_STATUSFILE_DIR "/%s/%s", parent, name);
+@@ -127,8 +127,8 @@
+ static int l2tp_statusfile_dir_delete(const char *root, const char *parent, const char *name, int recursive)
+ {
+ 	int result;
+-	char dirname[256];
+-	char filename[256];
++	char dirname[257];
++	char filename[257];
+ 	DIR *dir;
+ 	struct dirent *entry;
+ 	struct stat statbuf;
+diff '--color=auto' -Naurd openl2tp-1.8.orig/l2tp_config.c openl2tp-1.8/l2tp_config.c
+--- openl2tp-1.8.orig/l2tp_config.c	2020-07-12 16:03:00.062192426 +0300
++++ openl2tp-1.8/l2tp_config.c	2020-07-12 16:07:00.035142012 +0300
+@@ -135,7 +135,8 @@
+ 		goto out;
+ 	}
+ 	if (strcmp(server_name, &server[0])) {
+-		strncpy(&server[0], server_name, sizeof(server));
++		strncpy(&server[0], server_name, sizeof(server) - 1);
++		server[sizeof(server) - 1] = '\0';
+ 
+ 		clnt_destroy(cl);
+ 		cl = clnt_create(server, L2TP_PROG, L2TP_VERSION, opt_rpc_protocol);
+@@ -6629,7 +6630,8 @@
+ 		arg++;
+ 		break;
+ 	case 'R':
+-		strncpy(server, optarg, sizeof(server));
++		strncpy(server, optarg, sizeof(server) - 1);
++		server[sizeof(server) - 1] = '\0';
+ 		arg += 2;
+ 		l2tp_set_prompt(server);
+ 		break;
diff --git a/net-dialup/openl2tp/openl2tp-1.8-r2.ebuild b/net-dialup/openl2tp/openl2tp-1.8-r2.ebuild
new file mode 100644
index 000000000000..31d207b45529
--- /dev/null
+++ b/net-dialup/openl2tp/openl2tp-1.8-r2.ebuild
@@ -0,0 +1,129 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit linux-info
+
+DESCRIPTION="Userspace tools for kernel L2TP implementation"
+HOMEPAGE="https://sourceforge.net/projects/openl2tp/"
+SRC_URI="mirror://sourceforge/openl2tp/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="+client debug dmalloc doc +examples rpc server stats"
+
+REQUIRED_USE="|| ( client server )"
+
+BDEPEND="
+	>=net-libs/rpcsvc-proto-1.3.1-r1
+	sys-devel/bison
+	sys-devel/flex
+"
+DEPEND="
+	>=net-dialup/ppp-2.4.5
+	>=net-libs/libtirpc-1.0.3
+	sys-libs/readline:=
+	dmalloc? ( dev-libs/dmalloc )
+"
+RDEPEND="${DEPEND}
+	rpc? ( net-nds/rpcbind )
+"
+
+CONFIG_CHECK="~PPPOL2TP"
+
+PATCHES=(
+	"${FILESDIR}/${P}-werror.patch"
+	"${FILESDIR}/${P}-ldflags.patch"
+	"${FILESDIR}/${P}-pppd-2.patch"
+	"${FILESDIR}/${P}-man.patch"
+	"${FILESDIR}/${P}-l2tpconfig.patch"
+	"${FILESDIR}/${P}-parallelbuild.patch"
+	"${FILESDIR}/${P}-optionsfile.patch"
+	"${FILESDIR}/${P}-clientip_as_ipparam.patch"
+	"${FILESDIR}/${P}-setkey.patch"
+	"${FILESDIR}/${P}-unused-var.patch"
+	"${FILESDIR}/${P}-configure-Makefile.patch"
+	"${FILESDIR}/${P}-cflags.patch"
+	"${FILESDIR}/${P}-tirpc.patch"
+	"${FILESDIR}/${P}-native-tc.patch"
+	"${FILESDIR}/${P}-musl.patch"
+	"${FILESDIR}/${P}-strings.patch"
+)
+
+src_prepare() {
+	default
+	sed -i 's/CFLAGS.optimize/CFLAGS_optimize/g' Makefile */Makefile || die "Makefile sed failed"
+}
+
+src_configure() {
+	myconf=
+
+	use client	|| myconf+=" L2TP_FEATURE_LAC_SUPPORT=n
+							 L2TP_FEATURE_LAIC_SUPPORT=n
+							 L2TP_FEATURE_LAOC_SUPPORT=n "
+
+	use server	|| myconf+=" L2TP_FEATURE_LNS_SUPPORT=n
+							 L2TP_FEATURE_LNIC_SUPPORT=n
+							 L2TP_FEATURE_LNOC_SUPPORT=n "
+
+	use rpc		|| myconf+=" L2TP_FEATURE_RPC_MANAGEMENT=n "
+
+	use stats	&& myconf+=" L2TP_FEATURE_LOCAL_STAT_FILE=y "
+	use debug	&& myconf+=" L2TP_DEBUG=y "
+	use dmalloc	&& myconf+=" USE_DMALLOC=y "
+
+	echo ${myconf} > "${T}/myconf"
+}
+
+src_compile() {
+	emake $(cat "${T}/myconf")
+}
+
+src_install() {
+	emake $(cat "${T}/myconf") DESTDIR="${D}" install
+
+	if use examples; then
+		docinto event_socket
+		dodoc doc/{event_sock_example.c,README.event_sock}
+		docinto
+		dodoc -r "${FILESDIR}"/examples
+	fi
+
+	if use doc; then
+		dodoc doc/*.txt
+		newdoc plugins/README README.plugins
+		dodoc -r ipsec
+	fi
+
+	newinitd "${FILESDIR}"/openl2tpd.initd openl2tpd
+	# init.d script is quite different for RPC and non-RPC versions.
+	use rpc || sed -i s/userpc=\"yes\"/userpc=\"no\"/ "${D}/etc/init.d/openl2tpd" || die "sed failed"
+	newconfd "${FILESDIR}"/openl2tpd.confd openl2tpd
+}
+
+pkg_postinst() {
+	if use rpc; then
+		ewarn
+		ewarn "RPC control does not provide any auth checks for control connection."
+		ewarn "Unless you need this you should disable it, for reference:"
+		ewarn "http://forums.openl2tp.org/viewtopic.php?f=4&t=41"
+		ewarn
+		ewarn "Therefore DO NOT USE RPC IN INSECURE ENVIRONMENTS!"
+	else
+		ewarn
+		ewarn "Without RPC support you won't be able to use l2tpconfig."
+		ewarn "Please read http://forums.openl2tp.org/viewtopic.php?f=4&t=41"
+		ewarn "for more information about the security risk before enabling."
+		ewarn
+		ewarn "If you are using numerical strings (e.g. login name containing only"
+		ewarn "digits) or special characters in password, please use double quotes"
+		ewarn "to enclose them."
+	fi
+	if use stats; then
+		ewarn
+		ewarn "To enable status files openl2tpd must be started with -S option."
+		ewarn "Upstream warns about runtime overhead with status files enabled."
+	fi
+}