Security fix for AST-2010-002 (dial plan wildcard injection vulnerability) on the 1.2 branch. Please read up immediately on the use of the Filter command.

Package-Manager: portage-2.2_rc63/cvs/Linux x86_64

3 files changed, 416 insertions, 5 deletions

diff --git a/net-misc/asterisk/ChangeLog b/net-misc/asterisk/ChangeLog
index 0c900f9bdbf8..0c5962bdb652 100644
--- a/net-misc/asterisk/ChangeLog
+++ b/net-misc/asterisk/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for net-misc/asterisk
 # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/asterisk/ChangeLog,v 1.249 2010/02/21 20:39:54 chainsaw Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-misc/asterisk/ChangeLog,v 1.250 2010/02/21 21:44:08 chainsaw Exp $
+
+*asterisk-1.2.40 (21 Feb 2010)
+
+  21 Feb 2010; <chainsaw@gentoo.org> +asterisk-1.2.40.ebuild:
+  Security fix for AST-2010-002 (dial plan wildcard injection vulnerability)
+  on the 1.2 branch. Please read up immediately on the use of the Filter
+  command.
 
 *asterisk-1.6.2.4 (21 Feb 2010)
 *asterisk-1.6.1.16 (21 Feb 2010)
diff --git a/net-misc/asterisk/Manifest b/net-misc/asterisk/Manifest
index 0ad84d2c639e..da22c1f3f201 100644
--- a/net-misc/asterisk/Manifest
+++ b/net-misc/asterisk/Manifest
@@ -36,18 +36,20 @@ AUX 1.6.2/asterisk-1.6.2.2-parallel-make.patch 842 RMD160 e62c458de2508c86985029
 DIST asterisk-1.2.27-patches-1.0.tar.bz2 6653 RMD160 18f1d7fc4497466050ed4f517ff5732eb448ff2e SHA1 2aecd3e91cde38dbb0fd591e8a49db221f44b94e SHA256 a4da0570fca2df3c508f072be62722879956fe8c454027fbb8dafb7a6095384c
 DIST asterisk-1.2.36.tar.gz 29897926 RMD160 47b8c0e58c43cac6aa415482182aea15b1489ccc SHA1 b6f60404ba0ca802cfa5cd43685a36b467441c5c SHA256 69f48a0e49f3a37196b65f11e8babf5c28e33700903b9f304e984def6c35dbf0
 DIST asterisk-1.2.37.tar.gz 29899629 RMD160 1de7ff96d3b1fd8d89f3ef7b3bb9e35bedccfb33 SHA1 c9a3c4684e021f62b4d19f6e0c8fc11f64db19d6 SHA256 9f3ec67efe0e4d45434621cd358e8e7d64e1b05df04d66e2390c9420acd2aeaa
+DIST asterisk-1.2.40.tar.gz 29903514 RMD160 dc3da60756c82c98a055e49b068eb6760a01948e SHA1 4b4b794e858a3436bc35bdd2f4edf824c2885b68 SHA256 61dc745b12f6dc2998404e77747a964db56df8efae84a666c4ccddf016c9c06d
 DIST asterisk-1.6.1.16.tar.gz 23517899 RMD160 a03f86ae3eecfe940eb63a40286b9697a3c7e6ac SHA1 df0ad2f94614479c7bff13ae24200b89f9605132 SHA256 997786c51698827d5dc9c17793deb47716c857de9ce884c6ecd9e8447599727c
 DIST asterisk-1.6.2.4.tar.gz 23184195 RMD160 72d42566475376484774e0e198075716a77f6c3c SHA1 bed12cbfb9af09898ec8810b903512f1ad1f4512 SHA256 3b08ce205ced7b5fe96dabb5f65f5d6b094cf1d4c543df3d86c08bbe3a0f2e51
 EBUILD asterisk-1.2.36.ebuild 10640 RMD160 de9118d48d7122200847783aec84e89724f33475 SHA1 8839099437bb0fa20ab7ba4c4aabeef33be353d5 SHA256 73421c18cf2aec1412ef1f86cb6a810765cf7c78fdb056b2e84224430368a1ca
 EBUILD asterisk-1.2.37.ebuild 10640 RMD160 82f1d14082b607402146bd8f7950ea32ee2558f3 SHA1 5718e0411fff8bc14c4c57562a9df281c33abdc5 SHA256 2f2290922b09f9b71b06cb73e99fc7916b4a994960375e0e48b6bb39fd802e0c
+EBUILD asterisk-1.2.40.ebuild 10647 RMD160 7b267ebc801d87ad4a1433454cf64b36227647b4 SHA1 949f14d1e7fce52b8a09af12aa5283aafe479450 SHA256 2d96cf3daddf083c3094780a97e6699869e7ad9fc8c82f1a4fb17cee520b96c6
 EBUILD asterisk-1.6.1.16.ebuild 11228 RMD160 353dc948d499efafee74c741bd61d310b0c74815 SHA1 d5d3f04469dd8b425ec30d7db9de552263439d46 SHA256 e6db16c5b51048839db684379ec05cc162ed03b7fa03a6a9dd8c7509c661473e
 EBUILD asterisk-1.6.2.4.ebuild 9958 RMD160 446e23144bf699618d57b116b1ff95efa550aff5 SHA1 30b1f6a0267df97a8dd8a5722a75339052a74691 SHA256 5d53e17d965a190b91dcf56fdf32e51dd36409c3408bc991052da20c117a2101
-MISC ChangeLog 55629 RMD160 fe0432eea89757ff6cc615174abd79ebb710153a SHA1 893c1acd4361115124734e6f8800e885e7980449 SHA256 59e60469429cbc0fbff8d663de263661601475ace1de4332ced3cbda1d29f07b
+MISC ChangeLog 55885 RMD160 7d661a63c9312a1a550a4c9c7acfaac7c1da7a3a SHA1 acd306d72b1f39f73181ce073ea8653f0b95ba60 SHA256 2963d40e82a7ba96a424d958578b051bdb43b32f8dfec90455709872b32f5579
 MISC metadata.xml 1103 RMD160 9be6c713684efa268e58cfc111fae4716e97f9dd SHA1 5af1f100c97f1bca1834867e06c3fb9111ed1fde SHA256 a83ca9d4cfd8da10b8dbb9583e1b6fa5fc0f30968a0681e4bc931673a00e1c99
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.14 (GNU/Linux)
 
-iEYEARECAAYFAkuBmlQACgkQp5vW4rUFj5osxwCdEfOADdJiQjkNUL1kb+ohIqZk
-zBIAnjEg5s3lgMp3a++B0lX0XGQC/gp8
-=9dlz
+iEYEARECAAYFAkuBqTIACgkQp5vW4rUFj5qnIQCgoaLqBPCQHRBL4lWdlUH8gqfN
+vksAn0XdwUVRffMrKMoZp/zLgCfcM5/K
+=LUvJ
 -----END PGP SIGNATURE-----
diff --git a/net-misc/asterisk/asterisk-1.2.40.ebuild b/net-misc/asterisk/asterisk-1.2.40.ebuild
new file mode 100644
index 000000000000..7d25a1b5f8ab
--- /dev/null
+++ b/net-misc/asterisk/asterisk-1.2.40.ebuild
@@ -0,0 +1,402 @@
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-misc/asterisk/asterisk-1.2.40.ebuild,v 1.1 2010/02/21 21:44:08 chainsaw Exp $
+
+EAPI=2
+inherit eutils multilib toolchain-funcs
+
+IUSE="alsa curl debug doc gtk hardened lowmem mmx nosamples \
+	odbc osp postgres pri sqlite ssl speex zaptel elibc_uclibc"
+
+AST_PATCHES="1.2.27-patches-1.0"
+
+MY_P="${P/_p/.}"
+
+DESCRIPTION="Asterisk: A Modular Open Source PBX System"
+HOMEPAGE="http://www.asterisk.org/"
+SRC_URI="http://downloads.digium.com/pub/asterisk/releases/${MY_P}.tar.gz
+	 mirror://gentoo/${PN}-${AST_PATCHES}.tar.bz2"
+
+S="${WORKDIR}/${MY_P}"
+
+SLOT="0"
+LICENSE="GPL-2"
+KEYWORDS="~alpha ~amd64 ~hppa ~ppc ~sparc ~x86"
+
+RDEPEND="dev-libs/newt
+	media-sound/sox
+	ssl? ( dev-libs/openssl )
+	gtk? ( =x11-libs/gtk+-1.2* )
+	pri? ( =net-libs/libpri-1.2*[-bri] )
+	alsa? ( media-libs/alsa-lib )
+	curl? ( net-misc/curl )
+	odbc? ( dev-db/unixODBC )
+	speex? ( media-libs/speex )
+	sqlite? ( <dev-db/sqlite-3.0.0 )
+	zaptel? ( >=net-misc/zaptel-1.2.16 )
+	postgres? ( virtual/postgresql-base )
+	osp? ( >=net-libs/osptoolkit-3.3.4 )"
+
+DEPEND="${RDEPEND}
+	sys-devel/flex
+	sys-devel/bison
+	doc? ( app-doc/doxygen )
+	virtual/logger"
+
+#asterisk uses special mpg123 functions and does not work with mpeg321, bug #42703
+PDEPEND="|| ( media-sound/mpg123 net-misc/asterisk-addons )"
+
+QA_TEXTRELS_x86="usr/lib/asterisk/modules/codec_gsm.so"
+QA_EXECSTACK_x86="usr/lib/asterisk/modules/codec_gsm.so"
+
+#
+# List of modules to ignore during scan (because they have been removed in 1.2.x)
+#
+SCAN_IGNORE_MODS="
+	app_qcall
+	chan_modem
+	chan_modem_i4l
+	chan_modem_bestdata
+	chan_modme_aopen"
+
+#
+# shortcuts
+#
+is_ast10update() {
+	return $(has_version "=net-misc/asterisk-1.0*")
+}
+
+is_astupdate() {
+	if ! is_ast10update; then
+		return $(has_version "<net-misc/asterisk-${PV}")
+	fi
+	return 0
+}
+
+#
+# Scan for asterisk-1.0.x modules that will have to be updated
+#
+scan_modules() {
+	local modules_list=""
+	local n
+
+	for x in $(ls -1 "${ROOT}"usr/$(get_libdir)/asterisk/modules/*.so); do
+		echo -en "Scanning.... $(basename ${x})   \r"
+
+		# skip blacklisted modules
+		hasq $(basename ${x//.so}) ${SCAN_IGNORE_MODS} && continue
+
+		if $(readelf -s "${x}" | grep -q "\(ast_load\|ast_destroy\)$"); then
+			modules_list="${modules_list} $(basename ${x//.so})"
+		fi
+	done
+
+	if [[ -n "${modules_list}" ]]; then
+		echo  "   ========================================================"
+		ewarn "Please update or unmerge the following modules:"
+		echo
+
+		n=0
+		for x in ${modules_list}; do
+			ewarn " -   ${x}"
+			(( n++ ))
+		done
+
+		echo
+		ewarn "Warning: $n outdated module(s) found!"
+		ewarn "Warning: asterisk may not work if you don't update them!"
+		echo  "   ========================================================"
+		echo
+		einfo "You can use the \"asterisk-updater\" script to update the modules"
+		epause
+		echo
+		return 1
+	else
+		einfo "No asterisk-1.0.x modules found!"
+		return 0
+	fi
+}
+
+pkg_setup() {
+	local checkfailed=0 waitaftermsg=0
+
+	if is_ast10update; then
+		ewarn "                      Asterisk UPGRADE Warning"
+		ewarn ""
+		ewarn "- Please read "${ROOT}"usr/share/doc/${PF}/UPGRADE.txt.gz after the installation!"
+		ewarn ""
+		ewarn "                      Asterisk UPGRADE Warning"
+		echo
+		waitaftermsg=1
+	fi
+
+	#
+	# Regular checks
+	#
+	einfo "Running some pre-flight checks..."
+	echo
+
+}
+
+src_prepare() {
+	#
+	# gentoo patchset
+	#
+	for x in $(grep -v "^#\| \+" "${WORKDIR}"/patches/patches.list); do
+		epatch "${WORKDIR}"/patches/${x}
+	done
+
+	if use mmx; then
+		if ! use hardened; then
+			einfo "Enabling mmx optimization"
+			sed -i -e "s:^#\(K6OPT[\t ]\+= -DK6OPT\):\1:" \
+				Makefile
+		else
+			ewarn "Hardened use-flag is set, not enabling mmx optimization for codec_gsm!"
+		fi
+	fi
+
+	if ! use debug; then
+		einfo "Disabling debug support"
+		sed -i -e "s:^\(DEBUG=\):#\1:" \
+			Makefile
+	fi
+
+	if ! use ssl; then
+		einfo "Disabling crypto support"
+		sed -i -e 's:^#\(NOCRYPTO=yes\):\1:' \
+			-e '/^LIBS+=-lssl/d' Makefile || die
+	fi
+
+	epatch "${FILESDIR}/1.2.0/${PN}-1.2.35-lpc10-prototypes.diff"
+
+	#
+	# uclibc patch
+	#
+	if use elibc_uclibc; then
+		einfo "Patching asterisk for uclibc..."
+		epatch "${FILESDIR}"/1.0.0/${PN}-1.0.5-uclibc-dns.diff
+		epatch "${FILESDIR}"/1.2.0/${PN}-1.2.1-uclibc-getloadavg.diff
+	fi
+
+	#
+	# Disable AEL, security bug #171884
+	# Re-enable at your own risk (no USE since it can be critical)
+	#
+	sed -i -e 's/pbx_ael.so//' pbx/Makefile || die
+
+	# codecs/Makefile does not add -lspeexdsp needed for speex 1.2,  bug #206463
+	if use speex && has_version ">=media-libs/speex-1.2"; then
+		sed -i -e "s/-lspeex/-lspeex -lspeexdsp/" codecs/Makefile \
+			|| die "patching codecs/Makefile failed"
+	fi
+}
+
+src_compile() {
+	local myopts
+
+	use lowmem && \
+		myopts="-DLOW_MEMORY"
+
+	einfo "Building Asterisk..."
+	if use debug; then
+		unset CFLAGS
+		make \
+			CC=$(tc-getCC) \
+			NOTRACE=1 \
+			PWLIBDIR=/usr/share/pwlib \
+			OPTIONS="${myopts}" \
+			dont-optimize=1 || die "Make failed"
+	else
+		make \
+			CC=$(tc-getCC) \
+			NOTRACE=1 \
+			OPTIMIZE="${CFLAGS}" \
+			PWLIBDIR=/usr/share/pwlib \
+			OPTIONS="${myopts}" || die "Make failed"
+	fi
+
+	# create api docs
+	use doc && \
+		make progdocs
+}
+
+src_install() {
+
+	# install asterisk
+	make DESTDIR="${D}" ASTLIBDIR="\$(INSTALL_PREFIX)/usr/$(get_libdir)/asterisk" install || die "Make install failed"
+	make DESTDIR="${D}" ASTLIBDIR="\$(INSTALL_PREFIX)/usr/$(get_libdir)/asterisk" samples || die "Failed to create sample files"
+
+	# remove installed sample files if nosamples flag is set
+	if use nosamples; then
+		einfo "Skipping installation of sample files..."
+		rm -rf "${D}"var/spool/asterisk/voicemail/default
+		rm -f  "${D}"var/lib/asterisk/mohmp3/*
+		rm -f  "${D}"var/lib/asterisk/sounds/demo-*
+		rm -f  "${D}"var/lib/asterisk/agi-bin/*
+	else
+		einfo "Sample files have been installed"
+		keepdir /var/spool/asterisk/voicemail/default/1234/INBOX
+	fi
+
+	# move sample configuration files to doc directory
+	if is_ast10update; then
+		elog "Updating from old (pre-1.2) asterisk version, new configuration files have been installed"
+		elog "into "${ROOT}"etc/asterisk, use etc-update or dispatch-conf to update them"
+	elif has_version "net-misc/asterisk"; then
+		elog "Configuration samples have been moved to: $ROOT/usr/share/doc/${PF}/conf"
+		insinto /usr/share/doc/${PF}/conf
+		doins "${D}"etc/asterisk/*.conf*
+		rm -f "${D}"etc/asterisk/*.conf* 2>/dev/null
+	fi
+
+	# don't delete these directories, even if they are empty
+	for x in voicemail meetme system dictate monitor tmp; do
+		keepdir /var/spool/asterisk/${x}
+	done
+	keepdir /var/lib/asterisk/sounds/priv-callerintros
+	keepdir /var/lib/asterisk/mohmp3
+	keepdir /var/lib/asterisk/agi-bin
+	keepdir /var/log/asterisk/cdr-csv
+	keepdir /var/log/asterisk/cdr-custom
+	keepdir /var/run/asterisk
+
+	# install astxs
+	dobin  contrib/scripts/astxs
+
+	newinitd "${FILESDIR}"/1.2.0/asterisk.rc6 asterisk
+	newconfd "${FILESDIR}"/1.2.0/asterisk.confd asterisk
+
+	# install standard docs...
+	dodoc BUGS CREDITS ChangeLog HARDWARE README
+	dodoc SECURITY doc/CODING-GUIDELINES doc/linkedlists.README UPGRADE.txt
+	dodoc doc/README.*
+	dodoc doc/*.txt
+
+	docinto scripts
+	dodoc contrib/scripts/*
+
+	docinto utils
+	dodoc contrib/utils/*
+
+	docinto configs
+	dodoc configs/*
+
+	# install api docs
+	if use doc; then
+		insinto /usr/share/doc/${PF}/api/html
+		doins doc/api/html/*
+	fi
+
+	insinto /usr/share/doc/${PF}/cgi
+	doins contrib/scripts/vmail.cgi
+	doins images/*.gif
+
+	# install asterisk-updater
+	dosbin "${FILESDIR}"/1.2.0/asterisk-updater
+
+	# install asterisk.h, a lot of external modules need this
+	insinto /usr/include/asterisk
+	doins   include/asterisk.h
+
+	# make sure misdn/capi stuff is not installed, provided by asterisk-chan_..
+	rm -f "${D}"/etc/asterisk/misdn.conf "${D}"/usr/lib/asterisk/modules/chan_misdn.so \
+		"${D}"/usr/share/doc/${PF}/{conf/misdn.conf,configs/misdn.conf.sample.gz,README.misdn.gz}
+	rm -f "${D}"/usr/include/asterisk/chan_capi{,_app}.h \
+		"${D}"/usr/share/doc/${PF}/{conf/capi.conf,configs/capi.conf.sample.gz}
+
+	# make sure the broken speex support does not keep Asterisk from starting up
+	# bug #206463 if you care about this. solution needs to work with --as-needed
+	rm -f "${D}"usr/$(get_libdir)/asterisk/modules/codec_speex.so || die "Unable to remove fatally flawed codec_speex.so"
+}
+
+pkg_preinst() {
+	enewgroup asterisk
+	enewuser asterisk -1 -1 /var/lib/asterisk "asterisk,dialout"
+}
+
+pkg_postinst() {
+	einfo "Fixing permissions"
+	chown -R asterisk:asterisk "${ROOT}"var/log/asterisk
+	chmod -R u=rwX,g=rX,o=     "${ROOT}"var/log/asterisk
+
+	for x in lib run spool; do
+		chown -R asterisk:asterisk "${ROOT}"var/${x}/asterisk
+		chmod -R u=rwX,g=rwX,o=    "${ROOT}"var/${x}/asterisk
+	done
+
+	chown asterisk:asterisk "${ROOT}"etc/asterisk/
+	chown asterisk:asterisk "${ROOT}"etc/asterisk/*.adsi
+	chown asterisk:asterisk "${ROOT}"etc/asterisk/extensions.ael
+	chmod u=rwX,g=rwX,o= "${ROOT}"etc/asterisk/
+	chmod u=rwX,g=rwX,o= "${ROOT}"etc/asterisk/*.adsi
+	chmod u=rwX,g=rwX,o= "${ROOT}"etc/asterisk/extensions.ael
+	echo
+
+	#
+	# Announcements, warnings, reminders...
+	#
+	einfo "Asterisk has been installed"
+	einfo ""
+	elog "If you want to know more about asterisk, visit these sites:"
+	elog "http://www.asteriskdocs.org/"
+	elog "http://www.voip-info.org/wiki-Asterisk"
+	elog
+	elog "http://www.automated.it/guidetoasterisk.htm"
+	elog
+	elog "Gentoo VoIP IRC Channel:"
+	elog "#gentoo-voip @ irc.freenode.net"
+	elog
+	elog "Please note that AEL is no longer built because of security bugs"
+	elog "See http://bugs.gentoo.org/show_bug.cgi?id=171884"
+	elog
+	echo
+	echo
+
+	#
+	# Warning about 1.0 -> 1.2 changes...
+	#
+	if is_ast10update; then
+		ewarn ""
+		ewarn "- Please read "${ROOT}"usr/share/doc/${PF}/UPGRADE.txt.gz before continuing"
+		ewarn ""
+	fi
+
+	if is_astupdate; then
+		ewarn ""
+		ewarn " - The initgroups patch has been dropped, please update your"
+		ewarn "   \"conf.d/asterisk\" and \"init.d/asterisk\" file!"
+		ewarn ""
+	fi
+
+	# scan for old modules
+	if is_ast10update; then
+		einfo "Asterisk has been updated from pre-1.2.x, scanning for old modules"
+		scan_modules
+	fi
+}
+
+pkg_config() {
+	einfo "Do you want to reset file permissions and ownerships (y/N)?"
+
+	read tmp
+	tmp="$(echo $tmp | tr [:upper:] [:lower:])"
+
+	if [[ "$tmp" = "y" ]] ||\
+	   [[ "$tmp" = "yes" ]]
+	then
+		einfo "Resetting permissions to defaults..."
+
+		for x in spool run lib log; do
+			chown -R asterisk:asterisk "${ROOT}"var/${x}/asterisk
+			chmod -R u=rwX,g=rX,o=     "${ROOT}"var/${x}/asterisk
+		done
+
+		chown -R root:asterisk "${ROOT}"etc/asterisk
+		chmod -R u=rwX,g=rX,o= "${ROOT}"etc/asterisk
+
+		einfo "done"
+	else
+		einfo "skipping"
+	fi
+}