Merge lp:~zulcss/ubuntu/intrepid/ipsec-tools/src-374185 into lp:ubuntu/intrepid/ipsec-tools

[Chuck Short]

[Steve Beattie (sbeattie)]

Looks okay, modulo similar comments about including the prior security fix and making sure to update bug descriptions rather than merely adding a comment. Thanks!

review: Approve (sru)

Unmerged revisions

20. By Chuck Short on 2009-10-01

src/racoon/ipsec_doi.c: Patched to fix segfault when using
ipv6 addresses in sainfo section of racoon.conf. Thanks to
Fredrik Ljunggren. (LP: #374185)

19. By Marc Deslauriers on 2009-06-04

* SECURITY UPDATE: denial of service via fragmented packets without a
  payload.
  - src/racoon/isakmp_frag.c: validate size of payload data.
  - http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c.diff?r1=1.4&r2=1.4.6.1&f=h
  - CVE-2009-1574
* SECURITY UPDATE: denial of service via multiple memory leaks.
  - src/racoon/crypto_openssl.c: call X509_free().
  - src/racoon/nattraversal.c: add new natt_keepalive_delete() function
    that also frees ka->src and ka->dst.
  - http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c.diff?r1=1.11.6.4&r2=1.11.6.5&f=u
  - http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/nattraversal.c.diff?r1=1.6&r2=1.6.6.1&f=u
  - CVE-2009-1632

=== modified file 'debian/changelog'
--- debian/changelog	2008-06-18 17:34:55 +0000
+++ debian/changelog	2009-10-01 15:25:20 +0000
@@ -1,3 +1,28 @@
+ipsec-tools (1:0.7-2.1ubuntu1.8.10.2) intrepid-proposed; urgency=low
+
+  * src/racoon/ipsec_doi.c: Patched to fix segfault when using
+    ipv6 addresses in sainfo section of racoon.conf. Thanks to 
+    Fredrik Ljunggren. (LP: #374185)
+
+ -- Chuck Short <[e-mail]>  Thu, 01 Oct 2009 11:15:27 -0400
+
+ipsec-tools (1:0.7-2.1ubuntu1.8.10.1) intrepid-security; urgency=low
+
+  * SECURITY UPDATE: denial of service via fragmented packets without a
+    payload.
+    - src/racoon/isakmp_frag.c: validate size of payload data.
+    - http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c.diff?r1=1.4&r2=1.4.6.1&f=h
+    - CVE-2009-1574
+  * SECURITY UPDATE: denial of service via multiple memory leaks.
+    - src/racoon/crypto_openssl.c: call X509_free().
+    - src/racoon/nattraversal.c: add new natt_keepalive_delete() function
+      that also frees ka->src and ka->dst.
+    - http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c.diff?r1=1.11.6.4&r2=1.11.6.5&f=u
+    - http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/nattraversal.c.diff?r1=1.6&r2=1.6.6.1&f=u
+    - CVE-2009-1632
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 04 Jun 2009 14:35:06 -0400
+
 ipsec-tools (1:0.7-2.1ubuntu1) intrepid; urgency=low
 
   * Merge from debian unstable, remaining changes:
 
=== modified file 'src/racoon/crypto_openssl.c'
--- src/racoon/crypto_openssl.c	2008-06-18 17:34:55 +0000
+++ src/racoon/crypto_openssl.c	2009-10-01 15:25:20 +0000
@@ -900,12 +900,14 @@
 	evp = X509_get_pubkey(x509);
 	if (! evp) {
 		plog(LLV_ERROR, LOCATION, NULL, "X509_get_pubkey(): %s\n", eay_strerror());
+		X509_free(x509);
 		return -1;
 	}
 
 	res = eay_rsa_verify(source, sig, evp->pkey.rsa);
 
 	EVP_PKEY_free(evp);
+	X509_free(x509);
 
 	return res;
 }
 
=== modified file 'src/racoon/ipsec_doi.c'
--- src/racoon/ipsec_doi.c	2008-06-18 17:34:55 +0000
+++ src/racoon/ipsec_doi.c	2009-10-01 15:25:20 +0000
@@ -4396,20 +4396,29 @@
 	char *dat;
 	static char buf[BUFLEN];
 	struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *)id->v;
-	struct sockaddr saddr;
+	struct sockaddr_storage saddr_storage;
+	struct sockaddr        *saddr;
+	struct sockaddr_in     *saddr_in;
+	struct sockaddr_in6    *saddr_in6;
 	u_int plen = 0;
 
+	saddr     = (struct sockaddr *)&saddr_storage;
+	saddr_in  = (struct sockaddr_in *)&saddr_storage;
+	saddr_in6 = (struct sockaddr_in6 *)&saddr_storage;
+
+	
 	switch (id_b->type) {
 	case IPSECDOI_ID_IPV4_ADDR:
 	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
 	case IPSECDOI_ID_IPV4_ADDR_RANGE:
 
 #ifndef __linux__
-		saddr.sa_len = sizeof(struct sockaddr_in);
+		saddr->sa_len = sizeof(struct sockaddr_in);
 #endif
-		saddr.sa_family = AF_INET;
-		((struct sockaddr_in *)&saddr)->sin_port = IPSEC_PORT_ANY;
-		memcpy(&((struct sockaddr_in *)&saddr)->sin_addr,
+		saddr->sa_family = AF_INET;
+
+		saddr_in->sin_port = IPSEC_PORT_ANY;
+		memcpy(&saddr_in->sin_addr,
 			id->v + sizeof(*id_b), sizeof(struct in_addr));
 		break;
 #ifdef INET6
@@ -4418,12 +4427,17 @@
 	case IPSECDOI_ID_IPV6_ADDR_RANGE:
 
 #ifndef __linux__
-		saddr.sa_len = sizeof(struct sockaddr_in6);
+		saddr->sa_len = sizeof(struct sockaddr_in6);
 #endif
-		saddr.sa_family = AF_INET6;
-		((struct sockaddr_in6 *)&saddr)->sin6_port = IPSEC_PORT_ANY;
-		memcpy(&((struct sockaddr_in6 *)&saddr)->sin6_addr,
+		saddr->sa_family = AF_INET6;
+
+		saddr_in6->sin6_port = IPSEC_PORT_ANY;
+		memcpy(&saddr_in6->sin6_addr,
 			id->v + sizeof(*id_b), sizeof(struct in6_addr));
+		saddr_in6->sin6_scope_id =
+			(IN6_IS_ADDR_LINKLOCAL(&saddr_in6->sin6_addr)
+				? ((struct sockaddr_in6 *)id_b)->sin6_scope_id
+				: 0);
 		break;
 #endif
 	}
@@ -4433,7 +4447,7 @@
 #ifdef INET6
 	case IPSECDOI_ID_IPV6_ADDR:
 #endif
-		len = snprintf( buf, BUFLEN, "%s", saddrwop2str(&saddr));
+		len = snprintf( buf, BUFLEN, "%s", saddrwop2str(saddr));
 		break;
 
 	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
@@ -4489,42 +4503,46 @@
 			plen += l;
 		}
 
-		len = snprintf( buf, BUFLEN, "%s/%i", saddrwop2str(&saddr), plen);
+		len = snprintf( buf, BUFLEN, "%s/%i", saddrwop2str(saddr), plen);
 	    }
 		break;
 
 	case IPSECDOI_ID_IPV4_ADDR_RANGE:
 
-		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(&saddr));
+		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(saddr));
 
 #ifndef __linux__
-		saddr.sa_len = sizeof(struct sockaddr_in);
+		saddr->sa_len = sizeof(struct sockaddr_in);
 #endif
-		saddr.sa_family = AF_INET;
-		((struct sockaddr_in *)&saddr)->sin_port = IPSEC_PORT_ANY;
-		memcpy(&((struct sockaddr_in *)&saddr)->sin_addr,
+		saddr->sa_family = AF_INET;
+		saddr_in->sin_port = IPSEC_PORT_ANY;
+		memcpy(&saddr_in->sin_addr,
 			id->v + sizeof(*id_b) + sizeof(struct in_addr),
 			sizeof(struct in_addr));
 
-		len += snprintf( buf + len, BUFLEN - len, "%s", saddrwop2str(&saddr));
+		len += snprintf( buf + len, BUFLEN - len, "%s", saddrwop2str(saddr));
 
 		break;
 
 #ifdef INET6
 	case IPSECDOI_ID_IPV6_ADDR_RANGE:
 
-		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(&saddr));
+		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(saddr));
 
 #ifndef __linux__
-		saddr.sa_len = sizeof(struct sockaddr_in6);
+		saddr->sa_len = sizeof(struct sockaddr_in6);
 #endif
-		saddr.sa_family = AF_INET6;
-		((struct sockaddr_in6 *)&saddr)->sin6_port = IPSEC_PORT_ANY;
-		memcpy(&((struct sockaddr_in6 *)&saddr)->sin6_addr,
+		saddr->sa_family = AF_INET6;
+		saddr_in6->sin6_port = IPSEC_PORT_ANY;
+		memcpy(&saddr_in6->sin6_addr,
 			id->v + sizeof(*id_b) + sizeof(struct in6_addr),
 			sizeof(struct in6_addr));
+		saddr_in6->sin6_scope_id =
+			(IN6_IS_ADDR_LINKLOCAL(&saddr_in6->sin6_addr)
+				? ((struct sockaddr_in6 *)id_b)->sin6_scope_id
+				: 0);
 
-		len += snprintf( buf + len, BUFLEN - len, "%s", saddrwop2str(&saddr));
+		len += snprintf( buf + len, BUFLEN - len, "%s", saddrwop2str(saddr));
 
 		break;
 #endif
 
=== modified file 'src/racoon/isakmp_frag.c'
--- src/racoon/isakmp_frag.c	2008-06-18 17:34:55 +0000
+++ src/racoon/isakmp_frag.c	2009-10-01 15:25:20 +0000
@@ -199,7 +199,8 @@
 	 * frag->len is the frag payload data plus the frag payload header,
 	 * whose size is sizeof(*frag) 
 	 */
-	if (msg->l < sizeof(*isakmp) + ntohs(frag->len)) {
+	if (msg->l < sizeof(*isakmp) + ntohs(frag->len) ||
+	    ntohs(frag->len) < sizeof(*frag) + 1) {
 		plog(LLV_ERROR, LOCATION, NULL, "Fragment too short\n");
 		return -1;
 	}
 
=== modified file 'src/racoon/nattraversal.c'
--- src/racoon/nattraversal.c	2008-06-18 17:34:55 +0000
+++ src/racoon/nattraversal.c	2009-10-01 15:25:20 +0000
@@ -319,6 +319,15 @@
       iph1->natt_flags |= NAT_ANNOUNCED;
 }
 
+static void
+natt_keepalive_delete (struct natt_ka_addrs *ka)
+{
+  TAILQ_REMOVE (&ka_tree, ka, chain);
+  racoon_free (ka->src);
+  racoon_free (ka->dst);
+  racoon_free (ka);
+}
+
 /* NAT keepalive functions */
 static void
 natt_keepalive_send (void *param)
@@ -333,8 +342,7 @@
     
     s = getsockmyaddr(ka->src);
     if (s == -1) {
-      TAILQ_REMOVE (&ka_tree, ka, chain);
-      racoon_free (ka);
+      natt_keepalive_delete(ka);
       continue;
     }
     plog (LLV_DEBUG, LOCATION, NULL, "KA: %s\n", 
@@ -435,8 +443,7 @@
 
       plog (LLV_DEBUG, LOCATION, NULL, "KA removing this one...\n");
 
-      TAILQ_REMOVE (&ka_tree, ka, chain);
-      racoon_free (ka);
+      natt_keepalive_delete (ka);
       /* Should we break here? Every pair of addresses should 
          be inserted only once, but who knows :-) Lets traverse 
 	 the whole list... */