Merge pull request #720 from micmac1/restund-cve
authorJiri Slachta <jiri@slachta.eu>
Thu, 9 Dec 2021 10:37:04 +0000 (11:37 +0100)
committerGitHub <noreply@github.com>
Thu, 9 Dec 2021 10:37:04 +0000 (11:37 +0100)
restund: fix CVE-2021-21382

net/baresip/Makefile
net/baresip/patches/002-fix-rem-include.patch [deleted file]
net/coturn/Makefile [new file with mode: 0644]
net/coturn/files/turnserver.conf [new file with mode: 0644]
net/coturn/files/turnserver.init [new file with mode: 0755]
net/coturn/patches/01-includes.patch [new file with mode: 0644]
net/coturn/patches/02-fix-flags-dupes.patch [new file with mode: 0644]
net/coturn/patches/03-fix-libmariadb-detection.patch [new file with mode: 0644]

index 7cab4d87e2dc67482bbdaf8799bb150785a85e12..f687913ec3e32613502292392c09beb9dfbb8f17 100644 (file)
@@ -127,6 +127,7 @@ MAKE_FLAGS+= \
        LIBRE_MK="$(STAGING_DIR)/usr/share/re/re.mk" \
        LIBRE_INC="$(STAGING_DIR)/usr/include/re" \
        LIBRE_SO="$(STAGING_DIR)/usr/lib" \
+       LIBREM_PATH="$(STAGING_DIR)/usr" \
        OS=linux \
        RELEASE=1 \
        SYSROOT="$(shell $(FIND) $(TOOLCHAIN_DIR) -path '*/include/pthread.h' | sed -ne '1s|/include/pthread.h||p')" \
diff --git a/net/baresip/patches/002-fix-rem-include.patch b/net/baresip/patches/002-fix-rem-include.patch
deleted file mode 100644 (file)
index 7556241..0000000
+++ /dev/null
@@ -1,68 +0,0 @@
---- a/Makefile
-+++ b/Makefile
-@@ -45,63 +45,11 @@ SYSROOT_LOCAL := $(shell [ -d /usr/local
- endif
- endif
--ifndef LIBREM_PATH
--LIBREM_PATH   := $(shell [ -d ../rem ] && echo "../rem")
--endif
--
--ifeq ($(LIBREM_PATH),)
--ifneq ($(SYSROOT_LOCAL),)
--LIBREM_PATH   := $(shell [ -f $(SYSROOT_LOCAL)/include/rem/rem.h ] && \
--      echo "$(SYSROOT_LOCAL)")
--endif
--endif
--
--ifeq ($(LIBREM_PATH),)
--LIBREM_PATH   := $(shell [ -f $(SYSROOT)/include/rem/rem.h ] && \
--      echo "$(SYSROOT)")
--endif
--
- # Include path
--LIBREM_INC := $(shell [ -f $(LIBREM_PATH)/include/rem.h ] && \
--      echo "$(LIBREM_PATH)/include")
--ifeq ($(LIBREM_INC),)
--LIBREM_INC := $(shell [ -f $(LIBREM_PATH)/include/rem/rem.h ] && \
--      echo "$(LIBREM_PATH)/include/rem")
--endif
--ifeq ($(LIBREM_INC),)
--LIBREM_INC := $(shell [ -f /usr/local/include/rem/rem.h ] && \
--      echo "/usr/local/include/rem")
--endif
--ifeq ($(LIBREM_INC),)
--LIBREM_INC := $(shell [ -f /usr/include/rem/rem.h ] && echo "/usr/include/rem")
--endif
-+LIBREM_INC := $(SYSROOT_ALT)/include/rem
- # Library path
--ifeq ($(LIBREM_SO),)
--LIBREM_SO  := $(shell [ -f $(LIBREM_PATH)/librem.a ] && \
--      echo "$(LIBREM_PATH)")
--endif
--ifeq ($(LIBREM_SO),)
--LIBREM_SO :=$(shell [ -f $(LIBREM_PATH)/librem$(LIB_SUFFIX) ] && \
--      echo "$(LIBREM_PATH)")
--endif
--ifeq ($(LIBREM_SO),)
--LIBREM_SO := $(shell [ -f $(LIBREM_PATH)/lib/librem$(LIB_SUFFIX) ] && \
--      echo "$(LIBREM_PATH)/lib")
--endif
--ifeq ($(LIBREM_SO),)
--LIBREM_SO  := $(shell [ -f /usr/local/lib/librem$(LIB_SUFFIX) ] \
--      && echo "/usr/local/lib")
--endif
--ifeq ($(LIBREM_SO),)
--LIBREM_SO  := $(shell [ -f /usr/lib/librem$(LIB_SUFFIX) ] && \
--      echo "/usr/lib")
--endif
--ifeq ($(LIBREM_SO),)
--LIBREM_SO  := $(shell [ -f /usr/lib64/librem$(LIB_SUFFIX) ] && \
--      echo "/usr/lib64")
--endif
--
-+LIBREM_SO  := $(SYSROOT_ALT)/include/rem
- CFLAGS    += -I. -Iinclude -I$(LIBRE_INC)
- CFLAGS    += -I$(LIBREM_INC)
diff --git a/net/coturn/Makefile b/net/coturn/Makefile
new file mode 100644 (file)
index 0000000..155b6f5
--- /dev/null
@@ -0,0 +1,143 @@
+#
+# Copyright (C) 2021 Sebastian Kemper <sebastian_ml@gmx.net>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=coturn
+PKG_VERSION:=4.5.2
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/coturn/coturn/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=462f1aa5c2455f28c1c8df09510d9e88ab14a1159b5e33ea5be5095262e83745
+
+PKG_LICENSE:=BSD-COTURN-CITRIX COMBINED-CITRIX-VIVOCHA-BSD MIT-HASH
+PKG_LICENSE_FILES:=LICENSE src/apps/relay/dbdrivers/* src/server/ns_turn_khash.h
+
+PKG_MAINTAINER:=Jiri Slachta <jiri@slachta.eu>, Sebastian Kemper <sebastian_ml@gmx.net>
+
+PKG_BUILD_PARALLEL:=1
+
+PKG_INSTALL:=1
+
+PKG_CONFIG_DEPENDS+= \
+       CONFIG_COTURN_ENABLE_MYSQL \
+       CONFIG_COTURN_ENABLE_POSTGRESQL \
+       CONFIG_COTURN_ENABLE_REDIS \
+       CONFIG_COTURN_ENABLE_SQLITE
+
+PKG_CPE_ID:=cpe:/a:coturn_project:coturn
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/nls.mk
+
+define Package/coturn
+  TITLE:=coturn TURN and STUN Server
+  CATEGORY:=Network
+  SECTION:=net
+  SUBMENU:=Telephony
+  URL:=https://github.com/coturn/coturn
+  USERID:=turnserver=379:turnserver=379
+  DEPENDS := \
+         +libevent2 \
+         +libevent2-extra \
+         +libevent2-pthreads \
+         +libevent2-openssl \
+         +libopenssl \
+         +COTURN_ENABLE_MYSQL:libmariadb \
+         +COTURN_ENABLE_POSTGRESQL:libpq \
+         +COTURN_ENABLE_REDIS:libhiredis \
+         +COTURN_ENABLE_SQLITE:libsqlite3
+  FILE_MODES:=/etc/turnserver:turnserver:turnserver:0750
+endef
+
+define Package/coturn/conffiles
+/etc/config/turnserver
+/etc/init.d/turnserver
+/etc/turnserver.conf
+endef
+
+define Package/coturn/config
+  menu "coturn configuration"
+    depends on PACKAGE_coturn
+
+    config COTURN_ENABLE_SQLITE
+      bool "SQLite support"
+      default y
+      help
+        Enable SQLite support
+
+    config COTURN_ENABLE_MYSQL
+      bool "MySQL support"
+      default n
+      help
+        Enable MySQL support
+
+    config COTURN_ENABLE_POSTGRESQL
+      bool "PostgreSQL support"
+      default n
+      help
+        Enable PostgreSQL support
+
+    config COTURN_ENABLE_REDIS
+      bool "Redis support"
+      default n
+      help
+        Enable Redis support
+
+  endmenu
+endef
+
+define Package/coturn/description
+The TURN Server is a VoIP media traffic NAT traversal server and
+gateway. It can be used as a general-purpose network traffic TURN server
+and gateway, too.
+endef
+
+define Package/coturn/install
+       $(INSTALL_DIR) \
+               $(1)/etc/{config,init.d,turnserver} $(1)/usr/{bin,share/coturn}
+       $(INSTALL_DATA) $(PKG_INSTALL_DIR)/etc/turnserver.conf.default \
+               $(1)/etc/turnserver.conf
+       $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/turn* $(1)/usr/bin
+       $(INSTALL_BIN) ./files/turnserver.init \
+               $(1)/etc/init.d/turnserver
+       $(INSTALL_CONF) ./files/turnserver.conf \
+               $(1)/etc/config/turnserver
+ifneq ($(CONFIG_COTURN_ENABLE_MYSQL)$(CONFIG_COTURN_ENABLE_POSTGRESQL)$(CONFIG_COTURN_ENABLE_SQLITE),)
+       $(INSTALL_DATA) \
+               $(PKG_INSTALL_DIR)/usr/share/coturn/{schema,testsqldbsetup}.sql \
+               $(1)/usr/share/coturn
+endif
+ifneq ($(CONFIG_COTURN_ENABLE_REDIS),)
+       $(INSTALL_DATA) \
+               $(PKG_INSTALL_DIR)/usr/share/coturn/schema.{stats,userdb}.redis \
+               $(1)/usr/share/coturn
+       $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/share/coturn/testredisdbsetup.sh \
+               $(1)/usr/share/coturn
+endif
+endef
+
+CONFIGURE_ARGS+= \
+       --disable-rpath \
+       --schemadir=/usr/share/coturn \
+       --turndbdir=/etc/turnserver
+
+CONFIGURE_VARS+= \
+       TURN_NO_PROMETHEUS=1 \
+       TURN_NO_SCTP=1 \
+       TURN_NO_SYSTEMD=1 \
+       TURN_NO_MONGO=1 \
+       $(if $(CONFIG_COTURN_ENABLE_MYSQL),,TURN_NO_MYSQL=1) \
+       $(if $(CONFIG_COTURN_ENABLE_POSTGRESQL),,TURN_NO_PQ=1) \
+       $(if $(CONFIG_COTURN_ENABLE_REDIS),,TURN_NO_HIREDIS=1) \
+       $(if $(CONFIG_COTURN_ENABLE_SQLITE),,TURN_NO_SQLITE=1)
+
+define Build/InstallDev
+endef
+
+$(eval $(call BuildPackage,coturn))
diff --git a/net/coturn/files/turnserver.conf b/net/coturn/files/turnserver.conf
new file mode 100644 (file)
index 0000000..d6eec32
--- /dev/null
@@ -0,0 +1,6 @@
+
+config turnserver 'general'
+       option enabled '0'
+       option log_stderr '0'
+       option log_stdout '0'
+       option options '--pidfile /var/run/turnserver.pid --log-file syslog --no-cli --proc-user turnserver --proc-group turnserver'
diff --git a/net/coturn/files/turnserver.init b/net/coturn/files/turnserver.init
new file mode 100755 (executable)
index 0000000..8f36d5a
--- /dev/null
@@ -0,0 +1,39 @@
+#!/bin/sh /etc/rc.common
+
+START=90
+STOP=10
+
+USE_PROCD=1
+
+#PROCD_DEBUG=1
+
+NAME=turnserver
+COMMAND=/usr/bin/$NAME
+
+LOGGER="/usr/bin/logger -s -t $NAME"
+LOG_ERR="$LOGGER -p daemon.err --"
+
+start_service() {
+
+  config_load $NAME
+
+  config_get_bool enabled general enabled 0
+  if [ $enabled -eq 0 ]; then
+    $LOG_ERR service not enabled in /etc/config/$NAME
+    exit 1
+  fi
+
+  config_get_bool log_stderr general log_stderr 1
+  config_get_bool log_stdout general log_stdout 1
+
+  config_get options general options
+
+  procd_open_instance
+  procd_set_param command $COMMAND
+  procd_append_param command $options
+  # forward stderr to logd
+  procd_set_param stderr $log_stderr
+  # same for stdout
+  procd_set_param stdout $log_stdout
+  procd_close_instance
+}
diff --git a/net/coturn/patches/01-includes.patch b/net/coturn/patches/01-includes.patch
new file mode 100644 (file)
index 0000000..9cd7a7c
--- /dev/null
@@ -0,0 +1,9 @@
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -1,5 +1,5 @@
+-LIBEVENT_INCLUDE = -I${PREFIX}/include/ -I/usr/local/include/
++LIBEVENT_INCLUDE =
+ INCFLAGS = -Isrc -Isrc/apps/common -Isrc/server -Isrc/client -Isrc/client++ ${LIBEVENT_INCLUDE} 
diff --git a/net/coturn/patches/02-fix-flags-dupes.patch b/net/coturn/patches/02-fix-flags-dupes.patch
new file mode 100644 (file)
index 0000000..eb12cb7
--- /dev/null
@@ -0,0 +1,14 @@
+--- a/configure
++++ b/configure
+@@ -1034,9 +1034,9 @@ ${ECHO_CMD} "# Generated by configure sc
+ ${ECHO_CMD} "#################################" >> Makefile
+ ${ECHO_CMD} "ECHO_CMD = ${ECHO_CMD}" >> Makefile
+ ${ECHO_CMD} "CC = ${CC}" >> Makefile
+-${ECHO_CMD} "LDFLAGS += ${OSLIBS}" >> Makefile
++${ECHO_CMD} "LDFLAGS = ${OSLIBS}" >> Makefile
+ ${ECHO_CMD} "DBLIBS += ${DBLIBS}" >> Makefile
+-${ECHO_CMD} "CFLAGS += ${OSCFLAGS}" >> Makefile
++${ECHO_CMD} "CFLAGS = ${OSCFLAGS}" >> Makefile
+ ${ECHO_CMD} "CPPFLAGS = ${CPPFLAGS}" >> Makefile
+ ${ECHO_CMD} "DBCFLAGS += ${DBCFLAGS} ${TURN_NO_PQ} ${TURN_NO_MYSQL} ${TURN_NO_SQLITE} ${TURN_NO_MONGO} ${TURN_NO_HIREDIS} ${TURN_NO_SYSTEMD}" >> Makefile
+ ${ECHO_CMD} "#" >> Makefile
diff --git a/net/coturn/patches/03-fix-libmariadb-detection.patch b/net/coturn/patches/03-fix-libmariadb-detection.patch
new file mode 100644 (file)
index 0000000..aa81ecb
--- /dev/null
@@ -0,0 +1,11 @@
+--- a/configure
++++ b/configure
+@@ -931,7 +931,7 @@ fi
+ ###########################
+ if [ -z "${TURN_NO_MYSQL}" ] ; then
+-    if testpkg_db mariadb || testpkg_db mysqlclient ; then
++    if testpkg_db libmariadb || testpkg_db mysqlclient ; then
+         ${ECHO_CMD} "MySQL found."
+     else
+         ${ECHO_CMD} "MySQL not found. Building without MySQL support."