Thu Nov 13 09:45:47 2014 UTC ()
Backport upstream commit to fix CVE-2014-8760. Bump PKGREVISION.


(fhajny)
diff -r1.46 -r1.47 pkgsrc/chat/ejabberd/Makefile
diff -r1.27 -r1.28 pkgsrc/chat/ejabberd/distinfo
diff -r0 -r1.1 pkgsrc/chat/ejabberd/patches/patch-src_ejabberd__c2s.erl
cvs diff -r1.46 -r1.47 pkgsrc/chat/ejabberd/Makefile (expand / switch to unified diff)

--- pkgsrc/chat/ejabberd/Makefile 2014/10/16 12:47:59 1.46
+++ pkgsrc/chat/ejabberd/Makefile 2014/11/13 09:45:47 1.47
@@ -1,17 +1,17 @@ @@ -1,17 +1,17 @@
1# $NetBSD: Makefile,v 1.46 2014/10/16 12:47:59 fhajny Exp $ 1# $NetBSD: Makefile,v 1.47 2014/11/13 09:45:47 fhajny Exp $
2 2
3DISTNAME= ejabberd-14.07 3DISTNAME= ejabberd-14.07
4PKGREVISION= 3 4PKGREVISION= 4
5CATEGORIES= chat 5CATEGORIES= chat
6MASTER_SITES= http://www.process-one.net/downloads/ejabberd/${PKGVERSION_NOREV}/ 6MASTER_SITES= http://www.process-one.net/downloads/ejabberd/${PKGVERSION_NOREV}/
7EXTRACT_SUFX= .tgz 7EXTRACT_SUFX= .tgz
8 8
9DISTFILES+= ${DEFAULT_DISTFILES} ${DISTNAME}-deps.tar.gz 9DISTFILES+= ${DEFAULT_DISTFILES} ${DISTNAME}-deps.tar.gz
10SITES.${DISTNAME}-deps.tar.gz= ftp://ftp.NetBSD.org/pub/NetBSD/misc/fhajny/ 10SITES.${DISTNAME}-deps.tar.gz= ftp://ftp.NetBSD.org/pub/NetBSD/misc/fhajny/
11 11
12MAINTAINER= pkgsrc-users@NetBSD.org 12MAINTAINER= pkgsrc-users@NetBSD.org
13HOMEPAGE= http://www.ejabberd.im/ 13HOMEPAGE= http://www.ejabberd.im/
14COMMENT= Free and Open Source distributed fault-tolerant Jabber server 14COMMENT= Free and Open Source distributed fault-tolerant Jabber server
15LICENSE= gnu-gpl-v2 15LICENSE= gnu-gpl-v2
16 16
17BUILD_DEPENDS+= git-base>=1.5:../../devel/git-base 17BUILD_DEPENDS+= git-base>=1.5:../../devel/git-base
cvs diff -r1.27 -r1.28 pkgsrc/chat/ejabberd/distinfo (expand / switch to unified diff)

--- pkgsrc/chat/ejabberd/distinfo 2014/10/16 12:47:59 1.27
+++ pkgsrc/chat/ejabberd/distinfo 2014/11/13 09:45:47 1.28
@@ -1,13 +1,14 @@ @@ -1,13 +1,14 @@
1$NetBSD: distinfo,v 1.27 2014/10/16 12:47:59 fhajny Exp $ 1$NetBSD: distinfo,v 1.28 2014/11/13 09:45:47 fhajny Exp $
2 2
3SHA1 (ejabberd-14.07-deps.tar.gz) = 102a78c428fe587d57385c66a11cc731d2ec434e 3SHA1 (ejabberd-14.07-deps.tar.gz) = 102a78c428fe587d57385c66a11cc731d2ec434e
4RMD160 (ejabberd-14.07-deps.tar.gz) = 02c28e5a0c234800811d8ff24ca6afab4d3d0eec 4RMD160 (ejabberd-14.07-deps.tar.gz) = 02c28e5a0c234800811d8ff24ca6afab4d3d0eec
5Size (ejabberd-14.07-deps.tar.gz) = 8797259 bytes 5Size (ejabberd-14.07-deps.tar.gz) = 8797259 bytes
6SHA1 (ejabberd-14.07.tgz) = 321b28faedbc28f80664d4b301424b118dd0bad0 6SHA1 (ejabberd-14.07.tgz) = 321b28faedbc28f80664d4b301424b118dd0bad0
7RMD160 (ejabberd-14.07.tgz) = 6df710abe3a73746939930790623d65009c2b83f 7RMD160 (ejabberd-14.07.tgz) = 6df710abe3a73746939930790623d65009c2b83f
8Size (ejabberd-14.07.tgz) = 3200975 bytes 8Size (ejabberd-14.07.tgz) = 3200975 bytes
9SHA1 (patch-aa) = f573f541ae6963acffa5a470a290874b3312b787 9SHA1 (patch-aa) = f573f541ae6963acffa5a470a290874b3312b787
10SHA1 (patch-ad) = cdd7a61333f3206ac3ae9168b1878a059da25988 10SHA1 (patch-ad) = cdd7a61333f3206ac3ae9168b1878a059da25988
11SHA1 (patch-ae) = 542ac36eecc4b679dded78e56903686060fd643a 11SHA1 (patch-ae) = 542ac36eecc4b679dded78e56903686060fd643a
12SHA1 (patch-configure) = 8cf03f571ef13ed825b445e0f1664d387895b8fe 12SHA1 (patch-configure) = 8cf03f571ef13ed825b445e0f1664d387895b8fe
13SHA1 (patch-deps_p1__iconv_rebar.config) = e9252229695195ebfe5aeea7ef3ef2c6cd95bc02 13SHA1 (patch-deps_p1__iconv_rebar.config) = e9252229695195ebfe5aeea7ef3ef2c6cd95bc02
 14SHA1 (patch-src_ejabberd__c2s.erl) = f9b8a00e1d5f85134cce8bb9b770d1e41a29b906
File Added: pkgsrc/chat/ejabberd/patches/Attic/patch-src_ejabberd__c2s.erl
$NetBSD: patch-src_ejabberd__c2s.erl,v 1.1 2014/11/13 09:45:47 fhajny Exp $

Backport upstream commit to fix CVE-2014-8760
--- src/ejabberd_c2s.erl.orig	2014-07-22 15:42:49.000000000 +0000
+++ src/ejabberd_c2s.erl
@@ -718,7 +718,7 @@ wait_for_feature_request({xmlstreameleme
 	(StateData#state.sockmod):get_sockmod(StateData#state.socket),
     case {xml:get_attr_s(<<"xmlns">>, Attrs), Name} of
       {?NS_SASL, <<"auth">>}
-	  when not ((SockMod == gen_tcp) and TLSRequired) ->
+	  when TLSEnabled or not TLSRequired ->
 	  Mech = xml:get_attr_s(<<"mechanism">>, Attrs),
 	  ClientIn = jlib:decode_base64(xml:get_cdata(Els)),
 	  case cyrsasl:server_start(StateData#state.sasl_state,
@@ -832,7 +832,7 @@ wait_for_feature_request({xmlstreameleme
 		end
 	  end;
       _ ->
-	  if (SockMod == gen_tcp) and TLSRequired ->
+	  if TLSRequired and not TLSEnabled ->
 		 Lang = StateData#state.lang,
 		 send_element(StateData,
 			      ?POLICY_VIOLATION_ERR(Lang,