3 files changed, 77 insertions, 0 deletions
diff --git a/net-misc/vde/files/vde-2.3.2-format-security.patch b/net-misc/vde/files/vde-2.3.2-format-security.patch
new file mode 100644
index 000000000000..d1cfaa58cb2f
--- /dev/null
+++ b/net-misc/vde/files/vde-2.3.2-format-security.patch
@@ -0,0 +1,18 @@
+--- a/src/common/cmdparse.c	2017-09-20 18:47:31.662856695 -0400
++++ b/src/common/cmdparse.c	2017-09-20 18:48:54.008852141 -0400
+@@ -284,13 +284,13 @@
+ 								int i;
+ 								for (i=0;i<argc;i++) {
+ 									if (i) fprintf(mf," ");
+-									fprintf(mf,argv[i]);
++									fprintf(mf,"%s",argv[i]);
+ 								}
+ 							} else {
+ 								int num=atoi(t);
+ 								while (*t >='0' && *t <= '9') t++;
+ 								if (num < argc) 
+-									fprintf(mf,argv[num]);
++									fprintf(mf,"%s",argv[num]);
+ 							}
+ 						} else
+ 							fprintf(mf,"%c",*t);
diff --git a/net-misc/vde/files/vde.conf-r1 b/net-misc/vde/files/vde.conf-r1
new file mode 100644
index 000000000000..856bde8ea2b0
--- /dev/null
+++ b/net-misc/vde/files/vde.conf-r1
@@ -0,0 +1,15 @@
+# load the tun module
+VDE_MODPROBE_TUN="yes"
+
+# virtual tap networking device to be used for vde
+VDE_TAP="tap0"
+
+# The group that will have access to the VDE control socket.
+VDE_GROUP="qemu"
+
+# VDE socket location (default: /run/${RC_SVCNAME}.ctl)
+VDE_SOCKET=""
+
+# Additional options passed to the vde_switch daemon.
+#VDE_OPTS=""
+VDE_OPTS=""
+\ No newline at end of file
diff --git a/net-misc/vde/files/vde.init-r1 b/net-misc/vde/files/vde.init-r1
new file mode 100644
index 000000000000..0934c51f8f48
--- /dev/null
+++ b/net-misc/vde/files/vde.init-r1
@@ -0,0 +1,44 @@
+#!/sbin/openrc-run
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+command="/usr/bin/vde_switch"
+pidfile="/run/${RC_SVCNAME}.pid"
+
+depend() {
+	after net.${VDE_TAP}
+}
+
+start_pre() {
+	[ "${VDE_MODPROBE_TUN}" = "yes" ] || return 0
+	modprobe tun
+}
+
+# We have to use start() because the shortform uses --pidfile for s-s-d --start
+# which causes s-s-d to check the pid file before it exists
+start() {
+	VDE_SOCKET="${VDE_SOCKET:-/run/${RC_SVCNAME}.ctl}"
+
+	ebegin "Starting ${SVC_NAME}"
+
+	start-stop-daemon --start --exec ${command} -- \
+		--pidfile=${pidfile} \
+		--tap=${VDE_TAP} \
+		--group=${VDE_GROUP} \
+		--mode=660 \
+		--dirmode=770 \
+		--sock=${VDE_SOCKET} \
+		--daemon \
+	${VDE_OPTS}
+	ewaitfile 10 "${VDE_SOCKET}"
+
+	eend $? "Failed to start ${RC_SVCNAME}"
+}
+
+stop_post() {
+	[ "${VDE_MODPROBE_TUN}" = "yes" ] && modprobe --quiet --remove tun
+
+	# Don't fail to stop the service if the "tun" module in use
+	# and the above "modprobe -r" command fails.
+	return 0
+}