From mboxrd@z Thu Jan 1 00:00:00 1970 From: Adolf Belka To: development@lists.ipfire.org Subject: Re: [PATCH 2/2] suricata: Update to 5.0.9 Date: Fri, 22 Apr 2022 23:31:56 +0200 Message-ID: <5fe12ad9-c7e6-28e1-d9a9-862f45f01124@ipfire.org> In-Reply-To: <20220422082148.22197-2-matthias.fischer@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4746230263350249483==" List-Id: --===============4746230263350249483== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Reviewed-by: Adolf Belka On 22/04/2022 10:21, Matthias Fischer wrote: > Changelog: > > "5.0.9 -- 2022-04-21 > > Security #4889: ftp: SEGV at flow cleanup due to protocol confusion > Security #5025: ftp: GetLine function buffers data indefinitely if 0x0a was= not found int the frag'd input > Security #5028: smtp: GetLine function buffers data indefinitely if 0x0a wa= s not found in the frag'd input > Security #5253: Infinite loop in JsonFTPLogger > Feature #4644: pthreads: set minimum stack size > Bug #4466: dataset file not written when run as user > Bug #4678: Configuration test mode succeeds when reference.config file cont= ains invalid content > Bug #4745: Absent app-layer protocol is always enabled by default > Bug #4819: tcp: insert_data_normal_fail can hit without triggering memcap > Bug #4823: conf: quadratic complexity > Bug #4825: pppoe decoder fails when protocol identity field is only 1 byte > Bug #4827: packetpool: packets in pool may have capture method ReleasePacke= t callbacks set > Bug #4838: af-packet: cluster_id is not used when trying to set fanout supp= ort > Bug #4878: datasets: memory leak in 5.0.x > Bug #4887: dnp3: buffer over read in logging base64 empty objects > Bug #4891: protodetect: SMB vs TLS protocol detection in midstream > Bug #4893: TFTP: memory leak due to missing detect state > Bug #4895: Memory leak with signature using file_data and NFS > Bug #4897: profiling: Invalid performance counter when using sampling > Bug #4901: eve: memory leak related to dns > Bug #4932: smtp: smtp transaction not logged if no email is present > Bug #4955: stream: too aggressive pruning in lossy streams > Bug #4957: SMTP assertion triggered > Bug #4959: suricatasc loop if recv returns no data > Bug #4961: dns: transaction not created when z-bit set > Bug #4963: Run stream reassembly on both directions upon receiving a FIN pa= cket > Bug #5058: dns: probing/parser can return error when it should return incom= plete > Bug #5063: Not keyword matches in Kerberos requests > Bug #5096: output: timestamp missing usecs on Arm 32bit + Musl > Bug #5099: htp: server personality radix handling issue > Bug #5101: defrag: policy config can setup radix incorrectly > Bug #5103: Application log cannot to be re-opened when running as non-root = user > Bug #5105: iprep: cidr support can set up radix incorrectly > Bug #5107: detect/iponly: rule parsing does not always apply netmask correc= tly > Bug #5109: swf: coverity warning > Bug #5115: detect/ip_proto: inconsistent behavior when specifying protocol = by string > Bug #5117: detect/iponly: mixing netblocks can lead to FN/FP > Bug #5119: smb: excessive CPU utilization and higher packet processing late= ncy due to excessive calls to Vec::extend_from_slice() > Bug #5137: smb: excessive memory use during file transfer > Bug #5150: nfs: Integer underflow in NFS > Bug #5157: xbits: noalert is allowed in rule language with other commands > Bug #5164: iprep: use_cnt can get desynchronized (SIGABRT) > Bug #5171: detect/iponly: non-cidr netmask settings can lead incorrect radi= x tree > Bug #5193: SSL : over allocation for certificates > Bug #5213: content:"22 2 22"; is parsed without error > Bug #5227: 5.0.x: SMB: Wrong buffer being checked for possible overflow. > Bug #5251: smb: integer underflows and overflows > Task #5006: libhtp 0.5.40" > > Additionally, I moved the 'suricata' patch files into a separate directory. > Apart from some line numbers, nothing else was changed. > > Signed-off-by: Matthias Fischer > --- > lfs/suricata | 12 ++++++------ > ...eam-tcp-Handle-retransmitted-SYN-with-TSval.patch | 2 +- > ...-5.0.8-fix-level1-cache-line-size-detection.patch | 2 +- > .../suricata-disable-sid-2210059.patch | 0 > 4 files changed, 8 insertions(+), 8 deletions(-) > rename src/patches/{ =3D> suricata}/suricata-5.0-stream-tcp-Handle-retran= smitted-SYN-with-TSval.patch (97%) > rename src/patches/{ =3D> suricata}/suricata-5.0.8-fix-level1-cache-line-= size-detection.patch (95%) > rename src/patches/{ =3D> suricata}/suricata-disable-sid-2210059.patch (1= 00%) > > diff --git a/lfs/suricata b/lfs/suricata > index 80e0923d3..4a9dcdb1d 100644 > --- a/lfs/suricata > +++ b/lfs/suricata > @@ -1,7 +1,7 @@ > #########################################################################= ###### > # = # > # IPFire.org - A linux based firewall = # > -# Copyright (C) 2007-2021 IPFire Team = # > +# Copyright (C) 2007-2022 IPFire Team = # > # = # > # This program is free software: you can redistribute it and/or modify = # > # it under the terms of the GNU General Public License as published by = # > @@ -24,7 +24,7 @@ > =20 > include Config > =20 > -VER =3D 5.0.8 > +VER =3D 5.0.9 > =20 > THISAPP =3D suricata-$(VER) > DL_FILE =3D $(THISAPP).tar.gz > @@ -40,7 +40,7 @@ objects =3D $(DL_FILE) > =20 > $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE) > =20 > -$(DL_FILE)_BLAKE2 =3D 5c13aea176b6666477c620d1ed294310ee84ec706abbc740a23d= 66722297c09b61f253bbe17700cd58f8ce439987c9b13f312aba37d911b6522e4848e7c1b0cd > +$(DL_FILE)_BLAKE2 =3D 02ab99585233a47b1577e55060ba1141c339718e5bd39b6f4d38= bb9384fd459aae353f313083048128507f9023a8bcfea3e5a5bcc9ea0c75cfc9c288ca9db6b6 > =20 > install : $(TARGET) > =20 > @@ -70,9 +70,9 @@ $(subst %,%_BLAKE2,$(objects)) : > $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) > @$(PREBUILD) > @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) > - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata-5.0-stream-= tcp-Handle-retransmitted-SYN-with-TSval.patch > - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata-disable-sid= -2210059.patch > - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata-5.0.8-fix-l= evel1-cache-line-size-detection.patch > + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-5.= 0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch > + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-di= sable-sid-2210059.patch > + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-5.= 0.8-fix-level1-cache-line-size-detection.patch > cd $(DIR_APP) && LDFLAGS=3D"$(LDFLAGS)" ./configure \ > --prefix=3D/usr \ > --sysconfdir=3D/etc \ > diff --git a/src/patches/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-w= ith-TSval.patch b/src/patches/suricata/suricata-5.0-stream-tcp-Handle-retrans= mitted-SYN-with-TSval.patch > similarity index 97% > rename from src/patches/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-wi= th-TSval.patch > rename to src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted= -SYN-with-TSval.patch > index fcea77cfa..6bc745a0f 100644 > --- a/src/patches/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSv= al.patch > +++ b/src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted-SYN= -with-TSval.patch > @@ -26,7 +26,7 @@ diff --git a/src/stream-tcp.c b/src/stream-tcp.c > index 1cff19fa5..af681760b 100644 > --- a/src/stream-tcp.c > +++ b/src/stream-tcp.c > -@@ -1643,6 +1643,23 @@ static int StreamTcpPacketStateSynSent(ThreadVars *= tv, Packet *p, > +@@ -1641,6 +1641,23 @@ static int StreamTcpPacketStateSynSent(ThreadVars *= tv, Packet *p, > "ssn->client.last_ack %"PRIu32"", ssn, > ssn->client.isn, ssn->client.next_seq, > ssn->client.last_ack); > diff --git a/src/patches/suricata-5.0.8-fix-level1-cache-line-size-detectio= n.patch b/src/patches/suricata/suricata-5.0.8-fix-level1-cache-line-size-dete= ction.patch > similarity index 95% > rename from src/patches/suricata-5.0.8-fix-level1-cache-line-size-detection= .patch > rename to src/patches/suricata/suricata-5.0.8-fix-level1-cache-line-size-de= tection.patch > index a6747a2a7..68a21f1e9 100644 > --- a/src/patches/suricata-5.0.8-fix-level1-cache-line-size-detection.patch > +++ b/src/patches/suricata/suricata-5.0.8-fix-level1-cache-line-size-detect= ion.patch > @@ -2,7 +2,7 @@ diff --git a/configure.ac b/configure.ac > index d56d3a550..81abf8f00 100644 > --- a/configure.ac > +++ b/configure.ac > -@@ -2313,7 +2313,7 @@ fi > +@@ -2318,7 +2318,7 @@ fi > AC_PATH_PROG(HAVE_GETCONF_CMD, getconf, "no") > if test "$HAVE_GETCONF_CMD" !=3D "no"; then > CLS=3D$(getconf LEVEL1_DCACHE_LINESIZE) > diff --git a/src/patches/suricata-disable-sid-2210059.patch b/src/patches/s= uricata/suricata-disable-sid-2210059.patch > similarity index 100% > rename from src/patches/suricata-disable-sid-2210059.patch > rename to src/patches/suricata/suricata-disable-sid-2210059.patch --===============4746230263350249483==--