Development November 2016

development@lists.ipfire.org

8 participants
25 discussions

[PATCH 0/6] Update ffmepg and the packages that use it
by Marcel Lorenz 14 Mar '17

14 Mar '17

The next series of patches updates ffmpeg an all packges they wont build after update ffmpeg. ffmpeg and ffmpeg-libs: update 3.1.4 motion: update to 4.0.1 xvid: update to 1.3.4 minidlna: update to 1.1.5 apcupsd: update to 3.14.14 mpd: update to 0.19.19 -- 2.9.3

3 17

[PATCH] openssh: Update to 7.3p1.
by Stefan Schantl 27 Feb '17

27 Feb '17

This is a major update to the latest stable version of OpenSSH. * Drop not longer required patches. * Drop SElinux support. Fixes #11218. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- openssh/openssh.nm | 8 +- openssh/patches/openssh-6.7p1-audit.patch | 2332 -------------------- .../patches/openssh-6.7p1-seccomp-aarch64.patch | 66 - 3 files changed, 3 insertions(+), 2403 deletions(-) delete mode 100644 openssh/patches/openssh-6.7p1-audit.patch delete mode 100644 openssh/patches/openssh-6.7p1-seccomp-aarch64.patch diff --git a/openssh/openssh.nm b/openssh/openssh.nm index 8489438..2e8de76 100644 --- a/openssh/openssh.nm +++ b/openssh/openssh.nm @@ -4,8 +4,8 @@ ############################################################################### name = openssh -version = 6.8p1 -release = 2 +version = 7.3p1 +release = 1 groups = Application/Internet url = http://www.openssh.com/portable.html @@ -28,10 +28,9 @@ build automake groff libedit-devel - libselinux-devel ncurses-devel openldap-devel - openssl-devel >= 1.0.0d-2 + openssl-devel >= 1.0.2 pam-devel util-linux zlib-devel @@ -51,7 +50,6 @@ build --with-ipaddr-display \ --with-pam \ --with-libedit \ - --with-selinux \ --with-audit=linux prepare_cmds diff --git a/openssh/patches/openssh-6.7p1-audit.patch b/openssh/patches/openssh-6.7p1-audit.patch deleted file mode 100644 index 213ca67..0000000 --- a/openssh/patches/openssh-6.7p1-audit.patch +++ /dev/null @@ -1,2332 +0,0 @@ -diff -up openssh-6.8p1/Makefile.in.audit openssh-6.8p1/Makefile.in ---- openssh-6.8p1/Makefile.in.audit 2015-03-20 13:41:15.065883826 +0100 -+++ openssh-6.8p1/Makefile.in 2015-03-20 13:41:15.100883769 +0100 -@@ -98,7 +98,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ - sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o blocks.o \ - kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \ - kexdhc.o kexgexc.o kexecdhc.o kexc25519c.o \ -- kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o -+ kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o auditstub.o - - SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \ - sshconnect.o sshconnect1.o sshconnect2.o mux.o \ -diff -up openssh-6.8p1/audit-bsm.c.audit openssh-6.8p1/audit-bsm.c ---- openssh-6.8p1/audit-bsm.c.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/audit-bsm.c 2015-03-20 13:41:15.092883782 +0100 -@@ -375,10 +375,23 @@ audit_connection_from(const char *host, - #endif - } - --void -+int - audit_run_command(const char *command) - { - /* not implemented */ -+ return 0; -+} -+ -+void -+audit_end_command(int handle, const char *command) -+{ -+ /* not implemented */ -+} -+ -+void -+audit_count_session_open(void) -+{ -+ /* not necessary */ - } - - void -@@ -393,6 +406,12 @@ audit_session_close(struct logininfo *li) - /* not implemented */ - } - -+int -+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv) -+{ -+ /* not implemented */ -+} -+ - void - audit_event(ssh_audit_event_t event) - { -@@ -454,4 +473,40 @@ audit_event(ssh_audit_event_t event) - debug("%s: unhandled event %d", __func__, event); - } - } -+ -+void -+audit_unsupported_body(int what) -+{ -+ /* not implemented */ -+} -+ -+void -+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid, uid_t uid) -+{ -+ /* not implemented */ -+} -+ -+void -+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid) -+{ -+ /* not implemented */ -+} -+ -+void -+audit_destroy_sensitive_data(const char *fp) -+{ -+ /* not implemented */ -+} -+ -+void -+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid) -+{ -+ /* not implemented */ -+} -+ -+void -+audit_generate_ephemeral_server_key(const char *fp) -+{ -+ /* not implemented */ -+} - #endif /* BSM */ -diff -up openssh-6.8p1/audit-linux.c.audit openssh-6.8p1/audit-linux.c ---- openssh-6.8p1/audit-linux.c.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/audit-linux.c 2015-03-20 13:41:15.093883780 +0100 -@@ -35,13 +35,25 @@ - - #include "log.h" - #include "audit.h" -+#include "key.h" -+#include "hostfile.h" -+#include "auth.h" -+#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */ -+#include "servconf.h" - #include "canohost.h" -+#include "packet.h" -+#include "cipher.h" - -+#define AUDIT_LOG_SIZE 256 -+ -+extern ServerOptions options; -+extern Authctxt *the_authctxt; -+extern u_int utmp_len; - const char* audit_username(void); - --int --linux_audit_record_event(int uid, const char *username, -- const char *hostname, const char *ip, const char *ttyn, int success) -+static void -+linux_audit_user_logxxx(int uid, const char *username, -+ const char *hostname, const char *ip, const char *ttyn, int success, int event) - { - int audit_fd, rc, saved_errno; - -@@ -49,11 +61,11 @@ linux_audit_record_event(int uid, const char *username, - if (audit_fd < 0) { - if (errno == EINVAL || errno == EPROTONOSUPPORT || - errno == EAFNOSUPPORT) -- return 1; /* No audit support in kernel */ -+ return; /* No audit support in kernel */ - else -- return 0; /* Must prevent login */ -+ goto fatal_report; /* Must prevent login */ - } -- rc = audit_log_acct_message(audit_fd, AUDIT_USER_LOGIN, -+ rc = audit_log_acct_message(audit_fd, event, - NULL, "login", username ? username : "(unknown)", - username == NULL ? uid : -1, hostname, ip, ttyn, success); - saved_errno = errno; -@@ -65,35 +77,154 @@ linux_audit_record_event(int uid, const char *username, - if ((rc == -EPERM) && (geteuid() != 0)) - rc = 0; - errno = saved_errno; -- return (rc >= 0); -+ if (rc < 0) { -+fatal_report: -+ fatal("linux_audit_write_entry failed: %s", strerror(errno)); -+ } - } - -+static void -+linux_audit_user_auth(int uid, const char *username, -+ const char *hostname, const char *ip, const char *ttyn, int success, int event) -+{ -+ int audit_fd, rc, saved_errno; -+ static const char *event_name[] = { -+ "maxtries exceeded", -+ "root denied", -+ "success", -+ "none", -+ "password", -+ "challenge-response", -+ "pubkey", -+ "hostbased", -+ "gssapi", -+ "invalid user", -+ "nologin", -+ "connection closed", -+ "connection abandoned", -+ "unknown" -+ }; -+ -+ audit_fd = audit_open(); -+ if (audit_fd < 0) { -+ if (errno == EINVAL || errno == EPROTONOSUPPORT || -+ errno == EAFNOSUPPORT) -+ return; /* No audit support in kernel */ -+ else -+ goto fatal_report; /* Must prevent login */ -+ } -+ -+ if ((event < 0) || (event > SSH_AUDIT_UNKNOWN)) -+ event = SSH_AUDIT_UNKNOWN; -+ -+ rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, -+ NULL, event_name[event], username ? username : "(unknown)", -+ username == NULL ? uid : -1, hostname, ip, ttyn, success); -+ saved_errno = errno; -+ close(audit_fd); -+ /* -+ * Do not report error if the error is EPERM and sshd is run as non -+ * root user. -+ */ -+ if ((rc == -EPERM) && (geteuid() != 0)) -+ rc = 0; -+ errno = saved_errno; -+ if (rc < 0) { -+fatal_report: -+ fatal("linux_audit_write_entry failed: %s", strerror(errno)); -+ } -+} -+ -+int -+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv) -+{ -+ char buf[AUDIT_LOG_SIZE]; -+ int audit_fd, rc, saved_errno; -+ -+ audit_fd = audit_open(); -+ if (audit_fd < 0) { -+ if (errno == EINVAL || errno == EPROTONOSUPPORT || -+ errno == EAFNOSUPPORT) -+ return 1; /* No audit support in kernel */ -+ else -+ return 0; /* Must prevent login */ -+ } -+ snprintf(buf, sizeof(buf), "%s_auth rport=%d", host_user ? "pubkey" : "hostbased", get_remote_port()); -+ rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL, -+ buf, audit_username(), -1, NULL, get_remote_ipaddr(), NULL, rv); -+ if ((rc < 0) && ((rc != -1) || (getuid() == 0))) -+ goto out; -+ /* is the fingerprint_prefix() still needed? -+ snprintf(buf, sizeof(buf), "key algo=%s size=%d fp=%s%s rport=%d", -+ type, bits, sshkey_fingerprint_prefix(), fp, get_remote_port()); -+ */ -+ snprintf(buf, sizeof(buf), "key algo=%s size=%d fp=%s rport=%d", -+ type, bits, fp, get_remote_port()); -+ rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL, -+ buf, audit_username(), -1, NULL, get_remote_ipaddr(), NULL, rv); -+out: -+ saved_errno = errno; -+ audit_close(audit_fd); -+ errno = saved_errno; -+ /* do not report error if the error is EPERM and sshd is run as non root user */ -+ return (rc >= 0) || ((rc == -EPERM) && (getuid() != 0)); -+} -+ -+static int user_login_count = 0; -+ - /* Below is the sshd audit API code */ - - void - audit_connection_from(const char *host, int port) - { --} - /* not implemented */ -+} - --void -+int - audit_run_command(const char *command) - { -- /* not implemented */ -+ if (!user_login_count++) -+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns), -+ NULL, "ssh", 1, AUDIT_USER_LOGIN); -+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns), -+ NULL, "ssh", 1, AUDIT_USER_START); -+ return 0; -+} -+ -+void -+audit_end_command(int handle, const char *command) -+{ -+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns), -+ NULL, "ssh", 1, AUDIT_USER_END); -+ if (user_login_count && !--user_login_count) -+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns), -+ NULL, "ssh", 1, AUDIT_USER_LOGOUT); -+} -+ -+void -+audit_count_session_open(void) -+{ -+ user_login_count++; - } - - void - audit_session_open(struct logininfo *li) - { -- if (linux_audit_record_event(li->uid, NULL, li->hostname, -- NULL, li->line, 1) == 0) -- fatal("linux_audit_write_entry failed: %s", strerror(errno)); -+ if (!user_login_count++) -+ linux_audit_user_logxxx(li->uid, NULL, li->hostname, -+ NULL, li->line, 1, AUDIT_USER_LOGIN); -+ linux_audit_user_logxxx(li->uid, NULL, li->hostname, -+ NULL, li->line, 1, AUDIT_USER_START); - } - - void - audit_session_close(struct logininfo *li) - { -- /* not implemented */ -+ linux_audit_user_logxxx(li->uid, NULL, li->hostname, -+ NULL, li->line, 1, AUDIT_USER_END); -+ if (user_login_count && !--user_login_count) -+ linux_audit_user_logxxx(li->uid, NULL, li->hostname, -+ NULL, li->line, 1, AUDIT_USER_LOGOUT); - } - - void -@@ -101,21 +232,43 @@ audit_event(ssh_audit_event_t event) - { - switch(event) { - case SSH_AUTH_SUCCESS: -- case SSH_CONNECTION_CLOSE: -+ linux_audit_user_auth(-1, audit_username(), NULL, -+ get_remote_ipaddr(), "ssh", 1, event); -+ break; -+ - case SSH_NOLOGIN: -- case SSH_LOGIN_EXCEED_MAXTRIES: - case SSH_LOGIN_ROOT_DENIED: -+ linux_audit_user_auth(-1, audit_username(), NULL, -+ get_remote_ipaddr(), "ssh", 0, event); -+ linux_audit_user_logxxx(-1, audit_username(), NULL, -+ get_remote_ipaddr(), "ssh", 0, AUDIT_USER_LOGIN); - break; - -+ case SSH_LOGIN_EXCEED_MAXTRIES: - case SSH_AUTH_FAIL_NONE: - case SSH_AUTH_FAIL_PASSWD: - case SSH_AUTH_FAIL_KBDINT: - case SSH_AUTH_FAIL_PUBKEY: - case SSH_AUTH_FAIL_HOSTBASED: - case SSH_AUTH_FAIL_GSSAPI: -+ linux_audit_user_auth(-1, audit_username(), NULL, -+ get_remote_ipaddr(), "ssh", 0, event); -+ break; -+ -+ case SSH_CONNECTION_CLOSE: -+ if (user_login_count) { -+ while (user_login_count--) -+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns), -+ NULL, "ssh", 1, AUDIT_USER_END); -+ linux_audit_user_logxxx(the_authctxt->pw->pw_uid, NULL, get_remote_name_or_ip(utmp_len, options.use_dns), -+ NULL, "ssh", 1, AUDIT_USER_LOGOUT); -+ } -+ break; -+ -+ case SSH_CONNECTION_ABANDON: - case SSH_INVALID_USER: -- linux_audit_record_event(-1, audit_username(), NULL, -- get_remote_ipaddr(), "sshd", 0); -+ linux_audit_user_logxxx(-1, audit_username(), NULL, -+ get_remote_ipaddr(), "ssh", 0, AUDIT_USER_LOGIN); - break; - - default: -@@ -123,4 +276,135 @@ audit_event(ssh_audit_event_t event) - } - } - -+void -+audit_unsupported_body(int what) -+{ -+#ifdef AUDIT_CRYPTO_SESSION -+ char buf[AUDIT_LOG_SIZE]; -+ const static char *name[] = { "cipher", "mac", "comp" }; -+ char *s; -+ int audit_fd; -+ -+ snprintf(buf, sizeof(buf), "op=unsupported-%s direction=? cipher=? ksize=? rport=%d laddr=%s lport=%d ", -+ name[what], get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())), -+ get_local_port()); -+ free(s); -+ audit_fd = audit_open(); -+ if (audit_fd < 0) -+ /* no problem, the next instruction will be fatal() */ -+ return; -+ audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION, -+ buf, NULL, get_remote_ipaddr(), NULL, 0); -+ audit_close(audit_fd); -+#endif -+} -+ -+const static char *direction[] = { "from-server", "from-client", "both" }; -+ -+void -+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid, -+ uid_t uid) -+{ -+#ifdef AUDIT_CRYPTO_SESSION -+ char buf[AUDIT_LOG_SIZE]; -+ int audit_fd, audit_ok; -+ const Cipher *cipher = cipher_by_name(enc); -+ char *s; -+ -+ snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d mac=%s pfs=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ", -+ direction[ctos], enc, cipher ? 8 * cipher->key_len : 0, mac, pfs, -+ (intmax_t)pid, (intmax_t)uid, -+ get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())), get_local_port()); -+ free(s); -+ audit_fd = audit_open(); -+ if (audit_fd < 0) { -+ if (errno == EINVAL || errno == EPROTONOSUPPORT || -+ errno == EAFNOSUPPORT) -+ return; /* No audit support in kernel */ -+ else -+ fatal("cannot open audit"); /* Must prevent login */ -+ } -+ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION, -+ buf, NULL, get_remote_ipaddr(), NULL, 1); -+ audit_close(audit_fd); -+ /* do not abort if the error is EPERM and sshd is run as non root user */ -+ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0))) -+ fatal("cannot write into audit"); /* Must prevent login */ -+#endif -+} -+ -+void -+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid) -+{ -+ char buf[AUDIT_LOG_SIZE]; -+ int audit_fd, audit_ok; -+ char *s; -+ -+ snprintf(buf, sizeof(buf), "op=destroy kind=session fp=? direction=%s spid=%jd suid=%jd rport=%d laddr=%s lport=%d ", -+ direction[ctos], (intmax_t)pid, (intmax_t)uid, -+ get_remote_port(), -+ (s = get_local_ipaddr(packet_get_connection_in())), -+ get_local_port()); -+ free(s); -+ audit_fd = audit_open(); -+ if (audit_fd < 0) { -+ if (errno != EINVAL && errno != EPROTONOSUPPORT && -+ errno != EAFNOSUPPORT) -+ error("cannot open audit"); -+ return; -+ } -+ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER, -+ buf, NULL, get_remote_ipaddr(), NULL, 1); -+ audit_close(audit_fd); -+ /* do not abort if the error is EPERM and sshd is run as non root user */ -+ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0))) -+ error("cannot write into audit"); -+} -+ -+void -+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid) -+{ -+ char buf[AUDIT_LOG_SIZE]; -+ int audit_fd, audit_ok; -+ -+ snprintf(buf, sizeof(buf), "op=destroy kind=server fp=%s direction=? spid=%jd suid=%jd ", -+ fp, (intmax_t)pid, (intmax_t)uid); -+ audit_fd = audit_open(); -+ if (audit_fd < 0) { -+ if (errno != EINVAL && errno != EPROTONOSUPPORT && -+ errno != EAFNOSUPPORT) -+ error("cannot open audit"); -+ return; -+ } -+ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER, -+ buf, NULL, -+ listening_for_clients() ? get_remote_ipaddr() : NULL, -+ NULL, 1); -+ audit_close(audit_fd); -+ /* do not abort if the error is EPERM and sshd is run as non root user */ -+ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0))) -+ error("cannot write into audit"); -+} -+ -+void -+audit_generate_ephemeral_server_key(const char *fp) -+{ -+ char buf[AUDIT_LOG_SIZE]; -+ int audit_fd, audit_ok; -+ -+ snprintf(buf, sizeof(buf), "op=create kind=server fp=%s direction=? ", fp); -+ audit_fd = audit_open(); -+ if (audit_fd < 0) { -+ if (errno != EINVAL && errno != EPROTONOSUPPORT && -+ errno != EAFNOSUPPORT) -+ error("cannot open audit"); -+ return; -+ } -+ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER, -+ buf, NULL, 0, NULL, 1); -+ audit_close(audit_fd); -+ /* do not abort if the error is EPERM and sshd is run as non root user */ -+ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0))) -+ error("cannot write into audit"); -+} - #endif /* USE_LINUX_AUDIT */ -diff -up openssh-6.8p1/audit.c.audit openssh-6.8p1/audit.c ---- openssh-6.8p1/audit.c.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/audit.c 2015-03-20 13:41:15.093883780 +0100 -@@ -28,6 +28,7 @@ - - #include <stdarg.h> - #include <string.h> -+#include <unistd.h> - - #ifdef SSH_AUDIT_EVENTS - -@@ -36,6 +37,11 @@ - #include "key.h" - #include "hostfile.h" - #include "auth.h" -+#include "ssh-gss.h" -+#include "monitor_wrap.h" -+#include "xmalloc.h" -+#include "misc.h" -+#include "servconf.h" - - /* - * Care must be taken when using this since it WILL NOT be initialized when -@@ -43,6 +49,7 @@ - * audit_event(CONNECTION_ABANDON) is called. Test for NULL before using. - */ - extern Authctxt *the_authctxt; -+extern ServerOptions options; - - /* Maybe add the audit class to struct Authmethod? */ - ssh_audit_event_t -@@ -71,13 +78,10 @@ audit_classify_auth(const char *method) - const char * - audit_username(void) - { -- static const char unknownuser[] = "(unknown user)"; -- static const char invaliduser[] = "(invalid user)"; -+ static const char unknownuser[] = "(unknown)"; - -- if (the_authctxt == NULL || the_authctxt->user == NULL) -+ if (the_authctxt == NULL || the_authctxt->user == NULL || !the_authctxt->valid) - return (unknownuser); -- if (!the_authctxt->valid) -- return (invaliduser); - return (the_authctxt->user); - } - -@@ -111,6 +115,40 @@ audit_event_lookup(ssh_audit_event_t ev) - return(event_lookup[i].name); - } - -+void -+audit_key(int host_user, int *rv, const Key *key) -+{ -+ char *fp; -+ const char *crypto_name; -+ -+ fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX); -+ if (key->type == KEY_RSA1) -+ crypto_name = "ssh-rsa1"; -+ else -+ crypto_name = key_ssh_name(key); -+ if (audit_keyusage(host_user, crypto_name, key_size(key), fp, *rv) == 0) -+ *rv = 0; -+ free(fp); -+} -+ -+void -+audit_unsupported(int what) -+{ -+ PRIVSEP(audit_unsupported_body(what)); -+} -+ -+void -+audit_kex(int ctos, char *enc, char *mac, char *comp, char *pfs) -+{ -+ PRIVSEP(audit_kex_body(ctos, enc, mac, comp, pfs, getpid(), getuid())); -+} -+ -+void -+audit_session_key_free(int ctos) -+{ -+ PRIVSEP(audit_session_key_free_body(ctos, getpid(), getuid())); -+} -+ - # ifndef CUSTOM_SSH_AUDIT_EVENTS - /* - * Null implementations of audit functions. -@@ -140,6 +178,17 @@ audit_event(ssh_audit_event_t event) - } - - /* -+ * Called when a child process has called, or will soon call, -+ * audit_session_open. -+ */ -+void -+audit_count_session_open(void) -+{ -+ debug("audit count session open euid %d user %s", geteuid(), -+ audit_username()); -+} -+ -+/* - * Called when a user session is started. Argument is the tty allocated to - * the session, or NULL if no tty was allocated. - * -@@ -174,13 +223,91 @@ audit_session_close(struct logininfo *li) - /* - * This will be called when a user runs a non-interactive command. Note that - * it may be called multiple times for a single connection since SSH2 allows -- * multiple sessions within a single connection. -+ * multiple sessions within a single connection. Returns a "handle" for -+ * audit_end_command. - */ --void -+int - audit_run_command(const char *command) - { - debug("audit run command euid %d user %s command '%.200s'", geteuid(), - audit_username(), command); -+ return 0; -+} -+ -+/* -+ * This will be called when the non-interactive command finishes. Note that -+ * it may be called multiple times for a single connection since SSH2 allows -+ * multiple sessions within a single connection. "handle" should come from -+ * the corresponding audit_run_command. -+ */ -+void -+audit_end_command(int handle, const char *command) -+{ -+ debug("audit end nopty exec euid %d user %s command '%.200s'", geteuid(), -+ audit_username(), command); -+} -+ -+/* -+ * This will be called when user is successfully autherized by the RSA1/RSA/DSA key. -+ * -+ * Type is the key type, len is the key length(byte) and fp is the fingerprint of the key. -+ */ -+int -+audit_keyusage(int host_user, const char *type, unsigned bits, char *fp, int rv) -+{ -+ debug("audit %s key usage euid %d user %s key type %s key length %d fingerprint %s%s, result %d", -+ host_user ? "pubkey" : "hostbased", geteuid(), audit_username(), type, bits, -+ sshkey_fingerprint_prefix(), fp, rv); -+} -+ -+/* -+ * This will be called when the protocol negotiation fails. -+ */ -+void -+audit_unsupported_body(int what) -+{ -+ debug("audit unsupported protocol euid %d type %d", geteuid(), what); -+} -+ -+/* -+ * This will be called on succesfull protocol negotiation. -+ */ -+void -+audit_kex_body(int ctos, char *enc, char *mac, char *compress, char *pfs, pid_t pid, -+ uid_t uid) -+{ -+ debug("audit protocol negotiation euid %d direction %d cipher %s mac %s compresion %s pfs %s from pid %ld uid %u", -+ (unsigned)geteuid(), ctos, enc, mac, compress, pfs, (long)pid, -+ (unsigned)uid); -+} -+ -+/* -+ * This will be called on succesfull session key discard -+ */ -+void -+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid) -+{ -+ debug("audit session key discard euid %u direction %d from pid %ld uid %u", -+ (unsigned)geteuid(), ctos, (long)pid, (unsigned)uid); -+} -+ -+/* -+ * This will be called on destroy private part of the server key -+ */ -+void -+audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid) -+{ -+ debug("audit destroy sensitive data euid %d fingerprint %s from pid %ld uid %u", -+ geteuid(), fp, (long)pid, (unsigned)uid); -+} -+ -+/* -+ * This will be called on generation of the ephemeral server key -+ */ -+void -+audit_generate_ephemeral_server_key(const char *) -+{ -+ debug("audit create ephemeral server key euid %d fingerprint %s", geteuid(), fp); - } - # endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */ - #endif /* SSH_AUDIT_EVENTS */ -diff -up openssh-6.8p1/audit.h.audit openssh-6.8p1/audit.h ---- openssh-6.8p1/audit.h.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/audit.h 2015-03-20 13:41:15.093883780 +0100 -@@ -28,6 +28,7 @@ - # define _SSH_AUDIT_H - - #include "loginrec.h" -+#include "key.h" - - enum ssh_audit_event_type { - SSH_LOGIN_EXCEED_MAXTRIES, -@@ -47,11 +48,25 @@ enum ssh_audit_event_type { - }; - typedef enum ssh_audit_event_type ssh_audit_event_t; - -+int listening_for_clients(void); -+ - void audit_connection_from(const char *, int); - void audit_event(ssh_audit_event_t); -+void audit_count_session_open(void); - void audit_session_open(struct logininfo *); - void audit_session_close(struct logininfo *); --void audit_run_command(const char *); -+int audit_run_command(const char *); -+void audit_end_command(int, const char *); - ssh_audit_event_t audit_classify_auth(const char *); -+int audit_keyusage(int, const char *, unsigned, char *, int); -+void audit_key(int, int *, const Key *); -+void audit_unsupported(int); -+void audit_kex(int, char *, char *, char *, char *); -+void audit_unsupported_body(int); -+void audit_kex_body(int, char *, char *, char *, char *, pid_t, uid_t); -+void audit_session_key_free(int ctos); -+void audit_session_key_free_body(int ctos, pid_t, uid_t); -+void audit_destroy_sensitive_data(const char *, pid_t, uid_t); -+void audit_generate_ephemeral_server_key(const char *); - - #endif /* _SSH_AUDIT_H */ -diff -up openssh-6.8p1/auditstub.c.audit openssh-6.8p1/auditstub.c ---- openssh-6.8p1/auditstub.c.audit 2015-03-20 13:41:15.093883780 +0100 -+++ openssh-6.8p1/auditstub.c 2015-03-20 13:41:15.093883780 +0100 -@@ -0,0 +1,50 @@ -+/* $Id: auditstub.c,v 1.1 jfch Exp $ */ -+ -+/* -+ * Copyright 2010 Red Hat, Inc. All rights reserved. -+ * Use is subject to license terms. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in the -+ * documentation and/or other materials provided with the distribution. -+ * -+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR -+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES -+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. -+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, -+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT -+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF -+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -+ * -+ * Red Hat author: Jan F. Chadima <jchadima(a)redhat.com> -+ */ -+ -+#include <sys/types.h> -+ -+void -+audit_unsupported(int n) -+{ -+} -+ -+void -+audit_kex(int ctos, char *enc, char *mac, char *comp, char *pfs) -+{ -+} -+ -+void -+audit_session_key_free(int ctos) -+{ -+} -+ -+void -+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid) -+{ -+} -diff -up openssh-6.8p1/auth-rsa.c.audit openssh-6.8p1/auth-rsa.c ---- openssh-6.8p1/auth-rsa.c.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/auth-rsa.c 2015-03-20 13:41:15.094883779 +0100 -@@ -95,7 +95,10 @@ auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16]) - { - u_char buf[32], mdbuf[16]; - struct ssh_digest_ctx *md; -- int len; -+ int len, rv; -+#ifdef SSH_AUDIT_EVENTS -+ char *fp; -+#endif - - /* don't allow short keys */ - if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { -@@ -119,12 +122,18 @@ auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16]) - ssh_digest_free(md); - - /* Verify that the response is the original challenge. */ -- if (timingsafe_bcmp(response, mdbuf, 16) != 0) { -- /* Wrong answer. */ -- return (0); -+ rv = timingsafe_bcmp(response, mdbuf, 16) == 0; -+ -+#ifdef SSH_AUDIT_EVENTS -+ fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX); -+ if (audit_keyusage(1, "ssh-rsa1", RSA_size(key->rsa) * 8, fp, rv) == 0) { -+ debug("unsuccessful audit"); -+ rv = 0; - } -- /* Correct answer. */ -- return (1); -+ free(fp); -+#endif -+ -+ return rv; - } - - /* -diff -up openssh-6.8p1/auth.c.audit openssh-6.8p1/auth.c ---- openssh-6.8p1/auth.c.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/auth.c 2015-03-20 13:41:15.094883779 +0100 -@@ -644,9 +644,6 @@ getpwnamallow(const char *user) - record_failed_login(user, - get_canonical_hostname(options.use_dns), "ssh"); - #endif --#ifdef SSH_AUDIT_EVENTS -- audit_event(SSH_INVALID_USER); --#endif /* SSH_AUDIT_EVENTS */ - return (NULL); - } - if (!allowed_user(pw)) -diff -up openssh-6.8p1/auth.h.audit openssh-6.8p1/auth.h ---- openssh-6.8p1/auth.h.audit 2015-03-20 13:41:15.002883927 +0100 -+++ openssh-6.8p1/auth.h 2015-03-20 13:41:15.094883779 +0100 -@@ -195,6 +195,7 @@ void abandon_challenge_response(Authctxt - - char *expand_authorized_keys(const char *, struct passwd *pw); - char *authorized_principals_file(struct passwd *); -+int user_key_verify(const Key *, const u_char *, u_int, const u_char *, u_int); - - FILE *auth_openkeyfile(const char *, struct passwd *, int); - FILE *auth_openprincipals(const char *, struct passwd *, int); -@@ -213,6 +214,7 @@ int get_hostkey_index(Key *, int, struc - int ssh1_session_key(BIGNUM *); - int sshd_hostkey_sign(Key *, Key *, u_char **, size_t *, - const u_char *, size_t, u_int); -+int hostbased_key_verify(const Key *, const u_char *, u_int, const u_char *, u_int); - - /* debug messages during authentication */ - void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2))); -diff -up openssh-6.8p1/auth2-hostbased.c.audit openssh-6.8p1/auth2-hostbased.c ---- openssh-6.8p1/auth2-hostbased.c.audit 2015-03-20 13:41:15.002883927 +0100 -+++ openssh-6.8p1/auth2-hostbased.c 2015-03-20 13:41:15.093883780 +0100 -@@ -147,7 +147,7 @@ userauth_hostbased(Authctxt *authctxt) - /* test for allowed key and correct signature */ - authenticated = 0; - if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) && -- PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b), -+ PRIVSEP(hostbased_key_verify(key, sig, slen, buffer_ptr(&b), - buffer_len(&b))) == 1) - authenticated = 1; - -@@ -164,6 +164,18 @@ done: - return authenticated; - } - -+int -+hostbased_key_verify(const Key *key, const u_char *sig, u_int slen, const u_char *data, u_int datalen) -+{ -+ int rv; -+ -+ rv = key_verify(key, sig, slen, data, datalen); -+#ifdef SSH_AUDIT_EVENTS -+ audit_key(0, &rv, key); -+#endif -+ return rv; -+} -+ - /* return 1 if given hostkey is allowed */ - int - hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost, -diff -up openssh-6.8p1/auth2-pubkey.c.audit openssh-6.8p1/auth2-pubkey.c ---- openssh-6.8p1/auth2-pubkey.c.audit 2015-03-20 13:41:15.013883910 +0100 -+++ openssh-6.8p1/auth2-pubkey.c 2015-03-20 13:41:15.094883779 +0100 -@@ -172,7 +172,7 @@ userauth_pubkey(Authctxt *authctxt) - /* test for correct signature */ - authenticated = 0; - if (PRIVSEP(user_key_allowed(authctxt->pw, key)) && -- PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b), -+ PRIVSEP(user_key_verify(key, sig, slen, buffer_ptr(&b), - buffer_len(&b))) == 1) { - authenticated = 1; - /* Record the successful key to prevent reuse */ -@@ -250,6 +250,18 @@ pubkey_auth_info(Authctxt *authctxt, con - free(extra); - } - -+int -+user_key_verify(const Key *key, const u_char *sig, u_int slen, const u_char *data, u_int datalen) -+{ -+ int rv; -+ -+ rv = key_verify(key, sig, slen, data, datalen); -+#ifdef SSH_AUDIT_EVENTS -+ audit_key(1, &rv, key); -+#endif -+ return rv; -+} -+ - static int - match_principals_option(const char *principal_list, struct sshkey_cert *cert) - { -diff -up openssh-6.8p1/auth2.c.audit openssh-6.8p1/auth2.c ---- openssh-6.8p1/auth2.c.audit 2015-03-20 13:41:15.044883860 +0100 -+++ openssh-6.8p1/auth2.c 2015-03-20 13:41:15.093883780 +0100 -@@ -249,9 +249,6 @@ input_userauth_request(int type, u_int32 - } else { - logit("input_userauth_request: invalid user %s", user); - authctxt->pw = fakepw(); --#ifdef SSH_AUDIT_EVENTS -- PRIVSEP(audit_event(SSH_INVALID_USER)); --#endif - } - #ifdef USE_PAM - if (options.use_pam) -diff -up openssh-6.8p1/cipher.c.audit openssh-6.8p1/cipher.c ---- openssh-6.8p1/cipher.c.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/cipher.c 2015-03-20 13:41:15.101883767 +0100 -@@ -57,26 +59,6 @@ extern const EVP_CIPHER *evp_ssh1_3des(v - extern int ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int); - #endif - --struct sshcipher { -- char *name; -- int number; /* for ssh1 only */ -- u_int block_size; -- u_int key_len; -- u_int iv_len; /* defaults to block_size */ -- u_int auth_len; -- u_int discard_len; -- u_int flags; --#define CFLAG_CBC (1<<0) --#define CFLAG_CHACHAPOLY (1<<1) --#define CFLAG_AESCTR (1<<2) --#define CFLAG_NONE (1<<3) --#ifdef WITH_OPENSSL -- const EVP_CIPHER *(*evptype)(void); --#else -- void *ignored; --#endif --}; -- - static const struct sshcipher ciphers[] = { - #ifdef WITH_SSH1 - { "des", SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc }, -diff -up openssh-6.8p1/cipher.h.audit openssh-6.8p1/cipher.h ---- openssh-6.8p1/cipher.h.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/cipher.h 2015-03-20 13:41:15.094883779 +0100 -@@ -62,7 +62,26 @@ - #define CIPHER_ENCRYPT 1 - #define CIPHER_DECRYPT 0 - --struct sshcipher; -+struct sshcipher { -+ char *name; -+ int number; /* for ssh1 only */ -+ u_int block_size; -+ u_int key_len; -+ u_int iv_len; /* defaults to block_size */ -+ u_int auth_len; -+ u_int discard_len; -+ u_int flags; -+#define CFLAG_CBC (1<<0) -+#define CFLAG_CHACHAPOLY (1<<1) -+#define CFLAG_AESCTR (1<<2) -+#define CFLAG_NONE (1<<3) -+#ifdef WITH_OPENSSL -+ const EVP_CIPHER *(*evptype)(void); -+#else -+ void *ignored; -+#endif -+}; -+ - struct sshcipher_ctx { - int plaintext; - int encrypt; -diff -up openssh-6.8p1/kex.c.audit openssh-6.8p1/kex.c ---- openssh-6.8p1/kex.c.audit 2015-03-20 13:41:15.046883856 +0100 -+++ openssh-6.8p1/kex.c 2015-03-20 13:41:15.101883767 +0100 -@@ -54,6 +55,7 @@ - #include "ssherr.h" - #include "sshbuf.h" - #include "digest.h" -+#include "audit.h" - - #ifdef GSSAPI - #include "ssh-gss.h" -@@ -484,8 +508,12 @@ choose_enc(struct sshenc *enc, char *cli - { - char *name = match_list(client, server, NULL); - -- if (name == NULL) -+ if (name == NULL) { -+#ifdef SSH_AUDIT_EVENTS -+ audit_unsupported(0); -+#endif - return SSH_ERR_NO_CIPHER_ALG_MATCH; -+ } - if ((enc->cipher = cipher_by_name(name)) == NULL) - return SSH_ERR_INTERNAL_ERROR; - enc->name = name; -@@ -503,8 +531,12 @@ choose_mac(struct ssh *ssh, struct sshma - { - char *name = match_list(client, server, NULL); - -- if (name == NULL) -+ if (name == NULL) { -+#ifdef SSH_AUDIT_EVENTS -+ audit_unsupported(1); -+#endif - return SSH_ERR_NO_MAC_ALG_MATCH; -+ } - if (mac_setup(mac, name) < 0) - return SSH_ERR_INTERNAL_ERROR; - /* truncate the key */ -@@ -521,8 +553,12 @@ choose_comp(struct sshcomp *comp, char * - { - char *name = match_list(client, server, NULL); - -- if (name == NULL) -+ if (name == NULL) { -+#ifdef SSH_AUDIT_EVENTS -+ audit_unsupported(2); -+#endif - return SSH_ERR_NO_COMPRESS_ALG_MATCH; -+ } - if (strcmp(name, "zlib(a)openssh.com") == 0) { - comp->type = COMP_DELAYED; - } else if (strcmp(name, "zlib") == 0) { -@@ -672,6 +708,10 @@ kex_choose_conf(struct ssh *ssh) - dh_need = MAX(dh_need, newkeys->enc.block_size); - dh_need = MAX(dh_need, newkeys->enc.iv_len); - dh_need = MAX(dh_need, newkeys->mac.key_len); -+ debug("kex: %s need=%d dh_need=%d", kex->name, need, dh_need); -+#ifdef SSH_AUDIT_EVENTS -+ audit_kex(mode, newkeys->enc.name, newkeys->mac.name, newkeys->comp.name, kex->name); -+#endif - } - /* XXX need runden? */ - kex->we_need = need; -@@ -847,3 +887,34 @@ dump_digest(char *msg, u_char *digest, i - sshbuf_dump_data(digest, len, stderr); - } - #endif -+ -+static void -+enc_destroy(struct sshenc *enc) -+{ -+ if (enc == NULL) -+ return; -+ -+ if (enc->key) { -+ memset(enc->key, 0, enc->key_len); -+ free(enc->key); -+ } -+ -+ if (enc->iv) { -+ memset(enc->iv, 0, enc->block_size); -+ free(enc->iv); -+ } -+ -+ memset(enc, 0, sizeof(*enc)); -+} -+ -+void -+newkeys_destroy(struct newkeys *newkeys) -+{ -+ if (newkeys == NULL) -+ return; -+ -+ enc_destroy(&newkeys->enc); -+ mac_destroy(&newkeys->mac); -+ memset(&newkeys->comp, 0, sizeof(newkeys->comp)); -+} -+ -diff -up openssh-6.8p1/kex.h.audit openssh-6.8p1/kex.h ---- openssh-6.8p1/kex.h.audit 2015-03-20 13:41:15.046883856 +0100 -+++ openssh-6.8p1/kex.h 2015-03-20 13:41:15.095883777 +0100 -@@ -199,6 +199,8 @@ int kexgss_client(struct ssh *); - int kexgss_server(struct ssh *); - #endif - -+void newkeys_destroy(struct newkeys *newkeys); -+ - int kex_dh_hash(const char *, const char *, - const u_char *, size_t, const u_char *, size_t, const u_char *, size_t, - const BIGNUM *, const BIGNUM *, const BIGNUM *, u_char *, size_t *); -diff -up openssh-6.8p1/key.h.audit openssh-6.8p1/key.h ---- openssh-6.8p1/key.h.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/key.h 2015-03-20 13:41:15.095883777 +0100 -@@ -50,6 +50,7 @@ typedef struct sshkey Key; - #define key_ecdsa_bits_to_nid sshkey_ecdsa_bits_to_nid - #define key_ecdsa_key_to_nid sshkey_ecdsa_key_to_nid - #define key_is_cert sshkey_is_cert -+#define key_is_private sshkey_is_private - #define key_type_plain sshkey_type_plain - #define key_cert_is_legacy sshkey_cert_is_legacy - #define key_curve_name_to_nid sshkey_curve_name_to_nid -diff -up openssh-6.8p1/mac.c.audit openssh-6.8p1/mac.c ---- openssh-6.8p1/mac.c.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/mac.c 2015-03-20 13:41:15.102883766 +0100 -@@ -226,6 +246,20 @@ mac_clear(struct sshmac *mac) - mac->umac_ctx = NULL; - } - -+void -+mac_destroy(struct sshmac *mac) -+{ -+ if (mac == NULL) -+ return; -+ -+ if (mac->key) { -+ memset(mac->key, 0, mac->key_len); -+ free(mac->key); -+ } -+ -+ memset(mac, 0, sizeof(*mac)); -+} -+ - /* XXX copied from ciphers_valid */ - #define MAC_SEP "," - int -diff -up openssh-6.8p1/mac.h.audit openssh-6.8p1/mac.h ---- openssh-6.8p1/mac.h.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/mac.h 2015-03-20 13:41:15.095883777 +0100 -@@ -47,5 +47,6 @@ int mac_init(struct sshmac *); - int mac_compute(struct sshmac *, u_int32_t, const u_char *, int, - u_char *, size_t); - void mac_clear(struct sshmac *); -+void mac_destroy(struct sshmac *); - - #endif /* SSHMAC_H */ -diff -up openssh-6.8p1/monitor.c.audit openssh-6.8p1/monitor.c ---- openssh-6.8p1/monitor.c.audit 2015-03-20 13:41:15.072883814 +0100 -+++ openssh-6.8p1/monitor.c 2015-03-20 13:41:15.107883758 +0100 -@@ -102,6 +102,7 @@ - #include "ssh2.h" - #include "roaming.h" - #include "authfd.h" -+#include "audit.h" - #include "match.h" - #include "ssherr.h" - -@@ -117,6 +118,8 @@ extern Buffer auth_debug; - extern int auth_debug_init; - extern Buffer loginmsg; - -+extern void destroy_sensitive_data(int); -+ - /* State exported from the child */ - static struct sshbuf *child_state; - -@@ -167,6 +170,11 @@ int mm_answer_gss_updatecreds(int, Buffe - #ifdef SSH_AUDIT_EVENTS - int mm_answer_audit_event(int, Buffer *); - int mm_answer_audit_command(int, Buffer *); -+int mm_answer_audit_end_command(int, Buffer *); -+int mm_answer_audit_unsupported_body(int, Buffer *); -+int mm_answer_audit_kex_body(int, Buffer *); -+int mm_answer_audit_session_key_free_body(int, Buffer *); -+int mm_answer_audit_server_key_free(int, Buffer *); - #endif - - static int monitor_read_log(struct monitor *); -@@ -226,6 +234,10 @@ struct mon_table mon_dispatch_proto20[] - #endif - #ifdef SSH_AUDIT_EVENTS - {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, -+ {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body}, -+ {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body}, -+ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body}, -+ {MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free}, - #endif - #ifdef BSD_AUTH - {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery}, -@@ -264,6 +276,11 @@ struct mon_table mon_dispatch_postauth20 - #ifdef SSH_AUDIT_EVENTS - {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, - {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command}, -+ {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command}, -+ {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body}, -+ {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body}, -+ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body}, -+ {MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free}, - #endif - {0, 0, NULL} - }; -@@ -296,6 +313,10 @@ struct mon_table mon_dispatch_proto15[] - #endif - #ifdef SSH_AUDIT_EVENTS - {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, -+ {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body}, -+ {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body}, -+ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body}, -+ {MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free}, - #endif - #endif /* WITH_SSH1 */ - {0, 0, NULL} -@@ -309,6 +330,11 @@ struct mon_table mon_dispatch_postauth15 - #ifdef SSH_AUDIT_EVENTS - {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, - {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command}, -+ {MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command}, -+ {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body}, -+ {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body}, -+ {MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body}, -+ {MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free}, - #endif - #endif /* WITH_SSH1 */ - {0, 0, NULL} -@@ -1466,9 +1493,11 @@ mm_answer_keyverify(int sock, Buffer *m) - Key *key; - u_char *signature, *data, *blob; - u_int signaturelen, datalen, bloblen; -+ int type = 0; - int verified = 0; - int valid_data = 0; - -+ type = buffer_get_int(m); - blob = buffer_get_string(m, &bloblen); - signature = buffer_get_string(m, &signaturelen); - data = buffer_get_string(m, &datalen); -@@ -1476,6 +1505,8 @@ mm_answer_keyverify(int sock, Buffer *m) - if (hostbased_cuser == NULL || hostbased_chost == NULL || - !monitor_allowed_key(blob, bloblen)) - fatal("%s: bad key, not previously allowed", __func__); -+ if (type != key_blobtype) -+ fatal("%s: bad key type", __func__); - - key = key_from_blob(blob, bloblen); - if (key == NULL) -@@ -1496,7 +1527,17 @@ mm_answer_keyverify(int sock, Buffer *m) - if (!valid_data) - fatal("%s: bad signature data blob", __func__); - -- verified = key_verify(key, signature, signaturelen, data, datalen); -+ switch (key_blobtype) { -+ case MM_USERKEY: -+ verified = user_key_verify(key, signature, signaturelen, data, datalen); -+ break; -+ case MM_HOSTKEY: -+ verified = hostbased_key_verify(key, signature, signaturelen, data, datalen); -+ break; -+ default: -+ verified = 0; -+ break; -+ } - debug3("%s: key %p signature %s", - __func__, key, (verified == 1) ? "verified" : "unverified"); - -@@ -1554,6 +1595,12 @@ mm_session_close(Session *s) - debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd); - session_pty_cleanup2(s); - } -+#ifdef SSH_AUDIT_EVENTS -+ if (s->command != NULL) { -+ debug3("%s: command %d", __func__, s->command_handle); -+ session_end_command2(s); -+ } -+#endif - session_unused(s->self); - } - -@@ -1836,6 +1883,8 @@ mm_answer_term(int sock, Buffer *req) - sshpam_cleanup(); - #endif - -+ destroy_sensitive_data(0); -+ - while (waitpid(pmonitor->m_pid, &status, 0) == -1) - if (errno != EINTR) - exit(1); -@@ -1878,11 +1927,43 @@ mm_answer_audit_command(int socket, Buff - { - u_int len; - char *cmd; -+ Session *s; - - debug3("%s entering", __func__); - cmd = buffer_get_string(m, &len); -+ - /* sanity check command, if so how? */ -- audit_run_command(cmd); -+ s = session_new(); -+ if (s == NULL) -+ fatal("%s: error allocating a session", __func__); -+ s->command = cmd; -+ s->command_handle = audit_run_command(cmd); -+ -+ buffer_clear(m); -+ buffer_put_int(m, s->self); -+ -+ mm_request_send(socket, MONITOR_ANS_AUDIT_COMMAND, m); -+ -+ return (0); -+} -+ -+int -+mm_answer_audit_end_command(int socket, Buffer *m) -+{ -+ int handle; -+ u_int len; -+ char *cmd; -+ Session *s; -+ -+ debug3("%s entering", __func__); -+ handle = buffer_get_int(m); -+ cmd = buffer_get_string(m, &len); -+ -+ s = session_by_id(handle); -+ if (s == NULL || s->ttyfd != -1 || s->command == NULL || -+ strcmp(s->command, cmd) != 0) -+ fatal("%s: invalid handle", __func__); -+ mm_session_close(s); - free(cmd); - return (0); - } -@@ -1936,6 +2017,7 @@ - void - mm_get_keystate(struct monitor *pmonitor) - { -+ Buffer m; - debug3("%s: Waiting for new keys", __func__); - - if ((child_state = sshbuf_new()) == NULL) -@@ -1946,6 +2027,21 @@ mm_get_keystate(struct monitor *pmonitor - mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT, - child_state); - debug3("%s: GOT new keys", __func__); -+ -+#ifdef SSH_AUDIT_EVENTS -+ if (compat20) { -+ buffer_init(&m); -+ mm_request_receive_expect(pmonitor->m_sendfd, -+ MONITOR_REQ_AUDIT_SESSION_KEY_FREE, &m); -+ mm_answer_audit_session_key_free_body(pmonitor->m_sendfd, &m); -+ buffer_free(&m); -+ } -+#endif -+ -+ /* Drain any buffered messages from the child */ -+ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0) -+ ; -+ - } - - -@@ -2212,3 +2308,87 @@ mm_answer_gss_updatecreds(int socket, Bu - - #endif /* GSSAPI */ - -+#ifdef SSH_AUDIT_EVENTS -+int -+mm_answer_audit_unsupported_body(int sock, Buffer *m) -+{ -+ int what; -+ -+ what = buffer_get_int(m); -+ -+ audit_unsupported_body(what); -+ -+ buffer_clear(m); -+ -+ mm_request_send(sock, MONITOR_ANS_AUDIT_UNSUPPORTED, m); -+ return 0; -+} -+ -+int -+mm_answer_audit_kex_body(int sock, Buffer *m) -+{ -+ int ctos, len; -+ char *cipher, *mac, *compress, *pfs; -+ pid_t pid; -+ uid_t uid; -+ -+ ctos = buffer_get_int(m); -+ cipher = buffer_get_string(m, &len); -+ mac = buffer_get_string(m, &len); -+ compress = buffer_get_string(m, &len); -+ pfs = buffer_get_string(m, &len); -+ pid = buffer_get_int64(m); -+ uid = buffer_get_int64(m); -+ -+ audit_kex_body(ctos, cipher, mac, compress, pfs, pid, uid); -+ -+ free(cipher); -+ free(mac); -+ free(compress); -+ free(pfs); -+ buffer_clear(m); -+ -+ mm_request_send(sock, MONITOR_ANS_AUDIT_KEX, m); -+ return 0; -+} -+ -+int -+mm_answer_audit_session_key_free_body(int sock, Buffer *m) -+{ -+ int ctos; -+ pid_t pid; -+ uid_t uid; -+ -+ ctos = buffer_get_int(m); -+ pid = buffer_get_int64(m); -+ uid = buffer_get_int64(m); -+ -+ audit_session_key_free_body(ctos, pid, uid); -+ -+ buffer_clear(m); -+ -+ mm_request_send(sock, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, m); -+ return 0; -+} -+ -+int -+mm_answer_audit_server_key_free(int sock, Buffer *m) -+{ -+ int len; -+ char *fp; -+ pid_t pid; -+ uid_t uid; -+ -+ fp = buffer_get_string(m, &len); -+ pid = buffer_get_int64(m); -+ uid = buffer_get_int64(m); -+ -+ audit_destroy_sensitive_data(fp, pid, uid); -+ -+ free(fp); -+ buffer_clear(m); -+ -+ mm_request_send(sock, MONITOR_ANS_AUDIT_SERVER_KEY_FREE, m); -+ return 0; -+} -+#endif /* SSH_AUDIT_EVENTS */ -diff -up openssh-6.8p1/monitor.h.audit openssh-6.8p1/monitor.h ---- openssh-6.8p1/monitor.h.audit 2015-03-20 13:41:15.072883814 +0100 -+++ openssh-6.8p1/monitor.h 2015-03-20 13:41:15.096883775 +0100 -@@ -69,7 +69,13 @@ enum monitor_reqtype { - MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107, - MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109, - MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111, -- MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113, -+ MONITOR_REQ_AUDIT_EVENT = 112, -+ MONITOR_REQ_AUDIT_COMMAND = 114, MONITOR_ANS_AUDIT_COMMAND = 115, -+ MONITOR_REQ_AUDIT_END_COMMAND = 116, -+ MONITOR_REQ_AUDIT_UNSUPPORTED = 118, MONITOR_ANS_AUDIT_UNSUPPORTED = 119, -+ MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121, -+ MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 122, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 123, -+ MONITOR_REQ_AUDIT_SERVER_KEY_FREE = 124, MONITOR_ANS_AUDIT_SERVER_KEY_FREE = 125 - - }; - -diff -up openssh-6.8p1/monitor_wrap.c.audit openssh-6.8p1/monitor_wrap.c ---- openssh-6.8p1/monitor_wrap.c.audit 2015-03-20 13:41:15.047883855 +0100 -+++ openssh-6.8p1/monitor_wrap.c 2015-03-20 13:41:15.108883756 +0100 -@@ -461,7 +461,7 @@ mm_key_allowed(enum mm_keytype type, cha - */ - - int --mm_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen) -+mm_key_verify(enum mm_keytype type, Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen) - { - Buffer m; - u_char *blob; -@@ -475,6 +475,7 @@ mm_key_verify(Key *key, u_char *sig, u_i - return (0); - - buffer_init(&m); -+ buffer_put_int(&m, type); - buffer_put_string(&m, blob, len); - buffer_put_string(&m, sig, siglen); - buffer_put_string(&m, data, datalen); -@@ -492,6 +493,18 @@ mm_key_verify(Key *key, u_char *sig, u_i - return (verified); - } - -+int -+mm_hostbased_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen) -+{ -+ return mm_key_verify(MM_HOSTKEY, key, sig, siglen, data, datalen); -+} -+ -+int -+mm_user_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen) -+{ -+ return mm_key_verify(MM_USERKEY, key, sig, siglen, data, datalen); -+} -+ - void - mm_send_keystate(struct monitor *monitor) - { -@@ -1005,10 +1018,11 @@ mm_audit_event(ssh_audit_event_t event) - buffer_free(&m); - } - --void -+int - mm_audit_run_command(const char *command) - { - Buffer m; -+ int handle; - - debug3("%s entering command %s", __func__, command); - -@@ -1016,6 +1030,26 @@ mm_audit_run_command(const char *command - buffer_put_cstring(&m, command); - - mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, &m); -+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_COMMAND, &m); -+ -+ handle = buffer_get_int(&m); -+ buffer_free(&m); -+ -+ return (handle); -+} -+ -+void -+mm_audit_end_command(int handle, const char *command) -+{ -+ Buffer m; -+ -+ debug3("%s entering command %s", __func__, command); -+ -+ buffer_init(&m); -+ buffer_put_int(&m, handle); -+ buffer_put_cstring(&m, command); -+ -+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_END_COMMAND, &m); - buffer_free(&m); - } - #endif /* SSH_AUDIT_EVENTS */ -@@ -1151,3 +1185,72 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc - - #endif /* GSSAPI */ - -+#ifdef SSH_AUDIT_EVENTS -+void -+mm_audit_unsupported_body(int what) -+{ -+ Buffer m; -+ -+ buffer_init(&m); -+ buffer_put_int(&m, what); -+ -+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_UNSUPPORTED, &m); -+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_UNSUPPORTED, -+ &m); -+ -+ buffer_free(&m); -+} -+ -+void -+mm_audit_kex_body(int ctos, char *cipher, char *mac, char *compress, char *fps, pid_t pid, -+ uid_t uid) -+{ -+ Buffer m; -+ -+ buffer_init(&m); -+ buffer_put_int(&m, ctos); -+ buffer_put_cstring(&m, cipher); -+ buffer_put_cstring(&m, (mac ? mac : "")); -+ buffer_put_cstring(&m, compress); -+ buffer_put_cstring(&m, fps); -+ buffer_put_int64(&m, pid); -+ buffer_put_int64(&m, uid); -+ -+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_KEX, &m); -+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_KEX, -+ &m); -+ -+ buffer_free(&m); -+} -+ -+void -+mm_audit_session_key_free_body(int ctos, pid_t pid, uid_t uid) -+{ -+ Buffer m; -+ -+ buffer_init(&m); -+ buffer_put_int(&m, ctos); -+ buffer_put_int64(&m, pid); -+ buffer_put_int64(&m, uid); -+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SESSION_KEY_FREE, &m); -+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, -+ &m); -+ buffer_free(&m); -+} -+ -+void -+mm_audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid) -+{ -+ Buffer m; -+ -+ buffer_init(&m); -+ buffer_put_cstring(&m, fp); -+ buffer_put_int64(&m, pid); -+ buffer_put_int64(&m, uid); -+ -+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, &m); -+ mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_SERVER_KEY_FREE, -+ &m); -+ buffer_free(&m); -+} -+#endif /* SSH_AUDIT_EVENTS */ -diff -up openssh-6.8p1/monitor_wrap.h.audit openssh-6.8p1/monitor_wrap.h ---- openssh-6.8p1/monitor_wrap.h.audit 2015-03-20 13:41:15.048883853 +0100 -+++ openssh-6.8p1/monitor_wrap.h 2015-03-20 13:41:15.096883775 +0100 -@@ -52,7 +52,8 @@ int mm_key_allowed(enum mm_keytype, char - int mm_user_key_allowed(struct passwd *, Key *); - int mm_hostbased_key_allowed(struct passwd *, char *, char *, Key *); - int mm_auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *); --int mm_key_verify(Key *, u_char *, u_int, u_char *, u_int); -+int mm_hostbased_key_verify(Key *, u_char *, u_int, u_char *, u_int); -+int mm_user_key_verify(Key *, u_char *, u_int, u_char *, u_int); - int mm_auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **); - int mm_auth_rsa_verify_response(Key *, BIGNUM *, u_char *); - BIGNUM *mm_auth_rsa_generate_challenge(Key *); -@@ -79,7 +80,12 @@ void mm_sshpam_free_ctx(void *); - #ifdef SSH_AUDIT_EVENTS - #include "audit.h" - void mm_audit_event(ssh_audit_event_t); --void mm_audit_run_command(const char *); -+int mm_audit_run_command(const char *); -+void mm_audit_end_command(int, const char *); -+void mm_audit_unsupported_body(int); -+void mm_audit_kex_body(int, char *, char *, char *, char *, pid_t, uid_t); -+void mm_audit_session_key_free_body(int, pid_t, uid_t); -+void mm_audit_destroy_sensitive_data(const char *, pid_t, uid_t); - #endif - - struct Session; -diff -up openssh-6.8p1/packet.c.audit openssh-6.8p1/packet.c ---- openssh-6.8p1/packet.c.audit 2015-03-20 13:41:14.990883947 +0100 -+++ openssh-6.8p1/packet.c 2015-03-20 13:41:15.097883774 +0100 -@@ -67,6 +67,7 @@ - #include "key.h" /* typedefs XXX */ - - #include "xmalloc.h" -+#include "audit.h" - #include "crc32.h" - #include "deattack.h" - #include "compat.h" -@@ -448,6 +449,13 @@ ssh_packet_get_connection_out(struct ssh - return ssh->state->connection_out; - } - -+static int -+packet_state_has_keys (const struct session_state *state) -+{ -+ return state != NULL && -+ (state->newkeys[MODE_IN] != NULL || state->newkeys[MODE_OUT] != NULL); -+} -+ - /* - * Returns the IP-address of the remote host as a string. The returned - * string must not be freed. -@@ -478,13 +486,6 @@ ssh_packet_close(struct ssh *ssh) - if (!state->initialized) - return; - state->initialized = 0; -- if (state->connection_in == state->connection_out) { -- shutdown(state->connection_out, SHUT_RDWR); -- close(state->connection_out); -- } else { -- close(state->connection_in); -- close(state->connection_out); -- } - sshbuf_free(state->input); - sshbuf_free(state->output); - sshbuf_free(state->outgoing_packet); -@@ -516,14 +517,24 @@ ssh_packet_close(struct ssh *ssh) - inflateEnd(stream); - } - } -- if ((r = cipher_cleanup(&state->send_context)) != 0) -- error("%s: cipher_cleanup failed: %s", __func__, ssh_err(r)); -- if ((r = cipher_cleanup(&state->receive_context)) != 0) -- error("%s: cipher_cleanup failed: %s", __func__, ssh_err(r)); -+ if (packet_state_has_keys(state)) { -+ if ((r = cipher_cleanup(&state->send_context)) != 0) -+ error("%s: cipher_cleanup failed: %s", __func__, ssh_err(r)); -+ if ((r = cipher_cleanup(&state->receive_context)) != 0) -+ error("%s: cipher_cleanup failed: %s", __func__, ssh_err(r)); -+ audit_session_key_free(2); -+ } - if (ssh->remote_ipaddr) { - free(ssh->remote_ipaddr); - ssh->remote_ipaddr = NULL; - } -+ if (state->connection_in == state->connection_out) { -+ shutdown(state->connection_out, SHUT_RDWR); -+ close(state->connection_out); -+ } else { -+ close(state->connection_in); -+ close(state->connection_out); -+ } - free(ssh->state); - ssh->state = NULL; - } -@@ -941,6 +952,7 @@ ssh_set_newkeys(struct ssh *ssh, int mod - } - if (state->newkeys[mode] != NULL) { - debug("set_newkeys: rekeying"); -+ audit_session_key_free(mode); - if ((r = cipher_cleanup(cc)) != 0) - return r; - enc = &state->newkeys[mode]->enc; -@@ -2263,6 +2275,75 @@ ssh_packet_get_output(struct ssh *ssh) - return (void *)ssh->state->output; - } - -+static void -+newkeys_destroy_and_free(struct newkeys *newkeys) -+{ -+ if (newkeys == NULL) -+ return; -+ -+ free(newkeys->enc.name); -+ -+ if (newkeys->mac.enabled) { -+ mac_clear(&newkeys->mac); -+ free(newkeys->mac.name); -+ } -+ -+ free(newkeys->comp.name); -+ -+ newkeys_destroy(newkeys); -+ free(newkeys); -+} -+ -+static void -+packet_destroy_state(struct session_state *state) -+{ -+ if (state == NULL) -+ return; -+ -+ cipher_cleanup(&state->receive_context); -+ cipher_cleanup(&state->send_context); -+ -+ buffer_free(state->input); -+ state->input = NULL; -+ buffer_free(state->output); -+ state->output = NULL; -+ buffer_free(state->outgoing_packet); -+ state->outgoing_packet = NULL; -+ buffer_free(state->incoming_packet); -+ state->incoming_packet = NULL; -+ if( state->compression_buffer ) { -+ buffer_free(state->compression_buffer); -+ state->compression_buffer = NULL; -+ } -+ newkeys_destroy_and_free(state->newkeys[MODE_IN]); -+ state->newkeys[MODE_IN] = NULL; -+ newkeys_destroy_and_free(state->newkeys[MODE_OUT]); -+ state->newkeys[MODE_OUT] = NULL; -+ mac_destroy(state->packet_discard_mac); -+// TAILQ_HEAD(, packet) outgoing; -+// memset(state, 0, sizeof(state)); -+} -+ -+void -+packet_destroy_all(int audit_it, int privsep) -+{ -+ if (audit_it) -+ audit_it = (active_state != NULL && packet_state_has_keys(active_state->state)) -+ || (backup_state != NULL && packet_state_has_keys(backup_state->state)); -+ if (active_state != NULL) -+ packet_destroy_state(active_state->state); -+ if (backup_state != NULL) -+ packet_destroy_state(backup_state->state); -+ if (audit_it) { -+#ifdef SSH_AUDIT_EVENTS -+ if (privsep) -+ audit_session_key_free(2); -+ else -+ audit_session_key_free_body(2, getpid(), getuid()); -+#endif -+ } -+} -+ - /* XXX TODO update roaming to new API (does not work anyway) */ - /* - * Save the state for the real connection, and use a separate state when -@@ -2272,18 +2373,12 @@ void - ssh_packet_backup_state(struct ssh *ssh, - struct ssh *backup_state) - { -- struct ssh *tmp; -- - close(ssh->state->connection_in); - ssh->state->connection_in = -1; - close(ssh->state->connection_out); - ssh->state->connection_out = -1; -- if (backup_state) -- tmp = backup_state; -- else -- tmp = ssh_alloc_session_state(); - backup_state = ssh; -- ssh = tmp; -+ ssh = ssh_alloc_session_state(); - } - - /* XXX FIXME FIXME FIXME */ -@@ -2302,9 +2397,7 @@ ssh_packet_restore_state(struct ssh *ssh - backup_state = ssh; - ssh = tmp; - ssh->state->connection_in = backup_state->state->connection_in; -- backup_state->state->connection_in = -1; - ssh->state->connection_out = backup_state->state->connection_out; -- backup_state->state->connection_out = -1; - len = sshbuf_len(backup_state->state->input); - if (len > 0) { - if ((r = sshbuf_putb(ssh->state->input, -@@ -2313,6 +2406,11 @@ ssh_packet_restore_state(struct ssh *ssh - sshbuf_reset(backup_state->state->input); - add_recv_bytes(len); - } -+ backup_state->state->connection_in = -1; -+ backup_state->state->connection_out = -1; -+ packet_destroy_state(backup_state->state); -+ free(backup_state); -+ backup_state = NULL; - } - - /* Reset after_authentication and reset compression in post-auth privsep */ -diff -up openssh-6.8p1/packet.h.audit openssh-6.8p1/packet.h ---- openssh-6.8p1/packet.h.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/packet.h 2015-03-20 13:41:15.097883774 +0100 -@@ -189,7 +189,7 @@ int sshpkt_get_end(struct ssh *ssh); - const u_char *sshpkt_ptr(struct ssh *, size_t *lenp); - - /* OLD API */ --extern struct ssh *active_state; -+extern struct ssh *active_state, *backup_state; - #include "opacket.h" - - #if !defined(WITH_OPENSSL) -@@ -203,4 +203,5 @@ extern struct ssh *active_state; - # undef EC_POINT - #endif - -+void packet_destroy_all(int, int); - #endif /* PACKET_H */ -diff -up openssh-6.8p1/session.c.audit openssh-6.8p1/session.c ---- openssh-6.8p1/session.c.audit 2015-03-20 13:41:15.073883813 +0100 -+++ openssh-6.8p1/session.c 2015-03-20 13:41:15.097883774 +0100 -@@ -139,7 +139,7 @@ extern int log_stderr; - extern int debug_flag; - extern u_int utmp_len; - extern int startup_pipe; --extern void destroy_sensitive_data(void); -+extern void destroy_sensitive_data(int); - extern Buffer loginmsg; - - /* original command from peer. */ -@@ -731,6 +731,14 @@ do_exec_pty(Session *s, const char *comm - /* Parent. Close the slave side of the pseudo tty. */ - close(ttyfd); - -+#ifndef HAVE_OSF_SIA -+ /* do_login in the child did not affect state in this process, -+ compensate. From an architectural standpoint, this is extremely -+ ugly. */ -+ if (!(options.use_login && command == NULL)) -+ audit_count_session_open(); -+#endif -+ - /* Enter interactive session. */ - s->ptymaster = ptymaster; - packet_set_interactive(1, -@@ -853,15 +861,19 @@ do_exec(Session *s, const char *command) - get_remote_port()); - - #ifdef SSH_AUDIT_EVENTS -+ if (s->command != NULL || s->command_handle != -1) -+ fatal("do_exec: command already set"); - if (command != NULL) -- PRIVSEP(audit_run_command(command)); -+ s->command = xstrdup(command); - else if (s->ttyfd == -1) { - char *shell = s->pw->pw_shell; - - if (shell[0] == '\0') /* empty shell means /bin/sh */ - shell =_PATH_BSHELL; -- PRIVSEP(audit_run_command(shell)); -+ s->command = xstrdup(shell); - } -+ if (s->command != NULL && s->ptyfd == -1) -+ s->command_handle = PRIVSEP(audit_run_command(s->command)); - #endif - if (s->ttyfd != -1) - ret = do_exec_pty(s, command); -@@ -1704,7 +1716,10 @@ do_child(Session *s, const char *command - int r = 0; - - /* remove hostkey from the child's memory */ -- destroy_sensitive_data(); -+ destroy_sensitive_data(1); -+ /* Don't audit this - both us and the parent would be talking to the -+ monitor over a single socket, with no synchronization. */ -+ packet_destroy_all(0, 1); - - /* Force a password change */ - if (s->authctxt->force_pwchange) { -@@ -1934,6 +1949,7 @@ session_unused(int id) - sessions[id].ttyfd = -1; - sessions[id].ptymaster = -1; - sessions[id].x11_chanids = NULL; -+ sessions[id].command_handle = -1; - sessions[id].next_unused = sessions_first_unused; - sessions_first_unused = id; - } -@@ -2016,6 +2032,19 @@ session_open(Authctxt *authctxt, int cha - } - - Session * -+session_by_id(int id) -+{ -+ if (id >= 0 && id < sessions_nalloc) { -+ Session *s = &sessions[id]; -+ if (s->used) -+ return s; -+ } -+ debug("session_by_id: unknown id %d", id); -+ session_dump(); -+ return NULL; -+} -+ -+Session * - session_by_tty(char *tty) - { - int i; -@@ -2532,6 +2561,32 @@ session_exit_message(Session *s, int sta - chan_write_failed(c); - } - -+#ifdef SSH_AUDIT_EVENTS -+void -+session_end_command2(Session *s) -+{ -+ if (s->command != NULL) { -+ if (s->command_handle != -1) -+ audit_end_command(s->command_handle, s->command); -+ free(s->command); -+ s->command = NULL; -+ s->command_handle = -1; -+ } -+} -+ -+static void -+session_end_command(Session *s) -+{ -+ if (s->command != NULL) { -+ if (s->command_handle != -1) -+ PRIVSEP(audit_end_command(s->command_handle, s->command)); -+ free(s->command); -+ s->command = NULL; -+ s->command_handle = -1; -+ } -+} -+#endif -+ - void - session_close(Session *s) - { -@@ -2540,6 +2593,10 @@ session_close(Session *s) - debug("session_close: session %d pid %ld", s->self, (long)s->pid); - if (s->ttyfd != -1) - session_pty_cleanup(s); -+#ifdef SSH_AUDIT_EVENTS -+ if (s->command) -+ session_end_command(s); -+#endif - free(s->term); - free(s->display); - free(s->x11_chanids); -@@ -2754,6 +2811,15 @@ do_authenticated2(Authctxt *authctxt) - server_loop2(authctxt); - } - -+static void -+do_cleanup_one_session(Session *s) -+{ -+ session_pty_cleanup2(s); -+#ifdef SSH_AUDIT_EVENTS -+ session_end_command2(s); -+#endif -+} -+ - void - do_cleanup(Authctxt *authctxt) - { -@@ -2802,5 +2868,5 @@ do_cleanup(Authctxt *authctxt) - * or if running in monitor. - */ - if (!use_privsep || mm_is_monitor()) -- session_destroy_all(session_pty_cleanup2); -+ session_destroy_all(do_cleanup_one_session); - } -diff -up openssh-6.8p1/session.h.audit openssh-6.8p1/session.h ---- openssh-6.8p1/session.h.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/session.h 2015-03-20 13:41:15.097883774 +0100 -@@ -61,6 +61,12 @@ struct Session { - char *name; - char *val; - } *env; -+ -+ /* exec */ -+#ifdef SSH_AUDIT_EVENTS -+ int command_handle; -+ char *command; -+#endif - }; - - void do_authenticated(Authctxt *); -@@ -73,8 +79,10 @@ void session_close_by_pid(pid_t, int); - void session_close_by_channel(int, void *); - void session_destroy_all(void (*)(Session *)); - void session_pty_cleanup2(Session *); -+void session_end_command2(Session *); - - Session *session_new(void); -+Session *session_by_id(int); - Session *session_by_tty(char *); - void session_close(Session *); - void do_setusercontext(struct passwd *); -diff -up openssh-6.8p1/sshd.c.audit openssh-6.8p1/sshd.c ---- openssh-6.8p1/sshd.c.audit 2015-03-20 13:41:15.083883796 +0100 -+++ openssh-6.8p1/sshd.c 2015-03-20 13:41:15.110883753 +0100 -@@ -121,6 +124,7 @@ - #endif - #include "monitor_wrap.h" - #include "roaming.h" -+#include "audit.h" - #include "ssh-sandbox.h" - #include "version.h" - #include "ssherr.h" -@@ -260,7 +264,7 @@ Buffer loginmsg; - struct passwd *privsep_pw = NULL; - - /* Prototypes for various functions defined later in this file. */ --void destroy_sensitive_data(void); -+void destroy_sensitive_data(int); - void demote_sensitive_data(void); - - #ifdef WITH_SSH1 -@@ -281,6 +285,15 @@ close_listen_socks(void) - num_listen_socks = -1; - } - -+/* -+ * Is this process listening for clients (i.e. not specific to any specific -+ * client connection?) -+ */ -+int listening_for_clients(void) -+{ -+ return num_listen_socks > 0; -+} -+ - static void - close_startup_pipes(void) - { -@@ -560,22 +573,45 @@ sshd_exchange_identification(int sock_in - } - } - --/* Destroy the host and server keys. They will no longer be needed. */ -+/* -+ * Destroy the host and server keys. They will no longer be needed. Careful, -+ * this can be called from cleanup_exit() - i.e. from just about anywhere. -+ */ - void --destroy_sensitive_data(void) -+destroy_sensitive_data(int privsep) - { - int i; -+ pid_t pid; -+ uid_t uid; - - if (sensitive_data.server_key) { - key_free(sensitive_data.server_key); - sensitive_data.server_key = NULL; - } -+ pid = getpid(); -+ uid = getuid(); - for (i = 0; i < options.num_host_key_files; i++) { - if (sensitive_data.host_keys[i]) { -+ char *fp; -+ -+ if (key_is_private(sensitive_data.host_keys[i])) -+ fp = sshkey_fingerprint(sensitive_data.host_keys[i], options.fingerprint_hash, SSH_FP_HEX); -+ else -+ fp = NULL; - key_free(sensitive_data.host_keys[i]); - sensitive_data.host_keys[i] = NULL; -+ if (fp != NULL) { -+ if (privsep) -+ PRIVSEP(audit_destroy_sensitive_data(fp, -+ pid, uid)); -+ else -+ audit_destroy_sensitive_data(fp, -+ pid, uid); -+ free(fp); -+ } - } -- if (sensitive_data.host_certificates[i]) { -+ if (sensitive_data.host_certificates -+ && sensitive_data.host_certificates[i]) { - key_free(sensitive_data.host_certificates[i]); - sensitive_data.host_certificates[i] = NULL; - } -@@ -589,6 +625,8 @@ void - demote_sensitive_data(void) - { - Key *tmp; -+ pid_t pid; -+ uid_t uid; - int i; - - if (sensitive_data.server_key) { -@@ -597,13 +635,25 @@ demote_sensitive_data(void) - sensitive_data.server_key = tmp; - } - -+ pid = getpid(); -+ uid = getuid(); - for (i = 0; i < options.num_host_key_files; i++) { - if (sensitive_data.host_keys[i]) { -+ char *fp; -+ -+ if (key_is_private(sensitive_data.host_keys[i])) -+ fp = sshkey_fingerprint(sensitive_data.host_keys[i], options.fingerprint_hash, SSH_FP_HEX); -+ else -+ fp = NULL; - tmp = key_demote(sensitive_data.host_keys[i]); - key_free(sensitive_data.host_keys[i]); - sensitive_data.host_keys[i] = tmp; - if (tmp->type == KEY_RSA1) - sensitive_data.ssh1_host_key = tmp; -+ if (fp != NULL) { -+ audit_destroy_sensitive_data(fp, pid, uid); -+ free(fp); -+ } - } - /* Certs do not need demotion */ - } -@@ -675,7 +725,7 @@ privsep_preauth(Authctxt *authctxt) - - if (use_privsep == PRIVSEP_ON) - box = ssh_sandbox_init(pmonitor); -- pid = fork(); -+ pmonitor->m_pid = pid = fork(); - if (pid == -1) { - fatal("fork of unprivileged child failed"); - } else if (pid != 0) { -@@ -759,6 +811,12 @@ privsep_postauth(Authctxt *authctxt) - else if (pmonitor->m_pid != 0) { - verbose("User child is on pid %ld", (long)pmonitor->m_pid); - buffer_clear(&loginmsg); -+ if (*pmonitor->m_pkex != NULL ){ -+ newkeys_destroy((*pmonitor->m_pkex)->newkeys[MODE_OUT]); -+ newkeys_destroy((*pmonitor->m_pkex)->newkeys[MODE_IN]); -+ audit_session_key_free_body(2, getpid(), getuid()); -+ packet_destroy_all(0, 0); -+ } - monitor_child_postauth(pmonitor); - - /* NEVERREACHED */ -@@ -1286,6 +1341,7 @@ server_accept_loop(int *sock_in, int *so - if (received_sigterm) { - logit("Received signal %d; terminating.", - (int) received_sigterm); -+ destroy_sensitive_data(0); - close_listen_socks(); - if (options.pid_file != NULL) - unlink(options.pid_file); -@@ -2242,6 +2321,7 @@ main(int ac, char **av) - */ - if (use_privsep) { - mm_send_keystate(pmonitor); -+ packet_destroy_all(1, 1); - exit(0); - } - -@@ -2287,7 +2367,7 @@ main(int ac, char **av) - privsep_postauth(authctxt); - /* the monitor process [priv] will not return */ - if (!compat20) -- destroy_sensitive_data(); -+ destroy_sensitive_data(0); - } - - packet_set_timeout(options.client_alive_interval, -@@ -2301,6 +2381,9 @@ main(int ac, char **av) - do_authenticated(authctxt); - - /* The connection has been terminated. */ -+ packet_destroy_all(1, 1); -+ destroy_sensitive_data(1); -+ - packet_get_bytes(&ibytes, &obytes); - verbose("Transferred: sent %llu, received %llu bytes", - (unsigned long long)obytes, (unsigned long long)ibytes); -@@ -2461,6 +2544,10 @@ do_ssh1_kex(void) - if (cookie[i] != packet_get_char()) - packet_disconnect("IP Spoofing check bytes do not match."); - -+#ifdef SSH_AUDIT_EVENTS -+ audit_kex(2, cipher_name(cipher_type), "crc", "none", "none"); -+#endif -+ - debug("Encryption type: %.200s", cipher_name(cipher_type)); - - /* Get the encrypted integer. */ -@@ -2520,7 +2607,7 @@ do_ssh1_kex(void) - } - - /* Destroy the private and public keys. No longer. */ -- destroy_sensitive_data(); -+ destroy_sensitive_data(1); - - if (use_privsep) - mm_ssh1_session_id(session_id); -@@ -2703,6 +2802,16 @@ do_ssh2_kex(void) - void - cleanup_exit(int i) - { -+ static int in_cleanup = 0; -+ int is_privsep_child; -+ -+ /* cleanup_exit can be called at the very least from the privsep -+ wrappers used for auditing. Make sure we don't recurse -+ indefinitely. */ -+ if (in_cleanup) -+ _exit(i); -+ in_cleanup = 1; -+ - if (the_authctxt) { - do_cleanup(the_authctxt); - if (use_privsep && privsep_is_preauth && -@@ -2714,9 +2823,14 @@ cleanup_exit(int i) - pmonitor->m_pid, strerror(errno)); - } - } -+ is_privsep_child = use_privsep && pmonitor != NULL && pmonitor->m_pid == 0; -+ if (sensitive_data.host_keys != NULL) -+ destroy_sensitive_data(is_privsep_child); -+ packet_destroy_all(1, is_privsep_child); - #ifdef SSH_AUDIT_EVENTS - /* done after do_cleanup so it can cancel the PAM auth 'thread' */ -- if (!use_privsep || mm_is_monitor()) -+ if ((the_authctxt == NULL || !the_authctxt->authenticated) && -+ (!use_privsep || mm_is_monitor())) - audit_event(SSH_CONNECTION_ABANDON); - #endif - _exit(i); -diff -up openssh-6.8p1/sshkey.c.audit openssh-6.8p1/sshkey.c ---- openssh-6.8p1/sshkey.c.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/sshkey.c 2015-03-20 13:41:15.111883751 +0100 -@@ -317,6 +319,33 @@ sshkey_type_is_valid_ca(int type) - } - - int -+sshkey_is_private(const struct sshkey *k) -+{ -+ switch (k->type) { -+ case KEY_RSA_CERT_V00: -+ case KEY_RSA_CERT: -+ case KEY_RSA1: -+ case KEY_RSA: -+ return k->rsa->d != NULL; -+ case KEY_DSA_CERT_V00: -+ case KEY_DSA_CERT: -+ case KEY_DSA: -+ return k->dsa->priv_key != NULL; -+#ifdef OPENSSL_HAS_ECC -+ case KEY_ECDSA_CERT: -+ case KEY_ECDSA: -+ return EC_KEY_get0_private_key(k->ecdsa) != NULL; -+#endif -+ case KEY_ED25519_CERT: -+ case KEY_ED25519: -+ return (k->ed25519_pk != NULL); -+ default: -+ /* fatal("key_is_private: bad key type %d", k->type); */ -+ return 0; -+ } -+} -+ -+int - sshkey_is_cert(const struct sshkey *k) - { - if (k == NULL) -diff -up openssh-6.8p1/sshkey.h.audit openssh-6.8p1/sshkey.h ---- openssh-6.8p1/sshkey.h.audit 2015-03-17 06:49:20.000000000 +0100 -+++ openssh-6.8p1/sshkey.h 2015-03-20 13:41:15.098883772 +0100 -@@ -134,6 +134,7 @@ u_int sshkey_size(const struct sshkey - int sshkey_generate(int type, u_int bits, struct sshkey **keyp); - int sshkey_from_private(const struct sshkey *, struct sshkey **); - int sshkey_type_from_name(const char *); -+int sshkey_is_private(const struct sshkey *); - int sshkey_is_cert(const struct sshkey *); - int sshkey_type_is_cert(int); - int sshkey_type_plain(int); -diff -up openssh-6.8p1/sandbox-seccomp-filter.c.audit openssh-6.8p1/sandbox-seccomp-filter.c ---- openssh-6.8p1/sandbox-seccomp-filter.c.audit 2015-03-20 13:41:15.088883788 +0100 -+++ openssh-6.8p1/sandbox-seccomp-filter.c 2015-03-20 13:41:15.097883774 +0100 -@@ -110,6 +110,12 @@ static const struct sock_filter preauth_ - #ifdef __NR_time /* not defined on EABI ARM */ - SC_ALLOW(time), - #endif -+#ifdef SSH_AUDIT_EVENTS -+ SC_ALLOW(getuid), -+#ifdef __NR_getuid32 /* not defined on x86_64 */ -+ SC_ALLOW(getuid32), -+#endif -+#endif - SC_ALLOW(read), - SC_ALLOW(write), - SC_ALLOW(close), diff --git a/openssh/patches/openssh-6.7p1-seccomp-aarch64.patch b/openssh/patches/openssh-6.7p1-seccomp-aarch64.patch deleted file mode 100644 index 4285bd9..0000000 --- a/openssh/patches/openssh-6.7p1-seccomp-aarch64.patch +++ /dev/null @@ -1,66 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 4065d0e..d59ad44 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -764,9 +764,12 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) - i*86-*) - seccomp_audit_arch=AUDIT_ARCH_I386 - ;; -- arm*-*) -+ aarch64*-*) -+ seccomp_audit_arch=AUDIT_ARCH_AARCH64 -+ ;; -+ arm*-*) - seccomp_audit_arch=AUDIT_ARCH_ARM -- ;; -+ ;; - esac - if test "x$seccomp_audit_arch" != "x" ; then - AC_MSG_RESULT(["$seccomp_audit_arch"]) -diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c -index 095b04a..52f6810 100644 ---- a/sandbox-seccomp-filter.c -+++ b/sandbox-seccomp-filter.c -@@ -90,8 +90,20 @@ static const struct sock_filter preauth_insns[] = { - /* Load the syscall number for checking. */ - BPF_STMT(BPF_LD+BPF_W+BPF_ABS, - offsetof(struct seccomp_data, nr)), -- SC_DENY(open, EACCES), -- SC_DENY(stat, EACCES), -+ SC_DENY(openat, EACCES), -+#ifdef __NR_open -+ SC_DENY(open, EACCES), /* not on AArch64 */ -+#endif -+#ifdef __NR_fstat -+ SC_DENY(fstat, EACCES), /* x86_64, Aarch64 */ -+#endif -+#if defined(__NR_stat64) && defined(__NR_fstat64) -+ SC_DENY(stat64, EACCES), /* ix86, arm */ -+ SC_DENY(fstat64, EACCES), -+#endif -+#ifdef __NR_newfstatat -+ SC_DENY(newfstatat, EACCES), /* Aarch64 */ -+#endif - SC_ALLOW(getpid), - SC_ALLOW(gettimeofday), - SC_ALLOW(clock_gettime), -@@ -111,12 +123,19 @@ static const struct sock_filter preauth_insns[] = { - SC_ALLOW(shutdown), - #endif - SC_ALLOW(brk), -+#ifdef __NR_poll /* not on AArch64 */ - SC_ALLOW(poll), -+#endif - #ifdef __NR__newselect - SC_ALLOW(_newselect), - #else -+#ifdef __NR_select /* not on AArch64 */ - SC_ALLOW(select), - #endif -+#ifdef __NR_pselect6 /* AArch64 */ -+ SC_ALLOW(pselect6), -+#endif -+#endif - SC_ALLOW(madvise), - #ifdef __NR_mmap2 /* EABI ARM only has mmap2() */ - SC_ALLOW(mmap2), -- 2.7.4

3 5

[PATCH] net-snmp: Update to 5.7.3
by Stefan Schantl 16 Jan '17

16 Jan '17

This is a minor update to the latest available version of net-snmp. * Drop SELinux support. Fixes #11216. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- net-snmp/net-snmp.nm | 5 +- net-snmp/patches/net-snmp-5.5-apsl-copying.patch | 20 +-- net-snmp/patches/net-snmp-5.6-multilib.patch | 30 ++-- .../net-snmp-5.7.2-python-ipaddress-size.patch | 23 ---- net-snmp/patches/net-snmp-5.7.2-systemd.patch | 151 ++++++++++----------- 5 files changed, 100 insertions(+), 129 deletions(-) delete mode 100644 net-snmp/patches/net-snmp-5.7.2-python-ipaddress-size.patch diff --git a/net-snmp/net-snmp.nm b/net-snmp/net-snmp.nm index 8b2a7fa..36254ef 100644 --- a/net-snmp/net-snmp.nm +++ b/net-snmp/net-snmp.nm @@ -4,8 +4,8 @@ ############################################################################### name = net-snmp -version = 5.7.2 -release = 2 +version = 5.7.3 +release = 1 groups = Networking/Daemons url = http://net-snmp.sourceforge.net @@ -27,7 +27,6 @@ build bzip2-devel chrpath elfutils-devel - libselinux-devel lm-sensors-devel >= 3 openssl-devel perl(ExtUtils::Embed) diff --git a/net-snmp/patches/net-snmp-5.5-apsl-copying.patch b/net-snmp/patches/net-snmp-5.5-apsl-copying.patch index 43b85b6..5ae7ca3 100644 --- a/net-snmp/patches/net-snmp-5.5-apsl-copying.patch +++ b/net-snmp/patches/net-snmp-5.5-apsl-copying.patch @@ -11,15 +11,15 @@ the code to 'any subsequent version of this License published by Apple'. According to http://fedoraproject.org/wiki/Licensing, APSL ver. 2.0 is better for us. -diff -up net-snmp-5.5/COPYING.apsl net-snmp-5.5/COPYING ---- net-snmp-5.5/COPYING.apsl 2010-08-04 12:40:27.494479126 +0200 -+++ net-snmp-5.5/COPYING 2010-08-04 12:45:47.713684755 +0200 -@@ -292,3 +292,337 @@ ON ANY THEORY OF LIABILITY, WHETHER IN C - TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE - USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH - DAMAGE. +diff -up net-snmp-5.7.3/COPYING.skiFvk net-snmp-5.7.3/COPYING +--- net-snmp-5.7.3/COPYING.skiFvk 2015-02-17 13:33:15.963257594 +0100 ++++ net-snmp-5.7.3/COPYING 2015-02-17 13:33:37.931241818 +0100 +@@ -325,3 +325,337 @@ PROFITS; OR BUSINESS INTERRUPTION) HOWEV + LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + -+---- Part 10: APPLE PUBLIC SOURCE LICENSE (APSL 2.0) ---- ++---- Part 11: APPLE PUBLIC SOURCE LICENSE (APSL 2.0) ---- + +Version 2.0 - August 6, 2003 + @@ -333,8 +333,8 @@ diff -up net-snmp-5.5/COPYING.apsl net-snmp-5.5/COPYING + +Where You are located in the province of Quebec, Canada, the following clause +applies: The parties hereby confirm that they have requested that this License -+and all related documents be drafted in English. Les parties ont exig� que le -+pr�sent contrat et tous les documents connexes soient r�dig�s en anglais. ++and all related documents be drafted in English. Les parties ont exige que le ++present contrat et tous les documents connexes soient rediges en anglais. + +EXHIBIT A. + diff --git a/net-snmp/patches/net-snmp-5.6-multilib.patch b/net-snmp/patches/net-snmp-5.6-multilib.patch index a50f5a8..9c12385 100644 --- a/net-snmp/patches/net-snmp-5.6-multilib.patch +++ b/net-snmp/patches/net-snmp-5.6-multilib.patch @@ -1,8 +1,6 @@ -Make the man pages multilib safe. - -diff -up net-snmp-5.6/man/netsnmp_config_api.3.def.multilib net-snmp-5.6/man/netsnmp_config_api.3.def ---- net-snmp-5.6/man/netsnmp_config_api.3.def.multilib 2010-09-08 17:41:37.000000000 +0200 -+++ net-snmp-5.6/man/netsnmp_config_api.3.def 2010-10-25 17:40:43.433726423 +0200 +diff -up net-snmp-5.7.3/man/netsnmp_config_api.3.def.oSBcEB net-snmp-5.7.3/man/netsnmp_config_api.3.def +--- net-snmp-5.7.3/man/netsnmp_config_api.3.def.oSBcEB 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/man/netsnmp_config_api.3.def 2015-02-17 13:32:38.903284207 +0100 @@ -295,7 +295,7 @@ for one particular machine. .PP The default list of directories to search is \fC SYSCONFDIR/snmp\fP, @@ -19,24 +17,24 @@ diff -up net-snmp-5.6/man/netsnmp_config_api.3.def.multilib net-snmp-5.6/man/net -Default: SYSCONFDIR/snmp:DATADIR/snmp:LIBDIR/snmp:$HOME/.snmp +Default: SYSCONFDIR/snmp:DATADIR/snmp:/usr/lib(64)/snmp:$HOME/.snmp .SH "SEE ALSO" - .BR mib_api "(3), " snmp_api (3) + netsnmp_mib_api(3), snmp_api(3) .\" Local Variables: -diff -up net-snmp-5.6/man/snmp_config.5.def.multilib net-snmp-5.6/man/snmp_config.5.def ---- net-snmp-5.6/man/snmp_config.5.def.multilib 2010-09-17 11:51:52.000000000 +0200 -+++ net-snmp-5.6/man/snmp_config.5.def 2010-10-25 17:40:12.681976439 +0200 +diff -up net-snmp-5.7.3/man/snmp_config.5.def.oSBcEB net-snmp-5.7.3/man/snmp_config.5.def +--- net-snmp-5.7.3/man/snmp_config.5.def.oSBcEB 2015-02-17 13:32:04.251309092 +0100 ++++ net-snmp-5.7.3/man/snmp_config.5.def 2015-02-17 13:33:09.217262438 +0100 @@ -10,7 +10,7 @@ First off, there are numerous places tha found and read from. By default, the applications look for configuration files in the following 4 directories, in order: SYSCONFDIR/snmp, -DATADIR/snmp, LIBDIR/snmp, and $HOME/.snmp. In each of these +DATADIR/snmp, /usr/lib(64)/snmp, and $HOME/.snmp. In each of these - directories, it looks for files with the extension of both - .IR conf " and " local.conf - (reading the second ones last). In this manner, there are -diff -up net-snmp-5.6/man/snmpd.conf.5.def.multilib net-snmp-5.6/man/snmpd.conf.5.def ---- net-snmp-5.6/man/snmpd.conf.5.def.multilib 2010-09-17 11:51:52.000000000 +0200 -+++ net-snmp-5.6/man/snmpd.conf.5.def 2010-10-25 17:40:12.682976925 +0200 -@@ -1387,7 +1387,7 @@ filename), and call the initialisation r + directories, it looks for files snmp.conf, snmpd.conf and/or + snmptrapd.conf, as well as snmp.local.conf, snmpd.local.conf + and/or snmptrapd.local.conf. *.local.conf are always +diff -up net-snmp-5.7.3/man/snmpd.conf.5.def.oSBcEB net-snmp-5.7.3/man/snmpd.conf.5.def +--- net-snmp-5.7.3/man/snmpd.conf.5.def.oSBcEB 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/man/snmpd.conf.5.def 2015-02-17 13:32:04.251309092 +0100 +@@ -1502,7 +1502,7 @@ filename), and call the initialisation r .RS .IP "Note:" If the specified PATH is not a fully qualified filename, it will diff --git a/net-snmp/patches/net-snmp-5.7.2-python-ipaddress-size.patch b/net-snmp/patches/net-snmp-5.7.2-python-ipaddress-size.patch deleted file mode 100644 index 51a489f..0000000 --- a/net-snmp/patches/net-snmp-5.7.2-python-ipaddress-size.patch +++ /dev/null @@ -1,23 +0,0 @@ -895357 - net-snmp-python adds zeros to end of IP address (IPADDR type), which is not valid - -Source: upstream commit 234158b8e84cc204cbac96e6e9be6959635404b8 - - --- a/python/netsnmp/client_intf.c -+++ a/python/netsnmp/client_intf.c -@@ -821,14 +821,14 @@ OCT: - - case TYPE_IPADDR: - vars->type = ASN_IPADDRESS; -- vars->val.integer = (long *)malloc(sizeof(long)); -+ vars->val.integer = (in_addr_t *)malloc(sizeof(in_addr_t)); - if (val) - *(vars->val.integer) = inet_addr(val); - else { - ret = FAILURE; - *(vars->val.integer) = 0; - } -- vars->val_len = sizeof(long); -+ vars->val_len = sizeof(in_addr_t); - break; - - case TYPE_OBJID: diff --git a/net-snmp/patches/net-snmp-5.7.2-systemd.patch b/net-snmp/patches/net-snmp-5.7.2-systemd.patch index b349097..4c89d60 100644 --- a/net-snmp/patches/net-snmp-5.7.2-systemd.patch +++ b/net-snmp/patches/net-snmp-5.7.2-systemd.patch @@ -57,10 +57,9 @@ Date: Tue Aug 9 10:53:43 2011 +0200 - update WantedBy in socket units as recommended by http://0pointer.de/blog/projects/socket-activation.html - rephrase README.systemd - -diff -up net-snmp-5.7.2/agent/snmpd.c.systemd net-snmp-5.7.2/agent/snmpd.c ---- net-snmp-5.7.2/agent/snmpd.c.systemd 2012-10-10 00:28:58.000000000 +0200 -+++ net-snmp-5.7.2/agent/snmpd.c 2012-11-12 10:18:46.084369548 +0100 +diff -up net-snmp-5.7.3/agent/snmpd.c.MPGqYh net-snmp-5.7.3/agent/snmpd.c +--- net-snmp-5.7.3/agent/snmpd.c.MPGqYh 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/agent/snmpd.c 2015-02-17 13:34:05.736221851 +0100 @@ -164,6 +164,10 @@ typedef long fd_mask; #endif @@ -72,7 +71,7 @@ diff -up net-snmp-5.7.2/agent/snmpd.c.systemd net-snmp-5.7.2/agent/snmpd.c netsnmp_feature_want(logging_file) netsnmp_feature_want(logging_stdio) netsnmp_feature_want(logging_syslog) -@@ -441,18 +445,26 @@ main(int argc, char *argv[]) +@@ -443,18 +447,26 @@ main(int argc, char *argv[]) int agent_mode = -1; char *pid_file = NULL; char option_compatability[] = "-Le"; @@ -101,7 +100,7 @@ diff -up net-snmp-5.7.2/agent/snmpd.c.systemd net-snmp-5.7.2/agent/snmpd.c } #endif /* #WIN32 */ -@@ -1100,6 +1112,19 @@ main(int argc, char *argv[]) +@@ -1107,6 +1119,19 @@ main(int argc, char *argv[]) netsnmp_addrcache_initialise(); /* @@ -121,9 +120,9 @@ diff -up net-snmp-5.7.2/agent/snmpd.c.systemd net-snmp-5.7.2/agent/snmpd.c * Forever monitor the dest_port for incoming PDUs. */ DEBUGMSGTL(("snmpd/main", "We're up. Starting to process data.\n")); -diff -up net-snmp-5.7.2/apps/snmptrapd.c.systemd net-snmp-5.7.2/apps/snmptrapd.c ---- net-snmp-5.7.2/apps/snmptrapd.c.systemd 2012-10-10 00:28:58.000000000 +0200 -+++ net-snmp-5.7.2/apps/snmptrapd.c 2012-11-12 10:18:46.084369548 +0100 +diff -up net-snmp-5.7.3/apps/snmptrapd.c.MPGqYh net-snmp-5.7.3/apps/snmptrapd.c +--- net-snmp-5.7.3/apps/snmptrapd.c.MPGqYh 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/apps/snmptrapd.c 2015-02-17 13:34:05.736221851 +0100 @@ -125,6 +125,10 @@ SOFTWARE. #include <net-snmp/net-snmp-features.h> @@ -135,7 +134,7 @@ diff -up net-snmp-5.7.2/apps/snmptrapd.c.systemd net-snmp-5.7.2/apps/snmptrapd.c #ifndef BSD4_3 #define BSD4_2 #endif -@@ -655,15 +659,22 @@ main(int argc, char *argv[]) +@@ -657,15 +661,22 @@ main(int argc, char *argv[]) int agentx_subagent = 1; #endif netsnmp_trapd_handler *traph; @@ -160,7 +159,7 @@ diff -up net-snmp-5.7.2/apps/snmptrapd.c.systemd net-snmp-5.7.2/apps/snmptrapd.c } #endif /* #WIN32 */ -@@ -1311,6 +1322,19 @@ main(int argc, char *argv[]) +@@ -1318,6 +1329,19 @@ main(int argc, char *argv[]) #endif #endif @@ -180,9 +179,9 @@ diff -up net-snmp-5.7.2/apps/snmptrapd.c.systemd net-snmp-5.7.2/apps/snmptrapd.c #ifdef WIN32SERVICE trapd_status = SNMPTRAPD_RUNNING; #endif -diff -up net-snmp-5.7.2/configure.d/config_modules_lib.systemd net-snmp-5.7.2/configure.d/config_modules_lib ---- net-snmp-5.7.2/configure.d/config_modules_lib.systemd 2012-10-10 00:28:58.000000000 +0200 -+++ net-snmp-5.7.2/configure.d/config_modules_lib 2012-11-12 10:18:46.085369546 +0100 +diff -up net-snmp-5.7.3/configure.d/config_modules_lib.MPGqYh net-snmp-5.7.3/configure.d/config_modules_lib +--- net-snmp-5.7.3/configure.d/config_modules_lib.MPGqYh 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/configure.d/config_modules_lib 2015-02-17 13:34:05.737221850 +0100 @@ -53,6 +53,14 @@ if test "x$PARTIALTARGETOS" = "xmingw32" other_ftobjs_list="$other_ftobjs_list winpipe.ft" fi @@ -198,9 +197,9 @@ diff -up net-snmp-5.7.2/configure.d/config_modules_lib.systemd net-snmp-5.7.2/co AC_SUBST(other_src_list) AC_SUBST(other_objs_list) AC_SUBST(other_lobjs_list) -diff -up net-snmp-5.7.2/configure.d/config_project_with_enable.systemd net-snmp-5.7.2/configure.d/config_project_with_enable ---- net-snmp-5.7.2/configure.d/config_project_with_enable.systemd 2012-10-10 00:28:58.000000000 +0200 -+++ net-snmp-5.7.2/configure.d/config_project_with_enable 2012-11-12 10:18:46.086369544 +0100 +diff -up net-snmp-5.7.3/configure.d/config_project_with_enable.MPGqYh net-snmp-5.7.3/configure.d/config_project_with_enable +--- net-snmp-5.7.3/configure.d/config_project_with_enable.MPGqYh 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/configure.d/config_project_with_enable 2015-02-17 13:34:05.737221850 +0100 @@ -690,6 +690,15 @@ if test "x$with_dummy_values" != "xyes"; data for]) fi @@ -217,10 +216,10 @@ diff -up net-snmp-5.7.2/configure.d/config_project_with_enable.systemd net-snmp- NETSNMP_ARG_ENABLE(set-support, [ --disable-set-support Do not allow SNMP set requests.]) if test "x$enable_set_support" = "xno"; then -diff -up net-snmp-5.7.2/configure.systemd net-snmp-5.7.2/configure ---- net-snmp-5.7.2/configure.systemd 2012-10-10 00:35:37.000000000 +0200 -+++ net-snmp-5.7.2/configure 2012-11-12 10:18:46.099369517 +0100 -@@ -950,6 +950,8 @@ with_kmem_usage +diff -up net-snmp-5.7.3/configure.MPGqYh net-snmp-5.7.3/configure +--- net-snmp-5.7.3/configure.MPGqYh 2014-12-08 21:23:37.000000000 +0100 ++++ net-snmp-5.7.3/configure 2015-02-17 13:34:05.744221845 +0100 +@@ -951,6 +951,8 @@ with_kmem_usage enable_kmem_usage with_dummy_values enable_dummy_values @@ -229,7 +228,7 @@ diff -up net-snmp-5.7.2/configure.systemd net-snmp-5.7.2/configure enable_set_support with_set_support with_sys_contact -@@ -1866,6 +1868,8 @@ Configuring the agent: +@@ -1867,6 +1869,8 @@ Configuring the agent: This is technically not compliant with the SNMP specifications, but was how the agent operated for versions < 4.0. @@ -238,7 +237,7 @@ diff -up net-snmp-5.7.2/configure.systemd net-snmp-5.7.2/configure --with-sys-contact="who@where" Default system contact. (Default: LOGIN@DOMAINNAME) --with-sys-location="location" Default system location. -@@ -4397,6 +4401,24 @@ $as_echo "#define NETSNMP_NO_DUMMY_VALUE +@@ -4398,6 +4402,24 @@ $as_echo "#define NETSNMP_NO_DUMMY_VALUE fi @@ -263,7 +262,7 @@ diff -up net-snmp-5.7.2/configure.systemd net-snmp-5.7.2/configure # Check whether --enable-set-support was given. if test "${enable_set_support+set}" = set; then : enableval=$enable_set_support; -@@ -18239,6 +18261,14 @@ if test "x$PARTIALTARGETOS" = "xmingw32" +@@ -18639,6 +18661,14 @@ if test "x$PARTIALTARGETOS" = "xmingw32" other_ftobjs_list="$other_ftobjs_list winpipe.ft" fi @@ -278,9 +277,9 @@ diff -up net-snmp-5.7.2/configure.systemd net-snmp-5.7.2/configure -diff -up net-snmp-5.7.2/dist/snmpd.service.systemd net-snmp-5.7.2/dist/snmpd.service ---- net-snmp-5.7.2/dist/snmpd.service.systemd 2012-11-12 10:18:46.104369507 +0100 -+++ net-snmp-5.7.2/dist/snmpd.service 2012-11-12 10:18:46.104369507 +0100 +diff -up net-snmp-5.7.3/dist/snmpd.service.MPGqYh net-snmp-5.7.3/dist/snmpd.service +--- net-snmp-5.7.3/dist/snmpd.service.MPGqYh 2015-02-17 13:34:05.745221844 +0100 ++++ net-snmp-5.7.3/dist/snmpd.service 2015-02-17 13:34:05.745221844 +0100 @@ -0,0 +1,18 @@ +# +# SNMP agent service file for systemd @@ -300,9 +299,9 @@ diff -up net-snmp-5.7.2/dist/snmpd.service.systemd net-snmp-5.7.2/dist/snmpd.ser + +[Install] +WantedBy=multi-user.target -diff -up net-snmp-5.7.2/dist/snmpd.socket.systemd net-snmp-5.7.2/dist/snmpd.socket ---- net-snmp-5.7.2/dist/snmpd.socket.systemd 2012-11-12 10:18:46.104369507 +0100 -+++ net-snmp-5.7.2/dist/snmpd.socket 2012-11-12 10:18:46.104369507 +0100 +diff -up net-snmp-5.7.3/dist/snmpd.socket.MPGqYh net-snmp-5.7.3/dist/snmpd.socket +--- net-snmp-5.7.3/dist/snmpd.socket.MPGqYh 2015-02-17 13:34:05.745221844 +0100 ++++ net-snmp-5.7.3/dist/snmpd.socket 2015-02-17 13:34:05.745221844 +0100 @@ -0,0 +1,17 @@ +[Unit] +Description=Socket listening for SNMP and AgentX messages @@ -321,9 +320,9 @@ diff -up net-snmp-5.7.2/dist/snmpd.socket.systemd net-snmp-5.7.2/dist/snmpd.sock + +[Install] +WantedBy=sockets.target -diff -up net-snmp-5.7.2/dist/snmptrapd.service.systemd net-snmp-5.7.2/dist/snmptrapd.service ---- net-snmp-5.7.2/dist/snmptrapd.service.systemd 2012-11-12 10:18:46.105369505 +0100 -+++ net-snmp-5.7.2/dist/snmptrapd.service 2012-11-12 10:18:46.105369505 +0100 +diff -up net-snmp-5.7.3/dist/snmptrapd.service.MPGqYh net-snmp-5.7.3/dist/snmptrapd.service +--- net-snmp-5.7.3/dist/snmptrapd.service.MPGqYh 2015-02-17 13:34:05.745221844 +0100 ++++ net-snmp-5.7.3/dist/snmptrapd.service 2015-02-17 13:34:05.745221844 +0100 @@ -0,0 +1,16 @@ +# +# SNMP trap-processing service file for systemd @@ -341,9 +340,9 @@ diff -up net-snmp-5.7.2/dist/snmptrapd.service.systemd net-snmp-5.7.2/dist/snmpt + +[Install] +WantedBy=multi-user.target -diff -up net-snmp-5.7.2/dist/snmptrapd.socket.systemd net-snmp-5.7.2/dist/snmptrapd.socket ---- net-snmp-5.7.2/dist/snmptrapd.socket.systemd 2012-11-12 10:18:46.105369505 +0100 -+++ net-snmp-5.7.2/dist/snmptrapd.socket 2012-11-12 10:18:46.105369505 +0100 +diff -up net-snmp-5.7.3/dist/snmptrapd.socket.MPGqYh net-snmp-5.7.3/dist/snmptrapd.socket +--- net-snmp-5.7.3/dist/snmptrapd.socket.MPGqYh 2015-02-17 13:34:05.745221844 +0100 ++++ net-snmp-5.7.3/dist/snmptrapd.socket 2015-02-17 13:34:05.745221844 +0100 @@ -0,0 +1,14 @@ +[Unit] +Description=Socket listening for SNMP trap messages @@ -359,9 +358,9 @@ diff -up net-snmp-5.7.2/dist/snmptrapd.socket.systemd net-snmp-5.7.2/dist/snmptr + +[Install] +WantedBy=sockets.target -diff -up net-snmp-5.7.2/include/net-snmp/library/sd-daemon.h.systemd net-snmp-5.7.2/include/net-snmp/library/sd-daemon.h ---- net-snmp-5.7.2/include/net-snmp/library/sd-daemon.h.systemd 2012-11-12 10:18:46.106369503 +0100 -+++ net-snmp-5.7.2/include/net-snmp/library/sd-daemon.h 2012-11-12 10:18:46.106369503 +0100 +diff -up net-snmp-5.7.3/include/net-snmp/library/sd-daemon.h.MPGqYh net-snmp-5.7.3/include/net-snmp/library/sd-daemon.h +--- net-snmp-5.7.3/include/net-snmp/library/sd-daemon.h.MPGqYh 2015-02-17 13:34:05.746221843 +0100 ++++ net-snmp-5.7.3/include/net-snmp/library/sd-daemon.h 2015-02-17 13:34:05.746221843 +0100 @@ -0,0 +1,286 @@ +/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/ + @@ -649,10 +648,10 @@ diff -up net-snmp-5.7.2/include/net-snmp/library/sd-daemon.h.systemd net-snmp-5. +#endif + +#endif /* SNMPD_SD_DAEMON_H */ -diff -up net-snmp-5.7.2/include/net-snmp/net-snmp-config.h.in.systemd net-snmp-5.7.2/include/net-snmp/net-snmp-config.h.in ---- net-snmp-5.7.2/include/net-snmp/net-snmp-config.h.in.systemd 2012-10-10 00:28:58.000000000 +0200 -+++ net-snmp-5.7.2/include/net-snmp/net-snmp-config.h.in 2012-11-12 10:18:46.107369501 +0100 -@@ -1389,6 +1389,9 @@ +diff -up net-snmp-5.7.3/include/net-snmp/net-snmp-config.h.in.MPGqYh net-snmp-5.7.3/include/net-snmp/net-snmp-config.h.in +--- net-snmp-5.7.3/include/net-snmp/net-snmp-config.h.in.MPGqYh 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/include/net-snmp/net-snmp-config.h.in 2015-02-17 13:34:05.746221843 +0100 +@@ -1410,6 +1410,9 @@ /* If you don't have root access don't exit upon kmem errors */ #undef NETSNMP_NO_ROOT_ACCESS @@ -662,9 +661,9 @@ diff -up net-snmp-5.7.2/include/net-snmp/net-snmp-config.h.in.systemd net-snmp-5 /* Define if you want to remove all SET/write access from the code */ #undef NETSNMP_NO_WRITE_SUPPORT -diff -up net-snmp-5.7.2/README.systemd.systemd net-snmp-5.7.2/README.systemd ---- net-snmp-5.7.2/README.systemd.systemd 2012-11-12 10:18:46.108369499 +0100 -+++ net-snmp-5.7.2/README.systemd 2012-11-12 10:18:46.108369499 +0100 +diff -up net-snmp-5.7.3/README.systemd.MPGqYh net-snmp-5.7.3/README.systemd +--- net-snmp-5.7.3/README.systemd.MPGqYh 2015-02-17 13:34:05.747221843 +0100 ++++ net-snmp-5.7.3/README.systemd 2015-02-17 13:34:05.747221843 +0100 @@ -0,0 +1,41 @@ +README.systemd +-------------- @@ -708,9 +707,9 @@ diff -up net-snmp-5.7.2/README.systemd.systemd net-snmp-5.7.2/README.systemd +start during boot and not after first SNMP trap arrives. Same rules as for snmpd +applies then. \ No newline at end of file -diff -up net-snmp-5.7.2/snmplib/sd-daemon.c.systemd net-snmp-5.7.2/snmplib/sd-daemon.c ---- net-snmp-5.7.2/snmplib/sd-daemon.c.systemd 2012-11-12 10:18:46.109369497 +0100 -+++ net-snmp-5.7.2/snmplib/sd-daemon.c 2012-11-12 10:18:46.109369497 +0100 +diff -up net-snmp-5.7.3/snmplib/sd-daemon.c.MPGqYh net-snmp-5.7.3/snmplib/sd-daemon.c +--- net-snmp-5.7.3/snmplib/sd-daemon.c.MPGqYh 2015-02-17 13:34:05.747221843 +0100 ++++ net-snmp-5.7.3/snmplib/sd-daemon.c 2015-02-17 13:34:05.747221843 +0100 @@ -0,0 +1,532 @@ +/* + * Systemd integration parts. @@ -1244,9 +1243,9 @@ diff -up net-snmp-5.7.2/snmplib/sd-daemon.c.systemd net-snmp-5.7.2/snmplib/sd-da +} + +#endif /* ! NETSNMP_NO_SYSTEMD */ -diff -up net-snmp-5.7.2/snmplib/transports/snmpTCPDomain.c.systemd net-snmp-5.7.2/snmplib/transports/snmpTCPDomain.c ---- net-snmp-5.7.2/snmplib/transports/snmpTCPDomain.c.systemd 2012-10-10 00:28:58.000000000 +0200 -+++ net-snmp-5.7.2/snmplib/transports/snmpTCPDomain.c 2012-11-12 10:19:41.767217067 +0100 +diff -up net-snmp-5.7.3/snmplib/transports/snmpTCPDomain.c.MPGqYh net-snmp-5.7.3/snmplib/transports/snmpTCPDomain.c +--- net-snmp-5.7.3/snmplib/transports/snmpTCPDomain.c.MPGqYh 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/snmplib/transports/snmpTCPDomain.c 2015-02-17 13:34:05.748221842 +0100 @@ -43,6 +43,10 @@ #include <net-snmp/library/snmpTCPBaseDomain.h> #include <net-snmp/library/tools.h> @@ -1326,9 +1325,9 @@ diff -up net-snmp-5.7.2/snmplib/transports/snmpTCPDomain.c.systemd net-snmp-5.7. } /* -diff -up net-snmp-5.7.2/snmplib/transports/snmpTCPIPv6Domain.c.systemd net-snmp-5.7.2/snmplib/transports/snmpTCPIPv6Domain.c ---- net-snmp-5.7.2/snmplib/transports/snmpTCPIPv6Domain.c.systemd 2012-10-10 00:28:58.000000000 +0200 -+++ net-snmp-5.7.2/snmplib/transports/snmpTCPIPv6Domain.c 2012-11-12 10:20:32.019078971 +0100 +diff -up net-snmp-5.7.3/snmplib/transports/snmpTCPIPv6Domain.c.MPGqYh net-snmp-5.7.3/snmplib/transports/snmpTCPIPv6Domain.c +--- net-snmp-5.7.3/snmplib/transports/snmpTCPIPv6Domain.c.MPGqYh 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/snmplib/transports/snmpTCPIPv6Domain.c 2015-02-17 13:34:05.748221842 +0100 @@ -49,6 +49,10 @@ #include <net-snmp/library/snmpTCPBaseDomain.h> #include <net-snmp/library/tools.h> @@ -1409,9 +1408,9 @@ diff -up net-snmp-5.7.2/snmplib/transports/snmpTCPIPv6Domain.c.systemd net-snmp- } /* -diff -up net-snmp-5.7.2/snmplib/transports/snmpUDPIPv4BaseDomain.c.systemd net-snmp-5.7.2/snmplib/transports/snmpUDPIPv4BaseDomain.c ---- net-snmp-5.7.2/snmplib/transports/snmpUDPIPv4BaseDomain.c.systemd 2012-10-10 00:28:58.000000000 +0200 -+++ net-snmp-5.7.2/snmplib/transports/snmpUDPIPv4BaseDomain.c 2012-11-12 10:22:30.279750750 +0100 +diff -up net-snmp-5.7.3/snmplib/transports/snmpUDPIPv4BaseDomain.c.MPGqYh net-snmp-5.7.3/snmplib/transports/snmpUDPIPv4BaseDomain.c +--- net-snmp-5.7.3/snmplib/transports/snmpUDPIPv4BaseDomain.c.MPGqYh 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/snmplib/transports/snmpUDPIPv4BaseDomain.c 2015-02-17 13:36:22.744123462 +0100 @@ -40,6 +40,10 @@ #include <net-snmp/library/snmpSocketBaseDomain.h> @@ -1420,10 +1419,10 @@ diff -up net-snmp-5.7.2/snmplib/transports/snmpUDPIPv4BaseDomain.c.systemd net-s +#include <net-snmp/library/sd-daemon.h> +#endif + - #if (defined(linux) && defined(IP_PKTINFO)) \ - || defined(IP_RECVDSTADDR) && HAVE_STRUCT_MSGHDR_MSG_CONTROL \ - && HAVE_STRUCT_MSGHDR_MSG_FLAGS -@@ -67,6 +71,7 @@ netsnmp_udpipv4base_transport(struct soc + #if defined(HAVE_IP_PKTINFO) || defined(HAVE_IP_RECVDSTADDR) + int netsnmp_udpipv4_recvfrom(int s, void *buf, int len, struct sockaddr *from, + socklen_t *fromlen, struct sockaddr *dstip, +@@ -64,6 +68,7 @@ netsnmp_udpipv4base_transport(struct soc char *client_socket = NULL; netsnmp_indexed_addr_pair addr_pair; socklen_t local_addr_len; @@ -1431,7 +1430,7 @@ diff -up net-snmp-5.7.2/snmplib/transports/snmpUDPIPv4BaseDomain.c.systemd net-s #ifdef NETSNMP_NO_LISTEN_SUPPORT if (local) -@@ -91,7 +96,20 @@ netsnmp_udpipv4base_transport(struct soc +@@ -88,7 +93,20 @@ netsnmp_udpipv4base_transport(struct soc free(str); } @@ -1453,17 +1452,16 @@ diff -up net-snmp-5.7.2/snmplib/transports/snmpUDPIPv4BaseDomain.c.systemd net-s DEBUGMSGTL(("UDPBase", "openned socket %d as local=%d\n", t->sock, local)); if (t->sock < 0) { netsnmp_transport_free(t); -@@ -141,13 +159,15 @@ netsnmp_udpipv4base_transport(struct soc - DEBUGMSGTL(("netsnmp_udp", "set IP_RECVDSTADDR\n")); +@@ -151,12 +169,14 @@ netsnmp_udpipv4base_transport(struct soc + } } - #endif + #endif /* !defined(WIN32) */ - rc = bind(t->sock, (struct sockaddr *) addr, - sizeof(struct sockaddr)); - if (rc != 0) { - netsnmp_socketbase_close(t); - netsnmp_transport_free(t); - return NULL; -- } + if (!socket_initialized) { + rc = bind(t->sock, (struct sockaddr *) addr, + sizeof(struct sockaddr)); @@ -1472,13 +1470,12 @@ diff -up net-snmp-5.7.2/snmplib/transports/snmpUDPIPv4BaseDomain.c.systemd net-s + netsnmp_transport_free(t); + return NULL; + } -+ } + } t->data = NULL; t->data_length = 0; - #else /* NETSNMP_NO_LISTEN_SUPPORT */ -diff -up net-snmp-5.7.2/snmplib/transports/snmpUDPIPv6Domain.c.systemd net-snmp-5.7.2/snmplib/transports/snmpUDPIPv6Domain.c ---- net-snmp-5.7.2/snmplib/transports/snmpUDPIPv6Domain.c.systemd 2012-10-10 00:28:58.000000000 +0200 -+++ net-snmp-5.7.2/snmplib/transports/snmpUDPIPv6Domain.c 2012-11-12 10:23:19.713603003 +0100 +diff -up net-snmp-5.7.3/snmplib/transports/snmpUDPIPv6Domain.c.MPGqYh net-snmp-5.7.3/snmplib/transports/snmpUDPIPv6Domain.c +--- net-snmp-5.7.3/snmplib/transports/snmpUDPIPv6Domain.c.MPGqYh 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/snmplib/transports/snmpUDPIPv6Domain.c 2015-02-17 13:37:16.256087147 +0100 @@ -67,6 +67,10 @@ static const struct in6_addr in6addr_any #include <net-snmp/library/snmpSocketBaseDomain.h> #include <net-snmp/library/tools.h> @@ -1520,8 +1517,8 @@ diff -up net-snmp-5.7.2/snmplib/transports/snmpUDPIPv6Domain.c.systemd net-snmp- netsnmp_transport_free(t); return NULL; @@ -242,13 +259,14 @@ netsnmp_udp6_transport(struct sockaddr_i - } - } + } + } #endif - - rc = bind(t->sock, (struct sockaddr *) addr, @@ -1541,9 +1538,9 @@ diff -up net-snmp-5.7.2/snmplib/transports/snmpUDPIPv6Domain.c.systemd net-snmp- } t->local = (unsigned char*)malloc(18); if (t->local == NULL) { -diff -up net-snmp-5.7.2/snmplib/transports/snmpUnixDomain.c.systemd net-snmp-5.7.2/snmplib/transports/snmpUnixDomain.c ---- net-snmp-5.7.2/snmplib/transports/snmpUnixDomain.c.systemd 2012-10-10 00:28:58.000000000 +0200 -+++ net-snmp-5.7.2/snmplib/transports/snmpUnixDomain.c 2012-11-12 10:24:02.803466358 +0100 +diff -up net-snmp-5.7.3/snmplib/transports/snmpUnixDomain.c.MPGqYh net-snmp-5.7.3/snmplib/transports/snmpUnixDomain.c +--- net-snmp-5.7.3/snmplib/transports/snmpUnixDomain.c.MPGqYh 2014-12-08 21:23:22.000000000 +0100 ++++ net-snmp-5.7.3/snmplib/transports/snmpUnixDomain.c 2015-02-17 13:34:05.749221841 +0100 @@ -37,6 +37,10 @@ #include <net-snmp/library/system.h> /* mkdirhier */ #include <net-snmp/library/tools.h> -- 2.7.4

2 4

[PATCH] ntp: Do not use an RPATH.
by Stefan Schantl 12 Jan '17

12 Jan '17

Fixes #11243. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- ntp/ntp.nm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ntp/ntp.nm b/ntp/ntp.nm index 780ad01..ad4b046 100644 --- a/ntp/ntp.nm +++ b/ntp/ntp.nm @@ -6,7 +6,7 @@ name = ntp version = %{ver_major}.8 ver_major = 4.2 -release = 2 +release = 3 groups = System/Daemons url = http://www.ntp.org/ @@ -49,6 +49,7 @@ build configure_options += \ --sysconfdir=%{sysconfdir}/ntp/crypto \ --with-openssl-libdir=%{libdir} \ + --without-rpath \ --enable-all-clocks \ --enable-parse-clocks \ --enable-ntp-signd=%{localstatedir}/run/ntp_signd -- 2.7.4

2 4

[PATCH] intltool: Enable testsuite.
by Stefan Schantl 12 Jan '17

12 Jan '17

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- intltool/intltool.nm | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/intltool/intltool.nm b/intltool/intltool.nm index 1f0311c..a217ea3 100644 --- a/intltool/intltool.nm +++ b/intltool/intltool.nm @@ -5,7 +5,7 @@ name = intltool version = 0.51.0 -release = 1 +release = 2 arch = noarch groups = Localization/Tools @@ -29,7 +29,18 @@ build end configure_options += \ - --mandir=/usr/share/man + --mandir=%{mandir} + + test + if ! make check; then + find . -type f -name 'test-suite.log' | while read trs; do + echo "BEGIN " ${trs}; cat ${trs} 1>&2; + done + + echo "Exiting abnormally due to make check failure above" 1>&2 + exit 1 + fi + end end packages -- 2.7.4

2 3

[PATCH] squid 3.5.22: latest patches (14103-14113)
by Matthias Fischer 30 Nov '16

30 Nov '16

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 11 +++ src/patches/squid/squid-3.5-14103.patch | 61 ++++++++++++ src/patches/squid/squid-3.5-14104.patch | 66 +++++++++++++ src/patches/squid/squid-3.5-14105.patch | 48 +++++++++ src/patches/squid/squid-3.5-14106.patch | 34 +++++++ src/patches/squid/squid-3.5-14107.patch | 56 +++++++++++ src/patches/squid/squid-3.5-14108.patch | 33 +++++++ src/patches/squid/squid-3.5-14109.patch | 167 ++++++++++++++++++++++++++++++++ src/patches/squid/squid-3.5-14110.patch | 102 +++++++++++++++++++ src/patches/squid/squid-3.5-14111.patch | 43 ++++++++ src/patches/squid/squid-3.5-14112.patch | 60 ++++++++++++ src/patches/squid/squid-3.5-14113.patch | 47 +++++++++ 12 files changed, 728 insertions(+) create mode 100644 src/patches/squid/squid-3.5-14103.patch create mode 100644 src/patches/squid/squid-3.5-14104.patch create mode 100644 src/patches/squid/squid-3.5-14105.patch create mode 100644 src/patches/squid/squid-3.5-14106.patch create mode 100644 src/patches/squid/squid-3.5-14107.patch create mode 100644 src/patches/squid/squid-3.5-14108.patch create mode 100644 src/patches/squid/squid-3.5-14109.patch create mode 100644 src/patches/squid/squid-3.5-14110.patch create mode 100644 src/patches/squid/squid-3.5-14111.patch create mode 100644 src/patches/squid/squid-3.5-14112.patch create mode 100644 src/patches/squid/squid-3.5-14113.patch diff --git a/lfs/squid b/lfs/squid index 338dcc9..dbe79cb 100644 --- a/lfs/squid +++ b/lfs/squid @@ -74,6 +74,17 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14100.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14101.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14102.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14103.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14104.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14105.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14106.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14107.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14108.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14109.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14110.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14111.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14112.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14113.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid-3.5.22-fix-max-file-descriptors.patch cd $(DIR_APP) && autoreconf -vfi diff --git a/src/patches/squid/squid-3.5-14103.patch b/src/patches/squid/squid-3.5-14103.patch new file mode 100644 index 0000000..816aa91 --- /dev/null +++ b/src/patches/squid/squid-3.5-14103.patch @@ -0,0 +1,61 @@ +------------------------------------------------------------ +revno: 14103 +revision-id: squid3(a)treenet.co.nz-20161029232628-1y2u918re62uqs3v +parent: squid3(a)treenet.co.nz-20161025082530-do632qnr9bwyk5et +fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4627 +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Sun 2016-10-30 12:26:28 +1300 +message: + Bug 4627: fix generate-host-certificates and dynamic_cert_mem_cache_size docs + + For Squid-3 the fix is just to update the documentation. +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161029232628-1y2u918re62uqs3v +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: ea728cefc977ea5489da01b7a742821121c29476 +# timestamp: 2016-10-29 23:51:13 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161025082530-\ +# do632qnr9bwyk5et +# +# Begin patch +=== modified file 'src/cf.data.pre' +--- src/cf.data.pre 2016-10-25 08:23:49 +0000 ++++ src/cf.data.pre 2016-10-29 23:26:28 +0000 +@@ -1787,13 +1787,12 @@ + certificate equals lifetime of the CA certificate. If + generated certificate is selfsigned lifetime is three + years. +- This option is enabled by default when ssl-bump is used. +- See the ssl-bump option above for more information. ++ This option is disabled by default. See the ssl-bump ++ option above for more information. + + dynamic_cert_mem_cache_size=SIZE + Approximate total RAM size spent on cached generated +- certificates. If set to zero, caching is disabled. The +- default value is 4MB. ++ certificates. If set to zero, caching is disabled. + + TLS / SSL Options: + +@@ -2063,13 +2062,12 @@ + certificate equals lifetime of CA certificate. If + generated certificate is selfsigned lifetime is three + years. +- This option is enabled by default when SslBump is used. +- See the sslBump option above for more information. ++ This option is disabled by default. See the ssl-bump ++ option above for more information. + + dynamic_cert_mem_cache_size=SIZE + Approximate total RAM size spent on cached generated +- certificates. If set to zero, caching is disabled. The +- default value is 4MB. ++ certificates. If set to zero, caching is disabled. + + See http_port for a list of available options. + DOC_END + diff --git a/src/patches/squid/squid-3.5-14104.patch b/src/patches/squid/squid-3.5-14104.patch new file mode 100644 index 0000000..c5d6ed0 --- /dev/null +++ b/src/patches/squid/squid-3.5-14104.patch @@ -0,0 +1,66 @@ +------------------------------------------------------------ +revno: 14104 +revision-id: squid3(a)treenet.co.nz-20161030093816-7vwnk5zrrql2p5ks +parent: squid3(a)treenet.co.nz-20161029232628-1y2u918re62uqs3v +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Sun 2016-10-30 22:38:16 +1300 +message: + Copyright: add some missing blurbs and contributor details +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161030093816-7vwnk5zrrql2p5ks +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: 8d44709a8f9c34926ce569e58aef82603a3d514b +# timestamp: 2016-10-30 09:40:44 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161029232628-\ +# 1y2u918re62uqs3v +# +# Begin patch +=== modified file 'CONTRIBUTORS' +--- CONTRIBUTORS 2016-01-06 14:27:36 +0000 ++++ CONTRIBUTORS 2016-10-30 09:38:16 +0000 +@@ -211,6 +211,8 @@ + Joe Ramey <ramey(a)jello.csc.ti.com> + Joerg Lehrke <jlehrke(a)noc.de> + Johnathan Conley <johnathan.conley(a)gmail.com> ++ John(a)MCC.ac.uk ++ John(a)Pharmweb.NET + John Dilley <jad(a)hpl.hp.com> + John M Cooper <john.cooper(a)yourcommunications.co.uk> + John Saunders <johns(a)rd.scitec.com.au> + +=== modified file 'contrib/url-normalizer.pl' +--- contrib/url-normalizer.pl 1996-12-07 00:54:31 +0000 ++++ contrib/url-normalizer.pl 2016-10-30 09:38:16 +0000 +@@ -1,4 +1,11 @@ + #!/usr/local/bin/perl -Tw ++# ++# * Copyright (C) 1996-2016 The Squid Software Foundation and contributors ++# * ++# * Squid software is distributed under GPLv2+ license and includes ++# * contributions from numerous individuals and organizations. ++# * Please see the COPYING and CONTRIBUTORS files for details. ++# + + # From: Markus Gyger <mgyger(a)itr.ch> + # + +=== modified file 'contrib/user-agents.pl' +--- contrib/user-agents.pl 1996-12-07 00:28:56 +0000 ++++ contrib/user-agents.pl 2016-10-30 09:38:16 +0000 +@@ -1,5 +1,13 @@ + #!/usr/bin/perl + # ++# * Copyright (C) 1996-2016 The Squid Software Foundation and contributors ++# * ++# * Squid software is distributed under GPLv2+ license and includes ++# * contributions from numerous individuals and organizations. ++# * Please see the COPYING and CONTRIBUTORS files for details. ++# ++ ++# + # John(a)MCC.ac.uk + # John(a)Pharmweb.NET + diff --git a/src/patches/squid/squid-3.5-14105.patch b/src/patches/squid/squid-3.5-14105.patch new file mode 100644 index 0000000..d73dcea --- /dev/null +++ b/src/patches/squid/squid-3.5-14105.patch @@ -0,0 +1,48 @@ +------------------------------------------------------------ +revno: 14105 +revision-id: squid3(a)treenet.co.nz-20161030093920-5f7f2px9ea08rxlq +parent: squid3(a)treenet.co.nz-20161030093816-7vwnk5zrrql2p5ks +fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4567 +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Sun 2016-10-30 22:39:20 +1300 +message: + Bug 4567: Strange IPv6 shown in access.log +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161030093920-5f7f2px9ea08rxlq +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: 8dbae4e7fc5fb80afc6eee6800743abd1b1eaa47 +# timestamp: 2016-10-30 09:40:47 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161030093816-\ +# 7vwnk5zrrql2p5ks +# +# Begin patch +=== modified file 'src/AccessLogEntry.cc' +--- src/AccessLogEntry.cc 2016-01-01 00:14:27 +0000 ++++ src/AccessLogEntry.cc 2016-10-30 09:39:20 +0000 +@@ -30,14 +30,17 @@ + log_ip = request->indirect_client_addr; + else + #endif +- if (tcpClient != NULL) ++ if (tcpClient) + log_ip = tcpClient->remote; +- else if (cache.caddr.isNoAddr()) { // e.g., ICAP OPTIONS lack client +- strncpy(buf, "-", bufsz); +- return; +- } else ++ else + log_ip = cache.caddr; + ++ // internally generated requests (and some ICAP) lack client IP ++ if (log_ip.isNoAddr()) { ++ strncpy(buf, "-", bufsz); ++ return; ++ } ++ + // Apply so-called 'privacy masking' to IPv4 clients + // - localhost IP is always shown in full + // - IPv4 clients masked with client_netmask + diff --git a/src/patches/squid/squid-3.5-14106.patch b/src/patches/squid/squid-3.5-14106.patch new file mode 100644 index 0000000..cd3f63f --- /dev/null +++ b/src/patches/squid/squid-3.5-14106.patch @@ -0,0 +1,34 @@ +------------------------------------------------------------ +revno: 14106 +revision-id: squid3(a)treenet.co.nz-20161030094025-l4b8fdahoru8h16d +parent: squid3(a)treenet.co.nz-20161030093920-5f7f2px9ea08rxlq +author: Garri Djavadyan <garryd(a)comnet.uz> +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Sun 2016-10-30 22:40:25 +1300 +message: + Fix debug message in ACLChecklist::bannedAction() +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161030094025-l4b8fdahoru8h16d +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: 4fd7942b294096f5c27e3d460b6d4c79580443e1 +# timestamp: 2016-10-30 09:40:49 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161030093920-\ +# 5f7f2px9ea08rxlq +# +# Begin patch +=== modified file 'src/acl/Checklist.cc' +--- src/acl/Checklist.cc 2016-01-01 00:14:27 +0000 ++++ src/acl/Checklist.cc 2016-10-30 09:40:25 +0000 +@@ -397,7 +397,7 @@ + ACLChecklist::bannedAction(const allow_t &action) const + { + const bool found = std::find(bannedActions_.begin(), bannedActions_.end(), action) != bannedActions_.end(); +- debugs(28, 5, "Action '" << action << "/" << action.kind << (found ? " is " : "is not") << " banned"); ++ debugs(28, 5, "Action '" << action << "/" << action.kind << (found ? "' is " : "' is not") << " banned"); + return found; + } + + diff --git a/src/patches/squid/squid-3.5-14107.patch b/src/patches/squid/squid-3.5-14107.patch new file mode 100644 index 0000000..34b0ace --- /dev/null +++ b/src/patches/squid/squid-3.5-14107.patch @@ -0,0 +1,56 @@ +------------------------------------------------------------ +revno: 14107 +revision-id: squid3(a)treenet.co.nz-20161030094503-rwdft21ffff44rns +parent: squid3(a)treenet.co.nz-20161030094025-l4b8fdahoru8h16d +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Sun 2016-10-30 22:45:03 +1300 +message: + HTTP/1.1: make Vary:* objects cacheable + + Under new clauses from RFC 7231 section 7.1.4 and HTTP response + containing header Vary:* (wifcard variant) can be cached, but + requires revalidation with server before each use. + + Use the new mandatory revalidation flags to allow storing of any + wildcard Vary:* response. + + Note that responses with headers like Vary:A,B,C,* are equivalent + to Vary:*. The cache key string for these objects is normalized. +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161030094503-rwdft21ffff44rns +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: 2652a5a689745e31fc450e0dfd1c5c472f6d68d6 +# timestamp: 2016-10-30 09:45:47 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161030094025-\ +# l4b8fdahoru8h16d +# +# Begin patch +=== modified file 'src/http.cc' +--- src/http.cc 2016-10-09 19:47:26 +0000 ++++ src/http.cc 2016-10-30 09:45:03 +0000 +@@ -594,7 +594,7 @@ + while (strListGetItem(&vary, ',', &item, &ilen, &pos)) { + SBuf name(item, ilen); + if (name == asterisk) { +- vstr.clear(); ++ vstr = asterisk; + break; + } + name.toLower(); +@@ -917,6 +917,12 @@ + varyFailure = true; + } else { + entry->mem_obj->vary_headers = vary; ++ ++ // RFC 7231 section 7.1.4 ++ // Vary:* can be cached, but has mandatory revalidation ++ static const SBuf asterisk("*"); ++ if (vary == asterisk) ++ EBIT_SET(entry->flags, ENTRY_REVALIDATE_ALWAYS); + } + } + + diff --git a/src/patches/squid/squid-3.5-14108.patch b/src/patches/squid/squid-3.5-14108.patch new file mode 100644 index 0000000..282fe41 --- /dev/null +++ b/src/patches/squid/squid-3.5-14108.patch @@ -0,0 +1,33 @@ +------------------------------------------------------------ +revno: 14108 +revision-id: squid3(a)treenet.co.nz-20161101112231-k77st4up2sekl5zx +parent: squid3(a)treenet.co.nz-20161030094503-rwdft21ffff44rns +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Wed 2016-11-02 00:22:31 +1300 +message: + Fix build issue after rev.14105 +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161101112231-k77st4up2sekl5zx +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: fea1ede525ccb3ad7bf50e8de8f125a86a8dc016 +# timestamp: 2016-11-01 11:51:06 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161030094503-\ +# rwdft21ffff44rns +# +# Begin patch +=== modified file 'src/AccessLogEntry.cc' +--- src/AccessLogEntry.cc 2016-10-30 09:39:20 +0000 ++++ src/AccessLogEntry.cc 2016-11-01 11:22:31 +0000 +@@ -30,7 +30,7 @@ + log_ip = request->indirect_client_addr; + else + #endif +- if (tcpClient) ++ if (tcpClient != NULL) + log_ip = tcpClient->remote; + else + log_ip = cache.caddr; + diff --git a/src/patches/squid/squid-3.5-14109.patch b/src/patches/squid/squid-3.5-14109.patch new file mode 100644 index 0000000..82b7dd2 --- /dev/null +++ b/src/patches/squid/squid-3.5-14109.patch @@ -0,0 +1,167 @@ +------------------------------------------------------------ +revno: 14109 +revision-id: squid3(a)treenet.co.nz-20161111060325-yh8chavvnzuvfh3h +parent: squid3(a)treenet.co.nz-20161101112231-k77st4up2sekl5zx +fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=3379 +author: Garri Djavadyan <garryd(a)comnet.uz>, Amos Jeffries <squid3(a)treenet.co.nz> +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Fri 2016-11-11 19:03:25 +1300 +message: + Bug 3379: Combination of If-Match and a Cache Hit result in TCP Connection Failure +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161111060325-yh8chavvnzuvfh3h +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: 50d66878a765925d9a64569b3c226bebdee1f736 +# timestamp: 2016-11-11 06:10:37 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161101112231-\ +# k77st4up2sekl5zx +# +# Begin patch +=== modified file 'src/client_side_reply.cc' +--- src/client_side_reply.cc 2016-10-09 19:47:26 +0000 ++++ src/client_side_reply.cc 2016-11-11 06:03:25 +0000 +@@ -589,6 +589,7 @@ + debugs(88, 5, "negative-HIT"); + http->logType = LOG_TCP_NEGATIVE_HIT; + sendMoreData(result); ++ return; + } else if (blockedHit()) { + debugs(88, 5, "send_hit forces a MISS"); + http->logType = LOG_TCP_MISS; +@@ -641,27 +642,29 @@ + http->logType = LOG_TCP_MISS; + processMiss(); + } ++ return; + } else if (r->conditional()) { + debugs(88, 5, "conditional HIT"); +- processConditional(result); +- } else { +- /* +- * plain ol' cache hit +- */ +- debugs(88, 5, "plain old HIT"); ++ if (processConditional(result)) ++ return; ++ } ++ ++ /* ++ * plain ol' cache hit ++ */ ++ debugs(88, 5, "plain old HIT"); + + #if USE_DELAY_POOLS +- if (e->store_status != STORE_OK) +- http->logType = LOG_TCP_MISS; +- else ++ if (e->store_status != STORE_OK) ++ http->logType = LOG_TCP_MISS; ++ else + #endif +- if (e->mem_status == IN_MEMORY) +- http->logType = LOG_TCP_MEM_HIT; +- else if (Config.onoff.offline) +- http->logType = LOG_TCP_OFFLINE_HIT; ++ if (e->mem_status == IN_MEMORY) ++ http->logType = LOG_TCP_MEM_HIT; ++ else if (Config.onoff.offline) ++ http->logType = LOG_TCP_OFFLINE_HIT; + +- sendMoreData(result); +- } ++ sendMoreData(result); + } + + /** +@@ -755,17 +758,16 @@ + } + + /// process conditional request from client +-void ++bool + clientReplyContext::processConditional(StoreIOBuffer &result) + { + StoreEntry *const e = http->storeEntry(); + + if (e->getReply()->sline.status() != Http::scOkay) { +- debugs(88, 4, "clientReplyContext::processConditional: Reply code " << +- e->getReply()->sline.status() << " != 200"); ++ debugs(88, 4, "Reply code " << e->getReply()->sline.status() << " != 200"); + http->logType = LOG_TCP_MISS; + processMiss(); +- return; ++ return true; + } + + HttpRequest &r = *http->request; +@@ -773,7 +775,7 @@ + if (r.header.has(HDR_IF_MATCH) && !e->hasIfMatchEtag(r)) { + // RFC 2616: reply with 412 Precondition Failed if If-Match did not match + sendPreconditionFailedError(); +- return; ++ return true; + } + + bool matchedIfNoneMatch = false; +@@ -786,14 +788,14 @@ + r.header.delById(HDR_IF_MODIFIED_SINCE); + http->logType = LOG_TCP_MISS; + sendMoreData(result); +- return; ++ return true; + } + + if (!r.flags.ims) { + // RFC 2616: if If-None-Match matched and there is no IMS, + // reply with 304 Not Modified or 412 Precondition Failed + sendNotModifiedOrPreconditionFailedError(); +- return; ++ return true; + } + + // otherwise check IMS below to decide if we reply with 304 or 412 +@@ -805,19 +807,20 @@ + if (e->modifiedSince(r.ims, r.imslen)) { + http->logType = LOG_TCP_IMS_HIT; + sendMoreData(result); +- return; +- } + +- if (matchedIfNoneMatch) { ++ } else if (matchedIfNoneMatch) { + // If-None-Match matched, reply with 304 Not Modified or + // 412 Precondition Failed + sendNotModifiedOrPreconditionFailedError(); +- return; ++ ++ } else { ++ // otherwise reply with 304 Not Modified ++ sendNotModified(); + } +- +- // otherwise reply with 304 Not Modified +- sendNotModified(); ++ return true; + } ++ ++ return false; + } + + /// whether squid.conf send_hit prevents us from serving this hit + +=== modified file 'src/client_side_reply.h' +--- src/client_side_reply.h 2016-09-23 15:28:42 +0000 ++++ src/client_side_reply.h 2016-11-11 06:03:25 +0000 +@@ -114,7 +114,7 @@ + bool alwaysAllowResponse(Http::StatusCode sline) const; + int checkTransferDone(); + void processOnlyIfCachedMiss(); +- void processConditional(StoreIOBuffer &result); ++ bool processConditional(StoreIOBuffer &result); + void cacheHit(StoreIOBuffer result); + void handleIMSReply(StoreIOBuffer result); + void sendMoreData(StoreIOBuffer result); + diff --git a/src/patches/squid/squid-3.5-14110.patch b/src/patches/squid/squid-3.5-14110.patch new file mode 100644 index 0000000..0d0a9db --- /dev/null +++ b/src/patches/squid/squid-3.5-14110.patch @@ -0,0 +1,102 @@ +------------------------------------------------------------ +revno: 14110 +revision-id: squid3(a)treenet.co.nz-20161114105124-46hmtnsg8uj4owxz +parent: squid3(a)treenet.co.nz-20161111060325-yh8chavvnzuvfh3h +author: Christos Tsantilas <chtsanti(a)users.sourceforge.net> +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Mon 2016-11-14 23:51:24 +1300 +message: + Fix ssl::server_name ACL badly broken since inception. + + The original server_name code mishandled all SNI checks and some rare + host checks: + + * The SNI-derived value was pointing to an already freed memory storage. + * Missing host-derived values were not detected (host() is never nil). + * Mismatches were re-checked with an undocumented "none" value + instead of being treated as mismatches. + + Same for ssl::server_name_regex. + + Also set SNI for more server-first and client-first transactions. + + This is a Measurement Factory project. +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161114105124-46hmtnsg8uj4owxz +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: 46aadc410b46d91d597218961dbf1c634fb834fb +# timestamp: 2016-11-14 10:56:00 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161111060325-\ +# yh8chavvnzuvfh3h +# +# Begin patch +=== modified file 'src/acl/ServerName.cc' +--- src/acl/ServerName.cc 2016-09-08 12:27:06 +0000 ++++ src/acl/ServerName.cc 2016-11-14 10:51:24 +0000 +@@ -90,27 +90,28 @@ + { + assert(checklist != NULL && checklist->request != NULL); + +- if (checklist->conn() && checklist->conn()->serverBump()) { +- if (X509 *peer_cert = checklist->conn()->serverBump()->serverCert.get()) { +- if (Ssl::matchX509CommonNames(peer_cert, (void *)data, check_cert_domain<MatchType>)) +- return 1; +- } +- } +- + const char *serverName = NULL; +- if (checklist->conn() && !checklist->conn()->sslCommonName().isEmpty()) { +- SBuf scn = checklist->conn()->sslCommonName(); +- serverName = scn.c_str(); +- } +- +- if (serverName == NULL) +- serverName = checklist->request->GetHost(); +- +- if (serverName && data->match(serverName)) { +- return 1; +- } +- +- return data->match("none"); ++ SBuf serverNameKeeper; // because c_str() is not constant ++ if (ConnStateData *conn = checklist->conn()) { ++ if (conn->serverBump()) { ++ if (X509 *peer_cert = conn->serverBump()->serverCert.get()) ++ return Ssl::matchX509CommonNames(peer_cert, (void *)data, check_cert_domain<MatchType>); ++ } ++ ++ if (conn->sslCommonName().isEmpty()) { ++ const char *host = checklist->request->GetHost(); ++ if (host && *host) // paranoid first condition: host() is never nil ++ serverName = host; ++ } else { ++ serverNameKeeper = conn->sslCommonName(); ++ serverName = serverNameKeeper.c_str(); ++ } ++ } ++ ++ if (!serverName) ++ serverName = "none"; ++ ++ return data->match(serverName); + } + + ACLServerNameStrategy * + +=== modified file 'src/cf.data.pre' +--- src/cf.data.pre 2016-10-29 23:26:28 +0000 ++++ src/cf.data.pre 2016-11-14 10:51:24 +0000 +@@ -1167,6 +1167,9 @@ + # During each Ssl-Bump step, Squid may improve its understanding of a + # "true server name". Unlike dstdomain, this ACL does not perform + # DNS lookups. ++ # The "none" name can be used to match transactions where Squid ++ # could not compute the server name using any information source ++ # already available at the ACL evaluation time. + + acl aclname ssl::server_name_regex [-i] \.foo\.com ... + # regex matches server name obtained from various sources [fast] + diff --git a/src/patches/squid/squid-3.5-14111.patch b/src/patches/squid/squid-3.5-14111.patch new file mode 100644 index 0000000..984069b --- /dev/null +++ b/src/patches/squid/squid-3.5-14111.patch @@ -0,0 +1,43 @@ +------------------------------------------------------------ +revno: 14111 +revision-id: squid3(a)treenet.co.nz-20161114105434-f1uvw2lu8l4lpgay +parent: squid3(a)treenet.co.nz-20161114105124-46hmtnsg8uj4owxz +author: Garri Djavadyan <garryd(a)comnet.uz> +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Mon 2016-11-14 23:54:34 +1300 +message: + Fix spelling for digest nonce cache maintenance event +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161114105434-f1uvw2lu8l4lpgay +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: 8c91678868beb689db5e0e6eaa6911c44f503ac8 +# timestamp: 2016-11-14 10:56:03 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161114105124-\ +# 46hmtnsg8uj4owxz +# +# Begin patch +=== modified file 'src/auth/digest/Config.cc' +--- src/auth/digest/Config.cc 2016-01-01 00:14:27 +0000 ++++ src/auth/digest/Config.cc 2016-11-14 10:54:34 +0000 +@@ -204,7 +204,7 @@ + if (!digest_nonce_cache) { + digest_nonce_cache = hash_create((HASHCMP *) strcmp, 7921, hash_string); + assert(digest_nonce_cache); +- eventAdd("Digest none cache maintenance", authenticateDigestNonceCacheCleanup, NULL, static_cast<Auth::Digest::Config*>(Auth::Config::Find("digest"))->nonceGCInterval, 1); ++ eventAdd("Digest nonce cache maintenance", authenticateDigestNonceCacheCleanup, NULL, static_cast<Auth::Digest::Config*>(Auth::Config::Find("digest"))->nonceGCInterval, 1); + } + } + +@@ -268,7 +268,7 @@ + debugs(29, 3, "Finished cleaning the nonce cache."); + + if (static_cast<Auth::Digest::Config*>(Auth::Config::Find("digest"))->active()) +- eventAdd("Digest none cache maintenance", authenticateDigestNonceCacheCleanup, NULL, static_cast<Auth::Digest::Config*>(Auth::Config::Find("digest"))->nonceGCInterval, 1); ++ eventAdd("Digest nonce cache maintenance", authenticateDigestNonceCacheCleanup, NULL, static_cast<Auth::Digest::Config*>(Auth::Config::Find("digest"))->nonceGCInterval, 1); + } + + static void + diff --git a/src/patches/squid/squid-3.5-14112.patch b/src/patches/squid/squid-3.5-14112.patch new file mode 100644 index 0000000..a63c1c0 --- /dev/null +++ b/src/patches/squid/squid-3.5-14112.patch @@ -0,0 +1,60 @@ +------------------------------------------------------------ +revno: 14112 +revision-id: squid3(a)treenet.co.nz-20161114124051-s0vzoj5exv5g8w56 +parent: squid3(a)treenet.co.nz-20161114105434-f1uvw2lu8l4lpgay +author: Alex Rousskov <rousskov(a)measurement-factory.com> +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Tue 2016-11-15 01:40:51 +1300 +message: + Honor SBufReservationRequirements::minSize regardless of idealSize. + + In a fully specified SBufReservationRequirements, idealSize would + naturally match or exceed minSize. However, the idealSize default value + (zero) may not. We should honor minSize regardless of idealSize, just as + the API documentation promises to do. + + No runtime changes expected right now because the only existing user of + SBufReservationRequirements sets .idealSize to CLIENT_REQ_BUF_SZ (4096) + and .minSize to 1024. +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161114124051-s0vzoj5exv5g8w56 +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: fb0969aa035352582364b529a70286cbfd89564a +# timestamp: 2016-11-14 12:43:10 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161114105434-\ +# f1uvw2lu8l4lpgay +# +# Begin patch +=== modified file 'src/SBuf.cc' +--- src/SBuf.cc 2016-06-18 13:36:07 +0000 ++++ src/SBuf.cc 2016-11-14 12:40:51 +0000 +@@ -178,7 +178,8 @@ + if (!mustRealloc && len_ >= req.maxCapacity) + return spaceSize(); // but we cannot reallocate + +- const size_type newSpace = std::min(req.idealSpace, maxSize - len_); ++ const size_type desiredSpace = std::max(req.minSpace, req.idealSpace); ++ const size_type newSpace = std::min(desiredSpace, maxSize - len_); + reserveCapacity(std::min(len_ + newSpace, req.maxCapacity)); + debugs(24, 7, id << " now: " << off_ << '+' << len_ << '+' << spaceSize() << + '=' << store_->capacity); + +=== modified file 'src/SBuf.h' +--- src/SBuf.h 2016-06-18 13:36:07 +0000 ++++ src/SBuf.h 2016-11-14 12:40:51 +0000 +@@ -635,9 +635,10 @@ + /* + * Parameters are listed in the reverse order of importance: Satisfaction of + * the lower-listed requirements may violate the higher-listed requirements. ++ * For example, idealSpace has no effect unless it exceeds minSpace. + */ + size_type idealSpace; ///< if allocating anyway, provide this much space +- size_type minSpace; ///< allocate if spaceSize() is smaller ++ size_type minSpace; ///< allocate [at least this much] if spaceSize() is smaller + size_type maxCapacity; ///< do not allocate more than this + bool allowShared; ///< whether sharing our storage with others is OK + }; + diff --git a/src/patches/squid/squid-3.5-14113.patch b/src/patches/squid/squid-3.5-14113.patch new file mode 100644 index 0000000..d545026 --- /dev/null +++ b/src/patches/squid/squid-3.5-14113.patch @@ -0,0 +1,47 @@ +------------------------------------------------------------ +revno: 14113 +revision-id: squid3(a)treenet.co.nz-20161115075728-2xj2621oh5bwn8wn +parent: squid3(a)treenet.co.nz-20161114124051-s0vzoj5exv5g8w56 +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Tue 2016-11-15 20:57:28 +1300 +message: + TLS: Make key= before cert= an error instead of quietly hiding the issue + + This squid.conf setup is fatal in Squid-4. So best to fix these installations. + Even though Squdi-3 can cope with it. +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20161115075728-2xj2621oh5bwn8wn +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: a18738f4cbf0c1bd368e61d4b19c5d6f5005b919 +# timestamp: 2016-11-15 07:58:39 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20161114124051-\ +# s0vzoj5exv5g8w56 +# +# Begin patch +=== modified file 'src/cache_cf.cc' +--- src/cache_cf.cc 2016-09-23 11:11:48 +0000 ++++ src/cache_cf.cc 2016-11-15 07:57:28 +0000 +@@ -2257,6 +2257,9 @@ + safe_free(p->sslcert); + p->sslcert = xstrdup(token + 8); + } else if (strncmp(token, "sslkey=", 7) == 0) { ++ if (!p->sslcert) { ++ debugs(3, DBG_CRITICAL, "ERROR: " << cfg_directive << ": sslcert= option must be set before sslkey= is used."); ++ } + safe_free(p->sslkey); + p->sslkey = xstrdup(token + 7); + } else if (strncmp(token, "sslversion=", 11) == 0) { +@@ -3729,6 +3732,9 @@ + safe_free(s->cert); + s->cert = xstrdup(token + 5); + } else if (strncmp(token, "key=", 4) == 0) { ++ if (!s->cert) { ++ debugs(3, DBG_CRITICAL, "ERROR: " << cfg_directive << ": cert= option must be set before key= is used."); ++ } + safe_free(s->key); + s->key = xstrdup(token + 4); + } else if (strncmp(token, "version=", 8) == 0) { + -- 2.10.2

1 0

WAN Failover
by Jeffrey S. Russell 29 Nov '16

29 Nov '16

First, I apologize if I am not conforming to any specific processes or etiquette in this correspondence. I did look for guidance prior to sending this email, and didn't find any. Now, on to the purpose of this missive: I have been using IPFire for about 4 years now. I'm quite impressed with the platform and its sophistication. However, I ran into a need for WAN Failover, which was absent in the platform. After looking for solutions and finding very little, I became adventurous. I'm hoping that this can be taken as a contribution to be incorporated into the core platform, though it will likely need a little tweaking. I created my own WAN Failover solution for IPFire, including a script that checks and verifies the primary connection and switches to the secondary WAN in the event of a failure. It continues to monitor the primary and switches back once it's reliably up again. Additionally, I "hacked" the integration of configuration pages in the Web GUI. To be clear, I am not a typically educated programmer, but have learned along the way due to various needs I or others have had. My technique may be lacking, so please be gentle. :) Here's what I did: On the IPFire box, I had to do the following: 1. Add a secondary IP address to the RED interface 2. Modify the file "/var/ipfire/menu.d/30-network.menu" to include a menu item for "WAN Failover" 3. Modify the file "/var/ipfire/langs/en.pl" to include certain language additions (I didn't know the correct words for the other languages, but could research to add) 4. Create a CGI file for WAN failover, "/srv/web/ipfire/cgi-bin/failover.cgi" 5. Create a folder for the failover config, "/var/ipfire/failover", and a file in the folder, "failover.conf", marking both for owner and group, "nobody:nobody" 6. Create a script to switch from Primary to Secondary WAN and vice-versa 7. Add a fcrontab entry to run the script every 5 minutes To add the secondary IP address, I edited "/etc/rc.d/init.d/networking/red" and inserted "ip addr add 1.1.1.2/30 dev red0" on line 117. I'm not happy with specifying the IP address explicitly in this file, but I have not yet delved deep enough to understand the best way to include this as a variable, especially given the complexity of this file. My implementation is based on Ethernet-only, but could be further developed to encompass any RED interface type. To do this, someone smarter than me would need to make this more integrated with the IPFire setup. This is, in my mind, the weakest part of my implementation. Here are the entries I added to the /var/ipfire/langs/en.pl: 'Failover' => 'WAN Failover', 'ping target' => 'Ping Target', 'primary isp name' => 'Primary ISP Name', 'secondary isp name' => 'Secondary ISP Name', The CGI file for WAN Failover includes all the required fields for the gateway switching script: * Ping Target - This is the IP address that should be used to check for Layer-3 connectivity over the Primary WAN. This should always be an IP address, because DNS resolution failure could cause the script to fail in error. * Gateway - This is the IP address of the Primary WAN gateway, which we discover from the "/var/ipfire/network/settings" file. * Primary ISP Name - This is just a useful name for the primary, typically the name of your ISP and is used in the logging. * Secondary ISP Name - Again, a useful name and is relevant in logging. * Source IP - This is the Source IP address to be used to verify connectivity and should align with the subnet of the primary WAN link gateway. * Mailserver Address - This is the FQDN of the mail server for notifications of gateway changes. * Mailserver Port - This is the TCP port the mail server listens on. * Mail Sender - This is the sender email address, which should represent the IPFire box. * Mail recipient - This is the receiver email address, which should represent the indivudual that manages the IPFire box, or can be an email address linked to a distribution list for multiple recipients. * Username - This is the mail server username for the IPFire login to email. * Password - This is the mail server password for the IPFire login to email. If I had more time and/or better skills, I would have added an optional checkbox to enable/disable email notification as well as optional credential entry. I would also have considered using the "Mailserver" package in IPFire and its relevant credentials. The following is my CGI file for WAN Failover: #!/usr/bin/perl ############################################################################ ### # # # IPFire.org - A linux based firewall # # Copyright (C) 2007 Michael Tremer & Christian Schmidt # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # # the Free Software Foundation, either version 3 of the License, or # # (at your option) any later version. # # # # This program is distributed in the hope that it will be useful, # # but WITHOUT ANY WARRANTY; without even the implied warranty of # # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # # GNU General Public License for more details. # # # # You should have received a copy of the GNU General Public License # # along with this program. If not, see <http://www.gnu.org/licenses/>. # # # ############################################################################ ### use strict; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; my %cgiparams=(); my %mainsettings=(); my %failoversettings=(); my %netsettings=(); my %color=(); my %checked=(); my $errormessage=''; $cgiparams{'ACTION'} = ''; &Header::getcgihash(\%cgiparams); &Header::showhttpheaders(); &General::readhash("${General::swroot}/main/settings",\%mainsettings); &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/i nclude/colors.txt", \%color); &General::readhash("${General::swroot}/failover/failover.conf",\%failoverset tings); &General::readhash("${General::swroot}/ethernet/settings",\%netsettings); if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}") { $failoversettings{'TARGET'} = $cgiparams{'TARGET'}; $failoversettings{'MAILFROM'} = $cgiparams{'MAILFROM'}; $failoversettings{'MAILTO'} = $cgiparams{'MAILTO'}; $failoversettings{'PRIMARYISP'} = $cgiparams{'PRIMARYISP'}; $failoversettings{'SECONDARYISP'} = $cgiparams{'SECONDARYISP'}; $failoversettings{'MAILSERVER'} = $cgiparams{'MAILSERVER'}; $failoversettings{'MAILPORT'} = $cgiparams{'MAILPORT'}; $failoversettings{'MAILUSER'} = $cgiparams{'MAILUSER'}; $failoversettings{'MAILPWD'} = $cgiparams{'MAILPWD'}; $failoversettings{'GATEWAY'} = $cgiparams{'GATEWAY'}; $failoversettings{'SOURCEIP'} = $cgiparams{'SOURCEIP'}; &General::writehash("${General::swroot}/failover/failover.conf", \%failoversettings); SAVE_ERROR: } else { if ($failoversettings{'TARGET'}) { $cgiparams{'TARGET'} = $failoversettings{'TARGET'}; } if ($failoversettings{'MAILFROM'}) { $cgiparams{'MAILFROM'} = $failoversettings{'MAILFROM'}; } if ($failoversettings{'MAILTO'}) { $cgiparams{'MAILTO'} = $failoversettings{'MAILTO'}; } if ($failoversettings{'PRIMARYISP'}) { $cgiparams{'PRIMARYISP'} = $failoversettings{'PRIMARYISP'}; } if ($failoversettings{'SECONDARYISP'}) { $cgiparams{'SECONDARYISP'} = $failoversettings{'SECONDARYISP'}; } if ($failoversettings{'MAILSERVER'}) { $cgiparams{'MAILSERVER'} = $failoversettings{'MAILSERVER'}; } if ($failoversettings{'MAILPORT'}) { $cgiparams{'MAILPORT'} = $failoversettings{'MAILPORT'}; } if ($failoversettings{'MAILUSER'}) { $cgiparams{'MAILUSER'} = $failoversettings{'MAILUSER'}; } if ($failoversettings{'MAILPWD'}) { $cgiparams{'MAILPWD'} = $failoversettings{'MAILPWD'}; } if ($failoversettings{'GATEWAY'}) { $cgiparams{'GATEWAY'} = $failoversettings{'GATEWAY'}; } else { $cgiparams{'GATEWAY'} = $netsettings{'DEFAULT_GATEWAY'}; } if ($failoversettings{'SOURCEIP'}) { $cgiparams{'SOURCEIP'} = $failoversettings{'SOURCEIP'}; } else { $cgiparams{'SOURCEIP'} = $netsettings{'RED_ADDRESS'}; } } &Header::openpage($Lang::tr{'Failover'}, 1, ''); print <<END <form method='post' action='$ENV{'SCRIPT_NAME'}'> <table width='100%'> <tr> <td> </td> <td width='25%' class='base'>$Lang::tr{'ping target'}: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='TARGET' value='$cgiparams{'TARGET'}' /></td> <td width='25%' class='base'>$Lang::tr{'primary isp name'}: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='PRIMARYISP' value='$cgiparams{'PRIMARYISP'}' /></td> </tr> <tr> <td> </td> <td width='25%' class='base'>$Lang::tr{'gateway'}: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='GATEWAY' value='$cgiparams{'GATEWAY'}' /></td> <td width='25%' class='base'>$Lang::tr{'secondary isp name'}: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='SECONDARYISP' value='$cgiparams{'SECONDARYISP'}' /></td> </tr> <tr> <td> </td> <td width='25%' class='base'></td> <td width='25%'></td> <td width='25%' class='base'>Source IP: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='SOURCEIP' value='$cgiparams{'SOURCEIP'}' /></td> </tr> <tr> <td> </td> <td width='25%' class='base'>$Lang::tr{'email mailaddr'}: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='MAILSERVER' value='$cgiparams{'MAILSERVER'}' /></td> <td width='25%' class='base'>$Lang::tr{'email mailport'}: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='MAILPORT' value='$cgiparams{'MAILPORT'}' /></td> </tr> <tr> <td> </td> <td width='25%' class='base'>$Lang::tr{'email mailsender'}: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='MAILFROM' value='$cgiparams{'MAILFROM'}' /></td> <td width='25%' class='base'>$Lang::tr{'email mailrcpt'}: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='MAILTO' value='$cgiparams{'MAILTO'}' /></td> </tr> <tr> <td> </td> <td width='25%' class='base'>$Lang::tr{'email mailuser'}: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='text' name='MAILUSER' value='$cgiparams{'MAILUSER'}' /></td> <td width='25%' class='base'>$Lang::tr{'email mailpass'}: <img src='/blob.gif' alt='*' /></td> <td width='25%'><input type='password' name='MAILPWD' value='$cgiparams{'MAILPWD'}' /></td> </tr> </table> <table width='100%'> <tr> <td> </td> <td width='25%'><img src='/blob.gif' alt='*' /> $Lang::tr{'required field'}</td> <td width='50%' align='right'></td> <td width='25%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td> </tr> </table> END ; &Header::closebox(); &Header::closebigbox(); &Header::closepage(); The following is the format of the "failover.conf" file: MAILUSER=<username> GATEWAY=<gateway_address> MAILPORT=<mail_port> MAILPWD=<mail_password> TARGET=<ping_target> SOURCEIP=<source_ip_address> MAILTO=<email_recipient> MAILFROM=<email_sender> SECONDARYISP=<secondary_isp> PRIMARYISP=<primary_isp> MAILSERVER=<mail_server_fqdn> The following is the "check-gateway.sh" script: # Script to check on the status of the Primary WAN network and switch to a Secondary WAN network. #!/bin/bash # Create logfile and send all output to logfile logfile=/var/log/gateway-check.log exec &> >(tee -a "$logfile") # Define variable for a date/time stamp datetimestamp=$(date) # Define variable for the source IP to use for the ping source SRC_IP=$(cat /var/ipfire/failover/failover.conf | grep SOURCEIP | cut -d "=" -f 2) # Define variable for Primary Gateway Address GATEWAY_IP=$(cat /var/ipfire/failover/failover.conf | grep GATEWAY | cut -d "=" -f 2) # Define variable for destination MACs DEST_MAC=$(arp -n $GATEWAY_IP | grep $GATEWAY_IP | awk '{print $3}') # Define variable for ping target PING_TARGET=$(cat /var/ipfire/failover/failover.conf | grep TARGET | cut -d "=" -f 2) # Define email fields MAIL_FROM=$(cat /var/ipfire/failover/failover.conf | grep MAILFROM | cut -d "=" -f 2) MAIL_TO=$(cat /var/ipfire/failover/failover.conf | grep MAILTO | cut -d "=" -f 2) PRIMARY_ISP=$(cat /var/ipfire/failover/failover.conf | grep PRIMARYISP | cut -d "=" -f 2) SECONDARY_ISP=$(cat /var/ipfire/failover/failover.conf | grep SECONDARYISP | cut -d "=" -f 2) MAIL_SERVER=$(cat /var/ipfire/failover/failover.conf | grep MAILSERVER | cut -d "=" -f 2) MAIL_PORT=$(cat /var/ipfire/failover/failover.conf | grep MAILPORT | cut -d "=" -f 2) MAIL_USER=$(cat /var/ipfire/failover/failover.conf | grep MAILUSER | cut -d "=" -f 2) MAIL_PWD=$(cat /var/ipfire/failover/failover.conf | grep MAILPWD | cut -d "=" -f 2) # Beginning bracket for logging results to show the date.time of the event echo "=========="$datetimestamp"==========" echo "------------------Parameter Check------------------" echo "---------------------------------------------------" echo "Field | Parameter" echo "___________________________________________________" echo "Source IP Address | "$SRC_IP echo "Gateway IP Address | "$GATEWAY_IP echo "Destination MAC Address | "$DEST_MAC echo "Ping Target | "$PING_TARGET echo "Source email Address | "$MAIL_FROM echo "Destination email Address | "$MAIL_TO echo "Primary ISP Name | "$PRIMARY_ISP echo "Secondary ISP Name | "$SECONDARY_ISP echo "Mail Server FQDN | "$MAIL_SERVER echo "Mail Server Port | "$MAIL_PORT echo "Mail Server Username | "$MAIL_USER echo "Mail Server Password | "$MAIL_PWD echo # Creating a variable to determine the result of the nping command, which send 5 pings to the ping target, always over my Primary WAN, no matter the default gateway # The command pulls the number of "Lost" pings, which will be a value from 1 to 5. result=$(nping --icmp --source-ip $SRC_IP --dest-mac $DEST_MAC $PING_TARGET | grep Lost | awk '{print $12}') # Creating a variable to determine the default gateway. The "route" command shows the routing table, the "grep" command is pulling the default route line and the "awk" command is printing the second value on the line. gateway=$(route | grep default | awk '{print $2}') # This prints the current gateway and the number of lost pings to the logfile. echo "The current gateway is ("$gateway"), and the number of lost pings is "$result"." # Here, I evaluate the conditions and create an action depending on the result. First, I am trying to determine if all pings were lost. If all pings are lost, I'm declaring the Primary WAN link to be "dead". if [ $result -eq 5 ]; then # Next, knowing that the Primary WAN has failed, I check to see if the default gateway is over my Primary WAN ("gateway" is the hostname). if [ "$gateway" = "gateway" ]; then # The next line logs that the Primary WAN link has failed and we will switch over to Secondary WAN. echo "The $PRIMARY_ISP link has failed. Switching over to the $SECONDARY_ISP link..." # The next lines delete the current Primary WAN gateway, switch to Secondary WAN and show the routing table for confirmation. route delete default gw gateway route add default gw 1.1.1.1 echo "Gateway switched from $PRIMARY_ISP to $SECONDARY_ISP. Following is the routing table:" route # The next command sends me an email to alert me that the Primary WAN link is down and we are switching over to Secondary WAN. echo sendEmail -f $MAIL_FROM -t $MAIL_TO -u "Gateway Change Alert" -m "The $PRIMARY_ISP link has failed. Switching over to $SECONDARY_ISP link." -s $MAIL_SERVER:$MAIL_PORT -xu $MAIL_USER -xp $MAIL_PWD else # Now, again knowing that we failed over Primary WAN, if the default gateway is Secondary WAN, we don't do anything. echo "$SECONDARY_ISP is the current active link. $PRIMARY_ISP is still down." # Since there is nothing we need to do, we next exit the shell script. exit fi # The next section is based on if the Primary WAN is operational (i.e. less than 5 lost pings) else # Knowing that the Primary WAN link is viable, we now evaluate if we are using the Secondary WAN link (1.1.1.1 is the gateway when using Secondary WAN). if [ "$gateway" = "1.1.1.1" ]; then # The next line logs that the Primary WAN is operational and we will switch back to Primary WAN from Secondary WAN. echo "The $PRIMARY_ISP link is now operational. Switching over to the $PRIMARY_ISP link." # The next lines delete the current Secondary WAN gateway, switch to Primary WAN and show the routing table for verification. route delete default gw 1.1.1.1 route add default gw gateway echo "Gateway switched from $SECONDARY_ISP to $PRIMARY_ISP. Following is the routing table:" route # The next command sends me an email to alert me that the Primary WAN link is up and we are switching back to the Primary WAN. echo sendEmail -f $MAIL_FROM -t $MAIL_TO -u "Gateway Change Alert" -m "The $PRIMARY_ISP link is now operational. Switching back to the $PRIMARY_ISP link." -s $MAIL_SERVER:$MAIL_PORT -xu $MAIL_USER -xp $MAIL_PWD else # Now, again knowing that the Primary WAN is operational, if the default gateway is already the cable mode, then we don't do anything. echo "The $PRIMARY_ISP link is operational and $PRIMARY_ISP is the current active link." fi fi # We end the logging with the same date/time stamp to indicate that this is the end of this iteration of the scrupt run. echo "=========="$datetimestamp"==========" Finally, the following is the addition to fcrontab for the 5-minute interval run of the script: # Check the gateway connection every 15 minutes, if down, switch gateway to Verizon backup */5 * * * * /root/check-gateway.sh The script is currently stored in /root/, but that is just in my implementation while I am ignorant of the proper location of such a script. So, that's it! I'm open to thoughts or suggestions, but I'm currently at my limit of capability. I'd love to see this get added as an option in the initial setup, or packaged into an addon. I've seen numerous requests for this kind of feature, so I did this to get something functional in place. If there are any resources that can help me develop this into an official add-on, I'd love to see it so this can be available to the community. Thank you! Jeff Russell

2 2

Patchwork
by Jonatan Schlag 29 Nov '16

29 Nov '16

Hi, some members of this list got or will get some emails from our patchwork and maybe wonder why the patches were superseded. I will try to explain why these emails were sent out. I updated some (i think around 20 to 30) patches, because - the version in git is newer than the version of the the patch or - there is a new version of this patch or - the patch was not correctly caught from the mail (There were 2 patches this happen) and so the patch was more than one time in patchwork or - the patch belong to dnsmasq Regards Jonatan

3 2

[PATCH] boost: Fix RPATH issue on i686.
by Stefan Schantl 28 Nov '16

28 Nov '16

Fixes #11018. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- boost/boost.nm | 2 +- boost/patches/boost-1.60.0-no-rpath.patch0 | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 boost/patches/boost-1.60.0-no-rpath.patch0 diff --git a/boost/boost.nm b/boost/boost.nm index 0a6af33..1e6038c 100644 --- a/boost/boost.nm +++ b/boost/boost.nm @@ -8,7 +8,7 @@ ver_major = 1 ver_minor = 60 ver_plevel = 0 version = %{ver_major}.%{ver_minor}.%{ver_plevel} -release = 1 +release = 2 groups = System/Libraries url = http://www.boost.org/ diff --git a/boost/patches/boost-1.60.0-no-rpath.patch0 b/boost/patches/boost-1.60.0-no-rpath.patch0 new file mode 100644 index 0000000..eed65c2 --- /dev/null +++ b/boost/patches/boost-1.60.0-no-rpath.patch0 @@ -0,0 +1,21 @@ +diff -up tools/build/src/tools/gcc.jam.rpath tools/build/src/tools/gcc.jam +--- tools/build/src/tools/gcc.jam.rpath 2016-05-27 13:30:01.092192721 -0500 ++++ tools/build/src/tools/gcc.jam 2016-05-27 13:30:46.686987585 -0500 +@@ -952,7 +952,7 @@ rule link ( targets * : sources * : prop + + actions link bind LIBRARIES + { +- "$(CONFIG_COMMAND)" -L"$(LINKPATH)" -Wl,$(RPATH_OPTION:E=-R)$(SPACE)-Wl,$(RPATH) -Wl,-rpath-link$(SPACE)-Wl,"$(RPATH_LINK)" -o "$(<)" $(START-GROUP) "$(>)" "$(LIBRARIES)" $(FINDLIBS-ST-PFX) -l$(FINDLIBS-ST) $(FINDLIBS-SA-PFX) -l$(FINDLIBS-SA) $(END-GROUP) $(OPTIONS) $(USER_OPTIONS) ++ "$(CONFIG_COMMAND)" -L"$(LINKPATH)" -o "$(<)" $(START-GROUP) "$(>)" "$(LIBRARIES)" $(FINDLIBS-ST-PFX) -l$(FINDLIBS-ST) $(FINDLIBS-SA-PFX) -l$(FINDLIBS-SA) $(END-GROUP) $(OPTIONS) $(USER_OPTIONS) + } + + +@@ -1018,7 +1018,7 @@ rule link.dll ( targets * : sources * : + # Differs from 'link' above only by -shared. + actions link.dll bind LIBRARIES + { +- "$(CONFIG_COMMAND)" -L"$(LINKPATH)" -Wl,$(RPATH_OPTION:E=-R)$(SPACE)-Wl,$(RPATH) "$(.IMPLIB-COMMAND)$(<[1])" -o "$(<[-1])" $(HAVE_SONAME)-Wl,$(SONAME_OPTION)$(SPACE)-Wl,$(<[-1]:D=) -shared $(START-GROUP) "$(>)" "$(LIBRARIES)" $(FINDLIBS-ST-PFX) -l$(FINDLIBS-ST) $(FINDLIBS-SA-PFX) -l$(FINDLIBS-SA) $(END-GROUP) $(OPTIONS) $(USER_OPTIONS) ++ "$(CONFIG_COMMAND)" -L"$(LINKPATH)" "$(.IMPLIB-COMMAND)$(<[1])" -o "$(<[-1])" $(HAVE_SONAME)-Wl,$(SONAME_OPTION)$(SPACE)-Wl,$(<[-1]:D=) -shared $(START-GROUP) "$(>)" "$(LIBRARIES)" $(FINDLIBS-ST-PFX) -l$(FINDLIBS-ST) $(FINDLIBS-SA-PFX) -l$(FINDLIBS-SA) $(END-GROUP) $(OPTIONS) $(USER_OPTIONS) + } + + rule setup-threading ( targets * : sources * : properties * ) -- 2.7.4

2 1

[PATCHv2] boost: Fix RPATH issue on i686.
by Stefan Schantl 28 Nov '16

28 Nov '16

Fixes #11176. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- boost/boost.nm | 2 +- boost/patches/boost-1.60.0-no-rpath.patch0 | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 boost/patches/boost-1.60.0-no-rpath.patch0 diff --git a/boost/boost.nm b/boost/boost.nm index 0a6af33..1e6038c 100644 --- a/boost/boost.nm +++ b/boost/boost.nm @@ -8,7 +8,7 @@ ver_major = 1 ver_minor = 60 ver_plevel = 0 version = %{ver_major}.%{ver_minor}.%{ver_plevel} -release = 1 +release = 2 groups = System/Libraries url = http://www.boost.org/ diff --git a/boost/patches/boost-1.60.0-no-rpath.patch0 b/boost/patches/boost-1.60.0-no-rpath.patch0 new file mode 100644 index 0000000..eed65c2 --- /dev/null +++ b/boost/patches/boost-1.60.0-no-rpath.patch0 @@ -0,0 +1,21 @@ +diff -up tools/build/src/tools/gcc.jam.rpath tools/build/src/tools/gcc.jam +--- tools/build/src/tools/gcc.jam.rpath 2016-05-27 13:30:01.092192721 -0500 ++++ tools/build/src/tools/gcc.jam 2016-05-27 13:30:46.686987585 -0500 +@@ -952,7 +952,7 @@ rule link ( targets * : sources * : prop + + actions link bind LIBRARIES + { +- "$(CONFIG_COMMAND)" -L"$(LINKPATH)" -Wl,$(RPATH_OPTION:E=-R)$(SPACE)-Wl,$(RPATH) -Wl,-rpath-link$(SPACE)-Wl,"$(RPATH_LINK)" -o "$(<)" $(START-GROUP) "$(>)" "$(LIBRARIES)" $(FINDLIBS-ST-PFX) -l$(FINDLIBS-ST) $(FINDLIBS-SA-PFX) -l$(FINDLIBS-SA) $(END-GROUP) $(OPTIONS) $(USER_OPTIONS) ++ "$(CONFIG_COMMAND)" -L"$(LINKPATH)" -o "$(<)" $(START-GROUP) "$(>)" "$(LIBRARIES)" $(FINDLIBS-ST-PFX) -l$(FINDLIBS-ST) $(FINDLIBS-SA-PFX) -l$(FINDLIBS-SA) $(END-GROUP) $(OPTIONS) $(USER_OPTIONS) + } + + +@@ -1018,7 +1018,7 @@ rule link.dll ( targets * : sources * : + # Differs from 'link' above only by -shared. + actions link.dll bind LIBRARIES + { +- "$(CONFIG_COMMAND)" -L"$(LINKPATH)" -Wl,$(RPATH_OPTION:E=-R)$(SPACE)-Wl,$(RPATH) "$(.IMPLIB-COMMAND)$(<[1])" -o "$(<[-1])" $(HAVE_SONAME)-Wl,$(SONAME_OPTION)$(SPACE)-Wl,$(<[-1]:D=) -shared $(START-GROUP) "$(>)" "$(LIBRARIES)" $(FINDLIBS-ST-PFX) -l$(FINDLIBS-ST) $(FINDLIBS-SA-PFX) -l$(FINDLIBS-SA) $(END-GROUP) $(OPTIONS) $(USER_OPTIONS) ++ "$(CONFIG_COMMAND)" -L"$(LINKPATH)" "$(.IMPLIB-COMMAND)$(<[1])" -o "$(<[-1])" $(HAVE_SONAME)-Wl,$(SONAME_OPTION)$(SPACE)-Wl,$(<[-1]:D=) -shared $(START-GROUP) "$(>)" "$(LIBRARIES)" $(FINDLIBS-ST-PFX) -l$(FINDLIBS-ST) $(FINDLIBS-SA-PFX) -l$(FINDLIBS-SA) $(END-GROUP) $(OPTIONS) $(USER_OPTIONS) + } + + rule setup-threading ( targets * : sources * : properties * ) -- 2.7.4

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2016