Development April 2017

development@lists.ipfire.org

11 participants
59 discussions

Re: forgot to say...
by Paul Simmons 05 Apr '17

05 Apr '17

On Wed, 2017-04-05 at 10:09 +0100, Michael Tremer wrote: > Hi, > > thank you. > > Can we maybe arrange a session where I log in from remote to your > system and see > what I can find? > > So far I don't have many ideas. > > Would this be possible? Where in the world are you even? > > Best, > -Michael > > On Mon, 2017-04-03 at 15:35 -0500, Paul Simmons wrote: > > Michael, I forgot to tell you that I'm willing and able to test > > script changes > > (such as the unbound init) or substitute executables on the test > > system. > > > > Thnks, > > Paul > > Hello, Michael. Oh, how I wish! Unfortunately, I'm NATed and the ISP doesn't allow "local servers". Also, without working DNS, I'm unsure of how to connect. I'm in a rural area of West Texas, with "challenging" terrain. I'm hoping a nearby (~10km distant) fiber provider will build a NLOS WISP in a year or two; they are interested, but not ready to commit. Perhaps we should take this discussion out of the devel list for now? I appreciate your attention, and realize you have a lot of others to support. I notice core110 is in testing. I'll try some changes locally, based on that release. I'll poke around in the unbound init.d and get some better info. I'll report any findings in another thread. Best, Paul

1 0

[PATCH] logwatch 7.4.3: some more fixes for rootfile
by Matthias Fischer 05 Apr '17

05 Apr '17

Hi, 'eximstats', 'zz-sys' and 'resolver'-files were missing. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/logwatch | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/logwatch b/config/rootfiles/common/logwatch index 36b90677d..e99da016d 100644 --- a/config/rootfiles/common/logwatch +++ b/config/rootfiles/common/logwatch @@ -94,7 +94,7 @@ usr/share/logwatch/default.conf/services/dhcpd.conf #usr/share/logwatch/default.conf/services/evtsecurity.conf #usr/share/logwatch/default.conf/services/evtsystem.conf #usr/share/logwatch/default.conf/services/exim.conf -#usr/share/logwatch/default.conf/services/eximstats.conf +usr/share/logwatch/default.conf/services/eximstats.conf #usr/share/logwatch/default.conf/services/extreme-networks.conf #usr/share/logwatch/default.conf/services/fail2ban.conf #usr/share/logwatch/default.conf/services/fetchmail.conf @@ -182,7 +182,7 @@ usr/share/logwatch/default.conf/services/zz-disk_space.conf #usr/share/logwatch/default.conf/services/zz-lm_sensors.conf usr/share/logwatch/default.conf/services/zz-network.conf usr/share/logwatch/default.conf/services/zz-runtime.conf -#usr/share/logwatch/default.conf/services/zz-sys.conf +usr/share/logwatch/default.conf/services/zz-sys.conf #usr/share/logwatch/default.conf/services/zz-zfs.conf #usr/share/logwatch/dist.conf usr/share/logwatch/dist.conf/logfiles @@ -238,7 +238,7 @@ usr/share/logwatch/scripts/services/dialup #usr/share/logwatch/scripts/services/evtsecurity #usr/share/logwatch/scripts/services/evtsystem #usr/share/logwatch/scripts/services/exim -#usr/share/logwatch/scripts/services/eximstats +usr/share/logwatch/scripts/services/eximstats #usr/share/logwatch/scripts/services/extreme-networks #usr/share/logwatch/scripts/services/fail2ban #usr/share/logwatch/scripts/services/fetchmail @@ -289,7 +289,7 @@ usr/share/logwatch/scripts/services/postfix #usr/share/logwatch/scripts/services/qmail-send #usr/share/logwatch/scripts/services/qmail-smtpd #usr/share/logwatch/scripts/services/raid -#usr/share/logwatch/scripts/services/resolver +usr/share/logwatch/scripts/services/resolver #usr/share/logwatch/scripts/services/rsyslogd #usr/share/logwatch/scripts/services/rt314 usr/share/logwatch/scripts/services/samba @@ -326,7 +326,7 @@ usr/share/logwatch/scripts/services/zz-disk_space #usr/share/logwatch/scripts/services/zz-lm_sensors usr/share/logwatch/scripts/services/zz-network usr/share/logwatch/scripts/services/zz-runtime -#usr/share/logwatch/scripts/services/zz-sys +usr/share/logwatch/scripts/services/zz-sys #usr/share/logwatch/scripts/services/zz-zfs #usr/share/logwatch/scripts/shared usr/share/logwatch/scripts/shared/applybinddate -- 2.11.0

2 2

[PATCH] netsnmpd: added lmsensors and some other mibs
by Daniel Weismüller 05 Apr '17

05 Apr '17

Signed-off-by: Daniel Weismüller <daniel.weismueller(a)ipfire.org> --- config/rootfiles/packages/netsnmpd | 3 +++ lfs/netsnmpd | 13 ++++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/packages/netsnmpd b/config/rootfiles/packages/netsnmpd index 6328949..9d80ec2 100644 --- a/config/rootfiles/packages/netsnmpd +++ b/config/rootfiles/packages/netsnmpd @@ -542,6 +542,8 @@ usr/share/snmp/mibs/IPV6-MIB.txt usr/share/snmp/mibs/IPV6-TC.txt usr/share/snmp/mibs/IPV6-TCP-MIB.txt usr/share/snmp/mibs/IPV6-UDP-MIB.txt +usr/share/snmp/mibs/LM-SENSORS-MIB.txt +usr/share/snmp/mibs/MTA-MIB.txt usr/share/snmp/mibs/NET-SNMP-AGENT-MIB.txt usr/share/snmp/mibs/NET-SNMP-EXAMPLES-MIB.txt usr/share/snmp/mibs/NET-SNMP-EXTEND-MIB.txt @@ -549,6 +551,7 @@ usr/share/snmp/mibs/NET-SNMP-MIB.txt usr/share/snmp/mibs/NET-SNMP-PASS-MIB.txt usr/share/snmp/mibs/NET-SNMP-TC.txt usr/share/snmp/mibs/NET-SNMP-VACM-MIB.txt +usr/share/snmp/mibs/NETWORK-SERVICES-MIB.txt usr/share/snmp/mibs/NOTIFICATION-LOG-MIB.txt usr/share/snmp/mibs/RFC-1215.txt usr/share/snmp/mibs/RFC1155-SMI.txt diff --git a/lfs/netsnmpd b/lfs/netsnmpd index b513678..d91ae91 100644 --- a/lfs/netsnmpd +++ b/lfs/netsnmpd @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = netsnmpd -PAK_VER = 4 +PAK_VER = 5 DEPS = "" ############################################################################### @@ -83,14 +83,21 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --with-sys-location="localhost" \ --with-logfile="/var/log/snmpd.log" \ --with-persistent-directory="/var/net-snmp" \ + --with-mib-modules="host agentx smux \ + ucd-snmp/diskio tcp-mib udp-mib mibII/mta_sendmail \ + ip-mib/ipv4InterfaceTable ip-mib/ipv6InterfaceTable \ + ip-mib/ipAddressPrefixTable/ipAddressPrefixTable \ + ip-mib/ipDefaultRouterTable/ipDefaultRouterTable \ + ip-mib/ipv6ScopeZoneIndexTable ip-mib/ipIfStatsTable \ + sctp-mib rmon-mib etherlike-mib ucd-snmp/lmsensorsMib" --libdir=/usr/lib \ --sysconfdir="/etc" cd $(DIR_APP) && make cd $(DIR_APP) && make install - install -v -m644 $(DIR_SRC)/config/netsnmpd/snmpd.conf /etc/snmpd.conf + install -v -m 644 $(DIR_SRC)/config/netsnmpd/snmpd.conf /etc/snmpd.conf install -v -m 644 $(DIR_SRC)/config/backup/includes/netsnmpd \ /var/ipfire/backup/addons/includes/netsnmpd - install -v -m755 $(DIR_SRC)/src/initscripts/init.d/netsnmpd /etc/init.d/netsnmpd + install -v -m 755 $(DIR_SRC)/src/initscripts/init.d/netsnmpd /etc/init.d/netsnmpd ln -sf ../init.d/netsnmpd /etc/rc.d/rc3.d/S65netsnmpd ln -sf ../init.d/netsnmpd /etc/rc.d/rc0.d/K02netsnmpd ln -sf ../init.d/netsnmpd /etc/rc.d/rc6.d/K02netsnmpd -- 2.7.4

2 1

[PATCH] logwatch: Update to 7.4.3
by Matthias Fischer 04 Apr '17

04 Apr '17

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/logwatch | 9 ++++----- lfs/logwatch | 6 +++--- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/config/rootfiles/common/logwatch b/config/rootfiles/common/logwatch index 9dea4bffd..36b90677d 100644 --- a/config/rootfiles/common/logwatch +++ b/config/rootfiles/common/logwatch @@ -1,11 +1,6 @@ #etc/logwatch etc/logwatch/conf #etc/logwatch/logwatch.cron -#etc/logwatch/conf/ignore.conf -#etc/logwatch/conf/logfiles -#etc/logwatch/conf/logwatch.conf -#etc/logwatch/conf/override.conf -#etc/logwatch/conf/services etc/logwatch/scripts etc/logwatch/scripts/services usr/sbin/logwatch @@ -166,10 +161,12 @@ usr/share/logwatch/default.conf/services/scsi.conf #usr/share/logwatch/default.conf/services/spamassassin.conf usr/share/logwatch/default.conf/services/sshd.conf usr/share/logwatch/default.conf/services/sshd2.conf +#usr/share/logwatch/default.conf/services/sssd.conf #usr/share/logwatch/default.conf/services/stunnel.conf usr/share/logwatch/default.conf/services/sudo.conf #usr/share/logwatch/default.conf/services/syslog-ng.conf usr/share/logwatch/default.conf/services/syslogd.conf +#usr/share/logwatch/default.conf/services/systemd.conf #usr/share/logwatch/default.conf/services/tac_acc.conf #usr/share/logwatch/default.conf/services/tivoli-smc.conf #usr/share/logwatch/default.conf/services/up2date.conf @@ -308,10 +305,12 @@ usr/share/logwatch/scripts/services/scsi #usr/share/logwatch/scripts/services/spamassassin usr/share/logwatch/scripts/services/sshd usr/share/logwatch/scripts/services/sshd2 +#usr/share/logwatch/scripts/services/sssd #usr/share/logwatch/scripts/services/stunnel usr/share/logwatch/scripts/services/sudo #usr/share/logwatch/scripts/services/syslog-ng usr/share/logwatch/scripts/services/syslogd +#usr/share/logwatch/scripts/services/systemd #usr/share/logwatch/scripts/services/tac_acc #usr/share/logwatch/scripts/services/tivoli-smc #usr/share/logwatch/scripts/services/up2date diff --git a/lfs/logwatch b/lfs/logwatch index 7144d07f3..9f9a0db55 100644 --- a/lfs/logwatch +++ b/lfs/logwatch @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2015 Michael Tremer & Christian Schmidt # +# Copyright (C) 2007-2017 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 7.4.1 +VER = 7.4.3 THISAPP = logwatch-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = a0c3d8721f877bdcd4a9089eb1b4691b +$(DL_FILE)_MD5 = 22bd22841caa45f12c605abc3e0c2b09 install : $(TARGET) -- 2.11.0

1 0

[PATCH] logwatch 7.4.1: another fix for rootfile
by Matthias Fischer 04 Apr '17

04 Apr '17

Hi, similar to: http://git.ipfire.org/?p=people/mfischer/ipfire-2.x.git;a=commit;h=9f46e637… A missing '#' for "usr/share/logwatch/default.conf/services" in rootfile. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/logwatch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/rootfiles/common/logwatch b/config/rootfiles/common/logwatch index f0e83e36c..9dea4bffd 100644 --- a/config/rootfiles/common/logwatch +++ b/config/rootfiles/common/logwatch @@ -72,7 +72,7 @@ usr/share/logwatch/default.conf/logfiles/xferlog.conf #usr/share/logwatch/default.conf/logfiles/yum.conf #usr/share/logwatch/default.conf/logfiles/zypp.conf usr/share/logwatch/default.conf/logwatch.conf -usr/share/logwatch/default.conf/services +#usr/share/logwatch/default.conf/services #usr/share/logwatch/default.conf/services/afpd.conf usr/share/logwatch/default.conf/services/amavis.conf #usr/share/logwatch/default.conf/services/arpwatch.conf -- 2.11.0

1 0

[PATCH] logwatch 7.4.1: fix for rootfile
by Matthias Fischer 03 Apr '17

03 Apr '17

Hi, One missing '#' and all underlying 'services' in 'usr/share/logwatch/scripts/services' are installed. 147 files are active, but it should be only 33. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/logwatch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/rootfiles/common/logwatch b/config/rootfiles/common/logwatch index 998ab8ae2..f0e83e36c 100644 --- a/config/rootfiles/common/logwatch +++ b/config/rootfiles/common/logwatch @@ -213,7 +213,7 @@ usr/share/logwatch/scripts/logfiles/xferlog/removeheaders #usr/share/logwatch/scripts/logfiles/yum #usr/share/logwatch/scripts/logfiles/yum/applydate usr/share/logwatch/scripts/logwatch.pl -usr/share/logwatch/scripts/services +#usr/share/logwatch/scripts/services #usr/share/logwatch/scripts/services/afpd usr/share/logwatch/scripts/services/amavis #usr/share/logwatch/scripts/services/arpwatch -- 2.11.0

1 0

[PATCH] squid: Update to 3.5.25
by Matthias Fischer 03 Apr '17

03 Apr '17

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 20 +- ...=> squid-3.5.25-fix-max-file-descriptors.patch} | 0 src/patches/squid/squid-3.5-14142.patch | 72 ----- src/patches/squid/squid-3.5-14143.patch | 55 ---- src/patches/squid/squid-3.5-14144.patch | 43 --- src/patches/squid/squid-3.5-14145.patch | 33 -- src/patches/squid/squid-3.5-14146.patch | 41 --- src/patches/squid/squid-3.5-14147.patch | 37 --- src/patches/squid/squid-3.5-14148.patch | 62 ---- src/patches/squid/squid-3.5-14149.patch | 78 ----- src/patches/squid/squid-3.5-14150.patch | 32 -- src/patches/squid/squid-3.5-14151.patch | 36 --- src/patches/squid/squid-3.5-14152.patch | 35 -- src/patches/squid/squid-3.5-14153.patch | 353 --------------------- 14 files changed, 4 insertions(+), 893 deletions(-) rename src/patches/{squid-3.5.24-fix-max-file-descriptors.patch => squid-3.5.25-fix-max-file-descriptors.patch} (100%) delete mode 100644 src/patches/squid/squid-3.5-14142.patch delete mode 100644 src/patches/squid/squid-3.5-14143.patch delete mode 100644 src/patches/squid/squid-3.5-14144.patch delete mode 100644 src/patches/squid/squid-3.5-14145.patch delete mode 100644 src/patches/squid/squid-3.5-14146.patch delete mode 100644 src/patches/squid/squid-3.5-14147.patch delete mode 100644 src/patches/squid/squid-3.5-14148.patch delete mode 100644 src/patches/squid/squid-3.5-14149.patch delete mode 100644 src/patches/squid/squid-3.5-14150.patch delete mode 100644 src/patches/squid/squid-3.5-14151.patch delete mode 100644 src/patches/squid/squid-3.5-14152.patch delete mode 100644 src/patches/squid/squid-3.5-14153.patch diff --git a/lfs/squid b/lfs/squid index 269902067..70d83b04c 100644 --- a/lfs/squid +++ b/lfs/squid @@ -24,7 +24,7 @@ include Config -VER = 3.5.24 +VER = 3.5.25 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 3fae511e16b6379b61c011914673973d +$(DL_FILE)_MD5 = 6b7dd7b42b1adacf08f3155640ea2782 install : $(TARGET) @@ -70,19 +70,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xaf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14142.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14143.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14144.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14145.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14146.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14147.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14148.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14149.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14150.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14151.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14152.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14153.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid-3.5.24-fix-max-file-descriptors.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid-3.5.25-fix-max-file-descriptors.patch cd $(DIR_APP) && autoreconf -vfi cd $(DIR_APP)/libltdl && autoreconf -vfi @@ -159,7 +147,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cp -f $(DIR_SRC)/config/updxlrator/lscache /var/ipfire/updatexlrator/bin/lscache cp -f $(DIR_SRC)/config/updxlrator/checkdeaddl /var/ipfire/updatexlrator/bin/checkdeaddl - cp -f $(DIR_SRC)/config/updxlrator/updxlrator-lib.pl /var/ipfire/updatexlrator//updxlrator-lib.pl + cp -f $(DIR_SRC)/config/updxlrator/updxlrator-lib.pl /var/ipfire/updatexlrator/updxlrator-lib.pl chmod 755 /usr/sbin/updxlrator /var/ipfire/updatexlrator/bin/checkup \ /var/ipfire/updatexlrator/bin/download \ diff --git a/src/patches/squid-3.5.24-fix-max-file-descriptors.patch b/src/patches/squid-3.5.25-fix-max-file-descriptors.patch similarity index 100% rename from src/patches/squid-3.5.24-fix-max-file-descriptors.patch rename to src/patches/squid-3.5.25-fix-max-file-descriptors.patch diff --git a/src/patches/squid/squid-3.5-14142.patch b/src/patches/squid/squid-3.5-14142.patch deleted file mode 100644 index 8649e27f9..000000000 --- a/src/patches/squid/squid-3.5-14142.patch +++ /dev/null @@ -1,72 +0,0 @@ ------------------------------------------------------------- -revno: 14142 -revision-id: squid3(a)treenet.co.nz-20170208054033-pxqn8rs4yu713ijq -parent: squid3(a)treenet.co.nz-20170128035415-bpwt79jsobv1rqx3 -author: Christos Tsantilas <chtsanti(a)users.sourceforge.net> -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Wed 2017-02-08 18:40:33 +1300 -message: - Bump SSL client on [more] errors encountered before ssl_bump evaluation - - ... such as ERR_ACCESS_DENIED with HTTP/403 Forbidden triggered by an - http_access deny rule match. - - The old code allowed ssl_bump step1 rules to be evaluated in the - presence of an error. An ssl_bump splicing decision would then trigger - the useless "send the error to the client now" processing logic instead - of going down the "to serve an error, bump the client first" path. - - Furthermore, the ssl_bump evaluation result itself could be surprising - to the admin because ssl_bump (and most other) rules are not meant to be - evaluated for a transaction in an error state. This complicated triage. - - Also polished an important comment to clarify that we want to bump on - error if (and only if) the SslBump feature is applicable to the failed - transaction (i.e., if the ssl_bump rules would have been evaluated if - there were no prior errors). The old comment could have been - misinterpreted that ssl_bump rules must be evaluated to allow an - "ssl_bump splice" match to hide the error. - - This is a Measurement Factory project. ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170208054033-pxqn8rs4yu713ijq -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: 8c3f2a03f86aa1b1484195a63742bc4002ba2359 -# timestamp: 2017-02-08 05:51:15 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170128035415-\ -# bpwt79jsobv1rqx3 -# -# Begin patch -=== modified file 'src/client_side_request.cc' ---- src/client_side_request.cc 2017-01-23 02:05:46 +0000 -+++ src/client_side_request.cc 2017-02-08 05:40:33 +0000 -@@ -1442,6 +1442,13 @@ - return false; - } - -+ if (error) { -+ debugs(85, 5, "SslBump applies. Force bump action on error " << err_type_str[(error->type >= ERR_NONE && error->type < ERR_MAX) ? error->type : ERR_NONE]); -+ http->sslBumpNeed(Ssl::bumpBump); -+ http->al->ssl.bumpMode = Ssl::bumpBump; -+ return false; -+ } -+ - // Do not bump during authentication: clients would not proxy-authenticate - // if we delay a 407 response and respond with 200 OK to CONNECT. - if (error && error->httpStatus == Http::scProxyAuthenticationRequired) { -@@ -1781,8 +1788,9 @@ - } - - #if USE_OPENSSL -- // We need to check for SslBump even if the calloutContext->error is set -- // because bumping may require delaying the error until after CONNECT. -+ // Even with calloutContext->error, we call sslBumpAccessCheck() to decide -+ // whether SslBump applies to this transaction. If it applies, we will -+ // attempt to bump the client to serve the error. - if (!calloutContext->sslBumpCheckDone) { - calloutContext->sslBumpCheckDone = true; - if (calloutContext->sslBumpAccessCheck()) - diff --git a/src/patches/squid/squid-3.5-14143.patch b/src/patches/squid/squid-3.5-14143.patch deleted file mode 100644 index 49b3eb8ef..000000000 --- a/src/patches/squid/squid-3.5-14143.patch +++ /dev/null @@ -1,55 +0,0 @@ ------------------------------------------------------------- -revno: 14143 -revision-id: squid3(a)treenet.co.nz-20170225055014-j7v5xax13u4jddr9 -parent: squid3(a)treenet.co.nz-20170208054033-pxqn8rs4yu713ijq -author: Christos Tsantilas <chtsanti(a)users.sourceforge.net> -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Sat 2017-02-25 18:50:14 +1300 -message: - Fix regression in CONNECT authentication after rev.14142 ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170225055014-j7v5xax13u4jddr9 -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: bedc99ffdffd1e999c98c33faa830d4e9d1fc01d -# timestamp: 2017-02-25 05:51:22 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170208054033-\ -# pxqn8rs4yu713ijq -# -# Begin patch -=== modified file 'src/client_side_request.cc' ---- src/client_side_request.cc 2017-02-08 05:40:33 +0000 -+++ src/client_side_request.cc 2017-02-25 05:50:14 +0000 -@@ -1442,6 +1442,14 @@ - return false; - } - -+ // Do not bump during authentication: clients would not proxy-authenticate -+ // if we delay a 407 response and respond with 200 OK to CONNECT. -+ if (error && error->httpStatus == Http::scProxyAuthenticationRequired) { -+ http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log - -+ debugs(85, 5, HERE << "no SslBump during proxy authentication"); -+ return false; -+ } -+ - if (error) { - debugs(85, 5, "SslBump applies. Force bump action on error " << err_type_str[(error->type >= ERR_NONE && error->type < ERR_MAX) ? error->type : ERR_NONE]); - http->sslBumpNeed(Ssl::bumpBump); -@@ -1449,14 +1457,6 @@ - return false; - } - -- // Do not bump during authentication: clients would not proxy-authenticate -- // if we delay a 407 response and respond with 200 OK to CONNECT. -- if (error && error->httpStatus == Http::scProxyAuthenticationRequired) { -- http->al->ssl.bumpMode = Ssl::bumpEnd; // SslBump does not apply; log - -- debugs(85, 5, HERE << "no SslBump during proxy authentication"); -- return false; -- } -- - debugs(85, 5, HERE << "SslBump possible, checking ACL"); - - ACLFilledChecklist *aclChecklist = clientAclChecklistCreate(Config.accessList.ssl_bump, http); - diff --git a/src/patches/squid/squid-3.5-14144.patch b/src/patches/squid/squid-3.5-14144.patch deleted file mode 100644 index 592a774d6..000000000 --- a/src/patches/squid/squid-3.5-14144.patch +++ /dev/null @@ -1,43 +0,0 @@ ------------------------------------------------------------- -revno: 14144 -revision-id: squid3(a)treenet.co.nz-20170226084624-5tkl3bdrqz8nlp9g -parent: squid3(a)treenet.co.nz-20170225055014-j7v5xax13u4jddr9 -author: Alex Rousskov <rousskov(a)measurement-factory.com> -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Sun 2017-02-26 21:46:24 +1300 -message: - Fix crash when configuring with invalid delay_parameters restore value. - - ... like none/none. Introduced in rev which fixed another, much - bigger delay_parameters parsing bug. - - TODO: Reject all invalid input, including restore/max of "-/100". - - TODO: Fix misleading/wrong associated error messages. For example: - ERROR: invalid delay rate 'none/none'. Expecting restore/max or 'none' - ERROR: restore rate in '1/none' is not a number. ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170226084624-5tkl3bdrqz8nlp9g -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: 42f47b8ee1da049d57e6af76ce755e459d2fc9fd -# timestamp: 2017-02-26 08:51:02 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170225055014-\ -# j7v5xax13u4jddr9 -# -# Begin patch -=== modified file 'src/DelaySpec.cc' ---- src/DelaySpec.cc 2017-01-01 00:16:45 +0000 -+++ src/DelaySpec.cc 2017-02-26 08:46:24 +0000 -@@ -55,7 +55,7 @@ - - // parse the first digits into restore_bps - const char *p = NULL; -- if (!StringToInt(token, restore_bps, &p, 10) && *p != '/') { -+ if (!StringToInt(token, restore_bps, &p, 10) || *p != '/') { - debugs(77, DBG_CRITICAL, "ERROR: invalid delay rate '" << token << "'. Expecting restore/max or 'none'."); - self_destruct(); - } - diff --git a/src/patches/squid/squid-3.5-14145.patch b/src/patches/squid/squid-3.5-14145.patch deleted file mode 100644 index aaa56ed33..000000000 --- a/src/patches/squid/squid-3.5-14145.patch +++ /dev/null @@ -1,33 +0,0 @@ ------------------------------------------------------------- -revno: 14145 -revision-id: squid3(a)treenet.co.nz-20170226085009-tj3o81s5ybk8ly9s -parent: squid3(a)treenet.co.nz-20170226084624-5tkl3bdrqz8nlp9g -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Sun 2017-02-26 21:50:09 +1300 -message: - Fix missing CRLF on FTP timeout ABORT commands ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170226085009-tj3o81s5ybk8ly9s -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: a290f77545e17012eea87e6315a9d375bff16752 -# timestamp: 2017-02-26 08:51:05 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170226084624-\ -# 5tkl3bdrqz8nlp9g -# -# Begin patch -=== modified file 'src/clients/FtpGateway.cc' ---- src/clients/FtpGateway.cc 2017-01-01 00:16:45 +0000 -+++ src/clients/FtpGateway.cc 2017-02-26 08:50:09 +0000 -@@ -1775,7 +1775,7 @@ - - // ABORT on timeouts. server may be waiting on a broken TCP link. - if (io.xerrno == Comm::TIMEOUT) -- writeCommand("ABOR"); -+ writeCommand("ABOR\r\n"); - - // try another connection attempt with some other method - ftpSendPassive(this); - diff --git a/src/patches/squid/squid-3.5-14146.patch b/src/patches/squid/squid-3.5-14146.patch deleted file mode 100644 index 391fa35d8..000000000 --- a/src/patches/squid/squid-3.5-14146.patch +++ /dev/null @@ -1,41 +0,0 @@ ------------------------------------------------------------- -revno: 14146 -revision-id: squid3(a)treenet.co.nz-20170226085245-vcvc7nemupizbe4t -parent: squid3(a)treenet.co.nz-20170226085009-tj3o81s5ybk8ly9s -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Sun 2017-02-26 21:52:45 +1300 -message: - Check that -k argument is provided before trying to use it. - - Detected by Coverity Scan. Issue 1364726. ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170226085245-vcvc7nemupizbe4t -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: 31bba06ced5b67f892e4be897b05ec3744b2a942 -# timestamp: 2017-02-26 09:51:00 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170226085009-\ -# tj3o81s5ybk8ly9s -# -# Begin patch -=== modified file 'src/main.cc' ---- src/main.cc 2017-01-01 00:16:45 +0000 -+++ src/main.cc 2017-02-26 08:52:45 +0000 -@@ -425,11 +425,11 @@ - /** \par k - * Run the administrative action given following the option */ - -- /** \li When its an unknown option display the usage help. */ -- if ((int) strlen(optarg) < 1) -+ /** \li When it is missing or an unknown option display the usage help. */ -+ if (!optarg || strlen(optarg) < 1) - usage(); - -- if (!strncmp(optarg, "reconfigure", strlen(optarg))) -+ else if (!strncmp(optarg, "reconfigure", strlen(optarg))) - /** \li On reconfigure send SIGHUP. */ - opt_send_signal = SIGHUP; - else if (!strncmp(optarg, "rotate", strlen(optarg))) - diff --git a/src/patches/squid/squid-3.5-14147.patch b/src/patches/squid/squid-3.5-14147.patch deleted file mode 100644 index a8b52f388..000000000 --- a/src/patches/squid/squid-3.5-14147.patch +++ /dev/null @@ -1,37 +0,0 @@ ------------------------------------------------------------- -revno: 14147 -revision-id: squid3(a)treenet.co.nz-20170226085617-89jfjndt62i83qtn -parent: squid3(a)treenet.co.nz-20170226085245-vcvc7nemupizbe4t -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Sun 2017-02-26 21:56:17 +1300 -message: - ext_kerberos_ldap_group_acl: fix unused value warnings - - Detected by Coverity Scan. Issues 1364748 and 1364749. ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170226085617-89jfjndt62i83qtn -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: fd770175ba851fc62de4a085414c8fd996b53e46 -# timestamp: 2017-02-26 09:51:04 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170226085245-\ -# vcvc7nemupizbe4t -# -# Begin patch -=== modified file 'helpers/external_acl/kerberos_ldap_group/support_ldap.cc' ---- helpers/external_acl/kerberos_ldap_group/support_ldap.cc 2017-01-01 00:16:45 +0000 -+++ helpers/external_acl/kerberos_ldap_group/support_ldap.cc 2017-02-26 08:56:17 +0000 -@@ -919,8 +919,8 @@ - /* - * Initialise ldap - */ -- ldap_debug = 127 /* LDAP_DEBUG_TRACE */ ; -- ldap_debug = -1 /* LDAP_DEBUG_ANY */ ; -+// ldap_debug = 127 /* LDAP_DEBUG_TRACE */ ; -+// ldap_debug = -1 /* LDAP_DEBUG_ANY */ ; - ldap_debug = 0; - (void) ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, &ldap_debug); - #endif - diff --git a/src/patches/squid/squid-3.5-14148.patch b/src/patches/squid/squid-3.5-14148.patch deleted file mode 100644 index ce7d9667c..000000000 --- a/src/patches/squid/squid-3.5-14148.patch +++ /dev/null @@ -1,62 +0,0 @@ ------------------------------------------------------------- -revno: 14148 -revision-id: squid3(a)treenet.co.nz-20170226110942-90rcwhx3fwa2l7is -parent: squid3(a)treenet.co.nz-20170226085617-89jfjndt62i83qtn -author: Alexander Gozman <a.gozman(a)securitycode.ru> -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Mon 2017-02-27 00:09:42 +1300 -message: - Native FTP relay: NAT and TPROXY interception fixes ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170226110942-90rcwhx3fwa2l7is -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: 63f57f0ddddf0f231c3ef88a12728a707828c6ad -# timestamp: 2017-02-26 11:51:04 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170226085617-\ -# 89jfjndt62i83qtn -# -# Begin patch -=== modified file 'src/servers/FtpServer.cc' ---- src/servers/FtpServer.cc 2017-01-01 00:16:45 +0000 -+++ src/servers/FtpServer.cc 2017-02-26 11:09:42 +0000 -@@ -1454,9 +1454,33 @@ - Comm::ConnectionPointer conn = new Comm::Connection(); - conn->flags |= COMM_DOBIND; - -- // Use local IP address of the control connection as the source address -- // of the active data connection, or some clients will refuse to accept. -- conn->setAddrs(clientConnection->local, cltAddr); -+ if (clientConnection->flags & COMM_INTERCEPTION) { -+ // In the case of NAT interception conn->local value is not set -+ // because the TCP stack will automatically pick correct source -+ // address for the data connection. We must only ensure that IP -+ // version matches client's address. -+ conn->local.setAnyAddr(); -+ -+ if (cltAddr.isIPv4()) -+ conn->local.setIPv4(); -+ -+ conn->remote = cltAddr; -+ } else { -+ // In the case of explicit-proxy the local IP of the control connection -+ // is the Squid IP the client is knowingly talking to. -+ // -+ // In the case of TPROXY the IP address of the control connection is -+ // server IP the client is connecting to, it can be spoofed by Squid. -+ // -+ // In both cases some clients may refuse to accept data connections if -+ // these control connectin local-IP's are not used. -+ conn->setAddrs(clientConnection->local, cltAddr); -+ -+ // Using non-local addresses in TPROXY mode requires appropriate socket option. -+ if (clientConnection->flags & COMM_TRANSPARENT) -+ conn->flags |= COMM_TRANSPARENT; -+ } -+ - // RFC 959 requires active FTP connections to originate from port 20 - // but that would preclude us from supporting concurrent transfers! (XXX?) - conn->local.port(0); - diff --git a/src/patches/squid/squid-3.5-14149.patch b/src/patches/squid/squid-3.5-14149.patch deleted file mode 100644 index a9fa59754..000000000 --- a/src/patches/squid/squid-3.5-14149.patch +++ /dev/null @@ -1,78 +0,0 @@ ------------------------------------------------------------- -revno: 14149 -revision-id: squid3(a)treenet.co.nz-20170330133122-zcpblbvnuq7mjvq3 -parent: squid3(a)treenet.co.nz-20170226110942-90rcwhx3fwa2l7is -fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4508 -author: Christos Tsantilas <chtsanti(a)users.sourceforge.net> -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Fri 2017-03-31 01:31:22 +1200 -message: - Bug 4508: Host forgery stalls intercepted being-spliced connections. - - Most SslBump splicing happens after getting SNI. SNI goes into the - second fake CONNECT request, where it may fail the host forgery check. - A failed check triggers an HTTP error response from Squid. When - attempting to send that response to the TLS client, Squid checks whether - all previously pipelined HTTP requests on the connection have finished. - - Prior to this fix, Squid left the first fake CONNECT request in the - connection pipeline despite adding the second fake CONNECT. That first - CONNECT stalled the error response described above, with Squid waiting, - in vain, for that already handled [fake] transaction to finish. - - Also call quitAfterError() to force Squid to close the connection (after - writing the discussed error response) instead of just logging a - [misleading] "kick abandoning [connection]" message in cache.log. - - TODO: Always pop the first CONNECT when generating a second one. - Unifying CONNECT treatment is difficult because code like tunnel.cc - wants that CONNECT to be in the pipeline. Polishing that would probably - require disassociating ConnStateData from tunnel.cc (at least). - - TODO: Apply the existing "delayed error" logic (that optionally bumps - TLS connections to deliver [some] errors to [some] SSL/TLS clients) to - host forgery errors. Otherwise, the plain HTTP error message cannot be - understood by the intercepted TLS client. - - This is a Measurement Factory project ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170330133122-zcpblbvnuq7mjvq3 -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: db616fff2ac0df73cf41d380f07a96b773cf2be5 -# timestamp: 2017-03-30 13:51:17 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170226110942-\ -# 90rcwhx3fwa2l7is -# -# Begin patch -=== modified file 'src/client_side.cc' ---- src/client_side.cc 2017-01-27 13:38:24 +0000 -+++ src/client_side.cc 2017-03-30 13:31:22 +0000 -@@ -4376,7 +4376,12 @@ - fd_table[connState->clientConnection->fd].read_method = &default_read_method; - fd_table[connState->clientConnection->fd].write_method = &default_write_method; - -+ ClientSocketContext::Pointer context = connState->getCurrentContext(); -+ Must(context != NULL); - if (connState->transparent()) { -+ // If we are going to fake the second CONNECT, clear the first one. -+ context->connIsFinished(); -+ - // fake a CONNECT request to force connState to tunnel - // XXX: copy from MemBuf reallocates, not a regression since old code did too - SBuf temp; - -=== modified file 'src/client_side_request.cc' ---- src/client_side_request.cc 2017-02-25 05:50:14 +0000 -+++ src/client_side_request.cc 2017-03-30 13:31:22 +0000 -@@ -561,6 +561,7 @@ - debugs(85, DBG_IMPORTANT, "SECURITY ALERT: on URL: " << urlCanonical(http->request)); - - // IP address validation for Host: failed. reject the connection. -+ http->getConn()->quitAfterError(http->request); - clientStreamNode *node = (clientStreamNode *)http->client_stream.tail->prev->data; - clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw()); - assert (repContext); - diff --git a/src/patches/squid/squid-3.5-14150.patch b/src/patches/squid/squid-3.5-14150.patch deleted file mode 100644 index dfe97a0ef..000000000 --- a/src/patches/squid/squid-3.5-14150.patch +++ /dev/null @@ -1,32 +0,0 @@ ------------------------------------------------------------- -revno: 14150 -revision-id: squid3(a)treenet.co.nz-20170331005152-8exm3hsly1v1jk8y -parent: squid3(a)treenet.co.nz-20170330133122-zcpblbvnuq7mjvq3 -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Fri 2017-03-31 12:51:52 +1200 -message: - Fix variable shadowing after rev.14149 ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170331005152-8exm3hsly1v1jk8y -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: ae1e30fff31cf8b411c62eba344fdc944692aecf -# timestamp: 2017-03-31 01:51:06 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170330133122-\ -# zcpblbvnuq7mjvq3 -# -# Begin patch -=== modified file 'src/client_side.cc' ---- src/client_side.cc 2017-03-30 13:31:22 +0000 -+++ src/client_side.cc 2017-03-31 00:51:52 +0000 -@@ -4390,7 +4390,6 @@ - } else { - // in.buf still has the "CONNECT ..." request data, reset it to SSL hello message - connState->in.buf.append(rbuf.content(), rbuf.contentSize()); -- ClientSocketContext::Pointer context = connState->getCurrentContext(); - ClientHttpRequest *http = context->http; - tunnelStart(http, &http->out.size, &http->al->http.code, http->al); - } - diff --git a/src/patches/squid/squid-3.5-14151.patch b/src/patches/squid/squid-3.5-14151.patch deleted file mode 100644 index d22387d53..000000000 --- a/src/patches/squid/squid-3.5-14151.patch +++ /dev/null @@ -1,36 +0,0 @@ ------------------------------------------------------------- -revno: 14151 -revision-id: squid3(a)treenet.co.nz-20170331233831-m3hfrigo82uhz4id -parent: squid3(a)treenet.co.nz-20170331005152-8exm3hsly1v1jk8y -author: Garri Djavadyan <garryd(a)comnet.uz> -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Sat 2017-04-01 12:38:31 +1300 -message: - Docs: update refresh_pattern description regarding 'max' option ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170331233831-m3hfrigo82uhz4id -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: be64101730dcb2deb664d6594d20a7295a666b98 -# timestamp: 2017-03-31 23:40:50 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170331005152-\ -# 8exm3hsly1v1jk8y -# -# Begin patch -=== modified file 'src/cf.data.pre' ---- src/cf.data.pre 2017-01-01 00:16:45 +0000 -+++ src/cf.data.pre 2017-03-31 23:38:31 +0000 -@@ -5401,7 +5401,9 @@ - will be considered fresh. - - 'Max' is an upper limit on how long objects without an explicit -- expiry time will be considered fresh. -+ expiry time will be considered fresh. The value is also used -+ to form Cache-Control: max-age header for a request sent from -+ Squid to origin/parent. - - options: override-expire - override-lastmod - diff --git a/src/patches/squid/squid-3.5-14152.patch b/src/patches/squid/squid-3.5-14152.patch deleted file mode 100644 index 81bd3a039..000000000 --- a/src/patches/squid/squid-3.5-14152.patch +++ /dev/null @@ -1,35 +0,0 @@ ------------------------------------------------------------- -revno: 14152 -revision-id: squid3(a)treenet.co.nz-20170331233921-efxhs8vy025fvrnl -parent: squid3(a)treenet.co.nz-20170331233831-m3hfrigo82uhz4id -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Sat 2017-04-01 12:39:21 +1300 -message: - libtrie: Fix 'make check' when run before 'make all' ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170331233921-efxhs8vy025fvrnl -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: 8399bbfe7b517fa6306bdc61d212a9a4fcc9e88b -# timestamp: 2017-03-31 23:40:52 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170331233831-\ -# m3hfrigo82uhz4id -# -# Begin patch -=== modified file 'lib/libTrie/Makefile.am' ---- lib/libTrie/Makefile.am 2017-01-01 00:16:45 +0000 -+++ lib/libTrie/Makefile.am 2017-03-31 23:39:21 +0000 -@@ -8,8 +8,8 @@ - include $(top_srcdir)/src/Common.am - include $(top_srcdir)/src/TestHeaders.am - --DIST_SUBDIRS = test --SUBDIRS = test -+DIST_SUBDIRS = . test -+SUBDIRS = . test - - noinst_LIBRARIES = libTrie.a - - diff --git a/src/patches/squid/squid-3.5-14153.patch b/src/patches/squid/squid-3.5-14153.patch deleted file mode 100644 index c236a6115..000000000 --- a/src/patches/squid/squid-3.5-14153.patch +++ /dev/null @@ -1,353 +0,0 @@ ------------------------------------------------------------- -revno: 14153 -revision-id: squid3(a)treenet.co.nz-20170331234747-59glu40hhx0kf8fx -parent: squid3(a)treenet.co.nz-20170331233921-efxhs8vy025fvrnl -fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4688 -author: Lubos Uhliarik <luhliari(a)redhat.com> -committer: Amos Jeffries <squid3(a)treenet.co.nz> -branch nick: 3.5 -timestamp: Sat 2017-04-01 12:47:47 +1300 -message: - Bug 4688: various typo error(s) in man page(s) ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3(a)treenet.co.nz-20170331234747-59glu40hhx0kf8fx -# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# testament_sha1: a05d98a4e328e39f2a490cfeff72ad8735cc6b6e -# timestamp: 2017-03-31 23:48:51 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 -# base_revision_id: squid3(a)treenet.co.nz-20170331233921-\ -# efxhs8vy025fvrnl -# -# Begin patch -=== modified file 'compat/compat.h' ---- compat/compat.h 2017-01-01 00:16:45 +0000 -+++ compat/compat.h 2017-03-31 23:47:47 +0000 -@@ -11,7 +11,7 @@ - - /* - * From discussions it was chosen to push compat code as far down as possible. -- * That means we can have a seperate compat for most -+ * That means we can have a separate compat for most - * compatability and portability hacks and resolutions. - * - * This file is meant to collate all those hacks files together and - -=== modified file 'helpers/basic_auth/DB/basic_db_auth.pl.in' ---- helpers/basic_auth/DB/basic_db_auth.pl.in 2017-01-01 00:16:45 +0000 -+++ helpers/basic_auth/DB/basic_db_auth.pl.in 2017-03-31 23:47:47 +0000 -@@ -14,7 +14,7 @@ - - basic_db_auth [options] - --=head1 DESCRIPTOIN -+=head1 DESCRIPTION - - This program verifies username & password to a database - -@@ -97,7 +97,7 @@ - Copyright (C) 2007 Henrik Nordstrom <henrik(a)henriknordstrom.net> - Copyright (C) 2010 Luis Daniel Lucio Quiroz <dlucio(a)okay.com.mx> (Joomla support) - This program is free software. You may redistribute copies of it under the --terms of the GNU General Public License version 2, or (at youropinion) any -+terms of the GNU General Public License version 2, or (at your opinion) any - later version. - - =head1 QUESTIONS - -=== modified file 'helpers/basic_auth/LDAP/basic_ldap_auth.8' ---- helpers/basic_auth/LDAP/basic_ldap_auth.8 2017-01-01 00:16:45 +0000 -+++ helpers/basic_auth/LDAP/basic_ldap_auth.8 2017-03-31 23:47:47 +0000 -@@ -98,7 +98,7 @@ - .B Note: - This can only be done if all your users are located directly under - the same position in the LDAP tree and the login name is used for naming --each user object. If your LDAP tree does not match these criterias or if -+each user object. If your LDAP tree does not match these criteria or if - you want to filter who are valid users then you need to use a search filter - to search for your users DN ( - .B \-f -@@ -186,15 +186,15 @@ - .B never - dereference aliases (default), - .B always --dereference aliases, only while --.B search ing -+dereference aliases, only during a -+.B search - or only to - .B find - the base object. - . - .if !'po4a'hide' .TP - .if !'po4a'hide' .B "\-H ldap_uri --Specity the LDAP server to connect to by LDAP URI (requires OpenLDAP libraries). -+Specify the LDAP server to connect to by LDAP URI (requires OpenLDAP libraries). - Servers can also be specified last on the command line. - . - .if !'po4a'hide' .TP - -=== modified file 'helpers/digest_auth/LDAP/digest_pw_auth.cc' ---- helpers/digest_auth/LDAP/digest_pw_auth.cc 2017-01-01 00:16:45 +0000 -+++ helpers/digest_auth/LDAP/digest_pw_auth.cc 2017-03-31 23:47:47 +0000 -@@ -30,7 +30,7 @@ - * the file format. However storing such a triple does little to - * improve security: If compromised the username:realm:HA1 combination - * is "plaintext equivalent" - for the purposes of digest authentication -- * they allow the user access. Password syncronisation is not tackled -+ * they allow the user access. Password synchronization is not tackled - * by digest - just preventing on the wire compromise. - * - * Copyright (c) 2003 Robert Collins <robertc(a)squid-cache.org> - -=== modified file 'helpers/digest_auth/eDirectory/digest_pw_auth.cc' ---- helpers/digest_auth/eDirectory/digest_pw_auth.cc 2017-01-01 00:16:45 +0000 -+++ helpers/digest_auth/eDirectory/digest_pw_auth.cc 2017-03-31 23:47:47 +0000 -@@ -30,7 +30,7 @@ - * the file format. However storing such a triple does little to - * improve security: If compromised the username:realm:HA1 combination - * is "plaintext equivalent" - for the purposes of digest authentication -- * they allow the user access. Password syncronisation is not tackled -+ * they allow the user access. Password synchronization is not tackled - * by digest - just preventing on the wire compromise. - * - * Copyright (c) 2003 Robert Collins <robertc(a)squid-cache.org> - -=== modified file 'helpers/digest_auth/file/digest_file_auth.8' ---- helpers/digest_auth/file/digest_file_auth.8 2017-01-01 00:16:45 +0000 -+++ helpers/digest_auth/file/digest_file_auth.8 2017-03-31 23:47:47 +0000 -@@ -15,7 +15,7 @@ - is an installed binary authentication program for Squid. It handles digest - authentication protocol and authenticates against a text file backend. - . --This program will automatically detect the existence of a concurrecy channel-ID and adjust appropriately. -+This program will automatically detect the existence of a concurrency channel-ID and adjust appropriately. - It may be used with any value 0 or above for the auth_param children concurrency= parameter. - . - .SH OPTIONS -@@ -54,7 +54,7 @@ - improve security: If compromised the - .B username:realm:HA1 - combination is "plaintext equivalent" - for the purposes of digest authentication --they allow the user access. Password syncronisation is not tackled -+they allow the user access. Password synchronization is not tackled - by digest - just preventing on the wire compromise. - . - .SH AUTHOR - -=== modified file 'helpers/digest_auth/file/digest_file_auth.cc' ---- helpers/digest_auth/file/digest_file_auth.cc 2017-01-01 00:16:45 +0000 -+++ helpers/digest_auth/file/digest_file_auth.cc 2017-03-31 23:47:47 +0000 -@@ -33,7 +33,7 @@ - * the file format. However storing such a triple does little to - * improve security: If compromised the username:realm:HA1 combination - * is "plaintext equivalent" - for the purposes of digest authentication -- * they allow the user access. Password syncronisation is not tackled -+ * they allow the user access. Password synchronization is not tackled - * by digest - just preventing on the wire compromise. - * - * Copyright (c) 2003 Robert Collins <robertc(a)squid-cache.org> - -=== modified file 'helpers/digest_auth/file/text_backend.cc' ---- helpers/digest_auth/file/text_backend.cc 2017-01-01 00:16:45 +0000 -+++ helpers/digest_auth/file/text_backend.cc 2017-03-31 23:47:47 +0000 -@@ -29,7 +29,7 @@ - * the file format. However storing such a triple does little to - * improve security: If compromised the username:realm:HA1 combination - * is "plaintext equivalent" - for the purposes of digest authentication -- * they allow the user access. Password syncronisation is not tackled -+ * they allow the user access. Password synchronization is not tackled - * by digest - just preventing on the wire compromise. - * - * Copyright (c) 2003 Robert Collins <robertc(a)squid-cache.org> - -=== modified file 'helpers/external_acl/LDAP_group/ext_ldap_group_acl.8' ---- helpers/external_acl/LDAP_group/ext_ldap_group_acl.8 2017-01-01 00:16:45 +0000 -+++ helpers/external_acl/LDAP_group/ext_ldap_group_acl.8 2017-03-31 23:47:47 +0000 -@@ -52,8 +52,8 @@ - .BI never - dereference aliases (default), - .BI always --dereference aliases, only while --.BR search ing -+dereference aliases, only during a -+.BR search - or only to - .B find - the base object -@@ -143,7 +143,7 @@ - . - .if !'po4a'hide' .TP - .if !'po4a'hide' .BI \-H " ldapuri" --Specity the LDAP server to connect to by a LDAP URI (requires OpenLDAP libraries) -+Specify the LDAP server to connect to by a LDAP URI (requires OpenLDAP libraries) - . - .if !'po4a'hide' .TP - .if !'po4a'hide' .BI \-K - -=== modified file 'helpers/external_acl/kerberos_ldap_group/README' ---- helpers/external_acl/kerberos_ldap_group/README 2010-08-13 10:17:20 +0000 -+++ helpers/external_acl/kerberos_ldap_group/README 2017-03-31 23:47:47 +0000 -@@ -65,7 +65,7 @@ - export KRB5_KTNAME - - If you use a different Kerberos domain than the machine itself is in you can point squid to --the seperate Kerberos config file by setting the following environmnet variable in the startup -+the separate Kerberos config file by setting the following environment variable in the startup - script. - - KRB5_CONFIG=/etc/krb5-squid.conf - -=== modified file 'helpers/external_acl/kerberos_ldap_group/ext_kerberos_ldap_group_acl.8' ---- helpers/external_acl/kerberos_ldap_group/ext_kerberos_ldap_group_acl.8 2015-03-21 06:32:34 +0000 -+++ helpers/external_acl/kerberos_ldap_group/ext_kerberos_ldap_group_acl.8 2017-03-31 23:47:47 +0000 -@@ -163,7 +163,7 @@ - .if !'po4a'hide' .ft - . - If you use a different Kerberos domain than the machine itself is in you can point squid to --the seperate Kerberos config file by setting the following environmnet variable in the startup -+the separate Kerberos config file by setting the following environment variable in the startup - script. - .if !'po4a'hide' .P - .if !'po4a'hide' .ft CR - -=== modified file 'helpers/external_acl/session/ext_session_acl.8' ---- helpers/external_acl/session/ext_session_acl.8 2017-01-01 00:16:45 +0000 -+++ helpers/external_acl/session/ext_session_acl.8 2017-03-31 23:47:47 +0000 -@@ -21,7 +21,7 @@ - ) or a fixed period of time ( - .B \-T - ). The former is suitable for displaying terms and conditions to a user; the --latter is suitable for the display of advertisments or other notices (both as a -+latter is suitable for the display of advertisements or other notices (both as a - splash page \- see config examples in the wiki online). The session helper can also be used - to force users to re\-authenticate if the - .B %LOGIN -@@ -55,7 +55,7 @@ - environment is created within the directory. The advantage of the latter - is better database support between multiple instances of the session - helper. Using multiple instances of the session helper with a single --database file will cause synchronisation problems between processes. -+database file will cause synchronization problems between processes. - If this option is not specified the session details will be kept in - memory only and all sessions will reset each time Squid restarts its - helpers (Squid restart or rotation of logs). - -=== modified file 'helpers/log_daemon/DB/log_db_daemon.pl.in' ---- helpers/log_daemon/DB/log_db_daemon.pl.in 2017-01-01 00:16:45 +0000 -+++ helpers/log_daemon/DB/log_db_daemon.pl.in 2017-03-31 23:47:47 +0000 -@@ -18,7 +18,7 @@ - - log_db_daemon DSN [options] - --=head1 DESCRIPTOIN -+=head1 DESCRIPTION - - This program writes Squid access.log entries to a database. - Presently only accepts the B<squid> native format -@@ -373,7 +373,7 @@ - WHERE squid_request_status LIKE '%MISS%') - / - (SELECT COUNT(*) FROM access_log)*100 -- AS pecentage; -+ AS percentage; - - =item Response time ranges - -@@ -433,7 +433,7 @@ - - This script currently implements only the C<L> (i.e. "append a line to the log") command, therefore the log lines are never purged from the table. This approach has an obvious scalability problem. - --One solution would be to implement e.g. the "rotate log" command in a way that would calculate some summary values, put them in a "summary table" and then delete the lines used to caluclate those values. -+One solution would be to implement e.g. the "rotate log" command in a way that would calculate some summary values, put them in a "summary table" and then delete the lines used to calculate those values. - - Similar cleanup code could be implemented in an external script and run periodically independently from squid log commands. - - -=== modified file 'helpers/negotiate_auth/kerberos/README' ---- helpers/negotiate_auth/kerberos/README 2008-10-03 02:25:50 +0000 -+++ helpers/negotiate_auth/kerberos/README 2017-03-31 23:47:47 +0000 -@@ -53,7 +53,7 @@ - export KRB5_KTNAME - - If you use a different Kerberos domain than the machine itself is in you can point squid to --the seperate Kerberos config file by setting the following environmnet variable in the startup -+the separate Kerberos config file by setting the following environment variable in the startup - script. - - KRB5_CONFIG=/etc/krb-squid5.conf - -=== modified file 'helpers/negotiate_auth/kerberos/negotiate_kerberos_auth.8' ---- helpers/negotiate_auth/kerberos/negotiate_kerberos_auth.8 2014-12-20 17:10:25 +0000 -+++ helpers/negotiate_auth/kerberos/negotiate_kerberos_auth.8 2017-03-31 23:47:47 +0000 -@@ -69,7 +69,7 @@ - export KRB5_KTNAME - - If you use a different Kerberos domain than the machine itself is in you can point squid to --the seperate Kerberos config file by setting the following environmnet variable in the startup -+the separate Kerberos config file by setting the following environment variable in the startup - script. - - KRB5_CONFIG=/etc/krb5\-squid.conf - -=== modified file 'helpers/storeid_rewrite/file/storeid_file_rewrite.pl.in' ---- helpers/storeid_rewrite/file/storeid_file_rewrite.pl.in 2017-01-01 00:16:45 +0000 -+++ helpers/storeid_rewrite/file/storeid_file_rewrite.pl.in 2017-03-31 23:47:47 +0000 -@@ -29,7 +29,7 @@ - Rewrite rules are matched in the same order as they appear in the rules file. - So for best performance, sort it in order of frequency of occurrence. - --This program will automatically detect the existence of a concurrecy channel-ID and adjust appropriately. -+This program will automatically detect the existence of a concurrency channel-ID and adjust appropriately. - It may be used with any value 0 or above for the store_id_children concurrency= parameter. - - =head1 OPTIONS - -=== modified file 'src/StoreFileSystem.h' ---- src/StoreFileSystem.h 2017-01-01 00:16:45 +0000 -+++ src/StoreFileSystem.h 2017-03-31 23:47:47 +0000 -@@ -47,7 +47,7 @@ - \par - * configure will take a list of storage types through the - * --enable-store-io parameter. This parameter takes a list of -- * space seperated storage types. For example, -+ * space separated storage types. For example, - * --enable-store-io="ufs aufs" . - * - \par - -=== modified file 'src/ipcache.cc' ---- src/ipcache.cc 2017-01-01 00:16:45 +0000 -+++ src/ipcache.cc 2017-03-31 23:47:47 +0000 -@@ -50,7 +50,7 @@ - \defgroup IPCacheInternal IP Cache Internals - \ingroup IPCacheAPI - \todo when IP cache is provided as a class. These sub-groups will be obsolete -- * for now they are used to seperate the public and private functions. -+ * for now they are used to separate the public and private functions. - * with the private ones all being in IPCachInternal and public in IPCacheAPI - * - \section InternalOperation Internal Operation - -=== modified file 'src/ssl/ssl_crtd.8' ---- src/ssl/ssl_crtd.8 2017-01-01 00:16:45 +0000 -+++ src/ssl/ssl_crtd.8 2017-03-31 23:47:47 +0000 -@@ -33,7 +33,7 @@ - Because the generation and signing of SSL certificates takes time - Squid must use external process to handle the work. - . --This process generates new SSL certificates and uses a disk cache of certificatess -+This process generates new SSL certificates and uses a disk cache of certificates - to improve response times on repeated requests. - Communication occurs via TCP sockets bound to the loopback interface. - . -@@ -122,7 +122,7 @@ - . - .PP - For simple configuration the helper defaults can be used. --Only HTTP listening port options are required to enable generation and set the signign CA certificate. -+Only HTTP listening port options are required to enable generation and set the signing CA certificate. - For Example: - .if !'po4a'hide' .RS - .if !'po4a'hide' .B http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/ssl_cert/www.sample.com.pem - -- 2.11.0

1 0

Re: [PATCH] DNS: Fall back to permissive mode if recursor mode is unavailable
by Paul Simmons 02 Apr '17

02 Apr '17

On Tue, 2017-03-07 at 09:58 -0600, Paul Simmons wrote: > On Tue, 2017-03-07 at 12:06 +0000, Michael Tremer wrote: > > No, it is supposed to resolve everything. > > > > For that it only needs to be able to contact the root name servers > > and practically all others on the internet. That seems to fail > > here. > > > > What does unbound log? > > > > > On 6 Mar 2017, at 11:29 pm, Paul Simmons <redneckmother(a)hughes.ne > > > t> > > > wrote: > > > > > > > On Mon, 2017-03-06 at 22:37 +0000, Michael Tremer wrote: > > > > Hi, > > > > > > > > > On Mon, 2017-03-06 at 15:47 -0600, Paul Simmons wrote: > > > > > > On Mon, 2017-03-06 at 21:00 +0000, Michael Tremer wrote: > > > > > > > > > > > > Hi, > > > > > > > > > > > > > On Mon, 2017-03-06 at 12:18 -0600, Paul Simmons wrote: > > > > > > > > > > > > > > > On Sun, 2017-03-05 at 11:42 +0000, Michael Tremer > > > > > > > > wrote: > > > > > > > > > > > > > > > > > > > > > > > > Hi, > > > > > > > > > > > > > > > > can you confirm if unbound is running? > > > > > > > > > > > > > > > > What is the output of /etc/init.d/unbound restart? > > > > > > > > > > > > > > > > -Michael > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ----<% snip %>---- > > > > > > > > > > > > > > > > > > > > I have nightly commit > > > > > > > > > > c016773b9816ad9be4ffc8643c30457e87c094e3 > > > > > > > > > > available locally, and will beg my users for > > > > > > > > > > downtime > > > > > > > > > > to > > > > > > > > > > test. > > > > > > > > > > > > > > > > > > > > Thank you, and best regards, > > > > > > > > > > Paul > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Bad juju - build c016773b couldn't resolve any hosts > > > > > > > > > (other > > > > > > > > > than > > > > > > > > > those in "localdomain"). > > > > > > > > > > > > > > > > > > Provider is "hughes.net" and is the only ISP > > > > > > > > > available > > > > > > > > > (no > > > > > > > > > hardlines > > > > > > > > > or other LOS/NLOS WISPs available). > > > > > > > > > > > > > > > > > > Tried assigning DNS servers 74.113.60.185 and > > > > > > > > > 156.154.70.1 > > > > > > > > > - no > > > > > > > > > change. > > > > > > > > > > > > > > > > > > Paul > > > > > > > > > > > > > > > > > > > > > > > Sorry for the lllooonnnggg delay - had to get a testing > > > > > > > time > > > > > > > window. > > > > > > > > > > > > > > Unbound was indeed running - verified with > > > > > > > "/etc/init.d/unbound > > > > > > > status" > > > > > > > > > > > > > > Command and output from "restart": > > > > > > > > > > > > > > # /etc/init.d/unbound restart > > > > > > > Stopping Unbound DNS > > > > > > > Proxy... [ OK > > > > > > > ] > > > > > > > Starting Unbound DNS > > > > > > > Proxy... [ OK > > > > > > > ] > > > > > > > Ignoring broken upstream name server(s): 74.113.60.185 > > > > > > > 156.154.70.1 [ WARN ] > > > > > > > Falling back to recursor > > > > > > > mode [ WARN ] > > > > > > > > > > > > So, can you remind me what your provider does again? Is any > > > > > > access to > > > > > > other name > > > > > > servers forbidden? If so the updated script should have > > > > > > detected > > > > > > that > > > > > > and should > > > > > > not have activated the recursor mode. > > > > > > > > > > > > Could you manually execute the following commands from the > > > > > > console of > > > > > > IPFire for > > > > > > me? > > > > > > > > > > > > dig @198.41.0.4 +dnssec SOA . > > > > > > > > > > > > The dot at the end is important. What is the output of it? > > > > > > > > > > > > Best, > > > > > > -Michael > > > > > > > > > > > > > > > > > > > > > > > > > > > Thank you, > > > > > > > Paul > > > > > > > > > > # dig @198.41.0.4 +dnssec SOA . > > > > > > > > > > ; <<>> DiG 9.11.0-P3 <<>> @198.41.0.4 +dnssec SOA . > > > > > ; (1 server found) > > > > > ;; global options: +cmd > > > > > ;; Got answer: > > > > > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 811 > > > > > ;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 14, > > > > > ADDITIONAL: > > > > > 27 > > > > > ;; WARNING: recursion requested but not available > > > > > > > > > > ;; OPT PSEUDOSECTION: > > > > > ; EDNS: version: 0, flags: do; udp: 4096 > > > > > ;; QUESTION SECTION: > > > > > ;. IN SOA > > > > > > > > > > ;; ANSWER SECTION: > > > > > . 86400 IN SOA a.root- > > > > > servers.net. nstld.verisign-grs.com. 2017030601 1800 900 > > > > > 604800 > > > > > 86400 > > > > > . 86400 IN RRSIG SOA 8 > > > > > 0 > > > > > 86400 20170319170000 20170306160000 61045 . > > > > > X2xWv3z0ZmFxXkF9ybMgxMv6dcZ+SmnG3XHcNtAavuPNPLW3cVBwolDP > > > > > lOU5/tfOaKwbu7HENFWysaekMpb6O7ycg+kryuCP7z6Q4WyG0O2160l1 > > > > > DDG0UbBW5yidfcghq1r6sdz30RI5cSBGcAOmlktnPkjs9wv9/S/ZPyrC > > > > > qMPJR9A60R52NcWEONS3DiyGxR66KA4S4grJnDgcI6pcytJGXm/b5WRO > > > > > +v51tnLT0UVbgXvV03Itn/3MR72muzKXWzzj5LFJST5iqWCgAHJryG3T > > > > > vNKEYLQ76nwl6B3YVJDjC1InmpIujwXBbxMKpyL1Sh0RLdlHq2TtZS8O > > > > > qk4V0Q== > > > > > > > > > > ;; AUTHORITY SECTION: > > > > > . 518400 IN NS e.root- > > > > > servers.net. > > > > > . 518400 IN NS h.root- > > > > > servers.net. > > > > > . 518400 IN NS l.root- > > > > > servers.net. > > > > > . 518400 IN NS i.root- > > > > > servers.net. > > > > > . 518400 IN NS a.root- > > > > > servers.net. > > > > > . 518400 IN NS d.root- > > > > > servers.net. > > > > > . 518400 IN NS c.root- > > > > > servers.net. > > > > > . 518400 IN NS b.root- > > > > > servers.net. > > > > > . 518400 IN NS j.root- > > > > > servers.net. > > > > > . 518400 IN NS k.root- > > > > > servers.net. > > > > > . 518400 IN NS g.root- > > > > > servers.net. > > > > > . 518400 IN NS m.root- > > > > > servers.net. > > > > > . 518400 IN NS f.root- > > > > > servers.net. > > > > > . 518400 IN RRSIG NS 8 > > > > > 0 > > > > > 518400 20170319170000 20170306160000 61045 . > > > > > iQVPY67dNDj6w14dY1tDFgwRFqhEXVVLmY8q1woIX1eU7t1k/XaPi+tX > > > > > 3+PDCFQlrQmWSWUtLPaA6pmrACB6EL2YvWzAiLVyocGCBpUpnbUCNAwm > > > > > nD4SvBZb0ET2jWbSiAzo8iy+1+Hr84I8RXtbcrcpF5Y/J5Oataxt5z9o > > > > > dHGQSKru0eYEbwfszq0L5L8KECk6skm7iQ0RAIspdTfjDsIwtvoAhEGV > > > > > B8qjFQP5Bkcn38b35eWHneCmc3cgG0J+pK/eX/YHpqClcINGh3eavBlC > > > > > 1KpUkDDMAwCvo+X/MhDE2Ol/VR00/M/YCzXbEv97IWenM1Xi4ArX9F1C > > > > > xBc0gA== > > > > > > > > > > ;; ADDITIONAL SECTION: > > > > > e.root-servers.net. 518400 IN A 192.203 > > > > > .230 > > > > > .10 > > > > > e.root-servers.net. 518400 IN AAAA 2001 > > > > > :500 > > > > > :a8::e > > > > > h.root-servers.net. 518400 IN A 198.97. > > > > > 190. > > > > > 53 > > > > > h.root-servers.net. 518400 IN AAAA 2001 > > > > > :500 > > > > > :1::53 > > > > > l.root-servers.net. 518400 IN A 199.7.8 > > > > > 3.42 > > > > > l.root-servers.net. 518400 IN AAAA 2001 > > > > > :500 > > > > > :9f::42 > > > > > i.root-servers.net. 518400 IN A 192.36. > > > > > 148. > > > > > 17 > > > > > i.root-servers.net. 518400 IN AAAA 2001 > > > > > :7fe > > > > > ::53 > > > > > a.root-servers.net. 518400 IN A 198.41. > > > > > 0.4 > > > > > a.root-servers.net. 518400 IN AAAA 2001 > > > > > :503 > > > > > :ba3e::2:30 > > > > > d.root-servers.net. 518400 IN A 199.7.9 > > > > > 1.13 > > > > > d.root-servers.net. 518400 IN AAAA 2001 > > > > > :500 > > > > > :2d::d > > > > > c.root-servers.net. 518400 IN A 192.33. > > > > > 4.12 > > > > > c.root-servers.net. 518400 IN AAAA 2001 > > > > > :500 > > > > > :2::c > > > > > b.root-servers.net. 518400 IN A 192.228 > > > > > .79. > > > > > 201 > > > > > b.root-servers.net. 518400 IN AAAA 2001 > > > > > :500 > > > > > :84::b > > > > > j.root-servers.net. 518400 IN A 192.58. > > > > > 128. > > > > > 30 > > > > > j.root-servers.net. 518400 IN AAAA 2001 > > > > > :503 > > > > > :c27::2:30 > > > > > k.root-servers.net. 518400 IN A 193.0.1 > > > > > 4.12 > > > > > 9 > > > > > k.root-servers.net. 518400 IN AAAA 2001 > > > > > :7fd > > > > > ::1 > > > > > g.root-servers.net. 518400 IN A 192.112 > > > > > .36. > > > > > 4 > > > > > g.root-servers.net. 518400 IN AAAA 2001 > > > > > :500 > > > > > :12::d0d > > > > > m.root-servers.net. 518400 IN A 202.12. > > > > > 27.3 > > > > > 3 > > > > > m.root-servers.net. 518400 IN AAAA 2001 > > > > > :dc3 > > > > > ::35 > > > > > f.root-servers.net. 518400 IN A 192.5.5 > > > > > .241 > > > > > f.root-servers.net. 518400 IN AAAA 2001 > > > > > :500 > > > > > :2f::f > > > > > > > > > > ;; Query time: 836 msec > > > > > ;; SERVER: 198.41.0.4#53(198.41.0.4) > > > > > ;; WHEN: Mon Mar 06 15:40:58 CST 2017 > > > > > ;; MSG SIZE rcvd: 1440 > > > > > # > > > > > > > > > > I suspect the ISP mangles DNS requests directed outside their > > > > > net. > > > > > > > > Well, that command shouldn't have worked then. > > > > > > > > Could you give me an example for something that you cannot > > > > resolve? > > > > > > > > -Michael > > > > > > > > > Thank you, > > > > > Paul > > > > > > Ah, I see... so the problem is that we're not forwarding requests > > > outside the local domain? Latest testing sequence follows: > > > > > > # /etc/init.d/unbound restart > > > Stopping Unbound DNS > > > Proxy... [ OK ] > > > Starting Unbound DNS > > > Proxy... [ OK ] > > > Ignoring broken upstream name server(s): 74.113.60.185 > > > 156.154.70.1 [ WARN ] > > > Falling back to recursor > > > mode [ WARN ] > > > > > > # dig @198.41.0.4 +dnssec SOA . > > > > > > ; <<>> DiG 9.11.0-P3 <<>> @198.41.0.4 +dnssec SOA . > > > ; (1 server found) > > > ;; global options: +cmd > > > ;; Got answer: > > > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23002 > > > ;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 14, > > > ADDITIONAL: > > > 27 > > > ;; WARNING: recursion requested but not available > > > > > > ;; OPT PSEUDOSECTION: > > > ; EDNS: version: 0, flags: do; udp: 1472 > > > ;; QUESTION SECTION: > > > ;. IN SOA > > > > > > ;; ANSWER SECTION: > > > . 86400 IN SOA a.root-servers.net. > > > nstld.verisign-grs.com. 2017030601 1800 900 604800 86400 > > > . 86400 IN RRSIG SOA 8 0 86400 20170319170000 > > > 20170306160000 61045 . > > > X2xWv3z0ZmFxXkF9ybMgxMv6dcZ+SmnG3XHcNtAavuPNPLW3cVBwolDP > > > lOU5/tfOaKwbu7HENFWysaekMpb6O7ycg+kryuCP7z6Q4WyG0O2160l1 > > > DDG0UbBW5yidfcghq1r6sdz30RI5cSBGcAOmlktnPkjs9wv9/S/ZPyrC > > > qMPJR9A60R52NcWEONS3DiyGxR66KA4S4grJnDgcI6pcytJGXm/b5WRO > > > +v51tnLT0UVbgXvV03Itn/3MR72muzKXWzzj5LFJST5iqWCgAHJryG3T > > > vNKEYLQ76nwl6B3YVJDjC1InmpIujwXBbxMKpyL1Sh0RLdlHq2TtZS8O qk4V0Q== > > > > > > ;; AUTHORITY SECTION: > > > . 518400 IN NS a.root-servers.net. > > > . 518400 IN NS b.root-servers.net. > > > . 518400 IN NS c.root-servers.net. > > > . 518400 IN NS d.root-servers.net. > > > . 518400 IN NS e.root-servers.net. > > > . 518400 IN NS f.root-servers.net. > > > . 518400 IN NS g.root-servers.net. > > > . 518400 IN NS h.root-servers.net. > > > . 518400 IN NS i.root-servers.net. > > > . 518400 IN NS j.root-servers.net. > > > . 518400 IN NS k.root-servers.net. > > > . 518400 IN NS l.root-servers.net. > > > . 518400 IN NS m.root-servers.net. > > > . 518400 IN RRSIG NS 8 0 518400 > > > 20170319170000 > > > 20170306160000 61045 . > > > iQVPY67dNDj6w14dY1tDFgwRFqhEXVVLmY8q1woIX1eU7t1k/XaPi+tX > > > 3+PDCFQlrQmWSWUtLPaA6pmrACB6EL2YvWzAiLVyocGCBpUpnbUCNAwm > > > nD4SvBZb0ET2jWbSiAzo8iy+1+Hr84I8RXtbcrcpF5Y/J5Oataxt5z9o > > > dHGQSKru0eYEbwfszq0L5L8KECk6skm7iQ0RAIspdTfjDsIwtvoAhEGV > > > B8qjFQP5Bkcn38b35eWHneCmc3cgG0J+pK/eX/YHpqClcINGh3eavBlC > > > 1KpUkDDMAwCvo+X/MhDE2Ol/VR00/M/YCzXbEv97IWenM1Xi4ArX9F1C xBc0gA== > > > > > > ;; ADDITIONAL SECTION: > > > a.root-servers.net. 518400 IN A 198.41.0.4 > > > b.root-servers.net. 518400 IN A 192.228.79.201 > > > c.root-servers.net. 518400 IN A 192.33.4.12 > > > d.root-servers.net. 518400 IN A 199.7.91.13 > > > e.root-servers.net. 518400 IN A 192.203.230.10 > > > f.root-servers.net. 518400 IN A 192.5.5.241 > > > g.root-servers.net. 518400 IN A 192.112.36.4 > > > h.root-servers.net. 518400 IN A 198.97.190.53 > > > i.root-servers.net. 518400 IN A 192.36.148.17 > > > j.root-servers.net. 518400 IN A 192.58.128.30 > > > k.root-servers.net. 518400 IN A 193.0.14.129 > > > l.root-servers.net. 518400 IN A 199.7.83.42 > > > m.root-servers.net. 518400 IN A 202.12.27.33 > > > a.root- > > > servers.net. 518400 IN AAAA 2001:503:ba3e::2:30 > > > b.root-servers.net. 518400 IN AAAA 2001:500:84::b > > > c.root-servers.net. 518400 IN AAAA 2001:500:2::c > > > d.root-servers.net. 518400 IN AAAA 2001:500:2d::d > > > e.root-servers.net. 518400 IN AAAA 2001:500:a8::e > > > f.root-servers.net. 518400 IN AAAA 2001:500:2f::f > > > g.root-servers.net. 518400 IN AAAA 2001:500:12::d0d > > > h.root-servers.net. 518400 IN AAAA 2001:500:1::53 > > > i.root-servers.net. 518400 IN AAAA 2001:7fe::53 > > > j.root-servers.net. 518400 IN AAAA 2001:503:c27::2:30 > > > k.root-servers.net. 518400 IN AAAA 2001:7fd::1 > > > l.root-servers.net. 518400 IN AAAA 2001:500:9f::42 > > > m.root-servers.net. 518400 IN AAAA 2001:dc3::35 > > > > > > ;; Query time: 797 msec > > > ;; SERVER: 198.41.0.4#53(198.41.0.4) > > > ;; WHEN: Mon Mar 06 17:03:12 CST 2017 > > > ;; MSG SIZE rcvd: 1440 > > > > > > # host www.google.com > > > Host www.google.com not found: 2(SERVFAIL) > > > > > > # host www.ipfire.org > > > ;; connection timed out; no servers could be reached > > > > > > > > > # nslookup www.google.com > > > Server: 127.0.0.1 > > > Address: 127.0.0.1#53 > > > > > > ** server can't find www.google.com: SERVFAIL > > > > > > # nslookup www.ipfire.org 8.8.8.8 > > > Server: 8.8.8.8 > > > Address: 8.8.8.8#53 > > > > > > Non-authoritative answer: > > > www.ipfire.org class="Apple-tab-span" style="white- > > > space:pre"> canonical name = web01.ipfire.org. > > > Name: web01.ipfire.org > > > Address: 81.3.27.41 > > > > > > > > > Thanks, > > > Paul > > > > > Log from unbound (via web interface): > > IPFire diagnostics > Section: unbound > Date: March 07, 2017 > > 09:53:05 unbound: [3485:0] info: validation failure > ns02.fedoraproject.org. AAAA IN > 09:53:05 unbound: [3485:0] info: validation failure > ns05.fedoraproject.org. AAAA IN > 09:53:05 unbound: [3485:0] info: validation failure > fedoraproject.org. AAAA IN > 09:52:36 unbound: [3485:1] info: validation failure > fedoraproject.org.localdomain. AAAA IN > 09:52:29 unbound: [3485:0] info: failed to prime trust anchor -- > could not fetch DNSKEY rrset . DNSKEY IN > 09:52:19 unbound: [3485:0] info: failed to prime trust anchor -- > could not fetch DNSKEY rrset . DNSKEY IN > 09:51:29 unbound: [3485:0] info: start of service (unbound 1.6.1). > 09:51:29 unbound: [3485:0] notice: init module 1: iterator > 09:51:29 unbound: [3485:0] notice: init module 0: validator > 09:51:27 unbound: [1406:0] info: 4.000000 8.000000 1 > 09:51:27 unbound: [1406:0] info: 2.000000 4.000000 1 > 09:51:27 unbound: [1406:0] info: 0.524288 1.000000 2 > 09:51:27 unbound: [1406:0] info: 0.262144 0.524288 5 > 09:51:27 unbound: [1406:0] info: 0.131072 0.262144 1 > 09:51:27 unbound: [1406:0] info: 0.016384 0.032768 1 > 09:51:27 unbound: [1406:0] info: 0.008192 0.016384 1 > 09:51:27 unbound: [1406:0] info: 0.000000 0.000001 7 > 09:51:27 unbound: [1406:0] info: lower(secs) upper(secs) recursions > 09:51:27 unbound: [1406:0] info: [25%]=6.78571e-07 > median[50%]=0.196608 [75%]=0.484966 > 09:51:27 unbound: [1406:0] info: histogram of recursion processing > times > 09:51:27 unbound: [1406:0] info: average recursion processing time > 0.581705 sec > 09:51:27 unbound: [1406:0] info: server stats for thread 1: > requestlist max 3 avg 0.526316 exceeded 0 jostled 0 > 09:51:27 unbound: [1406:0] info: server stats for thread 1: 45 > queries, 26 answers from cache, 19 recursions, 0 prefetch, 0 rejected > by ip ratelimiting > 09:51:27 unbound: [1406:0] info: 32.000000 64.000000 6 > 09:51:27 unbound: [1406:0] info: 16.000000 32.000000 6 > 09:51:27 unbound: [1406:0] info: 8.000000 16.000000 11 > 09:51:27 unbound: [1406:0] info: 4.000000 8.000000 5 > 09:51:27 unbound: [1406:0] info: 2.000000 4.000000 2 > 09:51:27 unbound: [1406:0] info: 1.000000 2.000000 2 > 09:51:27 unbound: [1406:0] info: 0.262144 0.524288 4 > 09:51:27 unbound: [1406:0] info: 0.131072 0.262144 1 > 09:51:27 unbound: [1406:0] info: 0.000000 0.000001 2 > 09:51:27 unbound: [1406:0] info: lower(secs) upper(secs) recursions > 09:51:27 unbound: [1406:0] info: [25%]=2.75 median[50%]=10.5455 > [75%]=22 > 09:51:27 unbound: [1406:0] info: histogram of recursion processing > times > 09:51:27 unbound: [1406:0] info: average recursion processing time > 15.696339 sec > 09:51:27 unbound: [1406:0] info: server stats for thread 0: > requestlist max 68 avg 23.925 exceeded 0 jostled 0 > 09:51:27 unbound: [1406:0] info: server stats for thread 0: 67 > queries, 28 answers from cache, 39 recursions, 1 prefetch, 0 rejected > by ip ratelimiting > 09:51:27 unbound: [1406:0] info: service stopped (unbound 1.6.1). > 09:50:18 unbound: [1406:0] info: validation failure b.gtld- > servers.net. AAAA IN > 09:50:18 unbound: [1406:0] info: validation failure a.gtld- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure a.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure m.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure c.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure b.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure l.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure k.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure j.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure i.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure h.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure g.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure f.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure e.root- > servers.net. AAAA IN > 09:50:17 unbound: [1406:0] info: validation failure d.root- > servers.net. AAAA IN > 09:49:55 unbound: [1406:0] info: validation failure > ns02.fedoraproject.org. AAAA IN > 09:49:55 unbound: [1406:0] info: validation failure > ns05.fedoraproject.org. AAAA IN > 09:49:51 unbound: [1406:0] info: validation failure > fedoraproject.org. AAAA IN > 09:49:48 unbound: [1406:0] info: validation failure > fireinfo.ipfire.org. AAAA IN > 09:49:46 unbound: [1406:0] info: validation failure > ns1.lightningwirelabs.com. AAAA IN > 09:49:46 unbound: [1406:0] info: validation failure > ns3.lightningwirelabs.com. AAAA IN > 09:49:46 unbound: [1406:0] info: validation failure > ns2.lightningwirelabs.com. AAAA IN > 09:49:42 unbound: [1406:1] info: validation failure > fedoraproject.org. AAAA IN > 09:49:18 unbound: [1406:0] info: validation failure > fedoraproject.org.localdomain. AAAA IN > 09:49:18 unbound: [1406:0] info: validation failure > fireinfo.ipfire.org.localdomain. AAAA IN > 09:48:21 unbound: [1406:0] info: start of service (unbound 1.6.1). > 09:48:21 unbound: [1406:0] notice: init module 1: iterator > 09:48:21 unbound: [1406:0] notice: init module 0: validator > > > Thank you, > Paul Forgot to cc: the list...Paul

2 9

[PATCH] squid 3.5.24: latest patches (14149-14153)
by Matthias Fischer 02 Apr '17

02 Apr '17

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 5 + src/patches/squid/squid-3.5-14149.patch | 78 +++++++ src/patches/squid/squid-3.5-14150.patch | 32 +++ src/patches/squid/squid-3.5-14151.patch | 36 ++++ src/patches/squid/squid-3.5-14152.patch | 35 ++++ src/patches/squid/squid-3.5-14153.patch | 353 ++++++++++++++++++++++++++++++++ 6 files changed, 539 insertions(+) create mode 100644 src/patches/squid/squid-3.5-14149.patch create mode 100644 src/patches/squid/squid-3.5-14150.patch create mode 100644 src/patches/squid/squid-3.5-14151.patch create mode 100644 src/patches/squid/squid-3.5-14152.patch create mode 100644 src/patches/squid/squid-3.5-14153.patch diff --git a/lfs/squid b/lfs/squid index 5f12b9b05..269902067 100644 --- a/lfs/squid +++ b/lfs/squid @@ -77,6 +77,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14146.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14147.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14148.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14149.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14150.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14151.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14152.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5-14153.patch cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid-3.5.24-fix-max-file-descriptors.patch cd $(DIR_APP) && autoreconf -vfi diff --git a/src/patches/squid/squid-3.5-14149.patch b/src/patches/squid/squid-3.5-14149.patch new file mode 100644 index 000000000..a9fa59754 --- /dev/null +++ b/src/patches/squid/squid-3.5-14149.patch @@ -0,0 +1,78 @@ +------------------------------------------------------------ +revno: 14149 +revision-id: squid3(a)treenet.co.nz-20170330133122-zcpblbvnuq7mjvq3 +parent: squid3(a)treenet.co.nz-20170226110942-90rcwhx3fwa2l7is +fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4508 +author: Christos Tsantilas <chtsanti(a)users.sourceforge.net> +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Fri 2017-03-31 01:31:22 +1200 +message: + Bug 4508: Host forgery stalls intercepted being-spliced connections. + + Most SslBump splicing happens after getting SNI. SNI goes into the + second fake CONNECT request, where it may fail the host forgery check. + A failed check triggers an HTTP error response from Squid. When + attempting to send that response to the TLS client, Squid checks whether + all previously pipelined HTTP requests on the connection have finished. + + Prior to this fix, Squid left the first fake CONNECT request in the + connection pipeline despite adding the second fake CONNECT. That first + CONNECT stalled the error response described above, with Squid waiting, + in vain, for that already handled [fake] transaction to finish. + + Also call quitAfterError() to force Squid to close the connection (after + writing the discussed error response) instead of just logging a + [misleading] "kick abandoning [connection]" message in cache.log. + + TODO: Always pop the first CONNECT when generating a second one. + Unifying CONNECT treatment is difficult because code like tunnel.cc + wants that CONNECT to be in the pipeline. Polishing that would probably + require disassociating ConnStateData from tunnel.cc (at least). + + TODO: Apply the existing "delayed error" logic (that optionally bumps + TLS connections to deliver [some] errors to [some] SSL/TLS clients) to + host forgery errors. Otherwise, the plain HTTP error message cannot be + understood by the intercepted TLS client. + + This is a Measurement Factory project +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20170330133122-zcpblbvnuq7mjvq3 +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: db616fff2ac0df73cf41d380f07a96b773cf2be5 +# timestamp: 2017-03-30 13:51:17 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20170226110942-\ +# 90rcwhx3fwa2l7is +# +# Begin patch +=== modified file 'src/client_side.cc' +--- src/client_side.cc 2017-01-27 13:38:24 +0000 ++++ src/client_side.cc 2017-03-30 13:31:22 +0000 +@@ -4376,7 +4376,12 @@ + fd_table[connState->clientConnection->fd].read_method = &default_read_method; + fd_table[connState->clientConnection->fd].write_method = &default_write_method; + ++ ClientSocketContext::Pointer context = connState->getCurrentContext(); ++ Must(context != NULL); + if (connState->transparent()) { ++ // If we are going to fake the second CONNECT, clear the first one. ++ context->connIsFinished(); ++ + // fake a CONNECT request to force connState to tunnel + // XXX: copy from MemBuf reallocates, not a regression since old code did too + SBuf temp; + +=== modified file 'src/client_side_request.cc' +--- src/client_side_request.cc 2017-02-25 05:50:14 +0000 ++++ src/client_side_request.cc 2017-03-30 13:31:22 +0000 +@@ -561,6 +561,7 @@ + debugs(85, DBG_IMPORTANT, "SECURITY ALERT: on URL: " << urlCanonical(http->request)); + + // IP address validation for Host: failed. reject the connection. ++ http->getConn()->quitAfterError(http->request); + clientStreamNode *node = (clientStreamNode *)http->client_stream.tail->prev->data; + clientReplyContext *repContext = dynamic_cast<clientReplyContext *>(node->data.getRaw()); + assert (repContext); + diff --git a/src/patches/squid/squid-3.5-14150.patch b/src/patches/squid/squid-3.5-14150.patch new file mode 100644 index 000000000..dfe97a0ef --- /dev/null +++ b/src/patches/squid/squid-3.5-14150.patch @@ -0,0 +1,32 @@ +------------------------------------------------------------ +revno: 14150 +revision-id: squid3(a)treenet.co.nz-20170331005152-8exm3hsly1v1jk8y +parent: squid3(a)treenet.co.nz-20170330133122-zcpblbvnuq7mjvq3 +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Fri 2017-03-31 12:51:52 +1200 +message: + Fix variable shadowing after rev.14149 +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20170331005152-8exm3hsly1v1jk8y +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: ae1e30fff31cf8b411c62eba344fdc944692aecf +# timestamp: 2017-03-31 01:51:06 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20170330133122-\ +# zcpblbvnuq7mjvq3 +# +# Begin patch +=== modified file 'src/client_side.cc' +--- src/client_side.cc 2017-03-30 13:31:22 +0000 ++++ src/client_side.cc 2017-03-31 00:51:52 +0000 +@@ -4390,7 +4390,6 @@ + } else { + // in.buf still has the "CONNECT ..." request data, reset it to SSL hello message + connState->in.buf.append(rbuf.content(), rbuf.contentSize()); +- ClientSocketContext::Pointer context = connState->getCurrentContext(); + ClientHttpRequest *http = context->http; + tunnelStart(http, &http->out.size, &http->al->http.code, http->al); + } + diff --git a/src/patches/squid/squid-3.5-14151.patch b/src/patches/squid/squid-3.5-14151.patch new file mode 100644 index 000000000..d22387d53 --- /dev/null +++ b/src/patches/squid/squid-3.5-14151.patch @@ -0,0 +1,36 @@ +------------------------------------------------------------ +revno: 14151 +revision-id: squid3(a)treenet.co.nz-20170331233831-m3hfrigo82uhz4id +parent: squid3(a)treenet.co.nz-20170331005152-8exm3hsly1v1jk8y +author: Garri Djavadyan <garryd(a)comnet.uz> +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Sat 2017-04-01 12:38:31 +1300 +message: + Docs: update refresh_pattern description regarding 'max' option +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20170331233831-m3hfrigo82uhz4id +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: be64101730dcb2deb664d6594d20a7295a666b98 +# timestamp: 2017-03-31 23:40:50 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20170331005152-\ +# 8exm3hsly1v1jk8y +# +# Begin patch +=== modified file 'src/cf.data.pre' +--- src/cf.data.pre 2017-01-01 00:16:45 +0000 ++++ src/cf.data.pre 2017-03-31 23:38:31 +0000 +@@ -5401,7 +5401,9 @@ + will be considered fresh. + + 'Max' is an upper limit on how long objects without an explicit +- expiry time will be considered fresh. ++ expiry time will be considered fresh. The value is also used ++ to form Cache-Control: max-age header for a request sent from ++ Squid to origin/parent. + + options: override-expire + override-lastmod + diff --git a/src/patches/squid/squid-3.5-14152.patch b/src/patches/squid/squid-3.5-14152.patch new file mode 100644 index 000000000..81bd3a039 --- /dev/null +++ b/src/patches/squid/squid-3.5-14152.patch @@ -0,0 +1,35 @@ +------------------------------------------------------------ +revno: 14152 +revision-id: squid3(a)treenet.co.nz-20170331233921-efxhs8vy025fvrnl +parent: squid3(a)treenet.co.nz-20170331233831-m3hfrigo82uhz4id +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Sat 2017-04-01 12:39:21 +1300 +message: + libtrie: Fix 'make check' when run before 'make all' +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20170331233921-efxhs8vy025fvrnl +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: 8399bbfe7b517fa6306bdc61d212a9a4fcc9e88b +# timestamp: 2017-03-31 23:40:52 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20170331233831-\ +# m3hfrigo82uhz4id +# +# Begin patch +=== modified file 'lib/libTrie/Makefile.am' +--- lib/libTrie/Makefile.am 2017-01-01 00:16:45 +0000 ++++ lib/libTrie/Makefile.am 2017-03-31 23:39:21 +0000 +@@ -8,8 +8,8 @@ + include $(top_srcdir)/src/Common.am + include $(top_srcdir)/src/TestHeaders.am + +-DIST_SUBDIRS = test +-SUBDIRS = test ++DIST_SUBDIRS = . test ++SUBDIRS = . test + + noinst_LIBRARIES = libTrie.a + + diff --git a/src/patches/squid/squid-3.5-14153.patch b/src/patches/squid/squid-3.5-14153.patch new file mode 100644 index 000000000..c236a6115 --- /dev/null +++ b/src/patches/squid/squid-3.5-14153.patch @@ -0,0 +1,353 @@ +------------------------------------------------------------ +revno: 14153 +revision-id: squid3(a)treenet.co.nz-20170331234747-59glu40hhx0kf8fx +parent: squid3(a)treenet.co.nz-20170331233921-efxhs8vy025fvrnl +fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4688 +author: Lubos Uhliarik <luhliari(a)redhat.com> +committer: Amos Jeffries <squid3(a)treenet.co.nz> +branch nick: 3.5 +timestamp: Sat 2017-04-01 12:47:47 +1300 +message: + Bug 4688: various typo error(s) in man page(s) +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: squid3(a)treenet.co.nz-20170331234747-59glu40hhx0kf8fx +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# testament_sha1: a05d98a4e328e39f2a490cfeff72ad8735cc6b6e +# timestamp: 2017-03-31 23:48:51 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.5 +# base_revision_id: squid3(a)treenet.co.nz-20170331233921-\ +# efxhs8vy025fvrnl +# +# Begin patch +=== modified file 'compat/compat.h' +--- compat/compat.h 2017-01-01 00:16:45 +0000 ++++ compat/compat.h 2017-03-31 23:47:47 +0000 +@@ -11,7 +11,7 @@ + + /* + * From discussions it was chosen to push compat code as far down as possible. +- * That means we can have a seperate compat for most ++ * That means we can have a separate compat for most + * compatability and portability hacks and resolutions. + * + * This file is meant to collate all those hacks files together and + +=== modified file 'helpers/basic_auth/DB/basic_db_auth.pl.in' +--- helpers/basic_auth/DB/basic_db_auth.pl.in 2017-01-01 00:16:45 +0000 ++++ helpers/basic_auth/DB/basic_db_auth.pl.in 2017-03-31 23:47:47 +0000 +@@ -14,7 +14,7 @@ + + basic_db_auth [options] + +-=head1 DESCRIPTOIN ++=head1 DESCRIPTION + + This program verifies username & password to a database + +@@ -97,7 +97,7 @@ + Copyright (C) 2007 Henrik Nordstrom <henrik(a)henriknordstrom.net> + Copyright (C) 2010 Luis Daniel Lucio Quiroz <dlucio(a)okay.com.mx> (Joomla support) + This program is free software. You may redistribute copies of it under the +-terms of the GNU General Public License version 2, or (at youropinion) any ++terms of the GNU General Public License version 2, or (at your opinion) any + later version. + + =head1 QUESTIONS + +=== modified file 'helpers/basic_auth/LDAP/basic_ldap_auth.8' +--- helpers/basic_auth/LDAP/basic_ldap_auth.8 2017-01-01 00:16:45 +0000 ++++ helpers/basic_auth/LDAP/basic_ldap_auth.8 2017-03-31 23:47:47 +0000 +@@ -98,7 +98,7 @@ + .B Note: + This can only be done if all your users are located directly under + the same position in the LDAP tree and the login name is used for naming +-each user object. If your LDAP tree does not match these criterias or if ++each user object. If your LDAP tree does not match these criteria or if + you want to filter who are valid users then you need to use a search filter + to search for your users DN ( + .B \-f +@@ -186,15 +186,15 @@ + .B never + dereference aliases (default), + .B always +-dereference aliases, only while +-.B search ing ++dereference aliases, only during a ++.B search + or only to + .B find + the base object. + . + .if !'po4a'hide' .TP + .if !'po4a'hide' .B "\-H ldap_uri +-Specity the LDAP server to connect to by LDAP URI (requires OpenLDAP libraries). ++Specify the LDAP server to connect to by LDAP URI (requires OpenLDAP libraries). + Servers can also be specified last on the command line. + . + .if !'po4a'hide' .TP + +=== modified file 'helpers/digest_auth/LDAP/digest_pw_auth.cc' +--- helpers/digest_auth/LDAP/digest_pw_auth.cc 2017-01-01 00:16:45 +0000 ++++ helpers/digest_auth/LDAP/digest_pw_auth.cc 2017-03-31 23:47:47 +0000 +@@ -30,7 +30,7 @@ + * the file format. However storing such a triple does little to + * improve security: If compromised the username:realm:HA1 combination + * is "plaintext equivalent" - for the purposes of digest authentication +- * they allow the user access. Password syncronisation is not tackled ++ * they allow the user access. Password synchronization is not tackled + * by digest - just preventing on the wire compromise. + * + * Copyright (c) 2003 Robert Collins <robertc(a)squid-cache.org> + +=== modified file 'helpers/digest_auth/eDirectory/digest_pw_auth.cc' +--- helpers/digest_auth/eDirectory/digest_pw_auth.cc 2017-01-01 00:16:45 +0000 ++++ helpers/digest_auth/eDirectory/digest_pw_auth.cc 2017-03-31 23:47:47 +0000 +@@ -30,7 +30,7 @@ + * the file format. However storing such a triple does little to + * improve security: If compromised the username:realm:HA1 combination + * is "plaintext equivalent" - for the purposes of digest authentication +- * they allow the user access. Password syncronisation is not tackled ++ * they allow the user access. Password synchronization is not tackled + * by digest - just preventing on the wire compromise. + * + * Copyright (c) 2003 Robert Collins <robertc(a)squid-cache.org> + +=== modified file 'helpers/digest_auth/file/digest_file_auth.8' +--- helpers/digest_auth/file/digest_file_auth.8 2017-01-01 00:16:45 +0000 ++++ helpers/digest_auth/file/digest_file_auth.8 2017-03-31 23:47:47 +0000 +@@ -15,7 +15,7 @@ + is an installed binary authentication program for Squid. It handles digest + authentication protocol and authenticates against a text file backend. + . +-This program will automatically detect the existence of a concurrecy channel-ID and adjust appropriately. ++This program will automatically detect the existence of a concurrency channel-ID and adjust appropriately. + It may be used with any value 0 or above for the auth_param children concurrency= parameter. + . + .SH OPTIONS +@@ -54,7 +54,7 @@ + improve security: If compromised the + .B username:realm:HA1 + combination is "plaintext equivalent" - for the purposes of digest authentication +-they allow the user access. Password syncronisation is not tackled ++they allow the user access. Password synchronization is not tackled + by digest - just preventing on the wire compromise. + . + .SH AUTHOR + +=== modified file 'helpers/digest_auth/file/digest_file_auth.cc' +--- helpers/digest_auth/file/digest_file_auth.cc 2017-01-01 00:16:45 +0000 ++++ helpers/digest_auth/file/digest_file_auth.cc 2017-03-31 23:47:47 +0000 +@@ -33,7 +33,7 @@ + * the file format. However storing such a triple does little to + * improve security: If compromised the username:realm:HA1 combination + * is "plaintext equivalent" - for the purposes of digest authentication +- * they allow the user access. Password syncronisation is not tackled ++ * they allow the user access. Password synchronization is not tackled + * by digest - just preventing on the wire compromise. + * + * Copyright (c) 2003 Robert Collins <robertc(a)squid-cache.org> + +=== modified file 'helpers/digest_auth/file/text_backend.cc' +--- helpers/digest_auth/file/text_backend.cc 2017-01-01 00:16:45 +0000 ++++ helpers/digest_auth/file/text_backend.cc 2017-03-31 23:47:47 +0000 +@@ -29,7 +29,7 @@ + * the file format. However storing such a triple does little to + * improve security: If compromised the username:realm:HA1 combination + * is "plaintext equivalent" - for the purposes of digest authentication +- * they allow the user access. Password syncronisation is not tackled ++ * they allow the user access. Password synchronization is not tackled + * by digest - just preventing on the wire compromise. + * + * Copyright (c) 2003 Robert Collins <robertc(a)squid-cache.org> + +=== modified file 'helpers/external_acl/LDAP_group/ext_ldap_group_acl.8' +--- helpers/external_acl/LDAP_group/ext_ldap_group_acl.8 2017-01-01 00:16:45 +0000 ++++ helpers/external_acl/LDAP_group/ext_ldap_group_acl.8 2017-03-31 23:47:47 +0000 +@@ -52,8 +52,8 @@ + .BI never + dereference aliases (default), + .BI always +-dereference aliases, only while +-.BR search ing ++dereference aliases, only during a ++.BR search + or only to + .B find + the base object +@@ -143,7 +143,7 @@ + . + .if !'po4a'hide' .TP + .if !'po4a'hide' .BI \-H " ldapuri" +-Specity the LDAP server to connect to by a LDAP URI (requires OpenLDAP libraries) ++Specify the LDAP server to connect to by a LDAP URI (requires OpenLDAP libraries) + . + .if !'po4a'hide' .TP + .if !'po4a'hide' .BI \-K + +=== modified file 'helpers/external_acl/kerberos_ldap_group/README' +--- helpers/external_acl/kerberos_ldap_group/README 2010-08-13 10:17:20 +0000 ++++ helpers/external_acl/kerberos_ldap_group/README 2017-03-31 23:47:47 +0000 +@@ -65,7 +65,7 @@ + export KRB5_KTNAME + + If you use a different Kerberos domain than the machine itself is in you can point squid to +-the seperate Kerberos config file by setting the following environmnet variable in the startup ++the separate Kerberos config file by setting the following environment variable in the startup + script. + + KRB5_CONFIG=/etc/krb5-squid.conf + +=== modified file 'helpers/external_acl/kerberos_ldap_group/ext_kerberos_ldap_group_acl.8' +--- helpers/external_acl/kerberos_ldap_group/ext_kerberos_ldap_group_acl.8 2015-03-21 06:32:34 +0000 ++++ helpers/external_acl/kerberos_ldap_group/ext_kerberos_ldap_group_acl.8 2017-03-31 23:47:47 +0000 +@@ -163,7 +163,7 @@ + .if !'po4a'hide' .ft + . + If you use a different Kerberos domain than the machine itself is in you can point squid to +-the seperate Kerberos config file by setting the following environmnet variable in the startup ++the separate Kerberos config file by setting the following environment variable in the startup + script. + .if !'po4a'hide' .P + .if !'po4a'hide' .ft CR + +=== modified file 'helpers/external_acl/session/ext_session_acl.8' +--- helpers/external_acl/session/ext_session_acl.8 2017-01-01 00:16:45 +0000 ++++ helpers/external_acl/session/ext_session_acl.8 2017-03-31 23:47:47 +0000 +@@ -21,7 +21,7 @@ + ) or a fixed period of time ( + .B \-T + ). The former is suitable for displaying terms and conditions to a user; the +-latter is suitable for the display of advertisments or other notices (both as a ++latter is suitable for the display of advertisements or other notices (both as a + splash page \- see config examples in the wiki online). The session helper can also be used + to force users to re\-authenticate if the + .B %LOGIN +@@ -55,7 +55,7 @@ + environment is created within the directory. The advantage of the latter + is better database support between multiple instances of the session + helper. Using multiple instances of the session helper with a single +-database file will cause synchronisation problems between processes. ++database file will cause synchronization problems between processes. + If this option is not specified the session details will be kept in + memory only and all sessions will reset each time Squid restarts its + helpers (Squid restart or rotation of logs). + +=== modified file 'helpers/log_daemon/DB/log_db_daemon.pl.in' +--- helpers/log_daemon/DB/log_db_daemon.pl.in 2017-01-01 00:16:45 +0000 ++++ helpers/log_daemon/DB/log_db_daemon.pl.in 2017-03-31 23:47:47 +0000 +@@ -18,7 +18,7 @@ + + log_db_daemon DSN [options] + +-=head1 DESCRIPTOIN ++=head1 DESCRIPTION + + This program writes Squid access.log entries to a database. + Presently only accepts the B<squid> native format +@@ -373,7 +373,7 @@ + WHERE squid_request_status LIKE '%MISS%') + / + (SELECT COUNT(*) FROM access_log)*100 +- AS pecentage; ++ AS percentage; + + =item Response time ranges + +@@ -433,7 +433,7 @@ + + This script currently implements only the C<L> (i.e. "append a line to the log") command, therefore the log lines are never purged from the table. This approach has an obvious scalability problem. + +-One solution would be to implement e.g. the "rotate log" command in a way that would calculate some summary values, put them in a "summary table" and then delete the lines used to caluclate those values. ++One solution would be to implement e.g. the "rotate log" command in a way that would calculate some summary values, put them in a "summary table" and then delete the lines used to calculate those values. + + Similar cleanup code could be implemented in an external script and run periodically independently from squid log commands. + + +=== modified file 'helpers/negotiate_auth/kerberos/README' +--- helpers/negotiate_auth/kerberos/README 2008-10-03 02:25:50 +0000 ++++ helpers/negotiate_auth/kerberos/README 2017-03-31 23:47:47 +0000 +@@ -53,7 +53,7 @@ + export KRB5_KTNAME + + If you use a different Kerberos domain than the machine itself is in you can point squid to +-the seperate Kerberos config file by setting the following environmnet variable in the startup ++the separate Kerberos config file by setting the following environment variable in the startup + script. + + KRB5_CONFIG=/etc/krb-squid5.conf + +=== modified file 'helpers/negotiate_auth/kerberos/negotiate_kerberos_auth.8' +--- helpers/negotiate_auth/kerberos/negotiate_kerberos_auth.8 2014-12-20 17:10:25 +0000 ++++ helpers/negotiate_auth/kerberos/negotiate_kerberos_auth.8 2017-03-31 23:47:47 +0000 +@@ -69,7 +69,7 @@ + export KRB5_KTNAME + + If you use a different Kerberos domain than the machine itself is in you can point squid to +-the seperate Kerberos config file by setting the following environmnet variable in the startup ++the separate Kerberos config file by setting the following environment variable in the startup + script. + + KRB5_CONFIG=/etc/krb5\-squid.conf + +=== modified file 'helpers/storeid_rewrite/file/storeid_file_rewrite.pl.in' +--- helpers/storeid_rewrite/file/storeid_file_rewrite.pl.in 2017-01-01 00:16:45 +0000 ++++ helpers/storeid_rewrite/file/storeid_file_rewrite.pl.in 2017-03-31 23:47:47 +0000 +@@ -29,7 +29,7 @@ + Rewrite rules are matched in the same order as they appear in the rules file. + So for best performance, sort it in order of frequency of occurrence. + +-This program will automatically detect the existence of a concurrecy channel-ID and adjust appropriately. ++This program will automatically detect the existence of a concurrency channel-ID and adjust appropriately. + It may be used with any value 0 or above for the store_id_children concurrency= parameter. + + =head1 OPTIONS + +=== modified file 'src/StoreFileSystem.h' +--- src/StoreFileSystem.h 2017-01-01 00:16:45 +0000 ++++ src/StoreFileSystem.h 2017-03-31 23:47:47 +0000 +@@ -47,7 +47,7 @@ + \par + * configure will take a list of storage types through the + * --enable-store-io parameter. This parameter takes a list of +- * space seperated storage types. For example, ++ * space separated storage types. For example, + * --enable-store-io="ufs aufs" . + * + \par + +=== modified file 'src/ipcache.cc' +--- src/ipcache.cc 2017-01-01 00:16:45 +0000 ++++ src/ipcache.cc 2017-03-31 23:47:47 +0000 +@@ -50,7 +50,7 @@ + \defgroup IPCacheInternal IP Cache Internals + \ingroup IPCacheAPI + \todo when IP cache is provided as a class. These sub-groups will be obsolete +- * for now they are used to seperate the public and private functions. ++ * for now they are used to separate the public and private functions. + * with the private ones all being in IPCachInternal and public in IPCacheAPI + * + \section InternalOperation Internal Operation + +=== modified file 'src/ssl/ssl_crtd.8' +--- src/ssl/ssl_crtd.8 2017-01-01 00:16:45 +0000 ++++ src/ssl/ssl_crtd.8 2017-03-31 23:47:47 +0000 +@@ -33,7 +33,7 @@ + Because the generation and signing of SSL certificates takes time + Squid must use external process to handle the work. + . +-This process generates new SSL certificates and uses a disk cache of certificatess ++This process generates new SSL certificates and uses a disk cache of certificates + to improve response times on repeated requests. + Communication occurs via TCP sockets bound to the loopback interface. + . +@@ -122,7 +122,7 @@ + . + .PP + For simple configuration the helper defaults can be used. +-Only HTTP listening port options are required to enable generation and set the signign CA certificate. ++Only HTTP listening port options are required to enable generation and set the signing CA certificate. + For Example: + .if !'po4a'hide' .RS + .if !'po4a'hide' .B http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/ssl_cert/www.sample.com.pem + -- 2.11.0

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2017