Development December 2021

development@lists.ipfire.org

11 participants
54 discussions

Info re OpenVPN 2.5.5 release
by Adolf Belka 17 Dec '21

17 Dec '21

Dear All, OpenVPN has released version 2.5.5 with IPFire on 2.5.4 in Core Update 162 I have reviewed the changes ion 2.5.5 and they are related to windows builds or to use of windows console commands. There is nothing related to any bug fixes or security issues. Therefore I intend to leave this version and wait to review the next one when it is released. Regards, Adolf.

1 0

[PATCH] suricata: Do not load rules for dnp3 and modbus.
by Stefan Schantl 17 Dec '21

17 Dec '21

The parsers for those are disabled in the suricata config so the rules are not needed, on the contrary they massively will spam warnings when launching suricate because of the disabled parsers. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/suricata/suricata-default-rules.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/config/suricata/suricata-default-rules.yaml b/config/suricata/suricata-default-rules.yaml index 64493e462..d6c358add 100644 --- a/config/suricata/suricata-default-rules.yaml +++ b/config/suricata/suricata-default-rules.yaml @@ -5,13 +5,11 @@ - /usr/share/suricata/rules/app-layer-events.rules - /usr/share/suricata/rules/decoder-events.rules - /usr/share/suricata/rules/dhcp-events.rules - - /usr/share/suricata/rules/dnp3-events.rules - /usr/share/suricata/rules/dns-events.rules - /usr/share/suricata/rules/files.rules - /usr/share/suricata/rules/http-events.rules - /usr/share/suricata/rules/ipsec-events.rules - /usr/share/suricata/rules/kerberos-events.rules - - /usr/share/suricata/rules/modbus-events.rules - /usr/share/suricata/rules/nfs-events.rules - /usr/share/suricata/rules/ntp-events.rules - /usr/share/suricata/rules/smb-events.rules -- 2.30.2

2 1

Question regarding rootfile warning "Error! '/aarch64' in rootfiles files found!"
by Peter Müller 15 Dec '21

15 Dec '21

Hello *, while preparing Core Update 163, these messages are emitted at the end of a build on my workstation: > Error! '/aarch64' in rootfiles files found! > ./config/rootfiles/common/liburcu:#usr/include/urcu/arch/aarch64.h > ./config/rootfiles/common/liburcu:#usr/include/urcu/uatomic/aarch64.h > ./config/rootfiles/common/gdb:#usr/share/gdb/syscalls/aarch64-linux.xml > Replace by xxxMACHINExxx ! While I get the intention of a check like this, these appear to be safe to ignore. However, I'd like to have someone more experienced on this to confirm that opinion. Thanks, and best regards, Peter Müller

3 7

[PATCH] libloc: Update to 0.9.9
by Peter Müller 13 Dec '21

13 Dec '21

Please refer to https://lists.ipfire.org/pipermail/location/2021-November/000483.html for this versions' release announcement. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/libloc | 2 +- lfs/libloc | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/libloc b/config/rootfiles/common/libloc index 6b788658d..43f9efd9e 100644 --- a/config/rootfiles/common/libloc +++ b/config/rootfiles/common/libloc @@ -18,7 +18,7 @@ usr/bin/location #usr/lib/libloc.la #usr/lib/libloc.so usr/lib/libloc.so.1 -usr/lib/libloc.so.1.0.0 +usr/lib/libloc.so.1.0.1 usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/Location.pm #usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Location #usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Location/.packlist diff --git a/lfs/libloc b/lfs/libloc index f57918e4e..37571881e 100644 --- a/lfs/libloc +++ b/lfs/libloc @@ -24,8 +24,8 @@ include Config -VER = 0.9.8 -DB_DATE = 2021-09-25 +VER = 0.9.9 +DB_DATE = 2021-12-13 THISAPP = libloc-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,8 +43,8 @@ objects = $(DL_FILE) \ $(DL_FILE) = https://source.ipfire.org/releases/libloc/$(DL_FILE) location-$(DB_DATE).db.xz = https://location.ipfire.org/databases/1/archive/location-$(DB_DATE).db.xz -$(DL_FILE)_MD5 = 9598c08b157305f8c38fc672f5037884 -location-$(DB_DATE).db.xz_MD5 = d2a3c63202ba73f9650beba461b41db4 +$(DL_FILE)_MD5 = 0d14fcad39b19accc001ed5f17a09471 +location-$(DB_DATE).db.xz_MD5 = 7239646f05ac92e76ae2700e7aa14ab8 install : $(TARGET) -- 2.26.2

2 1

[PATCH] unbound: Update to 1.14.0
by Matthias Fischer 11 Dec '21

11 Dec '21

For details see: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-14-0 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/unbound | 2 +- lfs/unbound | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index 558c70268..abf2c158c 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.1.13 +usr/lib/libunbound.so.8.1.14 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/lfs/unbound b/lfs/unbound index 675b4c14b..359645092 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -24,7 +24,7 @@ include Config -VER = 1.13.2 +VER = 1.14.0 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 5a63b7228141f45f2ab3169662f7ee13 +$(DL_FILE)_MD5 = e069764e88be0057c7fbe8b5ae7700f0 install : $(TARGET) -- 2.18.0

2 1

[PATCH] Inform users about the eol of i?86
by Jonatan Schlag 10 Dec '21

10 Dec '21

The warning point to a wiki page which is currently in construction. This should give us the opportunity to add further information for these users even if we do not provide updates anymore. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- html/cgi-bin/index.cgi | 4 ++-- langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/index.cgi b/html/cgi-bin/index.cgi index 948fdde55..90e2daff0 100644 --- a/html/cgi-bin/index.cgi +++ b/html/cgi-bin/index.cgi @@ -541,10 +541,10 @@ if ( ! -e "/var/ipfire/main/send_profile") { $warnmessage .= "<li><a style='color: white;' href='fireinfo.cgi'>$Lang::tr{'fireinfo please enable'}</a></li>"; } -# Legacy architecture +# EOL architecture my ($sysname, $nodename, $release, $version, $machine) = &POSIX::uname(); if ($machine =~ m/^i.86$/) { - $warnmessage .= "<li>$Lang::tr{'legacy architecture warning'}</li>"; + $warnmessage .= "<li href='https://wiki.ipfire.org/hardware/eol-architectures'>$Lang::tr{'eol architecture warning'}</li>"; } # Memory usage warning diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index e350bc651..c81b28fea 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -989,6 +989,7 @@ 'enter data' => 'Geben Sie die Daten ein <br /> und klicken Sie danach auf <i>Speichern</i>.', 'entropy' => 'Entropie', 'entropy graphs' => 'Entropiegraphen', +'eol architecture warning' => 'Sie betreiben ein IPFire System auf einer Architektur, welche nicht mehr unterstützt wird. Sie werden keine Updates mehr erhalten. Das ist ein Sicherheitsrisiko.', 'err bk 1' => 'Fehler beim Erzeugen des Archivs', 'err bk 10 password' => 'Fehler beim Datensicherungs-Passwort', 'err bk 2 key' => 'Fehler beim Erzeugen der Schlüsseldatei', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 4c05dcf76..a92bb07f8 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1015,6 +1015,7 @@ 'enter data' => 'Enter your settings <br /> and then press <i>Save</i>.', 'entropy' => 'Entropy', 'entropy graphs' => 'Entropy Graphs', +'eol architecture warning' => 'You are running an architecture of IPFire which reached its end of life. You will not receive updates anymore. This is a security risk.', 'err bk 1' => 'Error creating archive', 'err bk 10 password' => 'Error with backup password', 'err bk 2 key' => 'Error creating key file', -- 2.20.1

5 9

[PATCH v2 1/3] webinterface: Add links to the configuration wiki
by Leo-Andres Hofmann 10 Dec '21

10 Dec '21

This patch adds a little "help" icon to the page header. If a manual entry exists for a configuration page, the icon appears and offers a quick way to access the wiki. Wiki pages can be configured in the "manualpages" file. Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- config/cfgroot/header.pl | 20 +++++++++++++++++++ config/cfgroot/manualpages | 7 +++++++ html/html/themes/ipfire/include/css/style.css | 13 ++++++++++++ html/html/themes/ipfire/include/functions.pl | 17 +++++++++++++++- 4 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 config/cfgroot/manualpages diff --git a/config/cfgroot/header.pl b/config/cfgroot/header.pl index 79accbe8a..e97f90d67 100644 --- a/config/cfgroot/header.pl +++ b/config/cfgroot/header.pl @@ -91,7 +91,11 @@ if ( -d "/var/ipfire/langs/${language}/" ) { }; }; +### Initialize user manual +my %manualpages = (); +&General::readhash("${General::swroot}/main/manualpages", \%manualpages); +### Load selected language and theme functions require "${swroot}/langs/en.pl"; require "${swroot}/langs/${language}.pl"; eval `/bin/cat /srv/web/ipfire/html/themes/ipfire/include/functions.pl`; @@ -553,3 +557,19 @@ sub colorize { return $string; } } + +# Get user manual URL for the specified configuration page, returns empty if no entry is configured +sub get_manualpage_url() { + my ($cgi_page) = @_; + + # Ensure base url is configured + return unless($manualpages{'BASE_URL'}); + + # Return URL + if($cgi_page && defined($manualpages{$cgi_page})) { + return "$manualpages{'BASE_URL'}/$manualpages{$cgi_page}"; + } + + # No manual page configured, return nothing + return; +} diff --git a/config/cfgroot/manualpages b/config/cfgroot/manualpages new file mode 100644 index 000000000..e5ab1a13c --- /dev/null +++ b/config/cfgroot/manualpages @@ -0,0 +1,7 @@ +# User manual base URL (without trailing slash) +BASE_URL=https://wiki.ipfire.org + +# Assign manual page URL path to CGI file ([cgi basename]=[path/to/page]) +index=configuration/system/startpage +pppsetup=configuration/system/dial +qos=configuration/services/qos diff --git a/html/html/themes/ipfire/include/css/style.css b/html/html/themes/ipfire/include/css/style.css index b92f476c4..661773675 100644 --- a/html/html/themes/ipfire/include/css/style.css +++ b/html/html/themes/ipfire/include/css/style.css @@ -169,6 +169,19 @@ iframe { margin-bottom: 1em; } +#main_header > * { + display: inline-block; + vertical-align: baseline; +} + +#main_header > span { + margin-left: 0.8em; +} + +#main_header img { + padding: 0; +} + #footer { height: 2.5em; margin-bottom: 1em; diff --git a/html/html/themes/ipfire/include/functions.pl b/html/html/themes/ipfire/include/functions.pl index 9f12bbe59..18931428e 100644 --- a/html/html/themes/ipfire/include/functions.pl +++ b/html/html/themes/ipfire/include/functions.pl @@ -170,7 +170,22 @@ END print <<END <div class="bigbox fixed"> <div id="main_inner" class="fixed"> - <h1>$title</h1> + <div id="main_header"> + <h1>$title</h1> +END +; + +# Print user manual link +my $manual_url = &Header::get_manualpage_url($scriptName); +if($manual_url) { + print <<END + <span><a href="$manual_url" title="$Lang::tr{'online help en'}" target="_blank"><img src="/images/help-browser.png" alt="$Lang::tr{'online help en'}"></a></span> +END +; +} + +print <<END + </div> END ; } -- 2.27.0.windows.1

8 25

[PATCH] bash: Update to version 5.1.8 plus patches 9 to 12
by Adolf Belka 09 Dec '21

09 Dec '21

- Update main file from 5.1 to 5.1.8 (includes patches 1 to 8) - Remove patches 1 to 4 - Changelog - Patches 1 to 4 from the previous IPFire version together with patches 5 to 8 are now included into bash-5.1.8 followed by application of patches 9 to 12 Patch 12 There is a possible race condition that arises when a child process receives a signal trapped by the parent before it can reset the signal dispositions. The child process is not supposed to trap the signal in this circumstance. Patch 11 When reading a compound assignment, and running it through the parser to split it into words, we need to save and restore any alias we're currently expanding. Patch 10 If `wait -n' is interrupted by a trapped signal other than SIGINT, it does not completely clean up state, and that can prevent subsequent calls to `wait -n' from working correctly. Patch 9 The bash malloc implementation of malloc_usable_size() does not follow the specification. This can cause library functions that use it to overwrite memory bounds checking. Patch 8 Process substitution FIFOs opened by child processes as targets of redirections were not removed appropriately, leaving remnants in the file system. Patch 7 The code to check readline versions in an inputrc file had the sense of the comparisons reversed. Patch 6 Make sure child processes forked to run command substitutions are in the proper process group. Patch 5 Fix two memory leaks when assigning arrays using compound assignment syntax. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/bash | 6 +- src/patches/bash/bash51-001 | 80 --------------- src/patches/bash/bash51-002 | 57 ----------- src/patches/bash/bash51-003 | 53 ---------- src/patches/bash/bash51-004 | 126 ----------------------- src/patches/bash/bash51-009 | 59 +++++++++++ src/patches/bash/bash51-010 | 59 +++++++++++ src/patches/bash/bash51-011 | 81 +++++++++++++++ src/patches/bash/bash51-012 | 198 ++++++++++++++++++++++++++++++++++++ 9 files changed, 400 insertions(+), 319 deletions(-) delete mode 100644 src/patches/bash/bash51-001 delete mode 100644 src/patches/bash/bash51-002 delete mode 100644 src/patches/bash/bash51-003 delete mode 100644 src/patches/bash/bash51-004 create mode 100644 src/patches/bash/bash51-009 create mode 100644 src/patches/bash/bash51-010 create mode 100644 src/patches/bash/bash51-011 create mode 100644 src/patches/bash/bash51-012 diff --git a/lfs/bash b/lfs/bash index 7b0baccad..1bf3eb2ec 100644 --- a/lfs/bash +++ b/lfs/bash @@ -24,7 +24,7 @@ include Config -VER = 5.1 +VER = 5.1.8 THISAPP = bash-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -53,7 +53,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = bb91a17fd6c9032c26d0b2b78b50aff5 +$(DL_FILE)_MD5 = 23eee6195b47318b9fd878e590ccb38c install : $(TARGET) @@ -87,7 +87,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) sed -e "s/filename, RTLD_LAZY/filename, RTLD_NOW/" \ -i $(DIR_APP)/builtins/enable.def - for i in $$(seq 1 4); do \ + for i in $$(seq 9 12); do \ cd $(DIR_APP) && patch -Np0 < $(DIR_SRC)/src/patches/bash/bash51-$$(printf "%03d" "$${i}") || exit 1; \ done diff --git a/src/patches/bash/bash51-001 b/src/patches/bash/bash51-001 deleted file mode 100644 index 6f29981d2..000000000 --- a/src/patches/bash/bash51-001 +++ /dev/null @@ -1,80 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-001 - -Bug-Reported-by: Fazal Majid <fazal(a)majid.org> -Bug-Reference-ID: <DEAB7D2C-C626-450C-B2E5-281AFF2D26D4(a)majid.org> -Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2020-12/msg00000.html - -Bug-Description: - -There is a missing dependency on a constructed file, which can cause highly -parellel builds to fail. - -Patch (apply with `patch -p0'): - -*** ../bash-5.1-patched/Makefile.in 2020-12-04 09:51:19.000000000 -0500 ---- Makefile.in 2020-12-16 11:28:36.000000000 -0500 -*************** -*** 1316,1319 **** ---- 1316,1320 ---- - bashline.o: pcomplete.h ${BASHINCDIR}/chartypes.h input.h - bashline.o: ${BASHINCDIR}/shmbutil.h ${BASHINCDIR}/shmbchar.h -+ bashline.o: ${DEFDIR}/builtext.h - bracecomp.o: config.h bashansi.h ${BASHINCDIR}/ansi_stdlib.h - bracecomp.o: shell.h syntax.h config.h bashjmp.h ${BASHINCDIR}/posixjmp.h -*************** -*** 1436,1439 **** ---- 1437,1441 ---- - builtins/evalstring.o: jobs.h builtins.h flags.h input.h execute_cmd.h - builtins/evalstring.o: bashhist.h $(DEFSRC)/common.h pathnames.h -+ builtins/evalstring.o: ${DEFDIR}/builtext.h - builtins/getopt.o: config.h ${BASHINCDIR}/memalloc.h - builtins/getopt.o: shell.h syntax.h bashjmp.h command.h general.h xmalloc.h error.h - -*** ../bash-5.1-patched/builtins/Makefile.in 2019-07-25 08:03:45.000000000 -0400 ---- builtins/Makefile.in 2020-12-16 11:29:29.000000000 -0500 -*************** -*** 362,366 **** - evalstring.o: $(topdir)/flags.h $(topdir)/input.h $(topdir)/execute_cmd.h - evalstring.o: $(topdir)/bashhist.h $(srcdir)/common.h -! evalstring.o: $(topdir)/trap.h $(topdir)/redir.h ../pathnames.h - #evalstring.o: $(topdir)/y.tab.h - getopt.o: ../config.h $(BASHINCDIR)/memalloc.h ---- 362,366 ---- - evalstring.o: $(topdir)/flags.h $(topdir)/input.h $(topdir)/execute_cmd.h - evalstring.o: $(topdir)/bashhist.h $(srcdir)/common.h -! evalstring.o: $(topdir)/trap.h $(topdir)/redir.h ../pathnames.h ./builtext.h - #evalstring.o: $(topdir)/y.tab.h - getopt.o: ../config.h $(BASHINCDIR)/memalloc.h - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 1,5 **** - /* patchlevel.h -- current bash patch level */ - -! /* Copyright (C) 2001-2016 Free Software Foundation, Inc. - - This file is part of GNU Bash, the Bourne Again SHell. ---- 1,5 ---- - /* patchlevel.h -- current bash patch level */ - -! /* Copyright (C) 2001-2020 Free Software Foundation, Inc. - - This file is part of GNU Bash, the Bourne Again SHell. -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 0 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 1 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-002 b/src/patches/bash/bash51-002 deleted file mode 100644 index 8c991649a..000000000 --- a/src/patches/bash/bash51-002 +++ /dev/null @@ -1,57 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-002 - -Bug-Reported-by: oguzismailuysal(a)gmail.com -Bug-Reference-ID: <CAH7i3LoHFUa4aSF5-AD2r80HG-p-YzD_9ZxomarZkhP8NMq63g(a)mail.gmail.com> -Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2020-12/msg00037.html - -Bug-Description: - -If there are no jobs, and the `-n' and `-p' options are both supplied to -`wait', bash can assign a value to the variable name specified with `-p' -instead of leaving it unset. - -Patch (apply with `patch -p0'): - -*** ../bash-5.1-patched/builtins/wait.def 2020-04-09 15:13:57.000000000 -0400 ---- builtins/wait.def 2020-12-11 09:46:49.000000000 -0500 -*************** -*** 214,222 **** - - status = wait_for_any_job (wflags, &pstat); -- if (status < 0) -- status = 127; -- - if (vname && status >= 0) - bind_var_to_int (vname, pstat.pid); - if (list) - unset_waitlist (); ---- 214,222 ---- - - status = wait_for_any_job (wflags, &pstat); - if (vname && status >= 0) - bind_var_to_int (vname, pstat.pid); -+ -+ if (status < 0) -+ status = 127; - if (list) - unset_waitlist (); - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 1 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 2 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-003 b/src/patches/bash/bash51-003 deleted file mode 100644 index 68e5dce6a..000000000 --- a/src/patches/bash/bash51-003 +++ /dev/null @@ -1,53 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-003 - -Bug-Reported-by: oguzismailuysal(a)gmail.com -Bug-Reference-ID: <CAH7i3LpG91BnNcDtaTUm2Ph7a+PnJkuh6nAc87cVL7_38tOaMQ(a)mail.gmail.com> -Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2020-12/msg00050.html - -Bug-Description: - -Bash does not put a command substitution process that is started to perform an -expansion in a child process into the right process group where it can receive -keyboard-generated signals. - -Patch (apply with `patch -p0'): - -*** ../bash-5.1-patched/subst.c 2020-11-16 10:33:15.000000000 -0500 ---- subst.c 2020-12-12 13:50:11.000000000 -0500 -*************** -*** 6357,6362 **** - #if defined (JOB_CONTROL) - old_pipeline_pgrp = pipeline_pgrp; -! /* Don't reset the pipeline pgrp if we're already a subshell in a pipeline. */ -! if ((subshell_environment & SUBSHELL_PIPE) == 0) - pipeline_pgrp = shell_pgrp; - cleanup_the_pipeline (); ---- 6357,6364 ---- - #if defined (JOB_CONTROL) - old_pipeline_pgrp = pipeline_pgrp; -! /* Don't reset the pipeline pgrp if we're already a subshell in a pipeline or -! we've already forked to run a disk command (and are expanding redirections, -! for example). */ -! if ((subshell_environment & (SUBSHELL_FORK|SUBSHELL_PIPE)) == 0) - pipeline_pgrp = shell_pgrp; - cleanup_the_pipeline (); - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 2 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 3 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-004 b/src/patches/bash/bash51-004 deleted file mode 100644 index 39a6c647f..000000000 --- a/src/patches/bash/bash51-004 +++ /dev/null @@ -1,126 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-004 - -Bug-Reported-by: oguzismailuysal(a)gmail.com -Bug-Reference-ID: <CAH7i3LoHGmwaghDpCWRUfcY04gQmeDTH3RiG=bf2b=KbU=gyhw(a)mail.gmail.com> -Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2020-12/msg00039.html - -Bug-Description: - -If a key-value compound array assignment to an associative array is supplied -as an assignment statement argument to the `declare' command that declares the -array, the assignment doesn't perform the correct word expansions. - -This patch makes key-value assignment and subscript assignment perform the -same expansions when they're supplied as an argument to `declare'. - -Patch (apply with `patch -p0'): - -*** ../bash-5.1-patched/arrayfunc.c 2020-10-09 11:38:58.000000000 -0400 ---- arrayfunc.c 2020-12-11 15:12:22.000000000 -0500 -*************** -*** 598,601 **** ---- 598,622 ---- - } - } -+ -+ /* Return non-zero if L appears to be a key-value pair associative array -+ compound assignment. */ -+ int -+ kvpair_assignment_p (l) -+ WORD_LIST *l; -+ { -+ return (l && (l->word->flags & W_ASSIGNMENT) == 0 && l->word->word[0] != '['); /*]*/ -+ } -+ -+ char * -+ expand_and_quote_kvpair_word (w) -+ char *w; -+ { -+ char *t, *r; -+ -+ t = w ? expand_assignment_string_to_string (w, 0) : 0; -+ r = sh_single_quote (t ? t : ""); -+ free (t); -+ return r; -+ } - #endif - -*************** -*** 641,645 **** - - #if ASSOC_KVPAIR_ASSIGNMENT -! if (assoc_p (var) && nlist && (nlist->word->flags & W_ASSIGNMENT) == 0 && nlist->word->word[0] != '[') /*]*/ - { - iflags = flags & ~ASS_APPEND; ---- 662,666 ---- - - #if ASSOC_KVPAIR_ASSIGNMENT -! if (assoc_p (var) && kvpair_assignment_p (nlist)) - { - iflags = flags & ~ASS_APPEND; -*** ../bash-5.1-patched/arrayfunc.h 2020-04-29 17:24:15.000000000 -0400 ---- arrayfunc.h 2020-12-11 14:23:50.000000000 -0500 -*************** -*** 68,71 **** ---- 68,74 ---- - extern void quote_compound_array_list PARAMS((WORD_LIST *, int)); - -+ extern int kvpair_assignment_p PARAMS((WORD_LIST *)); -+ extern char *expand_and_quote_kvpair_word PARAMS((char *)); -+ - extern int unbind_array_element PARAMS((SHELL_VAR *, char *, int)); - extern int skipsubscript PARAMS((const char *, int, int)); -*** ../bash-5.1-patched/subst.c 2020-11-16 10:33:15.000000000 -0500 ---- subst.c 2020-12-11 15:11:10.000000000 -0500 -*************** -*** 11605,11608 **** ---- 11605,11609 ---- - WORD_LIST *l, *nl; - char *t; -+ int kvpair; - - if (flags == 0) -*************** -*** 11619,11622 **** ---- 11620,11627 ---- - /* Associative array */ - l = parse_string_to_word_list (value, 1, "array assign"); -+ #if ASSOC_KVPAIR_ASSIGNMENT -+ kvpair = kvpair_assignment_p (l); -+ #endif -+ - /* For associative arrays, with their arbitrary subscripts, we have to - expand and quote in one step so we don't have to search for the -*************** -*** 11624,11627 **** ---- 11629,11638 ---- - for (nl = l; nl; nl = nl->next) - { -+ #if ASSOC_KVPAIR_ASSIGNMENT -+ if (kvpair) -+ /* keys and values undergo the same set of expansions */ -+ t = expand_and_quote_kvpair_word (nl->word->word); -+ else -+ #endif - if ((nl->word->flags & W_ASSIGNMENT) == 0) - t = sh_single_quote (nl->word->word ? nl->word->word : ""); - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 3 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 4 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-009 b/src/patches/bash/bash51-009 new file mode 100644 index 000000000..2796c3b9b --- /dev/null +++ b/src/patches/bash/bash51-009 @@ -0,0 +1,59 @@ + BASH PATCH REPORT + ================= + +Bash-Release: 5.1 +Patch-ID: bash51-009 + +Bug-Reported-by: Julien Moutinho <julm+bash(a)sourcephile.fr> +Bug-Reference-ID: <20211004035906.5kiobuzkpeckmvwg(a)sourcephile.fr> +Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2021-10/msg00022.html + +Bug-Description: + +The bash malloc implementation of malloc_usable_size() does not follow the +specification. This can cause library functions that use it to overwrite +memory bounds checking. + +Patch (apply with `patch -p0'): + +*** ../bash-5.1-patched/lib/malloc/malloc.c 2020-07-08 10:19:30.000000000 -0400 +--- lib/malloc/malloc.c 2021-10-05 16:10:55.000000000 -0400 +*************** +*** 1287,1297 **** + } + +! /* XXX - should we return 0 if ISFREE? */ +! maxbytes = binsize(p->mh_index); +! +! /* So the usable size is the maximum number of bytes in the bin less the +! malloc overhead */ +! maxbytes -= MOVERHEAD + MSLOP; +! return (maxbytes); + } + +--- 1358,1367 ---- + } + +! /* return 0 if ISFREE */ +! if (p->mh_alloc == ISFREE) +! return 0; +! +! /* Since we use bounds checking, the usable size is the last requested size. */ +! return (p->mh_nbytes); + } + +*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 +--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 +*************** +*** 26,30 **** + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 8 + + #endif /* _PATCHLEVEL_H_ */ +--- 26,30 ---- + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 9 + + #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-010 b/src/patches/bash/bash51-010 new file mode 100644 index 000000000..cfe6fa46b --- /dev/null +++ b/src/patches/bash/bash51-010 @@ -0,0 +1,59 @@ + BASH PATCH REPORT + ================= + +Bash-Release: 5.1 +Patch-ID: bash51-010 + +Bug-Reported-by: Jonas Alfredsson <jonas.alfredsson(a)protonmail.com> +Bug-Reference-ID: <LjAfZaEuZncr2RaqhSSfcaiXdkuK6kdEYxshP3LApXbgMVQzggMGyWHO9knVkXicW2fP-ibsipJ_GZ-YaJRm96Rsozf6PgFmPsljRCtflls=(a)protonmail.com> +Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2021-05/msg00059.html + +Bug-Description: + +If `wait -n' is interrupted by a trapped signal other than SIGINT, it does +not completely clean up state, and that can prevent subsequent calls to +`wait -n' from working correctly. + +Patch (apply with `patch -p0'): + +*** ../bash-5.1-patched/builtins/wait.def 2020-12-16 17:13:12.000000000 -0500 +--- builtins/wait.def 2021-11-17 10:25:15.000000000 -0500 +*************** +*** 112,116 **** + WORD_LIST *list; + { +! int status, code, opt, nflag, wflags; + char *vname; + SHELL_VAR *pidvar; +--- 112,117 ---- + WORD_LIST *list; + { +! int status, code, opt, nflag; +! volatile int wflags; + char *vname; + SHELL_VAR *pidvar; +*************** +*** 181,184 **** +--- 188,193 ---- + status = 128 + wait_signal_received; + wait_sigint_cleanup (); ++ if (wflags & JWAIT_WAITING) ++ unset_waitlist (); + WAIT_RETURN (status); + } + +*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 +--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 +*************** +*** 26,30 **** + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 9 + + #endif /* _PATCHLEVEL_H_ */ +--- 26,30 ---- + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 10 + + #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-011 b/src/patches/bash/bash51-011 new file mode 100644 index 000000000..655c7ec8b --- /dev/null +++ b/src/patches/bash/bash51-011 @@ -0,0 +1,81 @@ + BASH PATCH REPORT + ================= + +Bash-Release: 5.1 +Patch-ID: bash51-011 + +Bug-Reported-by: Alex fxmbsw7 Ratchev <fxmbsw7(a)gmail.com> +Bug-Reference-ID: <CAALKErFrm+yuwy=ioK+RmjCiwxTDmzeMFWqLF2BEWYtkGS5UFQ(a)mail.gmail.com> +Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2020-11/msg00064.html + +Bug-Description: + +When reading a compound assignment, and running it through the parser to +split it into words, we need to save and restore any alias we're currently +expanding. + +Patch (apply with `patch -p0'): + +*** ../bash-5.1-patched/parse.y 2020-11-28 12:10:06.000000000 -0500 +--- parse.y 2021-10-13 11:04:27.000000000 -0400 +*************** +*** 6494,6501 **** + + push_stream (1); +- #if 0 /* TAG: bash-5.2 Alex fxmbsw7 Ratchev <fxmbsw7(a)gmail.com> 11/17/2020 */ + if (ea = expanding_alias ()) + parser_save_alias (); +- #endif + last_read_token = WORD; /* WORD to allow reserved words here */ + current_command_line_count = 0; +--- 6494,6499 ---- +*************** +*** 6532,6539 **** + pop_stream (); + +- #if 0 /* TAG: bash-5.2 */ + if (ea) + parser_restore_alias (); +- #endif + + #if defined (HISTORY) +--- 6530,6535 ---- +*** ../bash-5.1-patched/y.tab.c 2020-11-28 12:17:19.000000000 -0500 +--- y.tab.c 2021-11-17 10:47:35.000000000 -0500 +*************** +*** 8788,8795 **** + + push_stream (1); +- #if 0 /* TAG: bash-5.2 Alex fxmbsw7 Ratchev <fxmbsw7(a)gmail.com> 11/17/2020 */ + if (ea = expanding_alias ()) + parser_save_alias (); +- #endif + last_read_token = WORD; /* WORD to allow reserved words here */ + current_command_line_count = 0; +--- 8777,8782 ---- +*************** +*** 8826,8833 **** + pop_stream (); + +- #if 0 /* TAG: bash-5.2 */ + if (ea) + parser_restore_alias (); +- #endif + + #if defined (HISTORY) +--- 8813,8818 ---- +*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 +--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 +*************** +*** 26,30 **** + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 10 + + #endif /* _PATCHLEVEL_H_ */ +--- 26,30 ---- + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 11 + + #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-012 b/src/patches/bash/bash51-012 new file mode 100644 index 000000000..222491884 --- /dev/null +++ b/src/patches/bash/bash51-012 @@ -0,0 +1,198 @@ + BASH PATCH REPORT + ================= + +Bash-Release: 5.1 +Patch-ID: bash51-012 + +Bug-Reported-by: Nikolay Borisov <nborisov(a)suse.com> +Bug-Reference-ID: <1a715205-06ce-413b-c1c0-2f5639ce06c0(a)suse.com> +Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2020-11/msg00091.html + +Bug-Description: + +There is a possible race condition that arises when a child process receives +a signal trapped by the parent before it can reset the signal dispositions. +The child process is not supposed to trap the signal in this circumstance. + +Patch (apply with `patch -p0'): + +*** ../bash-20201118/command.h 2020-08-14 15:04:39.000000000 -0400 +--- command.h 2020-11-27 15:18:02.000000000 -0500 +*************** +*** 125,128 **** +--- 125,129 ---- + #define SUBSHELL_COPROC 0x40 /* subshell from a coproc pipeline */ + #define SUBSHELL_RESETTRAP 0x80 /* subshell needs to reset trap strings on first call to trap */ ++ #define SUBSHELL_IGNTRAP 0x100 /* subshell should reset trapped signals from trap_handler */ + + /* A structure which represents a word. */ + +*** ../bash-20201118/execute_cmd.c 2020-11-23 14:16:48.000000000 -0500 +--- execute_cmd.c 2020-11-27 16:43:25.000000000 -0500 +*************** +*** 1548,1551 **** +--- 1548,1554 ---- + reset_signal_handlers (); + subshell_environment |= SUBSHELL_RESETTRAP; ++ /* Note that signal handlers have been reset, so we should no longer ++ reset the handler and resend trapped signals to ourselves. */ ++ subshell_environment &= ~SUBSHELL_IGNTRAP; + + /* We are in a subshell, so forget that we are running a trap handler or +*************** +*** 4321,4325 **** + cmdflags |= CMD_NO_FORK; + +! subshell_environment = SUBSHELL_FORK; /* XXX */ + if (pipe_in != NO_PIPE || pipe_out != NO_PIPE) + subshell_environment |= SUBSHELL_PIPE; +--- 4324,4329 ---- + cmdflags |= CMD_NO_FORK; + +! /* We redo some of what make_child() does with SUBSHELL_IGNTRAP */ +! subshell_environment = SUBSHELL_FORK|SUBSHELL_IGNTRAP; /* XXX */ + if (pipe_in != NO_PIPE || pipe_out != NO_PIPE) + subshell_environment |= SUBSHELL_PIPE; +*************** +*** 4575,4578 **** +--- 4580,4584 ---- + reset_signal_handlers (); + subshell_environment |= SUBSHELL_RESETTRAP; ++ subshell_environment &= ~SUBSHELL_IGNTRAP; + + if (async) +*************** +*** 5515,5518 **** +--- 5521,5525 ---- + /* Cancel traps, in trap.c. */ + restore_original_signals (); ++ subshell_environment &= ~SUBSHELL_IGNTRAP; + + #if defined (JOB_CONTROL) + +*** ../bash-20201118/jobs.c 2020-08-04 10:17:39.000000000 -0400 +--- jobs.c 2020-11-27 16:39:56.000000000 -0500 +*************** +*** 2218,2221 **** +--- 2218,2223 ---- + pid_t mypid; + ++ subshell_environment |= SUBSHELL_IGNTRAP; ++ + /* If this ends up being changed to modify or use `command' in the + child process, go back and change callers who free `command' in +diff -rC 2 ../bash-20201118/nojobs.c nojobs.c +*** ../bash-20201118/nojobs.c 2020-07-08 10:11:25.000000000 -0400 +--- nojobs.c 2020-11-27 16:38:36.000000000 -0500 +*************** +*** 576,579 **** +--- 576,581 ---- + #endif + ++ subshell_environment |= SUBSHELL_IGNTRAP; ++ + default_tty_job_signals (); + } + +*** ../bash-20201118/sig.c 2020-11-23 13:22:17.000000000 -0500 +--- sig.c 2020-11-28 10:21:43.000000000 -0500 +*************** +*** 56,60 **** + #endif + +! extern void initialize_siglist (); + + #if !defined (JOB_CONTROL) +--- 56,61 ---- + #endif + +! extern void initialize_siglist PARAMS((void)); +! extern void set_original_signal PARAMS((int, SigHandler *)); + + #if !defined (JOB_CONTROL) +*************** +*** 256,259 **** +--- 257,267 ---- + XHANDLER(i) = oact.sa_handler; + XSAFLAGS(i) = oact.sa_flags; ++ ++ #if 0 ++ set_original_signal (XSIG(i), XHANDLER(i)); /* optimization */ ++ #else ++ set_original_signal (XSIG(i), act.sa_handler); /* optimization */ ++ #endif ++ + /* Don't do anything with signals that are ignored at shell entry + if the shell is not interactive. */ + +*** ../bash-20201118/subst.c 2020-11-16 10:33:15.000000000 -0500 +--- subst.c 2020-11-27 16:07:00.000000000 -0500 +*************** +*** 5952,5955 **** +--- 5952,5956 ---- + /* Cancel traps, in trap.c. */ + restore_original_signals (); /* XXX - what about special builtins? bash-4.2 */ ++ subshell_environment &= ~SUBSHELL_IGNTRAP; + QUIT; /* catch any interrupts we got post-fork */ + setup_async_signals (); +*************** +*** 6383,6386 **** +--- 6384,6388 ---- + QUIT; /* catch any interrupts we got post-fork */ + subshell_environment |= SUBSHELL_RESETTRAP; ++ subshell_environment &= ~SUBSHELL_IGNTRAP; + } + + +diff -rC 2 ../bash-20201118/trap.c trap.c +*** ../bash-20201118/trap.c 2020-11-28 12:04:07.000000000 -0500 +--- trap.c 2020-11-28 10:22:10.000000000 -0500 +*************** +*** 482,485 **** +--- 482,511 ---- + } + ++ /* This means we're in a subshell, but have not yet reset the handler for ++ trapped signals. We're not supposed to execute the trap in this situation; ++ we should restore the original signal and resend the signal to ourselves ++ to preserve the Posix "signal traps that are not being ignored shall be ++ set to the default action" semantics. */ ++ if ((subshell_environment & SUBSHELL_IGNTRAP) && trap_list[sig] != (char *)IGNORE_SIG) ++ { ++ sigset_t mask; ++ ++ /* Paranoia */ ++ if (original_signals[sig] == IMPOSSIBLE_TRAP_HANDLER) ++ original_signals[sig] = SIG_DFL; ++ ++ restore_signal (sig); ++ ++ /* Make sure we let the signal we just caught through */ ++ sigemptyset (&mask); ++ sigprocmask (SIG_SETMASK, (sigset_t *)NULL, &mask); ++ sigdelset (&mask, sig); ++ sigprocmask (SIG_SETMASK, &mask, (sigset_t *)NULL); ++ ++ kill (getpid (), sig); ++ ++ SIGRETURN (0); ++ } ++ + if ((sig >= NSIG) || + (trap_list[sig] == (char *)DEFAULT_SIG) || + +*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 +--- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 +*************** +*** 26,30 **** + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 11 + + #endif /* _PATCHLEVEL_H_ */ +--- 26,30 ---- + looks for to find the patch level (for the sccs version string). */ + +! #define PATCHLEVEL 12 + + #endif /* _PATCHLEVEL_H_ */ -- 2.34.1

3 4

[PATCH] findutils: Create /var/lib/locale
by Michael Tremer 09 Dec '21

09 Dec '21

This is required for updatedb to store its data. Fixes: #12670 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/rootfiles/common/aarch64/stage2 | 1 - config/rootfiles/common/armv6l/stage2 | 1 - config/rootfiles/common/findutils | 1 + config/rootfiles/common/i586/stage2 | 1 - config/rootfiles/common/x86_64/stage2 | 1 - lfs/stage2 | 2 +- 6 files changed, 2 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/aarch64/stage2 b/config/rootfiles/common/aarch64/stage2 index 59d85aabc..521c815c0 100644 --- a/config/rootfiles/common/aarch64/stage2 +++ b/config/rootfiles/common/aarch64/stage2 @@ -157,7 +157,6 @@ usr/share/doc/licenses/GPLv3 #var/cache var/empty #var/lib -#var/lib/locate #var/lib/misc #var/local var/lock diff --git a/config/rootfiles/common/armv6l/stage2 b/config/rootfiles/common/armv6l/stage2 index 0645bb37d..5989bc9a9 100644 --- a/config/rootfiles/common/armv6l/stage2 +++ b/config/rootfiles/common/armv6l/stage2 @@ -156,7 +156,6 @@ usr/share/doc/licenses/GPLv3 #var/cache var/empty #var/lib -#var/lib/locate #var/lib/misc #var/local var/lock diff --git a/config/rootfiles/common/findutils b/config/rootfiles/common/findutils index d9f9ad0b6..4f71f1600 100644 --- a/config/rootfiles/common/findutils +++ b/config/rootfiles/common/findutils @@ -15,3 +15,4 @@ usr/lib/findutils/frcode #usr/share/man/man1/updatedb.1 #usr/share/man/man1/xargs.1 #usr/share/man/man5/locatedb.5 +var/lib/locate diff --git a/config/rootfiles/common/i586/stage2 b/config/rootfiles/common/i586/stage2 index 9d73bf9c3..2c9fef709 100644 --- a/config/rootfiles/common/i586/stage2 +++ b/config/rootfiles/common/i586/stage2 @@ -156,7 +156,6 @@ usr/share/doc/licenses/GPLv3 #var/cache var/empty #var/lib -#var/lib/locate #var/lib/misc #var/local var/lock diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2 index d0f013b1a..0d613f76a 100644 --- a/config/rootfiles/common/x86_64/stage2 +++ b/config/rootfiles/common/x86_64/stage2 @@ -157,7 +157,6 @@ usr/share/doc/licenses/GPLv3 #var/cache var/empty #var/lib -#var/lib/locate #var/lib/misc #var/local var/lock diff --git a/lfs/stage2 b/lfs/stage2 index 9032b013e..daa98765e 100644 --- a/lfs/stage2 +++ b/lfs/stage2 @@ -132,7 +132,7 @@ endif # Create /var dirs and files -mkdir -v /var/{lock,log,mail,spool,empty} - -mkdir -pv /var/{opt,cache,lib/{misc,locate},local} + -mkdir -pv /var/{opt,cache,lib/{misc},local} -mkdir -pv /var/log/{counter,calamaris} chown nobody.nobody /var/log/calamaris touch /var/log/{btmp,lastlog,wtmp} -- 2.30.2

2 2

[PATCH 1/3] suricata: Update config file.
by Stefan Schantl 09 Dec '21

09 Dec '21

* This will enable swf decompression. * Enable modbus parser. * Enable dnp3 parser. * Enable enip parser. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/suricata/suricata.yaml | 84 +++++++++++++++++++++++++++++++++++ 1 file changed, 84 insertions(+) diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index 0ad36e705..49921db86 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -525,6 +525,20 @@ app-layer: # auto will use http-body-inline mode in IPS mode, yes or no set it statically http-body-inline: auto + # Decompress SWF files. + # 2 types: 'deflate', 'lzma', 'both' will decompress deflate and lzma + # compress-depth: + # Specifies the maximum amount of data to decompress, + # set 0 for unlimited. + # decompress-depth: + # Specifies the maximum amount of decompressed data to obtain, + # set 0 for unlimited. + swf-decompression: + enabled: yes + type: both + compress-depth: 0 + decompress-depth: 0 + # Take a random value for inspection sizes around the specified value. # This lower the risk of some evasion technics but could lead # detection change between runs. It is set to 'yes' by default. @@ -539,6 +553,76 @@ app-layer: double-decode-path: no double-decode-query: no + # Can disable LZMA decompression + #lzma-enabled: yes + # Memory limit usage for LZMA decompression dictionary + # Data is decompressed until dictionary reaches this size + #lzma-memlimit: 1mb + # Maximum decompressed size with a compression ratio + # above 2048 (only LZMA can reach this ratio, deflate cannot) + #compression-bomb-limit: 1mb + # Maximum time spent decompressing a single transaction in usec + #decompression-time-limit: 100000 + + server-config: + + #- apache: + # address: [192.168.1.0/24, 127.0.0.0/8, "::1"] + # personality: Apache_2 + # # Can be specified in kb, mb, gb. Just a number indicates + # # it's in bytes. + # request-body-limit: 4096 + # response-body-limit: 4096 + # double-decode-path: no + # double-decode-query: no + + #- iis7: + # address: + # - 192.168.0.0/24 + # - 192.168.10.0/24 + # personality: IIS_7_0 + # # Can be specified in kb, mb, gb. Just a number indicates + # # it's in bytes. + # request-body-limit: 4096 + # response-body-limit: 4096 + # double-decode-path: no + # double-decode-query: no + + # Note: Modbus probe parser is minimalist due to the poor significant field + # Only Modbus message length (greater than Modbus header length) + # And Protocol ID (equal to 0) are checked in probing parser + # It is important to enable detection port and define Modbus port + # to avoid false positive + modbus: + # How many unreplied Modbus requests are considered a flood. + # If the limit is reached, app-layer-event:modbus.flooded; will match. + #request-flood: 500 + + enabled: yes + detection-ports: + dp: 502 + # According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it + # is recommended to keep the TCP connection opened with a remote device + # and not to open and close it for each MODBUS/TCP transaction. In that + # case, it is important to set the depth of the stream reassembling as + # unlimited (stream.reassembly.depth: 0) + + # Stream reassembly size for modbus. By default track it completely. + stream-depth: 0 + + # DNP3 + dnp3: + enabled: yes + detection-ports: + dp: 20000 + + # SCADA EtherNet/IP and CIP protocol support + enip: + enabled: yes + detection-ports: + dp: 44818 + sp: 44818 + ntp: enabled: yes dhcp: -- 2.30.2

3 9

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development December 2021