suricata: 'Downdate' to 5.0.5

  Triggered by https://lists.ipfire.org/pipermail/development/2020-December/008868.html

Workaround for https://bugzilla.ipfire.org/show_bug.cgi?id=12548

Downgrading to 'suricata 5.0.5' bypasses Bug #12548 for now,
but its only a temporary workaround...

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
---
 lfs/suricata | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
  

Hi,

Thank you for submitting this patch.

I am not sure if I want to merge this, yet.

I will consider this when we move closer to a release, but upstream didn’t provide a solution, yet.

I suppose it is okay if we burn through a little bit more of CPU as long as the system is secure. The overhead seems to be small enough for me to not cause any significant impact on throughput or latency.

Is this an acceptable benchmark for you?

Best,
-Michael

> On 12 Dec 2020, at 10:14, Matthias Fischer <matthias.fischer@ipfire.org> wrote:
> 
> Triggered by https://lists.ipfire.org/pipermail/development/2020-December/008868.html
> 
> Workaround for https://bugzilla.ipfire.org/show_bug.cgi?id=12548
> 
> Downgrading to 'suricata 5.0.5' bypasses Bug #12548 for now,
> but its only a temporary workaround...
> 
> Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
> ---
> lfs/suricata | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/lfs/suricata b/lfs/suricata
> index 2871d8e7b..c5dc46af4 100644
> --- a/lfs/suricata
> +++ b/lfs/suricata
> @@ -24,7 +24,7 @@
> 
> include Config
> 
> -VER        = 6.0.0
> +VER        = 5.0.5
> 
> THISAPP    = suricata-$(VER)
> DL_FILE    = $(THISAPP).tar.gz
> @@ -44,7 +44,7 @@ objects = $(DL_FILE)
> 
> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
> 
> -$(DL_FILE)_MD5 = bbddcf2f209930206ef21977d40120d2
> +$(DL_FILE)_MD5 = fe039cc4571eb56828874ddc0b71dc51
> 
> install : $(TARGET)
> 
> -- 
> 2.18.0
>
  

On 14.12.2020 10:33, Michael Tremer wrote:
> Hi,

Hi,

> Thank you for submitting this patch.
> 
> I am not sure if I want to merge this, yet.

Yep.

Looking at the changelogs I would prefer 6.0.1, but I just wanted to
have an alternative ready in case it was needed.

> I will consider this when we move closer to a release, but upstream didn’t provide a solution, yet.
> 
> I suppose it is okay if we burn through a little bit more of CPU as long as the system is secure. The overhead seems to be small enough for me to not cause any significant impact on throughput or latency.
> 
> Is this an acceptable benchmark for you?

For me: yes. No problem. ;-)

Best,
Matthias

> Best,
> -Michael
> 
>> On 12 Dec 2020, at 10:14, Matthias Fischer <matthias.fischer@ipfire.org> wrote:
>> 
>> Triggered by https://lists.ipfire.org/pipermail/development/2020-December/008868.html
>> 
>> Workaround for https://bugzilla.ipfire.org/show_bug.cgi?id=12548
>> 
>> Downgrading to 'suricata 5.0.5' bypasses Bug #12548 for now,
>> but its only a temporary workaround...
>> 
>> Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
>> ---
>> lfs/suricata | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>> 
>> diff --git a/lfs/suricata b/lfs/suricata
>> index 2871d8e7b..c5dc46af4 100644
>> --- a/lfs/suricata
>> +++ b/lfs/suricata
>> @@ -24,7 +24,7 @@
>> 
>> include Config
>> 
>> -VER        = 6.0.0
>> +VER        = 5.0.5
>> 
>> THISAPP    = suricata-$(VER)
>> DL_FILE    = $(THISAPP).tar.gz
>> @@ -44,7 +44,7 @@ objects = $(DL_FILE)
>> 
>> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
>> 
>> -$(DL_FILE)_MD5 = bbddcf2f209930206ef21977d40120d2
>> +$(DL_FILE)_MD5 = fe039cc4571eb56828874ddc0b71dc51
>> 
>> install : $(TARGET)
>> 
>> -- 
>> 2.18.0
>> 
>
  

Hi,

I am now convinced that the impact is bad enough that we will need to revert.

I would like to be able to release c153 before Christmas and I am not sure if upstream will be able to provide a hotfix.

-Michael

> On 14 Dec 2020, at 21:02, Matthias Fischer <matthias.fischer@ipfire.org> wrote:
> 
> On 14.12.2020 10:33, Michael Tremer wrote:
>> Hi,
> 
> Hi,
> 
>> Thank you for submitting this patch.
>> 
>> I am not sure if I want to merge this, yet.
> 
> Yep.
> 
> Looking at the changelogs I would prefer 6.0.1, but I just wanted to
> have an alternative ready in case it was needed.
> 
>> I will consider this when we move closer to a release, but upstream didn’t provide a solution, yet.
>> 
>> I suppose it is okay if we burn through a little bit more of CPU as long as the system is secure. The overhead seems to be small enough for me to not cause any significant impact on throughput or latency.
>> 
>> Is this an acceptable benchmark for you?
> 
> For me: yes. No problem. ;-)
> 
> Best,
> Matthias
> 
>> Best,
>> -Michael
>> 
>>> On 12 Dec 2020, at 10:14, Matthias Fischer <matthias.fischer@ipfire.org> wrote:
>>> 
>>> Triggered by https://lists.ipfire.org/pipermail/development/2020-December/008868.html
>>> 
>>> Workaround for https://bugzilla.ipfire.org/show_bug.cgi?id=12548
>>> 
>>> Downgrading to 'suricata 5.0.5' bypasses Bug #12548 for now,
>>> but its only a temporary workaround...
>>> 
>>> Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
>>> ---
>>> lfs/suricata | 4 ++--
>>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>> 
>>> diff --git a/lfs/suricata b/lfs/suricata
>>> index 2871d8e7b..c5dc46af4 100644
>>> --- a/lfs/suricata
>>> +++ b/lfs/suricata
>>> @@ -24,7 +24,7 @@
>>> 
>>> include Config
>>> 
>>> -VER        = 6.0.0
>>> +VER        = 5.0.5
>>> 
>>> THISAPP    = suricata-$(VER)
>>> DL_FILE    = $(THISAPP).tar.gz
>>> @@ -44,7 +44,7 @@ objects = $(DL_FILE)
>>> 
>>> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
>>> 
>>> -$(DL_FILE)_MD5 = bbddcf2f209930206ef21977d40120d2
>>> +$(DL_FILE)_MD5 = fe039cc4571eb56828874ddc0b71dc51
>>> 
>>> install : $(TARGET)
>>> 
>>> -- 
>>> 2.18.0
>>> 
>> 
>