From patchwork Fri Apr 22 08:21:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthias Fischer X-Patchwork-Id: 5529 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4Kl6nz225cz3xG6 for ; Fri, 22 Apr 2022 08:21:59 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4Kl6nv16Y8z4JP; Fri, 22 Apr 2022 08:21:55 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4Kl6nt71tLz2xy1; Fri, 22 Apr 2022 08:21:54 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4Kl6ns5L1lz2xSn for ; Fri, 22 Apr 2022 08:21:53 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4Kl6ns2HGSz17w for ; Fri, 22 Apr 2022 08:21:53 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1650615713; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=xqHUh8xvAJ4OLEKCF5bgGdY54NlfMaYH1y1a+LV2s5o=; b=Mu31foLVs502V0Vjh4GgstPQPhSiCnScmAstXYOuIzyMRTjSvvn+fAn7rmjBwWwbkzAYdT TVk6r952uMcYCbAQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1650615713; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=xqHUh8xvAJ4OLEKCF5bgGdY54NlfMaYH1y1a+LV2s5o=; b=SX5e3UPSDsoiMneu7fnrP787ZzM7PVHGtTKAAbiJccNAJTQiHdx4FMYm2VRaToO1Z/vdI9 xgEChdwe4JOYbuIRiU+QVl+QAocR1N2+56uoTCg6ebQH3UCs5oSH6DWVKtlKnMPyxTFyTz DgAh/EwyOfd0/bG31HpRVeu+H8Oo6n3ypnn/N0SqKXzmm96tpo5BwewIC56nE/LpfJAif4 Yszbnbq9npA8ejAvXBIh13o/UqQGqeWhVInl8KTDGteLWW35sWiWP1AhXUzEBtKCIioS4N 7BZSMfaOOo6RD6IfvJM8dB3HRYH/gS1yroB0tmwSsqaupyC9JVY5iN23WNDfbg== From: Matthias Fischer To: development@lists.ipfire.org Subject: [PATCH 1/2] libhtp: Update to 0.5.40 - needed for 'suricata' Date: Fri, 22 Apr 2022 10:21:47 +0200 Message-Id: <20220422082148.22197-1-matthias.fischer@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" For details see: https://github.com/OISF/libhtp/releases/tag/0.5.40 "uri: optionally allows spaces in uri ints: integer handling improvements headers: continue on nul byte headers: consistent trailing space handling list: fix integer overflow util: remove unused htp_utf8_decode fix 100-continue with CL 0 lzma: don't do unnecessary realloc" Signed-off-by: Matthias Fischer Reviewed-by: Adolf Belka --- lfs/libhtp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/libhtp b/lfs/libhtp index 3dad9955b..ffc82f8cd 100644 --- a/lfs/libhtp +++ b/lfs/libhtp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team # +# Copyright (C) 2007-2022 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.5.39 +VER = 0.5.40 THISAPP = libhtp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = fec9e2b0dd867becde972e9e2bf572a21d90acc747a8ee8338e2fe68240d690706db01b12c3cf8c6bf1b5d4415da4e4a5bf92a056e1dff96f54a9ac569906712 +$(DL_FILE)_BLAKE2 = 37239d8d0afb6841c54bab1669a17ec7336b10998f8835ef91cf9556dd7449991ce6fb04a408d16b431ba6327b32f6f509a79a4c79ffc6e88e555fcf2e9f2cce install : $(TARGET) From patchwork Fri Apr 22 08:21:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthias Fischer X-Patchwork-Id: 5530 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4Kl6nz29Lzz3xgY for ; Fri, 22 Apr 2022 08:21:59 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4Kl6nv2RMMz5bq; Fri, 22 Apr 2022 08:21:55 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4Kl6nv0fpDz2yvw; Fri, 22 Apr 2022 08:21:55 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4Kl6ns60QNz2xbv for ; Fri, 22 Apr 2022 08:21:53 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4Kl6ns4jFTz4JP for ; Fri, 22 Apr 2022 08:21:53 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1650615713; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AT3quwIpAPwuwqL+VDMI/c5oWoW10D6MmN/Up/KX2ig=; b=Uqlq6MqrAh67v5/WJnw+RS0VDP2Lf+G+Kgb8wDtHoVR4eh+sYzsDwVVMTKLedLxlq7/2VL WFzJA1iteEqKSGDg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1650615713; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AT3quwIpAPwuwqL+VDMI/c5oWoW10D6MmN/Up/KX2ig=; b=G1/e1jLDdfCwLrBgP+EG6jRCLMA/18m7UCXWy7+50aP4+OT/77+/5yonFVh+f0943Ea4u0 QsckyH1VxuTDH8qBD2KbymOJQPDVfmb2bOpAE8Kjhbclc50pvkXQGONY0vo3JFe+h+F54R VODynkET7AP1Sy8Z7nOEiEVCIiKBpkznavhzprtg19J9T5xV/kNh7CmPDzSXAMtQ0ghCBq FzhPS7R1vspmsRITlZqKbFTvNQXpsaXsKLWf6iM9tDIagbd4UxJCInbkhBd6rhccb4X4bK 2lD+rUoTjGP7cbjtfFHMnbg9FAx6dvLwPPJa7v7liaKAwr8n1MFPKA85xkoA6w== From: Matthias Fischer To: development@lists.ipfire.org Subject: [PATCH 2/2] suricata: Update to 5.0.9 Date: Fri, 22 Apr 2022 10:21:48 +0200 Message-Id: <20220422082148.22197-2-matthias.fischer@ipfire.org> In-Reply-To: <20220422082148.22197-1-matthias.fischer@ipfire.org> References: <20220422082148.22197-1-matthias.fischer@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" Changelog: "5.0.9 -- 2022-04-21 Security #4889: ftp: SEGV at flow cleanup due to protocol confusion Security #5025: ftp: GetLine function buffers data indefinitely if 0x0a was not found int the frag'd input Security #5028: smtp: GetLine function buffers data indefinitely if 0x0a was not found in the frag'd input Security #5253: Infinite loop in JsonFTPLogger Feature #4644: pthreads: set minimum stack size Bug #4466: dataset file not written when run as user Bug #4678: Configuration test mode succeeds when reference.config file contains invalid content Bug #4745: Absent app-layer protocol is always enabled by default Bug #4819: tcp: insert_data_normal_fail can hit without triggering memcap Bug #4823: conf: quadratic complexity Bug #4825: pppoe decoder fails when protocol identity field is only 1 byte Bug #4827: packetpool: packets in pool may have capture method ReleasePacket callbacks set Bug #4838: af-packet: cluster_id is not used when trying to set fanout support Bug #4878: datasets: memory leak in 5.0.x Bug #4887: dnp3: buffer over read in logging base64 empty objects Bug #4891: protodetect: SMB vs TLS protocol detection in midstream Bug #4893: TFTP: memory leak due to missing detect state Bug #4895: Memory leak with signature using file_data and NFS Bug #4897: profiling: Invalid performance counter when using sampling Bug #4901: eve: memory leak related to dns Bug #4932: smtp: smtp transaction not logged if no email is present Bug #4955: stream: too aggressive pruning in lossy streams Bug #4957: SMTP assertion triggered Bug #4959: suricatasc loop if recv returns no data Bug #4961: dns: transaction not created when z-bit set Bug #4963: Run stream reassembly on both directions upon receiving a FIN packet Bug #5058: dns: probing/parser can return error when it should return incomplete Bug #5063: Not keyword matches in Kerberos requests Bug #5096: output: timestamp missing usecs on Arm 32bit + Musl Bug #5099: htp: server personality radix handling issue Bug #5101: defrag: policy config can setup radix incorrectly Bug #5103: Application log cannot to be re-opened when running as non-root user Bug #5105: iprep: cidr support can set up radix incorrectly Bug #5107: detect/iponly: rule parsing does not always apply netmask correctly Bug #5109: swf: coverity warning Bug #5115: detect/ip_proto: inconsistent behavior when specifying protocol by string Bug #5117: detect/iponly: mixing netblocks can lead to FN/FP Bug #5119: smb: excessive CPU utilization and higher packet processing latency due to excessive calls to Vec::extend_from_slice() Bug #5137: smb: excessive memory use during file transfer Bug #5150: nfs: Integer underflow in NFS Bug #5157: xbits: noalert is allowed in rule language with other commands Bug #5164: iprep: use_cnt can get desynchronized (SIGABRT) Bug #5171: detect/iponly: non-cidr netmask settings can lead incorrect radix tree Bug #5193: SSL : over allocation for certificates Bug #5213: content:"22 2 22"; is parsed without error Bug #5227: 5.0.x: SMB: Wrong buffer being checked for possible overflow. Bug #5251: smb: integer underflows and overflows Task #5006: libhtp 0.5.40" Additionally, I moved the 'suricata' patch files into a separate directory. Apart from some line numbers, nothing else was changed. Signed-off-by: Matthias Fischer Reviewed-by: Adolf Belka --- lfs/suricata | 12 ++++++------ ...eam-tcp-Handle-retransmitted-SYN-with-TSval.patch | 2 +- ...-5.0.8-fix-level1-cache-line-size-detection.patch | 2 +- .../suricata-disable-sid-2210059.patch | 0 4 files changed, 8 insertions(+), 8 deletions(-) rename src/patches/{ => suricata}/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch (97%) rename src/patches/{ => suricata}/suricata-5.0.8-fix-level1-cache-line-size-detection.patch (95%) rename src/patches/{ => suricata}/suricata-disable-sid-2210059.patch (100%) diff --git a/lfs/suricata b/lfs/suricata index 80e0923d3..4a9dcdb1d 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team # +# Copyright (C) 2007-2022 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 5.0.8 +VER = 5.0.9 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 5c13aea176b6666477c620d1ed294310ee84ec706abbc740a23d66722297c09b61f253bbe17700cd58f8ce439987c9b13f312aba37d911b6522e4848e7c1b0cd +$(DL_FILE)_BLAKE2 = 02ab99585233a47b1577e55060ba1141c339718e5bd39b6f4d38bb9384fd459aae353f313083048128507f9023a8bcfea3e5a5bcc9ea0c75cfc9c288ca9db6b6 install : $(TARGET) @@ -70,9 +70,9 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata-disable-sid-2210059.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata-5.0.8-fix-level1-cache-line-size-detection.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-disable-sid-2210059.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-5.0.8-fix-level1-cache-line-size-detection.patch cd $(DIR_APP) && LDFLAGS="$(LDFLAGS)" ./configure \ --prefix=/usr \ --sysconfdir=/etc \ diff --git a/src/patches/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch b/src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch similarity index 97% rename from src/patches/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch rename to src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch index fcea77cfa..6bc745a0f 100644 --- a/src/patches/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch +++ b/src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch @@ -26,7 +26,7 @@ diff --git a/src/stream-tcp.c b/src/stream-tcp.c index 1cff19fa5..af681760b 100644 --- a/src/stream-tcp.c +++ b/src/stream-tcp.c -@@ -1643,6 +1643,23 @@ static int StreamTcpPacketStateSynSent(ThreadVars *tv, Packet *p, +@@ -1641,6 +1641,23 @@ static int StreamTcpPacketStateSynSent(ThreadVars *tv, Packet *p, "ssn->client.last_ack %"PRIu32"", ssn, ssn->client.isn, ssn->client.next_seq, ssn->client.last_ack); diff --git a/src/patches/suricata-5.0.8-fix-level1-cache-line-size-detection.patch b/src/patches/suricata/suricata-5.0.8-fix-level1-cache-line-size-detection.patch similarity index 95% rename from src/patches/suricata-5.0.8-fix-level1-cache-line-size-detection.patch rename to src/patches/suricata/suricata-5.0.8-fix-level1-cache-line-size-detection.patch index a6747a2a7..68a21f1e9 100644 --- a/src/patches/suricata-5.0.8-fix-level1-cache-line-size-detection.patch +++ b/src/patches/suricata/suricata-5.0.8-fix-level1-cache-line-size-detection.patch @@ -2,7 +2,7 @@ diff --git a/configure.ac b/configure.ac index d56d3a550..81abf8f00 100644 --- a/configure.ac +++ b/configure.ac -@@ -2313,7 +2313,7 @@ fi +@@ -2318,7 +2318,7 @@ fi AC_PATH_PROG(HAVE_GETCONF_CMD, getconf, "no") if test "$HAVE_GETCONF_CMD" != "no"; then CLS=$(getconf LEVEL1_DCACHE_LINESIZE) diff --git a/src/patches/suricata-disable-sid-2210059.patch b/src/patches/suricata/suricata-disable-sid-2210059.patch similarity index 100% rename from src/patches/suricata-disable-sid-2210059.patch rename to src/patches/suricata/suricata-disable-sid-2210059.patch