mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-11 19:55:52 +02:00
d6d2019fae
Release notes (https://suricata-ids.org/2020/04/28/suricata-5-0-3-released/, truncated): This is the first release after Suricata joined the Oss-Fuzz program, leading to discovery of a number of (potential) security issues. We expect that in the coming months we’ll fix more such issues, as the fuzzers increase their coverage and we continue to improve the seed corpus. Feature #3481: GRE ERSPAN Type 1 Support Feature #3613: Teredo port configuration Feature #3673: datasets: add ‘dataset-remove’ unix command Bug #3240: Dataset hash-size or prealloc invalid value logging Bug #3241: Dataset reputation invalid value logging Bug #3342: Suricata 5.0 crashes while parsing SMB data Bug #3450: signature with sticky buffer with subsequent pcre check in a different buffer loads but will never match Bug #3491: Backport 5 BUG_ON(strcasecmp(str, “any”) in DetectAddressParseString Bug #3507: rule parsing: memory leaks Bug #3526: 5.0.x Kerberos vulnerable to TCP splitting evasion Bug #3534: Skip over ERF_TYPE_META records Bug #3552: file logging: complete files sometimes marked ‘TRUNCATED’ Bug #3571: rust: smb compile warnings Bug #3573: TCP Fast Open – Bypass of stateless alerts Bug #3574: Behavior for tcp fastopen Bug #3576: Segfault when facing malformed SNMP rules Bug #3577: SIP: Input not parsed when header values contain trailing spaces Bug #3580: Faulty signature with two threshold keywords does not generate an error and never match Bug #3582: random failures on sip and http-evader suricata-verify tests Bug #3585: htp: asan issue Bug #3592: Segfault on SMTP TLS Bug #3598: rules: memory leaks in pktvar keyword Bug #3600: rules: bad address block leads to stack exhaustion Bug #3602: rules: crash on ‘internal’-only keywords Bug #3604: rules: missing ‘consumption’ of transforms before pkt_data would lead to crash Bug #3606: rules: minor memory leak involving pcre_get_substring Bug #3609: ssl/tls: ASAN issue in SSLv3ParseHandshakeType Bug #3610: defrag: asan issue Bug #3612: rules/bsize: memory issue during parsing Bug #3614: build-info and configure wrongly display libnss status Bug #3644: Invalid memory read on malformed rule with Lua script Bug #3646: rules: memory leaks on failed rules Bug #3649: CIDR Parsing Issue Bug #3651: FTP response buffering against TCP stream Bug #3653: Recursion stack-overflow in parsing YAML configuration Bug #3660: Multiple DetectEngineReload and bad insertion into linked list lead to buffer overflow Bug #3665: FTP: Incorrect ftp_memuse calculation. Bug #3667: Signature with an IP range creates one IPOnlyCIDRItem by signe IP address Bug #3669: Rules reload with Napatech can hang Suricata UNIX manager process Bug #3672: coverity: data directory handling issues Bug #3674: Protocol detection evasion by packet splitting Optimization #3406: filestore rules are loaded without warning when filestore is not enabled Task #3478: libhtp 0.5.33 Task #3514: SMTP should place restraints on variable length items (e.g., filenames) Documentation #3543: doc: add ipv4.hdr and ipv6.hdr Bundled libhtp 0.5.33 Bundled Suricata-Update 1.1.2 Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Acked-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
123 lines
4.2 KiB
Plaintext
123 lines
4.2 KiB
Plaintext
###############################################################################
|
|
# #
|
|
# IPFire.org - A linux based firewall #
|
|
# Copyright (C) 2007-2020 IPFire Team <info@ipfire.org> #
|
|
# #
|
|
# This program is free software: you can redistribute it and/or modify #
|
|
# it under the terms of the GNU General Public License as published by #
|
|
# the Free Software Foundation, either version 3 of the License, or #
|
|
# (at your option) any later version. #
|
|
# #
|
|
# This program is distributed in the hope that it will be useful, #
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
|
# GNU General Public License for more details. #
|
|
# #
|
|
# You should have received a copy of the GNU General Public License #
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
|
# #
|
|
###############################################################################
|
|
|
|
###############################################################################
|
|
# Definitions
|
|
###############################################################################
|
|
|
|
include Config
|
|
|
|
VER = 5.0.3
|
|
|
|
THISAPP = suricata-$(VER)
|
|
DL_FILE = $(THISAPP).tar.gz
|
|
DL_FROM = $(URL_IPFIRE)
|
|
DIR_APP = $(DIR_SRC)/$(THISAPP)
|
|
TARGET = $(DIR_INFO)/$(THISAPP)
|
|
|
|
###############################################################################
|
|
# Top-level Rules
|
|
###############################################################################
|
|
|
|
objects = $(DL_FILE)
|
|
|
|
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
|
|
|
|
$(DL_FILE)_MD5 = d302ae41735551e2e1198e965d452664
|
|
|
|
install : $(TARGET)
|
|
|
|
check : $(patsubst %,$(DIR_CHK)/%,$(objects))
|
|
|
|
download :$(patsubst %,$(DIR_DL)/%,$(objects))
|
|
|
|
md5 : $(subst %,%_MD5,$(objects))
|
|
|
|
###############################################################################
|
|
# Downloading, checking, md5sum
|
|
###############################################################################
|
|
|
|
$(patsubst %,$(DIR_CHK)/%,$(objects)) :
|
|
@$(CHECK)
|
|
|
|
$(patsubst %,$(DIR_DL)/%,$(objects)) :
|
|
@$(LOAD)
|
|
|
|
$(subst %,%_MD5,$(objects)) :
|
|
@$(MD5)
|
|
|
|
###############################################################################
|
|
# Installation Details
|
|
###############################################################################
|
|
|
|
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
|
|
@$(PREBUILD)
|
|
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
|
|
cd $(DIR_APP) && ./configure \
|
|
--prefix=/usr \
|
|
--sysconfdir=/etc \
|
|
--localstatedir=/var \
|
|
--enable-gccprotect \
|
|
--disable-gccmarch-native \
|
|
--enable-non-bundled-htp \
|
|
--enable-nfqueue \
|
|
--disable-static \
|
|
--disable-python \
|
|
--with-libjansson-libraries=/usr/lib \
|
|
--with-libjansson-includes=/usr/include \
|
|
--disable-suricata-update \
|
|
--enable-rust
|
|
|
|
cd $(DIR_APP) && make $(MAKETUNING)
|
|
cd $(DIR_APP) && make install
|
|
cd $(DIR_APP) && make install-conf
|
|
|
|
# Remove default suricata config file.
|
|
rm -rvf /etc/suricata/suricata.yaml
|
|
|
|
# Install IPFire related config file.
|
|
install -m 0644 $(DIR_SRC)/config/suricata/suricata.yaml /etc/suricata
|
|
|
|
# Remove shipped rules.
|
|
rm -rvf /usr/share/suricata
|
|
|
|
# Create emtpy rules directory.
|
|
-mkdir -p /var/lib/suricata
|
|
|
|
# Move config files for references, threshold and classification
|
|
# to the rules directory.
|
|
mv /etc/suricata/*.config /var/lib/suricata
|
|
|
|
# Set correct permissions for the files.
|
|
chmod 644 /var/lib/suricata/*.config
|
|
|
|
# Set correct ownership for /var/lib/suricata and the
|
|
# contained files
|
|
chown -R nobody:nobody /var/lib/suricata
|
|
|
|
# Create logging directory.
|
|
-mkdir -p /var/log/suricata
|
|
|
|
# Set correct ownership for /var/log/suricata.
|
|
chown suricata:suricata /var/log/suricata
|
|
|
|
@rm -rf $(DIR_APP)
|
|
@$(POSTBUILD)
|