webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-10 19:15:54 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
fbfe5b652ed07e412f5533a88de352def0bf7828
bpfire/lfs/squid
Matthias Fischer 9fa6a8d81d squid: Update to 4.13 
For details see:
http://www.squid-cache.org/Versions/v4/changesets/

and

http://lists.squid-cache.org/pipermail/squid-users/2020-August/022566.html

Fixes (excerpt):

"* SQUID-2020:8 HTTP(S) Request Splitting
   (CVE-2020-15811)

This problem is serious because it allows any client, including
browser scripts, to bypass local security and poison the browser
cache and any downstream caches with content from an arbitrary
source.

* SQUID-2020:9 Denial of Service processing Cache Digest Response
   (CVE pending allocation)

This problem allows a trusted peer to deliver to perform Denial
of Service by consuming all available CPU cycles on the machine
running Squid when handling a crafted Cache Digest response
message.

* SQUID-2020:10 HTTP(S) Request Smuggling
   (CVE-2020-15810)

This problem is serious because it allows any client, including
browser scripts, to bypass local security and poison the proxy
cache and any downstream caches with content from an arbitrary
source.

* Bug 5051: Some collapsed revalidation responses never expire

* SSL-Bump: Support parsing GREASEd (and future) TLS handshakes

* Honor on_unsupported_protocol for intercepted https_port"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2020-08-24 09:47:40 +00:00

191 lines
6.8 KiB
Plaintext
Raw Blame History

###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2007-2020 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation, either version 3 of the License, or #
# (at your option) any later version. #
# #
# This program is distributed in the hope that it will be useful, #
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
# GNU General Public License for more details. #
# #
# You should have received a copy of the GNU General Public License #
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
# #
###############################################################################
###############################################################################
# Definitions
###############################################################################
include Config
VER = 4.13
THISAPP = squid-$(VER)
DL_FILE = $(THISAPP).tar.xz
DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
CXXFLAGS+= -Wno-error=format-truncation
ifeq "$(BUILD_ARCH)" "armv5tel"
LDFLAGS += -latomic
endif
###############################################################################
# Top-level Rules
###############################################################################
objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
$(DL_FILE)_MD5 = 492e54afc15821141ff1d1d9903854d6
install : $(TARGET)
check : $(patsubst %,$(DIR_CHK)/%,$(objects))
download :$(patsubst %,$(DIR_DL)/%,$(objects))
md5 : $(subst %,%_MD5,$(objects))
###############################################################################
# Downloading, checking, md5sum
###############################################################################
$(patsubst %,$(DIR_CHK)/%,$(objects)) :
@$(CHECK)
$(patsubst %,$(DIR_DL)/%,$(objects)) :
@$(LOAD)
$(subst %,%_MD5,$(objects)) :
@$(MD5)
###############################################################################
# Installation Details
###############################################################################
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xaf $(DIR_DL)/$(DL_FILE)
cd $(DIR_APP) && autoreconf -vfi
cd $(DIR_APP)/libltdl && autoreconf -vfi
cd $(DIR_APP) && CFLAGS="$(CFLAGS)" CXXFLAGS="$(CXXFLAGS)" \
LDFLAGS="$(LDFLAGS)" ./configure \
--prefix=/usr \
--sysconfdir=/etc/squid \
--datadir=/usr/lib/squid \
--mandir=/usr/share/man \
--libexecdir=/usr/lib/squid \
--localstatedir=/var \
--disable-ssl \
--disable-icmp \
--disable-wccp \
--disable-wccpv2 \
--disable-kqueue \
--disable-esi \
--disable-arch-native \
--enable-poll \
--enable-ident-lookups \
--enable-storeio=aufs,diskd,ufs \
--enable-underscores \
--enable-http-violations \
--enable-removal-policies=heap,lru \
--enable-delay-pools \
--enable-linux-netfilter \
--enable-snmp \
--enable-auth \
--enable-auth-basic \
--enable-auth-digest \
--enable-auth-negotiate \
--enable-auth-ntlm \
--enable-log-daemon-helpers \
--enable-url-rewrite-helpers \
--enable-build-info \
--enable-eui \
--enable-async-io=16 \
--enable-unlinkd \
--enable-internal-dns \
--enable-epoll \
--enable-select \
--enable-cache-digests \
--enable-forw-via-db \
--enable-htcp \
--enable-kill-parent-hack \
--enable-icap-client \
--enable-zph-qos \
--with-dl \
--with-filedescriptors=$$(( 16384 * 64 )) \
--with-large-files \
--without-gnutls \
--without-netfilter-conntrack
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
rm -f /etc/squid/squid.conf
ln -sf /var/ipfire/proxy/squid.conf /etc/squid/squid.conf
rm -f /etc/squid/cachemgr.conf
ln -sf /var/ipfire/proxy/cachemgr.conf /etc/squid/cachemgr.conf
rm -f /etc/squid/errors
ln -sf /usr/lib/squid/errors/en /etc/squid/errors
-mkdir -p /var/log/cache /var/log/squid /var/log/updatexlrator
touch /var/log/squid/access.log
chown -R squid:squid /var/log/squid /var/log/cache /var/log/updatexlrator
cp /usr/lib/squid/cachemgr.cgi /srv/web/ipfire/cgi-bin/cachemgr.cgi
chown nobody.nobody /srv/web/ipfire/cgi-bin/cachemgr.cgi
cp -f $(DIR_SRC)/config/updxlrator/updxlrator /usr/sbin/updxlrator
cp -f $(DIR_SRC)/config/updxlrator/checkup /var/ipfire/updatexlrator/bin/checkup
cp -f $(DIR_SRC)/config/updxlrator/download /var/ipfire/updatexlrator/bin/download
cp -f $(DIR_SRC)/config/updxlrator/convert /var/ipfire/updatexlrator/bin/convert
cp -f $(DIR_SRC)/config/updxlrator/lscache /var/ipfire/updatexlrator/bin/lscache
cp -f $(DIR_SRC)/config/updxlrator/checkdeaddl /var/ipfire/updatexlrator/bin/checkdeaddl
cp -f $(DIR_SRC)/config/updxlrator/updxlrator-lib.pl /var/ipfire/updatexlrator/updxlrator-lib.pl
chmod 755 /usr/sbin/updxlrator /var/ipfire/updatexlrator/bin/checkup \
/var/ipfire/updatexlrator/bin/download \
/var/ipfire/updatexlrator/bin/convert \
/var/ipfire/updatexlrator/bin/lscache \
/var/ipfire/updatexlrator/bin/checkdeaddl
ln -fs /bin/false /var/ipfire/updatexlrator/autocheck/cron.daily
ln -fs /bin/false /var/ipfire/updatexlrator/autocheck/cron.monthly
ln -fs /bin/false /var/ipfire/updatexlrator/autocheck/cron.weekly
chown -R nobody:nobody /var/ipfire/updatexlrator
chown nobody.squid /var/updatecache
chown nobody.squid /var/updatecache/download
chown nobody.squid /var/updatecache/metadata
chmod 775 /var/updatecache
chmod 775 /var/updatecache/download
chmod 775 /var/updatecache/metadata
chmod 755 /var/log/updatexlrator
chmod 755 /srv/web/ipfire/html/images/updbooster
chown squid:squid /var/log/squid
ln -sf /usr/lib/squid /usr/lib/squid/auth
cp -f $(DIR_SRC)/config/proxy/proxy.pac /srv/web/ipfire/html/proxy.pac
chown nobody.nobody /srv/web/ipfire/html/proxy.pac
ln -sf /srv/web/ipfire/html/proxy.pac /srv/web/ipfire/html/wpad.dat
#Copy stylesheets for the errorpages
cp -f $(DIR_SRC)/config/proxy/errorpage-ipfire.css /var/ipfire/proxy/
cp -f /etc/squid/errorpage.css /var/ipfire/proxy/errorpage-squid.css
@rm -rf $(DIR_APP)
@$(POSTBUILD)
Reference in New Issue View Git Blame Copy Permalink