[17.09] squid: fix CVE-2018-1000024 & CVE-2018-1000027 #34582

andir · 2018-02-04T08:33:52Z

Motivation for this change

fixing CVE-2018-1000024 & CVE-2018-1000027

Things done

Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- other Linux distributions
Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

GrahamcOfBorg · 2018-02-04T08:46:52Z

Failure on x86_64-darwin (full log)

Partial log (click to expand)

Package ‘squid-3.5.27’ in /Users/graham/nix-borg/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-ndnd/pkgs/servers/squid/default.nix:43 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg · 2018-02-04T08:53:42Z

Failure on x86_64-darwin (full log)

Partial log (click to expand)

Package ‘squid-3.5.27’ in /Users/graham/nix-borg/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-ndnd/pkgs/servers/squid/default.nix:43 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg · 2018-02-04T08:54:24Z

Failure on x86_64-linux (full log)

Partial log (click to expand)

cc1plus: warning: unrecognized command line option '-Wno-deprecated-register'
make[3]: *** [Makefile:863: Libxml2Parser.lo] Error 1
make[3]: Leaving directory '/tmp/nix-build-squid-4.0.23.drv-0/squid-4.0.23/src/esi'
make[2]: *** [Makefile:6942: all-recursive] Error 1
make[2]: Leaving directory '/tmp/nix-build-squid-4.0.23.drv-0/squid-4.0.23/src'
make[1]: *** [Makefile:5961: all] Error 2
make[1]: Leaving directory '/tmp/nix-build-squid-4.0.23.drv-0/squid-4.0.23/src'
make: *** [Makefile:582: all-recursive] Error 1
builder for ‘/nix/store/235bjmqd5q83vlm0jqa7g5wri6x0y6qd-squid-4.0.23.drv’ failed with exit code 2
error: build of ‘/nix/store/08xp24bkr3rhcbmqhhll7flziwsh0a26-squid-3.5.27.drv’, ‘/nix/store/235bjmqd5q83vlm0jqa7g5wri6x0y6qd-squid-4.0.23.drv’ failed

GrahamcOfBorg · 2018-02-04T09:00:29Z

Failure on x86_64-darwin (full log)

Partial log (click to expand)

Package ‘squid-3.5.27’ in /Users/graham/nix-borg/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-ndnd/pkgs/servers/squid/default.nix:43 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg · 2018-02-04T09:07:15Z

Failure on x86_64-linux (full log)

Partial log (click to expand)

gzipping man pages under /nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27/share/man/
stripping (with flags -S) in /nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27/libexec  /nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27/bin  /nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27/sbin 
patching script interpreter paths in /nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27
/nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27/libexec/basic_smb_auth.sh: interpreter directive changed from "/bin/sh" to "/nix/store/jgw8hxx7wzkyhb2dr9hwsd9h2caaasdc-bash-4.4-p12/bin/sh"
/nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27/libexec/url_fake_rewrite.sh: interpreter directive changed from "/bin/sh" to "/nix/store/jgw8hxx7wzkyhb2dr9hwsd9h2caaasdc-bash-4.4-p12/bin/sh"
/nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27/libexec/cert_valid.pl: interpreter directive changed from "/usr/bin/perl -w" to "/nix/store/i6xckn2cfmwry0rnyqpxf14xynghsnls-perl-5.24.3/bin/perl -w"
/nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27/libexec/helper-mux.pl: interpreter directive changed from "/usr/bin/perl" to "/nix/store/i6xckn2cfmwry0rnyqpxf14xynghsnls-perl-5.24.3/bin/perl"
checking for references to /tmp/nix-build-squid-3.5.27.drv-0 in /nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27...
moving /nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27/sbin/* to /nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27/bin
error: build of ‘/nix/store/235bjmqd5q83vlm0jqa7g5wri6x0y6qd-squid-4.0.23.drv’ failed

GrahamcOfBorg · 2018-02-04T09:31:56Z

Failure on aarch64-linux (full log)

Partial log (click to expand)

cc1plus: warning: unrecognized command line option '-Wno-deprecated-register'
make[3]: *** [Makefile:863: Libxml2Parser.lo] Error 1
make[3]: Leaving directory '/build/squid-4.0.23/src/esi'
make[2]: *** [Makefile:6942: all-recursive] Error 1
make[2]: Leaving directory '/build/squid-4.0.23/src'
make[1]: *** [Makefile:5961: all] Error 2
make[1]: Leaving directory '/build/squid-4.0.23/src'
make: *** [Makefile:582: all-recursive] Error 1
builder for '/nix/store/m1sp4n1xh624x7b45ag0yw8pj5yflrsm-squid-4.0.23.drv' failed with exit code 2
error: build of '/nix/store/kjyrj0fjrrs603kccka4xa75hg212srv-squid-3.5.27.drv', '/nix/store/m1sp4n1xh624x7b45ag0yw8pj5yflrsm-squid-4.0.23.drv' failed

GrahamcOfBorg · 2018-02-04T10:02:33Z

Failure on aarch64-linux (full log)

Partial log (click to expand)

cc1plus: warning: unrecognized command line option '-Wno-deprecated-register'
make[3]: *** [Makefile:863: Libxml2Parser.lo] Error 1
make[3]: Leaving directory '/build/squid-4.0.23/src/esi'
make[2]: *** [Makefile:6942: all-recursive] Error 1
make[2]: Leaving directory '/build/squid-4.0.23/src'
make[1]: *** [Makefile:5961: all] Error 2
make[1]: Leaving directory '/build/squid-4.0.23/src'
make: *** [Makefile:582: all-recursive] Error 1
builder for '/nix/store/m1sp4n1xh624x7b45ag0yw8pj5yflrsm-squid-4.0.23.drv' failed with exit code 2
error: build of '/nix/store/m1sp4n1xh624x7b45ag0yw8pj5yflrsm-squid-4.0.23.drv' failed

(cherry picked from commit 5cdcd3f)

(cherry picked from commit f70b5cb57832e83f96c4f81faa649a42acabd86b)

andir · 2018-02-07T10:39:43Z

@GrahamcOfBorg build squid squid4

GrahamcOfBorg · 2018-02-07T10:39:58Z

Failure on x86_64-darwin (full log)

Partial log (click to expand)

Package ‘squid-3.5.27’ in /private/var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/lnl7-mac/pkgs/servers/squid/default.nix:43 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg · 2018-02-07T10:45:35Z

Failure on x86_64-darwin (full log)

Partial log (click to expand)

Package ‘squid-3.5.27’ in /private/var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/lnl7-mac/pkgs/servers/squid/default.nix:43 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg · 2018-02-07T10:53:15Z

Success on x86_64-linux (full log)

Partial log (click to expand)

shrinking /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/sbin/squid
shrinking /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/bin/purge
shrinking /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/bin/squidclient
gzipping man pages under /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/share/man/
stripping (with flags -S) in /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/libexec  /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/bin  /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/sbin 
patching script interpreter paths in /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23
/nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/libexec/basic_smb_auth.sh: interpreter directive changed from "/bin/sh" to "/nix/store/jgw8hxx7wzkyhb2dr9hwsd9h2caaasdc-bash-4.4-p12/bin/sh"
/nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/libexec/url_fake_rewrite.sh: interpreter directive changed from "/bin/sh" to "/nix/store/jgw8hxx7wzkyhb2dr9hwsd9h2caaasdc-bash-4.4-p12/bin/sh"
checking for references to /tmp/nix-build-squid-4.0.23.drv-0 in /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23...
moving /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/sbin/* to /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/bin

GrahamcOfBorg · 2018-02-07T10:55:08Z

Success on x86_64-linux (full log)

Partial log (click to expand)

shrinking /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/bin/purge
gzipping man pages under /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/share/man/
stripping (with flags -S) in /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/libexec  /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/bin  /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/sbin 
patching script interpreter paths in /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23
/nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/libexec/basic_smb_auth.sh: interpreter directive changed from "/bin/sh" to "/nix/store/jgw8hxx7wzkyhb2dr9hwsd9h2caaasdc-bash-4.4-p12/bin/sh"
/nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/libexec/url_fake_rewrite.sh: interpreter directive changed from "/bin/sh" to "/nix/store/jgw8hxx7wzkyhb2dr9hwsd9h2caaasdc-bash-4.4-p12/bin/sh"
checking for references to /tmp/nix-build-squid-4.0.23.drv-0 in /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23...
moving /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/sbin/* to /nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23/bin
/nix/store/y58dw4cnbzi7mwg6nkl9w4r3gbn8p8vb-squid-3.5.27
/nix/store/vi0246zfswrsrhxzzqnrpqzpn7gc22v4-squid-4.0.23

GrahamcOfBorg · 2018-02-07T11:42:42Z

Success on aarch64-linux (full log)

Partial log (click to expand)

shrinking /nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23/libexec/ext_ldap_group_acl
gzipping man pages under /nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23/share/man/
stripping (with flags -S) in /nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23/libexec  /nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23/bin  /nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23/sbin
patching script interpreter paths in /nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23
/nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23/libexec/url_fake_rewrite.sh: interpreter directive changed from "/bin/sh" to "/nix/store/7b94zsymp6g5rzp2pgwhpkw0idjg52x5-bash-4.4-p12/bin/sh"
/nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23/libexec/basic_smb_auth.sh: interpreter directive changed from "/bin/sh" to "/nix/store/7b94zsymp6g5rzp2pgwhpkw0idjg52x5-bash-4.4-p12/bin/sh"
checking for references to /build in /nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23...
moving /nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23/sbin/* to /nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23/bin
/nix/store/jcbz76j9wa23mwsww8m5blr19rg2gyws-squid-3.5.27
/nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23

GrahamcOfBorg · 2018-02-07T11:42:45Z

Success on aarch64-linux (full log)

Partial log (click to expand)

these derivations will be built:
  /nix/store/p3r4q2367d3y1kpndmsp5yj6xwix7wpw-squid-3.5.27.drv
  /nix/store/zbz015y8yrjmy2nby2zz20cxbmayns7k-squid-4.0.23.drv
waiting for locks or build slots...
/nix/store/jcbz76j9wa23mwsww8m5blr19rg2gyws-squid-3.5.27
/nix/store/8p9ld4vhflx4vyiia3m8652s5mp1r6sd-squid-4.0.23

andir force-pushed the 17.09/squid branch from 5718a81 to 17eb323 Compare February 4, 2018 08:35

GrahamcOfBorg added 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 labels Feb 4, 2018

andir force-pushed the 17.09/squid branch from 17eb323 to 9414056 Compare February 4, 2018 08:44

andir force-pushed the 17.09/squid branch from 9414056 to e80a11a Compare February 4, 2018 08:51

FRidh added the 1.severity: security label Feb 5, 2018

andir added 3 commits February 7, 2018 10:40

squid4: 4.0.21 -> 4.0.23 (fixes CVE-2018-1000024 & CVE-2018-1000027)

8495886

(cherry picked from commit 5cdcd3f)

squid4: hack to detect our libxml2

7cf5bdd

squid: fix CVE-2018-1000024 & CVE-2018-1000027

bff2ac1

(cherry picked from commit f70b5cb57832e83f96c4f81faa649a42acabd86b)

andir force-pushed the 17.09/squid branch from e80a11a to bff2ac1 Compare February 7, 2018 10:38

andir merged commit 3d985c4 into NixOS:release-17.09 Feb 7, 2018

andir deleted the 17.09/squid branch February 7, 2018 11:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[17.09] squid: fix CVE-2018-1000024 & CVE-2018-1000027 #34582

[17.09] squid: fix CVE-2018-1000024 & CVE-2018-1000027 #34582

andir commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

andir commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

[17.09] squid: fix CVE-2018-1000024 & CVE-2018-1000027 #34582

[17.09] squid: fix CVE-2018-1000024 & CVE-2018-1000027 #34582

Conversation

andir commented Feb 4, 2018

Motivation for this change

Things done

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

GrahamcOfBorg commented Feb 4, 2018

andir commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018

GrahamcOfBorg commented Feb 7, 2018