From owner-freebsd-ports-bugs@FreeBSD.ORG Sun Jun 17 15:40:04 2007 Return-Path: X-Original-To: freebsd-ports-bugs@hub.freebsd.org Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 2F70C16A468 for ; Sun, 17 Jun 2007 15:40:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40]) by mx1.freebsd.org (Postfix) with ESMTP id 0EE9D13C465 for ; Sun, 17 Jun 2007 15:40:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id l5HFe39r023787 for ; Sun, 17 Jun 2007 15:40:03 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id l5HFe3mF023786; Sun, 17 Jun 2007 15:40:03 GMT (envelope-from gnats) Resent-Date: Sun, 17 Jun 2007 15:40:03 GMT Resent-Message-Id: <200706171540.l5HFe3mF023786@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Henrik Brix Andersen Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 4E8C016A468 for ; Sun, 17 Jun 2007 15:33:08 +0000 (UTC) (envelope-from brix@lothlorien.brixandersen.dk) Received: from solow.pil.dk (relay.pil.dk [195.41.47.164]) by mx1.freebsd.org (Postfix) with ESMTP id 1908813C465 for ; Sun, 17 Jun 2007 15:33:07 +0000 (UTC) (envelope-from brix@lothlorien.brixandersen.dk) Received: from lothlorien.brixandersen.dk (osgiliath.brixandersen.dk [87.53.223.189]) by solow.pil.dk (Postfix) with ESMTP id 72F551CC105; Sun, 17 Jun 2007 17:33:06 +0200 (CEST) Received: by lothlorien.brixandersen.dk (Postfix, from userid 1001) id DEC481141F; Sun, 17 Jun 2007 17:33:05 +0200 (CEST) Message-Id: <20070617153305.DEC481141F@lothlorien.brixandersen.dk> Date: Sun, 17 Jun 2007 17:33:05 +0200 (CEST) From: Henrik Brix Andersen To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Mij Subject: ports/113800: [patch] security/sshguard{, -ipfw, -pf} doesn't recognize all IPv6 addresses X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Henrik Brix Andersen List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Jun 2007 15:40:04 -0000 >Number: 113800 >Category: ports >Synopsis: [patch] security/sshguard{,-ipfw,-pf} doesn't recognize all IPv6 addresses >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Jun 17 15:40:02 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Henrik Brix Andersen >Release: FreeBSD 7.0-CURRENT i386 >Organization: pil.dk >Environment: System: FreeBSD lothlorien.brixandersen.dk 7.0-CURRENT FreeBSD 7.0-CURRENT #44: Wed Jun 13 13:26:40 CEST 2007 root@lothlorien.brixandersen.dk:/usr/obj/usr/src/sys/LOTHLORIEN i386 >Description: The regex used to recognize IPv6 addresses in security/sshguard{,-ipfw,-pf} doesn't catch all IPv6 addresses. The author (and port maintainer) is aware of this issue and supplied the following patch, which fixes the issue. The patch will be part of sshguard-1.1, which is due soonish. He OK'ed that I submit the patch for inclusion in FreeBSD ports. >How-To-Repeat: >Fix: --- sshguard.diff begins here --- diff -urpN /usr/ports/security/sshguard/Makefile security/sshguard/Makefile --- /usr/ports/security/sshguard/Makefile Wed Jun 13 00:13:32 2007 +++ security/sshguard/Makefile Sun Jun 17 17:25:16 2007 @@ -7,6 +7,7 @@ PORTNAME= sshguard DISTVERSION= 1.0 +PORTREVISION= 1 CATEGORIES= security MASTER_SITES= ${MASTER_SITE_SOURCEFORGE} MASTER_SITE_SUBDIR= ${PORTNAME} diff -urpN /usr/ports/security/sshguard/files/patch-attack_scanner.l security/sshguard/files/patch-attack_scanner.l --- /usr/ports/security/sshguard/files/patch-attack_scanner.l Thu Jan 1 01:00:00 1970 +++ security/sshguard/files/patch-attack_scanner.l Sun Jun 17 17:22:37 2007 @@ -0,0 +1,11 @@ +--- src/attack_scanner.l.orig Wed May 23 20:53:53 2007 ++++ src/attack_scanner.l Sat Jun 16 17:45:43 2007 +@@ -46,7 +46,7 @@ NUMBER [1-9][0-9]* + /* an IPv4 address */ + (25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]([0-9])?)(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]([0-9])?|0)){3} { yylval.str = yytext; return IPv4; } + /* an IPv6 address */ +-((([a-fA-F0-9]{1,4}:){2}(:[a-fA-F0-9]{1,4}){1,5})|(:(:[a-fA-F0-9]{1,4}){1,6}|([a-fA-F0-9]{1,4}:)(:[a-fA-F0-9]{1,4}){1,6}|([a-fA-F0-9]{1,4}:){2}(:[a-fA-F0-9]{1,4}){1,5}|([a-fA-F0-9]{1,4}:){3}(:[a-fA-F0-9]{1,4}){1,4}|([a-fA-F0-9]{1,4}:){4}(:[a-fA-F0-9]{1,4}){1,3}|([a-fA-F0-9]{1,4}:){5}(:[a-fA-F0-9]{1,4}){1,2}|([a-fA-F0-9]{1,4}:){6}:[a-fA-F0-9]{1,4})) { yylval.str = yytext; return IPv6; } ++(([a-fA-F0-9]{1,4}(:[a-fA-F0-9]{1,4}){7})|(([a-fA-F0-9]{1,4}:){2}(:[a-fA-F0-9]{1,4}){1,5})|(:(:[a-fA-F0-9]{1,4}){1,6}|([a-fA-F0-9]{1,4}:)(:[a-fA-F0-9]{1,4}){1,6}|([a-fA-F0-9]{1,4}:){2}(:[a-fA-F0-9]{1,4}){1,5}|([a-fA-F0-9]{1,4}:){3}(:[a-fA-F0-9]{1,4}){1,4}|([a-fA-F0-9]{1,4}:){4}(:[a-fA-F0-9]{1,4}){1,3}|([a-fA-F0-9]{1,4}:){5}(:[a-fA-F0-9]{1,4}){1,2}|([a-fA-F0-9]{1,4}:){6}:[a-fA-F0-9]{1,4})) { yylval.str = yytext; return IPv6; } + + /* an host address (PTR) */ + localhost|([-a-zA-Z0-9]+\.)+[a-zA-Z]+ { yylval.str = yytext; return HOSTADDR; } --- sshguard.diff ends here --- >Release-Note: >Audit-Trail: >Unformatted: