Re: www/weboob SSLv3 fallout
On Sun, Sep 27, 2015 at 09:11:22PM +0200, Landry Breuil wrote: > On Sat, Sep 26, 2015 at 03:34:53PM +0200, Jona Joachim wrote: > > Hi, > > weboob has a runtime dependency for SSLv3. The attached diff replaces > > SSLv3 usage with SSLv23. > > > > 2015-09-26 15:02:52,557:ERROR:weboob:1.0:ouiboube.py:450:load_backends > > Unable to load module "cic": 'module' object has no attribute > > 'PROTOCOL_SSLv3' > > > > This is already fixed in the upstream git repo. > > I dont see this in > https://github.com/laurentb/weboob/blob/master/weboob/deprecated/browser/browser.py#L783 PROTOCOL_SSLv3 was replaced with PROTOCOL_SSLv23 in commit: c42f4b61d83b However, I think that change and the previous code was a mistake. Despite the name, they should only be using SSLv23. > > +-_PROTOCOLS = [ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv3] > > ++_PROTOCOLS = [ssl.PROTOCOL_SSLv23] > > Im not sure removing TLSv1 makes sense... dont we want to deprecate > SSLv2 and SSLv3 here ? What upstream commit are you reffering to ? OpenSSL has an unfortunately named 'SSLv23_*' method that really means highest supported protocol (SSL or TLS). You can optionally disable protocols by settings options SSL_OP_NO_*. We gutted SSLv2 and SSLv3 support in LibreSSL so 'SSLv23' means TLS v1.0 or higher for us by default. Upstream weboob changed the above line in git to: _PROTOCOLS = [ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv23] It looks like their intention is to try TLS and if that fails, fall back on SSL. The way they are doing this has unintended consequences and it's not necessary to have multiple tries. 'TLSv1' is another unfortunate name that means TLS v1.0 only and not v1.*. The _PROTOCOLS above will try TLS v1.0 specifically and if that fails, fall back on what SSLv23 allows. In practice, 'TLSv1' will select TLS v1.0 even if TLS v1.0 through v1.2 are supported by the server. If 'SSLv23' was used, it will select the highest supported protocol in common between the client and the server (but subject to SSL_OP_NO_*). Upstream should remove _PROTOCOLS and always use SSLv23. It already does what they want.
[UPDATE] pledge textproc/jq
Hi,
Diff for adding pledge to jq as it is often used with output from remote
servers.
Index: textproc/jq/Makefile
===
RCS file: /cvsmirror/ports/textproc/jq/Makefile,v
retrieving revision 1.6
diff -u -p -r1.6 Makefile
--- textproc/jq/Makefile24 Oct 2015 10:25:39 - 1.6
+++ textproc/jq/Makefile17 Jan 2016 17:05:02 -
@@ -4,6 +4,7 @@ COMMENT = lightweight and flexible comm
V =1.5
DISTNAME = jq-$V
+REVISION = 0
SHARED_LIBS += jq1.0 # 1.4
@@ -14,6 +15,7 @@ HOMEPAGE =http://stedolan.github.io/jq
# MIT (code), CC-BY-3.0 (docs)
PERMIT_PACKAGE_CDROM = Yes
+# uses pledge(2)
WANTLIB += c m
MASTER_SITES = https://github.com/stedolan/jq/releases/download/jq-$V/
Index: textproc/jq/patches/patch-main_c
===
RCS file: textproc/jq/patches/patch-main_c
diff -N textproc/jq/patches/patch-main_c
--- /dev/null 1 Jan 1970 00:00:00 -
+++ textproc/jq/patches/patch-main_c17 Jan 2016 17:12:20 -
@@ -0,0 +1,15 @@
+$OpenBSD$
+--- main.c.origSat Aug 15 21:37:35 2015
main.c Sun Jan 17 09:12:05 2016
+@@ -176,6 +176,11 @@ int main(int argc, char* argv[]) {
+ int badwrite;
+ jv program_arguments = jv_array();
+
++ if (pledge("stdio rpath", NULL) == -1) {
++perror("pledge");
++exit(1);
++ }
++
+ #ifdef WIN32
+ SetConsoleOutputCP(CP_UTF8);
+ fflush(stdout);
Re: pledge textproc/the_silver_searcher
On Sat, Jan 16, 2016 at 08:37:16PM -0500, Michael McConville wrote:
> Also, yet another tweak. deraadt@ pointed out that I should use the
> local err clone (die()) rather than including err.h.
Comments inline.
> Index: Makefile
> ===
> RCS file: /cvs/ports/textproc/the_silver_searcher/Makefile,v
> retrieving revision 1.19
> diff -u -p -r1.19 Makefile
> --- Makefile 9 Oct 2015 12:48:22 - 1.19
> +++ Makefile 17 Jan 2016 01:28:24 -
> @@ -3,6 +3,7 @@
> COMMENT =code searching tool, with a focus on speed (ag)
>
> DISTNAME = the_silver_searcher-0.31.0
> +REVISION = 0
> CATEGORIES = textproc
>
> HOMEPAGE = https://github.com/ggreer/the_silver_searcher
> Index: patches/patch-src_main_c
> ===
> RCS file: patches/patch-src_main_c
> diff -N patches/patch-src_main_c
> --- /dev/null 1 Jan 1970 00:00:00 -
> +++ patches/patch-src_main_c 17 Jan 2016 01:28:24 -
> @@ -0,0 +1,14 @@
> +$OpenBSD$
> +--- src/main.c.orig Sun Sep 6 00:29:27 2015
> src/main.c Sat Jan 16 20:25:38 2016
Why remove the pledge at the start of main in your diff? I think it was
correct to have this:
+@@ -35,6 +35,9 @@ int main(int argc, char **argv) {
+ int workers_len;
+ int num_cores;
+
++if (pledge("stdio rpath proc exec", NULL) == -1)
++die("pledge: %s", strerror(errno));
++
+ set_log_level(LOG_LEVEL_WARN);
+
+ work_queue = NULL;
> +@@ -156,6 +156,10 @@ int main(int argc, char **argv) {
> + log_debug("No CPU affinity support.");
> + #endif
> + }
> ++
> ++if (pledge("stdio rpath", NULL) == -1)
> ++die("pledge: %s", strerror(errno));
> ++
> + for (i = 0; paths[i] != NULL; i++) {
> + log_debug("searching path %s for %s", paths[i], opts.query);
> + symhash = NULL;
> Index: patches/patch-src_options_c
> ===
> RCS file: patches/patch-src_options_c
> diff -N patches/patch-src_options_c
> --- /dev/null 1 Jan 1970 00:00:00 -
> +++ patches/patch-src_options_c 17 Jan 2016 01:28:24 -
> @@ -0,0 +1,13 @@
> +$OpenBSD$
> +--- src/options.c.orig Sun Sep 6 02:20:35 2015
> src/options.cSat Jan 16 20:25:13 2016
> +@@ -574,6 +574,9 @@ void parse_options(int argc, char **argv, char **base_
> + }
> + }
> +
> ++if (pledge("stdio rpath proc", NULL) == -1)
> ++die("pledge: %s", strerror(errno));
> ++
> + if (help) {
> + usage();
> + exit(0);
You can't do this pledge unconditionally. There may be another popen()
for VCS includes.
I've been using this:
+@@ -574,6 +574,11 @@ void parse_options(int argc, char **argv, char **base_
+ }
+ }
+
++if (opts.skip_vcs_ignores) {
++if (pledge("stdio rpath proc", NULL) == -1)
++die("pledge: %s", strerror(errno));
++}
++
+ if (help) {
+ usage();
+ exit(0);
+@@ -620,6 +625,10 @@ void parse_options(int argc, char **argv, char **base_
+ #else
+ gitconfig_file = popen("git config -z --path --get core.excludesfile
2>/dev/null", "r");
+ #endif
++
++if (pledge("stdio rpath proc", NULL) == -1)
++die("pledge: %s", strerror(errno));
++
+ if (gitconfig_file != NULL) {
+ do {
+ gitconfig_res = ag_realloc(gitconfig_res, buf_len + 65);
Re: pledge textproc/the_silver_searcher
On Wed, Feb 03, 2016 at 06:02:55PM +0100, Florian Stinglmayr wrote:
> Michael's patch is very nice and should definitely make it in.
>
> Yet after speaking with upstream the other day it was made very clear to
> me that upstream wants the patch in their repository. Since my upstream
> patch requires a change in configure.ac (and thus a rerunning
> autoreconf) I don't want to put it in ports. So my plan is:
Great!
> 1. Use Michael's patch until upstream releases a new version.
> 2. Send Michael's patch upstream.
> 3. Wait for new version.
> 4. Update port, remove old patches.
>
> Attached below is the git patch that will go upstream. I'd appreciate
> any feedback.
Some feedback below.
> diff --git a/src/main.c b/src/main.c
> index 4d0e623..1551c0d 100644
> --- a/src/main.c
> +++ b/src/main.c
> @@ -35,6 +35,12 @@ int main(int argc, char **argv) {
> int workers_len;
> int num_cores;
>
> +#ifdef HAVE_PLEDGE
> +if (pledge("stdio rpath proc exec", NULL) < 0) {
Can you use the standard convention == -1? It's (almost?) universally
checked that way. Makes it easier to spot errors when everything is
consistent.
> diff --git a/src/options.c b/src/options.c
> index 6bc5b18..bcd452e 100644
> --- a/src/options.c
> +++ b/src/options.c
> @@ -600,6 +600,12 @@ void parse_options(int argc, char **argv, char
> **base_paths[], char **paths[]) {
> }
> }
>
> +#ifdef HAVE_PLEDGE
> +if (opts.skip_vcs_ignores && pledge("stdio rpath proc", NULL) < 0) {
This is a minor nit, but almost every other one is "if (pledge(".
> +#ifdef HAVE_PLEDGE
> +if (pledge("stdio rpath proc", NULL) < -1) {
This will never happen. It should be == -1.
[update] lang/elixir
Add FLAVORs for all Erlang releases supported by Elixir: 18, 19 and 20.
Add versioned binaries and directories.
Setup an UTF-8 environment so it doesn't complain and 'make test' runs.
diff --git lang/elixir/Makefile lang/elixir/Makefile
index
983cbb11abcc760b4fa2f6be6f49b68e0699ecc7..b1fbbc5cd6c942348a6219ac001b0566e3979315
100644
--- lang/elixir/Makefile
+++ lang/elixir/Makefile
@@ -8,6 +8,7 @@ GH_PROJECT= elixir
GH_TAGNAME=v$V
DISTNAME= ${GH_PROJECT}-$V
CATEGORIES=lang
+REVISION= 0
HOMEPAGE= http://elixir-lang.org/
@@ -17,15 +18,29 @@ MAINTAINER= Jasper Lievisse Adriaanse
PERMIT_PACKAGE_CDROM= Yes
MODULES= lang/erlang
-MODERL_VERSION=19
+
+# Elixir 1.5.x works with erlang 18+.
+# These flavors correspond to entries in lang/erlang/erlang.port.mk
+FLAVOR ?= erlang19
+.if ${FLAVOR:Merlang18} || ${FLAVOR:Merlang19} || ${FLAVOR:Merlang20}
+.else
+ERRORS += "Fatal: Invalid FLAVOR set: ${FLAVOR}"
+.endif
ALL_TARGET=# empty
TEST_TARGET= test
PORTHOME= ${WRKDIR}
+# Elixir expects a UTF-8 environment.
+MAKE_ENV= LC_CTYPE="en_US.UTF-8" \
+ LANG="en_US.UTF-8"
+
MAKE_FLAGS=PREFIX="${PREFIX}" \
- Q=""
+ Q="" \
+ MODERL_VERSION="${MODERL_VERSION}"
+
+SUBST_VARS+= MODERL_VERSION
pre-configure:
${SUBST_CMD} ${WRKSRC}/bin/elixir
diff --git lang/elixir/patches/patch-Makefile lang/elixir/patches/patch-Makefile
index
74aaaba5f63b7b32c8802655ab19e79cab008c0e..0a9681efd82be30f9e106b6e53dc5e8c42121533
100644
--- lang/elixir/patches/patch-Makefile
+++ lang/elixir/patches/patch-Makefile
@@ -1,8 +1,81 @@
$OpenBSD: patch-Makefile,v 1.1 2017/01/07 13:21:50 jasper Exp $
Makefile.orig Sat Jan 7 14:14:00 2017
-+++ Makefile Sat Jan 7 14:18:37 2017
-@@ -251,9 +251,9 @@ clean_man:
- rm -f man/iex.1
+Index: Makefile
+--- Makefile.orig
Makefile
+@@ -3,8 +3,10 @@ PREFIX ?= /usr/local
+ SHARE_PREFIX ?= $(PREFIX)/share
+ CANONICAL := v1.5/
+ ELIXIRC := bin/elixirc --verbose --ignore-module-conflict
+-ERLC := erlc -I lib/elixir/include
+-ERL := erl -I lib/elixir/include -noshell -pa lib/elixir/ebin
++ERLC := erlc$(MODERL_VERSION) -I lib/elixir/include
++ERL := erl$(MODERL_VERSION) -I lib/elixir/include -noshell -pa lib/elixir/ebin
++EPMD := epmd$(MODERL_VERSION)
++DIALYZER := dialyzer$(MODERL_VERSION)
+ VERSION := $(strip $(shell cat VERSION))
+ Q := @
+ LIBDIR := lib
+@@ -22,7 +24,7 @@ GIT_TAG = $(strip $(shell head="$(call GIT_REVISION)";
+ #==> Functions
+
+ define CHECK_ERLANG_RELEASE
+- $(Q) erl -noshell -eval '{V,_} =
string:to_integer(erlang:system_info(otp_release)), io:fwrite("~s",
[is_integer(V) and (V >= 18)])' -s erlang halt | grep -q '^true'; \
++ $(Q) erl$(MODERL_VERSION) -noshell -eval '{V,_} =
string:to_integer(erlang:system_info(otp_release)), io:fwrite("~s",
[is_integer(V) and (V >= 18)])' -s erlang halt | grep -q '^true'; \
+ if [ $$? != 0 ]; then \
+ echo "At least Erlang 18.0 is required to build Elixir"; \
+ exit 1; \
+@@ -102,15 +104,15 @@ $(eval $(call APP_TEMPLATE,iex,IEx))
+ install: compile
+ @ echo "==> elixir (install)"
+ $(Q) for dir in lib/*; do \
+- rm -rf $(DESTDIR)$(PREFIX)/$(LIBDIR)/elixir/$$dir/ebin; \
+- $(INSTALL_DIR)
"$(DESTDIR)$(PREFIX)/$(LIBDIR)/elixir/$$dir/ebin"; \
+- $(INSTALL_DATA) $$dir/ebin/*
"$(DESTDIR)$(PREFIX)/$(LIBDIR)/elixir/$$dir/ebin"; \
++ rm -rf
$(DESTDIR)$(PREFIX)/$(LIBDIR)/elixir$(MODERL_VERSION)/$$dir/ebin; \
++ $(INSTALL_DIR)
"$(DESTDIR)$(PREFIX)/$(LIBDIR)/elixir$(MODERL_VERSION)/$$dir/ebin"; \
++ $(INSTALL_DATA) $$dir/ebin/*
"$(DESTDIR)$(PREFIX)/$(LIBDIR)/elixir$(MODERL_VERSION)/$$dir/ebin"; \
+ done
+- $(Q) $(INSTALL_DIR) "$(DESTDIR)$(PREFIX)/$(LIBDIR)/elixir/bin"
+- $(Q) $(INSTALL_PROGRAM) $(filter-out %.ps1, $(filter-out %.bat,
$(wildcard bin/*))) "$(DESTDIR)$(PREFIX)/$(LIBDIR)/elixir/bin"
++ $(Q) $(INSTALL_DIR)
"$(DESTDIR)$(PREFIX)/$(LIBDIR)/elixir$(MODERL_VERSION)/bin"
++ $(Q) $(INSTALL_PROGRAM) $(filter-out %.ps1, $(filter-out %.bat,
$(wildcard bin/*))) "$(DESTDIR)$(PREFIX)/$(LIBDIR)/elixir$(MODERL_VERSION)/bin"
+ $(Q) $(INSTALL_DIR) "$(DESTDIR)$(PREFIX)/$(BINDIR)"
+- $(Q) for file in "$(DESTDIR)$(PREFIX)"/$(LIBDIR)/elixir/bin/*; do \
+- ln -sf "../$(LIBDIR)/elixir/bin/$${file##*/}"
"$(DESTDIR)$(PREFIX)/$(BINDIR)/"; \
++ $(Q) for file in
"$(DESTDIR)$(PREFIX)"/$(LIBDIR)/elixir$(MODERL_VERSION)/bin/*; do \
++ ln -sf "../$(LIBDIR)/elixir$(MODERL_VERSION)/bin/$${file##*/}"
"$(DESTDIR)$(PREFIX)/$(BINDIR)/$${file##*/}$(MODERL_VERSION)"; \
+ done
+ $(MAKE) install_man
+
[update] lang/erlang
I have been working with Jasper to revamp the Erlang port. Add support for Erlang 20.x as an additional FLAVOR. Switch lang/erlang/18 to major release 18.3. Update to the latest patch release for 17.x, 18.x, 19.x and 20.x. Add versioned calls to erl so versioned erlc, dialyzer, etc work. Quiet some of the clang warnings by removing undefined behavior. Reduce differences between the files for each Erlang release. Make all Erlang versions conflict on the pre-versioned Erlang packages. Ensure all PLISTs are using *_VER variables in paths. lang_erlang_20170906.patch.gz Description: application/gunzip
[update] benchmarks/tsung 1.5.1 -> 1.7.0
This updates tsung to 1.7.0 which was released a few days ago.
I tested it with httpd using FLAVOR=erlang19 and tsung_stats.pl.
It also passes 'make test' with erlang 16 and erlang 19.
Note that this requires gnuplot without FLAVOR=no_x11. Is there
a good way to specify that a FLAVOR is invalid in RUN_DEPENDS?
diff --git benchmarks/tsung/Makefile benchmarks/tsung/Makefile
index
ec3e8215aa33974378db7091384200a2b12d0ef6..959886d92e6e96fdf63223c8c48f09a4b954
100644
--- benchmarks/tsung/Makefile
+++ benchmarks/tsung/Makefile
@@ -2,9 +2,8 @@
COMMENT= multi-protocol distributed load testing tool
-V= 1.5.1
+V= 1.7.0
DISTNAME= tsung-$V
-REVISION= 4
CATEGORIES=benchmarks net
@@ -16,17 +15,26 @@ PERMIT_PACKAGE_CDROM= Yes
MASTER_SITES= http://tsung.erlang-projects.org/dist/
MODPY_BUILDDEP=No
+
+# tsung 1.7.0 works with OTP R16B03 and above.
MODULES= lang/erlang \
lang/python
-RUN_DEPENDS= graphics/py-matplotlib \
- math/gnuplot \
- shells/bash
+# tsung_plotter uses py-matplotlib
+# tsung_stats.pl uses 'terminal png' which is not available with
gnuplot-no_x11.
+# tsung_stats.pl uses the module Template.
+# tsung_rrds.pl uses the module RRDs.
+# tsung_percentile.pl uses the module JSON.
+RUN_DEPENDS= graphics/py-matplotlib \
+ math/gnuplot\
+ shells/bash \
+ textproc/p5-Template\
+ net/rrdtool \
+ converters/p5-JSON
CONFIGURE_STYLE= gnu
-CONFIGURE_ENV= HOME=/tmp \
- ERL=${MODERL_ERL} \
- ERLC=${MODERL_ERLC}
+CONFIGURE_ARGS+= --with-erlang=${PREFIX}/lib/erlang${MODERL_VERSION}
+CONFIGURE_ENV= HOME=/tmp
MODPY_ADJ_FILES= src/tsung-plotter/tsplot.py.in
@@ -38,6 +46,10 @@ FAKE_FLAGS=
CONFDIR="${PREFIX}/share/examples/tsung/" \
SUBST_VARS+= V
pre-configure:
- ${SUBST_CMD} ${WRKSRC}/tsung.sh.in ${WRKSRC}/tsung-recorder.sh.in
+ ${SUBST_CMD} ${WRKSRC}/Makefile.in
+
+post-install:
+ ${MODPY_BIN} ${MODPY_LIBDIR}/compileall.py \
+ ${PREFIX}/lib/tsung/tsung_plotter
.include
diff --git benchmarks/tsung/distinfo benchmarks/tsung/distinfo
index
5521fc2328cb6ec29deebdee46fe02049c95d87f..c814b8fcb867e4ec03d5af2558efd266b766d471
100644
--- benchmarks/tsung/distinfo
+++ benchmarks/tsung/distinfo
@@ -1,2 +1,2 @@
-SHA256 (tsung-1.5.1.tar.gz) = VRRX/+idHFt9BksT/oLmv/AFI8zHoANnsK44ytDCKCs=
-SIZE (tsung-1.5.1.tar.gz) = 1422049
+SHA256 (tsung-1.7.0.tar.gz) = Y5REWGDvNPrt+MRtqVo8sga8FzARRbySAVEQf/os5So=
+SIZE (tsung-1.7.0.tar.gz) = 1572265
diff --git benchmarks/tsung/patches/patch-Makefile_in
benchmarks/tsung/patches/patch-Makefile_in
new file mode 100644
index
..b09a5090c9621be242d1f0ac7125438b545521e8
--- /dev/null
+++ benchmarks/tsung/patches/patch-Makefile_in
@@ -0,0 +1,23 @@
+$OpenBSD$
+
+Index: Makefile.in
+--- Makefile.in.orig
Makefile.in
+@@ -17,7 +17,7 @@ USENEWTIMEAPI=@erlang_cv_new_time_api@
+
+ ERLANG_XMERL_DIR=@ERLANG_LIB_DIR_xmerl@/include
+
+-raw_erlang_prefix=@libdir@/erlang/
++raw_erlang_prefix=@libdir@/erlang${MODERL_VERSION}/
+
+ PACKAGE_TARNAME=@PACKAGE_TARNAME@
+
+@@ -91,7 +91,7 @@ DOC_DIR = $(docdir)
+ # custom behaviours
+ BEHAVIORS = $(EBIN)/ts_plugin.beam $(EBIN)/gen_ts_transport.beam
+
+-ERLANG_LIB_DIR = $(libdir)/erlang/lib
++ERLANG_LIB_DIR = $(libdir)/erlang${MODERL_VERSION}/lib
+
+ APPLICATION = tsung
+ CONTROLLER_APPLICATION = tsung_controller
diff --git benchmarks/tsung/patches/patch-src_test_ifcfg_out
benchmarks/tsung/patches/patch-src_test_ifcfg_out
new file mode 100644
index
..d8e44e4c45f7267d750060cac738cbc4af32c402
--- /dev/null
+++ benchmarks/tsung/patches/patch-src_test_ifcfg_out
@@ -0,0 +1,71 @@
+$OpenBSD$
+
+Use a dummy OpenBSD ifconfig output instead of Linux.
+
+Index: src/test/ifcfg.out
+--- src/test/ifcfg.out.orig
src/test/ifcfg.out
+@@ -1,43 +1,20 @@
+-eth0 Link encap:Ethernet HWaddr 68:B5:99:79:71:5C
+- inet addr:192.168.76.183 Bcast:192.168.79.255 Mask:255.255.248.0
+- UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
+- RX packets:2853444 errors:0 dropped:0 overruns:0 frame:0
+- TX packets:1157524 errors:0 dropped:0 overruns:0 carrier:0
+- collisions:0 txqueuelen:1000
+- RX bytes:342116836 (326.2 MiB) TX bytes:147190992 (140.3 MiB)
+- Interrupt:122 Memory:fb00-fb7f
+-
+-eth0:0Link encap:Ethernet HWaddr 68:B5:99:79:71:5C
+- inet addr:192.168.76.184 Bcast:192.168.79.255 Mask:255.255.248.0
+- UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
+- Interrupt:122 Memory:fb00-fb7f
+-
