net/shadowsocks-libev: Update to 3.1.3
ClosedPublic
Actions

Authored by yuri on Feb 5 2018, 12:29 AM.

Details

Reviewers

tcberner
adamw

Commits

rP461010: MFH: r460962
rP460962: net/shadowsocks-libev: Update to 3.1.3
rP460961: Adding VuXML record for vulnerability CVE-2017-15924 in net/shadowsocks-libev.

Summary

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=225442

maintainer approval is present.

Summary of change logs:

shadowsocks-libev (3.1.3-1) unstable; urgency=medium
- Fix a bug in UDP relay.
shadowsocks-libev (3.1.2-1) unstable; urgency=medium
- Fix a bug in DNS resolver.
- Add new TFO API support.
shadowsocks-libev (3.1.1-1) unstable; urgency=high
- Fix a security issue in ss-manager. (CVE-2017-15924)

Additional port changes:

Added LICENSE_FILE
Changed static library to shared library
Added USE_LDCONFIG
Sorted GH_TUPLE
Added INSTALL_TARGET=install-strip
Added optional shell completion files for BASH and ZSH

Also:

Asked upstream to have a separate configure argument for manpages https://github.com/shadowsocks/shadowsocks-libev/issues/1910

Diff Detail

Repository

rP FreeBSD ports repository

Lint

No Lint Coverage

Unit

No Test Coverage

Build Status

Buildable 14781
Build 14900: arc lint + arc unit

Event Timeline

yuri created this revision.Feb 5 2018, 12:29 AM

Harbormaster completed remote builds in B14781: Diff 38869.Feb 5 2018, 12:29 AM

Herald added a subscriber: mat. · View Herald TranscriptFeb 5 2018, 12:29 AM

yuri edited the summary of this revision. (Show Details)Feb 5 2018, 12:32 AM

yuri edited the summary of this revision. (Show Details)Feb 5 2018, 12:34 AM

yuri edited the summary of this revision. (Show Details)

This will need a VuXML entry and an MFH, no?

In D14200#297812, @adamw wrote:

This will need a VuXML entry and an MFH, no?

FreBSD's VuXML doesn't have an entry for CVE-2017-15924, but it exists in the online database: https://nvd.nist.gov/vuln/detail/CVE-2017-15924

Since it hasn't been added to VuXML before, should anything be done for this now that it is fixed?

In D14200#297813, @yuri wrote:

Since it hasn't been added to VuXML before, should anything be done for this now that it is fixed?

Absolutely. That's the point of VuXML, to alert users who have vulnerable software versions installed.

Added the VuXML entry.

Harbormaster completed remote builds in B14782: Diff 38870.Feb 5 2018, 2:30 AM

Approved, with the changes to the message text.

Be sure to include the MFH field too when you commit.

Nice work on that VuXML entry!

security/vuxml/vuln.xml
73 ↗	(On Diff #38870)	This message is primarily for end-users. Remove the first part and start it at "Improper parsing"...
75 ↗	(On Diff #38870)	... and end it at "UDP traffic."

This revision is now accepted and ready to land.Feb 5 2018, 3:15 AM

Closed by commit rP460962: net/shadowsocks-libev: Update to 3.1.3 (authored by yuri). · Explain WhyFeb 5 2018, 5:10 AM

This revision was automatically updated to reflect the committed changes.

yuri mentioned this in rP460961: Adding VuXML record for vulnerability CVE-2017-15924 in net/shadowsocks-libev..Feb 5 2018, 5:12 AM

mat added inline comments.Feb 5 2018, 10:51 PM

head/net/shadowsocks-libev/Makefile
32 ↗	(On Diff #38873)	Is there a reason the completion are not always enabled ?

adamw added inline comments.Feb 5 2018, 10:55 PM

head/net/shadowsocks-libev/Makefile
32 ↗	(On Diff #38873)	It looked weird and I couldn't connect why. Yuri, @mat is correct. These shouldn't be options at all. They should always be installed.

yuri added inline comments.Feb 5 2018, 11:00 PM

head/net/shadowsocks-libev/Makefile
32 ↗	(On Diff #38873)	I did this on the thinking that completions are extra-options, not necessary in general. Somebody may be using `bash`, but might be preferring to not use completions.

mat added inline comments.Feb 6 2018, 9:24 AM

head/net/shadowsocks-libev/Makefile
32 ↗	(On Diff #38873)	Thank you for your input, this was already considered. Completions should always be installed by default, see Shell Completion Files.