Squid fix CVE-2018-1000024 & CVE-2018-1000027

[andir]

Motivation for this change

fixing CVE-2018-1000024 & CVE-2018-1000027

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.

---

[GrahamcOfBorg]

Failure on x86_64-darwin (full log)

Partial log (click to expand)

Package ‘squid-3.5.27’ in /Users/graham/nix-borg/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-ndnd/pkgs/servers/squid/default.nix:44 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

[GrahamcOfBorg]

Failure on x86_64-darwin (full log)

Partial log (click to expand)

Package ‘squid-3.5.27’ in /Users/graham/nix-borg/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-ndnd/pkgs/servers/squid/default.nix:44 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

[GrahamcOfBorg]

Failure on x86_64-darwin (full log)

Partial log (click to expand)

Package ‘squid-3.5.27’ in /Users/graham/nix-borg/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-ndnd/pkgs/servers/squid/default.nix:44 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

[GrahamcOfBorg]

Failure on x86_64-linux (full log)

Partial log (click to expand)

strip is /nix/store/5qj61lcvzlap87rf6blvf8p577d482bv-binutils-2.28.1/bin/strip
stripping (with command strip and flags -S) in /nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27/libexec  /nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27/bin  /nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27/sbin 
patching script interpreter paths in /nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27
/nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27/libexec/helper-mux.pl: interpreter directive changed from "/usr/bin/perl" to "/nix/store/yxqymnn0m0a4wzx49qxsq6782pw5rppd-perl-5.24.3/bin/perl"
/nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27/libexec/basic_smb_auth.sh: interpreter directive changed from "/bin/sh" to "/nix/store/yq03c2ny43mc24j7dq5riznzb09ddhpq-bash-4.4-p12/bin/sh"
/nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27/libexec/cert_valid.pl: interpreter directive changed from "/usr/bin/perl -w" to "/nix/store/yxqymnn0m0a4wzx49qxsq6782pw5rppd-perl-5.24.3/bin/perl -w"
/nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27/libexec/url_fake_rewrite.sh: interpreter directive changed from "/bin/sh" to "/nix/store/yq03c2ny43mc24j7dq5riznzb09ddhpq-bash-4.4-p12/bin/sh"
checking for references to /tmp/nix-build-squid-3.5.27.drv-0 in /nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27...
moving /nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27/sbin/* to /nix/store/v7hh4cj6g3c1l7l22vvdsmj0ch78hxm8-squid-3.5.27/bin
error: build of ‘/nix/store/y4ysggr9cvb58j0jnaf65ws4f21fjd5z-squid-4.0.23.drv’ failed

[GrahamcOfBorg]

Failure on aarch64-linux (full log)

Partial log (click to expand)

strip is /nix/store/xmpjypwjmp2qi1chs5kr0hacnh161ls4-binutils-2.28.1/bin/strip
stripping (with command strip and flags -S) in /nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27/libexec  /nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27/bin  /nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27/sbin
patching script interpreter paths in /nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27
/nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27/libexec/helper-mux.pl: interpreter directive changed from "/usr/bin/perl" to "/nix/store/qfsjbxlzzcwbv4s8f6xd7dkhz8pp3c2a-perl-5.24.3/bin/perl"
/nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27/libexec/cert_valid.pl: interpreter directive changed from "/usr/bin/perl -w" to "/nix/store/qfsjbxlzzcwbv4s8f6xd7dkhz8pp3c2a-perl-5.24.3/bin/perl -w"
/nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27/libexec/url_fake_rewrite.sh: interpreter directive changed from "/bin/sh" to "/nix/store/7fxbh1yhagvwbdrmdyyy5ghcjhwjndhs-bash-4.4-p12/bin/sh"
/nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27/libexec/basic_smb_auth.sh: interpreter directive changed from "/bin/sh" to "/nix/store/7fxbh1yhagvwbdrmdyyy5ghcjhwjndhs-bash-4.4-p12/bin/sh"
checking for references to /build in /nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27...
moving /nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27/sbin/* to /nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27/bin
error: build of '/nix/store/1gpbinl1qd61k6chq1h6bmikfykilgq5-squid-4.0.23.drv' failed

[GrahamcOfBorg]

Failure on x86_64-darwin (full log)

Partial log (click to expand)

Package ‘squid-3.5.27’ in /private/var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/lnl7-mac/pkgs/servers/squid/default.nix:44 is not supported on ‘x86_64-darwin’, refusing to evaluate.

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

[GrahamcOfBorg]

Success on x86_64-linux (full log)

Partial log (click to expand)

shrinking /nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23/libexec/unlinkd
shrinking /nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23/libexec/ext_file_userip_acl
gzipping man pages under /nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23/share/man/
strip is /nix/store/5qj61lcvzlap87rf6blvf8p577d482bv-binutils-2.28.1/bin/strip
stripping (with command strip and flags -S) in /nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23/libexec  /nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23/bin  /nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23/sbin 
patching script interpreter paths in /nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23
/nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23/libexec/basic_smb_auth.sh: interpreter directive changed from "/bin/sh" to "/nix/store/yq03c2ny43mc24j7dq5riznzb09ddhpq-bash-4.4-p12/bin/sh"
/nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23/libexec/url_fake_rewrite.sh: interpreter directive changed from "/bin/sh" to "/nix/store/yq03c2ny43mc24j7dq5riznzb09ddhpq-bash-4.4-p12/bin/sh"
checking for references to /tmp/nix-build-squid-4.0.23.drv-0 in /nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23...
moving /nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23/sbin/* to /nix/store/7pdfkxabvrzaaynblrky9vp1sxy0nqv5-squid-4.0.23/bin

[GrahamcOfBorg]

Success on aarch64-linux (full log)

Partial log (click to expand)

gzipping man pages under /nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23/share/man/
strip is /nix/store/xmpjypwjmp2qi1chs5kr0hacnh161ls4-binutils-2.28.1/bin/strip
stripping (with command strip and flags -S) in /nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23/libexec  /nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23/bin  /nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23/sbin
patching script interpreter paths in /nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23
/nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23/libexec/url_fake_rewrite.sh: interpreter directive changed from "/bin/sh" to "/nix/store/7fxbh1yhagvwbdrmdyyy5ghcjhwjndhs-bash-4.4-p12/bin/sh"
/nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23/libexec/basic_smb_auth.sh: interpreter directive changed from "/bin/sh" to "/nix/store/7fxbh1yhagvwbdrmdyyy5ghcjhwjndhs-bash-4.4-p12/bin/sh"
checking for references to /build in /nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23...
moving /nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23/sbin/* to /nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23/bin
/nix/store/xd3ql33m1hd2n71fd06hnwnq7kqfjcyj-squid-3.5.27
/nix/store/8a5mmbyrir343hzlfv19k4jf2qfcc4z0-squid-4.0.23