<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi James,</p>
<br>
<div class="moz-cite-prefix">El 23/02/17 a las 12:57, James Cowgill
escribió:<br>
</div>
<blockquote
cite="mid:040fb7af-32b8-98ca-0b1c-b68ffcd523ee@debian.org"
type="cite">
<pre wrap="">Hi,
On 22/02/17 23:16, Marcos Fouces wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hello
I uploaded to repo a first attempt of libnids1.24 package wich aims to
close its two critical bugs:
#855602: fixed upstream in 1.24 release.
</pre>
</blockquote>
<pre wrap="">
As I wrote in the bugreport, the fix applied by upstream is not enough
to fix this. You also need to apply the patch from Fedora otherwise
dsniff will FTBFS on i386.</pre>
</blockquote>
<br>
I applied the patch you mentioned and after a rebuild of dsniff and
libnids, it still seems to work properly at least on amd64<br>
<br>
Please, check it:<br>
<pre wrap=""><a class="moz-txt-link-freetext" href="https://anonscm.debian.org/cgit/pkg-security/libnids.git">https://anonscm.debian.org/cgit/pkg-security/libnids.git</a>
</pre>
<br>
<blockquote
cite="mid:040fb7af-32b8-98ca-0b1c-b68ffcd523ee@debian.org"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">#851060: i tried using -fno-strict-aliasing flag as reporter indicates.
I didn't noticed any change on my amd64, but he talked about armhf arch.
I built dsniff (1) against this new version of libnids-dev (2) and here
is the result:
* Run dsniff
* Run the same test as bug reporter: curl -v --basic --user foo:bar
<a class="moz-txt-link-freetext" href="http://neverssl.com/">http://neverssl.com/</a>
dsniff says this:
dsniff: listening on eth0
-----------------
02/22/17 23:56:32 tcp 192.168.1.3.47942 ->
s3-website-us-west-2.amazonaws.com.80 (http)
GET / HTTP/1.1
Host: neverssl.com
Authorization: Basic Zm9vOmJhcg== [foo:bar]
</pre>
</blockquote>
<pre wrap="">
So interestingly, after recompiling your new versions of both libnids
and dsniff, things start working again. I'm not sure what happened
before when I couldn't get anything to work.</pre>
</blockquote>
I really don't know, i couldn' t reproduce this bug at any time.<br>
<br>
<blockquote
cite="mid:040fb7af-32b8-98ca-0b1c-b68ffcd523ee@debian.org"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">(1) <a class="moz-txt-link-freetext" href="https://anonscm.debian.org/cgit/pkg-security/dsniff.git">https://anonscm.debian.org/cgit/pkg-security/dsniff.git</a>
</pre>
</blockquote>
<pre wrap="">
For stretch, I don't think dsniff needs to be changed.
</pre>
<blockquote type="cite">
<pre wrap="">(2) <a class="moz-txt-link-freetext" href="https://anonscm.debian.org/cgit/pkg-security/libnids.git">https://anonscm.debian.org/cgit/pkg-security/libnids.git</a>
</pre>
</blockquote>
<pre wrap="">
At the moment Debian is frozen and you've made a number of changes here
which are not sutible for the freeze. These include:
- Packaging a new version of libnids.
- Breaking the ABI of libnids.
- Bumping debhelper compat
For stretch, the fixes need to be targeted so as to only change as much
stuff as necessary to fix the two RC bugs.</pre>
</blockquote>
<br>
I am agree with you, when i fix these bugs i will create a separate
git branch, cherry-pick only freeze-allowed changes and try to get a
package ready for stretch.<br>
<blockquote
cite="mid:040fb7af-32b8-98ca-0b1c-b68ffcd523ee@debian.org"
type="cite">
<pre wrap="">
For buster, can I suggest you rewrite the rules file. I expect it could
be simplified much more using dh.</pre>
</blockquote>
<br>
Sure<br>
<blockquote
cite="mid:040fb7af-32b8-98ca-0b1c-b68ffcd523ee@debian.org"
type="cite">
<pre wrap="">
Looking at the diff from upstream, I can't help but stare in disbelief
at this:
</pre>
<blockquote type="cite">
<pre wrap="">diff --git a/src/hash.c b/src/hash.c
index 7e4c611..3eb28ca 100644
--- a/src/hash.c
+++ b/src/hash.c
@@ -57,7 +57,8 @@ mkhash (u_int src, u_short sport, u_int dest,
</pre>
</blockquote>
<pre wrap="">u_short dport)
</pre>
<blockquote type="cite">
<pre wrap=""> u_int res = 0;
int i;
u_char data[12];
- *(u_int *) (data) = src;
+ u_int *stupid_strict_aliasing_warnings=(u_int*)data;
+ *stupid_strict_aliasing_warnings = src;
*(u_int *) (data + 4) = dest;
*(u_short *) (data + 8) = sport;
*(u_short *) (data + 10) = dport;
</pre>
</blockquote>
<pre wrap="">
A minor note: as someone not part of the pkg-security team, I find it
confusing to have both a "debian/master" and "master" branch in the same
repository both referring to Debian packaging. I think you should remove
the "master" branch (unless this is a team policy?)
Thanks,
James
</pre>
</blockquote>
This is the default behaviour of gbp when creating a repo. In
pkg-security team we don't use it but you can see it in some
packages. Anyway, i deleted it. :-)<br>
<br>
Cheers, <br>
<br>
Marcos<br>
<br>
<blockquote
cite="mid:040fb7af-32b8-98ca-0b1c-b68ffcd523ee@debian.org"
type="cite">
<pre wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">
</pre>
</blockquote>
<br>
</body>
</html>