From 365015c2d54f484b9547f60f4851c2a5a979dc24 Mon Sep 17 00:00:00 2001 From: Alexander Gozman Date: Thu, 7 Apr 2016 10:31:25 +0300 Subject: [PATCH] Support sending rejects via libnet when running under non-root. Since version 1.1.6 libnet handles capabilities correctly. So changing libnet's version checking a little bit should do the trick. --- configure.ac | 13 ++++++++++++- src/detect-parse.c | 2 +- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 7faf9a63cd..e9de6f2d12 100644 --- a/configure.ac +++ b/configure.ac @@ -970,7 +970,9 @@ AC_MSG_CHECKING(for libnet.h version 1.1.x) if test "$LIBNET_INC_DIR" != ""; then - if eval "grep LIBNET_VERSION $LIBNET_INC_DIR/libnet.h | grep -v '1.[[12]]' >/dev/null"; then + LIBNET_VER=`grep LIBNET_VERSION $LIBNET_INC_DIR/libnet.h | grep '1.[[12]]' | sed 's/[[^"]]*"\([[^"]]*\).*/\1/'` + + if test -z "$LIBNET_VER" ; then AC_MSG_RESULT(no) LIBNET_DETECT_FAIL="yes" LIBNET_FAIL_WARN($libnet_dir) @@ -1012,6 +1014,15 @@ fi LIBS="${TMPLIBS}" fi + + # See if we have libnet 1.1.6 or newer - these versions handle capabilities correctly + # Some patched 1.1.4 versions are also good, but it's not guaranteed for all distros. + # + # Details: https://bugzilla.redhat.com/show_bug.cgi?id=589770 + AS_VERSION_COMPARE([LIBNET_VER], [1.1.6], + [], + [AC_DEFINE([HAVE_LIBNET_CAPABILITIES],[1], (libnet_have_capabilities_patch))], + [AC_DEFINE([HAVE_LIBNET_CAPABILITIES],[1], (libnet_have_capabilities_patch))]) fi else LIBNET_DETECT_FAIL="yes" diff --git a/src/detect-parse.c b/src/detect-parse.c index 670dd28879..62e1f49a51 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -751,7 +751,7 @@ static int SigParsePort(const DetectEngineCtx *de_ctx, static int SigParseActionRejectValidate(const char *action) { #ifdef HAVE_LIBNET11 -#ifdef HAVE_LIBCAP_NG +#if defined HAVE_LIBCAP_NG && !defined HAVE_LIBNET_CAPABILITIES if (sc_set_caps == TRUE) { SCLogError(SC_ERR_LIBNET11_INCOMPATIBLE_WITH_LIBCAP_NG, "Libnet 1.1 is " "incompatible with POSIX based capabilities with privs dropping. " -- 2.47.2