Issue with Perl 5.38 and fix

[Vark]

[Copied to here as a suggestion to bring to the attention of devs]

Hi,

Following investigation there is a change in Perl 5.38 which breaks LFD (see Debian 12 LFD issues by me in General Discussions).

https://perldoc.perl.org/perldelta#read ... -eof-flags

As soon as one of the log files causes an error (e.g. is simply not present), all future log file reads on any file will fail until the error is cleared.

I solved this by adding a clearerr call before each log read, which is in the LFD file and the function getlogfile (around line 2195 for the function start).

I amended the code as follows:

Code: Select all

 if (!defined($lffd[$lfn]))  {
                if (&openlogfile($logfile,$lfn)) {return undef}
    }

    $lffd[$lfn]->clearerr(); # <-- THIS IS THE NEW LINE

    (undef, $ino, undef, undef, undef, undef, undef, $size, undef) = stat($logfile);

Now LFD reads the log files under Perl 5.38. Not sure if this has any side effects or might occur elsewhere, so use at your own risk. I've not checked but assume a similar fix would be needed anywhere a file open/read could fail as this will now affect all future opens/reads.

[Adambean]

Thank you for this fix Vark. I can very much confirm it appears to work fine within my Debian 12 instances.

--

To make keeping this patch in place more conveniently make a plain text file called "lfd-debian12.patch" as follows:

Code: Select all

--- /usr/sbin/lfd       2023-04-18 10:02:42.000000000 +0000
+++ /usr/sbin/lfd       2023-07-25 19:34:26.000000000 +0000
@@ -2205,6 +2205,8 @@
                if (&openlogfile($logfile,$lfn)) {return undef}
     }

+    $lffd[$lfn]->clearerr();
+
     (undef, $ino, undef, undef, undef, undef, undef, $size, undef) = stat($logfile);

     if ($ino != $lfino[$lfn])  {

You can then apply Vark's fix with the command: `patch /usr/sbin/lfd lfd-debian12.patch`
Don't forget to `csf -ra` to restart CSF+LFD after.

(Obviously you'll need to be working with super user privileges to do that.)

You will almost certainly receive the following email if you have firewall emails turned on:

The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/sbin/lfd: FAILED
/sbin/lfd: FAILED

This is normal. You just made that modification.

[Vark]

Thanks for making the patch file, I'll snarf that back for my use!

Are you seeing the portscan checks working OK? Mine don't seem to, but I'm not sure if that's from this change (or an affect somewhere else), or something I've configured (tho I've got it configured the same as another one on Debian Bullseye that is correctly detecting).

[Vark]

Looking at the changelog for 14.19, this fix has been incorporated into their code

[adamreece-webbox]

haha yeah I noticed this morning. Very splendid!