2.1.30

An audit release. Update — the web application firewall has not been running on any server that installed it.

Fixed​

• The firewall could not read its own master key. hitechcloudwaf -check builds the same state the service does, and building that state generates the key when there is none — so a preflight run as root created a key owned by root, and the service, which runs as its own account, failed every start with "permission denied". On the server where this was found, systemd had counted 12,968 restarts. Nothing said so: the unit restarts always and the panel went on listing the firewall as a feature.

  A check no longer writes anything. The service creates the key on its first real start, as the account it runs as, and native-waf repairs ownership across its whole directory rather than only the per-site files — so a server already in this state fixes itself the next time the firewall is touched.

• The firewall's unit asked systemd not to give up, in a section systemd ignores. StartLimitIntervalSec belongs in [Unit]; in [Service] it is read by nothing, and the default applies instead — five starts in ten seconds and then stop. So it did not retry for ever against the unreadable key, it stopped after ten seconds and stayed stopped, with the unit file saying in plain words that it would keep trying.

• Document Root opened the wrong directory on every application page. The same fault fixed in the domains and FTP tables in 2.1.29, in nineteen more templates and fifty-seven more places: the link was built by removing /var/www/html/ from the front of the document root, which is the container layout. Natively nothing was removed and the path was resolved underneath the account's home a second time, so every one of those links answered "Directory does not exist".

Notes​

Nothing to migrate. The update replaces scripts, binaries and one unit file, then repairs the firewall's ownership and restarts it if it is installed.

On the security scan. Both Go binaries report no vulnerable code paths. Two advisories are present in dependencies and neither has a fixed release: one in gorilla/csrf, whose vulnerable feature this product does not use and whose class was separately fixed in the origin check in 2.1.29; one in golang.org/x/crypto/openpgp, which nothing here imports. The webmail's dependencies are clean. The documentation site carries twenty high findings that all trace to one image-measuring package used at build time, on the site's own images, with no patched version published — recorded rather than worked around.

On the path audit. The two path faults behind this week's bugs were searched for everywhere rather than waited for. The remaining container paths in Go are the translate-then-use pattern, which is safe: a native path is already a host path, so the translation does nothing. It is subtracting a prefix that breaks, and every instance of that is gone.