Development August 2021

development@lists.ipfire.org

11 participants
67 discussions

squid 5.1 gone stable
by Matthias Fischer 23 Aug '21

23 Aug '21

Hi, ...for the records...: ;-) Today I tested building 'squid 5.1' with our usual configure options: ... --with-dl \ --with-filedescriptors=$(( 16384 * 64 )) \ --with-large-files \ --without-gnutls \ ... No errors in '_build.ipfire.log' for this 'squid' - except: ... checking for library containing log... none required configure: forcing default of 1048576 filedescriptors (user-forced) checking Default FD_SETSIZE value... 1024 checking for getrlimit... yes checking for setrlimit... yes checking Maximum number of filedescriptors we can open... 32768 configure: Default number of filedescriptors: 1048576 ... So the maximum number of filedescriptors which are possible for 'squid 5.1' are 32768!? Ok then. I rebuilt the whole thing with the "maximum": ... --with-filedescriptors=32768 \ ... But no change. During starting, 'squid 5.1.' still complains: ... NOTICE: Could not increase the number of filedescriptors With 4096 file descriptors available ... This is the value reported by 'ulimit -n' on my IPFire / Core 158. Currently, only 'squid 4.16' can increase this number under *exactly* the same environment. What consequences could it have, respectively!? Best, Matthias

2 8

What Michael has been working on...
by Michael Tremer 23 Aug '21

23 Aug '21

Hello, Because I have been quiet lately I wanted to update everyone a little bit on what I have been working on in the last couple of weeks. Nothing is a secret, but I have been toying around with a couple of things and they are simply not done, yet, so there is nothing to show, but I still wanted to keep everyone up to date. Project #1: Benchmarks Together with Daniel, I took an entire day to test performance of our appliances. This is something we have done before, but we wanted to know what has changed over the recent software changes, especially with the new kernel. And we have discovered some amazing things that the community seems to have generally confirmed on other hardware, too: The new kernel is a lot faster. We spent most time on the IPFire Mini Appliance, because it is (obviously) the slowest, but also the most commonly bought model. There is a lot of potential here from which plenty of people would benefit. I do not have my notes with me now while writing this email, but generally, we can saturate all interfaces now rather easily using fireperf and we could bring up the throughput of the IPS from only a few mbps to about 120 MBit/s (duplex). This is a little bit of a mile stone because that makes this appliances suitable for a 100 MBit/s connection which it wasn’t really before. We have also experimented a lot with offloading features for network interfaces so that the OS has less work to do which will result in a couple of changes soon. There is a lot more we can do to increase throughput even more (see below). We will soon write up all these benchmark results and put them on the wiki, although we already have lots of patches that will change them again, but we would like to track progress of how much we are improving IPFire. Project #2: IPFire on AWS for ARM IPFire will soon be available on AWS Graviton 2 instances. The code is already done, but the entire product is under review with AWS right now. This going to make IPFire available on a non-Intel/non-AMD-based platform which is exciting and new and also cheaper. I have a little blog post prepared for the release of it and it will strengthen IPFire in the cloud. Project #3: Cake The new kernel is coming with a couple of new features that we can use now and so I started playing around with Cake: https://www.bufferbloat.net/projects/codel/wiki/Cake/ I only changed the “out-of-the box” configuration and did not touch the QoS, yet (lack of time): https://git.ipfire.org/?p=people/ms/ipfire-2.x.git;a=commitdiff;h=dbebf0703… I have also disabled any extra qdiscs on interfaces where it probably does not make too much sense (bridges, GRE/VTI, …). That should save us a couple of CPU cycles again. If anyone wants to deploy this on their systems, I would be happy to hear some feedback. Project #4: Making the IPS 100x faster Then, I have been working with Stefan on making the IPS faster. In our benchmarks, we discovered, that we spent most CPU cycles on copying the data packets from the kernel to the user space. That is a very expensive job and has only gotten worse since we have the Spectre/Meltdown fixes everywhere. However, when the IPS is scanning packets, it cannot always do that very well. For example a TLS connection can be analysed during the handshake, but any traffic coming after that is practically random noise. It is encrypted and one of the goals of TLS is to not give anyone any clue about what might be in the data packet. So why would we send such a packet to suricata in the first place? We shouldn’t. And that is what we have been working on which makes the IPS so much faster because we cut out the bad part that is passing dumb traffic for no reason. We have experimental patches for this, but there is a lot that needs to change for this to work and co-exist with other features that mangle packets, specifically the QoS and NAT. We are working on this and hopefully will be able to send a tech preview soon. Yeah, so this is what I have in the pipeline. FYI. Feedback is of course greatly appreciated. Best, -Michael

1 0

First results from running build without python2
by Adolf Belka 23 Aug '21

23 Aug '21

Hi All, So with crda and the remaining python2 modules removed the question was if removing python2 from the build ran without any problem or if something was flagged up. ca-certificates was flagged up. There is a python2 script, certdata2pem.py, which fails if python2 is not present. Running that script with python3 flags up some invalid syntax, unsurprisingly. I found some patches in Debian from 2015 for certdata2pem.py to provide python3 compatibility. Unfortunately looking at the patch approx half could not be applied because the lines don't exist in the IPFire version of certdata2pem.py (sections to do with blacklisted certs) I then ran the 2to3 converter on certdata2pem.py and tried that in the build but it came up with the following error. TypeError: a bytes-like object is required, not 'str' I don't know how to further move forward with this as I am totally unfamiliar with the python language. Regards, Adolf.

2 22

[PATCH 1/4] ca-certificates: Update to work with python3 version of certdata2pem.py
by Adolf Belka 23 Aug '21

23 Aug '21

- Implement python3 version of certdata2pem.py script from fedora - Modify build.sh to work with python3 script that uses p11-kit based on fedora approach - https://src.fedoraproject.org/rpms/ca-certificates/tree/rawhide - Extraction of cert files now uses p11-kit which requires libtasn1 as a build dependency - Updated rootfile - Updated ca-certificates installed into a vm and confirmed to download a file from an https site with the same results as with existing ca-certfictaes system Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/ca-certificates/build.sh | 48 +++-- config/ca-certificates/certdata2pem.py | 260 ++++++++++++++++++++---- config/rootfiles/common/ca-certificates | 5 +- lfs/ca-certificates | 2 +- 4 files changed, 248 insertions(+), 67 deletions(-) diff --git a/config/ca-certificates/build.sh b/config/ca-certificates/build.sh index c868ed94a..8e64f9e9f 100644 --- a/config/ca-certificates/build.sh +++ b/config/ca-certificates/build.sh @@ -3,13 +3,34 @@ set -e # Create file layout. -mkdir -pv certs certs/legacy-default certs/legacy-disable +mkdir -pv certs +mkdir -pv /etc/pki/ca-trust/source cp certdata.txt certs cd certs -python ../certdata2pem.py +python3 ../certdata2pem.py cd .. + + +cat <<EOF > ca-bundle.trust.p11-kit +# This is a bundle of X.509 certificates of public Certificate +# Authorities. It was generated from the Mozilla root CA list. +# These certificates and trust/distrust attributes use the file format accepted +# by the p11-kit-trust module. +# +# Source: mozilla/security/nss/lib/ckfw/builtins/certdata.txt +# +EOF + + +P11FILES=`find certs -name \*.tmp-p11-kit | wc -l` +if [ $P11FILES -ne 0 ]; then + for p in certs/*.tmp-p11-kit; do + cat "$p" >> /etc/pki/ca-trust/source/ca-bundle.trust.p11-kit + done +fi + cat <<EOF > ca-bundle.crt # This is a bundle of X.509 certificates of public Certificate # Authorities. It was generated from the Mozilla root CA list. @@ -28,24 +49,11 @@ cat <<EOF > ca-bundle.trust.crt # EOF -for f in certs/*.crt; do - [ -z "${f}" ] && continue - - tbits=$(sed -n '/^# openssl-trust/{s/^.*=//;p;}' ${f}) - case "${tbits}" in - *serverAuth*) - openssl x509 -text -in "${f}" >> ca-bundle.crt - ;; - esac +trust extract --comment --filter=certificates --format=openssl-bundle --overwrite ca-bundle.trust +cat ca-bundle.trust >> ca-bundle.trust.crt - if [ -n "$tbits" ]; then - targs="" - for t in ${tbits}; do - targs="${targs} -addtrust ${t}" - done +trust extract --comment --filter=ca-anchors --format=pem-bundle --overwrite --purpose server-auth ca-bundle +cat ca-bundle >> ca-bundle.crt - openssl x509 -text -in "${f}" -trustout $targs >> ca-bundle.trust.crt - fi -done -exit 0 +exit 0 \ No newline at end of file diff --git a/config/ca-certificates/certdata2pem.py b/config/ca-certificates/certdata2pem.py index 44cc9e03b..a52ce9c74 100644 --- a/config/ca-certificates/certdata2pem.py +++ b/config/ca-certificates/certdata2pem.py @@ -26,16 +26,17 @@ import os.path import re import sys import textwrap -import urllib +import urllib.request, urllib.parse, urllib.error +import subprocess objects = [] def printable_serial(obj): - return ".".join(map(lambda x:str(ord(x)), obj['CKA_SERIAL_NUMBER'])) + return ".".join([str(x) for x in obj['CKA_SERIAL_NUMBER']]) # Dirty file parser. in_data, in_multiline, in_obj = False, False, False -field, type, value, obj = None, None, None, dict() +field, ftype, value, binval, obj = None, None, None, bytearray(), dict() for line in open('certdata.txt', 'r'): # Ignore the file header. if not in_data: @@ -55,33 +56,36 @@ for line in open('certdata.txt', 'r'): continue if in_multiline: if not line.startswith('END'): - if type == 'MULTILINE_OCTAL': + if ftype == 'MULTILINE_OCTAL': line = line.strip() for i in re.finditer(r'\\([0-3][0-7][0-7])', line): - value += chr(int(i.group(1), 8)) + integ = int(i.group(1), 8) + binval.extend((integ).to_bytes(1, sys.byteorder)) + obj[field] = binval else: value += line + obj[field] = value continue - obj[field] = value in_multiline = False continue if line.startswith('CKA_CLASS'): in_obj = True line_parts = line.strip().split(' ', 2) if len(line_parts) > 2: - field, type = line_parts[0:2] + field, ftype = line_parts[0:2] value = ' '.join(line_parts[2:]) elif len(line_parts) == 2: - field, type = line_parts + field, ftype = line_parts value = None else: - raise NotImplementedError, 'line_parts < 2 not supported.\n' + line - if type == 'MULTILINE_OCTAL': + raise NotImplementedError('line_parts < 2 not supported.\n' + line) + if ftype == 'MULTILINE_OCTAL': in_multiline = True value = "" + binval = bytearray() continue obj[field] = value -if len(obj.items()) > 0: +if len(list(obj.items())) > 0: objects.append(obj) # Build up trust database. @@ -91,7 +95,7 @@ for obj in objects: continue key = obj['CKA_LABEL'] + printable_serial(obj) trustmap[key] = obj - print " added trust", key + print(" added trust", key) # Build up cert database. certmap = dict() @@ -100,7 +104,7 @@ for obj in objects: continue key = obj['CKA_LABEL'] + printable_serial(obj) certmap[key] = obj - print " added cert", key + print(" added cert", key) def obj_to_filename(obj): label = obj['CKA_LABEL'][1:-1] @@ -109,10 +113,32 @@ def obj_to_filename(obj): .replace('(', '=')\ .replace(')', '=')\ .replace(',', '_') - label = re.sub(r'\\x[0-9a-fA-F]{2}', lambda m:chr(int(m.group(0)[2:], 16)), label) + labelbytes = bytearray() + i = 0 + imax = len(label) + while i < imax: + if i < imax-3 and label[i] == '\\' and label[i+1] == 'x': + labelbytes.extend(bytes.fromhex(label[i+2:i+4])) + i += 4 + continue + labelbytes.extend(str.encode(label[i])) + i = i+1 + continue + label = labelbytes.decode('utf-8') serial = printable_serial(obj) return label + ":" + serial +def write_cert_ext_to_file(f, oid, value, public_key): + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']) + f.write("\n") + f.write("class: x-certificate-extension\n"); + f.write("object-id: " + oid + "\n") + f.write("value: \"" + value + "\"\n") + f.write("modifiable: false\n"); + f.write(public_key) + trust_types = { "CKA_TRUST_DIGITAL_SIGNATURE": "digital-signature", "CKA_TRUST_NON_REPUDIATION": "non-repudiation", @@ -151,34 +177,39 @@ openssl_trust = { "CKA_TRUST_EMAIL_PROTECTION": "emailProtection", } +cert_distrust_types = { + "CKA_NSS_SERVER_DISTRUST_AFTER": "nss-server-distrust-after", + "CKA_NSS_EMAIL_DISTRUST_AFTER": "nss-email-distrust-after", +} + for tobj in objects: if tobj['CKA_CLASS'] == 'CKO_NSS_TRUST': key = tobj['CKA_LABEL'] + printable_serial(tobj) - print "producing trust for " + key + print("producing trust for " + key) trustbits = [] distrustbits = [] openssl_trustflags = [] openssl_distrustflags = [] legacy_trustbits = [] legacy_openssl_trustflags = [] - for t in trust_types.keys(): - if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + for t in list(trust_types.keys()): + if t in tobj and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': trustbits.append(t) if t in openssl_trust: openssl_trustflags.append(openssl_trust[t]) - if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + if t in tobj and tobj[t] == 'CKT_NSS_NOT_TRUSTED': distrustbits.append(t) if t in openssl_trust: openssl_distrustflags.append(openssl_trust[t]) - for t in legacy_trust_types.keys(): - if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + for t in list(legacy_trust_types.keys()): + if t in tobj and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': real_t = legacy_to_real_trust_types[t] legacy_trustbits.append(real_t) if real_t in openssl_trust: legacy_openssl_trustflags.append(openssl_trust[real_t]) - if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED': - raise NotImplementedError, 'legacy distrust not supported.\n' + line + if t in tobj and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + raise NotImplementedError('legacy distrust not supported.\n' + line) fname = obj_to_filename(tobj) try: @@ -186,43 +217,181 @@ for tobj in objects: except: obj = None - if obj != None: - fname += ".crt" - else: - fname += ".p11-kit" + # optional debug code, that dumps the parsed input to files + #fulldump = "dump-" + fname + #dumpf = open(fulldump, 'w') + #dumpf.write(str(obj)); + #dumpf.write(str(tobj)); + #dumpf.close(); is_legacy = 0 - if tobj.has_key('LEGACY_CKA_TRUST_SERVER_AUTH') or tobj.has_key('LEGACY_CKA_TRUST_EMAIL_PROTECTION') or tobj.has_key('LEGACY_CKA_TRUST_CODE_SIGNING'): + if 'LEGACY_CKA_TRUST_SERVER_AUTH' in tobj or 'LEGACY_CKA_TRUST_EMAIL_PROTECTION' in tobj or 'LEGACY_CKA_TRUST_CODE_SIGNING' in tobj: is_legacy = 1 if obj == None: - raise NotImplementedError, 'found legacy trust without certificate.\n' + line - legacy_fname = "legacy-default/" + fname + raise NotImplementedError('found legacy trust without certificate.\n' + line) + + legacy_fname = "legacy-default/" + fname + ".crt" f = open(legacy_fname, 'w') f.write("# alias=%s\n"%tobj['CKA_LABEL']) f.write("# trust=" + " ".join(legacy_trustbits) + "\n") if legacy_openssl_trustflags: f.write("# openssl-trust=" + " ".join(legacy_openssl_trustflags) + "\n") f.write("-----BEGIN CERTIFICATE-----\n") - f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + f.write("\n".join(temp_wrapped)) f.write("\n-----END CERTIFICATE-----\n") f.close() - if tobj.has_key('CKA_TRUST_SERVER_AUTH') or tobj.has_key('CKA_TRUST_EMAIL_PROTECTION') or tobj.has_key('CKA_TRUST_CODE_SIGNING'): - fname = "legacy-disable/" + fname - else: - continue + if 'CKA_TRUST_SERVER_AUTH' in tobj or 'CKA_TRUST_EMAIL_PROTECTION' in tobj or 'CKA_TRUST_CODE_SIGNING' in tobj: + legacy_fname = "legacy-disable/" + fname + ".crt" + f = open(legacy_fname, 'w') + f.write("# alias=%s\n"%tobj['CKA_LABEL']) + f.write("# trust=" + " ".join(trustbits) + "\n") + if openssl_trustflags: + f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") + f.write("-----BEGIN CERTIFICATE-----\n") + f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + f.write("\n-----END CERTIFICATE-----\n") + f.close() + + # don't produce p11-kit output for legacy certificates + continue + + pk = '' + cert_comment = '' + if obj != None: + # must extract the public key from the cert, let's use openssl + cert_fname = "cert-" + fname + fc = open(cert_fname, 'w') + fc.write("-----BEGIN CERTIFICATE-----\n") + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + fc.write("\n".join(temp_wrapped)) + fc.write("\n-----END CERTIFICATE-----\n") + fc.close(); + pk_fname = "pubkey-" + fname + fpkout = open(pk_fname, "w") + dump_pk_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-pubkey"] + subprocess.call(dump_pk_command, stdout=fpkout) + fpkout.close() + with open (pk_fname, "r") as myfile: + pk=myfile.read() + # obtain certificate information suitable as a comment + comment_fname = "comment-" + fname + fcout = open(comment_fname, "w") + comment_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-text"] + subprocess.call(comment_command, stdout=fcout) + fcout.close() + sed_command = ["sed", "--in-place", "s/^/#/", comment_fname] + subprocess.call(sed_command) + with open (comment_fname, "r", errors = 'replace') as myfile: + cert_comment=myfile.read() + + fname += ".tmp-p11-kit" f = open(fname, 'w') + if obj != None: - f.write("# alias=%s\n"%tobj['CKA_LABEL']) - f.write("# trust=" + " ".join(trustbits) + "\n") - f.write("# distrust=" + " ".join(distrustbits) + "\n") - if openssl_trustflags: - f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") - if openssl_distrustflags: - f.write("# openssl-distrust=" + " ".join(openssl_distrustflags) + "\n") + is_distrusted = False + has_server_trust = False + has_email_trust = False + has_code_trust = False + + if 'CKA_TRUST_SERVER_AUTH' in tobj: + if tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_server_trust = True + + if 'CKA_TRUST_EMAIL_PROTECTION' in tobj: + if tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_email_trust = True + + if 'CKA_TRUST_CODE_SIGNING' in tobj: + if tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_code_trust = True + + if is_distrusted: + trust_ext_oid = "1.3.6.1.4.1.3319.6.10.1" + trust_ext_value = "0.%06%0a%2b%06%01%04%01%99w%06%0a%01%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + write_cert_ext_to_file(f, trust_ext_oid, trust_ext_value, pk) + + trust_ext_oid = "2.5.29.37" + if has_server_trust: + if has_email_trust: + if has_code_trust: + # server + email + code + trust_ext_value = "0%2a%06%03U%1d%25%01%01%ff%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + else: + # server + email + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01" + else: + if has_code_trust: + # server + code + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + else: + # server + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%01" + else: + if has_email_trust: + if has_code_trust: + # email + code + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%03" + else: + # email + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%04" + else: + if has_code_trust: + # code + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%03" + else: + # none + trust_ext_value = "0%18%06%03U%1d%25%01%01%ff%04%0e0%0c%06%0a%2b%06%01%04%01%99w%06%0a%10" + + # no 2.5.29.37 for neutral certificates + if (is_distrusted or has_server_trust or has_email_trust or has_code_trust): + write_cert_ext_to_file(f, trust_ext_oid, trust_ext_value, pk) + + pk = '' + f.write("\n") + + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']) + f.write("\n") + if is_distrusted: + f.write("x-distrusted: true\n") + elif has_server_trust or has_email_trust or has_code_trust: + f.write("trusted: true\n") + else: + f.write("trusted: false\n") + + # requires p11-kit >= 0.23.4 + f.write("nss-mozilla-ca-policy: true\n") + f.write("modifiable: false\n"); + + # requires p11-kit >= 0.23.19 + for t in list(cert_distrust_types.keys()): + if t in obj: + value = obj[t] + if value == 'CK_FALSE': + value = bytearray(1) + f.write(cert_distrust_types[t] + ": \"") + f.write(urllib.parse.quote(value)); + f.write("\"\n") + f.write("-----BEGIN CERTIFICATE-----\n") - f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + f.write("\n".join(temp_wrapped)) f.write("\n-----END CERTIFICATE-----\n") + f.write(cert_comment) + f.write("\n") + else: f.write("[p11-kit-object-v1]\n") f.write("label: "); @@ -230,14 +399,15 @@ for tobj in objects: f.write("\n") f.write("class: certificate\n") f.write("certificate-type: x-509\n") + f.write("modifiable: false\n"); f.write("issuer: \""); - f.write(urllib.quote(tobj['CKA_ISSUER'])); + f.write(urllib.parse.quote(tobj['CKA_ISSUER'])); f.write("\"\n") f.write("serial-number: \""); - f.write(urllib.quote(tobj['CKA_SERIAL_NUMBER'])); + f.write(urllib.parse.quote(tobj['CKA_SERIAL_NUMBER'])); f.write("\"\n") if (tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED'): f.write("x-distrusted: true\n") f.write("\n\n") f.close() - print " -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags) + print(" -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags)) diff --git a/config/rootfiles/common/ca-certificates b/config/rootfiles/common/ca-certificates index 087c3e450..06eb66f3b 100644 --- a/config/rootfiles/common/ca-certificates +++ b/config/rootfiles/common/ca-certificates @@ -1,4 +1,7 @@ +#etc/pki +#etc/pki/ca-trust +#etc/pki/ca-trust/source +etc/pki/ca-trust/source/ca-bundle.trust.p11-kit etc/ssl/cert.pem -#etc/ssl/certs etc/ssl/certs/ca-bundle.crt etc/ssl/certs/ca-bundle.trust.crt diff --git a/lfs/ca-certificates b/lfs/ca-certificates index f3c68a7c0..9e37687da 100644 --- a/lfs/ca-certificates +++ b/lfs/ca-certificates @@ -24,7 +24,7 @@ include Config -VER = 20210611 +VER = 20210819 THISAPP = ca-certificates DIR_APP = $(DIR_SRC)/$(THISAPP) -- 2.33.0

2 7

[PATCH] collectd: disable python to allow build without python2
by Adolf Belka 23 Aug '21

23 Aug '21

- Added python to ./configure disable line - Added --disable-static to ./configure Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/collectd | 74 ++------------------------------ lfs/collectd | 3 +- 2 files changed, 5 insertions(+), 72 deletions(-) diff --git a/config/rootfiles/common/collectd b/config/rootfiles/common/collectd index 277f2c88f..73b9cfed0 100644 --- a/config/rootfiles/common/collectd +++ b/config/rootfiles/common/collectd @@ -3,7 +3,6 @@ etc/collectd.custom etc/collectd.precache etc/collectd.thermal etc/collectd.vpn -etc/rc.d/init.d/collectd etc/rc.d/rc0.d/K50collectd etc/rc.d/rc3.d/S29collectd etc/rc.d/rc6.d/K50collectd @@ -13,204 +12,136 @@ etc/rc.d/rc6.d/K50collectd #usr/include/collectd/client.h #usr/include/collectd/lcc_features.h #usr/lib/collectd -#usr/lib/collectd/apache.a #usr/lib/collectd/apache.la usr/lib/collectd/apache.so -#usr/lib/collectd/apcups.a #usr/lib/collectd/apcups.la usr/lib/collectd/apcups.so -#usr/lib/collectd/ascent.a #usr/lib/collectd/ascent.la usr/lib/collectd/ascent.so -#usr/lib/collectd/battery.a #usr/lib/collectd/battery.la usr/lib/collectd/battery.so -#usr/lib/collectd/bind.a #usr/lib/collectd/bind.la usr/lib/collectd/bind.so -#usr/lib/collectd/conntrack.a #usr/lib/collectd/conntrack.la usr/lib/collectd/conntrack.so -#usr/lib/collectd/contextswitch.a #usr/lib/collectd/contextswitch.la usr/lib/collectd/contextswitch.so -#usr/lib/collectd/cpu.a #usr/lib/collectd/cpu.la usr/lib/collectd/cpu.so -#usr/lib/collectd/cpufreq.a #usr/lib/collectd/cpufreq.la usr/lib/collectd/cpufreq.so -#usr/lib/collectd/curl.a #usr/lib/collectd/curl.la usr/lib/collectd/curl.so -#usr/lib/collectd/curl_xml.a #usr/lib/collectd/curl_xml.la usr/lib/collectd/curl_xml.so -#usr/lib/collectd/df.a #usr/lib/collectd/df.la usr/lib/collectd/df.so -#usr/lib/collectd/disk.a #usr/lib/collectd/disk.la usr/lib/collectd/disk.so -#usr/lib/collectd/dns.a #usr/lib/collectd/dns.la usr/lib/collectd/dns.so -#usr/lib/collectd/email.a #usr/lib/collectd/email.la usr/lib/collectd/email.so -#usr/lib/collectd/entropy.a #usr/lib/collectd/entropy.la usr/lib/collectd/entropy.so -#usr/lib/collectd/exec.a #usr/lib/collectd/exec.la usr/lib/collectd/exec.so -#usr/lib/collectd/filecount.a #usr/lib/collectd/filecount.la usr/lib/collectd/filecount.so -#usr/lib/collectd/fscache.a #usr/lib/collectd/fscache.la usr/lib/collectd/fscache.so -#usr/lib/collectd/hddtemp.a #usr/lib/collectd/hddtemp.la usr/lib/collectd/hddtemp.so -#usr/lib/collectd/interface.a #usr/lib/collectd/interface.la usr/lib/collectd/interface.so -#usr/lib/collectd/iptables.a #usr/lib/collectd/iptables.la usr/lib/collectd/iptables.so -#usr/lib/collectd/irq.a #usr/lib/collectd/irq.la usr/lib/collectd/irq.so -#usr/lib/collectd/load.a #usr/lib/collectd/load.la usr/lib/collectd/load.so -#usr/lib/collectd/logfile.a #usr/lib/collectd/logfile.la usr/lib/collectd/logfile.so -#usr/lib/collectd/madwifi.a #usr/lib/collectd/madwifi.la usr/lib/collectd/madwifi.so -#usr/lib/collectd/match_empty_counter.a #usr/lib/collectd/match_empty_counter.la usr/lib/collectd/match_empty_counter.so -#usr/lib/collectd/match_hashed.a #usr/lib/collectd/match_hashed.la usr/lib/collectd/match_hashed.so -#usr/lib/collectd/match_regex.a #usr/lib/collectd/match_regex.la usr/lib/collectd/match_regex.so -#usr/lib/collectd/match_timediff.a #usr/lib/collectd/match_timediff.la usr/lib/collectd/match_timediff.so -#usr/lib/collectd/match_value.a #usr/lib/collectd/match_value.la usr/lib/collectd/match_value.so -#usr/lib/collectd/memory.a #usr/lib/collectd/memory.la usr/lib/collectd/memory.so -#usr/lib/collectd/multimeter.a #usr/lib/collectd/multimeter.la usr/lib/collectd/multimeter.so -#usr/lib/collectd/network.a #usr/lib/collectd/network.la usr/lib/collectd/network.so -#usr/lib/collectd/nfs.a #usr/lib/collectd/nfs.la usr/lib/collectd/nfs.so -#usr/lib/collectd/ntpd.a #usr/lib/collectd/ntpd.la usr/lib/collectd/ntpd.so -#usr/lib/collectd/olsrd.a #usr/lib/collectd/olsrd.la usr/lib/collectd/olsrd.so -#usr/lib/collectd/openvpn.a #usr/lib/collectd/openvpn.la usr/lib/collectd/openvpn.so -#usr/lib/collectd/ping.a #usr/lib/collectd/ping.la usr/lib/collectd/ping.so -#usr/lib/collectd/powerdns.a #usr/lib/collectd/powerdns.la usr/lib/collectd/powerdns.so -#usr/lib/collectd/processes.a #usr/lib/collectd/processes.la usr/lib/collectd/processes.so -#usr/lib/collectd/protocols.a #usr/lib/collectd/protocols.la usr/lib/collectd/protocols.so -#usr/lib/collectd/python.a -#usr/lib/collectd/python.la -usr/lib/collectd/python.so -#usr/lib/collectd/rrdcached.a #usr/lib/collectd/rrdcached.la usr/lib/collectd/rrdcached.so -#usr/lib/collectd/rrdtool.a #usr/lib/collectd/rrdtool.la usr/lib/collectd/rrdtool.so -#usr/lib/collectd/sensors.a #usr/lib/collectd/sensors.la usr/lib/collectd/sensors.so -#usr/lib/collectd/swap.a #usr/lib/collectd/swap.la usr/lib/collectd/swap.so -#usr/lib/collectd/syslog.a #usr/lib/collectd/syslog.la usr/lib/collectd/syslog.so -#usr/lib/collectd/table.a #usr/lib/collectd/table.la usr/lib/collectd/table.so -#usr/lib/collectd/tail.a #usr/lib/collectd/tail.la usr/lib/collectd/tail.so -#usr/lib/collectd/target_notification.a #usr/lib/collectd/target_notification.la usr/lib/collectd/target_notification.so -#usr/lib/collectd/target_replace.a #usr/lib/collectd/target_replace.la usr/lib/collectd/target_replace.so -#usr/lib/collectd/target_scale.a #usr/lib/collectd/target_scale.la usr/lib/collectd/target_scale.so -#usr/lib/collectd/target_set.a #usr/lib/collectd/target_set.la usr/lib/collectd/target_set.so -#usr/lib/collectd/tcpconns.a #usr/lib/collectd/tcpconns.la usr/lib/collectd/tcpconns.so -#usr/lib/collectd/teamspeak2.a #usr/lib/collectd/teamspeak2.la usr/lib/collectd/teamspeak2.so -#usr/lib/collectd/ted.a #usr/lib/collectd/ted.la usr/lib/collectd/ted.so -#usr/lib/collectd/thermal.a #usr/lib/collectd/thermal.la usr/lib/collectd/thermal.so -#usr/lib/collectd/unixsock.a #usr/lib/collectd/unixsock.la usr/lib/collectd/unixsock.so -#usr/lib/collectd/uptime.a #usr/lib/collectd/uptime.la usr/lib/collectd/uptime.so -#usr/lib/collectd/users.a #usr/lib/collectd/users.la usr/lib/collectd/users.so -#usr/lib/collectd/uuid.a #usr/lib/collectd/uuid.la usr/lib/collectd/uuid.so -#usr/lib/collectd/vmem.a #usr/lib/collectd/vmem.la usr/lib/collectd/vmem.so -#usr/lib/collectd/wireless.a #usr/lib/collectd/wireless.la usr/lib/collectd/wireless.so -#usr/lib/collectd/write_http.a #usr/lib/collectd/write_http.la usr/lib/collectd/write_http.so -#usr/lib/libcollectdclient.a #usr/lib/libcollectdclient.la -usr/lib/libcollectdclient.so +#usr/lib/libcollectdclient.so usr/lib/libcollectdclient.so.0 usr/lib/libcollectdclient.so.0.0.0 #usr/lib/perl5/Collectd @@ -242,5 +173,6 @@ usr/share/collectd/types.db #usr/share/man/man5/collectd-unixsock.5 #usr/share/man/man5/collectd.conf.5 #usr/share/man/man5/types.db.5 -#var/lib/collectd var/ipfire/ovpn/collectd.vpn +#var/lib/collectd +etc/rc.d/init.d/collectd diff --git a/lfs/collectd b/lfs/collectd index 09d8c6fcf..3d8ef33a5 100644 --- a/lfs/collectd +++ b/lfs/collectd @@ -114,12 +114,13 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && ./configure --prefix=/usr --localstatedir=/var \ --disable-{apple_sensors,csv,ipvs,mbmon,memcached,mysql} \ --disable-{netlink,nginx,nut,perl,serial,snmp,tape,vserver,xmms} \ - --disable-{perl,serial,snmp,tape,vserver,xmms} \ + --disable-{perl,serial,snmp,tape,vserver,xmms,python} \ --enable-{apcups,battery,cpu{,freq},df,disk,dns,email,entropy,exec,hddtemp} \ --enable-{interface,iptables,irq,load,logfile,memory,multimeter} \ --enable-{network,nfs,ntpd,ping,processes,rrdtool,sensors,swap,syslog} \ --enable-{tcpconns,unixsock,users,wireless} \ --with-librrd=/usr/share/rrdtool-1.2.30 \ + --disable-static \ --with-fp-layout=nothing cd $(DIR_APP) && make install #collectd-4 does not support parallel build cp -vf $(DIR_SRC)/config/collectd/collectd.* /etc/ -- 2.33.0

2 1

[PATCH] freeradius: Update to 3.0.23 and disable python to allow running without python2
by Adolf Belka 23 Aug '21

23 Aug '21

- Added --without-rlm_python to ./configure to allow running without python2 - Updated rootfile - Updated patch for preventing cert generation during buildtime to work with new version of source code - Update from 3.0.21 to 3.0.23 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/freeradius | 156 ++++++++++++++++-- lfs/freeradius | 7 +- .../freeradius-no-buildtime-cert-gen.patch | 88 ++++------ 3 files changed, 181 insertions(+), 70 deletions(-) diff --git a/config/rootfiles/packages/freeradius b/config/rootfiles/packages/freeradius index bdaf7e135..dc91b9d62 100644 --- a/config/rootfiles/packages/freeradius +++ b/config/rootfiles/packages/freeradius @@ -3,7 +3,7 @@ etc/raddb #etc/raddb/README.rst #etc/raddb/certs #etc/raddb/certs/Makefile -#etc/raddb/certs/README +#etc/raddb/certs/README.md #etc/raddb/certs/bootstrap #etc/raddb/certs/ca.cnf #etc/raddb/certs/client.cnf @@ -29,6 +29,9 @@ etc/raddb #etc/raddb/mods-available/detail.example.com #etc/raddb/mods-available/detail.log #etc/raddb/mods-available/dhcp +#etc/raddb/mods-available/dhcp_files +#etc/raddb/mods-available/dhcp_passwd +#etc/raddb/mods-available/dhcp_sql #etc/raddb/mods-available/dhcp_sqlippool #etc/raddb/mods-available/digest #etc/raddb/mods-available/dynamic_clients @@ -71,9 +74,11 @@ etc/raddb #etc/raddb/mods-available/soh #etc/raddb/mods-available/sometimes #etc/raddb/mods-available/sql +#etc/raddb/mods-available/sql_map #etc/raddb/mods-available/sqlcounter #etc/raddb/mods-available/sqlippool #etc/raddb/mods-available/sradutmp +#etc/raddb/mods-available/totp #etc/raddb/mods-available/unix #etc/raddb/mods-available/unpack #etc/raddb/mods-available/utf8 @@ -85,20 +90,19 @@ etc/raddb #etc/raddb/mods-config/attr_filter/access_challenge #etc/raddb/mods-config/attr_filter/access_reject #etc/raddb/mods-config/attr_filter/accounting_response +#etc/raddb/mods-config/attr_filter/coa #etc/raddb/mods-config/attr_filter/post-proxy #etc/raddb/mods-config/attr_filter/pre-proxy #etc/raddb/mods-config/files #etc/raddb/mods-config/files/accounting #etc/raddb/mods-config/files/authorize +#etc/raddb/mods-config/files/dhcp #etc/raddb/mods-config/files/pre-proxy #etc/raddb/mods-config/perl #etc/raddb/mods-config/perl/example.pl #etc/raddb/mods-config/preprocess #etc/raddb/mods-config/preprocess/hints #etc/raddb/mods-config/preprocess/huntgroups -#etc/raddb/mods-config/python -#etc/raddb/mods-config/python/example.py -#etc/raddb/mods-config/python/radiusd.py #etc/raddb/mods-config/sql #etc/raddb/mods-config/sql/counter #etc/raddb/mods-config/sql/counter/mysql @@ -126,11 +130,39 @@ etc/raddb #etc/raddb/mods-config/sql/cui/sqlite #etc/raddb/mods-config/sql/cui/sqlite/queries.conf #etc/raddb/mods-config/sql/cui/sqlite/schema.sql +#etc/raddb/mods-config/sql/dhcp +#etc/raddb/mods-config/sql/dhcp/mssql +#etc/raddb/mods-config/sql/dhcp/mssql/queries.conf +#etc/raddb/mods-config/sql/dhcp/mssql/schema.sql +#etc/raddb/mods-config/sql/dhcp/mysql +#etc/raddb/mods-config/sql/dhcp/mysql/queries.conf +#etc/raddb/mods-config/sql/dhcp/mysql/schema.sql +#etc/raddb/mods-config/sql/dhcp/mysql/setup.sql +#etc/raddb/mods-config/sql/dhcp/oracle +#etc/raddb/mods-config/sql/dhcp/oracle/queries.conf +#etc/raddb/mods-config/sql/dhcp/oracle/schema.sql +#etc/raddb/mods-config/sql/dhcp/postgresql +#etc/raddb/mods-config/sql/dhcp/postgresql/queries.conf +#etc/raddb/mods-config/sql/dhcp/postgresql/schema.sql +#etc/raddb/mods-config/sql/dhcp/postgresql/setup.sql +#etc/raddb/mods-config/sql/dhcp/sqlite +#etc/raddb/mods-config/sql/dhcp/sqlite/queries.conf +#etc/raddb/mods-config/sql/dhcp/sqlite/schema.sql #etc/raddb/mods-config/sql/ippool #etc/raddb/mods-config/sql/ippool-dhcp +#etc/raddb/mods-config/sql/ippool-dhcp/mssql +#etc/raddb/mods-config/sql/ippool-dhcp/mssql/procedure.sql +#etc/raddb/mods-config/sql/ippool-dhcp/mssql/queries.conf +#etc/raddb/mods-config/sql/ippool-dhcp/mssql/schema.sql #etc/raddb/mods-config/sql/ippool-dhcp/mysql +#etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure-no-skip-locked.sql +#etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure.sql #etc/raddb/mods-config/sql/ippool-dhcp/mysql/queries.conf #etc/raddb/mods-config/sql/ippool-dhcp/mysql/schema.sql +#etc/raddb/mods-config/sql/ippool-dhcp/postgresql +#etc/raddb/mods-config/sql/ippool-dhcp/postgresql/procedure.sql +#etc/raddb/mods-config/sql/ippool-dhcp/postgresql/queries.conf +#etc/raddb/mods-config/sql/ippool-dhcp/postgresql/schema.sql #etc/raddb/mods-config/sql/ippool-dhcp/sqlite #etc/raddb/mods-config/sql/ippool-dhcp/sqlite/queries.conf #etc/raddb/mods-config/sql/ippool-dhcp/sqlite/schema.sql @@ -141,6 +173,7 @@ etc/raddb #etc/raddb/mods-config/sql/ippool/mssql/queries.conf #etc/raddb/mods-config/sql/ippool/mssql/schema.sql #etc/raddb/mods-config/sql/ippool/mysql +#etc/raddb/mods-config/sql/ippool/mysql/procedure-no-skip-locked.sql #etc/raddb/mods-config/sql/ippool/mysql/procedure.sql #etc/raddb/mods-config/sql/ippool/mysql/queries.conf #etc/raddb/mods-config/sql/ippool/mysql/schema.sql @@ -219,6 +252,7 @@ etc/raddb #etc/raddb/mods-enabled/replicate #etc/raddb/mods-enabled/soh #etc/raddb/mods-enabled/sradutmp +#etc/raddb/mods-enabled/totp #etc/raddb/mods-enabled/unix #etc/raddb/mods-enabled/unpack #etc/raddb/mods-enabled/utf8 @@ -256,10 +290,12 @@ etc/raddb #etc/raddb/sites-available/inner-tunnel #etc/raddb/sites-available/originate-coa #etc/raddb/sites-available/proxy-inner-tunnel +#etc/raddb/sites-available/resource-check #etc/raddb/sites-available/robust-proxy-accounting #etc/raddb/sites-available/soh #etc/raddb/sites-available/status #etc/raddb/sites-available/tls +#etc/raddb/sites-available/totp #etc/raddb/sites-available/virtual.example.com #etc/raddb/sites-available/vmps #etc/raddb/sites-enabled @@ -283,6 +319,7 @@ usr/bin/radtest usr/bin/radwho usr/bin/radzap usr/bin/rlm_ippool_tool +#usr/bin/rlm_sqlippool_tool usr/bin/smbencrypt #usr/include/freeradius #usr/include/freeradius/attributes.h @@ -419,9 +456,6 @@ usr/lib/freeradius/rlm_eap_fast.so #usr/lib/freeradius/rlm_eap_gtc.a #usr/lib/freeradius/rlm_eap_gtc.la usr/lib/freeradius/rlm_eap_gtc.so -#usr/lib/freeradius/rlm_eap_leap.a -#usr/lib/freeradius/rlm_eap_leap.la -usr/lib/freeradius/rlm_eap_leap.so #usr/lib/freeradius/rlm_eap_md5.a #usr/lib/freeradius/rlm_eap_md5.la usr/lib/freeradius/rlm_eap_md5.so @@ -491,9 +525,6 @@ usr/lib/freeradius/rlm_perl.so #usr/lib/freeradius/rlm_preprocess.a #usr/lib/freeradius/rlm_preprocess.la usr/lib/freeradius/rlm_preprocess.so -#usr/lib/freeradius/rlm_python.a -#usr/lib/freeradius/rlm_python.la -usr/lib/freeradius/rlm_python.so #usr/lib/freeradius/rlm_radutmp.a #usr/lib/freeradius/rlm_radutmp.la usr/lib/freeradius/rlm_radutmp.so @@ -515,6 +546,9 @@ usr/lib/freeradius/rlm_sometimes.so #usr/lib/freeradius/rlm_sql.a #usr/lib/freeradius/rlm_sql.la usr/lib/freeradius/rlm_sql.so +#usr/lib/freeradius/rlm_sql_map.a +#usr/lib/freeradius/rlm_sql_map.la +usr/lib/freeradius/rlm_sql_map.so #usr/lib/freeradius/rlm_sql_null.a #usr/lib/freeradius/rlm_sql_null.la usr/lib/freeradius/rlm_sql_null.so @@ -526,6 +560,9 @@ usr/lib/freeradius/rlm_sqlcounter.so usr/lib/freeradius/rlm_sqlippool.so #usr/lib/freeradius/rlm_test.a #usr/lib/freeradius/rlm_test.la +#usr/lib/freeradius/rlm_totp.a +#usr/lib/freeradius/rlm_totp.la +usr/lib/freeradius/rlm_totp.so #usr/lib/freeradius/rlm_unix.a #usr/lib/freeradius/rlm_unix.la usr/lib/freeradius/rlm_unix.so @@ -549,6 +586,101 @@ usr/sbin/radmin #usr/share/doc/freeradius/ChangeLog #usr/share/doc/freeradius/Makefile.sphinx #usr/share/doc/freeradius/README +#usr/share/doc/freeradius/antora +#usr/share/doc/freeradius/antora/antora.yml +#usr/share/doc/freeradius/antora/modules +#usr/share/doc/freeradius/antora/modules/ROOT +#usr/share/doc/freeradius/antora/modules/ROOT/assets +#usr/share/doc/freeradius/antora/modules/ROOT/assets/images +#usr/share/doc/freeradius/antora/modules/ROOT/assets/images/favicon.png +#usr/share/doc/freeradius/antora/modules/ROOT/assets/images/favicon.svg +#usr/share/doc/freeradius/antora/modules/ROOT/assets/images/networkradius.png +#usr/share/doc/freeradius/antora/modules/ROOT/nav.adoc +#usr/share/doc/freeradius/antora/modules/ROOT/pages +#usr/share/doc/freeradius/antora/modules/ROOT/pages/directories.adoc +#usr/share/doc/freeradius/antora/modules/ROOT/pages/index.adoc +#usr/share/doc/freeradius/antora/modules/howto +#usr/share/doc/freeradius/antora/modules/howto/nav.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages +#usr/share/doc/freeradius/antora/modules/howto/pages/index.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/enable.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/index.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/policy.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/policy_common_options.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/policy_device_options.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/policy_ippool_access.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/policy_ippool_creation.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/policy_network_options.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/policy_subnet_options.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/prepare.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/test.adoc +#usr/share/doc/freeradius/antora/modules/installation +#usr/share/doc/freeradius/antora/modules/installation/nav.adoc +#usr/share/doc/freeradius/antora/modules/installation/pages +#usr/share/doc/freeradius/antora/modules/installation/pages/dependencies.adoc +#usr/share/doc/freeradius/antora/modules/installation/pages/index.adoc +#usr/share/doc/freeradius/antora/modules/installation/pages/packages.adoc +#usr/share/doc/freeradius/antora/modules/installation/pages/source.adoc +#usr/share/doc/freeradius/antora/modules/installation/pages/upgrade.adoc +#usr/share/doc/freeradius/antora/modules/unlang +#usr/share/doc/freeradius/antora/modules/unlang/nav.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages +#usr/share/doc/freeradius/antora/modules/unlang/pages/attr.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/break.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/case.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition/and.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition/cmp.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition/eq.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition/index.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition/not.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition/operands.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition/or.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition/para.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition/regex.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/condition/return_codes.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/default.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/else.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/elsif.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/foreach.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/group.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/if.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/index.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/keywords.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/list.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/load-balance.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/module.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/module_builtin.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/module_method.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/redundant-load-balance.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/redundant.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/return.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/return_codes.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/switch.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/type +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/all_types.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/double.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/index.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/ip.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/numb.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/string +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/string/backticks.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/string/double.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/string/escaping.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/string/single.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/type/string/unquoted.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/update.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/xlat +#usr/share/doc/freeradius/antora/modules/unlang/pages/xlat/alternation.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/xlat/attribute.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/xlat/builtin.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/xlat/character.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/xlat/index.adoc +#usr/share/doc/freeradius/antora/modules/unlang/pages/xlat/module.adoc +#usr/share/doc/freeradius/antora/modules/unlang/partials +#usr/share/doc/freeradius/antora/modules/unlang/partials/rcode_table.adoc #usr/share/doc/freeradius/bugs #usr/share/doc/freeradius/concepts #usr/share/doc/freeradius/concepts/aaa.rst @@ -557,6 +689,7 @@ usr/sbin/radmin #usr/share/doc/freeradius/configuration/acct_type.rst #usr/share/doc/freeradius/configuration/autz_type.rst #usr/share/doc/freeradius/configuration/configurable_failover.rst +#usr/share/doc/freeradius/configuration/dynamic_home_servers.md #usr/share/doc/freeradius/configuration/load_balance.rst #usr/share/doc/freeradius/configuration/post_auth_type #usr/share/doc/freeradius/configuration/session_type @@ -745,6 +878,7 @@ usr/share/freeradius #usr/share/freeradius/dictionary.cablelabs #usr/share/freeradius/dictionary.cabletron #usr/share/freeradius/dictionary.camiant +#usr/share/freeradius/dictionary.centec #usr/share/freeradius/dictionary.checkpoint #usr/share/freeradius/dictionary.chillispot #usr/share/freeradius/dictionary.cisco @@ -900,6 +1034,7 @@ usr/share/freeradius #usr/share/freeradius/dictionary.t_systems_nova #usr/share/freeradius/dictionary.telebit #usr/share/freeradius/dictionary.telkom +#usr/share/freeradius/dictionary.telrad #usr/share/freeradius/dictionary.terena #usr/share/freeradius/dictionary.trapeze #usr/share/freeradius/dictionary.travelping @@ -968,6 +1103,7 @@ usr/share/freeradius #usr/share/man/man8/radsniff.8 #usr/share/man/man8/radsqlrelay.8 #usr/share/man/man8/rlm_ippool_tool.8 +#usr/share/man/man8/rlm_sqlippool_tool.8 var/ipfire/backup/addons/includes/freeradius var/log/radius #var/log/radius/radacct diff --git a/lfs/freeradius b/lfs/freeradius index b1a139bb6..967a00483 100644 --- a/lfs/freeradius +++ b/lfs/freeradius @@ -24,7 +24,7 @@ include Config -VER = 3.0.21 +VER = 3.0.23 THISAPP = freeradius-server-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = freeradius -PAK_VER = 13 +PAK_VER = 14 DEPS = libtalloc samba @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8b7f794f2ac0d686d9aecfa083a63614 +$(DL_FILE)_MD5 = 7e462b0c069ce04f2cbc60da78627182 install : $(TARGET) @@ -97,6 +97,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --without-rlm_sql_oracle \ --without-rlm_sql_sqlite \ --without-rlm_sql_mysql \ + --without-rlm_python \ LDFLAGS="$(LDFLAGS)" cd $(DIR_APP) && make $(MAKETUNING) diff --git a/src/patches/freeradius-no-buildtime-cert-gen.patch b/src/patches/freeradius-no-buildtime-cert-gen.patch index aa3be6648..c65f72897 100644 --- a/src/patches/freeradius-no-buildtime-cert-gen.patch +++ b/src/patches/freeradius-no-buildtime-cert-gen.patch @@ -1,42 +1,15 @@ -From e6f7c9d4c2af1cda7760ca8155166bb5d4d541d0 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel <ascheel(a)redhat.com> -Date: Wed, 8 May 2019 12:58:02 -0400 -Subject: [PATCH] Don't generate certificates in reproducible builds - -Signed-off-by: Alexander Scheel <ascheel(a)redhat.com> ---- - Make.inc.in | 5 +++++ - configure | 4 ++++ - configure.ac | 3 +++ - raddb/all.mk | 4 ++++ - 4 files changed, 16 insertions(+) - -diff --git a/Make.inc.in b/Make.inc.in -index 0b2cd74de8..8c623cf95c 100644 ---- a/Make.inc.in -+++ b/Make.inc.in -@@ -173,3 +173,8 @@ else - TESTBINDIR = ./$(BUILD_DIR)/bin - TESTBIN = ./$(BUILD_DIR)/bin - endif -+ -+# -+# With reproducible builds, do not generate certificates during installation -+# -+ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@ -diff --git a/configure b/configure -index c2c599c92b..3d4403a844 100755 ---- a/configure -+++ b/configure -@@ -655,6 +655,7 @@ RUSERS +diff -Naur a/configure b/configure +--- a/configure 2021-06-10 16:49:17.000000000 +0200 ++++ b/configure 2021-08-19 11:14:56.964232407 +0200 +@@ -654,6 +654,7 @@ + RUSERS SNMPWALK SNMPGET - PERL +ENABLE_REPRODUCIBLE_BUILDS openssl_version_check_config WITH_DHCP modconfdir -@@ -5586,6 +5587,7 @@ else +@@ -5986,6 +5987,7 @@ fi @@ -44,7 +17,7 @@ index c2c599c92b..3d4403a844 100755 # Check whether --enable-reproducible-builds was given. if test "${enable_reproducible_builds+set}" = set; then : enableval=$enable_reproducible_builds; case "$enableval" in -@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h +@@ -5997,6 +5999,7 @@ ;; *) reproducible_builds=no @@ -52,19 +25,10 @@ index c2c599c92b..3d4403a844 100755 esac fi -@@ -5604,6 +5607,7 @@ fi - - - -+ - CHECKRAD=checkrad - # Extract the first word of "perl", so it can be a program name with args. - set dummy perl; ac_word=$2 -diff --git a/configure.ac b/configure.ac -index a7abf0025a..35b013f4af 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config]) +diff -Naur a/configure.ac b/configure.ac +--- a/configure.ac 2021-06-10 16:49:17.000000000 +0200 ++++ b/configure.ac 2021-08-19 11:17:10.786259778 +0200 +@@ -690,6 +690,7 @@ dnl # dnl # extra argument: --enable-reproducible-builds dnl # @@ -72,7 +36,7 @@ index a7abf0025a..35b013f4af 100644 AC_ARG_ENABLE(reproducible-builds, [AS_HELP_STRING([--enable-reproducible-builds], [ensure the build does not change each time])], -@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds, +@@ -701,8 +702,10 @@ ;; *) reproducible_builds=no @@ -83,22 +47,32 @@ index a7abf0025a..35b013f4af 100644 dnl ############################################################# -diff --git a/raddb/all.mk b/raddb/all.mk -index c966edd657..c8e976a499 100644 ---- a/raddb/all.mk -+++ b/raddb/all.mk -@@ -124,7 +124,11 @@ $(R)$(raddbdir)/users: $(R)$(modconfdir)/files/authorize +diff -Naur a/Make.inc.in b/Make.inc.in +--- a/Make.inc.in 2021-06-10 16:49:17.000000000 +0200 ++++ b/Make.inc.in 2021-08-19 10:56:52.236404050 +0200 +@@ -174,6 +174,10 @@ + TESTBIN = ./$(BUILD_DIR)/bin + endif + ++# ++# With reproducible builds, do not generate certificates during installation ++# ++ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@ + + # + # For creating documentation via doc/all.mk +diff -Naur a/raddb/all.mk b/raddb/all.mk +--- a/raddb/all.mk 2021-06-10 16:49:17.000000000 +0200 ++++ b/raddb/all.mk 2021-08-19 11:18:58.640674802 +0200 +@@ -124,7 +124,11 @@ ifneq "$(LOCAL_CERT_PRODUCTS)" "" $(LOCAL_CERT_PRODUCTS): @echo BOOTSTRAP raddb/certs/ +ifeq "$(ENABLE_REPRODUCIBLE_BUILDS)" "yes" + @$(MAKE) -C $(R)$(raddbdir)/certs/ passwords.mk -+else ++else @$(MAKE) -C $(R)$(raddbdir)/certs/ +endif # Bootstrap is special $(R)$(raddbdir)/certs/bootstrap: | raddb/certs/bootstrap $(LOCAL_CERT_PRODUCTS) --- -2.21.0 - -- 2.33.0

2 1

[PATCH] bind: Update to 9.11.35
by Matthias Fischer 22 Aug '21

22 Aug '21

For details see: https://downloads.isc.org/isc/bind9/9.11.35/RELEASE-NOTES-bind-9.11.35.html "Security Fixes named failed to check the opcode of responses when performing zone refreshes, stub zone updates, and UPDATE forwarding. This could lead to an assertion failure under certain conditions and has been addressed by rejecting responses whose opcode does not match the expected value. [GL #2762] Notes for BIND 9.11.34 This maintenance release of BIND 9.11 contains no significant changes, although some minor updates have been made (for example, to fix build issues on Solaris 11). Notes for BIND 9.11.33 This maintenance release of BIND 9.11 contains no significant changes, although some minor updates have been made (for example, to eliminate compiler warnings emitted by GCC 11)." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 4 ++-- lfs/bind | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 6fb228a5a..2cc6f29b3 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -273,11 +273,11 @@ usr/lib/libbind9.so.161.0.4 #usr/lib/libdns.la #usr/lib/libdns.so usr/lib/libdns.so.1115 -usr/lib/libdns.so.1115.0.0 +usr/lib/libdns.so.1115.0.2 #usr/lib/libisc.la #usr/lib/libisc.so usr/lib/libisc.so.1107 -usr/lib/libisc.so.1107.0.5 +usr/lib/libisc.so.1107.0.7 #usr/lib/libisccc.la #usr/lib/libisccc.so usr/lib/libisccc.so.161 diff --git a/lfs/bind b/lfs/bind index 0545066b7..9ec512067 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.11.32 +VER = 9.11.35 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 0d029dd06ca60c6739c3189c999ef757 +$(DL_FILE)_MD5 = dff5141ccfc05b4b7c0fca811290d39f install : $(TARGET) -- 2.18.0

1 0

[PATCH] glibc: Fix CVE-2021-33574 and follow-up issue
by Michael Tremer 19 Aug '21

19 Aug '21

The mq_notify function has a potential use-after-free issue when using a notification type of SIGEV_THREAD and a thread attribute with a non-default affinity mask. The fix for this introduced a NULL pointer dereference. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/glibc | 4 + ...x-null-pointer-dereference-bug-28213.patch | 40 ++++++++++ ...ead_attr_copy-in-mq_notify-bug-27896.patch | 74 +++++++++++++++++++ 3 files changed, 118 insertions(+) create mode 100644 src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch create mode 100644 src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch diff --git a/lfs/glibc b/lfs/glibc index aa7948aed..5dbc386d7 100644 --- a/lfs/glibc +++ b/lfs/glibc @@ -109,6 +109,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) $(DIR_SRC)/glibc-build && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) @mkdir $(DIR_SRC)/glibc-build + # Security Fixes + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/glibc-localedef-no-archive.patch ifneq "$(TOOLCHAIN)" "1" diff --git a/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch b/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch new file mode 100644 index 000000000..d2083e6e2 --- /dev/null +++ b/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch @@ -0,0 +1,40 @@ +From 27a78fd712c06748737dfa9638fab96ea362fca9 Mon Sep 17 00:00:00 2001 +From: Nikita Popov <npv1310(a)gmail.com> +Date: Mon, 9 Aug 2021 20:17:34 +0530 +Subject: [PATCH] librt: fix NULL pointer dereference (bug 28213) + +Helper thread frees copied attribute on NOTIFY_REMOVED message +received from the OS kernel. Unfortunately, it fails to check whether +copied attribute actually exists (data.attr != NULL). This worked +earlier because free() checks passed pointer before actually +attempting to release corresponding memory. But +__pthread_attr_destroy assumes pointer is not NULL. + +So passing NULL pointer to __pthread_attr_destroy will result in +segmentation fault. This scenario is possible if +notification->sigev_notify_attributes == NULL (which means default +thread attributes should be used). + +Signed-off-by: Nikita Popov <npv1310(a)gmail.com> +Reviewed-by: Siddhesh Poyarekar <siddhesh(a)sourceware.org> +(cherry picked from commit b805aebd42364fe696e417808a700fdb9800c9e8) +--- + sysdeps/unix/sysv/linux/mq_notify.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c +index 6f46d29d1d..1714e1cc5f 100644 +--- a/sysdeps/unix/sysv/linux/mq_notify.c ++++ b/sysdeps/unix/sysv/linux/mq_notify.c +@@ -132,7 +132,7 @@ helper_thread (void *arg) + to wait until it is done with it. */ + (void) __pthread_barrier_wait (&notify_barrier); + } +- else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED) ++ else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED && data.attr != NULL) + { + /* The only state we keep is the copy of the thread attributes. */ + pthread_attr_destroy (data.attr); +-- +2.20.1 + diff --git a/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch b/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch new file mode 100644 index 000000000..f846b37b8 --- /dev/null +++ b/src/patches/glibc-2.33-use-__pthread_attr_copy-in-mq_notify-bug-27896.patch @@ -0,0 +1,74 @@ +From 4b6be914bd3920500a67ef6ca1aa7d1c37e5e859 Mon Sep 17 00:00:00 2001 +From: Andreas Schwab <schwab(a)linux-m68k.org> +Date: Thu, 27 May 2021 12:49:47 +0200 +Subject: [PATCH] Use __pthread_attr_copy in mq_notify (bug 27896) + +Make a deep copy of the pthread attribute object to remove a potential +use-after-free issue. + +(cherry picked from commit 42d359350510506b87101cf77202fefcbfc790cb) +--- + NEWS | 6 ++++++ + sysdeps/unix/sysv/linux/mq_notify.c | 15 ++++++++++----- + 2 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/NEWS b/NEWS +index 0c33a80af9..b9e570b4a4 100644 +--- a/NEWS ++++ b/NEWS +@@ -13,6 +13,12 @@ Major new features: + a dump of information related to IFUNC resolver operation and + glibc-hwcaps subdirectory selection. + ++Security related changes: ++ ++ CVE-2021-33574: The mq_notify function has a potential use-after-free ++ issue when using a notification type of SIGEV_THREAD and a thread ++ attribute with a non-default affinity mask. ++ + The following bugs are resolved with this release: + + [15271] dlfcn function failure after dlmopen terminates process +diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c +index cc575a0cdd..f7ddfe5a6c 100644 +--- a/sysdeps/unix/sysv/linux/mq_notify.c ++++ b/sysdeps/unix/sysv/linux/mq_notify.c +@@ -133,8 +133,11 @@ helper_thread (void *arg) + (void) __pthread_barrier_wait (&notify_barrier); + } + else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED) +- /* The only state we keep is the copy of the thread attributes. */ +- free (data.attr); ++ { ++ /* The only state we keep is the copy of the thread attributes. */ ++ pthread_attr_destroy (data.attr); ++ free (data.attr); ++ } + } + return NULL; + } +@@ -255,8 +258,7 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification) + if (data.attr == NULL) + return -1; + +- memcpy (data.attr, notification->sigev_notify_attributes, +- sizeof (pthread_attr_t)); ++ __pthread_attr_copy (data.attr, notification->sigev_notify_attributes); + } + + /* Construct the new request. */ +@@ -270,7 +272,10 @@ mq_notify (mqd_t mqdes, const struct sigevent *notification) + + /* If it failed, free the allocated memory. */ + if (__glibc_unlikely (retval != 0)) +- free (data.attr); ++ { ++ pthread_attr_destroy (data.attr); ++ free (data.attr); ++ } + + return retval; + } +-- +2.20.1 + -- 2.20.1

1 0

[PATCH] mc: Update to 7.8.27
by Matthias Fischer 17 Aug '21

17 Aug '21

For details see: http://midnight-commander.org/wiki/NEWS-4.8.27 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/mc | 1 + lfs/mc | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/packages/mc b/config/rootfiles/packages/mc index 4c71298a1..1faf7ee76 100644 --- a/config/rootfiles/packages/mc +++ b/config/rootfiles/packages/mc @@ -173,6 +173,7 @@ usr/share/mc/syntax/idl.syntax usr/share/mc/syntax/ini.syntax usr/share/mc/syntax/j.syntax usr/share/mc/syntax/jal.syntax +usr/share/mc/syntax/json.syntax usr/share/mc/syntax/java.syntax usr/share/mc/syntax/js.syntax usr/share/mc/syntax/kotlin.syntax diff --git a/lfs/mc b/lfs/mc index b5498ab24..9ef542bac 100644 --- a/lfs/mc +++ b/lfs/mc @@ -24,7 +24,7 @@ include Config -VER = 4.8.26 +VER = 4.8.27 THISAPP = mc-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = mc -PAK_VER = 21 +PAK_VER = 22 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 3c1f77b71dba1f4eeeedc4276627fed7 +$(DL_FILE)_MD5 = e51cd40a897d9aa01af251d191637ca4 install : $(TARGET) -- 2.18.0

1 1

[PATCH] Patch 'log.dat' to show 'monit' messages in system logs
by Matthias Fischer 16 Aug '21

16 Aug '21

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- html/cgi-bin/logs.cgi/log.dat | 2 ++ 1 file changed, 2 insertions(+) diff --git a/html/cgi-bin/logs.cgi/log.dat b/html/cgi-bin/logs.cgi/log.dat index e467e1d2e..0d6c6722a 100644 --- a/html/cgi-bin/logs.cgi/log.dat +++ b/html/cgi-bin/logs.cgi/log.dat @@ -62,6 +62,7 @@ my %sections = ( 'ipfire' => '(ipfire: )', 'ipsec' => '(ipsec_[\w_]+: |pluto\[.*\]: |charon: |vpnwatch: )', 'kernel' => '(kernel: (?!DROP_))', + 'monit' => '(monit\[.*\]: )', 'ntp' => '(ntpd(?:ate)?\[.*\]: )', 'oinkmaster' => '(oinkmaster\[.*\]: )', 'openvpn' => '(openvpnserver\[.*\]: |.*n2n\[.*\]: )', @@ -91,6 +92,7 @@ my %trsections = ( 'ipfire' => 'IPFire', 'ipsec' => 'IPSec', 'kernel' => "$Lang::tr{'kernel'}", + 'monit' => 'Monit', 'ntp' => 'NTP', 'oinkmaster' => 'Oinkmaster', 'openvpn' => 'OpenVPN', -- 2.18.0

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development August 2021