Development March 2022

development@lists.ipfire.org

21 participants
109 discussions

ipblacklist V2
by Rob Brewer 03 Apr '22

03 Apr '22

Hi. I have been looking at Tim FitzGeorge's code for ipblacklist v2 on https://patchwork.ipfire.org/project/ipfire/list/?series=1215 to see if I can help progress its incorporation into IPFire. After I extracted the programs from Patchwork I have been able to build them into my firewall where they are running very successfully. The code on the server seems to be in good shape and apart from a few small patches and additions of a few missing scripts I think it could be successfully introduced into the IPFire code base. I am more than happy to help in seeing this process carried out but need to know if this is acceptable to yourselves. Regards Rob Brewer

5 26

[PATCH] backup: Fix broken globbing expansion
by Michael Tremer 31 Mar '22

31 Mar '22

This patch fixes globbing expansion in the backup include file list which got broken in c7e0d73e7cfd7be95db9d0a5f3392b8241813d5b. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/backup/backup.pl | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/config/backup/backup.pl b/config/backup/backup.pl index a2337cf23..6f9295e94 100644 --- a/config/backup/backup.pl +++ b/config/backup/backup.pl @@ -19,6 +19,8 @@ # # ############################################################################### +shopt -s nullglob + NOW="$(date "+%Y-%m-%d-%H:%M")" list_addons() { @@ -38,10 +40,8 @@ process_includes() { for include in $@; do local file while read -r file; do - for file in ${file}; do - if [ -e "/${file}" ]; then - echo "${file}" - fi + for file in /${file}; do + echo "${file}" done done < "${include}" done | sort -u -- 2.30.2

4 28

[PATCH] Drop rfkill
by Peter Müller 31 Mar '22

31 Mar '22

It has been obsoleted by util-linux. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/rfkill | 2 - lfs/rfkill | 81 ----- make.sh | 1 - src/patches/rfkill-5.0-use_uapi_rfkill.patch | 341 ------------------- 4 files changed, 425 deletions(-) delete mode 100644 config/rootfiles/common/rfkill delete mode 100644 lfs/rfkill delete mode 100644 src/patches/rfkill-5.0-use_uapi_rfkill.patch diff --git a/config/rootfiles/common/rfkill b/config/rootfiles/common/rfkill deleted file mode 100644 index 8887a02f6..000000000 --- a/config/rootfiles/common/rfkill +++ /dev/null @@ -1,2 +0,0 @@ -usr/sbin/rfkill -#usr/share/man/man8/rfkill.8.gz diff --git a/lfs/rfkill b/lfs/rfkill deleted file mode 100644 index bfd4e8516..000000000 --- a/lfs/rfkill +++ /dev/null @@ -1,81 +0,0 @@ -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -############################################################################### -# Definitions -############################################################################### - -include Config - -VER = 0.5 - -THISAPP = rfkill-$(VER) -DL_FILE = $(THISAPP).tar.xz -DL_FROM = $(URL_IPFIRE) -DIR_APP = $(DIR_SRC)/$(THISAPP) -TARGET = $(DIR_INFO)/$(THISAPP) - -############################################################################### -# Top-level Rules -############################################################################### - -objects = $(DL_FILE) - -$(DL_FILE) = $(DL_FROM)/$(DL_FILE) - -$(DL_FILE)_MD5 = ce834c00c049cd86a04ab115c92ef548 - -install : $(TARGET) - -check : $(patsubst %,$(DIR_CHK)/%,$(objects)) - -download :$(patsubst %,$(DIR_DL)/%,$(objects)) - -md5 : $(subst %,%_MD5,$(objects)) - -############################################################################### -# Downloading, checking, md5sum -############################################################################### - -$(patsubst %,$(DIR_CHK)/%,$(objects)) : - @$(CHECK) - -$(patsubst %,$(DIR_DL)/%,$(objects)) : - @$(LOAD) - -$(subst %,%_MD5,$(objects)) : - @$(MD5) - -############################################################################### -# Installation Details -############################################################################### - -$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) - @$(PREBUILD) - @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - - # Apply upstream patches. - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/rfkill-5.0-use_uapi_rfkill.patch - - cd $(DIR_APP) && make $(MAKETUNING) - cd $(DIR_APP) && make install - - @rm -rf $(DIR_APP) - @$(POSTBUILD) diff --git a/make.sh b/make.sh index 2a24f02e3..a34bceb43 100755 --- a/make.sh +++ b/make.sh @@ -1716,7 +1716,6 @@ buildipfire() { lfsmake2 firmware-update lfsmake2 tshark lfsmake2 speedtest-cli - lfsmake2 rfkill lfsmake2 amazon-ssm-agent lfsmake2 libloc lfsmake2 ncdu diff --git a/src/patches/rfkill-5.0-use_uapi_rfkill.patch b/src/patches/rfkill-5.0-use_uapi_rfkill.patch deleted file mode 100644 index 4c3d3e144..000000000 --- a/src/patches/rfkill-5.0-use_uapi_rfkill.patch +++ /dev/null @@ -1,341 +0,0 @@ -From fd06998396d631f028fd8f8d7bcb2b442c578292 Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes(a)sipsolutions.net> -Date: Thu, 8 Jan 2015 09:02:42 +0100 -Subject: use uapi rfkill.h - ---- - rfkill.h | 295 ++------------------------------------------------------------- - 1 file changed, 6 insertions(+), 289 deletions(-) - -diff --git a/rfkill.h b/rfkill.h -index d253b4e..058757f 100644 ---- a/rfkill.h -+++ b/rfkill.h -@@ -1,6 +1,3 @@ --#ifndef __RFKILL_H --#define __RFKILL_H -- - /* - * Copyright (C) 2006 - 2007 Ivo van Doorn - * Copyright (C) 2007 Dmitry Torokhov -@@ -18,6 +15,9 @@ - * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF - * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - */ -+#ifndef _UAPI__RFKILL_H -+#define _UAPI__RFKILL_H -+ - - #include <linux/types.h> - -@@ -29,7 +29,7 @@ - /** - * enum rfkill_type - type of rfkill switch. - * -- * @RFKILL_TYPE_ALL: toggles all switches (userspace only) -+ * @RFKILL_TYPE_ALL: toggles all switches (requests only - not a switch type) - * @RFKILL_TYPE_WLAN: switch is on a 802.11 wireless network device. - * @RFKILL_TYPE_BLUETOOTH: switch is on a bluetooth device. - * @RFKILL_TYPE_UWB: switch is on a ultra wideband device. -@@ -83,7 +83,7 @@ struct rfkill_event { - __u8 type; - __u8 op; - __u8 soft, hard; --} __packed; -+} __attribute__((packed)); - - /* - * We are planning to be backward and forward compatible with changes -@@ -105,288 +105,5 @@ struct rfkill_event { - #define RFKILL_IOCTL_NOINPUT _IO(RFKILL_IOC_MAGIC, RFKILL_IOC_NOINPUT) - - /* and that's all userspace gets */ --#ifdef __KERNEL__ --/* don't allow anyone to use these in the kernel */ --enum rfkill_user_states { -- RFKILL_USER_STATE_SOFT_BLOCKED = RFKILL_STATE_SOFT_BLOCKED, -- RFKILL_USER_STATE_UNBLOCKED = RFKILL_STATE_UNBLOCKED, -- RFKILL_USER_STATE_HARD_BLOCKED = RFKILL_STATE_HARD_BLOCKED, --}; --#undef RFKILL_STATE_SOFT_BLOCKED --#undef RFKILL_STATE_UNBLOCKED --#undef RFKILL_STATE_HARD_BLOCKED -- --#include <linux/kernel.h> --#include <linux/list.h> --#include <linux/mutex.h> --#include <linux/device.h> --#include <linux/leds.h> --#include <linux/err.h> -- --/* this is opaque */ --struct rfkill; -- --/** -- * struct rfkill_ops - rfkill driver methods -- * -- * @poll: poll the rfkill block state(s) -- only assign this method -- * when you need polling. When called, simply call one of the -- * rfkill_set{,_hw,_sw}_state family of functions. If the hw -- * is getting unblocked you need to take into account the return -- * value of those functions to make sure the software block is -- * properly used. -- * @query: query the rfkill block state(s) and call exactly one of the -- * rfkill_set{,_hw,_sw}_state family of functions. Assign this -- * method if input events can cause hardware state changes to make -- * the rfkill core query your driver before setting a requested -- * block. -- * @set_block: turn the transmitter on (blocked == false) or off -- * (blocked == true) -- ignore and return 0 when hard blocked. -- * This callback must be assigned. -- */ --struct rfkill_ops { -- void (*poll)(struct rfkill *rfkill, void *data); -- void (*query)(struct rfkill *rfkill, void *data); -- int (*set_block)(void *data, bool blocked); --}; -- --#if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE) --/** -- * rfkill_alloc - allocate rfkill structure -- * @name: name of the struct -- the string is not copied internally -- * @parent: device that has rf switch on it -- * @type: type of the switch (RFKILL_TYPE_*) -- * @ops: rfkill methods -- * @ops_data: data passed to each method -- * -- * This function should be called by the transmitter driver to allocate an -- * rfkill structure. Returns %NULL on failure. -- */ --struct rfkill * __must_check rfkill_alloc(const char *name, -- struct device *parent, -- const enum rfkill_type type, -- const struct rfkill_ops *ops, -- void *ops_data); -- --/** -- * rfkill_register - Register a rfkill structure. -- * @rfkill: rfkill structure to be registered -- * -- * This function should be called by the transmitter driver to register -- * the rfkill structure. Before calling this function the driver needs -- * to be ready to service method calls from rfkill. -- * -- * If rfkill_init_sw_state() is not called before registration, -- * set_block() will be called to initialize the software blocked state -- * to a default value. -- * -- * If the hardware blocked state is not set before registration, -- * it is assumed to be unblocked. -- */ --int __must_check rfkill_register(struct rfkill *rfkill); -- --/** -- * rfkill_pause_polling(struct rfkill *rfkill) -- * -- * Pause polling -- say transmitter is off for other reasons. -- * NOTE: not necessary for suspend/resume -- in that case the -- * core stops polling anyway -- */ --void rfkill_pause_polling(struct rfkill *rfkill); -- --/** -- * rfkill_resume_polling(struct rfkill *rfkill) -- * -- * Pause polling -- say transmitter is off for other reasons. -- * NOTE: not necessary for suspend/resume -- in that case the -- * core stops polling anyway -- */ --void rfkill_resume_polling(struct rfkill *rfkill); -- -- --/** -- * rfkill_unregister - Unregister a rfkill structure. -- * @rfkill: rfkill structure to be unregistered -- * -- * This function should be called by the network driver during device -- * teardown to destroy rfkill structure. Until it returns, the driver -- * needs to be able to service method calls. -- */ --void rfkill_unregister(struct rfkill *rfkill); -- --/** -- * rfkill_destroy - free rfkill structure -- * @rfkill: rfkill structure to be destroyed -- * -- * Destroys the rfkill structure. -- */ --void rfkill_destroy(struct rfkill *rfkill); -- --/** -- * rfkill_set_hw_state - Set the internal rfkill hardware block state -- * @rfkill: pointer to the rfkill class to modify. -- * @state: the current hardware block state to set -- * -- * rfkill drivers that get events when the hard-blocked state changes -- * use this function to notify the rfkill core (and through that also -- * userspace) of the current state. They should also use this after -- * resume if the state could have changed. -- * -- * You need not (but may) call this function if poll_state is assigned. -- * -- * This function can be called in any context, even from within rfkill -- * callbacks. -- * -- * The function returns the combined block state (true if transmitter -- * should be blocked) so that drivers need not keep track of the soft -- * block state -- which they might not be able to. -- */ --bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked); -- --/** -- * rfkill_set_sw_state - Set the internal rfkill software block state -- * @rfkill: pointer to the rfkill class to modify. -- * @state: the current software block state to set -- * -- * rfkill drivers that get events when the soft-blocked state changes -- * (yes, some platforms directly act on input but allow changing again) -- * use this function to notify the rfkill core (and through that also -- * userspace) of the current state. -- * -- * Drivers should also call this function after resume if the state has -- * been changed by the user. This only makes sense for "persistent" -- * devices (see rfkill_init_sw_state()). -- * -- * This function can be called in any context, even from within rfkill -- * callbacks. -- * -- * The function returns the combined block state (true if transmitter -- * should be blocked). -- */ --bool rfkill_set_sw_state(struct rfkill *rfkill, bool blocked); -- --/** -- * rfkill_init_sw_state - Initialize persistent software block state -- * @rfkill: pointer to the rfkill class to modify. -- * @state: the current software block state to set -- * -- * rfkill drivers that preserve their software block state over power off -- * use this function to notify the rfkill core (and through that also -- * userspace) of their initial state. It should only be used before -- * registration. -- * -- * In addition, it marks the device as "persistent", an attribute which -- * can be read by userspace. Persistent devices are expected to preserve -- * their own state when suspended. -- */ --void rfkill_init_sw_state(struct rfkill *rfkill, bool blocked); -- --/** -- * rfkill_set_states - Set the internal rfkill block states -- * @rfkill: pointer to the rfkill class to modify. -- * @sw: the current software block state to set -- * @hw: the current hardware block state to set -- * -- * This function can be called in any context, even from within rfkill -- * callbacks. -- */ --void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw); -- --/** -- * rfkill_blocked - query rfkill block -- * -- * @rfkill: rfkill struct to query -- */ --bool rfkill_blocked(struct rfkill *rfkill); --#else /* !RFKILL */ --static inline struct rfkill * __must_check --rfkill_alloc(const char *name, -- struct device *parent, -- const enum rfkill_type type, -- const struct rfkill_ops *ops, -- void *ops_data) --{ -- return ERR_PTR(-ENODEV); --} -- --static inline int __must_check rfkill_register(struct rfkill *rfkill) --{ -- if (rfkill == ERR_PTR(-ENODEV)) -- return 0; -- return -EINVAL; --} -- --static inline void rfkill_pause_polling(struct rfkill *rfkill) --{ --} -- --static inline void rfkill_resume_polling(struct rfkill *rfkill) --{ --} -- --static inline void rfkill_unregister(struct rfkill *rfkill) --{ --} -- --static inline void rfkill_destroy(struct rfkill *rfkill) --{ --} -- --static inline bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked) --{ -- return blocked; --} -- --static inline bool rfkill_set_sw_state(struct rfkill *rfkill, bool blocked) --{ -- return blocked; --} -- --static inline void rfkill_init_sw_state(struct rfkill *rfkill, bool blocked) --{ --} -- --static inline void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw) --{ --} -- --static inline bool rfkill_blocked(struct rfkill *rfkill) --{ -- return false; --} --#endif /* RFKILL || RFKILL_MODULE */ -- -- --#ifdef CONFIG_RFKILL_LEDS --/** -- * rfkill_get_led_trigger_name - Get the LED trigger name for the button's LED. -- * This function might return a NULL pointer if registering of the -- * LED trigger failed. Use this as "default_trigger" for the LED. -- */ --const char *rfkill_get_led_trigger_name(struct rfkill *rfkill); -- --/** -- * rfkill_set_led_trigger_name -- set the LED trigger name -- * @rfkill: rfkill struct -- * @name: LED trigger name -- * -- * This function sets the LED trigger name of the radio LED -- * trigger that rfkill creates. It is optional, but if called -- * must be called before rfkill_register() to be effective. -- */ --void rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name); --#else --static inline const char *rfkill_get_led_trigger_name(struct rfkill *rfkill) --{ -- return NULL; --} -- --static inline void --rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name) --{ --} --#endif -- --#endif /* __KERNEL__ */ - --#endif /* RFKILL_H */ -+#endif /* _UAPI__RFKILL_H */ --- -cgit v1.2.1 - -- 2.34.1

1 0

[PATCH] Core Update 166: Drop orphaned convert-ovpn script
by Peter Müller 31 Mar '22

31 Mar '22

This script only appeared in conjunction with Core Update 75, released January 2014. Although it is still being executed while restoring a backup, it would only be effective if anyone tried to restore a backup created before C75. I don't think there is a realistic need to carry this script along any further. In doubt, it might be better to start from scratch again rather than trying to restore an 8 year old backup, expecting everything to be peachy and vanilla with it. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/backup/backup.pl | 5 +-- config/rootfiles/common/aarch64/stage2 | 1 - config/rootfiles/common/armv6l/stage2 | 1 - config/rootfiles/common/x86_64/stage2 | 1 - config/rootfiles/core/166/update.sh | 1 + src/scripts/convert-ovpn | 60 -------------------------- 6 files changed, 2 insertions(+), 67 deletions(-) delete mode 100755 src/scripts/convert-ovpn diff --git a/config/backup/backup.pl b/config/backup/backup.pl index a2337cf23..1582789b6 100644 --- a/config/backup/backup.pl +++ b/config/backup/backup.pl @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2014 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -153,9 +153,6 @@ restore_backup() { # Reload firewall firewallctrl - # Convert old OpenVPN CCD files (CN change, Core Update 75) - convert-ovpn - # Snort to suricata converter. if [ -d "/var/ipfire/snort" ]; then # Run converter diff --git a/config/rootfiles/common/aarch64/stage2 b/config/rootfiles/common/aarch64/stage2 index e7eae625c..352c704d4 100644 --- a/config/rootfiles/common/aarch64/stage2 +++ b/config/rootfiles/common/aarch64/stage2 @@ -92,7 +92,6 @@ usr/local/bin/backupiso usr/local/bin/connscheduler usr/local/bin/consort.sh usr/local/bin/convert-dns-settings -usr/local/bin/convert-ovpn usr/local/bin/convert-to-location usr/local/bin/filesystem-cleanup usr/local/bin/hddshutdown diff --git a/config/rootfiles/common/armv6l/stage2 b/config/rootfiles/common/armv6l/stage2 index 670a99927..198461a01 100644 --- a/config/rootfiles/common/armv6l/stage2 +++ b/config/rootfiles/common/armv6l/stage2 @@ -90,7 +90,6 @@ usr/local/bin/backupiso usr/local/bin/connscheduler usr/local/bin/consort.sh usr/local/bin/convert-dns-settings -usr/local/bin/convert-ovpn usr/local/bin/convert-to-location usr/local/bin/filesystem-cleanup usr/local/bin/hddshutdown diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2 index d07c264b4..b03a7fecf 100644 --- a/config/rootfiles/common/x86_64/stage2 +++ b/config/rootfiles/common/x86_64/stage2 @@ -92,7 +92,6 @@ usr/local/bin/backupiso usr/local/bin/connscheduler usr/local/bin/consort.sh usr/local/bin/convert-dns-settings -usr/local/bin/convert-ovpn usr/local/bin/convert-to-location usr/local/bin/filesystem-cleanup usr/local/bin/hddshutdown diff --git a/config/rootfiles/core/166/update.sh b/config/rootfiles/core/166/update.sh index 1370555b0..99bbe40f4 100644 --- a/config/rootfiles/core/166/update.sh +++ b/config/rootfiles/core/166/update.sh @@ -37,6 +37,7 @@ rm -vf \ /opt/pakfire/pakfire-2007.key \ /usr/bin/mkinitrd \ /usr/lib/dracut \ + /usr/local/bin/convert-ovpn \ /usr/local/bin/ovpn-ccd-convert \ /usr/local/bin/rebuild-initrd diff --git a/src/scripts/convert-ovpn b/src/scripts/convert-ovpn deleted file mode 100755 index 30e754326..000000000 --- a/src/scripts/convert-ovpn +++ /dev/null @@ -1,60 +0,0 @@ -#!/usr/bin/perl - -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### -# # -# This script converts old openvpn ccd files with underscore # -# to files with spaces to make them working with openvpn 2.3 again # -# STEP1: read ovpnconfig and verify cert names # -# STEP2: if neccessary convert ccd file # -# # -############################################################################### - -require '/var/ipfire/general-functions.pl'; - -my %configovpn=(); -my $ccdpath="/var/ipfire/ovpn/ccd/"; -my $ovpnconfig="/var/ipfire/ovpn/ovpnconfig"; - -&General::readhasharray ($ovpnconfig,\%configovpn); - -&check_config(); - -sub check_config { - print "Converting CCD files...\n"; - chdir($ccdpath); - - foreach my $key (sort keys %configovpn){ - # Skip everything else but roadwarrior connections. - next if ($configovpn{$key}[3] ne 'host'); - - # Skip all connections with no space in the CN name. - next if ($configovpn{$key}[2] !~ " "); - - my $ccdname = $configovpn{$key}[2]; - $ccdname =~ tr/ /_/; - - # Rename the CCD file if one with the old format exists. - if (-e "$ccdname") { - print " Renaming $ccdname -> $configovpn{$key}[2]...\n"; - rename($ccdname, $configovpn{$key}[2]); - } - } -} -- 2.34.1

2 3

rfkill (util-linux) vs. rfkill (rfkill)
by Peter Müller 31 Mar '22

31 Mar '22

Hello Michael, commit f5ffdb75cecd18ed9c348fbcff11e888aa325ff1 introduced /usr/sbin/rfkill to the rootfile of util-linux. We already have /usr/sbin/rfkill being served by rfkill. Which one should we keep? Does this mean we can drop the decdicated rfkill package altogether? Thanks, and best regards, Peter Müller

2 1

[PATCH] Tor: Pick up upstream patch for fixing sandbox with glibc >= 2.34
by Peter Müller 31 Mar '22

31 Mar '22

Fixes: #12807 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/tor | 5 ++++- .../Tor-Sandbox-permit-the-clone3-system-call.patch | 13 +++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 src/patches/Tor-Sandbox-permit-the-clone3-system-call.patch diff --git a/lfs/tor b/lfs/tor index 2eb2adcb1..d732bc66e 100644 --- a/lfs/tor +++ b/lfs/tor @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 67 +PAK_VER = 68 DEPS = libseccomp @@ -89,6 +89,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --with-tor-user=tor \ --with-tor-group=tor + # https://bugzilla.ipfire.org/show_bug.cgi?id=12807 + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/Tor-Sandbox-permit-the-clone3-system-call.patch + cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/Tor-Sandbox-permit-the-clone3-system-call.patch b/src/patches/Tor-Sandbox-permit-the-clone3-system-call.patch new file mode 100644 index 000000000..e8c6957f2 --- /dev/null +++ b/src/patches/Tor-Sandbox-permit-the-clone3-system-call.patch @@ -0,0 +1,13 @@ +diff -Naur tor-0.4.6.10.orig/src/lib/sandbox/sandbox.c tor-0.4.6.10/src/lib/sandbox/sandbox.c +--- tor-0.4.6.10.orig/src/lib/sandbox/sandbox.c 2022-03-31 07:17:55.966217291 +0000 ++++ tor-0.4.6.10/src/lib/sandbox/sandbox.c 2022-03-31 07:19:23.730134367 +0000 +@@ -151,6 +151,9 @@ + SCMP_SYS(clock_gettime), + SCMP_SYS(close), + SCMP_SYS(clone), ++#ifdef __NR_clone3 ++ SCMP_SYS(clone3), ++#endif + SCMP_SYS(dup), + SCMP_SYS(epoll_create), + SCMP_SYS(epoll_wait), -- 2.34.1

1 0

[PATCH] zlib: Update to 1.2.12
by Peter Müller 31 Mar '22

31 Mar '22

Full changelog, as retrieved from https://www.zlib.net/ChangeLog.txt : Changes in 1.2.12 (27 Mar 2022) - Cygwin does not have _wopen(), so do not create gzopen_w() there - Permit a deflateParams() parameter change as soon as possible - Limit hash table inserts after switch from stored deflate - Fix bug when window full in deflate_stored() - Fix CLEAR_HASH macro to be usable as a single statement - Avoid a conversion error in gzseek when off_t type too small - Have Makefile return non-zero error code on test failure - Avoid some conversion warnings in gzread.c and gzwrite.c - Update use of errno for newer Windows CE versions - Small speedup to inflate [psumbera] - Return an error if the gzputs string length can't fit in an int - Add address checking in clang to -w option of configure - Don't compute check value for raw inflate if asked to validate - Handle case where inflateSync used when header never processed - Avoid the use of ptrdiff_t - Avoid an undefined behavior of memcpy() in gzappend() - Avoid undefined behaviors of memcpy() in gz*printf() - Avoid an undefined behavior of memcpy() in _tr_stored_block() - Make the names in functions declarations identical to definitions - Remove old assembler code in which bugs have manifested - Fix deflateEnd() to not report an error at start of raw deflate - Add legal disclaimer to README - Emphasize the need to continue decompressing gzip members - Correct the initialization requirements for deflateInit2() - Fix a bug that can crash deflate on some input when using Z_FIXED - Assure that the number of bits for deflatePrime() is valid - Use a structure to make globals in enough.c evident - Use a macro for the printf format of big_t in enough.c - Clean up code style in enough.c, update version - Use inline function instead of macro for index in enough.c - Clarify that prefix codes are counted in enough.c - Show all the codes for the maximum tables size in enough.c - Add gznorm.c example, which normalizes gzip files - Fix the zran.c example to work on a multiple-member gzip file - Add tables for crc32_combine(), to speed it up by a factor of 200 - Add crc32_combine_gen() and crc32_combine_op() for fast combines - Speed up software CRC-32 computation by a factor of 1.5 to 3 - Use atomic test and set, if available, for dynamic CRC tables - Don't bother computing check value after successful inflateSync() - Correct comment in crc32.c - Add use of the ARMv8 crc32 instructions when requested - Use ARM crc32 instructions if the ARM architecture has them - Explicitly note that the 32-bit check values are 32 bits - Avoid adding empty gzip member after gzflush with Z_FINISH - Fix memory leak on error in gzlog.c - Fix error in comment on the polynomial representation of a byte - Clarify gz* function interfaces, referring to parameter names - Change macro name in inflate.c to avoid collision in VxWorks - Correct typo in blast.c - Improve portability of contrib/minizip - Fix indentation in minizip's zip.c - Replace black/white with allow/block. (theresa-m) - minizip warning fix if MAXU32 already defined. (gvollant) - Fix unztell64() in minizip to work past 4GB. (DaniÃ«l HÃ¶rchner) - Clean up minizip to reduce warnings for testing - Add fallthrough comments for gcc - Eliminate use of ULL constants - Separate out address sanitizing from warnings in configure - Remove destructive aspects of make distclean - Check for cc masquerading as gcc or clang in configure - Fix crc32.c to compile local functions only if used Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/zlib | 2 +- lfs/zlib | 8 +- ...ate-on-some-input-when-using-Z_FIXED.patch | 338 ------------------ 3 files changed, 3 insertions(+), 345 deletions(-) delete mode 100644 src/patches/zlib-fix-a-bug-that-can-crash-deflate-on-some-input-when-using-Z_FIXED.patch diff --git a/config/rootfiles/common/zlib b/config/rootfiles/common/zlib index ef52aa5d6..0e01dc00e 100644 --- a/config/rootfiles/common/zlib +++ b/config/rootfiles/common/zlib @@ -1,6 +1,6 @@ lib/libz.so lib/libz.so.1 -lib/libz.so.1.2.11 +lib/libz.so.1.2.12 #usr/include/zconf.h #usr/include/zlib.h #usr/lib/libz.a diff --git a/lfs/zlib b/lfs/zlib index c2386778d..fcddc3a9a 100644 --- a/lfs/zlib +++ b/lfs/zlib @@ -24,7 +24,7 @@ include Config -VER = 1.2.11 +VER = 1.2.12 THISAPP = zlib-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 1c9f62f0778697a09d36121ead88e08e +$(DL_FILE)_MD5 = 5fc414a9726be31427b440b434d05f78 install : $(TARGET) @@ -78,10 +78,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && CROSS_PREFIX=$(CROSS_PREFIX) ./configure --prefix=$(PREFIX) --shared - - # https://www.openwall.com/lists/oss-security/2022/03/24/1 - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/zlib-fix-a-bug-that-can-crash-deflate-on-some-input-when-using-Z_FIXED.patch - cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/zlib-fix-a-bug-that-can-crash-deflate-on-some-input-when-using-Z_FIXED.patch b/src/patches/zlib-fix-a-bug-that-can-crash-deflate-on-some-input-when-using-Z_FIXED.patch deleted file mode 100644 index 2b46bcce5..000000000 --- a/src/patches/zlib-fix-a-bug-that-can-crash-deflate-on-some-input-when-using-Z_FIXED.patch +++ /dev/null @@ -1,338 +0,0 @@ -commit 5c44459c3b28a9bd3283aaceab7c615f8020c531 -Author: Mark Adler <madler(a)alumni.caltech.edu> -Date: Tue Apr 17 22:09:22 2018 -0700 - - Fix a bug that can crash deflate on some input when using Z_FIXED. - - This bug was reported by Danilo Ramos of Eideticom, Inc. It has - lain in wait 13 years before being found! The bug was introduced - in zlib 1.2.2.2, with the addition of the Z_FIXED option. That - option forces the use of fixed Huffman codes. For rare inputs with - a large number of distant matches, the pending buffer into which - the compressed data is written can overwrite the distance symbol - table which it overlays. That results in corrupted output due to - invalid distances, and can result in out-of-bound accesses, - crashing the application. - - The fix here combines the distance buffer and literal/length - buffers into a single symbol buffer. Now three bytes of pending - buffer space are opened up for each literal or length/distance - pair consumed, instead of the previous two bytes. This assures - that the pending buffer cannot overwrite the symbol table, since - the maximum fixed code compressed length/distance is 31 bits, and - since there are four bytes of pending space for every three bytes - of symbol space. - -diff --git a/deflate.c b/deflate.c -index 425babc..19cba87 100644 ---- a/deflate.c -+++ b/deflate.c -@@ -255,11 +255,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, - int wrap = 1; - static const char my_version[] = ZLIB_VERSION; - -- ushf *overlay; -- /* We overlay pending_buf and d_buf+l_buf. This works since the average -- * output size for (length,distance) codes is <= 24 bits. -- */ -- - if (version == Z_NULL || version[0] != my_version[0] || - stream_size != sizeof(z_stream)) { - return Z_VERSION_ERROR; -@@ -329,9 +324,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, - - s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */ - -- overlay = (ushf *) ZALLOC(strm, s->lit_bufsize, sizeof(ush)+2); -- s->pending_buf = (uchf *) overlay; -- s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L); -+ /* We overlay pending_buf and sym_buf. This works since the average size -+ * for length/distance pairs over any compressed block is assured to be 31 -+ * bits or less. -+ * -+ * Analysis: The longest fixed codes are a length code of 8 bits plus 5 -+ * extra bits, for lengths 131 to 257. The longest fixed distance codes are -+ * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest -+ * possible fixed-codes length/distance pair is then 31 bits total. -+ * -+ * sym_buf starts one-fourth of the way into pending_buf. So there are -+ * three bytes in sym_buf for every four bytes in pending_buf. Each symbol -+ * in sym_buf is three bytes -- two for the distance and one for the -+ * literal/length. As each symbol is consumed, the pointer to the next -+ * sym_buf value to read moves forward three bytes. From that symbol, up to -+ * 31 bits are written to pending_buf. The closest the written pending_buf -+ * bits gets to the next sym_buf symbol to read is just before the last -+ * code is written. At that time, 31*(n-2) bits have been written, just -+ * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at -+ * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1 -+ * symbols are written.) The closest the writing gets to what is unread is -+ * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and -+ * can range from 128 to 32768. -+ * -+ * Therefore, at a minimum, there are 142 bits of space between what is -+ * written and what is read in the overlain buffers, so the symbols cannot -+ * be overwritten by the compressed data. That space is actually 139 bits, -+ * due to the three-bit fixed-code block header. -+ * -+ * That covers the case where either Z_FIXED is specified, forcing fixed -+ * codes, or when the use of fixed codes is chosen, because that choice -+ * results in a smaller compressed block than dynamic codes. That latter -+ * condition then assures that the above analysis also covers all dynamic -+ * blocks. A dynamic-code block will only be chosen to be emitted if it has -+ * fewer bits than a fixed-code block would for the same set of symbols. -+ * Therefore its average symbol length is assured to be less than 31. So -+ * the compressed data for a dynamic block also cannot overwrite the -+ * symbols from which it is being constructed. -+ */ -+ -+ s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4); -+ s->pending_buf_size = (ulg)s->lit_bufsize * 4; - - if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL || - s->pending_buf == Z_NULL) { -@@ -340,8 +373,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, - deflateEnd (strm); - return Z_MEM_ERROR; - } -- s->d_buf = overlay + s->lit_bufsize/sizeof(ush); -- s->l_buf = s->pending_buf + (1+sizeof(ush))*s->lit_bufsize; -+ s->sym_buf = s->pending_buf + s->lit_bufsize; -+ s->sym_end = (s->lit_bufsize - 1) * 3; -+ /* We avoid equality with lit_bufsize*3 because of wraparound at 64K -+ * on 16 bit machines and because stored blocks are restricted to -+ * 64K-1 bytes. -+ */ - - s->level = level; - s->strategy = strategy; -@@ -552,7 +589,7 @@ int ZEXPORT deflatePrime (strm, bits, value) - - if (deflateStateCheck(strm)) return Z_STREAM_ERROR; - s = strm->state; -- if ((Bytef *)(s->d_buf) < s->pending_out + ((Buf_size + 7) >> 3)) -+ if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3)) - return Z_BUF_ERROR; - do { - put = Buf_size - s->bi_valid; -@@ -1113,7 +1150,6 @@ int ZEXPORT deflateCopy (dest, source) - #else - deflate_state *ds; - deflate_state *ss; -- ushf *overlay; - - - if (deflateStateCheck(source) || dest == Z_NULL) { -@@ -1133,8 +1169,7 @@ int ZEXPORT deflateCopy (dest, source) - ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte)); - ds->prev = (Posf *) ZALLOC(dest, ds->w_size, sizeof(Pos)); - ds->head = (Posf *) ZALLOC(dest, ds->hash_size, sizeof(Pos)); -- overlay = (ushf *) ZALLOC(dest, ds->lit_bufsize, sizeof(ush)+2); -- ds->pending_buf = (uchf *) overlay; -+ ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4); - - if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL || - ds->pending_buf == Z_NULL) { -@@ -1148,8 +1183,7 @@ int ZEXPORT deflateCopy (dest, source) - zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size); - - ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf); -- ds->d_buf = overlay + ds->lit_bufsize/sizeof(ush); -- ds->l_buf = ds->pending_buf + (1+sizeof(ush))*ds->lit_bufsize; -+ ds->sym_buf = ds->pending_buf + ds->lit_bufsize; - - ds->l_desc.dyn_tree = ds->dyn_ltree; - ds->d_desc.dyn_tree = ds->dyn_dtree; -@@ -1925,7 +1959,7 @@ local block_state deflate_fast(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -@@ -2056,7 +2090,7 @@ local block_state deflate_slow(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -@@ -2131,7 +2165,7 @@ local block_state deflate_rle(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -@@ -2170,7 +2204,7 @@ local block_state deflate_huff(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -diff --git a/deflate.h b/deflate.h -index 23ecdd3..d4cf1a9 100644 ---- a/deflate.h -+++ b/deflate.h -@@ -217,7 +217,7 @@ typedef struct internal_state { - /* Depth of each subtree used as tie breaker for trees of equal frequency - */ - -- uchf *l_buf; /* buffer for literals or lengths */ -+ uchf *sym_buf; /* buffer for distances and literals/lengths */ - - uInt lit_bufsize; - /* Size of match buffer for literals/lengths. There are 4 reasons for -@@ -239,13 +239,8 @@ typedef struct internal_state { - * - I can't count above 4 - */ - -- uInt last_lit; /* running index in l_buf */ -- -- ushf *d_buf; -- /* Buffer for distances. To simplify the code, d_buf and l_buf have -- * the same number of elements. To use different lengths, an extra flag -- * array would be necessary. -- */ -+ uInt sym_next; /* running index in sym_buf */ -+ uInt sym_end; /* symbol table full when sym_next reaches this */ - - ulg opt_len; /* bit length of current block with optimal trees */ - ulg static_len; /* bit length of current block with static trees */ -@@ -325,20 +320,22 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf, - - # define _tr_tally_lit(s, c, flush) \ - { uch cc = (c); \ -- s->d_buf[s->last_lit] = 0; \ -- s->l_buf[s->last_lit++] = cc; \ -+ s->sym_buf[s->sym_next++] = 0; \ -+ s->sym_buf[s->sym_next++] = 0; \ -+ s->sym_buf[s->sym_next++] = cc; \ - s->dyn_ltree[cc].Freq++; \ -- flush = (s->last_lit == s->lit_bufsize-1); \ -+ flush = (s->sym_next == s->sym_end); \ - } - # define _tr_tally_dist(s, distance, length, flush) \ - { uch len = (uch)(length); \ - ush dist = (ush)(distance); \ -- s->d_buf[s->last_lit] = dist; \ -- s->l_buf[s->last_lit++] = len; \ -+ s->sym_buf[s->sym_next++] = dist; \ -+ s->sym_buf[s->sym_next++] = dist >> 8; \ -+ s->sym_buf[s->sym_next++] = len; \ - dist--; \ - s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \ - s->dyn_dtree[d_code(dist)].Freq++; \ -- flush = (s->last_lit == s->lit_bufsize-1); \ -+ flush = (s->sym_next == s->sym_end); \ - } - #else - # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c) -diff --git a/trees.c b/trees.c -index 4f4a650..decaeb7 100644 ---- a/trees.c -+++ b/trees.c -@@ -416,7 +416,7 @@ local void init_block(s) - - s->dyn_ltree[END_BLOCK].Freq = 1; - s->opt_len = s->static_len = 0L; -- s->last_lit = s->matches = 0; -+ s->sym_next = s->matches = 0; - } - - #define SMALLEST 1 -@@ -948,7 +948,7 @@ void ZLIB_INTERNAL _tr_flush_block(s, buf, stored_len, last) - - Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ", - opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len, -- s->last_lit)); -+ s->sym_next / 3)); - - if (static_lenb <= opt_lenb) opt_lenb = static_lenb; - -@@ -1017,8 +1017,9 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc) - unsigned dist; /* distance of matched string */ - unsigned lc; /* match length-MIN_MATCH or unmatched char (if dist==0) */ - { -- s->d_buf[s->last_lit] = (ush)dist; -- s->l_buf[s->last_lit++] = (uch)lc; -+ s->sym_buf[s->sym_next++] = dist; -+ s->sym_buf[s->sym_next++] = dist >> 8; -+ s->sym_buf[s->sym_next++] = lc; - if (dist == 0) { - /* lc is the unmatched char */ - s->dyn_ltree[lc].Freq++; -@@ -1033,30 +1034,7 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc) - s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++; - s->dyn_dtree[d_code(dist)].Freq++; - } -- --#ifdef TRUNCATE_BLOCK -- /* Try to guess if it is profitable to stop the current block here */ -- if ((s->last_lit & 0x1fff) == 0 && s->level > 2) { -- /* Compute an upper bound for the compressed length */ -- ulg out_length = (ulg)s->last_lit*8L; -- ulg in_length = (ulg)((long)s->strstart - s->block_start); -- int dcode; -- for (dcode = 0; dcode < D_CODES; dcode++) { -- out_length += (ulg)s->dyn_dtree[dcode].Freq * -- (5L+extra_dbits[dcode]); -- } -- out_length >>= 3; -- Tracev((stderr,"\nlast_lit %u, in %ld, out ~%ld(%ld%%) ", -- s->last_lit, in_length, out_length, -- 100L - out_length*100L/in_length)); -- if (s->matches < s->last_lit/2 && out_length < in_length/2) return 1; -- } --#endif -- return (s->last_lit == s->lit_bufsize-1); -- /* We avoid equality with lit_bufsize because of wraparound at 64K -- * on 16 bit machines and because stored blocks are restricted to -- * 64K-1 bytes. -- */ -+ return (s->sym_next == s->sym_end); - } - - /* =========================================================================== -@@ -1069,13 +1047,14 @@ local void compress_block(s, ltree, dtree) - { - unsigned dist; /* distance of matched string */ - int lc; /* match length or unmatched char (if dist == 0) */ -- unsigned lx = 0; /* running index in l_buf */ -+ unsigned sx = 0; /* running index in sym_buf */ - unsigned code; /* the code to send */ - int extra; /* number of extra bits to send */ - -- if (s->last_lit != 0) do { -- dist = s->d_buf[lx]; -- lc = s->l_buf[lx++]; -+ if (s->sym_next != 0) do { -+ dist = s->sym_buf[sx++] & 0xff; -+ dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8; -+ lc = s->sym_buf[sx++]; - if (dist == 0) { - send_code(s, lc, ltree); /* send a literal byte */ - Tracecv(isgraph(lc), (stderr," '%c' ", lc)); -@@ -1100,11 +1079,10 @@ local void compress_block(s, ltree, dtree) - } - } /* literal or match pair ? */ - -- /* Check that the overlay between pending_buf and d_buf+l_buf is ok: */ -- Assert((uInt)(s->pending) < s->lit_bufsize + 2*lx, -- "pendingBuf overflow"); -+ /* Check that the overlay between pending_buf and sym_buf is ok: */ -+ Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow"); - -- } while (lx < s->last_lit); -+ } while (sx < s->sym_next); - - send_code(s, END_BLOCK, ltree); - } -- 2.34.1

1 0

[PATCH] networking: Correctly set MTU on all bridges
by Michael Tremer 31 Mar '22

31 Mar '22

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/udev/network-hotplug-bridges | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/config/udev/network-hotplug-bridges b/config/udev/network-hotplug-bridges index 4b8764598..9fded1fd0 100644 --- a/config/udev/network-hotplug-bridges +++ b/config/udev/network-hotplug-bridges @@ -80,11 +80,17 @@ MODE="$(get_value "${ZONE}_MODE")" # The name of the virtual bridge BRIDGE="$(get_value "${ZONE}_DEV")" +MTU="$(get_value "${ZONE}_MTU")" STP="$(get_value "${ZONE}_STP")" STP_PRIORITY="$(get_value "${ZONE}_STP_PRIORITY")" case "${MODE}" in bridge) + # Set default MTU if nothing is set + if [ -z "${MTU}" ]; then + MTU=1500 + fi + # We need to check if $STP_PRIORITY has a valid value if not set it if [ -z "${STP_PRIORITY}" ]; then STP_PRIORITY=16384 @@ -95,7 +101,7 @@ case "${MODE}" in # We need to create the bridge if it doesn't exist, yet if [ ! -d "/sys/class/net/${BRIDGE}" ]; then - ip link add "${BRIDGE}" address "${ADDRESS}" type bridge \ + ip link add "${BRIDGE}" address "${ADDRESS}" mtu "${MTU}" type bridge \ $([ "${STP}" = "on" ] && echo "stp_state 1 priority ${STP_PRIORITY}" ) #ip link set "${BRIDGE}" up fi @@ -105,6 +111,9 @@ case "${MODE}" in iw dev "${INTERFACE}" set type __ap fi + # Attempt to set the MTU + ip link set dev "${INTERFACE}" mtu "${MTU}" + # Attach the physical device logger "Attach ${INTERFACE} to ${BRIDGE}" ip link set dev "${INTERFACE}" master "${BRIDGE}" -- 2.30.2

2 1

[PATCH v2 1/5] unbound-dhcp-leases-bridge: Improve logging
by Michael Tremer 30 Mar '22

30 Mar '22

This improves logging and enables logging to the console. Suggested-by: Anthony Heading <ajrh(a)ajrh.net> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/unbound/unbound-dhcp-leases-bridge | 26 ++++++++++++++++------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/config/unbound/unbound-dhcp-leases-bridge b/config/unbound/unbound-dhcp-leases-bridge index a2df5f101..ce0cb8614 100644 --- a/config/unbound/unbound-dhcp-leases-bridge +++ b/config/unbound/unbound-dhcp-leases-bridge @@ -30,27 +30,37 @@ import re import signal import stat import subprocess +import sys import tempfile import inotify.adapters LOCAL_TTL = 60 -def setup_logging(loglevel=logging.INFO): - log = logging.getLogger("dhcp") +log = logging.getLogger("dhcp") +log.setLevel(logging.DEBUG) + +def setup_logging(daemon=True, loglevel=logging.INFO): log.setLevel(loglevel) + # Log to syslog by default handler = logging.handlers.SysLogHandler(address="/dev/log", facility="daemon") - handler.setLevel(loglevel) + log.addHandler(handler) + # Format everything formatter = logging.Formatter("%(name)s[%(process)d]: %(message)s") handler.setFormatter(formatter) - log.addHandler(handler) + handler.setLevel(loglevel) - return log + # If we are running in foreground, we should write everything to the console, too + if not daemon: + handler = logging.StreamHandler() + log.addHandler(handler) -log = logging.getLogger("dhcp") + handler.setLevel(loglevel) + + return log def ip_address_to_reverse_pointer(address): parts = address.split(".") @@ -579,12 +589,12 @@ if __name__ == "__main__": elif args.verbose >= 2: loglevel = logging.DEBUG - setup_logging(loglevel) + setup_logging(daemon=args.daemon, loglevel=loglevel) bridge = UnboundDHCPLeasesBridge(args.dhcp_leases, args.fix_leases, args.unbound_leases, args.hosts) - ctx = daemon.DaemonContext(detach_process=args.daemon) + ctx = daemon.DaemonContext(detach_process=args.daemon, stderr=sys.stderr) ctx.signal_map = { signal.SIGHUP : bridge.update_dhcp_leases, signal.SIGTERM : bridge.terminate, -- 2.30.2

1 4

[PATCH 1/3] unbound-dhcp-leases-bridge : fix bug 12694 - DHCP hosts not reliably propagated to DNS
by Anthony Heading 30 Mar '22

30 Mar '22

Switch from inotify watching individual files to monitoring the containing directories, as because dhcpd renames its leases file into a backup, monitoring the single inode does not work well. Additionally, python appears to have a bug with replacing expired inotify watches on single files. --- unbound-dhcp-leases-bridge | 47 +++++++++++++++++++++++++------------- 1 file changed, 31 insertions(+), 16 deletions(-) diff --git unbound-dhcp-leases-bridge unbound-dhcp-leases-bridge index a2df5f1..6e22066 100644 --- unbound-dhcp-leases-bridge +++ unbound-dhcp-leases-bridge @@ -72,6 +72,15 @@ class UnboundDHCPLeasesBridge(object): self.fix_leases_file = fix_leases_file self.hosts_file = hosts_file + # base mask for a completed file change + mask = inotify.constants.IN_CLOSE_WRITE | inotify.constants.IN_MOVED_TO + # IN_MODIFY since dhcpd appends lease updates to an open file + self.watches = { + self.leases_file: mask | inotify.constants.IN_MODIFY, + self.fix_leases_file: mask, + self.hosts_file: mask + } + self.unbound = UnboundConfigWriter(unbound_leases_file) self.running = False @@ -80,36 +89,42 @@ class UnboundDHCPLeasesBridge(object): self.running = True # Initial setup - self.hosts = self.read_static_hosts() - self.update_dhcp_leases() + update_hosts = True + update_leases = True + + i = inotify.adapters.Inotify() - i = inotify.adapters.Inotify([ - self.leases_file, - self.fix_leases_file, - self.hosts_file, - ]) + for f in self.watches: + i.add_watch(os.path.dirname(f), self.watches[f]) for event in i.event_gen(): # End if we are requested to terminate if not self.running: break + # Make pending updates once inotify queue is empty if event is None: + if update_hosts: + self.hosts = self.read_static_hosts() + update_hosts = False + if update_leases: + self.update_dhcp_leases() + update_leases = False continue header, type_names, watch_path, filename = event - # Update leases after leases file has been modified - if "IN_MODIFY" in type_names: - # Reload hosts - if watch_path == self.hosts_file: - self.hosts = self.read_static_hosts() + file = os.path.join(watch_path, filename) + + if not file in self.watches: + continue + + log.debug("Inotify %s: %s", file, " ".join(type_names)) - self.update_dhcp_leases() + update_leases = True - # If the file is deleted, we re-add the watcher - if "IN_IGNORED" in type_names: - i.add_watch(watch_path) + if file == self.hosts_file: + update_hosts = True log.info("Unbound DHCP Leases Bridge terminated") -- 2.34.1

3 11

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2022