Development March 2023

development@lists.ipfire.org

11 participants
71 discussions

[PATCH] apache: Update to 2.4.56
by Matthias Fischer 11 Mar '23

11 Mar '23

For details see: https://dlcdn.apache.org/httpd/CHANGES_2.4.56 "Changes with Apache 2.4.56 *) SECURITY: CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting (cve.mitre.org) HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client. Credits: Dimas Fariski Setyawan Putra (nyxsorcerer) *) SECURITY: CVE-2023-25690: HTTP request splitting with mod_rewrite and mod_proxy (cve.mitre.org) Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" " http://example.com:8080/elsewhere?$1" http://example.com:8080/elsewhere ; [P] ProxyPassReverse /here/ http://example.com:8080/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Credits: Lars Krapf of Adobe *) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be truncated without the initial logfile being truncated. [Eric Covener] *) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to allow connections of any age to be reused. Up to now, a negative value was handled as an error when parsing the configuration file. PR 66421. [nailyk <bzapache nailyk.fr>, Christophe Jaillet] *) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number of headers. [Ruediger Pluem] *) mod_md: - Enabling ED25519 support and certificate transparency information when building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis. - MDChallengeDns01 can now be configured for individual domains. Thanks to JÃ©rÃ´me Billiras (@bilhackmac) for the initial PR. - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge teardown not being invoked as it should. [Stefan Eissing] *) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors reported in access logs and error documents. The processing of the reset was correct, only unneccesary reporting was caused. [Stefan Eissing] *) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation. [Yann Ylavic]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/apache2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/apache2 b/lfs/apache2 index 7e1ef7911..402aa8567 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -25,7 +25,7 @@ include Config -VER = 2.4.55 +VER = 2.4.56 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 98e9ec41aa3ccbbe533672ba6de8421e1f0cb5a4b4a06d0cf26c676945bcd5ebe66a1fd21d941ad8ff2c9183565ce542a5643730bbee5972934008652924945b +$(DL_FILE)_BLAKE2 = f9aaf5038543aeec79d5b8615b1b2120fe321966280574c685070f2356f8f1dba1d55a9a25f46cb5ecdd6e3f03785fe7a4e1b965506896cb889720728aa18101 install : $(TARGET) -- 2.34.1

2 1

[PATCH] gawk: Proper build with PIE
by Stefan Schantl 11 Mar '23

11 Mar '23

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- gawk/gawk.nm | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/gawk/gawk.nm b/gawk/gawk.nm index 5060b1704..0e544ee70 100644 --- a/gawk/gawk.nm +++ b/gawk/gawk.nm @@ -5,7 +5,7 @@ name = gawk version = 5.2.1 -release = 1 +release = 2 groups = System/Tools url = https://www.gnu.org/software/gawk/gawk.html @@ -31,6 +31,12 @@ build configure_options += \ --with-libsigsegv-prefix=no + prepare_cmds + # The config scripts checks if the used compiler accepts -no-pie and if + # yes, will set this as compile and linker flags - Change this to pie. + sed -i 's/-no-pie/-pie/g' configure + end + test make check diffout end -- 2.30.2

1 0

[PATCH] gettext: Fix hardening for some binaries.
by Stefan Schantl 11 Mar '23

11 Mar '23

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- gettext/gettext.nm | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/gettext/gettext.nm b/gettext/gettext.nm index 264eb2db0..1e2af67f7 100644 --- a/gettext/gettext.nm +++ b/gettext/gettext.nm @@ -5,7 +5,7 @@ name = gettext version = 0.21.1 -release = 2.1 +release = 3 groups = System/Base url = https://www.gnu.org/software/gettext/ @@ -44,6 +44,13 @@ build --enable-shared \ --disable-rpath + configure_cmds + # Add additional compiler flages to build gettext-tools binaries with + # proper hardening. + sed -i '/^CFLAGS =/ s/$/ -fno-builtin-exit -D__noreturn__=/' \ + %{DIR_APP}/gettext-tools/src/Makefile + end + test make check || : end -- 2.30.2

1 0

[PATCH] bison: Proper use LDFLAGS to link liby
by Stefan Schantl 11 Mar '23

11 Mar '23

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- bison/bison.nm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bison/bison.nm b/bison/bison.nm index 96d0ed331..3a8665a0c 100644 --- a/bison/bison.nm +++ b/bison/bison.nm @@ -5,7 +5,7 @@ name = bison version = 3.8.2 -release = 1 +release = 2 groups = Development/Tools url = http://www.gnu.org/software/bison/ @@ -32,7 +32,7 @@ build build_cmds cd lib - gcc -shared -Wl,-soname,liby.so.%{version} \ + gcc %{LDFLAGS} -shared -Wl,-soname,liby.so.%{version} \ -o liby.so.%{version} %{CFLAGS} main.o yyerror.o end -- 2.30.2

1 0

[PATCH] ovpnmain.cgi: Fix for bug#11048 - insecure download icon for connections with a password
by Adolf Belka 10 Mar '23

10 Mar '23

- The insecure package download icon is shown if entry 41 in /var/ipfire/ovpn/ovpnconfig is set to no-pass. The code block on ovpnmain.cgi that deals with this checks if the connection is a host and if the first password entry is a null. Then it adds no-pass to ovpnconfig. - The same block of code is also used for when he connection is edited. However at this stage the password entry is back to null because the password value is only kept until the connection has been saved. Therefore doing an edit results in the password value being taken as null even for connections with a password. - This fix checks the password value only if entry 41 in the ovpnconfig file is a null. If it is a null then it enters no-pass if the password is a null and it enters pass if the password contains characters. This way the entry 41 always contains either pass or no-pass, except when the connection is being first added and saved. - When adding this fix into a Core Update the update.sh script will need to check if ovpnconfig exists and then add pass to all lines that have a null at entry 41. This will only fix those connections that have not already been edited. Any connections already edited will have no-pass at entry 41 of ovpnconfig and will therefore show the insecure package download icon. - The only way I can think of dealing with entries that already have no-pass added is to go through all .p12 files in the certs directory and if there is a connection entry with that name then to change the no-pass to a pass. However that will only work if the connection name has been set the same as the certificate name, which is not a requirement. - So I think we can only fix those coneections that have never been edited. Any connections with passwords that have already been edited and containg no-pass in ovpnconfig and showing the insecure package download icon will have to be manually dealt with by users. - I think that should still be okay because they currently have two icons when they shouldn't and that will continue to be the case if they don't carry out a manual edit of ovpnconfig. - Maybe someone can think of an alternative way of identifying all connections using a password so that they can have entry 41 changed to pass. I haven't been able to do that so far - Looking forward to feedback Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 42a7354fc..2586a1796 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -4326,9 +4326,13 @@ if ($cgiparams{'TYPE'} eq 'net') { $confighash{$key}[39] = $cgiparams{'DAUTH'}; $confighash{$key}[40] = $cgiparams{'DCIPHER'}; - if (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} eq "")) { - $confighash{$key}[41] = "no-pass"; - } + if ($confighash{$key}[41] eq "") { + if (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} eq "")) { + $confighash{$key}[41] = "no-pass"; + } elsif (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} ne "")) { + $confighash{$key}[41] = "pass"; + } + } $confighash{$key}[42] = 'HOTP/T30/6'; $confighash{$key}[43] = $cgiparams{'OTP_STATE'}; -- 2.39.1

1 1

[PATCH 1/2] log.dat: Fix bug#12922 - add HAProxy to System Log drop down list
by Adolf Belka 08 Mar '23

08 Mar '23

Fixes: Bug#12922 Suggested-by: Michael <ip.fire(a)die-fritzens.de> Tested-by: Michael <ip.fire(a)die-fritzens.de> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/logs.cgi/log.dat | 2 ++ 1 file changed, 2 insertions(+) diff --git a/html/cgi-bin/logs.cgi/log.dat b/html/cgi-bin/logs.cgi/log.dat index fbc83f48d..d3f2599f8 100644 --- a/html/cgi-bin/logs.cgi/log.dat +++ b/html/cgi-bin/logs.cgi/log.dat @@ -60,6 +60,7 @@ my %sections = ( 'dhcp' => '(dhcpd: )', 'dma' => '(dma: |dma\[.*\]: |postfix/\w*\[\d*\]: )', 'guardian' => '(guardian\[.*\]: )', + 'haproxy' => '(haproxy\[.*?\]: )', 'ipblocklist' => '(ipblocklist: )', 'ipfire' => '(ipfire: )', 'ipsec' => '(ipsec_[\w_]+: |pluto\[.*\]: |charon: |vpnwatch: )', @@ -93,6 +94,7 @@ my %trsections = ( 'dhcp' => "$Lang::tr{'dhcp server'}", 'dma' => 'Mail', 'guardian' => "$Lang::tr{'guardian'}", + 'haproxy' => 'HAProxy', 'ipblocklist' => "$Lang::tr{'ipblocklist'}", 'ipfire' => 'IPFire', 'ipsec' => 'IPSec', -- 2.39.2

1 1

[PATCH] Suricata: Do not use hard-coded red interface name
by Stefan Schantl 08 Mar '23

08 Mar '23

Read the correct interface name from the corresponding interface file. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/initscripts/system/suricata | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index 938ea66de..f2fe21f44 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -27,6 +27,8 @@ PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) +IFACE_FILE="/var/ipfire/red/iface" + # Name of the firewall chains. IPS_INPUT_CHAIN="IPS_INPUT" IPS_FORWARD_CHAIN="IPS_FORWARD" @@ -87,8 +89,8 @@ function generate_fw_rules { if [ "${!enable_ids_zone}" == "on" ]; then # Check if the current processed zone is "red" and the configured type is PPPoE dialin. if [ "$zone" == "red" ] && [ "$RED_TYPE" == "PPPOE" ]; then - # Set device name to ppp0. - network_device="ppp0" + # Read the used interface name from the corresponding file. + network_device="$(head -n 1 $IFACE_FILE)" elif [ "$zone" == "ovpn" ]; then # Get all virtual net devices because the RW server and each # N2N connection creates it's own tun device. -- 2.30.2

2 1

[PATCH 1/2] qpdf: Update to version 11.3.0
by Adolf Belka 07 Mar '23

07 Mar '23

- Update from version 10.4.0 to 11.3.0 - Update of rootfile - Build changed to cmake from version 11.0 onwards - find-dependencies run due to lib so bump. Only qpdf and cups-filters are linked to the changed libs. cups-filters being shipped due to a change required because of qpdf-11.3.0 - Changelog is too large to include here. Details can be found in the ChangeLog file in the source tarball. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/qpdf | 29 +++++++++++++++++++++++------ lfs/qpdf | 17 ++++++++++------- 2 files changed, 33 insertions(+), 13 deletions(-) diff --git a/config/rootfiles/common/qpdf b/config/rootfiles/common/qpdf index 6e59ba345..1afd04a53 100644 --- a/config/rootfiles/common/qpdf +++ b/config/rootfiles/common/qpdf @@ -10,6 +10,7 @@ usr/bin/qpdf #usr/include/qpdf/FileInputSource.hh #usr/include/qpdf/InputSource.hh #usr/include/qpdf/JSON.hh +#usr/include/qpdf/PDFVersion.hh #usr/include/qpdf/Pipeline.hh #usr/include/qpdf/Pl_Buffer.hh #usr/include/qpdf/Pl_Concatenate.hh @@ -17,9 +18,12 @@ usr/bin/qpdf #usr/include/qpdf/Pl_DCT.hh #usr/include/qpdf/Pl_Discard.hh #usr/include/qpdf/Pl_Flate.hh +#usr/include/qpdf/Pl_Function.hh +#usr/include/qpdf/Pl_OStream.hh #usr/include/qpdf/Pl_QPDFTokenizer.hh #usr/include/qpdf/Pl_RunLength.hh #usr/include/qpdf/Pl_StdioFile.hh +#usr/include/qpdf/Pl_String.hh #usr/include/qpdf/PointerHolder.hh #usr/include/qpdf/QIntC.hh #usr/include/qpdf/QPDF.hh @@ -33,6 +37,8 @@ usr/bin/qpdf #usr/include/qpdf/QPDFExc.hh #usr/include/qpdf/QPDFFileSpecObjectHelper.hh #usr/include/qpdf/QPDFFormFieldObjectHelper.hh +#usr/include/qpdf/QPDFJob.hh +#usr/include/qpdf/QPDFLogger.hh #usr/include/qpdf/QPDFMatrix.hh #usr/include/qpdf/QPDFNameTreeObjectHelper.hh #usr/include/qpdf/QPDFNumberTreeObjectHelper.hh @@ -48,22 +54,33 @@ usr/bin/qpdf #usr/include/qpdf/QPDFStreamFilter.hh #usr/include/qpdf/QPDFSystemError.hh #usr/include/qpdf/QPDFTokenizer.hh +#usr/include/qpdf/QPDFUsage.hh #usr/include/qpdf/QPDFWriter.hh #usr/include/qpdf/QPDFXRefEntry.hh #usr/include/qpdf/QTC.hh #usr/include/qpdf/QUtil.hh #usr/include/qpdf/RandomDataProvider.hh #usr/include/qpdf/Types.h +#usr/include/qpdf/auto_job_c_att.hh +#usr/include/qpdf/auto_job_c_copy_att.hh +#usr/include/qpdf/auto_job_c_enc.hh +#usr/include/qpdf/auto_job_c_main.hh +#usr/include/qpdf/auto_job_c_pages.hh +#usr/include/qpdf/auto_job_c_uo.hh #usr/include/qpdf/qpdf-c.h -#usr/lib/libqpdf.la +#usr/include/qpdf/qpdfjob-c.h +#usr/include/qpdf/qpdflogger-c.h +#usr/lib/cmake/qpdf +#usr/lib/cmake/qpdf/libqpdfTargets-noconfig.cmake +#usr/lib/cmake/qpdf/libqpdfTargets.cmake +#usr/lib/cmake/qpdf/qpdfConfig.cmake +#usr/lib/cmake/qpdf/qpdfConfigVersion.cmake #usr/lib/libqpdf.so -usr/lib/libqpdf.so.28 -usr/lib/libqpdf.so.28.4.0 +usr/lib/libqpdf.so.29 +usr/lib/libqpdf.so.29.3.0 #usr/lib/pkgconfig/libqpdf.pc #usr/share/doc/qpdf -#usr/share/doc/qpdf/qpdf-manual.html -#usr/share/doc/qpdf/qpdf-manual.pdf -#usr/share/doc/qpdf/stylesheet.css +#usr/share/doc/qpdf/README-doc.txt #usr/share/man/man1/fix-qdf.1 #usr/share/man/man1/qpdf.1 #usr/share/man/man1/zlib-flate.1 diff --git a/lfs/qpdf b/lfs/qpdf index c51883f83..2b7557c27 100644 --- a/lfs/qpdf +++ b/lfs/qpdf @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 10.4.0 +VER = 11.3.0 THISAPP = qpdf-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = bc984c742bec582b5b67f7a4f4f00bb22a36e8e14d78b8e8848baed0c94489f6920070bc317928c53aca855c252c2fa5de0fba8b64ba16ba37afc2362d6ae7ba +$(DL_FILE)_BLAKE2 = 80dd2a96f3b82b9e530f26c72cd24cd3b111e2e1cbe821b12af13807e8d54fbc7f5632130f5cbd03df1b7c70de3c94a7e889d4ea4f1a3670a28f726364564b16 install : $(TARGET) @@ -70,9 +70,12 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && ./configure --prefix=/usr --disable-static \ - CFLAGS="$(CFLAGS)" CXXFLAGS="$(CXXFLAGS)" LDFLAGS="$(LDFLAGS)" - cd $(DIR_APP) && make $(MAKETUNING) - cd $(DIR_APP) && make install + cd $(DIR_APP) && mkdir -pv build + cd $(DIR_APP)/build && cmake .. \ + -DCMAKE_INSTALL_PREFIX=/usr \ + -DBUILD_STATIC_LIBS=FALSE \ + -DINSTALL_EXAMPLES=OFF + cd $(DIR_APP)/build && make $(MAKETUNING) + cd $(DIR_APP)/build && make install @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.39.2

1 1

[PATCH 1/2] poppler: Update to version 23.03.0
by Adolf Belka 07 Mar '23

07 Mar '23

- Update from version 23.01.0 to 23.03.0 - Update of rootfile not required - Changelog Release 23.03.0: core: * PngWriter: Fix potential uninitialized memory use Release 23.02.0: core: * CairoOutputDev: Fix rendering of color type 3 fonts * CairoOutputDev: Add handling matte entry * Fix segfault on wrong nssdir * Fix "NSS could not shutdown" utils: * pdfsig: Point out supports PKCS#11 URIs as nickname Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/poppler | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/poppler b/lfs/poppler index f7ccb68ba..959eeed0c 100644 --- a/lfs/poppler +++ b/lfs/poppler @@ -24,7 +24,7 @@ include Config -VER = 23.01.0 +VER = 23.03.0 THISAPP = poppler-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 8dd85767a0c101b3d7166719374658a233aff491b0990917aacaa6fb3c5d8e51104b3ac45c78dcfb380286ea48067d1db57c2794d99a93cae9f4d64e9ca3dd07 +$(DL_FILE)_BLAKE2 = 1247b7cf62466f65c46b739f0784e8ba97911940e04f91a7db28bf0663c8fe182f79066aa3925cb338580ccedbf17aecd2a2d2795e859680d1fb721390a1cbe0 install : $(TARGET) -- 2.39.2

1 1

[PATCH] ids-functions.pl: Extract rules files if they are in a providers rules folder.
by Stefan Schantl 07 Mar '23

07 Mar '23

Now the rules files in a subfolder like "<provider>-rules" also will get extracted. Fixes rule file extraction for Snort Community ruleset. Fixes #12948. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/cfgroot/ids-functions.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index ec4fdacc5..d97431b4a 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -572,7 +572,7 @@ sub extractruleset ($) { # Handle rules files. } elsif ($file =~ m/\.rules$/) { # Skip rule files which are not located in the rules directory or archive root. - next unless(($packed_file =~ /^rules\//) || ($packed_file !~ /\//)); + next unless(($packed_file =~ /^rules\//) || ($packed_file =~ /^$provider-rules\//) || ($packed_file !~ /\//)); # Skip deleted.rules. # -- 2.30.2

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2023