Development April 2023

development@lists.ipfire.org

11 participants
38 discussions

[PATCH] unbound: Update to 1.17.1
by Matthias Fischer 25 Apr '23

25 Apr '23

For details see: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-17-1 "Features Expose 'statistics-inhibit-zero' as a configuration option; the default value retains Unbound's behavior. Expose 'max-sent-count' as a configuration option; the default value retains Unbound's behavior. Merge #461 from Christian Allred: Add max-query-restarts option. Exposes an internal configuration but the default value retains Unbound's behavior. Merge #569 from JINMEI Tatuya: add keep-cache option to 'unbound-control reload' to keep caches. Bug Fixes Merge #768 from fobser: Arithmetic on a pointer to void is a GNU extension. In unit test, print python script name list correctly. testcode/dohclient sets log identity to its name. Clarify the use of MAX_SENT_COUNT in the iterator code. Fix that cachedb does not store failures in the external cache. Merge #767 from jonathangray: consistently use IPv4/IPv6 in unbound.conf.5. Fix to ignore tcp events for closed comm points. Fix to make sure to not read again after a tcp comm point is closed. Fix #775: libunbound: subprocess reap causes parent process reap to hang. iana portlist update. Complementary fix for distutils.sysconfig deprecation in Python 3.10 to commit 62c5039ab9da42713e006e840b7578e01d66e7f2. Fix #779: [doc] Missing documention in ub_resolve_event() for callback parameter was_ratelimited. Ignore expired error responses. Merge #720 from jonathangray: fix use after free when WSACreateEvent() fails. Fix for the ignore of tcp events for closed comm points, preserve the use after free protection features. Fix #782: Segmentation fault in stats.c:404. Add SVCB and HTTPS to the types removed by 'unbound-control flush'. Clear documentation for interactivity between the subnet module and the serve-expired and prefetch configuration options. Fix #773: When used with systemd-networkd, unbound does not start until systemd-networkd-wait-online.service times out. Merge #808: Wrap Makefile script's directory variables in quotes. Fix to wrap Makefile scripts directory in quotes for uninstall. Fix windows compile for libunbound subprocess reap comm point closes. Update github workflows to use checkout v3. Fix wildcard in hyperlocal zone service degradation, reported by Sergey Kacheev." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/unbound | 2 +- lfs/unbound | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index 26ce13c3f..575c4f500 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.1.20 +usr/lib/libunbound.so.8.1.21 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/lfs/unbound b/lfs/unbound index 3852c2e6a..789bbded9 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.17.0 +VER = 1.17.1 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 611c1b96ff84e6dd8f7a592135cc17f416cd810d0f35d27c8cedd56af069badd8dca112cc5927a1fe50ec3335c377b6bd6fc4e1a6d63a332a90d676e3c23dcef +$(DL_FILE)_BLAKE2 = c2dec1608e28302da33ee72144bb8eb16cdff2e949e548f9ea5edb10b370e396085de641446b1f94daeb96a48a02f9361ebae69f72f3d449575fe3ce93dcdb5b install : $(TARGET) -- 2.34.1

2 1

[PATCH] bind: Update to 9.16.40
by Matthias Fischer 25 Apr '23

25 Apr '23

For details see: https://downloads.isc.org/isc/bind9/9.16.40/doc/arm/html/notes.html#notes-f… "Notes for BIND 9.16.40 Bug Fixes Logfiles using timestamp-style suffixes were not always correctly removed when the number of files exceeded the limit set by versions. This has been fixed for configurations which do not explicitly specify a directory path as part of the file argument in the channel specification. [GL #3959] [GL #3991] Performance of DNSSEC validation in zones with many DNSKEY records has been improved. [GL #3981]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 14 +++++++------- lfs/bind | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index aabaae6fa..eeeee6e94 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -271,24 +271,24 @@ usr/bin/nsupdate #usr/include/pk11/site.h #usr/include/pkcs11 #usr/include/pkcs11/pkcs11.h -usr/lib/libbind9-9.16.39.so +usr/lib/libbind9-9.16.40.so #usr/lib/libbind9.la #usr/lib/libbind9.so -usr/lib/libdns-9.16.39.so +usr/lib/libdns-9.16.40.so #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libirs-9.16.39.so +usr/lib/libirs-9.16.40.so #usr/lib/libirs.la #usr/lib/libirs.so -usr/lib/libisc-9.16.39.so +usr/lib/libisc-9.16.40.so #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisccc-9.16.39.so +usr/lib/libisccc-9.16.40.so #usr/lib/libisccc.la #usr/lib/libisccc.so -usr/lib/libisccfg-9.16.39.so +usr/lib/libisccfg-9.16.40.so #usr/lib/libisccfg.la #usr/lib/libisccfg.so -usr/lib/libns-9.16.39.so +usr/lib/libns-9.16.40.so #usr/lib/libns.la #usr/lib/libns.so diff --git a/lfs/bind b/lfs/bind index 584cb7e5a..850e3f93a 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.16.39 +VER = 9.16.40 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = d9fb51435dce11c8854084cc21de79df3ae6529baead76dcf27711bcff33469d1fd6fbd3366b61bc921f92850620c9b7464d4dbe08dd0c7e2f3e5e1c1100cb79 +$(DL_FILE)_BLAKE2 = 1ebfec11cc6902480113b1edadcbdb2f819050d779aaa1556ef79491c580a28106d3eff186da89bdecec03025e4e672342602f54e6b0e6f9619a181a1399e070 install : $(TARGET) -- 2.34.1

2 1

[PATCH] u-boot: add nanopi r2c support
by Arne Fitzenreiter 23 Apr '23

23 Apr '23

this patch add nanopi r2c plus support. if this u-boot is installed on the eMMC this is also supported. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/rootfiles/common/aarch64/u-boot | 2 + lfs/u-boot | 20 +++ .../u-boot/rockchip/add_nanopi-r2c.patch | 169 ++++++++++++++++++ .../u-boot/rockchip/generate-2-ethaddr.diff | 18 -- 4 files changed, 191 insertions(+), 18 deletions(-) create mode 100644 src/patches/u-boot/rockchip/add_nanopi-r2c.patch delete mode 100644 src/patches/u-boot/rockchip/generate-2-ethaddr.diff diff --git a/config/rootfiles/common/aarch64/u-boot b/config/rootfiles/common/aarch64/u-boot index 2b60c7802..4b2dcd4fd 100644 --- a/config/rootfiles/common/aarch64/u-boot +++ b/config/rootfiles/common/aarch64/u-boot @@ -6,6 +6,8 @@ boot/u-boot-rpi4.bin boot/uEnv.txt boot/uboot.env #usr/share/u-boot +#usr/share/u-boot/nanopi_r2c +usr/share/u-boot/nanopi_r2c/u-boot-rockchip.bin #usr/share/u-boot/nanopi_r2s usr/share/u-boot/nanopi_r2s/u-boot-rockchip.bin #usr/share/u-boot/nanopi_r4s diff --git a/lfs/u-boot b/lfs/u-boot index 0d4c2cc58..cea74e64c 100644 --- a/lfs/u-boot +++ b/lfs/u-boot @@ -137,6 +137,26 @@ ifneq "$(MKIMAGE)" "1" /usr/share/u-boot/nanopi_r2s/u-boot-rockchip.bin cd $(DIR_APP) && make distclean + # Nanopi R2C + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/u-boot/rockchip/add_nanopi-r2c.patch + cd $(DIR_APP) && rm -rf arm-trusted-firmware-$(ATF_VER) + cd $(DIR_APP) && tar axf $(DIR_DL)/arm-trusted-firmware-$(ATF_VER).tar.gz + cd $(DIR_APP)/arm-trusted-firmware-$(ATF_VER) && make PLAT=rk3328 ARCH=aarch64 DEBUG=0 bl31 LDFLAGS="$(LDFLAGS)" + cd $(DIR_APP) && cp arm-trusted-firmware-$(ATF_VER)/build/rk3328/release/bl31/bl31.elf bl31.elf + cd $(DIR_APP) && rm -rf arm-trusted-firmware-$(ATF_VER) + -mkdir -pv /usr/share/u-boot/nanopi_r2c + + cd $(DIR_APP) && make CROSS_COMPILE="" nanopi-r2c-rk3328_config + cd $(DIR_APP) && sed -i -e 's!^CONFIG_IDENT_STRING=.*!CONFIG_IDENT_STRING=" Nanopi R2C - IPFire.org"!' .config + cd $(DIR_APP) && sed -i -e 's!^CONFIG_BOOTCOMMAND=.*!CONFIG_BOOTCOMMAND="console=ttyS2,115200n8;run distro_bootcmd"!' .config + cd $(DIR_APP) && sed -i -e 's!^CONFIG_BAUDRATE=.*!CONFIG_BAUDRATE=115200!' .config + cd $(DIR_APP) && sed -i -e 's!.*CONFIG_ENV_OVERWRITE.*!CONFIG_ENV_OVERWRITE=y!' .config + cd $(DIR_APP) && make CROSS_COMPILE="" HOSTCC="gcc $(CFLAGS)" + cd $(DIR_APP) && install -v -m 644 u-boot-rockchip.bin \ + /usr/share/u-boot/nanopi_r2c/u-boot-rockchip.bin + cd $(DIR_APP) && make distclean + + # Nanopi R4S # arm trusted firmware for rk3399 cannot build without cortex m0 gcc crosscompiler # it is build on ubuntu with make PLAT=rk3399 ARCH=aarch64 DEBUG=0 bl31 diff --git a/src/patches/u-boot/rockchip/add_nanopi-r2c.patch b/src/patches/u-boot/rockchip/add_nanopi-r2c.patch new file mode 100644 index 000000000..9e330041f --- /dev/null +++ b/src/patches/u-boot/rockchip/add_nanopi-r2c.patch @@ -0,0 +1,169 @@ +diff -Naur u-boot-2022.10.org/arch/arm/dts/Makefile u-boot-2022.10/arch/arm/dts/Makefile +--- u-boot-2022.10.org/arch/arm/dts/Makefile 2022-10-03 19:25:32.000000000 +0000 ++++ u-boot-2022.10/arch/arm/dts/Makefile 2023-04-22 15:02:25.945603949 +0000 +@@ -124,6 +124,7 @@ + + dtb-$(CONFIG_ROCKCHIP_RK3328) += \ + rk3328-evb.dtb \ ++ rk3328-nanopi-r2c.dtb \ + rk3328-nanopi-r2s.dtb \ + rk3328-roc-cc.dtb \ + rk3328-rock64.dtb \ +diff -Naur u-boot-2022.10.org/arch/arm/dts/rk3328-nanopi-r2c-u-boot.dtsi u-boot-2022.10/arch/arm/dts/rk3328-nanopi-r2c-u-boot.dtsi +--- u-boot-2022.10.org/arch/arm/dts/rk3328-nanopi-r2c-u-boot.dtsi 1970-01-01 00:00:00.000000000 +0000 ++++ u-boot-2022.10/arch/arm/dts/rk3328-nanopi-r2c-u-boot.dtsi 2023-04-22 15:07:54.544953841 +0000 +@@ -0,0 +1,7 @@ ++// SPDX-License-Identifier: GPL-2.0+ ++/* ++ * Copyright (c) 2021 FriendlyElec Computer Tech. Co., Ltd. ++ * (http://www.friendlyarm.com) ++ */ ++ ++#include "rk3328-nanopi-r2s-u-boot.dtsi" +diff -Naur u-boot-2022.10.org/arch/arm/dts/rk3328-nanopi-r2c.dts u-boot-2022.10/arch/arm/dts/rk3328-nanopi-r2c.dts +--- u-boot-2022.10.org/arch/arm/dts/rk3328-nanopi-r2c.dts 1970-01-01 00:00:00.000000000 +0000 ++++ u-boot-2022.10/arch/arm/dts/rk3328-nanopi-r2c.dts 2023-04-22 15:07:07.861614679 +0000 +@@ -0,0 +1,27 @@ ++// SPDX-License-Identifier: (GPL-2.0+ OR MIT) ++/* ++ * Copyright (c) 2021 FriendlyElec Computer Tech. Co., Ltd. ++ * (http://www.friendlyarm.com) ++ */ ++ ++/dts-v1/; ++#include "rk3328-nanopi-r2s.dts" ++ ++/ { ++ model = "FriendlyElec NanoPi R2C"; ++ compatible = "friendlyarm,nanopi-r2c", "rockchip,rk3328"; ++}; ++ ++&emmc { ++ bus-width = <8>; ++ cap-mmc-highspeed; ++ max-frequency = <150000000>; ++ mmc-ddr-1_8v; ++ mmc-hs200-1_8v; ++ non-removable; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&emmc_clk &emmc_cmd &emmc_bus8>; ++ vmmc-supply = <&vcc_io_33>; ++ vqmmc-supply = <&vcc18_emmc>; ++ status = "okay"; ++}; +diff -Naur u-boot-2022.10.org/configs/nanopi-r2c-rk3328_defconfig u-boot-2022.10/configs/nanopi-r2c-rk3328_defconfig +--- u-boot-2022.10.org/configs/nanopi-r2c-rk3328_defconfig 1970-01-01 00:00:00.000000000 +0000 ++++ u-boot-2022.10/configs/nanopi-r2c-rk3328_defconfig 2023-04-22 15:09:20.843584447 +0000 +@@ -0,0 +1,112 @@ ++CONFIG_ARM=y ++CONFIG_SKIP_LOWLEVEL_INIT=y ++CONFIG_COUNTER_FREQUENCY=24000000 ++CONFIG_ARCH_ROCKCHIP=y ++CONFIG_SYS_TEXT_BASE=0x00200000 ++CONFIG_SPL_GPIO=y ++CONFIG_NR_DRAM_BANKS=1 ++CONFIG_ENV_OFFSET=0x3F8000 ++CONFIG_DEFAULT_DEVICE_TREE="rk3328-nanopi-r2c" ++CONFIG_ROCKCHIP_RK3328=y ++CONFIG_TPL_ROCKCHIP_COMMON_BOARD=y ++CONFIG_TPL_LIBCOMMON_SUPPORT=y ++CONFIG_TPL_LIBGENERIC_SUPPORT=y ++CONFIG_SPL_DRIVERS_MISC=y ++CONFIG_SPL_STACK_R_ADDR=0x600000 ++CONFIG_DEBUG_UART_BASE=0xFF130000 ++CONFIG_DEBUG_UART_CLOCK=24000000 ++CONFIG_SYS_LOAD_ADDR=0x800800 ++CONFIG_DEBUG_UART=y ++CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y ++CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x300000 ++CONFIG_TPL_SYS_MALLOC_F_LEN=0x800 ++# CONFIG_ANDROID_BOOT_IMAGE is not set ++CONFIG_FIT=y ++CONFIG_FIT_VERBOSE=y ++CONFIG_SPL_LOAD_FIT=y ++CONFIG_DEFAULT_FDT_FILE="rockchip/rk3328-nanopi-r2c.dtb" ++# CONFIG_DISPLAY_CPUINFO is not set ++CONFIG_DISPLAY_BOARDINFO_LATE=y ++CONFIG_MISC_INIT_R=y ++CONFIG_SPL_MAX_SIZE=0x40000 ++CONFIG_SPL_PAD_TO=0x7f8000 ++CONFIG_SPL_HAS_BSS_LINKER_SECTION=y ++CONFIG_SPL_BSS_START_ADDR=0x2000000 ++CONFIG_SPL_BSS_MAX_SIZE=0x2000 ++# CONFIG_SPL_RAW_IMAGE_SUPPORT is not set ++# CONFIG_SPL_SHARES_INIT_SP_ADDR is not set ++CONFIG_SPL_STACK=0x400000 ++CONFIG_SPL_STACK_R=y ++CONFIG_SPL_I2C=y ++CONFIG_SPL_POWER=y ++CONFIG_SPL_ATF=y ++CONFIG_SPL_ATF_NO_PLATFORM_PARAM=y ++CONFIG_TPL_SYS_MALLOC_SIMPLE=y ++CONFIG_CMD_BOOTZ=y ++CONFIG_CMD_GPT=y ++CONFIG_CMD_MMC=y ++CONFIG_CMD_USB=y ++# CONFIG_CMD_SETEXPR is not set ++CONFIG_CMD_TIME=y ++CONFIG_SPL_OF_CONTROL=y ++CONFIG_TPL_OF_CONTROL=y ++CONFIG_OF_SPL_REMOVE_PROPS="clock-names interrupt-parent assigned-clocks assigned-clock-rates assigned-clock-parents" ++CONFIG_TPL_OF_PLATDATA=y ++CONFIG_ENV_IS_IN_MMC=y ++CONFIG_SYS_RELOC_GD_ENV_ADDR=y ++CONFIG_SYS_MMC_ENV_DEV=1 ++CONFIG_NET_RANDOM_ETHADDR=y ++CONFIG_TPL_DM=y ++CONFIG_REGMAP=y ++CONFIG_SPL_REGMAP=y ++CONFIG_TPL_REGMAP=y ++CONFIG_SYSCON=y ++CONFIG_SPL_SYSCON=y ++CONFIG_TPL_SYSCON=y ++CONFIG_CLK=y ++CONFIG_SPL_CLK=y ++CONFIG_FASTBOOT_BUF_ADDR=0x800800 ++CONFIG_FASTBOOT_CMD_OEM_FORMAT=y ++CONFIG_ROCKCHIP_GPIO=y ++CONFIG_SYS_I2C_ROCKCHIP=y ++CONFIG_MMC_DW=y ++CONFIG_MMC_DW_ROCKCHIP=y ++CONFIG_SF_DEFAULT_SPEED=20000000 ++CONFIG_ETH_DESIGNWARE=y ++CONFIG_GMAC_ROCKCHIP=y ++CONFIG_PINCTRL=y ++CONFIG_SPL_PINCTRL=y ++CONFIG_DM_PMIC=y ++CONFIG_PMIC_RK8XX=y ++CONFIG_SPL_PMIC_RK8XX=y ++CONFIG_SPL_DM_REGULATOR=y ++CONFIG_REGULATOR_PWM=y ++CONFIG_DM_REGULATOR_FIXED=y ++CONFIG_SPL_DM_REGULATOR_FIXED=y ++CONFIG_REGULATOR_RK8XX=y ++CONFIG_PWM_ROCKCHIP=y ++CONFIG_RAM=y ++CONFIG_SPL_RAM=y ++CONFIG_TPL_RAM=y ++CONFIG_DM_RESET=y ++CONFIG_BAUDRATE=1500000 ++CONFIG_DEBUG_UART_SHIFT=2 ++CONFIG_SYSINFO=y ++CONFIG_SYSRESET=y ++# CONFIG_TPL_SYSRESET is not set ++CONFIG_USB=y ++CONFIG_USB_XHCI_HCD=y ++CONFIG_USB_XHCI_DWC3=y ++CONFIG_USB_EHCI_HCD=y ++CONFIG_USB_EHCI_GENERIC=y ++CONFIG_USB_OHCI_HCD=y ++CONFIG_USB_OHCI_GENERIC=y ++CONFIG_SYS_USB_OHCI_MAX_ROOT_PORTS=1 ++CONFIG_USB_DWC2=y ++CONFIG_USB_DWC3=y ++# CONFIG_USB_DWC3_GADGET is not set ++CONFIG_USB_GADGET=y ++CONFIG_USB_GADGET_DWC2_OTG=y ++CONFIG_SPL_TINY_MEMSET=y ++CONFIG_TPL_TINY_MEMSET=y ++CONFIG_ERRNO_STR=y diff --git a/src/patches/u-boot/rockchip/generate-2-ethaddr.diff b/src/patches/u-boot/rockchip/generate-2-ethaddr.diff deleted file mode 100644 index 067c8b503..000000000 --- a/src/patches/u-boot/rockchip/generate-2-ethaddr.diff +++ /dev/null @@ -1,18 +0,0 @@ -diff -Naur u-boot-2021.07.org/arch/arm/mach-rockchip/misc.c u-boot-2021.07/arch/arm/mach-rockchip/misc.c ---- u-boot-2021.07.org/arch/arm/mach-rockchip/misc.c 2021-07-05 15:11:28.000000000 +0000 -+++ u-boot-2021.07/arch/arm/mach-rockchip/misc.c 2021-10-08 10:47:13.704806367 +0000 -@@ -49,9 +49,12 @@ - memcpy(mac_addr, hash, 6); - - /* Make this a valid MAC address and set it */ -- mac_addr[0] &= 0xfe; /* clear multicast bit */ -- mac_addr[0] |= 0x02; /* set local assignment bit (IEEE802) */ -+ mac_addr[0] = 0x02; /* set local assignment bit (IEEE802) */ - eth_env_set_enetaddr("ethaddr", mac_addr); -+ if (env_get("eth1addr")) -+ return 0; -+ mac_addr[0] = 0x12; /* set local assignment bit (IEEE802) */ -+ eth_env_set_enetaddr("eth1addr", mac_addr); - #endif - return 0; - } -- 2.34.1

1 0

[PATCH] kernel: add nanopi r2c patches
by Arne Fitzenreiter 23 Apr '23

23 Apr '23

https://git.ipfire.org/?p=people/arne_f/kernel.git;a=commit;h=4a06c119e0065… https://git.ipfire.org/?p=people/arne_f/kernel.git;a=commit;h=716f69f11cf3b… Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/rootfiles/common/aarch64/linux | 4 +++- lfs/linux | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 77c6ba1b7..7e471dda6 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -293,6 +293,8 @@ boot/dtb-KVER-ipfire #boot/dtb-KVER-ipfire/rockchip/rk3326-odroid-go2.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-a1.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-evb.dtb +#boot/dtb-KVER-ipfire/rockchip/rk3328-nanopi-r2c-oc.dtb +#boot/dtb-KVER-ipfire/rockchip/rk3328-nanopi-r2c.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-nanopi-r2s-oc.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-nanopi-r2s.dtb #boot/dtb-KVER-ipfire/rockchip/rk3328-roc-cc.dtb @@ -22444,7 +22446,7 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/sound/soc/sunxi/sun8i-adda-pr-regmap.ko.xz #lib/modules/KVER-ipfire/kernel/sound/soc/sunxi/sun8i-codec-analog.ko.xz #lib/modules/KVER-ipfire/kernel/sound/soundcore.ko.xz -#lib/modules/KVER-ipfire/kernel/sound/usb +#lib/modules/KVER[5~-ipfire/kernel/sound/usb #lib/modules/KVER-ipfire/kernel/sound/usb/6fire #lib/modules/KVER-ipfire/kernel/sound/usb/6fire/snd-usb-6fire.ko.xz #lib/modules/KVER-ipfire/kernel/sound/usb/bcd2000 diff --git a/lfs/linux b/lfs/linux index d9f7bdd71..e48374f1e 100644 --- a/lfs/linux +++ b/lfs/linux @@ -25,7 +25,7 @@ include Config VER = 6.1.24 -ARM_PATCHES = 6.1.y-ipfire0 +ARM_PATCHES = 6.1.y-ipfire1 THISAPP = linux-$(VER) DL_FILE = linux-$(VER).tar.xz @@ -76,7 +76,7 @@ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz $(DL_FILE)_BLAKE2 = 2f20ad999655226bc79caca109bde0f940420d87a293cf000f2d8304122bdfcc388c1a558ff26f2f551c9b6133b8fb120dbd537f914e1b88d0fbbd5408e648b0 -arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 3ef9a778c5c41ee8bf2942a48f63b21228a632a2910d2123f01155bbf571592898cffffa61c387a5a6c817b62e458947b4c406c6591b23b5401faa47b020337f +arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 2181ba20d1c9d2752d67438784da12470f5c9cb8acc4eb748637ae1e8bf9d7cd0e7a08a51fad5cac98764d46ae6a20521ddda31da7002d48dbd180ff04a4d9aa install : $(TARGET) -- 2.34.1

1 0

[PATCH 1/3] alsa: Fix bug#13087 remove services entry
by Adolf Belka 21 Apr '23

21 Apr '23

- alsa has an initscript but it is not starting and stopping a traditional daemon service. The initscript loads some alsa modules and then restores the asound.state file - This patch updates the PAK_VER number and removes the services entry and explicitly adds alsa in for the initscript installation. Fixes: Bug#13087 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/alsa | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/alsa b/lfs/alsa index 2d89af880..5c74bd182 100644 --- a/lfs/alsa +++ b/lfs/alsa @@ -37,11 +37,11 @@ DL_FILE = $(THISAPP).tar.bz2 DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) PROG = alsa -PAK_VER = 15 +PAK_VER = 16 DEPS = -SERVICES = alsa +SERVICES = TARGET = $(DIR_INFO)/$(THISAPP) @@ -104,6 +104,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP)/alsa-firmware-$(FVER) && make $(MAKETUNING) $(EXTRA_MAKE) cd $(DIR_APP)/alsa-firmware-$(FVER) && make install # install initscript - $(call INSTALL_INITSCRIPTS,$(SERVICES)) + $(call INSTALL_INITSCRIPTS,alsa) @rm -rf $(DIR_SRC)/alsa* @$(POSTBUILD) -- 2.40.0

1 2

[PATCH] firewall: Drop legacy rules for PPPoE/PPTP
by Michael Tremer 21 Apr '23

21 Apr '23

These rules where created to permit any local traffic to the firewall when using a PPP connection that utilised Ethernet as transport. This is however nonsensical and a security issue for any other connection methods that call the RED interface "red0" and use PPP (e.g. QMI). Since PPPoE packets do not flow through iptables, these rules can be dropped safely. We do not know whether PPTP works at all these days. Fixes: #13088 - firewall: INPUT accepts all packets when using QMI for dial-in Tested-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Tested-by: Arne Fitzenreiter <arne_f(a)ipfire.org> Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- src/initscripts/system/firewall | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index dfa08d58b..50f2b3e02 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -424,19 +424,6 @@ iptables_red_up() { fi fi - # PPPoE / PPTP Device - if [ "$IFACE" != "" ]; then - # PPPoE / PPTP - if [ "$DEVICE" != "" ]; then - iptables -A REDINPUT -i $DEVICE -j ACCEPT - fi - if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then - if [ "$RED_DEV" != "" ]; then - iptables -A REDINPUT -i $RED_DEV -j ACCEPT - fi - fi - fi - # PPTP over DHCP if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT -- 2.30.2

1 0

[PATCH] Increase size of /boot to 512 MiB
by Michael Tremer 21 Apr '23

21 Apr '23

Is XFS is being selected as file system, the minimum size requirement is 300 MiB. In order to keep it to a round number, this patch increases the size of /boot to 512 MiB. To keep all systems consistent, we will also do this on systems that are being formatted using different file systems. Fixes: #13077 - xfs cannot installed anymore because boot is to small Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/flash-images | 4 ++-- src/installer/hw.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/flash-images b/lfs/flash-images index e6b25da1c..464ad5edf 100644 --- a/lfs/flash-images +++ b/lfs/flash-images @@ -77,9 +77,9 @@ else PART_TYPE = L endif -# /boot: 256 MB - OFFSET +# /boot: 512 MB - OFFSET # / : 1800 MB -S_BOOT := $(shell echo $$(( 524288 - $(S_OFFSET) ))) +S_BOOT := $(shell echo $$(( 1048576 - $(S_OFFSET) ))) S_ROOT := 3773292 ifeq "$(EFI)" "1" diff --git a/src/installer/hw.c b/src/installer/hw.c index 9d11d85de..894b887d9 100644 --- a/src/installer/hw.c +++ b/src/installer/hw.c @@ -490,7 +490,7 @@ static unsigned long long hw_swap_size(struct hw_destination* dest) { } static unsigned long long hw_boot_size(struct hw_destination* dest) { - return MB2BYTES(256); + return MB2BYTES(512); } static int hw_device_has_p_suffix(const struct hw_destination* dest) { -- 2.30.2

1 0

[PATCH] libgcrypt: Update to version 1.10.2
by Adolf Belka 19 Apr '23

19 Apr '23

- Update from version 1.10.1 to 1.10.2 - Update of rootfile - Changelog Noteworthy changes in version 1.10.2 (2023-04-06) [C24/A4/R2] * Bug fixes: - Fix Argon2 for the case output > 64. [rC13b5454d26] - Fix missing HWF_PPC_ARCH_3_10 in HW feature. [rCe073f0ed44] - Fix RSA key generation failure in forced FIPS mode. [T5919] - Fix gcry_pk_hash_verify for explicit hash. [T6066] - Fix a wrong result of gcry_mpi_invm. [T5970] - Allow building with --disable-asm for HPPA. [T5976] - Fix Jitter RNG for building native on Windows. [T5891] - Allow building with -Oz. [T6432] - Enable the fast path to ChaCha20 only when supported. [T6384] - Use size_t to avoid counter overflow in Keccak when directly feeding more than 4GiB. [T6217] * Other: - Do not use secure memory for a DRBG instance. [T5933] - Do not allow PKCS#1.5 padding for encryption in FIPS mode. [T5918] - Fix the behaviour for child process re-seeding in the DRBG. [rC019a40c990] - Allow verification of small RSA signatures in FIPS mode. [T5975] - Allow the use of a shorter salt for KDFs in FIPS mode. [T6039] - Run digest+sign self tests for RSA and ECC in FIPS mode. [rC06c9350165] - Add function-name based FIPS indicator function. GCRYCTL_FIPS_SERVICE_INDICATOR_FUNCTION. This is not considered an ABI changes because the new FIPS features were not yet approved. [rC822ee57f07] - Improve PCT in FIPS mode. [rC285bf54b1a, rC4963c127ae, T6397] - Use getrandom (GRND_RANDOM) in FIPS mode. [rCcf10c74bd9] - Disable RSA-OAEP padding in FIPS mode. [rCe5bfda492a] - Check minimum allowed key size in PBKDF in FIPS mode. [T6039,T6219] - Get maximum 32B of entropy at once in FIPS mode. [rCce0df08bba] - Prefer gpgrt-config when available. [T5034] - Mark AESWRAP as approved FIPS algorithm. [T5512] - Prevent usage of long salt for PSS in FIPS mode. [rCfdd2a8b332] - Prevent usage of X9.31 keygen in FIPS mode. [rC392e0ccd25] - Remove GCM mode from the allowed FIPS indicators. [rC1540698389] - Add explicit FIPS indicators for hash and MAC algorithms. [T6376] Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/libgcrypt | 2 +- lfs/libgcrypt | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/libgcrypt b/config/rootfiles/common/libgcrypt index 8e7f74392..fe687dab5 100644 --- a/config/rootfiles/common/libgcrypt +++ b/config/rootfiles/common/libgcrypt @@ -6,7 +6,7 @@ #usr/lib/libgcrypt.la #usr/lib/libgcrypt.so usr/lib/libgcrypt.so.20 -usr/lib/libgcrypt.so.20.4.1 +usr/lib/libgcrypt.so.20.4.2 #usr/lib/pkgconfig/libgcrypt.pc #usr/share/aclocal/libgcrypt.m4 #usr/share/info/gcrypt.info diff --git a/lfs/libgcrypt b/lfs/libgcrypt index bf81a0645..a79f5bed2 100644 --- a/lfs/libgcrypt +++ b/lfs/libgcrypt @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.10.1 +VER = 1.10.2 THISAPP = libgcrypt-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 46f30459891183b6d9ec18f1c7907fee0ad156c7dd75044f3db2b4d1c19dc6f30b2dfa6f85bc82adc9243aaba913e40fb6faf77d2226ca5a33897220d032437a +$(DL_FILE)_BLAKE2 = c86b29648664aae3fb694b20ad258828d2cecbb09db2b83df00fbdebd5d74228c92015c50f659c250cb0768ccaef7949294d9b7cdcd47e1387b7dce81d35da19 install : $(TARGET) -- 2.40.0

1 4

[PATCH 1/2] linux: Update to 6.1.24
by Peter Müller 19 Apr '23

19 Apr '23

Compiling the kernel has automatically introduced CONFIG_INIT_STACK_ALL_ZERO=y and removed GCC's structleak plugin (not to be confused with its stackleak counterpart). However, according to related documentation, this neither introduces a security nor performance disadvantage. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 24 ++++++++++------------ config/kernel/kernel.config.x86_64-ipfire | 24 ++++++++++------------ config/rootfiles/common/x86_64/linux | 4 ---- lfs/linux | 4 ++-- 4 files changed, 24 insertions(+), 32 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 9fbe4b7a2..7e3918d84 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,15 +1,15 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.1.6-ipfire Kernel Configuration +# Linux/arm64 6.1.24-ipfire Kernel Configuration # -CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.3.0" +CONFIG_CC_VERSION_TEXT="gcc (GCC) 12.2.0" CONFIG_CC_IS_GCC=y -CONFIG_GCC_VERSION=110300 +CONFIG_GCC_VERSION=120200 CONFIG_CLANG_VERSION=0 CONFIG_AS_IS_GNU=y -CONFIG_AS_VERSION=23900 +CONFIG_AS_VERSION=24000 CONFIG_LD_IS_BFD=y -CONFIG_LD_VERSION=23900 +CONFIG_LD_VERSION=24000 CONFIG_LLD_VERSION=0 CONFIG_CC_CAN_LINK=y CONFIG_CC_CAN_LINK_STATIC=y @@ -1536,7 +1536,6 @@ CONFIG_DEFAULT_NET_SCH="fq_codel" # CONFIG_NET_CLS=y CONFIG_NET_CLS_BASIC=m -CONFIG_NET_CLS_TCINDEX=m CONFIG_NET_CLS_ROUTE4=m CONFIG_NET_CLS_FW=m CONFIG_NET_CLS_U32=m @@ -3544,7 +3543,6 @@ CONFIG_SERIAL_ARC=m CONFIG_SERIAL_ARC_NR_PORTS=1 # CONFIG_SERIAL_RP2 is not set CONFIG_SERIAL_FSL_LPUART=m -CONFIG_SERIAL_FSL_LPUART_CONSOLE=y CONFIG_SERIAL_FSL_LINFLEXUART=y CONFIG_SERIAL_FSL_LINFLEXUART_CONSOLE=y # CONFIG_SERIAL_CONEXANT_DIGICOLOR is not set @@ -5463,7 +5461,6 @@ CONFIG_DVB_SP2=m CONFIG_APERTURE_HELPERS=y CONFIG_DRM=m CONFIG_DRM_MIPI_DSI=y -CONFIG_DRM_USE_DYNAMIC_DEBUG=y CONFIG_DRM_KMS_HELPER=m # CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set CONFIG_DRM_DEBUG_MODESET_LOCK=y @@ -5943,6 +5940,7 @@ CONFIG_SND_HDA_CODEC_SI3054=m CONFIG_SND_HDA_GENERIC=m CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0 # CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set +# CONFIG_SND_HDA_CTL_DEV_ID is not set # end of HD-Audio CONFIG_SND_HDA_CORE=m @@ -7937,16 +7935,16 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf" # # Kernel hardening options # -CONFIG_GCC_PLUGIN_STRUCTLEAK=y # # Memory initialization # +CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y +CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y +CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y # CONFIG_INIT_STACK_NONE is not set -# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set -# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set -CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y -# CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE is not set +# CONFIG_INIT_STACK_ALL_PATTERN is not set +CONFIG_INIT_STACK_ALL_ZERO=y # CONFIG_GCC_PLUGIN_STACKLEAK is not set CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 988ec980b..867e99e9f 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,15 +1,15 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.1.6 Kernel Configuration +# Linux/x86 6.1.24-ipfire Kernel Configuration # -CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.3.0" +CONFIG_CC_VERSION_TEXT="gcc (GCC) 12.2.0" CONFIG_CC_IS_GCC=y -CONFIG_GCC_VERSION=110300 +CONFIG_GCC_VERSION=120200 CONFIG_CLANG_VERSION=0 CONFIG_AS_IS_GNU=y -CONFIG_AS_VERSION=23900 +CONFIG_AS_VERSION=24000 CONFIG_LD_IS_BFD=y -CONFIG_LD_VERSION=23900 +CONFIG_LD_VERSION=24000 CONFIG_LLD_VERSION=0 CONFIG_CC_CAN_LINK=y CONFIG_CC_CAN_LINK_STATIC=y @@ -1579,7 +1579,6 @@ CONFIG_DEFAULT_NET_SCH="fq_codel" # CONFIG_NET_CLS=y CONFIG_NET_CLS_BASIC=m -CONFIG_NET_CLS_TCINDEX=m CONFIG_NET_CLS_ROUTE4=m CONFIG_NET_CLS_FW=m CONFIG_NET_CLS_U32=m @@ -3444,7 +3443,6 @@ CONFIG_SERIAL_ARC_NR_PORTS=1 CONFIG_SERIAL_RP2=m CONFIG_SERIAL_RP2_NR_UARTS=32 CONFIG_SERIAL_FSL_LPUART=m -CONFIG_SERIAL_FSL_LPUART_CONSOLE=y CONFIG_SERIAL_FSL_LINFLEXUART=m CONFIG_SERIAL_SPRD=m # end of Serial drivers @@ -5171,7 +5169,6 @@ CONFIG_INTEL_GTT=y CONFIG_VGA_SWITCHEROO=y CONFIG_DRM=m CONFIG_DRM_MIPI_DSI=y -CONFIG_DRM_USE_DYNAMIC_DEBUG=y CONFIG_DRM_KMS_HELPER=m # CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set # CONFIG_DRM_DEBUG_MODESET_LOCK is not set @@ -5614,6 +5611,7 @@ CONFIG_SND_HDA_CODEC_SI3054=m CONFIG_SND_HDA_GENERIC=m CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0 # CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set +# CONFIG_SND_HDA_CTL_DEV_ID is not set # end of HD-Audio CONFIG_SND_HDA_CORE=m @@ -7153,16 +7151,16 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf" # # Kernel hardening options # -CONFIG_GCC_PLUGIN_STRUCTLEAK=y # # Memory initialization # +CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y +CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y +CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y # CONFIG_INIT_STACK_NONE is not set -# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set -# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set -CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y -# CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE is not set +# CONFIG_INIT_STACK_ALL_PATTERN is not set +CONFIG_INIT_STACK_ALL_ZERO=y # CONFIG_GCC_PLUGIN_STACKLEAK is not set CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index fab1e5064..58ca6d1cd 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -7460,7 +7460,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/DRM_TTM #lib/modules/KVER-ipfire/build/include/config/DRM_TTM_HELPER #lib/modules/KVER-ipfire/build/include/config/DRM_UDL -#lib/modules/KVER-ipfire/build/include/config/DRM_USE_DYNAMIC_DEBUG #lib/modules/KVER-ipfire/build/include/config/DRM_VBOXVIDEO #lib/modules/KVER-ipfire/build/include/config/DRM_VIRTIO_GPU #lib/modules/KVER-ipfire/build/include/config/DRM_VMWGFX @@ -9133,7 +9132,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/NET_CLS_ROUTE4 #lib/modules/KVER-ipfire/build/include/config/NET_CLS_RSVP #lib/modules/KVER-ipfire/build/include/config/NET_CLS_RSVP6 -#lib/modules/KVER-ipfire/build/include/config/NET_CLS_TCINDEX #lib/modules/KVER-ipfire/build/include/config/NET_CLS_U32 #lib/modules/KVER-ipfire/build/include/config/NET_CORE #lib/modules/KVER-ipfire/build/include/config/NET_DEVLINK @@ -10358,7 +10356,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/SERIAL_EARLYCON #lib/modules/KVER-ipfire/build/include/config/SERIAL_FSL_LINFLEXUART #lib/modules/KVER-ipfire/build/include/config/SERIAL_FSL_LPUART -#lib/modules/KVER-ipfire/build/include/config/SERIAL_FSL_LPUART_CONSOLE #lib/modules/KVER-ipfire/build/include/config/SERIAL_JSM #lib/modules/KVER-ipfire/build/include/config/SERIAL_LANTIQ #lib/modules/KVER-ipfire/build/include/config/SERIAL_MCTRL_GPIO @@ -22762,7 +22759,6 @@ lib/modules/KVER-ipfire/kernel #lib/modules/KVER-ipfire/kernel/net/sched/cls_route.ko.xz #lib/modules/KVER-ipfire/kernel/net/sched/cls_rsvp.ko.xz #lib/modules/KVER-ipfire/kernel/net/sched/cls_rsvp6.ko.xz -#lib/modules/KVER-ipfire/kernel/net/sched/cls_tcindex.ko.xz #lib/modules/KVER-ipfire/kernel/net/sched/cls_u32.ko.xz #lib/modules/KVER-ipfire/kernel/net/sched/em_cmp.ko.xz #lib/modules/KVER-ipfire/kernel/net/sched/em_ipset.ko.xz diff --git a/lfs/linux b/lfs/linux index b790a4fe3..d9f7bdd71 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,7 +24,7 @@ include Config -VER = 6.1.11 +VER = 6.1.24 ARM_PATCHES = 6.1.y-ipfire0 THISAPP = linux-$(VER) @@ -75,7 +75,7 @@ objects = \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_BLAKE2 = 2a1dc1acd63308d72a927f39bc5a9be0bc220673655422c90113300598e754d16021cec85751044114d161a82e476473896bd778180d889d54917ce19d176b4c +$(DL_FILE)_BLAKE2 = 2f20ad999655226bc79caca109bde0f940420d87a293cf000f2d8304122bdfcc388c1a558ff26f2f551c9b6133b8fb120dbd537f914e1b88d0fbbd5408e648b0 arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 3ef9a778c5c41ee8bf2942a48f63b21228a632a2910d2123f01155bbf571592898cffffa61c387a5a6c817b62e458947b4c406c6591b23b5401faa47b020337f install : $(TARGET) -- 2.35.3

2 2

[PATCH] libcap: Update to version 2.67
by Adolf Belka 18 Apr '23

18 Apr '23

- Update from version 2.66 to 2.67 - Update of rootfile - Changelog Release notes for 2.67 Replace use of fgrep with grep -F (POSIX grep flags preferred by GNU grep) - patch from David Seifert. Added SPDX identifiers to License file(s). Hopefully this will help the various robots out there correctly identify the longstanding licenses for libcap and friends. (Bug: 216609 reported by Günther Noack) Started down the rabbit hole of trying to address (Bug: 216610 reported by Günther Noack on behalf of Michael Stapelberg) The basic issue is how to link C code with Go psx without using CGo. This is all a low level hackery. If you are interested, browse the source. Correct for bad whatis entries in man pages (this was throwing a Debian build test, detail) Also reviewed man pages and addressed cross linkage issues (Bug: 216585) Cleaned up some README.md files (made a github mirror now just so I can automatically render them). Changed meaning of DYNAMIC=no builds. This now builds everything with static linking except for libc. The reason for this exception is explained in the commit message. Inserted demonstration exploit code in capso.so to support article. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/libcap | 9 +++++++-- lfs/libcap | 8 ++++---- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/common/libcap b/config/rootfiles/common/libcap index f0518d6aa..194fc7f19 100644 --- a/config/rootfiles/common/libcap +++ b/config/rootfiles/common/libcap @@ -1,8 +1,8 @@ lib/libcap.so.2 -lib/libcap.so.2.66 +lib/libcap.so.2.67 #lib/libpsx.so #lib/libpsx.so.2 -lib/libpsx.so.2.66 +lib/libpsx.so.2.67 #lib/pkgconfig/libcap.pc #lib/pkgconfig/libpsx.pc lib/security/pam_cap.so @@ -32,6 +32,7 @@ usr/lib/libcap.so #usr/share/man/man3/cap_get_file.3 #usr/share/man/man3/cap_get_flag.3 #usr/share/man/man3/cap_get_mode.3 +#usr/share/man/man3/cap_get_nsowner.3 #usr/share/man/man3/cap_get_pid.3 #usr/share/man/man3/cap_get_proc.3 #usr/share/man/man3/cap_get_secbits.3 @@ -59,10 +60,14 @@ usr/lib/libcap.so #usr/share/man/man3/cap_mode.3 #usr/share/man/man3/cap_mode_name.3 #usr/share/man/man3/cap_new_launcher.3 +#usr/share/man/man3/cap_prctl.3 +#usr/share/man/man3/cap_prctlw.3 +#usr/share/man/man3/cap_proc_root.3 #usr/share/man/man3/cap_set_fd.3 #usr/share/man/man3/cap_set_file.3 #usr/share/man/man3/cap_set_flag.3 #usr/share/man/man3/cap_set_mode.3 +#usr/share/man/man3/cap_set_nsowner.3 #usr/share/man/man3/cap_set_proc.3 #usr/share/man/man3/cap_set_secbits.3 #usr/share/man/man3/cap_setgroups.3 diff --git a/lfs/libcap b/lfs/libcap index f81b13c99..9eab679ff 100644 --- a/lfs/libcap +++ b/lfs/libcap @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.66 +VER = 2.67 THISAPP = libcap-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = e79bf10c6a3dbffe96dc97aad0bed67caa0b3805d9dcaff1e4a8a833396ee5c6da4f7f0d321b254e99a00073bc39021b9f3a4b350d93094d0df4d74889b3ca56 +$(DL_FILE)_BLAKE2 = bd9be22e439397a3c1726093cfee2410df93773b3139d50a1cdc10daecb666ddb9b64daded6e0ec9f2fd6defd16ea156dbd66bd55360ea266131f31ea0f0e989 install : $(TARGET) @@ -75,7 +75,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && make GOLANG=no cd $(DIR_APP) && make install GOLANG=no rm -vf /lib/libcap.so - ln -svf /lib/libcap.so.2.66 /usr/lib/libcap.so + ln -svf /lib/libcap.so.2.67 /usr/lib/libcap.so chmod +x /lib/libcap.so.* @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.40.0

2 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2023