Development August 2023

development@lists.ipfire.org

10 participants
55 discussions

[PATCH] manualpages: correct link to dns help page
by Jon Murphy 21 Aug '23

21 Aug '23

- point the dns help link to "configuration/network/dns-server" Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- config/cfgroot/manualpages | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/cfgroot/manualpages b/config/cfgroot/manualpages index e99986899..fe5ebc0b8 100644 --- a/config/cfgroot/manualpages +++ b/config/cfgroot/manualpages @@ -33,7 +33,7 @@ mdstat.cgi=configuration/status/mdstat # Network menu zoneconf.cgi=configuration/network/zoneconf -dns.cgi=dns +dns.cgi=configuration/network/dns-server proxy.cgi=configuration/network/proxy urlfilter.cgi=configuration/network/proxy/url-filter updatexlrator.cgi=configuration/network/proxy/update_accelerator -- 2.30.2

1 0

Start local and uplink network independent
by Jonatan Schlag 21 Aug '23

21 Aug '23

Hi, this is the first try for a patch series which makes the startup of local and uplink networks independent. This resolves in the end #11502. It should further allow us to keep waiting for a DHCP lease, because at least our local networks are all up when we get to the red network. This might have some small quirks, even when my testing so far shows no problems. I still think it is now better to share result, then to wait any longer. As this touches quite important parts of our network stack, I might be a could idea to merge this in two stages. After the patch, titled "network startup: Clean up duplicated Code ", might be a good breaking point. But in the end, this is up to you. Please keep in mind, I only tested the full patch set: Remove ipsec interface creation from network startup Remove Start/Stop links for client175 Use bash as shebang in network initscripts network initscripts: check if the zone in the current config exists network initscripts: Remove code for old zone scheme network scripts: remove check for AUTOCONNECT network startup: Reload routing informations for every interface network startup: Always cleanup before red gets started network startup: check for correct action at start network startup: Refactor how cmd args are processed network startup: Clean up duplicated Code network script: add extra scripts for action that depend on a network network startup: Add scripts for local and uplink network startup: Start local and uplink network independent network startup: Only work with configured zones config/rootfiles/common/aarch64/initscripts | 31 +++-- config/rootfiles/common/riscv64/initscripts | 31 +++-- config/rootfiles/common/x86_64/initscripts | 31 +++-- lfs/initscripts | 36 +++--- src/initscripts/networking/any | 31 ++++- src/initscripts/networking/functions.network | 14 +- src/initscripts/networking/red | 5 +- .../networking/red.up/99-pakfire-update | 2 +- src/initscripts/system/depends-on-network | 40 ++++++ src/initscripts/system/network | 121 ++++++++---------- 10 files changed, 218 insertions(+), 124 deletions(-) create mode 100644 src/initscripts/system/depends-on-network Looking forward to your feedback Greetings Jonatan

2 34

[PATCH] avahi-daemo: remove orange interface
by Jon Murphy 20 Aug '23

20 Aug '23

- fix Bug 13202 - add non-default config file - enable mDNS reflector - remove IPv6 Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- config/avahi/avahi-daemon.conf | 69 ++++++++++++++++++++++++++++++++++ lfs/avahi | 9 +++-- 2 files changed, 75 insertions(+), 3 deletions(-) create mode 100644 config/avahi/avahi-daemon.conf diff --git a/config/avahi/avahi-daemon.conf b/config/avahi/avahi-daemon.conf new file mode 100644 index 000000000..7e2b951db --- /dev/null +++ b/config/avahi/avahi-daemon.conf @@ -0,0 +1,69 @@ +# This file is part of avahi. +# +# avahi is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as +# published by the Free Software Foundation; either version 2 of the +# License, or (at your option) any later version. +# +# avahi is distributed in the hope that it will be useful, but WITHOUT +# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public +# License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with avahi; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 +# USA. + +# See avahi-daemon.conf(5) for more information on this configuration +# file! + +[server] +#host-name=foo +#domain-name=local +#browse-domains=0pointer.de, zeroconf.org +use-ipv4=yes +use-ipv6=no +#allow-interfaces=eth0 +deny-interfaces=orange0 +#check-response-ttl=no +#use-iff-running=no +#enable-dbus=yes +#disallow-other-stacks=no +#allow-point-to-point=no +#cache-entries-max=4096 +#clients-max=4096 +#objects-per-client-max=1024 +#entries-per-entry-group-max=32 +ratelimit-interval-usec=1000000 +ratelimit-burst=1000 + +[wide-area] +enable-wide-area=yes + +[publish] +#disable-publishing=no +#disable-user-service-publishing=no +#add-service-cookie=no +#publish-addresses=yes +publish-hinfo=no +publish-workstation=no +#publish-domain=yes +#publish-dns-servers=192.168.50.1, 192.168.50.2 +#publish-resolv-conf-dns-servers=yes +#publish-aaaa-on-ipv4=yes +#publish-a-on-ipv6=no + +[reflector] +enable-reflector=yes +#reflect-ipv=no +#reflect-filters=_airplay._tcp.local,_raop._tcp.local + +[rlimits] +#rlimit-as= +#rlimit-core=0 +#rlimit-data=8388608 +#rlimit-fsize=0 +#rlimit-nofile=768 +#rlimit-stack=8388608 +#rlimit-nproc=3 diff --git a/lfs/avahi b/lfs/avahi index 6564e6c38..fe5df10db 100644 --- a/lfs/avahi +++ b/lfs/avahi @@ -32,9 +32,9 @@ THISAPP = avahi-$(VER) DL_FILE = $(THISAPP).tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) -TARGET = $(DIR_INFO)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) PROG = avahi -PAK_VER = 12 +PAK_VER = 13 DEPS = dbus libdaemon @@ -101,8 +101,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install + # Add conf file to /etc/avahi directory + cp -vf $(DIR_CONF)/avahi/avahi-daemon.conf /etc/avahi + # Install configuration for samba - cp -avf $(DIR_SRC)/config/avahi/smb.service /etc/avahi/services/smb.service + cp -avf $(DIR_CONF)/avahi/smb.service /etc/avahi/services/smb.service # Install initscript $(call INSTALL_INITSCRIPTS,$(SERVICES)) -- 2.30.2

1 0

[PATCH] dhcpcd: Update to version 10.0.2
by Adolf Belka 20 Aug '23

20 Aug '23

- Update from version 10.0.1 to 10.0.2 - Update of rootfile not required - Changelog 10.0.2 Major changes listed as:- chore: Link to GitHub for the updated commit log by @frazar in #203 Additional DHCP options by @rrobgill in #214 risc-v fix vendor error by @Im-0xea in #213 compat sync by @tobhe in #226 Commit list can be seen at https://github.com/NetworkConfiguration/dhcpcd/compare/v10.0.1...v10.0.2 This includes two bug fixes for two situations causing segfaults Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/dhcpcd | 6 +++--- ...cd-10.0.2-Allow-free-selection-of-MTU-by-the-user.patch} | 0 2 files changed, 3 insertions(+), 3 deletions(-) rename src/patches/{dhcpcd-10.0.1-Allow-free-selection-of-MTU-by-the-user.patch => dhcpcd-10.0.2-Allow-free-selection-of-MTU-by-the-user.patch} (100%) diff --git a/lfs/dhcpcd b/lfs/dhcpcd index 136494ed1..909de6e57 100644 --- a/lfs/dhcpcd +++ b/lfs/dhcpcd @@ -24,7 +24,7 @@ include Config -VER = 10.0.1 +VER = 10.0.2 THISAPP = dhcpcd-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f1e93285d040b98bede86bb2e87e372afc0d1d124e7a6580c23d8d228a34ee17001fc3c2d9091b16fb082fe2f2ad7ba50c0dd7b0db2b2237ab1cff9ca152100a +$(DL_FILE)_BLAKE2 = 999033b4c0bc46943332b0b7ed3f1869ad54e2c37346523a15fbd3d9f29db1e01c1ddd0a300826021d3e20493ea06358ef47ac6a02c50331ca0d90e31a123b85 install : $(TARGET) @@ -70,7 +70,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcpcd-10.0.1-Allow-free-selection-of-MTU-by-the-user.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dhcpcd-10.0.2-Allow-free-selection-of-MTU-by-the-user.patch cd $(DIR_APP) && ./configure \ --prefix="" \ --sysconfdir=/var/ipfire/dhcpc \ diff --git a/src/patches/dhcpcd-10.0.1-Allow-free-selection-of-MTU-by-the-user.patch b/src/patches/dhcpcd-10.0.2-Allow-free-selection-of-MTU-by-the-user.patch similarity index 100% rename from src/patches/dhcpcd-10.0.1-Allow-free-selection-of-MTU-by-the-user.patch rename to src/patches/dhcpcd-10.0.2-Allow-free-selection-of-MTU-by-the-user.patch -- 2.41.0

1 1

[PATCH] clamav: Update to 1.1.1
by Matthias Fischer 19 Aug '23

19 Aug '23

For details see: https://blog.clamav.net/2023/07/2023-08-16-releases.html Excerpts from changelog: "ClamAV 1.1.1 is a critical patch release with the following fixes: CVE-2023-20197 Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Fixed a build issue when using the Rust nightly toolchain, which was affecting the oss-fuzz build environment used for regression tests. Fixed a build issue on Windows when using Rust version 1.70 or newer. CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain. The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer. Removed a warning message showing the HTTP response codes during the Freshclam database update process." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/clamav | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/clamav b/lfs/clamav index c48c48834..88619afcb 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -26,7 +26,7 @@ include Config SUMMARY = Antivirus Toolkit -VER = 1.1.0 +VER = 1.1.1 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 67 +PAK_VER = 68 DEPS = @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 6a30558b8e6d2f8d98eb0b990e58ec9a19d7f58b11863ec5dffe97f45c73c1ea8bb0360456193c76d178068ee5eb7f01fc44851eb7bf90d42ca9dd9431413a4f +$(DL_FILE)_BLAKE2 = 880318a2be3dcc8bc425cd6d7bbc4fb2b6dd28e9f491dcac382e8a9ff7c0229d846512127c6e10a1e1aa7daa5ac53a5284462e341f29725269f8862e73310caa install : $(TARGET) -- 2.34.1

1 0

[PATCH] ppp: Bug#13164 - Update configure options to have correct directory for pid
by Adolf Belka 18 Aug '23

18 Aug '23

- The original poster of the bug#13164 has already tested out ppp-2.5.0 in CU179 (master) and identified that the startup could not find the directory /usr/var/run/. This is due to the change in use of the prefix command in 2.5.0 vs 2.4.9 so --localstatedir set to /var. runstatedir is then set to localstatedir/run ie /var/run which is then correct for IPFire. - This fix needs to be implemented into CU179 so that the bug poster can test out the update - Updated rootfile to remove additional empty line Fixes: Bug#13164 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/ppp | 1 - lfs/ppp | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/config/rootfiles/common/ppp b/config/rootfiles/common/ppp index 6098fa7c3..379c64af4 100644 --- a/config/rootfiles/common/ppp +++ b/config/rootfiles/common/ppp @@ -71,4 +71,3 @@ usr/sbin/pppstats #usr/share/man/man8/pppoe-discovery.8 #usr/share/man/man8/pppstats.8 var/log/connect-errors - diff --git a/lfs/ppp b/lfs/ppp index fc4528ece..a6bd633b4 100644 --- a/lfs/ppp +++ b/lfs/ppp @@ -82,6 +82,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --prefix=/usr \ --sysconfdir=/etc \ --with-logfile-dir=/var/log \ + --localstatedir=/var \ cc="gcc" \ cflags="$(CFLAGS)" cd $(DIR_APP) && make $(MAKETUNING) -- 2.41.0

1 0

[PATCH] openvpn: Update to version 2.5.9
by Adolf Belka 16 Aug '23

16 Aug '23

- Update from version 2.5.8 to 2.5.9 which is the last version in the 2.5 series - Update of rootfile not required - Tested openvpn-2.5.9 in my vm testbed. OpenVPN RW connection worked fine. Also tested OpenVPN N2N connection with CU179 & OpenVPN version 2.5.9 at one end and CU177 & OpenVPN version 2.5.8 at the other end. N2N connection worked with no problemns. - Changelog 2.5.9 Implement optional cipher in --data-ciphers prefixed with ? Fix handling an optional invalid cipher at the end of data-ciphers Ensure that argument to parse_line has always space for final sentinel Improve documentation on user/password requirement and unicodize function Remove unused gc_arena Fix corner case that might lead to leaked file descriptor msvc: always call git-version.py git-version.py: proper support for tags Check if pkcs11_cert is NULL before freeing it Do not add leading space to pushed options pull-filter: ignore leading "spaces" in option names Do not include auth-token in pulled option digest Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/openvpn | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/openvpn b/lfs/openvpn index db2246206..b71b4ccc9 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.5.8 +VER = 2.5.9 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = d029f6facd94a82aa28765cab340130dd4e5a4ffc2e0ccf3bf4888aee52d337126c21fdd7304dbaad5fe67d0a1f8d44e5a3c44801dcfa935aef200675ac5167f +$(DL_FILE)_BLAKE2 = e5110ebb9149121c11de45f085f66d30a89fb674ad96c5792d83b16dc29c95215a91e682adb3c800b91ed4d88d6d24b5bcae0799cdb855a284832f0668ffcb82 install : $(TARGET) -- 2.41.0

1 0

[PATCH 1/7] ffmpeg: Fix build with binutils 2.41
by Michael Tremer 15 Aug '23

15 Aug '23

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/ffmpeg | 2 +- ...hpops-clip-constants-used-with-shift.patch | 76 +++++++++++++++++++ 2 files changed, 77 insertions(+), 1 deletion(-) create mode 100644 src/patches/ffmpeg-6.0-mathpops-clip-constants-used-with-shift.patch diff --git a/lfs/ffmpeg b/lfs/ffmpeg index d989846d5..836c4dd37 100644 --- a/lfs/ffmpeg +++ b/lfs/ffmpeg @@ -85,7 +85,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/ffmpeg-6.0-mathpops-clip-constants-used-with-shift.patch cd $(DIR_APP) && \ CFLAGS="$(CFLAGS)" \ LDFLAGS="$(LDFLAGS)" \ diff --git a/src/patches/ffmpeg-6.0-mathpops-clip-constants-used-with-shift.patch b/src/patches/ffmpeg-6.0-mathpops-clip-constants-used-with-shift.patch new file mode 100644 index 000000000..52a931002 --- /dev/null +++ b/src/patches/ffmpeg-6.0-mathpops-clip-constants-used-with-shift.patch @@ -0,0 +1,76 @@ +From effadce6c756247ea8bae32dc13bb3e6f464f0eb Mon Sep 17 00:00:00 2001 +From: =?utf8?q?R=C3=A9mi=20Denis-Courmont?= <remi(a)remlab.net> +Date: Sun, 16 Jul 2023 18:18:02 +0300 +Subject: [PATCH] avcodec/x86/mathops: clip constants used with shift + instructions within inline assembly + +Fixes assembling with binutil as >= 2.41 + +Signed-off-by: James Almer <jamrial(a)gmail.com> +--- + libavcodec/x86/mathops.h | 26 +++++++++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +diff --git a/libavcodec/x86/mathops.h b/libavcodec/x86/mathops.h +index 6298f5ed19..ca7e2dffc1 100644 +--- a/libavcodec/x86/mathops.h ++++ b/libavcodec/x86/mathops.h +@@ -35,12 +35,20 @@ + static av_always_inline av_const int MULL(int a, int b, unsigned shift) + { + int rt, dummy; ++ if (__builtin_constant_p(shift)) + __asm__ ( + "imull %3 \n\t" + "shrdl %4, %%edx, %%eax \n\t" + :"=a"(rt), "=d"(dummy) +- :"a"(a), "rm"(b), "ci"((uint8_t)shift) ++ :"a"(a), "rm"(b), "i"(shift & 0x1F) + ); ++ else ++ __asm__ ( ++ "imull %3 \n\t" ++ "shrdl %4, %%edx, %%eax \n\t" ++ :"=a"(rt), "=d"(dummy) ++ :"a"(a), "rm"(b), "c"((uint8_t)shift) ++ ); + return rt; + } + +@@ -113,19 +121,31 @@ __asm__ volatile(\ + // avoid +32 for shift optimization (gcc should do that ...) + #define NEG_SSR32 NEG_SSR32 + static inline int32_t NEG_SSR32( int32_t a, int8_t s){ ++ if (__builtin_constant_p(s)) + __asm__ ("sarl %1, %0\n\t" + : "+r" (a) +- : "ic" ((uint8_t)(-s)) ++ : "i" (-s & 0x1F) + ); ++ else ++ __asm__ ("sarl %1, %0\n\t" ++ : "+r" (a) ++ : "c" ((uint8_t)(-s)) ++ ); + return a; + } + + #define NEG_USR32 NEG_USR32 + static inline uint32_t NEG_USR32(uint32_t a, int8_t s){ ++ if (__builtin_constant_p(s)) + __asm__ ("shrl %1, %0\n\t" + : "+r" (a) +- : "ic" ((uint8_t)(-s)) ++ : "i" (-s & 0x1F) + ); ++ else ++ __asm__ ("shrl %1, %0\n\t" ++ : "+r" (a) ++ : "c" ((uint8_t)(-s)) ++ ); + return a; + } + +-- +2.25.1 + -- 2.39.2

1 6

CU178 kernel fixes Testing
by Adolf Belka 15 Aug '23

15 Aug '23

Hi All, I didn't see any further notification about the kernel fixes in CU178 being available to test but looking in the Changelog in the nightlies it seemed that the fixes were available in the CU178 version in master. So I have tested it on 2 vm systems that I have. After update the systems were on 178 Development Build master/41e33931. During the reboot on both systems no issues were found and no red warning messages. OpenVPN RW and N2N both worked as normal after the update. Ran for a couple of hours and did a range of web activities. Everything worked as expected and all graphs reviewed showed data as normally expected. No problems found. Regards, Adolf.

4 9

Web Site blocked as hostile. Not sure if this is correct or not
by Adolf Belka 15 Aug '23

15 Aug '23

Hi Peter, I am getting a DROP_HOSTILE for a web site, oldlinux.org Looking in libloc it shows up as hostile location lookup 107.148.241.134 107.148.241.134: Network : 107.148.0.0/15 Country : United States of America Autonomous System : AS54600 - PEGTECHINC Hostile Network safe to drop: yes However in spamhaus it says that oldlinux.org and 107.148.241.134 have no issues. I ran a couple of blacklist checkers on the ip. blacklistchecker.com came back with a pass on everything. dnschecker.org came back with a pass on everything except from dnsbl.spfbl.net who have it flagged because it doesn't have an rDNS With the problems we are having currently with selective announcements of networks, I wasn't sure if this problem I have encountered is coming from the libloc database or is a real problem. oldlinux is hosted on the network from Peg Tech Inc hosting so maybe they are a hoster of hostile networks but I don't know how to confirm this. I wasn't sure about raising a new bug on this, or adding it to bug#13236, in case it was a real hostile network and should be blocked. Hoping you can help me with this. Regards, Adolf. -- Sent from my laptop

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development August 2023