Development January 2018

development@lists.ipfire.org

12 participants
52 discussions

Question regarding package updates, applying patches, and building
by Peter Müller 17 Jun '18

17 Jun '18

Hello, while trying to update entire packages in IPFire (some of them are outdated) and to fix some bugs, I ran into a couple of questions: (a) How to update entire packages? As far as I understood, to every package belongs a file in lfs/[package_name], containing information about how to build, apply patches to it, and so on. It seems like packages are downloaded from https://source.ipfire.org/ , but it did not became clear to me how to upload a new version of a package to this server. Of course, the download URL can be changed manually, but that seems rather ugly to me. Unfortunately, I was unable to find a sort of tutorial in the wiki for this issue. (b) How to apply patches to downloaded packages with changed filenames? As discussed in December (https://wiki.ipfire.org/devel/telco/2017-12-04), I am supposed to have a look at the DEFAULT cipher suite in OpenSSL. To change this value, the .tar.gz file needs to be downloaded and unpacked first. After that, the file "ssl/ssl.h" needs to be changed. The patch at src/patches/openssl-1.0.2h-weak-ciphers.patch does something similar: diff -Naur openssl-1.0.2h.org/ssl/ssl.h openssl-1.0.2h/ssl/ssl.h --- openssl-1.0.2h.org/ssl/ssl.h 2016-05-03 15:44:42.000000000 +0200 +++ openssl-1.0.2h/ssl/ssl.h 2016-05-03 18:49:10.393302264 +0200 @@ -338,7 +338,7 @@ * The following cipher list is used by default. It also is substituted when * an application-defined cipher list string starts with 'DEFAULT'. */ -# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2" +# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2:!RC2:!DES" /* * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always * starts with a reasonable order, and all we have to do for DEFAULT is But where does the file openssl-[...].org came from? (c) How to build the distribution partly? In the past, I handed in some patches to allow remote syslogging via TCP, too. After some struggles (settings are written by a C program, not the CGI file itself), I modified syslogdctrl.c, and the changes were shipped. (See https://bugzilla.ipfire.org/show_bug.cgi?id=11540 for details.) But since this program now crashes with a segfault on my machine (*sigh*), it seems like my patch contained some errors. However, building the entire distribution is somewhat time-consuming and not worth the effort for a probably small error. Is there any way of just building this C program, and omit the rest? Thanks in advance! Best regards, Peter Müller

2 3

Planning out Core Update 117
by Michael Tremer 12 May '18

12 May '18

Hello, so the big Core Update 115 has been shipped last week. Core Update 116 is coming today. So the next one should be a little bit calmer please :) I do not have anything so far except some smaller bug fixes here and there. Does anyone have anything big? It doesn't have to be another big update. We could also just improve IPFire where ever it is needed with loads of smaller changes and start working on 3 and other sub-projects that are floating around... Best, -Michael

5 31

[PATCH v2] show RNGD status at WebUI service page, too
by Peter Müller 27 Mar '18

27 Mar '18

Also show the status of the hardware random number generator ("RNGD") at the services.cgi page in the WebUI. Before, this was only shown at the entropy.cgi page, which was a bit inconsistent. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/services.cgi | 4 +++- src/initscripts/system/rngd | 6 ++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/services.cgi b/html/cgi-bin/services.cgi index 64fdbba05..eaaa5298a 100644 --- a/html/cgi-bin/services.cgi +++ b/html/cgi-bin/services.cgi @@ -56,6 +56,7 @@ my %servicenames =( $Lang::tr{'secure shell server'} => 'sshd', $Lang::tr{'vpn'} => 'charon', $Lang::tr{'web proxy'} => 'squid', + $Lang::tr{'random number generator daemon'} => 'rngd', 'OpenVPN' => 'openvpn' ); @@ -74,7 +75,8 @@ my %link =( "$Lang::tr{'intrusion detection system'} (GREEN)" => "<a href=\'ids.cgi\'>$Lang::tr{'intrusion detection system'} (GREEN)</a>", "$Lang::tr{'intrusion detection system'} (RED)" => "<a href=\'ids.cgi\'>$Lang::tr{'intrusion detection system'} (RED)</a>", "$Lang::tr{'intrusion detection system'} (ORANGE)" => "<a href=\'ids.cgi\'>$Lang::tr{'intrusion detection system'} (ORANGE)</a>", - "$Lang::tr{'intrusion detection system'} (BLUE)" => "<a href=\'ids.cgi\'>$Lang::tr{'intrusion detection system'} (BLUE)</a>" + "$Lang::tr{'intrusion detection system'} (BLUE)" => "<a href=\'ids.cgi\'>$Lang::tr{'intrusion detection system'} (BLUE)</a>", + "$Lang::tr{'random number generator daemon'}" => "<a href=\'entropy.cgi\'>$Lang::tr{'random number generator daemon'}</a>" ); my $lines=0; # Used to count the outputlines to make different bgcolor diff --git a/src/initscripts/system/rngd b/src/initscripts/system/rngd index df4aa7da2..9abcf6a79 100644 --- a/src/initscripts/system/rngd +++ b/src/initscripts/system/rngd @@ -30,10 +30,16 @@ case "${1}" in boot_mesg "Starting Random Number Generator Daemon..." if pidofproc /usr/sbin/rngd &>/dev/null; then + # Make sure PID file is readable. + test -f /run/rngd.pid && chmod 755 /run/rngd.pid + # Is already running. echo_ok else loadproc /usr/sbin/rngd --no-tpm=1 + + # Make sure PID file is readable. + test -f /run/rngd.pid && chmod 755 /run/rngd.pid fi ;; -- 2.13.6

2 1

Testing squid 4.0.23 - grsec denied kernel module auto-load of nf_conntrack_netlink by uid 23
by Matthias Fischer 11 Mar '18

11 Mar '18

Hi, Just to keep in touch, I tested 'squid 4.0.23' yesterday - it seemed to run fine at first. But after a while I took a closer look at the logs and discovered a bunch of kernel messages within a few hours and I don't know what exactly triggered these messages: ... 132 Time(s): grsec: denied kernel module auto-load of nf_conntrack_netlink by uid 23 ... As far as I found out: "uid 23" => squid-user, and the new squid tried to 'autoload' a module which 'grsec' didn't like. Is this a correct interpretation and has anyone some useable clue how to avoid this? Besides, after going back to '3.5.27' the messages didn't came back again. '4.0.22' didn't throw these messages, too. They changed something and I don't know what it is... Thanks for all tips! Best, Matthias

2 8

[PATCH] OpenVPN: Update to version 2.4.4
by Erik Kapfer 15 Feb '18

15 Feb '18

Changed LFS and ROOTFILE for OpenVPN 2.4.4 update. Added CRL updater script to LFS. Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> --- config/rootfiles/common/openvpn | 5 ++++- lfs/openvpn | 11 ++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index b58e30c..cbfd03e 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -1,3 +1,5 @@ +etc/fcron.daily/ovpn_crl_updater.sh +#usr/include/openvpn-msg.h #usr/include/openvpn-plugin.h #usr/lib/openvpn #usr/lib/openvpn/plugins @@ -10,11 +12,12 @@ usr/sbin/openvpn #usr/share/doc/openvpn #usr/share/doc/openvpn/COPYING #usr/share/doc/openvpn/COPYRIGHT.GPL +#usr/share/doc/openvpn/Changes.rst #usr/share/doc/openvpn/README #usr/share/doc/openvpn/README.IPv6 #usr/share/doc/openvpn/README.auth-pam #usr/share/doc/openvpn/README.down-root -#usr/share/doc/openvpn/README.polarssl +#usr/share/doc/openvpn/README.mbedtls #usr/share/doc/openvpn/management-notes.txt #usr/share/man/man8/openvpn.8 var/ipfire/ovpn/ca diff --git a/lfs/openvpn b/lfs/openvpn index 8307d01..e7f9bc2 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2017 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.3.18 +VER = 2.4.4 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 844ec9c64aae62051478784b8562f881 +$(DL_FILE)_MD5 = 7a2002aad1671b24457bc9432a0c5c52 install : $(TARGET) @@ -96,5 +96,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify chown root:root /usr/lib/openvpn/verify chmod 755 /usr/lib/openvpn/verify + mv -v /var/ipfire/ovpn/ovpn_crl_updater.sh /etc/fcron.daily + chown root:root /etc/fcron.daily/ovpn_crl_updater.sh + chmod 750 /etc/fcron.daily/ovpn_crl_updater.sh + @rm -rf $(DIR_APP) @$(POSTBUILD) + -- 2.7.4

4 28

Testing Core Update 118
by Peter Müller 06 Feb '18

06 Feb '18

Hello, I installed the Core Update 118 (beta) a few minutes ago: IPsec N2N WORKS NRPE WORKS Squid WORKS WebUI WORKS Snort (IDS) WORKS Currently, there are these two (minor) issues: (a) A patch of mine (marking 3DES and 1024 bit DH keys as weak, see: https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=6fc0f5eb92c51067f79cf19…) seems not to be applied. Maybe forgot to ship? (b) Changing the remote syslogging settings does not cause a crash anymore (this is fixed). However, changing protocol to "TCP" does not change anything in the configuration @ /etc/syslog.conf . Mea culpa, I've got to have a look at this *again*, but at least we do not have the segfault anymore. Apart from that, everything changed in 118 seems to work. Best regards, Peter Müller

3 11

IPSec Roadwarrior Configuration
by Tom Rymes 31 Jan '18

31 Jan '18

I suppose that this isn't particularly "Development" related, but I think it does touch upon features and functionality that are important to making the project attractive to new users and I also think that, perhaps, some changes might be needed to the WUI to keep up with changes to clients. I would think that a tried-and-true configuration that makes it easy for any user to implement a VPN using built-in clients would be a major benefit to the project. IPFire supports two methods for roadwarrior VPN clients, OpenVPN and IPSec. Of these, OpenVPN requires a client, while IPSec is supported natively by most or all major operating systems. For various reasons, I prefer IPSec. Perusing the internet, one can find many tutorials for how to configure Strongswan to work with roadwarrior clients, and some of them might even work. There seems to be a lot of confusion out there over which settings are needed to support the various client OSs, too. Most importantly, the WUI makes it look like this should just work out of the box, but I have not been able to find a good tutorial for using the WUI in IPFire to accomplish this task. There is one here: https://wiki.ipfire.org/configuration/services/ipsec/example_configuration-… However, it is missing many details, and has not kept up with changes in the WUI. Worse, still, it requires one to manually modify the configuration files, which, ideally, should not be necessary. After messing about with that tutorial, I have succeeded in connecting a Windows 10 computer, but I have not been able to succeed with a MacOS device, and I haven't even dared to try with iOS. As it stands, it is unclear what one should enter for the fields Remote host/IP, Remote Subnet, Local ID, and Remote ID, and I am still unclear on what the proper settings for IKE/ESP settings, DPD, and the other options at the bottom of the page are. I will continue to experiment and do my best to update the docs, but I'm flying pretty blind here. This leads me to a few questions (the forum has not been of much help in this area): 1.) Does anyone have a good tutorial that they can provide to help me in making this work and in improving the documentation? 2.) What changes to the WUI, if any, are needed to avoid the need to manually edit text files and properly support RoadWarrior connections to Windows 7/8/10, MacOS, Android, and iOS? 3.) What changes need to be made to the certs, configs, etc to support MacOS, iOS, and Android? Many thanks, Tom

2 4

[PATCH] [PATCH] OpenVPN: Update to version 2.4.4 .
by Erik Kapfer 30 Jan '18

30 Jan '18

ovpnmain.cgi includes new directive '--ncp-disable' to disable for the first the cipher negotiation. script-security flag 'system' has been dropped cause of security concerns. Directive changes/explanations can be found in here https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage . Update script for OpenVPN CRL has been integrated since OpenVPN refactors the CRL handling since v.2.4.0 . Script checks the next update field from the CRL and preforms an update two days before it expires. Script is placed under fcron.daily for daily checks. Changes can be found in here https://github.com/OpenVPN/openvpn/commit/160504a2955c4478cd2c0323452929e07… . update.sh for Core 118 includes needed server.conf changes but also an update of the CRL to prevent connection problems if systems have already an expired CRL. Server stop and start if active will be also executed. Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org> --- config/rootfiles/common/openvpn | 5 ++++- config/rootfiles/core/118/update.sh | 13 +++++++++++++ html/cgi-bin/ovpnmain.cgi | 3 ++- lfs/openvpn | 11 ++++++++--- 4 files changed, 27 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index b58e30c..cbfd03e 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -1,3 +1,5 @@ +etc/fcron.daily/ovpn_crl_updater.sh +#usr/include/openvpn-msg.h #usr/include/openvpn-plugin.h #usr/lib/openvpn #usr/lib/openvpn/plugins @@ -10,11 +12,12 @@ usr/sbin/openvpn #usr/share/doc/openvpn #usr/share/doc/openvpn/COPYING #usr/share/doc/openvpn/COPYRIGHT.GPL +#usr/share/doc/openvpn/Changes.rst #usr/share/doc/openvpn/README #usr/share/doc/openvpn/README.IPv6 #usr/share/doc/openvpn/README.auth-pam #usr/share/doc/openvpn/README.down-root -#usr/share/doc/openvpn/README.polarssl +#usr/share/doc/openvpn/README.mbedtls #usr/share/doc/openvpn/management-notes.txt #usr/share/man/man8/openvpn.8 var/ipfire/ovpn/ca diff --git a/config/rootfiles/core/118/update.sh b/config/rootfiles/core/118/update.sh index 545c8ef..ea56832 100644 --- a/config/rootfiles/core/118/update.sh +++ b/config/rootfiles/core/118/update.sh @@ -58,6 +58,19 @@ ldconfig /etc/init.d/apache restart /etc/init.d/snort start +# Add changed and new OpenVPN-2.4 directives to server.conf and renew CRL +if [ -e /var/ipfire/ovpn/server.conf ]; then + if pgrep openvpn >/dev/null; then + openvpnctrl -k + sed -i -e 's/script-security 3 system/script-security 3/' -e '/status .*/ a ncp-disable' /var/ipfire/ovpn/server.conf + openssl ca -gencrl -keyfile /var/ipfire/ovpn/ca/cakey.pem -cert /var/ipfire/ovpn/ca/cacert.pem -out /var/ipfire/ovpn/crls/cacrl.pem -config /var/ipfire/ovpn/openssl/ovpn.cnf + openvpnctrl -s + else + sed -i -e 's/script-security 3 system/script-security 3/' -e '/status .*/ a ncp-disable' /var/ipfire/ovpn/server.conf + openssl ca -gencrl -keyfile /var/ipfire/ovpn/ca/cakey.pem -cert /var/ipfire/ovpn/ca/cacert.pem -out /var/ipfire/ovpn/crls/cacrl.pem -config /var/ipfire/ovpn/openssl/ovpn.cnf + fi +fi + # This update need a reboot... touch /var/run/need_reboot diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 9f5e682..424a5c9 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -216,7 +216,7 @@ sub writeserverconf { print CONF "dev tun\n"; print CONF "proto $sovpnsettings{'DPROTOCOL'}\n"; print CONF "port $sovpnsettings{'DDEST_PORT'}\n"; - print CONF "script-security 3 system\n"; + print CONF "script-security 3\n"; print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n"; print CONF "client-config-dir /var/ipfire/ovpn/ccd\n"; print CONF "tls-server\n"; @@ -289,6 +289,7 @@ sub writeserverconf { } print CONF "status-version 1\n"; print CONF "status /var/run/ovpnserver.log 30\n"; + print CONF "ncp-disable\n"; print CONF "cipher $sovpnsettings{DCIPHER}\n"; if ($sovpnsettings{'DAUTH'} eq '') { print CONF ""; diff --git a/lfs/openvpn b/lfs/openvpn index 8307d01..e7f9bc2 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2017 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.3.18 +VER = 2.4.4 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 844ec9c64aae62051478784b8562f881 +$(DL_FILE)_MD5 = 7a2002aad1671b24457bc9432a0c5c52 install : $(TARGET) @@ -96,5 +96,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify chown root:root /usr/lib/openvpn/verify chmod 755 /usr/lib/openvpn/verify + mv -v /var/ipfire/ovpn/ovpn_crl_updater.sh /etc/fcron.daily + chown root:root /etc/fcron.daily/ovpn_crl_updater.sh + chmod 750 /etc/fcron.daily/ovpn_crl_updater.sh + @rm -rf $(DIR_APP) @$(POSTBUILD) + -- 2.7.4

3 3

[PATCH v2] WebUI: print more information on used nameservers
by Peter Müller 29 Jan '18

29 Jan '18

Show rDNS/PTR entry and country flag of the used nameservers on the nameserver status list at "netexternal.cgi". These information might be useful for debugging, or are just "nice to have" and do not harm anything. :-) Changes since v1: Corrected file link to country.cgi and added title to flag. Please disregard the first version of this patch. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- diff --git a/html/cgi-bin/netexternal.cgi b/html/cgi-bin/netexternal.cgi index 299612d4c..6fe0cc7d6 100644 --- a/html/cgi-bin/netexternal.cgi +++ b/html/cgi-bin/netexternal.cgi @@ -25,9 +25,13 @@ use strict; #use warnings; #use CGI::Carp 'fatalsToBrowser'; +use IO::Socket; +use Geo::IP::PurePerl; + require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +require "${General::swroot}/geoip-functions.pl"; require "${General::swroot}/graphs.pl"; my %color = (); @@ -99,6 +103,12 @@ if ( $querry[0] ne~ ""){ $Lang::tr{'nameserver'} </th> <th align="center"> + $Lang::tr{'flag'} + </th> + <th align="center"> + $Lang::tr{'rdns'} + </th> + <th align="center"> $Lang::tr{'status'} </th> </tr> @@ -139,9 +149,22 @@ END my $table_colour = ($id++ % 2) ? $color{'color22'} : $color{'color20'}; + # Get rDNS entry for nameserver (might be useful) + my $iaddr = inet_aton($nameserver); + my $rdns = gethostbyaddr($iaddr, AF_INET); + if (!$rdns) { $rdns = $Lang::tr{'lookup failed'}; } + + # Get country flag for the nameserver (might be useful) + my $gi = Geo::IP::PurePerl->new(); + my $ccode = $gi->country_code_by_name($nameserver); + my $fcode = lc($ccode); + my $flag_icon = &GeoIP::get_flag_icon($fcode); + print <<END; <tr bgcolor="$table_colour"> <td>$nameserver</td> + <td align="center"><a href="country.cgi#$fcode"><img src="$flag_icon" border="0" align="absmiddle" alt="$ccode" title="$ccode"></a></td> + <td>$rdns</td> <td bgcolor="$bgcolour" align="center"> $message </td> @@ -271,3 +294,4 @@ sub check_dnssec($$) { return $aware + $validating; } + diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 0138cbc02..a63eb3160 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1902,6 +1902,7 @@ 'quick playlist' => 'Quick Playlist', 'ram' => 'RAM-Speicher', 'random number generator daemon' => 'Random Number Generator Daemon', +'rdns' => 'rDNS', 'read bytes' => 'Gelesene Bytes', 'read list' => 'Liste der Leseberechtigten', 'real address' => 'Reale Addresse', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index b3aee5a2b..13c18f4c8 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1936,6 +1936,7 @@ 'quick playlist' => 'Quick Playlist', 'ram' => 'RAM', 'random number generator daemon' => 'Random Number Generator Daemon', +'rdns' => 'rDNS', 'read bytes' => 'Read Bytes', 'read list' => 'list with readonly hosts', 'real address' => 'Real Address',

4 16

[PATCH] clamav: Update to 0.99.3
by Matthias Fischer 26 Jan '18

26 Jan '18

Excerpt from 'README': "ClamAV 0.99.3 is a hotfix release to patch a set of vulnerabilities. - fixes for the following CVE's: CVE-2017-6418, CVE-2017-6420, CVE-2017-12374, CVE-2017-12375, CVE-2017-12376, CVE-2017-12377, CVE-2017-12378, CVE-2017-12379, CVE-2017-12380. - also included are 2 minor fixes to properly detect openssl install locations on FreeBSD 11, and prevent false warnings about zlib 1.2.1# version numbers." For details see: http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/clamav | 10 +++++----- .../clamav-0.99.3-gcc-6.patch} | 0 src/patches/clamav/llvm-glibc.patch | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) rename src/patches/{clamav-0.99.2-gcc-6.patch => clamav/clamav-0.99.3-gcc-6.patch} (100%) diff --git a/lfs/clamav b/lfs/clamav index e91eb97c8..a2c58a186 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2016 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.99.2 +VER = 0.99.3 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 34 +PAK_VER = 35 DEPS = "" @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 61b51a04619aeafd965892a53f86d192 +$(DL_FILE)_MD5 = 5272f127312e987b3e10c155cf1d84df install : $(TARGET) @@ -82,7 +82,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/clamav/llvm-glibc.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/clamav-0.99.2-gcc-6.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/clamav-0.99.3-gcc-6.patch cd $(DIR_APP) && ./configure \ --prefix=/usr \ --disable-zlib-vcheck \ diff --git a/src/patches/clamav-0.99.2-gcc-6.patch b/src/patches/clamav/clamav-0.99.3-gcc-6.patch similarity index 100% rename from src/patches/clamav-0.99.2-gcc-6.patch rename to src/patches/clamav/clamav-0.99.3-gcc-6.patch diff --git a/src/patches/clamav/llvm-glibc.patch b/src/patches/clamav/llvm-glibc.patch index 67dbdd7d8..78845fcfc 100644 --- a/src/patches/clamav/llvm-glibc.patch +++ b/src/patches/clamav/llvm-glibc.patch @@ -2,7 +2,7 @@ Index: clamav-0.97.3/libclamav/c++/llvm/lib/ExecutionEngine/JIT/Intercept.cpp =================================================================== --- clamav-0.97.3.orig/libclamav/c++/llvm/lib/ExecutionEngine/JIT/Intercept.cpp +++ clamav-0.97.3/libclamav/c++/llvm/lib/ExecutionEngine/JIT/Intercept.cpp -@@ -52,6 +52,7 @@ static void runAtExitHandlers() { +@@ -55,6 +55,7 @@ static void runAtExitHandlers() { #include <sys/stat.h> #endif #include <fcntl.h> -- 2.16.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development January 2018