Development November 2018

development@lists.ipfire.org

9 participants
25 discussions

Re: [Infrastructure] Smartcard hardware recommendations
by Peter Müller 25 Nov '18

25 Nov '18

Hello Michael, hello *, > Hey, > > thanks for this, but I think it is best if you send this to the dev list. On > here are only like five people :) here you go... :-) Sorry for the delay. Thanks, and best regards, Peter Müller > > -Michael > > On Thu, 2018-11-15 at 18:32 +0100, Peter Müller wrote: >> Hello, > >> after bringing this up in telephone conferences for several times now, >> Michael asked me to write a brief summary concerning Smartcard hardware >> recommendations. > >> Here you go... > >> (a) GnuPG compatible card >> In our environment, smartcards will be used in combination with GnuPG >> so they need to be compatible to this software. The private key stored >> on the card is basically a GPG key, with some additional subkeys for >> encryption, signing and authenticating. > >> Such cards support RSA up to 4096 bits (newer ones already make use >> of ECC crypto, but depending on how much you trust NIST/Brainpool curves, >> RSA might be a more satisfying choice here) and are available, for example, >> here: >> https://www.floss-shop.de/de/security-privacy/smartcards/13/openpgp-smart-c… > >> They are available with or without a SIM card size cutout and cost >> about 18,- EUR. > >> (b) Choose the right card format >> Needless to say, a smartcard reader is required to use such a device. >> These readers come in three different versions: Similar to an ordinary >> USB stick, as a card reader or as a card reader with dedicated numerical >> keypad. > >> Readers in USB stick style are more easy to use, since there is no >> need to look for a reader if sitting in front of a new computer. Since >> they can only hold a cutout version of the smartcard, you need to order >> this one here. > >> Card readers are nothing special: A smartcard is just inserted and >> then connected via USB to the computer. They might be more useful if >> storing the smartcard in your briefcase between all other plastic >> cards is desired. > >> Smartcards are secured with a PIN (which may also contain non-numerical >> characters, so it actually is a password) and for both reader devices >> discussed so far, the PIN will be entered normally via the keyboard. >> In case a system is infected, an attacker might gain access to the PIN. >> He only needs to steal the card from its victim in order to use it. > >> Because of this, I prefer card readers with a dedicated keypad. In >> case the GnuPG version installed recognises such a reader, it forwards >> the PIN entry dialogue to the reader itself, so the PIN will never reach >> the computer. > >> (For some hardware, an up-to-date GnuPG version is required for this. >> Otherwise, such a reader might be used as a normal one, making the PIN >> visible to the operating system.) > >> Of course, an attacker might bug the reader, but this is certainly more >> expensive than just installing a (software) keylogger on the victims machine. > >> Normal card readers (USB stick style or with a card slot) cost around >> 20,- EUR, readers with dedicated keypad usually 50,- to 60,- EUR. > >> (c) What about (NitroKey|YubiKey|*)? >> Besides smartcards, there are other cryptography devices available. >> Popular ones include NitroKey and YubiKey. While some of them use >> other mechanism for authentication (such as one time passwords), some >> provide smartcard functionality with additional features. > >> As there seems to be no way to enter needed passwords/PINs to them >> but by using a normal keyboard, I prefer plain smartcards in combination >> with a dedicated keypad reader. > >> Talking about the NitroKey, there are two similar (?) models available: >> NitroKey Start and Pro 2. The latter one has a "tamper-resistant smartcard", >> while the first does not. It never became clear to me how big the security >> impact of this divergence is. > >> Just my personal opinion... :-) > >> (d) Avoid proprietary stuff! >> Talking about cryptography, closed software (and hardware) seem to >> cause more trouble than it solves. Thereof, I think it's best to stay >> away from these - if possible. Open hardware is rare, usually expensive, >> and difficult to obtain. > > >> In case further details about software implementation, key setup, etc. >> is used, please drop me a line. Same thing goes if there are any questions. > >> The idea behind this was to use smartcards for all people having SSH >> access to any *.ipfire.org server, as private keyfiles are vulnerable >> to brute force attacks. Of course, disabling password authentication >> is needed first in my point of view. > >> Thank you, and best regards, >> Peter Müller >> _______________________________________________ >> Infrastructure mailing list >> Infrastructure(a)lists.ipfire.org >> https://lists.ipfire.org/mailman/listinfo/infrastructure > -- Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq

1 0

SSH access on git.ipfire.org
by Michael Tremer 23 Nov '18

23 Nov '18

Hello, as you know I am currently busy with updating some parts of our infrastructure. While that is making some good progress, I wanted to give you a small update: The Git server has been replaced by a new machine. This one is running CentOS 7 as all new servers now and we are phasing our Fedora everywhere else. This machine is using the same SSH key, but a new OS in installed and some settings have been made tighter. So if you are experiencing any issues, please let me know. Also, the new server has a new hostname. It is called people01.i.ipfire.org which is in line with our new account system that is currently being tested and will officially be announced soon. Best, -Michael

1 0

Core 125 - small bug post upgrade
by Kienker, Fred 19 Nov '18

19 Nov '18

IPFire core 124 connecting via DHCP on RED with DNS set via the web interface page “Assign DNS-Server”. Post upgrade to core 125, after a restart, home page shows unbound in local recursor mode. Going to the “Assign DNS-Server” page, it displays the correct DNS server IP numbers. Clicking on the Save button corrects the problem and after unbound restarts, the correct DNS server IP’s are displayed on the home page. It’s a pretty minor issue, but the fix may elude many of the less experienced. Best regards, Fred Kienker

2 4

git.ipfire.org and blog.ipfire.org => 502 service unavailable!?
by Matthias Fischer 13 Nov '18

13 Nov '18

Hi, I didn't do it! ;-) Suddenly https://git.ipfire.org/ and https://blog.ipfire.org/ lead to: "503 Service Unavailable No server is available to handle this request." https://wiki.ipfire.org/ and https://patchwork.ipfire.org/project/ipfire/list/ /e.g.) are OK. Can anyone confirm? Best, Matthias

2 1

[PATCH] BUG 11929: Build 'bind'-binaries dynamically and install needed libraries (V1 - TESTING VERSION)
by Matthias Fischer 13 Nov '18

13 Nov '18

Hi, To save space linking the 'bind'-binaries was changed from statically to dynamically. Package shrinked from ~4800K to ~1700K. Needs testing and confirmation! Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 369 +++++++++++++++++++++++++++++++++++ lfs/bind | 18 +- 2 files changed, 378 insertions(+), 9 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 303c5b828..a9b4d7b64 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -3,7 +3,376 @@ usr/bin/dig usr/bin/host usr/bin/nslookup usr/bin/nsupdate +#usr/include/bind9 +#usr/include/bind9/check.h +#usr/include/bind9/getaddresses.h +#usr/include/bind9/version.h +#usr/include/dns +#usr/include/dns/acache.h +#usr/include/dns/acl.h +#usr/include/dns/adb.h +#usr/include/dns/badcache.h +#usr/include/dns/bit.h +#usr/include/dns/byaddr.h +#usr/include/dns/cache.h +#usr/include/dns/callbacks.h +#usr/include/dns/catz.h +#usr/include/dns/cert.h +#usr/include/dns/client.h +#usr/include/dns/clientinfo.h +#usr/include/dns/compress.h +#usr/include/dns/db.h +#usr/include/dns/dbiterator.h +#usr/include/dns/dbtable.h +#usr/include/dns/diff.h +#usr/include/dns/dispatch.h +#usr/include/dns/dlz.h +#usr/include/dns/dlz_dlopen.h +#usr/include/dns/dns64.h +#usr/include/dns/dnssec.h +#usr/include/dns/dnstap.h +#usr/include/dns/ds.h +#usr/include/dns/dsdigest.h +#usr/include/dns/dyndb.h +#usr/include/dns/ecdb.h +#usr/include/dns/edns.h +#usr/include/dns/enumclass.h +#usr/include/dns/enumtype.h +#usr/include/dns/events.h +#usr/include/dns/fixedname.h +#usr/include/dns/forward.h +#usr/include/dns/geoip.h +#usr/include/dns/ipkeylist.h +#usr/include/dns/iptable.h +#usr/include/dns/journal.h +#usr/include/dns/keydata.h +#usr/include/dns/keyflags.h +#usr/include/dns/keytable.h +#usr/include/dns/keyvalues.h +#usr/include/dns/lib.h +#usr/include/dns/log.h +#usr/include/dns/lookup.h +#usr/include/dns/master.h +#usr/include/dns/masterdump.h +#usr/include/dns/message.h +#usr/include/dns/name.h +#usr/include/dns/ncache.h +#usr/include/dns/nsec.h +#usr/include/dns/nsec3.h +#usr/include/dns/nta.h +#usr/include/dns/opcode.h +#usr/include/dns/order.h +#usr/include/dns/peer.h +#usr/include/dns/portlist.h +#usr/include/dns/private.h +#usr/include/dns/rbt.h +#usr/include/dns/rcode.h +#usr/include/dns/rdata.h +#usr/include/dns/rdataclass.h +#usr/include/dns/rdatalist.h +#usr/include/dns/rdataset.h +#usr/include/dns/rdatasetiter.h +#usr/include/dns/rdataslab.h +#usr/include/dns/rdatastruct.h +#usr/include/dns/rdatatype.h +#usr/include/dns/request.h +#usr/include/dns/resolver.h +#usr/include/dns/result.h +#usr/include/dns/rootns.h +#usr/include/dns/rpz.h +#usr/include/dns/rriterator.h +#usr/include/dns/rrl.h +#usr/include/dns/sdb.h +#usr/include/dns/sdlz.h +#usr/include/dns/secalg.h +#usr/include/dns/secproto.h +#usr/include/dns/soa.h +#usr/include/dns/ssu.h +#usr/include/dns/stats.h +#usr/include/dns/tcpmsg.h +#usr/include/dns/time.h +#usr/include/dns/timer.h +#usr/include/dns/tkey.h +#usr/include/dns/tsec.h +#usr/include/dns/tsig.h +#usr/include/dns/ttl.h +#usr/include/dns/types.h +#usr/include/dns/update.h +#usr/include/dns/validator.h +#usr/include/dns/version.h +#usr/include/dns/view.h +#usr/include/dns/xfrin.h +#usr/include/dns/zone.h +#usr/include/dns/zonekey.h +#usr/include/dns/zt.h +#usr/include/dst +#usr/include/dst/dst.h +#usr/include/dst/gssapi.h +#usr/include/dst/lib.h +#usr/include/dst/result.h +#usr/include/isc +#usr/include/isc/aes.h +#usr/include/isc/app.h +#usr/include/isc/assertions.h +#usr/include/isc/atomic.h +#usr/include/isc/backtrace.h +#usr/include/isc/base32.h +#usr/include/isc/base64.h +#usr/include/isc/bind9.h +#usr/include/isc/boolean.h +#usr/include/isc/buffer.h +#usr/include/isc/bufferlist.h +#usr/include/isc/commandline.h +#usr/include/isc/condition.h +#usr/include/isc/counter.h +#usr/include/isc/crc64.h +#usr/include/isc/deprecated.h +#usr/include/isc/dir.h +#usr/include/isc/entropy.h +#usr/include/isc/errno.h +#usr/include/isc/error.h +#usr/include/isc/event.h +#usr/include/isc/eventclass.h +#usr/include/isc/file.h +#usr/include/isc/formatcheck.h +#usr/include/isc/fsaccess.h +#usr/include/isc/hash.h +#usr/include/isc/heap.h +#usr/include/isc/hex.h +#usr/include/isc/hmacmd5.h +#usr/include/isc/hmacsha.h +#usr/include/isc/ht.h +#usr/include/isc/httpd.h +#usr/include/isc/int.h +#usr/include/isc/interfaceiter.h +#usr/include/isc/iterated_hash.h +#usr/include/isc/json.h +#usr/include/isc/keyboard.h +#usr/include/isc/lang.h +#usr/include/isc/lex.h +#usr/include/isc/lfsr.h +#usr/include/isc/lib.h +#usr/include/isc/likely.h +#usr/include/isc/list.h +#usr/include/isc/log.h +#usr/include/isc/magic.h +#usr/include/isc/md5.h +#usr/include/isc/mem.h +#usr/include/isc/meminfo.h +#usr/include/isc/msgcat.h +#usr/include/isc/msgs.h +#usr/include/isc/mutex.h +#usr/include/isc/mutexblock.h +#usr/include/isc/net.h +#usr/include/isc/netaddr.h +#usr/include/isc/netdb.h +#usr/include/isc/netscope.h +#usr/include/isc/offset.h +#usr/include/isc/once.h +#usr/include/isc/ondestroy.h +#usr/include/isc/os.h +#usr/include/isc/parseint.h +#usr/include/isc/platform.h +#usr/include/isc/pool.h +#usr/include/isc/portset.h +#usr/include/isc/print.h +#usr/include/isc/queue.h +#usr/include/isc/quota.h +#usr/include/isc/radix.h +#usr/include/isc/random.h +#usr/include/isc/ratelimiter.h +#usr/include/isc/refcount.h +#usr/include/isc/regex.h +#usr/include/isc/region.h +#usr/include/isc/resource.h +#usr/include/isc/result.h +#usr/include/isc/resultclass.h +#usr/include/isc/rwlock.h +#usr/include/isc/safe.h +#usr/include/isc/serial.h +#usr/include/isc/sha1.h +#usr/include/isc/sha2.h +#usr/include/isc/sockaddr.h +#usr/include/isc/socket.h +#usr/include/isc/stat.h +#usr/include/isc/stats.h +#usr/include/isc/stdio.h +#usr/include/isc/stdlib.h +#usr/include/isc/stdtime.h +#usr/include/isc/strerror.h +#usr/include/isc/string.h +#usr/include/isc/symtab.h +#usr/include/isc/syslog.h +#usr/include/isc/task.h +#usr/include/isc/taskpool.h +#usr/include/isc/thread.h +#usr/include/isc/time.h +#usr/include/isc/timer.h +#usr/include/isc/tm.h +#usr/include/isc/types.h +#usr/include/isc/util.h +#usr/include/isc/version.h +#usr/include/isc/xml.h +#usr/include/isccc +#usr/include/isccc/alist.h +#usr/include/isccc/base64.h +#usr/include/isccc/cc.h +#usr/include/isccc/ccmsg.h +#usr/include/isccc/events.h +#usr/include/isccc/lib.h +#usr/include/isccc/result.h +#usr/include/isccc/sexpr.h +#usr/include/isccc/symtab.h +#usr/include/isccc/symtype.h +#usr/include/isccc/types.h +#usr/include/isccc/util.h +#usr/include/isccc/version.h +#usr/include/isccfg +#usr/include/isccfg/aclconf.h +#usr/include/isccfg/cfg.h +#usr/include/isccfg/dnsconf.h +#usr/include/isccfg/grammar.h +#usr/include/isccfg/log.h +#usr/include/isccfg/namedconf.h +#usr/include/isccfg/version.h +#usr/include/lwres +#usr/include/lwres/context.h +#usr/include/lwres/int.h +#usr/include/lwres/ipv6.h +#usr/include/lwres/lang.h +#usr/include/lwres/list.h +#usr/include/lwres/lwbuffer.h +#usr/include/lwres/lwpacket.h +#usr/include/lwres/lwres.h +#usr/include/lwres/net.h +#usr/include/lwres/netdb.h +#usr/include/lwres/platform.h +#usr/include/lwres/result.h +#usr/include/lwres/stdlib.h +#usr/include/lwres/string.h +#usr/include/lwres/version.h +#usr/include/pk11 +#usr/include/pk11/constants.h +#usr/include/pk11/internal.h +#usr/include/pk11/pk11.h +#usr/include/pk11/result.h +#usr/include/pk11/site.h +#usr/include/pkcs11 +#usr/include/pkcs11/cryptoki.h +#usr/include/pkcs11/eddsa.h +#usr/include/pkcs11/pkcs11.h +#usr/include/pkcs11/pkcs11f.h +#usr/include/pkcs11/pkcs11t.h +#usr/lib/libbind9.la +usr/lib/libbind9.so +usr/lib/libbind9.so.161 +usr/lib/libbind9.so.161.0.0 +#usr/lib/libdns.la +usr/lib/libdns.so +usr/lib/libdns.so.1104 +usr/lib/libdns.so.1104.0.0 +#usr/lib/libisc.la +usr/lib/libisc.so +usr/lib/libisc.so.1100 +usr/lib/libisc.so.1100.0.0 +#usr/lib/libisccc.la +usr/lib/libisccc.so +usr/lib/libisccc.so.161 +usr/lib/libisccc.so.161.0.0 +#usr/lib/libisccfg.la +usr/lib/libisccfg.so +usr/lib/libisccfg.so.163 +usr/lib/libisccfg.so.163.0.0 +#usr/lib/liblwres.la +usr/lib/liblwres.so +usr/lib/liblwres.so.161 +usr/lib/liblwres.so.161.0.0 #usr/share/man/man1/dig.1 #usr/share/man/man1/host.1 #usr/share/man/man1/nslookup.1 #usr/share/man/man1/nsupdate.1 +#usr/share/man/man3/lwres.3 +#usr/share/man/man3/lwres_addr_parse.3 +#usr/share/man/man3/lwres_buffer.3 +#usr/share/man/man3/lwres_buffer_add.3 +#usr/share/man/man3/lwres_buffer_back.3 +#usr/share/man/man3/lwres_buffer_clear.3 +#usr/share/man/man3/lwres_buffer_first.3 +#usr/share/man/man3/lwres_buffer_forward.3 +#usr/share/man/man3/lwres_buffer_getmem.3 +#usr/share/man/man3/lwres_buffer_getuint16.3 +#usr/share/man/man3/lwres_buffer_getuint32.3 +#usr/share/man/man3/lwres_buffer_getuint8.3 +#usr/share/man/man3/lwres_buffer_init.3 +#usr/share/man/man3/lwres_buffer_invalidate.3 +#usr/share/man/man3/lwres_buffer_putmem.3 +#usr/share/man/man3/lwres_buffer_putuint16.3 +#usr/share/man/man3/lwres_buffer_putuint32.3 +#usr/share/man/man3/lwres_buffer_putuint8.3 +#usr/share/man/man3/lwres_buffer_subtract.3 +#usr/share/man/man3/lwres_conf_clear.3 +#usr/share/man/man3/lwres_conf_get.3 +#usr/share/man/man3/lwres_conf_init.3 +#usr/share/man/man3/lwres_conf_parse.3 +#usr/share/man/man3/lwres_conf_print.3 +#usr/share/man/man3/lwres_config.3 +#usr/share/man/man3/lwres_context.3 +#usr/share/man/man3/lwres_context_allocmem.3 +#usr/share/man/man3/lwres_context_create.3 +#usr/share/man/man3/lwres_context_destroy.3 +#usr/share/man/man3/lwres_context_freemem.3 +#usr/share/man/man3/lwres_context_initserial.3 +#usr/share/man/man3/lwres_context_nextserial.3 +#usr/share/man/man3/lwres_context_sendrecv.3 +#usr/share/man/man3/lwres_endhostent.3 +#usr/share/man/man3/lwres_endhostent_r.3 +#usr/share/man/man3/lwres_freeaddrinfo.3 +#usr/share/man/man3/lwres_freehostent.3 +#usr/share/man/man3/lwres_gabn.3 +#usr/share/man/man3/lwres_gabnrequest_free.3 +#usr/share/man/man3/lwres_gabnrequest_parse.3 +#usr/share/man/man3/lwres_gabnrequest_render.3 +#usr/share/man/man3/lwres_gabnresponse_free.3 +#usr/share/man/man3/lwres_gabnresponse_parse.3 +#usr/share/man/man3/lwres_gabnresponse_render.3 +#usr/share/man/man3/lwres_gai_strerror.3 +#usr/share/man/man3/lwres_getaddrinfo.3 +#usr/share/man/man3/lwres_getaddrsbyname.3 +#usr/share/man/man3/lwres_gethostbyaddr.3 +#usr/share/man/man3/lwres_gethostbyaddr_r.3 +#usr/share/man/man3/lwres_gethostbyname.3 +#usr/share/man/man3/lwres_gethostbyname2.3 +#usr/share/man/man3/lwres_gethostbyname_r.3 +#usr/share/man/man3/lwres_gethostent.3 +#usr/share/man/man3/lwres_gethostent_r.3 +#usr/share/man/man3/lwres_getipnode.3 +#usr/share/man/man3/lwres_getipnodebyaddr.3 +#usr/share/man/man3/lwres_getipnodebyname.3 +#usr/share/man/man3/lwres_getnamebyaddr.3 +#usr/share/man/man3/lwres_getnameinfo.3 +#usr/share/man/man3/lwres_getrrsetbyname.3 +#usr/share/man/man3/lwres_gnba.3 +#usr/share/man/man3/lwres_gnbarequest_free.3 +#usr/share/man/man3/lwres_gnbarequest_parse.3 +#usr/share/man/man3/lwres_gnbarequest_render.3 +#usr/share/man/man3/lwres_gnbaresponse_free.3 +#usr/share/man/man3/lwres_gnbaresponse_parse.3 +#usr/share/man/man3/lwres_gnbaresponse_render.3 +#usr/share/man/man3/lwres_herror.3 +#usr/share/man/man3/lwres_hstrerror.3 +#usr/share/man/man3/lwres_inetntop.3 +#usr/share/man/man3/lwres_lwpacket_parseheader.3 +#usr/share/man/man3/lwres_lwpacket_renderheader.3 +#usr/share/man/man3/lwres_net_ntop.3 +#usr/share/man/man3/lwres_noop.3 +#usr/share/man/man3/lwres_nooprequest_free.3 +#usr/share/man/man3/lwres_nooprequest_parse.3 +#usr/share/man/man3/lwres_nooprequest_render.3 +#usr/share/man/man3/lwres_noopresponse_free.3 +#usr/share/man/man3/lwres_noopresponse_parse.3 +#usr/share/man/man3/lwres_noopresponse_render.3 +#usr/share/man/man3/lwres_packet.3 +#usr/share/man/man3/lwres_resutil.3 +#usr/share/man/man3/lwres_sethostent.3 +#usr/share/man/man3/lwres_sethostent_r.3 +#usr/share/man/man3/lwres_string_parse.3 diff --git a/lfs/bind b/lfs/bind index d0fcfeda0..c2530b174 100644 --- a/lfs/bind +++ b/lfs/bind @@ -76,16 +76,16 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && STD_CDEFINES="$(CPPFLAGS)" \ ./configure \ --prefix=/usr \ - --disable-static \ - --disable-openssl-version-check - cd $(DIR_APP) && make -C lib/dns - cd $(DIR_APP) && make -C lib/isc - cd $(DIR_APP) && make -C lib/bind9 - cd $(DIR_APP) && make -C lib/isccfg - cd $(DIR_APP) && make -C lib/lwres - cd $(DIR_APP) && make -C bin/dig + --enable-threads \ + --with-libtool \ + --disable-static + cd $(DIR_APP) && make -C lib/isc install + cd $(DIR_APP) && make -C lib/dns install + cd $(DIR_APP) && make -C lib/isccc install + cd $(DIR_APP) && make -C lib/isccfg install + cd $(DIR_APP) && make -C lib/bind9 install + cd $(DIR_APP) && make -C lib/lwres install cd $(DIR_APP) && make -C bin/dig install - cd $(DIR_APP) && make -C bin/nsupdate cd $(DIR_APP) && make -C bin/nsupdate install install -v -m 644 $(DIR_SRC)/config/bind/trusted-key.key \ -- 2.18.0

2 2

[PATCH] BUG 11929: Build 'bind'-binaries dynamically and install needed libraries (V2)
by Matthias Fischer 13 Nov '18

13 Nov '18

Hi, To save space linking the 'bind 9.11.5'-binaries was changed from statically to dynamically. Changes to V2: Removed unnecessary '*.so'-links. Complete file sizes shrinked from ~4800K to ~1700K. Needs testing and confirmation! I'm running this version right now under Core 124 - no seen problems so far. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 369 +++++++++++++++++++++++++++++++++++ lfs/bind | 18 +- 2 files changed, 378 insertions(+), 9 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index 303c5b828..7ddfab332 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -3,7 +3,376 @@ usr/bin/dig usr/bin/host usr/bin/nslookup usr/bin/nsupdate +#usr/include/bind9 +#usr/include/bind9/check.h +#usr/include/bind9/getaddresses.h +#usr/include/bind9/version.h +#usr/include/dns +#usr/include/dns/acache.h +#usr/include/dns/acl.h +#usr/include/dns/adb.h +#usr/include/dns/badcache.h +#usr/include/dns/bit.h +#usr/include/dns/byaddr.h +#usr/include/dns/cache.h +#usr/include/dns/callbacks.h +#usr/include/dns/catz.h +#usr/include/dns/cert.h +#usr/include/dns/client.h +#usr/include/dns/clientinfo.h +#usr/include/dns/compress.h +#usr/include/dns/db.h +#usr/include/dns/dbiterator.h +#usr/include/dns/dbtable.h +#usr/include/dns/diff.h +#usr/include/dns/dispatch.h +#usr/include/dns/dlz.h +#usr/include/dns/dlz_dlopen.h +#usr/include/dns/dns64.h +#usr/include/dns/dnssec.h +#usr/include/dns/dnstap.h +#usr/include/dns/ds.h +#usr/include/dns/dsdigest.h +#usr/include/dns/dyndb.h +#usr/include/dns/ecdb.h +#usr/include/dns/edns.h +#usr/include/dns/enumclass.h +#usr/include/dns/enumtype.h +#usr/include/dns/events.h +#usr/include/dns/fixedname.h +#usr/include/dns/forward.h +#usr/include/dns/geoip.h +#usr/include/dns/ipkeylist.h +#usr/include/dns/iptable.h +#usr/include/dns/journal.h +#usr/include/dns/keydata.h +#usr/include/dns/keyflags.h +#usr/include/dns/keytable.h +#usr/include/dns/keyvalues.h +#usr/include/dns/lib.h +#usr/include/dns/log.h +#usr/include/dns/lookup.h +#usr/include/dns/master.h +#usr/include/dns/masterdump.h +#usr/include/dns/message.h +#usr/include/dns/name.h +#usr/include/dns/ncache.h +#usr/include/dns/nsec.h +#usr/include/dns/nsec3.h +#usr/include/dns/nta.h +#usr/include/dns/opcode.h +#usr/include/dns/order.h +#usr/include/dns/peer.h +#usr/include/dns/portlist.h +#usr/include/dns/private.h +#usr/include/dns/rbt.h +#usr/include/dns/rcode.h +#usr/include/dns/rdata.h +#usr/include/dns/rdataclass.h +#usr/include/dns/rdatalist.h +#usr/include/dns/rdataset.h +#usr/include/dns/rdatasetiter.h +#usr/include/dns/rdataslab.h +#usr/include/dns/rdatastruct.h +#usr/include/dns/rdatatype.h +#usr/include/dns/request.h +#usr/include/dns/resolver.h +#usr/include/dns/result.h +#usr/include/dns/rootns.h +#usr/include/dns/rpz.h +#usr/include/dns/rriterator.h +#usr/include/dns/rrl.h +#usr/include/dns/sdb.h +#usr/include/dns/sdlz.h +#usr/include/dns/secalg.h +#usr/include/dns/secproto.h +#usr/include/dns/soa.h +#usr/include/dns/ssu.h +#usr/include/dns/stats.h +#usr/include/dns/tcpmsg.h +#usr/include/dns/time.h +#usr/include/dns/timer.h +#usr/include/dns/tkey.h +#usr/include/dns/tsec.h +#usr/include/dns/tsig.h +#usr/include/dns/ttl.h +#usr/include/dns/types.h +#usr/include/dns/update.h +#usr/include/dns/validator.h +#usr/include/dns/version.h +#usr/include/dns/view.h +#usr/include/dns/xfrin.h +#usr/include/dns/zone.h +#usr/include/dns/zonekey.h +#usr/include/dns/zt.h +#usr/include/dst +#usr/include/dst/dst.h +#usr/include/dst/gssapi.h +#usr/include/dst/lib.h +#usr/include/dst/result.h +#usr/include/isc +#usr/include/isc/aes.h +#usr/include/isc/app.h +#usr/include/isc/assertions.h +#usr/include/isc/atomic.h +#usr/include/isc/backtrace.h +#usr/include/isc/base32.h +#usr/include/isc/base64.h +#usr/include/isc/bind9.h +#usr/include/isc/boolean.h +#usr/include/isc/buffer.h +#usr/include/isc/bufferlist.h +#usr/include/isc/commandline.h +#usr/include/isc/condition.h +#usr/include/isc/counter.h +#usr/include/isc/crc64.h +#usr/include/isc/deprecated.h +#usr/include/isc/dir.h +#usr/include/isc/entropy.h +#usr/include/isc/errno.h +#usr/include/isc/error.h +#usr/include/isc/event.h +#usr/include/isc/eventclass.h +#usr/include/isc/file.h +#usr/include/isc/formatcheck.h +#usr/include/isc/fsaccess.h +#usr/include/isc/hash.h +#usr/include/isc/heap.h +#usr/include/isc/hex.h +#usr/include/isc/hmacmd5.h +#usr/include/isc/hmacsha.h +#usr/include/isc/ht.h +#usr/include/isc/httpd.h +#usr/include/isc/int.h +#usr/include/isc/interfaceiter.h +#usr/include/isc/iterated_hash.h +#usr/include/isc/json.h +#usr/include/isc/keyboard.h +#usr/include/isc/lang.h +#usr/include/isc/lex.h +#usr/include/isc/lfsr.h +#usr/include/isc/lib.h +#usr/include/isc/likely.h +#usr/include/isc/list.h +#usr/include/isc/log.h +#usr/include/isc/magic.h +#usr/include/isc/md5.h +#usr/include/isc/mem.h +#usr/include/isc/meminfo.h +#usr/include/isc/msgcat.h +#usr/include/isc/msgs.h +#usr/include/isc/mutex.h +#usr/include/isc/mutexblock.h +#usr/include/isc/net.h +#usr/include/isc/netaddr.h +#usr/include/isc/netdb.h +#usr/include/isc/netscope.h +#usr/include/isc/offset.h +#usr/include/isc/once.h +#usr/include/isc/ondestroy.h +#usr/include/isc/os.h +#usr/include/isc/parseint.h +#usr/include/isc/platform.h +#usr/include/isc/pool.h +#usr/include/isc/portset.h +#usr/include/isc/print.h +#usr/include/isc/queue.h +#usr/include/isc/quota.h +#usr/include/isc/radix.h +#usr/include/isc/random.h +#usr/include/isc/ratelimiter.h +#usr/include/isc/refcount.h +#usr/include/isc/regex.h +#usr/include/isc/region.h +#usr/include/isc/resource.h +#usr/include/isc/result.h +#usr/include/isc/resultclass.h +#usr/include/isc/rwlock.h +#usr/include/isc/safe.h +#usr/include/isc/serial.h +#usr/include/isc/sha1.h +#usr/include/isc/sha2.h +#usr/include/isc/sockaddr.h +#usr/include/isc/socket.h +#usr/include/isc/stat.h +#usr/include/isc/stats.h +#usr/include/isc/stdio.h +#usr/include/isc/stdlib.h +#usr/include/isc/stdtime.h +#usr/include/isc/strerror.h +#usr/include/isc/string.h +#usr/include/isc/symtab.h +#usr/include/isc/syslog.h +#usr/include/isc/task.h +#usr/include/isc/taskpool.h +#usr/include/isc/thread.h +#usr/include/isc/time.h +#usr/include/isc/timer.h +#usr/include/isc/tm.h +#usr/include/isc/types.h +#usr/include/isc/util.h +#usr/include/isc/version.h +#usr/include/isc/xml.h +#usr/include/isccc +#usr/include/isccc/alist.h +#usr/include/isccc/base64.h +#usr/include/isccc/cc.h +#usr/include/isccc/ccmsg.h +#usr/include/isccc/events.h +#usr/include/isccc/lib.h +#usr/include/isccc/result.h +#usr/include/isccc/sexpr.h +#usr/include/isccc/symtab.h +#usr/include/isccc/symtype.h +#usr/include/isccc/types.h +#usr/include/isccc/util.h +#usr/include/isccc/version.h +#usr/include/isccfg +#usr/include/isccfg/aclconf.h +#usr/include/isccfg/cfg.h +#usr/include/isccfg/dnsconf.h +#usr/include/isccfg/grammar.h +#usr/include/isccfg/log.h +#usr/include/isccfg/namedconf.h +#usr/include/isccfg/version.h +#usr/include/lwres +#usr/include/lwres/context.h +#usr/include/lwres/int.h +#usr/include/lwres/ipv6.h +#usr/include/lwres/lang.h +#usr/include/lwres/list.h +#usr/include/lwres/lwbuffer.h +#usr/include/lwres/lwpacket.h +#usr/include/lwres/lwres.h +#usr/include/lwres/net.h +#usr/include/lwres/netdb.h +#usr/include/lwres/platform.h +#usr/include/lwres/result.h +#usr/include/lwres/stdlib.h +#usr/include/lwres/string.h +#usr/include/lwres/version.h +#usr/include/pk11 +#usr/include/pk11/constants.h +#usr/include/pk11/internal.h +#usr/include/pk11/pk11.h +#usr/include/pk11/result.h +#usr/include/pk11/site.h +#usr/include/pkcs11 +#usr/include/pkcs11/cryptoki.h +#usr/include/pkcs11/eddsa.h +#usr/include/pkcs11/pkcs11.h +#usr/include/pkcs11/pkcs11f.h +#usr/include/pkcs11/pkcs11t.h +#usr/lib/libbind9.la +#usr/lib/libbind9.so +usr/lib/libbind9.so.161 +usr/lib/libbind9.so.161.0.0 +#usr/lib/libdns.la +#usr/lib/libdns.so +usr/lib/libdns.so.1104 +usr/lib/libdns.so.1104.0.0 +#usr/lib/libisc.la +#usr/lib/libisc.so +usr/lib/libisc.so.1100 +usr/lib/libisc.so.1100.0.0 +#usr/lib/libisccc.la +#usr/lib/libisccc.so +usr/lib/libisccc.so.161 +usr/lib/libisccc.so.161.0.0 +#usr/lib/libisccfg.la +#usr/lib/libisccfg.so +usr/lib/libisccfg.so.163 +usr/lib/libisccfg.so.163.0.0 +#usr/lib/liblwres.la +#usr/lib/liblwres.so +usr/lib/liblwres.so.161 +usr/lib/liblwres.so.161.0.0 #usr/share/man/man1/dig.1 #usr/share/man/man1/host.1 #usr/share/man/man1/nslookup.1 #usr/share/man/man1/nsupdate.1 +#usr/share/man/man3/lwres.3 +#usr/share/man/man3/lwres_addr_parse.3 +#usr/share/man/man3/lwres_buffer.3 +#usr/share/man/man3/lwres_buffer_add.3 +#usr/share/man/man3/lwres_buffer_back.3 +#usr/share/man/man3/lwres_buffer_clear.3 +#usr/share/man/man3/lwres_buffer_first.3 +#usr/share/man/man3/lwres_buffer_forward.3 +#usr/share/man/man3/lwres_buffer_getmem.3 +#usr/share/man/man3/lwres_buffer_getuint16.3 +#usr/share/man/man3/lwres_buffer_getuint32.3 +#usr/share/man/man3/lwres_buffer_getuint8.3 +#usr/share/man/man3/lwres_buffer_init.3 +#usr/share/man/man3/lwres_buffer_invalidate.3 +#usr/share/man/man3/lwres_buffer_putmem.3 +#usr/share/man/man3/lwres_buffer_putuint16.3 +#usr/share/man/man3/lwres_buffer_putuint32.3 +#usr/share/man/man3/lwres_buffer_putuint8.3 +#usr/share/man/man3/lwres_buffer_subtract.3 +#usr/share/man/man3/lwres_conf_clear.3 +#usr/share/man/man3/lwres_conf_get.3 +#usr/share/man/man3/lwres_conf_init.3 +#usr/share/man/man3/lwres_conf_parse.3 +#usr/share/man/man3/lwres_conf_print.3 +#usr/share/man/man3/lwres_config.3 +#usr/share/man/man3/lwres_context.3 +#usr/share/man/man3/lwres_context_allocmem.3 +#usr/share/man/man3/lwres_context_create.3 +#usr/share/man/man3/lwres_context_destroy.3 +#usr/share/man/man3/lwres_context_freemem.3 +#usr/share/man/man3/lwres_context_initserial.3 +#usr/share/man/man3/lwres_context_nextserial.3 +#usr/share/man/man3/lwres_context_sendrecv.3 +#usr/share/man/man3/lwres_endhostent.3 +#usr/share/man/man3/lwres_endhostent_r.3 +#usr/share/man/man3/lwres_freeaddrinfo.3 +#usr/share/man/man3/lwres_freehostent.3 +#usr/share/man/man3/lwres_gabn.3 +#usr/share/man/man3/lwres_gabnrequest_free.3 +#usr/share/man/man3/lwres_gabnrequest_parse.3 +#usr/share/man/man3/lwres_gabnrequest_render.3 +#usr/share/man/man3/lwres_gabnresponse_free.3 +#usr/share/man/man3/lwres_gabnresponse_parse.3 +#usr/share/man/man3/lwres_gabnresponse_render.3 +#usr/share/man/man3/lwres_gai_strerror.3 +#usr/share/man/man3/lwres_getaddrinfo.3 +#usr/share/man/man3/lwres_getaddrsbyname.3 +#usr/share/man/man3/lwres_gethostbyaddr.3 +#usr/share/man/man3/lwres_gethostbyaddr_r.3 +#usr/share/man/man3/lwres_gethostbyname.3 +#usr/share/man/man3/lwres_gethostbyname2.3 +#usr/share/man/man3/lwres_gethostbyname_r.3 +#usr/share/man/man3/lwres_gethostent.3 +#usr/share/man/man3/lwres_gethostent_r.3 +#usr/share/man/man3/lwres_getipnode.3 +#usr/share/man/man3/lwres_getipnodebyaddr.3 +#usr/share/man/man3/lwres_getipnodebyname.3 +#usr/share/man/man3/lwres_getnamebyaddr.3 +#usr/share/man/man3/lwres_getnameinfo.3 +#usr/share/man/man3/lwres_getrrsetbyname.3 +#usr/share/man/man3/lwres_gnba.3 +#usr/share/man/man3/lwres_gnbarequest_free.3 +#usr/share/man/man3/lwres_gnbarequest_parse.3 +#usr/share/man/man3/lwres_gnbarequest_render.3 +#usr/share/man/man3/lwres_gnbaresponse_free.3 +#usr/share/man/man3/lwres_gnbaresponse_parse.3 +#usr/share/man/man3/lwres_gnbaresponse_render.3 +#usr/share/man/man3/lwres_herror.3 +#usr/share/man/man3/lwres_hstrerror.3 +#usr/share/man/man3/lwres_inetntop.3 +#usr/share/man/man3/lwres_lwpacket_parseheader.3 +#usr/share/man/man3/lwres_lwpacket_renderheader.3 +#usr/share/man/man3/lwres_net_ntop.3 +#usr/share/man/man3/lwres_noop.3 +#usr/share/man/man3/lwres_nooprequest_free.3 +#usr/share/man/man3/lwres_nooprequest_parse.3 +#usr/share/man/man3/lwres_nooprequest_render.3 +#usr/share/man/man3/lwres_noopresponse_free.3 +#usr/share/man/man3/lwres_noopresponse_parse.3 +#usr/share/man/man3/lwres_noopresponse_render.3 +#usr/share/man/man3/lwres_packet.3 +#usr/share/man/man3/lwres_resutil.3 +#usr/share/man/man3/lwres_sethostent.3 +#usr/share/man/man3/lwres_sethostent_r.3 +#usr/share/man/man3/lwres_string_parse.3 diff --git a/lfs/bind b/lfs/bind index d0fcfeda0..c2530b174 100644 --- a/lfs/bind +++ b/lfs/bind @@ -76,16 +76,16 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && STD_CDEFINES="$(CPPFLAGS)" \ ./configure \ --prefix=/usr \ - --disable-static \ - --disable-openssl-version-check - cd $(DIR_APP) && make -C lib/dns - cd $(DIR_APP) && make -C lib/isc - cd $(DIR_APP) && make -C lib/bind9 - cd $(DIR_APP) && make -C lib/isccfg - cd $(DIR_APP) && make -C lib/lwres - cd $(DIR_APP) && make -C bin/dig + --enable-threads \ + --with-libtool \ + --disable-static + cd $(DIR_APP) && make -C lib/isc install + cd $(DIR_APP) && make -C lib/dns install + cd $(DIR_APP) && make -C lib/isccc install + cd $(DIR_APP) && make -C lib/isccfg install + cd $(DIR_APP) && make -C lib/bind9 install + cd $(DIR_APP) && make -C lib/lwres install cd $(DIR_APP) && make -C bin/dig install - cd $(DIR_APP) && make -C bin/nsupdate cd $(DIR_APP) && make -C bin/nsupdate install install -v -m 644 $(DIR_SRC)/config/bind/trusted-key.key \ -- 2.18.0

1 0

[PATCH] squid: Update to 4.4 (stable)
by Matthias Fischer 09 Nov '18

09 Nov '18

For details see: http://www.squid-cache.org/Versions/v4/changesets/ In July 2018, 'squid 4' was "released for production use", see: https://wiki.squid-cache.org/Squid-4 "The features have been set and large code changes are reserved for later versions." I've tested almost all 4.x-versions and patch series before with good results. Right now, 4.4 is running here with no seen problems together with 'squidclamav', 'squidguard' and 'privoxy'. I too would declare this version stable. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 12 ++-- ...via_D_in_ERR_SECURE_CONNECT_FAIL_306.patch | 72 ------------------- ...ry_leak_when_parsing_SNMP_packet_313.patch | 22 ------ ... squid-4.4-fix-max-file-descriptors.patch} | 4 +- 4 files changed, 8 insertions(+), 102 deletions(-) delete mode 100644 src/patches/squid/01_Certificate_fields_injection_via_D_in_ERR_SECURE_CONNECT_FAIL_306.patch delete mode 100644 src/patches/squid/02_Fix_memory_leak_when_parsing_SNMP_packet_313.patch rename src/patches/squid/{squid-4.3-fix-max-file-descriptors.patch => squid-4.4-fix-max-file-descriptors.patch} (92%) diff --git a/lfs/squid b/lfs/squid index 11b84d719..e5e799111 100644 --- a/lfs/squid +++ b/lfs/squid @@ -24,7 +24,7 @@ include Config -VER = 3.5.28 +VER = 4.4 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 9367e0375ea53ba0e99f77054d4402c5 +$(DL_FILE)_MD5 = 892504ca9700e1f139a53f84098613bd install : $(TARGET) @@ -72,9 +72,7 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xaf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/squid/01_Certificate_fields_injection_via_D_in_ERR_SECURE_CONNECT_FAIL_306.patch - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/squid/02_Fix_memory_leak_when_parsing_SNMP_packet_313.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-3.5.28-fix-max-file-descriptors.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/squid/squid-4.4-fix-max-file-descriptors.patch cd $(DIR_APP) && autoreconf -vfi cd $(DIR_APP)/libltdl && autoreconf -vfi @@ -125,7 +123,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --enable-zph-qos \ --with-dl \ --with-filedescriptors=$$(( 16384 * 64 )) \ - --with-large-files + --with-large-files \ + --without-gnutls \ + --without-netfilter-conntrack cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/patches/squid/01_Certificate_fields_injection_via_D_in_ERR_SECURE_CONNECT_FAIL_306.patch b/src/patches/squid/01_Certificate_fields_injection_via_D_in_ERR_SECURE_CONNECT_FAIL_306.patch deleted file mode 100644 index fadb1d48c..000000000 --- a/src/patches/squid/01_Certificate_fields_injection_via_D_in_ERR_SECURE_CONNECT_FAIL_306.patch +++ /dev/null @@ -1,72 +0,0 @@ -commit f1657a9decc820f748fa3aff68168d3145258031 -Author: Christos Tsantilas <christos(a)chtsanti.net> -Date: 2018-10-17 15:14:07 +0000 - - Certificate fields injection via %D in ERR_SECURE_CONNECT_FAIL (#306) - - %ssl_subject, %ssl_ca_name, and %ssl_cn values were not properly escaped when %D code was expanded in HTML context of the ERR_SECURE_CONNECT_FAIL template. This bug affects all - ERR_SECURE_CONNECT_FAIL page templates containing %D, including the default template. - - Other error pages are not vulnerable because Squid does not populate %D with certificate details in other contexts (yet). - - Thanks to Nikolas Lohmann [eBlocker] for identifying the problem. - - TODO: If those certificate details become needed for ACL checks or other non-HTML purposes, make their HTML-escaping conditional. - - This is a Measurement Factory project. - -diff --git a/src/ssl/ErrorDetail.cc b/src/ssl/ErrorDetail.cc -index b5030e3..314e998 100644 ---- a/src/ssl/ErrorDetail.cc -+++ b/src/ssl/ErrorDetail.cc -@@ -8,6 +8,8 @@ - - #include "squid.h" - #include "errorpage.h" -+#include "fatal.h" -+#include "html_quote.h" - #include "ssl/ErrorDetail.h" - - #include <climits> -@@ -432,8 +434,11 @@ const char *Ssl::ErrorDetail::subject() const - { - if (broken_cert.get()) { - static char tmpBuffer[256]; // A temporary buffer -- if (X509_NAME_oneline(X509_get_subject_name(broken_cert.get()), tmpBuffer, sizeof(tmpBuffer))) -- return tmpBuffer; -+ if (X509_NAME_oneline(X509_get_subject_name(broken_cert.get()), tmpBuffer, sizeof(tmpBuffer))) { -+ // quote to avoid possible html code injection through -+ // certificate subject -+ return html_quote(tmpBuffer); -+ } - } - return "[Not available]"; - } -@@ -461,8 +466,11 @@ const char *Ssl::ErrorDetail::cn() const - static String tmpStr; ///< A temporary string buffer - tmpStr.clean(); - Ssl::matchX509CommonNames(broken_cert.get(), &tmpStr, copy_cn); -- if (tmpStr.size()) -- return tmpStr.termedBuf(); -+ if (tmpStr.size()) { -+ // quote to avoid possible html code injection through -+ // certificate subject -+ return html_quote(tmpStr.termedBuf()); -+ } - } - return "[Not available]"; - } -@@ -474,8 +482,11 @@ const char *Ssl::ErrorDetail::ca_name() const - { - if (broken_cert.get()) { - static char tmpBuffer[256]; // A temporary buffer -- if (X509_NAME_oneline(X509_get_issuer_name(broken_cert.get()), tmpBuffer, sizeof(tmpBuffer))) -- return tmpBuffer; -+ if (X509_NAME_oneline(X509_get_issuer_name(broken_cert.get()), tmpBuffer, sizeof(tmpBuffer))) { -+ // quote to avoid possible html code injection through -+ // certificate issuer subject -+ return html_quote(tmpBuffer); -+ } - } - return "[Not available]"; - } diff --git a/src/patches/squid/02_Fix_memory_leak_when_parsing_SNMP_packet_313.patch b/src/patches/squid/02_Fix_memory_leak_when_parsing_SNMP_packet_313.patch deleted file mode 100644 index 2ae034c20..000000000 --- a/src/patches/squid/02_Fix_memory_leak_when_parsing_SNMP_packet_313.patch +++ /dev/null @@ -1,22 +0,0 @@ -commit bc9786119f058a76ddf0625424bc33d36460b9a2 (refs/remotes/origin/v3.5) -Author: flozilla <fishyflow(a)gmail.com> -Date: 2018-10-24 14:12:01 +0200 - - Fix memory leak when parsing SNMP packet (#313) - - SNMP queries denied by snmp_access rules and queries with certain - unsupported SNMPv2 commands were leaking a few hundred bytes each. Such - queries trigger "SNMP agent query DENIED from..." WARNINGs in cache.log. - -diff --git a/src/snmp_core.cc b/src/snmp_core.cc -index c4d21c1..16c2993 100644 ---- a/src/snmp_core.cc -+++ b/src/snmp_core.cc -@@ -409,6 +409,7 @@ snmpDecodePacket(SnmpRequest * rq) - snmpConstructReponse(rq); - } else { - debugs(49, DBG_IMPORTANT, "WARNING: SNMP agent query DENIED from : " << rq->from); -+ snmp_free_pdu(PDU); - } - xfree(Community); - diff --git a/src/patches/squid/squid-4.3-fix-max-file-descriptors.patch b/src/patches/squid/squid-4.4-fix-max-file-descriptors.patch similarity index 92% rename from src/patches/squid/squid-4.3-fix-max-file-descriptors.patch rename to src/patches/squid/squid-4.4-fix-max-file-descriptors.patch index a46390c1e..8d1a4e03a 100644 --- a/src/patches/squid/squid-4.3-fix-max-file-descriptors.patch +++ b/src/patches/squid/squid-4.4-fix-max-file-descriptors.patch @@ -1,6 +1,6 @@ --- configure.ac.~ Wed Apr 20 14:26:07 2016 +++ configure.ac Fri Apr 22 17:20:46 2016 -@@ -3149,6 +3149,9 @@ +@@ -3156,6 +3156,9 @@ ;; esac @@ -10,7 +10,7 @@ dnl --with-maxfd present for compatibility with Squid-2. dnl undocumented in ./configure --help to encourage using the Squid-3 directive AC_ARG_WITH(maxfd,, -@@ -3179,8 +3182,6 @@ +@@ -3186,8 +3189,6 @@ esac ]) -- 2.18.0

2 2

New backup scripts don't work
by Matthias Fischer 08 Nov '18

08 Nov '18

Hi, I got something weird here: I just tried to test the new 'backupiso' and 'backup.pl'-scripts from next. 'backupiso' tells me that "arch is i586", but tries to download "...2.21.*i686*..."!? Hardware: Duo Box Output of 'uname -m': root@ipfire: /usr/local/bin # uname -m i686 ***SNIP*** root@ipfire: /usr/local/bin # ./backupiso /tmp/test_backup Your arch is i586 Fetching https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core124/ipfire-2.21.i… Fetching https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core124/ipfire-2.21.i… Checking md5 of ipfire-2.21.i686-full-core124.iso md5sum: ipfire-2.21.i686-full-core124.iso.md5: no properly formatted MD5 checksum lines found md5 mismatch Fetching again https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core124/ipfire-2.21.i… Checking again md5 of ipfire-2.21.i686-full-core124.iso md5sum: ipfire-2.21.i686-full-core124.iso.md5: no properly formatted MD5 checksum lines found md5 mismatch aborting backup because md5 mismatch ***SNAP*** Can anyone confirm - or tell me whats going on here? Best, Matthias

2 3

PortSmash and yesterday's discussion
by Michael Tremer 06 Nov '18

06 Nov '18

Hello, I have written a blog post about the discussion yesterday: https://blog.ipfire.org/post/more-on-intel-s-hardware-bugs Let me know if I summed it up correctly what we talked about yesterday and just for the record if you agree or disagree. Looking at the topic, I am terribly frustrated but do not have anything constructive to say... Best, -Michael

1 0

[PATCH] Tor: update to 0.3.4.9
by Peter Müller 05 Nov '18

05 Nov '18

For details and release announcement, see: https://blog.torproject.org/new-release-tor-0349 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/tor | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/tor b/lfs/tor index 5b03aba5d..2c3940638 100644 --- a/lfs/tor +++ b/lfs/tor @@ -24,7 +24,7 @@ include Config -VER = 0.3.3.9 +VER = 0.3.4.9 THISAPP = tor-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 30 +PAK_VER = 31 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 16b24bda0772dc3d5c4c05254ec4bce7 +$(DL_FILE)_MD5 = 8a303c7c2491cd27b1646f6efdc4a5d0 install : $(TARGET) -- 2.16.4

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2018