Development November 2020

development@lists.ipfire.org

20 participants
71 discussions

[PATCH] DNS: Make YouTube configurable for Safe Search
by Michael Tremer 07 Nov '20

07 Nov '20

When safe search is enabled, it is being enabled on YouTube, too. This creates problems in some scenarios like schools where politics is being tought as well as other subjects that might be censored by YouTube (i.e. election TV spots). Therefore it is now possible to exclude YouTube from Safe Search but keep it enabled for the search engines. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- doc/language_issues.en | 1 + doc/language_issues.es | 1 + doc/language_issues.fr | 1 + doc/language_issues.it | 1 + doc/language_issues.nl | 1 + doc/language_issues.pl | 1 + doc/language_issues.ru | 1 + doc/language_issues.tr | 1 + doc/language_missings | 7 ++++ html/cgi-bin/dns.cgi | 19 ++++++++++ langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + src/initscripts/system/unbound | 69 +++++++++++++++++----------------- 13 files changed, 70 insertions(+), 35 deletions(-) diff --git a/doc/language_issues.en b/doc/language_issues.en index 9efb56a39..6ee7ac034 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -601,6 +601,7 @@ WARNING: untranslated string: dns check failed = DNS check failed WARNING: untranslated string: dns check servers = Check DNS Servers WARNING: untranslated string: dns configuration = DNS Configuration WARNING: untranslated string: dns enable safe-search = Enable Safe Search +WARNING: untranslated string: dns enable safe-search youtube = Include YouTube in Safe Search WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous) WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled) WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server diff --git a/doc/language_issues.es b/doc/language_issues.es index e01f5aa98..a68e232d8 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -897,6 +897,7 @@ WARNING: untranslated string: dns = unknown string WARNING: untranslated string: dns check servers = Check DNS Servers WARNING: untranslated string: dns configuration = DNS Configuration WARNING: untranslated string: dns enable safe-search = Enable Safe Search +WARNING: untranslated string: dns enable safe-search youtube = Include YouTube in Safe Search WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous) WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled) WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server diff --git a/doc/language_issues.fr b/doc/language_issues.fr index b98154eca..60db5a967 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -879,6 +879,7 @@ WARNING: translation string unused: zoneconf val ppp assignment error WARNING: translation string unused: zoneconf val vlan amount assignment error WARNING: translation string unused: zoneconf val vlan tag assignment error WARNING: translation string unused: zoneconf val zoneslave amount error +WARNING: untranslated string: dns enable safe-search youtube = Include YouTube in Safe Search WARNING: untranslated string: fwhost cust locationgrp = unknown string WARNING: untranslated string: fwhost err hostip = unknown string WARNING: untranslated string: guardian block a host = unknown string diff --git a/doc/language_issues.it b/doc/language_issues.it index 2f41213a8..414adbb9f 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -923,6 +923,7 @@ WARNING: untranslated string: dns = unknown string WARNING: untranslated string: dns check servers = Check DNS Servers WARNING: untranslated string: dns configuration = DNS Configuration WARNING: untranslated string: dns enable safe-search = Enable Safe Search +WARNING: untranslated string: dns enable safe-search youtube = Include YouTube in Safe Search WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous) WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled) WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server diff --git a/doc/language_issues.nl b/doc/language_issues.nl index d486349bc..03ae8d242 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -923,6 +923,7 @@ WARNING: untranslated string: dns = unknown string WARNING: untranslated string: dns check servers = Check DNS Servers WARNING: untranslated string: dns configuration = DNS Configuration WARNING: untranslated string: dns enable safe-search = Enable Safe Search +WARNING: untranslated string: dns enable safe-search youtube = Include YouTube in Safe Search WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous) WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled) WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server diff --git a/doc/language_issues.pl b/doc/language_issues.pl index e01f5aa98..a68e232d8 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -897,6 +897,7 @@ WARNING: untranslated string: dns = unknown string WARNING: untranslated string: dns check servers = Check DNS Servers WARNING: untranslated string: dns configuration = DNS Configuration WARNING: untranslated string: dns enable safe-search = Enable Safe Search +WARNING: untranslated string: dns enable safe-search youtube = Include YouTube in Safe Search WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous) WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled) WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server diff --git a/doc/language_issues.ru b/doc/language_issues.ru index cc2fe7489..26595d1d9 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -901,6 +901,7 @@ WARNING: untranslated string: dns = unknown string WARNING: untranslated string: dns check servers = Check DNS Servers WARNING: untranslated string: dns configuration = DNS Configuration WARNING: untranslated string: dns enable safe-search = Enable Safe Search +WARNING: untranslated string: dns enable safe-search youtube = Include YouTube in Safe Search WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous) WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled) WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server diff --git a/doc/language_issues.tr b/doc/language_issues.tr index 99ead4c4a..3b1c99d97 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -900,6 +900,7 @@ WARNING: untranslated string: dns = unknown string WARNING: untranslated string: dns check servers = Check DNS Servers WARNING: untranslated string: dns configuration = DNS Configuration WARNING: untranslated string: dns enable safe-search = Enable Safe Search +WARNING: untranslated string: dns enable safe-search youtube = Include YouTube in Safe Search WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous) WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled) WARNING: untranslated string: dns isp assigned nameserver = ISP-assigned DNS server diff --git a/doc/language_missings b/doc/language_missings index 90f4c2926..2dfa3665f 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -239,6 +239,7 @@ < dns configuration < dns could not add server < dns enable safe-search +< dns enable safe-search youtube < dnsforward < dnsforward add a new entry < dnsforward configuration @@ -950,6 +951,7 @@ < ansi t1.483 < bewan adsl pci st < bewan adsl usb +< dns enable safe-search youtube < g.dtm < g.lite < upload fcdsl.o @@ -1052,6 +1054,7 @@ < dns configuration < dns could not add server < dns enable safe-search +< dns enable safe-search youtube < dns forward disable dnssec < dnsforward dnssec disabled < dnsforward forward_servers @@ -1431,6 +1434,7 @@ < dns configuration < dns could not add server < dns enable safe-search +< dns enable safe-search youtube < dns forward disable dnssec < dnsforward dnssec disabled < dnsforward forward_servers @@ -1923,6 +1927,7 @@ < dns configuration < dns could not add server < dns enable safe-search +< dns enable safe-search youtube < dnsforward < dnsforward add a new entry < dnsforward configuration @@ -2792,6 +2797,7 @@ < dns configuration < dns could not add server < dns enable safe-search +< dns enable safe-search youtube < dnsforward < dnsforward add a new entry < dnsforward configuration @@ -3516,6 +3522,7 @@ < dns configuration < dns could not add server < dns enable safe-search +< dns enable safe-search youtube < dns forward disable dnssec < dnsforward dnssec disabled < dnsforward forward_servers diff --git a/html/cgi-bin/dns.cgi b/html/cgi-bin/dns.cgi index 0a097e2c0..e406f2b9e 100755 --- a/html/cgi-bin/dns.cgi +++ b/html/cgi-bin/dns.cgi @@ -87,6 +87,10 @@ if ($cgiparams{'GENERAL'} eq $Lang::tr{'save'}) { $cgiparams{'ENABLE_SAFE_SEARCH'} = "off"; } + if ($cgiparams{'ENABLE_SAFE_SEARCH_YOUTUBE'} ne "on") { + $cgiparams{'ENABLE_SAFE_SEARCH_YOUTUBE'} = "off"; + } + # Check if using ISP nameservers and TLS is enabled at the same time. if (($cgiparams{'USE_ISP_NAMESERVERS'} eq "on") && ($cgiparams{'PROTO'} eq "TLS")) { $errormessage = $Lang::tr{'dns isp nameservers and tls not allowed'} @@ -259,6 +263,7 @@ if (($cgiparams{'SERVERS'} eq $Lang::tr{'save'}) || ($cgiparams{'SERVERS'} eq $L # Hash to store the generic DNS settings. my %settings = (); +$settings{"ENABLE_SAFE_SEARCH_YOUTUBE"} = "on"; # Read-in general DNS settings. &General::readhash("$settings_file", \%settings); @@ -313,6 +318,10 @@ $checked{'ENABLE_SAFE_SEARCH'}{'off'} = ''; $checked{'ENABLE_SAFE_SEARCH'}{'on'} = ''; $checked{'ENABLE_SAFE_SEARCH'}{$settings{'ENABLE_SAFE_SEARCH'}} = "checked='checked'"; +$checked{'ENABLE_SAFE_SEARCH_YOUTUBE'}{'off'} = ''; +$checked{'ENABLE_SAFE_SEARCH_YOUTUBE'}{'on'} = ''; +$checked{'ENABLE_SAFE_SEARCH_YOUTUBE'}{$settings{'ENABLE_SAFE_SEARCH_YOUTUBE'}} = "checked='checked'"; + $selected{'PROTO'}{'UDP'} = ''; $selected{'PROTO'}{'TLS'} = ''; $selected{'PROTO'}{'TCP'} = ''; @@ -384,6 +393,16 @@ sub show_general_dns_configuration () { </td> </tr> + <tr> + <td width="33%"> + » $Lang::tr{'dns enable safe-search youtube'} + </td> + + <td> + <input type="checkbox" name="ENABLE_SAFE_SEARCH_YOUTUBE" $checked{'ENABLE_SAFE_SEARCH_YOUTUBE'}{'on'}> + </td> + </tr> + <tr> <td colspan="2"> diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 6ad0e02c5..016c92be9 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -829,6 +829,7 @@ 'dns configuration' => 'DNS-Konfiguration', 'dns desc' => 'Wenn auf Schnittstelle red0 die IP-Adressinformationen über DHCP vom Provider kommen, werden automatisch die DNS-Server-Adressen des Providers gesetzt. Hier können Sie nun diese mit den eigenen DNS-Server-IP-Adressen überschreiben.', 'dns enable safe-search' => 'Safe Search via DNS aktivieren', +'dns enable safe-search youtube' => 'YouTube in Safe Search einbeziehen', 'dns error 0' => 'Die IP Adresse vom primären DNS Server ist nicht gültig, bitte überprüfen Sie Ihre Eingabe! Die eingegebene sekundären DNS Server Adresse ist jedoch gültig. ', 'dns error 01' => 'Die eingegebene IP Adresse des primären wie auch des sekundären DNS-Servers sind nicht gültig, bitte überprüfen Sie Ihre Eingaben!', 'dns error 1' => 'Die IP Adresse vom sekundären DNS Server ist nicht gültig, bitte überprüfen Sie Ihre Eingabe! Die eingegebene primäre DNS Server Adresse ist jedoch gültig.', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index d00de3d03..b190190d8 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -851,6 +851,7 @@ 'dns could not add server' => 'Could not add server - Reason:', 'dns desc' => 'If the red0 interface gets the IP address information via DHCP from the provider, the DNS server addresses will be set automatically. Now here you are able to change these DNS server IP addresses with your own ones.', 'dns enable safe-search' => 'Enable Safe Search', +'dns enable safe-search youtube' => 'Include YouTube in Safe Search', 'dns error 0' => 'The IP address of the primary DNS server is not valid, please check your entries! The entered secondary DNS server address is valid.', 'dns error 01' => 'The entered IP address of the primary and secondary DNS server are not valid, please check your entries!', 'dns error 1' => 'The IP address of the secondary DNS server is not valid, please check your entries! The entered primary DNS server address is valid.', diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index acbf6f5b5..5c5d2e3f4 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -502,45 +502,44 @@ update_safe_search() { unbound-control local_zone_remove "${domain}" done >/dev/null - # Nothing to do if safe search is not enabled - if [ "${ENABLE_SAFE_SEARCH}" != "on" ]; then - return 0 - fi - - # Bing - unbound-control bing.com transparent >/dev/null - for address in $(resolve "strict.bing.com"); do - unbound-control local_data "www.bing.com ${LOCAL_TTL} IN A ${address}" - done >/dev/null - - # DuckDuckGo - unbound-control local_zone duckduckgo.com typetransparent >/dev/null - for address in $(resolve "safe.duckduckgo.com"); do - unbound-control local_data "duckduckgo.com ${LOCAL_TTL} IN A ${address}" - done >/dev/null - - # Google - local addresses="$(resolve "forcesafesearch.google.com")" - for domain in ${google_tlds[@]}; do - unbound-control local_zone "${domain}" transparent >/dev/null - for address in ${addresses}; do - unbound-control local_data "www.${domain} ${LOCAL_TTL} IN A ${address}" + if [ "${ENABLE_SAFE_SEARCH}" = "on" ]; then + # Bing + unbound-control bing.com transparent >/dev/null + for address in $(resolve "strict.bing.com"); do + unbound-control local_data "www.bing.com ${LOCAL_TTL} IN A ${address}" done >/dev/null - done - # Yandex - for domain in yandex.com yandex.ru; do - unbound-control local_zone "${domain}" typetransparent >/dev/null - for address in $(resolve "familysearch.${domain}"); do - unbound-control local_data "${domain} ${LOCAL_TTL} IN A ${address}" + # DuckDuckGo + unbound-control local_zone duckduckgo.com typetransparent >/dev/null + for address in $(resolve "safe.duckduckgo.com"); do + unbound-control local_data "duckduckgo.com ${LOCAL_TTL} IN A ${address}" done >/dev/null - done - # YouTube - unbound-control local_zone youtube.com transparent >/dev/null - for address in $(resolve "restrictmoderate.youtube.com"); do - unbound-control local_data "www.youtube.com ${LOCAL_TTL} IN A ${address}" - done >/dev/null + # Google + local addresses="$(resolve "forcesafesearch.google.com")" + for domain in ${google_tlds[@]}; do + unbound-control local_zone "${domain}" transparent >/dev/null + for address in ${addresses}; do + unbound-control local_data "www.${domain} ${LOCAL_TTL} IN A ${address}" + done >/dev/null + done + + # Yandex + for domain in yandex.com yandex.ru; do + unbound-control local_zone "${domain}" typetransparent >/dev/null + for address in $(resolve "familysearch.${domain}"); do + unbound-control local_data "${domain} ${LOCAL_TTL} IN A ${address}" + done >/dev/null + done + + # YouTube + if [ "${ENABLE_SAFE_SEARCH_YOUTUBE}" = "on" ]; then + unbound-control local_zone youtube.com transparent >/dev/null + for address in $(resolve "restrictmoderate.youtube.com"); do + unbound-control local_data "www.youtube.com ${LOCAL_TTL} IN A ${address}" + done >/dev/null + fi + fi return 0 } -- 2.20.1

1 0

[PATCH 1/4] Tor: allow multiple countries to be selected for Exit relays
by Peter Müller 06 Nov '20

06 Nov '20

This extends the functionality of the Tor CGI in order to be able to select multiple countries for possible Exit relays, which is - in terms of anonymity - less worse than limiting all Tor circuits to a single country. For example, a user might want to avoid Exit relays in more than one country, and permit Tor to use Exit relays elesewhere, and vice versa. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- html/cgi-bin/tor.cgi | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/html/cgi-bin/tor.cgi b/html/cgi-bin/tor.cgi index 7447bd791..3db4bc22c 100644 --- a/html/cgi-bin/tor.cgi +++ b/html/cgi-bin/tor.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2013-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -319,9 +319,16 @@ END </tr> <tr> <td width='50%' colspan='2'> - <select name='TOR_EXIT_COUNTRY'> + <select name='TOR_EXIT_COUNTRY' multiple='multiple'> <option value=''>- $Lang::tr{'tor exit country any'} -</option> END + + # Convert Exit/Guard country strings into lists to make comparison easier + my @exit_countries; + if ($settings{'TOR_EXIT_COUNTRY'} ne '') { + @exit_countries = split(/\|/, $settings{'TOR_EXIT_COUNTRY'}); + } + my @country_codes = &Location::database_countries($db_handle); foreach my $country_code (@country_codes) { # Convert country code into upper case format. @@ -332,8 +339,8 @@ END print "<option value='$country_code'"; - if ($settings{'TOR_EXIT_COUNTRY'} eq $country_code) { - print " selected"; + if ($settings{'TOR_EXIT_COUNTRY'} ne '') { + print " selected" if grep /$country_code/, @exit_countries; } print ">$country_name ($country_code)</option>\n"; @@ -678,8 +685,17 @@ sub BuildConfiguration() { if ($settings{'TOR_EXIT_COUNTRY'} ne '') { $strict_nodes = 1; + my $countrylist; + + for my $singlecountry (split(/\|/, $settings{'TOR_EXIT_COUNTRY'})) { + if ($countrylist eq '') { + $countrylist = "{" . lc $singlecountry . "}"; + } else { + $countrylist = $countrylist . "," . "{" . lc $singlecountry . "}"; + } + } - print FILE "ExitNodes {$settings{'TOR_EXIT_COUNTRY'}}\n"; + print FILE "ExitNodes $countrylist\n"; } if ($settings{'TOR_USE_EXIT_NODES'} ne '') { -- 2.26.2

2 4

AW: [PATCH] First Patch from me. Hope this Ok so. Socat, filan and procan.
by smooky＠v16.de 06 Nov '20

06 Nov '20

Hey all. Does anyone happen to have an idea why the socat package offered by Pakfire does not contain any program data? It only contains the install.sh, uninstall.sh, update.sh, ROOTFILES and an empty .tar.xz archive. Seen here https://mirror1.ipfire.org/pakfire2/2.25-x86_64/paks/socat-1.7.3.4-1.ipfire. The .tar.xz archive is filled with my locally created version. best regards Marcel Follert

3 5

[PATCH] core152: Ship header.pl
by Matthias Fischer 06 Nov '20

06 Nov '20

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/core/152/filelists/files | 1 + 1 file changed, 1 insertion(+) diff --git a/config/rootfiles/core/152/filelists/files b/config/rootfiles/core/152/filelists/files index 58fb41dd3..571dd0398 100644 --- a/config/rootfiles/core/152/filelists/files +++ b/config/rootfiles/core/152/filelists/files @@ -14,4 +14,5 @@ srv/web/ipfire/cgi-bin/logs.cgi/log.dat srv/web/ipfire/cgi-bin/proxy.cgi usr/local/bin/setaliases var/ipfire/graphs.pl +var/ipfire/header.pl var/ipfire/langs -- 2.25.1

2 1

[PATCH] socat-1.7.3.4 added missing entry to make.sh
by smooky＠v16.de 05 Nov '20

05 Nov '20

Entry to make.sh for socat added. Was forgotten before and thus Pakfire distributed an empty addon. Thanks to Matthias Fischer for clarifying why the distributed addon was empty. Signed-off-by: Marcel Follert (Smooky) <smooky(a)v16.de> --- make.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/make.sh b/make.sh index 9ddfd4c07..4158a5642 100755 --- a/make.sh +++ b/make.sh @@ -1648,6 +1648,7 @@ buildipfire() { lfsmake2 libloc lfsmake2 ncdu lfsmake2 lshw + lfsmake2 socat } buildinstaller() { -- 2.28.0

1 0

[PATCH] sysctl.conf: include PID in file names of generated core dumps
by Peter Müller 03 Nov '20

03 Nov '20

This is recommended by various Linux hardening guides in order to prevent accidential overwriting of existing core dumps. While it has probably little to no relevance to the average IPFire user, enabling it won't harm and fixes a Lynis warning. :-) Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/etc/sysctl.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index be7c07c85..c9b4c092a 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -103,3 +103,6 @@ net.ipv4.tcp_fastopen = 3 # This protects against various TCP attacks, such as DoS against or injection # of arbitrary segments into prematurely closed connections. net.ipv4.tcp_rfc1337 = 1 + +# Include PID in file names of generated core dumps +kernel.core_uses_pid = 1 -- 2.26.2

1 0

[PATCH] libseccomp: update to 2.4.4
by Peter Müller 03 Nov '20

03 Nov '20

Full changelog obtained from: https://github.com/seccomp/libseccomp/releases/tag/v2.4.4 Version 2.4.4 - August 21, 2020 Update the syscall table for Linux v5.8-rc7 Fix double free when BPF generation fails Add aarch64 support for clone3, getrlimit, and setrlimit Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/packages/libseccomp | 2 +- lfs/libseccomp | 7 +++---- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/packages/libseccomp b/config/rootfiles/packages/libseccomp index 081103b21..214c14328 100644 --- a/config/rootfiles/packages/libseccomp +++ b/config/rootfiles/packages/libseccomp @@ -4,7 +4,7 @@ usr/bin/scmp_sys_resolver #usr/lib/libseccomp.la #usr/lib/libseccomp.so usr/lib/libseccomp.so.2 -usr/lib/libseccomp.so.2.4.3 +usr/lib/libseccomp.so.2.4.4 #usr/lib/pkgconfig/libseccomp.pc #usr/share/man/man1/scmp_sys_resolver.1 #usr/share/man/man3/seccomp_api_get.3 diff --git a/lfs/libseccomp b/lfs/libseccomp index 676b516e9..b04fda5de 100644 --- a/lfs/libseccomp +++ b/lfs/libseccomp @@ -24,7 +24,7 @@ include Config -VER = 2.4.3 +VER = 2.4.4 THISAPP = libseccomp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = libseccomp -PAK_VER = 3 +PAK_VER = 4 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 3a2c3b7539c1b6a933c20cd1fdcb2252 +$(DL_FILE)_MD5 = 05013a9e372f822f41ac4cb3f18703c0 install : $(TARGET) @@ -77,7 +77,6 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar vxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && ./autogen.sh cd $(DIR_APP) && ./configure \ --prefix=/usr \ --disable-static -- 2.26.2

1 0

[PATCH] curl: update to 7.73.0
by Peter Müller 03 Nov '20

03 Nov '20

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/curl | 9 ++++++++- lfs/curl | 4 ++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/curl b/config/rootfiles/common/curl index 68926a0bb..f4240065e 100644 --- a/config/rootfiles/common/curl +++ b/config/rootfiles/common/curl @@ -6,6 +6,7 @@ usr/bin/curl #usr/include/curl/easy.h #usr/include/curl/mprintf.h #usr/include/curl/multi.h +#usr/include/curl/options.h #usr/include/curl/stdcheaders.h #usr/include/curl/system.h #usr/include/curl/typecheck-gcc.h @@ -13,7 +14,7 @@ usr/bin/curl #usr/lib/libcurl.la #usr/lib/libcurl.so usr/lib/libcurl.so.4 -usr/lib/libcurl.so.4.6.0 +usr/lib/libcurl.so.4.7.0 #usr/lib/pkgconfig/libcurl.pc #usr/share/aclocal/libcurl.m4 #usr/share/man/man1/curl-config.1 @@ -31,6 +32,7 @@ usr/lib/libcurl.so.4.6.0 #usr/share/man/man3/CURLINFO_CONTENT_LENGTH_UPLOAD_T.3 #usr/share/man/man3/CURLINFO_CONTENT_TYPE.3 #usr/share/man/man3/CURLINFO_COOKIELIST.3 +#usr/share/man/man3/CURLINFO_EFFECTIVE_METHOD.3 #usr/share/man/man3/CURLINFO_EFFECTIVE_URL.3 #usr/share/man/man3/CURLINFO_FILETIME.3 #usr/share/man/man3/CURLINFO_FILETIME_T.3 @@ -53,6 +55,7 @@ usr/lib/libcurl.so.4.6.0 #usr/share/man/man3/CURLINFO_PRIVATE.3 #usr/share/man/man3/CURLINFO_PROTOCOL.3 #usr/share/man/man3/CURLINFO_PROXYAUTH_AVAIL.3 +#usr/share/man/man3/CURLINFO_PROXY_ERROR.3 #usr/share/man/man3/CURLINFO_PROXY_SSL_VERIFYRESULT.3 #usr/share/man/man3/CURLINFO_REDIRECT_COUNT.3 #usr/share/man/man3/CURLINFO_REDIRECT_TIME.3 @@ -325,6 +328,7 @@ usr/lib/libcurl.so.4.6.0 #usr/share/man/man3/CURLOPT_SSL_CIPHER_LIST.3 #usr/share/man/man3/CURLOPT_SSL_CTX_DATA.3 #usr/share/man/man3/CURLOPT_SSL_CTX_FUNCTION.3 +#usr/share/man/man3/CURLOPT_SSL_EC_CURVES.3 #usr/share/man/man3/CURLOPT_SSL_ENABLE_ALPN.3 #usr/share/man/man3/CURLOPT_SSL_ENABLE_NPN.3 #usr/share/man/man3/CURLOPT_SSL_FALSESTART.3 @@ -381,6 +385,9 @@ usr/lib/libcurl.so.4.6.0 #usr/share/man/man3/curl_easy_escape.3 #usr/share/man/man3/curl_easy_getinfo.3 #usr/share/man/man3/curl_easy_init.3 +#usr/share/man/man3/curl_easy_option_by_id.3 +#usr/share/man/man3/curl_easy_option_by_name.3 +#usr/share/man/man3/curl_easy_option_next.3 #usr/share/man/man3/curl_easy_pause.3 #usr/share/man/man3/curl_easy_perform.3 #usr/share/man/man3/curl_easy_recv.3 diff --git a/lfs/curl b/lfs/curl index 34dfe90e8..1f188fc02 100644 --- a/lfs/curl +++ b/lfs/curl @@ -24,7 +24,7 @@ include Config -VER = 7.71.1 +VER = 7.73.0 THISAPP = curl-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b54b386057846ce3edd3584b19741569 +$(DL_FILE)_MD5 = d7df02d3b78b625fee4dd765808a6eb6 install : $(TARGET) -- 2.26.2

1 0

[PATCH] lynis: update to 3.0.1
by Peter Müller 03 Nov '20

03 Nov '20

Full changelog obtained from: https://cisofy.com/changelog/lynis/#301 - Detection of Alpine Linux - Detection of CloudLinux - Detection of Kali Linux - Detection of Linux Mint - Detection of macOS Big Sur (11.0) - Detection of Pop!_OS - Detection of PHP 7.4 - Malware detection tool: Microsoft Defender ATP - New flag: --slow-warning to allow tests more time before showing a warning - Test TIME-3185 to check systemd-timesyncd synchronized time - rsh host file permissions - AUTH-9229 - Added option for LOCKED accounts and bugfix for older bash versions - BOOT-5122 - Presence check for grub.d added - CRYP-7902 - Added support for certificates in DER format - CRYP-7931 - Added data to report - CRYP-7931 - Redirect errors (e.g. when swap is not encrypted) - FILE-6430 - Don't grep nonexistant modprobe.d files - FIRE-4535 - Set initial firewall state - INSE-8312 - Corrected text on screen - KRNL-5728 - Handle zipped kernel configuration correctly - KRNL-5830 - Improved version detection for non-symlinked kernel - MALW-3280 - Extended detection of BitDefender - TIME-3104 - Find more time synchronization commands - TIME-3182 - Corrected detection of time peers - Fix: hostid generation routine would sometimes show too short IDs - Fix: language detection - Generic improvements for macOS - German translation updated - End-of-life database updated - Several minor code enhancements Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/packages/lynis | 1 + lfs/lynis | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/packages/lynis b/config/rootfiles/packages/lynis index 7df7cea2e..a7ca0e3dd 100644 --- a/config/rootfiles/packages/lynis +++ b/config/rootfiles/packages/lynis @@ -15,6 +15,7 @@ var/ipfire/lynis/db/languages/br var/ipfire/lynis/db/languages/cn var/ipfire/lynis/db/languages/da var/ipfire/lynis/db/languages/de +var/ipfire/lynis/db/languages/de-AT var/ipfire/lynis/db/languages/en var/ipfire/lynis/db/languages/en-GB var/ipfire/lynis/db/languages/en-US diff --git a/lfs/lynis b/lfs/lynis index 49360abc8..7dc807781 100644 --- a/lfs/lynis +++ b/lfs/lynis @@ -24,7 +24,7 @@ include Config -VER = 3.0.0 +VER = 3.0.1 THISAPP = lynis-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -33,7 +33,7 @@ DIR_APP = $(DIR_SRC)/lynis TARGET = $(DIR_INFO)/$(THISAPP) PROG = lynis -PAK_VER = 7 +PAK_VER = 8 DEPS = ############################################################################### @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 7f6777843fc4f30ea16e4e2bf393f797 +$(DL_FILE)_MD5 = ac984258e89b88c86e8c1c5395de8a15 install : $(TARGET) -- 2.26.2

1 0

[PATCH] tor.cgi: look up Tor relay country codes using libloc
by Peter Müller 03 Nov '20

03 Nov '20

Tor provides a function to resolve a relay's IP address into a country code by taking advantage of a (heavily outdated) GeoIP database shipped with it. We should consequently use libloc for doing this, since it can be confusing if those results differ from active connections in the connection tracking CGI (where we _use_ libloc) and such tasks are why we invented libloc in the first place. :-) Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- html/cgi-bin/tor.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/tor.cgi b/html/cgi-bin/tor.cgi index 7447bd791..14bfcfe90 100644 --- a/html/cgi-bin/tor.cgi +++ b/html/cgi-bin/tor.cgi @@ -912,7 +912,7 @@ sub TorNodeDescription() { $node->{'address'} = $3; $node->{'port'} = $4; - my $country_code = &TorGetInfo($tor, "ip-to-country/$node->{'address'}"); + my $country_code = &Location::Functions::lookup_country_code($db_handle, $node->{'address'}); $node->{'country_code'} = $country_code; # Flags -- 2.26.2

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development November 2020