Development April 2020

development@lists.ipfire.org

12 participants
133 discussions

[PATCH] hyperscan: Update to version 5.2.1
by Erik Kapfer 22 Apr '20

22 Apr '20

Several bugfixes, improvements and extra detection has been added. For the full changelog, take a look into here --> https://github.com/intel/hyperscan/blob/master/CHANGELOG.md . Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> --- config/rootfiles/common/i586/hyperscan | 4 ++-- config/rootfiles/common/x86_64/hyperscan | 4 ++-- lfs/hyperscan | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/config/rootfiles/common/i586/hyperscan b/config/rootfiles/common/i586/hyperscan index 3cec5c087..945c2b68c 100644 --- a/config/rootfiles/common/i586/hyperscan +++ b/config/rootfiles/common/i586/hyperscan @@ -5,10 +5,10 @@ #usr/include/hs/hs_runtime.h #usr/lib/libhs.so usr/lib/libhs.so.5 -usr/lib/libhs.so.5.1.1 +usr/lib/libhs.so.5.2.1 usr/lib/libhs_runtime.so usr/lib/libhs_runtime.so.5 -usr/lib/libhs_runtime.so.5.1.1 +usr/lib/libhs_runtime.so.5.2.1 #usr/lib/pkgconfig/libhs.pc #usr/share/doc/hyperscan #usr/share/doc/hyperscan/examples diff --git a/config/rootfiles/common/x86_64/hyperscan b/config/rootfiles/common/x86_64/hyperscan index 3cec5c087..945c2b68c 100644 --- a/config/rootfiles/common/x86_64/hyperscan +++ b/config/rootfiles/common/x86_64/hyperscan @@ -5,10 +5,10 @@ #usr/include/hs/hs_runtime.h #usr/lib/libhs.so usr/lib/libhs.so.5 -usr/lib/libhs.so.5.1.1 +usr/lib/libhs.so.5.2.1 usr/lib/libhs_runtime.so usr/lib/libhs_runtime.so.5 -usr/lib/libhs_runtime.so.5.1.1 +usr/lib/libhs_runtime.so.5.2.1 #usr/lib/pkgconfig/libhs.pc #usr/share/doc/hyperscan #usr/share/doc/hyperscan/examples diff --git a/lfs/hyperscan b/lfs/hyperscan index 45e57bc08..b63c6ecbe 100644 --- a/lfs/hyperscan +++ b/lfs/hyperscan @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 5.1.1 +VER = 5.2.1 THISAPP = hyperscan-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 96f9cd558132dd65ec03648aaaba2a48 +$(DL_FILE)_MD5 = e722ec217282d38b1457cc751f0a4bb6 install : $(TARGET) -- 2.20.1

2 1

[PATCH] bind: Update to 9.11.18
by Matthias Fischer 21 Apr '20

21 Apr '20

For details see: https://downloads.isc.org/isc/bind9/9.11.18/RELEASE-NOTES-bind-9.11.18.html "Security Fixes DNS rebinding protection was ineffective when BIND 9 is configured as a forwarding DNS server. Found and responsibly reported by Tobias Klein. [GL #1574] Known Issues We have received reports that in some circumstances, receipt of an IXFR can cause the processing of queries to slow significantly. Some of these were related to RPZ processing, which has been fixed in this release (see below). Others appear to occur where there are NSEC3-related changes (such as an operator changing the NSEC3 salt used in the hash calculation). These are being investigated. [GL #1685]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/bind | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/bind b/lfs/bind index 80207f4dc..1d5bca986 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.11.17 +VER = 9.11.18 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = ceab137e8e7ce3b356be95f505abf737 +$(DL_FILE)_MD5 = 83144af1532ba16e95f90b42036ef519 install : $(TARGET) -- 2.18.0

1 0

[PATCH] squid: Update to 4.11
by Matthias Fischer 21 Apr '20

21 Apr '20

For details see: http://www.squid-cache.org/Versions/v4/changesets/ Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/squid b/lfs/squid index 8553d7113..9c913b928 100644 --- a/lfs/squid +++ b/lfs/squid @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.10 +VER = 4.11 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = af7ac6e70f9bd03ae4fcec0c9b99c38a +$(DL_FILE)_MD5 = 10f34e852153a9996aa4614670e2bda1 install : $(TARGET) -- 2.18.0

1 0

[PATCH] dhcpcd: Update to 9.0.2
by Matthias Fischer 21 Apr '20

21 Apr '20

For details see: https://roy.marples.name/archives/dhcpcd-discuss/0002941.html "* Control sockets are not opened in test mode * privsep: no longer aborts if protocol not available * inet6: Don't regen temporary addresses without a state * inet6: Reduce RA log spam * dhcp6: Don't log when things consitently fail * inet6: Add temporary directive to slaac option [1] * Ensure current interface flags persist when setting a flag * DHCP via BPF is now aligned correctly * CMSG buffers are now aligned correctly * hostnames are no longer clobbered when being forced and a RA is recieved" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/dhcpcd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/dhcpcd b/lfs/dhcpcd index 0216ae2fd..bc55e9705 100644 --- a/lfs/dhcpcd +++ b/lfs/dhcpcd @@ -24,7 +24,7 @@ include Config -VER = 9.0.1 +VER = 9.0.2 THISAPP = dhcpcd-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = e893186a0c64adce6da47c33f4984951 +$(DL_FILE)_MD5 = f62118a576b01f5d0adf0c5ce617fbe7 install : $(TARGET) -- 2.18.0

1 0

[PATCH] openssl: update to 1.1.1g
by Arne Fitzenreiter 21 Apr '20

21 Apr '20

CVE-2020-1967 (OpenSSL advisory) [High severity] 21 April 2020: Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. https://www.openssl.org/news/secadv/20200421.txt Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/openssl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/openssl b/lfs/openssl index 06b999a15..8fe3c2856 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -24,7 +24,7 @@ include Config -VER = 1.1.1f +VER = 1.1.1g THISAPP = openssl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -87,7 +87,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 3f486f2f4435ef14b81814dbbc7b48bb +$(DL_FILE)_MD5 = 76766e98997660138cdaf13a187bd234 install : $(TARGET) -- 2.17.1

2 1

[PATCH] libusb: update to 1.0.23
by Peter Müller 20 Apr '20

20 Apr '20

Fixes: #11480 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/libusb | 9 +-------- lfs/libusb | 6 +++--- 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/config/rootfiles/common/libusb b/config/rootfiles/common/libusb index 5be9bdf9f..232574159 100644 --- a/config/rootfiles/common/libusb +++ b/config/rootfiles/common/libusb @@ -1,16 +1,9 @@ etc/udev/rules.d/23-usb.rules -#usr/bin/libusb-config #usr/include/libusb-1.0 #usr/include/libusb-1.0/libusb.h -#usr/include/usb.h -#usr/lib/libusb-0.1.so.4 -#usr/lib/libusb-0.1.so.4.4.4 #usr/lib/libusb-1.0.a #usr/lib/libusb-1.0.la #usr/lib/libusb-1.0.so usr/lib/libusb-1.0.so.0 -usr/lib/libusb-1.0.so.0.1.0 -#usr/lib/libusb.la -#usr/lib/libusb.so +usr/lib/libusb-1.0.so.0.2.0 #usr/lib/pkgconfig/libusb-1.0.pc -#usr/lib/pkgconfig/libusb.pc diff --git a/lfs/libusb b/lfs/libusb index a32e11a8b..fcae2a445 100644 --- a/lfs/libusb +++ b/lfs/libusb @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.0.19 +VER = 1.0.23 THISAPP = libusb-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = f9e2bb5879968467e5ca756cb4e1fa7e +$(DL_FILE)_MD5 = 1e29700f6a134766d32b36b8d1d61a95 install : $(TARGET) -- 2.16.4

2 1

[PATCH] kernel: disable CONFIG_DEBUG_LIST on i586(-pae)
by Peter Müller 20 Apr '20

20 Apr '20

Fixes: #12378 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.i586-ipfire | 2 +- config/kernel/kernel.config.i586-ipfire-pae | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 4bb39fc20..3b8998b2d 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -6588,7 +6588,7 @@ CONFIG_STACKTRACE=y # CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set # CONFIG_DEBUG_KOBJECT is not set CONFIG_DEBUG_BUGVERBOSE=y -CONFIG_DEBUG_LIST=y +# CONFIG_DEBUG_LIST is not set # CONFIG_DEBUG_PI_LIST is not set # CONFIG_DEBUG_SG is not set # CONFIG_DEBUG_NOTIFIERS is not set diff --git a/config/kernel/kernel.config.i586-ipfire-pae b/config/kernel/kernel.config.i586-ipfire-pae index 318384613..3969bc915 100644 --- a/config/kernel/kernel.config.i586-ipfire-pae +++ b/config/kernel/kernel.config.i586-ipfire-pae @@ -6594,7 +6594,7 @@ CONFIG_STACKTRACE=y # CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set # CONFIG_DEBUG_KOBJECT is not set CONFIG_DEBUG_BUGVERBOSE=y -CONFIG_DEBUG_LIST=y +# CONFIG_DEBUG_LIST is not set # CONFIG_DEBUG_PI_LIST is not set # CONFIG_DEBUG_SG is not set # CONFIG_DEBUG_NOTIFIERS is not set -- 2.16.4

2 1

[PATCH] kernel: enable CONFIG_SCHED_STACK_END_CHECK on x86_64, armv5tel and aarch64
by Peter Müller 20 Apr '20

20 Apr '20

> This option checks for a stack overrun on calls to schedule(). If the stack > end location is found to be over written always panic as the content of the > corrupted region can no longer be trusted. This is to ensure no erroneous > behaviour occurs which could result in data corruption or a sporadic crash at a > later stage once the region is examined. The runtime overhead introduced is > minimal. Fixes: #12376 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.armv5tel-ipfire-multi | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 32ad2df07..2043e044a 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -6442,7 +6442,7 @@ CONFIG_PANIC_TIMEOUT=0 CONFIG_SCHED_DEBUG=y CONFIG_SCHED_INFO=y CONFIG_SCHEDSTATS=y -# CONFIG_SCHED_STACK_END_CHECK is not set +CONFIG_SCHED_STACK_END_CHECK=y # CONFIG_DEBUG_TIMEKEEPING is not set # diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index cfa766005..dc09d33de 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -6924,7 +6924,7 @@ CONFIG_PANIC_TIMEOUT=0 CONFIG_SCHED_DEBUG=y CONFIG_SCHED_INFO=y CONFIG_SCHEDSTATS=y -# CONFIG_SCHED_STACK_END_CHECK is not set +CONFIG_SCHED_STACK_END_CHECK=y # CONFIG_DEBUG_TIMEKEEPING is not set # diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index b16d13504..c4b1a7ae3 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -6429,7 +6429,7 @@ CONFIG_PANIC_TIMEOUT=0 CONFIG_SCHED_DEBUG=y CONFIG_SCHED_INFO=y CONFIG_SCHEDSTATS=y -# CONFIG_SCHED_STACK_END_CHECK is not set +CONFIG_SCHED_STACK_END_CHECK=y # CONFIG_DEBUG_TIMEKEEPING is not set # -- 2.16.4

2 1

[PATCH] kernel: disable CONFIG_USELIB on x86_64 and i586(-pae)
by Peter Müller 20 Apr '20

20 Apr '20

> This option enables the uselib syscall a system call used in the dynamic > linker from libc5 and earlier. glibc does not use this system call. If you > intend to run programs built on libc5 or earlier you may need to enable this > syscall. Current systems running glibc can safely disable this. In my point of view, the last sentence matches our situation. Fixes: #12379 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.i586-ipfire | 2 +- config/kernel/kernel.config.i586-ipfire-pae | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 4bb39fc20..602e3ce2c 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -72,7 +72,7 @@ CONFIG_POSIX_MQUEUE=y CONFIG_POSIX_MQUEUE_SYSCTL=y CONFIG_CROSS_MEMORY_ATTACH=y CONFIG_FHANDLE=y -CONFIG_USELIB=y +# CONFIG_USELIB is not set # CONFIG_AUDIT is not set CONFIG_HAVE_ARCH_AUDITSYSCALL=y diff --git a/config/kernel/kernel.config.i586-ipfire-pae b/config/kernel/kernel.config.i586-ipfire-pae index 318384613..e18434557 100644 --- a/config/kernel/kernel.config.i586-ipfire-pae +++ b/config/kernel/kernel.config.i586-ipfire-pae @@ -72,7 +72,7 @@ CONFIG_POSIX_MQUEUE=y CONFIG_POSIX_MQUEUE_SYSCTL=y CONFIG_CROSS_MEMORY_ATTACH=y CONFIG_FHANDLE=y -CONFIG_USELIB=y +# CONFIG_USELIB is not set # CONFIG_AUDIT is not set CONFIG_HAVE_ARCH_AUDITSYSCALL=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index b16d13504..54da3aea4 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -75,7 +75,7 @@ CONFIG_POSIX_MQUEUE=y CONFIG_POSIX_MQUEUE_SYSCTL=y CONFIG_CROSS_MEMORY_ATTACH=y CONFIG_FHANDLE=y -CONFIG_USELIB=y +# CONFIG_USELIB is not set # CONFIG_AUDIT is not set CONFIG_HAVE_ARCH_AUDITSYSCALL=y -- 2.16.4

2 1

[PATCH] kernel: enable CONFIG_DEBUG_WX on aarch64
by Peter Müller 20 Apr '20

20 Apr '20

Since this is described as 'Generate a warning if any W+X mappings are found at boot.', it most likely does not break anything and can be safely enabled. Fixes: #12373 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 32ad2df07..eb914365f 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -6572,7 +6572,7 @@ CONFIG_IO_STRICT_DEVMEM=y # CONFIG_ARM64_PTDUMP_DEBUGFS is not set # CONFIG_PID_IN_CONTEXTIDR is not set # CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET is not set -# CONFIG_DEBUG_WX is not set +CONFIG_DEBUG_WX=y CONFIG_DEBUG_ALIGN_RODATA=y # CONFIG_ARM64_RELOC_TEST is not set # CONFIG_CORESIGHT is not set -- 2.16.4

2 1

← Newer
1
2
3
4
5
6
7
...
14
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2020