Development March 2021

development@lists.ipfire.org

14 participants
107 discussions

[PATCH] header.pl: Hide PPPoE menu item if RED is in IP mode
by Leo-Andres Hofmann 27 Mar '21

27 Mar '21

Fixes: #11342 Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- config/cfgroot/header.pl | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/config/cfgroot/header.pl b/config/cfgroot/header.pl index 5684c01c5..8dea804d0 100644 --- a/config/cfgroot/header.pl +++ b/config/cfgroot/header.pl @@ -170,6 +170,12 @@ sub genmenu { $menu->{'02.status'}{'subMenu'}->{'74.modem-status'}{'enabled'} = 1; } + # Disable the Dialup/PPPoE menu item when the RED interface is in IP mode + # (the "Network" module is loaded by general-functions.pl) + if(&Network::is_red_mode_ip()) { + $menu->{'01.system'}{'subMenu'}->{'20.dialup'}{'enabled'} = 0; + } + # Disbale unusable things in cloud environments if (&General::running_in_cloud()) { $menu->{'03.network'}{'subMenu'}->{'30.dhcp'}{'enabled'} = 0; -- 2.27.0.windows.1

2 1

Fwd: OpenSSL Security Advisory
by Michael Tremer 25 Mar '21

25 Mar '21

This is pretty bad, so I have merged this update into Core Update 155 as well as 156. Please everyone reinstall after the build has gone through. Best, -Michael > Begin forwarded message: > > From: OpenSSL <openssl(a)openssl.org> > Subject: OpenSSL Security Advisory > Date: 25 March 2021 at 14:03:24 GMT > To: openssl-project(a)openssl.org, OpenSSL User Support ML <openssl-users(a)openssl.org>, OpenSSL Announce ML <openssl-announce(a)openssl.org> > Reply-To: openssl-users(a)openssl.org, openssl(a)openssl.org > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > OpenSSL Security Advisory [25 March 2021] > ========================================= > > CA certificate check bypass with X509_V_FLAG_X509_STRICT (CVE-2021-3450) > ======================================================================== > > Severity: High > > The X509_V_FLAG_X509_STRICT flag enables additional security checks of the > certificates present in a certificate chain. It is not set by default. > > Starting from OpenSSL version 1.1.1h a check to disallow certificates in > the chain that have explicitly encoded elliptic curve parameters was added > as an additional strict check. > > An error in the implementation of this check meant that the result of a > previous check to confirm that certificates in the chain are valid CA > certificates was overwritten. This effectively bypasses the check > that non-CA certificates must not be able to issue other certificates. > > If a "purpose" has been configured then there is a subsequent opportunity > for checks that the certificate is a valid CA. All of the named "purpose" > values implemented in libcrypto perform this check. Therefore, where > a purpose is set the certificate chain will still be rejected even when the > strict flag has been used. A purpose is set by default in libssl client and > server certificate verification routines, but it can be overridden or > removed by an application. > > In order to be affected, an application must explicitly set the > X509_V_FLAG_X509_STRICT verification flag and either not set a purpose > for the certificate verification or, in the case of TLS client or server > applications, override the default purpose. > > OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these > versions should upgrade to OpenSSL 1.1.1k. > > OpenSSL 1.0.2 is not impacted by this issue. > > This issue was reported to OpenSSL on 18th March 2021 by Benjamin Kaduk > from Akamai and was discovered by Xiang Ding and others at Akamai. The fix was > developed by Tomáš Mráz. > > > NULL pointer deref in signature_algorithms processing (CVE-2021-3449) > ===================================================================== > > Severity: High > > An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation > ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits > the signature_algorithms extension (where it was present in the initial > ClientHello), but includes a signature_algorithms_cert extension then a NULL > pointer dereference will result, leading to a crash and a denial of service > attack. > > A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which > is the default configuration). OpenSSL TLS clients are not impacted by this > issue. > > All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions > should upgrade to OpenSSL 1.1.1k. > > OpenSSL 1.0.2 is not impacted by this issue. > > This issue was reported to OpenSSL on 17th March 2021 by Nokia. The fix was > developed by Peter Kästle and Samuel Sapalski from Nokia. > > Note > ==== > > OpenSSL 1.0.2 is out of support and no longer receiving public updates. Extended > support is available for premium support customers: > https://www.openssl.org/support/contracts.html > > OpenSSL 1.1.0 is out of support and no longer receiving updates of any kind. > The impact of these issues on OpenSSL 1.1.0 has not been analysed. > > Users of these versions should upgrade to OpenSSL 1.1.1. > > References > ========== > > URL for this Security Advisory: > https://www.openssl.org/news/secadv/20210325.txt > > Note: the online version of the advisory may be updated with additional details > over time. > > For details of OpenSSL severity classifications please see: > https://www.openssl.org/policies/secpolicy.html > -----BEGIN PGP SIGNATURE----- > > iQEzBAEBCAAdFiEEhlersmDwVrHlGQg52cTSbQ5gRJEFAmBcl6sACgkQ2cTSbQ5g > RJGvnAgAtG6I7rfokDC9E5yB26KC3k0Vasfq5iH/aZz0CNRyOokWJBUyyNIVjqr0 > 2eZP7VsQT7zRM+tgh9c8MwH3FIghtpwJRJls4qZDHKoXts7JH4Ul4NLPd546x7xA > GcKNwTD4NkZbTqtZ72NTgliInzrj0MCC8jqQrIIkcAIleGNzvZ0f64jdE+vBXoqX > M2FOhWiA/JkAKtB3W7pthIt25qkOwHbrpTy+UUp/S5QD779NJ/EOYcsOFBRfLZiP > gA6QILuW2L55lhG6Y2u+nVE3UI2hqd2hGgSAvDIPr2lVJxq0LQpgHca7Gj5bfIRo > GLDz7n0FhN6n7NBqetP+nlHmYivcSg== > =XIXK > -----END PGP SIGNATURE-----

1 0

[PATCH 0/2] Introduction to perl-libnet patch series
by Adolf Belka 25 Mar '21

25 Mar '21

This patch set is a build of the replacement of Net-SMTP-SSL by Net-SMTP which is provided by perl-libnet The dependency line in git was updated with this change of module The build of this replacement module with git had no problems but the real test will be in testing of it. I don't have a git setup in my IPFire systems so I think this is best tested by the devs who already are running with git in IPFire. It should show up quickly if this has broken the usage. If everything works well then the patch series can be implemented as it includes the removal of perl-Net-SMTP-SSL. If something has been broken then I will probably need guidance on how to fix it. This is also testing out the --compose option for the first time for myself that I saw mentioned in other communications in the list. Regards, Adolf

2 4

[PATCH] sysbench: Update to 1.0.20
by Adolf Belka 25 Mar '21

25 Mar '21

- Update from 0.4.12 to 1.0.20 - Updated rootfile - Changelog 2020-04-24 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.20 * build/CI/packaging: Add arm64 to Travis CI matrix (#358) * build/CI/packaging: add Ubuntu Focal * build/CI/packaging: remove Fedora Rawhide from CI matrix * build/CI/packaging: fix regression tests to work with MySQL 8.0.19+ * build/CI/packaging: fix macOS builds in Travis * build/CI/packaging: remove Ubuntu Disco (EOL) 2019-12-08 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.19 * build/CI/packaging: fix Ubuntu packaging for Bionic and later versions * regression tests: compatibility fix for PostgreSQL 12 * build/CI/packaging: fix macOs builds in Travis * build/CI/packaging: add Fedora 31. 2019-10-21 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.18 * build/CI/packaging: add Ubuntu Eoan. * build/CI/packaging: remove Ubuntu Cosmic (EOL). * build/CI/packaging: add CentOS 8. * build/CI/packaging: add Ubuntu Disco. * build/CI/packaging: remove Ubuntu Trusty (EOL). * build/CI/packaging: remove Fedora 28 (EOL). * build/CI/packaging: add Fedora 30. * build/CI/packaging: cherry-pick fix for LuaJIT/LuaJIT#484 to fix builds on macOS Mojave. * build/CI/packaging: add Debian Buster 2019-03-15 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.17 * build/CI/packaging: update RPM spec to support RHEL8-beta (thanks to Alexey Bychko for the patch) * regression tests: remove unnecessary error leading to opt_rate.t instability. * --rate mode: return a non-zero exit code on event queue overflow. * --rate mode: fix a bogus error about eventgen thread termination 2018-12-16 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.16 * build/CI/packaging: add Ubuntu Cosmic. * build/CI/packaging: add Fedora 29. * build/CI/packaging: remove Fedora 27 (EOL). * SQL API: fix GH-282 (Mysql's fetch_row() is broken) * --rate mode: fix latency stats skew on low rates * Lua: Add /usr/share/lua/5.1 to LUA_PATH and /usr/lib/lua/5.1 to LUA_CPATH. * build/CI/packaging: add -Wvla to default compiler flags. * build/CI/packaging: fix debian/changelog format * build/CI/packaging: fix buildpack.sh to not push multiple file types to packagecloud. * build/CI/packaging: add libaio-dev to Debian/Ubuntu build dependencies. 2018-07-03 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.15 * CI/build/packaging: add Fedora 28 * CI/build/packaging: add Ubuntu Bionic * CI/build/packaging: remove Fedora 26 (EOL) * CI/build/packaging: remove Debian Wheezy (EOL) * fileio: fix GH-229 (--file-fsync-freq=0 seems to prevent fsync() at the end of the test) * command line: improve parsing of boolean command line options * tests: fix GH-220 (Testsuite api_sql_mysql.t failed ...) * tests: fix GH-223 (test failure on ppc64) * tests: fix opt_help.t to pass when the binary is not configured with MySQL support * MySQL driver: use it by default in DB benchmarks 2018-04-01 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.14 * reports: fix JSON stats reporter to produce valid JSON (GH-195) * Lua SQL API: don't crash when query_row() is called with a SELECT returning empty result set * Lua SQL API: don't crash when bulk insert API calls are used out of order * regression tests: make PostgreSQL tests compatible with the new dump format introduced in 10.3 * regression tests: minor stability and coverage improvements 2018-02-17 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.13 * remove Ubuntu Zesty from CI/build/packaging matrices (EOL) * minor cleanups in build scripts * improve report formatting for long latency values * fileio: --file-extra-flags now accepts a list of flags rather than just a single value * OLTP: re-prepare prepared statements after reconnects, i.e. in cases when a server connection is lost and sysbench is configured to ignore such errors 2018-01-17 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.12 * improve --rate mode precision for high argument values * add Fedora Rawhide and Debian Sid to CI matrix * fix compile-time architecture detection for some Broadwell CPUs which were incorrectly identified as Core 2. * remove build dependency on xxd (and vim-minimal package) * fix Lua API to correctly stop the benchmark when event() returns a value other than nil or false (thanks to caojiafeng for the patch) * fix the fileio benchmark when the specified file size is not a multiple of block size * fix the fileio benchmark to throw a descriptive error when the specified file size does not match the size of files created by 'prepare' * remove Fedora 25 from CI/build/packaging matrices (EOL) * minor improvements in tests and documentation. 2017-12-09 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.11 * add Debian Stretch to CI/build/packaging matrices * add Fedora 27 to CI/build/packaging matrices * make statistic counters usable from Lua scripts * fix the PostgreSQL driver to be compatible with CockroachDB (GH-180) * fix oltp_insert.lua to work correctly when both --tables and --threads are greater than 1 (GH-178) * fix FreeBSD builds by adding -rdynamic to the default linker flags (GH-174) * minor documentation updates 2017-10-25 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.10 * fixed PK conflicts in oltp_insert.lua by creating empty tables on 'prepare' * made sysbench.opt available to init()/done() by exporting it to the global Lua state * added Fedora 26 (both x86_64 and AArch64) to the list of supported and tested distributions * fixed GH-172: sysbench 1.0.9 doesn't build with mariadb 10.2.8 * add the /usr/local LuaRocks root directory to default LUA_PATH and LUA_CPATH * removed Fedora 24, Ubuntu Precise, Yakkety from default build matrices * added Ubuntu Artful to default build matrices 2017-09-05 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.9 * fixed oltp_delete.lua to not use INSERT statements for consistency with other oltp_* benchmarks (GH-168) * added a workaround for MySQL bug #87337 "8.0.2 reintroduces my_bool to client API" * fixed building on on Debian GNU/kFreeBSD (GH-161) * fixed building against MariaDB 10.2 (thanks to Xavier Bachelot for the patch, GH-160) 2017-07-04 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.8 * fixed api_report test for slow machines (thanks to @jcfp) * fileio: suggest to run prepare step on missing files (thanks to Heinrich Schuchardt) * JSON reports: removed an erroneous trailing comma (GH-139) * added events per second to the CPU benchmark report (GH-140) * fixed db_connect() in legacy SQL API to use the default value for --db-driver (GH-146) * removed busy-wait in the bounded event generation mode (--rate) to avoid CPU hogging 2017-05-15 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.7 * Ubuntu Zesty added to package build matrix * fixed GH-130: Mutex Benchmark Documentation * fixed latency reports in the --rate mode * fixed compiler warnings when building against MySQL 8.0 client libraries 2017-04-13 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.6 * no functional changes * many build- and packaging-related improvements * Linux packages are now automatically built using Travis CI and packpack, hosted by packagecloud.io 2017-04-02 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.5 * various build-related documentation updates * benchmark can now be specified by a module name on the command line * memory benchmark: performance and scalability improvements * fix ARMv6 builds with system ConcurrencyKit * fix GH-123: Table already exists error on prepare * fix GH-121: make buildhost cpudetection optional 2017-03-13 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.4 * fixed a number of compilation errors and warnings that were specific to 32-bit platforms * bundle cram (regression tests framework) and use it by default in 'make test' * bundled ConcurrencyKit updated to 0.6.0 2017-02-26 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.3 * LuaJIT scalability improvements for non-x86 architectures * performance optimizations in oltp_read_write.lua to avoid Lua string management * fixed Illumos builds (thanks to Dillon Amburgey) 2017-02-17 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.2 * improved scalability for --report-checkpoints mode * fix builds on CentoOS 6 and autoconf 2.63 * support for Snap (http://snapcraft.io) packages 2017-02-05 Alexey Kopytov <akopytov(a)gmail.com> * version 1.0.1 * fix clock_gettime runtime failure built with macOS 10.11 and Xcode 8.x 2017-02-04 Aleksei Kopytov <akopytov(a)gmail.com> * version 1.0.0 * too much time and too many changes since the previous formal release, so briefly: * Lua scripts instead of hard-coded C tests for database ("oltp") benchmarks + ability to create custom workloads * much better single-threaded performance * much better scalability * improvements and cleanups in command line syntax and options * latency histograms in cumulative statistic reports * report hooks to print statistics in custom formats (CSV/JSON/XML/etc.) * Dropped Windows support * Dropped support for Oracle, Drizzle and libattachsql drivers Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/packages/sysbench | 87 ++++++++++++++++++++++++++++++ lfs/sysbench | 6 +-- 2 files changed, 90 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/packages/sysbench b/config/rootfiles/packages/sysbench index 31642561b..d38ecba1f 100644 --- a/config/rootfiles/packages/sysbench +++ b/config/rootfiles/packages/sysbench @@ -1 +1,88 @@ usr/bin/sysbench +#usr/share/sysbench +usr/share/sysbench/bulk_insert.lua +usr/share/sysbench/oltp_common.lua +usr/share/sysbench/oltp_delete.lua +usr/share/sysbench/oltp_insert.lua +usr/share/sysbench/oltp_point_select.lua +usr/share/sysbench/oltp_read_only.lua +usr/share/sysbench/oltp_read_write.lua +usr/share/sysbench/oltp_update_index.lua +usr/share/sysbench/oltp_update_non_index.lua +usr/share/sysbench/oltp_write_only.lua +usr/share/sysbench/select_random_points.lua +usr/share/sysbench/select_random_ranges.lua +#usr/share/sysbench/tests +#usr/share/sysbench/tests/include +usr/share/sysbench/tests/include/api_sql_common.sh +usr/share/sysbench/tests/include/config.sh +usr/share/sysbench/tests/include/drv_common.sh +usr/share/sysbench/tests/include/inspect.lua +usr/share/sysbench/tests/include/mysql_common.sh +#usr/share/sysbench/tests/include/oltp_legacy +usr/share/sysbench/tests/include/oltp_legacy/bulk_insert.lua +usr/share/sysbench/tests/include/oltp_legacy/common.lua +usr/share/sysbench/tests/include/oltp_legacy/delete.lua +usr/share/sysbench/tests/include/oltp_legacy/insert.lua +usr/share/sysbench/tests/include/oltp_legacy/oltp.lua +usr/share/sysbench/tests/include/oltp_legacy/oltp_simple.lua +usr/share/sysbench/tests/include/oltp_legacy/parallel_prepare.lua +usr/share/sysbench/tests/include/oltp_legacy/select.lua +usr/share/sysbench/tests/include/oltp_legacy/select_random_points.lua +usr/share/sysbench/tests/include/oltp_legacy/select_random_ranges.lua +usr/share/sysbench/tests/include/oltp_legacy/update_index.lua +usr/share/sysbench/tests/include/oltp_legacy/update_non_index.lua +usr/share/sysbench/tests/include/pgsql_common.sh +usr/share/sysbench/tests/include/script_bulk_insert_common.sh +usr/share/sysbench/tests/include/script_oltp_common.sh +usr/share/sysbench/tests/include/script_oltp_legacy_common.sh +usr/share/sysbench/tests/include/script_select_random_common.sh +usr/share/sysbench/tests/include/script_select_random_legacy_common.sh +#usr/share/sysbench/tests/t +usr/share/sysbench/tests/t/1st.t +usr/share/sysbench/tests/t/api_basic.t +usr/share/sysbench/tests/t/api_histogram.t +usr/share/sysbench/tests/t/api_legacy_basic.t +usr/share/sysbench/tests/t/api_legacy_rand.t +usr/share/sysbench/tests/t/api_legacy_sql.t +usr/share/sysbench/tests/t/api_rand.t +usr/share/sysbench/tests/t/api_reports.t +usr/share/sysbench/tests/t/api_sql_mysql.t +usr/share/sysbench/tests/t/api_sql_pgsql.t +usr/share/sysbench/tests/t/cmd_cleanup.t +usr/share/sysbench/tests/t/cmd_help.t +usr/share/sysbench/tests/t/cmd_prepare.t +usr/share/sysbench/tests/t/cmd_run.t +usr/share/sysbench/tests/t/cmdline.t +usr/share/sysbench/tests/t/commands.t +usr/share/sysbench/tests/t/drivers.t +usr/share/sysbench/tests/t/drv_mysql.t +usr/share/sysbench/tests/t/drv_pgsql.t +usr/share/sysbench/tests/t/help_drv_mysql.t +usr/share/sysbench/tests/t/help_drv_pgsql.t +usr/share/sysbench/tests/t/opt_help.t +usr/share/sysbench/tests/t/opt_histogram.t +usr/share/sysbench/tests/t/opt_rate.t +usr/share/sysbench/tests/t/opt_report_checkpoints.t +usr/share/sysbench/tests/t/opt_report_interval.t +usr/share/sysbench/tests/t/opt_version.t +usr/share/sysbench/tests/t/script_bulk_insert_mysql.t +usr/share/sysbench/tests/t/script_bulk_insert_pgsql.t +usr/share/sysbench/tests/t/script_oltp_delete_mysql.t +usr/share/sysbench/tests/t/script_oltp_delete_pgsql.t +usr/share/sysbench/tests/t/script_oltp_help.t +usr/share/sysbench/tests/t/script_oltp_insert_mysql.t +usr/share/sysbench/tests/t/script_oltp_insert_pgsql.t +usr/share/sysbench/tests/t/script_oltp_point_select_mysql.t +usr/share/sysbench/tests/t/script_oltp_point_select_pgsql.t +usr/share/sysbench/tests/t/script_oltp_read_write_mysql.t +usr/share/sysbench/tests/t/script_oltp_read_write_pgsql.t +usr/share/sysbench/tests/t/script_select_random_mysql.t +usr/share/sysbench/tests/t/script_select_random_pgsql.t +usr/share/sysbench/tests/t/test_cpu.t +usr/share/sysbench/tests/t/test_fileio.t +usr/share/sysbench/tests/t/test_memory.t +usr/share/sysbench/tests/t/test_mutex.t +usr/share/sysbench/tests/t/test_threads.t +usr/share/sysbench/tests/t/tests.t +usr/share/sysbench/tests/test_run.sh diff --git a/lfs/sysbench b/lfs/sysbench index 557c00ee3..ff9478d28 100644 --- a/lfs/sysbench +++ b/lfs/sysbench @@ -9,7 +9,7 @@ include Config -VER = 0.4.12 +VER = 1.0.20 THISAPP = sysbench-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -17,7 +17,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = sysbench -PAK_VER = 1 +PAK_VER = 2 DEPS = @@ -29,7 +29,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 3a6d54fdd3fe002328e4458206392b9d +$(DL_FILE)_MD5 = 756381c6fc4e16af1e0831b5e6a3dcb3 install : $(TARGET) -- 2.31.0

2 1

[PATCH 1/2] network-functions.pl: Add MAC address compare function
by Leo-Andres Hofmann 24 Mar '21

24 Mar '21

Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- config/cfgroot/network-functions.pl | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/config/cfgroot/network-functions.pl b/config/cfgroot/network-functions.pl index e94404f05..9908ee8ab 100644 --- a/config/cfgroot/network-functions.pl +++ b/config/cfgroot/network-functions.pl @@ -431,6 +431,18 @@ sub valid_mac($) { return $mac =~ /^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$/; } +# Compares two MAC addresses and returns true if they are equal +sub is_mac_equal { + my $mac_1 = uc shift; # convert to upper case + my $mac_2 = uc shift; + + if(valid_mac($mac_1) && valid_mac($mac_2) && ($mac_1 eq $mac_2)) { + return 1; + } + + return 0; +} + sub random_mac { my $address = "02"; -- 2.27.0.windows.1

1 1

[PATCH] BUG12479: Copied NAT rule in Firewall displays incorrect source Port
by Alexander Marx 22 Mar '21

22 Mar '21

Fixes: #12479 When copying a NAT rule in the firewall the existing sourceport is copied, too. This Fix deletes the sourceport from a copied NAT rule. After Saving, the correct port is used. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> --- html/cgi-bin/firewall.cgi | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 1483e779f..532f99f91 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -1552,6 +1552,11 @@ sub newrule $fwdfwsettings{'USE_NAT'} = $hash{$key}[28]; $fwdfwsettings{'nat'} = $hash{$key}[31]; #changed order $fwdfwsettings{$fwdfwsettings{'nat'}} = $hash{$key}[29]; + #Fix BUG 12479 + #When copying a DNAT Rule, the sourceport has to be empty at this point. + if($hash{$key}[14] eq 'cust_srv' and $hash{$key}[31] eq 'dnat'){ + $hash{$key}[30] = ''; + } $fwdfwsettings{'dnatport'} = $hash{$key}[30]; $fwdfwsettings{'LIMIT_CON_CON'} = $hash{$key}[32]; $fwdfwsettings{'concon'} = $hash{$key}[33]; -- 2.25.1

2 1

[PATCH] bind: Update to 9.11.29
by Matthias Fischer 22 Mar '21

22 Mar '21

For details see: https://downloads.isc.org/isc/bind9/9.11.29/RELEASE-NOTES-bind-9.11.29.html "Bug Fixes An invalid direction field (not one of N, S, E, W) in a LOC record resulted in an INSIST failure when a zone file containing such a record was loaded. [GL #2499]" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/bind | 2 +- lfs/bind | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index c3235bb8f..7e1ecd48f 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -273,7 +273,7 @@ usr/lib/libbind9.so.161.0.4 #usr/lib/libdns.la #usr/lib/libdns.so usr/lib/libdns.so.1113 -usr/lib/libdns.so.1113.0.1 +usr/lib/libdns.so.1113.0.2 #usr/lib/libisc.la #usr/lib/libisc.so usr/lib/libisc.so.1107 diff --git a/lfs/bind b/lfs/bind index 592d61ed2..c0c7c5ebf 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.11.28 +VER = 9.11.29 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 59aa4d7be438b2c8103811d18f318c82 +$(DL_FILE)_MD5 = 439d5491dfea08be032a1f9ca5a54faa install : $(TARGET) -- 2.18.0

2 1

[PATCH] zoneconf.cgi: Fix VLAN tag range check
by Leo-Andres Hofmann 22 Mar '21

22 Mar '21

Use the correct VLAN tag range 1-4094 and add an error message to the range check. The missing error message was discovered by Jonatan. Signed-off-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> --- doc/language_missings | 7 +++++++ html/cgi-bin/zoneconf.cgi | 11 +++++------ langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + 4 files changed, 14 insertions(+), 6 deletions(-) diff --git a/doc/language_missings b/doc/language_missings index 3cd277726..4b5a90c67 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -912,6 +912,7 @@ < zoneconf val stp zone mode error < zoneconf val vlan amount assignment error < zoneconf val vlan tag assignment error +< zoneconf val vlan tag range error < zoneconf val zoneslave amount error ############################################################################ # Checking cgi-bin translations for language: fr # @@ -933,6 +934,7 @@ < zoneconf stp priority < zoneconf val stp priority range error < zoneconf val stp zone mode error +< zoneconf val vlan tag range error ############################################################################ # Checking cgi-bin translations for language: it # ############################################################################ @@ -1322,6 +1324,7 @@ < zoneconf val stp zone mode error < zoneconf val vlan amount assignment error < zoneconf val vlan tag assignment error +< zoneconf val vlan tag range error < zoneconf val zoneslave amount error ############################################################################ # Checking cgi-bin translations for language: nl # @@ -1766,6 +1769,7 @@ < zoneconf val stp zone mode error < zoneconf val vlan amount assignment error < zoneconf val vlan tag assignment error +< zoneconf val vlan tag range error < zoneconf val zoneslave amount error ############################################################################ # Checking cgi-bin translations for language: pl # @@ -2652,6 +2656,7 @@ < zoneconf val stp zone mode error < zoneconf val vlan amount assignment error < zoneconf val vlan tag assignment error +< zoneconf val vlan tag range error < zoneconf val zoneslave amount error ############################################################################ # Checking cgi-bin translations for language: ru # @@ -3545,6 +3550,7 @@ < zoneconf val stp zone mode error < zoneconf val vlan amount assignment error < zoneconf val vlan tag assignment error +< zoneconf val vlan tag range error < zoneconf val zoneslave amount error ############################################################################ # Checking cgi-bin translations for language: tr # @@ -3741,4 +3747,5 @@ < zoneconf val stp zone mode error < zoneconf val vlan amount assignment error < zoneconf val vlan tag assignment error +< zoneconf val vlan tag range error < zoneconf val zoneslave amount error diff --git a/html/cgi-bin/zoneconf.cgi b/html/cgi-bin/zoneconf.cgi index b90ea8a41..c0d44764f 100644 --- a/html/cgi-bin/zoneconf.cgi +++ b/html/cgi-bin/zoneconf.cgi @@ -279,11 +279,10 @@ if ($cgiparams{"ACTION"} eq $Lang::tr{"save"}) { } $VALIDATE_nic_check{"VLAN $mac $vlan_tag"} = 1; - - if (! looks_like_number($vlan_tag)) { - last; - } - if ($vlan_tag < 1 || $vlan_tag > 4095) { + + # check VLAN tag range: 1..4094 (0, 4095 are reserved) + unless (looks_like_number($vlan_tag) && ($vlan_tag >= 1) && ($vlan_tag <= 4094)) { + $VALIDATE_error = $Lang::tr{"zoneconf val vlan tag range error"}; last; } @@ -486,7 +485,7 @@ END <option value="NATIVE" $access_selected{"NATIVE"}>$Lang::tr{"zoneconf access native"}</option> <option value="VLAN" $access_selected{"VLAN"} $vlan_disabled>$Lang::tr{"zoneconf access vlan"}</option> </select> - <input type="number" class="vlanid" id="TAG-$uc-$mac" name="TAG $uc $mac" min="1" max="4095" value="$zone_vlan_id" required $field_disabled> + <input type="number" class="vlanid" id="TAG-$uc-$mac" name="TAG $uc $mac" min="1" max="4094" value="$zone_vlan_id" required $field_disabled> </td> END ; diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 6a8133807..191c778d2 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -2988,6 +2988,7 @@ 'zoneconf val stp zone mode error' => 'STP kann nur aktiviert werden, wenn sich die Zone im Brückenmodus befindet', 'zoneconf val vlan amount assignment error' => 'Pro Zone kann nur ein VLAN verwendet werden.', 'zoneconf val vlan tag assignment error' => 'Pro Netzwerkkarte kann derselbe VLAN-Tag nur einmal verwendet werden.', +'zoneconf val vlan tag range error' => 'VLAN-Tag muss im Bereich 1-4094 liegen.', 'zoneconf val zoneslave amount error' => 'Wenn eine Zone nicht im Brückenmodus ist, kann ihr nur eine Netzwerkkarte zugewiesen werden.', ); diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 8f7e0c2cf..1d059aac8 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -3037,6 +3037,7 @@ 'zoneconf val stp zone mode error' => 'STP can only be enabled if the zone is in bridge mode', 'zoneconf val vlan amount assignment error' => 'A zone cannot have more than one VLAN assigned.', 'zoneconf val vlan tag assignment error' => 'You cannot use the same VLAN tag more than once per NIC.', +'zoneconf val vlan tag range error' => 'VLAN tag must be in the range of 1-4094.', 'zoneconf val zoneslave amount error' => 'A zone that is not in bridge mode can\'t have more than one NIC assigned', ); -- 2.27.0.windows.1

2 1

[PATCH] sysvinit: Update to 2.99
by Adolf Belka 22 Mar '21

22 Mar '21

- Update from 2.98 to 2.99 - Update to rootfile not required - Changelog sysvinit (2.99) released; urgency=low * Fixed typos and missing underlines in shutdown manual page. Corrections provided by Helge Kreutzmann. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/sysvinit | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/sysvinit b/lfs/sysvinit index e7b715ea4..7bf631a05 100644 --- a/lfs/sysvinit +++ b/lfs/sysvinit @@ -24,7 +24,7 @@ include Config -VER = 2.98 +VER = 2.99 THISAPP = sysvinit-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = e3254f7622ea5cf2322b1b386a98ba59 +$(DL_FILE)_MD5 = 6abc0ea61b8dd4a41b4e931a43b1bb90 install : $(TARGET) -- 2.31.0

2 1

[PATCH 2/3] perl-MIME-Base64: Update to 3.16
by Adolf Belka 22 Mar '21

22 Mar '21

- Update from 3.15 to 3.16 - No update of rootfile required - This a dependency to the git addon package - Changelog 2020-09-26 - Convert the build to Dist::Zilla to ensure we're releasing well built packages - Ensure all tests are using strict and warnings (thanks, Nicolas R). - Cleanup this change log - Add a .mailmap to cleanup our contributors list - Use `our` instead of `use vars` - Bump the required Perl version to v5.6.2 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/perl-MIME-Base64 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/perl-MIME-Base64 b/lfs/perl-MIME-Base64 index 00623560e..584b0b41f 100644 --- a/lfs/perl-MIME-Base64 +++ b/lfs/perl-MIME-Base64 @@ -24,7 +24,7 @@ include Config -VER = 3.15 +VER = 3.16 THISAPP = MIME-Base64-$(VER) DL_FILE = ${THISAPP}.tar.gz @@ -33,7 +33,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = perl-MIME-Base64 DEPS = -PAK_VER = 2 +PAK_VER = 3 ############################################################################### # Top-level Rules @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = ef958dc2bf96be5f759391c6ac1debd4 +$(DL_FILE)_MD5 = 58a62a2ddd42999d8446d93c8badc8a2 install : $(TARGET) -- 2.31.0

1 0

← Newer
1
2
3
4
5
6
7
8
...
11
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2021